keri-ts 2.2.3 → 2.2.5

package/esm/keri/npm/src/app/credentials/root-replicator.js

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
 var _RootReplicator_instances, _RootReplicator_deps, _RootReplicator_pending, _RootReplicator_inflight, _RootReplicator_seen, _RootReplicator_dirty, _RootReplicator_pruned, _RootReplicator_attempt, _RootReplicator_refreshDirty, _RootReplicator_derive;
-import { isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
+import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
 import { replicateRootCopy, RootResealBudgetMs } from "./root-replicating.js";
 /** Most copies one `processOnce` attempts, so a first pass over a large store cannot stall the runtime. */
 export const RootSendsPerPass = 4;
@@ -18,13 +18,22 @@ export const RootSendsPerPass = 4;
 export const RootRetryBaseMs = 1_000;
 export const RootRetryMaxMs = 300_000;
 const idOf = (group, registry, recipient) => [group, registry, recipient].join("/");
+/**
+ * What a group's owed copies were last derived from: its latest establishment SAID and its stored signing members.
+ * The members change without a new establishment event when a member's KEL arrives after the event was accepted.
+ */
+function derivedFrom(hby, hab) {
+    const established = hab.pre && isLocalGroupHab(hby, hab) ? hab.kever?.lastEst.d : null;
+    return established ? [established, ...groupSigningMembers(hby, hab.pre)].join(" ") : null;
+}
 /**
  * Derives, sends and records registry root copies for a wallet's local groups.
  *
  * Holds no durable state of its own beyond `Baser.rrsn`; what is pending and the
  * backoff are process-local and rebuilt from state. A host calls `prompt` (or
  * `replicate`) for each Dhke cue and `processOnce` on its loop; both are safe to repeat,
- * and overlapping `processOnce` calls never send one copy twice.
+ * and overlapping `processOnce` calls never send one copy twice. Groups on the `changed`
+ * deck are prompted by the next pass.
  */
 export class RootReplicator {
     constructor(deps) {
@@ -58,8 +67,8 @@ export class RootReplicator {
         return yield* this.processDue({ timeoutMs });
     }
     /**
-     * The fixed-tock pass: re-derive only the groups that were prompted, then send up to {@link RootSendsPerPass}
-     * due copies. A rotation nobody prompted for waits for {@link RootReplicator.sweep}.
+     * The fixed-tock pass: re-derive only the groups that were prompted or are on the `changed` deck, then send up
+     * to {@link RootSendsPerPass} due copies. A rotation nobody prompted for waits for {@link RootReplicator.sweep}.
      */
     *processDue({ timeoutMs = RootResealBudgetMs } = {}) {
         const { clock } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), deadline = clock.now() + Math.max(timeoutMs, 0);
@@ -68,7 +77,8 @@ export class RootReplicator {
         for (const entry of [...__classPrivateFieldGet(this, _RootReplicator_pending, "f").values()]) {
             if (results.length >= RootSendsPerPass)
                 break;
-            if (entry.retryAt > clock.now())
+            // The group's local member signs the copy; one that cannot sign yet keeps it without spending an attempt.
+            if (entry.retryAt > clock.now() || !__classPrivateFieldGet(this, _RootReplicator_deps, "f").root.hby.habs.get(entry.group)?.canSign())
                 continue;
             const result = yield* __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_attempt).call(this, entry.group, entry.registry, entry.recipient, deadline);
             if (!result)
@@ -106,7 +116,7 @@ export class RootReplicator {
     }
     /** Whether a copy is owed or a group is waiting to be re-derived; in memory, reads no store. */
     pending() {
-        return __classPrivateFieldGet(this, _RootReplicator_pending, "f").size > 0 || __classPrivateFieldGet(this, _RootReplicator_dirty, "f").size > 0;
+        return __classPrivateFieldGet(this, _RootReplicator_pending, "f").size > 0 || __classPrivateFieldGet(this, _RootReplicator_dirty, "f").size > 0 || !(__classPrivateFieldGet(this, _RootReplicator_deps, "f").changed?.empty ?? true);
     }
     /** Pure read: what is owed and why it has not gone yet. */
     status() {
@@ -116,8 +126,8 @@ export class RootReplicator {
     }
     /**
      * The full check: drop markers of groups that are gone (once) and re-derive each local group that is new or
-     * whose establishment event changed. One keyed read per local identifier, so a host runs it every
-     * many tocks, not every tock.
