keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/db/basing.js

@@ -1,22 +1,20 @@
 /** KERI event-log databaser built on `LMDBer` composition. */
-import { b, Cigar, Dater, Diger, essrPayload, Labeler, Noncer, NumberPrimitive, NumDex, Prefixer, ResourceLimitError, ResourcePolicy, Saider, SealEvent, Seqner, SerderKERI, Siger, t, Texter, Verfer, Verser, Vrsn_1_0, } from "cesr-ts";
-import { join } from "../deps/jsr.io/@std/path/1.1.6/mod.js";
-import { action, call } from "effection";
-import { attachmentCounterPayloadQb64b, attachmentCounterQb64b, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
-import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
-import { Kever } from "../core/kever.js";
+import { b, Cigar, Dater, Diger, Ilks, Labeler, Noncer, NumberPrimitive, NumDex, Prefixer, Saider, SealEvent, SerderKERI, Siger, t, Texter, Verfer, Verser, Vrsn_1_0, } from "cesr-ts";
+import { action } from "effection";
+import { attachmentCounterPayloadQb64b, attachmentCounterQb64b, attachmentOrdinal, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
+import { DatabaseNotOpenError, DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { Kever } from "../core/kel/kever.js";
 import { consoleLogger } from "../core/logger.js";
 import { CacheTypeRecord, EndpointRecord, EventSourceRecord, HabitatRecord, KeyStateRecord, LocationRecord, MsgCacheRecord, ObservedRecord, OobiRecord, TopicsRecord, TxnMsgCacheRecord, WellKnownAuthN, } from "../core/records.js";
-import { dgKey, splitOnKey, suffix, unsuffix } from "./core/keys.js";
+import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
+import { baserDefaults } from "./baser-defaults.js";
+import { dgKey, splitOnKey } from "./core/keys.js";
 import { LMDBer } from "./core/lmdber.js";
-import { ExchangeRecord, PlaintextRecord } from "./exchange-records.js";
-import { CapturedKelReplay } from "./kel-replay.js";
+import { ExchangeRecord, ExchangeRegistryStateRecord } from "./exchange/exchange-records.js";
 import { IoSetKomer, Komer } from "./koming.js";
-import { MailboxInbox } from "./mailbox-inbox.js";
-import { PayloadArchive } from "./payload-archive.js";
-import { payloadRange } from "./payload-view.js";
-import { B64OnIoDupSuber, BytesIoSetSuber, BytesSuber, CatCesrIoSetSuber, CatCesrSuber, CesrIoSetSuber, CesrOnSuber, CesrSuber, IoSetSuber, OnIoDupSuber, OnSuber, SchemerSuber, SerderSuber, Suber, } from "./subing.js";
-import { CapturedWitnessReplay } from "./witness-replay.js";
+import { CapturedKelReplay } from "./replay/kel-replay.js";
+import { CapturedWitnessReplay } from "./replay/witness-replay.js";
+import { B64OnIoDupSuber, BytesIoSetSuber, CatCesrIoSetSuber, CatCesrSuber, CesrIoSetSuber, CesrOnSuber, CesrSuber, IoSetSuber, OnIoDupSuber, OnSuber, SchemerSuber, SerderSuber, Suber, } from "./subing.js";
 function isMissingReloadEventError(error) {
     return error instanceof Error
         && error.message.startsWith("Missing accepted event for reloaded Kever state ");
@@ -55,6 +53,10 @@ function eventSealsEqual(left, right) {
 function encodeHugeOrdinal(num) {
     return new NumberPrimitive({ code: NumDex.Huge, raw: hugeOrdinalRaw(num) });
 }
+/** Preserve qualified numeric source ordinals; normalize legacy Seqner input to the stored number family. */
+function eventSourceOrdinal(ordinal) {
+    return ordinal instanceof NumberPrimitive ? ordinal : encodeHugeOrdinal(ordinal.sn);
+}
 function hugeOrdinalRaw(num) {
     const raw = new Uint8Array(16);
     let value = BigInt(num);
@@ -64,9 +66,6 @@ function hugeOrdinalRaw(num) {
     }
     return raw;
 }
-function seqnerFromNumber(number) {
-    return new Seqner({ code: NumDex.Huge, raw: hugeOrdinalRaw(number.num) });
-}
 /**
  * High-level event-log databaser for KERI application state.
  *
@@ -89,195 +88,21 @@ function seqnerFromNumber(number) {
  *   subset is actively driven by `Habery`/CLI in this arc
  */
 export class Baser {
-    /** Private provenance is separate from the KERIpy exchange wire tables. */
-    get exchangeMeta() {
-        return this.exchangeMetadata ??= new Komer(this.lmdber, {
-            subkey: "exchange.meta.",
-            recordClass: ExchangeRecord,
-        });
-    }
-    /** Open the exclusive file owner lazily and finish recovery before admitting payloads. */
-    openPayloads(signal) {
-        signal?.throwIfAborted();
-        if (!this.opened || !this.path)
-            return Promise.reject(new Error("Payload database is closed"));
-        if (this.archive)
-            return this.archive;
-        const opening = this.recoverPayloads(signal);
-        this.archive = opening;
-        // Failed or cancelled recovery owns its cleanup and permits a later fresh admission.
-        void opening.catch(() => {
-            if (this.archive === opening)
-                this.archive = undefined;
-        });
-        return opening;
-    }
-    /** Remove interrupted wire rows while the archive still excludes all payload admissions. */
-    async recoverPayloads(signal) {
-        const archive = await PayloadArchive.open(this.lmdber, join(this.path, "payloads"), signal);
-        try {
-            let previous;
-            let owned = false;
-            // Exclusive startup proves all private staging rows belong to interrupted admissions.
