keri-ts 2.2.3 → 2.2.5

package/esm/keri/npm/src/app/transport/messengering.js

@@ -7,25 +7,56 @@
  * do not select a stored framing preference or acquire workers, stores or queues.
  */
 import { ValidationError } from "../../core/errors.js";
+import { readUrl } from "../../core/wire-fields.js";
+import { isRequestableHttpUrl } from "./http-client.js";
 import { HTTPMessenger } from "./http-messenger.js";
 import { HTTPStreamMessenger } from "./http-stream-messenger.js";
 import { requireTcpDialer } from "./tcp-dialer.js";
-/** Choose HTTPS, HTTP, then TCP and reject a mismatched advertised scheme before I/O. */
-function endpointFrom(urls) {
+/**
+ * Choose HTTPS, HTTP, then TCP, refusing before I/O what no messenger can use: an unparseable URL, a scheme other than
+ * the advertised one, an HTTP(S) URL the HTTP client refuses ({@link isRequestableHttpUrl}: embedded credentials), or
+ * a TCP URL without a valid port. A refused higher-priority URL does not fall through to another transport.
+ *
+ * @param urls Resolved endpoints, keyed by their advertised scheme.
+ * @returns The selection, never a throw.
+ */
+function selectEndpoint(urls) {
     for (const scheme of ["https", "http", "tcp"]) {
         const value = urls[scheme];
         if (value === undefined)
             continue;
-        const endpoint = new URL(value);
-        if (endpoint.protocol !== `${scheme}:` || endpoint.username || endpoint.password) {
-            throw new ValidationError(`Invalid ${scheme} messenger endpoint: ${value}`);
+        const endpoint = readUrl(value);
+        if (!endpoint)
+            return { kind: "refused", reason: `Invalid ${scheme} messenger endpoint: ${value}` };
+        const usable = scheme === "tcp" ? !endpoint.username && !endpoint.password : isRequestableHttpUrl(value);
+        if (endpoint.protocol !== `${scheme}:` || !usable) {
+            return { kind: "refused", reason: `Invalid ${scheme} messenger endpoint: ${value}` };
         }
         if (scheme === "tcp" && (!endpoint.port || Number(endpoint.port) < 1 || Number(endpoint.port) > 65535)) {
-            throw new ValidationError(`TCP messenger endpoint requires a valid port: ${value}`);
+            return { kind: "refused", reason: `TCP messenger endpoint requires a valid port: ${value}` };
         }
-        return endpoint;
+        return { kind: "usable", value, endpoint };
     }
-    throw new ValidationError("No supported messenger endpoint is available.");
+    return { kind: "refused", reason: "No supported messenger endpoint is available." };
+}
+/** Select the factories' endpoint, refusing an unusable one as a caller error. */
+function endpointFrom(urls) {
+    const selection = selectEndpoint(urls);
+    if (selection.kind === "refused")
+        throw new ValidationError(selection.reason);
+    return selection.endpoint;
+}
+/**
+ * The URL the messenger factories would use for these endpoints, or null when they would refuse it. A caller holding
+ * a location another party advertised reads a refused one as no location, so it fails one delivery as unroutable
+ * instead of throwing out of the factory.
+ *
+ * @param urls Resolved endpoints, keyed by their advertised scheme.
+ * @returns The selected URL exactly as advertised, or null.
+ */
+export function messengerUrl(urls) {
+    const selection = selectEndpoint(urls);
+    return selection.kind === "usable" ? selection.value : null;
 }
 /**
  * Bind ordinary signed-message delivery to the first present HTTPS/HTTP/TCP URL.

