keri-ts 2.2.0 → 2.2.1

package/esm/keri/npm/src/acdc/custody.js

@@ -135,6 +135,29 @@ export class RegistryCustody {
         this.options.store.pin(event.said, value);
         return value;
     }
+    /**
+     * The opening of the accepted update that issued `credential`, for a holder of the registry root that did not
+     * author the update and so retained no coordinates (a group member that consented to it). The opening is derived
+     * from the credential and the `issued` state and must open the update's own commitment; it is then retained like
+     * an authored one. Only an unbound issuance update is derived here.
+     */
+    issuedOpening(event, credential) {
+        if (this.options.store.get(event.said))
+            return this.derivedOpening(event);
+        if (event.ilk !== "bup" || !event.verify())
+            throw new ValidationError("Exact accepted blinded update is required");
+        const ordinal = Number(BigInt(`0x${event.sad.n}`));
+        const stored = event.regid ? this.options.registry.seqEvent(event.regid, ordinal) : null;
+        if (!Number.isSafeInteger(ordinal) || !stored || !bytesEqual(stored.raw, event.raw)) {
+            throw new ValidationError("Exact accepted registry event is required");
+        }
+        const opening = this.derive(event.regid, ordinal, credential, "issued");
+        if (!vetBlind(opening, event.sad.b)) {
+            throw new ValidationError("The accepted update is not this credential's issuance");
+        }
+        this.retainDerivedUpdate(event, opening);
+        return opening;
+    }
     /** Reproduce only the exact accepted event, never today's head or a later credential's coordinates. */
     derivedOpening(event) {
         if (event.ilk !== "bup" || !event.verify())

package/esm/keri/npm/src/app/ipex/group-ipex.js

@@ -23,6 +23,7 @@
  */
 import { concatBytes, Counter, Vrsn_2_0 } from "cesr-ts";
 import { ValidationError } from "../../core/errors.js";
+import { loadNests } from "../../db/exchange/exchange-nests.js";
 import { registryEventStatus, settleRegistryEvent } from "../credentials/registry-settling.js";
 import { isLocalGroupHab } from "../multisig/group-members.js";
 import { MULTISIG_EXN_ROUTE } from "../multisig/grouping.js";
@@ -30,6 +31,8 @@ import { RetryBackoff } from "../runtime/retry-backoff.js";
 import { observeUntil } from "../runtime/workflow-contract.js";
 import { IpexAdmitter } from "./ipex-admitting.js";
 import { approveMultisigIpexLocally, approveStoredMultisigIpexWrappers, findStoredMultisigIpex, groupIpexApproved, prepareAcdcV2GroupIpex, publishGroupIpexProposal, publishInitialGroupIpex, requireAcdcV2GroupUse, sendCompletedGroupIpex, storedMultisigIpexBody, } from "./ipex-grouping.js";
+import { isIssuanceOrigin } from "./ipex-node-authentication.js";
+import { IPEX_GRANT_ROUTE } from "./ipexing.js";
 /** Milliseconds between collections of the other members' stored contributions. */
 export const GROUP_IPEX_COLLECT_MS = 250;
 /** How long delivery failures may last before an operation ends `failed`; a group IPEX message has no deadline. */
@@ -186,6 +189,7 @@ export class GroupIpexOperations {
         this.outcomes.set(op.said, {
             messages: op.publication?.messages ?? [],
             deliveries: op.publication?.deliveries ?? [],
+            members: op.publication?.members ?? [],
             sent: op.deliveries,
         });
         this.deps.changes?.push({ kind: "ipex", id: op.said });
@@ -257,6 +261,9 @@ export function groupIpexProposals(ops, hab) {
             continue;
         if (found.some((item) => item.said === embedded.said))
             continue;
+        if (embedded.route === IPEX_GRANT_ROUTE
+            && isIssuanceOrigin(group, loadNests(hby.db, wrapper.said)[0]?.nests?.[0]))
+            continue;
         found.push({
             said: embedded.said,
             route: embedded.route,
@@ -319,6 +326,13 @@ export function groupIpexStatus(ops, said) {
     }
     return { state: "active", phase: "awaitingConsent", needs: "approve" };
 }
+/**
+ * The member wrappers this process has published for one message: from the live operation once it published, from
+ * the outcome after it ended. Empty before publication. A pure read.
+ */
+export function groupIpexMessages(ops, said) {
+    return ops.live.get(said)?.publication?.messages ?? ops.outcomes.get(said)?.messages ?? [];
+}
 /** Observe until the message is accepted and delivered, or ended, or the budget expires. Starts no worker. */
 export function* waitForGroupIpex(ops, said, { timeoutMs, clock = ops.deps.clock, until = (status) => status.state !== "active" }) {
     const settled = yield* observeUntil(() => until(groupIpexStatus(ops, said)), { timeoutMs, clock });

