keri-ts 1.0.0 → 2.0.1

package/esm/keri/npm/src/{app/cli → cli/tools}/benchmark.js

@@ -1,8 +1,10 @@
 import * as dntShim from "../../_dnt.shims.js";
 import { benchmarkParser, } from "cesr-ts";
-import { abortable } from "../abortable.js";
-import { collectBytes, fileBytes, streamBytes } from "../byte-source.js";
-import { writeStdout } from "./output.js";
+import { abortable } from "../../app/runtime/abortable.js";
+import { collectBytes, fileBytes, streamBytes } from "../../app/transport/byte-source.js";
+import { ValidationError } from "../../core/errors.js";
+import { parseBooleanOption, parseCountOption, parseStringOption } from "../common/parsing.js";
+import { writeStdout } from "../output.js";
 /** Present complete-run metrics using the shared benchmark's measured values. */
 function formatBenchmarkText(source, result) {
     return [
@@ -19,7 +21,16 @@ function formatBenchmarkText(source, result) {
 }
 /** Retain one admitted corpus and own every input, parse, and output leaf in this operation. */
 export function* benchmarkCommand(args) {
-    const options = args;
+    const options = {
+        inPath: parseStringOption(args.inPath, "inPath"),
+        json: parseBooleanOption(args.json, "json"),
+        iterations: parseCountOption(args.iterations, "iterations"),
+        warmupIterations: parseCountOption(args.warmupIterations, "warmupIterations"),
+        chunkSize: parseCountOption(args.chunkSize, "chunkSize"),
+    };
+    if (options.iterations === 0 || options.chunkSize === 0) {
+        throw new ValidationError("iterations and chunkSize must be positive");
+    }
     const source = options.inPath ?? "stdin";
     const bytes = yield* abortable((signal) => collectBytes(options.inPath ? fileBytes(options.inPath, { signal }) : streamBytes(dntShim.Deno.stdin.readable, { signal })));
     const result = yield* abortable((signal) => benchmarkParser(bytes, {

package/esm/keri/npm/src/{app/cli → cli/tools}/db-dump.js

@@ -3,8 +3,9 @@ import { DatabaseOperationError, ValidationError } from "../../core/errors.js";
 import { RawRecord } from "../../core/records.js";
 import { createBaser } from "../../db/basing.js";
 import { createKeeper } from "../../db/keeping.js";
-import { createMailboxer } from "../../db/mailboxing.js";
+import { createMailboxer } from "../../db/mailbox/mailboxing.js";
 import { createNoter } from "../../db/noting.js";
+import { parseBooleanOption, parseIntegerOption, parseStringOption } from "../common/parsing.js";
 const DOMAIN_FACTORIES = {
     baser: {
         open: (options) => createBaser(options),
@@ -242,15 +243,15 @@ function resolveLimit(rawLimit) {
  * - `mailboxer.tpcs`
  */
 export function* dumpDatabase(args) {
-    const name = args.name;
-    const base = args.base;
-    const headDirPath = args.headDirPath;
-    const temp = args.temp;
-    const compat = args.compat;
-    const mapSize = resolveMapSize(args.mapSize);
-    const target = args.target;
-    const prefix = args.prefix;
-    const limit = resolveLimit(args.limit);
+    const name = parseStringOption(args.name, "name");
+    const base = parseStringOption(args.base, "base");
+    const headDirPath = parseStringOption(args.headDirPath, "headDirPath");
+    const temp = parseBooleanOption(args.temp, "temp");
+    const compat = parseBooleanOption(args.compat, "compat");
+    const mapSize = resolveMapSize(parseIntegerOption(args.mapSize, "mapSize"));
+    const target = parseStringOption(args.target, "target");
+    const prefix = parseStringOption(args.prefix, "prefix");
+    const limit = resolveLimit(parseIntegerOption(args.limit, "limit"));
     if (!name) {
         throw new ValidationError("`--name` is required");
     }