package/esm/keri/npm/src/app/witness/ingress.js

@@ -2,6 +2,7 @@
 import { parse } from "cesr-ts";
 import { call, ensure } from "effection";
 import { rethrowCleanupFailure } from "../runtime/abortable.js";
+import { promptForEndRole } from "../runtime/cue-runtime.js";
 import { chunkBytes } from "../transport/byte-source.js";
 /** Return the active wire-message habitat or `null` when selection is ambiguous. */
 function cueHab(runtime, serviceHab) {
@@ -15,6 +16,7 @@ function cueHab(runtime, serviceHab) {
 /**
  * Route one initial witness cue batch, leaving saved key-state facts for the
  * application cue worker and its optional command-owned noticer destination.
+ * An accepted mailbox end role prompts the KEL publisher and poller as the cue worker does.
  * Respondant publishes Poster work; this ingress helper never drains Poster
  * network delivery. Query network I/O stays with the independent sender.
  *
@@ -39,6 +41,11 @@ export function* drainWitnessCues(runtime, serviceHab, cues, { deliver = true }
             cues.append(cue);
             continue;
         }
+        if (cue.kin === "endRoleSaved") {
+            cues.pull();
+            promptForEndRole(runtime, cue);
+            continue;
+        }
         if (deliver) {
             if (cue.kin === "query") {
                 runtime.querying.enqueueCue(cue, hab);

package/esm/keri/npm/src/app/witness/receipt-client.js

@@ -8,6 +8,7 @@ import { collectBytes } from "../transport/byte-source.js";
 import { buildCesrRequest, CESR_CONTENT_TYPE, KERIPY_CESR_JSON_CONTENT_TYPE } from "../transport/cesr-http.js";
 import { HTTPMessenger } from "../transport/http-messenger.js";
 import { requireTcpDialer } from "../transport/tcp-dialer.js";
+import { TransportError } from "../transport/transport-error.js";
 import { inspectReceiptMessage } from "./receipt-messages.js";
 const WitnessReceiptPollAttempts = 20;
 const WitnessReceiptPollDelayMs = 100;
@@ -51,6 +52,8 @@ function preferredWitnessTransportUrl(hab, witness) {
     return witnessHttpUrl(hab, witness) ?? witnessTcpUrl(hab, witness);
 }
 /**
+ * Deliver one message to a witness, reporting remote failure as data.
+ *
  * Send via HTTP first; an explicit protocol processor processes same-socket TCP replies.
  * Without a protocol processor TCP reports local transmission only. Actual socket/parser
  * cleanup finishes before this borrowed protocol processor can be released.
@@ -62,27 +65,51 @@ function preferredWitnessTransportUrl(hab, witness) {
  * @param clock Borrowed clock with epoch-millisecond now and millisecond timer delays.
  * @param protocol Optional same-socket reply processor; null selects transmit-only TCP.
  * @param auth Optional HTTP Authorization header value.
- * @throws Missing endpoint, peer refusal, transport/parser or cleanup failures propagate.
+ * @returns `unreachable` when the witness advertises no endpoint, refuses over HTTP, or the connection fails
+ * (`TransportError`); the caller decides whether to retry later. Parser, storage, programmer and cleanup
+ * failures still throw.
  */
-export function* sendWitnessMessage(hab, witness, bytes, http, clock, protocol, auth) {
+export function* deliverWitnessMessage(hab, witness, bytes, http, clock, protocol, auth) {
     const url = preferredWitnessTransportUrl(hab, witness);
     if (!url) {
-        throw new ValidationError(`Unable to find a valid endpoint for witness ${witness}.`);
+        return {
+            kind: "unreachable",
+            witness,
+            error: new ValidationError(`Unable to find a valid endpoint for witness ${witness}.`),
+        };
     }
-    const parsed = new URL(url);
-    if (parsed.protocol === "tcp:") {
-        yield* requireTcpDialer(http).messenger(url, clock, protocol).send(bytes, {
-            replies: Boolean(protocol),
-            local: true,
-        });
-        return;
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === "tcp:") {
+            yield* requireTcpDialer(http).messenger(url, clock, protocol).send(bytes, {
+                replies: Boolean(protocol),
+                local: true,
+            });
+            return { kind: "delivered" };
+        }
+        const outcome = yield* new HTTPMessenger(url, http, {
+            destination: witness,
+            headers: auth ? { Authorization: auth } : undefined,
+        }).send(bytes);
+        if (outcome.kind === "refuse")
+            return { kind: "unreachable", witness, error: outcome.error };
+        return { kind: "delivered" };
+    }
+    catch (error) {
+        if (!(error instanceof TransportError))
+            throw error;
+        return { kind: "unreachable", witness, error };
     }
-    const outcome = yield* new HTTPMessenger(url, http, {
-        destination: witness,
-        headers: auth ? { Authorization: auth } : undefined,
-    }).send(bytes);
-    if (outcome.kind === "refuse")
-        throw outcome.error;
+}
+/**
+ * Send one message to a witness for callers that require delivery.
+ *
+ * @throws The delivery's remote failure (missing endpoint, peer refusal, transport) and any local failure.
+ */
+export function* sendWitnessMessage(hab, witness, bytes, http, clock, protocol, auth) {
+    const delivery = yield* deliverWitnessMessage(hab, witness, bytes, http, clock, protocol, auth);
+    if (delivery.kind === "unreachable")
+        throw delivery.error;
 }
 function isKeripyContentTypeRejection(status, contentType, responseText) {
     return status === 406

