keri-ts 2.2.4 → 2.2.5

package/esm/keri/npm/src/app/ipex/ipex-discloser.js

@@ -88,6 +88,32 @@ export function* storedExchangeWire(retained, gvrsn = Vrsn_2_0) {
     frame.nests = nests;
     return yield* call(() => collectPayload(framePayload(frame)));
 }
+/**
+ * Extend a frozen Grant's exact origin proof with its presented-state opening and the KEL seal of the registry update
+ * that commits to it; the Grant body and its SAID are unchanged. Ordinary intake still authenticates the supplied
+ * presentation evidence. Reads no store and signs nothing.
+ *
+ * @throws ValidationError when the opening does not target this exact Grant's disclosed Issuee in the `presented` state.
+ */
+export function* attachPresentationProof(prepared, opening, source) {
+    const frames = parseBytes(prepared.raw), node = frames[0].body;
+    if (!node.issuee || opening.td.nonce !== prepared.exn.said || opening.ts.label !== "presented") {
+        throw new ValidationError("Presentation proof must target this exact Grant and disclosed Issuee.");
+    }
+    const seal = Counter.enclose({
+        code: "SealSourceTriples",
+        qb64: concatBytes(new Prefixer({ qb64: node.issuee }).qb64b, source.s.qb64b, source.d.qb64b),
+        version: Vrsn_2_0,
+    });
+    const first = concatBytes(node.raw, Counter.enclose({
+        qb64: concatBytes(...frames[0].attachments.map(group => group.raw), publicOpeningAttachment(opening), seal),
+        version: Vrsn_2_0,
+    }));
+    const rest = yield* call(() => Promise.all(frames.slice(1).map(frame => collectPayload(nestedPayload(frame, Vrsn_2_0)))));
+    const raw = concatBytes(Counter.makeGVC(Vrsn_2_0), first, ...rest);
+    const payloads = yield* call(() => Promise.all(parseBytes(raw).map(frame => collectPayload(nestedPayload(frame, Vrsn_2_0)))));
+    return { exn: prepared.exn, raw, nests: concatBytes(...payloads) };
+}
 /** Borrow concrete owners only. No constructor opens a store, starts a worker or loads registry secrets. */
 export class IpexDiscloser {
     constructor(hby, registry, exc, receiptor, custody, views) {
@@ -201,7 +227,15 @@ export class IpexDiscloser {
     }
     /** Carry selected public evidence and root-first delegation ancestry; receiver intake still verifies every approval. */
     proofSupport(raw, hab) {
-        const aids = new Set([hab.pre]), registries = new Set();
+        return this.proofSupportFor(raw, [hab.pre]);
+    }
+    /**
+     * `proofSupport` for explicitly named parties instead of one habitat: the KELs of `parties` and of every identifier
+     * the ACDC frames in `raw` name, each after its delegation ancestry, then the accepted TEL of every registry they
+     * name. Reads accepted state only and signs nothing, so it needs no keys.
+     */
+    proofSupportFor(raw, parties) {
+        const aids = new Set(parties), registries = new Set();
         for (const frame of parseBytes(raw)) {
             if (!(frame.body instanceof SerderACDC))
                 continue;
@@ -399,26 +433,6 @@ export class IpexDiscloser {
         const prior = yield* this.prior(priorSaid);
         return ipexExnBody(sender, `/ipex/${verb}`, [], { message, prior, recipient });
     }
-    /** Extend the frozen Grant's exact origin proof; ordinary intake still authenticates the supplied presentation evidence. */
-    *attachPresentationProof(prepared, opening, source) {
-        const frames = parseBytes(prepared.raw), node = frames[0].body;
-        if (!node.issuee || opening.td.nonce !== prepared.exn.said || opening.ts.label !== "presented") {
-            throw new ValidationError("Presentation proof must target this exact Grant and disclosed Issuee.");
-        }
-        const seal = Counter.enclose({
-            code: "SealSourceTriples",
-            qb64: concatBytes(new Prefixer({ qb64: node.issuee }).qb64b, source.s.qb64b, source.d.qb64b),
-            version: Vrsn_2_0,
-        });
-        const first = concatBytes(node.raw, Counter.enclose({
-            qb64: concatBytes(...frames[0].attachments.map(group => group.raw), publicOpeningAttachment(opening), seal),
-            version: Vrsn_2_0,
-        }));
-        const rest = yield* call(() => Promise.all(frames.slice(1).map(frame => collectPayload(nestedPayload(frame, Vrsn_2_0)))));
-        const raw = concatBytes(Counter.makeGVC(Vrsn_2_0), first, ...rest);
-        const payloads = yield* call(() => Promise.all(parseBytes(raw).map(frame => collectPayload(nestedPayload(frame, Vrsn_2_0)))));
