keri-ts 2.2.1 → 2.2.3

package/esm/keri/npm/src/app/ipex/issuance.js

@@ -68,7 +68,8 @@ import { grantTransactionId, registryUncommitted, resumableExchange } from "../.
 import { ValidationError } from "../../core/errors.js";
 import { CREDENTIAL_MAILBOX_TOPIC } from "../../core/mailbox/mailbox-topics.js";
 import { timestampMicros } from "../../time/mod.js";
-import { isLocalGroupHab } from "../multisig/group-members.js";
+import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
+import { remoteGroupMembers } from "../multisig/multisig-messaging.js";
 import { DeliveryOutbox, } from "../runtime/delivery-outbox.js";
 import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
 import { deriveGroupCustody, GroupIssuance, GroupParty, registerGroupRoutes, stepGroup, } from "./group-issuance.js";
@@ -87,6 +88,10 @@ export const ISSUANCE_QUERY_RESEND_MS = 1000;
  * other members approve it).
  */
 export const ISSUANCE_SWEEP_MS = 5_000;
+/** The key of one party's operation on a Grant. */
+export function partyKey(grant, role) {
+    return `${role}:${grant}`;
+}
 /**
  * Adapt a `Poster`; its delivery worker must be running (a one-shot CLI runs it under `withRuntimeWorkers`).
  * A wire of several complete messages (proof support plus Grant) goes as one ordered stream, which mailbox
@@ -128,14 +133,14 @@ export class IssuanceOperations {
             writable: true,
             value: deps
         });
-        /** Operations live in this process. Internal to this module's functions. */
+        /** Operations live in this process, by {@link partyKey}. Read them through {@link liveOf}. */
         Object.defineProperty(this, "live", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: new Map()
         });
-        /** Operations that ended in this process with their reasons; not durable, see the module doc. */
+        /** Operations that ended in this process with their reasons, by {@link partyKey}; not durable, see the module doc. */
         Object.defineProperty(this, "ended", {
             enumerable: true,
             configurable: true,
@@ -176,8 +181,44 @@ export class IssuanceOperations {
             writable: true,
             value: []
         });
+        /**
+         * The delivery the outboxes use. A recipient that is an identifier of this Habery takes the bytes through the
+         * ordinary reactor path, so the checks a remote delivery meets run too; for a local group its members that are
+         * not held here are still delivered to, each through the host's delivery.
+         */
+        Object.defineProperty(this, "transport", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: { deliver: (message) => this.deliverToParty(message) }
+        });
         this.discloser = new IpexDiscloser(deps.hby, deps.rgy.store, deps.exc, deps.receiptor);
     }
+    /** The live operation of one party of `grant`; without `role`, the issuer's when this Habery holds both. */
+    liveOf(grant, role) {
+        return role
+            ? this.live.get(partyKey(grant, role))
+            : this.live.get(partyKey(grant, "issuer")) ?? this.live.get(partyKey(grant, "holder"));
+    }
+    /** The operation of one party of `grant` that ended in this process; without `role`, as {@link liveOf}. */
+    endedOf(grant, role) {
+        return role
+            ? this.ended.get(partyKey(grant, role))
+            : this.ended.get(partyKey(grant, "issuer")) ?? this.ended.get(partyKey(grant, "holder"));
+    }
+    /** Every live operation, for the module functions that look across parties. */
+    liveOps() {
+        return [...this.live.values()];
+    }
+    /** Record a consented operation as live, replacing what an earlier one of the same party left behind. */
+    begin(op) {
+        this.ended.delete(partyKey(op.grant, op.role));
+        this.live.set(partyKey(op.grant, op.role), op);
+    }
+    /** Remember how a party's operation on `grant` ended without a live operation to end. */
+    remember(grant, ended) {
+        this.ended.set(partyKey(grant, ended.role), ended);
+    }
     /** Whether a pass has work: a live operation, or the one-time scan for resumable Grants has not run. */
     active() {
         return this.live.size > 0 || this.stale.length > 0 || this.deps.clock.now() >= this.nextSweep;
@@ -190,15 +231,18 @@ export class IssuanceOperations {
     *processOnce() {
         if (this.deps.clock.now() >= this.nextSweep) {
             this.nextSweep = this.deps.clock.now() + ISSUANCE_SWEEP_MS;
-            const known = new Set(this.stale.map(({ grant }) => grant));
-            this.stale.push(...resumableGrants(this.deps).filter(({ grant }) => !this.live.has(grant) && !known.has(grant) && !this.refused.has(grant) && !this.ended.has(grant)));
+            const known = new Set(this.stale.map(({ grant, role }) => partyKey(grant, role)));
+            this.stale.push(...resumableGrants(this.deps).filter(({ grant, role }) => {
+                const key = partyKey(grant, role);
+                return !this.live.has(key) && !known.has(key) && !this.refused.has(key) && !this.ended.has(key);
+            }));
         }
         for (const found of [...this.stale]) {
             if (yield* this.settle(found))
                 this.stale.splice(this.stale.indexOf(found), 1);
         }
         for (const op of [...this.live.values()]) {