package/esm/keri/npm/src/app/witness/receipting.js

@@ -8,8 +8,12 @@ import { dgKey } from "../../db/core/keys.js";
 import { acceptedEventReplayMessage } from "../identity/habbing.js";
 import { chunkBytes } from "../transport/byte-source.js";
 import { processMessages } from "../transport/message-source.js";
-import { getWitnessReceiptEndpoint, pollWitnessReceipt, postWitnessReceiptEndpoint, sendWitnessMessage, witnessHttpUrl, witnessTcpUrl, } from "./receipt-client.js";
+import { TransportError } from "../transport/transport-error.js";
+import { deliverWitnessMessage, getWitnessReceiptEndpoint, pollWitnessReceipt, postWitnessReceiptEndpoint, witnessHttpUrl, witnessTcpUrl, } from "./receipt-client.js";
 import { buildDetachedReceiptMessage } from "./receipt-messages.js";
+function incomplete(witness, error) {
+    return { kind: "incomplete", witness, error };
+}
 /** Build one `loc/scheme` replay bundle for witness introductions. */
 function* witnessSchemeReplies(hab, eids, gvrsn) {
     const replies = eids
@@ -94,7 +98,17 @@ export class Receiptor {
         this.gvrsn = gvrsn;
     }
     /** Submit the latest or specified event to all witnesses and gather receipts. */
-    *receipt(pre, { sn, auths = {}, allowTcp = false } = {}) {
+    *receipt(pre, options = {}) {
+        const outcome = yield* this.attempt(pre, options);
+        if (outcome.kind === "incomplete")
+            throw outcome.error;
+        return outcome.result;
+    }
+    /**
+     * Submit like `receipt`, but report a witness that is unreachable, refuses, or does not receipt as
+     * `incomplete` data. Local faults (unknown local AID, missing key state, storage) still throw.
+     */
+    *attempt(pre, { sn, auths = {}, allowTcp = false } = {}) {
         return yield* call(() => this.receiptOnce(pre, { sn, auths }, allowTcp));
     }
     /**
@@ -118,11 +132,13 @@ export class Receiptor {
         const { serder, message } = acceptedEventReplayMessage(this.hby, pre, eventSn, this.gvrsn);
         const witnesses = this.hby.db.acceptedEventWitnesses(serder);
         if (witnesses.length === 0) {
-            return { witnesses: [], statuses: {} };
+            return { kind: "receipted", result: { witnesses: [], statuses: {} } };
         }
         if (serder.ilk === Ilks.rot || serder.ilk === Ilks.drt) {
             for (const witness of serder.adds) {
-                yield* this.catchup(pre, witness);
+                const caughtUp = yield* this.replayHistory(hab, witness);
+                if (caughtUp.kind === "unreachable")
+                    return incomplete(witness, caughtUp.error);
             }
         }
         const receiptGroups = new Map();
@@ -134,23 +150,35 @@ export class Receiptor {
         for (const witness of witnesses) {
             if (kever.delegated) {
                 for (const dmsg of this.hby.db.cloneDelegation(kever, this.gvrsn)) {
-                    yield* sendWitnessMessage(hab, witness, this.selected(dmsg), this.http, this.clock, this.protocol);
+                    const delivery = yield* deliverWitnessMessage(hab, witness, this.selected(dmsg), this.http, this.clock, this.protocol);
+                    if (delivery.kind === "unreachable")
+                        return incomplete(witness, delivery.error);
                 }
             }
             if (allowTcp && !witnessHttpUrl(hab, witness) && witnessTcpUrl(hab, witness)) {
-                yield* sendWitnessMessage(hab, witness, this.selected(message), this.http, this.clock, this.protocol);
+                const delivery = yield* deliverWitnessMessage(hab, witness, this.selected(message), this.http, this.clock, this.protocol);
+                if (delivery.kind === "unreachable")
+                    return incomplete(witness, delivery.error);
                 statuses[witness] = 200;
             }
             else {
                 // A single receipt attempt owns its response until parsing and collection finish.
-                let response = yield* call(() => postWitnessReceiptEndpoint(hab, witness, message, this.http, auths[witness], this.gvrsn));
-                if (response.kind === "escrow") {
-                    response = yield* pollWitnessReceipt(hab, witness, pre, eventSn, said, this.http, this.gvrsn);
