keri-ts 2.2.4 → 2.2.5

package/esm/keri/npm/src/app/identity/retire-identifier.js

@@ -0,0 +1,98 @@
+/**
+ * Retire a local, non-group identifier from a running agent: `Habery.retireHab` at the store level, then the
+ * runtime's own state for it.
+ *
+ * {@link retireIdentifierRefusal} decides first, as a pure read, and {@link retireIdentifier} refuses with its
+ * reason before any write. Beyond `retireHab`'s own refusals (not local, a group, a local group's member or
+ * accepted member, a local habitat's delegator) the runtime refuses an identifier it still needs: the issuer of a
+ * legacy or v2 registry (a v2 registry's alias cannot be reloaded without its local issuer), one with a delegated
+ * event pending in `dpwe.`/`dune.`/`dpub.` or pinned as a delegation proxy, the habitat of a live issuance or
+ * Unblind operation, the source of a queued Poster event, the explicit signer of a queued query, and the
+ * querier's configured default signer.
+ *
+ * `retireHab` drops the held signers of the identifier's current keys with its stored keys. After it commits,
+ * this deletes the identifier's mailbox poll cursors (`Baser.tops`, keyed by subject and endpoint) and its KEL
+ * publisher bookkeeping (`Baser.kpub`), and prompts the mailbox poller and the KEL publisher. The poller halts
+ * the identifier's workers on its next tock; the publisher drops the identifier's budgets and derives nothing
+ * for it, since it is no longer local.
+ *
+ * Deleted, and why none of it is acceptance state: `tops.` is this consumer's own poll progress against a
+ * remote mailbox, not a record of anything accepted; `kpub.` records which mailboxes were told the
+ * identifier's KEL, the publisher's own bookkeeping (its sweep prunes rows of non-local identifiers anyway).
+ * Neither takes part in reply acceptance (BADA/RUN) or replay protection.
+ *
+ * Kept, deliberately (BADA/RUN): the KEL and its attachments, `states.` and key-state notices, every accepted
+ * reply the identifier authored or that names it (end-role and location records, reply SADs, their date-times
+ * and signatures or seal couples), transaction-state notices, KRAM cache rows, stored exchanges and
+ * credentials. Keeper registry-root rows (`rroots.`) keyed by this identifier are left too: a registry issuer
+ * is refused, so any such row belongs to a registry the identifier does not own.
+ *
+ * Retirement is one-way, as for `retireHab`: the retired name cannot be reused with the same salt and
+ * namespace, and the seeds of salt-derived keys stay derivable from the Keeper's root salt.
+ */
+import { ValidationError } from "../../core/errors.js";
+import { mailboxPollEndpoints } from "../mailbox/mailboxing.js";
+/**
+ * Why `runtime` would refuse to retire `pre`, or null when {@link retireIdentifier} would retire it. A pure read;
+ * the first refusal found is returned, `retireHab`'s own first.
+ */
+export function retireIdentifierRefusal(runtime, pre) {
+    const { hby } = runtime;
+    const store = hby.retireRefusal(pre);
+    if (store)
+        return store;
+    for (const [keys, record] of runtime.vdr?.reger.regs.getTopItemIter() ?? []) {
+        if (record.prefix === pre)
+            return `${pre} is the issuer of registry ${keys.join(".")}.`;
+    }
+    const acdc = runtime.acdc?.store;
+    for (const [keys, record] of acdc?.records?.getTopItemIter() ?? []) {
+        if (acdc.event(record.registryKey)?.issuer === pre)
+            return `${pre} is the issuer of registry ${keys.join(".")}.`;
+    }
+    const pending = runtime.delegating.pendingOf(pre);
+    if (pending.length)
+        return `${pre} has a pending delegated event: ${pending.join(", ")}.`;
+    const proxied = runtime.delegating.proxiedBy(pre);
+    if (proxied.length)
+        return `${pre} is the delegation proxy of ${proxied.join(", ")}.`;
+    const issuance = runtime.operations?.issuance.grantsOf(pre) ?? [];
+    if (issuance.length)
+        return `${pre} has live issuance operations: ${issuance.join(", ")}.`;
+    const unblinding = runtime.operations?.unblinding.grantsOf(pre) ?? [];
+    if (unblinding.length)
+        return `${pre} has live Unblind operations: ${unblinding.join(", ")}.`;
+    for (const evt of runtime.postman.evts) {
+        if (evt.src === pre)
+            return `${pre} has queued outgoing messages.`;
+    }
+    if (runtime.querying.hasRequestsSignedBy(pre))
+        return `${pre} signs queued queries.`;
+    if (runtime.querying.defaultSigner === pre)
+        return `${pre} is the runtime's configured query signer.`;
+    return null;
+}
+/**
+ * Retire `pre`: `Habery.retireHab` (which drops its held signers), then delete its mailbox cursors and KEL
+ * publisher rows, and prompt the mailbox poller and KEL publisher. Makes no event and signs nothing.
