keri-ts 2.2.4 → 2.2.5

package/esm/keri/npm/src/core/wire-fields.js

@@ -0,0 +1,126 @@
+/**
+ * Guarded readers for the field values of remote messages.
+ *
+ * A remote message can parse and verify its SAID while a field value is still not a valid value for its type: a
+ * non-hex or over-wide sequence number, a key that is not a verification key, a next-key digest that is not a digest,
+ * a prefix that is not a prefix. The cesr accessors and primitive constructors throw on such values, and a throw out
+ * of a processor ends its loop (the mailbox poller, the escrow doer, HTTP ingress). Processor boundaries therefore read
+ * remote field values through these readers and turn a null into their own typed refusal (ADR-0005) before any escrow
+ * decision or store write: `Kevery.decideEvent` and `processReceipt`, the reply route handlers and `Revery`'s
+ * datetime read, `Exchanger` admission and `queryEnvelopeFromDispatch`. Accepted KEL events are remote-authored too:
+ * their raw `a` seals are read through `readEventSeal` wherever an anchor is searched.
+ *
+ * Only the cesr codec's own malformed-input taxonomy (`ParserError` and its subclasses) is read as malformed input, and
+ * only while constructing a primitive from a string the message carried. That construction reads no store, so a
+ * `ParserError` there cannot be corrupt durable state or I/O; every other error propagates. Numbers are checked as
+ * text before any `BigInt` conversion, so cesr's `SyntaxError`/`RangeError` for bad hex is never relied on.
+ */
+import { Dater, Diger, Ilks, NumberPrimitive, ParserError, Prefixer, SealEvent, Verfer, } from "cesr-ts";
+import { encodeDateTimeToDater } from "../time/mod.js";
+/** Construct `Type` from qualified text, or null when the text is not a valid value of that type. */
+function readQualified(Type, value) {
+    if (typeof value !== "string" || !value)
+        return null;
+    try {
+        return new Type({ qb64: value });
+    }
+    catch (error) {
+        if (error instanceof ParserError)
+            return null;
+        throw error;
+    }
+}
+/** Read an identifier prefix (`i`, `di`, `cid`, `eid`, ...), or null when it is not one. */
+export function readPrefixer(value) {
+    return readQualified(Prefixer, value);
+}
+/** Read a digest (`d` of a key state notice, a next-key digest), or null when it is not one. */
+export function readDiger(value) {
+    return readQualified(Diger, value);
+}
+/** Read a verification key (a current key, a witness), or null when it is not one. */
+export function readVerfer(value) {
+    return readQualified(Verfer, value);
+}
+/** Read a datetime (`dt`) as a Dater, or null when it does not encode as one. */
+export function readDater(value) {
+    return typeof value === "string" ? readQualified(Dater, encodeDateTimeToDater(value)) : null;
+}
+/** Read a URL, or null when it does not parse. */
+export function readUrl(value) {
+    return URL.canParse(value) ? new URL(value) : null;
+}
+/**
+ * Read a KERI ordinal: lower- or upper-case hex text, or a non-negative integer number or bigint, as cesr's numeric
+ * ladder accepts them. Null when it is none of those or exceeds `Number.MAX_SAFE_INTEGER`, the largest value the KEL
+ * processors can compare exactly as a number.
+ */
+export function readOrdinal(value) {
+    let ordinal;
+    if (typeof value === "string") {
+        if (!/^[0-9a-f]+$/iu.test(value))
+            return null;
+        ordinal = BigInt(`0x${value}`);
+    }
+    else if (typeof value === "number") {
+        if (!Number.isSafeInteger(value) || value < 0)
+            return null;
+        ordinal = BigInt(value);
+    }
+    else if (typeof value === "bigint") {
+        ordinal = value;
+    }
+    else {
+        return null;
+    }
+    return ordinal >= 0n && ordinal <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(ordinal) : null;
+}
+/** Read a message's `s`, which cesr's `sner` reads only as hex text; null when absent or malformed. */
+export function readSequenceNumber(serder) {
+    const sn = serder.ked?.s;
+    return typeof sn === "string" ? readOrdinal(sn) : null;
+}
+/**
+ * Name the first field of a KEL event whose value the key-state machine would fail to decode, or null when all decode.
+ *
+ * Covers what `Kever` and escrow persistence decode beyond `i` and `s` (which `decideEvent` reads first): current keys
+ * `k` and next-key digests `n` of establishment events, witnesses `b` and witness changes `br`/`ba`, the witness
+ * threshold `bt`, and the delegator `di` of a delegated inception. Thresholds (`kt`, `nt`) already decode to null and are
+ * rejected by `Kever`; raw seals in `a` are not decoded here.
+ */
+export function kelEventFieldDefect(serder) {
+    const ked = serder.ked ?? {};
+    const ilk = serder.ilk;
+    const bad = (label, values, read) => {
+        const value = values.find((entry) => read(entry) === null);
+        return value === undefined ? null : `${label} ${JSON.stringify(value)}`;
+    };
+    return bad("key", serder.keys, readVerfer)
+        ?? bad("next key digest", serder.ndigs, readDiger)
+        ?? bad("witness", serder.backs, readVerfer)
+        ?? bad("witness cut", serder.cuts, readVerfer)
+        ?? bad("witness add", serder.adds, readVerfer)
+        ?? (ked.bt !== undefined && ked.bt !== null && readOrdinal(ked.bt) === null
+            ? `witness threshold ${JSON.stringify(ked.bt)}`
+            : null)
+        ?? (ilk === Ilks.dip && serder.delpre !== null && !readPrefixer(serder.delpre)
+            ? `delegator ${JSON.stringify(serder.delpre)}`
+            : null);
+}
+/**
+ * Read one raw `a` entry as an event seal `{i, s, d}`, or null when it is another seal shape or carries a value that
+ * does not decode.
+ *
+ * An accepted event's seals are not value-checked at acceptance (KERIpy keeps them as raw dicts), so any identifier can
+ * anchor junk in its own KEL. Anchor searches (delegation approval, sealing-event lookup) therefore read each entry
+ * through this reader and skip a null instead of throwing. KERIpy filters by the same field shape
+ * (`tuple(seal) == SealEvent._fields`) and compares raw strings, so a malformed value can never match a real event.
+ */
+export function readEventSeal(value) {
+    if (!SealEvent.isSad(value))
+        return null;
+    const pre = readPrefixer(value.i);
+    const sn = readOrdinal(value.s);
+    const said = readDiger(value.d);
+    return pre && sn !== null && said ? SealEvent.fromTuple([pre, NumberPrimitive.fromNum(BigInt(sn)), said]) : null;
+}

