keri-ts 2.2.0 → 2.2.2

package/esm/keri/npm/src/app/multisig/grouping.js

@@ -12,12 +12,13 @@ import { validateRip, validateUpdate } from "../../acdc/regeventing.js";
 import { ValidationError } from "../../core/errors.js";
 import { exchange, isIpexVerb, isV2RegistryRoute, multisigChildField, nestedIpexRoute, nestedMultisigIlks, } from "../../core/exchange/protocol-exchanging.js";
 import { Kevery } from "../../core/kel/eventing.js";
+import { Kever } from "../../core/kel/kever.js";
 import { BasicReplyRouteHandler, Revery, Router } from "../../core/routing.js";
 import { Exchanger } from "../exchanges/exchanging.js";
 import { IpexV2Handler } from "../ipex/ipex-v2.js";
 import { dispatchEnvelope, envelopeFromFrame } from "../protocol/parsering.js";
 import { abortable, rethrowCleanupFailure } from "../runtime/abortable.js";
-import { groupSigningMembers, localIpexContribution } from "./group-members.js";
+import { groupSigningMembers, isLocalGroupHab, localIpexContribution } from "./group-members.js";
 import { multisigEmbeddedSection, multisigPayloadSaid } from "./multisig-messaging.js";
 /** KERIpy multisig route constants. */
 export const MULTISIG_ICP_ROUTE = "/multisig/icp";
@@ -579,6 +580,14 @@ export class Multiplexor {
                 else
                     yield* this.processApproved(nests);
             }
+            else if (!unreplayed && this.alreadyComplete(serder, nests, route)) {
+                // Consent only adds this member's signature; an event the other members' signatures already complete needs
+                // none, so a member that only receives it takes it on receipt instead of waiting for an approval it need not give.
+                if (serder.pvrsn.major === 1)
+                    yield* this.processLegacyApproved(serder);
+                else
+                    yield* this.processApproved(nests);
+            }
             else if (serder.pvrsn.major === 2 || firstSubmission) {
                 // Legacy approval polling consumes its first notice; repeated v1 notices would re-propose it.
                 this.notifier?.add(firstSubmission ? { r: route, d: said } : { r: route, d: said, e: embeddedSaid });
@@ -598,6 +607,71 @@ export class Multiplexor {
             sender,
         };
     }
+    /**
+     * Whether the proposed event is already signed by enough keys to be the group's next event or reply, so that a
+     * member that only receives it need not approve it. An interaction (or the anchor of a registry proposal) is judged
+     * against the group's current keys and threshold; a rotation against its own keys and threshold, when it names the
+     * members the group already has (the prior next-key commitments are checked by ordinary processing, and a
+     * membership change waits for approval); a reply against the group's current establishment.
+     */
+    alreadyComplete(serder, nests, route) {
+        let event, frame;
+        if (serder.pvrsn.major === 1) {
+            const label = route === MULTISIG_IXN_ROUTE
+                ? "ixn"
+                : route === MULTISIG_ROT_ROUTE
+                    ? "rot"
+                    : route === MULTISIG_RPY_ROUTE
+                        ? "rpy"
+                        : null;
+            if (!label)
+                return false;
+            const child = multisigChild(this.hby, serder, label);
+            const attrs = isRecord(serder.ked?.a) ? serder.ked.a : {};
+            if (!child?.attachment.length || attrs.gid !== child.event.pre)
+                return false;
+            if (route === MULTISIG_ROT_ROUTE && !this.namesCurrentMembers(attrs))
+                return false;
+            frame = parseBytes(concatBytes(Counter.makeGVC(child.genus), child.event.raw, child.attachment))[0];
+            event = child.event;
+        }
+        else if (isV2RegistryRoute(route)) {
+            const anchor = acdcV2RegistryProposal(serder, nests, this.registry?.store ?? null)?.anchor;
+            frame = nests.find((nest) => nest.body.said === anchor?.said);
+            event = anchor;
+        }
+        if (!event || !frame || !event.pre || !this.isLocalGroup(event.pre))
+            return false;
+        const kever = this.hby.db.getKever(event.pre);
+        if (!kever?.tholder)
+            return false;
+        const envelope = envelopeFromFrame(frame);
+        if (route === MULTISIG_RPY_ROUTE) {
+            const proof = envelope.tsgs.find((group) => group.pre === event.pre && group.sn === BigInt(`0x${kever.lastEst.s}`) && group.said === kever.lastEst.d);
+            return !!proof
+                && kever.tholder.satisfy(Kever.verifyIndexedSignatures(event.raw, proof.sigers, kever.verfers).indices);
+        }
