keri-ts 2.1.0 → 2.2.1

package/esm/keri/npm/src/app/runtime/agent-runtime.js

@@ -1,15 +1,14 @@
 import { WireParseError } from "cesr-ts";
 import { call, resource, spawn, suspend } from "effection";
-import { Dhke } from "../../acdc/dhking.js";
 import { RegistryObserver } from "../../acdc/observing.js";
 import { createRegery as createAcdcRegery } from "../../acdc/registraring.js";
 import { RegistryRoot } from "../../acdc/salting.js";
-import { Unblind } from "../../acdc/unblinding.js";
 import { Deck } from "../../core/deck.js";
-import { DatabaseNotOpenError, ValidationError } from "../../core/errors.js";
+import { DatabaseNotOpenError } from "../../core/errors.js";
 import { Kevery } from "../../core/kel/eventing.js";
 import { Kramer } from "../../core/mailbox/kraming.js";
 import { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, RECEIPT_MAILBOX_TOPIC, REPLAY_MAILBOX_TOPIC, REPLY_MAILBOX_TOPIC, } from "../../core/mailbox/mailbox-topics.js";
+import { Roles } from "../../core/roles.js";
 import { Revery } from "../../core/routing.js";
 import { openOwner } from "../../db/core/store-owner.js";
 import { Mailboxer } from "../../db/mailbox/mailboxing.js";
@@ -28,10 +27,12 @@ import { loadChallengeHandlers } from "../identity/challenging.js";
 import { Anchorer, loadDelegationHandlers } from "../identity/delegating.js";
 import { loadIpexHandlers } from "../ipex/ipexing.js";
 import { ForwardHandler } from "../mailbox/forward-handler.js";
+import { KEL_PUBLISHER_PACING, KelPublisher, kelPublisherDo } from "../mailbox/kel-publisher.js";
 import { MailboxDirector } from "../mailbox/mailbox-director.js";
-import { MailboxPoller } from "../mailbox/mailbox-poller.js";
+import { MAILBOX_POLLER_PACING, MailboxPoller, } from "../mailbox/mailbox-poller.js";
 import { mailboxerOptionsForHabery } from "../mailbox/mailboxing.js";
 import { mailboxTopicForRoute } from "../mailbox/topic-routing.js";
+import { Counselor } from "../multisig/counseling.js";
 import { loadMultisigHandlers } from "../multisig/grouping.js";
 import { noterOptionsForHabery, Notifier } from "../notifications/notifying.js";
 import { Signaler } from "../notifications/signaling.js";
@@ -41,7 +42,11 @@ import { QueryReplies } from "../queries/query-replies.js";
 import { WitnessInquisitor } from "../queries/witness-inquisitor.js";
 import { Receiptor } from "../witness/receipting.js";
 import { cueDo } from "./cue-runtime.js";
-import { runtimeTurn } from "./runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "./doing.js";
+import { IpexAuxiliaries } from "./ipex-auxiliaries.js";
+import { composeOwners, operationOwnersDo, OWNER_PACING, } from "./operation-owners.js";
+import { signalerChangeSink } from "./workflow-contract.js";
+import { observeUntil } from "./workflow-contract.js";
 /**
  * Create the shared runtime composition root used by CLI commands and
  * `tufa agent`.
@@ -59,15 +64,6 @@ import { runtimeTurn } from "./runtime-turn.js";
  * @throws Dependency mismatch/acquisition errors propagate after owned resource cleanup.