-            let removed = this.enstStaging.trim();
-            // Scan physical keys only: a crashed write can leave arbitrarily many Texter rows.
-            for (const table of [this.essrs, this.enst]) {
-                previous = undefined;
-                for (const key of table.sdb.getKeys()) {
-                    signal?.throwIfAborted();
-                    const [saidKey] = unsuffix(key);
-                    const said = t(saidKey);
-                    if (said !== previous) {
-                        previous = said;
-                        // Preserve KERIpy-origin wire evidence without requiring our private metadata.
-                        owned = this.exns.sdb.doesExist(saidKey) || this.epse.sdb.doesExist(saidKey) || this.hasSchemaEscrow(said);
-                    }
-                    if (!owned)
-                        removed = table.sdb.removeSync(key) || removed;
-                }
-            }
-            if (removed)
-                await this.lmdber.env.flushed;
-            signal?.throwIfAborted();
-            return archive;
-        }
-        catch (error) {
-            await archive.close();
-            throw error;
-        }
-    }
-    /** Reopen private wire or borrow bounded KERIpy rows when no private metadata exists. */
-    async getEssr(said, signal, { maxEssrBytes = 8 * 1024 ** 2, maxEssrItems = 16384 } = {}) {
-        signal?.throwIfAborted();
-        for (const limit of [maxEssrBytes, maxEssrItems]) {
-            if (!Number.isSafeInteger(limit) || limit < 0)
-                throw new RangeError("Invalid stored ESSR limit");
-        }
-        if (!Number.isSafeInteger(4 * Math.ceil(maxEssrBytes / 3) + 12 * maxEssrItems)) {
-            throw new RangeError("Stored ESSR wire limit exceeds safe integer range");
-        }
-        const metadata = this.exchangeMeta.get([said])?.essr;
-        if (!metadata)
-            return this.borrowEssr(said, maxEssrBytes, maxEssrItems, signal);
-        if (metadata.count > maxEssrItems || metadata.size > maxEssrBytes) {
-            throw new ResourceLimitError("Stored ESSR exceeds admission limits");
-        }
-        const wire = await (await this.openPayloads(signal)).get(`essr/${said}`, signal);
-        if (!wire)
-            throw new Error("Exchange ESSR reference is missing");
-        return essrPayload({
-            size: wire.size,
-            /** Reopen the archive's immutable wire object for each decoded read. */
-            open: (signal) => wire.open(signal),
-            /** The archive retains ownership when a consumer releases this view. */
-            discard: async () => { },
-        }, metadata.count, metadata.size, metadata.gvrsn);
-    }
-    /** Preserve the insertion order and deduplication already represented by KERIpy rows. */
-    borrowEssr(said, maxBytes, maxItems, signal) {
+    /**
+     * Read pinned-main ESSR evidence only while an accepted or pending EXN owns it.
+     * Return hydrated Texters in first-insertion order, or null for absent/unowned
+     * evidence. These are set members, not the original fragment sequence: equal
+     * qualified values deduplicate and alternate fragmentations may add members.
+     * Callers needing authenticated payload bytes must verify the signed digest
+     * against this reconstruction; reading rows does not establish acceptance.
+     */
+    getEssrs(said) {
         if (!this.exns.get([said]) && !this.epse.get([said]) && !this.hasSchemaEscrow(said))
             return null;
-        let count = 0;
-        let size = 0;
-        let wireSize = 0;
-        for (const texter of this.essrRows(said, maxBytes, maxItems, signal)) {
-            count++;
-            size += texter.raw.length;
-            wireSize += texter.qb64.length;
-        }
-        if (!count)
-            return null;
-        /** Revisit current rows without retaining tokens or an item-size manifest. */
-        const rows = (signal) => this.essrRows(said, maxBytes, maxItems, signal);
-        return essrPayload({
-            size: wireSize,
-            /** Copy bounded chunks so a stored large token never supplies an oversized backing buffer. */
-            async *open(signal) {
-                for (const texter of rows(signal)) {
-                    const wire = texter.qb64b;
-                    for (let offset = 0; offset < wire.length; offset += 65536) {
-                        signal?.throwIfAborted();
-                        yield wire.slice(offset, offset + 65536);
-                    }
-                }
-            },
-            /** Releasing a borrowed view never deletes protocol evidence. */
-            async discard() { },
-        }, count, size, Vrsn_1_0); // The wire table records no original frame genus.
-    }
-    /** Admit stored token size/count before hydration; never assemble a complete ESSR message. */
-    *essrRows(said, maxBytes, maxItems, signal) {
-        let count = 0;
-        let size = 0;
-        signal?.throwIfAborted();
-        // Scan keys first so neither an over-count row nor an adjacent owner reads a value.
