keri-ts 2.2.4 → 2.2.5

package/types/app/multisig/rejoin-group.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Rebuild a lost group habitat record from the group's accepted key state.
+ *
+ * A host can lose its store while its member identifier survives: the member is re-adopted at open
+ * (`Habery.makeSignedHab` for a signer held outside the store), but the record of the group it belongs to
+ * is gone. The group's KEL is still held by a co-member and reachable by OOBI. `rejoinGroup` resolves that
+ * OOBI, waits until the group's key state is accepted locally, reads the signing and rotation members of the
+ * group's latest accepted establishment event (`acceptedGroupMembers`, KERIpy `GroupHab.acceptedMembers`),
+ * and records the group with `Habery.joinGroupHab`.
+ *
+ * Boundaries:
+ * - Membership is decided by accepted key state only, never by caller-supplied member lists, and only by
+ *   the member lists: a member whose signing weight is 0 is a member like any other.
+ * - The group's key state names keys, not identifiers. Attributing each key to a member needs every
+ *   member's KEL to be local, and a group OOBI carries the group's KEL only. A caller resolves the other
+ *   members' OOBIs first (or the wait ends `timed-out` with `waiting: "member-key-state"`).
+ * - Remote outcomes are returned (`RejoinResult`); only programmer misuse throws. A result other than
+ *   `joined` writes no habitat record; key state the OOBI taught stays, as for any resolution.
+ * - Only the record is rebuilt. Credentials, registry state and exchanges the store held come back by
+ *   replay from a co-member (`listGroupDisclosures`, `exportDisclosureStream`, `importCredentialStream`); this call
+ *   does not request it. `written: true` on the result says such a refill is due.
+ * - Dependencies are declared collaborators (ADR-0013); an `AgentRuntime` fits.
+ */
+import type { Operation } from "effection";
+import type { Oobiery } from "../bootstrap/oobiery.js";
+import type { RootReplicator } from "../credentials/root-replicator.js";
+import type { Hab, Habery } from "../identity/habbing.js";
+import type { KelPublisher } from "../mailbox/kel-publisher.js";
+import type { MailboxPoller } from "../mailbox/mailbox-poller.js";
+import type { RuntimeClock } from "../runtime/runtime-clock.js";
+import { type ChangeSink } from "../runtime/workflow-contract.js";
+/** Collaborators of {@link rejoinGroup}. */
+export interface RejoinDeps {
+    /** The Habery that holds `member`; the group record is written here. */
+    readonly hby: Habery;
+    /** Durable OOBI job owner; only its queueing entry is used. Something must be running it. */
+    readonly oobiery: Pick<Oobiery, "resolve">;
+    /** The runtime clock that bounds the wait. */
+    readonly clock: Pick<RuntimeClock, "now">;
+    /** Prompted for the group after a join, so the poller selects the group's mailboxes on its next tock. */
+    readonly mailboxPoller: Pick<MailboxPoller, "prompt">;
+    /** Prompted for the group after a join, so the group's KEL is posted to its mailboxes on the next tock. */
+    readonly kelPublisher: Pick<KelPublisher, "prompt">;
+    /** Prompted for the group after a join, or null for a runtime without one. */
+    readonly rootReplicator: Pick<RootReplicator, "prompt"> | null;
+    /** Told `{kind:"oobi"}` when the OOBI is queued and `{kind:"group"}` after a join. */
+    readonly changes?: ChangeSink;
+}
+/** What {@link rejoinGroup} needs. */
+export interface RejoinInput {
+    /** OOBI of the group, served by a co-member that holds its KEL. */
+    oobi: string;
+    /** Group prefix. */
+    group: string;
+    /** The Habery's single-signature habitat that is a member in the group's accepted key state. */
+    member: Hab;
+    /** Local alias the group record takes. */
+    alias: string;
+    /** Wait budget on `deps.clock`, from queueing the OOBI to the member lists being readable. */
+    timeoutMs: number;
+    /** Namespace of the alias; the default namespace when absent. */
+    domain?: string;
+}
+/** What a `timed-out` rejoin was still waiting for. */
+export type RejoinWait = 
+/** The OOBI had not reached a terminal state. */
+"oobi"
+/** The OOBI is done but the group has no accepted key state here (for example, an event is in escrow). */
+ | "group-key-state"
+/** The member is in the group's accepted key state, but not every key of it can be attributed to a local KEL. */
+ | "member-key-state";
+/**
+ * Outcome of {@link rejoinGroup}:
+ * - `joined`: the record names `member`; `smids` and `rmids` are the accepted members recorded (on a repeat,
+ *   the members already recorded). `written` is true when this call wrote the record and false when it found the
+ *   record already there. A written record means this identifier was already a member and this store had no record
+ *   of the group, so the store holds none of the group's credentials either: the embedder's signal to refill them
+ *   from a co-member.
+ * - `not-member`: `member` is in neither the signing nor the rotation members of the accepted state.
+ * - `oobi-failed`: the OOBI failed and the group has no accepted key state here; `reason` is the Oobiery's.
+ * - `timed-out`: the budget expired; `waiting` says on what.
+ *
+ * Only `joined` writes a habitat record.
+ */
+export type RejoinResult = {
+    outcome: "joined";
+    group: string;
+    alias: string;
+    smids: readonly string[];
+    rmids: readonly string[];
+    written: boolean;
+} | {
+    outcome: "not-member";
+    group: string;
+    member: string;
+} | {
+    outcome: "oobi-failed";
+    group: string;
+    reason: string;
+} | {
+    outcome: "timed-out";
+    group: string;
+    timeoutMs: number;
+    waiting: RejoinWait;
+};
+/**
+ * Resolve `input.oobi`, wait for the group's accepted key state, and record the group with `input.member` as
+ * its local member, using the accepted members. Then the mailbox poller, the KEL publisher and the root
+ * replicator are prompted for the group, so each acts for it on its next tock. Creates no event and signs
+ * nothing. Observe-only: the host must already run the runtime's workers (see `workflow-contract.ts`).
+ *
+ * A record that already names `member` returns `joined` at once with `written: false`, with no OOBI and no write.
+ *
+ * @throws ValidationError for misuse: `member` is not a local single-signature habitat, `group` is a local
+ * single-signature habitat, the group already has a local record naming a different member (use
+ * `replaceGroupMember`), or `alias` is bound to another prefix.
+ */
+export declare function rejoinGroup(deps: RejoinDeps, input: RejoinInput): Operation<RejoinResult>;
+//# sourceMappingURL=rejoin-group.d.ts.map

