keri-ts 2.2.3 → 2.2.5

package/esm/keri/npm/src/core/mailbox/kram-pruning.js

@@ -2,11 +2,12 @@
 import { b } from "cesr-ts";
 import { removeKramFactors } from "../../db/mailbox/kram-factors.js";
 import { timestampMicros } from "../../time/mod.js";
+import { consoleLogger } from "../logger.js";
 import { TxnMsgCacheRecord } from "../records.js";
 import { kramCacheValues } from "./kram-time.js";
 /** Prune stored windows, then prove orphan XIDs with restartable finite existence scans. */
 export class KramPruner {
-    constructor(db, policy) {
+    constructor(db, policy, logger = consoleLogger) {
         Object.defineProperty(this, "db", {
             enumerable: true,
             configurable: true,
@@ -19,6 +20,12 @@ export class KramPruner {
             writable: true,
             value: policy
         });
+        Object.defineProperty(this, "logger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: logger
+        });
         Object.defineProperty(this, "bound", {
             enumerable: true,
             configurable: true,
@@ -95,7 +102,14 @@ export class KramPruner {
             throw new Error("Invalid KRAM pruning receiver clock");
         if (!Number.isSafeInteger(maxRows) || maxRows < 1)
             throw new RangeError("Invalid KRAM pruning batch");
-        const result = { kind: "pruned", visited: 0, removed: 0, openers: 0, passComplete: false };
+        const result = {
+            kind: "pruned",
+            visited: 0,
+            removed: 0,
+            openers: 0,
+            partials: 0,
+            passComplete: false,
+        };
         if (!this.db.opened)
             throw new Error("KRAM pruning database is closed");
         if (this.bound !== this.db.msgc.sdb) {
@@ -114,15 +128,20 @@ export class KramPruner {
                     continue;
                 }
                 const keys = this.keys(physical, this.phase + 2), table = this.phase ? this.db.tmsc : this.db.msgc;
-                this.db.transaction(() => {
+                const partial = this.db.transaction(() => {
                     const record = table.get(keys);
                     if (!record || !this.expired(record, when))
-                        return;
+                        return null;
                     table.rem(keys);
-                    const partial = [keys[0], keys.at(-1)];
-                    removeKramFactors(this.db, partial);
+                    const owner = [keys[0], keys.at(-1)], incomplete = this.db.pmkm.get(owner) !== null;
+                    removeKramFactors(this.db, owner);
                     result.removed++;
+                    return incomplete ? owner : null;
                 });
+                if (partial) {
+                    result.partials++;
+                    this.logger.warn("KRAM expired incomplete multi-signature message", { sender: partial[0], said: partial[1] });
+                }
                 scan.start = this.after(physical);
                 result.visited++;
                 continue;

