keri-ts 2.2.2 → 2.2.4

package/esm/keri/npm/src/app/bootstrap/authenticating.js

@@ -1,6 +1,6 @@
 import { call, scoped } from "effection";
 import { persistResolvedContact } from "../identity/organizing.js";
-import { doEvery, PROTOCOL_PACING } from "../runtime/doing.js";
+import { doEveryOnWrite, PROTOCOL_PACING } from "../runtime/doing.js";
 import { systemClock } from "../runtime/runtime-clock.js";
 import { isWellKnownOobiUrl, parseOobiUrl } from "./oobiery.js";
 /**
@@ -70,7 +70,7 @@ export class Authenticator {
     }
     /** Continuous auth doer for long-lived runtime hosts. */
     *authDo(clock = systemClock, pacing = PROTOCOL_PACING) {
-        return yield* doEvery(clock, pacing.tockMs, () => this.processOnce());
+        return yield* doEveryOnWrite(clock, pacing, this.hby.db, () => this.processOnce());
     }
     /** Promote one eligible `woobi.` record into the fetchable `mfa.` queue. */
     promoteQueuedWellKnown() {

package/esm/keri/npm/src/app/bootstrap/oobiery.js

@@ -8,7 +8,7 @@ import { acceptReplyDecision, unverifiedReplyDecision } from "../../core/routing
 import { Schemer } from "../../core/scheming.js";
 import { persistResolvedContact } from "../identity/organizing.js";
 import { abortable } from "../runtime/abortable.js";
-import { doEvery, PROTOCOL_PACING } from "../runtime/doing.js";
+import { doEveryOnWrite, PROTOCOL_PACING } from "../runtime/doing.js";
 import { systemClock } from "../runtime/runtime-clock.js";
 import { collectBytes } from "../transport/byte-source.js";
 import { processMessages } from "../transport/message-source.js";
@@ -207,7 +207,7 @@ export class Oobiery {
      * doer rather than root-owned queue plumbing.
      */
     *oobiDo(clock = systemClock, pacing = PROTOCOL_PACING) {
-        return yield* doEvery(clock, pacing.tockMs, () => this.processOnce());
+        return yield* doEveryOnWrite(clock, pacing, this.hby.db, () => this.processOnce());
     }
     /** Select queued work, including a surviving in-flight row whose former process is gone. */
     nextQueued() {

package/esm/keri/npm/src/app/delivery/forwarding.js

@@ -9,7 +9,9 @@ import { mailboxTopicKey, preferredUrl } from "../mailbox/mailboxing.js";
 import { transportMailboxTopic } from "../mailbox/topic-routing.js";
 import { localGroupMember } from "../multisig/group-members.js";
 import { abortable } from "../runtime/abortable.js";
+import { PROTOCOL_TOCK_MS } from "../runtime/doing.js";
 import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { waitOnClock } from "../runtime/workflow-contract.js";
 import { CesrHttpRefusal } from "../transport/cesr-egress.js";
 import { messengerFrom, streamMessengerFrom } from "../transport/messengering.js";
 import { requireTcpDialer } from "../transport/tcp-dialer.js";
@@ -283,11 +285,16 @@ export class Poster {
         }
         return found;
     }
-    /** Run queued delivery independently of query response intake and producer lifetimes. */
-    *deliverDo() {
+    /**
+     * Run queued delivery independently of query response intake and producer lifetimes, as a fixed-tock doer:
+     * a pass only when something is queued (an emptiness check, no store read), then one tock. A message queued
+     * between tocks waits at most `tockMs` before its delivery starts.
+     */
+    *deliverDo(tockMs = PROTOCOL_TOCK_MS) {
         while (!this.closed) {
-            yield* this.process();
-            yield* runtimeTurn();
+            if (!this.evts.empty)
+                yield* this.process();
+            yield* waitOnClock(this.clock, tockMs);
         }
     }
     /** Runnable and active work determine convergence; consumable observations do not. */

