keri-ts 2.2.3 → 2.2.5

package/types/app/mailbox/forward-handler.d.ts

@@ -1,16 +1,44 @@
-/** Authenticated /fwd intake: validate provider authority before storing reconstructed child bytes. */
+/** Authenticated /fwd intake: deliver locally or re-forward for senders this host serves, else store for recipients. */
 import { type CesrFrame, SerderKERI } from "cesr-ts";
 import { type Operation } from "effection";
+import type { Poster } from "../delivery/forwarding.js";
 import type { ExchangeAttachment, ExchangeRouteHandler } from "../exchanges/exchanging.js";
+import type { Habery } from "../identity/habbing.js";
+import type { Reactor } from "../protocol/reactor.js";
 import type { MailboxDirector } from "./mailbox-director.js";
 /**
- * Accepted `/fwd` route handler that stores embedded payloads in mailbox topics.
+ * Accepted `/fwd` route handler that stores embedded payloads in mailbox topics and, on a relaying host, delivers
+ * a served sender's payloads onward.
  *
  * This is the `keri-ts` mailbox-storage analogue to KERIpy's `ForwardHandler`.
  *
- * Authorization rule:
- * - the request-scoped mailbox AID passed with this message must currently be
- *   authorized for the addressed recipient
+ * Paths, in order; exactly one runs for one `/fwd`:
+ * - ingest: the recipient is a habitat of this Habery and either this host
+ *   keeps the recipient's mail for pickup (`keepsForPickup`: a local group that
+ *   authorized it as mailbox or agent), whoever the sender is and whether or
+ *   not the host relays, or the host relays and the `/fwd` sender is served.
+ *   The child goes through this runtime's own byte ingress as remote input
+ *   addressed to that habitat's endpoint, so
+ *   signature, KRAM and escrow rules apply as for any received message. This is
+ *   how an edge's group co-member hosted on the agent receives every group
+ *   message. When the host keeps mail for pickup and the child is not
+ *   `ownTraffic` (its originator is a local habitat, an agent principal of the
+ *   host, or a member of the group, i.e. the edge that would pick it up), it is
+ *   also stored once in the group's mailbox topic for its remote members: one
+ *   ingest, one stored copy. A third party's `/fwd` to the group is ingested and
+ *   stored; the edge's own is ingested only. This ingest is the only local
+ *   delivery of a pickup group's mail: the host's `MailboxPoller` never polls
+ *   its own endpoint for that group, so the stored copy is for remote members.
+ * - store: the request-scoped mailbox AID passed with this message must
+ *   currently be authorized for the addressed recipient (witness, mailbox or
+ *   agent). A recipient this host stores for is never also relayed.
+ * - relay (relaying only): the `/fwd` sender is served and the recipient is
+ *   remote. The host re-sends the child with its own Poster, as KERIA's agent
+ *   re-sends a Signify client's exn.
+ *
+ * A served sender authorized this host as its `mailbox` or `agent`, directly or
+ * through a group it is an accepted member of. Witness membership never makes a
+ * sender served.
  */
 export declare class ForwardHandler implements ExchangeRouteHandler {
     /** Registered exchange route for store-forward messages. */
@@ -22,17 +50,27 @@ export declare class ForwardHandler implements ExchangeRouteHandler {
     /** Borrowed provider publication/correlation owner. */
     readonly mailboxDirector: MailboxDirector;
     /**
-     * Bind mailbox publication without acquiring a store.
+     * Borrowed byte ingress of this host's runtime, through which a local recipient receives the child; null (a
+     * standalone Exchanger without a runtime) never ingests and only stores.
+     */
+    readonly reactor: Reactor | null;
+    /** Borrowed Poster that re-sends a served sender's child to a remote recipient; null means this host never relays. */
+    readonly relay: Poster | null;
+    /**
+     * Bind mailbox publication, local ingress and optional relaying without acquiring a store.
      *
      * @param mailboxDirector Borrowed provider owner that publishes accepted forwarded payloads.
+     * @param reactor Borrowed ingress for a local recipient's child; null only outside a runtime.
+     * @param relay Borrowed Poster of a relaying host; null keeps the host from relaying or serving senders.
      */
-    constructor(mailboxDirector: MailboxDirector);
+    constructor(mailboxDirector: MailboxDirector, reactor: Reactor | null, relay: Poster | null);
     /**
-     * Verify that the embedded exchange has the mailbox modifiers and one
-     * extractable forwarded payload.
+     * Verify that the exchange names a {@link ForwardAddress} and carries one forwarded message: a legacy embed that
+     * rebuilds into exactly one complete message ({@link legacyForwardedMessage}), or one SAID-bound v2 child. Any
+     * other shape is refused here, so the Exchanger rejects the `/fwd` and nothing is stored, relayed or ingested.
      *
      * @param args Signed forwarding exchange, attachment evidence and optional nested frames; children retain their own authentication requirements.
-     * @returns Whether required modifiers and one bound forwarded payload are structurally valid.
+     * @returns Whether the address and one bound forwarded message are structurally valid.
      */
     verify(args: {
         serder: SerderKERI;
@@ -40,10 +78,9 @@ export declare class ForwardHandler implements ExchangeRouteHandler {
         nests?: readonly CesrFrame[];
     }): boolean;
     /**
-     * Store one forwarded payload when the receiving host is allowed to act as
-     * the recipient's async correspondence store.
+     * Take the one {@link ForwardPath} this `/fwd` qualifies for, or drop it.