package/types/app/multisig/rejoin-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rejoin-group.d.ts","sourceRoot":"","sources":["../../../src/app/multisig/rejoin-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAI3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,iCAAiC,CAAC;AAGhF,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3C,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1C,yGAAyG;IACzG,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACtD,2GAA2G;IAC3G,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC/D,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;CAC/B;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,MAAM,EAAE,GAAG,CAAC;IACZ,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,uDAAuD;AACvD,MAAM,MAAM,UAAU;AACpB,iDAAiD;AAC/C,MAAM;AACR,0GAA0G;GACxG,iBAAiB;AACnB,iHAAiH;GAC/G,kBAAkB,CAAC;AAEvB;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,YAAY,GACpB;IACA,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB,GACC;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AASpF;;;;;;;;;;;GAWG;AACH,wBAAiB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CA0B1F"}

package/types/app/multisig/replace-member.d.ts

@@ -1,4 +1,5 @@
 import type { Hab } from "../identity/habbing.js";
+import { type RetiredIdentifier } from "../identity/retire-identifier.js";
 import type { AgentRuntime } from "../runtime/agent-runtime.js";
 /** What {@link replaceGroupMember} needs. */
 export interface ReplaceGroupMemberInput {
@@ -10,7 +11,17 @@ export interface ReplaceGroupMemberInput {
     smids: readonly string[];
     /** The group's accepted rotation members; defaults to `smids`. */
     rmids?: readonly string[];
+    /** Keep the previous member as a local identifier instead of retiring it. Default false. */
+    keepPrevious?: boolean;
 }
+/** What became of the previous member: retired, or kept as a local identifier with the reason. */
+export type PreviousMemberOutcome = {
+    kind: "retired";
+    retired: RetiredIdentifier;
+} | {
+    kind: "kept";
+    reason: string;
+};
 /** What {@link replaceGroupMember} did. */
 export interface ReplacedGroupMember {
     /** The member the record named before. */
@@ -19,9 +30,12 @@ export interface ReplacedGroupMember {
     issuance: string[];
     /** Grants of the Unblind operations ended. */
     unblinding: string[];
+    /** Whether the previous member was retired, and why not when it was kept. */
+    previousMember: PreviousMemberOutcome;
 }
 /**
- * Replace the local member of `input.group`, then end live operations bound to the previous one.
+ * Replace the local member of `input.group`, end live operations bound to the previous one, then retire the
+ * previous one unless it is kept (see the module doc).
  *
  * @throws ValidationError when `joinGroupHab` refuses: the group has no accepted state, the previous member is
  * still a member of it, or the new one is not.

package/types/app/multisig/replace-member.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-member.d.ts","sourceRoot":"","sources":["../../../src/app/multisig/replace-member.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,6CAA6C;AAC7C,MAAM,WAAW,uBAAuB;IACtC,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,4GAA4G;IAC5G,MAAM,EAAE,GAAG,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,GAAG,mBAAmB,CAc7G"}
+{"version":3,"file":"replace-member.d.ts","sourceRoot":"","sources":["../../../src/app/multisig/replace-member.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,iBAAiB,EAA6C,MAAM,kCAAkC,CAAC;AACrH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,6CAA6C;AAC7C,MAAM,WAAW,uBAAuB;IACtC,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,4GAA4G;IAC5G,MAAM,EAAE,GAAG,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,kEAAkE;IAClE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,kGAAkG;AAClG,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6EAA6E;IAC7E,cAAc,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,GAAG,mBAAmB,CAe7G"}

package/types/app/protocol/parsering.d.ts

@@ -32,6 +32,8 @@ export interface ExchangerLike {
         mailboxAid?: string | null;
         /** Receiver-observed time supplied by local intake, independent of signed wire. */
         receiverTime?: string;
+        /** Retained history from a finite local import, admitted without KRAM (`DispatchOptions.retained`). */
+        retained?: boolean;
     }): Operation<void | ExchangeDecision>;
 }
 export interface TelDispatchArgs {
@@ -120,13 +122,30 @@ export interface DispatchResult {
  * @param messageKevery Authoritative shared message-policy/KRAM processor when distinct from input Kevery.
  * @param registry V2 registry intake over accepted public KEL state, without requiring a local alias.
  * @param qvy Optional auxiliary query owner; receives full evidence after v2 message admission.
+ * @param retained Whether this is retained history from a finite local import (`DispatchOptions.retained`): a v2
+ *   `exn`/`xip` then skips KRAM intake and reaches the Exchanger marked retained. Network intake never sets it.
  * @returns The processed envelope and protocol-specific decision data.
  * @throws Unsupported input and infrastructure/handler failures follow their owning processor contracts.
  */
 export declare function dispatchEnvelope(envelope: KeriDispatchEnvelope, revery: Revery, kevery: Kevery, exchanger?: ExchangerLike, tevery?: Tevery, verifier?: Verifier, mailboxAid?: string | null, 
 /** Long-lived v2 message policy/KRAM owner; input-specific Kevery handles KEL and legacy traffic. */
-messageKevery?: Kevery, registry?: RegistryObserver, qvy?: AuxiliaryQueryProcessor): Operation<DispatchResult>;
-/** Project one complete frame for message routing without an intermediate event array. */
+messageKevery?: Kevery, registry?: RegistryObserver, qvy?: AuxiliaryQueryProcessor, retained?: boolean): Operation<DispatchResult>;
+/**
+ * Whether a frame carries nested messages that no completed consumer owns.
+ *
+ * Only supported exchange routes, IPEX disclosure `xip`s and the v2 Unblind query retain parent-owned children; any
+ * other frame with children is unsupported input. A remote frame is refused as one invalid message
+ * (`ProtocolProcessor.dispatch`); {@link envelopeFromFrame} refuses it with a `ValidationError`.
+ */
+export declare function hasUnsupportedNests(message: CesrFrame): boolean;
+/**
+ * Project one complete frame for message routing without an intermediate event array.
+ *
+ * Only completed consumers may retain parent-owned children through normalization. A frame with children no consumer
+ * owns is usually a remote child nested inside a parent (a BUP inside an Unblind query, an event inside a multisig or
+ * IPEX exchange): it is refused with a `ValidationError`, which the parent's processor reports as its own typed
+ * refusal (an invalid-message drop, a rejected escrow row), never a fault that ends the runtime.
+ */
 export declare function envelopeFromFrame(message: CesrFrame, local?: boolean): KeriDispatchEnvelope;
 /** Own an auxiliary query's normalized full proof and public nested evidence beyond synchronous intake. */
 export declare function copyAuxiliaryQuery(envelope: KeriDispatchEnvelope): KeriDispatchEnvelope;