  */
 export function* createAgentRuntime(hby, http, clock, options = {}) {
-    const selected = options.ipexAuxiliary;
-    if (selected) {
-        if (options.kram?.enabled !== true) {
-            throw new ValidationError("IPEX auxiliary runtime requires explicitly enabled KRAM");
-        }
-        if (!selected.hab.pre || hby.habs.get(selected.hab.pre) !== selected.hab) {
-            throw new ValidationError("IPEX auxiliary runtime requires its actual local habitat");
-        }
-    }
     const injectedSignaler = options.signaler ?? options.notifier?.signaler;
     if ((options.notifier && options.notifier.signator !== hby.signator)
         || (options.noter && options.notifier && options.noter !== options.notifier.noter)
@@ -102,8 +98,6 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     const acdc = options.acdc ?? (!hby.readonly ? (yield* openAcdcRegeryForHabery(hby)) : null);
     const ownsAcdcRegery = options.acdc === undefined && acdc !== null;
     const acdcRegery = acdc;
-    if (selected && !acdc)
-        throw new ValidationError("IPEX auxiliary runtime requires a v2 registry");
     // Acquire after stores, before processors/consumers: reverse teardown joins consumers, clears cues, closes stores.
     const cues = yield* resource(function* (provide) {
         const owned = new Deck();
@@ -135,25 +129,21 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     const kvy = new Kevery(hby.db, { cues: protocolCues, rvy: revery, messagePolicy: options.messagePolicy, kramer });
     const exc = new Exchanger(hby, { cues: protocolCues, now });
     const registry = acdc ? new RegistryObserver(hby.db, acdc.store) : null;
-    const ipexAuxiliary = selected && registry
+    // Every runtime with a v2 registry store owns the per-identifier DH and Unblind owners: one dispatch path.
+    const ipex = registry
         ? yield* resource(function* (provide) {
-            const auxiliary = selected.kind === "dhke"
-                ? { kind: "dhke", owner: new Dhke({ hab: selected.hab, exc, registryStore: registry.store, rvy: revery, now }) }
-                : {
-                    kind: "unblind",
-                    owner: new Unblind({ hab: selected.hab, exc, registry, states: selected.states, rvy: revery, now }),
-                };
+            const owners = new IpexAuxiliaries(exc, registry, revery, now, options.kram?.enabled === true);
             try {
-                revery.rtr.addRoute(auxiliary.kind === "dhke" ? Dhke.Route : Unblind.Route, auxiliary.owner);
-                yield* provide(auxiliary);
+                owners.registerReplyRoutes(revery.rtr);
+                yield* provide(owners);
             }
             finally {
-                auxiliary.owner.close();
+                owners.close();
             }
         })
         : null;
     const replies = new QueryReplies(cues);
-    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipexAuxiliary?.owner);
+    const protocol = new ProtocolProcessor(kvy, revery, exc, vdr?.tvy ?? null, vdr?.vry ?? null, registry, protocolCues, cues, replies, ipex ?? undefined);
     const reactor = new Reactor(protocol);
     loadChallengeHandlers(hby.db, exc);
     loadDelegationHandlers(hby, exc, notifier);
@@ -165,7 +155,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         grantWalk: options.grantWalk,
     });
     // Construction adopts stored copies an earlier handler-less Exchanger left unescrowed.
-    const registryRoot = options.registryRoots !== "refuse" && acdc ? new RegistryRoot(hby, acdc, notifier) : null;
+    const registryRoot = options.registryRoots !== "refuse" && acdc
+        ? new RegistryRoot(hby, acdc, notifier, options.operationStores?.changes ?? (signaler ? signalerChangeSink(signaler) : undefined))
+        : null;
     if (registryRoot)
         exc.addHandler(registryRoot);
     const mailboxDirector = yield* resource(function* (provide) {
@@ -204,7 +196,25 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
     // Copies ride the credential topic; the refuser adds no mailbox topic of its own.
     if (options.registryRoots === "refuse")
         exc.addHandler(new RouteRefuser(RegistryRoot.Route));
-    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, {});
+    const kelPublisher = new KelPublisher({
+        hby,
+        http,
+        clock,
+        changes: signaler ? signalerChangeSink(signaler) : undefined,
+        retry: options.kelPublishRetry,
+    });
+    const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, {
+        onPolled: (pre, mailbox) => kelPublisher.prompt(pre, mailbox),
+        onUnauthorized: (pre, mailbox) => kelPublisher.repair(pre, mailbox),
+        timeouts: options.mailboxPolling,
+    });
+    // A mailbox role accepted from a reply (a group member's approved add, an OOBI) is acted on at the next tock.