+ *
+ * @throws ValidationError with {@link retireIdentifierRefusal}'s reason, before any write.
+ */
+export function retireIdentifier(runtime, pre) {
+    const refusal = retireIdentifierRefusal(runtime, pre);
+    if (refusal)
+        throw new ValidationError(refusal);
+    const { hby } = runtime;
+    const hab = hby.habs.get(pre);
+    const mailboxes = hab
+        ? [...new Set(mailboxPollEndpoints(hab, runtime.mailboxPoller.relay).map((endpoint) => endpoint.eid))]
+        : [];
+    const { name, released } = hby.retireHab(pre);
+    hby.db.transaction(() => {
+        hby.db.tops.trim([pre], { topive: true });
+        hby.db.kpub.trim([pre], { topive: true });
+    });
+    runtime.mailboxPoller.prompt(pre);
+    runtime.kelPublisher.prompt(pre);
+    return { pre, name, released, mailboxes };
+}

package/esm/keri/npm/src/app/ipex/disclosure-replaying.js

@@ -0,0 +1,116 @@
+/**
+ * Read a group's completed credential disclosures back out of the runtime's stores, as CESR a fresh store can take.
+ *
+ * A host that serves a group member (for example a custodian holding a weight-0 co-member) answers a wiped
+ * co-member's request for the group's credentials with these two reads, inside its own request handler, the way
+ * KERIA serves its REST API from the existing databases. Both are plain reads over the Habery's exchange tables,
+ * its KEL tables and the registry store: no network I/O, no writes, no new store or index, no signing, and no
+ * dependence on the wallet package.
+ *
+ * KERIpy's late-joiner refill sends KELs, schemas, the registry TEL and then the credential. Here the credential
+ * travels inside its Grant, so a disclosure is replayed as KELs, TELs, the Grant and its Admit; workflow wrappers
+ * (`/multisig/*`) stay out, as in KERIpy.
+ */
+import { collectPayload, concatBytes, Counter, framePayload, SerderACDC, Vrsn_2_0 } from "cesr-ts";
+import { call } from "effection";
+import { ValidationError } from "../../core/errors.js";
+import { loadNests } from "../../db/exchange/exchange-nests.js";
+/**
+ * Resolve `grant` to a completed disclosure, or null. Complete means: the Grant is an accepted v2 `/ipex/grant`
+ * disclosing exactly one origin that its stored nests carry; `erpy.` names its response; that response is an
+ * accepted v2 `/ipex/admit` whose prior is the Grant, sent by the Grant's recipient back to the Grant's sender.
+ * "Accepted" is the Exchanger's own record (`exns.`): it is written only once the sender's signing threshold is met,
+ * so a group's Admit counts when it holds enough weight overall, whatever weight the local member carries, and a
+ * proposal or partially signed Admit still in escrow does not count. A spurn, or no response, is not complete.
+ */
+function completed(hby, exc, grant) {
+    const db = hby.db, body = db.exns.get([grant]);
+    if (!body || body.said !== grant || body.route !== "/ipex/grant" || body.pvrsn.major !== 2 || !exc.complete(grant)) {
+        return null;
+    }
+    const said = db.erpy.get([grant])?.qb64, admit = said ? db.exns.get([said]) : null;
+    if (!admit || admit.said !== said || admit.route !== "/ipex/admit" || admit.pvrsn.major !== 2 || !exc.complete(said)
+        || admit.sad.p !== grant || admit.pre !== body.sad.ri || admit.sad.ri !== body.pre)
+        return null;
+    const origins = body.sad.a?.o;
+    if (!Array.isArray(origins) || origins.length !== 1 || typeof origins[0] !== "string")
+        return null;
+    const origin = loadNests(db, grant).find((node) => node.body instanceof SerderACDC && node.body.said === origins[0])
+        ?.body;
+    return origin ? { grant: body, admit, origin } : null;
+}
+/**
+ * The group's completed credential disclosures, in `erpy.` key order (by Grant SAID). Scans `erpy.` (one row per
+ * accepted exchange that answered a prior) and reads the named Grant, Admit and Grant nests; nothing else.
+ *
+ * - `holder`: the group is the Grant's recipient and its Admit is accepted, whoever sent the Grant. This is what a
+ *   wallet records as admitted.
+ * - `issuer`: the group sent the Grant and is the origin credential's issuer, and the recipient's Admit is accepted.