package/types/app/protocol/parsering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsering.d.ts","sourceRoot":"","sources":["../../../src/app/protocol/parsering.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,UAAU,EACV,UAAU,EACV,KAAK,SAAS,EACd,KAAK,EAKL,SAAS,EAUT,QAAQ,EAER,SAAS,EACT,QAAQ,EACR,UAAU,EACV,UAAU,EACV,UAAU,EACV,KAAK,EAEL,MAAM,EACN,SAAS,EAGT,KAAK,UAAU,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,YAAY,CAAC,IAAI,EAAE;QACjB,MAAM,EAAE,UAAU,CAAC;QACnB,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACzB,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,IAAI,EAAE,mBAAmB,EAAE,CAAC;QAC5B,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,6EAA6E;QAC7E,cAAc,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;QACrC,8EAA8E;QAC9E,IAAI,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;QACvC,uCAAuC;QACvC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,+DAA+D;QAC/D,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAC7B,qFAAqF;QACrF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,mFAAmF;QACnF,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAC9B,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAC7B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC5B,gFAAgF;IAChF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EACF,cAAc,GACd,kBAAkB,GAClB,uBAAuB,GACvB,kBAAkB,GAClB,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,gBAAgB,CAAC;IACrB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gGAAgG;AAChG,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,kBAAkB,GAClB,gBAAgB,GAChB,wBAAwB,GACxB,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,WAAW,GACX,IAAI,CAAC;AAET;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IACrC,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,gBAAgB,CAAC;CAChE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,KAAK,UAAQ,GACZ,oBAAoB,EAAE,CAExB;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAiB,gBAAgB,CAC/B,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,aAAa,EACzB,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;AAC1B,qGAAqG;AACrG,aAAa,GAAE,MAAe,EAC9B,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,GAAG,CAAC,EAAE,uBAAuB,GAC5B,SAAS,CAAC,cAAc,CAAC,CA+F3B;AAoVD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,EAClB,KAAK,UAAQ,GACZ,oBAAoB,CA2BtB;AAED,2GAA2G;AAC3G,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,oBAAoB,CA0CvF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,GAAE,SAAS,UAAU,EAAO,GAAG,UAAU,CAenH;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,UAAQ,GAAG,oBAAoB,CAM3F;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,oBAAoB,GAC7B,aAAa,CAaf"}
+{"version":3,"file":"parsering.d.ts","sourceRoot":"","sources":["../../../src/app/protocol/parsering.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,UAAU,EACV,UAAU,EACV,KAAK,SAAS,EACd,KAAK,EAKL,SAAS,EAUT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,UAAU,EACV,UAAU,EACV,UAAU,EACV,KAAK,EAEL,MAAM,EACN,SAAS,EAGT,KAAK,UAAU,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,yFAAyF;IACzF,YAAY,CAAC,IAAI,EAAE;QACjB,MAAM,EAAE,UAAU,CAAC;QACnB,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACzB,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,IAAI,EAAE,mBAAmB,EAAE,CAAC;QAC5B,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,6EAA6E;QAC7E,cAAc,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;QACrC,8EAA8E;QAC9E,IAAI,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;QACvC,uCAAuC;QACvC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,+DAA+D;QAC/D,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAC7B,qFAAqF;QACrF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,mFAAmF;QACnF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,uGAAuG;QACvG,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAC9B,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAC7B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC5B,gFAAgF;IAChF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EACF,cAAc,GACd,kBAAkB,GAClB,uBAAuB,GACvB,kBAAkB,GAClB,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,gBAAgB,CAAC;IACrB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gGAAgG;AAChG,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,kBAAkB,GAClB,gBAAgB,GAChB,wBAAwB,GACxB,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,WAAW,GACX,IAAI,CAAC;AAET;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IACrC,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,gBAAgB,CAAC;CAChE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,KAAK,UAAQ,GACZ,oBAAoB,EAAE,CAExB;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAiB,gBAAgB,CAC/B,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,aAAa,EACzB,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;AAC1B,qGAAqG;AACrG,aAAa,GAAE,MAAe,EAC9B,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,GAAG,CAAC,EAAE,uBAAuB,EAC7B,QAAQ,UAAQ,GACf,SAAS,CAAC,cAAc,CAAC,CA+F3B;AA6VD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAQ/D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,EAClB,KAAK,UAAQ,GACZ,oBAAoB,CAqBtB;AAED,2GAA2G;AAC3G,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,oBAAoB,CA0CvF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,GAAE,SAAS,UAAU,EAAO,GAAG,UAAU,CAenH;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,UAAQ,GAAG,oBAAoB,CAM3F;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,oBAAoB,GAC7B,aAAa,CAcf"}