+     * whose establishment event or stored members changed. One keyed read per local identifier, so a host runs it
+     * every many tocks, not every tock.
      */
     sweep() {
         const { root } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), hby = root.hby;
@@ -129,10 +139,10 @@ export class RootReplicator {
             }
         }
         for (const hab of hby.habs.values()) {
-            const established = hab.pre && isLocalGroupHab(hby, hab) ? hab.kever?.lastEst.d : null;
-            if (!established || (__classPrivateFieldGet(this, _RootReplicator_seen, "f").get(hab.pre) === established && !__classPrivateFieldGet(this, _RootReplicator_dirty, "f").has(hab.pre)))
+            const derived = derivedFrom(hby, hab);
+            if (!derived || (__classPrivateFieldGet(this, _RootReplicator_seen, "f").get(hab.pre) === derived && !__classPrivateFieldGet(this, _RootReplicator_dirty, "f").has(hab.pre)))
                 continue;
-            __classPrivateFieldGet(this, _RootReplicator_seen, "f").set(hab.pre, established);
+            __classPrivateFieldGet(this, _RootReplicator_seen, "f").set(hab.pre, derived);
             __classPrivateFieldGet(this, _RootReplicator_dirty, "f").delete(hab.pre);
             __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_derive).call(this, hab.pre);
         }
@@ -158,14 +168,16 @@ _RootReplicator_deps = new WeakMap(), _RootReplicator_pending = new WeakMap(), _
         __classPrivateFieldGet(this, _RootReplicator_inflight, "f").delete(id);
     }
 }, _RootReplicator_refreshDirty = function _RootReplicator_refreshDirty() {
-    const hby = __classPrivateFieldGet(this, _RootReplicator_deps, "f").root.hby;
+    const { root, changed } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), hby = root.hby;
+    for (let group = changed?.pull(); group !== undefined; group = changed?.pull())
+        this.prompt(group);
     for (const group of [...__classPrivateFieldGet(this, _RootReplicator_dirty, "f")]) {
         const hab = hby.habs.get(group);
-        const established = hab && isLocalGroupHab(hby, hab) ? hab.kever?.lastEst.d : null;
+        const derived = hab ? derivedFrom(hby, hab) : null;
         __classPrivateFieldGet(this, _RootReplicator_dirty, "f").delete(group);
-        if (!established)
+        if (!derived)
             continue;
-        __classPrivateFieldGet(this, _RootReplicator_seen, "f").set(group, established);
+        __classPrivateFieldGet(this, _RootReplicator_seen, "f").set(group, derived);
         __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_derive).call(this, group);
     }
 }, _RootReplicator_derive = function _RootReplicator_derive(group) {

package/esm/keri/npm/src/app/credentials/schema-resolving.js

@@ -1,3 +1,4 @@
+import { readUrl } from "../../core/wire-fields.js";
 /** Parse one schema reference into the supported resolver contract. */
 export function parseSchemaReference(reference) {
     if (reference.startsWith("sad:")) {
@@ -7,7 +8,10 @@ export function parseSchemaReference(reference) {
         return { kind: "did", url: reference };
     }
     if (reference.startsWith("http://") || reference.startsWith("https://")) {
-        const parsed = new URL(reference);
+        // The reference is a remote credential's `s`; one that does not parse names no cached schema.
