keri-ts 1.0.0 → 2.0.1

package/esm/keri/npm/src/acdc/messaging.js

@@ -100,6 +100,8 @@ export function regcept(issuer, options = {}) {
 /** Create an ACDC v2 blindable registry update (`bup`) message. */
 export function blindate(regid, prior, blid, options = {}) {
     const { sn = 1, stamp, pvrsn = Vrsn_2_0, gvrsn = Vrsn_2_0, kind = Kinds.json } = options;
+    if (BigInt(sn) < 1n)
+        throw new ValidationError(`ACDC blindable update sequence number must be positive: ${sn}`);
     return new SerderACDC({
         sad: {
             v: versionString({ pvrsn, gvrsn, kind }),

package/esm/keri/npm/src/acdc/observing.js

@@ -1,14 +1,16 @@
-/** Explicit public registry intake; this TypeScript integration is beyond frozen KERIpy 927. */
-import { Diger, Ilks, ParserError } from "cesr-ts";
+/** Public v2 registry intake with event-local opening preflight and durable retention. */
+import { bytesEqual, Diger, Ilks, ParserError } from "cesr-ts";
 import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
 import { RegistryEventer } from "./regengine.js";
-import { validateRip, validateUpdate } from "./regeventing.js";
+import { validateRegistrySourceLocators, validateRip, validateUpdate, vetBlind, } from "./regeventing.js";
+import { publicOpeningAttachment } from "./registering.js";
 /**
  * Borrow accepted public KEL state and one registry store without habitats, aliases or handles.
  * Reconstruct the engine's issuer from stored inception after reopen. Intake uses the engine's
- * full tuple/witness anchor policy, distinct from digest-only observer vetting. Each accepted
+ * exact registry-seal and historical witness policy shared with observer vetting. Each accepted
  * event commits independently; a later failure preserves the already accepted prefix.
- * Parsed evidence stays borrowed. This installs no automatic parser or runtime route.
+ * Parsed evidence stays borrowed. Composition supplies this owner to v2 protocol dispatch;
+ * no local habitat, alias or application disclosure custody is created by public intake.
  */
 export class RegistryObserver {
     constructor(db, store) {
@@ -26,11 +28,22 @@ export class RegistryObserver {
         });
     }
     /** Stage parsed events before inception, otherwise delegate ordinary validation and acceptance. */
-    processEvent(serder) {
+    processEvent(serder, locators = {}) {
         const result = serder.ilk === Ilks.rip ? validateRip(serder) : validateUpdate(serder, serder.regid ?? "");
         if (result.kind === "reject")
             return result;
         const event = result.event;
+        const openings = [...locators.bsqs ?? [], ...locators.bsss ?? []], opening = openings[0];
+        if (openings.length > 1 || (opening && event.ilk !== Ilks.bup))
+            return { kind: "reject", reason: "disclosure" };
+        if (opening) {
+            if (!vetBlind(opening, serder.sad.b))
+                return { kind: "reject", reason: "disclosure" };
+            const old = this.store.opening(event.said), stored = this.store.event(event.said);
+            if ((old && !bytesEqual(old, publicOpeningAttachment(opening)))
+                || (stored && !bytesEqual(stored.raw, serder.raw)))
+                return { kind: "reject", reason: "disclosure" };
+        }
         // Unknown registry routing cannot rely on a stored RIP to validate its qualified SAID.
         try {
             if (new Diger({ qb64: event.regid }).qb64 !== event.regid)
@@ -52,8 +65,13 @@ export class RegistryObserver {
             engine ??= new RegistryEventer(this.db, event.issuer, this.store, event.regid);
         }
         if (engine) {
-            return engine.processEvent(serder);
+            const decision = engine.processEvent(serder, locators);
+            if (decision.kind !== "reject" && opening)
+                this.store.retainOpening(serder, opening);
+            return decision;
         }
+        if (!validateRegistrySourceLocators(serder, this.db, null, locators))
+            return { kind: "reject", reason: "anchor" };
         // Issuer/anchor discovery is impossible until RIP arrives; the existing anchor escrow owns this body.
         const baser = this.store.baser;
         if (baser.readonly)
@@ -61,6 +79,8 @@ export class RegistryObserver {
         return baser.env.transactionSync(() => {
             this.store.putEvent(serder);
             this.store.escrowMissingAnchor(event.regid, Number(event.sn), event.said);
+            if (opening)
+                this.store.retainOpening(serder, opening);
             return { kind: "escrow", reason: "inception", event };
         });
     }
@@ -71,6 +91,19 @@ export class RegistryObserver {
             return;
         engine.processEscrows();
     }
+    /**
+     * Retry registries named by durable dependency escrows, including foreign registries after reopen.
