keri-ts 2.2.1 → 2.2.2

package/esm/keri/npm/src/app/ipex/presenting.js

@@ -184,7 +184,7 @@ export function* preparePresentation(deps, input) {
             break;
         case "agree":
         case "spurn":
-            prepared = yield* discloser.prepareReply(sender, input.verb, input.prior, input.message ?? "", input.recipient, input.auths);
+            prepared = yield* discloser.prepareReply(sender, input.verb, input.priorSaid, input.message ?? "", input.recipient, input.auths);
             break;
         case "offer":
             prepared = yield* discloser.prepareOffer(sender, input.selection, input.options);
@@ -259,6 +259,41 @@ export function* proposeGroupPresentation(deps, groupIpex, { hab, selection, opt
         },
     });
 }
+/**
+ * A group's consent to send an Apply, Offer, Agree or Spurn: freezes the unsigned body (the same body a single
+ * identifier would sign) and proposes it as a group-authored message with {@link proposeGroupIpex}. The other members
+ * list and approve it with `approveGroupIpex` and the elected lead delivers the completed message. A Grant has its own
+ * call, {@link proposeGroupPresentation}; an Admit has `proposeGroupAdmit`.
+ *
+ * @throws ValidationError for an identifier that is not a local group, a selection or predecessor the discloser
+ * refuses, an exchange that requires anchoring (a group message carries member contributions, not one source seal),
+ * or a message awaiting authenticating dependencies.
+ */
+export function* proposeGroupNegotiation(deps, groupIpex, input) {
+    const { hab, deliver } = input;
+    const sender = hab.pre;
+    let exn, nests, gvrsn;
+    switch (input.verb) {
+        case "apply":
+            gvrsn = input.options.gvrsn;
+            exn = discloserFor(deps, hab).applyBody(sender, input.options);
+            break;
+        case "offer": {
+            gvrsn = input.options.gvrsn;
+            const offer = yield* discloserFor(deps, hab, input.selection.derive).prepareOfferBody(sender, input.selection, input.options);
+            ({ exn, nests } = offer);
+            break;
+        }
+        case "agree":
+        case "spurn":
+            exn = yield* discloserFor(deps, hab).replyBody(sender, input.verb, input.priorSaid, input.message ?? "", input.recipient);
+            break;
+    }
+    if (exn.sad.a.ax?.[0] === true) {
+        throw new ValidationError("A group cannot send an exchange that requires anchoring.");
+    }
+    return yield* proposeGroupIpex(groupIpex, { hab, exn, nests, gvrsn: gvrsn ?? undefined, deliver });
+}
 /**
  * Deliver a group's completed prepared Grant ({@link resumePresentationFile}): queues the delivery bytes for
  * `processOnce` when the local member is the elected lead, with the retry and deadline of any presentation. Signs

package/esm/keri/npm/src/app/ipex/unblinding-workflow.js

@@ -34,11 +34,16 @@ import { singleKeyQueryWindow } from "../../core/mailbox/kram-policy.js";
 import { timestampMicros } from "../../time/mod.js";
 import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
 import { MULTISIG_QRY_ROUTE, MULTISIG_RPY_ROUTE, multisigExnBody } from "../multisig/grouping.js";
+import { remoteGroupMembers } from "../multisig/multisig-messaging.js";
 import { envelopeFromFrame } from "../protocol/parsering.js";
 import { DeliveryOutbox } from "../runtime/delivery-outbox.js";
 import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
 /** Milliseconds between resends of the unchanged disclosee query, as `tufa ipex unblind` does. */
 export const UNBLIND_QUERY_RESEND_MS = 1000;
+/** The key of one party's operation on a Grant. */
+export function unblindingKey(grant, role) {
+    return `${role}:${grant}`;
+}
 /** Per-operation state of a group party; memory only. */
 class GroupUnblind {
     constructor(member, proposer) {
@@ -94,6 +99,8 @@ class GroupUnblind {
     }
 }
 const EXPIRED = "The presentation reached its original exchange deadline";
+const NOT_ANSWERED = "No answer is begun for this presentation here; a group discloser's members begin it with answerUnblind";
+const UNNEEDED = "The presentation was already answered with its opening delivered, so this answer was not needed";
 const CHANGED = "Original presentation deadline changed";
 function message(error) {
     return error instanceof Error ? error.message : String(error);
@@ -113,14 +120,14 @@ export class UnblindingOperations {
             writable: true,
             value: deps
         });
-        /** Operations whose approval is live in this process. Internal to this module's functions. */
+        /** Operations whose approval is live in this process, by {@link unblindingKey}. Read them through {@link liveOf}. */
         Object.defineProperty(this, "live", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: new Map()
         });
-        /** Operations that finished or ended in this process; not durable, see the module doc. */
+        /** Operations that finished or ended in this process, by {@link unblindingKey}; not durable, see the module doc. */
         Object.defineProperty(this, "settled", {
             enumerable: true,
             configurable: true,
@@ -134,10 +141,48 @@ export class UnblindingOperations {
             writable: true,
             value: null
         });
+        /**
+         * The delivery the outboxes use. A recipient that is an identifier of this Habery takes the bytes through the
+         * ordinary reactor path in process, so the checks a remote delivery meets run too; a local group's members that
+         * are not held here are still delivered to.