+ *   A Grant in which the group re-presents a credential it holds is not listed; that credential is listed as held.
+ *
+ * Neither role needs the local member to sign or to carry weight, so a weight-0 member lists the same rows as its
+ * co-members once it has accepted the Admit. Listing does not reauthenticate stored proofs;
+ * {@link exportDisclosureStream} does. Each Grant carries its whole credential graph, so the rows are independent
+ * and need no order between them.
+ */
+export function listGroupDisclosures(hby, exc, group) {
+    const found = [];
+    for (const [keys] of hby.db.erpy.getTopItemIter()) {
+        const disclosure = completed(hby, exc, String(keys[0]));
+        if (!disclosure)
+            continue;
+        const { grant, admit, origin } = disclosure;
+        const role = grant.sad.ri === group
+            ? "holder"
+            : grant.pre === group && origin.issuer === group
+                ? "issuer"
+                : null;
+        if (!role)
+            continue;
+        found.push({ grant: grant.said, admit: admit.said, credential: origin.said, registry: origin.regid, role });
+    }
+    return found;
+}
+/**
+ * One dependency-ordered CESR stream for a completed disclosure, which a receiver with an empty store can process
+ * front to back:
+ *
+ * 1. KELs, each after its delegation ancestry, with the stored signatures, witness receipts and first-seen replay
+ *    attachments, of `hab`, the Grant's sender, the Admit's sender and every identifier the carried ACDC nodes name
+ *    (issuers, issuees, source-seal prefixes);
+ * 2. the accepted TEL (`rip`, `bup`, with any retained public opening) of every registry those nodes name;
+ * 3. the Grant, as accepted, with its nests: the credential and every disclosed far node of its graph (a chained
+ *    credential's dependencies travel inside it, before nothing that cites them);
+ * 4. the Admit, as accepted.
+ *
+ * Not in the stream: schemas (JSON Schema documents are not CESR; the receiver must hold or fetch them), the
+ * registry root and any other private registry state (a group root travels only as a `/registry/root` copy), the
+ * group's habitat record and its members' KELs beyond those named above, OOBI and end-role replies, KRAM cache
+ * rows, `/multisig/*` workflow wrappers and wallet inventory rows.
+ *
+ * Everything is re-encoded from stored, accepted evidence: `Exchanger.replay` revalidates each exchange's retained
+ * proofs, and nothing is signed, so `hab` needs no usable signing key; a weight-0 member, or one whose signer the
+ * host does not hold, exports the same stream. `hab` only adds its own KEL. A Grant that is not a completed
+ * disclosure (see {@link listGroupDisclosures}) is refused with a `ValidationError`. A host passes the runtime's
+ * own discloser, `runtime.operations.issuance.discloser`.
+ *
+ * The exchanges keep their original timestamps, so once their KRAM windows have passed, ordinary network intake
+ * with KRAM enabled refuses them as replays; accepting them on import is the importer's concern, not this read's.
+ */
+export function* exportDisclosureStream(discloser, hab, grant) {
+    const disclosure = completed(discloser.hby, discloser.exc, grant);
+    if (!disclosure)
+        throw new ValidationError(`Grant ${grant} is not an accepted Grant with an accepted Admit.`);
+    const { admit } = disclosure, db = discloser.hby.db, exc = discloser.exc;
+    const nests = loadNests(db, grant);
+    const raw = concatBytes(Counter.makeGVC(Vrsn_2_0), ...yield* call(() => Promise.all(nests.map((nest) => collectPayload(framePayload(nest))))));
+    const support = discloser.proofSupportFor(raw, [hab.pre, disclosure.grant.pre, admit.pre]);
+    const exchanges = yield* call(async () => {
+        const chunks = [];
+        for (const said of [grant, admit.said])
+            for await (const chunk of exc.replay(said))
+                chunks.push(chunk);
+        return chunks;
+    });
+    return concatBytes(support, ...exchanges);
+}

package/esm/keri/npm/src/app/ipex/group-ipex.js

@@ -13,33 +13,54 @@
  *   a member that is briefly offline), collects the other members' stored contributions, and, once the message is
  *   accepted, lets the elected lead send the completed message to its recipient. It signs nothing beyond the
  *   contribution that the consent recorded.
+ * - A member that did not sign a message the others' signatures complete (a weight-0 member, say) takes it with no
+ *   call: intake on receipt of a wrapper whose copies carry the group's threshold, or else `processOnce`'s periodic
+ *   sweep once the exchange the message answers is accepted. That adds no signature, so it is not consent; the
+ *   member then holds what the group completed and can accept the counterparty's answer in its thread.
  * - {@link groupIpexStatus} is a pure read and {@link waitForGroupIpex} only observes.