package/esm/keri/npm/src/{app/cli → cli/tools}/saidify.js

@@ -1,11 +1,12 @@
 import * as dntShim from "../../_dnt.shims.js";
 import { Saider } from "cesr-ts";
 import { ValidationError } from "../../core/errors.js";
+import { parseStringOption } from "../common/parsing.js";
 /** Implement KLI-compatible `saidify`: mutate one JSON SAD file in place. */
 export function* saidifyCommand(args) {
     const commandArgs = {
-        file: args.file,
-        label: args.label,
+        file: parseStringOption(args.file, "file"),
+        label: parseStringOption(args.label, "label"),
     };
     if (!commandArgs.file) {
         throw new ValidationError("File is required and cannot be empty.");

package/esm/keri/npm/src/{app/cli → cli/tools}/sign.js

@@ -1,6 +1,7 @@
+import { isLocalGroupHab } from "../../app/multisig/group-members.js";
 import { ValidationError } from "../../core/errors.js";
-import { withExistingHab } from "./common/context.js";
-import { loadTextArgument } from "./common/parsing.js";
+import { withExistingHab } from "../common/context.js";
+import { loadTextArgument, parseBooleanOption, parseStringOption } from "../common/parsing.js";
 /**
  * Sign one arbitrary text payload with the habitat's current accepted keys.
  *
@@ -8,16 +9,18 @@ import { loadTextArgument } from "./common/parsing.js";
  * - prints numbered indexed signatures as `1. <qb64>`
  * - the numbering is presentation only; `tufa verify` still expects raw
  *   signature qb64 values, matching KLI
+ * - group output labels its partial member contribution; it does not collect
+ *   approval or establish that the group's threshold has been satisfied
  */
 export function* signCommand(args) {
     const signArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        alias: args.alias,
-        compat: args.compat,
-        text: args.text,
+        name: parseStringOption(args.name, "--name"),
+        base: parseStringOption(args.base, "--base"),
+        headDirPath: parseStringOption(args.headDirPath, "--head-dir"),
+        passcode: parseStringOption(args.passcode, "--passcode"),
+        alias: parseStringOption(args.alias, "--alias"),
+        compat: parseBooleanOption(args.compat, "--compat"),
+        text: parseStringOption(args.text, "--text"),
     };
     if (!signArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");
@@ -34,8 +37,11 @@ export function* signCommand(args) {
         readonly: false,
         skipConfig: true,
         skipSignator: true,
-    }, function* ({ hab }) {
+    }, function* ({ hby, hab }) {
         const sigers = hab.sign(loadTextArgument(text), true);
+        if (isLocalGroupHab(hby, hab)) {
+            console.log(`Partial multisig signature contribution for ${hab.pre}; group approval is not collected by sign.`);
+        }
         for (const [idx, siger] of sigers.entries()) {
             console.log(`${idx + 1}. ${siger.qb64}`);
         }

package/esm/keri/npm/src/{app/cli → cli/tools}/verify.js

@@ -13,8 +13,8 @@
  */
 import { Siger } from "cesr-ts";
 import { ValidationError } from "../../core/errors.js";
-import { withExistingHabery } from "./common/context.js";
-import { loadTextArgument } from "./common/parsing.js";
+import { withExistingHabery } from "../common/context.js";
+import { loadTextArgument, parseBooleanOption, parseStringListOption, parseStringOption } from "../common/parsing.js";
 /**
  * Verify one or more indexed signatures against locally accepted key state.
  *
@@ -25,14 +25,14 @@ import { loadTextArgument } from "./common/parsing.js";
  */
 export function* verifyCommand(args) {
     const verifyArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        prefix: args.prefix,
-        compat: args.compat,
-        text: args.text,
-        signature: args.signature,
+        name: parseStringOption(args.name, "--name"),
+        base: parseStringOption(args.base, "--base"),
+        headDirPath: parseStringOption(args.headDirPath, "--head-dir"),
+        passcode: parseStringOption(args.passcode, "--passcode"),
+        prefix: parseStringOption(args.prefix, "--prefix"),
+        compat: parseBooleanOption(args.compat, "--compat"),
+        text: parseStringOption(args.text, "--text"),
+        signature: parseStringListOption(args.signature, "--signature"),
     };
     if (!verifyArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");