package/esm/keri/npm/src/db/basing.js

@@ -1,11 +1,12 @@
 /** KERI event-log databaser built on `LMDBer` composition. */
-import { b, Cigar, Dater, Diger, Ilks, Labeler, Noncer, NumberPrimitive, NumDex, Prefixer, Saider, SealEvent, SerderKERI, Siger, t, Texter, Verfer, Verser, Vrsn_1_0, } from "cesr-ts";
+import { b, Cigar, Dater, Diger, Ilks, Labeler, Noncer, NumberPrimitive, NumDex, Prefixer, Saider, SerderKERI, Siger, t, Texter, Verfer, Verser, Vrsn_1_0, } from "cesr-ts";
 import { action } from "effection";
 import { attachmentCounterPayloadQb64b, attachmentCounterQb64b, attachmentOrdinal, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
 import { DatabaseOperationError, ValidationError } from "../core/errors.js";
 import { Kever } from "../core/kel/kever.js";
 import { consoleLogger } from "../core/logger.js";
 import { CacheTypeRecord, EndpointRecord, EventSourceRecord, HabitatRecord, KelPublishedRecord, KeyStateRecord, LocationRecord, MsgCacheRecord, ObservedRecord, OobiRecord, RootSentRecord, TopicsRecord, TxnMsgCacheRecord, WellKnownAuthN, } from "../core/records.js";
+import { readEventSeal } from "../core/wire-fields.js";
 import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
 import { dgKey, splitOnKey } from "./core/keys.js";
 import { StoreOwner } from "./core/store-owner.js";
@@ -29,19 +30,9 @@ function isEventSealRecord(value) {
         && value.s instanceof NumberPrimitive
         && value.d instanceof Diger;
 }
+/** Accept an already-typed event seal, or read a raw `{i, s, d}` entry; null for other shapes or bad values. */
 function normalizeEventSeal(value) {
-    if (isEventSealRecord(value)) {
-        return value;
-    }
-    if (!SealEvent.isSad(value)) {
-        return null;
-    }
-    try {
-        return SealEvent.fromSad(value);
-    }
-    catch {
-        return null;
-    }
+    return isEventSealRecord(value) ? value : readEventSeal(value);
 }
 function eventSealsEqual(left, right) {
     return left.i.qb64 === right.i.qb64

package/esm/keri/npm/src/db/core/indexeddb-persistence.js

@@ -25,8 +25,9 @@
  *
  * Another tab's upgrade or delete fires `versionchange` here. The connection
  * closes at once so that tab is never blocked, and this adapter is then lost:
- * its next `load` or `write` rejects, which latches the queue, because writing
- * on after another context deleted the database would break prefix durability.
+ * its next `load` or `write` rejects, and so does every retry of it (a write never
+ * reconnects), which latches the queue, because writing on after another context
+ * deleted the database would break prefix durability.
  * Recovery is a new open, whose `meta` reconnects. Single-writer exclusion is
  * the composition's job, not this adapter's.
  *