package/esm/keri/npm/src/app/ipex/group-issuance.js

@@ -45,10 +45,11 @@ import { timestampMicros } from "../../time/mod.js";
 import { registryEventRef, registryEventStatus, settleRegistryEvent, } from "../credentials/registry-settling.js";
 import { groupElectedMember, groupSigningMembers, isLocalGroupHab, latestGroupContribution, localGroupMember, } from "../multisig/group-members.js";
 import { MULTISIG_EXN_ROUTE, MULTISIG_IPEX_PROOF_ROUTE, MULTISIG_QRY_ROUTE, MULTISIG_RPY_ROUTE, multisigExnBody, } from "../multisig/grouping.js";
+import { remoteGroupMembers } from "../multisig/multisig-messaging.js";
 import { proposeRegistryEvent } from "../multisig/proposing.js";
 import { envelopeFromFrame } from "../protocol/parsering.js";
 import { exchangeWire } from "./ipex-discloser.js";
-import { acceptedRegistryEvidence } from "./ipex-node-authentication.js";
+import { acceptedRegistryEvidence, isIssuanceOrigin } from "./ipex-node-authentication.js";
 import { ISSUANCE_QUERY_RESEND_MS, } from "./issuance.js";
 /** Milliseconds between scans of the stored wrappers for the final proof. */
 const PROOF_SCAN_MS = 1000;
@@ -119,9 +120,9 @@ export class GroupParty {
     get lead() {
         return this.member.pre === this.custodian;
     }
-    /** The other current signing members of the group. */
+    /** The other current signing members of the group that are not held in this Habery; local ones share its stores. */
     others() {
-        return groupSigningMembers(this.hby, this.group.pre).filter((peer) => peer !== this.member.pre);
+        return remoteGroupMembers(this.hby, this.member, groupSigningMembers(this.hby, this.group.pre));
     }
     /** The election this party stands for. */
     election() {
@@ -269,6 +270,8 @@ export function groupIssuanceProposals(ops, group) {
                 ? child.pre !== group.pre
                 : !hby.habs.get(child.pre) || !isLocalGroupHab(hby, hby.habs.get(child.pre))))
             continue;
+        if (!isIssuanceOrigin(child.pre, loadNests(hby.db, parent.said)[0]?.nests?.[0]))
+            continue;
         const self = localGroupMember(hby, child.pre).pre, known = found.get(child.said);
         if (known && (parent.pre === self || known.proposer !== self))
             continue;

