keri-ts 2.2.0 → 2.2.2

package/esm/keri/npm/src/app/ipex/group-ipex.js

@@ -23,6 +23,7 @@
  */
 import { concatBytes, Counter, Vrsn_2_0 } from "cesr-ts";
 import { ValidationError } from "../../core/errors.js";
+import { loadNests } from "../../db/exchange/exchange-nests.js";
 import { registryEventStatus, settleRegistryEvent } from "../credentials/registry-settling.js";
 import { isLocalGroupHab } from "../multisig/group-members.js";
 import { MULTISIG_EXN_ROUTE } from "../multisig/grouping.js";
@@ -30,6 +31,8 @@ import { RetryBackoff } from "../runtime/retry-backoff.js";
 import { observeUntil } from "../runtime/workflow-contract.js";
 import { IpexAdmitter } from "./ipex-admitting.js";
 import { approveMultisigIpexLocally, approveStoredMultisigIpexWrappers, findStoredMultisigIpex, groupIpexApproved, prepareAcdcV2GroupIpex, publishGroupIpexProposal, publishInitialGroupIpex, requireAcdcV2GroupUse, sendCompletedGroupIpex, storedMultisigIpexBody, } from "./ipex-grouping.js";
+import { isIssuanceOrigin } from "./ipex-node-authentication.js";
+import { IPEX_GRANT_ROUTE } from "./ipexing.js";
 /** Milliseconds between collections of the other members' stored contributions. */
 export const GROUP_IPEX_COLLECT_MS = 250;
 /** How long delivery failures may last before an operation ends `failed`; a group IPEX message has no deadline. */
@@ -186,6 +189,7 @@ export class GroupIpexOperations {
         this.outcomes.set(op.said, {
             messages: op.publication?.messages ?? [],
             deliveries: op.publication?.deliveries ?? [],
+            members: op.publication?.members ?? [],
             sent: op.deliveries,
         });
         this.deps.changes?.push({ kind: "ipex", id: op.said });
@@ -257,6 +261,9 @@ export function groupIpexProposals(ops, hab) {
             continue;
         if (found.some((item) => item.said === embedded.said))
             continue;
+        if (embedded.route === IPEX_GRANT_ROUTE
+            && isIssuanceOrigin(group, loadNests(hby.db, wrapper.said)[0]?.nests?.[0]))
+            continue;
         found.push({
             said: embedded.said,
             route: embedded.route,
@@ -319,6 +326,13 @@ export function groupIpexStatus(ops, said) {
     }
     return { state: "active", phase: "awaitingConsent", needs: "approve" };
 }
+/**
+ * The member wrappers this process has published for one message: from the live operation once it published, from
+ * the outcome after it ended. Empty before publication. A pure read.
+ */
+export function groupIpexMessages(ops, said) {
+    return ops.live.get(said)?.publication?.messages ?? ops.outcomes.get(said)?.messages ?? [];
+}
 /** Observe until the message is accepted and delivered, or ended, or the budget expires. Starts no worker. */
 export function* waitForGroupIpex(ops, said, { timeoutMs, clock = ops.deps.clock, until = (status) => status.state !== "active" }) {
     const settled = yield* observeUntil(() => until(groupIpexStatus(ops, said)), { timeoutMs, clock });