package/types/app/protocol/protocol-processing.d.ts

@@ -19,8 +19,8 @@ import { type AuxiliaryQueryProcessor, type DispatchResult } from "./parsering.j
  * which runs one full pass per cycle. A pass is never skipped or shortened; this is the time others get between passes.
  */
 export declare const ESCROW_TOCK_MS = 31.25;
-/** Protocol choices for a frame; input owners separately own cancellation and parsing. */
-export interface DispatchOptions {
+/** Protocol choices any input may make for a frame; input owners separately own cancellation and parsing. */
+export interface IntakeOptions {
     /** Whether the frame arrived through local witness/controller intake. */
     local?: boolean;
     /** Hosted mailbox endpoint provenance, independent of the signed sender. */
@@ -28,6 +28,19 @@ export interface DispatchOptions {
     /** Advance durable escrows after capturing this frame's decision and direct replies. */
     escrows?: boolean;
 }
+/** Intake choices plus `retained`, which only a finite, caller-initiated local import sets. */
+export interface DispatchOptions extends IntakeOptions {
+    /**
+     * The frame is retained history the caller already holds, read back from a store (an exported disclosure stream),
+     * not a message arriving now. A v2 `exn`/`xip` then skips KRAM intake: its original stamp is long past the
+     * receiver's window by design, and KRAM's replay protection guards live intake, not a local copy of accepted
+     * history. Nothing else is relaxed: sender policy still applies, the Exchanger still authenticates every signature
+     * against the sender's key state and runs the route's verify, escrows behave as usual, and queries and replies
+     * still pass KRAM. The Exchanger keeps the fact (see `ExchangeInput.retained`). Network inputs (HTTP, TCP, mailbox,
+     * witness ingress, the Reactor) take {@link IntakeOptions}, which cannot carry it.
+     */
+    retained?: boolean;
+}
 /** Exact processed evidence and mailbox authorization captured at the query decision. */
 export interface ProtocolDispatchResult extends DispatchResult {
     /** Current request authorization, never inferred solely from a matching reply SAID. */
@@ -62,6 +75,8 @@ export declare class ProtocolProcessor {
     /** Shared live request correlations; each requesting connection owns its slots. */
     readonly replies: QueryReplies;
     readonly qvy?: AuxiliaryQueryProcessor | undefined;
+    /** Relaying host: served senders' queries about remote subjects refresh this host's own view of them. */
+    readonly relaying: boolean;
     /**
      * Bind long-lived semantic owners and register their reply routes exactly once.
      *
@@ -75,6 +90,8 @@ export declare class ProtocolProcessor {
      * @param cues Application output Deck consumed by the composed cue router.
      * @param replies Shared live request correlations captured before application publication.
      * @param qvy Optional caller-owned auxiliary query receiver; owns its authorization and lifecycle.
+     * @param relaying Whether this domain is a relaying host's (the agent side of relay mode): a served sender's query
+     *   about a remote subject then also publishes the host's own refresh query cue (see `relayRefreshCue`).
      * @throws TypeError for inconsistent stores or cue bindings.
      */
     constructor(
@@ -95,7 +112,9 @@ export declare class ProtocolProcessor {
     /** Ordinary application cues; the composed cue router is the consumer. */
     cues: Deck<AgentCue>, 
     /** Shared live request correlations; each requesting connection owns its slots. */
-    replies: QueryReplies, qvy?: AuxiliaryQueryProcessor | undefined);
+    replies: QueryReplies, qvy?: AuxiliaryQueryProcessor | undefined, 
+    /** Relaying host: served senders' queries about remote subjects refresh this host's own view of them. */
+    relaying?: boolean);
     /**
      * Construct an input-owned Kevery with identical store, policy and cue bindings; register no routes.
      *
@@ -106,14 +125,15 @@ export declare class ProtocolProcessor {
      * Process one frame and publish its committed protocol cues before returning decision data.
      *
      * @param frame Complete hydrated frame whose evidence remains valid for this operation.
-     * @param options Local intake policy, hosted mailbox provenance and whether to advance escrows.
+     * @param options Local intake policy, hosted mailbox provenance, whether to advance escrows, and whether the frame is
+     *   retained history from a finite local import.
      * @param kvy Input-specific Kevery in this domain; defaults to the shared owner.
      * @returns Exact dispatch result and current mailbox authorization at its synchronous query decision.
      *   A message refused by validation after extraction is an `invalidMessage` drop, so the caller
      *   continues with the next frame as KERIpy's parser does.
      * @throws Domain mismatch, infrastructure/handler or cleanup errors propagate; publication still runs in the dispatch finalizer.
      */
-    dispatch(frame: CesrFrame, { local, mailboxAid, escrows }?: DispatchOptions, kvy?: Kevery): Operation<ProtocolDispatchResult>;
+    dispatch(frame: CesrFrame, { local, mailboxAid, escrows, retained }?: DispatchOptions, kvy?: Kevery): Operation<ProtocolDispatchResult>;
     /** Capture direct replies before handing ordinary protocol records to the application consumer. */
     private publishCues;
     /** Advance configured escrow owners; each scan joins its own I/O and handler cleanup. */