package/esm/keri/npm/src/core/mailbox/kram-time.js

@@ -1,5 +1,16 @@
-import { timestampMicros } from "../../time/mod.js";
+import { timestampFromMicros, timestampMicros } from "../../time/mod.js";
 import { MsgCacheRecord, TxnMsgCacheRecord } from "../records.js";
+import { readDater, readDiger } from "../wire-fields.js";
+/**
+ * Whether a drop reason means an authenticated message arrived too late or outside a live exchange.
+ *
+ * `timestamp`, `exchangeId`, `replay` and `authentication` are reachable by anyone who can post bytes (see
+ * kram-staging.ts), so callers that report or signal a refusal to anyone beyond the log must restrict themselves to
+ * these.
+ */
+export function isKramLateReason(reason) {
+    return reason === "timeliness" || reason === "lifetime" || reason === "unknownThread";
+}
 /** Validate durable cache values without turning corruption into remote refusal. */
 export function kramCacheValues(cache) {
     const { mdt, d, ml, pml, xl, pxl } = cache;
@@ -10,9 +21,19 @@ export function kramCacheValues(cache) {
         throw new Error("Corrupt KRAM timeliness cache");
     return { mdt: mdt, d: d, ml: ml, pml: pml, xl: xl, pxl: pxl };
 }
+/** Exchange id KRAM threads a message by: the `xip` SAID or the v2 `exn` `x` field; empty when it has none. */
+export function kramExchangeId(body) {
+    const said = body.said;
+    return body.ilk === "xip" ? said ?? "" : body.ilk === "exn" && body.pvrsn.major >= 2 ? String(body.ked?.x ?? "") : "";
+}
 /**
  * Inspect frozen message/xid routing and strict completed-message replay rules.
  * Only an incomplete multi-signature message retains partial state.
+ *
+ * The stamp and exchange id are remote-authored and become durable values: an exchange message's stamp can be stored
+ * as its thread opener (a Dater, which needs the fixed-width form), and the exchange id is a cache key part (a value
+ * that is not one qualified digest, such as one containing `.`, would make a key the pruner cannot split). Both are
+ * refused here, before any store write.
  */
 export function inspectKramReplay(db, body) {
     const mdt = timestampMicros(body.stamp);
@@ -22,7 +43,11 @@ export function inspectKramReplay(db, body) {
     if (!sender || !said)
         throw new Error("KRAM replay inspection requires sender and message SAID");
     const key = [sender, said];
-    const xid = body.ilk === "xip" ? said : body.ilk === "exn" && body.pvrsn.major >= 2 ? String(body.ked?.x ?? "") : "";
+    const xid = kramExchangeId(body);
+    if (xid && readDiger(xid)?.qb64 !== xid)
+        return { kind: "drop", reason: "exchangeId" };
+    if (xid && !readDater(body.stamp))
+        return { kind: "drop", reason: "timestamp" };
     const cacheKey = xid ? [sender, xid, said] : key;
     const cache = xid ? db.tmsc.get(cacheKey) : db.msgc.get(cacheKey);
     const partial = db.pmkm.get(key) !== null;
@@ -54,8 +79,9 @@ export function evaluateKramTime(db, policy, inspection, authentication, receive
     else {
         const type = policy.cacheType(body.ilk, body.route), multi = authentication.kind === "multi";
         const ml = multi ? type.ll : type.sl, pml = multi ? type.pll : type.psl;
-        if (!within(mdt, receipt - (BigInt(type.d) + BigInt(ml)) * 1000n, receipt + BigInt(type.d) * 1000n)) {
-            return { kind: "drop", reason: "timeliness" };
+        const reach = (BigInt(type.d) + BigInt(ml)) * 1000n;
+        if (!within(mdt, receipt - reach, receipt + BigInt(type.d) * 1000n)) {
+            return { kind: "drop", reason: "timeliness", deadline: timestampFromMicros(mdt + reach) };
         }
         values = { mdt: body.stamp, d: type.d, ml, pml, xl: type.xl, pxl: type.pxl };
     }
@@ -79,8 +105,10 @@ export function evaluateKramTime(db, policy, inspection, authentication, receive
     const opener = timestampMicros(xdt);
     if (opener === null)
         throw new Error("Corrupt KRAM transaction opener");
-    if (!cache && !within(mdt, opener, opener + BigInt(values.xl) * 1000n))
-        return { kind: "drop", reason: "lifetime" };
+    const closing = opener + BigInt(values.xl) * 1000n;
+    if (!cache && !within(mdt, opener, closing)) {
+        return { kind: "drop", reason: "lifetime", deadline: timestampFromMicros(closing) };
+    }
     const complete = authentication.kind !== "multi" || authentication.complete;
     const rdt = cache instanceof TxnMsgCacheRecord && cache.rdt ? cache.rdt : complete ? receiverTime : "";
     return {