package/esm/keri/npm/src/app/ipex/ipex-grouping.js

@@ -36,15 +36,20 @@ function acdcV2GraphUse(hby, registry, origin, nests, walk) {
     const graph = walkIpexGraph(origin, nests, walk);
     if (!graph)
         throw new ValidationError("ACDC v2 group graph is malformed or incomplete.");
-    const verdicts = new Map();
+    const verdicts = new Map(), why = [];
     for (const [said, node] of graph.nodes) {
-        verdicts.set(said, issuedNodeVerdict(authenticateIpexNode(node.body, envelopeFromFrame(node), hby.db, registry)));
+        const authentication = authenticateIpexNode(node.body, envelopeFromFrame(node), hby.db, registry);
+        verdicts.set(said, issuedNodeVerdict(authentication));
+        if (authentication.kind !== "authenticated")
+            why.push(`${said} ${authentication.kind}: ${authentication.reason}`);
     }
     const verdict = evaluateChain(graph, verdicts, hby.db);
     if (verdict?.kind === "unknown" && verdict.retryable)
         return null;
-    if (verdict?.kind !== "valid")
-        throw new ValidationError("ACDC v2 group graph is false or unresolved.");
+    if (verdict?.kind !== "valid") {
+        const found = !verdict ? "no verdict" : verdict.kind === "unknown" ? `unknown: ${verdict.reason}` : verdict.kind;
+        throw new ValidationError(`ACDC v2 group graph is false or unresolved (${found}${why.length ? `; ${why.join("; ")}` : ""}).`);
+    }
     return true;
 }
 /** Current retained Grant authentication and graph truth are separate from protocol completion/history. */
@@ -176,12 +181,13 @@ export function* approveMultisigIpex(hby, protocol, postman, reger, wrapper, opt
     const local = yield* approveMultisigIpexLocally(hby, protocol, reger, wrapper);
     const { embedded, groupHab, genus, approved } = local;
     const embeddedSaid = embedded.said;
-    if (!approved)
-        return { approved: null, accepted: protocol.exc.complete(embeddedSaid), messages: [], deliveries: [] };
+    if (!approved) {
+        return { approved: null, accepted: protocol.exc.complete(embeddedSaid), messages: [], deliveries: [], members: [] };
+    }
     const publication = options.publish
         ? yield* publishGroupIpexProposal(hby, protocol, postman, groupHab, approved, genus)
-        : { messages: [], deliveries: [] };
-    const deliveries = publication.deliveries;
+        : { messages: [], deliveries: [], members: [] };
+    const deliveries = [...publication.deliveries];
     if ((options.sendLead ?? true)
         && hby.db.exns.get([embeddedSaid])?.said === embeddedSaid
         && protocol.exc.lead(groupHab, embeddedSaid)) {
@@ -191,6 +197,7 @@ export function* approveMultisigIpex(hby, protocol, postman, reger, wrapper, opt
         accepted: hby.db.exns.get([embeddedSaid])?.said === embeddedSaid,
         messages: publication.messages,
         deliveries,
+        members: publication.members,
         approved,
     };
 }
@@ -430,6 +437,7 @@ export function* publishInitialGroupIpex(hby, protocol, postman, groupHab, embed
             recipient: message.recipient,
             exnSaid: message.exnSaid,
             payloadSaid: message.payloadSaid,
+            outcome: "delivered",
             deliveries: outcome.deliveries,
         });
     }