-        return { exn: prepared.exn, raw, nests: concatBytes(...payloads) };
-    }
     /** Select immutable admitted/transferred nests; proof refresh changes attachments only when explicitly requested. */
     *selected(selection, offer = false) {
         if ([selection.said, selection.fromGrant, selection.transferred].filter(value => value !== undefined).length !== 1) {
@@ -540,7 +554,7 @@ export class IpexDiscloser {
             if (reg.store.seqEvent(reg.regk, Number(BigInt(`0x${update.sad.n}`)))?.said !== update.said) {
                 throw new ValidationError("Presentation BUP remains pending authenticated acceptance.");
             }
-            ({ raw, nests } = yield* this.attachPresentationProof({ exn, raw, nests }, proof, seal));
+            ({ raw, nests } = yield* attachPresentationProof({ exn, raw, nests }, proof, seal));
         }
         const source = exn.sad.a.ax?.[0]
             ? yield* anchorExchange(this.hby, this.receiptor, hab, exn, options.auths)

package/esm/keri/npm/src/app/ipex/ipex-grouping.js

@@ -12,7 +12,7 @@ import { call } from "effection";
 import { evaluateChain } from "../../acdc/chaining.js";
 import { resolveAttachmentGvrsn } from "../../core/attachment-countering.js";
 import { TransIdxSigGroup } from "../../core/dispatch.js";
-import { ValidationError } from "../../core/errors.js";
+import { KramRefusedError, ValidationError } from "../../core/errors.js";
 import { verifyExchangeProofs } from "../../core/exchange/exchange-proofing.js";
 import { exchange, serializeMessage } from "../../core/exchange/protocol-exchanging.js";
 import { Kever } from "../../core/kel/kever.js";
@@ -74,7 +74,19 @@ export function requireAcdcV2GroupUse(hby, protocol, embedded) {
         throw new ValidationError("ACDC v2 group graph is unavailable for completed use.");
     }
 }
-/** Approve exactly one ACDC v2 IPEX stream before adding this member's signature; no new acceptance rows are manufactured. */
+/** KRAM refusals after which the message can no longer be accepted; a `replay` is routine, not one of them. */
+const KRAM_EXPIRY_REASONS = new Set(["timestamp", "timeliness", "unknownThread", "lifetime"]);
+/** Whether `decision` is this receiver's KRAM refusing a message for its time, its thread or its lifetime. */
+function isKramExpiry(decision) {
+    return !!decision && decision.kind === "drop" && "reason" in decision && KRAM_EXPIRY_REASONS.has(decision.reason);
+}
+/**
+ * Approve exactly one ACDC v2 IPEX stream before adding this member's signature; no new acceptance rows are manufactured.
+ *
+ * @returns This member's accepted wire, or null while its evidence or dependencies are missing.
+ * @throws KramRefusedError when this member's own KRAM refuses the contribution for its time, thread or exchange
+ * lifetime: the message can no longer be accepted here. A `replay` refusal is routine and is not thrown.
+ */
 export function* prepareAcdcV2GroupIpex(hby, protocol, group, raw) {
     const frames = parseBytes(concatBytes(Counter.makeGVC(Vrsn_2_0), raw));
     const frame = frames[0], embedded = frame?.body;
@@ -136,7 +148,11 @@ export function* prepareAcdcV2GroupIpex(hby, protocol, group, raw) {
     };
     const attachments = yield* call(() => collectPayload(attachmentPayload(approved, { gvrsn: Vrsn_2_0 })));
     const wire = concatBytes(embedded.raw, attachments);
-    yield* new Reactor(protocol).processBytes(wire, { local: true });
+    // Dispatch the frame itself, not its bytes, so this member's own KRAM decision is visible. A refusal here is
+    // not a remote outcome to skip: the contribution was never accepted and nothing else will complete the message.
+    const { decision } = yield* protocol.dispatch(parseBytes(wire)[0], { local: true }, new Reactor(protocol).kvy);
+    if (isKramExpiry(decision))
+        throw new KramRefusedError(embedded.said, decision);
     yield* protocol.processEscrowsOnce();
     return wire;
 }
@@ -457,6 +473,40 @@ export function* approveStoredMultisigIpexWrappers(hby, protocol, embeddedSaid,
         yield* approveIpexChild(hby, protocol, groupHab, child, wrapper, reger);
     }
 }
+/**
+ * The copies this member received of each v2 group IPEX message it has not accepted: per message, the child of each
+ * stored, authenticated `/multisig/exn` wrapper that carries it, with its signatures and nests. A pure read; whether a
+ * message may be taken from its copies is {@link groupIpexFollowable}'s rule.