+     * Finish both table cursors before acceptance writes; local aliases do not determine pending work.
+     */
+    processAllEscrows() {
+        const registries = new Set();
+        for (const table of [this.store.baser.maes, this.store.baser.ooes]) {
+            for (const [keys] of table.getAllItemIter())
+                registries.add(keys[0]);
+        }
+        for (const regid of registries)
+            this.processEscrows(regid);
+    }
     /** Stored inception is durable issuer identity, including while its anchor is still absent. */
     engine(regid) {
         if (!this.store.baser.env)

package/esm/keri/npm/src/acdc/regbasing.js

@@ -2,7 +2,7 @@
 import { b, Diger, NumberPrimitive, Saider, SerderACDC } from "cesr-ts";
 import { DatabaseNotOpenError } from "../core/errors.js";
 import { LMDBer } from "../db/core/lmdber.js";
-import { B64OnIoSetSuber, CatCesrSuber, CesrOnSuber, CesrSuber, SerderSuber } from "../db/subing.js";
+import { B64OnIoSetSuber, BytesSuber, CatCesrSuber, CesrOnSuber, CesrSuber, SerderSuber } from "../db/subing.js";
 /**
  * Own one environment for public registry TEL bodies, accepted ordinals and heads.
  * Mirrors frozen KERIpy RegBaser's typed tables; opening neither verifies
@@ -14,7 +14,10 @@ export class RegBaser extends LMDBer {
     hasTable(name) {
         if (!this.env)
             throw new DatabaseNotOpenError("Registry environment is closed.");
-        return this.env.getBinary(b(name)) !== undefined;
+        // Native lmdb-js exposes its C-string terminator in root metadata keys;
+        // the Deno backend also supports the unterminated representation.
+        return this.env.getBinary(b(name)) !== undefined
+            || this.env.getBinary(b(`${name}\0`)) !== undefined;
     }
     constructor(options = {}) {
         super(options, {
@@ -45,6 +48,13 @@ export class RegBaser extends LMDBer {
             writable: true,
             value: void 0
         });
+        /** Event-SAID -> one deliberately published counted BSQ/BSS opening; never private custody. */
+        Object.defineProperty(this, "openings", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         /** Event-SAID -> earliest verified KEL source couple, in the current store. */
         Object.defineProperty(this, "ancs", {
             enumerable: true,
@@ -76,6 +86,7 @@ export class RegBaser extends LMDBer {
             this.evts = new SerderSuber(this, { subkey: "evts.", ctor: SerderACDC });
             this.tels = new CesrOnSuber(this, { subkey: "tels.", ctor: Saider });
             this.heads = new CesrSuber(this, { subkey: "heds.", ctor: Saider });
+            this.openings = new BytesSuber(this, { subkey: "openings." });
             this.ancs = new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
             this.maes = new B64OnIoSetSuber(this, { subkey: "maes." });
             this.ooes = new B64OnIoSetSuber(this, { subkey: "ooes." });

package/esm/keri/npm/src/acdc/regengine.js

@@ -1,7 +1,8 @@
 /** Shared TEL validation, accepted-state publication, anchoring and retry for local and foreign registries. */
 import { Diger, Ilks, NumberPrimitive, } from "cesr-ts";
 import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
-import { validateRip, validateUpdate, verifyRegistryAnchor, } from "./regeventing.js";
+import { consoleLogger } from "../core/logger.js";
+import { findRegistryAnchor, validateRegistrySourceLocators, validateRip, validateUpdate, verifyRegistryAnchor, } from "./regeventing.js";
 /**
  * Borrow the issuer's accepted KEL and registry store; no keys or handles are acquired.
  * The local facade and foreign observer share this accepted-state engine.
@@ -81,10 +82,13 @@ export class RegistryEventer {
             return { kind: "reject", reason: "prior" };
         if ((number === undefined) !== (diger === undefined))
             return { kind: "reject", reason: "anchor" };
+        if (number && diger && !verifyRegistryAnchor(event, { db: this.db, issuer: this.issuer, number, diger })) {
+            return { kind: "reject", reason: "anchor" };
+        }
+        // Already accepted TEL history is immutable; explicit claims still verify before duplicate success.