+        const parsed = readUrl(reference);
+        if (!parsed)
+            return { kind: "oobi", url: reference };
         const parts = parsed.pathname.split("/").filter((part) => part.length > 0);
         const oobiIndex = parts.lastIndexOf("oobi");
         const said = oobiIndex >= 0 && oobiIndex + 2 === parts.length ? parts[oobiIndex + 1] : undefined;

package/esm/keri/npm/src/app/credentials/tel-publishing.js

@@ -1,17 +1,20 @@
 import { ValidationError } from "../../core/errors.js";
-import { sendWitnessMessage } from "../witness/receipt-client.js";
+import { deliverWitnessMessage } from "../witness/receipt-client.js";
 /**
  * Advance one captured set of protocol escrows. Receipt collection includes
  * fanout; a crash before its commit repeats that ordinary finite operation.
  * Dissemination replays accepted TEL evidence to the anchor's historical witness
- * cohort and commits ctel only after every local transmission finished. Failure
- * retains the corresponding escrow for explicit resume, without an outbox.
+ * cohort and commits ctel only after every local transmission finished. A witness
+ * that is unreachable, refuses or does not receipt ends only that target: its
+ * escrow is retained and the next pass retries it, without an outbox. Local faults
+ * (missing issuer Hab, storage) still throw.
  */
 export function* publishPendingTel(hby, publication, receiptor, http, clock) {
     publication.advance();
     for (const target of publication.pendingReceipts()) {
-        yield* receiptor.receipt(target.issuer, { sn: target.anchorSn, allowTcp: true });
-        publication.receipted(target);
+        const outcome = yield* receiptor.attempt(target.issuer, { sn: target.anchorSn, allowTcp: true });
+        if (outcome.kind === "receipted")
+            publication.receipted(target);
     }
     for (const target of publication.pendingPublications()) {
         const hab = hby.habs.get(target.issuer);
@@ -19,9 +22,15 @@ export function* publishPendingTel(hby, publication, receiptor, http, clock) {
             throw new ValidationError(`Missing local TEL issuer ${target.issuer}.`);
         const diger = publication.reger.tels.getOn(target.pre, target.sn);
         const message = publication.reger.cloneTvt(target.pre, diger);
+        let delivered = true;
         for (const witness of target.witnesses) {
-            yield* sendWitnessMessage(hab, witness, message, http, clock, null);
+            const delivery = yield* deliverWitnessMessage(hab, witness, message, http, clock, null);
+            if (delivery.kind === "unreachable") {
+                delivered = false;
+                break;
+            }
         }
-        publication.published(target);
+        if (delivered)
+            publication.published(target);
     }
 }

package/esm/keri/npm/src/app/delivery/forwarding.js

@@ -1,20 +1,23 @@
 /** Queued signed-message publication. Poster owns transport attempts and their concrete outcomes. */
-import { attachmentPayload, collectPayload, concatBytes, Diger, framePayload, MtrDex, parseBytes, Vrsn_2_0, } from "cesr-ts";
+import { attachmentPayload, collectPayload, concatBytes, Diger, framePayload, MtrDex, parseBytes, ParserError, Vrsn_2_0, } from "cesr-ts";
 import { call, resource } from "effection";
 import { Deck } from "../../core/deck.js";
 import { ValidationError } from "../../core/errors.js";
 import { exchange } from "../../core/exchange/protocol-exchanging.js";
 import { Roles } from "../../core/roles.js";
-import { mailboxTopicKey, preferredUrl } from "../mailbox/mailboxing.js";
+import { mailboxTopicKey } from "../mailbox/mailboxing.js";
 import { transportMailboxTopic } from "../mailbox/topic-routing.js";
 import { localGroupMember } from "../multisig/group-members.js";
 import { abortable } from "../runtime/abortable.js";
+import { PROTOCOL_TOCK_MS } from "../runtime/doing.js";
 import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { waitOnClock } from "../runtime/workflow-contract.js";
 import { CesrHttpRefusal } from "../transport/cesr-egress.js";
-import { messengerFrom, streamMessengerFrom } from "../transport/messengering.js";
+import { messengerFrom, messengerUrl, streamMessengerFrom } from "../transport/messengering.js";
 import { requireTcpDialer } from "../transport/tcp-dialer.js";
 import { TransportError } from "../transport/transport-error.js";
 import { introduce } from "./introducing.js";
+import { relayEndpoint, relayRefusal } from "./relaying.js";
 /**
  * A v2 message refused for a peer this node must treat as v1.