package/esm/keri/npm/src/core/attachment-countering.js

@@ -1,4 +1,4 @@
-import { Counter, CtrDexV1, CtrDexV2, Vrsn_1_0, Vrsn_2_0 } from "cesr-ts";
+import { Counter, CtrDexV1, CtrDexV2, NumberPrimitive, Seqner, Vrsn_1_0, Vrsn_2_0 } from "cesr-ts";
 import { ValidationError } from "./errors.js";
 const MAX_SMALL_COUNTER_COUNT = 4095;
 /**
@@ -19,6 +19,36 @@ export function resolveAttachmentGvrsn(serder, gvrsn = Vrsn_1_0, nested = false)
     }
     return resolved;
 }
+/**
+ * Qualify a sequence or first-seen ordinal for an attachment of genus `gvrsn`.
+ *
+ * KERIpy `messagize` (`_v1seqner`/`_v2number`): v1 attachments carry the fixed-width
+ * `0A` Seqner, v2 attachments the smallest automatic Number code (`MAAB` for 1),
+ * whatever primitive the caller holds, so a freshly signed message and one rebuilt
+ * from storage serialize to the same bytes. Hex strings are KERI `snh` ordinals.
+ */
+export function attachmentOrdinal(ordinal, gvrsn) {
+    if (gvrsn.major === 1 && ordinal instanceof Seqner)
+        return ordinal;
+    const value = ordinal instanceof Seqner
+        ? ordinal.sn
+        : ordinal instanceof NumberPrimitive
+            ? ordinal.num
+            : hexOrdinal(ordinal);
+    if (gvrsn.major >= 2)
+        return NumberPrimitive.fromNum(value);
+    if (value >= 1n << 128n)
+        throw new ValidationError(`Ordinal ${value} exceeds the 16-byte v1 Seqner.`);
+    const raw = new Uint8Array(16);
+    for (let at = raw.length - 1, rest = value; at >= 0; at--, rest >>= 8n)
+        raw[at] = Number(rest & 0xffn);
+    return new Seqner({ code: "0A", raw });
+}
+function hexOrdinal(hex) {
+    if (!/^[0-9a-f]+$/i.test(hex))
+        throw new ValidationError(`Invalid hex ordinal ${hex}`);
+    return BigInt(`0x${hex}`);
+}
 /** Build one bare attachment counter using the code family for `gvrsn`. */
 export function attachmentCounterQb64b(name, count, gvrsn = Vrsn_1_0) {
     validateCounterCount(name, count);

package/esm/keri/npm/src/core/{exchange-proofing.js → exchange/exchange-proofing.js}

@@ -1,5 +1,35 @@
-import { TransIdxSigGroup } from "./dispatch.js";
-import { Kever } from "./kever.js";
+/** Independently verify EXN or disclosed-node proofs against already accepted KEL state. */
+import { Diger, NumberPrimitive } from "cesr-ts";
+import { TransIdxSigGroup } from "../dispatch.js";
+import { Kever } from "../kel/kever.js";
+/**
+ * Authenticate a named query sender independently of optional KRAM admission.
+ * Explicit sender TSGs take precedence; only their absence allows raw/last
+ * factors to resolve against current accepted establishment state. A valid
+ * alternative suffices, but missing claimed coordinates refuse, as in Python.
+ */
+export function verifyQueryAttachments(db, envelope) {
+    const { serder } = envelope;
+    let tsgs = envelope.tsgs.filter((group) => group.pre === serder.pre);
+    const kever = db.getKever(serder.pre);
+    if (!tsgs.length && kever) {
+        const sigers = [
+            ...envelope.sigers,
+            ...envelope.ssgs.filter((group) => group.pre === serder.pre)
+                .flatMap((group) => group.sigers),
+        ];
+        if (sigers.length) {
+            tsgs = [
+                new TransIdxSigGroup(kever.prefixer, NumberPrimitive.fromNum(BigInt(kever.lastEst.s)), new Diger({ qb64: kever.lastEst.d }), sigers),
+            ];
+        }
+    }
+    const verified = verifyExchangeProofs(db, serder, {
+        tsgs,
+        cigars: envelope.cigars.filter((cigar) => cigar.verfer?.qb64 === serder.pre),
+    });
+    return !verified.missing.length && !!(verified.tsgs.length || verified.cigars.length);
+}
 /**
  * Match frozen KERIpy peer.exchanging.verifyAttachments without fetching or publishing.
  * Source seals select an accepted key event containing this body's SAID.

