keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/acdc/regbasing.js

@@ -1,7 +1,8 @@
 /** Public ACDC registry database layout and joined LMDB lifecycle. */
-import { b, Diger, NumberPrimitive, Saider, SerderACDC } from "cesr-ts";
-import { DatabaseNotOpenError } from "../core/errors.js";
-import { LMDBer } from "../db/core/lmdber.js";
+import { Diger, NumberPrimitive, Saider, SerderACDC } from "cesr-ts";
+import { DerivedUpdateRecord } from "../core/records.js";
+import { StoreOwner } from "../db/core/store-owner.js";
+import { Komer } from "../db/koming.js";
 import { B64OnIoSetSuber, BytesSuber, CatCesrSuber, CesrOnSuber, CesrSuber, SerderSuber } from "../db/subing.js";
 /**
  * Own one environment for public registry TEL bodies, accepted ordinals and heads.
@@ -9,24 +10,9 @@ import { B64OnIoSetSuber, BytesSuber, CatCesrSuber, CesrOnSuber, CesrSuber, Serd
  * evidence nor migrates rows. Every current store has anchor and escrow tables.
  * Construction stays closed; callers own reopen and joined close.
  */
-export class RegBaser extends LMDBer {
-    /** Named databases are root entries; testing presence opens no additional handles. */
-    hasTable(name) {
-        if (!this.env)
-            throw new DatabaseNotOpenError("Registry environment is closed.");
-        // Native lmdb-js exposes its C-string terminator in root metadata keys;
-        // the Deno backend also supports the unterminated representation.
-        return this.env.getBinary(b(name)) !== undefined
-            || this.env.getBinary(b(`${name}\0`)) !== undefined;
-    }
-    constructor(options = {}) {
-        super(options, {
-            tailDirPath: "keri/acdc/reg",
-            cleanTailDirPath: "keri/clean/acdc/reg",
-            altTailDirPath: options.compat ? ".keri/acdc/reg" : ".tufa/acdc/reg",
-            altCleanTailDirPath: options.compat ? ".keri/clean/acdc/reg" : ".tufa/clean/acdc/reg",
-            tempPrefix: "keri_acdc_reg_",
-        });
+export class RegBaser extends StoreOwner {
+    constructor() {
+        super(...arguments);
         /** Event-SAID -> parsed rip/bup body; body presence alone is not acceptance. */
         Object.defineProperty(this, "evts", {
             enumerable: true,
@@ -55,6 +41,13 @@ export class RegBaser extends LMDBer {
             writable: true,
             value: void 0
         });
+        /** keri-ts only. BUP SAID -> public blind-derivation coordinates; never a salt or opening. */
+        Object.defineProperty(this, "dvus", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         /** Event-SAID -> earliest verified KEL source couple, in the current store. */
         Object.defineProperty(this, "ancs", {
             enumerable: true,
@@ -79,17 +72,18 @@ export class RegBaser extends LMDBer {
     }
     /** Rebind the same environment's typed tables after every joined reopen. */
     *reopen(options = {}) {
-        const opened = yield* super.reopen(options);
+        const opened = yield* this.store.reopen(options);
         if (!opened)
             return false;
         try {
-            this.evts = new SerderSuber(this, { subkey: "evts.", ctor: SerderACDC });
-            this.tels = new CesrOnSuber(this, { subkey: "tels.", ctor: Saider });
-            this.heads = new CesrSuber(this, { subkey: "heds.", ctor: Saider });
-            this.openings = new BytesSuber(this, { subkey: "openings." });
-            this.ancs = new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
-            this.maes = new B64OnIoSetSuber(this, { subkey: "maes." });
-            this.ooes = new B64OnIoSetSuber(this, { subkey: "ooes." });
+            this.evts = new SerderSuber(this.store, { subkey: "evts.", ctor: SerderACDC });
+            this.tels = new CesrOnSuber(this.store, { subkey: "tels.", ctor: Saider });
+            this.heads = new CesrSuber(this.store, { subkey: "heds.", ctor: Saider });
+            this.openings = new BytesSuber(this.store, { subkey: "openings." });
+            this.dvus = new Komer(this.store, { subkey: "dvus.", recordClass: DerivedUpdateRecord });
+            this.ancs = new CatCesrSuber(this.store, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
+            this.maes = new B64OnIoSetSuber(this.store, { subkey: "maes." });
+            this.ooes = new B64OnIoSetSuber(this.store, { subkey: "ooes." });
             return true;
         }
         catch (error) {
@@ -98,3 +92,10 @@ export class RegBaser extends LMDBer {
         }
     }
 }
+/** Placement of this store kind. */
+Object.defineProperty(RegBaser, "Family", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: { tail: "acdc/reg" }
+});