+        if (occupied?.kind === "duplicate")
+            return this.processEvent(serder);
         if (number && diger) {
-            if (!verifyRegistryAnchor(event, { db: this.db, issuer: this.issuer, number, diger })) {
-                return { kind: "reject", reason: "anchor" };
-            }
             this.store.putAnchor(said, number, diger);
         }
         else {
@@ -148,16 +152,38 @@ export class RegistryEventer {
             for (const event of candidates) {
                 const result = this.processEvent(event.serder);
                 if (result.kind === "reject" || result.kind === "duplicate") {
-                    this.store.clearEscrows(this.regk, sn, event.said);
+                    const removed = this.store.clearEscrows(this.regk, sn, event.said);
+                    if (removed && result.kind === "reject") {
+                        consoleLogger.warn("RegistryEventer ejected registry candidate from escrow", {
+                            family: "registry",
+                            said: event.said,
+                            regk: this.regk,
+                            sn,
+                            reason: result.reason,
+                        });
+                    }
                 }
             }
         }
     }
-    /** Prune unrecoverable candidates; corrupt records and storage failures still propagate. */
+    /**
+     * Prune unrecoverable candidates and report completed removals; accepted duplicates stay quiet.
+     * @param said Candidate event SAID loaded from the current escrow snapshot.
+     * @param sn TEL ordinal under which the candidate was indexed.
+     * @returns The validated candidate, or null after obsolete or invalid membership cleanup.
+     */
     replayCandidate(said, sn) {
         const serder = this.store.event(said);
         if (!serder) {
-            this.store.clearEscrows(this.regk, sn, said);
+            if (this.store.clearEscrows(this.regk, sn, said)) {
+                consoleLogger.warn("RegistryEventer ejected registry candidate from escrow", {
+                    family: "registry",
+                    said,
+                    regk: this.regk,
+                    sn,
+                    reason: "missingEvent",
+                });
+            }
             return null;
         }
         if (serder.said !== said)
@@ -165,6 +191,7 @@ export class RegistryEventer {
         const result = serder.ilk === Ilks.rip
             ? validateRip(serder, this.issuer)
             : validateUpdate(serder, this.regk);
+        let reason = result.kind === "reject" ? result.reason : "registryOrOrdinal";
         if (result.kind === "valid") {
             const event = result.event;
             if (event.regid === this.regk && event.sn === BigInt(sn)) {
@@ -172,9 +199,19 @@ export class RegistryEventer {
                 const prior = sn > 0 ? this.acceptedAt(event.regid, sn - 1) : null;
                 if (!existing && (!prior || prior.said === event.prior))
                     return event;
+                reason = existing?.kind === "duplicate" ? null : existing?.kind === "reject" ? existing.reason : "prior";
             }
         }
-        this.store.clearEscrows(this.regk, sn, said);
+        const removed = this.store.clearEscrows(this.regk, sn, said);
+        if (removed && reason !== null) {
+            consoleLogger.warn("RegistryEventer ejected registry candidate from escrow", {
+                family: "registry",
+                said,
+                regk: this.regk,
+                sn,
+                reason,
+            });
+        }
         return null;
     }
     /** Earliest verified anchor wins; digest then event SAID break ties using code-point order. */
@@ -193,20 +230,23 @@ export class RegistryEventer {
         return left < right ? -1 : left > right ? 1 : 0;
     }
     /** Accept one parsed event, then advance ready successors without recursive replay. */
-    processEvent(serder) {
-        const decision = this.processOne(serder);
+    processEvent(serder, locators = {}) {
+        const decision = this.processOne(serder, locators);
         if (decision.kind === "accept")
             this.processQueued();
         return decision;
     }
     /** Decide and persist one event; callers own subsequent chain progression. */
-    processOne(serder) {
+    processOne(serder, locators = {}) {
         if (this.regk === null || serder.ilk === Ilks.rip)
-            return this.processInception(serder);
+            return this.processInception(serder, locators);
         const result = validateUpdate(serder, this.regk);
         if (result.kind === "reject")
             return result;
         const event = result.event;
+        if (!validateRegistrySourceLocators(serder, this.db, this.issuer, locators)) {
+            return { kind: "reject", reason: "anchor" };
+        }
         // Preserve protocol precision until the existing ordinal storage seam can represent it.
