keri-ts 2.2.4 → 2.2.6

package/esm/keri/npm/src/app/delivery/relaying.js

@@ -0,0 +1,232 @@
+import { ValidationError } from "../../core/errors.js";
+import { Roles } from "../../core/roles.js";
+import { fetchEndpointUrls } from "../mailbox/mailboxing.js";
+import { messengerUrl } from "../transport/messengering.js";
+import { TransportError } from "../transport/transport-error.js";
+/** The relay's location is not accepted yet (its OOBI has not resolved); nothing was sent. */
+export class RelayUnresolvedError extends ValidationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "RelayUnresolvedError"
+        });
+    }
+}
+/**
+ * The sending identity has not authorized the relay as its `mailbox`; nothing was sent. The agent relays only for a
+ * sender that named it its mailbox, so a wrapper sent before that would be dropped there without an answer.
+ */
+export class RelayUnauthorizedError extends ValidationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "RelayUnauthorizedError"
+        });
+    }
+}
+/** Refuses a request whose origin is neither the relay's OOBI origin nor an accepted relay location. */
+export class RelayOnlyError extends TransportError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "RelayOnlyError"
+        });
+    }
+}
+/**
+ * Read the relay's accepted location, as `Hab.endsFor` reads any endpoint's locations.
+ *
+ * Locations are accepted only from `/loc/scheme` replies verified against the relay's KEL, so a non-null result
+ * means the relay's OOBI (or an equivalent introduction) has resolved. A location no messenger can use
+ * ({@link messengerUrl}: one the HTTP client refuses, or a TCP URL without a port) reads as unresolved.
+ *
+ * @param hby Borrowed accepted-state store holding the relay's location replies.
+ * @param relay The configured relay agent.
+ * @returns The relay's preferred URL and scheme map, or null until a usable location is accepted.
+ */
+export function relayEndpoint(hby, relay) {
+    const accepted = fetchEndpointUrls(hby, relay.aid);
+    const urls = {};
+    if (accepted.https)
+        urls.https = accepted.https;
+    if (accepted.http)
+        urls.http = accepted.http;
+    if (accepted.tcp)
+        urls.tcp = accepted.tcp;
+    const url = messengerUrl(urls);
+    return url ? { eid: relay.aid, url, urls } : null;
+}
+/**
+ * Whether `pre` has authorized the relay as its mailbox: the accepted row `ends.[pre, mailbox, relay.aid]` is
+ * allowed. This is the row the agent reads to decide that it serves the sender, and the edge holds it because it
+ * signed and accepted the end-role reply itself (`addMailbox`).
+ *
+ * @param hby Borrowed accepted-state store holding end-role replies.
+ * @param pre Local identifier that signs what goes to the relay (for a group, its local member).
+ * @param relay The configured relay agent.
+ * @returns True when the mailbox role naming the relay is accepted and allowed.
+ */
+export function relayAuthorized(hby, pre, relay) {
+    return hby.db.ends.get([pre, Roles.mailbox, relay.aid])?.allowed === true;
+}
+/**
+ * Decide whether the relay can carry a message signed by `signer` now, before anything is prepared or sent.
+ *
+ * The relay must have an accepted location. A message it is to forward also needs `signer` to have authorized it as
+ * mailbox; a message addressed to the relay itself (`signer` null) needs no authorization, as the relay consumes it
+ * rather than forwarding it. Onboarding needs neither path: the mailbox add is posted to the relay's `/mailboxes`
+ * admin resource and carries the KEL that introduces the edge.
+ *
+ * @param hby Borrowed accepted-state store holding the relay's location and the signer's end roles.
+ * @param relay The configured relay agent.
+ * @param signer Local identifier that signs the forwarding wrapper or query; null for a message to the relay itself.
+ * @returns The refusal to report, or null when the relay can carry the message.