package/esm/keri/npm/src/db/core/webdber.js

@@ -9,50 +9,84 @@
  * Invariant: once the queue is joined with no failure, the mirror and the
  * persisted rows are byte-identical, which is why `reopen` joins before it loads.
  */
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
 var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
     if (kind === "m") throw new TypeError("Private method is not writable");
     if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _PersistenceQueue_instances, _PersistenceQueue_tail, _PersistenceQueue_failure, _PersistenceQueue_append, _PersistenceQueue_settled, _WebDBer_instances, _WebDBer_persistence, _WebDBer_queue, _WebDBer_pendingTables, _WebDBer_connected, _WebDBer_enqueue, _WebDBer_takePendingTables, _WebDBer_carryPendingTables;
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _PersistenceQueue_instances, _PersistenceQueue_tail, _PersistenceQueue_failure, _PersistenceQueue_retrying, _PersistenceQueue_retryDelays, _PersistenceQueue_append, _PersistenceQueue_attempt, _PersistenceQueue_latched, _PersistenceQueue_settled, _WebDBer_instances, _WebDBer_persistence, _WebDBer_queue, _WebDBer_pendingTables, _WebDBer_connected, _WebDBer_enqueue, _WebDBer_takePendingTables, _WebDBer_carryPendingTables;
 import { bytesEqual, bytesHex } from "cesr-ts";
 import { call, ensure } from "effection";
-import { DatabaseOperationError } from "../../core/errors.js";
+import { PersistenceLatchedError, PersistenceReadError } from "../../core/errors.js";
 import { MemStore } from "./memstore.js";
+/** Delays in milliseconds before each retry of a failed task: four attempts in about half a second. */
+export const PERSISTENCE_RETRY_DELAYS = Object.freeze([25, 100, 400]);
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * The persistence order of one composition. Tasks run strictly one at a time,
  * outside any Effection scope, so cancelling a waiter never cancels a write.
  *
- * The first failure latches: every later task is skipped, because applying a
- * later batch over a lost earlier one would break prefix durability.
+ * A failed task is retried in place on a fixed short schedule while it holds
+ * the head of the queue, so no later task runs ahead of it. Every task the
+ * library enqueues is safe to re-run: an adapter `write` applies one batch
+ * atomically and idempotently, `clear` deletes what may already be gone, and
+ * `close` releases what may already be released. A task that fails through its
+ * retries latches the queue for good: every later task is skipped, because
+ * applying a later batch over a lost earlier one would break prefix
+ * durability. Recovery is a new composition with a new queue.
  */
 export class PersistenceQueue {
-    constructor() {
+    /** @param retryDelays Delays before each retry; its length is the number of retries. */
+    constructor(retryDelays = PERSISTENCE_RETRY_DELAYS) {
         _PersistenceQueue_instances.add(this);
         _PersistenceQueue_tail.set(this, Promise.resolve());
         _PersistenceQueue_failure.set(this, null);
+        _PersistenceQueue_retrying.set(this, false);
+        _PersistenceQueue_retryDelays.set(this, void 0);
+        __classPrivateFieldSet(this, _PersistenceQueue_retryDelays, [...retryDelays], "f");
     }
-    /** Append a task, which is skipped if an earlier one failed. */
+    /** Append a task, retried on failure; skipped once the queue has latched. Run only re-runnable tasks here. */
     enqueue(task) {
         __classPrivateFieldGet(this, _PersistenceQueue_instances, "m", _PersistenceQueue_append).call(this, task, false);
     }
-    /** Append connection teardown, which still runs after a failure so a handle is not left open. */
+    /** Append connection teardown, which still runs, once, after a latch so a handle is not left open. */
     release(task) {
         __classPrivateFieldGet(this, _PersistenceQueue_instances, "m", _PersistenceQueue_append).call(this, task, true);
     }
-    /** Refuse new work once latched. The original failure is the cause. */
+    /**
+     * Run `task` after everything enqueued before this call, and resolve with its result. It sees every earlier
+     * commit durable, except after a latch, when it runs anyway and sees only the durable prefix; check `status()`.
+     * Nothing enqueued after it runs until it settles. A throwing `task` rejects only this caller, with
+     * `PersistenceReadError`; it is not retried and never latches the queue.
+     */
+    read(task) {
+        const result = __classPrivateFieldGet(this, _PersistenceQueue_tail, "f").then(async () => {
+            try {
+                return await task();
+            }
+            catch (error) {
+                throw new PersistenceReadError("Persistence read failed", { cause: error });
+            }
+        });