+         */
+        Object.defineProperty(this, "transport", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: { deliver: (message) => this.deliverToParty(message) }
+        });
+    }
+    /** The live operation of one party of `grant`; without `role`, the requester's when this Habery holds both. */
+    liveOf(grant, role) {
+        return role
+            ? this.live.get(unblindingKey(grant, role))
+            : this.live.get(unblindingKey(grant, "requester")) ?? this.live.get(unblindingKey(grant, "responder"));
     }
-    /** Whether the live operation for `grant` still holds a message the transport has not taken. */
-    owes(grant) {
-        return (this.live.get(grant)?.outbox.length ?? 0) > 0;
+    /** The operation of one party of `grant` that finished or ended in this process; without `role`, as {@link liveOf}. */
+    settledOf(grant, role) {
+        return role
+            ? this.settled.get(unblindingKey(grant, role))
+            : this.settled.get(unblindingKey(grant, "requester")) ?? this.settled.get(unblindingKey(grant, "responder"));
+    }
+    /** Every live operation, for the module functions that look across parties. */
+    liveOps() {
+        return [...this.live.values()];
+    }
+    /** Record a consented operation as live, replacing what an earlier one of the same party left behind. */
+    begin(op) {
+        this.settled.delete(unblindingKey(op.grant, op.role));
+        this.live.set(unblindingKey(op.grant, op.role), op);
+    }
+    /** Remember how a party's operation on `grant` finished or ended without a live operation to end. */
+    remember(grant, settled) {
+        this.settled.set(unblindingKey(grant, settled.role), settled);
+    }
+    /** Whether a live operation for `grant` (or only its party `role`) still holds a message the transport has not taken. */
+    owes(grant, role) {
+        return role
+            ? (this.liveOf(grant, role)?.outbox.length ?? 0) > 0
+            : this.owes(grant, "requester") || this.owes(grant, "responder");
     }
     /**
      * Whether a pass has work: a live operation, or an owner holds an authenticated peer query whose reply is
@@ -156,19 +201,23 @@ export class UnblindingOperations {
         const { deps } = this;
         this.adopt();
         for (const op of [...this.live.values()]) {
-            if (op.busy || !this.live.has(op.grant))
+            if (op.busy || this.live.get(unblindingKey(op.grant, op.role)) !== op)
                 continue;
             op.busy = true;
             try {
                 const left = op.expires - BigInt(deps.clock.now()) * 1000n;
                 if (left <= 0n)
-                    this.end(op, "expired", EXPIRED);
+                    this.end(op, "expired", this.expiry(op));
                 else if ((yield* race([this.advance(op), this.timer(Number(left) / 1000)])) === "expired") {
-                    this.end(op, "expired", EXPIRED);
+                    this.end(op, "expired", this.expiry(op));
                 }
             }
             catch (error) {
-                this.end(op, "failed", message(error));
+                // A discloser whose presentation closed before it was asked had nothing left to answer; that is not a failure.
