keri-ts 2.2.4 → 2.2.6

package/esm/keri/npm/src/app/identity/habbing.js

@@ -277,21 +277,22 @@ export class Hab {
         return !!this.pre && this.db.getKever(this.pre) !== null;
     }
     /**
-     * Whether the held or stored signing keys currently allow this habitat to sign.
-     * False for a keyless habitat (`makeSignedHab`) until the host holds its signer.
+     * Whether this habitat can sign now: every key `sign` would use has a held or stored signer
+     * (`Manager.hasSigner`). A pure read that signs nothing. False for a keyless habitat (`makeSignedHab`) until the
+     * host holds its signer, and for a habitat with no signing keys (no accepted state, or a group whose local member
+     * has no contribution). A group answers through its local member's contribution.
+     *
+     * Background loops read it before they sign and skip a habitat that cannot sign yet; a later `Manager.hold` lets
+     * the habitat act on the next tock.
      */
     canSign() {
-        try {
-            const probe = new Uint8Array(1);
-            if (this.kever?.transferable === false)
-                this.sign(probe, false);
-            else
-                this.sign(probe, true);
-            return true;
-        }
-        catch {
-            return false;
-        }
+        const keys = this.signingKeys();
+        return keys.kind === "keys" && keys.pubs.every((pub) => this.mgr.hasSigner(pub));
+    }
+    /** The current public keys `sign` would use whose signers are neither held nor stored; empty when it can sign. */
+    missingSigners() {
+        const keys = this.signingKeys();
+        return keys.kind === "keys" ? keys.pubs.filter((pub) => !this.mgr.hasSigner(pub)) : [];
     }
     /** Return the live accepted-state `Kever` for this habitat when available. */
     get kever() {
@@ -408,8 +409,32 @@ export class Hab {
      * - mirrors the pattern where local inception is signed in the habitat layer
      *   and then fed through `Kevery.processEvent()` rather than hand-writing
      *   `states.`/`kels.` directly
+     *
+     * Failure leaves nothing behind: the Keeper rows `Manager.incept` and `move`
+     * wrote roll back with the enclosing Keeper transaction, and the `habs.`
+     * record and `names.` mapping are undone, as `makeSigned` does. KERIpy keeps
+     * them.
      */
     make(args = {}) {
+        const ns = this.ns ?? "";
+        const priorName = this.db.getName(ns, this.name);
+        try {
+            this.ks.transaction(() => this.inceptLocally(args));
+        }
+        catch (error) {
+            if (this.pre && !args.hidden) {
+                this.db.habs.rem(this.pre);
+                if (priorName)
+                    this.db.pinName(ns, this.name, priorName);
+                else
+                    this.db.names.rem([ns, this.name]);
+            }
+            this.pre = "";
+            throw error;
+        }
+    }
+    /** Derive keys, sign and admit the inception; `make` owns the Keeper transaction and the rollback. */
+    inceptLocally(args) {
         const { code = "E", transferable = true, isith = undefined, icount = 1, icode = undefined, nsith = undefined, ncount = undefined, ncode = undefined, toad = 0, wits = [], delpre = undefined, estOnly = false, DnD = false, hidden = false, data = [], algo = undefined, salt = undefined, tier = undefined, version = Vrsn_2_0, } = args;
         let nextCount = ncount ?? icount;
         let nextSith = nsith ?? isith;
@@ -660,43 +685,43 @@ export class Hab {
         return this.mgr.decrypt(ser, { verfers: verfers ?? kever.verfers });
     }
     sign(ser, indexed = false) {
-        if (!this.pre) {
-            throw new ValidationError("Signing requires a local habitat prefix.");
-        }
-        const kever = this.kever;
-        if (!kever) {
-            throw new ValidationError(`Missing accepted key state for ${this.pre}.`);
-        }
-        const pubs = kever.verfers.map((verfer) => verfer.qb64);
-        const member = this.db.getHab(this.pre)?.mid;
-        if (member) {
-            const state = this.db.getKever(member);
-            if (!state)
-                throw new ValidationError(`Missing accepted member key state for ${member}.`);
-            // KERIpy GroupHab.sign/fetchLatestContribTo: a member may have rotated
-            // ahead of its contribution to the group's currently accepted key list.