package/types/app/protocol/protocol-processing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol-processing.d.ts","sourceRoot":"","sources":["../../../src/app/protocol/protocol-processing.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,OAAO,EAA0B,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,KAAK,UAAU,EAAmC,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,cAAc,EAGpB,MAAM,gBAAgB,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAQ,CAAC;AAEpC,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,yFAAyF;AACzF,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,uFAAuF;IACvF,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAcD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAiB1B,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,wFAAwF;IACxF,QAAQ,CAAC,GAAG,EAAE,SAAS;IACvB,uFAAuF;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAC1C,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,YAAY;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB;IAlCxC;;;;;;;;;;;;;;OAcG;;IAED,0FAA0F;IACjF,GAAG,EAAE,MAAM;IACpB,kFAAkF;IACzE,GAAG,EAAE,MAAM;IACpB,wFAAwF;IAC/E,GAAG,EAAE,SAAS;IACvB,uFAAuF;IAC9E,GAAG,EAAE,MAAM,GAAG,IAAI;IAC3B,sEAAsE;IAC7D,GAAG,EAAE,QAAQ,GAAG,IAAI;IAC7B,6EAA6E;IACpE,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAC1C,sFAAsF;IACrE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC;IAC7C,0EAA0E;IACjE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;IAC7B,mFAAmF;IAC1E,OAAO,EAAE,YAAY,EACrB,GAAG,CAAC,EAAE,uBAAuB,YAAA;IAaxC;;;;OAIG;IACH,UAAU,IAAI,MAAM;IAWpB;;;;;;;;;;OAUG;IACH,QAAQ,CACN,KAAK,EAAE,SAAS,EAChB,EAAE,KAAsB,EAAE,UAAU,EAAE,OAAe,EAAE,GAAE,eAAoB,EAC7E,GAAG,GAAE,MAAiB,GACrB,SAAS,CAAC,sBAAsB,CAAC;IAgDpC,mGAAmG;IACnG,OAAO,CAAC,WAAW;IASnB,yFAAyF;IACxF,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC;IAQtC;;;;;;OAMG;IACH,0BAA0B,IAAI,IAAI;IAQlC,0FAA0F;IAC1F,OAAO,CAAC,sBAAsB;IAK9B,qFAAqF;IACrF,OAAO,CAAE,cAAc;IAUvB;;;;;;;;;;OAUG;IACF,QAAQ,CAAC,KAAK,GAAE,YAA0B,EAAE,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAmB,GAAG,SAAS,CAAC,KAAK,CAAC;CAW/G;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAMtE"}
+{"version":3,"file":"protocol-processing.d.ts","sourceRoot":"","sources":["../../../src/app/protocol/protocol-processing.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAG1C,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,OAAO,EAA0B,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,KAAK,UAAU,EAAmC,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,cAAc,EAIpB,MAAM,gBAAgB,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAQ,CAAC;AAEpC,6GAA6G;AAC7G,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yFAAyF;AACzF,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,uFAAuF;IACvF,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAkCD;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAmB1B,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,wFAAwF;IACxF,QAAQ,CAAC,GAAG,EAAE,SAAS;IACvB,uFAAuF;IACvF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAC1C,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,YAAY;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB;IACtC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,OAAO;IAtC5B;;;;;;;;;;;;;;;;OAgBG;;IAED,0FAA0F;IACjF,GAAG,EAAE,MAAM;IACpB,kFAAkF;IACzE,GAAG,EAAE,MAAM;IACpB,wFAAwF;IAC/E,GAAG,EAAE,SAAS;IACvB,uFAAuF;IAC9E,GAAG,EAAE,MAAM,GAAG,IAAI;IAC3B,sEAAsE;IAC7D,GAAG,EAAE,QAAQ,GAAG,IAAI;IAC7B,6EAA6E;IACpE,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAC1C,sFAAsF;IACrE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC;IAC7C,0EAA0E;IACjE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;IAC7B,mFAAmF;IAC1E,OAAO,EAAE,YAAY,EACrB,GAAG,CAAC,EAAE,uBAAuB,YAAA;IACtC,yGAAyG;IAChG,QAAQ,GAAE,OAAe;IAapC;;;;OAIG;IACH,UAAU,IAAI,MAAM;IAWpB;;;;;;;;;;;OAWG;IACH,QAAQ,CACN,KAAK,EAAE,SAAS,EAChB,EAAE,KAAsB,EAAE,UAAU,EAAE,OAAe,EAAE,QAAgB,EAAE,GAAE,eAAoB,EAC/F,GAAG,GAAE,MAAiB,GACrB,SAAS,CAAC,sBAAsB,CAAC;IAiDpC,mGAAmG;IACnG,OAAO,CAAC,WAAW;IAKnB,yFAAyF;IACxF,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC;IAQtC;;;;;;OAMG;IACH,0BAA0B,IAAI,IAAI;IAQlC,0FAA0F;IAC1F,OAAO,CAAC,sBAAsB;IAK9B,qFAAqF;IACrF,OAAO,CAAE,cAAc;IAUvB;;;;;;;;;;OAUG;IACF,QAAQ,CAAC,KAAK,GAAE,YAA0B,EAAE,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAmB,GAAG,SAAS,CAAC,KAAK,CAAC;CAW/G;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAMtE"}

package/types/app/queries/query-replies.d.ts

@@ -10,15 +10,11 @@ interface QueryReplyBatch {
      */
     readonly cues: readonly DirectReply[];
 }
-/** A request correlation slot; close it when its HTTP/TCP request completes or is cancelled. */
+/**
+ * A request correlation slot; close it when its HTTP/TCP request completes or is cancelled.
+ * A request that waits for its reply reads `ready` on its own loop; the slot tells nobody.
+ */
 export interface QueryReply {
-    /**
-     * Observe this existing slot without queues or retained Promise waiters; one observer at a time.
-     *
-     * @param notify Synchronous wake-up callback, including already-ready/closed state.
-     * @returns Unsubscribe function; cancellation must call it.
-     */
-    observeReady(notify: () => void): () => void;
     /** Whether a captured batch is available for request-owned consumption. */
     readonly ready: boolean;
     /** Take the receipt/witness or ordered TSN pair. */

package/types/app/queries/query-replies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query-replies.d.ts","sourceRoot":"","sources":["../../../src/app/queries/query-replies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,yFAAyF;AACzF,KAAK,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAelE,wDAAwD;AACxD,UAAU,eAAe;IACvB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,gGAAgG;AAChG,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,oDAAoD;IACpD,OAAO,IAAI,eAAe,GAAG,SAAS,CAAC;IACvC,kFAAkF;IAClF,OAAO,IAAI,eAAe,GAAG,SAAS,CAAC;IACvC,wFAAwF;IACxF,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;GAMG;AACH,qBAAa,YAAY;IAQX,OAAO,CAAC,QAAQ,CAAC,SAAS;IAPtC,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;gBAC0B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;IAEtD;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU;IAIjC;;;;;;OAMG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IAInD;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IA6DlB;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI;CA2BtC"}
+{"version":3,"file":"query-replies.d.ts","sourceRoot":"","sources":["../../../src/app/queries/query-replies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,yFAAyF;AACzF,KAAK,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAalE,wDAAwD;AACxD,UAAU,eAAe;IACvB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,oDAAoD;IACpD,OAAO,IAAI,eAAe,GAAG,SAAS,CAAC;IACvC,kFAAkF;IAClF,OAAO,IAAI,eAAe,GAAG,SAAS,CAAC;IACvC,wFAAwF;IACxF,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;GAMG;AACH,qBAAa,YAAY;IAQX,OAAO,CAAC,QAAQ,CAAC,SAAS;IAPtC,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;gBAC0B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC;IAEtD;;;;;OAKG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU;IAIjC;;;;;;OAMG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IAInD;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IA6ClB;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI;CAyBtC"}