+                let response;
+                try {
+                    response = yield* call(() => postWitnessReceiptEndpoint(hab, witness, message, this.http, auths[witness], this.gvrsn));
+                    if (response.kind === "escrow") {
+                        response = yield* pollWitnessReceipt(hab, witness, pre, eventSn, said, this.http, this.gvrsn);
+                    }
+                }
+                catch (error) {
+                    if (!(error instanceof TransportError))
+                        throw error;
+                    return incomplete(witness, error);
                 }
                 statuses[witness] = response.status;
                 if (response.kind !== "accepted") {
                     const detail = response.kind === "reject" ? response.message : "receipt remained escrowed";
-                    throw new ValidationError(`Witness ${witness} failed to receipt ${pre}:${eventSn.toString(16)}: ${detail}`);
+                    return incomplete(witness, new ValidationError(`Witness ${witness} failed to receipt ${pre}:${eventSn.toString(16)}: ${detail}`));
                 }
                 yield* processMessages((signal) => chunkBytes(response.body, { signal }), this.protocol, this.kvy, {
                     local: false,
@@ -161,7 +189,7 @@ export class Receiptor {
             const index = witnesses.indexOf(witness);
             const wigers = this.hby.db.wigs.get(dgKey(pre, said)).filter((siger) => siger.index === index);
             if (wigers.length === 0) {
-                throw new ValidationError(`Witness ${witness} did not receipt ${pre}:${eventSn.toString(16)}.`);
+                return incomplete(witness, new ValidationError(`Witness ${witness} did not receipt ${pre}:${eventSn.toString(16)}.`));
             }
             receiptGroups.set(witness, wigers);
         }
@@ -190,9 +218,11 @@ export class Receiptor {
                     pipelined: true,
                     genusify: true,
                 }));
-            yield* sendWitnessMessage(hab, witness, concatBytes(...parts), this.http, this.clock, this.protocol);
+            const delivery = yield* deliverWitnessMessage(hab, witness, concatBytes(...parts), this.http, this.clock, this.protocol);
+            if (delivery.kind === "unreachable")
+                return incomplete(witness, delivery.error);
         }
-        return { witnesses, statuses };
+        return { kind: "receipted", result: { witnesses, statuses } };
     }
     /**
      * Query a stored witness receipt and apply it to local state when found.
@@ -243,15 +273,27 @@ export class Receiptor {
         if (!hab) {
             throw new ValidationError(`${pre} not a valid local AID.`);
         }
+        const delivery = yield* this.replayHistory(hab, witness);
+        if (delivery.kind === "unreachable")
+            throw delivery.error;
+    }
+    /** Replay a delegated inception's delegation chain and the KEL to one witness, stopping at the first failure. */
+    *replayHistory(hab, witness) {
         const kever = hab.kever;
-        if (kever?.delegated) {
-            for (const msg of this.hby.db.cloneDelegation(kever, this.gvrsn)) {
-                yield* sendWitnessMessage(hab, witness, this.selected(msg), this.http, this.clock, this.protocol);
-            }
-        }
-        for (const msg of this.hby.db.clonePreIter(pre, 0, this.gvrsn)) {
-            yield* sendWitnessMessage(hab, witness, this.selected(msg), this.http, this.clock, this.protocol);
+        const db = this.hby.db;
+        const gvrsn = this.gvrsn;
+        const pre = hab.pre;
+        const messages = (function* () {
+            if (kever?.delegated)
+                yield* db.cloneDelegation(kever, gvrsn);
+            yield* db.clonePreIter(pre, 0, gvrsn);
+        })();
+        for (const msg of messages) {
+            const delivery = yield* deliverWitnessMessage(hab, witness, this.selected(msg), this.http, this.clock, this.protocol);
+            if (delivery.kind === "unreachable")
+                return delivery;
         }
+        return { kind: "delivered" };
     }
     /** Complete streams select their framing before the body; detached receipt headers retain their existing enclosure. */
     selected(message) {