package/esm/keri/npm/src/core/mailbox/kraming.js

@@ -1,19 +1,27 @@
 import { makeNowIso8601, timestampMicros } from "../../time/mod.js";
 import { Deck } from "../deck.js";
+import { consoleLogger } from "../logger.js";
 import { KramPolicy } from "./kram-policy.js";
 import { KramPruner } from "./kram-pruning.js";
 import { stageKram } from "./kram-staging.js";
+import { isKramLateReason, kramExchangeId } from "./kram-time.js";
 /** Explicit receiver-owned cache and exemption configuration. */
 export { DEFAULT_KRAM_CACHES } from "./kram-policy.js";
 /** Optional receiver intake returns ordinary decisions without owning parser input. */
 export class Kramer {
-    constructor(db, { config = {}, cues = new Deck(), now = Date.now } = {}) {
+    constructor(db, { config = {}, cues = new Deck(), now = Date.now } = {}, logger = consoleLogger) {
         Object.defineProperty(this, "db", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: db
         });
+        Object.defineProperty(this, "logger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: logger
+        });
         /** Shared runtime cues, or the standalone caller's drainable receiver-state notifications. */
         Object.defineProperty(this, "cues", {
             enumerable: true,
@@ -42,7 +50,7 @@ export class Kramer {
         this.now = now;
         this.policy = new KramPolicy(db, config, now);
         this.cues = cues;
-        this.pruner = new KramPruner(db, this.policy);
+        this.pruner = new KramPruner(db, this.policy, logger);
     }
     /** Decide intake synchronously; protocol dispatch consumes the returned evidence. */
     intake(envelope) {
@@ -64,8 +72,56 @@ export class Kramer {
                 q: result.sn === null ? {} : { s: result.sn.toString(16) },
             });
         }
+        if (result.kind === "drop") {
+            this.report(envelope, result);
+            const cue = this.refusedCue(envelope, result);
+            if (cue)
+                this.cues.push(cue);
+        }
         return result;
     }
+    /**
+     * Describe a refusal the application may want to hear about, or null. Staging has already committed. A local
+     * caller receives its own refusal, and only the reasons KRAM decides after authentication are safe to signal:
+     * `timestamp`, `replay` and `authentication` are reachable by anyone who can post bytes.
+     */
+    refusedCue(envelope, refusal) {
+        if (envelope.local || !isKramLateReason(refusal.reason))
+            return null;
+        const { serder } = envelope;
+        const xid = kramExchangeId(serder), deadline = "deadline" in refusal ? refusal.deadline : undefined;
+        return {
+            kin: "kramRefused",
+            said: serder.said,
+            sender: serder.pre,
+            ilk: serder.ilk,
+            route: serder.route,
+            reason: refusal.reason,
+            stamp: serder.stamp,
+            ...(deadline === undefined ? {} : { deadline }),
+            ...(xid ? { xid } : {}),
+        };
+    }
+    /**
+     * Report one refused message. Replay is routine (every duplicate delivery lands here), so it logs at debug;
+     * the other reasons mean a sender or clock is misbehaving and log at warn. Dispatch does not log again.
+     */
+    report(envelope, refusal) {
+        const { serder } = envelope;
+        const fields = {
+            said: serder.said,
+            sender: serder.pre,
+            ilk: serder.ilk,
+            route: serder.route,
+            reason: refusal.reason,
+            stamp: serder.stamp,
+            deadline: "deadline" in refusal ? refusal.deadline : undefined,
+        };
+        if (refusal.reason === "replay")
+            this.logger.debug("KRAM refused message", fields);
+        else
+            this.logger.warn("KRAM refused message", fields);
+    }
     /** Reconfigure cache windows through the durable policy transition facility. */
     changeConfig(caches, delay) {
         this.policy.change(caches, delay);

