keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/app/multisig/proposals.js

@@ -0,0 +1,281 @@
+/**
+ * Group proposal reads, owned by the library so that a CLI, a browser wallet and
+ * a service all see and dismiss the same proposals. Operations follow the
+ * workflow contract (`app/runtime/workflow-contract.ts`):
+ * - `listGroupProposals` and `findGroupProposal` are pure reads of stored
+ *   exchange messages, the multisig embed index (`meids.`) and the notifier.
+ * - `dismissGroupProposal` removes local notices only.
+ *
+ * A proposal is identified by the SAID of the outer exchange wrapper that
+ * announced it. Approval, which is the only step that signs, names that SAID
+ * explicitly; nothing here or in the notice store selects a proposal to approve.
+ *
+ * Boundaries:
+ * - Dependencies are declared collaborators, not an AgentRuntime (ADR-0013).
+ * - Notices discover candidates only. Their attributes never authorize a route
+ *   or a group; every field below is read from the stored, indexed wrapper.
+ */
+import { Vrsn_2_0 } from "cesr-ts";
+import { ValidationError } from "../../core/errors.js";
+import { isV2RegistryRoute } from "../../core/exchange/protocol-exchanging.js";
+import { loadNests } from "../../db/exchange/exchange-nests.js";
+import { abortable } from "../runtime/abortable.js";
+import { collectBytes } from "../transport/byte-source.js";
+import { findLocalGroupMember, groupSigningMembers, uniqueMembers } from "./group-members.js";
+import { acdcV2RegistryProposal, MULTISIG_RPY_ROUTE, multisigChild } from "./grouping.js";
+import { multisigEmbeddedSection, multisigPayloadSaid, storedGroupMessage } from "./multisig-messaging.js";
+import { approveKelProposal, approveRegistryV2Proposal, approveRpyProposal, approveVdrProposal, eventAccepted, isKelRoute, isVdrRoute, kelApproval, payloadSection, } from "./multisig-workflows.js";
+/** Page size when reading the notice store; no proposal is hidden behind the first page. */
+const NOTICE_PAGE = 100;
+/** Wrapper route to proposal kind, or null for routes this API does not cover. */
+function proposalKind(route) {
+    if (!isKelRoute(route) && !isVdrRoute(route) && route !== MULTISIG_RPY_ROUTE && !isV2RegistryRoute(route)) {
+        return null;
+    }
+    return route.slice("/multisig/".length);
+}
+/** Page through every notice; `fn` sees each in durable order. */
+function eachNotice(notifier, fn) {
+    for (let start = 0;; start += NOTICE_PAGE) {
+        const page = notifier.list(start, NOTICE_PAGE);
+        for (const note of page)
+            fn({ rid: note.pad.i, attrs: note.pad.a });
+        if (page.length < NOTICE_PAGE)
+            break;
+    }
+}
+/** Wrapper SAIDs the notice store holds for multisig proposals, oldest first and without repeats. */
+function noticedWrappers(notifier) {
+    const saids = new Set();
+    eachNotice(notifier, ({ attrs }) => {
+        if (typeof attrs.d === "string")
+            saids.add(attrs.d);
+    });
+    return [...saids];
+}
+/** The local member that would approve, without throwing for a group not yet joined. */
+function approvingMember(hby, group, members) {
+    const mid = hby.db.getHab(group)?.mid;
+    return (mid ? hby.habs.get(mid) : null) ?? findLocalGroupMember(hby, members);
+}
+/**
+ * Event body of a wrapper's named child. v1 reads the pathed embed; v2 reads the
+ * first nest of a wrapper that authenticates through its own route. Proofs are
+ * not read: a listing never signs, so only the body is needed.