+    revery.onEndRole = (cid, role) => {
+        if (role !== Roles.mailbox)
+            return;
+        kelPublisher.prompt(cid);
+        mailboxPoller.prompt(cid);
+    };
     for (const topic of [
         DELEGATE_MAILBOX_TOPIC,
         CREDENTIAL_MAILBOX_TOPIC,
@@ -224,6 +234,36 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         }
     });
     const delegating = new Anchorer(hby, postman, querying, protocol, http, clock);
+    // Group receipting reaches TCP-only witnesses as `WitnessReceiptor` does, as KERIpy's Counselor does.
+    const groupReceiptor = new Receiptor(hby, protocol, http, clock);
+    const counselor = new Counselor(hby, {
+        receipt: (pre, options) => groupReceiptor.receipt(pre, { ...options, allowTcp: true }),
+        get: (pre, options) => groupReceiptor.get(pre, options),
+    }, clock, signaler ? signalerChangeSink(signaler) : undefined, { anchorer: delegating, querying }, {
+        rotated: (cue) => {
+            kelPublisher.rotated.push(cue);
+            owned?.rootReplicator?.prompt(cue.pre);
+        },
+    }, options.counselorReceiptRetry);
+    const owned = acdc && ipex
+        ? composeOwners({
+            hby,
+            acdc,
+            exc,
+            protocol,
+            reactor,
+            postman,
+            receiptor: new Receiptor(hby, protocol, http, clock),
+            ipex,
+            clock,
+            registryRoot,
+            mux,
+            counselor,
+            retry: options.operationRetry,
+            queryResendMs: options.issuanceQueryResendMs,
+            changes: signaler ? signalerChangeSink(signaler) : undefined,
+        }, options.operationStores)
+        : null;
     const oobiery = new Oobiery(hby, protocol, revery, http, cues);
     oobiery.registerReplyRoutes(revery.rtr);
     const authenticator = new Authenticator(hby, http);
@@ -239,7 +279,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         replies,
         exc,
         mux,
-        ipexAuxiliary,
+        ipex,
+        operations: owned?.operations ?? null,
+        rootReplicator: owned?.rootReplicator ?? null,
         oobiery,
         authenticator,
         mailboxDirector,
@@ -247,6 +289,12 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         mailboxPoller,
         postman,
         delegating,
+        counselor,
+        kelPublisher,
+        ownerPacing: options.ownerPacing ?? OWNER_PACING,
+        publisherPacing: options.publisherPacing ?? KEL_PUBLISHER_PACING,
+        protocolPacing: options.protocolPacing ?? PROTOCOL_PACING,
+        pollerPacing: options.pollerPacing ?? MAILBOX_POLLER_PACING,
         querying,
         replyStreams,
         vdr,
@@ -264,7 +312,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
             const failures = [];
             const cleanup = [
                 function* () {
-                    ipexAuxiliary?.owner.close();
+                    ipex?.close();
                 },
                 function* () {
                     yield* querying.close();
@@ -485,6 +533,7 @@ export function runtimePendingState(runtime) {
         delegationPending: runtime.hby.db.dpwe.cnt() > 0
             || runtime.hby.db.dune.cnt() > 0
             || runtime.hby.db.dpub.cnt() > 0,
+        groupPending: runtime.hby.db.gpse.cnt() > 0 || runtime.hby.db.gdee.cnt() > 0 || runtime.hby.db.gpwe.cnt() > 0,
         queriesPending: runtime.querying.hasPendingWork(),
         deliveriesPending: runtime.querying.hasPendingDelivery || runtime.postman.hasPending,
     };
@@ -506,6 +555,9 @@ export function runtimeHasPendingWork(runtime) {
 }
 /**
  * Return true once OOBI acceptance and its ingress/query dependencies settle.