package/esm/keri/npm/src/app/identity/delegating.js

@@ -18,6 +18,7 @@ import { DELEGATE_MAILBOX_TOPIC, REPLAY_MAILBOX_TOPIC } from "../../core/mailbox
 import { Schemes } from "../../core/schemes.js";
 import { dgKey } from "../../db/core/keys.js";
 import { createExchangeMessage } from "../exchanges/exchange-messaging.js";
+import { isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
 import { sendWitnessMessage } from "../witness/receipt-client.js";
 import { eventPayloadMessage, eventReplayMessage } from "./habbing.js";
 export const DELEGATE_REQUEST_ROUTE = "/delegate/request";
@@ -63,10 +64,6 @@ function localHabByPre(hby, pre, context) {
     }
     return hab;
 }
-function localGroupMember(hby, groupPre) {
-    const record = hby.db.getHab(groupPre);
-    return record?.mid ? hby.habs.get(record.mid) ?? null : null;
-}
 function workflowSaid(serder) {
     if (!serder.said) {
         throw new ValidationError("Delegated workflow event is missing a SAID.");
@@ -720,7 +717,7 @@ export class Anchorer {
         if (pinned) {
             return localHabByPre(this.hby, pinned, `Delegation workflow ${workflowId(serder)}`);
         }
-        return localGroupMember(this.hby, hab.pre) ?? this.communicationHab(serder, hab);
+        return isLocalGroupHab(this.hby, hab) ? localGroupMember(this.hby, hab.pre) : this.communicationHab(serder, hab);
     }
     /**
      * Send the delegation chain before the approving event, awaiting actual Poster or witness transmission outcomes.

package/esm/keri/npm/src/app/identity/habbing.js

@@ -30,7 +30,7 @@ import { Keeper, PreSit } from "../../db/keeping.js";
 import { makeNowIso8601 } from "../../time/mod.js";
 import { oobiReplyMessages } from "../bootstrap/oobi-replies.js";
 import { loadStoredReply } from "../delivery/stored-replies.js";
-import { acceptedGroupMembers, latestGroupContribution } from "../multisig/group-members.js";
+import { acceptedGroupMembers, isAcceptedGroupMember, latestGroupContribution } from "../multisig/group-members.js";
 import { branToSaltQb64, encodeHugeNumber, ensureKeeperCryptoReady, Manager, normalizeSaltQb64, saltySigner, } from "./keeping.js";
 /** Reserved alias for the local signatory habitat record. */
 export const SIGNER = "__signatory__";
@@ -1547,6 +1547,10 @@ export class Habery {
      * - this is the TypeScript analogue of `Habery.joinGroupHab()`
      * - it does not fabricate key state; accepted KEL state must still arrive
      *   through `Kevery.processEvent()`
+     * - KERIpy overwrites the recorded member unconditionally. Here a recorded member that is still a
+     *   signing or rotation member of the group's accepted key state is kept (a Habery holding two valid
+     *   members must not switch which one signs), and one that is in neither list is replaced by `mhab`.
+     *   Replacing creates no event and signs nothing; membership itself changes only by rotation.
      */
     joinGroupHab(pre, group, mhab, smids, rmids, ns) {
         if (!pre) {
@@ -1569,18 +1573,54 @@ export class Habery {
             throw new ValidationError(`Group alias ${group} is already bound to ${existingName}.`);
         }
         const existingRecord = this.db.getHab(pre);
-        if (existingRecord?.mid && existingRecord.mid !== mhab.pre) {
-            throw new ValidationError(`Group prefix ${pre} is already joined as ${existingRecord.name}.`);
+        const replacing = !!existingRecord?.mid && existingRecord.mid !== mhab.pre;
+        if (replacing) {
+            // Membership is decided by accepted key state, never by the caller's lists or a proposal.
+            if (!this.db.getKever(pre)) {
+                throw new ValidationError(`Group prefix ${pre} is already joined as ${existingRecord.name}; whether member ${existingRecord.mid} `
+                    + `is still a member cannot be judged until the group has accepted key state.`);
+            }
+            if (isAcceptedGroupMember(this.db, pre, existingRecord.mid)) {
+                throw new ValidationError(`Group prefix ${pre} is already joined as ${existingRecord.name} by member ${existingRecord.mid}, `
+                    + `which is still a member in its accepted key state.`);
+            }
+            if (!isAcceptedGroupMember(this.db, pre, mhab.pre)) {
+                throw new ValidationError(`Local member identifier ${mhab.pre} is not a member in the accepted key state of group ${pre}.`);
+            }
         }
         const hab = this.habs.get(pre) ?? new Hab(group, this.db, this.ks, this.mgr, this.cf, this.rtr, this.rvy, this.kevery, ns, pre);
-        this.persistGroupHabRecord(pre, group, mhab.pre, signingMembers, rotationMembers, ns);
+        this.persistGroupHabRecord(pre, group, mhab.pre, signingMembers, rotationMembers, ns, existingRecord ?? undefined);
         this.db.groups.add(pre);
         if (hab.accepted) {
             this.markAcceptedGroupHab(pre);
         }
         this.habs.set(pre, hab);
+        if (replacing && !this.readonly) {
+            // The stored lists must follow accepted state, which the old member's record kept from being committed.
+            this.recoverAcceptedGroupMembers(pre);
+            this.retireGroupMemberState(pre, existingRecord.mid);
+        }
         return hab;
     }
+    /**
+     * Drop the durable rows that address `group` to its former local member `old`: registry root copies
+     * escrowed for `old` (the holder check now refuses them, so a retry would only fail) and the markers
+     * of copies sent to `old` as a recipient. Rows keyed by the group itself stay. Live operations are
+     * owned by the runtime and are not reached from here.
+     */
+    retireGroupMemberState(group, old) {
+        for (const [keys] of [...this.db.rrpe.getTopItemIter()]) {
+            const serder = this.db.exns.get([keys.join(".")]);
+            const data = serder?.sad?.a;
+            if (serder?.route === "/registry/root" && serder.sad?.ri === old && data?.gid === group) {
+                this.db.rrpe.rem(keys);
+            }
+        }
+        for (const [keys] of [...this.db.rrsn.getTopItemIter([group])]) {
+            if (keys[2] === old)
+                this.db.rrsn.rem(keys);
+        }
+    }
     /** Commit accepted group member metadata after the corresponding group event is accepted. */
     commitGroupHabMembers(pre, smids, rmids = smids) {
         const record = this.db.getHab(pre);
@@ -1774,12 +1814,15 @@ export class Habery {
         return sigers;
     }
     /** Persist group habitat metadata and member ordinals. */
-    persistGroupHabRecord(pre, group, mid, smids, rmids, ns) {
+    persistGroupHabRecord(pre, group, mid, smids, rmids, ns, replaced) {
         this.db.pinHab(pre, new HabitatRecord({
             hid: pre,
             name: group,
             domain: ns,
             mid,
+            // A rejoin or replacement keeps the rest of the record.
+            sid: replaced?.sid,
+            watchers: replaced?.watchers ? [...replaced.watchers] : undefined,
             smids: [...smids],
             rmids: [...rmids],
         }));

