keri-ts 2.2.4 → 2.2.5

package/esm/keri/npm/src/app/mailbox/mailbox-poller.js

@@ -6,7 +6,6 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var _MailboxPoller_dirty;
 /** Recipient mailbox polling: signed queries, awaited SSE intake and persisted cursor progression. */
 import { call, scoped, spawn } from "effection";
-import { SignerNotHeldError } from "../identity/keeping.js";
 import { abortable } from "../runtime/abortable.js";
 import { doEvery, PROTOCOL_TOCK_MS } from "../runtime/doing.js";
 import { runtimeTurn } from "../runtime/runtime-turn.js";
@@ -15,6 +14,7 @@ import { isLegacyCesrMediaRejection, readResponseDetail } from "../transport/ces
 import { buildCesrRequest, CESR_CONTENT_TYPE, KERIPY_CESR_JSON_CONTENT_TYPE, } from "../transport/cesr-http.js";
 import { requestWithHeaderTimeout } from "../transport/httping.js";
 import { TransportError } from "../transport/transport-error.js";
+import { keepsForPickup } from "./agent-inbox.js";
 import { consumeMailboxSse } from "./mailbox-sse.js";
 import { mailboxPollEndpoints } from "./mailboxing.js";
 /** Tocks between the poller's full re-selection of workers: 160 tocks of 31.25 ms is five seconds. */
@@ -35,7 +35,8 @@ export const MAILBOX_POLLER_PACING = Object.freeze({
  *
  * Each endpoint has an independent worker and durable progress in the director.
  * Retrieved records are lent to the awaited consumer; protocol intake stays outside.
- * A provider store in the same runtime is never scanned for local recipient input.
+ * A provider store in the same runtime is never scanned for local recipient input, and this runtime never polls its
+ * own endpoint for a local group whose mail it processes on arrival (see {@link MailboxPoller.deliveredOnArrival}).
  */
 export class MailboxPoller {
     /**
@@ -45,9 +46,10 @@ export class MailboxPoller {
      * @param mailboxDirector Borrowed provider/topic/cursor owner.
      * @param http Borrowed HTTP implementation selected by composition.
      * @param clock Borrowed clock with epoch-millisecond now and millisecond timer delays.
-     * @param options Optional timeout overrides; finite positive values are floored with a 1 ms minimum. Missing/nonpositive/nonfinite values use 5-second headers and 30-second poll windows.
+     * @param relay The agent every subject is polled through; null selects authorized mailboxes and witnesses.
+     * @param options Optional timeout overrides and poll-report deck; finite positive timeouts are floored with a 1 ms minimum. Missing/nonpositive/nonfinite values use 5-second headers and 30-second poll windows.
      */
-    constructor(hby, mailboxDirector, http, clock, options = {}) {
+    constructor(hby, mailboxDirector, http, clock, relay, options = {}) {
         /** Borrowed habitat collection used to select mailbox signers. */
         Object.defineProperty(this, "hby", {
             enumerable: true,
@@ -83,22 +85,15 @@ export class MailboxPoller {
             writable: true,
             value: void 0
         });
-        /** Told after each poll a mailbox served. */
-        Object.defineProperty(this, "onPolled", {
+        /** Where served polls and 403s are pushed, for the KEL publisher; null when nothing consumes them. */
+        Object.defineProperty(this, "polls", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
-        /** Where unsignable polls are reported, when the host keeps such a record. */
-        Object.defineProperty(this, "signerConditions", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        /** Told when a mailbox answers 403. */
-        Object.defineProperty(this, "onUnauthorized", {
+        /** The agent this runtime polls through (an edge), its only provider; null polls mailboxes and witnesses. */
+        Object.defineProperty(this, "relay", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -106,15 +101,14 @@ export class MailboxPoller {
         });
         /** Identifiers whose mailbox endpoints changed; the poller re-selects their workers on the next tock. */
         _MailboxPoller_dirty.set(this, new Set());
-        const { timeouts, onPolled, onUnauthorized, signerConditions } = options;
-        this.signerConditions = signerConditions;
-        this.onPolled = onPolled;
-        this.onUnauthorized = onUnauthorized;
+        const { timeouts, polls } = options;
+        this.polls = polls ?? null;
         this.hby = hby;
         this.mailboxDirector = mailboxDirector;
         this.timeoutPolicy = normalizeMailboxPollingTimeoutPolicy(timeouts);
         this.http = http;
         this.clock = clock;
+        this.relay = relay;
     }
     /**
      * Register one mailbox topic that this poller should retrieve.