package/esm/keri/npm/src/acdc/regengine.js

@@ -256,12 +256,11 @@ export class RegistryEventer {
         const previous = this.acceptedEvent(event);
         if (previous)
             return previous;
-        const env = this.store.baser.env;
-        if (!env)
+        if (!this.store.baser.opened)
             throw new DatabaseNotOpenError("Registry acceptance requires an open backing store.");
         if (this.store.baser.readonly)
             throw new DatabaseOperationError("Cannot write readonly registry storage.");
-        return env.transactionSync(() => {
+        return this.store.baser.transaction(() => {
             const prior = this.acceptedAt(event.regid, Number(event.sn) - 1);
             if (prior && prior.said !== event.prior)
                 return { kind: "reject", reason: "prior" };
@@ -303,12 +302,11 @@ export class RegistryEventer {
                 this.regk = event.regid;
             return previous;
         }
-        const env = this.store.baser.env;
-        if (!env)
+        if (!this.store.baser.opened)
             throw new DatabaseNotOpenError("Registry acceptance requires an open backing store.");
         if (this.store.baser.readonly)
             throw new DatabaseOperationError("Cannot write readonly registry storage.");
-        const decision = env.transactionSync(() => {
+        const decision = this.store.baser.transaction(() => {
             const previous = this.acceptedEvent(event);
             if (previous)
                 return previous;

package/esm/keri/npm/src/acdc/registering.js

@@ -37,10 +37,13 @@ function retainedOpening(raw) {
 export class RegistryRecord extends RawRecord {
 }
 /** Acquire one backing owner; failures/cancellation join cleanup before ownership transfers. */
-export function* openRegistry({ web = false, reopen = true, ...options } = {}) {
-    if (web)
-        throw new ValidationError("web registry backend is not yet supported by V2 Regery");
-    const baser = new RegBaser(options);
+export function* openRegistry({ reopen = true, opener, ...options } = {}) {
+    if (!opener)
+        throw new ValidationError("A registry store needs a store opener.");
+    return yield* adoptRegistry(new RegBaser(opener.create(RegBaser.Family, options)), reopen);
+}
+/** Take ownership of a constructed registry owner, reopening it unless told otherwise. */
+export function* adoptRegistry(baser, reopen = true) {
     let delivered = false;
     try {
         if (reopen && !(yield* baser.reopen()))
@@ -81,7 +84,7 @@ export class RegistryStore {
             writable: true,
             value: null
         });
-        Object.defineProperty(this, "aliasEnv", {
+        Object.defineProperty(this, "aliasTable", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -90,13 +93,13 @@ export class RegistryStore {
     }
     /** Local alias mapper is optional; refresh it after the owner's reopen. */
     get records() {
-        if (!this.baser.env)
+        if (!this.baser.opened)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
-        if (this.aliasEnv !== this.baser.env) {
+        if (this.aliasTable !== this.baser.evts.sdb) {
             this.aliases = this.baser.hasTable("regs.")
-                ? new Komer(this.baser, { subkey: "regs.", recordClass: RegistryRecord })
+                ? new Komer(this.baser.store, { subkey: "regs.", recordClass: RegistryRecord })
                 : null;
-            this.aliasEnv = this.baser.env;
+            this.aliasTable = this.baser.evts.sdb;
         }
         return this.aliases;
     }
@@ -110,7 +113,7 @@ export class RegistryStore {
         if (!records) {
             if (this.baser.readonly)
                 throw new DatabaseOperationError("Cannot create readonly registry aliases.");
-            records = this.aliases = new Komer(this.baser, { subkey: "regs.", recordClass: RegistryRecord });
+            records = this.aliases = new Komer(this.baser.store, { subkey: "regs.", recordClass: RegistryRecord });
         }
         return records;
     }

package/esm/keri/npm/src/acdc/registraring.js

@@ -13,12 +13,8 @@ export function* createRegery({ hby, baser, ...options }) {
     try {
         if (!baser) {
             baser = yield* openRegistry({
-                name: hby.name,
-                base: hby.base,
-                temp: hby.temp,
-                headDirPath: hby.headDirPath,
-                compat: hby.compat,
-                readonly: hby.readonly,
+                ...hby.storeIdentity(),
+                opener: hby.opener,
                 ...options,
             });
         }
@@ -90,12 +86,11 @@ export class Regery {
         const rip = regcept(hab.pre, options);
         if (this.regs.has(rip.said))
             throw new ValidationError(`Registry already exists: ${rip.said}`);
-        const env = this.baser.env;
-        if (!env)
+        if (!this.baser.opened)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
         const records = this.store.initializeRecords();
         const registry = new Registry(hab, this.store, name);
-        env.transactionSync(() => {
+        this.baser.transaction(() => {
             if (records.get(name))
                 throw new ValidationError(`Registry alias already exists: ${name}`);
             const result = registry.processEvent(rip);