+        __classPrivateFieldSet(this, _PersistenceQueue_tail, result.then(() => { }, () => { }), "f");
+        return result;
+    }
+    /** The queue's state now; `retrying` lasts only while the head task is between attempts. */
+    status() {
+        if (__classPrivateFieldGet(this, _PersistenceQueue_failure, "f"))
+            return "latched";
+        return __classPrivateFieldGet(this, _PersistenceQueue_retrying, "f") ? "retrying" : "healthy";
+    }
+    /** Refuse new work once latched, with `PersistenceLatchedError` whose cause is the original failure. */
     assertHealthy() {
-        if (__classPrivateFieldGet(this, _PersistenceQueue_failure, "f")) {
-            throw new DatabaseOperationError("Persistence failed; this composition accepts no more commits", {
-                cause: __classPrivateFieldGet(this, _PersistenceQueue_failure, "f").error,
-            });
-        }
+        if (__classPrivateFieldGet(this, _PersistenceQueue_failure, "f"))
+            throw __classPrivateFieldGet(this, _PersistenceQueue_instances, "m", _PersistenceQueue_latched).call(this, __classPrivateFieldGet(this, _PersistenceQueue_failure, "f").error);
     }
     /** Wait until everything enqueued before this call is durable. Halting cancels only the wait. */
     *flushed() {
@@ -68,22 +102,46 @@ export class PersistenceQueue {
         });
     }
 }
-_PersistenceQueue_tail = new WeakMap(), _PersistenceQueue_failure = new WeakMap(), _PersistenceQueue_instances = new WeakSet(), _PersistenceQueue_append = function _PersistenceQueue_append(task, always) {
+_PersistenceQueue_tail = new WeakMap(), _PersistenceQueue_failure = new WeakMap(), _PersistenceQueue_retrying = new WeakMap(), _PersistenceQueue_retryDelays = new WeakMap(), _PersistenceQueue_instances = new WeakSet(), _PersistenceQueue_append = function _PersistenceQueue_append(task, always) {
     __classPrivateFieldSet(this, _PersistenceQueue_tail, __classPrivateFieldGet(this, _PersistenceQueue_tail, "f").then(async () => {
-        if (__classPrivateFieldGet(this, _PersistenceQueue_failure, "f") && !always)
+        if (!__classPrivateFieldGet(this, _PersistenceQueue_failure, "f"))
+            return await __classPrivateFieldGet(this, _PersistenceQueue_instances, "m", _PersistenceQueue_attempt).call(this, task);
+        if (!always)
             return;
         try {
             await task();
         }
-        catch (error) {
-            __classPrivateFieldSet(this, _PersistenceQueue_failure, __classPrivateFieldGet(this, _PersistenceQueue_failure, "f") ?? { error }, "f");
+        catch {
+            // Already latched; the recorded failure is the one reported.
         }
     }), "f");
+}, _PersistenceQueue_attempt = 
+/** Run `task`, retrying it in place on the schedule, and latch with its first failure when every attempt fails. */
+async function _PersistenceQueue_attempt(task) {
+    let first = null;
+    try {
+        for (let attempt = 0;; attempt++) {
+            try {
+                return await task();
+            }
+            catch (error) {
+                first ??= { error };
+                if (attempt >= __classPrivateFieldGet(this, _PersistenceQueue_retryDelays, "f").length) {
+                    __classPrivateFieldSet(this, _PersistenceQueue_failure, first, "f");
+                    return;
+                }
+            }
+            __classPrivateFieldSet(this, _PersistenceQueue_retrying, true, "f");
+            await pause(__classPrivateFieldGet(this, _PersistenceQueue_retryDelays, "f")[attempt]);
+        }
+    }
+    finally {
+        __classPrivateFieldSet(this, _PersistenceQueue_retrying, false, "f");
+    }
+}, _PersistenceQueue_latched = function _PersistenceQueue_latched(cause) {
+    return new PersistenceLatchedError("Persistence failed; this composition accepts no more commits", { cause });
 }, _PersistenceQueue_settled = function _PersistenceQueue_settled() {
-    return __classPrivateFieldGet(this, _PersistenceQueue_tail, "f").then(() => {
-        if (__classPrivateFieldGet(this, _PersistenceQueue_failure, "f"))
-            throw __classPrivateFieldGet(this, _PersistenceQueue_failure, "f").error;
-    });
+    return __classPrivateFieldGet(this, _PersistenceQueue_tail, "f").then(() => this.assertHealthy());
 };
 function sameValue(a, c) {
     return a === null || c === null ? a === c : bytesEqual(a, c);
@@ -120,7 +178,7 @@ function netVersion(changes) {
  * readable even though it was never persisted, and every later transaction
  * throws before touching the mirror, so the mirror stops changing. The durable
  * state is a prefix of the commit sequence. Recovery is a new composition, with
- * a new queue, loading that prefix; there is no retry.
+ * a new queue, loading that prefix; the queue's own retries happen before it latches.
  */
 export class WebDBer extends MemStore {
     constructor(options, persistence, queue) {