@@ -148,12 +142,12 @@ export class MailboxPoller {
                     shape = topics.join("|");
                     habs = self.hby.habs.size;
                     __classPrivateFieldGet(self, _MailboxPoller_dirty, "f").clear();
-                    yield* self.syncRemoteWorkers(remoteWorkers, onBatch, topics);
+                    yield* self.syncRemoteWorkers(remoteWorkers, onBatch, topics, pacing.tockMs);
                 }
                 else if (__classPrivateFieldGet(self, _MailboxPoller_dirty, "f").size) {
                     const only = new Set(__classPrivateFieldGet(self, _MailboxPoller_dirty, "f"));
                     __classPrivateFieldGet(self, _MailboxPoller_dirty, "f").clear();
-                    yield* self.syncRemoteWorkers(remoteWorkers, onBatch, topics, only);
+                    yield* self.syncRemoteWorkers(remoteWorkers, onBatch, topics, pacing.tockMs, only);
                 }
             });
         }
@@ -176,26 +170,20 @@ export class MailboxPoller {
      * @param target Mailbox subject habitat plus the actual local signer (a member for groups).
      * @param endpoint Selected remote endpoint AID and HTTP(S) URL.
      * @param onBatch Awaited consumer; successful completion precedes durable cursor advancement.
-     * @returns How the poll ended; see {@link PollOutcome}. An `unsignable` poll carries the missing public key.
+     * @returns How the poll ended; see {@link PollOutcome}.
      */
     *pollRemoteEndpointOnce(target, endpoint, onBatch) {
         const cursor = this.mailboxDirector.remoteQueryCursor(target.targetPre, endpoint.eid);
         // deno-lint-ignore no-this-alias -- Generator callbacks have no lexical this.
         const self = this;
-        // The concrete HTTP/SSE operation owns and joins this whole poll attempt. A signer the host released
-        // (while signing the query, or in the consumer's protocol work) ends the poll as `unsignable`.
-        try {
-            const outcome = yield* call(() => fetchMailboxMessages(target.signerHab, target.targetPre, endpoint.eid, endpoint.url, cursor, mailboxFetchTimeoutPolicy(this.timeoutPolicy), this.http, this.clock, function* deliverThenAdvanceCursor(message) {
-                yield* call(() => onBatch({ pre: target.targetPre, eid: endpoint.eid, messages: [message.msg] }));
-                self.mailboxDirector.updateRemoteCursor(target.targetPre, endpoint.eid, message.topic, message.idx);
-            }));
-            return { outcome };
-        }
-        catch (error) {
-            if (error instanceof SignerNotHeldError)
-                return { outcome: "unsignable", missing: error.pub };
-            throw error;
-        }
+        // The concrete HTTP/SSE operation owns and joins this whole poll attempt.
+        return yield* call(() => fetchMailboxMessages(target.signerHab, target.targetPre, endpoint.eid, endpoint.url, cursor, mailboxFetchTimeoutPolicy(this.timeoutPolicy), this.http, this.clock, function* deliverThenAdvanceCursor(message) {
+            yield* call(() => onBatch({ pre: target.targetPre, eid: endpoint.eid, messages: [message.msg] }));
+            // A subject retired during this poll keeps no cursor: its worker halts on the next tock.
+            if (!self.hby.habs.has(target.targetPre))
+                return;
+            self.mailboxDirector.updateRemoteCursor(target.targetPre, endpoint.eid, message.topic, message.idx);
+        }));
     }
     /**
      * Keep one long-lived worker running for each currently configured remote endpoint.
@@ -203,29 +191,32 @@ export class MailboxPoller {
      * @param remoteWorkers Owned worker map, mutated to match current endpoint selection.
      * @param onBatch Shared awaited consumer used independently by each endpoint worker.
      * @param topics Current registered topics; no topics means no remote workers.
+     * @param tockMs How long a worker whose signer cannot sign yet waits before it looks again.