-            const contribution = latestGroupContribution(this.db, member, kever.verfers);
-            if (contribution) {
-                const { index, verfer } = contribution;
-                if (indexed) {
-                    // Endorsement proves current authority only. Rotation signatures have
-                    // a separate prior-next commitment path in rotateGroupHab().
-                    return this.mgr.sign(ser, {
-                        pubs: [verfer.qb64],
-                        indexed: true,
-                        indices: [index],
-                        ondices: [null],
-                    });
-                }
-                return this.mgr.sign(ser, [verfer.qb64], false);
-            }
-            throw new ValidationError(`Member ${member} has no contribution to group ${this.pre}.`);
+        const keys = this.signingKeys();
+        if (keys.kind === "none")
+            throw new ValidationError(keys.reason);
+        const { pubs, index } = keys;
+        if (index !== null && indexed) {
+            // Endorsement proves current authority only. Rotation signatures have
+            // a separate prior-next commitment path in rotateGroupHab().
+            return this.mgr.sign(ser, { pubs, indexed: true, indices: [index], ondices: [null] });
         }
         if (indexed) {
             return this.mgr.sign(ser, pubs, true);
         }
         return this.mgr.sign(ser, pubs, false);
     }
+    /**
+     * Select the keys `sign` uses. A group habitat uses only its designated member's latest single-key contribution,
+     * located in its accepted KEL; any other habitat uses its accepted current keys.
+     */
+    signingKeys() {
+        if (!this.pre)
+            return { kind: "none", reason: "Signing requires a local habitat prefix." };
+        const kever = this.kever;
+        if (!kever)
+            return { kind: "none", reason: `Missing accepted key state for ${this.pre}.` };
+        const member = this.db.getHab(this.pre)?.mid;
+        if (!member)
+            return { kind: "keys", pubs: kever.verfers.map((verfer) => verfer.qb64), index: null };
+        if (!this.db.getKever(member)) {
+            return { kind: "none", reason: `Missing accepted member key state for ${member}.` };
+        }
+        // KERIpy GroupHab.sign/fetchLatestContribTo: a member may have rotated
+        // ahead of its contribution to the group's currently accepted key list.
+        const contribution = latestGroupContribution(this.db, member, kever.verfers);
+        if (!contribution)
+            return { kind: "none", reason: `Member ${member} has no contribution to group ${this.pre}.` };
+        return { kind: "keys", pubs: [contribution.verfer.qb64], index: contribution.index };
+    }
     /**
      * Endorse one already-built KERI message body with this habitat's current
      * establishment keys.
@@ -1357,42 +1382,44 @@ export class Habery {
             }
             hab.reconfigure();
         }
-        // Restart recovery: commit members of an accepted establishment event
-        // whose live commit was interrupted. Read-only openings never write.
-        for (const pre of this.readonly ? [] : this.habs.keys()) {
-            this.recoverAcceptedGroupMembers(pre);
+        // Restart recovery: a group whose establishment event was accepted while no runtime aligned its members.
+        for (const pre of this.habs.keys()) {
+            this.alignGroupMembers(pre);
         }
     }
     /**
-     * Commit the members of a local group's latest accepted establishment event
-     * when the stored record is stale (KERIpy `GroupHab.recoverAcceptedMembers`).
+     * Bring a local group's stored members (`smids`/`rmids` on its habitat record and in the keeper) in line with
+     * the group's latest accepted establishment event. This is the one writer of a local group's member lists after
+     * its record is created; acceptance, reopen recovery, member replacement and a proposer's immediate acceptance
+     * all reach it, and the runtime's Counselor calls it on its pass after each accepted establishment event, so a
+     * rotation that completes late (a co-member's signature arriving after the proposer stopped waiting) is followed
+     * without any caller asking.