      *
-     * Accepted host shapes:
+     * Accepted store host shapes:
      * - explicit mailbox provider authorized in `ends.`
      * - recipient witness host from the accepted KEL witness set
      * - recipient agent host authorized in `ends.`
@@ -51,8 +88,19 @@ export declare class ForwardHandler implements ExchangeRouteHandler {
      * Controller endpoints stay excluded here because they are direct
      * correspondence destinations, not store-and-forward hosts.
      *
+     * A relayed child is admitted to the Poster with this host as source and the
+     * `/fwd` topic unchanged; the Poster's own `transportMailboxTopic` is
+     * idempotent on that already-bare topic. Admission is the end of this
+     * handler's duty: a failed onward attempt is the Poster's logged failed
+     * outcome, with no outbox and no acknowledgement back to the sender.
+     *
+     * An ingested child is dispatched inside this handler's operation, after the
+     * Exchanger has committed the `/fwd`; it is one more input to the shared
+     * protocol owners, which hold no lock or input queue. A child the recipient
+     * cannot process yet escrows as any received message does.
+     *
      * @param args Accepted exchange with borrowed attachments/children and receiving mailboxAid provenance.
-     * @returns An operation for v2 child serialization, or synchronous completion/no-op for legacy or unauthorized input.
+     * @returns An operation for v2 child serialization or local ingest, or synchronous completion/no-op otherwise.
      */
     handle(args: {
         serder: SerderKERI;
@@ -62,7 +110,59 @@ export declare class ForwardHandler implements ExchangeRouteHandler {
         /** Receiving hosted endpoint whose authority must cover the addressed recipient. */
         mailboxAid?: string | null;
     }): void | Operation<void>;
+    /**
+     * Decide the path from current accepted state; see the class rules for their order.
+     *
+     * @param source Authenticated `/fwd` signer and the forwarded message's own originator.
+     * @param recipient Final recipient AID named by the `/fwd` modifiers.
+     * @param mailboxAid Receiving hosted endpoint AID, or null when the request named none.
+     * @returns The one path to take, or null to drop the `/fwd`.
+     */
+    private forwardPath;
+    /**
+     * Select the local host that keeps `recipient`'s mail for pickup, or null; any local habitat without
+     * request-scoped provenance, as {@link servingHost} does.
+     *
+     * @param recipient Final recipient AID named by the `/fwd` modifiers.
+     * @param mailboxAid Receiving hosted endpoint AID, or null when the request named none.
+     * @returns The local AID that keeps the recipient's mail for pickup, or null.
+     */
+    private pickupHost;
+    /**
+     * Take one decided path for complete child wire.
+     *
+     * @param path Path decided in this turn.
+     * @param address Final recipient AID and `/fwd` mailbox topic.
+     * @param wire Exactly one complete child message, signed by its originator.
+     * @returns The ingest operation for a local recipient; storage (including an ingested child's pickup copy, written
+     *   before ingest in the turn its authority was read) and Poster admission complete synchronously.
+     */
+    private deliver;
     /** Re-read accepted authority in the same synchronous turn as provider publication. */
     private canStoreRecipient;
 }
+/**
+ * Who a relayed request speaks for. A group's `/fwd` wrapper is signed by its local member (Poster cannot meet a
+ * group threshold with one signature), so the signer and the forwarded message's originator can differ. A request
+ * the host consumes itself (an `/oobis` request) has no forwarded originator.
+ */
+export interface ForwardSource {
+    /** Authenticated `/fwd` signer (its `i`), verified by the Exchanger before this handler runs. */
+    readonly sender: string | null;
+    /** The forwarded message's own `i` (an ACDC's issuer), or null when it carries none. */
+    readonly origin: string | null;
+}
+/**
+ * Select the local host that serves this source, or null. This is the one served-sender rule of a relaying host:
+ * `/fwd` intake relays only for it and the `/oobis` handler resolves only for it.
+ *
+ * Without request-scoped provenance any local habitat the source authorized serves it, as the store path
+ * accepts any local store host.
+ *
+ * @param hby Borrowed local habitat collection and accepted-state database.
+ * @param source Authenticated signer and, for a `/fwd`, the forwarded message's own originator.
+ * @param mailboxAid Receiving hosted endpoint AID, or null when the request named none.
+ * @returns The local AID the source authorized, or null.