package/esm/keri/npm/src/cli/messaging/multisig.js

@@ -16,7 +16,7 @@ import { telEventStatus, waitForIssuedCredential, waitForTelEvent, } from "../..
 import { endpointRoleAccepted, isLocalGroupHab, localGroupMember, proposeGroupEndpointRole, } from "../../app/identity/endpoint-roleing.js";
 import { MULTISIG_REV_ROUTE, MULTISIG_ROT_ROUTE, MULTISIG_VCP_ROUTE } from "../../app/multisig/grouping.js";
 import { routeForKelEvent } from "../../app/multisig/multisig-workflows.js";
-import { proposeGroupInception, proposeGroupInteraction, proposeGroupRotation, settleProposedRotation, } from "../../app/multisig/proposing.js";
+import { proposeGroupInception, proposeGroupInteraction, proposeGroupRotation, } from "../../app/multisig/proposing.js";
 import { observeUntil } from "../../app/runtime/workflow-contract.js";
 import { ValidationError } from "../../core/errors.js";
 import { isV2RegistryRoute } from "../../core/exchange/protocol-exchanging.js";
@@ -272,8 +272,9 @@ export function* multisigRotateCommand(args) {
         let delegationPhase = null;
         let rootCopies = [];
         if (accepted) {
-            // The proposer's own acceptance must commit the rotated membership as a joiner's does.
-            settleProposedRotation({ hby }, sent);
+            // Acceptance was read straight from the KEL, possibly before the Counselor's pass: follow it now, since the
+            // root copies below go to the rotated members.
+            hby.alignGroupMembers(sent.group);
             delegationPhase = yield* finishAcceptedEvent(hby, runtime, sent.event, commandArgs);
             rootCopies = yield* resealAfterRotation(hby, runtime, sent.group, sent.event.said, since);
         }