+ * This is a whole-runtime drain predicate: any unrelated pending cue, query,
+ * delegation or OOBI keeps it false. A command or request that asked for one
+ * OOBI must wait with `waitForOobi` (`app/bootstrap/oobi-resolving.ts`) instead.
  * Background receipt delivery is not remote acknowledgement of OOBI acceptance;
  * static OOBI servers may refuse unsolicited posts. Runtime close still joins I/O.
  *
@@ -536,14 +588,10 @@ export function* runAgentRuntimeUntil(runtime, done, options) {
     if (done())
         return;
     const { timeoutMs, ...workerOptions } = options;
-    const deadline = Date.now() + timeoutMs;
     const worker = yield* spawn(() => runAgentRuntime(runtime, workerOptions));
     try {
-        while (!done()) {
-            if (Date.now() >= deadline)
-                throw new Error(`Runtime did not converge within ${timeoutMs}ms.`);
-            yield* runtimeTurn();
-        }
+        if (!(yield* observeUntil(done, { timeoutMs })))
+            throw new Error(`Runtime did not converge within ${timeoutMs}ms.`);
     }
     finally {
         yield* worker.halt();
@@ -572,52 +620,55 @@ export { runtimeTurn } from "./runtime-turn.js";
  */
 export function* runAgentRuntime(runtime, options = {}) {
     runtime.querying.configure({ hab: options.hab });
+    const pacing = runtime.protocolPacing;
     const telReceiptor = runtime.vdr ? new Receiptor(runtime.hby, runtime.protocol, runtime.http, runtime.clock) : null;
     const tasks = [
         yield* spawn(() => runtime.querying.deliverDo()),
         yield* spawn(() => runtime.postman.deliverDo()),
         ...(runtime.vdr && telReceiptor
             ? [
-                yield* spawn(function* () {
-                    while (true) {
-                        yield* publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock);
-                        yield* runtimeTurn();
-                    }
-                }),
+                yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
             ]
             : []),
         yield* spawn(function* () {
-            yield* cueDo(runtime, options);
+            yield* cueDo(runtime, options, pacing);
         }),
         yield* spawn(function* () {
-            yield* runtime.protocol.escrowDo();
+            yield* runtime.protocol.escrowDo(runtime.clock);
         }),
         yield* spawn(function* () {
-            yield* runtime.oobiery.oobiDo();
+            yield* runtime.oobiery.oobiDo(runtime.clock, pacing);
         }),
         yield* spawn(function* () {
-            yield* runtime.authenticator.authDo();
+            yield* runtime.authenticator.authDo(runtime.clock, pacing);
         }),
         ...(runtime.signaler
             ? [
                 yield* spawn(function* () {
-                    yield* runtime.signaler.signalDo();
+                    yield* runtime.signaler.signalDo(runtime.clock, pacing);
                 }),
             ]
             : []),
         ...(options.pollMailbox ?? true
             ? [
                 yield* spawn(function* () {
-                    yield* runtime.mailboxPoller.pollDo((batch) => settleMailboxPollBatch(runtime, batch));
+                    yield* runtime.mailboxPoller.pollDo((batch) => settleMailboxPollBatch(runtime, batch), runtime.pollerPacing);
                 }),
             ]
             : []),
-        yield* spawn(function* () {
-            while (true) {
-                yield* runtime.delegating.processAllOnce();
-                yield* runtimeTurn();
-            }
-        }),
+        yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => runtime.delegating.processAllOnce())),
+        yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => runtime.counselor.processOnce())),
+        yield* spawn(() => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
+        ...(runtime.operations && runtime.ipex
+            ? [
+                yield* spawn(() => operationOwnersDo({
+                    operations: runtime.operations,
+                    rootReplicator: runtime.rootReplicator,
+                    ipex: runtime.ipex,
+                    clock: runtime.clock,
+                }, runtime.ownerPacing)),
+            ]
+            : []),
     ];
     try {
         return yield* suspend();

package/esm/keri/npm/src/app/runtime/cue-runtime.js

@@ -1,4 +1,4 @@
-import { runtimeTurn } from "./runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "./doing.js";
 /**
  * Use an explicitly selected or sole local habitat; never guess among hosted identities.
