keri-ts 1.0.0 → 2.0.1

package/esm/keri/npm/src/app/{notifying.js → notifications/notifying.js}

@@ -1,5 +1,5 @@
-import { ValidationError } from "../core/errors.js";
-import { createNoter, Notice } from "../db/noting.js";
+import { ValidationError } from "../../core/errors.js";
+import { createNoter, Notice } from "../../db/noting.js";
 import { Signaler } from "./signaling.js";
 export function notice(attrs, options = {}) {
     const dt = typeof options.dt === "string"
@@ -39,8 +39,8 @@ export function* openNoterForHabery(hby, options = {}) {
  * application-specific maps.
  */
 export class Notifier {
-    constructor(hby, { noter, signaler, }) {
-        Object.defineProperty(this, "hby", {
+    constructor(signator, { noter, signaler, }) {
+        Object.defineProperty(this, "signator", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -64,14 +64,14 @@ export class Notifier {
             writable: true,
             value: void 0
         });
-        this.hby = hby;
+        this.signator = signator;
         this.noter = noter;
         this.ownsSignaler = signaler === undefined;
         this.signaler = signaler ?? new Signaler();
     }
     /** Add one unread signed notice and emit a transient add signal. */
     add(attrs) {
-        const signator = this.requireSignator();
+        const signator = this.signator;
         const note = notice(attrs);
         const cigar = signator.sign(note.raw);
         if (!this.noter.add(note, cigar))
@@ -98,7 +98,7 @@ export class Notifier {
         if (note.read) {
             return false;
         }
-        const signator = this.requireSignator();
+        const signator = this.signator;
         note.read = true;
         const cigar = signator.sign(note.raw);
         if (!this.noter.update(note, cigar))
@@ -126,16 +126,10 @@ export class Notifier {
         return [this.requireVerifiedNotice(note, cigar), cigar];
     }
     requireVerifiedNotice(note, cigar) {
-        const signator = this.requireSignator();
+        const signator = this.signator;
         if (!signator.verify(note.raw, cigar)) {
             throw new ValidationError(`Notification ${note.rid} failed signator verification.`);
         }
         return note;
     }
-    requireSignator() {
-        if (!this.hby.signator) {
-            throw new ValidationError("Notifications require an available habery signator.");
-        }
-        return this.hby.signator;
-    }
 }

package/esm/keri/npm/src/app/{signaling.js → notifications/signaling.js}

@@ -11,7 +11,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 };
 var _Signal_raw, _Signal_pad, _Signal_ckey;
 import { MtrDex, Salter } from "cesr-ts";
-import { runtimeTurn } from "./runtime-turn.js";
+import { runtimeTurn } from "../runtime/runtime-turn.js";
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder();
 function randomNonce() {

package/esm/keri/npm/src/app/{parsering.js → protocol/parsering.js}

@@ -1,6 +1,7 @@
-import { BlindState, BoundState, Cigar, Dater, Diger, FirstSeen, Ilks, isCounterGroupLike, isGroupTuple, Labeler, Noncer, NumberPrimitive, parseSerder, Prefixer, requireFlatFrame, SealEvent, SealKind, SealSource, SerderACDC, SerderKERI, Siger, Texter, TypeMedia, Verfer, Verser, } from "cesr-ts";
-import { KeriDispatchEnvelope, PathedMaterialGroup, TransIdxSigGroup, TransLastIdxSigGroup, TransReceiptQuadruple, } from "../core/dispatch.js";
-import { supportsNestedExchange } from "../core/protocol-exchanging.js";
+import { BlindState, BoundState, Cigar, concatBytes, Counter, Dater, Diger, FirstSeen, Ilks, isCounterGroupLike, isGroupTuple, Labeler, Noncer, NumberPrimitive, parseBytes, parseSerder, Prefixer, requireFlatFrame, SealEvent, SealKind, SealSource, SerderACDC, SerderKERI, Siger, Texter, TypeMedia, Verfer, Verser, } from "cesr-ts";
+import { KeriDispatchEnvelope, PathedMaterialGroup, TransIdxSigGroup, TransLastIdxSigGroup, TransReceiptQuadruple, } from "../../core/dispatch.js";
+import { nestedIpexRoute, supportsNestedExchange } from "../../core/exchange/protocol-exchanging.js";
+import { serializeMessage } from "../../core/protocol-serialization.js";
 /**
  * Convert one or more already-parsed CESR frames into KERI dispatch envelopes.