+ */
+export function unacceptedGroupIpexCopies(hby, exchanger) {
+    const copies = new Map();
+    for (const [, wrapper] of hby.db.exns.getTopItemIter()) {
+        if (wrapper.route !== MULTISIG_EXN_ROUTE || wrapper.pvrsn.major !== 2)
+            continue;
+        const said = storedMultisigIpexBody(hby.db, wrapper)?.said;
+        if (!said || exchanger.complete(said) || !exchanger.verifyAccepted(wrapper.said, MULTISIG_EXN_ROUTE))
+            continue;
+        copies.set(said, [...copies.get(said) ?? [], loadNests(hby.db, wrapper.said)[0]]);
+    }
+    return [...copies.values()];
+}
+/**
+ * Accept a group IPEX message from the copies this member received, adding no signature: dispatch each copy with its
+ * own proofs, then advance escrows so that copies whose signatures only together meet the threshold complete. The
+ * caller has checked {@link groupIpexFollowable}.
+ *
+ * @throws KramRefusedError when this member's own KRAM refuses a copy for its time, thread or exchange lifetime: the
+ * message can no longer be accepted here.
+ */
+export function* acceptGroupIpexCopies(protocol, copies) {
+    const kvy = new Reactor(protocol).kvy;
+    for (const copy of copies) {
+        const { decision } = yield* protocol.dispatch(copy, { local: true }, kvy);
+        if (isKramExpiry(decision))
+            throw new KramRefusedError(copy.body.said, decision);
+    }
+    yield* protocol.processEscrowsOnce();
+}
 /**
  * Return the first incomplete stored `/multisig/exn` wrapping `/ipex/*`.
  *

package/esm/keri/npm/src/app/ipex/ipex-v2.js

@@ -464,8 +464,13 @@ export class IpexV2Handler {
         }
         return { pending, registries };
     }
-    /** Notify only after Exchanger has durably accepted the parent and its evidence. */
-    handle({ serder }) {
+    /**
+     * Notify only after Exchanger has durably accepted the parent and its evidence. A retained exchange (history a
+     * local import replayed, such as an already admitted Grant and its Admit) is not news: no notice asks anyone to act.
+     */
+    handle({ serder, retained }) {
+        if (retained)
+            return;
         this.notifier?.add({ r: `/exn${serder.route}`, d: serder.said, m: serder.sad.a.m });
     }
     /** Every disclosed own schema vets before presentation and issuer graph reduction. */

package/esm/keri/npm/src/app/ipex/issuance.js

@@ -22,6 +22,7 @@
  * | holder: pending Grant, no root held                                       | `awaitingExchangeConsent`                |
  * | pending Grant past its deadline                                           | `expired`                                |
  * | holder: root held, not committed otherwise; issuer: update accepted       | `active`, `rootRetained` (adopted)       |
+ * | group member: root copy received or the custodian's final proof stored    | `active`, `awaitingAnchor` (followed)    |
  * | issuer: pending Grant, update not accepted                                | `interrupted`                            |
  * | root held and the registry committed to another exchange                  | `interrupted`                            |
  * | holder: Grant accepted, no accepted Admit                                 | `active`, `awaitingAdmitConsent`         |
@@ -54,9 +55,12 @@
  * `{kind: "issuance", id: <grant>}` and the embedder records it.
  *
  * A local group issues and receives through the same table, status and wait: its consent calls and per-operation
- * steps are in `group-issuance.ts` and run inside the same `processOnce`. A group exchange is not resumed after a
- * restart (its frozen coordinator and custodian are not stored): a group pending Grant with no root reads
- * `awaitingExchangeConsent`, and a member consents again with the same call.
+ * steps are in `group-issuance.ts` and run inside the same `processOnce`. A group exchange in progress is not
+ * resumed after a restart (its frozen coordinator and custodian are not stored): a group pending Grant with no root
+ * reads `awaitingExchangeConsent`, and a member consents again with the same call. The custodian that retained the
+ * root is adopted once the stores allow it, and a member the group completed without is followed: the same sweep
+ * that finds resumable Grants begins the proof-only follow of each group Grant whose custodian's final proof is
+ * stored, signing nothing, so a restart begins it again.
  *
  * Collaborators are narrow concrete owners (ADR-0013); no `AgentRuntime`.
