keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/core/kel/kever-decisions.js

@@ -0,0 +1,70 @@
+import { consoleLogger } from "../logger.js";
+/** Builder for one successfully applied escrow row. */
+export function acceptEscrow() {
+    return { kind: "accept" };
+}
+/** Builder for one recoverable miss that should remain escrowed. */
+export function keepEscrow(reason, message) {
+    return { kind: "keep", reason, message };
+}
+/**
+ * Describe a terminal outcome without removing its escrow row.
+ *
+ * @param reason Existing protocol or stored-artifact reason for removal.
+ * @param message Specific validation detail, when available.
+ * @param cause Original caught validation failure; omitted for ordinary decisions.
+ * @returns The decision for the owner to apply and report after removal.
+ */
+export function dropEscrow(reason, message, cause) {
+    return { kind: "drop", reason, message, ...(cause !== undefined ? { cause } : {}) };
+}
+/**
+ * Report a terminal escrow removal after its owning write has succeeded.
+ *
+ * Accepted work and recoverable misses are silent. An original validation error
+ * remains available to the logger with its stack and cause.
+ *
+ * @param scope Owner, escrow family and identifying coordinates of the removed row.
+ * @param decision Replay outcome whose removal has already completed.
+ * @param logger Existing diagnostic sink; defaults to the process console logger.
+ */
+export function logEscrowDecision(scope, decision, logger = consoleLogger) {
+    if (decision.kind !== "drop") {
+        return;
+    }
+    const detail = `${scope}: escrow removed (${decision.reason})${decision.message ? `: ${decision.message}` : ""}`;
+    if (decision.cause !== undefined)
+        logger.warn(detail, decision.cause);
+    else
+        logger.warn(detail);
+}
+/** Builder for live receipt material that was successfully applied. */
+export function acceptReceipt() {
+    return { kind: "accept" };
+}
+/** Builder for one live receipt branch that should be ignored. */
+export function ignoreReceipt() {
+    return { kind: "ignore" };
+}
+/** Builder for one live receipt branch that must be escrowed. */
+export function escrowReceipt(reason) {
+    return { kind: "escrow", reason };
+}
+/** Builder for one terminal live receipt outcome that should be dropped. */
+export function dropReceipt(reason) {
+    return { kind: "drop", reason };
+}
+/** Builder for one successfully handled live query. */
+export function acceptQuery(cues) {
+    return cues && cues.length > 0
+        ? { kind: "accept", cues }
+        : { kind: "accept" };
+}
+/** Builder for one live query that should be escrowed. */
+export function escrowQuery(reason) {
+    return { kind: "escrow", reason };
+}
+/** Builder for one live query that should be dropped. */
+export function dropQuery(reason) {
+    return { kind: "drop", reason };
+}

package/esm/keri/npm/src/core/{kever.js → kel/kever.js}

@@ -1,9 +1,8 @@
 import { Dater, Diger, Ilks, NumberPrimitive, Prefixer, SealSource, Siger, Tholder, Verfer, } from "cesr-ts";
-import { dgKey } from "../db/core/keys.js";
-import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
-import { Deck } from "./deck.js";
-import { ValidationError } from "./errors.js";
-import { KeyStateRecord } from "./records.js";
+import { dgKey } from "../../db/core/keys.js";
+import { encodeDateTimeToDater, makeNowIso8601 } from "../../time/mod.js";
+import { ValidationError } from "../errors.js";
+import { KeyStateRecord } from "../records.js";
 import { deriveRotatedWitnessSet } from "./witnesses.js";
 /**
  * Convert one integer into the Huge-number CESR family used for durable replay
@@ -76,6 +75,8 @@ const THOLDER_NUMERIC_CAPACITIES = [
  *   instead of using exceptions as regular control flow
  * - exceptions remain for invariant failures, corrupt durable state, and misuse
  *   of accepted-state-only helpers
+ * - decisions describe follow-up cues; this state machine neither owns a queue
+ *   nor admits, publishes, or retires runtime work
  */
 export class Kever {
     /**
@@ -85,19 +86,13 @@ export class Kever {
      * and accepted-transition materialization do not have to fight over one
      * constructor policy.