package/esm/keri/npm/src/db/mailbox/mailboxing.js

@@ -15,8 +15,21 @@
  */
 import { Diger, MtrDex } from "cesr-ts";
 import { DatabaseNotOpenError } from "../../core/errors.js";
+import { MAX_KEY_BYTES } from "../core/dber.js";
+import { onKey } from "../core/keys.js";
 import { StoreOwner } from "../core/store-owner.js";
 import { CesrOnSuber, Suber } from "../subing.js";
+/**
+ * Whether `topic` can index a stored message: its `.tpcs` row key, `<topic>.<32 hex ordinal>`, fits the store's key
+ * limit (ADR-0015). A longer topic makes {@link Mailboxer.storeMsg} fail with `DatabaseKeyError`, a store fault, so a
+ * caller holding a topic another party chose checks it here before storing.
+ *
+ * @param topic Complete mailbox topic key, as `mailboxTopicKey` builds it.
+ * @returns True when a message can be stored under the topic.
+ */
+export function storableTopic(topic) {
+    return onKey(topic, 0).length <= MAX_KEY_BYTES;
+}
 /** Raw-byte value family used for stored mailbox message bodies. */
 class BytesSuber extends Suber {
     _ser(val) {

package/esm/keri/npm/src/db/subing.js

@@ -838,6 +838,10 @@ export class CryptSignerSuber extends SignerSuber {
             : val;
         return this.db.setVal(this.sdb, this._tokey(keys), signerToStored(stored));
     }
+    /** Whether a signer is stored at `keys`; reads the raw row and never decrypts it. */
+    has(keys) {
+        return this.db.getVal(this.sdb, this._tokey(keys)) !== null;
+    }
     /**
      * Read one signer, decrypting the stored ciphertext when a decrypter exists.
      *