+                if (op.role === "responder" && deps.hby.db.erpy.get([op.grant]))
+                    this.end(op, "unneeded", UNNEEDED);
+                else
+                    this.end(op, "failed", message(error));
             }
             finally {
                 op.busy = false;
@@ -185,7 +234,7 @@ export class UnblindingOperations {
         const { deps } = this;
         for (const owner of deps.unblinds.unblindOwners()) {
             for (const { xid, grant } of owner.awaitingReply()) {
-                if (this.live.has(grant))
+                if (this.live.has(unblindingKey(grant, "responder")))
                     continue;
                 let input, deadline, expires;
                 try {
@@ -196,14 +245,18 @@ export class UnblindingOperations {
                 catch (error) {
                     // Unreadable stored state fails this reply alone; release the owner's approval so it is not retried.
                     owner.abandon(xid);
-                    this.settled.set(grant, { role: "responder", state: "failed", reason: message(error) });
+                    this.settled.set(unblindingKey(grant, "responder"), {
+                        role: "responder",
+                        state: "failed",
+                        reason: message(error),
+                    });
                     deps.changes?.push({ kind: "unblinding", id: grant });
                     continue;
                 }
                 if (!input || !deadline || expires === null || BigInt(deps.clock.now()) * 1000n >= expires)
                     continue;
-                this.settled.delete(grant);
-                this.live.set(grant, {
+                this.settled.delete(unblindingKey(grant, "responder"));
+                this.live.set(unblindingKey(grant, "responder"), {
                     grant,
                     xid,
                     role: "responder",
@@ -223,15 +276,20 @@ export class UnblindingOperations {
             }
         }
     }
+    /** The reason an operation reached its deadline; a query still waiting for the issuer's anchoring event says so. */
+    expiry(op) {
+        const missing = op.role === "responder" ? op.owner.missingSource(op.xid) : null;
+        return missing ? `${EXPIRED}; ${missing}` : EXPIRED;
+    }
     /** End a live operation: release the approval, remember why until the process ends, tell the sink. */
     end(op, state, reason) {
         this.release(op);
-        this.settled.set(op.grant, { role: op.role, state, reason });
+        this.settled.set(unblindingKey(op.grant, op.role), { role: op.role, state, reason });
         this.deps.changes?.push({ kind: "unblinding", id: op.grant });
     }
     /** Drop the live entry and the owner's approval and frozen messages; delivered bytes stay the peer's. */
     release(op) {
-        this.live.delete(op.grant);
+        this.live.delete(unblindingKey(op.grant, op.role));
         try {
             op.owner.abandon(op.xid);
         }
@@ -242,7 +300,7 @@ export class UnblindingOperations {
     }
     finished(op) {
         this.release(op);
-        this.settled.set(op.grant, { role: op.role, state: "done" });
+        this.settled.set(unblindingKey(op.grant, op.role), { role: op.role, state: "done" });
         this.deps.changes?.push({ kind: "unblinding", id: op.grant });
     }
     *timer(milliseconds) {
@@ -413,9 +471,23 @@ export class UnblindingOperations {
         op.finished = true;
         return "stepped";
     }
+    *deliverToParty(message) {
+        const { hby, reactor, delivery } = this.deps, recipient = hby.habs.get(message.dest);
+        if (!recipient || !reactor)
+            return yield* delivery.deliver(message);
+        yield* reactor.processBytes(message.msg);
+        const reached = [`local:${recipient.pre}`];
+        if (!isLocalGroupHab(hby, recipient))
+            return reached;
+        const member = localGroupMember(hby, recipient.pre);
+        for (const dest of remoteGroupMembers(hby, member, groupSigningMembers(hby, recipient.pre))) {
+            reached.push(...yield* delivery.deliver({ ...message, dest }));
+        }
+        return reached;
+    }
     /** One pass: send what is queued, step only once the queue is empty, send what the step queued. */
     *advance(op) {
-        const drain = () => op.outbox.drain(this.deps.delivery, this.deps.clock);
+        const drain = () => op.outbox.drain(this.transport, this.deps.clock);
         if (!(yield* drain()))
             return "stepped";
         if (!op.finished)
@@ -428,7 +500,7 @@ export class UnblindingOperations {
 /** The exact live Grant the local party may consent to, with its deadline and role. */
 function selectGrant(ops, grant, role, proposer) {
     const { deps } = ops;
-    if (ops.live.has(grant))
+    if (ops.liveOf(grant, role))
         throw new ValidationError("Unblind was already begun for this Grant");
     const input = deps.exc.retainedInput(grant);
     if (!input)
@@ -460,6 +532,14 @@ function consent(ops, grant, role, options) {
     if (role === "responder" && !isLocalGroupHab(deps.hby, hab)) {
         throw new ValidationError("An individual discloser answers an authenticated query without consent");
     }
+    if (role === "responder" && deps.hby.db.erpy.get([grant])) {
+        // The verifier already answered the presentation, so no query will come: nothing to approve or answer.