  */
@@ -65,14 +69,14 @@ import { call, race } from "effection";
 import { RegistryAuthor } from "../../acdc/authoring.js";
 import { RegistryCustody } from "../../acdc/custody.js";
 import { grantTransactionId, registryUncommitted, resumableExchange } from "../../acdc/dhking.js";
-import { ValidationError } from "../../core/errors.js";
+import { KramRefusedError, ValidationError } from "../../core/errors.js";
 import { CREDENTIAL_MAILBOX_TOPIC } from "../../core/mailbox/mailbox-topics.js";
 import { timestampMicros } from "../../time/mod.js";
 import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
 import { remoteGroupMembers } from "../multisig/multisig-messaging.js";
 import { DeliveryOutbox, } from "../runtime/delivery-outbox.js";
 import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
-import { deriveGroupCustody, GroupIssuance, GroupParty, registerGroupRoutes, stepGroup, } from "./group-issuance.js";
+import { awaitsGroupProof, beginGroupProofFollow, deriveGroupCustody, GroupIssuance, GroupParty, registerGroupRoutes, stepGroup, storedGroupProof, } from "./group-issuance.js";
 import { IpexAdmitter } from "./ipex-admitting.js";
 import { exchangeWire, IpexDiscloser, storedExchangeWire } from "./ipex-discloser.js";
 /**
@@ -83,9 +87,9 @@ import { exchangeWire, IpexDiscloser, storedExchangeWire } from "./ipex-disclose
  */
 export const ISSUANCE_QUERY_RESEND_MS = 1000;
 /**
- * Milliseconds between scans of the pending exchange escrow for Grants a restarted process can finish. The scan
- * repeats because what makes a Grant resumable can arrive after the restart (an issuer's update accepted once the
- * other members approve it).
+ * Milliseconds between scans of the pending exchange escrow for Grants a restarted process can finish and group
+ * Grants whose final proof a member follows. The scan repeats because what makes a Grant resumable can arrive after
+ * the restart (an issuer's update accepted once the other members approve it), and a custodian's proof arrives late.
  */
 export const ISSUANCE_SWEEP_MS = 5_000;
 /** The key of one party's operation on a Grant. */
@@ -219,23 +223,27 @@ export class IssuanceOperations {
     remember(grant, ended) {
         this.ended.set(partyKey(grant, ended.role), ended);
     }
-    /** Whether a pass has work: a live operation, or the one-time scan for resumable Grants has not run. */
+    /** Whether a pass has work: a live operation, an adoption still owed, or a sweep of the pending Grants is due. */
     active() {
         return this.live.size > 0 || this.stale.length > 0 || this.deps.clock.now() >= this.nextSweep;
     }
     /**
      * Advance every live operation by one pass. Each pass is bounded by the operation's Grant deadline.
-     * The first pass also adopts the pending Grants the stores prove resumable ({@link resumableGrants});
-     * that signs and sends nothing.
+     * Every {@link ISSUANCE_SWEEP_MS} a pass also scans the pending exchange escrow once ({@link sweptGrants}): it
+     * adopts the Grants the stores prove resumable and begins the proof-only follow of the group Grants whose
+     * custodian's proof is stored. Neither signs nor sends anything.
      */
     *processOnce() {
         if (this.deps.clock.now() >= this.nextSweep) {
             this.nextSweep = this.deps.clock.now() + ISSUANCE_SWEEP_MS;
             const known = new Set(this.stale.map(({ grant, role }) => partyKey(grant, role)));
-            this.stale.push(...resumableGrants(this.deps).filter(({ grant, role }) => {
+            const swept = sweptGrants(this.deps, (grant, role) => {
                 const key = partyKey(grant, role);
-                return !this.live.has(key) && !known.has(key) && !this.refused.has(key) && !this.ended.has(key);
-            }));
+                return this.live.has(key) || known.has(key) || this.refused.has(key) || this.ended.has(key);
+            });
+            this.stale.push(...swept.resumable);
+            for (const found of swept.follows)
+                this.follow(found);
         }
         for (const found of [...this.stale]) {
             if (yield* this.settle(found))
@@ -249,6 +257,10 @@ export class IssuanceOperations {
                 const left = op.expires === null ? null : op.expires - BigInt(this.deps.clock.now()) * 1000n;
                 if (left !== null && left <= 0n)
                     this.end(op, "expired", EXPIRED);
+                // A habitat that cannot sign yet waits for its signer; only its Grant deadline ends the operation meanwhile.
+                // A proof-only follow signs nothing, so it proceeds without one.