+ */
+function childBody(deps, wrapper, route, label) {
+    if (wrapper.pvrsn.major === 1)
+        return multisigChild(deps.hby, wrapper, label);
+    if (!wrapper.said || !deps.exc.verifyAccepted(wrapper.said, route))
+        return null;
+    const body = loadNests(deps.hby.db, wrapper.said)[0]?.body;
+    const event = body;
+    if (!event || typeof event.pre !== "string")
+        return null;
+    return { event, attachment: new Uint8Array(), genus: event.gvrsn ?? event.pvrsn ?? Vrsn_2_0 };
+}
+function eventRef(event, pre) {
+    return event.said && event.sn !== null ? { pre, sn: event.sn, said: event.said } : undefined;
+}
+function decode(deps, exn, route, kind) {
+    const { hby } = deps;
+    const payload = payloadSection(exn.ked ?? {});
+    if (isKelRoute(route)) {
+        const child = childBody(deps, exn, route, kind);
+        const approval = child && kelApproval(exn, route, child);
+        if (!approval)
+            return null;
+        const { smids, rmids } = approval.proposal.attrs;
+        return {
+            kind,
+            group: approval.group,
+            embedded: approval.event.said ?? "",
+            smids,
+            rmids: rmids ?? [],
+            event: eventRef(approval.event, approval.group),
+            inapplicable: eventAccepted(hby, approval.event) && !smids.some(mid => hby.habs.has(mid)),
+        };
+    }
+    if (isV2RegistryRoute(route)) {
+        const nests = loadNests(hby.db, exn.said);
+        const registry = acdcV2RegistryProposal(exn, nests, deps.registryStore);
+        if (!registry?.anchor.pre)
+            return null;
+        const group = registry.anchor.pre;
+        return {
+            kind,
+            group,
+            embedded: registry.tel.said ?? "",
+            smids: groupSigningMembers(hby, group),
+            rmids: [],
+            event: eventRef(registry.anchor, group),
+        };
+    }
+    const group = typeof payload.gid === "string" ? payload.gid : "";
+    if (!group)
+        return null;
+    const smids = groupSigningMembers(hby, group);
+    if (route === MULTISIG_RPY_ROUTE) {
+        const child = childBody(deps, exn, route, "rpy");
+        return child?.event.said ? { kind, group, embedded: child.event.said, smids, rmids: [] } : null;
+    }
+    // vcp, iss and rev: the named TEL event, sealed by the group event in `anc`.
+    const anchor = multisigChild(hby, exn, "anc");
+    const tel = multisigEmbeddedSection(exn.ked ?? {})?.[kind];
+    const embedded = tel && typeof tel === "object" ? tel.d : undefined;
+    if (!anchor || anchor.event.pre !== group || typeof embedded !== "string")
+        return null;
+    return { kind, group, embedded, smids, rmids: [], event: eventRef(anchor.event, group) };
+}
+/** Read one stored wrapper; null when it is not a well-formed proposal of a supported kind. */
+function readProposal(deps, said) {
+    const { hby } = deps;
+    const exn = hby.db.exns.get([said]);
+    if (!exn?.ked || !exn.said || !exn.pre)
+        return null;
+    const route = exn.route ?? "";
+    const kind = proposalKind(route);
+    if (!kind || !multisigPayloadSaid(exn))
+        return null;
+    let decoded;
+    try {
+        decoded = decode(deps, exn, route, kind);
+    }
+    catch (error) {
+        if (error instanceof ValidationError)
+            return null; // one malformed row never hides the others
+        throw error;
+    }
+    if (!decoded)
+        return null;
+    const member = approvingMember(hby, decoded.group, uniqueMembers([...decoded.smids, ...decoded.rmids]));
+    const approved = !!member && storedGroupMessage(hby.db, member.pre, exn) !== null;
+    const inapplicable = !approved && decoded.inapplicable === true;
+    return {
+        said: exn.said,
+        kind,
+        group: decoded.group,
+        embedded: decoded.embedded,
+        proposer: exn.pre,
+        smids: decoded.smids,
+        rmids: decoded.rmids,
+        local: approved ? "approved" : inapplicable ? "inapplicable" : "unapproved",
+        needs: {
+            groupAlias: !approved && !inapplicable && (kind === "icp" || (kind === "rot" && !hby.habs.has(decoded.group))),
+            registryName: !approved && !inapplicable && kind === "vcp",
+        },
+        ...(decoded.event ? { event: decoded.event } : {}),
+    };
+}
+/** Group prefix for a prefix or local alias. */
+function resolveGroup(hby, group) {
+    return hby.habByName(group)?.pre ?? group;
+}
+/**
+ * List the proposals the notice store announces, oldest notice first. Pure. Only
+ * wrappers that are stored, indexed in `meids.` and well formed are listed, one
+ * entry per wrapper; every notice page is read, so nothing hides behind the
+ * first 100. A dismissed proposal has no notice and is not listed; it remains
+ * available through {@link findGroupProposal}.