  *
@@ -42,9 +45,47 @@ function knownV1Peer(hby, aid) {
     const kever = hby.db.getKever(aid);
     return kever !== null && kever !== undefined && kever.serder.pvrsn.major < 2;
 }
-/** Whether any frame of this complete signed wire needs a v2 reader. */
-function wireNeedsV2(message) {
-    return parseBytes(message).some(frame => frame.body.pvrsn.major >= 2 || (frame.gvrsn?.major ?? 1) >= 2);
+/**
+ * A queued message whose own bytes cannot be prepared for sending: they are not complete CESR, or a forwarded
+ * delivery's source is not exactly one complete message. It describes the event, never this node, so it fails that
+ * delivery and the Poster continues with the next.
+ */
+export class UnsendableMessageError extends ValidationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "UnsendableMessageError"
+        });
+    }
+}
+/**
+ * Decode a queued message once, before any target is prepared.
+ *
+ * `ParserError` is the decoder's refusal of the bytes. This is the Poster's only decode of a producer's bytes; the
+ * wrappers it later builds and re-parses are its own output, so a failure there stays a fault.
+ *
+ * @param evt Admitted event whose copied bytes are decoded.
+ * @returns The message's complete frames in wire order.
+ * @throws UnsendableMessageError when the bytes are not complete CESR.
+ */
+function messageFrames(evt) {
+    try {
+        return parseBytes(evt.msg);
+    }
+    catch (error) {
+        if (!(error instanceof ParserError))
+            throw error;
+        throw new UnsendableMessageError(`Queued message for ${evt.dest} is not complete CESR: ${error.message}`, {
+            cause: error,
+        });
+    }
+}
+/** Whether any of these frames needs a v2 reader. */
+function framesNeedV2(frames) {
+    return frames.some(frame => frame.body.pvrsn.major >= 2 || (frame.gvrsn?.major ?? 1) >= 2);
 }
 /**
  * Preserve resolved endpoint schemes and signed bytes for concrete transport construction.
@@ -64,6 +105,13 @@ function remoteCesrTarget(endpoint, message) {
  * storage). Only recipients without those roles use one witness. Transport
  * completion and opt-in outcomes do not prove remote protocol acceptance. Finite
  * stream admissions use the first present role through the same execution owner.
+ *
+ * With a relay (an edge runtime) there is no role traversal: every recipient other
+ * than the relay gets one `/fwd` delivery to the relay, which does the forwarding,
+ * and the relay itself gets the message directly. `sent` then means the relay
+ * accepted the wrapper, not that the final recipient received it. A forwarded
+ * delivery fails with `RelayUnauthorizedError`, sending nothing, until its wrapper
+ * signer (a group's local member) has authorized the relay as its mailbox.
  */
 export class Poster {
     /**
@@ -74,9 +122,10 @@ export class Poster {
      * @param protocol Borrowed same-database processor for TCP replies; null permits send-only work.
      * @param http Borrowed HTTP implementation selected by composition.
      * @param clock Borrowed clock for transport deadlines; times are milliseconds.
+     * @param relay The agent every message goes through; null selects ordinary direct role traversal.
      * @throws RangeError if protocol state belongs to a different database.
      */
-    constructor(hby, mbx, protocol, http, clock) {
+    constructor(hby, mbx, protocol, http, clock, relay) {
         /** Borrowed habitat collection and backing accepted protocol state. */
         Object.defineProperty(this, "hby", {
             enumerable: true,
@@ -168,6 +217,13 @@ export class Poster {
             writable: true,
             value: void 0
         });
+        /** The agent every message goes through (an edge); null delivers directly (a forwarder). */
+        Object.defineProperty(this, "relay", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         if (protocol && protocol.kvy.db !== hby.db)
             throw new RangeError("Poster protocol must use the same database");
         this.hby = hby;
@@ -175,6 +231,7 @@ export class Poster {
         this.http = http;
         this.clock = clock;
         this.protocol = protocol;
+        this.relay = relay;
     }
     /**
      * Admit signed source bytes; callers must observe an outcome before reporting transmission.