      */
-    constructor(db, cues) {
+    constructor(db) {
         Object.defineProperty(this, "db", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "cues", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         Object.defineProperty(this, "version", {
             enumerable: true,
             configurable: true,
@@ -219,22 +214,21 @@ export class Kever {
             value: null
         });
         this.db = db;
-        this.cues = cues ?? new Deck();
     }
     /** Rebuild one live `Kever` from durable key-state content. */
     static fromState(init) {
-        const kever = new Kever(init.db, init.cues);
+        const kever = new Kever(init.db);
         kever.reload(init.state);
         return kever;
     }
     /**
      * Materialize one live `Kever` from an already accepted transition.
      *
-     * This constructor bypasses durable-event reload because `applyDecision()`
+     * This constructor bypasses durable-event reload because Kevery
      * may need a working `Kever` instance before the event state has been persisted.
      */
-    static fromTransition(transition, { db, cues }) {
-        const kever = new Kever(db, cues);
+    static fromTransition(transition, { db }) {
+        const kever = new Kever(db);
         kever.loadState(transition.state, transition.log.serder);
         return kever;
     }
@@ -399,11 +393,10 @@ export class Kever {
             state: provisionalState,
             log: eventState,
         };
-        const runtime = { db: init.db, cues: init.cues };
         // Attachment validation needs a live kever-shaped view of the provisional
         // state because local/remote witness and delegation rules are defined in
         // terms of accepted-state helpers, not raw inception fields.
-        const scratch = Kever.fromTransition(icpTransition, runtime);
+        const scratch = Kever.fromTransition(icpTransition, { db: init.db });
         // This is the TypeScript equivalent of KERIpy's controller-signature,
         // witness-receipt, and delegation-validation pass, expressed as a typed
         // attachment decision.
@@ -448,6 +441,7 @@ export class Kever {
                 },
             },
             cues: attachments.attachments.cues,
+            ...(attachments.sourceSealRepairs ? { sourceSealRepairs: attachments.sourceSealRepairs } : {}),
         };
     }
     /** Evaluate one non-inceptive event against the current accepted state. */
@@ -483,7 +477,9 @@ export class Kever {
      * attachment decision.
      */
     static validateAttachments(input) {
-        return input.kever.validateAttachmentsInternal(input);
+        const repairs = [];
+        const decision = input.kever.validateAttachmentsInternal(input, repairs);
+        return repairs.length ? { ...decision, sourceSealRepairs: repairs } : decision;
     }
     /**
      * Reload all live `Kever` state from one persisted `KeyStateRecord`.
@@ -533,84 +529,6 @@ export class Kever {
             di: this.delpre ?? "",
         });
     }
-    /** Fix log metadata and clone cues before any accepted-event writes. */
-    prepareLogEvent(args) {
-        const pre = args.serder.pre;
-        if (!pre || !args.serder.said || args.serder.sn === null) {
-            throw new ValidationError("logEvent requires pre, said, and sn.");
-        }
-        const fn = args.first ? this.db.nextFelOrdinal(pre) : null;
-        const dater = args.frc?.dt ?? new Dater({ qb64: encodeDateTimeToDater(makeNowIso8601()) });
-        const cues = [];
-        if (fn !== null && args.frc && fn !== Number(args.frc.f.num)) {
-            cues.push({ kin: "noticeBadCloneFN", serder: args.serder, fn, firner: args.frc.f, dater: args.frc.dt });
-        }
-        return { fn, dater, cues };
-    }
-    /**
-     * Idempotently log one verified accepted event into the durable KEL surface.
-     *
-     * This is the shared logging seam used by fresh acceptance, late signatures,
-     * and future replay/recovery flows.