package/esm/keri/npm/src/core/errors.js

@@ -32,6 +32,34 @@ export class ValidationError extends AppError {
         });
     }
 }
+/**
+ * A caller asked to treat a KRAM refusal as a failure. Carries the refused message SAID and the refusal decision;
+ * the message names the reason and, when the refusal has one, the last instant the message was acceptable.
+ */
+export class KramRefusedError extends ValidationError {
+    constructor(said, refusal) {
+        super(`KRAM refused message ${said}: ${refusal.reason}`
+            + (refusal.deadline ? ` (acceptable until ${refusal.deadline})` : ""));
+        Object.defineProperty(this, "said", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: said
+        });
+        Object.defineProperty(this, "refusal", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: refusal
+        });
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "KramRefusedError"
+        });
+    }
+}
 /** Filesystem or path-resolution failure from path-managed resources. */
 export class PathError extends AppError {
     constructor() {
@@ -120,3 +148,48 @@ export class DatabaseOperationError extends DatabaseError {
         });
     }
 }
+/**
+ * Local durable state that the store's own records say must exist is missing or contradicts itself: a local group
+ * names a member habitat the store does not hold, for example. Never a remote outcome: no peer message removes a
+ * local record, so a long-running loop does not survive it and lets it end the runtime. Recovery is repairing or
+ * replacing the store, not retrying.
+ */
+export class MissingDurableStateError extends DatabaseError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "MissingDurableStateError"
+        });
+    }
+}
+/**
+ * A browser composition's persistence queue gave up on a write after its retries (ADR-0015 rule 3), so it accepts
+ * no more commits and reports this from every later commit, flush and close. The cause is the write's first failure.
+ * The latch is terminal for that composition; recovery is closing it and opening a new one.
+ */
+export class PersistenceLatchedError extends DatabaseOperationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "PersistenceLatchedError"
+        });
+    }
+}
+/** A task passed to `PersistenceQueue.read` failed. Only its caller sees it; the queue does not latch. */
+export class PersistenceReadError extends DatabaseOperationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "PersistenceReadError"
+        });
+    }
+}

package/esm/keri/npm/src/core/kel/delegation-ancestry.js

@@ -1,8 +1,17 @@
 import { dgKey } from "../../db/core/keys.js";
 import { ValidationError } from "../errors.js";
-/** Whether one accepted delegator event carries the exact `{i,s,d}` seal of a delegated inception. */
+import { readEventSeal } from "../wire-fields.js";
+/**
+ * Whether one accepted delegator event carries the exact `{i,s,d}` seal of a delegated inception.
+ *
+ * The delegator's seals are remote-authored and unchecked at acceptance; other shapes and undecodable values are
+ * skipped (`readEventSeal`), never thrown.
+ */
 function approves(event, dip) {
-    return event.eventSeals.some((seal) => seal.i.qb64 === dip.pre && seal.s.numh === dip.snh && seal.d.qb64 === dip.said);
+    return event.seals.some((raw) => {
+        const seal = readEventSeal(raw);
+        return seal !== null && seal.i.qb64 === dip.pre && seal.s.numh === dip.snh && seal.d.qb64 === dip.said;
+    });
 }
 /**
  * Find the delegator's accepted approval of `dip`.