+                else if (!op.hab.canSign() && op.group?.mode !== "proofOnly")
+                    continue;
                 else if ((yield* race([this.advance(op), ...(left === null ? [] : [this.timer(Number(left) / 1000)])])) === "expired")
                     this.end(op, "expired", EXPIRED);
             }
@@ -263,7 +275,8 @@ export class IssuanceOperations {
     /** End a live operation: release its DH approval, remember why until the process ends, tell the sink. */
     end(op, state, reason) {
         this.release(op);
-        this.ended.set(partyKey(op.grant, op.role), { role: op.role, state, reason });
+        const deadline = state === "expired" ? op.deadline : null;
+        this.ended.set(partyKey(op.grant, op.role), { role: op.role, state, reason, ...(deadline && { deadline }) });
         this.deps.changes?.push({ kind: "issuance", id: op.grant });
     }
     /**
@@ -277,6 +290,14 @@ export class IssuanceOperations {
             this.end(op, "abandoned", reason);
         return bound.map(op => op.grant);
     }
+    /** Grants of the live operations, and of those found resumable and not yet adopted, whose habitat is `pre`. */
+    grantsOf(pre) {
+        const grants = [...this.live.values()].filter(op => op.hab.pre === pre).map(op => op.grant);
+        for (const found of this.stale)
+            if (found.hab.pre === pre)
+                grants.push(found.grant);
+        return [...new Set(grants)];
+    }
     /** Drop the live entry and the DH approval; a missing approval means the owner already closed. */
     release(op) {
         this.live.delete(partyKey(op.grant, op.role));
@@ -324,6 +345,24 @@ export class IssuanceOperations {
         }
         return true;
     }
+    /**
+     * Begin the proof-only follow a sweep found, under the stored proof's election; it signs nothing, so it needs no
+     * unlocked Keeper. A refusal means the stores no longer support it: the Grant then reads from them and is not tried
+     * again in this process. Any other failure is this Grant's alone and ends it `failed`, as for an adoption.
+     */
+    follow(found) {
+        const key = partyKey(found.grant, found.role);
+        try {
+            beginGroupProofFollow(this, found.grant, found.role, found.election.coordinator.said);
+        }
+        catch (error) {
+            this.refused.add(key);
+            if (!(error instanceof ValidationError)) {
+                this.ended.set(key, { role: found.role, state: "failed", reason: message(error) });
+                this.deps.changes?.push({ kind: "issuance", id: found.grant });
+            }
+        }
+    }
     /** Rebuild the live entry of a resumable Grant from the stored Grant and the held roots. */
     *adopt({ hab, grant, role }) {
         const group = isLocalGroupHab(this.deps.hby, hab);
@@ -442,7 +481,8 @@ export class IssuanceOperations {
     }
     /**
      * Record one group operation the user consented to ({@link approveGroupIssuance},
-     * {@link approveGroupIssuanceExchange}, {@link followGroupIssuanceProof}). A holder approves DH here, with its
+     * {@link approveGroupIssuanceExchange}), or a proof-only follow, which needs no consent ({@link beginGroupProofFollow},
+     * begun by the sweep or by {@link followGroupIssuanceProof}). A holder approves DH here, with its
      * consent; an issuer approves once the group has authenticated the Grant.
      */
     beginGroup(group) {
@@ -559,6 +599,20 @@ export class IssuanceOperations {
 function reached(clock, expires) {
     return expires !== null && BigInt(clock.now()) * 1000n >= expires;
 }
+/**
+ * Refuse a Grant whose exchange deadline has passed with the KRAM lifetime refusal that names that deadline,
+ * so a caller learns why the Grant can no longer be acted on rather than that it is unknown. The deadline
+ * outlives the Grant's KRAM cache row and its ejection from escrow ({@link Exchanger.exchangeExpiry}). Returns
+ * when the Grant has no known deadline or is still inside it; the caller then raises its own refusal.
+ *
+ * @throws KramRefusedError (reason `lifetime`) once the deadline has passed.
+ */
+function refuseLapsedGrant(deps, grant) {
+    const deadline = deps.exc.exchangeExpiry(grant);
+    if (deadline && reached(deps.clock, timestampMicros(deadline))) {
+        throw new KramRefusedError(grant, { kind: "drop", reason: "lifetime", deadline });
+    }
+}
 /**
  * Whether a restarted process can complete this Grant without a new key exchange: it is pending inside its
  * deadline, `hab` is the party `role` names, and {@link resumableExchange} finds the roots. An issuer
@@ -585,23 +639,43 @@ function grantParties(hby, grant) {
     return issuer || holder ? { serder, issuer, holder } : null;
 }
 /**
- * Every pending Grant the stores prove a restarted process can finish: one scan of the pending exchange
- * escrow, made once when the owner first runs. A pure read.