+     *
+     * Members come from accepted key state only (`acceptedGroupMembers`, KERIpy `GroupHab.acceptedMembers`), never
+     * from a proposal's or caller's lists: the stored members are tried first, then every AID with local key state.
+     * When a key cannot be attributed yet nothing is written and the result is `unattributed`; a partial list is
+     * never stored. Only the latest accepted event is followed, so members never roll back, and repeating it
+     * changes nothing.
      *
-     * A process that stopped after a rotation was accepted but before its live
-     * `commitAcceptedGroupMembers` leaves `smids`/`rmids` stale. Members are
-     * derived from local KELs, trying the stored members first and every AID
-     * with local key state only when they do not account for every key. They
-     * are committed only when they differ from the stored record and the local
-     * member contributes to that event; a record that does not yet include the
-     * local member is a pending join, not a stale commit. Only the latest
-     * accepted event is committed, so this never rolls members back, and
-     * repeating it changes nothing. Returns whether stale members were committed.
+     * The recorded local member (`mid`) is never changed here; replacing it stays `joinGroupHab`'s explicit
+     * replacement. Diverging from KERIpy `GroupHab.recoverAcceptedMembers`, the lists follow accepted state even
+     * when it does not include the local member (a member rotated out, or one whose join is not accepted yet).
+     * Weight plays no part: a member whose signing weight is 0 is a member like any other.
      */
-    recoverAcceptedGroupMembers(pre) {
+    alignGroupMembers(pre) {
         const record = this.db.getHab(pre);
-        if (!record?.mid || record.sid || !this.habs.has(record.mid))
-            return false;
+        if (this.readonly || !record?.mid || record.sid || !this.habs.has(record.mid))
+            return "unchanged";
         const smids = [...(record.smids ?? [])], rmids = [...(record.rmids ?? [])];
         const accepted = acceptedGroupMembers(this.db, pre, new Set([...smids, ...rmids]))
             ?? acceptedGroupMembers(this.db, pre, [...this.db.states.getTopItemIter()].map(([keys]) => keys.join(".")));
         if (!accepted)
-            return false;
+            return "unattributed";
         const same = (left, right) => left.length === right.length && left.every((aid, index) => aid === right[index]);
         if (same(accepted.smids, smids) && same(accepted.rmids, rmids))
-            return false;
-        if (!accepted.smids.includes(record.mid) && !accepted.rmids.includes(record.mid))
-            return false;
+            return "unchanged";
         this.commitGroupHabMembers(pre, accepted.smids, accepted.rmids);
-        return true;
+        return "aligned";
     }
     /** Local AID prefixes currently managed by this habery. */
     get prefixes() {
@@ -1596,8 +1623,8 @@ export class Habery {
         }
         this.habs.set(pre, hab);
         if (replacing && !this.readonly) {
-            // The stored lists must follow accepted state, which the old member's record kept from being committed.
-            this.recoverAcceptedGroupMembers(pre);
+            // The stored lists must follow accepted state, whatever lists the caller passed.
+            this.alignGroupMembers(pre);
             this.retireGroupMemberState(pre, existingRecord.mid);
         }
         return hab;
@@ -1621,7 +1648,7 @@ export class Habery {
                 this.db.rrsn.rem(keys);
         }
     }
-    /** Commit accepted group member metadata after the corresponding group event is accepted. */
+    /** Write member lists already derived from accepted state; only `alignGroupMembers` calls this. */
     commitGroupHabMembers(pre, smids, rmids = smids) {
         const record = this.db.getHab(pre);
         if (!record?.mid) {
@@ -1696,8 +1723,9 @@ export class Habery {
         if (decision.kind === "reject") {
             throw new ValidationError(decision.message);
         }
+        // Accepted on local signatures alone: the members follow it now. Otherwise they follow when it is accepted.
         if (serder.sn !== null && serder.said && this.db.kels.getLast(hab.pre, serder.sn) === serder.said) {
-            this.commitGroupHabMembers(hab.pre, signingMembers, rotationMembers);
+            this.alignGroupMembers(hab.pre);
         }
         return {
             hab,
@@ -1872,6 +1900,97 @@ export class Habery {
         this.habs.set(pre, hab);
         return hab;
     }
+    /**
+     * Retire one local, non-group habitat: it stops being local, and its stored private keys are deleted.