package/esm/keri/npm/src/app/ipex/ipex-node-authentication.js

@@ -1,9 +1,10 @@
 /** Node issuer authentication over public KEL/TEL evidence; no conversation or validity policy. */
-import { Diger, NumberPrimitive, Prefixer } from "cesr-ts";
+import { Diger, NumberPrimitive, Prefixer, SerderACDC } from "cesr-ts";
 import { validateRip, validateUpdate, vetBinds, vetBlind, vetBound, } from "../../acdc/regeventing.js";
 import { TransIdxSigGroup } from "../../core/dispatch.js";
 import { DatabaseOperationError } from "../../core/errors.js";
 import { verifyExchangeProofs } from "../../core/exchange/exchange-proofing.js";
+import { envelopeFromFrame } from "../protocol/parsering.js";
 /** Protocol admission authenticates registry observations without imposing an application state vocabulary. */
 export function authenticatedNodeVerdict(authentication) {
     switch (authentication.kind) {
@@ -65,35 +66,57 @@ export function acceptedRegistryEvidence(store, regid) {
     }
     return { rip, updates };
 }
+/**
+ * Whether a Grant's origin node is a fresh issuance: a credential its own sender issues, disclosed with no registry
+ * proof because no registry update has issued it yet. A presentation of an issued credential carries the proof
+ * that opens its registry update, so it never matches. Both are Grants on the wire; only a fresh one is consented to
+ * as an issuance. The answer is the same before and after the registry update is approved.
+ */
+export function isIssuanceOrigin(sender, origin) {
+    const body = origin?.body;
+    if (!(body instanceof SerderACDC) || body.issuer !== sender || !body.regid)
+        return false;
+    const { bsqs, bsss } = envelopeFromFrame(origin);
+    return !bsqs.length && !bsss.length;
+}
 /** A declared registry, then supplied anchors, take precedence over current signatures. */
 export function authenticateIpexNode(serder, envelope, db, registry, historical = false) {
     if (serder.regid) {
         const proofs = [...envelope.bsqs, ...envelope.bsss];
-        if (!proofs.length || !registry)
-            return { kind: "reject" };
+        if (!proofs.length || !registry) {
+            return {
+                kind: "reject",
+                reason: "The node declares a registry but carries no issuer proof or no registry store is open.",
+            };
+        }
         const chain = acceptedRegistryEvidence(registry, serder.regid);
         if (!chain)
             return { kind: "missing", reason: `Missing local TEL evidence for ${serder.regid}.` };
         // A RIP alone authenticates ownership, never a disclosed credential state.
-        if (!chain.updates.length)
-            return { kind: "reject" };
+        if (!chain.updates.length) {
+            return {
+                kind: "reject",
+                reason: "The registry has only its inception; a RIP alone authenticates ownership, never a disclosed credential state.",
+            };
+        }
         let at;
         if (historical) {
             if (!serder.verify() || serder.issuer !== chain.rip.issuer || serder.regid !== chain.rip.said) {
-                return { kind: "reject" };
+                return { kind: "reject", reason: "The node differs from the registry inception it declares." };
             }
             // Authenticate all supplied bodies/duplicates and known bound contradictions
             // before missing evidence wins, independently of attachment order.
             if (proofs.some((proof) => !vetBlind(proof, proof.d.nonce))
                 || new Set(proofs.map((proof) => proof.d.nonce)).size !== proofs.length)
-                return { kind: "reject" };
+                return { kind: "reject", reason: "The disclosed issuer proofs are malformed or repeat a nonce." };
             let unresolved = false;
             for (const proof of proofs) {
                 if (proof.td.nonce && proof.td.nonce !== serder.said)
                     continue;
                 const bound = vetBound(proof, serder, db);
-                if (bound?.kind === "reject")
-                    return { kind: "reject" };
+                if (bound?.kind === "reject") {
+                    return { kind: "reject", reason: "A disclosed issuer proof contradicts the node." };
+                }
                 if (bound)
                     unresolved = true;
             }
@@ -103,7 +126,7 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
                     continue;
                 const matches = chain.updates.filter((event) => event.sad.b === proof.d.nonce);
                 if (matches.length > 1)
-                    return { kind: "reject" };
+                    return { kind: "reject", reason: "Several registry updates match one issuer proof." };
                 if (matches.length)
                     selected.push(matches[0]);
                 else
@@ -111,8 +134,9 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
             }
             if (unresolved)
                 return { kind: "missing", reason: `Missing retained issuer proof evidence for ${serder.said}.` };
-            if (!selected.length)
-                return { kind: "reject" };
+            if (!selected.length) {
+                return { kind: "reject", reason: "No registry update matches the disclosed issuer proofs." };
+            }
             const candidates = new Set(selected.map((event) => event.said));
             // Accepted history is ascending. Vacuous and other-target openings cannot
             // advance this issuer prefix; generic source locators never select it.
@@ -131,7 +155,7 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
         }
         return result.kind === "verified" && result.state.regid === serder.regid
             ? { kind: "authenticated", registration: result.state }
-            : { kind: "reject" };
+            : { kind: "reject", reason: "The registry update does not bind the node." };
     }
     // Disclosed inner rd without top-level rd is an unsupported hidden issuer registry.
     // Compact aggregate entries expose no declaration and remain opaque here.
@@ -139,15 +163,15 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
     const sections = [serder.sad.a, ...(Array.isArray(aggregate) ? aggregate.slice(1) : [aggregate])];
     if (sections.some(section => section && typeof section === "object" && !Array.isArray(section)
         && section.rd))
-        return { kind: "reject" };
+        return { kind: "reject", reason: "A disclosed inner registry has no top-level declaration." };
     if (!serder.issuer)
-        return { kind: "reject" };
+        return { kind: "reject", reason: "The node names no issuer." };
     let issuer;
     try {
         issuer = new Prefixer({ qb64: serder.issuer });
     }
     catch {
-        return { kind: "reject" };
+        return { kind: "reject", reason: "The node names a malformed issuer." };
     }
     const sourceSeals = [
         ...envelope.sscs.map((seal) => ({ i: issuer, ...seal })),
@@ -159,7 +183,7 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
             ? { kind: "missing", reason: `Missing issuer KEL anchor for ${serder.said}.` }
             : result.sourceSeals.length > 0
                 ? { kind: "authenticated", registration: null }
-                : { kind: "reject" };
+                : { kind: "reject", reason: "No issuer KEL anchor seals the node." };
     }
     const explicit = envelope.tsgs.filter((group) => group.pre === issuer.qb64);
     const last = envelope.ssgs.filter((group) => group.pre === issuer.qb64);
@@ -181,5 +205,5 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
         ? { kind: "missing", reason: `Missing current issuer KEL evidence for ${serder.said}.` }
         : result.tsgs.length + result.cigars.length > 0
             ? { kind: "authenticated", registration: null }
-            : { kind: "reject" };
+            : { kind: "reject", reason: "No current issuer signature authenticates the node." };
 }