+ */
+export declare function servingHost(hby: Habery, source: ForwardSource, mailboxAid: string | null | undefined): string | null;
 //# sourceMappingURL=forward-handler.d.ts.map

package/types/app/mailbox/forward-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forward-handler.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/forward-handler.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,EACL,KAAK,SAAS,EAQd,UAAU,EAEX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAG3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;GAQG;AACH,qBAAa,cAAe,YAAW,oBAAoB;IACzD,4DAA4D;IAC5D,MAAM,CAAC,QAAQ,CAAC,QAAQ,UAAU;IAClC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,UAA2B;IAC5C,+FAA+F;IAC/F,QAAQ,CAAC,YAAY,QAAQ;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C;;;;OAIG;gBACS,eAAe,EAAE,eAAe;IAI5C;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAClC,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;KAC9B,GAAG,OAAO;IAiBX;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAClC,2EAA2E;QAC3E,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAC7B,oFAAoF;QACpF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAuB1B,uFAAuF;IACvF,OAAO,CAAC,iBAAiB;CAO1B"}
+{"version":3,"file":"forward-handler.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/forward-handler.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,OAAO,EAEL,KAAK,SAAS,EAWd,UAAU,EAEX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAIjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAgB7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,qBAAa,cAAe,YAAW,oBAAoB;IACzD,4DAA4D;IAC5D,MAAM,CAAC,QAAQ,CAAC,QAAQ,UAAU;IAClC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,UAA2B;IAC5C,+FAA+F;IAC/F,QAAQ,CAAC,YAAY,QAAQ;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC,sHAAsH;IACtH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B;;;;;;OAMG;gBACS,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAM3F;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAClC,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;KAC9B,GAAG,OAAO;IAgBX;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAClC,2EAA2E;QAC3E,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAC7B,oFAAoF;QACpF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAyB1B;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAkBnB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAMlB;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;IAgBf,uFAAuF;IACvF,OAAO,CAAC,iBAAiB;CAO1B;AA0BD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGpH"}

package/types/app/mailbox/kel-publisher.d.ts

@@ -18,13 +18,14 @@
  * A failed post is retried with a doubling delay up to {@link KEL_PUBLISH_MAX_DELAY_MS}, in memory, and given
  * up when the next attempt would start more than {@link KEL_PUBLISH_BUDGET_MS} after the first. Giving up
  * writes `failed` to the record and a change to the sink. A timed-out entry is not retried on its own: a new
- * rotation, a successful poll of that mailbox (the mailbox is evidently back), a successful 403 repair, a
- * `prompt`, or the next runtime open (memory starts empty, so each owed entry gets a fresh budget) re-arms it.
+ * rotation, a successful poll of that mailbox (the mailbox is evidently back), a 403 from it, a `prompt`, or the
+ * next runtime open (memory starts empty, so each owed entry gets a fresh budget) re-arms it. The mailbox poller
+ * reports polls as {@link MailboxPollCue} records on the `polls` deck; the publisher acts on them on its own tock.
  * A host that cannot take a multi-message stream (KERIpy answers 400 or 406) is recorded as told: it does
  * not authenticate polls, so nothing is lost.
  */
 import { type Operation } from "effection";
-import type { RotatedCue } from "../../core/cues.js";
+import type { MailboxPollCue, RotatedCue } from "../../core/cues.js";
 import { Deck } from "../../core/deck.js";
 import { type DoerPacing } from "../runtime/doing.js";
 import type { RetryPolicy } from "../runtime/retry-backoff.js";
@@ -78,34 +79,21 @@ export declare class KelPublisher {
     #private;
     /** Completion points push here; the next tock gives that identifier's entries a fresh budget. */
     readonly rotated: Deck<RotatedCue>;
-    /** A failure that escapes a pass is counted and kept here; the fiber keeps running. */
-    readonly health: {
-        faults: number;
-        last: {
-            error: unknown;
-            at: number;
-        } | null;
-    };
+    /** The mailbox poller pushes what each poll said here; the next tock re-arms or repairs that entry. */
+    readonly polls: Deck<MailboxPollCue>;
     constructor(deps: KelPublisherDeps);
     /**
      * Give `pre`'s entries a fresh budget and derive them on the next tock; with `mailbox`, re-arm only that mailbox's
-     * entry, and only if it timed out (the poller calls this after a successful poll).
+     * entry, and only if it timed out (what a `polled` record on {@link KelPublisher.polls} does).
      */
     prompt(pre: string, mailbox?: string): void;
-    /**
-     * A mailbox refused the owner's poll with 403: whatever the record says it holds, it cannot authenticate
-     * the owner (it lost its state, or accepted a post it then escrowed). Forget what it was given, so the next
-     * pass posts the KEL again, and give the entry a fresh budget. The poller calls this at most once per backoff
-     * period, which is also the most this posts; a mailbox that never recovers is given up on like any other.
-     */
-    repair(pre: string, mailbox: string): void;
     /**
      * The full check: forget records of mailboxes no longer authorized, and mark every identifier for derivation.
      * A walk of all identifiers, so a host runs it at open and every many tocks.
      */
     sweep(): void;
     /**
-     * The fixed-tock pass: drain the cues, derive the marked identifiers and those still owed, then send up to
+     * The fixed-tock pass: drain the decks, derive the marked identifiers and those still owed, then send up to
      * {@link KelSendsPerPass} due posts, each within `timeoutMs` for the mailbox's answer. An idle pass reads no
      * store. A post is recorded when the mailbox answers 2xx; a failure is retried on the schedule until the budget
      * is used up. Never throws on a remote failure; every attempt is returned.
@@ -134,8 +122,10 @@ export declare class KelPublisher {
 /**
  * Run the publisher on its own fiber until halted, as a fixed-tock doer: a sweep on tock 0 and every
  * `pacing.sweepTocks`, a pass on every tock, then a wait of one tock. A mailbox that hangs holds up only this
- * fiber, never the operation owners. A failure that escapes a pass is counted in `publisher.health` and the
- * loop keeps running.
+ * fiber, never the operation owners. Nothing is caught: every outcome of a post (an HTTP error status, a transport
+ * failure, no answer in time) is a `failed` publication that the pass records and retries, so what escapes a pass is a
+ * real fault (a store that cannot be read or written, a local group whose member is missing) and it ends the loop and
+ * `runAgentRuntime`. Halting the loop returns from the pass and is not a fault.