+     *
+     * Removed, durable rows in one `db.transaction` (the Keeper deletes run in a nested Keeper transaction, see
+     * `Manager.forget`): the `habs.` record, its `names.` mapping when that still maps to `pre`, and the
+     * Keeper's stored key rows. After commit, `pre` leaves `db.prefixes`, `habs` and `deferredReconfigure`.
+     *
+     * Kept, deliberately: the KEL with its attachments, `states.`, receipts, key-state notices, every accepted
+     * reply the identifier authored or that names it (end-role and location records and their BADA date-times
+     * and signatures), and the `Kever` cache entry. KERI never deletes a KEL, and BADA/RUN acceptance compares
+     * new replies against the stored ones, so deleting them would let an older signed reply be accepted again.
+     * The identifier is afterwards an ordinary remote one; `Baser.reloadKevers` rebuilds `prefixes` from
+     * `habs.` only, so a reopen agrees. Retirement is one-way: `makeSignedHab` refuses a prefix with a `Kever`,
+     * and the kept Keeper `pres.` rows make `makeHab` refuse an inception that derives the retired keys again.
+     * Retirement deletes the stored keys and the ability to act as a local habitat, not the secret's
+     * derivability: a rooted salty habitat's seeds stay derivable from the Keeper's root salt plus its name.
+     * No event is made and nothing is signed. The held signers of the identifier's current keys are dropped
+     * (`Manager.forget`) once the rows are deleted. Runtime state (pollers, cursors, operations) is the caller's to
+     * clean up.
+     *
+     * Refused with a `ValidationError`, before any write, when `pre` is not a local habitat, is a group
+     * habitat, is the recorded local member (`mid`) of a local group, is an accepted signing or rotation
+     * member of a local group, or is the delegator of a local habitat.
+     *
+     * Differences from KERIpy `Habery.deleteHab(name, ns)`: keyed by prefix rather than by name, throws where
+     * KERIpy returns `False`, refuses the cases above where KERIpy has no guards, and deletes the Keeper's stored
+     * key rows other than `pres.` where KERIpy keeps them all.
+     */
+    retireHab(pre) {
+        const refusal = this.retireRefusal(pre);
+        if (refusal)
+            throw new ValidationError(refusal);
+        const record = this.db.getHab(pre);
+        const name = record.name;
+        const ns = record.domain ?? "";
+        const current = this.db.getKever(pre)?.verfers.map((verfer) => verfer.qb64) ?? [];
+        const { deleted, released } = this.db.transaction(() => {
+            this.db.habs.rem(pre);
+            if (this.db.getName(ns, name) === pre)
+                this.db.names.rem([ns, name]);
+            return this.mgr.forget(pre, current);
+        });
+        this.db.prefixes.delete(pre);
+        this.habs.delete(pre);
+        const deferred = this.deferredReconfigure.indexOf(pre);
+        if (deferred >= 0)
+            this.deferredReconfigure.splice(deferred, 1);
+        return { pre, name, domain: record.domain, keys: deleted, released };
+    }
+    /**
+     * The accepted local habitats that cannot sign now, each with the current public keys whose signers are neither
+     * held nor stored. Derived on every call from `Hab.missingSigners`; nothing records it. A store opened without a
+     * habitat's signer lists that habitat until the host calls `Manager.hold`. A habitat with no signing keys at all
+     * (a group whose local member has no contribution) is not listed: that is not a missing signer.
+     */
+    unsignable() {
+        const unsignable = [];
+        for (const hab of this.habs.values()) {
+            if (!hab.accepted)
+                continue;
+            const missing = hab.missingSigners();
+            if (missing.length)
+                unsignable.push({ pre: hab.pre, missing });
+        }
+        return unsignable;
+    }
+    /**
+     * Why {@link retireHab} would refuse `pre`, or null when it would retire it. A pure read: the refusals listed
+     * on `retireHab`, in the same order, so a caller can decide between retiring and keeping without a throw.