  *
  * Status is derived from the protocol stores: an accepted message reads `done`; a stored proposal without a live
  * operation reads `awaitingConsent` (a member that reloaded consents again with the same call and reuses its
  * recorded signature). Lost on reload, by design: whether the lead had already delivered the completed message,
- * the `failed` and `abandoned` reasons, and the publication results. The runtime never writes wallet inventory; the
+ * the `failed`, `expired` and `abandoned` reasons, and the publication results. The runtime never writes wallet inventory; the
  * embedder reacts to the pushed `{kind: "ipex", id: <message>}` change.
  */
 import { concatBytes, Counter, Vrsn_2_0 } from "cesr-ts";
-import { ValidationError } from "../../core/errors.js";
+import { KramRefusedError, ValidationError } from "../../core/errors.js";
 import { loadNests } from "../../db/exchange/exchange-nests.js";
 import { registryEventStatus, settleRegistryEvent } from "../credentials/registry-settling.js";
 import { isLocalGroupHab } from "../multisig/group-members.js";
-import { MULTISIG_EXN_ROUTE } from "../multisig/grouping.js";
+import { groupIpexFollowable, MULTISIG_EXN_ROUTE } from "../multisig/grouping.js";
 import { RetryBackoff } from "../runtime/retry-backoff.js";
 import { observeUntil } from "../runtime/workflow-contract.js";
 import { IpexAdmitter } from "./ipex-admitting.js";
-import { approveMultisigIpexLocally, approveStoredMultisigIpexWrappers, findStoredMultisigIpex, groupIpexApproved, prepareAcdcV2GroupIpex, publishGroupIpexProposal, publishInitialGroupIpex, requireAcdcV2GroupUse, sendCompletedGroupIpex, storedMultisigIpexBody, } from "./ipex-grouping.js";
+import { attachPresentationProof } from "./ipex-discloser.js";
+import { acceptGroupIpexCopies, approveMultisigIpexLocally, approveStoredMultisigIpexWrappers, findStoredMultisigIpex, groupIpexApproved, prepareAcdcV2GroupIpex, publishGroupIpexProposal, publishInitialGroupIpex, requireAcdcV2GroupUse, sendCompletedGroupIpex, storedMultisigIpexBody, unacceptedGroupIpexCopies, } from "./ipex-grouping.js";
 import { isIssuanceOrigin } from "./ipex-node-authentication.js";
 import { IPEX_GRANT_ROUTE } from "./ipexing.js";
 /** Milliseconds between collections of the other members' stored contributions. */
 export const GROUP_IPEX_COLLECT_MS = 250;
+/** Milliseconds between sweeps for group messages this member holds completed but has not accepted. */
+export const GROUP_IPEX_FOLLOW_MS = 5_000;
 /** How long delivery failures may last before an operation ends `failed`; a group IPEX message has no deadline. */
 export const GROUP_IPEX_RETRY_BOUND_MS = 600_000;
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * Frame a group-authored body with its nests and sign this member's contribution, accepting it locally; returns the
+ * contribution's wire. Both the proposer's consent and the owner's signing after a registry update use it.
+ *
+ * @throws ValidationError while the message awaits authenticating dependencies; KramRefusedError when this member's
+ * own KRAM refuses it.
+ */
+function* contribute(deps, hab, exn, nests, gvrsn) {
+    const candidate = concatBytes(Counter.makeGVC(gvrsn), exn.raw, Counter.enclose({ qb64: nests, version: gvrsn }));
+    const own = yield* prepareAcdcV2GroupIpex(deps.hby, deps.protocol, hab, candidate);
+    if (!own)
+        throw new ValidationError("ACDC v2 group disclosure awaits authenticating dependencies.");
+    return own;
+}
 /** The live table of group IPEX operations and its driver; one per host runtime. */
 export class GroupIpexOperations {
     constructor(deps) {
@@ -68,28 +89,75 @@ export class GroupIpexOperations {
             writable: true,
             value: new Map()
         });
+        /** Messages this member's KRAM refused to take from their copies in this process; a sweep tries them no more. */
+        Object.defineProperty(this, "unfollowable", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
+        });
+        /** When the next sweep for completed group messages is due. */
+        Object.defineProperty(this, "nextFollow", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
     }
-    /** Whether a pass has work. */
+    /** Whether a pass has work: a live operation, or a sweep for completed group messages is due. */
     active() {
-        return this.live.size > 0;
+        return this.live.size > 0 || this.deps.clock.now() >= this.nextFollow;
     }
-    /** Advance every live operation by one pass. */
+    /**
+     * Advance every live operation by one pass. Every {@link GROUP_IPEX_FOLLOW_MS} a pass also takes the group messages
+     * this member did not sign but holds completed ({@link follow}); that signs and sends nothing.