package/esm/keri/npm/src/app/ipex/issuance.js

@@ -266,6 +266,17 @@ export class IssuanceOperations {
         this.ended.set(partyKey(op.grant, op.role), { role: op.role, state, reason });
         this.deps.changes?.push({ kind: "issuance", id: op.grant });
     }
+    /**
+     * End, as abandoned with `reason`, every live operation of local group `group` whose party member or frozen
+     * DH custodian is `member`. Releasing the approval drops the DH owner's held query. Returns the Grants ended.
+     */
+    endBoundToMember(group, member, reason) {
+        const bound = [...this.live.values()].filter(op => op.group?.party.group.pre === group
+            && (op.group.party.member.pre === member || op.group.party.custodian === member));
+        for (const op of bound)
+            this.end(op, "abandoned", reason);
+        return bound.map(op => op.grant);
+    }
     /** Drop the live entry and the DH approval; a missing approval means the owner already closed. */
     release(op) {
         this.live.delete(partyKey(op.grant, op.role));

package/esm/keri/npm/src/app/ipex/unblinding-workflow.js

@@ -287,6 +287,16 @@ export class UnblindingOperations {
         this.settled.set(unblindingKey(op.grant, op.role), { role: op.role, state, reason });
         this.deps.changes?.push({ kind: "unblinding", id: op.grant });
     }
+    /**
+     * End, as abandoned with `reason`, every live Unblind of local group `group` whose party member is `member`.
+     * Releasing the approval drops the owner's held query. Returns the Grants ended.
+     */
+    endBoundToMember(group, member, reason) {
+        const bound = [...this.live.values()].filter(op => op.hab.pre === group && op.group?.member.pre === member);
+        for (const op of bound)
+            this.end(op, "abandoned", reason);
+        return bound.map(op => op.grant);
+    }
     /** Drop the live entry and the owner's approval and frozen messages; delivered bytes stay the peer's. */
     release(op) {
         this.live.delete(unblindingKey(op.grant, op.role));

package/esm/keri/npm/src/app/multisig/counseling.js

@@ -282,6 +282,10 @@ export class Counselor {
         for (const sn of removed)
             this.changes?.push({ kind: "group", id: `${pre}:${sn}` });
     }
+    /** Whether completed events are held in memory for forwarding, which a pass retries without any store write. */
+    get holdsForwards() {
+        return this.forwards.size > 0;
+    }
     /** One pass over all stages, as KERIpy `processEscrows`. */
     *processOnce() {
         // A runtime calls this every turn; with nothing counseled, three row counts are the whole cost.