      */
-    *syncRemoteWorkers(remoteWorkers, onBatch, topics, only) {
-        const active = new Set();
+    *syncRemoteWorkers(remoteWorkers, onBatch, topics, tockMs, only) {
+        const wanted = new Map();
         if (topics.length > 0) {
             for (const target of this.remotePollTargets(only)) {
-                for (const endpoint of mailboxPollEndpoints(target.hab)) {
-                    const workerKey = `${target.targetPre}:${endpoint.key}`;
-                    active.add(workerKey);
-                    if (remoteWorkers.has(workerKey)) {
+                for (const endpoint of mailboxPollEndpoints(target.hab, this.relay)) {
+                    if (this.deliveredOnArrival(target.targetPre, endpoint.eid))
                         continue;
-                    }
-                    const task = yield* spawn(() => this.remoteEndpointWorker(target, endpoint, onBatch));
-                    remoteWorkers.set(workerKey, task);
+                    // The signer is part of the identity: a group whose local member was replaced gets a new worker.
+                    wanted.set(`${target.targetPre}:${target.signerHab.pre}:${endpoint.key}`, { target, endpoint });
                 }
             }
         }
         for (const [workerKey, task] of [...remoteWorkers.entries()]) {
-            if (active.has(workerKey) || (only && !only.has(workerKey.slice(0, workerKey.indexOf(":"))))) {
+            if (wanted.has(workerKey) || (only && !only.has(workerKey.slice(0, workerKey.indexOf(":"))))) {
                 continue;
             }
             yield* task.halt();
             remoteWorkers.delete(workerKey);
         }
+        for (const [workerKey, { target, endpoint }] of wanted) {
+            if (remoteWorkers.has(workerKey))
+                continue;
+            remoteWorkers.set(workerKey, yield* spawn(() => this.remoteEndpointWorker(target, endpoint, onBatch, tockMs)));
+        }
     }
     /**
      * Poll one remote endpoint continuously in the long-lived runtime shape.
@@ -234,21 +225,26 @@ export class MailboxPoller {
      * `keri-ts`'s split between mailbox transport and runtime parser ownership. Each poll ends in a
      * {@link PollOutcome}; {@link nextPoll} maps it and the backoff state to the next action. A mailbox that is
      * unreachable or refuses is retried on {@link MailboxPoller.RefusalBackoff}, never in a tight loop and never
-     * by failing the runtime. A 403 also prompts the KEL publisher, which owns posting the KEL.
+     * by failing the runtime. A served poll and a 403 are pushed onto `polls` for the KEL publisher, which owns posting
+     * the KEL.
+     *
+     * A signer that cannot sign yet (a store opened without it) is not a remote failure: the worker neither polls
+     * nor backs off, and looks again each tock, so it polls within one tock of `Manager.hold`. Because it never polls
+     * for such a subject, the consumer's protocol work never runs for it either.
      *
      * @param target Mailbox subject habitat plus the actual local signer (a member for groups).
      * @param endpoint Selected remote endpoint AID and HTTP(S) URL.
      * @param onBatch Awaited consumer; successful completion precedes durable cursor advancement.
+     * @param tockMs How long the worker waits before it looks again at a signer that cannot sign.
      */
-    *remoteEndpointWorker(target, endpoint, onBatch) {
+    *remoteEndpointWorker(target, endpoint, onBatch, tockMs) {
         let state = { backoffMs: 0 };
         while (true) {
-            const { outcome, missing } = yield* this.pollRemoteEndpointOnce(target, endpoint, onBatch);
-            const source = `mailbox-poller:${target.targetPre}/${endpoint.eid}`;
-            if (missing)
-                this.signerConditions?.report(source, missing, this.clock.now());
-            else
-                this.signerConditions?.clear(source);
+            if (!target.signerHab.canSign()) {
+                yield* waitOnClock(this.clock, tockMs);
+                continue;
+            }
+            const outcome = yield* this.pollRemoteEndpointOnce(target, endpoint, onBatch);
             const step = nextPoll(state, outcome, {
                 initialMs: this.timeoutPolicy.refusalInitialMs,
                 maxMs: this.timeoutPolicy.refusalMaxMs,
@@ -256,23 +252,36 @@ export class MailboxPoller {
             state = step.state;
             switch (step.action.kind) {
                 case "poll":
-                    this.onPolled?.(target.targetPre, endpoint.eid);
+                    this.polls?.push({ kin: "polled", pre: target.targetPre, mailbox: endpoint.eid });
                     yield* runtimeTurn();
                     break;
                 case "prompt-publisher":
-                    this.onUnauthorized?.(target.targetPre, endpoint.eid);
+                    this.polls?.push({ kin: "unauthorized", pre: target.targetPre, mailbox: endpoint.eid });
                     yield* waitOnClock(this.clock, step.action.ms);
                     break;
                 case "wait":
-                    // A released signer is waited out until one is held again, not for the full backoff.