@@ -283,11 +340,16 @@ export class Poster {
         }
         return found;
     }
-    /** Run queued delivery independently of query response intake and producer lifetimes. */
-    *deliverDo() {
+    /**
+     * Run queued delivery independently of query response intake and producer lifetimes, as a fixed-tock doer:
+     * a pass only when something is queued (an emptiness check, no store read), then one tock. A message queued
+     * between tocks waits at most `tockMs` before its delivery starts.
+     */
+    *deliverDo(tockMs = PROTOCOL_TOCK_MS) {
         while (!this.closed) {
-            yield* this.process();
-            yield* runtimeTurn();
+            if (!this.evts.empty)
+                yield* this.process();
+            yield* waitOnClock(this.clock, tockMs);
         }
     }
     /** Runnable and active work determine convergence; consumable observations do not. */
@@ -376,7 +438,11 @@ export class Poster {
     /**
      * Resolve and execute one event using sequential current endpoints.
      * Observed HTTP refusal and TransportError permit remaining targets to run.
-     * Unexpected construction/parser/storage/cleanup errors propagate so process can
+     * The event's bytes are decoded once; bytes that are not complete CESR fail the
+     * event. `PeerVersionError` and `UnsendableMessageError` from preparation fail
+     * only that target: both are decided from the event's own bytes and the peer's
+     * accepted version before any store write or I/O for the target. Other
+     * construction/storage/cleanup errors are faults and propagate so process can
      * publish or report the failed outcome before exposing the error.
      *
      * @param evt Concrete source-message record; completion/failure lookup uses object identity, not message SAID.
@@ -388,6 +454,11 @@ export class Poster {
         const hab = this.hby.habs.get(evt.src);
         if (!hab)
             throw new Error(`Unknown local sender ${evt.src}`);
+        if (this.relay) {
+            const refusal = relayRefusal(this.hby, this.relay, this.relaySigner(hab, this.relay, evt.dest));
+            if (refusal)
+                return { kin: "failed", evt, deliveries, error: refusal };
+        }
         const routes = this.findBytesRoutes(hab, evt.dest, evt.topic, evt.kin);
         if (!routes.length) {
             return {
@@ -397,6 +468,15 @@ export class Poster {
                 error: new ValidationError(`No end roles for ${evt.dest} to send raw CESR payload.`),
             };
         }
+        let frames;
+        try {
+            frames = messageFrames(evt);
+        }
+        catch (error) {
+            if (!(error instanceof UnsendableMessageError))
+                throw error;
+            return { kin: "failed", evt, deliveries, error };
+        }
         // A refused target does not prevent later targets from receiving this event.
         const failed = [];
         try {
@@ -412,14 +492,19 @@ export class Poster {
                             eid: endpoint.eid,
                             url: endpoint.url,
                             urls: endpoint.urls,
-                        }, evt);
+                        }, evt, frames);
                     }
                     catch (error) {
-                        if (!(error instanceof PeerVersionError))
+                        // Facts about this event and its peer, never this node: that target fails and the rest still run.
+                        if (!(error instanceof PeerVersionError || error instanceof UnsendableMessageError))
                             throw error;
                         failed.push(error);
                         continue;
                     }
+                    if (target.kind === "unsignable") {
+                        failed.push(new ValidationError(`Local signer ${target.signer} cannot sign now; its signer is not held.`));
+                        continue;
+                    }
                     try {
                         if (target.kind !== "stored") {
                             const refusal = yield* this.sendPreparedTarget(target, evt, signal);
@@ -479,7 +564,10 @@ export class Poster {
      *
      * Controller and agent roles each retain all endpoints. An indirect role picks
      * one random provider, unless an explicitly composed store owns an eligible local
-     * AID. Empty location maps retain role selection and become execution failures.
+     * AID. An agent role whose endpoint is a local AID with a composed store is that
+     * same local store target (given a topic), as the hosted agent keeps the recipient's
+     * mail for pickup. Empty location maps retain role selection and become execution failures.