-            if (op.busy || !this.live.has(op.grant))
+            if (op.busy || this.live.get(partyKey(op.grant, op.role)) !== op)
                 continue;
             op.busy = true;
             try {
@@ -219,12 +263,23 @@ export class IssuanceOperations {
     /** End a live operation: release its DH approval, remember why until the process ends, tell the sink. */
     end(op, state, reason) {
         this.release(op);
-        this.ended.set(op.grant, { role: op.role, state, reason });
+        this.ended.set(partyKey(op.grant, op.role), { role: op.role, state, reason });
         this.deps.changes?.push({ kind: "issuance", id: op.grant });
     }
+    /**
+     * End, as abandoned with `reason`, every live operation of local group `group` whose party member or frozen
+     * DH custodian is `member`. Releasing the approval drops the DH owner's held query. Returns the Grants ended.
+     */
+    endBoundToMember(group, member, reason) {
+        const bound = [...this.live.values()].filter(op => op.group?.party.group.pre === group
+            && (op.group.party.member.pre === member || op.group.party.custodian === member));
+        for (const op of bound)
+            this.end(op, "abandoned", reason);
+        return bound.map(op => op.grant);
+    }
     /** Drop the live entry and the DH approval; a missing approval means the owner already closed. */
     release(op) {
-        this.live.delete(op.grant);
+        this.live.delete(partyKey(op.grant, op.role));
         try {
             op.dh.abandon(op.xid);
         }
@@ -239,7 +294,8 @@ export class IssuanceOperations {
      * dropped and reads from the stores. False means the Keeper is locked and the Grant is retried.
      */
     *settle(found) {
-        if (this.live.has(found.grant))
+        const key = partyKey(found.grant, found.role);
+        if (this.live.has(key))
             return true;
         try {
             found.hab.mgr.requireRegistryRootAccess();
@@ -251,18 +307,18 @@ export class IssuanceOperations {
         }
         // Another operations table over this runtime reached the Grant first (a command's own, beside the host's).
         if (this.deps.dhkes.dhke(found.hab).holds(found.grant)) {
-            this.refused.add(found.grant);
+            this.refused.add(key);
             return true;
         }
         try {
             yield* this.adopt(found);
         }
         catch (error) {
-            this.refused.add(found.grant);
+            this.refused.add(key);
             // A refusal means the stores no longer prove it resumable and status reads from them; anything else is
             // this Grant's failure alone and must not stop the other operations.
             if (!(error instanceof ValidationError)) {
-                this.ended.set(found.grant, { role: found.role, state: "failed", reason: message(error) });
+                this.ended.set(key, { role: found.role, state: "failed", reason: message(error) });
                 this.deps.changes?.push({ kind: "issuance", id: found.grant });
             }
         }
@@ -278,8 +334,8 @@ export class IssuanceOperations {
         }
         const wires = role === "issuer" ? yield* grantWires(retained) : null;
         const dh = this.deps.dhkes.dhke(hab), xid = dh.resume(grant);
-        this.ended.delete(grant);
-        this.live.set(grant, {
+        this.ended.delete(partyKey(grant, role));
+        this.live.set(partyKey(grant, role), {
             grant,
             xid,
             role,
@@ -308,8 +364,8 @@ export class IssuanceOperations {
         const party = GroupParty.resolve(this.deps, hab, election.coordinator.said);
         const group = new GroupIssuance(party, role, retained.serder, retained.nests ?? [], { mode: "resumed" });
         const dh = this.deps.dhkes.dhke(hab), xid = dh.resume(grant, party);
-        this.ended.delete(grant);
-        this.live.set(grant, this.liveGroup(group, dh, xid, "rootRetained"));
+        this.ended.delete(partyKey(grant, role));
+        this.live.set(partyKey(grant, role), this.liveGroup(group, dh, xid, "rootRetained"));
         this.deps.changes?.push({ kind: "issuance", id: grant });
     }
     /** The live entry of a group operation; its lifetime is the Grant's once KRAM has accepted it, else unknown. */
@@ -336,6 +392,20 @@ export class IssuanceOperations {
         yield* waitOnClock(this.deps.clock, milliseconds);
         return "expired";
     }
+    *deliverToParty(message) {
+        const { hby, reactor, delivery } = this.deps, recipient = hby.habs.get(message.dest);
+        if (!recipient)
+            return yield* delivery.deliver(message);
+        yield* reactor.processBytes(message.msg);
+        const reached = [`local:${recipient.pre}`];
+        if (!isLocalGroupHab(hby, recipient))
+            return reached;
+        const member = localGroupMember(hby, recipient.pre);
+        for (const dest of remoteGroupMembers(hby, member, groupSigningMembers(hby, recipient.pre))) {
+            reached.push(...yield* delivery.deliver({ ...message, dest }));
+        }
+        return reached;
+    }
     /**
      * Queue signed bytes for delivery from the identifier that signed them. Steps decide what to send; {@link drain}
      * sends it, so a member that is briefly offline delays the operation instead of ending it.