-        for (const key of this.essrs.sdb.getKeys({ start: suffix(b(said), 0) })) {
-            signal?.throwIfAborted();
-            if (t(unsuffix(key)[0]) !== said)
-                break;
-            if (++count > maxItems)
-                throw new ResourceLimitError("Stored ESSR exceeds admission limits");
-            const wire = this.essrs.sdb.get(key);
-            if (!wire)
-                throw new Error("Stored ESSR row disappeared during traversal");
-            if (wire.length > 4 * Math.ceil((maxBytes - size) / 3) + 12) {
-                throw new ResourceLimitError("Stored ESSR exceeds admission limits");
-            }
-            const texter = new Texter({ qb64b: wire });
-            size += texter.raw.length;
-            if (size > maxBytes)
-                throw new ResourceLimitError("Stored ESSR exceeds admission limits");
-            if (texter.qb64.length !== wire.length)
-                throw new Error("Stored ESSR row has trailing bytes");
-            yield texter;
-        }
-    }
-    /** Persist caller-authenticated recipient output after its signed exchange is accepted. */
-    async savePlaintext(said, plaintext, offset, signal) {
-        signal?.throwIfAborted();
-        if (!this.exns.get([said]))
-            throw new Error("Cannot store plaintext for an unaccepted exchange");
-        payloadRange(plaintext, offset);
-        const metadata = this.plaintextMetadata ??= new Komer(this.lmdber, {
-            subkey: "plaintext.meta.",
-            recordClass: PlaintextRecord,
-        });
-        const previous = metadata.get([said]);
-        if (previous && previous.offset !== offset) {
-            throw new Error("Plaintext header offset conflicts with its stored value");
-        }
-        const stored = await (await this.openPayloads(signal)).publish(`plain/${said}`, plaintext, () => {
-            metadata.pin([said], { offset });
-        }, signal);
-        return { plaintext: stored, body: payloadRange(stored, offset) };
-    }
-    /** Reopen the authenticated inner CESR source independently of ciphertext evidence. */
-    async getPlaintext(said, signal) {
-        signal?.throwIfAborted();
-        const metadata = this.plaintextMetadata ??= new Komer(this.lmdber, {
-            subkey: "plaintext.meta.",
-            recordClass: PlaintextRecord,
-        });
-        const record = metadata.get([said]);
-        if (!record)
-            return null;
-        const plaintext = await (await this.openPayloads(signal)).get(`plain/${said}`, signal);
-        if (!plaintext)
-            throw new Error("Plaintext reference is missing");
-        return { plaintext, body: payloadRange(plaintext, record.offset) };
-    }
-    /** Open opt-in consumer storage lazily so legacy/read-only opens require no new subdatabase. */
-    get mailboxInbox() {
-        return this.inbox ??= new MailboxInbox(this.lmdber, this.tops);
+        const fragments = this.essrs.get([said]);
+        return fragments.length ? fragments : null;
     }
     constructor(options = {}) {
-        /** Survives runtime shutdown because runtimes borrow this database. */
-        Object.defineProperty(this, "resources", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         Object.defineProperty(this, "lmdber", {
             enumerable: true,
             configurable: true,
@@ -308,6 +133,7 @@ export class Baser {
             writable: true,
             value: new Set()
         });
+        /** Locally prepared/membered group identities; membership does not itself prove KEL acceptance. */
         Object.defineProperty(this, "groups", {
             enumerable: true,
             configurable: true,
@@ -554,28 +380,15 @@ export class Baser {
             writable: true,
             value: void 0
         }); // Observed identifier records keyed by controller, watcher, and observed ID.
-        Object.defineProperty(this, "inbox", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        /** One lazily opened file owner, shared by parser staging and runtime storage. */
-        Object.defineProperty(this, "archive", {
+        /** Receiver receipt, mailbox provenance and attachment genus; no payload ownership. */
+        Object.defineProperty(this, "exchangeMeta", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
-        /** Private accepted/escrow provenance; protocol evidence stays in KERIpy tables. */
-        Object.defineProperty(this, "exchangeMetadata", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        /** Authenticated plaintext offsets used to reconstruct inner-stream views. */
-        Object.defineProperty(this, "plaintextMetadata", {
+        /** Registry observations from successful Grant verification, keyed by (Grant, node). */
+        Object.defineProperty(this, "exrs", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -622,7 +435,7 @@ export class Baser {
             configurable: true,
             writable: true,
             value: void 0
-        }); // Exchange-message partial signature escrow datetimes.
+        }); // Absolute partial-signature deadlines; v2 Grant originals survive body removal.
         /** Optional on readonly legacy stores; schema dependencies share one absolute deadline. */
         Object.defineProperty(this, "emse", {
             enumerable: true,
@@ -679,25 +492,30 @@ export class Baser {
             writable: true,
             value: void 0
         });
-        /** Private provisional wire rows, atomically moved to enst. with the accepted/escrow marker. */
-        Object.defineProperty(this, "enstStaging", {
+        Object.defineProperty(this, "epath", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
-        });
-        Object.defineProperty(this, "epath", {
+        }); // Exchange-message pathed attachments.
+        /**
+         * Pinned KERIpy main's `essrs.` table: EXN SAID keys, qualified Texter values,
+         * native insertion-ordered set semantics. Duplicate add=false is normal, not
+         * a write failure. This binding does not claim legacy `.essrs` interchange.
+         */
+        Object.defineProperty(this, "essrs", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
-        }); // Exchange-message pathed attachments.
-        Object.defineProperty(this, "essrs", {
+        });
+        /** KERIpy `rrpe.`: `/registry/root` copies in `exns`/`essrs` awaiting automatic retention; SAID -> time it entered escrow; no timeout. */
+        Object.defineProperty(this, "rrpe", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
-        }); // ESSR payloads keyed by exchange digest.
+        });
         Object.defineProperty(this, "chas", {
             enumerable: true,
             configurable: true,
@@ -908,18 +726,6 @@ export class Baser {
             writable: true,
             value: void 0
         }); // KRAM transactioned message-cache records.
-        Object.defineProperty(this, "kready", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        }); // Private first ready receiver timestamp; consumed only after joined handoff.
-        Object.defineProperty(this, "kpnd", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        }); // Private KRAM parent snapshots, never accepted wire publication.
         Object.defineProperty(this, "ulgs", {
             enumerable: true,
             configurable: true,
@@ -1010,17 +816,8 @@ export class Baser {
             writable: true,
             value: void 0
         }); // Type-media quadruples.