+        if (event.sn !== kever.sn + 1 || event.prior !== kever.said)
+            return false;
+        if (event.ilk === "rot") {
+            return !!event.tholder
+                && event.tholder.satisfy(Kever.verifyIndexedSignatures(event.raw, envelope.sigers, event.verfers).indices);
+        }
+        return event.ilk === "ixn"
+            && kever.tholder.satisfy(Kever.verifyIndexedSignatures(event.raw, envelope.sigers, kever.verfers).indices);
+    }
+    /** Whether a rotation proposal names exactly the group's current signing members and rotation members. */
+    namesCurrentMembers(attrs) {
+        const group = typeof attrs.gid === "string" ? attrs.gid : "";
+        const same = (named, current) => {
+            const set = new Set(named);
+            return set.size === current.length && current.every((member) => set.has(member));
+        };
+        const signing = memberPrefixes(attrs.smids, []);
+        const rotation = attrs.rmids === undefined ? signing : memberPrefixes(attrs.rmids, []);
+        return same(signing, groupSigningMembers(this.hby, group))
+            && same(rotation, this.hby.ks.getRmids(group).map((tuple) => tuple[0].qb64));
+    }
     /** Return true when this wrapper can be accepted for local group work. */
     verify(serder, nests = []) {
         return this.inspect(serder, nests).ok;
@@ -765,6 +839,9 @@ export class Multiplexor {
         if (membership) {
             return { ok: false, said, reason: membership };
         }
+        const stray = this.strayReason(serder, request, embeddedSaid);
+        if (stray)
+            return { ok: false, said, reason: stray };
         return {
             ok: true,
             said,
@@ -788,6 +865,44 @@ export class Multiplexor {
         }
         return exns;
     }
+    /**
+     * Why a remote wrapper is not for this runtime's members, or null. It must be addressed to a member held here and,
+     * for a proposal about a group, come from one of that group's signing members: a wrapper for a member the receiver
+     * does not hold, or from an identifier that is not in the group, is not stored, noticed or listed. The one exception
+     * is a rotation's proposed new member, accepted only once a current member's stored wrapper for the same event names
+     * it ({@link proposedByMember}).
+     */
+    strayReason(serder, request, embeddedSaid) {
+        const sender = serder.pre ?? "";
+        if (this.isLocalHab(sender))
+            return null;
+        const recipient = serder.sad?.rp;
+        if (typeof recipient === "string" && recipient.length > 0 && !this.isLocalHab(recipient)) {
+            return `Multisig wrapper is addressed to ${recipient}, which is not a local identifier.`;
+        }
+        const proposed = request.kind === "rotate" && request.members.includes(sender)
+            && this.proposedByMember(embeddedSaid, sender);
+        if (request.kind !== "reject" && request.kind !== "join" && this.isLocalGroup(request.group)
+            && !proposed && !groupSigningMembers(this.hby, request.group).includes(sender)) {
+            return `Multisig wrapper sender ${sender} is not a signing member of group ${request.group}.`;
+        }
+        return null;
+    }
+    /**
+     * Whether a current member of the group (or a local identifier) already proposed or approved this exact rotation
+     * in a stored wrapper that names `sender` among its members. A rotation's proposed members answer it before they
+     * are signing members of the group, but a sender cannot certify itself: the wrapper it names itself in is not
+     * enough, a wrapper for the same event from a member the group already trusts must name it too.
+     */
+    proposedByMember(embeddedSaid, sender) {
+        return this.get(embeddedSaid).some(({ exn }) => {
+            const attrs = isRecord(exn.a) ? exn.a : {};
+            const from = typeof exn.i === "string" ? exn.i : "";
+            const gid = typeof attrs.gid === "string" ? attrs.gid : "";
+            const named = memberPrefixes(attrs.smids, attrs.rmids).includes(sender);
+            return named && (this.isLocalHab(from) || groupSigningMembers(this.hby, gid).includes(from));
+        });
+    }
     /** Apply local habitat membership to an already decoded request. */
     verifyMembership(request) {
         if (request.kind === "participate") {
@@ -802,6 +917,10 @@ export class Multiplexor {
             ? null
             : `Invalid request to join group; no local member in mids=${request.members.join(",")}.`;
     }
+    isLocalGroup(pre) {
+        const hab = this.hby.habs.get(pre);
+        return !!hab && isLocalGroupHab(this.hby, hab);
+    }
     isLocalHab(pre) {
         return pre.length > 0 && this.hby.habs.has(pre);
     }