package/esm/keri/npm/src/app/multisig/group-members.js

@@ -128,6 +128,28 @@ export function groupMemberHasKey(db, member, key) {
     }
     return false;
 }
+/**
+ * True when `aid` is a signing or rotation member of `group`'s latest accepted establishment event: one of its
+ * establishment events supplied a key in that event's key list or committed to a digest in its next list.
+ * Decided from accepted key state only. False when the group has no accepted state.
+ */
+export function isAcceptedGroupMember(db, group, aid) {
+    const kever = db.getKever(group);
+    const event = kever ? db.getEvtSerder(group, kever.lastEst.d) : null;
+    if (!event)
+        return false;
+    const keys = new Set((event.verfers ?? []).map(verfer => verfer.qb64));
+    const digs = new Set((event.ndigers ?? []).map(diger => diger.qb64));
+    for (const [, said] of db.getKelItemIter(aid)) {
+        const member = db.getEvtSerder(aid, said);
+        if (!member?.estive)
+            continue;
+        if ((member.verfers ?? []).some(verfer => keys.has(verfer.qb64))
+            || (member.ndigers ?? []).some(diger => digs.has(diger.qb64)))
+            return true;
+    }
+    return false;
+}
 /**
  * Select only a cryptographically valid local partial at an accepted group establishment.
  * The shared esigs table can hold unverified escrow candidates, so a matching

package/esm/keri/npm/src/app/multisig/replace-member.js

@@ -0,0 +1,34 @@
+/**
+ * Replace a local group's recorded member after a rotation removed it, and end the runtime's work bound to it.
+ *
+ * `Habery.joinGroupHab` re-points the record and clears the durable rows addressed to the old member. The
+ * runtime owns the live operations, so this is the one call that also ends them: an issuance whose party
+ * member or frozen DH custodian is the old member, and an Unblind holding it. Each ends through its owner's
+ * own end path, which releases the approval and drops the held `heldq`/`heldu` rows. Group IPEX messages and
+ * presentations keep no member binding (their contributions are already signed and the member is read live),
+ * so they are left to run. Nothing is signed and no event is made.
+ */
+import { ValidationError } from "../../core/errors.js";
+/**
+ * Replace the local member of `input.group`, then end live operations bound to the previous one.
+ *
+ * @throws ValidationError when `joinGroupHab` refuses: the group has no accepted state, the previous member is
+ * still a member of it, or the new one is not.
+ */
+export function replaceGroupMember(runtime, input) {
+    const { hby } = runtime, { group, member } = input;
+    const record = hby.db.getHab(group), alias = record?.name;
+    if (!record?.mid || !alias)
+        throw new ValidationError(`Group ${group} is not a local group habitat.`);
+    const previous = record.mid;
+    if (previous === member.pre)
+        throw new ValidationError(`Member ${previous} is already the local member of ${group}.`);
+    hby.joinGroupHab(group, alias, member, input.smids, input.rmids ?? input.smids, record.domain);
+    const reason = `Local member ${previous} of group ${group} was replaced by ${member.pre}`;
+    const ops = runtime.operations;
+    return {
+        previous,
+        issuance: ops?.issuance.endBoundToMember(group, previous, reason) ?? [],
+        unblinding: ops?.unblinding.endBoundToMember(group, previous, reason) ?? [],
+    };
+}