  *
@@ -53,9 +53,6 @@ export function* processCuesOnce(runtime, { hab, queryCues } = {}) {
  * @param runtime Borrowed composed runtime containing the actual cue consumers.
  * @param options Explicit signer and optional command-owned query cue destination.
  */
-export function* cueDo(runtime, options = {}) {
-    while (true) {
-        yield* processCuesOnce(runtime, options);
-        yield* runtimeTurn();
-    }
+export function* cueDo(runtime, options = {}, pacing = PROTOCOL_PACING) {
+    return yield* doEvery(runtime.clock, pacing.tockMs, () => processCuesOnce(runtime, options));
 }

package/esm/keri/npm/src/app/runtime/delivery-outbox.js

@@ -0,0 +1,87 @@
+import { DEFAULT_RETRY_POLICY, RetryBackoff } from "./retry-backoff.js";
+/** Flatten an error and its `cause` chain to one line of text, so a reader sees the transport's own reason. */
+export function describeFailure(error) {
+    const parts = [];
+    for (let e = error, depth = 0; e !== undefined && e !== null && depth < 8; depth++) {
+        parts.push(e instanceof Error ? (e.message || e.name) : String(e));
+        e = e instanceof Error ? e.cause : undefined;
+    }
+    return parts.join(" <- ");
+}
+/** The queue and its retry state for one live operation. */
+export class DeliveryOutbox {
+    constructor(policy = DEFAULT_RETRY_POLICY) {
+        Object.defineProperty(this, "queue", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: []
+        });
+        Object.defineProperty(this, "backoff", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Destinations the transport reported for everything delivered so far. */
+        Object.defineProperty(this, "delivered", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: []
+        });
+        this.backoff = new RetryBackoff(policy);
+    }
+    /** Messages still waiting. */
+    get length() {
+        return this.queue.length;
+    }
+    /** Consecutive delivery failures of the head message. */
+    get attempts() {
+        return this.backoff.attempts;
+    }
+    /** The latest delivery error, or null. */
+    get lastError() {
+        return this.backoff.last;
+    }
+    /** The retry state of the head message, or null while nothing is failing. */
+    get failure() {
+        return this.backoff.attempts === 0
+            ? null
+            : {
+                attempts: this.backoff.attempts,
+                reason: describeFailure(this.backoff.last),
+                retryAt: new Date(this.backoff.next).toISOString(),
+            };
+    }
+    /** Queue a message behind the others. */
+    enqueue(message) {
+        this.queue.push(message);
+    }
+    /**
+     * Deliver the queued messages in order. A failure keeps the message and schedules a retry; it throws only when
+     * `boundMs` is given and failures have lasted that long.
+     *
+     * @returns True when the queue is empty, false while a message waits for its retry.