package/esm/keri/npm/src/app/multisig/multisig-messaging.js

@@ -142,23 +142,50 @@ export function* sendGroupMessage(postman, prepared) {
         recipient: prepared.recipient,
         exnSaid: prepared.exnSaid,
         payloadSaid: prepared.payloadSaid,
+        outcome: "delivered",
         deliveries: [...outcome.deliveries],
     };
 }
-/** Collect successful recipient outcomes into message identities and completed target URLs. */
+/** The outcome of sending `prepared` as a failed delivery with the transport's reason. */
+export function failedGroupDelivery(prepared, error) {
+    return {
+        recipient: prepared.recipient,
+        exnSaid: prepared.exnSaid,
+        payloadSaid: prepared.payloadSaid,
+        outcome: "failed",
+        deliveries: [],
+        reason: error instanceof Error ? error.message : String(error),
+    };
+}
+/**
+ * Like {@link sendGroupMessage}, but a transport failure is this member's outcome and not an error: the wrapper
+ * is already accepted locally, so one unreachable member must not stop the others or the caller's next step.
+ */
+export function* deliverGroupMessage(postman, prepared) {
+    try {
+        return yield* sendGroupMessage(postman, prepared);
+    }
+    catch (error) {
+        return failedGroupDelivery(prepared, error);
+    }
+}
+/** Collect recipient outcomes: delivered message identities and completed target URLs, and every member's outcome. */
 export function groupSendResult(outcomes) {
+    const delivered = outcomes.filter(outcome => outcome.outcome === "delivered");
     return {
-        messages: outcomes.map(({ recipient, exnSaid, payloadSaid }) => ({ recipient, exnSaid, payloadSaid })),
-        deliveries: outcomes.flatMap(outcome => outcome.deliveries),
+        messages: delivered.map(({ recipient, exnSaid, payloadSaid }) => ({ recipient, exnSaid, payloadSaid })),
+        deliveries: delivered.flatMap(outcome => outcome.deliveries),
+        members: [...outcomes],
     };
 }
 /**
  * Process the exact signed local contribution before admitting remote delivery,
  * so an immediate peer reply cannot outrun local Multiplexor evidence. Await
- * normal intake, then send the same bytes without signing again. Intake or send
- * failures propagate; no cross-store/network transaction is implied.
+ * normal intake, then send the same bytes without signing again. Intake failures
+ * propagate; a send failure is the member's `failed` outcome. No cross-store/network
+ * transaction is implied.
  */
 export function* admitAndSendGroupMessage(input, postman, prepared) {
     yield* input.processBytes(prepared.message, { local: true });
-    return yield* sendGroupMessage(postman, prepared);
+    return yield* deliverGroupMessage(postman, prepared);
 }