+ */
+export function listGroupProposals(deps, { group } = {}) {
+    if (!deps.notifier)
+        return [];
+    const wanted = group === undefined ? undefined : resolveGroup(deps.hby, group);
+    const proposals = [];
+    const seen = new Set();
+    for (const said of noticedWrappers(deps.notifier)) {
+        const exn = deps.hby.db.exns.get([said]);
+        const payloadSaid = exn && multisigPayloadSaid(exn);
+        if (!payloadSaid || !deps.hby.db.meids.get([payloadSaid]).some(index => index.qb64 === said))
+            continue;
+        const proposal = readProposal(deps, said);
+        if (!proposal || (wanted !== undefined && proposal.group !== wanted) || seen.has(said))
+            continue;
+        seen.add(said);
+        proposals.push(proposal);
+    }
+    return proposals;
+}
+/**
+ * Read one stored proposal by its wrapper SAID, whether or not a notice remains.
+ * Pure. Null when no such well-formed proposal is stored.
+ */
+export function findGroupProposal(deps, said) {
+    return readProposal(deps, said);
+}
+/**
+ * Dismiss a proposal locally: remove the notices that announce it, including
+ * those other members' wrappers of the same payload raised. The stored wrapper
+ * and the multisig index stay, so the proposal can still be found and approved
+ * by SAID. KERI has no reject message: nothing is sent, and the proposer and the
+ * other members learn nothing from a dismissal.
+ *
+ * @returns Number of notices removed.
+ */
+export function dismissGroupProposal(deps, said) {
+    if (!deps.notifier)
+        return 0;
+    const exn = deps.hby.db.exns.get([said]);
+    const payloadSaid = exn && multisigPayloadSaid(exn);
+    const wrappers = new Set([said]);
+    if (payloadSaid)
+        for (const index of deps.hby.db.meids.get([payloadSaid]))
+            wrappers.add(index.qb64);
+    const stale = [];
+    eachNotice(deps.notifier, ({ rid, attrs }) => {
+        if (typeof attrs.d === "string" && wrappers.has(attrs.d))
+            stale.push(rid);
+    });
+    return stale.filter(rid => deps.notifier.remove(rid)).length;
+}
+/**
+ * Approve one proposal, named by its wrapper SAID: sign this member's
+ * contribution to the embedded event, send it to the other members and hand the
+ * group event to the Counselor. Returns without waiting for other members; read
+ * progress with `counselor.status(result.event)`. This is the only call that
+ * signs, and it acts on exactly the SAID given: nothing is selected from the
+ * notice store, so a proposal the caller did not name cannot be approved.
+ *
+ * Calling it is the user's consent, so it never prompts. Repeating it after a
+ * crash resumes: this member's recorded signatures and stored wrapper are
+ * replayed, never replaced, and the group is not joined twice.
+ *
+ * Supports every proposal kind: KEL (`icp`, `rot`, `ixn`), reply (`rpy`), legacy registry and credential (`vcp`, `iss`, `rev`) and
+ * ACDC v2 registry (`rip`, `bup`). For the registry kinds `event` is the group anchor that seals the TEL event.