-        this.resources = options.resources ?? new ResourcePolicy();
         this.logger = options.logger ?? consoleLogger;
-        const compat = options.compat ?? false;
-        this.lmdber = new LMDBer(options, {
-            tailDirPath: Baser.TailDirPath,
-            cleanTailDirPath: "keri/clean/db",
-            altTailDirPath: compat ? Baser.CompatAltTailDirPath : Baser.AltTailDirPath,
-            altCleanTailDirPath: compat ? ".keri/clean/db" : ".tufa/clean/db",
-            tempPrefix: Baser.TempPrefix,
-            maxNamedDBs: Baser.MaxNamedDBs,
-        });
+        this.lmdber = new LMDBer(options, baserDefaults(options.compat));
     }
     /** Expose the resolved logical database name delegated from the root LMDBer. */
     get name() {
@@ -1054,9 +851,13 @@ export class Baser {
     get env() {
         return this.lmdber.env;
     }
-    /** Admit one physical binary row before its owned copy; native scratch remains separate. */
-    getValBounded(table, key, maxBytes) {
-        return this.lmdber.getValBounded(table, key, maxBytes);
+    /** Report an active caller writer without exposing native transaction internals. */
+    get inWriteTransaction() {
+        return this.lmdber.inWriteTransaction;
+    }
+    /** Read an owned binary row through the backing database's normal copy path. */
+    getVal(table, key) {
+        return this.lmdber.getVal(table, key);
     }
     /**
      * Reopen the root LMDB environment and bind the KERIpy-style named subdbs.
@@ -1067,17 +868,6 @@ export class Baser {
      * than hand-rolled raw LMDB handles.
      */
     *reopen(options = {}) {
-        if (options.resources && options.resources !== this.resources) {
-            throw new RangeError("Baser reopen requires its original resource policy");
-        }
-        if (this.archive) {
-            yield* call(async () => {
-                await (await this.archive.catch(() => null))?.close();
-            });
-        }
-        this.archive = undefined;
-        this.exchangeMetadata = undefined;
-        this.plaintextMetadata = undefined;
         const opened = yield* this.lmdber.reopen(options);
         if (!opened) {
             return false;
@@ -1261,7 +1051,6 @@ export class Baser {
                 subkey: "witm.",
                 recordClass: TopicsRecord,
             });
-            this.inbox = undefined;
             // Group partial signature escrow entries.
             this.gpse = new CatCesrIoSetSuber(this.lmdber, {
                 subkey: "gpse.",
@@ -1297,6 +1086,9 @@ export class Baser {
                 : null;
             // Exchange messages keyed by digest.
             this.exns = new SerderSuber(this.lmdber, { subkey: "exns." });
+            // Bind metadata during store opening, never lazily inside an admission that may abort.
+            this.exchangeMeta = new Komer(this.lmdber, { subkey: "exchange.meta.", recordClass: ExchangeRecord });
+            this.exrs = new Komer(this.lmdber, { subkey: "exrs.", recordClass: ExchangeRegistryStateRecord });
             // Forward pointers to provided reply messages.
             this.erpy = new CesrSuber(this.lmdber, {
                 subkey: "erpy.",
@@ -1321,12 +1113,13 @@ export class Baser {
             // Exchange-message pathed attachments.
             this.epath = new IoSetSuber(this.lmdber, { subkey: ".epath" });
             this.enst = new IoSetSuber(this.lmdber, { subkey: "enst." });
-            this.enstStaging = new IoSetSuber(this.lmdber, { subkey: "enst.stage." });
             // Encrypt-Sender-Sign-Receiver payloads keyed by exchange digest.
             this.essrs = new CesrIoSetSuber(this.lmdber, {
-                subkey: ".essrs",
+                subkey: "essrs.",
                 ctor: Texter,
             });
+            // Registry root copies awaiting automatic retention, keyed by exchange SAID.
+            this.rrpe = new CesrSuber(this.lmdber, { subkey: "rrpe.", ctor: Dater });
             // Accepted signed challenge-response exchange-message SAIDs keyed by the
             // signer prefix.
             this.chas = new CesrIoSetSuber(this.lmdber, {
@@ -1491,8 +1284,6 @@ export class Baser {
                 subkey: "tmsc.",
                 recordClass: TxnMsgCacheRecord,
             });
-            this.kpnd = new BytesSuber(this.lmdber, { subkey: "kpnd." });
-            this.kready = new Suber(this.lmdber, { subkey: "kready." });
             this.ulgs = new CesrIoSetSuber(this.lmdber, { subkey: "ulgs.", ctor: Prefixer });
             this.cigs = new CatCesrIoSetSuber(this.lmdber, { subkey: "cigs.", ctor: [Verfer, Cigar] });
             // KRAM partially signed multi-key messages keyed by `(AID, MID)`.
@@ -1560,19 +1351,11 @@ export class Baser {
         }
         catch (error) {
             this.logger.error(`Failed to open Baser sub-databases: ${error}`);
-            throw new DatabaseOperationError("Failed to open Baser sub-databases", { cause: error instanceof Error ? error.message : String(error) });
+            throw new DatabaseOperationError("Failed to open Baser sub-databases", { cause: error });
         }
     }
     /** Close the underlying LMDB resources. */
     *close(clear = false) {
-        if (this.archive) {
-            yield* call(async () => {
-                await (await this.archive.catch(() => null))?.close();
-            });
-        }
-        this.archive = undefined;
-        this.exchangeMetadata = undefined;
-        this.plaintextMetadata = undefined;
         this.kevers.clear();
         this.prefixes.clear();
         this.groups.clear();
@@ -1646,23 +1429,49 @@ export class Baser {
             }
         }
     }
+    /** Resolve the stored establishment governing an accepted event's witnesses. */
+    acceptedEventEstablishment(serder) {
+        const pre = serder.pre;
+        const sn = serder.sn;
+        const said = serder.said;
+        if (!pre || !said || sn === null || !this.kels.getOn(pre, sn).includes(said))
+            return null;
+        let event = this.getEvtSerder(pre, said);
+        while (event && !event.estive) {
+            event = event.prior ? this.getEvtSerder(pre, event.prior) : null;
+        }
+        return event;
+    }
     /**
-     * Return true when `serder` currently satisfies the stored witness threshold.