+     */
+    retireRefusal(pre) {
+        const record = this.db.getHab(pre);
+        if (!record?.name)
+            return `${pre} is not a local habitat.`;
+        if (record.mid || this.db.groups.has(pre)) {
+            return `${pre} is a group habitat; retiring group habitats is not supported.`;
+        }
+        for (const [key, local] of this.db.getHabItemIter()) {
+            const hid = local.hid || key;
+            if (hid === pre)
+                continue;
+            if (local.mid === pre)
+                return `${pre} is the recorded local member of group ${hid}.`;
+            if (local.mid && isAcceptedGroupMember(this.db, hid, pre)) {
+                return `${pre} is an accepted member of local group ${hid}.`;
+            }
+            if (this.db.getKever(hid)?.delpre === pre)
+                return `${pre} is the delegator of local habitat ${hid}.`;
+        }
+        return null;
+    }
     /** Creates this Habery's sidecar stores. */
     get opener() {
         if (!this.storeOpener)

package/esm/keri/npm/src/app/identity/keeping.js

@@ -1,5 +1,5 @@
 import { decodeB64, Decrypter, Diger, Encrypter, hydrateMatter, intToB64, MtrDex, NumberPrimitive, NumDex, parseMatter, Prefixer, Saider, Salter, Signer, Tiers, Verfer, } from "cesr-ts";
-import { b } from "cesr-ts";
+import { b, ParserError } from "cesr-ts";
 import { ValidationError } from "../../core/errors.js";
 import { PubLot } from "../../db/keeping.js";
 /**
@@ -194,9 +194,9 @@ function emptyLot(dt = "") {
     return new PubLot({ pubs: [], ridx: 0, kidx: 0, dt });
 }
 /**
- * No private key for `pub`: neither held (`Manager.hold`) nor stored in the Keeper. A custodial host releases
- * its signers on purpose, so a background loop that needs one treats this as a condition to wait out, not as a
- * failure of the runtime. The message is the one the Keeper has always used.
+ * No private key for `pub`: neither held (`Manager.hold`) nor stored in the Keeper. A background loop reads
+ * `Hab.canSign()` before it signs and skips a habitat that cannot, so this error escaping a loop is a real fault.
+ * The message is the one the Keeper has always used.
  */
 export class SignerNotHeldError extends Error {
     constructor(pub) {
@@ -270,13 +270,6 @@ export class Manager {
             writable: true,
             value: new Map()
         });
-        /** Told after `hold()` borrows signers; a loop that waited for a missing signer resumes on it. */
-        Object.defineProperty(this, "holdListeners", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: new Set()
-        });
         const { ks, seed = "", aeid = "", pidx = 0, algo = Algos.salty, salt = randomSaltQb64(), tier = Tiers.low, } = args;
         this._ks = ks;
         this._seed = seed;
@@ -433,9 +426,9 @@ export class Manager {
         this.decrypter = decrypter;
         this._seed = seed;
     }
-    /** Require full canonical keys; local ownership is the calling operation's responsibility. */
+    /** Require full canonical keys for a write; local ownership is the calling operation's responsibility. */
     registryRootKeys(aid, regid) {
-        if (new Prefixer({ qb64: aid }).qb64 !== aid || new Diger({ qb64: regid }).qb64 !== regid) {
+        if (!canonicalRegistryRootKeys(aid, regid)) {
             throw new Error("Registry root keys must be canonical AID and registry SAID strings");
         }
         return [aid, regid];
@@ -454,7 +447,10 @@ export class Manager {
     }
     /** Return the retained Salt128 root; absent reads require no encryption. */
     getRegistryRoot(aid, regid) {
-        const cipher = this.ks.rroots.get(this.registryRootKeys(aid, regid));
+        // No root is stored under a key that is not canonical (see `canonicalRegistryRootKeys`).