package/esm/keri/npm/src/app/ipex/group-issuance.js

@@ -45,11 +45,12 @@ import { timestampMicros } from "../../time/mod.js";
 import { registryEventRef, registryEventStatus, settleRegistryEvent, } from "../credentials/registry-settling.js";
 import { groupElectedMember, groupSigningMembers, isLocalGroupHab, latestGroupContribution, localGroupMember, } from "../multisig/group-members.js";
 import { MULTISIG_EXN_ROUTE, MULTISIG_IPEX_PROOF_ROUTE, MULTISIG_QRY_ROUTE, MULTISIG_RPY_ROUTE, multisigExnBody, } from "../multisig/grouping.js";
+import { remoteGroupMembers } from "../multisig/multisig-messaging.js";
 import { proposeRegistryEvent } from "../multisig/proposing.js";
 import { envelopeFromFrame } from "../protocol/parsering.js";
 import { exchangeWire } from "./ipex-discloser.js";
-import { acceptedRegistryEvidence } from "./ipex-node-authentication.js";
-import { ISSUANCE_QUERY_RESEND_MS, } from "./issuance.js";
+import { acceptedRegistryEvidence, isIssuanceOrigin } from "./ipex-node-authentication.js";
+import { ISSUANCE_QUERY_RESEND_MS, partyComplete, } from "./issuance.js";
 /** Milliseconds between scans of the stored wrappers for the final proof. */
 const PROOF_SCAN_MS = 1000;
 /** How many of the group's latest accepted events {@link deriveGroupCustody} considers as coordinators. */
@@ -119,9 +120,9 @@ export class GroupParty {
     get lead() {
         return this.member.pre === this.custodian;
     }
-    /** The other current signing members of the group. */
+    /** The other current signing members of the group that are not held in this Habery; local ones share its stores. */
     others() {
-        return groupSigningMembers(this.hby, this.group.pre).filter((peer) => peer !== this.member.pre);
+        return remoteGroupMembers(this.hby, this.member, groupSigningMembers(this.hby, this.group.pre));
     }
     /** The election this party stands for. */
     election() {
@@ -269,6 +270,8 @@ export function groupIssuanceProposals(ops, group) {
                 ? child.pre !== group.pre
                 : !hby.habs.get(child.pre) || !isLocalGroupHab(hby, hby.habs.get(child.pre))))
             continue;
+        if (!isIssuanceOrigin(child.pre, loadNests(hby.db, parent.said)[0]?.nests?.[0]))
+            continue;
         const self = localGroupMember(hby, child.pre).pre, known = found.get(child.said);
         if (known && (parent.pre === self || known.proposer !== self))
             continue;
@@ -324,7 +327,7 @@ function* proposalOf(ops, grant, proposal) {
  */
 export function* approveGroupIssuance(ops, grantSaid, options = {}) {
     const { deps, discloser } = ops;
-    if (ops.live.has(grantSaid) || deps.exc.complete(grantSaid)) {
+    if (ops.liveOf(grantSaid, "issuer") || partyComplete(deps, grantSaid, "issuer")) {
         throw new ValidationError("Issuance was already begun for this Grant");
     }
     const { child } = yield* proposalOf(ops, grantSaid, options.proposal);
@@ -410,7 +413,7 @@ function pendingGrant(deps, said) {
  */
 export function approveGroupIssuanceExchange(ops, said, coordinator) {
     const { deps } = ops;
-    if (ops.live.has(said) || deps.exc.complete(said)) {
+    if (ops.liveOf(said, "holder") || partyComplete(deps, said, "holder")) {
         throw new ValidationError("Issuance was already begun for this Grant");
     }
     const { grant, nodes } = pendingGrant(deps, said);
@@ -427,7 +430,7 @@ export function approveGroupIssuanceExchange(ops, said, coordinator) {
  */
 export function* followGroupIssuanceProof(ops, said, options = {}) {
     const { deps } = ops;
-    if (ops.live.has(said) || deps.exc.complete(said)) {
+    if (ops.liveOf(said, "issuer") || partyComplete(deps, said, "issuer")) {
         throw new ValidationError("Issuance was already begun for this Grant");
     }
     const { grant, nodes } = pendingGrant(deps, said);
@@ -644,7 +647,7 @@ export function registerGroupRoutes(ops) {
             acceptsNests: true,
             verify: (args) => structural(deps.hby, args.serder, args.nests ?? []),
             handle: (args) => {
-                for (const op of ops.live.values()) {
+                for (const op of ops.liveOps()) {
                     if (op.group?.accepts(args.serder, args.nests)) {
                         op.group.pending.set(args.serder.said, { wrapper: args.serder, child: args.nests[0] });
                     }
@@ -758,7 +761,10 @@ export function* stepGroup(ops, op) {
         for (const peer of party.others())
             yield* send(peer, msg);
     };
-    if (deps.exc.complete(grant))
+    // The accepted Grant is one fact of the Habery. A holder in the issuer's own Habery is not finished by the issuer
+    // finishing it: its key exchange completes, and its proof goes to its members, in its own steps.
+    const issuerHere = op.role === "holder" && deps.hby.habs.has(g.grant.pre);
+    if (deps.exc.complete(grant) && (!issuerHere || g.mode === "resumed"))
         return true;
     if (op.expires === null) {
         const deadline = deps.exc.exchangeDeadline(g.grant);