package/esm/keri/npm/src/app/multisig/multisig-workflows.js

@@ -25,7 +25,7 @@ import { abortable } from "../runtime/abortable.js";
 import { collectBytes } from "../transport/byte-source.js";
 import { findLocalGroupMember as findLocalMember, groupMemberHasKey, uniqueMembers } from "./group-members.js";
 import { acdcV2RegistryProposal, MULTISIG_ICP_ROUTE, MULTISIG_ISS_ROUTE, MULTISIG_IXN_ROUTE, MULTISIG_REV_ROUTE, MULTISIG_ROT_ROUTE, MULTISIG_RPY_ROUTE, MULTISIG_VCP_ROUTE, multisigChild, multisigChildEvidence, multisigChildGenusAttrs, prepareAcdcV2RegistryExn, prepareMultisigEventExn, prepareMultisigVdrExn, registryProposalEvent, } from "./grouping.js";
-import { admitAndSendGroupMessage, groupSendResult, prepareGroupMessage, remoteGroupMembers, signGroupMessage, storedGroupMessage, } from "./multisig-messaging.js";
+import { admitAndSendGroupMessage, failedGroupDelivery, groupSendResult, prepareGroupMessage, remoteGroupMembers, signGroupMessage, storedGroupMessage, } from "./multisig-messaging.js";
 /** Approve one exact ACDC v2 TEL/anchor through existing member signing and ordinary processors.
  * A returned wrapper records consent, not quorum/witness/TEL completion; retry the accepted-state owners.
  * `resume` reuses this member's recorded anchor signatures after a crash instead of signing again.
@@ -135,14 +135,10 @@ export function* publishAcdcV2Registry(hby, postman, group, approval) {
             notify: true,
         });
         const outcome = yield* postman.wait(evt);
-        if (outcome.kin === "failed")
-            throw outcome.error;
-        outcomes.push({
-            recipient,
-            exnSaid: approval[0].said,
-            payloadSaid: approval[0].sad.a.anc,
-            deliveries: outcome.deliveries,
-        });
+        const ref = { recipient, exnSaid: approval[0].said, payloadSaid: approval[0].sad.a.anc };
+        outcomes.push(outcome.kin === "failed"
+            ? failedGroupDelivery(ref, outcome.error)
+            : { ...ref, outcome: "delivered", deliveries: outcome.deliveries });
     }
     return groupSendResult(outcomes);
 }

package/esm/keri/npm/src/app/multisig/proposals.js

@@ -93,7 +93,7 @@ function decode(deps, exn, route, kind) {
             smids,
             rmids: rmids ?? [],
             event: eventRef(approval.event, approval.group),
-            inapplicable: eventAccepted(hby, approval.event) && !smids.some(mid => hby.habs.has(mid)),
+            inapplicable: eventAccepted(hby, approval.event) && (kind !== "icp" || !smids.some(mid => hby.habs.has(mid))),
         };
     }
     if (isV2RegistryRoute(route)) {