-                    if (missing && this.signerConditions)
-                        yield* this.signerConditions.waitForHold(this.clock, step.action.ms);
-                    else
-                        yield* waitOnClock(this.clock, step.action.ms);
+                    yield* waitOnClock(this.clock, step.action.ms);
                     break;
             }
         }
     }
+    /**
+     * Whether `subject`'s mail at `eid` already reached local processing when it arrived, so polling `eid` for it would
+     * process every stored message a second time. That holds when this runtime is the provider (it owns the mailbox
+     * store), `eid` is one of its own habitats and it keeps `subject`'s mail for pickup ({@link keepsForPickup}: for a
+     * local subject, a group that authorized `eid` as mailbox or agent). Such a host ingests every `/fwd` for the group
+     * on arrival (`ForwardHandler`) and dispatches every raw arrival before keeping it; the copy it stores is for the
+     * group's remote members, who poll it from here. Any other local subject at a local endpoint (a single-sig habitat
+     * whose mailbox is this host) is still polled over loopback HTTP, which is its only local delivery of stored mail.
+     * Without a mailbox store this runtime is not the provider, so it polls as any remote client would.
+     *
+     * @param subject Local mailbox subject AID.
+     * @param eid Selected provider AID.
+     * @returns True when the endpoint must not be polled for this subject.
+     */
+    deliveredOnArrival(subject, eid) {
+        return !!this.mailboxDirector.mailboxer && this.hby.habs.has(eid) && keepsForPickup(this.hby, subject, eid);
+    }
     /**
      * Select locally pollable subjects without substituting the group for its member signer.
      *
@@ -374,7 +383,6 @@ export function nextPoll(state, outcome, backoff = MailboxPoller.RefusalBackoff)
         }
         case "no-response":
         case "unreachable":
-        case "unsignable":
         case "refused":
             return backOff(state, backoff);
     }

package/esm/keri/npm/src/app/mailbox/mailboxing.js

@@ -103,15 +103,31 @@ export function authorizedMailboxes(db, pre) {
  * Both sets are polled, as in KERIpy MailboxDirector. A provider in both roles
  * shares one history and cursor, so it gets one worker. Locally controlled AIDs
  * remain eligible for HTTP polling; provider storage is never scanned directly.
+ * This lists every provider; the poller itself drops a local provider that
+ * processes the subject's mail on arrival (`MailboxPoller.deliveredOnArrival`).
  * Missing HTTP(S) locations produce no poll target until a location is available.
  *
+ * With a relay (an edge runtime) the relay is the only provider: witnesses and other mailboxes are not polled, and
+ * the relay is polled once the subject has authorized it as mailbox (for a group, the group's own row, since the
+ * relay stores the group's messages under that authorization). Until then the subject has no poll target; the
+ * runtime prompts the poller when the role is accepted.
+ *
  * @param hab Mailbox subject habitat supplying accepted roles and current witnesses.
+ * @param relay The agent this runtime polls through; null polls authorized mailboxes and witnesses.
  * @returns One HTTPS-preferred HTTP target per provider AID, with stable worker keys.
  */
-export function mailboxPollEndpoints(hab) {
-    const eids = new Set(authorizedMailboxes(hab.db, hab.pre));
-    for (const eid of hab.kever?.wits ?? [])
-        eids.add(eid);
+export function mailboxPollEndpoints(hab, relay) {
+    const eids = new Set();
+    if (relay) {
+        if (authorizedMailboxes(hab.db, hab.pre).includes(relay.aid))
+            eids.add(relay.aid);
+    }
+    else {
+        for (const eid of authorizedMailboxes(hab.db, hab.pre))
+            eids.add(eid);
+        for (const eid of hab.kever?.wits ?? [])
+            eids.add(eid);
+    }
     const endpoints = [];
     for (const eid of eids) {
         const urls = hab.fetchUrls(eid);

package/esm/keri/npm/src/app/multisig/counseling.js

@@ -80,10 +80,14 @@ export class Counselor {
      * @param clock Time source for fallback and retry; only `now` is used.