package/esm/keri/npm/src/app/ipex/ipex-building.js

@@ -40,7 +40,8 @@ export function ipexExnBody(sender, route, nodes, options) {
             throw new Error("IPEX reply parties do not match the prior.");
         }
         if (verb === "spurn" && prior.route === "/ipex/grant" && prior.sad.p) {
-            throw new Error("Only an opening grant may be spurned.");
+            throw new Error("Only a flow-starting Grant (one with no prior) may be spurned; a Grant that answers an Apply or Agree has no "
+                + "rejection message, so do not Admit it and keep it as evidence.");
         }
         recipient = prior.pre;
         xid = prior.ilk === "xip" ? prior.said : prior.sad.x;

package/esm/keri/npm/src/app/ipex/ipex-discloser.js

@@ -25,6 +25,12 @@ import { ipexExnBody, prepareIpexExn } from "./ipex-building.js";
 import { walkIpexGraph } from "./ipex-graph.js";
 import { acceptedRegistryEvidence, authenticateIpexNode, issuedNodeVerdict } from "./ipex-node-authentication.js";
 import { ipexGrantWalk } from "./ipex-v2.js";
+/** Refuse the builder's `prior` where the disclosure API names the prior exchange by `priorSaid`. */
+function refuseBuilderPrior(options) {
+    if (options.prior !== undefined) {
+        throw new ValidationError("Name the prior exchange with priorSaid; prior is not a disclosure option.");
+    }
+}
 /** Reuse a matching accepted KEL seal, or author once and gather real witness receipts. */
 export function* anchorExchange(hby, receiptor, hab, body, auths) {
     if (receiptor.hby !== hby)
@@ -61,8 +67,10 @@ export function exchangeWire(hab, exn, nested = new Uint8Array(), source, gvrsn
     return concatBytes(Counter.makeGVC(gvrsn), exn.raw, Counter.enclose({ qb64: concatBytes(proof, nested), version: gvrsn }));
 }
 /**
- * Re-encode a signed exchange from its retained, authenticated factors: the wire its signer sent, rebuilt
- * from the stored signatures or source seal and the stored nests. Signs nothing, so it needs no keys.
+ * Re-encode a signed exchange from its retained, authenticated factors: the exact bytes its signer presented,
+ * rebuilt from the stored signatures or source seal and the stored nests (`runtime.exc.retainedInput(said)` supplies
+ * them). Signs nothing, so it needs no keys. Public: a host that must hand the presented bytes to a third party
+ * reads them with this instead of re-signing.
  */
 export function* storedExchangeWire(retained, gvrsn = Vrsn_2_0) {
     const nests = [...retained.nests ?? []];
@@ -367,22 +375,30 @@ export class IpexDiscloser {
     }
     /** Create an application request; no credential-use approval is invented for negotiation. */
     *prepareApply(sender, options) {
-        const hab = this.signer(sender, options.gvrsn ?? Vrsn_2_0), exn = ipexExnBody(sender, "/ipex/apply", [], options);
+        const hab = this.signer(sender, options.gvrsn ?? Vrsn_2_0), exn = this.applyBody(sender, options);
         return {
             exn,
             wire: exchangeWire(hab, exn, undefined, undefined, options.gvrsn ?? Vrsn_2_0),
             support: new Uint8Array(),
         };
     }
+    /** The unsigned Apply body, for a sender that signs elsewhere (a group's members each sign their share). */
+    applyBody(sender, options) {
+        return ipexExnBody(sender, "/ipex/apply", [], options);
+    }
     /** Accept or decline the exact authenticated predecessor and its negotiated anchoring choice. */
     *prepareReply(sender, verb, priorSaid, message = "", recipient, auths) {
-        const hab = this.signer(sender), prior = yield* this.prior(priorSaid);
-        const exn = ipexExnBody(sender, `/ipex/${verb}`, [], { message, prior, recipient });
+        const hab = this.signer(sender), exn = yield* this.replyBody(sender, verb, priorSaid, message, recipient);
         const source = verb === "agree" && exn.sad.a.ax?.[0]
             ? yield* anchorExchange(this.hby, this.receiptor, hab, exn, auths)
             : undefined;
         return { exn, wire: exchangeWire(hab, exn, undefined, source), support: source ? this.kel(hab) : new Uint8Array() };
     }
+    /** The unsigned Agree or Spurn body answering an accepted, authenticated predecessor. */
+    *replyBody(sender, verb, priorSaid, message = "", recipient) {
+        const prior = yield* this.prior(priorSaid);
+        return ipexExnBody(sender, `/ipex/${verb}`, [], { message, prior, recipient });
+    }
     /** Extend the frozen Grant's exact origin proof; ordinary intake still authenticates the supplied presentation evidence. */
     *attachPresentationProof(prepared, opening, source) {
         const frames = parseBytes(prepared.raw), node = frames[0].body;
@@ -463,15 +479,22 @@ export class IpexDiscloser {
     }
     /** Offer only the selected commitment/view without issuer proof attachments. */
     *prepareOffer(sender, selection, options) {
-        const hab = this.signer(sender, options.gvrsn ?? Vrsn_2_0), prior = yield* this.prior(options.priorSaid);
-        const raw = yield* this.selected(selection, true);
-        const [exn, nests] = yield* prepareIpexExn(sender, "/ipex/offer", raw, { ...options, prior });
+        const hab = this.signer(sender, options.gvrsn ?? Vrsn_2_0);
+        const { exn, nests } = yield* this.prepareOfferBody(sender, selection, options);
         return {
             exn,
             wire: exchangeWire(hab, exn, nests, undefined, options.gvrsn ?? Vrsn_2_0),
             support: new Uint8Array(),
         };
     }
+    /** Freeze an Offer body and its nested evidence without signing, for a sender that signs elsewhere. */
+    *prepareOfferBody(sender, selection, options) {
+        refuseBuilderPrior(options);
+        const prior = yield* this.prior(options.priorSaid);
+        const raw = yield* this.selected(selection, true);
+        const [exn, nests] = yield* prepareIpexExn(sender, "/ipex/offer", raw, { ...options, prior });
+        return { exn, nests };
+    }
     /** Select and authorize once before freezing a Grant body, without signing or committing group approval. */
     *prepareGrantBody(sender, selection, options) {
         return yield* this.grantBody(sender, selection, options, false);
@@ -482,6 +505,7 @@ export class IpexDiscloser {
     }
     /** Both public preparation profiles preserve the same selected view and body construction. */
     *grantBody(sender, selection, options, pendingPresentation) {
+        refuseBuilderPrior(options);
         const hab = this.hby.habs.get(sender);
         if (!hab?.kever || (options.gvrsn ?? Vrsn_2_0).major < 2) {
             throw new ValidationError("ACDC v2 Grant preparation requires an accepted local sender and attachment genus 2.");