+     * With a relay, the relay alone is the route (see {@link relayRoutes}).
      *
      * @param hab Local signing habitat borrowing accepted role/location state.
      * @param recipient Resolved final recipient AID.
@@ -488,6 +576,8 @@ export class Poster {
      * @returns Ordered role groups; no eligible role returns an empty array.
      */
     findBytesRoutes(hab, recipient, topic, kin = "msg") {
+        if (this.relay)
+            return this.relayRoutes(hab, this.relay, recipient, topic);
         const ends = hab.endsFor(recipient);
         const roles = [Roles.controller, Roles.agent, Roles.mailbox].filter((role) => Object.keys(ends[role] ?? {}).length);
         if (!roles.length && Object.keys(ends[Roles.witness] ?? {}).length)
@@ -496,10 +586,16 @@ export class Poster {
             roles.splice(1);
         return roles.map((role) => {
             const candidates = Object.entries(ends[role]);
+            // An agent hosted by this Habery keeps the recipient's mail itself: store it, never post to our own ingress.
+            const localAgent = role === Roles.agent && topic && this.mbx
+                && candidates.find(([eid]) => this.hby.db.prefixes.has(eid));
+            if (localAgent) {
+                return { kind: "forward", targets: [{ eid: localAgent[0], url: `local-mailbox:${localAgent[0]}`, urls: {} }] };
+            }
             if (role === Roles.controller || role === Roles.agent) {
                 return {
                     kind: "direct",
-                    targets: candidates.map(([eid, urls]) => ({ eid, url: preferredUrl(urls), urls })),
+                    targets: candidates.map(([eid, urls]) => ({ eid, url: messengerUrl(urls), urls })),
                 };
             }
             if (!topic)
@@ -511,14 +607,60 @@ export class Poster {
             const [eid, urls] = candidates[Math.floor(Math.random() * candidates.length)];
             return {
                 kind: "forward",
-                targets: [{ eid, url: preferredUrl(urls), urls }],
+                targets: [{ eid, url: messengerUrl(urls), urls }],
             };
         });
     }
+    /**
+     * Route through the relay: one `forward` route to the relay for every other recipient, never a direct fallback,
+     * and one `direct` route when the recipient is the relay. Recipient end roles are not read.
+     *
+     * @param hab Local sending habitat; its wrapper signer must have authorized the relay as mailbox.
+     * @param relay The configured relay agent.
+     * @param recipient Resolved final recipient AID.
+     * @param topic Recipient mailbox topic; the forwarded route requires a nonempty topic.
+     * @returns One route to the relay, or none while {@link relayRefusal} refuses the relay for this sender.
+     */
+    relayRoutes(hab, relay, recipient, topic) {
+        if (relayRefusal(this.hby, relay, this.relaySigner(hab, relay, recipient)))
+            return [];
+        const endpoint = relayEndpoint(this.hby, relay);
+        if (recipient === relay.aid)
+            return [{ kind: "direct", targets: [endpoint] }];
+        if (!topic)
+            throw new ValidationError(`Forwarded delivery requires an explicit topic for ${recipient}.`);
+        return [{ kind: "forward", targets: [endpoint] }];
+    }
+    /**
+     * The identifier whose mailbox authorization of the relay a delivery needs: the `/fwd` wrapper's signer (see
+     * {@link Poster.wrapperSigner}), the same `i` the agent reads to decide it serves the sender. For a group source
+     * that is the local member, not the group. A message addressed to the relay is not wrapped and needs none (null).
+     *
+     * @param hab Local sending habitat.
+     * @param relay The configured relay agent.
+     * @param recipient Resolved final recipient AID.
+     * @returns The wrapper signer's AID, or null when the recipient is the relay.
+     */
+    relaySigner(hab, relay, recipient) {
+        return recipient === relay.aid ? null : this.wrapperSigner(hab).pre;
+    }
+    /**
+     * The habitat that signs a `/fwd` wrapper for `hab`. A group cannot sign the wrapper alone: one member's signature
+     * does not meet a threshold above one, and the host would escrow the wrapper. The local member wraps; the payload
+     * keeps whatever signatures it carries.