package/esm/keri/npm/src/acdc/salting.js

@@ -1,8 +1,10 @@
 /**
- * Explicit encrypted copies of existing registry roots.
+ * Encrypted copies of existing registry roots.
  *
  * `RegistryRoot` replicates held roots to individual members with ESSR `exn`
  * messages, ported from KERIpy `keri.acdc.salting` (kentbull/keripy v2-spec).
+ * Operators send them explicitly; group issuance completion and accepted group
+ * rotations also send them, fire and forget (`app/credentials/root-replicating.ts`).
  *
  * Local profile, not a KERI, ACDC or #1740 standard. Upstream KERIpy uses ESSR
  * only as the v1 `/essr/req` transport envelope on direct sends.
@@ -19,9 +21,12 @@
  * dependency escrow (`Baser.rrpe`, no timeout) that `processEscrows` retries.
  */
 import { concatBytes, Counter, Dater, Diger, Encrypter, essrChunks, Kinds, LabelDex, makeBlindUuid, MtrDex, ParserError, Prefixer, Saider, Salter, Texter, unblindBlindState, unblindBoundState, Vrsn_2_0, } from "cesr-ts";
-import { groupWitnesserSelection, isLocalGroupHab } from "../app/multisig/group-members.js";
+import { groupWitnesserSelection, isLocalGroupHab, localGroupMember } from "../app/multisig/group-members.js";
 import { ValidationError } from "../core/errors.js";
+import { Kever } from "../core/kel/kever.js";
 import { exchange } from "../core/protocol-eventing.js";
+import { dgKey } from "../db/core/keys.js";
+import { hasNests, loadNests } from "../db/exchange/exchange-nests.js";
 import { makeNowIso8601 } from "../time/mod.js";
 import { validateRip, validateUpdate, verifyRegistryAnchor, vetBlind } from "./regeventing.js";
 /** A stored registry-root copy that can never be retained as received. */
@@ -65,9 +70,9 @@ function contribution(db, member, verfers) {
         const event = db.getEvtSerder(member, said);
         if (!event?.estive)
             continue;
-        const index = keys.indexOf(event.verfers[0]?.qb64 ?? "");
+        const key = event.verfers[0]?.qb64 ?? "", index = keys.indexOf(key);
         if (index >= 0)
-            return { sn, index };
+            return { sn, index, key };
     }
     return null;
 }
@@ -172,7 +177,7 @@ export function rootExn(hab, recipient, gid, registry, root, { event, td }) {
  * keeps the copy escrowed rather than refusing it.
  */
 export class RegistryRoot {
-    constructor(hby, rgy, notifier = null) {
+    constructor(hby, rgy, notifier = null, changes) {
         Object.defineProperty(this, "resource", {
             enumerable: true,
             configurable: true,
@@ -203,11 +208,19 @@ export class RegistryRoot {
             writable: true,
             value: void 0
         });
+        /** Told `{kind: "root", id: registry}` after a copy is retained, so an embedder that waited for the root can act. */
+        Object.defineProperty(this, "changes", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         if (rgy.hby !== hby)
             throw new ValidationError("registry root replication requires the Habery's registry owner");
         this.hby = hby;
         this.rgy = rgy;
         this.notifier = notifier;
+        this.changes = changes;
         if (!hby.readonly)
             this.reconcile();
     }
@@ -290,14 +303,8 @@ export class RegistryRoot {
         }
         return rip;
     }
-    /**
-     * Return current signing member AIDs added by one accepted group rotation.
-     *
-     * Members, not keys, are compared: a continuing member usually rotates its
-     * own key, so it contributes to both establishments. Candidates are the AIDs
-     * with accepted key state in this Habery.
-     */
-    newcomers(ghab, rotation) {
+    /** Return `ghab`'s accepted `rotation` and the establishment before it; ValidationError otherwise. */
+    rotation(ghab, rotation) {
         const db = this.hby.db, pre = ghab.pre;
         if (!pre || ghab.db !== db || !isLocalGroupHab(this.hby, ghab)) {
             throw new ValidationError("newcomers require a local group habitat");
@@ -306,29 +313,59 @@ export class RegistryRoot {
         if (!event || !["rot", "drt"].includes(event.ilk) || db.kels.getLast(pre, event.sn) !== rotation) {
             throw new ValidationError("newcomers require an accepted group rotation");
         }
-        let prior = null;
         for (const [, sn, said] of db.kels.getOnItemBackIter(pre, event.sn - 1)) {
             if (db.kels.getLast(pre, sn) !== said)
                 continue;
             const candidate = db.getEvtSerder(pre, said);
-            if (candidate?.estive) {
-                prior = candidate;
-                break;
-            }
+            if (candidate?.estive)
+                return [event, candidate];
         }
-        if (!prior)