package/esm/keri/npm/src/core/routing.js

@@ -1,11 +1,12 @@
-import { Dater, Diger, NumberPrimitive, Prefixer, Siger } from "cesr-ts";
-import { encodeDateTimeToDater, timestampMicros } from "../time/mod.js";
+import { Diger, NumberPrimitive, Prefixer, Siger } from "cesr-ts";
+import { timestampMicros } from "../time/mod.js";
 import { Deck } from "./deck.js";
 import { TransIdxSigGroup } from "./dispatch.js";
 import { ValidationError } from "./errors.js";
 import { acceptEscrow, dropEscrow, keepEscrow, logEscrowDecision, } from "./kel/kever-decisions.js";
 import { EndpointRecord, LocationRecord } from "./records.js";
 import { isRole } from "./roles.js";
+import { readDater, readPrefixer, readUrl } from "./wire-fields.js";
 /** Builder for one accepted live reply decision. */
 export function acceptReplyDecision() {
     return { kind: "accept" };
@@ -276,6 +277,7 @@ Object.defineProperty(Router, "defaultResourceFunc", {
  * - persist accepted reply artifacts into `sdts.`, `rpys.`, `scgs.`, `ssgs.`
  * - escrow partially verifiable transferable replies into `rpes.`
  * - emit `query` cues when missing signer state blocks verification
+ * - emit an `endRoleSaved` cue after an accepted `/end/role` reply commits (TypeScript-only; KERIpy has no consumer)
  *
  * Current `keri-ts` differences:
  * - only the Gate E bootstrap reply families are currently routed
@@ -321,17 +323,6 @@ export class Revery {
             writable: true,
             value: void 0
         });
-        /**
-         * Told after an `/end/role` reply is accepted, with the controller, role, endpoint and whether the role is
-         * allowed. The runtime uses it to have the mailbox poller and KEL publisher look at a controller whose mailbox
-         * role just changed, rather than at their next sweep.
-         */
-        Object.defineProperty(this, "onEndRole", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         this.db = db;
         this.rtr = rtr ?? new Router();
         this.cues = cues ?? new Deck();
@@ -404,11 +395,10 @@ export class Revery {
         // Same-call groups see the last staged pin exactly as they previously saw the durable write.
         const staged = new Map();
         const groupKey = (pre, snh, said) => `${pre}.${snh}.${said}`;
-        const daterText = args.serder.ked?.dt;
-        if (typeof daterText !== "string") {
-            throw new ValidationError("Reply message is missing 'dt'.");
+        const dater = readDater(args.serder.ked?.dt);
+        if (!dater) {
+            throw new ValidationError("Reply message is missing a valid 'dt'.");
         }
-        const dater = new Dater({ qb64: encodeDateTimeToDater(daterText) });
         const odater = args.osaider ? this.db.sdts.get([args.osaider.qb64]) : null;
         let pending = false;
         const escrow = (material) => {
@@ -802,7 +792,8 @@ export class BasicReplyRouteHandler {
      * - derives the BADA route base `/end/role`
      * - applies same-SAID idempotence before acceptance
      * - evaluates proof and updates proof/`eans.`/`ends.` in its own transaction
-     * - publishes queries only after that commit; caller-owned writers are refused
+     * - publishes queries, then an `endRoleSaved` cue for an accepted reply, only after that commit; caller-owned
+     *   writers are refused
      */
     processReplyEndRole(args) {
         const allowed = args.route.startsWith("/end/role/add")
@@ -817,11 +808,11 @@ export class BasicReplyRouteHandler {
         if (!data || typeof data !== "object" || Array.isArray(data)) {
             throw new ValidationError("Missing one of cid/role/eid in /end/role reply.");
         }
-        const cid = "cid" in data && typeof data.cid === "string" ? new Prefixer({ qb64: data.cid }).qb64 : null;
+        const cid = "cid" in data ? readPrefixer(data.cid)?.qb64 ?? null : null;
         const role = "role" in data && typeof data.role === "string" ? data.role : null;
-        const eid = "eid" in data && typeof data.eid === "string" ? new Prefixer({ qb64: data.eid }).qb64 : null;
+        const eid = "eid" in data ? readPrefixer(data.eid)?.qb64 ?? null : null;
         if (!cid || !role || !eid) {
-            throw new ValidationError("Missing one of cid/role/eid in /end/role reply.");
+            throw new ValidationError("Missing or malformed one of cid/role/eid in /end/role reply.");
         }
         if (!isRole(role)) {
             throw new ValidationError(`Invalid endpoint role ${role}.`);
@@ -855,7 +846,7 @@ export class BasicReplyRouteHandler {
         if (queryCues.length)
             this.rvy.cues.extend(queryCues);
         if (decision.kind === "accept")
-            this.rvy.onEndRole?.(cid, role, eid, allowed);
+            this.rvy.cues.push({ kin: "endRoleSaved", cid, role, eid, allowed });
         return decision;
     }
     /**
@@ -877,14 +868,16 @@ export class BasicReplyRouteHandler {
         if (!data || typeof data !== "object" || Array.isArray(data)) {
             throw new ValidationError("Missing one of eid/scheme/url in /loc/scheme reply.");
         }
-        const eid = "eid" in data && typeof data.eid === "string" ? new Prefixer({ qb64: data.eid }).qb64 : null;
+        const eid = "eid" in data ? readPrefixer(data.eid)?.qb64 ?? null : null;
         const scheme = "scheme" in data && typeof data.scheme === "string" ? data.scheme : null;
         const url = "url" in data && typeof data.url === "string" ? data.url : null;
         if (!eid || !scheme || url === null) {
-            throw new ValidationError("Missing one of eid/scheme/url in /loc/scheme reply.");
+            throw new ValidationError("Missing or malformed one of eid/scheme/url in /loc/scheme reply.");
         }
         if (url) {
-            const parsed = new URL(url);
+            const parsed = readUrl(url);
+            if (!parsed)
+                throw new ValidationError(`Unparseable URL ${url} in /loc/scheme reply.`);
             if (parsed.protocol && parsed.protocol.slice(0, -1) !== scheme) {
                 throw new ValidationError(`URL ${url} does not match declared scheme ${scheme}.`);
             }