package/esm/keri/npm/src/app/ipex/ipex-grouping.js

@@ -36,15 +36,20 @@ function acdcV2GraphUse(hby, registry, origin, nests, walk) {
     const graph = walkIpexGraph(origin, nests, walk);
     if (!graph)
         throw new ValidationError("ACDC v2 group graph is malformed or incomplete.");
-    const verdicts = new Map();
+    const verdicts = new Map(), why = [];
     for (const [said, node] of graph.nodes) {
-        verdicts.set(said, issuedNodeVerdict(authenticateIpexNode(node.body, envelopeFromFrame(node), hby.db, registry)));
+        const authentication = authenticateIpexNode(node.body, envelopeFromFrame(node), hby.db, registry);
+        verdicts.set(said, issuedNodeVerdict(authentication));
+        if (authentication.kind !== "authenticated")
+            why.push(`${said} ${authentication.kind}: ${authentication.reason}`);
     }
     const verdict = evaluateChain(graph, verdicts, hby.db);
     if (verdict?.kind === "unknown" && verdict.retryable)
         return null;
-    if (verdict?.kind !== "valid")
-        throw new ValidationError("ACDC v2 group graph is false or unresolved.");
+    if (verdict?.kind !== "valid") {
+        const found = !verdict ? "no verdict" : verdict.kind === "unknown" ? `unknown: ${verdict.reason}` : verdict.kind;
+        throw new ValidationError(`ACDC v2 group graph is false or unresolved (${found}${why.length ? `; ${why.join("; ")}` : ""}).`);
+    }
     return true;
 }
 /** Current retained Grant authentication and graph truth are separate from protocol completion/history. */
@@ -176,12 +181,13 @@ export function* approveMultisigIpex(hby, protocol, postman, reger, wrapper, opt
     const local = yield* approveMultisigIpexLocally(hby, protocol, reger, wrapper);
     const { embedded, groupHab, genus, approved } = local;
     const embeddedSaid = embedded.said;
-    if (!approved)
-        return { approved: null, accepted: protocol.exc.complete(embeddedSaid), messages: [], deliveries: [] };
+    if (!approved) {
+        return { approved: null, accepted: protocol.exc.complete(embeddedSaid), messages: [], deliveries: [], members: [] };
+    }
     const publication = options.publish
         ? yield* publishGroupIpexProposal(hby, protocol, postman, groupHab, approved, genus)
-        : { messages: [], deliveries: [] };
-    const deliveries = publication.deliveries;
+        : { messages: [], deliveries: [], members: [] };
+    const deliveries = [...publication.deliveries];
     if ((options.sendLead ?? true)
         && hby.db.exns.get([embeddedSaid])?.said === embeddedSaid
         && protocol.exc.lead(groupHab, embeddedSaid)) {
@@ -191,6 +197,7 @@ export function* approveMultisigIpex(hby, protocol, postman, reger, wrapper, opt
         accepted: hby.db.exns.get([embeddedSaid])?.said === embeddedSaid,
         messages: publication.messages,
         deliveries,
+        members: publication.members,
         approved,
     };
 }
@@ -430,6 +437,7 @@ export function* publishInitialGroupIpex(hby, protocol, postman, groupHab, embed
             recipient: message.recipient,
             exnSaid: message.exnSaid,
             payloadSaid: message.payloadSaid,
+            outcome: "delivered",
             deliveries: outcome.deliveries,
         });
     }