package/esm/keri/npm/src/core/{protocol-exchanging.js → exchange/protocol-exchanging.js}

@@ -1,7 +1,7 @@
 import { concatBytes, Ilks, Kinds, makePather, NonceDex, Noncer, reapSerder, Saider, SerderKERI, Vrsn_1_0, Vrsn_2_0, } from "cesr-ts";
-import { makeNowIso8601 } from "../time/mod.js";
-import { pathedMaterialCounterQb64b } from "./attachment-countering.js";
-import { serializeMessage as serializeExchangeMessage } from "./protocol-serialization.js";
+import { makeNowIso8601 } from "../../time/mod.js";
+import { pathedMaterialCounterQb64b } from "../attachment-countering.js";
+import { serializeMessage as serializeExchangeMessage } from "../protocol-serialization.js";
 /** Narrow a wire route component before consulting version-specific policy. */
 export function isIpexVerb(value) {
     return value === "apply"
@@ -145,9 +145,17 @@ export function serializeMessage(serder, { tsgs, cigars, pathed, pipelined = fal
         gvrsn,
     });
 }
-/** Exact v2 multisig route/child-ilk contract at frozen KERIpy 927c0cb8 grouping.py:validate. */
+/** V2 TEL proposal routes share exact registry/anchor consent, not an arbitrary anchor bucket. */
+export function isV2RegistryRoute(route) {
+    return route === "/multisig/rip" || route === "/multisig/bup";
+}
+/** Selected ACDC v2 multisig routes; exact child relationships remain the coordinator's obligation. */
 export function nestedMultisigIlks(route) {
     switch (route) {
+        case "/multisig/rip":
+            return ["rip", "ixn", "rot", "drt"];
+        case "/multisig/bup":
+            return ["bup", "ixn", "rot", "drt"];
         case "/multisig/icp":
             return ["icp", "dip"];
         case "/multisig/rot":
@@ -156,10 +164,24 @@ export function nestedMultisigIlks(route) {
             return ["ixn"];
         case "/multisig/rpy":
             return ["rpy"];
+        case "/multisig/qry":
+            return ["qry"]; // Local v2 coordination profile; not an upstream KERI or #1740 route.
+        case "/multisig/ipex-proof":
+            return ["xip", "exn"]; // Local v2 coordination profile; the child is one complete Grant stream.
+        case "/multisig/exn":
+            return ["xip", "exn"];
         default:
             return null;
     }
 }
+/**
+ * Payload field carrying a v2 wrapper's signed child SAID: the route's last
+ * segment, except `/multisig/ipex-proof`, which commits its Grant as `grant`
+ * (KERIpy `Multiplexor.V2Fields`).
+ */
+export function multisigChildField(route) {
+    return route === "/multisig/ipex-proof" ? "grant" : route.slice(route.lastIndexOf("/") + 1);
+}
 /** V2 routes whose handlers own direct disclosed ACDC children. */
 export function nestedIpexRoute(route) {
     return route === "/ipex/offer" || route === "/ipex/grant";