  */
 export declare function kelPublisherDo(publisher: KelPublisher, clock: RuntimeClock, pacing?: Readonly<DoerPacing>): Operation<never>;
 //# sourceMappingURL=kel-publisher.d.ts.map

package/types/app/mailbox/kel-publisher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kel-publisher.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/kel-publisher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,KAAK,UAAU,EAAW,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,KAAK,UAAU,EAAgB,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AACjG,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EAGxB,MAAM,qBAAqB,CAAC;AAG7B,wGAAwG;AACxG,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAC/C,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAC7C,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,WAAW,CAI1D,CAAC;AACH,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,UAAU,CAGpD,CAAC;AAEH,sCAAsC;AACtC,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,kHAAkH;IAClH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,+HAA+H;IAC/H,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAClE,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD;AA0BD,2FAA2F;AAC3F,qBAAa,YAAY;;IACvB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,mBAA0B;IAC1C,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,KAAK,EAAE,OAAO,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAA6B;gBASjG,IAAI,EAAE,gBAAgB;IAIlC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAW3C;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAO1C;;;OAGG;IACH,KAAK,IAAI,IAAI;IAOb;;;;;OAKG;IACF,UAAU,CAAC,EAAE,SAAyC,EAAE,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,SAAS,CAChG,kBAAkB,EAAE,CACrB;IAkCD,sEAAsE;IACrE,WAAW,CAAC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,SAAS,CAAC,kBAAkB,EAAE,CAAC;IAKnF,yEAAyE;IACzE,MAAM,IAAI,kBAAkB;IAK5B,iGAAiG;IACjG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,EAAE;IA4B7C;;;;OAIG;IACF,kBAAkB,CACjB,GAAG,EAAE,MAAM,EACX,EAAE,SAAS,EAAE,MAAW,EAAE,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACjE,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;CAqG7C;AAED;;;;;GAKG;AACH,wBAAiB,cAAc,CAC7B,SAAS,EAAE,YAAY,EACvB,KAAK,EAAE,YAAY,EACnB,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAwB,GAClD,SAAS,CAAC,KAAK,CAAC,CAUlB"}
+{"version":3,"file":"kel-publisher.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/kel-publisher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,KAAK,UAAU,EAAW,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,KAAK,UAAU,EAAgB,KAAK,UAAU,EAAE,MAAM,iCAAiC,CAAC;AACjG,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EAGxB,MAAM,qBAAqB,CAAC;AAG7B,wGAAwG;AACxG,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AACzC,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAC/C,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAC7C,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,WAAW,CAI1D,CAAC;AACH,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,UAAU,CAGpD,CAAC;AAEH,sCAAsC;AACtC,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,kHAAkH;IAClH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,+HAA+H;IAC/H,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAClE,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACnD;AA0BD,2FAA2F;AAC3F,qBAAa,YAAY;;IACvB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,mBAA0B;IAC1C,uGAAuG;IACvG,QAAQ,CAAC,KAAK,uBAA8B;gBAShC,IAAI,EAAE,gBAAgB;IAIlC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAyB3C;;;OAGG;IACH,KAAK,IAAI,IAAI;IAOb;;;;;OAKG;IACF,UAAU,CAAC,EAAE,SAAyC,EAAE,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,SAAS,CAChG,kBAAkB,EAAE,CACrB;IAsCD,sEAAsE;IACrE,WAAW,CAAC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,SAAS,CAAC,kBAAkB,EAAE,CAAC;IAKnF,yEAAyE;IACzE,MAAM,IAAI,kBAAkB;IAK5B,iGAAiG;IACjG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,EAAE;IA4B7C;;;;OAIG;IACF,kBAAkB,CACjB,GAAG,EAAE,MAAM,EACX,EAAE,SAAS,EAAE,MAAW,EAAE,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACjE,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;CAqG7C;AAED;;;;;;;GAOG;AACH,wBAAiB,cAAc,CAC7B,SAAS,EAAE,YAAY,EACvB,KAAK,EAAE,YAAY,EACnB,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAwB,GAClD,SAAS,CAAC,KAAK,CAAC,CAKlB"}

package/types/app/mailbox/mailbox-poller.d.ts

@@ -1,9 +1,11 @@
 /** Recipient mailbox polling: signed queries, awaited SSE intake and persisted cursor progression. */
 import { type Operation } from "effection";
+import type { MailboxPollCue } from "../../core/cues.js";
+import type { Deck } from "../../core/deck.js";
+import type { Relay } from "../delivery/relaying.js";
 import type { Habery } from "../identity/habbing.js";
 import { type DoerPacing } from "../runtime/doing.js";
 import type { RuntimeClock } from "../runtime/runtime-clock.js";
-import type { SignerConditions } from "../runtime/signer-conditions.js";
 import type { HttpClient } from "../transport/http-client.js";
 import type { MailboxDirector } from "./mailbox-director.js";
 /**
@@ -14,18 +16,11 @@ interface MailboxPollerOptions {
      * Optional millisecond header and poll-window overrides.
      */
     timeouts?: Partial<MailboxPollingTimeoutPolicy>;
-    /** Told after each poll a mailbox served; the runtime re-arms a timed-out KEL publication with it. */
-    onPolled?: (pre: string, mailbox: string) => void;
     /**
-     * Told when a mailbox answers 403 (it cannot authenticate the requester against the KEL it holds); the runtime
-     * has its KEL publisher post the KEL again. The worker then backs off.
+     * Where each served poll (`polled`) and each 403 (`unauthorized`) is pushed; the runtime wires the KEL publisher's
+     * `polls` deck here, which the publisher drains on its tock. Omitted, polls are reported nowhere.