package/esm/keri/npm/src/app/runtime/agent-runtime.js

@@ -25,6 +25,7 @@ import { Respondant } from "../delivery/respondant.js";
 import { Exchanger, RouteRefuser } from "../exchanges/exchanging.js";
 import { loadChallengeHandlers } from "../identity/challenging.js";
 import { Anchorer, loadDelegationHandlers } from "../identity/delegating.js";
+import { SignerNotHeldError } from "../identity/keeping.js";
 import { loadIpexHandlers } from "../ipex/ipexing.js";
 import { ForwardHandler } from "../mailbox/forward-handler.js";
 import { KEL_PUBLISHER_PACING, KelPublisher, kelPublisherDo } from "../mailbox/kel-publisher.js";
@@ -33,6 +34,7 @@ import { MAILBOX_POLLER_PACING, MailboxPoller, } from "../mailbox/mailbox-poller
 import { mailboxerOptionsForHabery } from "../mailbox/mailboxing.js";
 import { mailboxTopicForRoute } from "../mailbox/topic-routing.js";
 import { Counselor } from "../multisig/counseling.js";
+import { groupEventForwarding } from "../multisig/event-forwarding.js";
 import { loadMultisigHandlers } from "../multisig/grouping.js";
 import { noterOptionsForHabery, Notifier } from "../notifications/notifying.js";
 import { Signaler } from "../notifications/signaling.js";
@@ -45,6 +47,7 @@ import { cueDo } from "./cue-runtime.js";
 import { doEvery, PROTOCOL_PACING } from "./doing.js";
 import { IpexAuxiliaries } from "./ipex-auxiliaries.js";
 import { composeOwners, operationOwnersDo, OWNER_PACING, } from "./operation-owners.js";
+import { SignerConditions } from "./signer-conditions.js";
 import { signalerChangeSink } from "./workflow-contract.js";
 import { observeUntil } from "./workflow-contract.js";
 /**
@@ -203,7 +206,9 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         changes: signaler ? signalerChangeSink(signaler) : undefined,
         retry: options.kelPublishRetry,
     });
+    const signerConditions = new SignerConditions();
     const mailboxPoller = new MailboxPoller(hby, mailboxDirector, http, clock, {
+        signerConditions,
         onPolled: (pre, mailbox) => kelPublisher.prompt(pre, mailbox),
         onUnauthorized: (pre, mailbox) => kelPublisher.repair(pre, mailbox),
         timeouts: options.mailboxPolling,
@@ -244,7 +249,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
             kelPublisher.rotated.push(cue);
             owned?.rootReplicator?.prompt(cue.pre);
         },
-    }, options.counselorReceiptRetry);
+    }, options.counselorReceiptRetry, groupEventForwarding(hby, postman));
     const owned = acdc && ipex
         ? composeOwners({
             hby,
@@ -291,6 +296,7 @@ export function* createAgentRuntime(hby, http, clock, options = {}) {
         delegating,
         counselor,
         kelPublisher,
+        signerConditions,
         ownerPacing: options.ownerPacing ?? OWNER_PACING,
         publisherPacing: options.publisherPacing ?? KEL_PUBLISHER_PACING,
         protocolPacing: options.protocolPacing ?? PROTOCOL_PACING,
@@ -622,31 +628,24 @@ export function* runAgentRuntime(runtime, options = {}) {
     runtime.querying.configure({ hab: options.hab });
     const pacing = runtime.protocolPacing;
     const telReceiptor = runtime.vdr ? new Receiptor(runtime.hby, runtime.protocol, runtime.http, runtime.clock) : null;
+    // A loop that needs a signer the host released waits for it; it never ends the runtime (see `surviving`).
+    const alive = (loop, make) => spawn(() => surviving(runtime, loop, make));
+    const stopHoldWatch = runtime.hby.mgr.onHold(() => runtime.signerConditions.held());
     const tasks = [
-        yield* spawn(() => runtime.querying.deliverDo()),
-        yield* spawn(() => runtime.postman.deliverDo()),
+        yield* alive("querying", () => runtime.querying.deliverDo()),
+        yield* alive("postman", () => runtime.postman.deliverDo()),