      * @param changes Optional sink told `{kind:"group", id:"<pre>:<sn>"}` after commits.
      * @param delegation Anchorer and query port for delegated events; omit for non-delegated hosts.
-     * @param mailboxes Told when one of the group's rotations completes; the member runtime's publisher then tells
-     *   the group's mailboxes the new key state, and several members doing so is harmless.
+     * @param rotated Deck that gets a record of each completed group rotation (`rot` or `drt`); the member runtime
+     *   passes its KEL publisher's, which then tells the group's mailboxes the new key state. Several members doing
+     *   so is harmless.
+     * @param groupChanges Deck that gets the prefix of a group whose establishment event completed or whose stored
+     *   members were aligned late; the member runtime shares it with its root replicator, which re-derives the
+     *   copies the group owes on its next pass instead of at its next sweep.
      */
-    constructor(hby, receipting, clock, changes, delegation, mailboxes, receiptRetry = DEFAULT_RECEIPT_RETRY, forwarding) {
+    constructor(hby, receipting, clock, changes, delegation, rotated, groupChanges, receiptRetry = DEFAULT_RECEIPT_RETRY, forwarding) {
         Object.defineProperty(this, "hby", {
             enumerable: true,
             configurable: true,
@@ -114,11 +118,17 @@ export class Counselor {
             writable: true,
             value: delegation
         });
-        Object.defineProperty(this, "mailboxes", {
+        Object.defineProperty(this, "rotated", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: mailboxes
+            value: rotated
+        });
+        Object.defineProperty(this, "groupChanges", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: groupChanges
         });
         Object.defineProperty(this, "receiptRetry", {
             enumerable: true,
@@ -151,6 +161,13 @@ export class Counselor {
             writable: true,
             value: new Map()
         });
+        /** Per local group, the latest establishment SAID its stored members were found to follow; memory only. */
+        Object.defineProperty(this, "aligned", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         Object.defineProperty(this, "anchorQuery", {
             enumerable: true,
             configurable: true,
@@ -286,8 +303,12 @@ export class Counselor {
     get holdsForwards() {
         return this.forwards.size > 0;
     }
-    /** One pass over all stages, as KERIpy `processEscrows`. */
+    /**
+     * One pass over all stages, as KERIpy `processEscrows`, after aligning stored group members with accepted state
+     * so that a completion in this pass forwards to the members of the event that completed.
+     */
     *processOnce() {
+        this.alignMembers();
         // A runtime calls this every turn; with nothing counseled, three row counts are the whole cost.
         const db = this.hby.db;
         if (db.gpse.cnt() === 0 && db.gdee.cnt() === 0 && db.gpwe.cnt() === 0 && this.forwards.size === 0)
@@ -307,23 +328,12 @@ export class Counselor {
             return;
         for (const [key, owed] of [...this.forwards]) {
             const now = this.clock.now();
-            if (now < owed.nextAt)
+            // The local member signs the forward; a group whose member cannot sign yet keeps it without spending an attempt.
+            if (now < owed.nextAt || !this.hby.habs.get(owed.event.pre)?.canSign())
                 continue;
-            let outcomes;
-            try {
-                outcomes = yield* this.forwarding.forward(owed.event, owed.members);
-            }
-            catch (error) {
-                const reason = error instanceof Error ? error.message : String(error);
-                outcomes = owed.members.map((recipient) => ({
-                    recipient,
-                    exnSaid: owed.event.said,
-                    payloadSaid: owed.event.said,
-                    outcome: "failed",
-                    deliveries: [],
-                    reason,
-                }));
-            }
+            // A member that could not be reached is its `failed` outcome; what `forward` throws is a fault (the accepted
+            // event or the local member missing from the store) and ends the loop instead of spending an attempt.