-     *
-     * Logging rules are intentionally split:
-     * - accepted-event material (`dtss.`, `sigs.`, `wigs.`, `wits.`, `evts.`) is
-     *   always safe to write idempotently
-     * - delegator source seals are only persisted for accepted delegated
-     *   non-`ixn` events so provisional or malicious source-seal attachments do
-     *   not become accepted state
-     * - first-seen effects (`fels.`/`fons.`) use prepared metadata; Kevery
-     *   admits and publishes replay-fn anomaly cues outside this write seam
-     */
-    logEvent(args, prepared) {
-        const local = args.local ?? false;
-        const pre = args.serder.pre;
-        const said = args.serder.said;
-        const sn = args.serder.sn;
-        if (!pre || !said || sn === null) {
-            throw new ValidationError("logEvent requires pre, said, and sn.");
-        }
-        const first = args.first ?? false;
-        const { fn, dater: nowDater } = prepared;
-        if (fn !== (first ? this.db.nextFelOrdinal(pre) : null)) {
-            throw new Error("Prepared first-seen ordinal changed before logging");
-        }
-        const dgkey = dgKey(pre, said);
-        this.db.dtss.put(dgkey, nowDater);
-        if (args.sigers && args.sigers.length > 0) {
-            this.db.sigs.put(dgkey, [...args.sigers]);
-        }
-        if (args.wigers && args.wigers.length > 0) {
-            this.db.wigs.put(dgkey, [...args.wigers]);
-        }
-        if (args.wits && args.wits.length > 0) {
-            this.db.wits.put(dgkey, args.wits.map((wit) => new Prefixer({ qb64: wit })));
-        }
-        this.db.evts.put(dgkey, args.serder);
-        if (args.sourceSeal && this.delegated && args.serder.ilk !== Ilks.ixn) {
-            this.db.aess.pin(dgkey, [
-                normalizeOrdinal(sourceSealOrdinal(args.sourceSeal)),
-                sourceSealDigest(args.sourceSeal),
-            ]);
-        }
-        const existingEsr = this.db.esrs.get(dgkey);
-        if (existingEsr) {
-            if (local && !existingEsr.local) {
-                existingEsr.local = true;
-                this.db.esrs.pin(dgkey, existingEsr);
-            }
-        }
-        else {
-            this.db.esrs.put(dgkey, { local });
-        }
-        if (first) {
-            if (this.db.appendFel(pre, said) !== fn)
-                throw new Error("First-seen append disagrees with preparation");
-            this.db.dtss.pin(dgkey, nowDater);
-            this.db.fons.pin(dgkey, encodeHugeOrdinal(fn));
-        }
-        this.db.kels.add(pre, sn, said);
-    }
     /**
      * Return the exposed prior-next digest indices satisfied by `sigers`.
      *
@@ -675,19 +593,19 @@ export class Kever {
      *
      * This is the TypeScript equivalent of KERIpy's
      * `fetchDelegatingEvent(... original=...)`. When an accepted delegated event
-     * is rediscovered via the KEL walk, the `.aess` hint is repaired so later
-     * recursive delegation-recovery checks can start from durable source-seal
-     * state instead of re-walking the KEL every time.
+     * is rediscovered via the KEL walk, return its `.aess` repair in the decision.
+     * Kevery persists repairs after queue admission under the processing writer;
+     * later lookups within this validation see the pending repair immediately.