+     */
     *processOnce() {
+        if (this.deps.clock.now() >= this.nextFollow) {
+            this.nextFollow = this.deps.clock.now() + GROUP_IPEX_FOLLOW_MS;
+            yield* this.follow();
+        }
         for (const op of [...this.live.values()]) {
-            if (op.busy || !this.live.has(op.said))
+            // A group whose local member cannot sign yet waits for its signer.
+            if (op.busy || !this.live.has(op.said) || !op.group.canSign())
                 continue;
             op.busy = true;
             try {
                 yield* this.step(op);
             }
             catch (error) {
-                this.end(op, "failed", message(error));
+                this.end(op, error instanceof KramRefusedError ? "expired" : "failed", message(error));
             }
             finally {
                 op.busy = false;
             }
         }
     }
+    /**
+     * Accept each stored group IPEX message whose received copies already carry the group's threshold
+     * ({@link groupIpexFollowable}), adding no signature, so this member holds what the group completed without it.
+     * Intake takes such a message on receipt; this sweep takes what intake could not yet, such as an answer that arrived
+     * before the exchange it answers. A message with a live operation is left to that operation's own collection.
+     */
+    *follow() {
+        const { hby, exc, protocol } = this.deps;
+        for (const copies of unacceptedGroupIpexCopies(hby, exc)) {
+            const said = copies[0].body.said;
+            if (this.live.has(said) || this.unfollowable.has(said) || !groupIpexFollowable(hby, copies))
+                continue;
+            try {
+                yield* acceptGroupIpexCopies(protocol, copies);
+            }
+            catch (error) {
+                if (!(error instanceof KramRefusedError))
+                    throw error;
+                this.unfollowable.add(said);
+                continue;
+            }
+            if (exc.complete(said))
+                this.deps.changes?.push({ kind: "ipex", id: said });
+        }
+    }
     /** End a live operation and tell the sink. */
     end(op, state, reason) {
         this.live.delete(op.said);
@@ -140,16 +208,46 @@ export class GroupIpexOperations {
             return false;
         }
     }
+    /**
+     * The event that took the awaited update's place, read from state: a different accepted KEL event at the anchor's
+     * sequence number, or a different accepted TEL event at the update's. Null while the update can still be accepted;
+     * an update the members never approve stays awaited until the user abandons it.
+     */
+    supersededBy(anchor) {
+        const kel = this.deps.hby.db.kels.getLast(anchor.anchor.pre, anchor.anchor.sn);
+        if (kel && kel !== anchor.anchor.said)
+            return kel;
+        const tel = this.deps.rgy.store.seqEvent(anchor.regid, anchor.sn)?.said;
+        if (tel && tel !== anchor.said)
+            return tel;
+        return null;
+    }
+    /**
+     * Sign this member's contribution to a presentation Grant whose registry update the group has accepted: attach the
+     * proof sealed by the accepted anchor, then contribute. The consent that began the operation covers this signature.
+     */
+    *signAfterUpdate(op, awaited) {
+        const seal = this.deps.rgy.store.anchor(awaited.anchor.said);
+        if (!seal)
+            throw new ValidationError("The presentation update is accepted but its anchor is unavailable");
+        const grant = yield* attachPresentationProof(awaited.grant, awaited.opening, { s: seal[0], d: seal[1] });
+        return yield* contribute(this.deps, op.group, grant.exn, grant.nests, op.genus);
+    }
     *step(op) {
         const { hby, protocol, postman, exc, rgy, clock } = this.deps;
         if (op.prerequisite) {
+            const awaited = op.prerequisite;
+            const superseding = this.supersededBy(awaited.anchor);
+            if (superseding) {
+                this.end(op, "failed", `The registry update was superseded by ${superseding}`);
+                return;
+            }
             const read = { db: hby.db, store: rgy.store, protocol };
-            const { anchor, proceed } = op.prerequisite;
-            if (registryEventStatus(read, anchor).state !== "accepted") {
-                if ((yield* settleRegistryEvent(read, anchor)).state !== "accepted")
+            if (registryEventStatus(read, awaited.anchor).state !== "accepted") {
+                if ((yield* settleRegistryEvent(read, awaited.anchor)).state !== "accepted")
                     return;
             }
-            op.outbound = { kind: "initial", wire: yield* proceed() };
+            op.outbound = { kind: "initial", wire: yield* this.signAfterUpdate(op, awaited) };
             op.prerequisite = null;
             this.setPhase(op, "publishing");
         }
@@ -201,27 +299,25 @@ export class GroupIpexOperations {
  * `processOnce`.