+        if (!canonicalRegistryRootKeys(aid, regid))
+            return null;
+        const cipher = this.ks.rroots.get([aid, regid]);
         if (!cipher)
             return null;
         const { decrypter } = this.registryRootCrypto();
@@ -476,9 +472,12 @@ export class Manager {
         const { aeid, encrypter, decrypter } = this.registryRootCrypto();
         return this.ks.retainRegistryRoot(keys, root, aeid, encrypter, decrypter, overwrite);
     }
-    /** Whether a root is retained for `aid` and `regid`; reads no ciphertext and needs no unlocked Keeper. */
+    /**
+     * Whether a root is retained for `aid` and `regid`; reads no ciphertext and needs no unlocked Keeper. False for
+     * a key that is not canonical, since no root is stored under one (see `canonicalRegistryRootKeys`).
+     */
     hasRegistryRoot(aid, regid) {
-        return !!this.ks.rroots.get(this.registryRootKeys(aid, regid));
+        return canonicalRegistryRootKeys(aid, regid) && !!this.ks.rroots.get([aid, regid]);
     }
     signerDecrypter() {
         if (this.aeid && !this.decrypter) {
@@ -504,7 +503,8 @@ export class Manager {
      *   and hold that encoding. A request for the other encoding does not match.
      * - The host owns each `Signer` and its seed bytes, including zeroing them.
      *   This keeps the reference only; it never copies seed bytes and never
-     *   erases them. Dropping a reference with `release()` does not zero memory.
+     *   erases them. Retiring the habitat (`forget()`) drops the reference but
+     *   does not zero memory.
      * - Holding a pub that is already held replaces the earlier signer. A held
      *   signer shadows a stored key with the same public key.
      * - The `pre/path` branch of `sign()` re-derives salty keys from the stored
@@ -522,32 +522,18 @@ export class Manager {
         }
         for (const [pub, signer] of batch)
             this.held.set(pub, signer);
-        for (const listener of [...this.holdListeners])
-            listener();
     }
     /**
-     * Be told after each `hold()`, so a background loop whose signer was released can resume at once.
+     * Whether this Manager can sign with `pub` now: a signer is held for it, or the Keeper stores its private key.
+     * A pure read; it neither decrypts nor signs.
      *
-     * @returns A function that stops the notifications.
+     * A store may be opened without a habitat's signer (a keyless habitat before its host calls `hold()`), so this
+     * is ordinary state: background loops read it before they sign and skip what cannot be signed yet.
      */
-    onHold(listener) {
-        this.holdListeners.add(listener);
-        return () => this.holdListeners.delete(listener);
-    }
-    /**
-     * Drop held signer references: all of them, or only those for `pubs`.
-     *
-     * Unheld pubs are ignored. Afterwards a request for a released key resolves
-     * from stored keys only and fails as any missing key does. This drops
-     * references; zeroing a signer's seed stays the host's job.
-     */
-    release(pubs) {
-        if (pubs === undefined) {
-            this.held.clear();
-            return;
-        }
-        for (const pub of pubs)
-            this.held.delete(pub);
+    hasSigner(pub) {
+        if (this.held.has(pub))
+            return true;
+        return this.ks.pris.has(pub);
     }
     /** Resolve one signer by qualified public key: held first, then the Keeper's `pris.`. */
     getSignerByPub(pub) {
@@ -835,6 +821,15 @@ export class Manager {
         if (!opre) {
             throw new Error("Invalid incept configuration produced no current verfers.");
         }
+        // The same seed under the other transferability encodes the same public key differently (`D...`/`B...`),
+        // so a forgotten prefix's kept `pres.` row is looked up under both encodings.
+        const first = isigners[0];
+        const twin = new Signer({ code: first.code, raw: first.raw, transferable: !first.transferable }).verfer.qb64;
+        const retired = [opre, twin].map((pub) => this.ks.getPres(pub)).find((owner) => owner !== null && this.ks.getSits(owner) === null);
+        if (retired) {
+            throw new Error(`Already incepted pre=${opre}: these keys derive the forgotten keys of retired identifier ${retired}; `
+                + "use another name, namespace or salt.");
+        }
         if (!this.ks.putPres(opre, opre)) {
             throw new Error(`Already incepted pre=${opre}.`);
         }
@@ -981,6 +976,68 @@ export class Manager {
         }
         return [verfers, digers];
     }
+    /**
+     * Delete the stored key rows of one managed prefix, in one Keeper transaction.