package/esm/keri/npm/src/core/kel/eventing.js

@@ -8,6 +8,7 @@ import { normalizeMbxTopicCursor } from "../mailbox/mailbox-topics.js";
 import { reply as replyEvent } from "../protocol-eventing.js";
 import { KeyStateRecord, ObservedRecord } from "../records.js";
 import { acceptReplyDecision, unverifiedReplyDecision } from "../routing.js";
+import { kelEventFieldDefect, readDater, readDiger, readOrdinal, readPrefixer, readSequenceNumber, } from "../wire-fields.js";
 import { acceptEscrow, acceptQuery, acceptReceipt, dropEscrow, dropQuery, dropReceipt, escrowQuery, escrowReceipt, ignoreReceipt, keepEscrow, logEscrowDecision, } from "./kever-decisions.js";
 import { Kever } from "./kever.js";
 import { deriveRotatedWitnessSet, hasUniqueWitnesses } from "./witnesses.js";
@@ -365,14 +366,15 @@ export class Kevery {
     processReceipt(envelope) {
         const serder = envelope.serder;
         const pre = serder.pre;
-        const sn = serder.sn;
+        // Decided before any escrow: a remote receipt's sn and prefix are read through the guarded readers.
+        const sn = readSequenceNumber(serder);
         const said = serder.said;
         const local = envelope.local ?? this.local;
-        if (!pre || sn === null || !said) {
+        if (!pre || !readPrefixer(pre) || sn === null || !said) {
             this.cues.push({
                 kin: "invalid",
                 serder,
-                reason: "Receipt message is missing receipted pre, sn, or said.",
+                reason: "Receipt message is missing a valid receipted pre, hex sn, or said.",
             });
             return;
         }
@@ -611,23 +613,22 @@ export class Kevery {
         const pre = serder.pre;
         const ilk = serder.ilk;
         const said = serder.said;
-        const sn = serder.sn;
+        // Every remote field value is decided here, before any escrow or store write: escrow replay re-enters through
+        // this method, so a row stored with a malformed value is rejected and removed instead of failing every pass.
+        const sn = readSequenceNumber(serder);
         if (!pre || !ilk || !said || sn === null) {
             return {
                 kind: "reject",
                 code: !pre ? "invalidPre" : !ilk ? "invalidIlk" : "invalidSn",
-                message: "KEL event must include pre, ilk, said, and sn.",
+                message: `KEL event must include pre, ilk, said, and a hex sn of at most ${Number.MAX_SAFE_INTEGER}.`,
             };
         }
-        try {
-            new Prefixer({ qb64: pre });
+        if (!readPrefixer(pre)) {
+            return { kind: "reject", code: "invalidPre", message: `Invalid pre=${pre} for event ${said}.` };
         }
-        catch (error) {
-            return {
-                kind: "reject",
-                code: "invalidPre",
-                message: `Invalid pre=${pre} for event ${said}: ${error instanceof Error ? error.message : String(error)}`,
-            };
+        const defect = kelEventFieldDefect(serder);
+        if (defect) {
+            return { kind: "reject", code: "malformedField", message: `Malformed ${defect} in event ${said} for ${pre}.` };
         }
         const local = envelope.local ?? this.local;
         const init = this.makeKeverEventInit(envelope, local);
@@ -939,16 +940,18 @@ export class Kevery {
             throw new ValidationError(`Unsupported route=${args.route} in ${Ilks.rpy} reply.`);
         }
         const ksn = KeyStateRecord.fromDict(args.serder.ked?.a);
-        const pre = typeof ksn.i === "string" ? ksn.i : null;
-        const sn = typeof ksn.s === "string" ? parseInt(ksn.s, 16) : null;
-        const said = typeof ksn.d === "string" ? ksn.d : null;
-        const dt = typeof ksn.dt === "string" ? ksn.dt : null;
-        if (!pre || sn === null || Number.isNaN(sn) || !said || !dt) {
+        // Decide the notice's field values before decideReply can escrow it.
+        const pre = readPrefixer(ksn.i)?.qb64 ?? null;
+        const sn = typeof ksn.s === "string" ? readOrdinal(ksn.s) : null;
+        const saider = readDiger(ksn.d);
+        const dater = readDater(ksn.dt);
+        if (!pre || sn === null || !saider || !dater) {
             throw new ValidationError("Malformed key state notice reply body.");
         }
+        const said = saider.qb64;
         if (!this.lax) {
             const watchers = this.configuredWatchers();
-            const backers = ksn.b ?? [];
+            const backers = Array.isArray(ksn.b) ? ksn.b : [];
             // In non-lax mode, only the controller, a reported KSN backer, or a
             // locally configured watcher may advance saved key state.
             const trusted = args.aid === pre
@@ -986,8 +989,6 @@ export class Kevery {
         if (ldig && ldig !== said) {
             throw new ValidationError(`Mismatch key state at sn=${sn} with accepted event log for ${pre}.`);
         }
-        const saider = new Diger({ qb64: said });
-        const dater = new Dater({ qb64: encodeDateTimeToDater(dt) });
         const cues = [{ kin: "keyStateSaved", ksn }];
         this.rvy.writeReply(reply);
         this.updateKeyState(args.aid, ksn, saider, dater);
@@ -1025,15 +1026,11 @@ export class Kevery {
             throw new ValidationError(`Unsupported route=${args.route} in ${Ilks.rpy} reply.`);
         }
         const data = args.serder.ked?.a;
-        const cid = typeof data?.cid === "string"
-            ? new Prefixer({ qb64: data.cid }).qb64
-            : null;
-        const oid = typeof data?.oid === "string"
-            ? new Prefixer({ qb64: data.oid }).qb64
-            : null;
+        const cid = readPrefixer(data?.cid)?.qb64 ?? null;
+        const oid = readPrefixer(data?.oid)?.qb64 ?? null;
         const oobi = typeof data?.oobi === "string" ? data.oobi : null;
         if (!cid || !oid) {
-            throw new ValidationError("Missing one of cid/oid in /watcher reply.");
+            throw new ValidationError("Missing or malformed one of cid/oid in /watcher reply.");
         }
         const keys = [cid, args.aid, oid];
         let osaider = this.db.wwas.get(keys);