package/types/app/queries/relay-refresh.d.ts

@@ -0,0 +1,26 @@
+import type { QueryCue } from "../../core/cues.js";
+import type { Habery } from "../identity/habbing.js";
+import { type DispatchResult } from "../protocol/parsering.js";
+/**
+ * Decide whether one processed query makes a relaying host refresh its view of the subject, and return the query cue
+ * that does it.
+ *
+ * Every condition must hold:
+ * - the message is a remote (not local) `logs` or `ksn` query the KEL owner accepted or escrowed;
+ * - its subject `q.i` is not a prefix of this Habery;
+ * - its requester is authenticated (see {@link authenticatedRequester}) and served by a local host under the shared
+ *   `servingHost` rule (an accepted mailbox or agent end role naming the host);
+ * - the host can address an attester for the subject now ({@link addressableAttesters}: one with an accepted
+ *   location), so the request is sent on the querier's next pass instead of waiting in its queue.
+ *
+ * The cue is `{ route: "logs", q: {} }` for the subject, signed by the serving host: one full replay from the
+ * attester covers both routes, since `ksn` is answered from the same key state. A `tels` query is not refreshed:
+ * its wire body names the registry and credential but not the issuer the querier selects attesters by.
+ *
+ * @param hby Borrowed habitats and accepted-state store of the relaying host.
+ * @param result Processed envelope and the decision its owner made.
+ * @param mailboxAid Receiving hosted endpoint AID, or null when the request named none.
+ * @returns The refresh query cue, or null when this query refreshes nothing.
+ */
+export declare function relayRefreshCue(hby: Habery, result: DispatchResult, mailboxAid: string | null): QueryCue | null;
+//# sourceMappingURL=relay-refresh.d.ts.map

package/types/app/queries/relay-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-refresh.d.ts","sourceRoot":"","sources":["../../../src/app/queries/relay-refresh.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,KAAK,cAAc,EAA6B,MAAM,0BAA0B,CAAC;AAuB1F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,CAa/G"}

package/types/app/queries/witness-inquisitor.d.ts

@@ -1,10 +1,26 @@
 import { type Operation } from "effection";
 import type { QueryCue, QueryRequest } from "../../core/cues.js";
 import { Deck } from "../../core/deck.js";
+import { type Relay } from "../delivery/relaying.js";
 import type { Hab, Habery } from "../identity/habbing.js";
 import type { ProtocolProcessor } from "../protocol/protocol-processing.js";
 import type { RuntimeClock } from "../runtime/runtime-clock.js";
-import type { HttpClient } from "../transport/http-client.js";
+import { type HttpClient } from "../transport/http-client.js";
+/**
+ * Delivery passes an ordinary request may rotate with a ready signer but no reachable attester before it is dropped:
+ * about five minutes at the protocol tock. Any remote party can cause such requests (every unverified reply signed by
+ * an unknown prefix yields a `query` cue), so without a bound they would rotate in the queue forever.
+ */
+export declare const UNADDRESSED_QUERY_PASS_LIMIT = 9600;
+/**
+ * The attesters of an ordinary query for `pre` that can be sent to now: those {@link queryAttesters} selects that also
+ * have an accepted location.
+ *
+ * @param hab Local habitat whose accepted-state store is read.
+ * @param pre Subject AID whose accepted endpoint roles and locations are consulted.
+ * @returns Addressable attester AIDs of the first eligible role; empty when none can be reached now.
+ */
+export declare function addressableAttesters(hab: Hab, pre: string): string[];
 /**
  * KERIpy-shaped query sender, independent from semantic query completion.
  *
@@ -43,6 +59,8 @@ export declare class WitnessInquisitor {
     private closed;
     /** Explicit default signer; null requires a unique local habitat. */
     private hab;
+    /** The agent every query is addressed and sent to (an edge); null selects ordinary attesters. */
+    readonly relay: Relay | null;
     /**
      * Bind actual protocol and I/O collaborators; acquire no store or network lifetime.
      *
@@ -50,9 +68,10 @@ export declare class WitnessInquisitor {
      * @param protocol Borrowed same-database processor for incoming query replies.
      * @param http Borrowed HTTP implementation selected by composition.
      * @param clock Borrowed clock for transport deadlines; times are milliseconds.
+     * @param relay The agent every query goes to; null selects attesters from accepted endpoint roles.
      * @param hab Optional default local signer; null requires an unambiguous sole habitat.
      */
-    constructor(hby: Habery, protocol: ProtocolProcessor, http: HttpClient, clock: RuntimeClock, hab?: Hab | null);
+    constructor(hby: Habery, protocol: ProtocolProcessor, http: HttpClient, clock: RuntimeClock, relay: Relay | null, hab?: Hab | null);
     /**
      * Select the local habitat used when queued requests have no explicit signer.
      *
@@ -61,6 +80,10 @@ export declare class WitnessInquisitor {
     configure({ hab }?: {
         hab?: Hab | null;
     }): void;
+    /** The explicitly configured default signer, or null when the sole local habitat is used. */
+    get defaultSigner(): string | null;
+    /** Whether a queued request names `signer` as its explicit signer. */
+    hasRequestsSignedBy(signer: string): boolean;
     /** Deferred instructions and active sends are this sender's only pending work. */
     hasPendingWork(): boolean;
     /**
@@ -77,6 +100,16 @@ export declare class WitnessInquisitor {
      * @param hab Optional local signer hint when the cue has no explicit signer.
      */
     enqueueCue(cue: QueryCue, hab?: Hab | null): void;
+    /**
+     * Admit a routed query cue unless an identical request is already queued: same subject, route, filters, signer,
+     * attester and witness overrides, with the signer resolved as {@link enqueueCue} resolves it. A relaying host's cue
+     * router uses this, so the queries of the many edges it serves about one subject leave one request queued; a request
+     * already taken for delivery is no longer queued, so a later cue queues the next one.
+     *
+     * @param cue Typed query cue; missing route/subject produces no request.
+     * @param hab Optional local signer hint when the cue has no explicit signer.
+     */
+    enqueueCueOnce(cue: QueryCue, hab?: Hab | null): void;
     /** Include actual query I/O in convergence; pending instructions have their own queue. */
     get hasPendingDelivery(): boolean;
     /**
@@ -131,12 +164,30 @@ export declare class WitnessInquisitor {
      * Resolve/sign one selected query and introduction immediately before its attempt.
      *
      * @param request Deferred unsigned request; nested query values must remain immutable.
-     * @returns Prepared packet, or null when signer/attester evidence is unresolved.
-     * @throws A selected attester with no endpoint URL throws; source removal remains with the caller.
+     * The attester is chosen at random among the eligible ones (the explicit `src`, the `wits` overrides, or the first
+     * eligible endpoint role) that have an accepted location. An attester without one is never promoted to another
+     * role; when none of the eligible attesters can be reached the request is unresolved, like a signer that cannot sign
+     * yet, so no endpoint condition ends the delivery loop or fails a caller's pass.
+     *
+     * @param request Deferred unsigned request; nested query values must remain immutable.
+     * @returns Prepared packet, or null when signer/attester evidence is unresolved, no eligible attester has an
+     *   accepted location, or the signer cannot sign yet.
      */
     private prepareRequest;
     /**
-     * Return the first eligible role’s attester IDs; preparation chooses one randomly.
+     * Address one query to the relay and sign it for the relay's location. The relay must have an accepted location
+     * and the signer must have authorized it as mailbox (where the answer is stored); until then the request stays
+     * unresolved and is tried again on a later pass, as for a signer that cannot sign yet.
+     *
+     * @param hab Local signing habitat.
+     * @param request Deferred unsigned request; its `src` and `wits` are not consulted.
+     * @param relay The configured relay agent, which is the attester.
+     * @returns Prepared packet for the relay, or null while {@link relayRefusal} refuses the relay for this signer.
+     */
+    private prepareRelayRequest;
+    /**
+     * Return the first eligible role’s attester IDs; preparation chooses one randomly. With a relay, the relay is the
+     * only attester.
      *
      * @param pre Subject AID whose accepted endpoint roles are consulted.
      * @param options Optional local signer AID and remote witness/attester overrides; neither selects a transport implementation.