      */
-    fetchDelegatingEvent(delpre, serder, { sourceSeal, original = false, eager = false, } = {}) {
+    fetchDelegatingEvent(delpre, serder, { sourceSeal, original = false, eager = false, repairs, }) {
         if (original) {
-            const stored = this.acceptedSourceSealForEvent(serder);
+            const stored = this.acceptedSourceSealForEvent(serder, repairs);
             if (stored) {
                 const exact = this.lookupAcceptedDelegatingEvent(delpre, stored, serder);
                 if (exact) {
                     return exact;
                 }
-                this.dropAcceptedSourceSeal(serder);
+                this.dropAcceptedSourceSeal(serder, repairs);
             }
             if (!eager) {
                 return null;
@@ -696,7 +614,7 @@ export class Kever {
                 original: true,
             });
             if (found) {
-                this.repairAcceptedSourceSeal(serder, found);
+                this.repairAcceptedSourceSeal(serder, found, repairs);
             }
             return found;
         }
@@ -706,11 +624,11 @@ export class Kever {
                 return hinted;
             }
         }
-        const stored = this.acceptedSourceSealForEvent(serder);
+        const stored = this.acceptedSourceSealForEvent(serder, repairs);
         if (stored) {
             const authoritative = this.lookupAuthoritativeDelegatingEvent(delpre, stored, serder);
             if (authoritative) {
-                this.repairAcceptedSourceSeal(serder, authoritative);
+                this.repairAcceptedSourceSeal(serder, authoritative, repairs);
                 return authoritative;
             }
         }
@@ -721,7 +639,7 @@ export class Kever {
             original: false,
         });
         if (found) {
-            this.repairAcceptedSourceSeal(serder, found);
+            this.repairAcceptedSourceSeal(serder, found, repairs);
         }
         return found;
     }
@@ -828,7 +746,8 @@ export class Kever {
         if (!derived) {
             return Kever.reject("invalidWitnessSet", `Rotation ${serder.said ?? "<unknown>"} carries invalid witness cuts/adds.`);
         }
-        const attachments = this.validateAttachmentsInternal({
+        const attachments = Kever.validateAttachments({
+            kever: this,
             serder,
             sigers: init.sigers,
             wigers: init.wigers ?? [],
@@ -894,6 +813,7 @@ export class Kever {
                 },
             },
             cues: attachments.attachments.cues,
+            ...(attachments.sourceSealRepairs ? { sourceSealRepairs: attachments.sourceSealRepairs } : {}),
         };
     }
     /**
@@ -918,7 +838,8 @@ export class Kever {
         if (serder.prior !== this.said) {
             return Kever.reject("invalidPriorDigest", `Interaction prior ${String(serder.prior)} does not match current SAID ${this.said}.`);
         }
-        const attachments = this.validateAttachmentsInternal({
+        const attachments = Kever.validateAttachments({
+            kever: this,
             serder,
             sigers: init.sigers,
             wigers: init.wigers ?? [],
@@ -980,6 +901,7 @@ export class Kever {
                 },
             },
             cues: attachments.attachments.cues,
+            ...(attachments.sourceSealRepairs ? { sourceSealRepairs: attachments.sourceSealRepairs } : {}),
         };
     }
     /**
@@ -999,7 +921,7 @@ export class Kever {
      * `escrow`, or `reject` instead of raising the KERIpy family of normal
      * control-flow exceptions.
      */
-    validateAttachmentsInternal(input) {
+    validateAttachmentsInternal(input, repairs) {
         const remoteMemberedCues = [];
         const verfers = [...input.verfers];
         const sigers = [...input.sigers];
@@ -1087,11 +1009,11 @@ export class Kever {
                     ...remoteMemberedCues,
                     {
                         kin: "query",
+                        route: "logs",
                         q: {
-                            pre: input.serder.pre ?? undefined,
-                            sn: input.serder.snh ?? undefined,
+                            s: input.serder.snh ?? undefined,
                         },
-                        pre: input.serder.pre ?? undefined,
+                        pre,
                     },
                 ]);
             }
@@ -1103,7 +1025,7 @@ export class Kever {
             ...input,
             delpre,
             sourceSeal: input.sourceSeal ?? null,
-        });
+        }, repairs);
         if (delegation.kind !== "verified") {
             if (remoteMemberedCues.length > 0 && delegation.kind === "escrow") {
                 delegation.cues = [...(delegation.cues ?? []), ...remoteMemberedCues];
@@ -1146,7 +1068,7 @@ export class Kever {
      *   `ixn` at the same sequence number, and otherwise the comparison climbs
      *   recursively through the delegator's own delegation chain
      */
-    validateDelegation(input) {
+    validateDelegation(input, repairs) {
         const delpre = input.delpre;
         // Non-delegated events short-circuit here so the caller can keep one
         // attachment pipeline for delegated and non-delegated events.