+ *
+ * @throws ValidationError for a SAID that is not a stored supported proposal, a missing `groupAlias` when the proposal {@link GroupProposal.needs} one, or a proposal that cannot be approved.
+ */
+export function* approveGroupProposal(deps, said, choices = {}) {
+    const { hby } = deps;
+    const proposal = findGroupProposal(deps, said);
+    const exn = hby.db.exns.get([said]);
+    if (!proposal || !exn)
+        throw new ValidationError(`No group proposal ${said} is stored.`);
+    const route = exn.route ?? "";
+    const payloadSaid = multisigPayloadSaid(exn);
+    if (!hby.db.meids.get([payloadSaid]).some(index => index.qb64 === said)) {
+        // Acceptance commits before the asynchronous handler; resume that ordinary intake.
+        const message = yield* abortable(signal => collectBytes(deps.exc.replay(said, signal)));
+        yield* deps.reactor.processBytes(message, { local: true });
+        if (!hby.db.meids.get([payloadSaid]).some(index => index.qb64 === said)) {
+            throw new ValidationError(`Group proposal ${said} is not indexed after replay.`);
+        }
+    }
+    const options = { resume: true, groupAlias: choices.groupAlias, registryName: choices.registryName };
+    const result = isKelRoute(route)
+        ? yield* approveKelProposal(hby, deps, exn, route, options)
+        : isVdrRoute(route)
+            ? yield* approveVdrProposal(hby, deps.vdr, deps, exn, route, options)
+            : isV2RegistryRoute(route)
+                ? yield* approveRegistryV2Proposal(hby, deps, exn, route, options)
+                : yield* approveRpyProposal(hby, deps, exn, route, options);
+    if (!result)
+        throw new ValidationError(`Group proposal ${said} cannot be approved.`);
+    const { event } = proposal;
+    if (event) {
+        const { auths, fallbackAfterMs, proxy } = choices;
+        deps.counselor.start(event, { auths, fallbackAfterMs, proxy });
+    }
+    return { ...result, ...(event ? { event } : {}) };
+}

package/esm/keri/npm/src/app/multisig/proposing.js

@@ -0,0 +1,122 @@
+import { ValidationError } from "../../core/errors.js";
+import { revokeCredential, } from "../credentials/credential-revoking.js";
+import { createCredential, inceptCredentialRegistry, } from "../credentials/credential-workflows.js";
+import { groupSigningMembers, localGroupMember, uniqueMembers } from "./group-members.js";
+import { MULTISIG_ICP_ROUTE, MULTISIG_IXN_ROUTE, MULTISIG_ROT_ROUTE } from "./grouping.js";
+import { remoteGroupMembers } from "./multisig-messaging.js";
+import { approveAcdcV2Registry, commitAcceptedGroupMembers, publishAcdcV2Registry, publishProposal, } from "./multisig-workflows.js";
+/** Propose a new group: create this member's inception and publish it. */
+export function* proposeGroupInception(deps, member, alias, { smids, rmids = smids, ...args }, inputs) {
+    // Publishing needs a route to every other member. Refuse before the group habitat exists, so a call that could
+    // not be sent leaves nothing behind and the same alias can be used again.