package/types/app/queries/witness-inquisitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"witness-inquisitor.d.ts","sourceRoot":"","sources":["../../../src/app/queries/witness-inquisitor.ts"],"names":[],"mappings":"AAWA,OAAO,EAAQ,KAAK,SAAS,EAAY,MAAM,WAAW,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAoB,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAM1C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA+F9D;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAiB;IAC5B,wDAAwD;IACxD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,sDAAsD;IACtD,OAAO,CAAC,UAAU,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,MAAM,CAAC,CAAkB;IACjC,2EAA2E;IAC3E,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,+EAA+E;IAC/E,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC,CAEvE;IACD,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAS;IACvB,qEAAqE;IACrE,OAAO,CAAC,GAAG,CAAa;IAExB;;;;;;;;OAQG;gBACS,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,GAAG,GAAG,IAAW;IASnH;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAU,EAAE,GAAE;QAAE,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAA;KAAO,GAAG,IAAI;IAI1D,kFAAkF;IAClF,cAAc,IAAI,OAAO;IAIzB;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IASpC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAQjD,0FAA0F;IAC1F,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;;;;OAKG;IACF,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC;IAK/B;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAyCpB;;;;;;;OAOG;IACH,OAAO,CAAE,gBAAgB;IAmBzB;;;;OAIG;IACF,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC;IAOzB;;;;;OAKG;IACF,SAAS,CAAC,MAAM,GAAE,MAAyB,GAAG,SAAS,CAAC,KAAK,CAAC;IAW/D;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAIrB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;OAMG;IACH,YAAY,CACV,GAAG,EAAE,MAAM,EACX,EAAE,MAAM,EAAE,IAAI,EAAE,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GAC1D,MAAM,EAAE;CAoBZ"}
+{"version":3,"file":"witness-inquisitor.d.ts","sourceRoot":"","sources":["../../../src/app/queries/witness-inquisitor.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAQ,KAAK,SAAS,EAAY,MAAM,WAAW,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAoB,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAK1C,OAAO,EAAE,KAAK,KAAK,EAA+B,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,6BAA6B,CAAC;AASpF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,OAAQ,CAAC;AA8HlD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpE;AAkBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAiB;IAC5B,wDAAwD;IACxD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,sDAAsD;IACtD,OAAO,CAAC,UAAU,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,MAAM,CAAC,CAAkB;IACjC,2EAA2E;IAC3E,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,+EAA+E;IAC/E,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC,CAEvE;IACD,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAS;IACvB,qEAAqE;IACrE,OAAO,CAAC,GAAG,CAAa;IACxB,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAE7B;;;;;;;;;OASG;gBAED,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,GAAG,GAAE,GAAG,GAAG,IAAW;IAWxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAU,EAAE,GAAE;QAAE,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAA;KAAO,GAAG,IAAI;IAI1D,6FAA6F;IAC7F,IAAI,aAAa,IAAI,MAAM,GAAG,IAAI,CAEjC;IAED,sEAAsE;IACtE,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAK5C,kFAAkF;IAClF,cAAc,IAAI,OAAO;IAIzB;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAUpC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAQjD;;;;;;;;OAQG;IACH,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IASrD,0FAA0F;IAC1F,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;;;;OAKG;IACF,WAAW,IAAI,SAAS,CAAC,IAAI,CAAC;IAK/B;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAkDpB;;;;;;;OAOG;IACH,OAAO,CAAE,gBAAgB;IAmBzB;;;;OAIG;IACF,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC;IAOzB;;;;;OAKG;IACF,SAAS,CAAC,MAAM,GAAE,MAAyB,GAAG,SAAS,CAAC,KAAK,CAAC;IAW/D;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAIrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,cAAc;IAuBtB;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;OAOG;IACH,YAAY,CACV,GAAG,EAAE,MAAM,EACX,EAAE,MAAM,EAAE,IAAI,EAAE,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GAC1D,MAAM,EAAE;CASZ"}