+     *
+     * Removed rows:
+     * - `prms.` and `sits.` for `pre`
+     * - every `pubs.` lot stored under `pre` or under an inception alias that
+     *   `move()` bound to it (the first current public key of a self-addressing prefix)
+     * - `pris.` for every public key named by those lots or by the situation
+     *
+     * Kept: every `pres.` row that resolves to `pre`. They are the one-way marker:
+     * `incept()` refuses any later inception whose first key is one of them, so
+     * the same name, namespace and salt cannot derive these keys again under a
+     * new or the same prefix.
+     *
+     * Limit: this deletes stored rows, not the secret's derivability. For a
+     * rooted salty prefix the seeds stay derivable from the Keeper-global salt
+     * and the habitat's derivation stem (its namespace and name).
+     *
+     * A prefix with no key rows, such as a keyless habitat whose signers are held
+     * externally (`hold()`) or one already forgotten, has no stored keys to delete.
+     * Held signers for `current` (the prefix's current public keys, which a keyless
+     * habitat has no Keeper row for) are dropped as well; zeroing their seeds stays
+     * the host's job. There is no other way to drop a held signer: a store's signers
+     * only ever grow until it closes.
+     *
+     * No KERIpy counterpart: `Habery.deleteHab` keeps all of the Keeper's state.
+     *
+     * @param pre Prefix to forget.
+     * @param current The prefix's current public keys, whose held signers are dropped.
+     * @returns What was deleted and dropped.
+     */
+    forget(pre, current) {
+        const deleted = this.ks.transaction(() => {
+            const aliases = new Set([pre]);
+            for (const [keys, prefixer] of this.ks.pres.getTopItemIter()) {
+                if (prefixer.qb64 === pre)
+                    aliases.add(keys.join("."));
+            }
+            const pubs = new Set();
+            const sit = this.ks.getSits(pre);
+            for (const lot of sit ? [sit.old, sit.new, sit.nxt] : []) {
+                for (const pub of lot.pubs)
+                    pubs.add(pub);
+            }
+            for (const alias of aliases) {
+                for (const [, lot] of this.ks.pubs.getTopItemIter(alias, { topive: true })) {
+                    for (const pub of lot.pubs)
+                        pubs.add(pub);
+                }
+                this.ks.pubs.trim(alias, { topive: true });
+            }
+            this.ks.prms.rem(pre);
+            this.ks.sits.rem(pre);
+            let deleted = 0;
+            for (const pub of pubs) {
+                if (this.ks.pris.rem(pub))
+                    deleted += 1;
+            }
+            return deleted;
+        });
+        return { deleted, released: current.filter((pub) => this.held.delete(pub)) };
+    }
     sign(ser, pubsOrArgs = [], indexed = true) {
         const args = Array.isArray(pubsOrArgs)
             ? { pubs: pubsOrArgs, indexed }
@@ -1312,3 +1369,18 @@ export function b64DecodeUrl(text) {
 export function ensureKeeperCryptoReady() {
     // no-op
 }
+/**
+ * Whether `aid` and `regid` are one complete canonical AID and one complete canonical SAID. A registry identifier is
+ * often a peer's text (a Grant's `rd`), so text that does not decode as CESR is a key that names no stored root, not
+ * a fault: a lookup answers "not held" and only a write refuses it.
+ */
+function canonicalRegistryRootKeys(aid, regid) {
+    try {
+        return new Prefixer({ qb64: aid }).qb64 === aid && new Diger({ qb64: regid }).qb64 === regid;
+    }
+    catch (error) {
+        if (error instanceof ParserError)
+            return false;
+        throw error;
+    }
+}