+        const closed = selected.input.serder;
+        const xid = closed.ilk === "xip" ? closed.said : String(closed.sad.x);
+        ops.remember(grant, { role: "responder", state: "unneeded", reason: UNNEEDED });
+        deps.changes?.push({ kind: "unblinding", id: grant });
+        return { op: null, begun: { grant, xid, role } };
+    }
     const owner = deps.unblinds.unblind(hab), xid = owner.approve(grant, { states: options.states });
     const begun = { grant, xid, role };
     // A current authenticated view needs no empty auxiliary query or new proof writes.
@@ -467,7 +547,7 @@ function consent(ops, grant, role, options) {
         const current = deps.exc.verifyGrantProofs(grant, selected.input.nests ?? []);
         if (current === true || typeof current === "object" && current.kind === "accept") {
             owner.abandon(xid);
-            ops.settled.set(grant, { role: "requester", state: "done" });
+            ops.remember(grant, { role: "requester", state: "done" });
             deps.changes?.push({ kind: "unblinding", id: grant });
             return { op: null, begun };
         }
@@ -512,8 +592,7 @@ export function requestUnblind(ops, grant, options = {}) {
         }
         else
             op.query = op.owner.start(grant);
-        ops.settled.delete(grant);
-        ops.live.set(grant, op);
+        ops.begin(op);
         ops.deps.changes?.push({ kind: "unblinding", id: grant });
     }
     return begun;
@@ -530,9 +609,10 @@ export function requestUnblind(ops, grant, options = {}) {
 export function answerUnblind(ops, grant, options = {}) {
     const { deps } = ops;
     const { op, begun } = consent(ops, grant, "responder", options);
+    if (!op)
+        return begun;
     registerUnblindRoutes(ops);
-    ops.settled.delete(grant);
-    ops.live.set(grant, op);
+    ops.begin(op);
     deps.changes?.push({ kind: "unblinding", id: grant });
     return begun;
 }
@@ -582,7 +662,7 @@ function registerUnblindRoutes(ops) {
             acceptsNests: true,
             verify: (args) => structural(deps.hby, args.serder, args.nests ?? []) && !args.attachments.length && !args.essrs?.length,
             handle: (args) => {
-                for (const op of ops.live.values()) {
+                for (const op of ops.liveOps()) {
                     if (op.group && groupAccepts(deps.hby, op, args.serder, args.nests)) {
                         op.group.pending.set(args.serder.said, { parent: args.serder, child: args.nests[0] });
                     }
@@ -601,8 +681,9 @@ function registerUnblindRoutes(ops) {
  * @throws ValidationError when `grant` is not a Grant a local identifier is the disclosee of, and no
  * operation for it is live or remembered.
  */
-export function unblindingStatus(ops, grant) {
-    const { deps } = ops, settled = ops.settled.get(grant), live = ops.live.get(grant);
+export function unblindingStatus(ops, grant, party = {}) {
+    const { deps } = ops, role = chooseParty(deps, grant, party);
+    const settled = ops.settledOf(grant, role), live = ops.liveOf(grant, role);
     if (settled) {
         return settled.state === "done"
             ? { state: "done", role: settled.role }
@@ -618,6 +699,13 @@ export function unblindingStatus(ops, grant) {
         };
     }
     const input = deps.exc.retainedInput(grant), recipient = input?.serder.sad?.ri;
+    if (role === "responder" && input && input.serder.pre && deps.hby.habs.has(input.serder.pre)) {
+        // A discloser that has not begun (a group member before its answer) reads as not begun, not as an error.