package/esm/keri/npm/src/core/genus-framing.js

@@ -0,0 +1,44 @@
+/** Stream genus framing for concatenated messages whose attachment genera may differ. */
+import { b64ToInt, concatBytes, Counter, smell, sniff, VersionError, Vrsn_2_0 } from "cesr-ts";
+/** Text-domain genus-version counter code; its three-character count is major plus two-character minor. */
+const GENUS_VERSION_CODE = "-_AAA";
+/** Attachment genus a stream message is framed in, or the genus a leading selector switches to. */
+function messageGenus(message) {
+    if (sniff(message) === "msg") {
+        const { pvrsn, gvrsn } = smell(message).smellage;
+        // A v2 version string may leave its genus field unset (0.00); the protocol version then governs.
+        return { genus: gvrsn && gvrsn.major > 0 ? gvrsn : pvrsn, selector: false };
+    }
+    const head = new TextDecoder().decode(message.subarray(0, 8));
+    if (head.startsWith(GENUS_VERSION_CODE) && head.length === 8) {
+        const major = b64ToInt(head[5]);
+        if (major !== 1 && major !== 2)
+            throw new VersionError(`Unsupported stream genus major ${major}`);
+        return { genus: { major, minor: b64ToInt(head.slice(6)) }, selector: true };
+    }
+    // Native CESR bodies and enclosing message groups exist only in genus 2.
+    return { genus: Vrsn_2_0, selector: false };
+}
+/**
+ * Prefix a genus-version counter wherever consecutive messages change attachment genus.
+ *
+ * Receivers keep a stream's genus across messages and change it only at a top-level
+ * genus-version counter: KERIpy starts every stream at 2.0, and keri-ts infers the
+ * first unselected body and then keeps any selection. The first message sets the
+ * stream's genus without a counter, so single-genus streams stay byte-identical; each
+ * later change carries its counter in the same chunk as the message it selects.
+ * Messages that already begin with a selector set the current genus unchanged.
+ */
+export function* genusFramed(messages) {
+    let current = null;
+    for (const message of messages) {
+        if (message.length === 0) {
+            yield message;
+            continue;
+        }
+        const { genus, selector } = messageGenus(message);
+        const changed = current !== null && (current.major !== genus.major || current.minor !== genus.minor);
+        current = genus;
+        yield changed && !selector ? concatBytes(Counter.makeGVC(genus), message) : message;
+    }
+}