         if (event.sn > BigInt(Number.MAX_SAFE_INTEGER))
             return { kind: "reject", reason: "ordinalRange" };
@@ -247,11 +287,14 @@ export class RegistryEventer {
         });
     }
     /** Validate, anchor and accept one inception, or retain its body in anchor escrow. */
-    processInception(serder) {
+    processInception(serder, locators) {
         const result = validateRip(serder, this.issuer);
         if (result.kind === "reject")
             return result;
         const event = result.event;
+        if (!validateRegistrySourceLocators(serder, this.db, this.issuer, locators)) {
+            return { kind: "reject", reason: "anchor" };
+        }
         if (this.regk !== null && this.regk !== event.regid)
             return { kind: "reject", reason: "registry" };
         const previous = this.acceptedEvent(event);
@@ -335,19 +378,24 @@ export class RegistryEventer {
         this.store.baser.maes.rem(event.regid, Number(event.sn));
         this.store.baser.ooes.rem(event.regid, Number(event.sn));
     }
-    /** Keep an already verified anchor or discover the earliest fully witnessed seal. */
+    /** Keep a valid first pair; recovery-invalidated pending anchors must rediscover current-branch authority. */
     discoverAnchor(event) {
-        if (this.store.anchor(event.said))
-            return;
-        const anchor = this.db.fetchLastSealingEventByEventSeal(this.issuer, {
-            i: event.regid,
-            s: event.serder.sad.n,
-            d: event.said,
-        });
+        const current = this.store.anchor(event.said);
+        if (current) {
+            if (verifyRegistryAnchor(event, {
+                db: this.db,
+                issuer: this.issuer,
+                number: current[0],
+                diger: current[1],
+            }))
+                return;
+            this.store.baser.ancs.rem(event.said);
+        }
+        const anchor = findRegistryAnchor(this.db, this.issuer, event.serder);
         if (!anchor)
             return;
-        const number = NumberPrimitive.fromNum(BigInt(anchor.sn));
-        const diger = new Diger({ qb64: anchor.said });
+        const number = NumberPrimitive.fromNum(BigInt(anchor[0]));
+        const diger = new Diger({ qb64: anchor[1] });
         if (verifyRegistryAnchor(event, { db: this.db, issuer: this.issuer, number, diger })) {
             this.store.putAnchor(event.said, number, diger);
         }

package/esm/keri/npm/src/acdc/regeventing.js

@@ -3,7 +3,7 @@
  * Mirrors frozen KERIpy acdc.regeventing.vet/vetBinds. Parsing, KEL acceptance,
  * fetching, escrow persistence, and issuer-side TEL processing belong to callers.
  */
-import { commitBlindState, commitBoundState, Ilks, } from "cesr-ts";
+import { commitBlindState, commitBoundState, Diger, Ilks, ParserError, } from "cesr-ts";
 import { timestampMicros } from "../time/mod.js";
 /** Sequence numbers retain protocol precision; database KEL lookups remain safe integers. */
 function ordinal(event) {
@@ -14,9 +14,14 @@ function normalizeEvent(event) {
     if (!event.verify() || (event.ilk !== Ilks.rip && event.ilk !== Ilks.bup))
         return { kind: "reject", reason: "event" };
     const sequence = event.sad?.n;
-    if (typeof sequence !== "string" || !/^[0-9a-fA-F]+$/.test(sequence) || ordinal(event) >= 2n ** 128n) {
+    if (typeof sequence !== "string" || !/^(0|[1-9a-f][0-9a-f]*)$/.test(sequence) || ordinal(event) >= 2n ** 128n) {
         return { kind: "reject", reason: "sequence" };
     }
+    const stamp = event.sad?.dt;
+    if (typeof stamp !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}[+-]\d{2}:\d{2}$/.test(stamp)
+        || stamp.startsWith("0000-")
+        || timestampMicros(stamp) === null)
+        return { kind: "reject", reason: "timestamp" };
     return {
         kind: "valid",
         event: {
@@ -61,8 +66,8 @@ export function validateUpdate(serder, regid, prior) {
     return result;
 }
 /**
- * Check a local TEL anchor against the last accepted, fully witnessed KEL event.
- * Unlike observer vetting, this requires the full registry/ordinal/digest tuple.