package/esm/keri/npm/src/core/kel/kever.js

@@ -1,8 +1,9 @@
-import { Dater, Diger, Ilks, NumberPrimitive, Prefixer, SealSource, Siger, Tholder, Verfer, } from "cesr-ts";
+import { Dater, Diger, Ilks, NumberPrimitive, Prefixer, SealEvent, SealSource, Siger, Tholder, Verfer, } from "cesr-ts";
 import { dgKey } from "../../db/core/keys.js";
 import { encodeDateTimeToDater, makeNowIso8601 } from "../../time/mod.js";
 import { ValidationError } from "../errors.js";
 import { KeyStateRecord } from "../records.js";
+import { readEventSeal } from "../wire-fields.js";
 import { deriveRotatedWitnessSet } from "./witnesses.js";
 /**
  * Convert one integer into the Huge-number CESR family used for durable replay
@@ -1434,16 +1435,21 @@ export class Kever {
         }
         return this.db.getState(pre)?.di || null;
     }
-    /** Return the zero-based index of the matching event seal or `-1`. */
+    /**
+     * Return the zero-based index of the matching event seal among the candidate's event-shaped seals, or `-1`.
+     *
+     * The candidate is an accepted delegator event, which is remote-authored: its `a` may hold any seal shape and
+     * undecodable values. Like KERIpy, the index counts entries with the `{i, s, d}` field shape; other shapes and
+     * malformed values never match (`readEventSeal`).
+     */
     eventAnchorSealIndex(candidate, serder) {
-        for (const [index, seal] of candidate.eventSeals.entries()) {
-            if (seal.i.qb64 === serder.pre
+        return candidate.seals.filter((raw) => SealEvent.isSad(raw)).findIndex((raw) => {
+            const seal = readEventSeal(raw);
+            return seal !== null
+                && seal.i.qb64 === serder.pre
                 && seal.s.numh === serder.snh
-                && seal.d.qb64 === serder.said) {
-                return index;
-            }
-        }
-        return -1;
+                && seal.d.qb64 === serder.said;
+        });
     }
     /**
      * Verify one indexed-signature set against a given verifier list.

package/esm/keri/npm/src/core/mailbox/kram-policy.js

@@ -29,6 +29,14 @@ function storedCacheType(db, ilk, route) {
 export function singleKeyQueryWindow(db, route) {
     return storedCacheType(db, "qry", route)?.sl ?? null;
 }
+/**
+ * How long an exchange of a message of `ilk` on `route` stays open after its opener under the windows this store
+ * is configured with now, in milliseconds: the exchange lag `xl`. Null when this store has no KRAM cache types
+ * (KRAM never ran on it).
+ */
+export function exchangeWindow(db, ilk, route) {
+    return storedCacheType(db, ilk, route)?.xl ?? null;
+}
 /** Validate caller configuration before any durable policy mutation. */
 function windows(value, transitional = false) {
     if (!Array.isArray(value) || value.length !== 7 || value.some((v) => !Number.isSafeInteger(v) || v < 0)) {