package/esm/keri/npm/src/app/protocol/protocol-processing.js

@@ -6,8 +6,8 @@ import { consoleLogger } from "../../core/logger.js";
 import { BasicReplyRouteHandler, Revery } from "../../core/routing.js";
 import { Exchanger } from "../exchanges/exchanging.js";
 import { QueryReplies } from "../queries/query-replies.js";
+import { doEveryOnWrite, PROTOCOL_PACING } from "../runtime/doing.js";
 import { systemClock } from "../runtime/runtime-clock.js";
-import { waitOnClock } from "../runtime/workflow-contract.js";
 import { dispatchEnvelope, envelopeFromFrame, queryEnvelopeFromDispatch, } from "./parsering.js";
 /**
  * Wait after every escrow pass, as KERIpy's Doist cycle (`tock` 0.03125 s, app/directing.py) paces its `escrowDo`,
@@ -260,12 +260,21 @@ export class ProtocolProcessor {
      * KERIpy correspondence:
      * - mirrors the dedicated `escrowDo` loop rather than folding escrow
      *   processing into parser ingress
+     *
+     * A pass is a function of the store and of time, so this is a {@link doEveryOnWrite} doer: a pass on tock 0,
+     * after any store write, and every `pacing.idleTocks` tocks for what only time releases (timeouts, KRAM
+     * windows). Data-driven work waits at most one tock.
      */
-    *escrowDo(clock = systemClock) {
-        while (true) {
-            yield* this.processEscrowsOnce();
-            yield* waitOnClock(clock, ESCROW_TOCK_MS);
-        }
+    *escrowDo(clock = systemClock, pacing = PROTOCOL_PACING) {
+        // Escrows live in the KEL store and, for TEL and registry work, in the registry stores; a write to any of them
+        // runs the next tock's pass.
+        const stores = [this.kvy.db, this.tvy?.reger, this.registry?.store.baser].filter((store) => !!store);
+        const written = {
+            get writeActivity() {
+                return stores.reduce((sum, store) => sum + store.writeActivity, 0);
+            },
+        };
+        return yield* doEveryOnWrite(clock, pacing, written, () => this.processEscrowsOnce());
     }
 }
 /**

package/esm/keri/npm/src/app/queries/witness-inquisitor.js

@@ -16,7 +16,8 @@ import { consoleLogger } from "../../core/logger.js";
 import { Roles } from "../../core/roles.js";
 import { Schemes } from "../../core/schemes.js";
 import { introduce } from "../delivery/introducing.js";
-import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { PROTOCOL_TOCK_MS } from "../runtime/doing.js";
+import { waitOnClock } from "../runtime/workflow-contract.js";
 import { CesrHttpRefusal } from "../transport/cesr-egress.js";
 import { HTTPMessenger } from "../transport/http-messenger.js";
 import { requireTcpDialer } from "../transport/tcp-dialer.js";
@@ -339,12 +340,15 @@ export class WitnessInquisitor {
      * preparation/cleanup faults terminate the worker. Caller cancellation joins
      * the current attempt; it does not close the borrowed state or HTTP service.
      */
-    *deliverDo() {
+    *deliverDo(tockMs = PROTOCOL_TOCK_MS) {
         while (true) {
-            const failure = yield* this.deliveryPass();
-            if (failure)
-                consoleLogger.warn("Query delivery failed", failure);
-            yield* runtimeTurn();
+            // Fixed tock: a pass only when a request is queued; a request waits at most `tockMs` to start.
+            if (!this.requests.empty) {
+                const failure = yield* this.deliveryPass();
+                if (failure)
+                    consoleLogger.warn("Query delivery failed", failure);
+            }
+            yield* waitOnClock(this.clock, tockMs);
         }
     }
     /**