  *
@@ -17,18 +18,48 @@ export function envelopesFromFrames(frames, local = false) {
  * Route one already-parsed KERI dispatch envelope into the established
  * `Revery` / `Kevery` / `Exchanger` architecture.
  * Return ordinary buffered evidence and its decision to the application owner.
+ *
+ * @param envelope Parsed body and its exact attachment evidence.
+ * @param revery Borrowed reply-route verifier.
+ * @param kevery Input KEL processor for this dispatch.
+ * @param exchanger Optional exchange processor; absent exchange support remains explicit.
+ * @param tevery Optional legacy TEL processor.
+ * @param verifier Optional credential processor.
+ * @param mailboxAid Receiving hosted endpoint provenance, distinct from claimed sender.
+ * @param messageKevery Authoritative shared message-policy/KRAM processor when distinct from input Kevery.
+ * @param registry V2 registry intake over accepted public KEL state, without requiring a local alias.
+ * @param qvy Optional auxiliary query owner; receives full evidence after v2 message admission.
+ * @returns The processed envelope and protocol-specific decision data.
+ * @throws Unsupported input and infrastructure/handler failures follow their owning processor contracts.
  */
-export function* dispatchEnvelope(envelope, revery, kevery, exchanger, tevery, verifier, mailboxAid) {
+export function* dispatchEnvelope(envelope, revery, kevery, exchanger, tevery, verifier, mailboxAid, 
+/** Long-lived v2 message policy/KRAM owner; input-specific Kevery handles KEL and legacy traffic. */
+messageKevery = kevery, registry, qvy) {
     const serder = envelope.serder;
     if (serder instanceof SerderACDC) {
-        if (serder.ilk === null) {
-            verifier?.processACDC(acdcEnvelopeFromDispatch(envelope, serder));
+        // Historical upd bytes remain decodable, but cannot enter live registry processing.
+        if (serder.ilk === Ilks.upd)
+            return { envelope, decision: { kind: "reject", reason: "event" } };
+        if (serder.ilk === Ilks.rip || serder.ilk === Ilks.bup) {
+            return {
+                envelope,
+                decision: registry?.processEvent(serder, {
+                    sscs: envelope.sscs,
+                    ssts: envelope.ssts,
+                    bsqs: envelope.bsqs,
+                    bsss: envelope.bsss,
+                })
+                    ?? { kind: "drop", reason: "missingProcessor" },
+            };
         }
-        return { envelope, decision: undefined };
+        return {
+            envelope,
+            decision: serder.ilk === null ? verifier?.processACDC(acdcEnvelopeFromDispatch(envelope, serder)) : undefined,
+        };
     }
     if (serder.pvrsn.major >= 2
         && [Ilks.qry, Ilks.rpy, Ilks.exn, Ilks.xip, Ilks.pro, Ilks.bar].some((ilk) => ilk === serder.ilk)) {
-        return yield* dispatchMessage(envelope, revery, kevery, exchanger, tevery, mailboxAid);
+        return yield* dispatchMessage(envelope, revery, messageKevery, exchanger, tevery, mailboxAid, qvy);
     }
     switch (serder.ilk) {
         case Ilks.rpy:
@@ -38,6 +69,7 @@ export function* dispatchEnvelope(envelope, revery, kevery, exchanger, tevery, v
                     serder,
                     cigars: envelope.cigars,
                     tsgs: envelope.tsgs,
+                    attachments: envelope,
                 }),
             };
         case Ilks.qry:
@@ -62,8 +94,7 @@ export function* dispatchEnvelope(envelope, revery, kevery, exchanger, tevery, v
         case Ilks.rev:
         case Ilks.bis:
         case Ilks.brv:
-            tevery?.processEvent(telEnvelopeFromDispatch(envelope, serder));
-            break;
+            return { envelope, decision: tevery?.processEvent(telEnvelopeFromDispatch(envelope, serder)) };
         case Ilks.icp:
         case Ilks.dip:
         case Ilks.rot:
@@ -98,11 +129,11 @@ export function* dispatchEnvelope(envelope, revery, kevery, exchanger, tevery, v
     return { envelope, decision: undefined };
 }
 /**
- * Frozen processMsg boundary: sender policy precedes optional KRAM and proof
+ * processMsg boundary: sender policy precedes optional KRAM and proof
  * prerequisites and delegation. Downstream processors authenticate their own
  * evidence; this layer borrows the envelope and never owns its payloads.