package/esm/keri/npm/src/core/{eventing.js → kel/eventing.js}

@@ -1,14 +1,15 @@
 import { Cigar, Dater, Diger, Ilks, NumberPrimitive, Prefixer, SealSource, Siger, Verfer, } from "cesr-ts";
-import { dgKey, snKey } from "../db/core/keys.js";
-import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
-import { Deck } from "./deck.js";
-import { ValidationError } from "./errors.js";
+import { dgKey, snKey } from "../../db/core/keys.js";
+import { encodeDateTimeToDater, makeNowIso8601 } from "../../time/mod.js";
+import { Deck } from "../deck.js";
+import { ValidationError } from "../errors.js";
+import { consoleLogger } from "../logger.js";
+import { normalizeMbxTopicCursor } from "../mailbox/mailbox-topics.js";
+import { reply as replyEvent } from "../protocol-eventing.js";
+import { KeyStateRecord, ObservedRecord } from "../records.js";
+import { acceptReplyDecision, unverifiedReplyDecision } from "../routing.js";
 import { acceptEscrow, acceptQuery, acceptReceipt, dropEscrow, dropQuery, dropReceipt, escrowQuery, escrowReceipt, ignoreReceipt, keepEscrow, logEscrowDecision, } from "./kever-decisions.js";
 import { Kever } from "./kever.js";
-import { normalizeMbxTopicCursor } from "./mailbox-topics.js";
-import { reply as replyEvent } from "./protocol-eventing.js";
-import { KeyStateRecord, ObservedRecord } from "./records.js";
-import { acceptReplyDecision, unverifiedReplyDecision } from "./routing.js";
 import { deriveRotatedWitnessSet, hasUniqueWitnesses } from "./witnesses.js";
 /** Normalize one dispatch ordinal into the number primitive expected by DB seal tuples. */
 function normalizeSealOrdinal(seqner) {
@@ -200,6 +201,8 @@ export class Kevery {
      *   state or route criteria
      * - `drop` means the query is malformed or unsupported and should not become
      *   query-not-found escrow
+     *
+     * @param envelope Parsed signed query and its attached authentication evidence.
      */
     decideQuery(envelope) {
         const route = envelope.serder.route;
@@ -253,7 +256,7 @@ export class Kevery {
                         pre,
                         src,
                         dest,
-                        messages,
+                        msgs: messages,
                     }]);
             }
             case "ksn": {
@@ -267,7 +270,12 @@ export class Kevery {
                 return acceptQuery([{
                         kin: "reply",
                         querySaid: envelope.serder.said ?? undefined,
-                        serder: replyEvent(`/ksn/${src}`, kever.state().asDict()),
+                        // KERIpy answers in the query's own protocol version and serialization kind.
+                        serder: replyEvent(`/ksn/${src}`, kever.state().asDict(), {
+                            pre,
+                            pvrsn: envelope.serder.pvrsn,
+                            kind: envelope.serder.kind,
+                        }),
                         src,
                         dest,
                     }]);
@@ -761,11 +769,12 @@ export class Kevery {
                 continue;
             }
             const decision = this.reprocessEscrowedWitnessReceipt(pre, sn, said, new Siger({ qb64: wigerQb64 }));
-            logEscrowDecision("Kevery UWE", decision);
             switch (decision.kind) {
                 case "accept":
                 case "drop":
-                    this.db.uwes.remOn([pre], sn, couple);
+                    if (this.db.uwes.remOn([pre], sn, couple)) {
+                        logEscrowDecision(`Kevery UWE pre=${pre} sn=${sn} said=${said}`, decision);
+                    }
                     break;
                 case "keep":
                     break;
@@ -795,11 +804,12 @@ export class Kevery {
             const [diger, prefixer, cigar] = triple;
             const hydrated = new Cigar(cigar, new Verfer({ qb64: prefixer.qb64 }));
             const decision = this.reprocessEscrowedNonTransReceipt(pre, sn, diger, hydrated);
-            logEscrowDecision("Kevery URE", decision);
             switch (decision.kind) {
                 case "accept":
                 case "drop":
-                    this.db.ures.rem([pre, snh], triple);
+                    if (this.db.ures.rem([pre, snh], triple)) {
+                        logEscrowDecision(`Kevery URE pre=${pre} sn=${sn} said=${diger.qb64}`, decision);
+                    }
                     break;
                 case "keep":
                     break;
@@ -829,11 +839,12 @@ export class Kevery {
             }
             const sn = parseInt(snh, 16);
             const decision = this.reprocessEscrowedTransferableReceipt(pre, sn, quintuple);
-            logEscrowDecision("Kevery VRE", decision);
             switch (decision.kind) {
                 case "accept":
                 case "drop":
-                    this.db.vres.rem([pre, snh], quintuple);
+                    if (this.db.vres.rem([pre, snh], quintuple)) {