package/esm/keri/npm/src/app/ipex/ipex-node-authentication.js

@@ -1,9 +1,10 @@
 /** Node issuer authentication over public KEL/TEL evidence; no conversation or validity policy. */
-import { Diger, NumberPrimitive, Prefixer } from "cesr-ts";
+import { Diger, NumberPrimitive, Prefixer, SerderACDC } from "cesr-ts";
 import { validateRip, validateUpdate, vetBinds, vetBlind, vetBound, } from "../../acdc/regeventing.js";
 import { TransIdxSigGroup } from "../../core/dispatch.js";
 import { DatabaseOperationError } from "../../core/errors.js";
 import { verifyExchangeProofs } from "../../core/exchange/exchange-proofing.js";
+import { envelopeFromFrame } from "../protocol/parsering.js";
 /** Protocol admission authenticates registry observations without imposing an application state vocabulary. */
 export function authenticatedNodeVerdict(authentication) {
     switch (authentication.kind) {
@@ -65,35 +66,57 @@ export function acceptedRegistryEvidence(store, regid) {
     }
     return { rip, updates };
 }
+/**
+ * Whether a Grant's origin node is a fresh issuance: a credential its own sender issues, disclosed with no registry
+ * proof because no registry update has issued it yet. A presentation of an issued credential carries the proof
+ * that opens its registry update, so it never matches. Both are Grants on the wire; only a fresh one is consented to
+ * as an issuance. The answer is the same before and after the registry update is approved.
+ */
+export function isIssuanceOrigin(sender, origin) {
+    const body = origin?.body;
+    if (!(body instanceof SerderACDC) || body.issuer !== sender || !body.regid)
+        return false;
+    const { bsqs, bsss } = envelopeFromFrame(origin);
+    return !bsqs.length && !bsss.length;
+}
 /** A declared registry, then supplied anchors, take precedence over current signatures. */
 export function authenticateIpexNode(serder, envelope, db, registry, historical = false) {
     if (serder.regid) {
         const proofs = [...envelope.bsqs, ...envelope.bsss];
-        if (!proofs.length || !registry)
-            return { kind: "reject" };
+        if (!proofs.length || !registry) {
+            return {
+                kind: "reject",
+                reason: "The node declares a registry but carries no issuer proof or no registry store is open.",
+            };
+        }
         const chain = acceptedRegistryEvidence(registry, serder.regid);
         if (!chain)
             return { kind: "missing", reason: `Missing local TEL evidence for ${serder.regid}.` };
         // A RIP alone authenticates ownership, never a disclosed credential state.
-        if (!chain.updates.length)
-            return { kind: "reject" };
+        if (!chain.updates.length) {
+            return {
+                kind: "reject",
+                reason: "The registry has only its inception; a RIP alone authenticates ownership, never a disclosed credential state.",
+            };
+        }
         let at;
         if (historical) {
             if (!serder.verify() || serder.issuer !== chain.rip.issuer || serder.regid !== chain.rip.said) {
-                return { kind: "reject" };
+                return { kind: "reject", reason: "The node differs from the registry inception it declares." };
             }
             // Authenticate all supplied bodies/duplicates and known bound contradictions
             // before missing evidence wins, independently of attachment order.
             if (proofs.some((proof) => !vetBlind(proof, proof.d.nonce))
                 || new Set(proofs.map((proof) => proof.d.nonce)).size !== proofs.length)
-                return { kind: "reject" };
+                return { kind: "reject", reason: "The disclosed issuer proofs are malformed or repeat a nonce." };
             let unresolved = false;
             for (const proof of proofs) {
                 if (proof.td.nonce && proof.td.nonce !== serder.said)
                     continue;
                 const bound = vetBound(proof, serder, db);