@@ -349,7 +419,7 @@ export class IssuanceOperations {
      * lasting {@link ISSUANCE_RETRY_BOUND_MS} end one that has none yet. True when the outbox is empty.
      */
     *drain(op) {
-        return yield* op.outbox.drain(this.deps.delivery, this.deps.clock, op.expires === null ? this.deps.retry?.boundMs ?? ISSUANCE_RETRY_BOUND_MS : undefined);
+        return yield* op.outbox.drain(this.transport, this.deps.clock, op.expires === null ? this.deps.retry?.boundMs ?? ISSUANCE_RETRY_BOUND_MS : undefined);
     }
     /** One pass: send what is queued, step only once the queue is empty, send what the step queued. */
     *advance(op) {
@@ -388,14 +458,16 @@ export class IssuanceOperations {
             : group.role === "issuer"
                 ? "awaitingGrantSignatures"
                 : "exchangingKeys";
-        this.ended.delete(group.said);
-        this.live.set(group.said, this.liveGroup(group, dh, xid, phase));
+        this.ended.delete(partyKey(group.said, group.role));
+        this.live.set(partyKey(group.said, group.role), this.liveGroup(group, dh, xid, phase));
         deps.changes?.push({ kind: "issuance", id: group.said });
         return { grant: group.said, xid };
     }
-    /** Whether the live operation for `grant` still holds a message the transport has not taken. */
-    owes(grant) {
-        return (this.live.get(grant)?.outbox.length ?? 0) > 0;
+    /** Whether a live operation for `grant` (or only its party `role`) still holds a message the transport has not taken. */
+    owes(grant, role) {
+        return role
+            ? (this.liveOf(grant, role)?.outbox.length ?? 0) > 0
+            : this.owes(grant, "issuer") || this.owes(grant, "holder");
     }
     /** One pass of the issuer loop, in the order of the CLI loop it replaces. */
     *step(op) {
@@ -525,7 +597,7 @@ function resumableGrants(deps) {
         if (parties.issuer && resumable(deps, parties.issuer, grant, "issuer")) {
             found.push({ hab: parties.issuer, grant, role: "issuer" });
         }
-        else if (parties.holder && resumable(deps, parties.holder, grant, "holder")) {
+        if (parties.holder && resumable(deps, parties.holder, grant, "holder")) {
             found.push({ hab: parties.holder, grant, role: "holder" });
         }
     }
@@ -575,7 +647,7 @@ function selectGrant(ops, hab, grant, role, group = false) {
     const { deps } = ops;
     if (!group)
         requireIndividual(deps, hab);
-    if (ops.live.has(grant) || deps.exc.complete(grant)) {
+    if (ops.liveOf(grant, role) || partyComplete(deps, grant, role)) {
         throw new ValidationError("Issuance was already begun for this Grant");
     }
     const retained = deps.exc.retainedInput(grant, { pending: true });
@@ -594,6 +666,16 @@ function selectGrant(ops, hab, grant, role, group = false) {
         throw new Error("Authenticated pending Grant has a missing or corrupt deadline");
     return { retained, credential, deadline, expires };
 }
+/**
+ * Whether one party's side of a Grant is finished. The accepted Grant is one fact of the Habery, but a Habery that
+ * holds both parties finishes the holder's side only when the holder's own exchange has retained its root.
