diff --git a/pjsip/include/pjsip-simple/errno.h b/pjsip/include/pjsip-simple/errno.h
index a09def7..966aed9 100644
--- a/pjsip/include/pjsip-simple/errno.h
+++ b/pjsip/include/pjsip-simple/errno.h
@@ -23,47 +23,53 @@
 #include <pjsip/sip_errno.h>
 
 /**
+ * Start of error code relative to PJ_ERRNO_START_USER.
+ */
+#define PJSIP_SIMPLE_ERRNO_START  (PJ_ERRNO_START_USER + PJ_ERRNO_SPACE_SIZE*2)
+
+
+/**
  * @hideinitializer
  * No event package with the specified name.
  */
-#define PJSIP_SIMPLE_ENOPKG	    -1
+#define PJSIP_SIMPLE_ENOPKG	    (PJSIP_SIMPLE_ERRNO_START+1)    /*270001*/
 /**
  * @hideinitializer
  * Event package already exists.
  */
-#define PJSIP_SIMPLE_EPKGEXISTS	    -1
+#define PJSIP_SIMPLE_EPKGEXISTS	    (PJSIP_SIMPLE_ERRNO_START+2)    /*270002*/
 
 
 /**
  * @hideinitializer
  * Expecting SUBSCRIBE request
  */
-#define PJSIP_SIMPLE_ENOTSUBSCRIBE  -1
+#define PJSIP_SIMPLE_ENOTSUBSCRIBE  (PJSIP_SIMPLE_ERRNO_START+20)   /*270020*/
 /**
  * @hideinitializer
  * No presence associated with subscription
  */
-#define PJSIP_SIMPLE_ENOPRESENCE    -1
+#define PJSIP_SIMPLE_ENOPRESENCE    (PJSIP_SIMPLE_ERRNO_START+21)   /*270021*/
 /**
  * @hideinitializer
  * No presence info in server subscription
  */
-#define PJSIP_SIMPLE_ENOPRESENCEINFO -1
+#define PJSIP_SIMPLE_ENOPRESENCEINFO (PJSIP_SIMPLE_ERRNO_START+22)  /*270022*/
 /**
  * @hideinitializer
  * Bad Content-Type
  */
-#define PJSIP_SIMPLE_EBADCONTENT    -1
+#define PJSIP_SIMPLE_EBADCONTENT    (PJSIP_SIMPLE_ERRNO_START+23)   /*270023*/
 /**
  * @hideinitializer
  * Bad PIDF Message
  */
-#define PJSIP_SIMPLE_EBADPIDF	    -1
+#define PJSIP_SIMPLE_EBADPIDF	    (PJSIP_SIMPLE_ERRNO_START+24)   /*270024*/
 /**
  * @hideinitializer
  * Bad XPIDF Message
  */
-#define PJSIP_SIMPLE_EBADXPIDF	    -1
+#define PJSIP_SIMPLE_EBADXPIDF	    (PJSIP_SIMPLE_ERRNO_START+25)   /*270025*/
 
 
 
diff --git a/pjsip/include/pjsip-simple/evsub.h b/pjsip/include/pjsip-simple/evsub.h
index ee6315e..1977ee4 100644
--- a/pjsip/include/pjsip-simple/evsub.h
+++ b/pjsip/include/pjsip-simple/evsub.h
@@ -76,6 +76,19 @@
 typedef enum pjsip_evsub_state pjsip_evsub_state;
 
 
+/**
+ * Some options for the event subscription.
+ */
+enum
+{
+    /** 
+     * If this flag is set, then outgoing request to create subscription
+     * will not have id in the Event header (e.g. in REFER request). But if 
+     * there is an id in the incoming NOTIFY, that id will be used.
+     */
+    PJSIP_EVSUB_NO_EVENT_ID  = 1,
+};
+
 
 /**
  * This structure describes callback that is registered by application or
@@ -244,6 +257,7 @@
  * @param dlg		The underlying dialog to use.
  * @param user_cb	Callback to receive event subscription notifications.
  * @param event		Event name.
+ * @param option	Bitmask of options.
  * @param p_evsub	Pointer to receive event subscription instance.
  *
  * @return		PJ_SUCCESS on success.
@@ -251,6 +265,7 @@
 PJ_DECL(pj_status_t) pjsip_evsub_create_uac( pjsip_dialog *dlg,
 					     const pjsip_evsub_user *user_cb,
 					     const pj_str_t *event,
+					     unsigned option,
 					     pjsip_evsub **p_evsub);
 