package/esm/keri/npm/src/runtime/index.js

@@ -33,6 +33,7 @@ export { importCredentialStream, } from "../app/credentials/credential-importing
 export { deliverCredentialRevocation, revokeCredential, } from "../app/credentials/credential-revoking.js";
 export { createCredential, credentialRegistryRecords, credentialRegistryStatus, exportCredentialStream, inceptCredentialRegistry, listCredentials, pinSchemaBytes, } from "../app/credentials/credential-workflows.js";
 export { Poster, } from "../app/delivery/forwarding.js";
+export { assertRelay, relayAuthorized, relayEndpoint, relayOnboarding, RelayOnlyError, relayOnlyHttpClient, relayRefusal, RelayUnauthorizedError, RelayUnresolvedError, } from "../app/delivery/relaying.js";
 export { EssrRecipient, } from "../app/exchanges/essr.js";
 export { createExchangeMessage, sendExchangeMessage, } from "../app/exchanges/exchange-messaging.js";
 export { Exchanger, RouteRefuser, } from "../app/exchanges/exchanging.js";
@@ -43,15 +44,17 @@ export { beginDelegation, completeEvent, DELEGATION_WAIT_TIMEOUT_MS, delegationS
 export { acceptedEventReplayMessage, Hab, Habery, openHabery, } from "../app/identity/habbing.js";
 export { Algos, Manager, SignerNotHeldError, } from "../app/identity/keeping.js";
 export { Organizer, } from "../app/identity/organizing.js";
+export { exportDisclosureStream, listGroupDisclosures, } from "../app/ipex/disclosure-replaying.js";
 export { IpexAdmitter } from "../app/ipex/ipex-admitting.js";
 export { ipexExnBody, prepareIpexExn } from "../app/ipex/ipex-building.js";
 export { credentialPresentationArtifacts, credentialSaidFromGrant, ipexCredentialAdmit, ipexCredentialGrant, processCredentialPresentationArtifacts, storedGrantArtifacts, } from "../app/ipex/ipex-credentialing.js";
-export { anchorExchange as anchorIpexExchange, exchangeWire, IpexDiscloser, storedExchangeWire, } from "../app/ipex/ipex-discloser.js";
+export { anchorExchange as anchorIpexExchange, attachPresentationProof, exchangeWire, IpexDiscloser, storedExchangeWire, } from "../app/ipex/ipex-discloser.js";
 export { walkIpexGraph } from "../app/ipex/ipex-graph.js";
 export { approveStoredMultisigIpexWrappers, prepareAcdcV2GroupIpex, publishInitialGroupIpex, requireAcdcV2GroupUse, sendCompletedGroupIpex, } from "../app/ipex/ipex-grouping.js";
 export { acceptedRegistryEvidence, authenticateIpexNode, issuedNodeVerdict, } from "../app/ipex/ipex-node-authentication.js";
 export { ipexGrantWalk } from "../app/ipex/ipex-v2.js";
 export { IPEX_GRANT_ROUTE, IPEX_ROUTES, ipexAdmitExn, ipexAgreeExn, ipexApplyExn, ipexGrantExn, ipexOfferExn, ipexSpurnExn, } from "../app/ipex/ipexing.js";
+export { keepRawArrival } from "../app/mailbox/agent-inbox.js";
 export { KEL_PUBLISHER_PACING, KEL_PUBLISHER_SWEEP_TOCKS, KEL_PUBLISHER_TOCK_MS, KelPublisher, kelPublisherDo, } from "../app/mailbox/kel-publisher.js";
 export { addMailbox, completeGroupMailbox, completeMailboxAdmin, mailboxAdminUrl, mailboxStatus, proposeGroupMailbox, removeMailbox, requireMailboxEndpointUrl, waitForMailboxState, } from "../app/mailbox/mailbox-admin.js";
 export { MailboxDirector, } from "../app/mailbox/mailbox-director.js";
@@ -64,11 +67,11 @@ export { Multiplexor, MULTISIG_ROUTES, multisigExn, multisigExnBody, multisigInc
 export { signGroupMessage } from "../app/multisig/multisig-messaging.js";
 export { approveAcdcV2Registry, publishAcdcV2Registry } from "../app/multisig/multisig-workflows.js";
 export { approveGroupProposal, dismissGroupProposal, findGroupProposal, listGroupProposals, } from "../app/multisig/proposals.js";
-export { proposeCredentialIssue, proposeCredentialRegistry, proposeCredentialRevocation, proposeGroupInception, proposeGroupInteraction, proposeGroupRotation, proposeRegistryEvent, settleProposedRotation, } from "../app/multisig/proposing.js";
+export { proposeCredentialIssue, proposeCredentialRegistry, proposeCredentialRevocation, proposeGroupInception, proposeGroupInteraction, proposeGroupRotation, proposeRegistryEvent, } from "../app/multisig/proposing.js";
+export { rejoinGroup, } from "../app/multisig/rejoin-group.js";
 export { replaceGroupMember, } from "../app/multisig/replace-member.js";
 export { Notifier, } from "../app/notifications/notifying.js";
 export { Signal, Signaler, } from "../app/notifications/signaling.js";
-export { SignerConditions } from "../app/runtime/signer-conditions.js";
 export { RawRecord } from "../core/records.js";
 export { Verifier, } from "../app/credentials/verifying.js";
 export { witnessKeyStateGet, witnessQueryGet, witnessReceiptGet, witnessReceiptPost, } from "../app/witness/http-endpoints.js";
@@ -87,12 +90,13 @@ export { deliverRegistryRoots, replicateRootCopies, replicateRootCopy, resealRoo
 export { RootReplicator, } from "../app/credentials/root-replicator.js";
 export { publishPendingTel } from "../app/credentials/tel-publishing.js";
 export { Deck } from "../core/deck.js";
-export { AppError, DatabaseError, DatabaseKeyError, DatabaseNotOpenError, DatabaseOperationError, InvalidPathNameError, PathError, PresentationClosedError, ValidationError, } from "../core/errors.js";
+export { AppError, DatabaseError, DatabaseKeyError, DatabaseNotOpenError, DatabaseOperationError, InvalidPathNameError, KramRefusedError, MissingDurableStateError, PathError, PersistenceLatchedError, PersistenceReadError, PresentationClosedError, ValidationError, } from "../core/errors.js";
 export { verifyExchangeProofs } from "../core/exchange/exchange-proofing.js";
 export { exchange } from "../core/exchange/protocol-exchanging.js";
 export { Kevery, } from "../core/kel/eventing.js";
 export { Kever, } from "../core/kel/kever.js";
 export { consoleLogger, getLogLevel, LOG_LEVELS, noopLogger, setLogLevel, } from "../core/logger.js";
+export { isKramLateReason, } from "../core/mailbox/kram-time.js";
 export { DEFAULT_KRAM_CACHES, Kramer } from "../core/mailbox/kraming.js";
 export { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, normalizeMbxTopicCursor, OOBI_MAILBOX_TOPIC, RECEIPT_MAILBOX_TOPIC, REPLAY_MAILBOX_TOPIC, REPLY_MAILBOX_TOPIC, } from "../core/mailbox/mailbox-topics.js";
 export { incept, interact, query, reply, rotate } from "../core/protocol-eventing.js";
@@ -145,13 +149,15 @@ export { abandonUnblinding, answerUnblind, requestUnblind, unblindingKey, Unblin
 // Fixed-tock doers.
 export { doEvery } from "../app/runtime/doing.js";
 // Operations owners composed by the runtime.
-export { OWNER_PACING, OWNER_SWEEP_TOCKS, OWNER_TOCK_MS, OwnerHealth, } from "../app/runtime/operation-owners.js";
+export { OWNER_PACING, OWNER_SWEEP_TOCKS, OWNER_TOCK_MS, } from "../app/runtime/operation-owners.js";
 // Library delegator approval (list, approve, status, wait, dismiss).
 export { approveDelegation, DELEGATION_APPROVAL_TIMEOUT_MS, delegationApprovalStatus, dismissDelegation, listPendingDelegations, proposeGroupDelegationApproval, requestDelegatedEvent, settleDelegationApproval, waitForDelegationAnchor, waitForDelegationApproval, waitForPendingDelegation, } from "../app/identity/delegation-approval.js";
 // Library TEL completion status/waits and challenge respond/status/wait.
 export { REGISTRY_WAIT_POLL_MS, registryEventRef, registryEventStatus, settleRegistryEvent, waitForRegistryEvent, } from "../app/credentials/registry-settling.js";
 export { issuedCredentialStatus, telEventStatus, waitForIssuedCredential, waitForTelEvent, } from "../app/credentials/tel-completion.js";
 export { challengeStatus, respondToChallenge, waitForChallengeResponse, } from "../app/identity/challenging.js";
+// Runtime-level retirement: retireHab plus mailbox workers, cursors and KEL publisher rows.
+export { retireIdentifier, retireIdentifierRefusal, } from "../app/identity/retire-identifier.js";
 // Library legacy IPEX conversation (apply, offer, agree, spurn; status and wait).
 export { ipexExchangeStatus, requireIpexPrior, requireIpexSender, sendIpexAgree, sendIpexApply, sendIpexOffer, sendIpexSpurn, waitForIpexExchange, } from "../app/ipex/ipex-conversation.js";
 // Library legacy IPEX grant, admit and credential settle.