package/esm/keri/npm/src/core/scheming.js

@@ -129,14 +129,21 @@ function parseSchemaJson(raw) {
     }
     return parsed;
 }
+/**
+ * Decode credential data for validation. The bytes are a remote credential's body, which need not be JSON (a CBOR or
+ * MGPK ACDC); data that does not decode fails validation as a `ValidationError`, like KERIpy's `json.loads` failure.
+ */
 function parseSchemaData(raw) {
-    if (raw instanceof Uint8Array) {
-        return JSON.parse(new TextDecoder().decode(raw));
+    if (!(raw instanceof Uint8Array) && typeof raw !== "string")
+        return raw;
+    try {
+        return JSON.parse(typeof raw === "string" ? raw : new TextDecoder().decode(raw));
     }
-    if (typeof raw === "string") {
-        return JSON.parse(raw);
+    catch (error) {
+        if (!(error instanceof SyntaxError))
+            throw error;
+        throw new ValidationError(`Credential data is not JSON: ${error.message}`);
     }
-    return raw;
 }
 function verifySchemaSaid(sed, kind) {
     const id = sed.$id;

package/esm/keri/npm/src/core/wire-fields.js

@@ -0,0 +1,126 @@
+/**
+ * Guarded readers for the field values of remote messages.
+ *
+ * A remote message can parse and verify its SAID while a field value is still not a valid value for its type: a
+ * non-hex or over-wide sequence number, a key that is not a verification key, a next-key digest that is not a digest,
+ * a prefix that is not a prefix. The cesr accessors and primitive constructors throw on such values, and a throw out
+ * of a processor ends its loop (the mailbox poller, the escrow doer, HTTP ingress). Processor boundaries therefore read
+ * remote field values through these readers and turn a null into their own typed refusal (ADR-0005) before any escrow
+ * decision or store write: `Kevery.decideEvent` and `processReceipt`, the reply route handlers and `Revery`'s
+ * datetime read, `Exchanger` admission and `queryEnvelopeFromDispatch`. Accepted KEL events are remote-authored too:
+ * their raw `a` seals are read through `readEventSeal` wherever an anchor is searched.
+ *
+ * Only the cesr codec's own malformed-input taxonomy (`ParserError` and its subclasses) is read as malformed input, and
+ * only while constructing a primitive from a string the message carried. That construction reads no store, so a
+ * `ParserError` there cannot be corrupt durable state or I/O; every other error propagates. Numbers are checked as
+ * text before any `BigInt` conversion, so cesr's `SyntaxError`/`RangeError` for bad hex is never relied on.
+ */
+import { Dater, Diger, Ilks, NumberPrimitive, ParserError, Prefixer, SealEvent, Verfer, } from "cesr-ts";
+import { encodeDateTimeToDater } from "../time/mod.js";
+/** Construct `Type` from qualified text, or null when the text is not a valid value of that type. */
+function readQualified(Type, value) {
+    if (typeof value !== "string" || !value)
+        return null;
+    try {
+        return new Type({ qb64: value });
+    }
+    catch (error) {
+        if (error instanceof ParserError)
+            return null;
+        throw error;
+    }
+}
+/** Read an identifier prefix (`i`, `di`, `cid`, `eid`, ...), or null when it is not one. */
+export function readPrefixer(value) {
+    return readQualified(Prefixer, value);
+}
+/** Read a digest (`d` of a key state notice, a next-key digest), or null when it is not one. */
+export function readDiger(value) {
+    return readQualified(Diger, value);
+}
+/** Read a verification key (a current key, a witness), or null when it is not one. */
+export function readVerfer(value) {
+    return readQualified(Verfer, value);
+}
+/** Read a datetime (`dt`) as a Dater, or null when it does not encode as one. */
+export function readDater(value) {