 /**
@@ -260,6 +275,7 @@
  * @param user_cb	Callback to receive event subscription notifications.
  * @param rdata		The incoming request that creates the event 
  *			subscription, such as SUBSCRIBE or REFER.
+ * @param option	Bitmask of options.
  * @param p_evsub	Pointer to receive event subscription instance.
  *
  * @return		PJ_SUCCESS on success.
@@ -267,6 +283,7 @@
 PJ_DECL(pj_status_t) pjsip_evsub_create_uas( pjsip_dialog *dlg,
 					     const pjsip_evsub_user *user_cb,
 					     pjsip_rx_data *rdata,
+					     unsigned option,
 					     pjsip_evsub **p_evsub);
 
 
@@ -366,7 +383,10 @@
 
 
 /**
- * Send request message.
+ * Send request message that was previously created with initiate(), notify(),
+ * or current_notify(). Application may also send request created with other
+ * functions, e.g. authentication. But the request MUST be either request
+ * that creates/refresh subscription or NOTIFY request.
  *
  * @param sub		The event subscription object.
  * @param tdata		Request message to be send.
diff --git a/pjsip/include/pjsip-simple/presence.h b/pjsip/include/pjsip-simple/presence.h
index e02498a..8559d91 100644
--- a/pjsip/include/pjsip-simple/presence.h
+++ b/pjsip/include/pjsip-simple/presence.h
@@ -202,7 +202,10 @@
 
 
 /**
- * Send request.
+ * Send request message that was previously created with initiate(), notify(),
+ * or current_notify(). Application may also send request created with other
+ * functions, e.g. authentication. But the request MUST be either request
+ * that creates/refresh subscription or NOTIFY request.
  *
  * @param sub		The subscription object.
  * @param tdata		Request message to be sent.
diff --git a/pjsip/include/pjsip-ua/sip_inv.h b/pjsip/include/pjsip-ua/sip_inv.h
index 21258cb..90d0d5a 100644
--- a/pjsip/include/pjsip-ua/sip_inv.h
+++ b/pjsip/include/pjsip-ua/sip_inv.h
@@ -97,16 +97,13 @@
     /**
      * This callback is called when the invite session has received 
      * new offer from peer. Application can inspect the remote offer 
-     * by calling negotiator's pjmedia_sdp_neg_get_neg_remote(), and 
-     * optionally specify a modified answer. 
-     *
-     * This callback is optional. When it's not specified, the default 
-     * behavior is nothing. After calling this callback, the negotiator 
-     * will negotiate remote offer with session's initial capability.
+     * in "offer". 
      *
      * @param inv	The invite session.
+     * @param offer	Remote offer.
      */
-    void (*on_rx_offer)(pjsip_inv_session *inv);
+    void (*on_rx_offer)(pjsip_inv_session *inv,
+			const pjmedia_sdp_session *offer);
 
     /**
      * This callback is called after SDP offer/answer session has completed.
@@ -121,7 +118,6 @@
      */
     void (*on_media_update)(pjsip_inv_session *inv_ses, 
 			    pj_status_t status);
-
 };
 
 
@@ -387,23 +383,20 @@
 					pjsip_tx_data **p_tdata );
 
 
-#if 0
- If we implement this, we need to send SDP answer automatically on 
- subsequent request/response. Something like "has_answer" flag.
-
 /**
- * Set local answer to respond to remote SDP offer. By calling this function,
- * application can start SDP negotiation immediately without having to
- * send any request or response message. This function is normally called
- * when on_rx_offer() callback is called.
+ * Set local answer to respond to remote SDP offer, to be carried by 
+ * subsequent response (or request).
  *
  * @param inv		The invite session.
  * @param sdp		The SDP description which will be set as answer
  *			to remote.
+ *
+ * @return		PJ_SUCCESS if local answer can be accepted by
+ *			SDP negotiator.
  */
-PJ_DECL(pj_status_t) pjsip_inv_set_sdp_answer( pjsip_inv_session *inv,
-					       const pjmedia_sdp_session *sdp );
-#endif
+PJ_DECL(pj_status_t) pjsip_inv_set_sdp_answer(pjsip_inv_session *inv,
+					      const pjmedia_sdp_session *sdp );
+
 