      */
-    onUnauthorized?: (pre: string, mailbox: string) => void;
-    /**
-     * Where a poll that cannot be signed (its signer released) is reported while its worker waits; the worker
-     * resumes as soon as a signer is held again.
-     */
-    signerConditions?: SignerConditions;
+    polls?: Deck<MailboxPollCue>;
 }
 /** Tocks between the poller's full re-selection of workers: 160 tocks of 31.25 ms is five seconds. */
 export declare const MAILBOX_POLLER_SWEEP_TOCKS = 160;
@@ -42,7 +37,8 @@ export declare const MAILBOX_POLLER_PACING: Readonly<DoerPacing>;
  *
  * Each endpoint has an independent worker and durable progress in the director.
  * Retrieved records are lent to the awaited consumer; protocol intake stays outside.
- * A provider store in the same runtime is never scanned for local recipient input.
+ * A provider store in the same runtime is never scanned for local recipient input, and this runtime never polls its
+ * own endpoint for a local group whose mail it processes on arrival (see {@link MailboxPoller.deliveredOnArrival}).
  */
 export declare class MailboxPoller {
     #private;
@@ -71,12 +67,10 @@ export declare class MailboxPoller {
     readonly http: HttpClient;
     /** Borrowed clock for this owner's actual network deadlines. */
     readonly clock: RuntimeClock;
-    /** Told after each poll a mailbox served. */
-    readonly onPolled: ((pre: string, mailbox: string) => void) | undefined;
-    /** Where unsignable polls are reported, when the host keeps such a record. */
-    readonly signerConditions: SignerConditions | undefined;
-    /** Told when a mailbox answers 403. */
-    readonly onUnauthorized: ((pre: string, mailbox: string) => void) | undefined;
+    /** Where served polls and 403s are pushed, for the KEL publisher; null when nothing consumes them. */
+    readonly polls: Deck<MailboxPollCue> | null;
+    /** The agent this runtime polls through (an edge), its only provider; null polls mailboxes and witnesses. */
+    readonly relay: Relay | null;
     /**
      * Bind polling inputs and dependencies without starting workers or acquiring stores.
      *
@@ -84,9 +78,10 @@ export declare class MailboxPoller {
      * @param mailboxDirector Borrowed provider/topic/cursor owner.
      * @param http Borrowed HTTP implementation selected by composition.
      * @param clock Borrowed clock with epoch-millisecond now and millisecond timer delays.
-     * @param options Optional timeout overrides; finite positive values are floored with a 1 ms minimum. Missing/nonpositive/nonfinite values use 5-second headers and 30-second poll windows.
+     * @param relay The agent every subject is polled through; null selects authorized mailboxes and witnesses.
+     * @param options Optional timeout overrides and poll-report deck; finite positive timeouts are floored with a 1 ms minimum. Missing/nonpositive/nonfinite values use 5-second headers and 30-second poll windows.
      */
-    constructor(hby: Habery, mailboxDirector: MailboxDirector, http: HttpClient, clock: RuntimeClock, options?: MailboxPollerOptions);
+    constructor(hby: Habery, mailboxDirector: MailboxDirector, http: HttpClient, clock: RuntimeClock, relay: Relay | null, options?: MailboxPollerOptions);
     /**
      * Register one mailbox topic that this poller should retrieve.
      *
@@ -114,7 +109,7 @@ export declare class MailboxPoller {
      * @param target Mailbox subject habitat plus the actual local signer (a member for groups).
      * @param endpoint Selected remote endpoint AID and HTTP(S) URL.
      * @param onBatch Awaited consumer; successful completion precedes durable cursor advancement.
-     * @returns How the poll ended; see {@link PollOutcome}. An `unsignable` poll carries the missing public key.
+     * @returns How the poll ended; see {@link PollOutcome}.
      */
     private pollRemoteEndpointOnce;
     /**
@@ -123,6 +118,7 @@ export declare class MailboxPoller {
      * @param remoteWorkers Owned worker map, mutated to match current endpoint selection.
      * @param onBatch Shared awaited consumer used independently by each endpoint worker.
      * @param topics Current registered topics; no topics means no remote workers.
+     * @param tockMs How long a worker whose signer cannot sign yet waits before it looks again.
      */
     private syncRemoteWorkers;
     /**
@@ -132,13 +128,34 @@ export declare class MailboxPoller {
      * `keri-ts`'s split between mailbox transport and runtime parser ownership. Each poll ends in a
      * {@link PollOutcome}; {@link nextPoll} maps it and the backoff state to the next action. A mailbox that is
      * unreachable or refuses is retried on {@link MailboxPoller.RefusalBackoff}, never in a tight loop and never
-     * by failing the runtime. A 403 also prompts the KEL publisher, which owns posting the KEL.
+     * by failing the runtime. A served poll and a 403 are pushed onto `polls` for the KEL publisher, which owns posting
+     * the KEL.
+     *
+     * A signer that cannot sign yet (a store opened without it) is not a remote failure: the worker neither polls
+     * nor backs off, and looks again each tock, so it polls within one tock of `Manager.hold`. Because it never polls
+     * for such a subject, the consumer's protocol work never runs for it either.
      *
      * @param target Mailbox subject habitat plus the actual local signer (a member for groups).
      * @param endpoint Selected remote endpoint AID and HTTP(S) URL.
      * @param onBatch Awaited consumer; successful completion precedes durable cursor advancement.
+     * @param tockMs How long the worker waits before it looks again at a signer that cannot sign.