         ...(runtime.vdr && telReceiptor
             ? [
-                yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
+                yield* alive("tel-publication", () => doEvery(runtime.clock, pacing.tockMs, () => publishPendingTel(runtime.hby, runtime.vdr.publication, telReceiptor, runtime.http, runtime.clock))),
             ]
             : []),
-        yield* spawn(function* () {
-            yield* cueDo(runtime, options, pacing);
-        }),
-        yield* spawn(function* () {
-            yield* runtime.protocol.escrowDo(runtime.clock);
-        }),
-        yield* spawn(function* () {
-            yield* runtime.oobiery.oobiDo(runtime.clock, pacing);
-        }),
-        yield* spawn(function* () {
-            yield* runtime.authenticator.authDo(runtime.clock, pacing);
-        }),
+        yield* alive("cues", () => cueDo(runtime, options, pacing)),
+        yield* alive("escrows", () => runtime.protocol.escrowDo(runtime.clock)),
+        yield* alive("oobi", () => runtime.oobiery.oobiDo(runtime.clock, pacing)),
+        yield* alive("authentication", () => runtime.authenticator.authDo(runtime.clock, pacing)),
         ...(runtime.signaler
             ? [
-                yield* spawn(function* () {
-                    yield* runtime.signaler.signalDo(runtime.clock, pacing);
-                }),
+                yield* alive("signals", () => runtime.signaler.signalDo(runtime.clock, pacing)),
             ]
             : []),
         ...(options.pollMailbox ?? true
@@ -656,12 +655,12 @@ export function* runAgentRuntime(runtime, options = {}) {
                 }),
             ]
             : []),
-        yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => runtime.delegating.processAllOnce())),
-        yield* spawn(() => doEvery(runtime.clock, pacing.tockMs, () => runtime.counselor.processOnce())),
-        yield* spawn(() => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
+        yield* alive("delegation", () => doEvery(runtime.clock, pacing.tockMs, () => runtime.delegating.processAllOnce())),
+        yield* alive("counselor", () => doEvery(runtime.clock, pacing.tockMs, () => runtime.counselor.processOnce())),
+        yield* alive("kel-publisher", () => kelPublisherDo(runtime.kelPublisher, runtime.clock, runtime.publisherPacing)),
         ...(runtime.operations && runtime.ipex
             ? [
-                yield* spawn(() => operationOwnersDo({
+                yield* alive("operation-owners", () => operationOwnersDo({
                     operations: runtime.operations,
                     rootReplicator: runtime.rootReplicator,
                     ipex: runtime.ipex,
@@ -674,8 +673,29 @@ export function* runAgentRuntime(runtime, options = {}) {
         return yield* suspend();
     }
     finally {
+        stopHoldWatch();
         for (const task of tasks.reverse()) {
             yield* task.halt();
         }
     }
 }
+/** How long a loop waits for a held signer before trying again, in milliseconds. */
+const SIGNER_RETRY_MS = 1_000;
+/**
+ * Run a background loop so that a signer the host released does not end the runtime: the loop's
+ * `SignerNotHeldError` is recorded in `runtime.signerConditions`, the loop waits for a signer to be held (or a
+ * second) and starts again. Every other failure still ends it.
+ */
+function* surviving(runtime, loop, make) {
+    while (true) {
+        try {
+            return yield* make();
+        }
+        catch (error) {
+            if (!(error instanceof SignerNotHeldError))
+                throw error;
+            runtime.signerConditions.report(`runtime:${loop}`, error.pub, runtime.clock.now());
+            yield* runtime.signerConditions.waitForHold(runtime.clock, SIGNER_RETRY_MS);
+        }
+    }
+}