 /**
  * Create a SIP message to initiate invite session termination. Depending on 
diff --git a/pjsip/include/pjsip-ua/sip_xfer.h b/pjsip/include/pjsip-ua/sip_xfer.h
new file mode 100644
index 0000000..16eb195
--- /dev/null
+++ b/pjsip/include/pjsip-ua/sip_xfer.h
@@ -0,0 +1,175 @@
+/* $Id$ */
+/* 
+ * Copyright (C) 2003-2006 Benny Prijono <benny@prijono.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
+ */
+#ifndef __PJSIP_XFER_H__
+#define __PJSIP_XFER_H__
+
+
+
+/**
+ * @file sip_xfer.h
+ * @brief SIP Transfer (REFER, RFC 3515)
+ */
+#include <pjsip-simple/evsub.h>
+#include <pjsip/sip_msg.h>
+
+
+
+PJ_BEGIN_DECL
+
+
+/**
+ * Declaration for REFER method constant.
+ */
+extern const pjsip_method pjsip_refer_method;
+
+
+/**
+ * Initialize the REFER subsystem.
+ * This currently does very little (only register REFER as supported method).
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_init_module(pjsip_endpoint *endpt);
+
+
+
+/**
+ * Create transferer (sender of REFER request).
+ *
+ * @param dlg		The underlying dialog to use.
+ * @param user_cb	Pointer to callbacks to receive presence subscription
+ *			events.
+ * @param p_evsub	Pointer to receive the presence subscription
+ *			session.
+ *
+ * @return		PJ_SUCCESS on success.
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_create_uac( pjsip_dialog *dlg,
+					    const pjsip_evsub_user *user_cb,
+					    pjsip_evsub **p_evsub );
+
+
+/**
+ * Create transferee (receiver of REFER request).
+ *
+ * @param dlg		The underlying dialog to use.
+ * @param user_cb	Pointer to callbacks to receive presence subscription
+ *			events.
+ * @param rdata		The incoming SUBSCRIBE request that creates the event 
+ *			subscription.
+ * @param p_evsub	Pointer to receive the presence subscription
+ *			session.
+ *
+ * @return		PJ_SUCCESS on success.
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_create_uas( pjsip_dialog *dlg,
+					    const pjsip_evsub_user *user_cb,
+					    pjsip_rx_data *rdata,
+					    pjsip_evsub **p_evsub );
+
+/**
+ * Call this function to create request to initiate REFER subscription,
+ * to refresh subscription, or to unsubscribe. For request other than
+ * the initial REFER request, "refer_to_uri" argument may be NULL.
+ *
+ * @param sub		Client subscription instance.
+ * @param refer_to_uri	URI to be put to the Refer-To header. This argument
+ *			may be NULL for subsequent REFER requests.
+ * @param p_tdata	Pointer to receive the request.
+ *
+ * @return		PJ_SUCCESS on success.
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_initiate( pjsip_evsub *sub,
+					  const pj_str_t *refer_to_uri,
+					  pjsip_tx_data **p_tdata);
+
+
+/**
+ * Accept the incoming REFER request by sending 2xx response.
+ *
+ * @param sub		Server subscription instance.
+ * @param rdata		The incoming subscription request message.
+ * @param st_code	Status code, which MUST be 2xx.
+ * @param hdr_list	Optional list of headers to be added in the response.
+ *
+ * @return		PJ_SUCCESS on success.
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_accept( pjsip_evsub *sub,
+					pjsip_rx_data *rdata,
+				        int st_code,
+					const pjsip_hdr *hdr_list );
+
+
+/**
+ * For notifier, create NOTIFY request to subscriber, and set the state 
+ * of the subscription. 
+ *
+ * @param sub		The server subscription (notifier) instance.
+ * @param state		New state to set.
+ * @param xfer_st_code	The call status code to be reported with the NOTIFY
+ *			request.
+ * @param xfer_st_text	Optional call status text to be reported with the 
+ *			NOTIFY request. If the value is NULL, default 
+ *			status text will be used.
+ * @param p_tdata	Pointer to receive the request.
+ *
+ * @return		PJ_SUCCESS on success.
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_notify( pjsip_evsub *sub,
+					pjsip_evsub_state state,
+					int xfer_st_code,
+					const pj_str_t *xfer_st_text,
+					pjsip_tx_data **p_tdata);
+
+
+/**
+ * Create NOTIFY request to reflect current subscription status. Application
+ * can only call this function after it has sent NOTIFY before.
+ * This will also re-send the last "message/sipfrag" body that was sent
+ * in the previous NOTIFY.
+ *
+ * @param sub		Server subscription object.
+ * @param p_tdata	Pointer to receive request.
+ *
+ * @return		PJ_SUCCESS on success.
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_current_notify( pjsip_evsub *sub,
+					        pjsip_tx_data **p_tdata );
+
+
+
+/**
+ * Send request message that was previously created with initiate(), notify(),
+ * or current_notify(). Application may also send request created with other
+ * functions, e.g. authentication. But the request MUST be either request
+ * that creates/refresh subscription or NOTIFY request.
+ *
+ *
+ * @param sub		The event subscription object.
+ * @param tdata		Request message to be send.
+ *
+ * @return		PJ_SUCCESS on success.
+ */
+PJ_DECL(pj_status_t) pjsip_xfer_send_request( pjsip_evsub *sub,
+					      pjsip_tx_data *tdata);
+
+
+
+PJ_END_DECL
+
+#endif	/* __PJSIP_XFER_H__ */
+
diff --git a/pjsip/include/pjsip/sip_dialog.h b/pjsip/include/pjsip/sip_dialog.h
index 6a0441f..d4454a8 100644
--- a/pjsip/include/pjsip/sip_dialog.h
+++ b/pjsip/include/pjsip/sip_dialog.h
@@ -41,6 +41,7 @@
 typedef struct pjsip_dlg_party
 {
     pjsip_fromto_hdr	*info;	    /**< From/To header, inc tag.	*/
+    pj_str_t		 info_str;  /**< String rep of info header.	*/
     pj_uint32_t		 tag_hval;  /**< Hashed value of the tag.	*/
     pjsip_contact_hdr	*contact;   /**< Contact header.		*/
     pj_int32_t		 first_cseq;/**< First CSeq seen.		*/
@@ -76,8 +77,9 @@
     void	       *dlg_set;
 