      */
     private remoteEndpointWorker;
+    /**
+     * Whether `subject`'s mail at `eid` already reached local processing when it arrived, so polling `eid` for it would
+     * process every stored message a second time. That holds when this runtime is the provider (it owns the mailbox
+     * store), `eid` is one of its own habitats and it keeps `subject`'s mail for pickup ({@link keepsForPickup}: for a
+     * local subject, a group that authorized `eid` as mailbox or agent). Such a host ingests every `/fwd` for the group
+     * on arrival (`ForwardHandler`) and dispatches every raw arrival before keeping it; the copy it stores is for the
+     * group's remote members, who poll it from here. Any other local subject at a local endpoint (a single-sig habitat
+     * whose mailbox is this host) is still polled over loopback HTTP, which is its only local delivery of stored mail.
+     * Without a mailbox store this runtime is not the provider, so it polls as any remote client would.
+     *
+     * @param subject Local mailbox subject AID.
+     * @param eid Selected provider AID.
+     * @returns True when the endpoint must not be polled for this subject.
+     */
+    private deliveredOnArrival;
     /**
      * Select locally pollable subjects without substituting the group for its member signer.
      *
@@ -210,10 +227,9 @@ export interface MailboxFetchTimeoutPolicy {
  * - `no-response`: no response headers within the open window.
  * - `unreachable`: the connection failed before or while the response was read (refused, DNS, reset).
  * - `unauthorized`: 403, the mailbox cannot authenticate the requester against the KEL it holds.
- * - `unsignable`: the poll could not be signed because the host released the signer (`Manager.release`).
  * - `refused`: any other non-success status.
  */
-export type PollOutcome = "served" | "no-response" | "unreachable" | "unauthorized" | "unsignable" | "refused";
+export type PollOutcome = "served" | "no-response" | "unreachable" | "unauthorized" | "refused";
 /** What the worker carries between polls: the current backoff, zero after a served poll. */
 export interface PollState {
     readonly backoffMs: number;

package/types/app/mailbox/mailbox-poller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mailbox-poller.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/mailbox-poller.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAQ,KAAK,SAAS,EAA4B,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAO,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAE,KAAK,UAAU,EAA6B,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAQxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D;;GAEG;AACH,UAAU,oBAAoB;IAC5B;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAChD,sGAAsG;IACtG,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClD;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,UAAU,CAGrD,CAAC;AAEH;;;;;;GAMG;AACH,qBAAa,aAAa;;IACxB;;OAEG;IACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAMxE;IACH;;OAEG;IACH,MAAM,CAAC,QAAQ,CAAC,iBAAiB,OAAO;IACxC;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAG3D;IAEH,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IAC9D,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACxE,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,uCAAuC;IACvC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAE9E;;;;;;;;OAQG;gBAED,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,eAAe,EAChC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,oBAAyB;IAapC;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIlC;;;;;;;;OAQG;IACF,MAAM,CACL,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,EAC5D,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAyB,GACnD,SAAS,CAAC,KAAK,CAAC;IAgCnB;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIzB;;;;;;;OAOG;IACH,OAAO,CAAE,sBAAsB;IAkC/B;;;;;;OAMG;IACH,OAAO,CAAE,iBAAiB;IA+B1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAE,oBAAoB;IAkC7B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAazB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;CAUtB;AAoBD,yGAAyG;AACzG,MAAM,WAAW,2BAA2B;IAC1C,mFAAmF;IACnF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,aAAa,GAAG,cAAc,GAAG,YAAY,GAAG,SAAS,CAAC;AAK/G,4FAA4F;AAC5F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,mHAAmH;AACnH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAO9E;AAED,2DAA2D;AAC3D,wBAAgB,OAAO,CACrB,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,QAAQ,CAAC,oBAAoB,CAAgC,GACrE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAG1C;AAED,2FAA2F;AAC3F,wBAAgB,QAAQ,CACtB,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,QAAQ,CAAC,oBAAoB,CAAgC,GACrE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAc1C"}
+{"version":3,"file":"mailbox-poller.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/mailbox-poller.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAQ,KAAK,SAAS,EAA4B,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,KAAK,EAAO,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,KAAK,UAAU,EAA6B,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAShE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAI9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D;;GAEG;AACH,UAAU,oBAAoB;IAC5B;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAChD;;;OAGG;IACH,KAAK,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;CAC9B;AAED,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,UAAU,CAGrD,CAAC;AAEH;;;;;;;GAOG;AACH,qBAAa,aAAa;;IACxB;;OAEG;IACH,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAMxE;IACH;;OAEG;IACH,MAAM,CAAC,QAAQ,CAAC,iBAAiB,OAAO;IACxC;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAG3D;IAEH,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IAC9D,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,sGAAsG;IACtG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IAC5C,6GAA6G;IAC7G,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAE7B;;;;;;;;;OASG;gBAED,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,eAAe,EAChC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,OAAO,GAAE,oBAAyB;IAYpC;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIlC;;;;;;;;OAQG;IACF,MAAM,CACL,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,EAC5D,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAyB,GACnD,SAAS,CAAC,KAAK,CAAC;IAgCnB;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIzB;;;;;;;OAOG;IACH,OAAO,CAAE,sBAAsB;IA6B/B;;;;;;;OAOG;IACH,OAAO,CAAE,iBAAiB;IAgC1B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAE,oBAAoB;IAkC7B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAazB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;CAUtB;AAoBD,yGAAyG;AACzG,MAAM,WAAW,2BAA2B;IAC1C,mFAAmF;IACnF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;AAKhG,4FAA4F;AAC5F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,mHAAmH;AACnH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAO9E;AAED,2DAA2D;AAC3D,wBAAgB,OAAO,CACrB,KAAK,EAAE,SAAS,EAChB,OAAO,GAAE,QAAQ,CAAC,oBAAoB,CAAgC,GACrE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAG1C;AAED,2FAA2F;AAC3F,wBAAgB,QAAQ,CACtB,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,QAAQ,CAAC,oBAAoB,CAAgC,GACrE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAa1C"}

package/types/app/mailbox/mailboxing.d.ts

@@ -18,6 +18,7 @@
 import type { Operation } from "effection";
 import type { Baser } from "../../db/basing.js";
 import { Mailboxer, type MailboxerOptions } from "../../db/mailbox/mailboxing.js";
+import type { Relay } from "../delivery/relaying.js";
 import type { Hab, Habery } from "../identity/habbing.js";
 /**
  * Derive mailbox open options from one existing habery.