+ */
+export function relayRefusal(hby, relay, signer) {
+    if (!relayEndpoint(hby, relay)) {
+        return new RelayUnresolvedError(`Relay ${relay.aid} has no accepted location; its OOBI has not resolved.`);
+    }
+    if (signer !== null && !relayAuthorized(hby, signer, relay)) {
+        return new RelayUnauthorizedError(`${signer} has not authorized relay ${relay.aid} as its mailbox.`);
+    }
+    return null;
+}
+/**
+ * Refuse a relay nothing can be composed over: its AID must be non-empty and its OOBI an absolute HTTP(S) URL,
+ * because the egress guard admits the OOBI's origin and the edge resolves that OOBI before anything else. A
+ * composition root (the guard, a wallet) calls it before it opens or sends anything.
+ *
+ * @param relay Candidate relay, possibly from untyped embedder input.
+ * @throws ValidationError when the AID is empty or the OOBI is not an absolute HTTP(S) URL.
+ */
+export function assertRelay(relay) {
+    const aid = relay.aid, oobi = relay.oobi;
+    const origin = typeof oobi === "string" ? originOf(oobi) : null;
+    if (typeof aid !== "string" || !aid || origin === null || !/^https?:\/\//.test(origin)) {
+        throw new ValidationError(`Relay requires an AID and an absolute HTTP(S) OOBI URL; got ${String(oobi)}.`);
+    }
+}
+/**
+ * The onboarding steps still missing for delivery through the relay, derived from accepted state on every call;
+ * nothing records progress. Order is the order to take them: resolve the relay's OOBI, then authorize each
+ * single-signature identifier, then each group (whose inception needs its members to reach each other first).
+ *
+ * Only identifiers with accepted key state are listed: an identifier that has not completed its inception cannot
+ * sign an end-role reply yet. The resolution step comes from {@link relayRefusal}; the authorization steps from
+ * {@link relayAuthorized}, the row both the edge's senders and the relay read.
+ *
+ * @param hby Borrowed accepted-state store holding the relay's location and the local end roles.
+ * @param relay The configured relay agent.
+ * @returns The missing steps; empty when every accepted local identifier can send and receive through the relay.
+ */
+export function relayOnboarding(hby, relay) {
+    const steps = [];
+    if (relayRefusal(hby, relay, null))
+        steps.push({ step: "resolve-oobi", oobi: relay.oobi });
+    const groups = [];
+    for (const hab of hby.habs.values()) {
+        if (!hab.accepted || relayAuthorized(hby, hab.pre, relay))
+            continue;
+        if (hby.db.getHab(hab.pre)?.mid)
+            groups.push({ step: "authorize-group", pre: hab.pre });
+        else
+            steps.push({ step: "authorize-member", pre: hab.pre });
+    }
+    return [...steps, ...groups];
+}
+/**
+ * Scheme and authority of a URL, comparable across `http(s):` and `tcp:` (whose WHATWG `origin` is `"null"`).
+ *
+ * @param url Candidate absolute URL.
+ * @returns `scheme://host[:port]`, or null when the URL does not parse.
+ */
+function originOf(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.host ? `${parsed.protocol}//${parsed.host}` : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a URL addresses the relay: its origin is the relay's own OOBI origin or the origin of a currently accepted
+ * relay location. The accepted locations are read on every call, so a location accepted (or replaced) later is
+ * honored at once. The egress guard refuses everything else, and the edge's Oobiery fetches such a URL directly
+ * while it resolves any other origin's OOBI through the relay.
+ *
+ * @param hby Borrowed accepted-state store holding the relay's location replies.
+ * @param relay The configured relay agent.
+ * @param url Candidate absolute URL.
+ * @returns True when the URL's origin is the relay's.
+ */
+export function isRelayOrigin(hby, relay, url) {
+    const origin = originOf(url);
+    if (origin === null)
+        return false;
+    if (origin === originOf(relay.oobi))
+        return true;
+    return Object.values(fetchEndpointUrls(hby, relay.aid)).some((location) => originOf(location) === origin);
+}
+/**
+ * Refuse egress to anything but the relay (see {@link isRelayOrigin}).
+ *
+ * @param hby Borrowed accepted-state store holding the relay's location replies.
+ * @param relay The configured relay agent.
+ * @param url Requested URL.