+ * Check a local TEL anchor against the current accepted KEL branch and its witness quorum.
+ * V2 TEL admission requires the full registry/ordinal/event-SAID seal.
  * Missing or mismatched evidence returns false; database failures propagate.
  */
 export function verifyRegistryAnchor(event, { db, issuer, number, diger }) {
@@ -70,13 +75,68 @@ export function verifyRegistryAnchor(event, { db, issuer, number, diger }) {
         return false;
     const said = db.kels.getLast(issuer, Number(number.num));
     const anchor = said ? db.getEvtSerder(issuer, said) : null;
-    if (!anchor || anchor.said !== diger.qb64 || !db.fullyWitnessed(anchor))
+    if (!anchor || anchor.said !== diger.qb64 || !onCurrentRegistryBranch(db, issuer, anchor)
+        || !db.fullyWitnessed(anchor))
         return false;
-    return anchor.seals.some((seal) => !!seal && typeof seal === "object" && !Array.isArray(seal)
-        && "i" in seal && "s" in seal && "d" in seal
-        && seal.i === event.regid && seal.s === event.serder.sad.n && seal.d === event.said);
+    return anchor.seals.some((seal) => matchesRegistrySeal(seal, event.serder));
 }
-/** Verifier anchors match digests; a seal's TEL sequence hint is not authoritative. */
+/** Descend the current head's exact prior digests, stopping at missing or noncontiguous ancestry. */
+function* currentRegistryBranch(db, issuer) {
+    let current = db.getKever(issuer)?.serder ?? null;
+    while (current) {
+        yield current;
+        const prior = current.prior ? db.getEvtSerder(issuer, current.prior) : null;
+        if (!prior || prior.sn !== current.sn - 1)
+            return;
+        current = prior;
+    }
+}
+/** Recovery preserves disputed buckets; new TEL authority comes only from the current branch. */
+function onCurrentRegistryBranch(db, issuer, anchor) {
+    for (const current of currentRegistryBranch(db, issuer)) {
+        if (current.sn < anchor.sn)
+            return false;
+        if (current.said === anchor.said)
+            return true;
+    }
+    return false;
+}
+/** Match the full registry/ordinal/event-SAID tuple required for v2 TEL authority. */
+export function matchesRegistrySeal(candidate, event) {
+    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+        return false;
+    const seal = candidate;
+    const fields = Object.keys(seal).sort().join(",");
+    if (fields !== "d,i,s")
+        return false;
+    return seal.d === event.said
+        && seal.s === event.sad.n
+        && seal.i === (event.ilk === Ilks.rip ? event.said : event.regid);
+}
+/** Refuse resolvable false locators before publication, without persisting unsigned requirements. */
+export function validateRegistrySourceLocators(event, db, issuer, { sscs = [], ssts = [] }) {
+    const locators = [
+        ...sscs.map((seal) => ({ controller: issuer, number: seal.s, diger: seal.d })),
+        ...ssts.map((seal) => ({ controller: seal.i.qb64, number: seal.s, diger: seal.d })),
+    ];
+    for (const { controller, number, diger } of locators) {
+        if (issuer !== null && controller !== issuer)
+            return false;
+        if (controller === null || number.num > BigInt(Number.MAX_SAFE_INTEGER))
+            continue;
+        const accepted = db.kels.getLast(controller, Number(number.num));
+        if (!accepted)
+            continue;
+        if (accepted !== diger.qb64)
+            return false;
+        const anchor = db.getEvtSerder(controller, accepted);
+        if (anchor && (!onCurrentRegistryBranch(db, controller, anchor)
+            || !anchor.seals.some((seal) => matchesRegistrySeal(seal, event))))
+            return false;
+    }
+    return true;
+}
+/** Public stateless vetting authenticates digest commitments; other seal fields are nonbinding hints. */
 function sealDigests(event) {
     return event.seals.flatMap((seal) => {
         if (typeof seal === "string")
@@ -86,19 +146,26 @@ function sealDigests(event) {
         return [];
     });
 }
-/** Scan only the accepted controller's KEL frontier; this does not verify KEL signatures. */
-function scanKel(db, issuer, said) {
-    const kever = db.getKever(issuer);
-    if (!kever)
-        return null;
-    for (const [sn, digest] of db.getKelItemIter(issuer)) {
-        if (sn > kever.sn)
-            break;
-        const event = db.getEvtSerder(issuer, digest);
-        if (event && sealDigests(event).includes(said))
-            return [sn, event.said];
+/** Find an accepted controller event carrying an exact registry seal and its historical witness quorum. */
+export function findRegistryAnchor(db, issuer, registry) {
+    let earliest = null;
+    for (const event of currentRegistryBranch(db, issuer)) {
+        if (db.fullyWitnessed(event)
+            && event.seals.some((seal) => matchesRegistrySeal(seal, registry))) {