+     *
+     * @param hab Local sending habitat, possibly a group.
+     * @returns `hab` itself, or the group's local member.
+     * @throws ValidationError when a group has no local member metadata.
+     */
+    wrapperSigner(hab) {
+        return this.hby.db.groups.has(hab.pre) ? localGroupMember(this.hby, hab.pre) : hab;
+    }
     /**
      * Whether `src` has any eligible role (controller, agent, mailbox or witness) from which to reach `dest`, as
      * delivery would find it now. A pure read of accepted endpoint state: it says nothing about whether the
-     * endpoint answers. A proposer uses it to refuse before it creates anything it could not publish.
+     * endpoint answers. A proposer uses it to refuse before it creates anything it could not publish. With a relay,
+     * it is whether {@link relayRefusal} accepts the relay for this sender.
      */
     canReach(src, dest, topic = "multisig") {
         const hab = this.hby.habs.get(src);
@@ -531,17 +673,19 @@ export class Poster {
      * @param route Selected direct or forwarded endpoint group.
      * @param endpoint One selected endpoint AID and URL from the route.
      * @param evt Original signed source and concrete ordinary/stream operation.
+     * @param frames The event's bytes, decoded once by {@link messageFrames}.
      * @returns A prepared remote target, or stored after authorized local mailbox publication.
      * @throws PeerVersionError when the wire needs a v2 reader that this peer is known not to be.
+     * @throws UnsendableMessageError when a forwarded ordinary message is not exactly one message.
      */
-    *prepareBytesTarget(hab, route, endpoint, evt) {
-        if (wireNeedsV2(evt.msg) && knownV1Peer(this.hby, evt.dest)) {
+    *prepareBytesTarget(hab, route, endpoint, evt, frames) {
+        if (framesNeedV2(frames) && knownV1Peer(this.hby, evt.dest)) {
             throw new PeerVersionError(`Refusing a v2 message for ${evt.dest}, whose latest accepted event is v1.`);
         }
         if (route.kind !== "direct") {
-            return yield* this.prepareForwardedTarget(hab, evt.dest, evt.topic, evt, endpoint);
+            return yield* this.prepareForwardedTarget(hab, evt.dest, evt.topic, evt, frames, endpoint);
         }
-        if (wireNeedsV2(evt.msg) && knownV1Peer(this.hby, endpoint.eid)) {
+        if (framesNeedV2(frames) && knownV1Peer(this.hby, endpoint.eid)) {
             throw new PeerVersionError(`Refusing a v2 message for endpoint ${endpoint.eid}, whose latest accepted event is v1.`);
         }
         return remoteCesrTarget(endpoint, evt.msg);
@@ -553,46 +697,46 @@ export class Poster {
      * @param recipient Final recipient AID, distinct from the intermediary endpoint.
      * @param topic Recipient mailbox topic used by the forwarding envelope.
      * @param evt Original signed source and operation; outer envelopes may be rebuilt.
+     * @param frames The event's decoded messages: exactly one for an ordinary event, each forwarded alone in a stream.
      * @param endpoint Mailbox/witness endpoint selected for this attempt.
-     * @returns Stored for a local endpoint, or signed forwarding wire with its introduction.
+     * @returns Stored for a local endpoint, unsignable when the wrapper signer cannot sign now, or signed forwarding
+     * wire with its introduction.
+     * @throws UnsendableMessageError when an ordinary event is not exactly one message.
      */
-    *prepareForwardedTarget(hab, recipient, topic, evt, endpoint) {
+    *prepareForwardedTarget(hab, recipient, topic, evt, frames, endpoint) {
         if (this.mbx && this.hby.db.prefixes.has(endpoint.eid)) {
             const stored = this.mbx.storeMsg(mailboxTopicKey(recipient, topic), mailboxReplyPayload(hab, recipient, topic, evt.msg));
             if (!stored)
                 throw new Error("Mailbox publication did not complete");
             return { kind: "stored" };
         }
-        // A group cannot sign the wrapper alone: one member's signature does not meet a threshold above one, and the
-        // host would escrow the wrapper. The local member wraps; the payload keeps whatever signatures it carries.