package/esm/keri/npm/src/app/runtime/agent-runtime.js

@@ -44,7 +44,7 @@ import { QueryReplies } from "../queries/query-replies.js";
 import { WitnessInquisitor } from "../queries/witness-inquisitor.js";
 import { Receiptor } from "../witness/receipting.js";
 import { cueDo } from "./cue-runtime.js";
-import { doEvery, PROTOCOL_PACING } from "./doing.js";
+import { doEveryOnWrite, PROTOCOL_PACING } from "./doing.js";
 import { IpexAuxiliaries } from "./ipex-auxiliaries.js";
 import { composeOwners, operationOwnersDo, OWNER_PACING, } from "./operation-owners.js";
 import { SignerConditions } from "./signer-conditions.js";
@@ -632,15 +632,19 @@ export function* runAgentRuntime(runtime, options = {}) {
     const alive = (loop, make) => spawn(() => surviving(runtime, loop, make));
     const stopHoldWatch = runtime.hby.mgr.onHold(() => runtime.signerConditions.held());
     const tasks = [
-        yield* alive("querying", () => runtime.querying.deliverDo()),
-        yield* alive("postman", () => runtime.postman.deliverDo()),
+        yield* alive("querying", () => runtime.querying.deliverDo(pacing.tockMs)),
+        yield* alive("postman", () => runtime.postman.deliverDo(pacing.tockMs)),
         ...(runtime.vdr && telReceiptor
             ? [
-                yield* alive("tel-publication", () => doEvery(runtime.clock, pacing.tockMs, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
+                yield* alive("tel-publication", () => doEveryOnWrite(runtime.clock, pacing, {
+                    get writeActivity() {
+                        return runtime.hby.db.writeActivity + runtime.vdr.publication.reger.writeActivity;
+                    },
+                }, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
             ]
             : []),
         yield* alive("cues", () => cueDo(runtime, options, pacing)),
-        yield* alive("escrows", () => runtime.protocol.escrowDo(runtime.clock)),
+        yield* alive("escrows", () => runtime.protocol.escrowDo(runtime.clock, pacing)),
         yield* alive("oobi", () => runtime.oobiery.oobiDo(runtime.clock, pacing)),
         yield* alive("authentication", () => runtime.authenticator.authDo(runtime.clock, pacing)),
         ...(runtime.signaler
@@ -655,8 +659,8 @@ export function* runAgentRuntime(runtime, options = {}) {
                 }),
             ]
             : []),
-        yield* alive("delegation", () => doEvery(runtime.clock, pacing.tockMs, () => runtime.delegating.processAllOnce())),
-        yield* alive("counselor", () => doEvery(runtime.clock, pacing.tockMs, () => runtime.counselor.processOnce())),
+        yield* alive("delegation", () => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.delegating.processAllOnce())),
+        yield* alive("counselor", () => doEveryOnWrite(runtime.clock, pacing, runtime.hby.db, () => runtime.counselor.processOnce(), () => runtime.counselor.holdsForwards)),
         yield* alive("kel-publisher", () => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
         ...(runtime.operations && runtime.ipex
             ? [

package/esm/keri/npm/src/app/runtime/doing.js

@@ -3,10 +3,13 @@ import { waitOnClock } from "./workflow-contract.js";
 export const PROTOCOL_TOCK_MS = 31.25;
 /** Tocks between full sweeps of a loop that has one: 1920 tocks of 31.25 ms is a minute. */
 export const PROTOCOL_SWEEP_TOCKS = 1920;
+/** Tocks between passes of a write-driven loop when the store did not change: 32 tocks of 31.25 ms is one second. */
+export const PROTOCOL_IDLE_TOCKS = 32;
 /** The production pacing of the protocol-facing background loops. */
 export const PROTOCOL_PACING = Object.freeze({
     tockMs: PROTOCOL_TOCK_MS,
     sweepTocks: PROTOCOL_SWEEP_TOCKS,
+    idleTocks: PROTOCOL_IDLE_TOCKS,
 });
 /** Run `pass` forever: pass 0, wait `tockMs` on `clock`, pass 1, and so on. A thrown error ends the doer. */
 export function* doEvery(clock, tockMs, pass) {
@@ -15,3 +18,25 @@ export function* doEvery(clock, tockMs, pass) {
         yield* waitOnClock(clock, tockMs);
     }
 }
+/**
+ * A fixed-tock doer for a loop whose work lives in store rows: pass 0, then a pass only on a tock after the
+ * store's write counter moved (a pass's own writes included, so it repeats until the store is quiet),
+ * after `busy()` says work is held in memory, or every `idleTocks`-th tock for what only time releases
+ * (timeouts, retry delays). A tock with nothing new costs a counter read, which touches no store, and no table scan. Rows written by
+ * another loop are seen on the next tock; time-driven work waits at most `idleTocks` tocks.
+ */
+export function* doEveryOnWrite(clock, pacing, db, pass, busy = () => false) {
+    const idle = pacing.idleTocks ?? PROTOCOL_IDLE_TOCKS;
+    let seen = -1;
+    for (let tock = 0;; tock++) {
+        if (tock % idle === 0 || db.writeActivity !== seen || busy()) {
+            try {
+                yield* pass(tock);
+            }
+            finally {
+                seen = db.writeActivity;
+            }
+        }
+        yield* waitOnClock(clock, pacing.tockMs);
+    }
+}