+            earliest = [event.sn, event.said];
+        }
+    }
+    return earliest;
+}
+/** Find a public digest commitment without granting v2 registry admission authority. */
+function findDigestAnchor(db, issuer, digest) {
+    let earliest = null;
+    for (const event of currentRegistryBranch(db, issuer)) {
+        if (db.fullyWitnessed(event) && sealDigests(event).includes(digest)) {
+            earliest = [event.sn, event.said];
+        }
     }
-    return null;
+    return earliest;
 }
 /** Match the reference's source-hint fallback and named aggregate-seal refusal. */
 function vetAnchor(event, issuer, db, told, source) {
@@ -111,29 +178,66 @@ function vetAnchor(event, issuer, db, told, source) {
     if (source !== undefined) {
         const said = typeof source === "string" ? source : db.kels.getLast(issuer, source);
         const anchor = said ? db.getEvtSerder(issuer, said) : null;
-        if (anchor) {
+        if (anchor && db.kels.getLast(issuer, anchor.sn) === anchor.said
+            && onCurrentRegistryBranch(db, issuer, anchor)) {
             const digests = sealDigests(anchor);
-            if (digests.includes(event.said))
+            if (db.fullyWitnessed(anchor) && digests.includes(event.said)) {
                 return { kind: "verified", anchor: [anchor.sn, anchor.said] };
+            }
             if (digests.length && !digests.some((digest) => typeof digest === "string" && told.has(digest))) {
                 return { kind: "reject", reason: "rootSeal" };
             }
         }
     }
-    const anchor = scanKel(db, issuer, event.said);
+    const anchor = findDigestAnchor(db, issuer, event.said);
     if (anchor)
         return { kind: "verified", anchor };
     for (const pre of db.kevers.keys()) {
-        if (pre !== issuer && scanKel(db, pre, event.said))
+        if (pre !== issuer && findDigestAnchor(db, pre, event.said))
             return { kind: "reject", reason: "anchor" };
     }
     return missing;
 }
-/** Recompute the disclosed tuple with the reference's default Blake3 commitment. */
-function vetBlind(blinder, blid) {
-    const redone = "bn" in blinder ? commitBoundState(blinder, "E") : commitBlindState(blinder, "E");
+/** Authenticate the declared native BLID against the exact carried primitive tuple. */
+export function vetBlind(blinder, blid) {
+    if (!/^[E-I][A-Za-z0-9_-]{43}$/.test(blid) || blinder.d.nonce !== blid)
+        return false;
+    let digest;
+    try {
+        digest = new Diger({ qb64: blid });
+    }
+    catch (error) {
+        if (error instanceof ParserError)
+            return false;
+        throw error;
+    }
+    if (new Diger({ code: digest.code, raw: digest.raw }).qb64 !== blid)
+        return false;
+    const redone = "bn" in blinder ? commitBoundState(blinder, digest.code) : commitBlindState(blinder, digest.code);
     return redone.d.nonce === blid;
 }
+/** A bound opening names an exact accepted Issuee event, including historical interactions. */
+export function vetBound(blinder, acdc, db) {
+    if (!("bn" in blinder))
+        return null;
+    const number = blinder.bn.num, digest = blinder.bd.nonce;
+    if (!blinder.td.nonce && !blinder.ts.text) {
+        return number === 0n && !digest ? null : { kind: "reject", reason: "binding" };
+    }
+    if (!digest || !acdc || blinder.td.nonce !== acdc.said || !acdc.issuee)
+        return { kind: "reject", reason: "binding" };
+    const issuer = acdc.issuee;
+    const missing = { kind: "missing", reason: "anchor", issuer, said: digest };
+    if (number > BigInt(Number.MAX_SAFE_INTEGER))
+        return missing;
+    const accepted = db.kels.getLast(issuer, Number(number));
+    if (!accepted)
+        return missing;
+    if (accepted !== digest)
+        return { kind: "reject", reason: "anchor" };
+    const event = db.getEvtSerder(issuer, accepted);
+    return event && db.fullyWitnessed(event) ? null : missing;
+}
 /** A registry must bind both the exact credential and its issuer, plus rd when present. */
 function binding(acdc, state) {
     if (!acdc.verify() || state.acdc !== acdc.said || acdc.issuer !== state.issuer)
@@ -200,6 +304,9 @@ export function vet({ rip, updates = [], db, sources = new Map(), acdc, blinder
     if (head.ilk === Ilks.bup && blinder) {
         if (!vetBlind(blinder, head.sad.b))
             return { kind: "reject", reason: "disclosure" };
+        const refusal = vetBound(blinder, acdc, db);
+        if (refusal)
+            return refusal;
         state.acdc = blinder.td.nonce || null;
         state.state = blinder.ts.text || null;
     }
@@ -215,25 +322,28 @@ export function vet({ rip, updates = [], db, sources = new Map(), acdc, blinder
 /**
  * Resolve the latest non-vacuous binding behind a verified (possibly historical)
  * head. Every intervening vacuous update needs exactly one authentic disclosure.