+    return typeof value === "string" ? readQualified(Dater, encodeDateTimeToDater(value)) : null;
+}
+/** Read a URL, or null when it does not parse. */
+export function readUrl(value) {
+    return URL.canParse(value) ? new URL(value) : null;
+}
+/**
+ * Read a KERI ordinal: lower- or upper-case hex text, or a non-negative integer number or bigint, as cesr's numeric
+ * ladder accepts them. Null when it is none of those or exceeds `Number.MAX_SAFE_INTEGER`, the largest value the KEL
+ * processors can compare exactly as a number.
+ */
+export function readOrdinal(value) {
+    let ordinal;
+    if (typeof value === "string") {
+        if (!/^[0-9a-f]+$/iu.test(value))
+            return null;
+        ordinal = BigInt(`0x${value}`);
+    }
+    else if (typeof value === "number") {
+        if (!Number.isSafeInteger(value) || value < 0)
+            return null;
+        ordinal = BigInt(value);
+    }
+    else if (typeof value === "bigint") {
+        ordinal = value;
+    }
+    else {
+        return null;
+    }
+    return ordinal >= 0n && ordinal <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(ordinal) : null;
+}
+/** Read a message's `s`, which cesr's `sner` reads only as hex text; null when absent or malformed. */
+export function readSequenceNumber(serder) {
+    const sn = serder.ked?.s;
+    return typeof sn === "string" ? readOrdinal(sn) : null;
+}
+/**
+ * Name the first field of a KEL event whose value the key-state machine would fail to decode, or null when all decode.
+ *
+ * Covers what `Kever` and escrow persistence decode beyond `i` and `s` (which `decideEvent` reads first): current keys
+ * `k` and next-key digests `n` of establishment events, witnesses `b` and witness changes `br`/`ba`, the witness
+ * threshold `bt`, and the delegator `di` of a delegated inception. Thresholds (`kt`, `nt`) already decode to null and are
+ * rejected by `Kever`; raw seals in `a` are not decoded here.
+ */
+export function kelEventFieldDefect(serder) {
+    const ked = serder.ked ?? {};
+    const ilk = serder.ilk;
+    const bad = (label, values, read) => {
+        const value = values.find((entry) => read(entry) === null);
+        return value === undefined ? null : `${label} ${JSON.stringify(value)}`;
+    };
+    return bad("key", serder.keys, readVerfer)
+        ?? bad("next key digest", serder.ndigs, readDiger)
+        ?? bad("witness", serder.backs, readVerfer)
+        ?? bad("witness cut", serder.cuts, readVerfer)
+        ?? bad("witness add", serder.adds, readVerfer)
+        ?? (ked.bt !== undefined && ked.bt !== null && readOrdinal(ked.bt) === null
+            ? `witness threshold ${JSON.stringify(ked.bt)}`
+            : null)
+        ?? (ilk === Ilks.dip && serder.delpre !== null && !readPrefixer(serder.delpre)
+            ? `delegator ${JSON.stringify(serder.delpre)}`
+            : null);
+}
+/**
+ * Read one raw `a` entry as an event seal `{i, s, d}`, or null when it is another seal shape or carries a value that
+ * does not decode.
+ *
+ * An accepted event's seals are not value-checked at acceptance (KERIpy keeps them as raw dicts), so any identifier can
+ * anchor junk in its own KEL. Anchor searches (delegation approval, sealing-event lookup) therefore read each entry
+ * through this reader and skip a null instead of throwing. KERIpy filters by the same field shape
+ * (`tuple(seal) == SealEvent._fields`) and compares raw strings, so a malformed value can never match a real event.
+ */
+export function readEventSeal(value) {
+    if (!SealEvent.isSad(value))
+        return null;
+    const pre = readPrefixer(value.i);
+    const sn = readOrdinal(value.s);
+    const said = readDiger(value.d);
+    return pre && sn !== null && said ? SealEvent.fromTuple([pre, NumberPrimitive.fromNum(BigInt(sn)), said]) : null;
+}