package/esm/keri/npm/src/app/runtime/ipex-auxiliaries.js

@@ -143,28 +143,58 @@ export class IpexAuxiliaries {
         this.unblinds.clear();
     }
     claims(serder) {
-        return this.select(serder) !== null;
+        return this.select(serder).length > 0;
     }
+    /**
+     * Every local party to the transaction takes the query: a Habery that holds both sides of a Grant has the sender's
+     * owner (its own threshold query) and the recipient's (the query received), and each decides by its own role.
+     */
     processQuery(envelope) {
-        return this.select(envelope.serder)?.processQuery(envelope) ?? { kind: "drop", reason: "missingProcessor" };
+        const owners = this.select(envelope.serder);
+        const decisions = owners.map((owner) => {
+            try {
+                return owner.processQuery(envelope);
+            }
+            catch (error) {
+                // With two parties, the one that is not the query's audience may refuse it; the other still decides.
+                if (owners.length > 1 && error instanceof ValidationError)
+                    return { kind: "drop", reason: "missingProcessor" };
+                throw error;
+            }
+        });
+        return decisions.find((decision) => decision && decision.kind === "accept") ?? decisions[0]
+            ?? { kind: "drop", reason: "missingProcessor" };
     }
     reply(kind, args) {
-        const owner = this.claimant(kind, args.serder.pre, args.serder.sad?.a?.x);
-        if (!owner)
+        const owners = this.claimants(kind, args.serder.pre, args.serder.sad?.a?.x);
+        if (!owners.length)
             throw new ValidationError(`No resource is registered to handle route ${args.route}`);
-        return owner.processReply(args);
+        let accepted, failure;
+        for (const owner of owners) {
+            try {
+                const decision = owner.processReply(args);
+                accepted ??= decision;
+            }
+            catch (error) {
+                failure ??= error;
+            }
+        }
+        if (accepted === undefined)
+            throw failure;
+        return accepted;
     }
     select(serder) {
         const kind = serder.route === Dhke.Route ? "dhke" : serder.route === Unblind.Route ? "unblind" : null;
-        return kind && this.claimant(kind, serder.pre, serder.sad?.q?.x);
+        return kind ? this.claimants(kind, serder.pre, serder.sad?.q?.x) : [];
     }
     /**
-     * The owner of the one local identifier party to the transaction, created now if needed; absent or
-     * ambiguous means unowned. Parties come from live owners (approved operations) and from the store.
+     * The owners of the local identifiers party to the transaction, created now if needed; none means unowned.
+     * Parties come from live owners (approved operations) and from the store. Usually one; two when this Habery
+     * holds both the sender and the recipient.
      */
-    claimant(kind, sender, xid) {
+    claimants(kind, sender, xid) {
         if (!sender || typeof xid !== "string")
-            return null;
+            return [];
         const owners = kind === "dhke" ? this.dhkes : this.unblinds;
         const habs = this.exc.hby.habs;
         const parties = new Set();
@@ -186,22 +216,26 @@ export class IpexAuxiliaries {
         const group = habs.get(sender);
         if (group && isLocalGroupHab(this.exc.hby, group))
             parties.add(sender);
-        if (parties.size !== 1)
-            return null;
-        const [pre] = parties;
-        const hab = habs.get(pre);
-        if (!hab) {
-            this.release(pre);
-            return null;
-        }
-        try {
-            return kind === "dhke" ? this.dhke(hab) : this.unblind(hab);
+        // Two parties are one transaction only when the sender is itself local: its owner and the recipient's.
+        if (parties.size < 1 || (parties.size > 1 && !(parties.size === 2 && parties.has(sender)))) {
+            return [];
         }
-        catch (error) {
-            // A group without a local signing member cannot own the route.
-            if (error instanceof ValidationError)
-                return null;
-            throw error;
+        const owned = [];
+        for (const pre of parties) {
+            const hab = habs.get(pre);
+            if (!hab) {
+                this.release(pre);
+                continue;
+            }
+            try {
+                owned.push(kind === "dhke" ? this.dhke(hab) : this.unblind(hab));
+            }
+            catch (error) {
+                // A group without a local signing member cannot own the route.
+                if (!(error instanceof ValidationError))
+                    throw error;
+            }
         }
+        return owned;
     }
 }

package/esm/keri/npm/src/app/runtime/operation-owners.js

@@ -89,6 +89,7 @@ export function composeOwners(parts, stores = {}) {
             unblinds: ipex,
             group: { mux, protocol },
             delivery,
+            reactor,
             clock,
             retry: parts.retry,
             changes,