+ * One scan of the pending exchange escrow, made every {@link ISSUANCE_SWEEP_MS}: each local party of a pending Grant
+ * that `skip` does not exclude (the owner skips what it holds live, ended, refused or already found) is either
+ * resumable, or a group member that follows the custodian's stored proof ({@link followable}). A pure read.
  */
-function resumableGrants(deps) {
-    const found = [];
+function sweptGrants(deps, skip) {
+    const swept = { resumable: [], follows: [] };
     for (const [[grant]] of [...deps.hby.db.epse.getTopItemIter()]) {
         const parties = grantParties(deps.hby, grant);
         if (!parties)
             continue;
-        if (parties.issuer && resumable(deps, parties.issuer, grant, "issuer")) {
-            found.push({ hab: parties.issuer, grant, role: "issuer" });
-        }
-        if (parties.holder && resumable(deps, parties.holder, grant, "holder")) {
-            found.push({ hab: parties.holder, grant, role: "holder" });
+        for (const [hab, role] of [[parties.issuer, "issuer"], [parties.holder, "holder"]]) {
+            if (!hab || skip(grant, role))
+                continue;
+            if (resumable(deps, hab, grant, role)) {
+                swept.resumable.push({ hab, grant, role });
+                continue;
+            }
+            const election = followable(deps, hab, grant, role, parties.serder);
+            if (election)
+                swept.follows.push({ hab, grant, role, election });
         }
     }
-    return found;
+    return swept;
+}
+/**
+ * The election under which the local member of group `hab` follows `grant` to its final proof, or null: the party's
+ * side is not complete, the Grant is inside its exchange deadline, and the custodian's proof is stored
+ * ({@link storedGroupProof}). Only the proof decides it, never the member's weight: a member that should sign is not
+ * followed, because the proof exists only once the key exchange no longer wants any signature.
+ */
+function followable(deps, hab, grant, role, serder) {
+    if (!isLocalGroupHab(deps.hby, hab) || partyComplete(deps, grant, role))
+        return null;
+    const deadline = deps.exc.exchangeDeadline(serder), expires = deadline ? timestampMicros(deadline) : null;
+    if (expires === null || reached(deps.clock, expires))
+        return null;
+    return storedGroupProof(deps, hab, grant);
 }
 /** The terminal reading of a pending Grant no process can complete: ended by a restart, or by another exchange. */
 function orphaned(deps, hab, grant) {
@@ -641,7 +715,8 @@ function requireIndividual(deps, hab) {
 }
 /**
  * The exact unanchored pending Grant a local party may consent to, with its deadline. Refuses a group
- * identifier, an issuance already begun, a Grant that is not this party's, and an issuer without its registry.
+ * identifier, an issuance already begun, a Grant that is not this party's, and an issuer without its registry;
+ * a Grant past its deadline is refused with `KramRefusedError`.
  */
 function selectGrant(ops, hab, grant, role, group = false) {
     const { deps } = ops;
@@ -655,6 +730,7 @@ function selectGrant(ops, hab, grant, role, group = false) {
     if (!retained || !(credential instanceof SerderACDC) || !credential.regid
         || (role === "issuer" ? retained.serder.pre : retained.serder.sad.ri) !== hab.pre
         || retained.sourceSeals?.length || retained.ptds?.length || retained.essrs?.length) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("Select the exact unanchored pending issuance Grant for this local party");
     }
     const reg = deps.rgy.regs.get(credential.regid);
@@ -689,12 +765,15 @@ function* grantWires(retained) {
  *
  * @throws ValidationError for a Grant that is not this identifier's exact
  * unanchored pending issuance, an unmanaged registry, a group identifier, or
- * an issuance already begun or completed.
+ * an issuance already begun or completed; its subclass `KramRefusedError`
+ * (reason `lifetime`, with the deadline) for a Grant past its exchange deadline.
  */
 export function* beginIssuance(ops, grant, auths) {
     const { deps } = ops, hab = grantParties(deps.hby, grant)?.issuer;
-    if (!hab)
+    if (!hab) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("Select the exact unanchored pending issuance Grant for this local party");
+    }
     const { retained, credential, deadline, expires } = selectGrant(ops, hab, grant, "issuer");
     const { raw, grantWire } = yield* grantWires(retained);
     const dh = deps.dhkes.dhke(hab), xid = dh.approve(grant), query = dh.start(grant);
@@ -730,14 +809,18 @@ export function* proposeIssuance(ops, draft, auths) {
  * operation holds reads `interrupted` (or `expired` once the Grant deadline has passed); that is a
  * statement, not a write.