+    for (const other of remoteGroupMembers(deps.hby, member, uniqueMembers([...smids, ...rmids]))) {
+        if (!deps.postman.canReach(member.pre, other)) {
+            throw new ValidationError(`Group member ${other} cannot be reached: no end role is known for it. Resolve its OOBI first.`);
+        }
+    }
+    const created = deps.hby.makeGroupHab(alias, member, [...smids], [...rmids], undefined, args);
+    const event = { pre: created.hab.pre, sn: created.serder.sn ?? 0, said: created.serder.said };
+    deps.counselor.start(event, inputs);
+    const sent = yield* publishProposal(deps.hby, deps.protocol, deps.postman, member, uniqueMembers([...smids, ...rmids]), {
+        route: MULTISIG_ICP_ROUTE,
+        attrs: { smids: [...smids], rmids: [...rmids], ...(args.delpre ? { delegator: args.delpre } : {}) },
+    }, created.message);
+    return { ...sent, route: MULTISIG_ICP_ROUTE, group: created.hab.pre, event, smids, rmids };
+}
+/** Propose a group rotation, including member add or remove through new `smids` / `rmids`. */
+export function* proposeGroupRotation(deps, group, { smids: newSmids, rmids: newRmids, ...args } = {}, inputs) {
+    const { hby } = deps;
+    const rotated = hby.rotateGroupHab(group.name, newSmids && [...newSmids], newRmids && [...newRmids], args);
+    const smids = newSmids?.length ? newSmids : groupSigningMembers(hby, rotated.hab.pre);
+    const rmids = newRmids?.length ? newRmids : smids;
+    const event = { pre: rotated.hab.pre, sn: rotated.serder.sn, said: rotated.serder.said };
+    deps.counselor.start(event, inputs);
+    const sent = yield* publishProposal(hby, deps.protocol, deps.postman, localGroupMember(hby, rotated.hab.pre), uniqueMembers([...smids, ...rmids]), { route: MULTISIG_ROT_ROUTE, attrs: { gid: rotated.hab.pre, smids: [...smids], rmids: [...rmids] } }, rotated.message);
+    return { ...sent, route: MULTISIG_ROT_ROUTE, group: rotated.hab.pre, event, smids, rmids };
+}
+/** Propose a group interaction event carrying `data`. */
+export function* proposeGroupInteraction(deps, group, data, inputs, version) {
+    const { hby } = deps;
+    const created = hby.interactGroupHab(group.name, undefined, { data, version });
+    const smids = groupSigningMembers(hby, created.hab.pre);
+    const event = { pre: created.hab.pre, sn: created.serder.sn, said: created.serder.said };
+    deps.counselor.start(event, inputs);
+    const sent = yield* publishProposal(hby, deps.protocol, deps.postman, localGroupMember(hby, created.hab.pre), smids, { route: MULTISIG_IXN_ROUTE, attrs: { gid: created.hab.pre, smids } }, created.message);
+    return { ...sent, route: MULTISIG_IXN_ROUTE, group: created.hab.pre, event, smids, rmids: [] };
+}
+/**
+ * Commit the members a proposed rotation named, once the rotation is accepted and
+ * is the group's latest establishment event. Idempotent; false until then, so a
+ * proposed newcomer is never adopted early. Other event kinds commit nothing.
+ *
+ * @throws ValidationError when the event is not an accepted event body held locally.
+ */
+export function settleProposedRotation(deps, result) {
+    if (result.route !== MULTISIG_ROT_ROUTE)
+        return false;
+    const serder = deps.hby.db.getEvtSerder(result.event.pre, result.event.said);
+    if (!serder)
+        throw new ValidationError(`No rotation ${result.event.said} is held for ${result.event.pre}.`);
+    return commitAcceptedGroupMembers(deps.hby, serder, result.smids, result.rmids);
+}
+/**
+ * Propose an ACDC v2 registry event (`rip` or `bup`): author the group anchor
+ * that seals it, process this member's own contribution, hand the anchor to the
+ * Counselor and publish the proposal. The proposer's contribution is also its
+ * approval. Returns without waiting; the anchor's progress is
+ * `counselor.status(result.event)`. A `bup` needs its `opening`.
+ *
+ * @throws ValidationError for a group that is not joined and accepted, or a TEL event the group cannot propose.