package/esm/keri/npm/src/app/ipex/issuance.js

@@ -393,6 +393,10 @@ export class IssuanceOperations {
         deps.changes?.push({ kind: "issuance", id: group.said });
         return { grant: group.said, xid };
     }
+    /** Whether the live operation for `grant` still holds a message the transport has not taken. */
+    owes(grant) {
+        return (this.live.get(grant)?.outbox.length ?? 0) > 0;
+    }
     /** One pass of the issuer loop, in the order of the CLI loop it replaces. */
     *step(op) {
         if (op.group) {
@@ -776,7 +780,11 @@ function heldRoot(deps, hab, grant) {
  * worker and drives nothing: someone else must call `processOnce`.
  */
 export function* waitForIssuance(ops, grant, { timeoutMs, clock = ops.deps.clock, until = (status) => status.state !== "active" }) {
-    const settled = yield* observeUntil(() => until(issuanceStatus(ops, grant)), { timeoutMs, clock });
+    // A phase is not reached while the step that produced it still owes a delivery: the host would stop its workers first.
+    const settled = yield* observeUntil(() => until(issuanceStatus(ops, grant)) && !ops.owes(grant), {
+        timeoutMs,
+        clock,
+    });
     const status = issuanceStatus(ops, grant);
     return settled ? { outcome: "settled", status } : { outcome: "timed-out", status, timeoutMs };
 }