+        const lifetime = deps.exc.exchangeDeadline(input.serder);
+        return lifetime && lapsed(deps.clock, lifetime)
+            ? { state: "expired", role: "responder", reason: EXPIRED }
+            : { state: "interrupted", role: "responder", reason: NOT_ANSWERED };
+    }
     if (!input || typeof recipient !== "string" || !deps.hby.habs.has(recipient)) {
         throw new ValidationError("No Unblind was begun for this Grant");
     }
@@ -634,16 +722,32 @@ export function unblindingStatus(ops, grant) {
         return { state: "expired", role: "requester", reason: EXPIRED };
     return { state: "interrupted", role: "requester", reason: INTERRUPTED };
 }
+/**
+ * The party a read is for: the one asked for, else the Habery's only party, else (it holds both) the requester.
+ * Undefined when the Grant is not stored here, so only what is live or remembered answers.
+ *
+ * @throws ValidationError when `choice` names a party this Habery does not hold.
+ */
+function chooseParty(deps, grant, choice) {
+    const input = deps.exc.retainedInput(grant);
+    if (!input)
+        return choice.role;
+    const held = [
+        ...(deps.hby.habs.has(String(input.serder.sad?.ri)) ? ["requester"] : []),
+        ...(input.serder.pre && deps.hby.habs.has(input.serder.pre) ? ["responder"] : []),
+    ];
+    if (choice.role && !held.includes(choice.role)) {
+        throw new ValidationError(`This Habery holds no ${choice.role} of this presentation`);
+    }
+    return choice.role ?? held[0];
+}
 /**
  * Observe until the Unblind is done or ended, or the budget expires. Starts no worker and drives nothing:
  * someone else must call `processOnce`.
  */
-export function* waitForUnblinding(ops, grant, { timeoutMs, clock = ops.deps.clock }) {
-    const settled = yield* observeUntil(() => unblindingStatus(ops, grant).state !== "active" && !ops.owes(grant), {
-        timeoutMs,
-        clock,
-    });
-    const status = unblindingStatus(ops, grant);
+export function* waitForUnblinding(ops, grant, { timeoutMs, clock = ops.deps.clock, role }) {
+    const settled = yield* observeUntil(() => unblindingStatus(ops, grant, { role }).state !== "active" && !ops.owes(grant, role), { timeoutMs, clock });
+    const status = unblindingStatus(ops, grant, { role });
     return settled ? { outcome: "settled", status } : { outcome: "timed-out", status, timeoutMs };
 }
 /**
@@ -653,15 +757,15 @@ export function* waitForUnblinding(ops, grant, { timeoutMs, clock = ops.deps.clo
  *
  * @throws ValidationError when no Unblind was begun for `grant`.
  */
-export function abandonUnblinding(ops, grant, reason = "Abandoned by the user") {
-    const status = unblindingStatus(ops, grant);
+export function abandonUnblinding(ops, grant, reason = "Abandoned by the user", party = {}) {
+    const status = unblindingStatus(ops, grant, party);
     if (status.state !== "active" && status.state !== "interrupted")
         return;
-    const live = ops.live.get(grant);
+    const live = ops.liveOf(grant, status.role);
     if (live)
         ops.end(live, "abandoned", reason);
     else {
-        ops.settled.set(grant, { role: status.role, state: "abandoned", reason });
+        ops.remember(grant, { role: status.role, state: "abandoned", reason });
         ops.deps.changes?.push({ kind: "unblinding", id: grant });
     }
 }

package/esm/keri/npm/src/app/mailbox/mailbox-poller.js

@@ -6,6 +6,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var _MailboxPoller_dirty;
 /** Recipient mailbox polling: signed queries, awaited SSE intake and persisted cursor progression. */
 import { call, scoped, spawn } from "effection";
+import { SignerNotHeldError } from "../identity/keeping.js";
 import { abortable } from "../runtime/abortable.js";
 import { doEvery, PROTOCOL_TOCK_MS } from "../runtime/doing.js";
 import { runtimeTurn } from "../runtime/runtime-turn.js";
@@ -89,6 +90,13 @@ export class MailboxPoller {
             writable: true,
             value: void 0
         });
+        /** Where unsignable polls are reported, when the host keeps such a record. */
+        Object.defineProperty(this, "signerConditions", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         /** Told when a mailbox answers 403. */
         Object.defineProperty(this, "onUnauthorized", {
             enumerable: true,
@@ -98,7 +106,8 @@ export class MailboxPoller {
         });
         /** Identifiers whose mailbox endpoints changed; the poller re-selects their workers on the next tock. */
         _MailboxPoller_dirty.set(this, new Set());
-        const { timeouts, onPolled, onUnauthorized } = options;
+        const { timeouts, onPolled, onUnauthorized, signerConditions } = options;
+        this.signerConditions = signerConditions;
         this.onPolled = onPolled;
         this.onUnauthorized = onUnauthorized;
         this.hby = hby;
@@ -167,17 +176,26 @@ export class MailboxPoller {
      * @param target Mailbox subject habitat plus the actual local signer (a member for groups).