-     *
-     * KERIpy correspondence:
-     * - mirrors `Baser.fullyWitnessed(...)`
+     * Resolve an accepted event's receipt witnesses from its latest establishment.
+     * Like KERIpy Kevery.fetchWitnessState, interactions inherit an establishment's
+     * stored cohort, including an empty cohort. Follow this event's prior digests
+     * so a recovery at the same ordinal cannot replace its historical cohort.
+     * Partial-witness escrows derive their cohort separately before acceptance.
+     */
+    acceptedEventWitnesses(serder) {
+        const event = this.acceptedEventEstablishment(serder);
+        return event ? this.wits.get(dgKey(event.pre, event.said)).map((wit) => wit.qb64) : null;
+    }
+    /**
+     * Return whether an accepted event has its governing establishment's receipts.
+     * Later rotations cannot raise or lower this historical event's required
+     * witness threshold.
+     * Reverify retained signatures against that event and count distinct witnesses;
+     * early event escrows may have stored attachments before witness verification.
      */
     fullyWitnessed(serder) {
-        const pre = serder.pre;
-        const said = serder.said;
-        if (!pre || !said) {
+        const establishment = this.acceptedEventEstablishment(serder);
+        if (!establishment)
             return false;
-        }
-        const kever = this.getKever(pre);
-        if (!kever) {
+        const witnesses = this.wits.get(dgKey(establishment.pre, establishment.said));
+        const threshold = establishment.bner.num;
+        if (threshold === 0n)
+            return witnesses.length === 0;
+        if (threshold < 1n || threshold > BigInt(witnesses.length))
             return false;
-        }
-        return BigInt(this.wigs.get(dgKey(pre, said)).length) >= kever.toader.num;
+        const verified = Kever.verifyIndexedSignatures(serder.raw, this.wigs.get(dgKey(serder.pre, serder.said)), witnesses.map((witness) => new Verfer({ qb64: witness.qb64 })));
+        return BigInt(verified.indices.length) >= threshold;
     }
     /**
      * Find the first fully witnessed event in `pre`'s KEL that carries `seal`.
@@ -1730,6 +1539,63 @@ export class Baser {
         }
         return next;
     }
+    /** Fix prospective FEL metadata before the processing owner admits follow-up work or writes. */
+    prepareKelEventLog(args) {
+        const pre = args.serder.pre;
+        if (!pre || !args.serder.said || args.serder.sn === null) {
+            throw new ValidationError("logEvent requires pre, said, and sn.");
+        }
+        return {
+            fn: args.first ? this.nextFelOrdinal(pre) : null,
+            dater: args.frc?.dt ?? new Dater({ qb64: encodeDateTimeToDater(makeNowIso8601()) }),
+        };
+    }
+    /**
+     * Persist verified accepted/duplicate event material under the caller's synchronous writer.
+     * The processing owner supplies the validated delegated fact, admits follow-up
+     * work before this call, and publishes live state/cues after native commit.
+     * This owns row layout and first-seen checks, not decisions, queues or transport.
+     */
+    writeKelEventLog(args, prepared, delegated) {
+        const local = args.local ?? false;
+        const pre = args.serder.pre, said = args.serder.said, sn = args.serder.sn;
+        if (!pre || !said || sn === null) {
+            throw new ValidationError("logEvent requires pre, said, and sn.");
+        }
+        const first = args.first ?? false;
+        const { fn, dater } = prepared;
+        if (fn !== (first ? this.nextFelOrdinal(pre) : null)) {
+            throw new Error("Prepared first-seen ordinal changed before logging");
+        }
+        const dgkey = dgKey(pre, said);
+        this.dtss.put(dgkey, dater);
+        if (args.sigers?.length)
+            this.sigs.put(dgkey, [...args.sigers]);
+        if (args.wigers?.length)
+            this.wigs.put(dgkey, [...args.wigers]);
+        if (args.wits?.length)
+            this.wits.put(dgkey, args.wits.map((wit) => new Prefixer({ qb64: wit })));
+        this.evts.put(dgkey, args.serder);
+        if (args.sourceSeal && delegated && args.serder.ilk !== Ilks.ixn) {
+            this.aess.pin(dgkey, [eventSourceOrdinal(args.sourceSeal.s), args.sourceSeal.d]);
+        }
+        const existing = this.esrs.get(dgkey);
+        if (existing) {
+            if (local && !existing.local) {
+                existing.local = true;
+                this.esrs.pin(dgkey, existing);
+            }
+        }
+        else
+            this.esrs.put(dgkey, { local });
+        if (first) {
+            if (this.appendFel(pre, said) !== fn)
+                throw new Error("First-seen append disagrees with preparation");
+            this.dtss.pin(dgkey, dater);
+            this.fons.pin(dgkey, encodeHugeOrdinal(fn));
+        }
+        this.kels.add(pre, sn, said);
+    }
     /** Read one first-seen digest by `(pre, fn)` from `fels.`. */
     getFel(pre, fn) {
         return this.fels.getOn(pre, fn);
@@ -1793,6 +1659,9 @@ export class Baser {
         const removes = [];
         for (const [pre, habord] of this.getHabItemIter()) {
             const hid = habord.hid || pre;
+            // Prepared membership survives reopen independently of accepted key state.