package/esm/keri/npm/src/app/ipex/presenting.js

@@ -87,6 +87,10 @@ export class PresentationOperations {
             value: new Map()
         });
     }
+    /** Whether the live presentation `said` still holds a message the transport has not taken. */
+    owes(said) {
+        return (this.live.get(said)?.outbox.length ?? 0) > 0;
+    }
     /** Whether a delivery is live. */
     active() {
         return this.live.size > 0;
@@ -340,7 +344,10 @@ export function presentationStatus(ops, said) {
  * nothing: someone else must call `processOnce`.
  */
 export function* waitForPresentation(ops, said, { timeoutMs, clock = ops.deps.clock, until = (status) => status.state !== "active" }) {
-    const settled = yield* observeUntil(() => until(presentationStatus(ops, said)), { timeoutMs, clock });
+    const settled = yield* observeUntil(() => until(presentationStatus(ops, said)) && !ops.owes(said), {
+        timeoutMs,
+        clock,
+    });
     const status = presentationStatus(ops, said);
     return settled ? { outcome: "settled", status } : { outcome: "timed-out", status, timeoutMs };
 }

package/esm/keri/npm/src/app/ipex/unblinding-workflow.js

@@ -135,6 +135,10 @@ export class UnblindingOperations {
             value: null
         });
     }
+    /** Whether the live operation for `grant` still holds a message the transport has not taken. */
+    owes(grant) {
+        return (this.live.get(grant)?.outbox.length ?? 0) > 0;
+    }
     /**
      * Whether a pass has work: a live operation, or an owner holds an authenticated peer query whose reply is
      * owed (an in-memory walk of the owners, no store read).
@@ -635,7 +639,10 @@ export function unblindingStatus(ops, grant) {
  * someone else must call `processOnce`.
  */
 export function* waitForUnblinding(ops, grant, { timeoutMs, clock = ops.deps.clock }) {
-    const settled = yield* observeUntil(() => unblindingStatus(ops, grant).state !== "active", { timeoutMs, clock });
+    const settled = yield* observeUntil(() => unblindingStatus(ops, grant).state !== "active" && !ops.owes(grant), {
+        timeoutMs,
+        clock,
+    });
     const status = unblindingStatus(ops, grant);
     return settled ? { outcome: "settled", status } : { outcome: "timed-out", status, timeoutMs };
 }

package/esm/keri/npm/src/app/multisig/counseling.js

@@ -35,7 +35,7 @@
  * restart never leaves a delegated event waiting for one. Collaborators are
  * narrow (ADR-0013); nothing here reaches a runtime.
  */
-import { Diger, Ilks, NumberPrimitive, NumDex, Verfer } from "cesr-ts";
+import { Diger, Ilks, NumberPrimitive, NumDex, ParserError, Verfer } from "cesr-ts";
 import { ValidationError } from "../../core/errors.js";
 import { Kever } from "../../core/kel/kever.js";
 import { dgKey } from "../../db/core/keys.js";
@@ -394,6 +394,12 @@ export class Counselor {
             // A witness refusing or being unreachable is a remote outcome: report it in status and retry later.
             run.failure = error instanceof Error ? error.message : String(error);
             run.delay = Math.min(run.delay * 2, this.receiptRetry.maxMs);
+            // A witness that answered with a reply this member cannot read (a receipt the elected member already
+            // obtained) will not answer better later: submit on the next attempt instead of waiting out the grace.
+            if (!submit && error instanceof ParserError) {
+                run.fallbackAfterMs = 0;
+                run.delay = this.receiptRetry.baseMs;
+            }
         }
         run.nextAt = now + run.delay;
         if (!this.hby.db.fullyWitnessed(serder))

