hiero-ledger · tinker-michaelj · Oct 15, 2025 · Oct 15, 2025 · Oct 16, 2025 · Oct 16, 2025
@@ -160,7 +160,7 @@ public static int countOfCryptographicKeys(@NonNull final Key key) {
                 key.thresholdKeyOrThrow().keysOrElse(KeyList.DEFAULT).keys().stream()
                         .mapToInt(HapiUtils::countOfCryptographicKeys)
                         .sum();
-            case CONTRACT_ID, DELEGATABLE_CONTRACT_ID, UNSET -> 0;
+            case CONTRACT_ID, DELEGATABLE_CONTRACT_ID, INDIRECT_KEY, UNSET -> 0;
         };
     }
 
@@ -438,4 +438,12 @@ private static int parsedIntOrZero(@NonNull final String s) {
             }
         }
     }
+
+    public static AccountID asAccountId(final ContractID contractID) {
+        return AccountID.newBuilder()
+                .shardNum(contractID.shardNum())
+                .realmNum(contractID.realmNum())
+                .accountNum(contractID.contractNumOrThrow())
+                .build();
+    }
 }
@@ -54,6 +54,7 @@
     exports com.hedera.hapi.node.state.blockrecords.codec;
     exports com.hedera.hapi.node.state.blockrecords.schema;
     exports com.hedera.hapi.node.state.blockstream;
+    exports com.hedera.hapi.node.state.systemtask;
     exports com.hedera.hapi.node.state.schedule;
     exports com.hedera.hapi.node.state.primitives;
     exports com.hedera.hapi.node.state.primitives.codec;

@@ -43,8 +43,10 @@ import "services/state/recordcache/recordcache.proto";
 import "services/state/roster/roster.proto";
 import "services/state/roster/roster_state.proto";
 import "services/state/schedule/schedule.proto";
+import "services/state/systemtask/system_task.proto";
 import "services/state/throttles/throttle_usage_snapshots.proto";
 import "services/state/token/account.proto";
+import "services/state/token/indirect_key_users.proto";
 import "services/state/token/account_pending_airdrop.proto";
 import "services/state/token/network_staking_rewards.proto";
 import "services/state/token/node_rewards.proto";
@@ -263,11 +265,21 @@ message StateKey {
      */
     com.hedera.hapi.node.state.hooks.LambdaSlotKey ContractService_I_LAMBDA_STORAGE = 52;
 
+    /**
+     * A state identifier for indirect key users.
+     */
+    proto.IndirectKeyUsersKey TokenService_I_INDIRECT_KEY_USERS = 53;
+
     // Queue states
     /**
      * Queue index for the round receipts queue.
      */
     uint64 RecordCache_I_TRANSACTION_RECEIPTS = 126;
+
+    /**
+     * Queue index for the system task queue.
+     */
+    uint64 SystemTaskService_I_SYSTEM_TASK_QUEUE = 127;
 
     /**
      * Queue index for the `150` upgrade file data.
@@ -339,7 +351,7 @@ message StateKey {
  * </ol>
  */
 message StateValue {
-  oneof value{
+  oneof value {
     /**
      * A state identifier for the next entity Identifier.
      */
@@ -596,11 +608,21 @@ message StateValue {
      */
     proto.SlotValue ContractService_I_LAMBDA_STORAGE = 52;
 
+    /**
+     * Prev/next pointers for indirect key users.
+     */
+    proto.IndirectKeyUsersValue TokenService_I_INDIRECT_KEY_USERS = 53;
+
     /**
      * Metadata of the round receipts queue.
      */
     proto.TransactionReceiptEntries RecordCache_I_TRANSACTION_RECEIPTS = 126;
 
+    /**
+     * Contents of the system task queue.
+     */
+    proto.SystemTask SystemTaskService_I_SYSTEM_TASK_QUEUE = 127;
+
     /**
      * Metadata of the queue state.<br/>
      * Reasons for the field number:
@@ -781,7 +803,12 @@ enum SingletonType {
    * Metadata of the round receipts queue.
    */
   RecordCache_I_TRANSACTION_RECEIPTS = 126;
-
+
+  /**
+   * Metadata of the system tasks queue.
+   */
+  SystemTaskService_I_SYSTEM_TASK_QUEUE = 127;
+
   /**
    * Metadata of the `150` upgrade file data queue.
    */

@@ -1107,6 +1107,28 @@ message Key {
          * running another contract via a `delegatecall`.
          */
         ContractID delegatable_contract_id = 8;
+
+        /**
+         * A key that indirectly references an account or contract key.
+         */
+        IndirectKey indirect_key = 9;
+    }
+}
+
+/**
+ * An indirect key referencing an account or contract.
+ */
+message IndirectKey {
+    oneof target {
+        /**
+         * The account whose key is referenced indirectly.
+         */
+        AccountID account_id = 1;
+
+        /**
+         * The contract whose key is referenced indirectly.
+         */
+        ContractID contract_id = 2;
     }
 }
 