+                        logEscrowDecision(`Kevery VRE pre=${pre} sn=${sn} said=${quintuple[0].qb64}`, decision);
+                    }
                     break;
                 case "keep":
                     break;
@@ -878,13 +889,15 @@ export class Kevery {
                 continue;
             }
             const decision = this.reprocessEscrowedQuery(requester, qsaid);
-            logEscrowDecision("Kevery QNF", decision);
             switch (decision.kind) {
                 case "accept":
-                case "drop":
-                    this.db.qnfs.rem([requester, qsaid], escrowedSaid);
+                case "drop": {
+                    const removed = this.db.qnfs.rem([requester, qsaid], escrowedSaid);
                     this.clearEscrowedQueryMaterial(requester, qsaid);
+                    if (removed)
+                        logEscrowDecision(`Kevery QNF requester=${requester} said=${qsaid}`, decision);
                     break;
+                }
                 case "keep":
                     break;
             }
@@ -918,8 +931,9 @@ export class Kevery {
      * Why `Kevery` owns this route:
      * - trust-source policy depends on KEL state and configured watchers
      * - accepted replies must stay consistent with the accepted event log at `sn`
-     * - successful acceptance emits `keyStateSaved`, which drives follow-on query
-     *   continuation work
+     * - successful validation/persistence emits `keyStateSaved`, supplying the
+     *   remote notice target for query workflows; ordinary KEL acceptance does not
+     *   imply receipt of such a notice
      */
     processReplyKeyStateNotice(args) {
         if (!this.rvy) {
@@ -1064,7 +1078,6 @@ export class Kevery {
             cues.push({ kin: "notice", serder });
         if (local && (state.b ?? []).some((wit) => this.db.getHab(wit) !== null))
             cues.push({ kin: "witness", serder });
-        cues.push({ kin: "keyStateSaved", ksn: state });
         return cues;
     }
     /** Repair replay source seals before publishing query output. */
@@ -1179,7 +1192,7 @@ export class Kevery {
                 source = new Prefixer({ qb64: requester });
             }
             catch (error) {
-                return dropEscrow("malformedEscrowedQuery", `QNF Failed to reconstruct requester=${requester} at dig=${qsaid}: ${error instanceof Error ? error.message : String(error)}`);
+                return dropEscrow("malformedEscrowedQuery", `QNF Failed to reconstruct requester=${requester} at dig=${qsaid}: ${error instanceof Error ? error.message : String(error)}`, error);
             }
         }
         const decision = this.decideQuery({
@@ -2076,7 +2089,9 @@ export class Kevery {
      *
      * Stored artifacts mirror the KERIpy event escrow model:
      * - `dtss.` for local escrow insertion time
-     * - `sigs.` / `wigs.` / `wits.` for verified attachment state
+     * - `sigs.` / `wigs.` for retained attachment candidates; early escrows may
+     *   precede their verification
+     * - `wits.` for the derived witness cohort when available
      * - `evts.` for the escrowed event body
      * - `udes.` for delegation or source-seal context when present
      * - `esrs.` for local/remote source provenance
@@ -2225,9 +2240,26 @@ export class Kevery {
      * - the escrowed event is reconstructed back into a normal event envelope
      * - the same native writer and explicit processing path as live intake is reused
      * - escrow movement/removal commits with event effects before state/cue publication
+     *
+     * @param currentEscrow Family currently retaining the event.
+     * @param pre Event AID in qualified Base64 form.
+     * @param on Event sequence number, or null for a set-keyed family.
+     * @param said Event digest identifying its stored body and detached proofs.
      */
     replayEscrowEntry(currentEscrow, pre, on, said) {
-        this.settleEventDecision(() => this.rehydrateEscrowEnvelope(currentEscrow, pre, said), { kind: currentEscrow, pre, on, said });
+        const decision = this.settleEventDecision(() => this.rehydrateEscrowEnvelope(currentEscrow, pre, said), { kind: currentEscrow, pre, on, said });
+        // The transaction above has committed the removal. Acceptance and movement
+        // to another dependency family are ordinary recovery, not ejections.
+        if (decision === null || decision.kind === "reject") {
+            consoleLogger.warn("KEL escrow removed", {
+                family: currentEscrow,
+                pre,
+                sn: on,
+                said,
+                reason: decision?.code ?? "missingEscrowedEvent",
+                detail: decision?.message ?? "Stored event body is missing.",
+            });
+        }
     }
     /** Remove one stored escrow pointer from its current bucket. */
     removeEscrow(escrow, pre, on, said) {