@@ -1202,8 +1124,9 @@ export class Kever {
         if (!delegator) {
             return this.makeAttachmentEscrowDecision("partialDels", input, `Missing delegator KEL for ${delpre} while validating ${input.serder.said ?? "<unknown>"}.`, [{
                     kin: "query",
-                    q: { pre: delpre ?? undefined },
-                    pre: delpre ?? undefined,
+                    route: "logs",
+                    q: {},
+                    pre: delpre,
                 }]);
         }
         if (delegator.doNotDelegate) {
@@ -1216,20 +1139,16 @@ export class Kever {
             sourceSeal: input.sourceSeal,
             original: false,
             eager: input.eager ?? false,
+            repairs,
         });
         if (!delegatingEvent) {
             return this.makeAttachmentEscrowDecision("partialDels", input, `No delegation seal found for ${input.serder.said ?? "<unknown>"}.`, [{
                     kin: "query",
+                    route: "logs",
                     q: {
-                        pre: delpre ?? undefined,
-                        sn: input.sourceSeal
-                            ? ordinalHex(sourceSealOrdinal(input.sourceSeal))
-                            : undefined,
-                        dig: input.sourceSeal
-                            ? sourceSealDigest(input.sourceSeal).qb64
-                            : undefined,
+                        s: input.sourceSeal ? ordinalHex(sourceSealOrdinal(input.sourceSeal)) : undefined,
                     },
-                    pre: delpre ?? undefined,
+                    pre: delpre,
                 }]);
         }
         // The simple cases are the same as KERIpy: inception is never a recovery
@@ -1257,12 +1176,14 @@ export class Kever {
         const originalDelegatingEvent = this.fetchDelegatingEvent(delpre, originalDelegatedEvent, {
             original: true,
             eager: input.eager ?? false,
+            repairs,
         });
         if (!originalDelegatingEvent) {
             return this.makeAttachmentEscrowDecision("partialDels", input, `No original delegation seal found for accepted recovery target ${originalDelegatedEvent.said ?? "<unknown>"}.`, [{
                     kin: "query",
-                    q: { pre: delpre ?? undefined },
-                    pre: delpre ?? undefined,
+                    route: "logs",
+                    q: {},
+                    pre: delpre,
                 }]);
         }
         const recoveryDecision = this.validateDelegatedRecovery({
@@ -1272,7 +1193,7 @@ export class Kever {
             candidateDelegation: delegatingEvent,
             originalEvent: originalDelegatedEvent,
             originalDelegation: originalDelegatingEvent,
-        });
+        }, repairs);
         if (recoveryDecision) {
             return recoveryDecision;
         }
@@ -1294,7 +1215,7 @@ export class Kever {
      * The comparison climbs one boss/original pair at a time until one of the
      * KERIpy superseding rules succeeds or the undelegated root is reached.
      */
-    validateDelegatedRecovery({ input, delpre, candidateEvent, candidateDelegation, originalEvent, originalDelegation, }) {
+    validateDelegatedRecovery({ input, delpre, candidateEvent, candidateDelegation, originalEvent, originalDelegation, }, repairs) {
         let currentDelpre = delpre;
         let candidate = candidateEvent;
         let candidateBoss = candidateDelegation;
@@ -1342,23 +1263,27 @@ export class Kever {
             const nextCandidateBoss = this.fetchDelegatingEvent(currentDelpre, candidate, {
                 original: false,
                 eager: input.eager ?? false,
+                repairs,
             });
             if (!nextCandidateBoss) {
                 return this.makeAttachmentEscrowDecision("partialDels", input, `No delegating recovery chain found for ${candidate.said ?? "<unknown>"} under ${currentDelpre}.`, [{
                         kin: "query",
-                        q: { pre: currentDelpre ?? undefined },
-                        pre: currentDelpre ?? undefined,
+                        route: "logs",
+                        q: {},
+                        pre: currentDelpre,
                     }]);
             }
             const nextOriginalBoss = this.fetchDelegatingEvent(currentDelpre, original, {
                 original: true,
                 eager: input.eager ?? false,
+                repairs,
             });
             if (!nextOriginalBoss) {
                 return this.makeAttachmentEscrowDecision("partialDels", input, `No original delegating recovery chain found for ${original.said ?? "<unknown>"} under ${currentDelpre}.`, [{
                         kin: "query",
-                        q: { pre: currentDelpre ?? undefined },
-                        pre: currentDelpre ?? undefined,
+                        route: "logs",
+                        q: {},
+                        pre: currentDelpre,
                     }]);
             }
             candidateBoss = nextCandidateBoss;
@@ -1373,39 +1298,47 @@ export class Kever {
         return this.db.getEvtSerder(this.pre, this.lastEst.d);
     }
     /** Read the stored accepted source-seal hint for one already accepted event. */
-    acceptedSourceSealForEvent(serder) {
+    acceptedSourceSealForEvent(serder, repairs) {
         const pre = serder.pre;
         const said = serder.said;
         if (!pre || !said) {
             return null;
         }
+        // Later lookups in this decision see earlier repairs without publishing them.