-                if (bound?.kind === "reject")
-                    return { kind: "reject" };
+                if (bound?.kind === "reject") {
+                    return { kind: "reject", reason: "A disclosed issuer proof contradicts the node." };
+                }
                 if (bound)
                     unresolved = true;
             }
@@ -103,7 +126,7 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
                     continue;
                 const matches = chain.updates.filter((event) => event.sad.b === proof.d.nonce);
                 if (matches.length > 1)
-                    return { kind: "reject" };
+                    return { kind: "reject", reason: "Several registry updates match one issuer proof." };
                 if (matches.length)
                     selected.push(matches[0]);
                 else
@@ -111,8 +134,9 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
             }
             if (unresolved)
                 return { kind: "missing", reason: `Missing retained issuer proof evidence for ${serder.said}.` };
-            if (!selected.length)
-                return { kind: "reject" };
+            if (!selected.length) {
+                return { kind: "reject", reason: "No registry update matches the disclosed issuer proofs." };
+            }
             const candidates = new Set(selected.map((event) => event.said));
             // Accepted history is ascending. Vacuous and other-target openings cannot
             // advance this issuer prefix; generic source locators never select it.
@@ -131,7 +155,7 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
         }
         return result.kind === "verified" && result.state.regid === serder.regid
             ? { kind: "authenticated", registration: result.state }
-            : { kind: "reject" };
+            : { kind: "reject", reason: "The registry update does not bind the node." };
     }
     // Disclosed inner rd without top-level rd is an unsupported hidden issuer registry.
     // Compact aggregate entries expose no declaration and remain opaque here.
@@ -139,15 +163,15 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
     const sections = [serder.sad.a, ...(Array.isArray(aggregate) ? aggregate.slice(1) : [aggregate])];
     if (sections.some(section => section && typeof section === "object" && !Array.isArray(section)
         && section.rd))
-        return { kind: "reject" };
+        return { kind: "reject", reason: "A disclosed inner registry has no top-level declaration." };
     if (!serder.issuer)
-        return { kind: "reject" };
+        return { kind: "reject", reason: "The node names no issuer." };
     let issuer;
     try {
         issuer = new Prefixer({ qb64: serder.issuer });
     }
     catch {
-        return { kind: "reject" };
+        return { kind: "reject", reason: "The node names a malformed issuer." };
     }
     const sourceSeals = [
         ...envelope.sscs.map((seal) => ({ i: issuer, ...seal })),
@@ -159,7 +183,7 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
             ? { kind: "missing", reason: `Missing issuer KEL anchor for ${serder.said}.` }
             : result.sourceSeals.length > 0
                 ? { kind: "authenticated", registration: null }
-                : { kind: "reject" };
+                : { kind: "reject", reason: "No issuer KEL anchor seals the node." };
     }
     const explicit = envelope.tsgs.filter((group) => group.pre === issuer.qb64);
     const last = envelope.ssgs.filter((group) => group.pre === issuer.qb64);
@@ -181,5 +205,5 @@ export function authenticateIpexNode(serder, envelope, db, registry, historical
         ? { kind: "missing", reason: `Missing current issuer KEL evidence for ${serder.said}.` }
         : result.tsgs.length + result.cigars.length > 0
             ? { kind: "authenticated", registration: null }
-            : { kind: "reject" };
+            : { kind: "reject", reason: "No current issuer signature authenticates the node." };
 }