      * @param endpoint Selected remote endpoint AID and HTTP(S) URL.
      * @param onBatch Awaited consumer; successful completion precedes durable cursor advancement.
-     * @returns How the poll ended; see {@link PollOutcome}.
+     * @returns How the poll ended; see {@link PollOutcome}. An `unsignable` poll carries the missing public key.
      */
     *pollRemoteEndpointOnce(target, endpoint, onBatch) {
         const cursor = this.mailboxDirector.remoteQueryCursor(target.targetPre, endpoint.eid);
         // deno-lint-ignore no-this-alias -- Generator callbacks have no lexical this.
         const self = this;
-        // The concrete HTTP/SSE operation owns and joins this whole poll attempt.
-        return yield* call(() => fetchMailboxMessages(target.signerHab, target.targetPre, endpoint.eid, endpoint.url, cursor, mailboxFetchTimeoutPolicy(this.timeoutPolicy), this.http, this.clock, function* deliverThenAdvanceCursor(message) {
-            yield* call(() => onBatch({ pre: target.targetPre, eid: endpoint.eid, messages: [message.msg] }));
-            self.mailboxDirector.updateRemoteCursor(target.targetPre, endpoint.eid, message.topic, message.idx);
-        }));
+        // The concrete HTTP/SSE operation owns and joins this whole poll attempt. A signer the host released
+        // (while signing the query, or in the consumer's protocol work) ends the poll as `unsignable`.
+        try {
+            const outcome = yield* call(() => fetchMailboxMessages(target.signerHab, target.targetPre, endpoint.eid, endpoint.url, cursor, mailboxFetchTimeoutPolicy(this.timeoutPolicy), this.http, this.clock, function* deliverThenAdvanceCursor(message) {
+                yield* call(() => onBatch({ pre: target.targetPre, eid: endpoint.eid, messages: [message.msg] }));
+                self.mailboxDirector.updateRemoteCursor(target.targetPre, endpoint.eid, message.topic, message.idx);
+            }));
+            return { outcome };
+        }
+        catch (error) {
+            if (error instanceof SignerNotHeldError)
+                return { outcome: "unsignable", missing: error.pub };
+            throw error;
+        }
     }
     /**
      * Keep one long-lived worker running for each currently configured remote endpoint.
@@ -225,7 +243,12 @@ export class MailboxPoller {
     *remoteEndpointWorker(target, endpoint, onBatch) {
         let state = { backoffMs: 0 };
         while (true) {
-            const outcome = yield* this.pollRemoteEndpointOnce(target, endpoint, onBatch);
+            const { outcome, missing } = yield* this.pollRemoteEndpointOnce(target, endpoint, onBatch);
+            const source = `mailbox-poller:${target.targetPre}/${endpoint.eid}`;
+            if (missing)
+                this.signerConditions?.report(source, missing, this.clock.now());
+            else
+                this.signerConditions?.clear(source);
             const step = nextPoll(state, outcome, {
                 initialMs: this.timeoutPolicy.refusalInitialMs,
                 maxMs: this.timeoutPolicy.refusalMaxMs,
@@ -241,7 +264,11 @@ export class MailboxPoller {
                     yield* waitOnClock(this.clock, step.action.ms);
                     break;
                 case "wait":
-                    yield* waitOnClock(this.clock, step.action.ms);
+                    // A released signer is waited out until one is held again, not for the full backoff.