- * The caller supplies a trusted receiver timestamp; this creates no KRAM state.
+ * The selected SAID fixes the TEL prefix; neither timestamps nor source hints select it.
  */
-export function vetBinds({ rip, updates = [], db, sources = new Map(), acdc, blinders, target, controller, cutoff, requireSource = false }) {
-    if (cutoff !== undefined) {
-        const when = timestampMicros(cutoff);
-        const inception = timestampMicros(rip.sad?.dt);
-        if (when === null || inception === null)
-            return { kind: "reject", reason: "timestamp" };
-        if (inception > when)
-            return { kind: "reject", reason: "binding" };
-        const selected = [];
+export function vetBinds({ rip, updates = [], db, sources = new Map(), acdc, blinders, target, controller, cutoff, at, requireSource = false }) {
+    if (cutoff !== undefined)
+        return { kind: "reject", reason: "event" };
+    if (at !== undefined) {
+        const selected = [rip, ...updates].filter((event) => event.said === at);
+        if (selected.length !== 1)
+            return { kind: "missing", reason: "anchor", issuer: rip.issuer, said: at };
+        const checked = selected[0].ilk === Ilks.rip ? validateRip(selected[0]) : validateUpdate(selected[0], rip.said);
+        if (checked.kind === "reject")
+            return checked;
+        const prefix = [];
         for (const update of updates) {
-            const stamp = timestampMicros(update.sad?.dt);
-            if (stamp === null)
-                return { kind: "reject", reason: "timestamp" };
-            if (stamp <= when)
-                selected.push(update);
+            const sequence = update.sad?.n;
+            if (typeof sequence !== "string" || !/^(0|[1-9a-f][0-9a-f]*)$/.test(sequence) || ordinal(update) >= 2n ** 128n) {
+                return { kind: "reject", reason: "sequence" };
+            }
+            if (ordinal(update) <= checked.event.sn)
+                prefix.push(update);
         }
-        updates = selected;
+        updates = prefix;
     }
     const result = vet({ rip, updates, db, sources });
     if (result.kind !== "verified")
@@ -243,10 +353,19 @@ export function vetBinds({ rip, updates = [], db, sources = new Map(), acdc, bli
     const newest = [...updates].sort((a, b) => ordinal(a) > ordinal(b) ? -1 : ordinal(a) < ordinal(b) ? 1 : 0);
     for (const update of newest) {
         const matches = blinders.filter((blinder) => blinder.d.nonce === update.sad.b);
+        if (!matches.length) {
+            if (blinders.some((blinder) => !vetBlind(blinder, blinder.d.nonce))
+                || new Set(blinders.map((blinder) => blinder.d.nonce)).size !== blinders.length)
+                return { kind: "reject", reason: "disclosure" };
+            return { kind: "missing", reason: "disclosure", issuer: result.state.issuer, said: update.said };
+        }
         if (matches.length !== 1 || !vetBlind(matches[0], update.sad.b)) {
             return { kind: "reject", reason: "disclosure" };
         }
         const blinder = matches[0];
+        const refusal = vetBound(blinder, acdc, db);
+        if (refusal)
+            return refusal;
         const td = blinder.td.nonce;
         const state = blinder.ts.text;
         if (!td && !state)