+            if (habord.mid)
+                this.groups.add(hid);
             const state = this.getState(hid);
             if (!state) {
                 if (!habord.mid) {
@@ -1804,9 +1673,6 @@ export class Baser {
                 const kever = Kever.fromState({ state, db: this });
                 this.kevers.set(kever.pre, kever);
                 this.prefixes.add(kever.pre);
-                if (habord.mid) {
-                    this.groups.add(hid);
-                }
             }
             catch (error) {
                 if (!habord.mid && isMissingReloadEventError(error)) {
@@ -1863,62 +1729,40 @@ export class Baser {
      * This is the durable export/replay seam for locally stored events. The
      * event body comes from `evts.`, while the attached foot is reconstructed
      * from the companion stores that hold controller signatures, witness
-     * signatures, source seals, receipts, and first-seen replay metadata. An optional
-     * byte budget preflights the body row before owned materialization and admits
-     * each evidence item before retaining the full message. Unlimited legacy calls
-     * keep their ordinary read path; fixed native scratch is separate overhead.
+     * signatures, source seals, receipts, and first-seen replay metadata.
      */
-    cloneEvtMsg(pre, fn, said, maxBytes = Infinity) {
-        if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 1)) {
-            throw new RangeError("Replay byte limit must be a positive safe integer");
-        }
+    cloneEvtMsg(pre, fn, said, requestedGenus = Vrsn_1_0) {
         const dgkey = dgKey(pre, said);
-        // A finite replay ceiling applies at the native row boundary, before owned copies or hydration.
-        const stored = maxBytes === Infinity
-            ? this.getEvt(dgkey)
-            : this.getValBounded(this.evtsRaw, dgkey, maxBytes);
+        const stored = this.getEvt(dgkey);
         if (stored === null)
             throw new DatabaseOperationError(`Missing event body for ${pre}:${said}`);
-        return this.cloneStoredEvtMsg(pre, fn, said, stored, maxBytes);
+        return this.cloneStoredEvtMsg(pre, fn, said, stored, requestedGenus);
     }
-    /** Reconstruct admitted body bytes without reopening their native row. */
-    cloneStoredEvtMsg(pre, fn, said, stored, maxBytes) {
+    /** Reconstruct stored body bytes without reopening their native row. */
+    cloneStoredEvtMsg(pre, fn, said, stored, requestedGenus = Vrsn_1_0) {
         const dgkey = dgKey(pre, said);
-        if (stored.length > maxBytes)
-            throw new ResourceLimitError("Replay message exceeds byte limit");
         // Preserve SerderSuber's validation so corrupt records retain clonePreIter's skip behavior.
         // SerderKERI recognizes both native CESR and version-string bodies.
         const serder = new SerderKERI({ raw: stored });
         const raw = serder.raw;
         // Preserve body bytes; its declared protocol/genus sets the minimum lawful attachment genus.
-        const gvrsn = resolveAttachmentGvrsn(serder);
-        let size = 0;
-        /** Admit each qualified fragment before retaining it or allocating the complete replay. */
-        const retain = (part) => {
-            if (part.length > maxBytes - size)
-                throw new ResourceLimitError("Replay message exceeds byte limit");
-            size += part.length;
-            return part;
-        };
-        retain(raw);
+        const gvrsn = resolveAttachmentGvrsn(serder, requestedGenus);
         const attachments = [];
-        /** Prefix already admitted payload pieces without a large argument spread or another copy. */
+        /** Prefix payload pieces without a large argument spread or another copy. */
         const group = (name, count, payload) => {
-            attachments.push(retain(attachmentCounterPayloadQb64b(name, count, payload, gvrsn)));
+            attachments.push(attachmentCounterPayloadQb64b(name, count, payload, gvrsn));
             for (const part of payload)
                 attachments.push(part);
         };
-        /** Iterate fixed-size signatures so storage cannot materialize an unbounded evidence array. */
+        /** Read controller and witness signature fragments in stored order. */
         const signatures = (entries) => {
             const parts = [];
             for (const siger of entries)
-                parts.push(retain(siger.qb64b));
+                parts.push(siger.qb64b);
             return parts;
         };
-        /** Legacy v1 seals require Seqner; v2 preserves the stored qualified Number. */
-        const ordinal = (value) => gvrsn.major === 1
-            ? seqnerFromNumber(value).qb64b
-            : value.qb64b;
+        /** V1 seals require the fixed Seqner; v2 writes the compact Number whatever width was stored. */
+        const ordinal = (value) => attachmentOrdinal(value, gvrsn).qb64b;
         const sigers = signatures(this.sigs.getIter(dgkey));
         if (sigers.length === 0)
             throw new DatabaseOperationError(`Missing indexed signatures for ${pre}:${said}`);
@@ -1929,7 +1773,7 @@ export class Baser {
         const seal = this.aess.get(dgkey);
         if (seal !== null) {
             const [number, diger] = seal;
-            group("SealSourceCouples", 1, [retain(ordinal(number)), retain(diger.qb64b)]);
+            group("SealSourceCouples", 1, [ordinal(number), diger.qb64b]);
         }
         // Receipt storage remains per signature; canonical groups share one establishment seal.