@@ -81,22 +82,35 @@ export declare function mailboxQueryTopics(hby: Habery, pre: string, witness: st
 export declare function updateMailboxRemoteCursor(hby: Habery, pre: string, witness: string, topic: string, idx: number): void;
 /** AIDs `pre` currently has an authorized mailbox role with, in stored order. */
 export declare function authorizedMailboxes(db: Baser, pre: string): string[];
+/** One mailbox provider to poll: its AID, its HTTP(S) URL and the worker key that names the pair. */
+export interface MailboxPollEndpoint {
+    /** Stable worker key, `eid:url`. */
+    readonly key: string;
+    /** Provider AID the poll query is addressed to. */
+    readonly eid: string;
+    /** Preferred HTTP(S) URL of the provider. */
+    readonly url: string;
+}
 /**
  * Enumerate authorized mailbox providers and the subject's current KEL witnesses.
  *
  * Both sets are polled, as in KERIpy MailboxDirector. A provider in both roles
  * shares one history and cursor, so it gets one worker. Locally controlled AIDs
  * remain eligible for HTTP polling; provider storage is never scanned directly.
+ * This lists every provider; the poller itself drops a local provider that
+ * processes the subject's mail on arrival (`MailboxPoller.deliveredOnArrival`).
  * Missing HTTP(S) locations produce no poll target until a location is available.
  *
+ * With a relay (an edge runtime) the relay is the only provider: witnesses and other mailboxes are not polled, and
+ * the relay is polled once the subject has authorized it as mailbox (for a group, the group's own row, since the
+ * relay stores the group's messages under that authorization). Until then the subject has no poll target; the
+ * runtime prompts the poller when the role is accepted.
+ *
  * @param hab Mailbox subject habitat supplying accepted roles and current witnesses.
+ * @param relay The agent this runtime polls through; null polls authorized mailboxes and witnesses.
  * @returns One HTTPS-preferred HTTP target per provider AID, with stable worker keys.
  */
-export declare function mailboxPollEndpoints(hab: Hab): Array<{
-    key: string;
-    eid: string;
-    url: string;
-}>;
+export declare function mailboxPollEndpoints(hab: Hab, relay: Relay | null): MailboxPollEndpoint[];
 /**
  * Read one endpoint's currently stored URLs directly from shared DB state.
  *

package/types/app/mailbox/mailboxing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mailboxing.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/mailboxing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,gBAAgB,CAKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAiB,sBAAsB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,SAAS,CAAC,SAAS,CAAC,CAGtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,IAAI,CAIN;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAMpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAW/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,MAAM,SAAK,GACV,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAwB,SAAQ,cAAc;IAC7D;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IACnC;;OAEG;IACH,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACzC;;OAEG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAqBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,cAAc,SAAK,EACnB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,cAAc,EAAE,CAqBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,cAAc,SAAK,EACnB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,cAAc,GAAG,IAAI,CAGvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,uBAAuB,EAAE,CAsB3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,cAAc,SAAK,EACnB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,qBAAqB,CA0BvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAChD,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAarC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAExE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD"}
+{"version":3,"file":"mailboxing.d.ts","sourceRoot":"","sources":["../../../src/app/mailbox/mailboxing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,gBAAgB,CAKlB;AAED;;;;;;;;;;GAUG;AACH,wBAAiB,sBAAsB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACtC,SAAS,CAAC,SAAS,CAAC,CAGtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,IAAI,CAIN;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAMpE;AAED,qGAAqG;AACrG,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,mBAAmB,EAAE,CAgBzF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,MAAM,SAAK,GACV,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAwB,SAAQ,cAAc;IAC7D;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IACnC;;OAEG;IACH,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACzC;;OAEG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAqBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,cAAc,SAAK,EACnB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,cAAc,EAAE,CAqBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,cAAc,SAAK,EACnB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,cAAc,GAAG,IAAI,CAGvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GACtB,uBAAuB,EAAE,CAsB3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,cAAc,SAAK,EACnB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,qBAAqB,CA0BvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAChD,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAarC;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAExE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD"}

package/types/app/multisig/counseling.d.ts

@@ -1,5 +1,6 @@
 import { type Operation } from "effection";
 import type { RotatedCue } from "../../core/cues.js";
+import type { Deck } from "../../core/deck.js";
 import { type Anchorer, type AnchorQueryDeps } from "../identity/delegating.js";
 import type { Hab, Habery } from "../identity/habbing.js";
 import type { RetryPolicy } from "../runtime/retry-backoff.js";
@@ -79,20 +80,17 @@ export interface GroupReceipting {
     receipt(pre: string, options: {
         sn: number;
         auths: WitnessAuthMap;
+        allowTcp?: boolean;
     }): Operation<unknown>;
     get(pre: string, options: {
         sn: number;
         said: string;
     }): Operation<boolean>;
 }
-/** Told when a group rotation completes, so its mailboxes are told; the runtime's `kelPublisher.rotated` fits. */
-export interface GroupMailboxes {
-    rotated(cue: RotatedCue): void;
-}
 /**
  * Sends a completed event to members that may never have seen the signatures that completed it (a member that signed
  * nothing, or one whose own signature was not needed). One outcome per member; a transport failure is the member's
- * `failed` outcome and not an error.