+     */
+    *drain(transport, clock, boundMs) {
+        while (this.queue.length) {
+            const now = clock.now();
+            if (!this.backoff.due(now))
+                return false;
+            try {
+                const { src, dest, msg, topic } = this.queue[0];
+                this.delivered.push(...yield* transport.deliver({ src, dest, msg: typeof msg === "function" ? msg() : msg, topic }));
+                this.queue.shift();
+                this.backoff.succeeded();
+            }
+            catch (error) {
+                this.backoff.failed(now, error);
+                if (boundMs !== undefined && this.backoff.exhausted(now, boundMs))
+                    throw error;
+                return false;
+            }
+        }
+        return true;
+    }
+}

package/esm/keri/npm/src/app/runtime/doing.js

@@ -0,0 +1,17 @@
+import { waitOnClock } from "./workflow-contract.js";
+/** Milliseconds between passes of the protocol-facing background loops: KERIpy's Doist cycle, as the escrow loop uses. */
+export const PROTOCOL_TOCK_MS = 31.25;
+/** Tocks between full sweeps of a loop that has one: 1920 tocks of 31.25 ms is a minute. */
+export const PROTOCOL_SWEEP_TOCKS = 1920;
+/** The production pacing of the protocol-facing background loops. */
+export const PROTOCOL_PACING = Object.freeze({
+    tockMs: PROTOCOL_TOCK_MS,
+    sweepTocks: PROTOCOL_SWEEP_TOCKS,
+});
+/** Run `pass` forever: pass 0, wait `tockMs` on `clock`, pass 1, and so on. A thrown error ends the doer. */
+export function* doEvery(clock, tockMs, pass) {
+    for (let tock = 0;; tock++) {
+        yield* pass(tock);
+        yield* waitOnClock(clock, tockMs);
+    }
+}

package/esm/keri/npm/src/app/runtime/ipex-auxiliaries.js

@@ -0,0 +1,207 @@
+import { Dhke } from "../../acdc/dhking.js";
+import { Unblind } from "../../acdc/unblinding.js";
+import { ValidationError } from "../../core/errors.js";
+import { isLocalGroupHab } from "../multisig/group-members.js";
+/** Per-identifier DH and Unblind owners behind one query receiver and one reply route each. */
+export class IpexAuxiliaries {
+    /**
+     * @param exc Exchanger shared by every owner.
+     * @param registry Public registry observer shared by every owner.
+     * @param rvy Reply verifier whose router the owners' routes are registered on.
+     * @param now Receiver clock shared by every owner.
+     * @param kram Whether KRAM is enabled; with it off, `approve` of either owner throws.
+     */
+    constructor(exc, registry, rvy, now, 
+    /** Whether the runtime's KRAM is on; DH and Unblind approval need the rows only KRAM writes. */
+    kram) {
+        Object.defineProperty(this, "exc", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: exc
+        });
+        Object.defineProperty(this, "registry", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: registry
+        });
+        Object.defineProperty(this, "rvy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: rvy
+        });
+        Object.defineProperty(this, "now", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: now
+        });
+        Object.defineProperty(this, "kram", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: kram
+        });
+        /** Unused: `claims` decides which queries this receiver takes. */
+        Object.defineProperty(this, "resource", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "/ipex"
+        });
+        Object.defineProperty(this, "dhkes", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "unblinds", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "restored", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+    }
+    /** Every live DH owner, for hosts draining their completion cues. */
+    dhkeOwners() {
+        return this.dhkes.values();
+    }
+    /** Every live Unblind owner, for hosts delivering the replies they owe. */
+    unblindOwners() {
+        if (!this.restored) {
+            // A request persisted before a restart is owed its reply by an owner nothing has created yet.