+                    if (missing && this.signerConditions)
+                        yield* this.signerConditions.waitForHold(this.clock, step.action.ms);
+                    else
+                        yield* waitOnClock(this.clock, step.action.ms);
                     break;
             }
         }
@@ -347,6 +374,7 @@ export function nextPoll(state, outcome, backoff = MailboxPoller.RefusalBackoff)
         }
         case "no-response":
         case "unreachable":
+        case "unsignable":
         case "refused":
             return backOff(state, backoff);
     }

package/esm/keri/npm/src/app/mailbox/mailboxing.js

@@ -264,9 +264,12 @@ export function hostedEndpointPathMatches(hby, pathname, eids) {
  * @param pathname Incoming URL pathname to compare against accepted endpoint base paths.
  * @param resourceSuffix Protocol resource suffix sought beneath the hosted base path.
  * @param eids Optional explicit hosted-AID filter; do not infer host eligibility from all local identities.
+ * @param destination The request's `CESR-DESTINATION`: when several local identifiers share the longest base
+ *   path (one ingress URL for many identifiers), the one it names is the match. Without it, or when it names
+ *   none of them, the tie stays ambiguous.
  * @returns Matching hosted endpoint projection; ambiguity follows this helper's documented selection policy.
  */
-export function resolveHostedEndpointPath(hby, pathname, resourceSuffix = "", eids) {
+export function resolveHostedEndpointPath(hby, pathname, resourceSuffix = "", eids, destination) {
     const matches = hostedEndpointPathMatches(hby, pathname, eids)
         .filter((match) => resourceSuffix.length === 0
         ? true
@@ -275,8 +278,11 @@ export function resolveHostedEndpointPath(hby, pathname, resourceSuffix = "", ei
         return { kind: "none", endpoint: null, relativePath: null };
     }
     const longest = matches[0].basePath.length;
-    const narrowed = matches.filter((match) => match.basePath.length === longest);
-    if (narrowed.length > 1) {
+    let narrowed = matches.filter((match) => match.basePath.length === longest);
+    if (narrowed.length > 1 && destination) {
+        narrowed = narrowed.filter((match) => match.eid === destination);
+    }
+    if (narrowed.length !== 1) {
         return { kind: "ambiguous", endpoint: null, relativePath: null };
     }
     const endpoint = narrowed[0];

package/esm/keri/npm/src/app/multisig/counseling.js

@@ -41,7 +41,10 @@ import { Kever } from "../../core/kel/kever.js";
 import { dgKey } from "../../db/core/keys.js";
 import { pinAuthorizingSeal, retryDelegatorWitnessQuery, } from "../identity/delegating.js";
 import { observeUntil } from "../runtime/workflow-contract.js";
-import { groupWitnesser, isLocalGroupHab, localGroupMember } from "./group-members.js";
+import { groupSigningMembers, groupWitnesser, isLocalGroupHab, localGroupMember } from "./group-members.js";
+import { remoteGroupMembers } from "./multisig-messaging.js";
+/** Forwarding attempts of one completed event before the Counselor stops retrying its failed members. */
+export const FORWARD_ATTEMPTS = 8;
 /** Grace before a non-elected member submits receipts itself. */
 export const DEFAULT_FALLBACK_AFTER_MS = 60_000;
 /** First and longest wait between receipt attempts for one event. */
@@ -80,7 +83,7 @@ export class Counselor {
      * @param mailboxes Told when one of the group's rotations completes; the member runtime's publisher then tells
      *   the group's mailboxes the new key state, and several members doing so is harmless.