package/esm/keri/npm/src/app/multisig/multisig-messaging.js

@@ -142,23 +142,50 @@ export function* sendGroupMessage(postman, prepared) {
         recipient: prepared.recipient,
         exnSaid: prepared.exnSaid,
         payloadSaid: prepared.payloadSaid,
+        outcome: "delivered",
         deliveries: [...outcome.deliveries],
     };
 }
-/** Collect successful recipient outcomes into message identities and completed target URLs. */
+/** The outcome of sending `prepared` as a failed delivery with the transport's reason. */
+export function failedGroupDelivery(prepared, error) {
+    return {
+        recipient: prepared.recipient,
+        exnSaid: prepared.exnSaid,
+        payloadSaid: prepared.payloadSaid,
+        outcome: "failed",
+        deliveries: [],
+        reason: error instanceof Error ? error.message : String(error),
+    };
+}
+/**
+ * Like {@link sendGroupMessage}, but a transport failure is this member's outcome and not an error: the wrapper
+ * is already accepted locally, so one unreachable member must not stop the others or the caller's next step.
+ */
+export function* deliverGroupMessage(postman, prepared) {
+    try {
+        return yield* sendGroupMessage(postman, prepared);
+    }
+    catch (error) {
+        return failedGroupDelivery(prepared, error);
+    }
+}
+/** Collect recipient outcomes: delivered message identities and completed target URLs, and every member's outcome. */
 export function groupSendResult(outcomes) {
+    const delivered = outcomes.filter(outcome => outcome.outcome === "delivered");
     return {
-        messages: outcomes.map(({ recipient, exnSaid, payloadSaid }) => ({ recipient, exnSaid, payloadSaid })),
-        deliveries: outcomes.flatMap(outcome => outcome.deliveries),
+        messages: delivered.map(({ recipient, exnSaid, payloadSaid }) => ({ recipient, exnSaid, payloadSaid })),
+        deliveries: delivered.flatMap(outcome => outcome.deliveries),
+        members: [...outcomes],
     };
 }
 /**
  * Process the exact signed local contribution before admitting remote delivery,
  * so an immediate peer reply cannot outrun local Multiplexor evidence. Await
- * normal intake, then send the same bytes without signing again. Intake or send
- * failures propagate; no cross-store/network transaction is implied.
+ * normal intake, then send the same bytes without signing again. Intake failures
+ * propagate; a send failure is the member's `failed` outcome. No cross-store/network
+ * transaction is implied.
  */
 export function* admitAndSendGroupMessage(input, postman, prepared) {
     yield* input.processBytes(prepared.message, { local: true });
-    return yield* sendGroupMessage(postman, prepared);
+    return yield* deliverGroupMessage(postman, prepared);
 }

package/esm/keri/npm/src/app/multisig/multisig-workflows.js

@@ -25,7 +25,7 @@ import { abortable } from "../runtime/abortable.js";
 import { collectBytes } from "../transport/byte-source.js";
 import { findLocalGroupMember as findLocalMember, groupMemberHasKey, uniqueMembers } from "./group-members.js";
 import { acdcV2RegistryProposal, MULTISIG_ICP_ROUTE, MULTISIG_ISS_ROUTE, MULTISIG_IXN_ROUTE, MULTISIG_REV_ROUTE, MULTISIG_ROT_ROUTE, MULTISIG_RPY_ROUTE, MULTISIG_VCP_ROUTE, multisigChild, multisigChildEvidence, multisigChildGenusAttrs, prepareAcdcV2RegistryExn, prepareMultisigEventExn, prepareMultisigVdrExn, registryProposalEvent, } from "./grouping.js";
-import { admitAndSendGroupMessage, groupSendResult, prepareGroupMessage, remoteGroupMembers, signGroupMessage, storedGroupMessage, } from "./multisig-messaging.js";
+import { admitAndSendGroupMessage, failedGroupDelivery, groupSendResult, prepareGroupMessage, remoteGroupMembers, signGroupMessage, storedGroupMessage, } from "./multisig-messaging.js";
 /** Approve one exact ACDC v2 TEL/anchor through existing member signing and ordinary processors.
  * A returned wrapper records consent, not quorum/witness/TEL completion; retry the accepted-state owners.
  * `resume` reuses this member's recorded anchor signatures after a crash instead of signing again.
@@ -135,14 +135,10 @@ export function* publishAcdcV2Registry(hby, postman, group, approval) {
             notify: true,
         });
         const outcome = yield* postman.wait(evt);
-        if (outcome.kin === "failed")
-            throw outcome.error;
-        outcomes.push({
-            recipient,
-            exnSaid: approval[0].said,
-            payloadSaid: approval[0].sad.a.anc,
-            deliveries: outcome.deliveries,
-        });
+        const ref = { recipient, exnSaid: approval[0].said, payloadSaid: approval[0].sad.a.anc };
+        outcomes.push(outcome.kin === "failed"
+            ? failedGroupDelivery(ref, outcome.error)
+            : { ...ref, outcome: "delivered", deliveries: outcome.deliveries });
     }
     return groupSendResult(outcomes);
 }