+            const outcomes = yield* this.forwarding.forward(owed.event, owed.members);
             const failed = outcomes.filter((outcome) => outcome.outcome === "failed");
             this.forwarded.set(key, [
                 ...(this.forwarded.get(key)?.filter((prior) => !outcomes.some((o) => o.recipient === prior.recipient)) ?? []),
@@ -410,6 +420,34 @@ export class Counselor {
         });
         this.changes?.push({ kind: "group", id: `${event.pre}:${event.sn}` });
     }
+    /**
+     * Bring each local group's stored members in line with its latest accepted establishment event, whoever proposed
+     * it and however late its last signature arrived (`Habery.alignGroupMembers`). A group is re-read only when that
+     * event differs from the one its members were last found to follow; one that cannot be attributed yet (a member's
+     * KEL is missing) is left as it is and read again on a later pass, which the arriving KEL's write brings about.
+     *
+     * After a change, an elected member whose latest establishment event already completed owes it again to the
+     * members it now has, and the group goes on `groupChanges` so the root replicator re-derives its copies.
+     */
+    alignMembers() {
+        const db = this.hby.db;
+        for (const pre of [...db.groups]) {
+            const est = db.getKever(pre)?.lastEst;
+            if (!est || this.aligned.get(pre) === est.d)
+                continue;
+            const alignment = this.hby.alignGroupMembers(pre);
+            if (alignment === "unattributed")
+                continue;
+            this.aligned.set(pre, est.d);
+            if (alignment === "unchanged")
+                continue;
+            this.changes?.push({ kind: "group", id: `${pre}:${est.s}` });
+            this.groupChanges?.push(pre);
+            const event = { pre, sn: est.s, said: est.d };
+            if (this.completed(pre, est.s) === est.d)
+                this.owe(event);
+        }
+    }
     /** The elected member owes the completed event to the members that did not sign it into existence. */
     owe(event) {
         if (!this.forwarding || !groupWitnesser(this.hby, event.pre, event))
@@ -418,7 +456,10 @@ export class Counselor {
         if (members.length)
             this.forwards.set(this.runKey(event), { event, members, attempts: 0, nextAt: 0 });
     }
-    /** Record completion of a counseled event and drop its row from `table`. */
+    /**
+     * Record completion of a counseled event and drop its row from `table`. A completed establishment event goes on
+     * `groupChanges`, and a completed rotation on `rotated` as well.
+     */
     finish(table, event, row) {
         const db = this.hby.db;
         db.transaction(() => {
@@ -428,9 +469,11 @@ export class Counselor {
         this.runs.delete(this.runKey(event));
         this.changes?.push({ kind: "group", id: `${event.pre}:${event.sn}` });
         this.owe(event);
-        const ilk = db.getEvtSerder(event.pre, event.said)?.ilk;
-        if (ilk === Ilks.rot || ilk === Ilks.drt) {
-            this.mailboxes?.rotated({ kin: "rotated", pre: event.pre, sn: event.sn, said: event.said });
+        const serder = db.getEvtSerder(event.pre, event.said);
+        if (serder?.estive)
+            this.groupChanges?.push(event.pre);
+        if (serder?.ilk === Ilks.rot || serder?.ilk === Ilks.drt) {
+            this.rotated?.push({ kin: "rotated", pre: event.pre, sn: event.sn, said: event.said });
         }
     }
     /** Complete events whose own witness threshold is met; otherwise submit or fetch receipts. */
@@ -460,8 +503,9 @@ export class Counselor {
             return;
         const submit = forceSubmit || groupWitnesser(this.hby, event.pre, event) || now - run.since >= run.fallbackAfterMs;
         try {
+            // Group receipting reaches TCP-only witnesses, as `WitnessReceiptor` and KERIpy's Counselor do.
             if (submit)
-                yield* this.receipting.receipt(event.pre, { sn: event.sn, auths: run.auths });
+                yield* this.receipting.receipt(event.pre, { sn: event.sn, auths: run.auths, allowTcp: true });
             else
                 yield* this.receipting.get(event.pre, { sn: event.sn, said: event.said });
             run.failure = null;

package/esm/keri/npm/src/app/multisig/group-members.js

@@ -1,17 +1,25 @@
 import { TransIdxSigGroup } from "../../core/dispatch.js";
-import { ValidationError } from "../../core/errors.js";
+import { MissingDurableStateError, ValidationError } from "../../core/errors.js";
 import { Kever } from "../../core/kel/kever.js";
 import { dgKey } from "../../db/core/keys.js";
 /** True when the selected habitat is a local group habitat. */
 export function isLocalGroupHab(hby, hab) {
     return !!hab.pre && !!hby.db.getHab(hab.pre)?.mid;
 }
-/** Return the local member habitat for a persisted group identifier. */
+/**
+ * Return the local member habitat for a persisted group identifier.