+ */
+export function partyComplete(deps, grant, role) {
+    if (!deps.exc.complete(grant))
+        return false;
+    const parties = grantParties(deps.hby, grant);
+    return role === "issuer" || !parties?.issuer || !parties.holder || heldRoot(deps, parties.holder, grant);
+}
 /** The Grant body with its nested disclosure (the input of proof support) and the Grant as sent to the holder. */
 function* grantWires(retained) {
     const raw = concatBytes(Counter.makeGVC(Vrsn_2_0), ...yield* call(() => Promise.all((retained.nests ?? []).map((nest) => collectPayload(framePayload(nest))))));
@@ -616,8 +698,7 @@ export function* beginIssuance(ops, grant, auths) {
     const { retained, credential, deadline, expires } = selectGrant(ops, hab, grant, "issuer");
     const { raw, grantWire } = yield* grantWires(retained);
     const dh = deps.dhkes.dhke(hab), xid = dh.approve(grant), query = dh.start(grant);
-    ops.ended.delete(grant);
-    ops.live.set(grant, {
+    ops.begin({
         grant,
         xid,
         role: "issuer",
@@ -651,8 +732,10 @@ export function* proposeIssuance(ops, draft, auths) {
  *
  * @throws ValidationError when `grant` is not a v2 Grant this runtime's identifiers are party to.
  */
-export function issuanceStatus(ops, grant) {
-    const { deps } = ops, ended = ops.ended.get(grant), live = ops.live.get(grant);
+export function issuanceStatus(ops, grant, party = {}) {
+    const { deps } = ops, parties = grantParties(deps.hby, grant);
+    const chosen = chooseParty(parties, party);
+    const ended = ops.endedOf(grant, chosen), live = ops.liveOf(grant, chosen);
     if (ended)
         return { state: ended.state, role: ended.role, reason: ended.reason };
     if (live && !reached(deps.clock, live.expires)) {
@@ -664,19 +747,18 @@ export function issuanceStatus(ops, grant) {
             ...(live.outbox.failure && { failure: live.outbox.failure }),
         };
     }
-    const parties = grantParties(deps.hby, grant);
     if (!parties)
         throw new ValidationError("No issuance was begun for this Grant");
     const { serder, issuer, holder } = parties, db = deps.hby.db;
-    if (deps.exc.complete(grant)) {
+    if (partyComplete(deps, grant, chosen)) {
         const admitted = !!db.erpy.get([grant]);
-        if (!holder || (issuer && !admitted))
+        if (chosen === "issuer")
             return { state: "done", role: "issuer", phase: "issued" };
         if (admitted)
             return { state: "done", role: "holder", phase: "admitted" };
         return { state: "active", role: "holder", phase: "awaitingAdmitConsent", needs: "admit" };
     }
-    const role = issuer ? "issuer" : "holder", hab = (issuer ?? holder);
+    const role = chosen, hab = (role === "issuer" ? issuer : holder);
     const group = isLocalGroupHab(deps.hby, hab);
     // A group issuer's partial Grant has no accepted lifetime until its members' contributions authenticate it.
     const lifetime = deps.exc.exchangeDeadline(serder) ?? undefined;
@@ -701,6 +783,24 @@ export function issuanceStatus(ops, grant) {
     const [state, reason] = orphaned(deps, hab, grant);
     return { state, role, reason };
 }
+/**
+ * The party a read is for: the one asked for, else the Habery's only party, else (it holds both) the issuer. Null
+ * when the Grant has no local party.
+ *
+ * @throws ValidationError when `choice` names a party this Habery does not hold.
+ */
+function chooseParty(parties, choice) {
+    if (!parties)
+        return choice.role;
+    const held = [
+        ...(parties.issuer ? ["issuer"] : []),
+        ...(parties.holder ? ["holder"] : []),
+    ];
+    if (choice.role && !held.includes(choice.role)) {
+        throw new ValidationError(`This Habery holds no ${choice.role} of this Grant`);
+    }
+    return choice.role ?? held[0];
+}
 /**
  * Pure read of the Grants waiting for the holder's exchange consent: authenticated pending v2 Grants addressed
  * to a local identifier (to `hab` when given) for which {@link approveIssuanceExchange} would be accepted.