+        const pending = repairs.findLast((repair) => repair.pre === pre && repair.said === said);
+        if (pending)
+            return pending.sourceSeal;
         const seal = this.db.aess.get(dgKey(pre, said));
         if (!seal) {
             return null;
         }
         return SealSource.fromTuple(seal);
     }
-    /** Remove one broken accepted source-seal hint so a later eager pass can repair it. */
-    dropAcceptedSourceSeal(serder) {
+    /** Describe removal of one broken hint so a later eager pass can repair it. */
+    dropAcceptedSourceSeal(serder, repairs) {
         const pre = serder.pre;
         const said = serder.said;
         if (!pre || !said) {
             return;
         }
-        this.db.aess.rem(dgKey(pre, said));
+        repairs.push({ pre, said, sourceSeal: null });
     }
-    /** Repair `.aess` for accepted delegated events after re-discovering the real boss. */
-    repairAcceptedSourceSeal(serder, lookup) {
+    /** Describe an accepted event hint repair after rediscovering the authorizing event. */
+    repairAcceptedSourceSeal(serder, lookup, repairs) {
         const pre = serder.pre;
         const said = serder.said;
         const dgkey = pre && said ? dgKey(pre, said) : null;
         if (!dgkey || !this.db.fons.get(dgkey)) {
             return;
         }
-        this.db.aess.pin(dgkey, [
-            normalizeOrdinal(sourceSealOrdinal(lookup.sourceSeal)),
-            sourceSealDigest(lookup.sourceSeal),
-        ]);
+        repairs.push({
+            pre: pre,
+            said: said,
+            sourceSeal: SealSource.fromTuple([
+                normalizeOrdinal(sourceSealOrdinal(lookup.sourceSeal)),
+                sourceSealDigest(lookup.sourceSeal),
+            ]),
+        });
     }
     /** Resolve one stored source seal to the exact accepted delegating event it names. */
     lookupAcceptedDelegatingEvent(delpre, sourceSeal, serder) {
@@ -1562,7 +1495,7 @@ export class Kever {
             new Prefixer({ qb64: pre });
         }
         catch (error) {
-            return Kever.reject("invalidPre", `Invalid prefix ${pre} for inception ${said ?? "<unknown>"}.`, { cause: error instanceof Error ? error.message : String(error) });
+            return Kever.reject("invalidPre", `Invalid prefix ${pre} for inception ${said ?? "<unknown>"}: ${error instanceof Error ? error.message : String(error)}`);
         }
         if (!said || sn === null) {
             return Kever.reject("invalidSn", "Inception event must include said and sn.");
@@ -1689,24 +1622,8 @@ export class Kever {
     }
     /** Build one typed duplicate/escrow decision from an attachment decision. */
     static fromAttachmentDecision(decision) {
-        if (decision.kind === "reject") {
-            return {
-                kind: "reject",
-                code: decision.code,
-                message: decision.message,
-                context: decision.context,
-            };
-        }
-        if (decision.kind === "escrow") {
-            return {
-                kind: "escrow",
-                reason: decision.reason,
-                message: decision.message,
-                instruction: decision.instruction,
-                cues: decision.cues,
-                context: decision.context,
-            };
-        }
+        if (decision.kind !== "verified")
+            return decision;
         return {
             kind: "reject",
             code: "unsupported",
@@ -1714,12 +1631,12 @@ export class Kever {
         };
     }