+ */
+export function* proposeRegistryEvent(deps, group, event, opening, inputs) {
+    const { hby } = deps;
+    const approval = yield* approveAcdcV2Registry(hby, deps.protocol, group, event, { opening, resume: true });
+    const anchorSaid = approval[0].sad?.a?.anc;
+    const anchor = anchorSaid ? hby.db.getEvtSerder(group.pre, anchorSaid) : null;
+    if (!anchor || anchor.sn === null)
+        throw new ValidationError("Registry proposal lost its group anchor.");
+    const anchorRef = { pre: group.pre, sn: anchor.sn, said: anchor.said };
+    deps.counselor.start(anchorRef, inputs);
+    const sent = yield* publishAcdcV2Registry(hby, deps.postman, group, approval);
+    const regid = event.ilk === "rip" ? event.said : event.regid;
+    const accepted = deps.registryStore?.seqEvent(regid, Number(BigInt(`0x${event.sad.n}`)))?.said === event.said;
+    return {
+        route: approval[0].route,
+        said: approval[0].said,
+        embedded: event.said,
+        group: group.pre,
+        accepted,
+        ...sent,
+        event: anchorRef,
+    };
+}
+function proposedGroup(result, what) {
+    if (!result.group)
+        throw new ValidationError(`${what} must be proposed by a local group.`);
+    return result;
+}
+/**
+ * Propose a group's legacy credential registry (`vcp`): author the anchoring group event,
+ * process this member's contribution, hand the anchor to the Counselor and publish the
+ * proposal. Returns without waiting; the anchor's progress is `counselor.status(result.group.event)`
+ * and the registry's is `waitForTelEvent`.
+ *
+ * @throws ValidationError when `group` is not a local group or the registry name is taken.
+ */
+export function* proposeCredentialRegistry(deps, group, options, inputs) {
+    const result = proposedGroup(yield* inceptCredentialRegistry(deps.rgy, deps.input, deps.postman, group, options), "A group registry");
+    deps.counselor.start(result.group.event, inputs);
+    return result;
+}
+/** Propose a group credential issuance (`iss`) the way {@link proposeCredentialRegistry} proposes a registry. */
+export function* proposeCredentialIssue(deps, options, inputs) {
+    const result = proposedGroup(yield* createCredential(deps.rgy, deps.input, deps.postman, options), "A group credential");
+    deps.counselor.start(result.group.event, inputs);
+    return result;
+}
+/** Propose a group credential revocation (`rev`) the way {@link proposeCredentialRegistry} proposes a registry. */
+export function* proposeCredentialRevocation(deps, options, inputs) {
+    const result = proposedGroup(yield* revokeCredential(deps.rgy, deps.input, deps.postman, options), "A group revocation");
+    deps.counselor.start(result.group.event, inputs);
+    return result;
+}

package/esm/keri/npm/src/app/notifications/notifying.js

@@ -1,5 +1,6 @@
 import { ValidationError } from "../../core/errors.js";
-import { createNoter, Notice } from "../../db/noting.js";
+import { openOwner } from "../../db/core/store-owner.js";
+import { Noter, Notice } from "../../db/noting.js";
 import { Signaler } from "./signaling.js";
 export function notice(attrs, options = {}) {
     const dt = typeof options.dt === "string"
@@ -17,19 +18,14 @@ export function notice(attrs, options = {}) {
 /** Derive sidecar-open options from the owning `Habery` path/layout settings. */
 export function noterOptionsForHabery(hby, options = {}) {
     return {
-        name: hby.name,
-        base: hby.base,
-        temp: hby.temp,
-        headDirPath: hby.headDirPath,
-        compat: hby.compat,
-        readonly: hby.readonly,
-        reopen: true,
+        ...hby.storeIdentity(),
         ...options,
     };
 }
 /** Open the notification sidecar that belongs to one `Habery`. */
 export function* openNoterForHabery(hby, options = {}) {
-    return yield* createNoter(noterOptionsForHabery(hby, options));
+    const identity = noterOptionsForHabery(hby, options);
+    return yield* openOwner(new Noter(hby.opener.create(Noter.Family, identity)), "Noter", identity);
 }
 /**
  * Signed durable controller notifications with transient `/notification` pings.