@@ -713,7 +813,7 @@ export function pendingIssuanceGrants(ops, { hab } = {}) {
         if (!holder || (hab && holder.pre !== hab.pre))
             continue;
         try {
-            const status = issuanceStatus(ops, grant);
+            const status = issuanceStatus(ops, grant, { role: "holder" });
             if (status.state !== "active" || status.needs !== "exchange")
                 continue;
             const { retained, credential, deadline } = selectGrant(ops, holder, grant, "holder");
@@ -746,7 +846,7 @@ export function pendingGroupGrants(ops, { group } = {}) {
         if (!parties || !holder || !isLocalGroupHab(deps.hby, holder) || (group && holder.pre !== group.pre))
             continue;
         try {
-            const status = issuanceStatus(ops, grant);
+            const status = issuanceStatus(ops, grant, { role: "holder" });
             if (status.state !== "active" || status.needs !== "exchange")
                 continue;
             const credential = deps.exc.retainedInput(grant, { pending: true })?.nests?.[0]?.body;
@@ -779,13 +879,13 @@ function heldRoot(deps, hab, grant) {
  * Observe until the issuance is done or ended, or the budget expires. Starts no
  * worker and drives nothing: someone else must call `processOnce`.
  */
-export function* waitForIssuance(ops, grant, { timeoutMs, clock = ops.deps.clock, until = (status) => status.state !== "active" }) {
+export function* waitForIssuance(ops, grant, { timeoutMs, clock = ops.deps.clock, until = (status) => status.state !== "active", role }) {
     // A phase is not reached while the step that produced it still owes a delivery: the host would stop its workers first.
-    const settled = yield* observeUntil(() => until(issuanceStatus(ops, grant)) && !ops.owes(grant), {
+    const settled = yield* observeUntil(() => until(issuanceStatus(ops, grant, { role })) && !ops.owes(grant, role), {
         timeoutMs,
         clock,
     });
-    const status = issuanceStatus(ops, grant);
+    const status = issuanceStatus(ops, grant, { role });
     return settled ? { outcome: "settled", status } : { outcome: "timed-out", status, timeoutMs };
 }
 /**
@@ -799,8 +899,7 @@ export function approveIssuanceExchange(ops, grant) {
         throw new ValidationError("Select the exact unanchored pending issuance Grant for this local party");
     const { retained, credential, deadline, expires } = selectGrant(ops, hab, grant, "holder");
     const dh = deps.dhkes.dhke(hab), xid = dh.approve(grant);
-    ops.ended.delete(grant);
-    ops.live.set(grant, {
+    ops.begin({
         grant,
         xid,
         role: "holder",
@@ -882,15 +981,15 @@ export function* rebuildIssuanceAdmit(deps, admit) {
  *
  * @throws ValidationError when no issuance was begun for `grant`.
  */
-export function abandonIssuance(ops, grant, reason = "Abandoned by the user") {
-    const status = issuanceStatus(ops, grant);
+export function abandonIssuance(ops, grant, reason = "Abandoned by the user", party = {}) {
+    const status = issuanceStatus(ops, grant, party);
     if (status.state !== "active")
         return;
-    const live = ops.live.get(grant);
+    const live = ops.liveOf(grant, status.role);
     if (live)
         ops.end(live, "abandoned", reason);
     else {
-        ops.ended.set(grant, { role: status.role, state: "abandoned", reason });
+        ops.remember(grant, { role: status.role, state: "abandoned", reason });
         ops.deps.changes?.push({ kind: "issuance", id: grant });
     }
 }

package/esm/keri/npm/src/app/ipex/pending-presentations.js

@@ -9,6 +9,8 @@
  */
 import { SerderACDC } from "cesr-ts";
 import { ValidationError } from "../../core/errors.js";
+import { timestampMicros } from "../../time/mod.js";
+import { singleDagDisclosurePlan } from "./ipex-graph.js";
 import { unblindingStatus } from "./unblinding-workflow.js";
 /**
  * The pending v2 Grants addressed to a local identifier (to `hab` when given) that are inside their deadline.
@@ -44,3 +46,51 @@ export function pendingPresentations(ops, { hab } = {}) {
     }
     return found;
 }
+/**
+ * The accepted v2 Applies addressed to a local identifier (to `hab` when given) that no exchange has answered
+ * (no `erpy` pointer) and whose deadline has not passed; with `includeAnswered`, the answered ones too. Mutates
+ * nothing. A group member lists the Applies of its group once the group has accepted them.