         const groups = new Map();
@@ -1938,19 +1782,19 @@ export class Baser {
             let receipt = groups.get(key);
             if (!receipt) {
                 receipt = {
-                    seal: [retain(prefixer.qb64b), retain(ordinal(snu)), retain(diger.qb64b)],
+                    seal: [prefixer.qb64b, ordinal(snu), diger.qb64b],
                     signatures: [],
                 };
                 groups.set(key, receipt);
             }
-            receipt.signatures.push(retain(siger.qb64b));
+            receipt.signatures.push(siger.qb64b);
         }
         if (groups.size) {
             const payload = [];
             for (const receipt of groups.values()) {
                 for (const part of receipt.seal)
                     payload.push(part);
-                payload.push(retain(attachmentCounterPayloadQb64b("ControllerIdxSigs", receipt.signatures.length, receipt.signatures, gvrsn)));
+                payload.push(attachmentCounterPayloadQb64b("ControllerIdxSigs", receipt.signatures.length, receipt.signatures, gvrsn));
                 for (const part of receipt.signatures)
                     payload.push(part);
             }
@@ -1959,7 +1803,7 @@ export class Baser {
         const receipts = [];
         let count = 0;
         for (const [prefixer, cigar] of this.rcts.getIter(dgkey)) {
-            receipts.push(retain(prefixer.qb64b), retain(cigar.qb64b));
+            receipts.push(prefixer.qb64b, cigar.qb64b);
             count++;
         }
         if (count)
@@ -1967,15 +1811,16 @@ export class Baser {
         const dater = this.dtss.get(dgkey);
         if (dater === null)
             throw new DatabaseOperationError(`Missing datetime stamp for ${pre}:${said}`);
-        // Huge ordinals remain legal Number primitives in both genera.
-        group("FirstSeenReplayCouples", 1, [retain(encodeHugeOrdinal(fn).qb64b), retain(dater.qb64b)]);
-        const attachmentSize = size - raw.length;
+        // KERIpy: v1 attachments carry a Seqner; v2 carries the smallest automatic Number code.
+        const firstSeen = gvrsn.major === 1 ? encodeHugeOrdinal(fn) : NumberPrimitive.fromNum(BigInt(fn));
+        group("FirstSeenReplayCouples", 1, [firstSeen.qb64b, dater.qb64b]);
+        const attachmentSize = attachments.reduce((size, part) => size + part.length, 0);
         if (attachmentSize % 4 !== 0) {
             throw new DatabaseOperationError(`Invalid attachment quadlet size for ${pre}:${said}`);
         }
-        const header = retain(attachmentCounterQb64b("AttachmentGroup", attachmentSize / 4, gvrsn));
-        // One admitted final allocation replaces the former attachment copy plus whole-message copy.
-        const message = new Uint8Array(size);
+        const header = attachmentCounterQb64b("AttachmentGroup", attachmentSize / 4, gvrsn);
+        // Allocate the actual wire extent once, after framing lengths are known.
+        const message = new Uint8Array(raw.length + header.length + attachmentSize);
         message.set(raw);
         message.set(header, raw.length);
         let offset = raw.length + header.length;
@@ -1994,10 +1839,10 @@ export class Baser {
      * Errors rebuilding individual events are skipped so export/replay callers
      * can continue streaming later entries, matching KERIpy's clone behavior.
      */
-    *clonePreIter(pre, fn = 0) {
+    *clonePreIter(pre, fn = 0, requestedGenus = Vrsn_1_0) {
         for (const [, currentFn, said] of this.fels.getAllItemIter(pre, fn)) {
             try {
-                yield this.cloneEvtMsg(pre, currentFn, said);
+                yield this.cloneEvtMsg(pre, currentFn, said, requestedGenus);
             }
             catch {
                 continue;
@@ -2010,7 +1855,7 @@ export class Baser {
      * KERIpy correspondence:
      * - mirrors `Baser.cloneDelegation(...)`
      */
-    *cloneDelegation(kever) {
+    *cloneDelegation(kever, requestedGenus = Vrsn_1_0) {
         if (!kever.delegated || !kever.delpre) {
             return;
         }
@@ -2018,22 +1863,17 @@ export class Baser {
         if (!delegator) {
             return;
         }
-        yield* this.cloneDelegation(delegator);
-        yield* this.clonePreIter(kever.delpre, 0);
+        yield* this.cloneDelegation(delegator, requestedGenus);
+        yield* this.clonePreIter(kever.delpre, 0, requestedGenus);
     }
     /**
      * Capture a reopenable replay extent without retaining its event bytes or an LMDB cursor.
      * The queried log precedes root-to-parent delegator logs, matching cloneDelegation order.
      * Event identities stop at the captured first-seen tails; proofs are read at consumption time.
      */
-    replay(pre, fn = 0, { maxDepth = 32, maxMessageBytes = 8 * 1024 * 1024 } = {}) {
+    replay(pre, fn = 0) {
         if (!Number.isSafeInteger(fn) || fn < 0)
             throw new RangeError("Replay ordinal must be a non-negative safe integer");
-        for (const limit of [maxDepth, maxMessageBytes]) {
-            if (!Number.isSafeInteger(limit) || limit < 1) {
-                throw new RangeError("Replay limits must be positive safe integers");
-            }
-        }
         // Each range is a small immutable identity/ordinal tuple; no event body is read during capture.