  */
-function* dispatchMessage(envelope, revery, kevery, exchanger, tevery, mailboxAid) {
+function* dispatchMessage(envelope, revery, kevery, exchanger, tevery, mailboxAid, qvy) {
     const serder = envelope.serder;
     const sender = serder.pre;
     if (sender !== null) {
@@ -112,18 +143,28 @@ function* dispatchMessage(envelope, revery, kevery, exchanger, tevery, mailboxAi
             return { envelope, decision: { kind: "drop", reason: "senderNotAllowed" } };
         }
     }
+    if (serder.ilk === "qry" && !["logs", "ksn", "mbx", "tels", "tsn"].includes(serder.route ?? "")
+        && qvy?.resource !== serder.route) {
+        return { envelope, decision: { kind: "drop", reason: "missingProcessor" } };
+    }
     const result = kevery.kramer?.intake(envelope);
     if (result && result.kind !== "ready")
         return { envelope, decision: result };
-    const ready = result?.envelope ?? envelope;
-    const decision = yield* dispatchReadyMessage(ready, revery, kevery, exchanger, tevery, mailboxAid, result?.receiverTime);
+    const ready = result?.kind === "ready" ? result.envelope : envelope;
+    const decision = yield* dispatchReadyMessage(ready, revery, kevery, exchanger, tevery, mailboxAid, result?.kind === "ready" ? result.receiverTime : undefined, qvy);
     return { envelope: ready, decision };
 }
 /** Delegate accepted evidence; downstream processors verify their own proof owners. */
-function* dispatchReadyMessage(envelope, revery, kevery, exchanger, tevery, mailboxAid, receiverTime) {
+function* dispatchReadyMessage(envelope, revery, kevery, exchanger, tevery, mailboxAid, receiverTime, qvy) {
     const serder = envelope.serder;
     switch (serder.ilk) {
         case Ilks.qry: {
+            if (qvy && !["logs", "ksn", "mbx", "tels", "tsn"].includes(serder.route ?? "")) {
+                if (!envelope.sigers.length && !envelope.ssgs.length && !envelope.tsgs.length && !envelope.cigars.length) {
+                    return { kind: "drop", reason: "missingAuthentication" };
+                }
+                return qvy.processQuery(envelope);
+            }
             const query = queryEnvelopeFromDispatch(envelope);
             if (!query.source && !query.cigars?.length)
                 return { kind: "drop", reason: "missingAuthentication" };
@@ -137,7 +178,8 @@ function* dispatchReadyMessage(envelope, revery, kevery, exchanger, tevery, mail
         case Ilks.rpy:
             if (!envelope.cigars.length && !envelope.tsgs.length)
                 return { kind: "drop", reason: "missingAuthentication" };
-            return revery.processReply({ serder, cigars: envelope.cigars, tsgs: envelope.tsgs });
+            return revery.processReply({ serder, cigars: envelope.cigars, tsgs: envelope.tsgs, attachments: envelope });
+        case Ilks.xip:
         case Ilks.exn:
             if (!envelope.cigars.length && !envelope.tsgs.length && !envelope.sscs.length && !envelope.ssts.length) {
                 return { kind: "drop", reason: "missingAuthentication" };
@@ -146,7 +188,7 @@ function* dispatchReadyMessage(envelope, revery, kevery, exchanger, tevery, mail
                 return { kind: "drop", reason: "missingProcessor" };
             return yield* dispatchExchange(envelope, exchanger, mailboxAid, receiverTime);
         default:
-            // processXip/processPro/processBar are pass stubs at the frozen reference.