+ */
+export function pendingApplies(deps, { hab, includeAnswered = false } = {}) {
+    const { hby, exc, clock } = deps, found = [];
+    const now = BigInt(clock.now()) * 1000n;
+    for (const [[apply], serder] of [...hby.db.exns.getTopItemIter()]) {
+        const holder = serder.sad?.ri;
+        if (serder.route !== "/ipex/apply" || serder.pvrsn.major < 2 || typeof holder !== "string")
+            continue;
+        if (!hby.habs.has(holder) || (hab && hab.pre !== holder))
+            continue;
+        if (!exc.complete(apply))
+            continue;
+        const answer = hby.db.erpy.get([apply])?.qb64 ?? null;
+        if (answer && !includeAnswered)
+            continue;
+        const deadline = exc.exchangeDeadline(serder), expiry = deadline ? timestampMicros(deadline) : null;
+        if (!answer && expiry !== null && now >= expiry)
+            continue;
+        const q = serder.sad?.q;
+        found.push({
+            apply,
+            holder,
+            applicant: serder.pre,
+            message: String(serder.sad?.a?.m ?? ""),
+            plan: singleDagDisclosurePlan(q?.dp) ?? [],
+            deadline,
+            state: answer ? "answered" : "pending",
+            answer,
+        });
+    }
+    return found;
+}
+/** What answered the exchange `said`, from the answer pointer the stores keep; null when nothing has. Mutates nothing. */
+export function exchangeAnswer(deps, said) {
+    const answer = deps.hby.db.erpy.get([said])?.qb64, serder = answer ? deps.hby.db.exns.get([answer]) : null;
+    if (!answer || !serder?.route)
+        return null;
+    return { answer, route: serder.route, sender: serder.pre, accepted: deps.exc.complete(answer) };
+}
+/** The Agree that answers the Offer `offer`; null while nothing, or something other than an Agree (a Spurn), answered it. */
+export function agreeFor(deps, offer) {
+    const answer = exchangeAnswer(deps, offer);
+    return answer?.route === "/ipex/agree" ? answer : null;
+}

package/esm/keri/npm/src/app/ipex/presenting.js

@@ -184,7 +184,7 @@ export function* preparePresentation(deps, input) {
             break;
         case "agree":
         case "spurn":
-            prepared = yield* discloser.prepareReply(sender, input.verb, input.prior, input.message ?? "", input.recipient, input.auths);
+            prepared = yield* discloser.prepareReply(sender, input.verb, input.priorSaid, input.message ?? "", input.recipient, input.auths);
             break;
         case "offer":
             prepared = yield* discloser.prepareOffer(sender, input.selection, input.options);
@@ -259,6 +259,41 @@ export function* proposeGroupPresentation(deps, groupIpex, { hab, selection, opt
         },
     });
 }
+/**
+ * A group's consent to send an Apply, Offer, Agree or Spurn: freezes the unsigned body (the same body a single
+ * identifier would sign) and proposes it as a group-authored message with {@link proposeGroupIpex}. The other members
+ * list and approve it with `approveGroupIpex` and the elected lead delivers the completed message. A Grant has its own
+ * call, {@link proposeGroupPresentation}; an Admit has `proposeGroupAdmit`.
+ *
+ * @throws ValidationError for an identifier that is not a local group, a selection or predecessor the discloser
+ * refuses, an exchange that requires anchoring (a group message carries member contributions, not one source seal),
+ * or a message awaiting authenticating dependencies.
+ */
+export function* proposeGroupNegotiation(deps, groupIpex, input) {
+    const { hab, deliver } = input;
+    const sender = hab.pre;
+    let exn, nests, gvrsn;
+    switch (input.verb) {
+        case "apply":
+            gvrsn = input.options.gvrsn;
+            exn = discloserFor(deps, hab).applyBody(sender, input.options);
+            break;
+        case "offer": {
+            gvrsn = input.options.gvrsn;
+            const offer = yield* discloserFor(deps, hab, input.selection.derive).prepareOfferBody(sender, input.selection, input.options);
+            ({ exn, nests } = offer);
+            break;
+        }
+        case "agree":
+        case "spurn":
+            exn = yield* discloserFor(deps, hab).replyBody(sender, input.verb, input.priorSaid, input.message ?? "", input.recipient);
+            break;
+    }
+    if (exn.sad.a.ax?.[0] === true) {
+        throw new ValidationError("A group cannot send an exchange that requires anchoring.");
+    }
+    return yield* proposeGroupIpex(groupIpex, { hab, exn, nests, gvrsn: gvrsn ?? undefined, deliver });
+}
 /**
  * Deliver a group's completed prepared Grant ({@link resumePresentationFile}): queues the delivery bytes for
  * `processOnce` when the local member is the elected lead, with the retry and deadline of any presentation. Signs