package/esm/keri/npm/src/time/mod.js

@@ -44,3 +44,8 @@ export function timestampMicros(value) {
     const epoch = Date.parse(`${base}${zone}`);
     return Number.isFinite(epoch) ? BigInt(epoch) * 1000n + BigInt(fraction.padEnd(6, "0")) : null;
 }
+/** Format epoch microseconds in the same fixed-width UTC text as `makeNowIso8601`, keeping microsecond precision. */
+export function timestampFromMicros(micros) {
+    const whole = makeNowIso8601(new Date(Number(micros / 1000n)));
+    return whole.replace(/\.\d{6}/, `.${(micros % 1000000n).toString().padStart(6, "0")}`);
+}

package/esm/keri/npm/src/vdr/credential-tsn-record.js

@@ -1,5 +1,5 @@
-import { Diger } from "cesr-ts";
 import { VcStateRecord } from "../core/records.js";
+import { readDiger } from "../core/wire-fields.js";
 import { timestampMicros } from "../time/mod.js";
 import { qualifiedPrefix } from "./registry-tsn-record.js";
 /** Legacy storage ordinals are safe integers even though protocol numbers may be wider. */
@@ -9,12 +9,7 @@ function ordinal(value) {
 }
 /** Require the full qualified digest rather than accepting trailing bytes. */
 function qualifiedDigest(value) {
-    try {
-        return typeof value === "string" && new Diger({ qb64: value }).qb64 === value;
-    }
-    catch {
-        return false;
-    }
+    return readDiger(value)?.qb64 === value;
 }
 /** Validate unknown fields and construct an owned record without erasing its guarantees. */
 export function credentialRecord(data) {