+ *
+ * @throws ValidationError when `groupPre` is not a local group (no habitat record names a local member).
+ * @throws MissingDurableStateError when the group's record names a local member the store does not hold: the
+ * store is damaged, which no remote message can cause (retirement refuses a local group's member).
+ */
 export function localGroupMember(hby, groupPre) {
-    const record = hby.db.getHab(groupPre);
-    const member = record?.mid ? hby.habs.get(record.mid) : null;
+    const mid = hby.db.getHab(groupPre)?.mid;
+    if (!mid)
+        throw new ValidationError(`${groupPre} is not a local group.`);
+    const member = hby.habs.get(mid);
     if (!member) {
-        throw new ValidationError(`Group ${groupPre} is missing local member metadata.`);
+        throw new MissingDurableStateError(`Group ${groupPre} names local member ${mid}, which this store does not hold.`);
     }
     return member;
 }
@@ -172,6 +180,34 @@ export function localIpexContribution(db, member, embedded, proofs) {
     }
     return null;
 }
+/**
+ * Whether the group signatures a member received on the group-authored message `embedded`, from every copy it holds,
+ * together satisfy the threshold of the accepted group establishment event they name. Only signatures that verify
+ * against that event count, and copies naming different events are not pooled, so a message below the threshold, or
+ * one signed under keys this store has not accepted, reads false.
+ *
+ * This is the rule under which a member takes a group message it did not sign: accepting what already carries the
+ * group's threshold adds no signature, so it is not consent.
+ */
+export function groupThresholdSigned(db, embedded, proofs) {
+    const signed = new Map();
+    for (const proof of proofs) {
+        if (!embedded.pre || proof.pre !== embedded.pre || proof.sn > BigInt(Number.MAX_SAFE_INTEGER))
+            continue;
+        const said = db.kels.getLast(proof.pre, Number(proof.sn));
+        const event = said && said === proof.said ? db.getEvtSerder(proof.pre, said) : null;
+        if (!said || !event?.estive || !event.tholder)
+            continue;
+        const indices = signed.get(said) ?? new Set();
+        for (const index of Kever.verifyIndexedSignatures(embedded.raw, proof.sigers, event.verfers).indices) {
+            indices.add(index);
+        }
+        signed.set(said, indices);
+        if (event.tholder.satisfy([...indices]))
+            return true;
+    }
+    return false;
+}
 /**
  * Derive the members of `group`'s latest accepted establishment event from
  * local KELs, as KERIpy `GroupHab.acceptedMembers`.

package/esm/keri/npm/src/app/multisig/grouping.js

@@ -14,11 +14,14 @@ import { exchange, isIpexVerb, isV2RegistryRoute, multisigChildField, nestedIpex
 import { Kevery } from "../../core/kel/eventing.js";
 import { Kever } from "../../core/kel/kever.js";
 import { BasicReplyRouteHandler, Revery, Router } from "../../core/routing.js";
+import { loadNests } from "../../db/exchange/exchange-nests.js";
 import { Exchanger } from "../exchanges/exchanging.js";
+import { isIssuanceOrigin } from "../ipex/ipex-node-authentication.js";
 import { IpexV2Handler } from "../ipex/ipex-v2.js";
+import { IPEX_GRANT_ROUTE } from "../ipex/ipexing.js";
 import { dispatchEnvelope, envelopeFromFrame } from "../protocol/parsering.js";
 import { abortable, rethrowCleanupFailure } from "../runtime/abortable.js";
-import { groupSigningMembers, isLocalGroupHab, localIpexContribution } from "./group-members.js";
+import { groupSigningMembers, groupThresholdSigned, isLocalGroupHab, localIpexContribution } from "./group-members.js";
 import { multisigEmbeddedSection, multisigPayloadSaid } from "./multisig-messaging.js";
 /** KERIpy multisig route constants. */
 export const MULTISIG_ICP_ROUTE = "/multisig/icp";
@@ -529,7 +532,10 @@ export class Multiplexor {
             && handler instanceof IpexV2Handler && handler.hby === this.hby
             && handler.registry === this.registry.store;
     }
-    /** Index an authenticated proposal; child acceptance still requires local approval and its own proofs. */
+    /**
+     * Index an authenticated proposal. Its child is accepted, with its own proofs, after local approval, or without one
+     * when the signatures received for it already complete it (see {@link alreadyComplete} and {@link groupIpexFollowable}).