  *
  * @throws ValidationError for a body the group did not author, a non-group identifier, a message awaiting
- * authenticating dependencies, or one already begun.
+ * authenticating dependencies, or one already begun; KramRefusedError (a ValidationError) when this member's own
+ * KRAM refuses the message, as an Offer past its exchange lifetime.
  */
 export function* proposeGroupIpex(ops, { hab, exn, nests = new Uint8Array(), gvrsn = Vrsn_2_0, deliver = true }) {
-    const { hby, protocol } = ops.deps;
-    if (!isLocalGroupHab(hby, hab))
+    if (!isLocalGroupHab(ops.deps.hby, hab))
         throw new ValidationError("Group IPEX requires a local group identifier");
     if (exn.pre !== hab.pre || !exn.said)
         throw new ValidationError("The IPEX message must be authored by the group");
     if (ops.live.has(exn.said))
         throw new ValidationError("A group IPEX message was already begun for this SAID");
-    const candidate = concatBytes(Counter.makeGVC(gvrsn), exn.raw, Counter.enclose({ qb64: nests, version: gvrsn }));
-    const own = yield* prepareAcdcV2GroupIpex(hby, protocol, hab, candidate);
-    if (!own)
-        throw new ValidationError("ACDC v2 group disclosure awaits authenticating dependencies.");
+    const own = yield* contribute(ops.deps, hab, exn, nests, gvrsn);
     return ops.begin(exn.said, hab, gvrsn, { kind: "initial", wire: own }, deliver);
 }
 /**
- * The proposer's consent to a group-authored message that waits for a registry update, as a Grant carrying a
- * presentation proof does: the caller has proposed the update (this member's contribution is its approval) and
- * passes the anchor to wait for. The owner signs the message's contribution, through `prerequisite.proceed`, once
- * the group has accepted the update, under this same consent. Returns after local commit.
+ * The proposer's consent to a presentation Grant that waits for a registry update: the caller has proposed the
+ * update (this member's contribution is its approval) and passes the frozen Grant, its opening and the anchor to wait
+ * for. On each pass the owner reads whether the group accepted the update; once it has, the owner attaches the proof
+ * and signs this member's contribution under this same consent. A superseded update ends the operation `failed`; one
+ * the members never approve stays active until {@link abandonGroupIpex}. Returns after local commit.
  */
 export function proposeGroupIpexAfter(ops, { hab, exn, gvrsn = Vrsn_2_0, deliver = true, prerequisite }) {
     if (!isLocalGroupHab(ops.deps.hby, hab))
@@ -286,7 +382,8 @@ export function groupIpexProposals(ops, hab) {
  * completed message, which a lead that learned of the acceptance from another member's wrapper has not yet done.
  *
  * @throws ValidationError when no v2 proposal is stored for `said`, an operation is already live for it, or this
- * member still lacks the evidence to approve it.
+ * member still lacks the evidence to approve it; KramRefusedError (a ValidationError) when this member's own KRAM
+ * refuses the contribution.
  */
 export function* approveGroupIpex(ops, said, { deliver = true } = {}) {
     const { hby, protocol } = ops.deps;

package/esm/keri/npm/src/app/ipex/group-issuance.js

@@ -16,6 +16,9 @@
  * | holder custodian or member    | {@link approveGroupIssuanceExchange}      | consent to DH (contributions follow as they arrive) |
  * | a member that only follows    | {@link followGroupIssuanceProof}          | nothing; verifies the custodian's final proof       |
  *
+ * The follow is not a consent and needs no call: the owner begins it itself (below). The explicit call remains for a
+ * proof supplied as bytes and is idempotent with the automatic follow.
+ *
  * The registry update is a separate consent: the custodian proposes the BUP through `proposeRegistryEvent`
  * (its own contribution is its approval) and every other issuer member approves that proposal with
  * `approveGroupProposal`. Admit is a separate consent as well.
@@ -25,10 +28,18 @@
  * Grant and the proof broadcast to the other members. Root copies are not sent here: the DH completion cue
  * feeds the runtime's `RootReplicator`, which sends exactly one copy per member.
  *
+ * Automatic follow: on its slow sweep of the pending exchange escrow the owner begins the proof-only follow, in either
+ * role, of each pending group Grant inside its deadline that this member has no live, ended or complete operation for
+ * and whose custodian's final proof is stored ({@link storedGroupProof}). The proof exists only after the key exchange
+ * finished, so the follow never takes the place of a member whose signature is still wanted; until the proof or a root
+ * copy is stored the member reads `awaitingExchangeConsent` and consents as usual. A member holding a root copy or the
+ * proof reads `awaitingAnchor` ({@link awaitsGroupProof}) until the follow accepts the Grant.