package/esm/keri/npm/src/vdr/eventing.js

@@ -17,8 +17,9 @@ import { Kever } from "../core/kel/kever.js";
 import { consoleLogger } from "../core/logger.js";
 import { projectRegistrySeal, state as registryState, vcstate as credentialState, } from "../core/protocol-vdr-eventing.js";
 import { acceptReplyDecision, unverifiedReplyDecision, } from "../core/routing.js";
+import { readDater, readSequenceNumber } from "../core/wire-fields.js";
 import { dgKey } from "../db/core/keys.js";
-import { encodeDateTimeToDater, makeNowIso8601, timestampMicros } from "../time/mod.js";
+import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
 import { backerThreshold, resolveBackerState } from "./backer-state.js";
 import { credentialRecord } from "./credential-tsn-record.js";
 import { qualifiedPrefix, registryRecord } from "./registry-tsn-record.js";
@@ -43,17 +44,21 @@ function okSaid(serder) {
     }
     return serder.said;
 }
+/** The event's `i`, which must be exactly one qualified prefix: TEL escrows key rows by it and split keys on `.`. */
 function okPre(serder) {
-    if (!serder.pre) {
-        throw new ValidationError("TEL event missing prefix.");
+    const pre = serder.pre;
+    if (!qualifiedPrefix(pre)) {
+        throw new ValidationError(`TEL event prefix ${JSON.stringify(pre)} is missing or not a qualified prefix.`);
     }
-    return serder.pre;
+    return pre;
 }
+/** The event's hex `s`, read without cesr's throwing `sn` getter; a missing, non-hex or unsafe value is refused. */
 function okSn(serder) {
-    if (serder.sn === null) {
-        throw new ValidationError("TEL event missing sequence number.");
+    const sn = readSequenceNumber(serder);
+    if (sn === null) {
+        throw new ValidationError(`TEL event sequence number ${JSON.stringify(serder.ked?.s)} is missing or malformed.`);
     }
-    return serder.sn;
+    return sn;
 }
 function okKed(serder) {
     if (!serder.ked) {
@@ -785,6 +790,10 @@ export class Tevery {
         try {
             decision = this.reger.transaction(() => {
                 const serder = args.serder;
+                // Parsed wire bodies are not SAID-checked by the parser. An unverified body would be stored in escrow, then
+                // fail re-parsing on every escrow pass, and could pre-empt the genuine event holding the same anchored `d`.
+                if (!serder.verify())
+                    return reject("TEL event body does not verify against its SAID.", serder);
                 const ilk = telIlk(serder);
                 const pre = okPre(serder);
                 const sn = okSn(serder);
@@ -951,8 +960,9 @@ export class Tevery {
     processReplyRegistryTxnState({ serder, diger, route, aid, cigars = [], tsgs = [] }) {
         const rvy = this.replyVerifier();
         const record = registryRecord(serder.ked?.a);
-        const stamp = serder.ked?.dt;
-        if (!record || !qualifiedPrefix(aid) || typeof stamp !== "string" || timestampMicros(stamp) === null
+        // A `dt` that parses as a timestamp can still fail to encode as a Dater (no fraction, `Z`); read it once here.
+        const dater = readDater(serder.ked?.dt);
+        if (!record || !qualifiedPrefix(aid) || !dater
             || route !== `/tsn/registry/${aid}`
             || serder.said !== diger.qb64 || !serder.verify()) {
             return unverifiedReplyDecision("Invalid registry transaction-state notice.");
@@ -991,7 +1001,7 @@ export class Tevery {
                 aid,
                 serder,
                 diger,
-                dater: new Dater({ qb64: encodeDateTimeToDater(stamp) }),
+                dater,
                 cigars,
                 tsgs,
             });
@@ -1061,7 +1071,6 @@ export class Tevery {
         if (fields.some((key) => JSON.stringify(record[key]) !== JSON.stringify(stored[key]))) {
             return reject("Registry state metadata mismatch.");
         }
-        const dater = new Dater({ qb64: encodeDateTimeToDater(stamp) });
         const cues = [{ kin: "txnStateSaved", record }];
         rvy.writeReply(proof);
         this.reger.txnsb.updateReply(aid, serder, diger, dater);
@@ -1077,8 +1086,8 @@ export class Tevery {
     processReplyCredentialTxnState({ serder, diger, route, aid, cigars = [], tsgs = [] }) {
         const rvy = this.replyVerifier();
         const record = credentialRecord(serder.ked?.a);
-        const stamp = serder.ked?.dt;
-        if (!record || !qualifiedPrefix(aid) || typeof stamp !== "string" || timestampMicros(stamp) === null
+        const dater = readDater(serder.ked?.dt);
+        if (!record || !qualifiedPrefix(aid) || !dater
             || route !== `/tsn/credential/${aid}` || serder.said !== diger.qb64 || !serder.verify())
             return unverifiedReplyDecision("Invalid credential transaction-state notice.");
         const vci = record.i, regk = record.ri, sn = Number.parseInt(record.s, 16);
@@ -1118,7 +1127,7 @@ export class Tevery {
                 aid,
                 serder,
                 diger,
-                dater: new Dater({ qb64: encodeDateTimeToDater(stamp) }),
+                dater,
                 cigars,
                 tsgs,
             });
@@ -1198,7 +1207,7 @@ export class Tevery {
             return reject("Credential state does not match current accepted TEL and anchors.");
         const cues = [{ kin: "txnStateSaved", record }];
         rvy.writeReply(proof);
-        this.reger.txnsb.updateReply(aid, serder, diger, new Dater({ qb64: encodeDateTimeToDater(stamp) }));
+        this.reger.txnsb.updateReply(aid, serder, diger, dater);
         if (previous?.qb64 !== diger.qb64)
             rvy.removeReply(previous);
         if (queryCues.length)
@@ -1335,8 +1344,8 @@ export class Tevery {
             case Ilks.iss:
             case Ilks.rev: {
                 const regk = stringField(okKed(serder), "ri");
-                if (!regk) {
-                    throw new ValidationError("TEL credential event missing ri.");
+                if (!qualifiedPrefix(regk)) {
+                    throw new ValidationError("TEL credential event missing or malformed ri.");
                 }
                 return regk;
             }
@@ -1344,8 +1353,8 @@ export class Tevery {
             case Ilks.brv: {
                 const ra = sealRecord(okKed(serder).ra);
                 const regk = ra && "i" in ra && typeof ra.i === "string" ? ra.i : null;
-                if (!regk) {
-                    throw new ValidationError("Backer TEL event missing ra.i.");
+                if (!qualifiedPrefix(regk)) {
+                    throw new ValidationError("Backer TEL event missing or malformed ra.i.");
                 }
                 return regk;
             }