+ * @throws RelayOnlyError when the URL's origin is not the relay's.
+ */
+function requireRelayOrigin(hby, relay, url) {
+    if (isRelayOrigin(hby, relay, url))
+        return;
+    throw new RelayOnlyError(`Relay-only egress refused ${originOf(url) ?? "an unparseable URL"}; relay is ${relay.aid}.`);
+}
+/**
+ * Wrap an HTTP client (and its TCP dialer, when present) so it reaches only the relay.
+ *
+ * The guard is the edge's fail-closed boundary: egress kinds not yet routed through the relay (delegation, TEL
+ * receipting, witness registration, well-known authentication) fail as `TransportError` instead of going direct.
+ * It allows the origin of the relay's OOBI and the origins of the relay's currently accepted locations.
+ *
+ * @param inner Borrowed client that performs permitted requests.
+ * @param hby Borrowed accepted-state store holding the relay's location replies.
+ * @param relay The configured relay agent.
+ * @returns A client with the same contract whose refused requests throw RelayOnlyError before any I/O.
+ * @throws ValidationError when the relay's OOBI is not an absolute HTTP(S) URL.
+ */
+export function relayOnlyHttpClient(inner, hby, relay) {
+    assertRelay(relay);
+    const dialer = inner.tcp;
+    const tcp = dialer
+        ? {
+            messenger(url, clock, protocol) {
+                requireRelayOrigin(hby, relay, url);
+                return dialer.messenger(url, clock, protocol);
+            },
+            streamMessenger(url, clock, payload) {
+                requireRelayOrigin(hby, relay, url);
+                return dialer.streamMessenger(url, clock, payload);
+            },
+        }
+        : undefined;
+    return {
+        ...(tcp ? { tcp } : {}),
+        *request(url, init) {
+            requireRelayOrigin(hby, relay, url);
+            return yield* inner.request(url, init);
+        },
+        *open(url, init) {
+            requireRelayOrigin(hby, relay, url);
+            return yield* inner.open(url, init);
+        },
+    };
+}

package/esm/keri/npm/src/app/delivery/respondant.js

@@ -46,26 +46,29 @@ export class Respondant {
      * @param hab Local habitat used to construct/sign this output; stores remain borrowed.
      * @param cues Source Deck; only its current head is interpreted, and removed after full publication.
      * @param hint Optional local sender hint used when cue provenance does not resolve a habitat.
-     * @returns True after complete admission/removal; false if the head has no routable responder output.
+     * @returns What became of the head; see {@link CueOutcome}. Only `taken` removes it.
      * @throws Construction/admission failures leave the source cue present.
      */
     enqueueCue(hab, cues, hint) {
         this.postman.ensureOpen();
         const cue = cues.peekHead();
         if (!cue)
-            return false;
+            return "unrouted";
         const dest = recipientForCue(cue), topic = topicForCue(cue);
         const src = senderHabForCue(this.hby, cue, hint);
         if (this.nothingToSend(cue, dest, topic, src)) {
             cues.pull();
-            return true;
+            return "taken";
         }
         if (!dest || !topic || !src)
-            return false;
+            return "unrouted";
+        // A replay carries already-signed messages; receipts, witness receipts and replies are signed here.