  *
+ * @throws KramRefusedError (reason `lifetime`, with the deadline) when the Grant's deadline has passed and the
+ * stores no longer hold what a status needs: KRAM pruned its cache row, or the escrow sweep ejected the Grant.
  * @throws ValidationError when `grant` is not a v2 Grant this runtime's identifiers are party to.
  */
 export function issuanceStatus(ops, grant, party = {}) {
     const { deps } = ops, parties = grantParties(deps.hby, grant);
     const chosen = chooseParty(parties, party);
     const ended = ops.endedOf(grant, chosen), live = ops.liveOf(grant, chosen);
-    if (ended)
-        return { state: ended.state, role: ended.role, reason: ended.reason };
+    if (ended) {
+        const { state, role, reason, deadline } = ended;
+        return { state, role, reason, ...(deadline && { deadline }) };
+    }
     if (live && !reached(deps.clock, live.expires)) {
         return {
             state: "active",
@@ -747,8 +830,10 @@ export function issuanceStatus(ops, grant, party = {}) {
             ...(live.outbox.failure && { failure: live.outbox.failure }),
         };
     }
-    if (!parties)
+    if (!parties) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("No issuance was begun for this Grant");
+    }
     const { serder, issuer, holder } = parties, db = deps.hby.db;
     if (partyComplete(deps, grant, chosen)) {
         const admitted = !!db.erpy.get([grant]);
@@ -763,16 +848,22 @@ export function issuanceStatus(ops, grant, party = {}) {
     // A group issuer's partial Grant has no accepted lifetime until its members' contributions authenticate it.
     const lifetime = deps.exc.exchangeDeadline(serder) ?? undefined;
     const deadline = lifetime, expires = lifetime ? timestampMicros(lifetime) : null;
-    if (!group && (!deadline || expires === null))
+    if (!group && (!deadline || expires === null)) {
+        // KRAM pruned the Grant's cache row at its deadline, before the escrow sweep ejected the Grant.
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("No issuance was begun for this Grant");
+    }
     if (reached(deps.clock, expires)) {
         const credential = deps.exc.retainedInput(grant)?.nests?.[0]?.body;
         const registry = credential instanceof SerderACDC ? credential.regid : undefined;
         const late = role === "holder" && registry && deps.rgy.store.headEvent(registry)?.ilk === "bup";
-        return { state: "expired", role, reason: late ? EXPIRED_LATE : EXPIRED };
+        return { state: "expired", role, reason: late ? EXPIRED_LATE : EXPIRED, deadline };
     }
     if (resumable(deps, hab, grant, role))
         return { state: "active", role, phase: "rootRetained", deadline };
+    // The group completed without this member: the owner follows the custodian's proof once it is stored.
+    if (group && awaitsGroupProof(deps, hab, grant))
+        return { state: "active", role, phase: "awaitingAnchor", deadline };
     if ((role === "holder" || group) && !heldRoot(deps, hab, grant)) {
         // A group issuer's Grant may still be a partial one that only its members' contributions authenticate.
         if (!group && !deps.exc.retainedInput(grant, { pending: true })) {
@@ -892,11 +983,16 @@ export function* waitForIssuance(ops, grant, { timeoutMs, clock = ops.deps.clock
  * The holder's consent to the DH exchange for one pending Grant addressed to a local identifier. Approves DH and records the
  * consent; `processOnce` then answers the issuer's query, waits for its registry update and finishes the Grant.
  * Admitting the credential is a separate consent ({@link admitIssuance}).
+ *
+ * @throws KramRefusedError (reason `lifetime`, with the deadline) for a Grant past its exchange deadline, and
+ * ValidationError for any other Grant this holder cannot consent to.
  */
 export function approveIssuanceExchange(ops, grant) {
     const { deps } = ops, hab = grantParties(deps.hby, grant)?.holder;
-    if (!hab)
+    if (!hab) {
+        refuseLapsedGrant(deps, grant);
         throw new ValidationError("Select the exact unanchored pending issuance Grant for this local party");
+    }
     const { retained, credential, deadline, expires } = selectGrant(ops, hab, grant, "holder");
     const dh = deps.dhkes.dhke(hab), xid = dh.approve(grant);
     ops.begin({

package/esm/keri/npm/src/app/ipex/pending-presentations.js

@@ -49,7 +49,9 @@ export function pendingPresentations(ops, { hab } = {}) {
 /**
  * The accepted v2 Applies addressed to a local identifier (to `hab` when given) that no exchange has answered
  * (no `erpy` pointer) and whose deadline has not passed; with `includeAnswered`, the answered ones too. Mutates
- * nothing. A group member lists the Applies of its group once the group has accepted them.