         const ranges = [];
         const ancestors = [];
@@ -2042,8 +1882,6 @@ export class Baser {
         while (parent) {
             if (visited.has(parent))
                 throw new DatabaseOperationError("Cyclic replay delegation chain");
-            if (ancestors.length >= maxDepth)
-                throw new ResourceLimitError("Replay delegation depth exceeds limit");
             visited.add(parent);
             const kever = this.getKever(parent);
             if (!kever)
@@ -2060,12 +1898,12 @@ export class Baser {
         }
         if (ranges.length === 0)
             return null;
-        return new CapturedKelReplay(this, ranges, maxMessageBytes);
+        return new CapturedKelReplay(this, ranges);
     }
     /** Capture target-only witness GET replay; explicit sequence queries retain KEL duplicate ordering. */
-    witnessReplay(pre, sn, maxMessageBytes) {
-        if (typeof pre !== "string" || !pre || !Number.isSafeInteger(maxMessageBytes) || maxMessageBytes < 1) {
-            throw new RangeError("Invalid witness replay prefix or ceiling");
+    witnessReplay(pre, sn) {
+        if (typeof pre !== "string" || !pre) {
+            throw new RangeError("Invalid witness replay prefix");
         }
         if (sn !== null && (!Number.isSafeInteger(sn) || sn < 0))
             throw new RangeError("Invalid witness replay sequence");
@@ -2075,9 +1913,9 @@ export class Baser {
         if (!Number.isFinite(felEnd) || felEnd < 0)
             throw new DatabaseOperationError("Corrupt witness FEL horizon");
         if (!Number.isSafeInteger(felEnd))
-            throw new ResourceLimitError("Unsupported witness replay horizon");
+            throw new RangeError("Unsupported witness replay horizon");
         if (sn === null)
-            return new CapturedKelReplay(this, [[pre, 0, felEnd]], maxMessageBytes);
+            return new CapturedKelReplay(this, [[pre, 0, felEnd]]);
         const start = b(`${pre}.${"f".repeat(32)}`);
         for (const entry of this.kels.sdb.getRange({ start, reverse: true, limit: 1 })) {
             const [prefix, end] = splitOnKey(entry.key);
@@ -2086,18 +1924,18 @@ export class Baser {
             if (!Number.isFinite(end) || end < 0)
                 throw new DatabaseOperationError("Corrupt witness KEL horizon");
             if (!Number.isSafeInteger(end))
-                throw new ResourceLimitError("Unsupported witness KEL horizon");
+                throw new RangeError("Unsupported witness KEL horizon");
             if (end < sn)
                 return null;
-            return new CapturedWitnessReplay(this, pre, sn, end, felEnd, maxMessageBytes);
+            return new CapturedWitnessReplay(this, pre, sn, end, felEnd);
         }
         return null;
     }
     /** Read one captured range, retaining only a current event and releasing its cursor before each yield. */
-    *replayRange([current, from, end], maxMessageBytes) {
+    *replayRange([current, from, end]) {
         if (typeof current !== "string" || !current || !Number.isSafeInteger(from) || from < 0
-            || !Number.isSafeInteger(end) || end < from || !Number.isSafeInteger(maxMessageBytes) || maxMessageBytes < 1)
-            throw new RangeError("Invalid captured KEL replay range or message limit");
+            || !Number.isSafeInteger(end) || end < from)
+            throw new RangeError("Invalid captured KEL replay range");
         let next = from;
         while (next <= end) {
             const rows = this.fels.getAllItemIter(current, next);
@@ -2113,18 +1951,15 @@ export class Baser {
                 break;
             const [, ordinal, said] = row;
             next = ordinal + 1;
-            // Native admission/I/O failures are outside the corrupt-record reconstruction skip boundary.
-            const stored = this.getValBounded(this.evtsRaw, dgKey(current, said), maxMessageBytes);
+            // Storage I/O failures are outside the corrupt-record reconstruction skip boundary.
+            const stored = this.getEvt(dgKey(current, said));
             if (!stored)
                 continue;
             let message;
             try {
-                message = this.cloneStoredEvtMsg(current, ordinal, said, stored, maxMessageBytes);
+                message = this.cloneStoredEvtMsg(current, ordinal, said, stored);
             }
-            catch (error) {
-                // Resource policy is terminal; only corrupt/incomplete replay records are skipped.
-                if (error instanceof ResourceLimitError)
-                    throw error;
+            catch {
                 // KERIpy clonePreIter skips individual corrupt/incomplete replay records.
                 continue;
             }
@@ -2198,36 +2033,6 @@ export class Baser {
         return this.hbys.get(name);
     }
 }
-Object.defineProperty(Baser, "TailDirPath", {
-    enumerable: true,
-    configurable: true,
-    writable: true,
-    value: "keri/db"
-});
-Object.defineProperty(Baser, "AltTailDirPath", {
-    enumerable: true,
-    configurable: true,
-    writable: true,
-    value: ".tufa/db"
-});
-Object.defineProperty(Baser, "CompatAltTailDirPath", {
-    enumerable: true,
-    configurable: true,
-    writable: true,
-    value: ".keri/db"
-});
-Object.defineProperty(Baser, "TempPrefix", {
-    enumerable: true,
-    configurable: true,
-    writable: true,
-    value: "keri_db_"
-});
-Object.defineProperty(Baser, "MaxNamedDBs", {
-    enumerable: true,
-    configurable: true,
-    writable: true,
-    value: 128
-});
 /**
  * Thin Effection-native lifecycle host for one `Baser`.
  *
@@ -2283,6 +2088,7 @@ export class BaserDoer {
 export function* createBaser(options = {}) {
     const baser = new Baser(options);
     let delivered = false;
+    let failure;
     try {
         const opened = yield* baser.reopen(options);
         if (!opened) {
@@ -2291,8 +2097,25 @@ export function* createBaser(options = {}) {
         delivered = true;
         return baser;
     }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
     finally {
-        if (!delivered)
-            yield* baser.close();
+        if (!delivered) {
+            try {
+                yield* baser.close();
+            }
+            catch (error) {
+                if (failure) {
+                    // deno-lint-ignore no-unsafe-finally -- Preserve the operation failure alongside shutdown failure.
+                    throw new AggregateError([failure.error, error], "Database acquisition and close failed", {
+                        cause: failure.error,
+                    });
+                }
+                // deno-lint-ignore no-unsafe-finally -- A shutdown failure must propagate.
+                throw error;
+            }
+        }
     }
 }