package/esm/keri/npm/src/db/core/lmdber.js

@@ -254,6 +254,13 @@ export class LMDBer extends BaseDBer {
             writable: true,
             value: false
         });
+        /** Write attempts made through this handle; a process-local counter, so reading it touches no store. */
+        Object.defineProperty(this, "commits", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
         this.defaults = { ...LMDBER_DEFAULTS, ...defaults };
         this.logger = options.logger ?? consoleLogger;
         this.configuredMapSize = options.mapSize;
@@ -482,7 +489,7 @@ export class LMDBer extends BaseDBer {
     setVer(val) {
         const env = this.requireEnv();
         try {
-            env.transactionSync(() => {
+            this.writing(env).transactionSync(() => {
                 env.putSync(b("__version__"), b(val));
             });
         }
@@ -521,6 +528,7 @@ export class LMDBer extends BaseDBer {
     }
     /** Run `fn` in one native synchronous write transaction; nesting is a child transaction. */
     transaction(fn) {
+        // A transaction is not itself a write: the puts and removes inside it count, so one that writes nothing does not.
         return this.requireEnv().transactionSync(fn);
     }
     /**
@@ -538,6 +546,15 @@ export class LMDBer extends BaseDBer {
             yield { key, value: copyDbBytes(entry.value) };
         }
     }
+    /** Count one write attempt through this handle and return the environment to write through. */
+    writing(env) {
+        this.commits++;
+        return env;
+    }
+    /** Counts this handle's own writes without reading the store; other processes' commits are not seen. */
+    get writeActivity() {
+        return this.commits;
+    }
     /** LMDB's committed transaction ID, which also counts other processes' commits. */
     get writeVersion() {
         const version = this.requireEnv().getStats().lastTxnId;
@@ -610,9 +627,11 @@ export class LMDBer extends BaseDBer {
     }
     putRow(table, key, val) {
         assertRowFits(table, key, val);
+        this.commits++;
         lmdbTable(table).putSync(key, val);
     }
     removeRow(table, key, val) {
+        this.commits++;
         return val === undefined ? lmdbTable(table).removeSync(key) : lmdbTable(table).removeSync(key, val);
     }
     /*
@@ -632,7 +651,7 @@ export class LMDBer extends BaseDBer {
         const db = lmdbTable(table);
         const env = this.requireEnv();
         try {
-            const result = env.transactionSync(() => {
+            const result = this.writing(env).transactionSync(() => {
                 const existing = db.get(key);
                 if (existing !== null && existing !== undefined) {
                     return false;
@@ -657,7 +676,7 @@ export class LMDBer extends BaseDBer {
         const db = lmdbTable(table);
         const env = this.requireEnv();
         try {
-            env.transactionSync(() => {
+            this.writing(env).transactionSync(() => {
                 assertRowFits(db, key, val);
                 db.put(key, val);
             });
@@ -700,7 +719,7 @@ export class LMDBer extends BaseDBer {
         const db = lmdbTable(table);
         const env = this.requireEnv();
         try {
-            const result = env.transactionSync(() => {
+            const result = this.writing(env).transactionSync(() => {
                 if (val !== undefined) {
                     // An empty key must still fail, but an over-long one can only be absent.
                     if (key.length > MAX_KEY_BYTES)
@@ -809,7 +828,7 @@ export class LMDBer extends BaseDBer {
             if (keys.length === 0) {
                 return false;
             }
-            env.transactionSync(() => {
+            this.writing(env).transactionSync(() => {
                 for (const key of keys) {
                     db.remove(key);
                 }
@@ -870,7 +889,7 @@ export class LMDBer extends BaseDBer {
         let result = true;
         const existing = new Set(this.getVals(db, key).map((val) => bytesHex(val)));
         const env = this.requireEnv();
-        env.transactionSync(() => {
+        this.writing(env).transactionSync(() => {
             for (const val of vals) {
                 const vh = bytesHex(val);
                 if (existing.has(vh)) {

package/esm/keri/npm/src/db/core/memstore.js

@@ -173,6 +173,10 @@ export class MemStore extends BaseDBer {
         this.assertOpen();
         return __classPrivateFieldGet(this, _MemStore_writeVersion, "f");
     }
+    /** Same count as {@link writeVersion}; in memory, so reading it is free. */
+    get writeActivity() {
+        return __classPrivateFieldGet(this, _MemStore_writeVersion, "f");
+    }
     /** Open or reopen the contents. A readonly open of never-created contents reports `false`. */
     *reopen(options = {}) {
         this.readonly = options.readonly ?? this.readonly;