+        if (cue.kin !== "replay" && !hab.canSign())
+            return "unsignable";
         const msgs = [...hab.processCuesIter([cue])];
         this.postman.sendAll(msgs.map((msg) => ({ src: src.pre, dest, topic, msg, replies: true })));
         cues.pull();
-        return true;
+        return "taken";
     }
     /**
      * Whether a receipt cue has nothing to send to. A receipt goes to the controller of the event it receipts, so it

package/esm/keri/npm/src/app/exchanges/exchange-messaging.js

@@ -42,7 +42,7 @@ export function createExchangeMessage(hab, args) {
  */
 export function sendExchangeMessage(hby, hab, http, clock, args) {
     return call(function* () {
-        const postman = new Poster(hby, null, null, http, clock);
+        const postman = new Poster(hby, null, null, http, clock, null);
         yield* resource(function* (provide) {
             try {
                 yield* provide();

package/esm/keri/npm/src/app/exchanges/exchanging.js

@@ -8,7 +8,9 @@ import { verifyExchangeProofs, } from "../../core/exchange/exchange-proofing.js"
 import { nestedIpexRoute, supportsNestedExchange } from "../../core/exchange/protocol-exchanging.js";
 import { Kever } from "../../core/kel/kever.js";
 import { consoleLogger } from "../../core/logger.js";
+import { exchangeWindow } from "../../core/mailbox/kram-policy.js";
 import { messageAttachmentGroups, serializeMessage } from "../../core/protocol-serialization.js";
+import { readPrefixer } from "../../core/wire-fields.js";
 import { hasNests, loadNests, prepareNests, publishNests } from "../../db/exchange/exchange-nests.js";
 import { encodeDateTimeToDater, makeNowIso8601, timestampMicros } from "../../time/mod.js";
 import { groupMemberHasKey } from "../multisig/group-members.js";
@@ -115,6 +117,17 @@ export class Exchanger {
             writable: true,
             value: void 0
         });
+        /**
+         * Lifetimes of the pending exchanges this process's escrow sweep ejected, by SAID. Ejection removes the only
+         * stored body, so this is all that still says when such an exchange expired ({@link exchangeExpiry}). Lost on
+         * restart, by design: no store keeps ejected exchanges.
+         */
+        Object.defineProperty(this, "ejected", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         this.now = now;
         this.hby = hby;
         this.cues = cues ?? new Deck();
@@ -203,6 +216,9 @@ export class Exchanger {
         }
         if (!args.serder.pre || !args.serder.said)
             return reject("Exchange message is missing sender or SAID.");
+        // Proof resolution and every later sender read decode this prefix; a remote value is decided here.
+        if (!readPrefixer(args.serder.pre))
+            return reject(`Exchange sender ${args.serder.pre} is not a valid prefix.`);
         if (args.receiverTime !== undefined && timestampMicros(args.receiverTime) === null) {
             throw new Error("Invalid exchange receiver time");
         }
@@ -328,6 +344,8 @@ export class Exchanger {
         const previous = this.hby.db.exchangeMeta.get([said]);
         const receiverTime = storedReceiverTime(previous) ?? args.receiverTime;
         const mailboxAid = args.mailboxAid ?? previous?.mailboxAid ?? null;
+        // Once imported as retained history an exchange stays so; a retry rebuilds its input from the stores.
+        const retained = previous?.retained === true || args.retained === true;
         const nests = args.nests?.length ? args.nests : loadNests(this.hby.db, said);
         if (nests.length
             && (!handler?.acceptsNests || !supportsNestedExchange(args.serder.route ?? "", args.serder.pvrsn.major))) {
@@ -413,10 +431,11 @@ export class Exchanger {
             mailboxAid,
             ...(receiverTime !== undefined ? { receiverTime } : {}),
             gvrsn: previous?.gvrsn ?? args.gvrsn ?? args.serder.gvrsn ?? args.serder.pvrsn,
+            ...(retained ? { retained } : {}),
         };
         // A retry that learns nothing new leaves the stored record as it is rather than committing it again.
         if (!previous || previous.mailboxAid !== meta.mailboxAid || previous.receiverTime !== meta.receiverTime
-            || JSON.stringify(previous.gvrsn) !== JSON.stringify(meta.gvrsn)) {
+            || JSON.stringify(previous.gvrsn) !== JSON.stringify(meta.gvrsn) || (previous.retained === true) !== retained) {
             this.hby.db.exchangeMeta.pin([said], meta);
         }
         if (pending) {
@@ -430,7 +449,7 @@ export class Exchanger {
             }
             return { decision: pending, cues };
         }
-        return { decision: { kind: "accept", said }, cues, handling };
+        return { decision: { kind: "accept", said }, cues, handling: retained ? { ...handling, retained } : handling };
     }
     /** Retry escrows using ordinary LMDB evidence and retained mailbox provenance. */
     processEscrows() {
@@ -481,13 +500,18 @@ export class Exchanger {
             }
             if (schema && new Diger({ qb64: keys[1] }).qb64 !== keys[1])
                 throw new Error("Corrupt schema escrow dependency.");
+            // Read before ejection removes the metadata that says whether the exchange is retained history.