+     */
     *add(serder, nests = []) {
         const inspection = this.inspect(serder, nests);
         if (!inspection.ok) {
@@ -588,6 +594,14 @@ export class Multiplexor {
                 else
                     yield* this.processApproved(nests);
             }
+            else if (v2Ipex && groupIpexFollowable(this.hby, this.receivedCopies(nests, existing))) {
+                // The same holds for a group IPEX message: once the copies received for it sign it to the group's threshold,
+                // this member takes it on receipt without signing, so every member holds what the group completed before the
+                // counterparty can answer in its thread. Earlier copies go first so that their signatures join this one's; a
+                // message already accepted here only gains this copy's. What cannot be taken yet (an answer whose prior has
+                // not arrived) the group IPEX owner takes on a later pass.
+                yield* this.processApproved(this.exchanger.complete(embeddedSaid) ? nests : this.receivedCopies(nests, existing).reverse());
+            }
             else if (serder.pvrsn.major === 2 || firstSubmission) {
                 // Legacy approval polling consumes its first notice; repeated v1 notices would re-propose it.
                 this.notifier?.add(firstSubmission ? { r: route, d: said } : { r: route, d: said, e: embeddedSaid });
@@ -660,6 +674,14 @@ export class Multiplexor {
         return event.ilk === "ixn"
             && kever.tholder.satisfy(Kever.verifyIndexedSignatures(event.raw, envelope.sigers, kever.verfers).indices);
     }
+    /** This wrapper's child first, then the children of the accepted wrappers already indexed for the same message. */
+    receivedCopies(nests, existing) {
+        const said = nests[0]?.body.said;
+        return [
+            ...nests.slice(0, 1),
+            ...existing.map((prior) => loadNests(this.hby.db, prior.qb64)[0]).filter((copy) => !!said && copy?.body.said === said),
+        ];
+    }
     /** Whether a rotation proposal names exactly the group's current signing members and rotation members. */
     namesCurrentMembers(attrs) {
         const group = typeof attrs.gid === "string" ? attrs.gid : "";
@@ -925,6 +947,32 @@ export class Multiplexor {
         return pre.length > 0 && this.hby.habs.has(pre);
     }
 }
+/**
+ * Whether a member takes, without consent, the v2 group IPEX message that `copies` carry: the children of the stored
+ * `/multisig/exn` wrappers it received for that message, the first naming it. It does when the message belongs to a
+ * local group, the copies sign it to the group's threshold ({@link groupThresholdSigned}), the exchange it answers
+ * (if any) is accepted here, and it is not a group issuer's DH Grant, which the issuance owner follows instead.
+ * Accepting such a message adds no signature, so it is not consent; one below the threshold waits for approval.
+ *
+ * KERIpy's `Multiplexor.add` replays a child only after local approval, so a KERIpy member that did not sign holds
+ * only the proposal. keri-ts delivers to, and completes at, every member regardless of weight.
+ */
+export function groupIpexFollowable(hby, copies) {
+    const first = copies[0], embedded = first?.body;
+    if (!(embedded instanceof SerderKERI) || embedded.pvrsn.major !== 2 || !embedded.pre || !embedded.said
+        || !embedded.route?.startsWith("/ipex/"))
+        return false;
+    const hab = hby.habs.get(embedded.pre);
+    if (!hab || !isLocalGroupHab(hby, hab))
+        return false;
+    if (embedded.route === IPEX_GRANT_ROUTE && isIssuanceOrigin(embedded.pre, first.nests?.[0]))
+        return false;
+    const prior = embedded.sad?.p;
+    if (typeof prior === "string" && prior.length > 0 && !hby.db.exns.get([prior]))
+        return false;
+    const proofs = copies.filter((copy) => copy.body.said === embedded.said).flatMap((copy) => envelopeFromFrame(copy).tsgs);
+    return groupThresholdSigned(hby.db, embedded, proofs);
+}
 /** Extract the embedded business EXN SAD from a `/multisig/exn` wrapper. */
 export function embeddedBusinessExnSAD(serder) {
     const embed = serder.ked ? multisigEmbeddedSection(serder.ked) : null;