package/esm/keri/npm/src/db/basing.js

@@ -1,11 +1,12 @@
 /** KERI event-log databaser built on `LMDBer` composition. */
-import { b, Cigar, Dater, Diger, Ilks, Labeler, Noncer, NumberPrimitive, NumDex, Prefixer, Saider, SealEvent, SerderKERI, Siger, t, Texter, Verfer, Verser, Vrsn_1_0, } from "cesr-ts";
+import { b, Cigar, Dater, Diger, Ilks, Labeler, Noncer, NumberPrimitive, NumDex, Prefixer, Saider, SerderKERI, Siger, t, Texter, Verfer, Verser, Vrsn_1_0, } from "cesr-ts";
 import { action } from "effection";
 import { attachmentCounterPayloadQb64b, attachmentCounterQb64b, attachmentOrdinal, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
 import { DatabaseOperationError, ValidationError } from "../core/errors.js";
 import { Kever } from "../core/kel/kever.js";
 import { consoleLogger } from "../core/logger.js";
 import { CacheTypeRecord, EndpointRecord, EventSourceRecord, HabitatRecord, KelPublishedRecord, KeyStateRecord, LocationRecord, MsgCacheRecord, ObservedRecord, OobiRecord, RootSentRecord, TopicsRecord, TxnMsgCacheRecord, WellKnownAuthN, } from "../core/records.js";
+import { readEventSeal } from "../core/wire-fields.js";
 import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
 import { dgKey, splitOnKey } from "./core/keys.js";
 import { StoreOwner } from "./core/store-owner.js";
@@ -29,19 +30,9 @@ function isEventSealRecord(value) {
         && value.s instanceof NumberPrimitive
         && value.d instanceof Diger;
 }
+/** Accept an already-typed event seal, or read a raw `{i, s, d}` entry; null for other shapes or bad values. */
 function normalizeEventSeal(value) {
-    if (isEventSealRecord(value)) {
-        return value;
-    }
-    if (!SealEvent.isSad(value)) {
-        return null;
-    }
-    try {
-        return SealEvent.fromSad(value);
-    }
-    catch {
-        return null;
-    }
+    return isEventSealRecord(value) ? value : readEventSeal(value);
 }
 function eventSealsEqual(left, right) {
     return left.i.qb64 === right.i.qb64

package/esm/keri/npm/src/db/core/indexeddb-persistence.js

@@ -25,8 +25,9 @@
  *
  * Another tab's upgrade or delete fires `versionchange` here. The connection
  * closes at once so that tab is never blocked, and this adapter is then lost:
- * its next `load` or `write` rejects, which latches the queue, because writing
- * on after another context deleted the database would break prefix durability.
+ * its next `load` or `write` rejects, and so does every retry of it (a write never
+ * reconnects), which latches the queue, because writing on after another context
+ * deleted the database would break prefix durability.
  * Recovery is a new open, whose `meta` reconnects. Single-writer exclusion is
  * the composition's job, not this adapter's.
  *