+            // processPro/processBar remain pass stubs at the selected reference.
             return { kind: "drop", reason: "referenceStub" };
     }
 }
@@ -401,7 +443,9 @@ function collectAttachments(group, envelope) {
 export function envelopeFromFrame(message, local = false) {
     // Only completed consumers may retain parent-owned children through normalization.
     const route = String(message.body.ked?.r ?? "");
-    if (message.body.ilk !== "exn" || !supportsNestedExchange(route, message.body.pvrsn.major)) {
+    const unblindQuery = message.body.ilk === "qry" && message.body.pvrsn.major === 2 && route === "/ipex/unblind";
+    if (!unblindQuery && ((message.body.ilk !== "exn" && !(message.body.ilk === "xip" && nestedIpexRoute(route)))
+        || !supportsNestedExchange(route, message.body.pvrsn.major))) {
         requireFlatFrame(message, "KERI runtime normalization");
     }
     const serder = (message.body instanceof SerderKERI || message.body instanceof SerderACDC)
@@ -420,6 +464,29 @@ export function envelopeFromFrame(message, local = false) {
     }
     return envelope;
 }
+/** Own an auxiliary query's normalized full proof and public nested evidence beyond synchronous intake. */
+export function copyAuxiliaryQuery(envelope) {
+    const version = envelope.gvrsn ?? envelope.serder.gvrsn ?? envelope.serder.pvrsn;
+    const copyFrame = (body, groups, genus, nests) => {
+        const frame = parseBytes(concatBytes(Counter.makeGVC(genus), body.raw, Counter.enclose({
+            code: "AttachmentGroup",
+            version: genus,
+            qb64: concatBytes(...groups.map(group => group.raw)),
+        })))[0];
+        frame.nests = nests.map(child => copyFrame(child.body, child.attachments, child.gvrsn ?? genus, child.nests ?? []));
+        return frame;
+    };
+    const copied = envelopeFromFrame(copyFrame(envelope.serder, envelope.attachmentGroups, version, envelope.nests), envelope.local);
+    // One-key raw/last-establishment proofs remain in the copied groups. KRAM's
+    // completed multi-key TSG may include earlier inputs, so copy that normalized proof too.
+    const normalized = envelopeFromFrame(parseBytes(serializeMessage(envelope.serder, {
+        tsgs: envelope.tsgs,
+        gvrsn: version,
+        genusify: true,
+    }))[0]);
+    copied.tsgs.splice(0, copied.tsgs.length, ...normalized.tsgs);
+    return copied;
+}
 /** Normalize the actual query endorsements for ingress and per-request authorization. */
 export function queryEnvelopeFromDispatch(envelope) {
     const lastSsg = envelope.ssgs.at(-1);
@@ -429,6 +496,7 @@ export function queryEnvelopeFromDispatch(envelope) {
         : undefined;
     return {
         serder: envelope.serder,
+        gvrsn: envelope.gvrsn,
         source: lastSsg?.prefixer ?? rawSource,
         sigers: lastSsg ? [...lastSsg.sigers] : rawSource ? [...envelope.sigers] : [],
         cigars: [...envelope.cigars],

package/esm/keri/npm/src/app/protocol/protocol-processing.js

@@ -0,0 +1,245 @@
+import { call } from "effection";
+import { Deck } from "../../core/deck.js";
+import { Kevery } from "../../core/kel/eventing.js";
+import { BasicReplyRouteHandler, Revery } from "../../core/routing.js";
+import { Exchanger } from "../exchanges/exchanging.js";
+import { QueryReplies } from "../queries/query-replies.js";
+import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { dispatchEnvelope, envelopeFromFrame, queryEnvelopeFromDispatch, } from "./parsering.js";
+/**
+ * Dispatch to synchronous semantic owners and publish their committed output.