     /** Helper to produce one reject decision. */
-    static reject(code, message, context) {
-        return { kind: "reject", code, message, context };
+    static reject(code, message) {
+        return { kind: "reject", code, message };
     }
     /** Helper to produce one reject attachment decision. */
-    static rejectAttachment(code, message, context) {
-        return { kind: "reject", code, message, context };
+    static rejectAttachment(code, message) {
+        return { kind: "reject", code, message };
     }
     /** Build one typed escrow decision for event-level routing. */
     makeEscrowDecision(escrow, init, message, cues) {

package/esm/keri/npm/src/core/logger.js

@@ -18,16 +18,16 @@ export function setLogLevel(level) {
 export function getLogLevel() {
     return currentLogLevel;
 }
-/** Default logger that forwards to `console.*` with level gating. */
+/** Level-gated diagnostics on stderr; stdout belongs to command data. */
 export const consoleLogger = {
     debug: (message, ...meta) => {
         if (shouldLog("debug")) {
-            console.debug(message, ...meta);
+            console.error(message, ...meta);
         }
     },
     info: (message, ...meta) => {
         if (shouldLog("info")) {
-            console.log(message, ...meta);
+            console.error(message, ...meta);
         }
     },
     warn: (message, ...meta) => {

package/esm/keri/npm/src/core/{kram-policy.js → mailbox/kram-policy.js}

@@ -1,6 +1,6 @@
 /** KRAM cache selection and safe, receiver-clocked configuration transitions. */
 import { intToB64 } from "cesr-ts";
-import { CacheTypeRecord } from "./records.js";
+import { CacheTypeRecord } from "../records.js";
 /** Only this key owns the policy transition metadata in the existing settings table. */
 const policyKey = "kram-policy";
 /** Validate caller configuration before any durable policy mutation. */
@@ -79,6 +79,18 @@ function policyState(stored, db) {
         throw new Error("Corrupt KRAM policy metadata", { cause });
     }
 }
+/** OOBI endpoint replies rely on BADA acceptance rather than KRAM replay protection (KERIpy `OobiDenials`). */
+const OOBI_EXEMPTIONS = [[[2, 0], "rpy", "/end/role"], [[2, 0], "rpy", "/loc/scheme"]];
+/**
+ * Store-and-forward routes whose copy is correct whenever it arrives, so a late
+ * mailbox fetch must not fall outside a KRAM window (KERIpy
+ * `StoreForwardDenials`). Their own acceptance model replaces replay protection:
+ * the exchange store is keyed by SAID, the handler ignores a stored SAID that is
+ * escrowed or already retained, every copy is fully re-authorized against
+ * current KEL/TEL state and its root reproduced before automatic retention, and
+ * a retained root is immutable.
+ */
+const STORE_FORWARD_EXEMPTIONS = [[[2, 0], "exn", "/registry/root"]];
 /**
  * Own finite cache configuration and exemption policy, reusing Baser.ctyp.
  * Persist staged acceptance expansions so restart cannot reopen an old window.
@@ -127,9 +139,7 @@ export class KramPolicy {
         this.enabled = config.enabled ?? false;
         const denials = [
             ...(config.denials ?? []),
-            ...(this.enabled
-                ? [[[2, 0], "rpy", "/end/role"], [[2, 0], "rpy", "/loc/scheme"]]
-                : []),
+            ...(this.enabled ? [...OOBI_EXEMPTIONS, ...STORE_FORWARD_EXEMPTIONS] : []),
         ];
         this.exemptions = denials.map(([version, type, route]) => {
             if (version.length !== 2 || version.some((v) => !Number.isSafeInteger(v) || v < 0)