package/esm/keri/npm/src/db/core/lmdber.js

@@ -254,6 +254,13 @@ export class LMDBer extends BaseDBer {
             writable: true,
             value: false
         });
+        /** Write attempts made through this handle; a process-local counter, so reading it touches no store. */
+        Object.defineProperty(this, "commits", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
         this.defaults = { ...LMDBER_DEFAULTS, ...defaults };
         this.logger = options.logger ?? consoleLogger;
         this.configuredMapSize = options.mapSize;
@@ -482,7 +489,7 @@ export class LMDBer extends BaseDBer {
     setVer(val) {
         const env = this.requireEnv();
         try {
-            env.transactionSync(() => {
+            this.writing(env).transactionSync(() => {
                 env.putSync(b("__version__"), b(val));
             });
         }
@@ -521,6 +528,7 @@ export class LMDBer extends BaseDBer {
     }
     /** Run `fn` in one native synchronous write transaction; nesting is a child transaction. */
     transaction(fn) {
+        // A transaction is not itself a write: the puts and removes inside it count, so one that writes nothing does not.
         return this.requireEnv().transactionSync(fn);
     }
     /**
@@ -538,6 +546,15 @@ export class LMDBer extends BaseDBer {
             yield { key, value: copyDbBytes(entry.value) };
         }
     }
+    /** Count one write attempt through this handle and return the environment to write through. */
+    writing(env) {
+        this.commits++;
+        return env;
+    }
+    /** Counts this handle's own writes without reading the store; other processes' commits are not seen. */
+    get writeActivity() {
+        return this.commits;
+    }
     /** LMDB's committed transaction ID, which also counts other processes' commits. */
     get writeVersion() {
         const version = this.requireEnv().getStats().lastTxnId;
@@ -610,9 +627,11 @@ export class LMDBer extends BaseDBer {
     }
     putRow(table, key, val) {
         assertRowFits(table, key, val);
+        this.commits++;
         lmdbTable(table).putSync(key, val);
     }
     removeRow(table, key, val) {
+        this.commits++;
         return val === undefined ? lmdbTable(table).removeSync(key) : lmdbTable(table).removeSync(key, val);
     }
     /*
@@ -632,7 +651,7 @@ export class LMDBer extends BaseDBer {
         const db = lmdbTable(table);
         const env = this.requireEnv();
         try {
-            const result = env.transactionSync(() => {
+            const result = this.writing(env).transactionSync(() => {
                 const existing = db.get(key);
                 if (existing !== null && existing !== undefined) {
                     return false;
@@ -657,7 +676,7 @@ export class LMDBer extends BaseDBer {
         const db = lmdbTable(table);
         const env = this.requireEnv();
         try {
-            env.transactionSync(() => {
+            this.writing(env).transactionSync(() => {
                 assertRowFits(db, key, val);
                 db.put(key, val);
             });
@@ -700,7 +719,7 @@ export class LMDBer extends BaseDBer {
         const db = lmdbTable(table);
         const env = this.requireEnv();
         try {
-            const result = env.transactionSync(() => {
+            const result = this.writing(env).transactionSync(() => {
                 if (val !== undefined) {
                     // An empty key must still fail, but an over-long one can only be absent.
                     if (key.length > MAX_KEY_BYTES)
@@ -809,7 +828,7 @@ export class LMDBer extends BaseDBer {
             if (keys.length === 0) {
                 return false;
             }
-            env.transactionSync(() => {
+            this.writing(env).transactionSync(() => {
                 for (const key of keys) {
                     db.remove(key);
                 }
@@ -870,7 +889,7 @@ export class LMDBer extends BaseDBer {
         let result = true;
         const existing = new Set(this.getVals(db, key).map((val) => bytesHex(val)));
         const env = this.requireEnv();
-        env.transactionSync(() => {
+        this.writing(env).transactionSync(() => {
             for (const val of vals) {
                 const vh = bytesHex(val);
                 if (existing.has(vh)) {

package/esm/keri/npm/src/db/core/memstore.js

@@ -173,6 +173,10 @@ export class MemStore extends BaseDBer {
         this.assertOpen();
         return __classPrivateFieldGet(this, _MemStore_writeVersion, "f");
     }
+    /** Same count as {@link writeVersion}; in memory, so reading it is free. */
+    get writeActivity() {
+        return __classPrivateFieldGet(this, _MemStore_writeVersion, "f");
+    }
     /** Open or reopen the contents. A readonly open of never-created contents reports `false`. */
     *reopen(options = {}) {
         this.readonly = options.readonly ?? this.readonly;