+            const deadline = this.lifetime(serder);
             const expired = yield* call(() => this.expirePending(serder));
             if (expired) {
+                if (deadline)
+                    this.ejected.set(said, deadline);
                 consoleLogger.warn("Exchanger ejected exchange escrow", {
                     said,
                     pre: serder.pre,
                     route: serder.route,
                     ...expired,
+                    ...(deadline && { deadline }),
                 });
                 continue;
             }
@@ -570,11 +594,8 @@ export class Exchanger {
     }
     /** Original accepted KRAM lifetime; partial-escrow timestamps never authorize live auxiliary work. */
     exchangeDeadline(serder) {
-        const said = serder.said, sender = serder.pre;
-        const xid = serder.ilk === "xip" ? said : serder.sad?.x;
-        if (!said || !sender || typeof xid !== "string" || !xid)
-            return null;
-        const cache = this.hby.db.tmsc.get([sender, xid, said]);
+        const key = transactionCacheKey(serder);
+        const cache = key && this.hby.db.tmsc.get(key);
         if (!cache?.rdt)
             return null;
         const opener = timestampMicros(cache.xdt);
@@ -583,6 +604,36 @@ export class Exchanger {
         }
         return this.deadlineDater(opener + BigInt(cache.xl) * 1000n).dts;
     }
+    /**
+     * When the exchange `said` expires, or expired: its KRAM lifetime, opener plus exchange window. Unlike
+     * {@link exchangeDeadline} this keeps answering after KRAM prunes the cache row (at opener + `pxl`, which the
+     * default windows make the deadline itself) and after the escrow sweep ejects an expired pending exchange, so a
+     * caller can say why the exchange is gone. A pure read. Null when KRAM is off (no exchange window), while KRAM
+     * holds the message without accepting it (an incomplete multi-signature message), for a pruned message that
+     * continues another message's thread, for an ejected exchange after a restart, and for retained history a local
+     * import admitted without KRAM ({@link ExchangeInput.retained}), which never had a window here.
+     */
+    exchangeExpiry(said) {
+        const db = this.hby.db, serder = db.exns.get([said]) ?? db.epse.get([said]);
+        return serder?.said === said ? this.lifetime(serder) : this.ejected.get(said) ?? null;
+    }
+    /**
+     * The accepted lifetime while KRAM keeps the cache row; once the row is pruned, an exchange that opens its own
+     * thread (an `xip`, or an `exn` with no prior, the rule KRAM opened it with) is its own opener, so its stamp
+     * plus the exchange window configured now gives the deadline again. Reads no escrow row, so it also works on
+     * the body of an exchange that is being ejected. Retained history never had a cache row here, so its stamp gives
+     * no deadline: it would only report an old exchange expired for its age.
+     */
+    lifetime(serder) {
+        const accepted = this.exchangeDeadline(serder), key = transactionCacheKey(serder);
+        if (accepted || !key || this.hby.db.tmsc.get(key))
+            return accepted;
+        if (this.hby.db.exchangeMeta.get([serder.said])?.retained === true)
+            return null;
+        const opener = serder.ilk === "xip" || !serder.ked?.p ? timestampMicros(serder.stamp) : null;
+        const window = exchangeWindow(this.hby.db, serder.ilk, serder.route);
+        return opener === null || window === null ? null : this.deadlineDater(opener + BigInt(window) * 1000n).dts;
+    }
     /**
      * Rehydrate authenticated retained factors without route handling or writes.