+ *
  * Reload: nothing about a group operation is durable but the protocol stores. A member that reloads reads
  * `awaitingExchangeConsent` for a pending Grant it holds no root for and consents again with the same call;
  * its signatures are deterministic, so consenting twice produces the same bytes. A custodian that reloaded
- * after retaining its root resumes when the stores allow it ({@link deriveGroupCustody}).
+ * after retaining its root resumes when the stores allow it ({@link deriveGroupCustody}). A follow signs nothing, so
+ * the first sweep after a reload begins it again from the stored proof.
  */
 import { bytesEqual, collectPayload, concatBytes, Counter, framePayload, parseBytes, SerderACDC, SerderKERI, Vrsn_2_0, } from "cesr-ts";
 import { call } from "effection";
@@ -197,29 +208,76 @@ export function deriveGroupCustody(deps, hab, grant) {
     if (!isLocalGroupHab(hby, hab) || !hab.kever)
         return null;
     const member = localGroupMember(hby, hab.pre);
-    const registries = new Set();
-    for (const nest of deps.exc.retainedInput(grant)?.nests ?? []) {
-        const rd = nest.body.ked?.rd;
-        if (typeof rd === "string")
-            registries.add(rd);
-    }
+    const registries = disclosedRegistries(deps.exc, grant);
     if (!registries.size || [...registries].some((registry) => !hab.mgr.hasRegistryRoot(hab.pre, registry))) {
         return null;
     }
     if (receivedRootCopy(hby, hab.pre, member.pre, registries))
         return null;
-    const events = [...hby.db.getKelItemIter(hab.pre)].slice(-GROUP_COORDINATOR_SEARCH);
+    const coordinator = electingCoordinator(hby, hab.pre, member.pre);
+    return coordinator ? { coordinator, custodian: member.pre, lead: true } : null;
+}
+/** The registries a retained Grant discloses credentials of. */
+function disclosedRegistries(exc, grant) {
+    const registries = new Set();
+    for (const nest of exc.retainedInput(grant)?.nests ?? []) {
+        const rd = nest.body.ked?.rd;
+        if (typeof rd === "string")
+            registries.add(rd);
+    }
+    return registries;
+}
+/** The latest of the group's recent accepted events whose threshold evidence elects `member`, or null. */
+function electingCoordinator(hby, group, member) {
+    const events = [...hby.db.getKelItemIter(group)].slice(-GROUP_COORDINATOR_SEARCH);
     for (const [, said] of events.reverse()) {
-        const event = hby.db.getEvtSerder(hab.pre, said);
+        const event = hby.db.getEvtSerder(group, said);
         if (!event || event.sn === null)
             continue;
         const coordinator = { sn: event.sn, said: event.said };
-        if (groupElectedMember(hby, hab.pre, coordinator) === member.pre) {
-            return { coordinator, custodian: member.pre, lead: true };
-        }
+        if (groupElectedMember(hby, group, coordinator) === member)
+            return coordinator;
     }
     return null;
 }
+/**
+ * The election of a final proof the local member of `hab` can follow for `grant` without taking part: the
+ * `/multisig/ipex-proof` wrapper of this exact Grant that another current signing member published, with a recent
+ * accepted group event electing that member as custodian. The custodian publishes the proof only after the key
+ * exchange finished and the registry update was accepted, so once it is stored no member's signature is still wanted
+ * for this issuance. The sender names the custodian exactly, which a root copy cannot (any member holding a root
+ * sends copies). Null when no such proof is stored. A pure read of the stored exchanges.
+ */
+export function storedGroupProof(deps, hab, grant) {
+    const { hby } = deps;
+    if (!isLocalGroupHab(hby, hab) || !hab.kever)
+        return null;
+    const member = localGroupMember(hby, hab.pre).pre, signing = groupSigningMembers(hby, hab.pre);
+    for (const [, parent] of hby.db.exns.getTopItemIter()) {
+        const attrs = parent.sad?.a;
+        if (parent.route !== MULTISIG_IPEX_PROOF_ROUTE || attrs?.gid !== hab.pre || attrs?.grant !== grant
+            || !parent.pre || parent.pre === member || !signing.includes(parent.pre))
+            continue;
+        const coordinator = electingCoordinator(hby, hab.pre, parent.pre);
+        if (coordinator)
+            return { coordinator, custodian: parent.pre, lead: false };
+    }
+    return null;
+}
+/**
+ * Whether the group completed `grant` without the local member of `hab`, so that its runtime follows the final proof
+ * instead of asking it to consent: a `/registry/root` copy of a disclosed registry was sent to it (copies are
+ * authorized only once the registry update is accepted, after the key exchange), or the custodian's final proof is
+ * stored ({@link storedGroupProof}). A pure read of the stores.