@@ -1771,6 +1771,21 @@ enum ResponseCodeEnum {
      */
     INVALID_SERIALIZED_TX_MESSAGE_HASH_ALGORITHM = 401;
 
+    /**
+     * The system task queue has no more capacity at this time.
+     */
+    SYSTEM_TASK_QUEUE_FULL = 402;
+
+    /**
+     * A complex key used more than the allowed number of indirect references.
+     */
+    INDIRECTION_LIMIT_PER_KEY_EXCEEDED = 403;
+
+    /**
+     * A key indirectly referenced an account or contract that does not exist.
+     */
+    INDIRECTION_KEY_TARGET_NOT_FOUND = 404;
+
     /**
      * An EVM hook execution was throttled due to high network gas utilization.
      */
@@ -1888,6 +1903,7 @@ enum ResponseCodeEnum {
      * The HookCall set in the transaction is invalid
      */
     INVALID_HOOK_CALL = 522;
+
     /**
      *  Hooks are not supported to be used in TokenAirdrop transactions
      */

@@ -79,4 +79,8 @@ message EntityCounts {
    * The number of lambda hook storage slots in the network.
    */
   uint64 num_lambda_storage_slots = 15;
+  /**
+   * The number of pending system tasks in state.
+   */
+  uint64 num_system_tasks = 16;
 }
@@ -0,0 +1,31 @@
+syntax = "proto3";
+
+package proto;
+
+// SPDX-License-Identifier: Apache-2.0
+option java_package = "com.hederahashgraph.api.proto.java";
+// <<<pbj.java_package = "com.hedera.hapi.node.state.systemtask">>> This comment is special code for setting PBJ Compiler java package
+option java_multiple_files = true;
+
+import "services/basic_types.proto";
+
+/**
+ * A request to propagate a materialized key from a key account to its indirect users.
+ */
+message KeyPropagation {
+  /**
+   * The account (possibly  contract account) whose materialized key must be
+   * propagated to indirect users.
+   */
+  AccountID key_account_id = 1;
+}
+
+/**
+ * A system-managed task enqueued for future, yet deterministic, processing.
+ */
+message SystemTask {
+  oneof task {
+    KeyPropagation key_propagation = 1;
+  }
+}
+
@@ -481,6 +481,37 @@ message Account {
      * The number of storage slots in use by this account's lambdas.
      */
     uint64 number_lambda_storage_slots = 38;
+
+    /**
+     * If applicable, the materialized key for this account.
+     * <p>
+     * Never contains indirection if non-null. When set, MUST be used for signature verifications.
+     */
+    Key materialized_key = 39;
+
+    /**
+     * The number of indirect key users currently linked to this account's key.
+     */
+    uint32 num_indirect_key_users = 40;
+
+    /**
+     * The maximum remaining propagations required to distribute the latest key
+     * change to all indirect key users. An upper bound; could overestimate if
+     * some users are deleted or stop using indirection before propagation, but
+     * this is harmless.
+     */
+    uint32 max_remaining_propagations = 41;
+
+    /**
+     * If this account has indirect key users, the first user id in a doubly-linked list.
+     */
+    AccountID first_key_user_id = 42;
+
+    /**
+     * If there is an ongoing propagation (`max_remaining_propagations > 0`), the next
+     * user id in line to receive the latest key change.
+     */
+    AccountID next_in_line_key_user_id = 43;
 }
 
 /**

@@ -0,0 +1,41 @@
+syntax = "proto3";
+
+package proto;
+
+// SPDX-License-Identifier: Apache-2.0
+option java_package = "com.hederahashgraph.api.proto.java";
+// <<<pbj.java_package = "com.hedera.hapi.node.state.token">>> This comment is special code for setting PBJ Compiler java package
+option java_multiple_files = true;
+
+import "services/basic_types.proto";
+
+/**
+ * The key of a mapping in the INDIRECT_KEY_USERS K/V state. Presence means that
+ * `indirect_user_id` is an indirect user of `key_account_id`.
+ */
+message IndirectKeyUsersKey {
+  /**
+   * The account whose key is indirectly used by `indirect_user_id`.
+   */
+  AccountID key_account_id = 1;
+  /**
+   * The account that indirectly uses `key_account_id`'s key.
+   */
+  AccountID indirect_user_id = 2;
+}
+
+/**
+ * The value of a mapping in the INDIRECT_KEY_USERS K/V state. Values forms a
+ * doubly-linked list of indirect users per key account.
+ */
+message IndirectKeyUsersValue {
+  /**
+   * The previous user in the implicit doubly-linked list of indirect users.
+   */
+  AccountID prev_user_id = 1;
+  /**
+   * The next user in the implicit doubly-linked list of indirect users.
+   */
+  AccountID next_user_id = 2;
+}
+