package/esm/keri/npm/src/db/core/store-owner.js

@@ -45,6 +45,10 @@ export class StoreOwner {
     get writeVersion() {
         return this.store.writeVersion;
     }
+    /** Writes made through this handle, counted without a store read (see `Dber.writeActivity`). */
+    get writeActivity() {
+        return this.store.writeActivity;
+    }
     transaction(fn) {
         return this.store.transaction(fn);
     }

package/esm/keri/npm/src/runtime/index.js

@@ -65,6 +65,7 @@ export { signGroupMessage } from "../app/multisig/multisig-messaging.js";
 export { approveAcdcV2Registry, publishAcdcV2Registry } from "../app/multisig/multisig-workflows.js";
 export { approveGroupProposal, dismissGroupProposal, findGroupProposal, listGroupProposals, } from "../app/multisig/proposals.js";
 export { proposeCredentialIssue, proposeCredentialRegistry, proposeCredentialRevocation, proposeGroupInception, proposeGroupInteraction, proposeGroupRotation, proposeRegistryEvent, settleProposedRotation, } from "../app/multisig/proposing.js";
+export { replaceGroupMember, } from "../app/multisig/replace-member.js";
 export { Notifier, } from "../app/notifications/notifying.js";
 export { Signal, Signaler, } from "../app/notifications/signaling.js";
 export { SignerConditions } from "../app/runtime/signer-conditions.js";

package/esm/keri/npm/src/version.js

@@ -6,9 +6,9 @@
  * `src/version.ts` files by hand; edit this template instead.
  */
 /** Package semantic version copied from the owning package manifest. */
-export const PACKAGE_VERSION = "2.2.2";
+export const PACKAGE_VERSION = "2.2.4";
 /** Optional build metadata stamp injected by release/CI workflows. */
-export const BUILD_METADATA = "build.34.381a01d4673ab3a718e81ff2c7ee9b47b4c31aae";
+export const BUILD_METADATA = "build.41.494decc08a02e94e55c83a49945ecaa6df7ad701";
 /** User-facing version string with build metadata appended when present. */
 export const DISPLAY_VERSION = BUILD_METADATA
     ? `${PACKAGE_VERSION}+${BUILD_METADATA}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keri-ts",
-  "version": "2.2.2",
+  "version": "2.2.4",
   "description": "KERI TypeScript protocol and runtime library",
   "homepage": "https://github.com/kentbull/keri-ts",
   "repository": {

package/types/app/bootstrap/authenticating.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticating.d.ts","sourceRoot":"","sources":["../../../src/app/bootstrap/authenticating.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,SAAS,EAAU,MAAM,WAAW,CAAC;AAEzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,KAAK,UAAU,EAA4B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,MAAM,GACV,OAAO,CAMT;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;;;;OAKG;gBACS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;IAKzC,sEAAsE;IACrE,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC;IAe/B,yDAAyD;IACxD,MAAM,CAAC,KAAK,GAAE,YAA0B,EAAE,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAmB,GAAG,SAAS,CAAC,KAAK,CAAC;IAI5G,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB;IAsC9B,0DAA0D;IAC1D,OAAO,CAAC,eAAe;IAYvB;;;;;OAKG;IACH,OAAO,CAAE,kBAAkB;CAgC5B"}
+{"version":3,"file":"authenticating.d.ts","sourceRoot":"","sources":["../../../src/app/bootstrap/authenticating.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,SAAS,EAAU,MAAM,WAAW,CAAC;AAEzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,KAAK,UAAU,EAAmC,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,MAAM,GACV,OAAO,CAMT;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;;;;OAKG;gBACS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;IAKzC,sEAAsE;IACrE,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC;IAe/B,yDAAyD;IACxD,MAAM,CAAC,KAAK,GAAE,YAA0B,EAAE,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAmB,GAAG,SAAS,CAAC,KAAK,CAAC;IAI5G,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB;IAsC9B,0DAA0D;IAC1D,OAAO,CAAC,eAAe;IAYvB;;;;;OAKG;IACH,OAAO,CAAE,kBAAkB;CAgC5B"}