package/esm/keri/npm/src/app/runtime/signer-conditions.js

@@ -0,0 +1,51 @@
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _SignerConditions_conditions, _SignerConditions_waiters;
+/**
+ * Background loops that sign with a local key meet a missing key when the host has released it
+ * (`Manager.release`), which a custodial host does on purpose. That is a condition to wait out, not a failure
+ * of the runtime: the loop reports it here, backs off and resumes when a signer is held again
+ * (`Manager.hold`), and an application reads the list to tell its user which identifier cannot act.
+ */
+import { action } from "effection";
+/** The runtime's record of loops waiting for a signer; process-local, rebuilt by the loops themselves. */
+export class SignerConditions {
+    constructor() {
+        _SignerConditions_conditions.set(this, new Map());
+        _SignerConditions_waiters.set(this, new Set());
+    }
+    /** `source` cannot sign because `pub` is not held; keeps the first time it was reported. */
+    report(source, pub, now) {
+        const known = __classPrivateFieldGet(this, _SignerConditions_conditions, "f").get(source);
+        __classPrivateFieldGet(this, _SignerConditions_conditions, "f").set(source, known?.pub === pub ? known : { source, pub, since: now });
+    }
+    /** `source` no longer waits for a signer. */
+    clear(source) {
+        __classPrivateFieldGet(this, _SignerConditions_conditions, "f").delete(source);
+    }
+    /** The loops waiting for a signer now. */
+    list() {
+        return [...__classPrivateFieldGet(this, _SignerConditions_conditions, "f").values()];
+    }
+    /** A signer was held: forget every condition (a loop that still lacks its key reports again) and wake the waiters. */
+    held() {
+        __classPrivateFieldGet(this, _SignerConditions_conditions, "f").clear();
+        for (const wake of [...__classPrivateFieldGet(this, _SignerConditions_waiters, "f")])
+            wake();
+    }
+    /** Wait up to `ms` on the host clock, or until a signer is held, whichever comes first. */
+    *waitForHold(clock, ms) {
+        yield* action((resolve) => {
+            const timer = clock.setTimeout(resolve, ms);
+            __classPrivateFieldGet(this, _SignerConditions_waiters, "f").add(resolve);
+            return () => {
+                clock.clearTimeout(timer);
+                __classPrivateFieldGet(this, _SignerConditions_waiters, "f").delete(resolve);
+            };
+        });
+    }
+}
+_SignerConditions_conditions = new WeakMap(), _SignerConditions_waiters = new WeakMap();

package/esm/keri/npm/src/app/transport/cesr-egress.js

@@ -34,6 +34,12 @@ export class CesrHttpRefusal extends ValidationError {
             writable: true,
             value: status
         });
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "CesrHttpRefusal"
+        });
     }
 }
 /**

package/esm/keri/npm/src/cli/credentials/ipex.js

@@ -372,7 +372,10 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
         throw new ValidationError(`Multisig IPEX sender ${group ?? "<missing>"} is not a local group AID.`);
     }
     if (!ipexArgs.auto) {
-        return { exn, group: { embedded, accepted: null, approved: null, lead: null, messages: [], deliveries: [] } };
+        return {
+            exn,
+            group: { embedded, accepted: null, approved: null, lead: null, messages: [], deliveries: [], members: [] },
+        };
     }
     if (embedded.pvrsn.major === 2) {
         // ACDC v2: the runtime's group IPEX owner approves, publishes, collects and lets the lead deliver.
@@ -393,6 +396,7 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
                 lead: runtime.exc.lead(hby.habs.get(group), said),
                 messages: outcome?.messages ?? [],
                 deliveries: [...(outcome?.deliveries ?? []), ...(outcome?.sent ?? [])],
+                members: outcome?.members ?? [],
             },
         };
     }
@@ -416,6 +420,7 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
                         credentialSaved,
                         messages: [],
                         deliveries: [],
+                        members: [],
                     },
                 };
             }
@@ -437,6 +442,7 @@ export function* joinIpexProposal(hby, runtime, reger, ipexArgs) {
                 credentialSaved,
                 messages: approval.messages,
                 deliveries: approval.deliveries,
+                members: approval.members,
             },
         };
     }