package/esm/keri/npm/src/app/notifications/signaling.js

@@ -11,7 +11,8 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 };
 var _Signal_raw, _Signal_pad, _Signal_ckey;
 import { MtrDex, Salter } from "cesr-ts";
-import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "../runtime/doing.js";
+import { systemClock } from "../runtime/runtime-clock.js";
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder();
 function randomNonce() {
@@ -162,11 +163,10 @@ export class Signaler {
         this.closed = true;
         this.clear();
     }
-    *signalDo() {
-        while (true) {
+    *signalDo(clock = systemClock, pacing = PROTOCOL_PACING) {
+        return yield* doEvery(clock, pacing.tockMs, function* () {
             this.processOnce();
-            yield* runtimeTurn();
-        }
+        }.bind(this));
     }
 }
 Object.defineProperty(Signaler, "SignalTimeoutMs", {

package/esm/keri/npm/src/app/protocol/parsering.js

@@ -144,7 +144,7 @@ function* dispatchMessage(envelope, revery, kevery, exchanger, tevery, mailboxAi
         }
     }
     if (serder.ilk === "qry" && !["logs", "ksn", "mbx", "tels", "tsn"].includes(serder.route ?? "")
-        && qvy?.resource !== serder.route) {
+        && !(qvy?.claims ? qvy.claims(serder) : qvy?.resource === serder.route)) {
         return { envelope, decision: { kind: "drop", reason: "missingProcessor" } };
     }
     const result = kevery.kramer?.intake(envelope);
@@ -487,6 +487,31 @@ export function copyAuxiliaryQuery(envelope) {
     copied.tsgs.splice(0, copied.tsgs.length, ...normalized.tsgs);
     return copied;
 }
+/**
+ * Serialize an auxiliary query without nested evidence so a later process can rebuild it: its own frame with
+ * every attachment group (plus `children`, nested evidence already encoded as counted frames), then the
+ * normalized proof KRAM may have completed from earlier inputs.
+ */
+export function auxiliaryQueryWire(envelope, children = []) {
+    const version = envelope.gvrsn ?? envelope.serder.gvrsn ?? envelope.serder.pvrsn;
+    const frame = concatBytes(Counter.makeGVC(version), envelope.serder.raw, Counter.enclose({
+        code: "AttachmentGroup",
+        version,
+        qb64: concatBytes(...envelope.attachmentGroups.map(group => group.raw), ...children),
+    }));
+    const proof = serializeMessage(envelope.serder, { tsgs: envelope.tsgs, gvrsn: version, genusify: true });
+    const size = new Uint8Array(4);
+    new DataView(size.buffer).setUint32(0, frame.length);
+    return concatBytes(size, frame, proof);
+}
+/** Rebuild the envelope {@link auxiliaryQueryWire} serialized. */
+export function restoreAuxiliaryQuery(wire, local = false) {
+    const length = new DataView(wire.buffer, wire.byteOffset, 4).getUint32(0);
+    const restored = envelopeFromFrame(parseBytes(wire.slice(4, 4 + length))[0], local);
+    const normalized = envelopeFromFrame(parseBytes(wire.slice(4 + length))[0]);
+    restored.tsgs.splice(0, restored.tsgs.length, ...normalized.tsgs);
+    return restored;
+}
 /** Normalize the actual query endorsements for ingress and per-request authorization. */
 export function queryEnvelopeFromDispatch(envelope) {
     const lastSsg = envelope.ssgs.at(-1);

package/esm/keri/npm/src/app/protocol/protocol-processing.js

@@ -1,11 +1,30 @@
 import { call } from "effection";
 import { Deck } from "../../core/deck.js";
+import { ValidationError } from "../../core/errors.js";
 import { Kevery } from "../../core/kel/eventing.js";
+import { consoleLogger } from "../../core/logger.js";
 import { BasicReplyRouteHandler, Revery } from "../../core/routing.js";
 import { Exchanger } from "../exchanges/exchanging.js";
 import { QueryReplies } from "../queries/query-replies.js";
-import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { systemClock } from "../runtime/runtime-clock.js";
+import { waitOnClock } from "../runtime/workflow-contract.js";
 import { dispatchEnvelope, envelopeFromFrame, queryEnvelopeFromDispatch, } from "./parsering.js";
+/**
+ * Wait after every escrow pass, as KERIpy's Doist cycle (`tock` 0.03125 s, app/directing.py) paces its `escrowDo`,
+ * which runs one full pass per cycle. A pass is never skipped or shortened; this is the time others get between passes.