package/types/app/runtime/agent-runtime.d.ts

@@ -15,6 +15,7 @@ import { Authenticator } from "../bootstrap/authenticating.js";
 import { Oobiery, type OobiJob } from "../bootstrap/oobiery.js";
 import type { RootReplicator } from "../credentials/root-replicator.js";
 import { Poster } from "../delivery/forwarding.js";
+import { type Relay } from "../delivery/relaying.js";
 import { ReplyStreams } from "../delivery/reply-streams.js";
 import { Respondant } from "../delivery/respondant.js";
 import { Exchanger } from "../exchanges/exchanging.js";
@@ -37,7 +38,7 @@ import { IpexAuxiliaries } from "./ipex-auxiliaries.js";
 import { type OperationStores, type RuntimeOperations } from "./operation-owners.js";
 import type { RetryPolicy } from "./retry-backoff.js";
 import type { RuntimeClock } from "./runtime-clock.js";
-import { SignerConditions } from "./signer-conditions.js";
+import { type ChangeSink } from "./workflow-contract.js";
 export type { KeriDispatchEnvelope, OobiJob, TransIdxSigGroup };
 /**
  * Shared runtime composition root owned by one `Habery`.
@@ -59,6 +60,11 @@ export interface AgentRuntime {
     hby: Habery;
     /** Provider mailbox store, borrowed when injected and otherwise owned when enabled. */
     mailboxer: Mailboxer | null;
+    /**
+     * Whether this runtime relays for served senders (the agent side of relay mode, `AgentRuntimeOptions.relaying`).
+     * A host reads it to serve the OOBI of any identifier whose KEL it holds, the edge's replay source.
+     */
+    readonly relaying: boolean;
     /** Persistent notice store; ownership follows explicit injection. */
     noter: Noter | null;
     /** Configured notice producer, sharing the composed signer and signaler. */
@@ -67,6 +73,8 @@ export interface AgentRuntime {
     signaler: Signaler | null;
     /** Ordinary protocol facts, consumed by the composed cue workers. */
     cues: Deck<AgentCue>;
+    /** Where the cue worker publishes `kramRefused` cues: the injected operation sink, else the Signaler's; null with neither. */
+    readonly changes: ChangeSink | null;
     /** Demand-driven input lifetime; protocol decisions stay with ProtocolProcessor. */
     reactor: Reactor;
     /** Shared protocol mutations, publication and background escrow processing. */
@@ -111,8 +119,6 @@ export interface AgentRuntime {
     counselor: Counselor;
     /** Tells an identifier's mailboxes its KEL after a rotation; `runAgentRuntime` runs its fiber. */
     kelPublisher: KelPublisher;
-    /** Loops waiting for a signer the host released; empty when nothing waits. */
-    signerConditions: SignerConditions;
     /** Pacing of the owners loop `runAgentRuntime` runs. */
     readonly ownerPacing: Readonly<DoerPacing>;
     /** Pacing of the KEL publisher loop `runAgentRuntime` runs. */
@@ -170,6 +176,16 @@ export interface AgentRuntimeOptions {
     notifier?: Notifier;
     /** Construct a provider mailbox store. Omitted leaves it absent; injected mailboxer stays borrowed. */
     enableMailboxStore?: boolean;
+    /**
+     * Agent side of relay mode: `/fwd` intake delivers the child of a sender that authorized this host as its
+     * `mailbox` or `agent`, through this runtime's own ingress to a local habitat and through its Poster to anyone
+     * else. Requires a mailbox store, which hosts `/fwd` intake. The `/oobis` handler then resolves an OOBI only
+     * for such a sender. A `logs` or `ksn` query from such a sender about a subject that is not local also makes
+     * this runtime query the subject's own endpoints for it (`relayRefreshCue`), and the cue router queues no
+     * query identical to one already queued. Omitted or false keeps store-only intake, accepts `/oobis` from any
+     * sender and never refreshes.
+     */
+    relaying?: boolean;
     /**
      * Header and poll-window overrides, in milliseconds, for this runtime's mailbox poller. Omitted values keep
      * the poller defaults; a short `maxPollDurationMs` makes polls turn over quickly for an embedder or test.
@@ -221,6 +237,16 @@ export interface AgentRuntimeOptions {
      * `"closed"` refuses any Grant missing a far node. Neither mode escrows.
      */
     grantWalk?: AcdcWalkPolicy;
+    /**
+     * The agent this runtime sends, queries and polls through, which makes it an edge. Every HTTP and TCP request
+     * is refused unless it goes to the relay's OOBI origin or an accepted relay location. Poster forwards every
+     * message to the relay, every query is addressed to the relay, and the relay is the only mailbox polled. Each
+     * needs a mailbox end role naming the relay: from the wrapper or query signer (a group's local member) to send,
+     * and from the polled subject (a group itself) to poll. The Oobiery fetches only the relay's origin: it asks the
+     * relay to resolve any other OOBI and reads the result from the relay's OOBI endpoint. The relay's OOBI
+     * is queued when its location is not yet accepted. Omitted, the runtime is a forwarder and delivers directly.
+     */
+    relay?: Relay;
 }
 /** Summary of pending runtime-backed durable work for bounded command hosts. */
 export interface RuntimePendingState {
@@ -391,6 +417,11 @@ export { runtimeTurn } from "./runtime-turn.js";
  * delegation and ordinary query sending. The finalizer halts children in reverse
  * order; store ownership remains with the composition scope.
  *
+ * Each loop is a plain spawned fixed-tock doer. A loop that signs for a local habitat reads `Hab.canSign()` on its
+ * tock and skips a habitat that cannot sign yet (a store opened without its signer); a later `Manager.hold` lets
+ * that habitat act on the next tock. A `SignerNotHeldError` that still escapes a loop is a fault: the loop ends
+ * and the failure ends this operation.
+ *
  * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
  * @param options Optional default query/cue signer, remote pollMailbox switch
  * (default true) and command-owned queryCues Deck. Wire queryCues before starting