-        const signer = this.hby.db.groups.has(hab.pre) ? localGroupMember(this.hby, hab.pre) : hab;
-        const msgs = [];
-        if (evt.kin === "stream") {
-            // Prepare every frame before opening the one selected relay attempt.
-            for (const frame of parseBytes(evt.msg)) {
-                msgs.push(yield* abortable((signal) => collectPayload(framePayload(frame), signal)));
-            }
-        }
-        else {
-            msgs.push(evt.msg);
+        const signer = this.wrapperSigner(hab);
+        // Poster does not retry: an event whose wrapper cannot be signed now fails like any other undeliverable one.
+        if (!signer.canSign())
+            return { kind: "unsignable", signer: signer.pre };
+        // A stream forwards each of its messages alone; an ordinary event is forwarded whole, so it must be one message.
+        if (evt.kin !== "stream" && frames.length !== 1) {
+            throw new UnsendableMessageError(`Forwarding to ${recipient} requires one complete CESR message.`);
         }
         // The provider reads the envelope, so it must read v2 whenever the envelope or child is v2.
-        if ((signer.kelVersion.major >= 2 || msgs.some(wireNeedsV2)) && knownV1Peer(this.hby, endpoint.eid)) {
+        if ((signer.kelVersion.major >= 2 || framesNeedV2(frames)) && knownV1Peer(this.hby, endpoint.eid)) {
             throw new PeerVersionError(`Refusing a v2 envelope for provider ${endpoint.eid}, whose latest accepted event is v1.`);
         }
+        // Prepare every frame before opening the one selected relay attempt.
         const forwarded = [];
-        for (const message of msgs)
-            forwarded.push(yield* buildForwardedDelivery(signer, { recipient, topic, message }));
+        for (const child of frames)
+            forwarded.push(yield* buildForwardedDelivery(signer, { recipient, topic, child }));
         const intro = introduce(signer, endpoint.eid);
         let message = concatBytes(intro, ...forwarded);
         if (evt.kin === "stream") {
-            const frames = parseBytes(message);
-            if (frames.some(frame => (frame.gvrsn?.major ?? 1) >= 2)) {
+            // This node's own wrappers around already-decoded children: a parse failure here is a fault.
+            const prepared = parseBytes(message);
+            if (prepared.some(frame => (frame.gvrsn?.major ?? 1) >= 2)) {
                 // A v2 peer's default cannot interpret unqualified v1 introduction counters.
                 // Declare each prepared frame's actual genus without changing signed bodies.
                 // Entirely legacy streams retain their v1-peer-compatible unqualified wire.
                 const qualified = [];
-                for (const frame of frames) {
+                for (const frame of prepared) {
                     qualified.push(yield* abortable(signal => collectPayload(framePayload(frame), signal)));
                 }
                 message = concatBytes(...qualified);
@@ -609,14 +753,11 @@ export class Poster {
  * material that should travel with the forwarded request.
  *
  * @param hab Local signing habitat; its state/store lifetime remains with the caller.
- * @param args Final recipient, mailbox topic and exactly one complete signed source message.
+ * @param args Final recipient, mailbox topic and one decoded signed source message.
  * @returns Signed /fwd wire; v2 binds one nested child body, legacy uses pathed embeds.
  */
 function* buildForwardedDelivery(hab, args) {
-    const frames = parseBytes(args.message);
-    if (frames.length !== 1)
-        throw new ValidationError("Forwarding requires one complete CESR message.");
-    const child = frames[0];
+    const child = args.child;
     // A v2 member's stream is v2 after its introduction, so even a v1 child (such as a
     // KERIpy-form `e`-embed group proposal) travels nested with its own genus selector,
     // like KERIpy `StreamPoster.createForward`. Only v1 members keep the legacy embed.