      * Pending-only access also enforces the original deadline with this owner's
@@ -1104,8 +1155,7 @@ export class Exchanger {
         if (prior && timestampMicros(prior.dts) === null)
             throw new Error("Corrupt missing-schema deadline.");
         if (!prior) {
-            const xid = serder.ilk === "xip" ? said : serder.sad.x;
-            const cache = typeof xid === "string" && xid ? this.hby.db.tmsc.get([serder.pre, xid, said]) : null;
+            const key = transactionCacheKey(serder), cache = key ? this.hby.db.tmsc.get(key) : null;
             const opener = cache && timestampMicros(cache.xdt);
             if (cache && (opener === null || opener === undefined || !Number.isSafeInteger(cache.pxl) || cache.pxl < 0)) {
                 throw new Error("Corrupt missing-schema transaction lifetime.");
@@ -1324,6 +1374,12 @@ export class Exchanger {
         this.hby.db.emsd?.rem([said]);
     }
 }
+/** The KRAM transaction cache key `[sender, xid, said]` of an exchange; null for a message outside a transaction. */
+function transactionCacheKey(serder) {
+    const said = serder.said, sender = serder.pre;
+    const xid = serder.ilk === "xip" ? said : serder.sad?.x;
+    return said && sender && typeof xid === "string" && xid ? [sender, xid, said] : null;
+}
 function normalizeAttachments(ptds) {
     return ptds.map((group) => ({
         raw: group.raw.slice(),

package/esm/keri/npm/src/app/identity/delegating.js

@@ -19,11 +19,21 @@ import { Schemes } from "../../core/schemes.js";
 import { dgKey } from "../../db/core/keys.js";
 import { createExchangeMessage } from "../exchanges/exchange-messaging.js";
 import { isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
-import { sendWitnessMessage } from "../witness/receipt-client.js";
+import { deliverWitnessMessage } from "../witness/receipt-client.js";
 import { eventPayloadMessage, eventReplayMessage } from "./habbing.js";
 export const DELEGATE_REQUEST_ROUTE = "/delegate/request";
 /** Runtime passes to wait between repeated delegator-witness anchor queries. */
 const DELEGATION_ANCHOR_QUERY_RETRY_PASSES = 8;
+/** Keep the delegation request row after the delegator could not take it; the next pass sends it again. */
+function retainedForDelegator(pre, said, error) {
+    return {
+        kind: "keep",
+        pre,
+        said,
+        phase: "waitingWitnessReceipts",
+        reason: `Delegation request is not delivered yet: ${error instanceof Error ? error.message : String(error)}`,
+    };
+}
 function eventKey(serder) {
     const pre = serder.pre;
     const snh = serder.snh;
@@ -410,6 +420,20 @@ export class Anchorer {
         this.http = http;
         this.clock = clock;
     }
+    /** Workflow ids (`pre:snh`) of `pre`'s delegated events still in the `dpwe.`, `dune.` or `dpub.` phase. */
+    pendingOf(pre) {
+        const ids = new Set();
+        const { dpwe, dune, dpub } = this.hby.db;
+        for (const phase of [dpwe, dune, dpub]) {
+            for (const [, serder] of phase.getTopItemIter([pre], { topive: true }))
+                ids.add(workflowId(serder));
+        }
+        return [...ids];
+    }
+    /** Workflow ids whose pinned communication habitat (the proxy that sends the request) is `pre`. */
+    proxiedBy(pre) {
+        return [...this.communicationHabPins].filter(([, pinned]) => pinned === pre).map(([id]) => id);
+    }
     /**
      * Start one delegated event in witness-receipt escrow and replace any previous local proxy pin.
      *
@@ -565,6 +589,16 @@ export class Anchorer {
                 reason: "Delegate witness receipts are not converged yet.",
             };
         }
+        // The request is signed by the communication habitat; one that cannot sign yet keeps the row for a later pass.
+        if (!communicationHab.canSign()) {
+            return {
+                kind: "keep",
+                pre,
+                said,
+                phase: "waitingWitnessReceipts",
+                reason: `Communication habitat ${communicationHab.pre} cannot sign yet; its signer is not held.`,
+            };
+        }
         // Do not ask the delegator to approve until the delegate's own witnesses
         // have receipted the event. That preserves the KERIpy approval ordering
         // and avoids anchoring an event the delegate cannot yet complete.