+ *
+ * KERIpy supplies parsers with concrete Kevery/Revery/Exchanger owners. Domain
+ * writers decide and commit without suspension; exchange durability and application
+ * handlers run in their input's operation. Independent inputs and escrow scans may
+ * progress during that I/O. This owner captures query replies before application delivery
+ * and registers shared semantic routes once; it owns no lock, input queue or transport.
+ */
+export class ProtocolProcessor {
+    /**
+     * Bind long-lived semantic owners and register their reply routes exactly once.
+     *
+     * @param kvy Shared KEL owner for semantic reply routes, KRAM policy and escrow recovery.
+     * @param rvy Shared reply verifier bound to the same database and private cue flow.
+     * @param exc Shared exchange owner with application handlers already configured.
+     * @param tvy Borrowed legacy TEL owner, or null without VDR support.
+     * @param vry Borrowed credential verifier, or null without that capability.
+     * @param registry Borrowed public v2 registry intake and escrow owner, or null.
+     * @param protocolCues Private semantic-output Deck; distinct from application cues.
+     * @param cues Application output Deck consumed by the composed cue router.
+     * @param replies Shared live request correlations captured before application publication.
+     * @param qvy Optional caller-owned auxiliary query receiver; owns its authorization and lifecycle.
+     * @throws TypeError for inconsistent stores or cue bindings.
+     */
+    constructor(
+    /** Long-lived KEL processor (kvy), used for semantic reply routes and escrow recovery. */
+    kvy, 
+    /** Shared reply verifier (rvy), including BADA and registered semantic routes. */
+    rvy, 
+    /** Shared exchange processor (exc), with the host's configured application handlers. */
+    exc, 
+    /** Legacy transaction-event processor (tvy), explicitly absent without VDR support. */
+    tvy, 
+    /** Credential verifier (vry), sharing the composed registry store. */
+    vry, 
+    /** Public v2 registry intake; local alias management remains with Regery. */
+    registry, 
+    /** Private output from semantic handlers, captured before application publication. */
+    protocolCues, 
+    /** Ordinary application cues; the composed cue router is the consumer. */
+    cues, 
+    /** Shared live request correlations; each requesting connection owns its slots. */
+    replies, qvy) {
+        Object.defineProperty(this, "kvy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: kvy
+        });
+        Object.defineProperty(this, "rvy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: rvy
+        });
+        Object.defineProperty(this, "exc", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: exc
+        });
+        Object.defineProperty(this, "tvy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: tvy
+        });
+        Object.defineProperty(this, "vry", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: vry
+        });
+        Object.defineProperty(this, "registry", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: registry
+        });
+        Object.defineProperty(this, "protocolCues", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: protocolCues
+        });
+        Object.defineProperty(this, "cues", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: cues
+        });
+        Object.defineProperty(this, "replies", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: replies
+        });
+        Object.defineProperty(this, "qvy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: qvy
+        });
+        if (protocolCues === cues || kvy.cues !== protocolCues || rvy.cues !== protocolCues
+            || exc.cues !== protocolCues || kvy.db !== rvy.db || exc.hby.db !== kvy.db || kvy.rvy !== rvy) {
+            throw new TypeError("Protocol processors require one store and a distinct shared protocol cue flow");
+        }
+        new BasicReplyRouteHandler(rvy).registerReplyRoutes(rvy.rtr);
+        kvy.registerReplyRoutes(rvy.rtr);
+        tvy?.registerReplyRoutes(rvy.rtr);
+    }
+    /**
+     * Construct an input-owned Kevery with identical store, policy and cue bindings; register no routes.