      */
-    constructor(hby, receipting, clock, changes, delegation, mailboxes, receiptRetry = DEFAULT_RECEIPT_RETRY) {
+    constructor(hby, receipting, clock, changes, delegation, mailboxes, receiptRetry = DEFAULT_RECEIPT_RETRY, forwarding) {
         Object.defineProperty(this, "hby", {
             enumerable: true,
             configurable: true,
@@ -123,12 +126,31 @@ export class Counselor {
             writable: true,
             value: receiptRetry
         });
+        Object.defineProperty(this, "forwarding", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: forwarding
+        });
         Object.defineProperty(this, "runs", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: new Map()
         });
+        /** Completed events this member, as the elected one, still owes to other members; memory only. */
+        Object.defineProperty(this, "forwards", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "forwarded", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         Object.defineProperty(this, "anchorQuery", {
             enumerable: true,
             configurable: true,
@@ -264,11 +286,53 @@ export class Counselor {
     *processOnce() {
         // A runtime calls this every turn; with nothing counseled, three row counts are the whole cost.
         const db = this.hby.db;
-        if (db.gpse.cnt() === 0 && db.gdee.cnt() === 0 && db.gpwe.cnt() === 0)
+        if (db.gpse.cnt() === 0 && db.gdee.cnt() === 0 && db.gpwe.cnt() === 0 && this.forwards.size === 0)
             return;
         this.processSignatures();
         yield* this.processDelegation();
         yield* this.processWitnesses();
+        yield* this.forwardCompleted();
+    }
+    /** What became of the completed `event` this member forwarded to the others, per member; empty before it did. */
+    forwardOutcomes(event) {
+        return this.forwarded.get(this.runKey(event)) ?? [];
+    }
+    /** Send each completed event to the members that may not have it; failed members are retried with a doubling delay. */
+    *forwardCompleted() {
+        if (!this.forwarding)
+            return;
+        for (const [key, owed] of [...this.forwards]) {
+            const now = this.clock.now();
+            if (now < owed.nextAt)
+                continue;
+            let outcomes;
+            try {
+                outcomes = yield* this.forwarding.forward(owed.event, owed.members);
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                outcomes = owed.members.map((recipient) => ({
+                    recipient,
+                    exnSaid: owed.event.said,
+                    payloadSaid: owed.event.said,
+                    outcome: "failed",
+                    deliveries: [],
+                    reason,
+                }));
+            }
+            const failed = outcomes.filter((outcome) => outcome.outcome === "failed");
+            this.forwarded.set(key, [
+                ...(this.forwarded.get(key)?.filter((prior) => !outcomes.some((o) => o.recipient === prior.recipient)) ?? []),
+                ...outcomes,
+            ]);
+            owed.attempts++;
+            if (!failed.length || owed.attempts >= FORWARD_ATTEMPTS) {
+                this.forwards.delete(key);
+                continue;
+            }
+            owed.members = failed.map((outcome) => outcome.recipient);
+            owed.nextAt = now + Math.min(this.receiptRetry.baseMs * 2 ** owed.attempts, this.receiptRetry.maxMs);
+        }
     }
     /** Move events accepted with their escrowed SAID on to delegation or witnesses. */
     processSignatures() {
@@ -342,6 +406,14 @@ export class Counselor {
         });
         this.changes?.push({ kind: "group", id: `${event.pre}:${event.sn}` });
     }
+    /** The elected member owes the completed event to the members that did not sign it into existence. */
+    owe(event) {
+        if (!this.forwarding || !groupWitnesser(this.hby, event.pre, event))
+            return;
+        const members = remoteGroupMembers(this.hby, localGroupMember(this.hby, event.pre), groupSigningMembers(this.hby, event.pre));
+        if (members.length)
+            this.forwards.set(this.runKey(event), { event, members, attempts: 0, nextAt: 0 });
+    }
     /** Record completion of a counseled event and drop its row from `table`. */
     finish(table, event, row) {
         const db = this.hby.db;
@@ -351,6 +423,7 @@ export class Counselor {
         });
         this.runs.delete(this.runKey(event));
         this.changes?.push({ kind: "group", id: `${event.pre}:${event.sn}` });
+        this.owe(event);
         const ilk = db.getEvtSerder(event.pre, event.said)?.ilk;
         if (ilk === Ilks.rot || ilk === Ilks.drt) {
             this.mailboxes?.rotated({ kin: "rotated", pre: event.pre, sn: event.sn, said: event.said });