package/esm/keri/npm/src/core/{kever-decisions.js → kel/kever-decisions.js}

@@ -1,4 +1,4 @@
-import { consoleLogger } from "./logger.js";
+import { consoleLogger } from "../logger.js";
 /** Builder for one successfully applied escrow row. */
 export function acceptEscrow() {
     return { kind: "accept" };
@@ -7,24 +7,36 @@ export function acceptEscrow() {
 export function keepEscrow(reason, message) {
     return { kind: "keep", reason, message };
 }
-/** Builder for one terminal outcome that should remove the escrow row. */
-export function dropEscrow(reason, message) {
-    return { kind: "drop", reason, message };
+/**
+ * Describe a terminal outcome without removing its escrow row.
+ *
+ * @param reason Existing protocol or stored-artifact reason for removal.
+ * @param message Specific validation detail, when available.
+ * @param cause Original caught validation failure; omitted for ordinary decisions.
+ * @returns The decision for the owner to apply and report after removal.
+ */
+export function dropEscrow(reason, message, cause) {
+    return { kind: "drop", reason, message, ...(cause !== undefined ? { cause } : {}) };
 }
 /**
- * Emit one consistent log line for escrow keep/drop outcomes.
+ * Report a terminal escrow removal after its owning write has succeeded.
+ *
+ * Accepted work and recoverable misses are silent. An original validation error
+ * remains available to the logger with its stack and cause.
  *
- * This preserves the diagnostic role KERIpy gets from exception logging while
- * keeping the runtime on explicit decisions instead of exception control flow.
+ * @param scope Owner, escrow family and identifying coordinates of the removed row.
+ * @param decision Replay outcome whose removal has already completed.
+ * @param logger Existing diagnostic sink; defaults to the process console logger.
  */
 export function logEscrowDecision(scope, decision, logger = consoleLogger) {
-    if (decision.kind === "accept") {
+    if (decision.kind !== "drop") {
         return;
     }
-    const detail = decision.message
-        ? `${scope}: ${decision.message}`
-        : `${scope}: escrow ${decision.kind} (${decision.reason})`;
-    logger.info(detail);
+    const detail = `${scope}: escrow removed (${decision.reason})${decision.message ? `: ${decision.message}` : ""}`;
+    if (decision.cause !== undefined)
+        logger.warn(detail, decision.cause);
+    else
+        logger.warn(detail);
 }
 /** Builder for live receipt material that was successfully applied. */
 export function acceptReceipt() {

package/esm/keri/npm/src/core/{kever.js → kel/kever.js}

@@ -1,8 +1,8 @@
 import { Dater, Diger, Ilks, NumberPrimitive, Prefixer, SealSource, Siger, Tholder, Verfer, } from "cesr-ts";
-import { dgKey } from "../db/core/keys.js";
-import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
-import { ValidationError } from "./errors.js";
-import { KeyStateRecord } from "./records.js";
+import { dgKey } from "../../db/core/keys.js";
+import { encodeDateTimeToDater, makeNowIso8601 } from "../../time/mod.js";
+import { ValidationError } from "../errors.js";
+import { KeyStateRecord } from "../records.js";
 import { deriveRotatedWitnessSet } from "./witnesses.js";
 /**
  * Convert one integer into the Huge-number CESR family used for durable replay

package/esm/keri/npm/src/core/logger.js

@@ -18,16 +18,16 @@ export function setLogLevel(level) {
 export function getLogLevel() {
     return currentLogLevel;
 }
-/** Default logger that forwards to `console.*` with level gating. */
+/** Level-gated diagnostics on stderr; stdout belongs to command data. */
 export const consoleLogger = {
     debug: (message, ...meta) => {
         if (shouldLog("debug")) {
-            console.debug(message, ...meta);
+            console.error(message, ...meta);
         }
     },
     info: (message, ...meta) => {
         if (shouldLog("info")) {
-            console.log(message, ...meta);
+            console.error(message, ...meta);
         }
     },
     warn: (message, ...meta) => {