+ */
+export function awaitsGroupProof(deps, hab, grant) {
+    const { hby } = deps;
+    if (!isLocalGroupHab(hby, hab) || !hab.kever)
+        return false;
+    const member = localGroupMember(hby, hab.pre).pre, registries = disclosedRegistries(deps.exc, grant);
+    return (registries.size > 0 && receivedRootCopy(hby, hab.pre, member, registries))
+        || !!storedGroupProof(deps, hab, grant);
+}
 /** Whether `member` was sent a `/registry/root` copy of the group's root for any of `registries`. */
 function receivedRootCopy(hby, group, member, registries) {
     for (const [, copy] of hby.db.exns.getTopItemIter()) {
@@ -421,23 +479,51 @@ export function approveGroupIssuanceExchange(ops, said, coordinator) {
     return ops.beginGroup(new GroupIssuance(party, "holder", grant, nodes));
 }
 /**
- * Follow a group issuance that has already been contributed to, only to verify and accept the custodian's final
- * proof: the file-free path of an issuer member that left after contributing and returns for the proof. The group
- * is the Grant's sender. Signs nothing. The proof may already be stored (it arrives by mailbox), or be supplied as
- * bytes.
+ * Follow a group issuance only to verify and accept the custodian's final proof, signing nothing. It serves any
+ * member that does not contribute to the key exchange: an issuer member that left after contributing and returns
+ * for the proof, or a holder member the group completed without, such as one whose signing weight is 0. The group
+ * is the Grant's sender when that is a local group, otherwise its recipient. The proof may already be stored (it
+ * arrives by mailbox), or be supplied as bytes.
+ *
+ * The owner begins the same follow on its own once the custodian's proof is stored ({@link storedGroupProof}), so a
+ * host needs this call only to supply the proof as bytes or to pin the coordinator. It is idempotent with that
+ * follow; see {@link beginGroupProofFollow}.
  *
- * @throws ValidationError for a Grant this runtime's groups did not send, or one already begun.
+ * @throws ValidationError for a Grant that is not pending for a local group, or one begun under a consent.
  */
 export function* followGroupIssuanceProof(ops, said, options = {}) {
-    const { deps } = ops;
-    if (ops.liveOf(said, "issuer") || partyComplete(deps, said, "issuer")) {
+    const { deps } = ops, sent = deps.exc.retainedInput(said)?.serder.pre;
+    const sender = sent ? deps.hby.habs.get(sent) : undefined;
+    const role = sender && isLocalGroupHab(deps.hby, sender) ? "issuer" : "holder";
+    const begun = beginGroupProofFollow(ops, said, role, options.coordinator);
+    // Stored for the follow's next scan, whether it began now or earlier.
+    if (options.proof)
+        yield* deps.reactor.processBytes(options.proof);
+    return begun;
+}
+/**
+ * Begin `role`'s proof-only follow of the pending group Grant `said` under `coordinator` (default the group's latest
+ * establishment event). Signs nothing. Idempotent: when that party's follow is already live, or its side of the Grant
+ * is already complete, returns the Grant and its transaction and begins nothing. The owner's sweep and
+ * {@link followGroupIssuanceProof} both begin follows here.
+ *
+ * @throws ValidationError for a Grant that is not pending for a local group, one whose live operation is a consent,
+ * or a coordinator {@link GroupParty.resolve} refuses.
+ */
+export function beginGroupProofFollow(ops, said, role, coordinator) {
+    const { deps } = ops, live = ops.liveOf(said, role);
+    if (live?.group?.mode === "proofOnly")
+        return { grant: said, xid: live.xid };
+    if (live)
         throw new ValidationError("Issuance was already begun for this Grant");
+    if (partyComplete(deps, said, role)) {
+        const serder = deps.exc.retainedInput(said)?.serder;
+        return { grant: said, xid: serder ? grantTransactionId(serder) : said };
     }
     const { grant, nodes } = pendingGrant(deps, said);
-    const party = GroupParty.resolve(deps, localGroup(deps, grant.pre), options.coordinator);
-    if (options.proof)
-        yield* deps.reactor.processBytes(options.proof);
-    return ops.beginGroup(new GroupIssuance(party, "issuer", grant, nodes, { mode: "proofOnly" }));
+    const group = localGroup(deps, role === "issuer" ? grant.pre : grant.sad.ri);
+    const party = GroupParty.resolve(deps, group, coordinator);
+    return ops.beginGroup(new GroupIssuance(party, role, grant, nodes, { mode: "proofOnly" }));
 }
 /**
  * The custodian's exact public proof of a completed group issuance: the proof support and the