package/esm/keri/npm/src/cli/credentials/ipex.js

@@ -372,7 +372,10 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
         throw new ValidationError(`Multisig IPEX sender ${group ?? "<missing>"} is not a local group AID.`);
     }
     if (!ipexArgs.auto) {
-        return { exn, group: { embedded, accepted: null, approved: null, lead: null, messages: [], deliveries: [] } };
+        return {
+            exn,
+            group: { embedded, accepted: null, approved: null, lead: null, messages: [], deliveries: [], members: [] },
+        };
     }
     if (embedded.pvrsn.major === 2) {
         // ACDC v2: the runtime's group IPEX owner approves, publishes, collects and lets the lead deliver.
@@ -393,6 +396,7 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
                 lead: runtime.exc.lead(hby.habs.get(group), said),
                 messages: outcome?.messages ?? [],
                 deliveries: [...(outcome?.deliveries ?? []), ...(outcome?.sent ?? [])],
+                members: outcome?.members ?? [],
             },
         };
     }
@@ -416,6 +420,7 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
                         credentialSaved,
                         messages: [],
                         deliveries: [],
+                        members: [],
                     },
                 };
             }
@@ -437,6 +442,7 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
                 credentialSaved,
                 messages: approval.messages,
                 deliveries: approval.deliveries,
+                members: approval.members,
             },
         };
     }

package/esm/keri/npm/src/cli/messaging/group-join.js

@@ -3,7 +3,8 @@
  *
  * Join approves exactly one stored proposal, the first the user consents to:
  * - an explicit `--said` names the proposal, otherwise the unapproved proposals
- *   the notice store announces are offered in notice order;
+ *   the notice store announces are offered in notice order; `--kind` restricts the
+ *   offer (and a `--said`) to one proposal kind, so a join never signs another kind;
  * - without `--auto` every offered proposal is shown and approved only on a yes;
  * - with `--auto` the first offered proposal is approved without a prompt. This is
  *   the whole of auto consent: it exists only inside the `join` the user ran for
@@ -19,17 +20,20 @@ function joinedGroup(hby, group) {
     return group === undefined ? undefined : (hby.habByName(group) ?? hby.habs.get(group))?.pre ?? undefined;
 }
 /** Candidates for one pass, oldest first. */
-function candidates(deps, { said, group }) {
+function candidates(deps, { said, group, kind }) {
     const wanted = joinedGroup(deps.hby, group);
     if (said !== undefined) {
         const proposal = findGroupProposal(deps, said);
+        if (proposal && kind !== undefined && proposal.kind !== kind) {
+            throw new ValidationError(`Multisig exchange ${said} is a ${proposal.kind} proposal, not ${kind}.`);
+        }
         if (proposal && wanted !== undefined && proposal.group !== wanted) {
             throw new ValidationError(`Multisig exchange ${said} belongs to group ${proposal.group}, not ${wanted}.`);
         }
         return proposal ? [proposal] : [];
     }
     return listGroupProposals(deps, wanted === undefined ? {} : { group: wanted })
-        .filter(proposal => proposal.local === "unapproved");
+        .filter(proposal => proposal.local === "unapproved" && (kind === undefined || proposal.kind === kind));
 }
 /**
  * Approve the first proposal the user consents to, polling stored proposals until