+     *
+     * @returns A new input-specific Kevery sharing accepted state, policy, Revery and the private cue Deck.
+     */
+    makeKevery() {
+        return new Kevery(this.kvy.db, {
+            cues: this.protocolCues,
+            rvy: this.rvy,
+            local: this.kvy.local,
+            lax: this.kvy.lax,
+            kramer: this.kvy.kramer,
+            messagePolicy: { allowList: this.kvy.allowList, denyList: this.kvy.denyList },
+        });
+    }
+    /**
+     * Process one frame and publish its committed protocol cues before returning decision data.
+     *
+     * @param frame Complete hydrated frame whose evidence remains valid for this operation.
+     * @param options Local intake policy, hosted mailbox provenance and whether to advance escrows.
+     * @param kvy Input-specific Kevery in this domain; defaults to the shared owner.
+     * @returns Exact dispatch result and current mailbox authorization at its synchronous query decision.
+     * @throws Domain mismatch, infrastructure/handler or cleanup errors propagate; publication still runs in the dispatch finalizer.
+     */
+    dispatch(frame, { local = this.kvy.local, mailboxAid, escrows = false } = {}, kvy = this.kvy) {
+        // A short-lived input processor must publish into this owner's private cue flow.
+        if (kvy.db !== this.kvy.db || kvy.cues !== this.protocolCues || kvy.rvy !== this.rvy) {
+            throw new TypeError("Kevery belongs to another protocol processing domain");
+        }
+        // deno-lint-ignore no-this-alias -- Generator callbacks have no lexical this.
+        const self = this;
+        return call(function* () {
+            try {
+                const result = yield* dispatchEnvelope(envelopeFromFrame(frame, local), self.rvy, kvy, self.exc, self.tvy ?? undefined, self.vry ?? undefined, mailboxAid, self.kvy, // One authoritative v2 sender policy and KRAM intake across all inputs.
+                self.registry ?? undefined, self.qvy);
+                const mailboxQueryAuthorized = result.envelope.serder.route === "mbx"
+                    && kvy.isMailboxQueryAuthorized(queryEnvelopeFromDispatch(result.envelope));
+                // Capture this request's facts before optional escrows can suspend or change key state.
+                self.publishCues();
+                if (escrows)
+                    yield* self.advanceEscrows();
+                return { ...result, mailboxQueryAuthorized };
+            }
+            finally {
+                self.publishCues();
+            }
+        });
+    }
+    /** Capture direct replies before handing ordinary protocol records to the application consumer. */
+    publishCues() {
+        // Readiness observers may synchronously reenter dispatch. Own this committed
+        // batch before notifying them so nested publication cannot take its records.
+        const committed = new Deck();
+        while (!this.protocolCues.empty)
+            committed.push(this.protocolCues.pull());
+        this.replies.capture(committed);
+        while (!committed.empty)
+            this.cues.push(committed.pull());
+    }
+    /** Advance configured escrow owners; each scan joins its own I/O and handler cleanup. */
+    *processEscrowsOnce() {
+        try {
+            yield* this.advanceEscrows();
+        }
+        finally {
+            this.publishCues();
+        }
+    }
+    /**
+     * Retry only KEL/reply dependencies and publish their committed cues.
+     *
+     * Finite introduction bootstrap needs these synchronous owners, without
+     * advancing unrelated exchange, credential or registry application work.
+     * Full host escrow processing retains its existing family/publication order.