+ */
+export const ESCROW_TOCK_MS = 31.25;
+/**
+ * Identify a refusal of one already-extracted message, which must not end its stream.
+ *
+ * KERIpy's parser resumes after any non-extraction exception. This is deliberately narrower:
+ * infrastructure failures, programmer errors and cancellation must still reach the input owner.
+ * A dispatch-side ParserError also propagates, because it indicates corrupt local state and
+ * skipping would advance a mailbox cursor past a message that was never processed.
+ */
+function isInvalidMessageError(error) {
+    return error instanceof ValidationError;
+}
 /**
  * Dispatch to synchronous semantic owners and publish their committed output.
  *
@@ -140,6 +159,8 @@ export class ProtocolProcessor {
      * @param options Local intake policy, hosted mailbox provenance and whether to advance escrows.
      * @param kvy Input-specific Kevery in this domain; defaults to the shared owner.
      * @returns Exact dispatch result and current mailbox authorization at its synchronous query decision.
+     *   A message refused by validation after extraction is an `invalidMessage` drop, so the caller
+     *   continues with the next frame as KERIpy's parser does.
      * @throws Domain mismatch, infrastructure/handler or cleanup errors propagate; publication still runs in the dispatch finalizer.
      */
     dispatch(frame, { local = this.kvy.local, mailboxAid, escrows = false } = {}, kvy = this.kvy) {
@@ -151,9 +172,26 @@ export class ProtocolProcessor {
         const self = this;
         return call(function* () {
             try {
-                const result = yield* dispatchEnvelope(envelopeFromFrame(frame, local), self.rvy, kvy, self.exc, self.tvy ?? undefined, self.vry ?? undefined, mailboxAid, self.kvy, // One authoritative v2 sender policy and KRAM intake across all inputs.
-                self.registry ?? undefined, self.qvy);
-                const mailboxQueryAuthorized = result.envelope.serder.route === "mbx"
+                const envelope = envelopeFromFrame(frame, local);
+                let result;
+                let invalid = false;
+                try {
+                    result = yield* dispatchEnvelope(envelope, self.rvy, kvy, self.exc, self.tvy ?? undefined, self.vry ?? undefined, mailboxAid, self.kvy, // One authoritative v2 sender policy and KRAM intake across all inputs.
+                    self.registry ?? undefined, self.qvy);
+                }
+                catch (error) {
+                    if (!isInvalidMessageError(error))
+                        throw error;
+                    invalid = true;
+                    consoleLogger.warn("Skipping invalid message", {
+                        said: envelope.serder.said,
+                        ilk: envelope.serder.ilk,
+                        route: envelope.serder.route,
+                        detail: error.message,
+                    });
+                    result = { envelope, decision: { kind: "drop", reason: "invalidMessage", detail: error.message } };
+                }
+                const mailboxQueryAuthorized = !invalid && result.envelope.serder.route === "mbx"
                     && kvy.isMailboxQueryAuthorized(queryEnvelopeFromDispatch(result.envelope));
                 // Capture this request's facts before optional escrows can suspend or change key state.
                 self.publishCues();
@@ -223,10 +261,10 @@ export class ProtocolProcessor {
      * - mirrors the dedicated `escrowDo` loop rather than folding escrow
      *   processing into parser ingress
      */
-    *escrowDo() {
+    *escrowDo(clock = systemClock) {
         while (true) {
             yield* this.processEscrowsOnce();
-            yield* runtimeTurn();
+            yield* waitOnClock(clock, ESCROW_TOCK_MS);
         }
     }
 }