+            this.restored = true;
+            const owed = new Set([...this.exc.hby.db.heldu.getTopItemIter()].map(([[pre]]) => pre));
+            for (const pre of owed) {
+                const hab = this.exc.hby.habs.get(pre);
+                if (!hab)
+                    continue;
+                try {
+                    this.unblind(hab);
+                }
+                catch (error) {
+                    if (!(error instanceof ValidationError))
+                        throw error;
+                }
+            }
+        }
+        return this.unblinds.values();
+    }
+    /** Register the DH and Unblind reply routes once; owners are looked up on each reply. */
+    registerReplyRoutes(rtr) {
+        rtr.addRoute(Dhke.Route, { processReply: (args) => this.reply("dhke", args) });
+        rtr.addRoute(Unblind.Route, { processReply: (args) => this.reply("unblind", args) });
+    }
+    /** The DH owner for `hab`, created on first use and recreated when `hab` is no longer the owner's object. */
+    dhke(hab) {
+        const current = this.dhkes.get(hab.pre);
+        if (current?.hab === hab)
+            return current;
+        const owner = new Dhke({
+            hab,
+            exc: this.exc,
+            registryStore: this.registry.store,
+            rvy: this.rvy,
+            now: this.now,
+            kram: this.kram,
+        });
+        current?.close();
+        this.dhkes.set(hab.pre, owner);
+        return owner;
+    }
+    /** The Unblind owner for `hab`, created on first use and recreated when `hab` is no longer the owner's object. */
+    unblind(hab) {
+        const current = this.unblinds.get(hab.pre);
+        if (current?.hab === hab)
+            return current;
+        const owner = new Unblind({ hab, exc: this.exc, registry: this.registry, rvy: this.rvy, kram: this.kram });
+        current?.close();
+        this.unblinds.set(hab.pre, owner);
+        return owner;
+    }
+    /** Close and unregister both owners of `pre`; process-local approvals and retries are cleared. */
+    release(pre) {
+        this.restored = false;
+        for (const owners of [this.dhkes, this.unblinds]) {
+            owners.get(pre)?.close();
+            owners.delete(pre);
+        }
+    }
+    /** Close every owner; the runtime calls this on explicit close and scope exit. */
+    close() {
+        for (const owner of [...this.dhkes.values(), ...this.unblinds.values()])
+            owner.close();
+        this.dhkes.clear();
+        this.unblinds.clear();
+    }
+    claims(serder) {
+        return this.select(serder) !== null;
+    }
+    processQuery(envelope) {
+        return this.select(envelope.serder)?.processQuery(envelope) ?? { kind: "drop", reason: "missingProcessor" };
+    }
+    reply(kind, args) {
+        const owner = this.claimant(kind, args.serder.pre, args.serder.sad?.a?.x);
+        if (!owner)
+            throw new ValidationError(`No resource is registered to handle route ${args.route}`);
+        return owner.processReply(args);
+    }
+    select(serder) {
+        const kind = serder.route === Dhke.Route ? "dhke" : serder.route === Unblind.Route ? "unblind" : null;
+        return kind && this.claimant(kind, serder.pre, serder.sad?.q?.x);
+    }
+    /**
+     * The owner of the one local identifier party to the transaction, created now if needed; absent or
+     * ambiguous means unowned. Parties come from live owners (approved operations) and from the store.
+     */
+    claimant(kind, sender, xid) {
+        if (!sender || typeof xid !== "string")
+            return null;
+        const owners = kind === "dhke" ? this.dhkes : this.unblinds;
+        const habs = this.exc.hby.habs;
+        const parties = new Set();
+        for (const [pre, owner] of owners)
+            if (owner.inTransaction(sender, xid))
+                parties.add(pre);
+        if (kind === "dhke") {
+            for (const recipient of Dhke.recipients(this.exc.hby.db, sender, xid)) {
+                if (habs.has(recipient))
+                    parties.add(recipient);
+            }
+        }
+        else {
+            for (const pre of habs.keys()) {
+                if (Unblind.recipients(this.exc.hby.db, pre, xid).includes(sender))
+                    parties.add(pre);
+            }
+        }
+        const group = habs.get(sender);
+        if (group && isLocalGroupHab(this.exc.hby, group))
+            parties.add(sender);
+        if (parties.size !== 1)
+            return null;
+        const [pre] = parties;
+        const hab = habs.get(pre);
+        if (!hab) {
+            this.release(pre);
+            return null;
+        }
+        try {
+            return kind === "dhke" ? this.dhke(hab) : this.unblind(hab);
+        }
+        catch (error) {
+            // A group without a local signing member cannot own the route.
+            if (error instanceof ValidationError)
+                return null;
+            throw error;
+        }
+    }
+}