+ * `failed` outcome and not an error. What it throws is a fault, which ends the Counselor's loop.
  */
 export interface GroupForwarding {
     forward(event: GroupEventRef, members: readonly string[]): Operation<GroupDelivery[]>;
@@ -115,23 +113,30 @@ export declare class Counselor {
     private readonly clock;
     private readonly changes?;
     private readonly delegation?;
-    private readonly mailboxes?;
+    private readonly rotated?;
+    private readonly groupChanges?;
     private readonly receiptRetry;
     private readonly forwarding?;
     private readonly runs;
     /** Completed events this member, as the elected one, still owes to other members; memory only. */
     private readonly forwards;
     private readonly forwarded;
+    /** Per local group, the latest establishment SAID its stored members were found to follow; memory only. */
+    private readonly aligned;
     /**
      * @param hby Borrowed identities and stores; the Counselor opens nothing.
      * @param receipting Submits or fetches witness receipts for accepted events.
      * @param clock Time source for fallback and retry; only `now` is used.
      * @param changes Optional sink told `{kind:"group", id:"<pre>:<sn>"}` after commits.
      * @param delegation Anchorer and query port for delegated events; omit for non-delegated hosts.
-     * @param mailboxes Told when one of the group's rotations completes; the member runtime's publisher then tells
-     *   the group's mailboxes the new key state, and several members doing so is harmless.
+     * @param rotated Deck that gets a record of each completed group rotation (`rot` or `drt`); the member runtime
+     *   passes its KEL publisher's, which then tells the group's mailboxes the new key state. Several members doing
+     *   so is harmless.
+     * @param groupChanges Deck that gets the prefix of a group whose establishment event completed or whose stored
+     *   members were aligned late; the member runtime shares it with its root replicator, which re-derives the
+     *   copies the group owes on its next pass instead of at its next sweep.
      */
-    constructor(hby: Habery, receipting: GroupReceipting, clock: Pick<RuntimeClock, "now">, changes?: ChangeSink | undefined, delegation?: GroupDelegation | undefined, mailboxes?: GroupMailboxes | undefined, receiptRetry?: Readonly<RetryPolicy>, forwarding?: GroupForwarding | undefined);
+    constructor(hby: Habery, receipting: GroupReceipting, clock: Pick<RuntimeClock, "now">, changes?: ChangeSink | undefined, delegation?: GroupDelegation | undefined, rotated?: Deck<RotatedCue> | undefined, groupChanges?: Deck<string> | undefined, receiptRetry?: Readonly<RetryPolicy>, forwarding?: GroupForwarding | undefined);
     private readonly anchorQuery;
     /**
      * Begin counseling an event. Idempotent and safe before local acceptance.
@@ -167,7 +172,12 @@ export declare class Counselor {
      * in-memory inputs. Accepted KEL state is untouched.
      */
     abandon(pre: string): void;
-    /** One pass over all stages, as KERIpy `processEscrows`. */
+    /** Whether completed events are held in memory for forwarding, which a pass retries without any store write. */
+    get holdsForwards(): boolean;
+    /**
+     * One pass over all stages, as KERIpy `processEscrows`, after aligning stored group members with accepted state
+     * so that a completion in this pass forwards to the members of the event that completed.
+     */
     processOnce(): Operation<void>;
     /** What became of the completed `event` this member forwarded to the others, per member; empty before it did. */
     forwardOutcomes(event: GroupEventRef): readonly GroupDelivery[];
@@ -184,9 +194,22 @@ export declare class Counselor {
     private publishDelegation;
     /** Non-publishing duty: find the delegator's sealing event, pin it, and move on to receipts. */
     private watchAnchor;
+    /**
+     * Bring each local group's stored members in line with its latest accepted establishment event, whoever proposed
+     * it and however late its last signature arrived (`Habery.alignGroupMembers`). A group is re-read only when that
+     * event differs from the one its members were last found to follow; one that cannot be attributed yet (a member's
+     * KEL is missing) is left as it is and read again on a later pass, which the arriving KEL's write brings about.
+     *
+     * After a change, an elected member whose latest establishment event already completed owes it again to the
+     * members it now has, and the group goes on `groupChanges` so the root replicator re-derives its copies.
+     */
+    private alignMembers;
     /** The elected member owes the completed event to the members that did not sign it into existence. */
     private owe;
-    /** Record completion of a counseled event and drop its row from `table`. */
+    /**
+     * Record completion of a counseled event and drop its row from `table`. A completed establishment event goes on
+     * `groupChanges`, and a completed rotation on `rotated` as well.
+     */
     private finish;
     /** Complete events whose own witness threshold is met; otherwise submit or fetch receipts. */
     private processWitnesses;