@@ -588,7 +622,7 @@ export class Anchorer {
         // Admission alone cannot release the next send or the delegation phase transition.
         const requested = yield* postman.wait(request);
         if (requested.kin === "failed")
-            throw requested.error;
+            return retainedForDelegator(pre, said, requested.error);
         const replay = postman.send({
             src: communicationHab.pre,
             dest: delpre,
@@ -597,7 +631,7 @@ export class Anchorer {
         }, { notify: true });
         const replayed = yield* postman.wait(replay);
         if (replayed.kin === "failed")
-            throw replayed.error;
+            return retainedForDelegator(pre, said, replayed.error);
         // KERIpy issues the first delegator-witness anchor query in the same
         // publish phase that forwards the delegation request and raw event bytes.
         // Keep that ordering here so delegate-side approval discovery does not
@@ -657,8 +691,8 @@ export class Anchorer {
         // event is learned locally; pinning `aess.` is what lets delegated unescrow
         // and later reopen paths prove the authorization.
         pinAuthorizingSeal(this.hby, serder, delegating);
-        this.hby.db.dune.rem(keys);
         if ((hab.kever?.wits.length ?? 0) === 0) {
+            this.hby.db.dune.rem(keys);
             this.hby.db.cdel.appendOn(pre, completionDiger(serder));
             this.clearWorkflowPins(serder);
             return {
@@ -669,7 +703,18 @@ export class Anchorer {
                 reason: "Delegator approval is anchored and no witness republication is required.",
             };
         }
-        yield* this.publishDelegator(serder);
+        // A delegator or witness that cannot take the publication keeps this row for the next pass.
+        const published = yield* this.publishDelegator(serder);
+        if (published.kind === "unreachable") {
+            return {
+                kind: "keep",
+                pre,
+                said,
+                phase: "waitingDelegatorAnchor",
+                reason: `Delegation publication is not delivered yet: ${published.error.message}`,
+            };
+        }
+        this.hby.db.dune.rem(keys);
         this.hby.db.dpub.pin(keys, serder);
         return {
             kind: "advance",
@@ -723,6 +768,8 @@ export class Anchorer {
      * Send the delegation chain before the approving event, awaiting actual Poster or witness transmission outcomes.
      *
      * @param serder Accepted delegator event to publish after its required delegation chain.
+     * @returns `unreachable` with the first remote failure (a witness or the delegator that is down, refuses or
+     * has no usable endpoint); nothing past it is attempted. Local faults still throw.
      */
     *publishDelegator(serder) {
         const pre = workflowPre(serder);
@@ -736,7 +783,9 @@ export class Anchorer {
         // matches the witness-visible material KERIpy sends for delegated approval.
         for (const msg of this.hby.db.cloneDelegation(kever)) {
             for (const witness of kever.wits) {
-                yield* sendWitnessMessage(transportHab, witness, msg, this.http, this.clock, this.protocol);
+                const delivery = yield* deliverWitnessMessage(transportHab, witness, msg, this.http, this.clock, this.protocol);
+                if (delivery.kind === "unreachable")
+                    return delivery;
             }
         }
         // Publish the approving event only after the complete delegation chain has been sent.
@@ -750,11 +799,19 @@ export class Anchorer {
                 msg: approvedEvent,
             }, { notify: true });
             const outcome = yield* postman.wait(evt);
-            if (outcome.kin === "failed")
-                throw outcome.error;
+            if (outcome.kin === "failed") {
+                return {
+                    kind: "unreachable",
+                    witness: kever.delpre,
+                    error: outcome.error instanceof Error ? outcome.error : new Error(String(outcome.error)),
+                };
+            }
         }
         for (const witness of kever.wits) {
-            yield* sendWitnessMessage(transportHab, witness, approvedEvent, this.http, this.clock, this.protocol);
+            const delivery = yield* deliverWitnessMessage(transportHab, witness, approvedEvent, this.http, this.clock, this.protocol);
+            if (delivery.kind === "unreachable")
+                return delivery;
         }
+        return { kind: "delivered" };
     }
 }