+ * nothing. A group member lists the Applies of its group once the group has accepted them. The deadline is the
+ * Apply's own stamp plus the exchange window once KRAM has pruned its cache row, so an expired Apply stays
+ * omitted after the prune.
  */
 export function pendingApplies(deps, { hab, includeAnswered = false } = {}) {
     const { hby, exc, clock } = deps, found = [];
@@ -65,7 +67,7 @@ export function pendingApplies(deps, { hab, includeAnswered = false } = {}) {
         const answer = hby.db.erpy.get([apply])?.qb64 ?? null;
         if (answer && !includeAnswered)
             continue;
-        const deadline = exc.exchangeDeadline(serder), expiry = deadline ? timestampMicros(deadline) : null;
+        const deadline = exc.exchangeExpiry(apply), expiry = deadline ? timestampMicros(deadline) : null;
         if (!answer && expiry !== null && now >= expiry)
             continue;
         const q = serder.sad?.q;

package/esm/keri/npm/src/app/ipex/presenting.js

@@ -47,7 +47,6 @@ import { DeliveryOutbox } from "../runtime/delivery-outbox.js";
 import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
 import { proposeGroupIpex, proposeGroupIpexAfter as groupIpexAfter, } from "./group-ipex.js";
 import { IpexDiscloser, storedExchangeWire, } from "./ipex-discloser.js";
-import { prepareAcdcV2GroupIpex } from "./ipex-grouping.js";
 /** How long delivery failures may last on an exchange with no deadline (an Apply, an Agree) before it reads `failed`. */
 export const PRESENTATION_RETRY_BOUND_MS = 600_000;
 const EXPIRED = "The presentation reached its original exchange deadline";
@@ -220,7 +219,7 @@ export function* proposeGroupPresentation(deps, groupIpex, { hab, selection, opt
     const { presentationRegistry, ...body } = options;
     const gvrsn = body.gvrsn ?? undefined;
     const discloser = discloserFor(deps, hab, selection.derive);
-    let prepared = yield* discloser.prepareGrantBody(hab.pre, selection, body);
+    const prepared = yield* discloser.prepareGrantBody(hab.pre, selection, body);
     if (!presentationRegistry) {
         return yield* proposeGroupIpex(groupIpex, { hab, exn: prepared.exn, nests: prepared.nests, gvrsn, deliver });
     }
@@ -237,26 +236,12 @@ export function* proposeGroupPresentation(deps, groupIpex, { hab, selection, opt
     // The Grant SAID is frozen before the update is anchored; only its nested proof is extended afterwards.
     const [proof, update] = reg.present(prepared.exn, "presented", { stamp: body.stamp });
     const proposed = yield* proposeRegistryEvent(proposals, hab, update, proof, counsel);
-    const exn = prepared.exn;
     return groupIpexAfter(groupIpex, {
         hab,
-        exn,
+        exn: prepared.exn,
         gvrsn,
         deliver,
-        prerequisite: {
-            anchor: registryEventRef(update, proposed.event),
-            *proceed() {
-                const seal = deps.rgy.store.anchor(update.said);
-                if (!seal)
-                    throw new ValidationError("The presentation update is accepted but its anchor is unavailable");
-                prepared = yield* discloser.attachPresentationProof(prepared, proof, { s: seal[0], d: seal[1] });
-                const candidate = concatBytes(Counter.makeGVC(gvrsn ?? Vrsn_2_0), prepared.exn.raw, Counter.enclose({ qb64: prepared.nests, version: gvrsn ?? Vrsn_2_0 }));
-                const own = yield* prepareAcdcV2GroupIpex(deps.hby, groupIpex.deps.protocol, hab, candidate);
-                if (!own)
-                    throw new ValidationError("ACDC v2 group disclosure awaits authenticating dependencies.");
-                return own;
-            },
-        },
+        prerequisite: { anchor: registryEventRef(update, proposed.event), grant: prepared, opening: proof },
     });
 }
 /**

package/esm/keri/npm/src/app/ipex/receive-issuance.js

@@ -48,7 +48,8 @@ export function* admitAndDeliver(deps, input) {
  * wait for the issuer to finish it, then admit and deliver ({@link admitAndDeliver}).
  *
  * @throws ValidationError for a Grant that is not addressed to a local identifier, one this runtime issued, or a
- * group identifier.
+ * group identifier; its subclass `KramRefusedError` (reason `lifetime`, with the deadline) for a Grant whose
+ * deadline passed before the stores could say more (its cache row pruned or the Grant ejected from escrow).
  */
 export function* receiveIssuance(ops, input) {
     const { grant, timeoutMs } = input, { deps } = ops;