     /* Dialog's session properties. */
-    enum pjsip_dialog_state	state;	    /**< Dialog state.			    */
+    pjsip_dialog_state	state;	    /**< Dialog state.			    */
     pjsip_uri	       *target;	    /**< Current target.		    */
+    pjsip_hdr	        inv_hdr;    /**< Headers from hparam in dest URL    */
     pjsip_dlg_party     local;	    /**< Local party info.		    */
     pjsip_dlg_party     remote;	    /**< Remote party info.		    */
     pjsip_role_e	role;	    /**< Initial role.			    */
diff --git a/pjsip/include/pjsip/sip_errno.h b/pjsip/include/pjsip/sip_errno.h
index 70cd884..8915334 100644
--- a/pjsip/include/pjsip/sip_errno.h
+++ b/pjsip/include/pjsip/sip_errno.h
@@ -171,6 +171,11 @@
  * Missing message body.
  */
 #define PJSIP_EMISSINGBODY	(PJSIP_ERRNO_START_PJSIP + 54)	/* 171054 */
+/**
+ * @hideinitializer
+ * Invalid/unexpected method.
+ */
+#define PJSIP_EINVALIDMETHOD	(PJSIP_ERRNO_START_PJSIP + 55)	/* 171055 */
 
 
 /************************************************************
@@ -347,6 +352,17 @@
  * Missing From/To tag.
  */
 #define PJSIP_EMISSINGTAG	 (PJSIP_ERRNO_START_PJSIP+120)	/* 171120 */
+/**
+ * @hideinitializer
+ * Expecting REFER method
+ */
+#define PJSIP_ENOTREFER		 (PJSIP_ERRNO_START_PJSIP+121)	/* 171121 */
+/**
+ * @hideinitializer
+ * Not associated with REFER subscription
+ */
+#define PJSIP_ENOREFERSESSION	 (PJSIP_ERRNO_START_PJSIP+122)	/* 171122 */
+
 
 
 
diff --git a/pjsip/include/pjsip/sip_msg.h b/pjsip/include/pjsip/sip_msg.h
index 0cef6a3..f4649d9 100644
--- a/pjsip/include/pjsip/sip_msg.h
+++ b/pjsip/include/pjsip/sip_msg.h
@@ -584,6 +584,22 @@
 				    char *buf, pj_size_t size);
 
 /**
+ * General purpose function to clone textual data in a SIP body. Attach this
+ * function as "clone_data" member of the SIP body only if the data type
+ * is a text (i.e. C string, not pj_str_t), and the length indicates the
+ * length of the text.
+ *
+ *  @param pool		Pool used to clone the data.
+ *  @param data		Textual data.
+ *  @param len		The length of the string.
+ *
+ *  @return		New text duplicated from the original text.
+ */
+PJ_DECL(void*) pjsip_clone_text_data( pj_pool_t *pool, const void *data,
+				      unsigned len);
+
+
+/**
  * Clone the message body in src_body to the dst_body. This will duplicate
  * the contents of the message body using the \a clone_data member of the
  * source message body.
diff --git a/pjsip/include/pjsip_ua.h b/pjsip/include/pjsip_ua.h
index f6fbdad..205ef75 100644
--- a/pjsip/include/pjsip_ua.h
+++ b/pjsip/include/pjsip_ua.h
@@ -21,6 +21,7 @@
 
 #include <pjsip-ua/sip_inv.h>
 #include <pjsip-ua/sip_regc.h>
+#include <pjsip-ua/sip_xfer.h>
 
 
 #endif	/* __PJSIP_UA_H__ */