+     */
+    processKelReplyEscrowsOnce() {
+        try {
+            this.advanceKelReplyEscrows();
+        }
+        finally {
+            this.publishCues();
+        }
+    }
+    /** Shared synchronous KEL/reply retry unit; the invoking composition owns publication. */
+    advanceKelReplyEscrows() {
+        this.kvy.processEscrows();
+        this.rvy.processEscrowReply();
+    }
+    /** Publish synchronous escrow facts before progressing asynchronous EXN recovery. */
+    *advanceEscrows() {
+        this.kvy.kramer?.prune();
+        this.advanceKelReplyEscrows();
+        this.tvy?.processEscrows();
+        this.vry?.processEscrows();
+        this.registry?.processAllEscrows();
+        this.publishCues();
+        yield* this.exc.processEscrows();
+    }
+    /**
+     * Continuous escrow doer for the long-lived runtime host.
+     *
+     * KERIpy correspondence:
+     * - mirrors the dedicated `escrowDo` loop rather than folding escrow
+     *   processing into parser ingress
+     */
+    *escrowDo() {
+        while (true) {
+            yield* this.processEscrowsOnce();
+            yield* runtimeTurn();
+        }
+    }
+}
+/**
+ * Compose minimal KEL/reply/exchange intake over an existing Habery; acquire no stores or workers.
+ *
+ * @param hby Borrowed local habitat collection and accepted-state database.
+ * @returns A minimal KEL/reply/exchange processor with no registry owners or running workers.
+ */
+export function createProtocolProcessor(hby) {
+    const cues = new Deck(), protocolCues = new Deck();
+    const rvy = new Revery(hby.db, { cues: protocolCues });
+    const kvy = new Kevery(hby.db, { cues: protocolCues, rvy });
+    const exc = new Exchanger(hby, { cues: protocolCues });
+    return new ProtocolProcessor(kvy, rvy, exc, null, null, null, protocolCues, cues, new QueryReplies(cues));
+}

package/esm/keri/npm/src/app/protocol/reactor.js

@@ -0,0 +1,55 @@
+import { chunkBytes } from "../transport/byte-source.js";
+import { processMessages } from "../transport/message-source.js";
+/**
+ * Own direct input and its buffered parser for one composed protocol domain.
+ *
+ * Like KERIpy's direct-mode input owners, this component consumes bytes and drives
+ * protocol handlers. It borrows the shared processor and owns an independent Kevery;
+ * accepted Kever state remains in the common Baser cache. Escrow scheduling, route
+ * registration and application handler installation belong to composition.
+ */
+export class Reactor {
+    /**
+     * Bind the actual shared protocol owner; create no runtime, transport or persistent stores.
+     *
+     * @param protocol Borrowed shared protocol domain; this input creates its own Kevery over that domain.
+     */
+    constructor(
+    /** Borrowed protocol mutations/publication owner, never a transport or callback scheduler. */
+    protocol) {
+        Object.defineProperty(this, "protocol", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: protocol
+        });
+        /** Input-specific Kevery (kvy); its accepted-state cache is shared through Baser. */
+        Object.defineProperty(this, "kvy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.kvy = protocol.makeKevery();
+    }
+    /**
+     * Own this input and finish dispatch before reading its next complete frame.
+     *
+     * @param source Creates cancellation-aware input bytes; this operation owns parsing and source cleanup.
+     * @param options Dispatch policy and optional upstream cancellation.
+     * @throws Source/parser, dispatch and cleanup failures propagate.
+     */
+    process(source, options = {}) {
+        return processMessages(source, this.protocol, this.kvy, options);
+    }
+    /**
+     * Consume one complete record through the same buffered parser source and dispatch path as network input.
+     *
+     * @param bytes Resident complete record; each parser chunk is copied during consumption.
+     * @param options Dispatch policy and optional upstream cancellation.
+     */
+    *processBytes(bytes, options = {}) {
+        // Copy already resident input in fixed-size chunks for the parser source.
+        yield* this.process((signal) => chunkBytes(bytes, { signal }), options);
+    }
+}