-            throw new ValidationError("rotation has no accepted prior establishment");
+        throw new ValidationError("rotation has no accepted prior establishment");
+    }
+    /**
+     * Return current signing member AIDs added by one accepted group rotation.
+     *
+     * Members, not keys, are compared: a continuing member usually rotates its
+     * own key, so it contributes to both establishments. `rekeyed` also returns
+     * continuing members whose contributing key changed, the recipients a
+     * re-seal must reach under their new key. Candidates are the AIDs with
+     * accepted key state in this Habery.
+     */
+    newcomers(ghab, rotation, { rekeyed = false } = {}) {
+        const db = this.hby.db, pre = ghab.pre, [event, prior] = this.rotation(ghab, rotation);
         const found = [];
         for (const [keys] of db.states.getTopItemIter()) {
             const aid = keys.join(".");
             if (aid === pre || !db.getKever(aid))
                 continue;
-            const added = contribution(db, aid, event.verfers);
-            if (added && !contribution(db, aid, prior.verfers) && this.current(aid, pre))
+            const added = contribution(db, aid, event.verfers), before = contribution(db, aid, prior.verfers);
+            if (added && this.current(aid, pre) && (!before || rekeyed && before.key !== added.key)) {
                 found.push([added.index, aid]);
+            }
         }
         return found.sort((left, right) => left[0] - right[0]).map(([, aid]) => aid);
     }
+    /**
+     * Return the members `ghab`'s local member re-seals held roots to after `rotation`.
+     *
+     * Only a signer of the accepted rotation that held a key in the prior
+     * establishment sends, and it sends to each current signing member that is
+     * new in the rotation or whose contributing key changed (`newcomers` with
+     * `rekeyed`). Every such signer sends: copies are idempotent, so no single
+     * sender is elected. An empty list means nothing is owed.
+     */
+    resealed(ghab, rotation) {
+        const recipients = this.newcomers(ghab, rotation, { rekeyed: true });
+        const db = this.hby.db, [event, prior] = this.rotation(ghab, rotation);
+        const member = localGroupMember(this.hby, ghab.pre).pre;
+        const own = contribution(db, member, event.verfers);
+        if (!own || !contribution(db, member, prior.verfers))
+            return [];
+        const { indices } = Kever.verifyIndexedSignatures(event.raw, db.sigs.get(dgKey(ghab.pre, rotation)), event.verfers);
+        if (!indices.includes(own.index))
+            return [];
+        return recipients.filter(aid => aid !== member);
+    }
     /** Return the current signing member AIDs of `gid` known to this Habery. */
     members(gid) {
         const db = this.hby.db, gkever = db.getKever(gid), found = [];
@@ -342,6 +379,11 @@ export class RegistryRoot {
         }
         return found.sort((left, right) => left[0] - right[0]).map(([, aid]) => aid);
     }
+    /** Public key by which `member` currently contributes to `gid`, or null while not a known current signing member. */
+    contributor(gid, member) {
+        const gkever = this.hby.db.getKever(gid);
+        return gkever ? contribution(this.hby.db, member, gkever.verfers)?.key ?? null : null;
+    }
     /** Return the registry SAIDs with a root retained locally for `gid`. */
     held(gid) {
         const found = [];
@@ -365,10 +407,17 @@ export class RegistryRoot {
     // sending
     /**
      * Return one authorized copy of a root held locally for `gid` or the issuer.
+     *
      * `hab` is the local individual sender. `event` defaults to the registry's
-     * accepted BUP head.
+     * accepted BUP head. `td` is the recipient's verification hint: omitted, it
+     * is derived for this registry (`hint`); `""` sends none; any other value is
+     * an override. Before sealing, a derived or override hint must let this
+     * sender's own root reproduce the BUP `b` commitment, so a copy never carries
+     * a hint that cannot verify it. `hinted` refuses with RootUnverified, instead
+     * of sending a copy without a hint, when no local evidence yields one;
+     * automatic sends set it.
      */
-    prepare(hab, recipient, gid, registry, { event, td } = {}) {
+    prepare(hab, recipient, gid, registry, { event, td, hinted = false } = {}) {
         const rip = this.authorize(hab.pre, recipient, gid, registry);
         let root = null;
         for (const holder of [gid, rip.issuer]) {
@@ -380,8 +429,74 @@ export class RegistryRoot {
         }
         if (!root)
             throw new ValidationError("no local root is held for this registry");
-        const [bup] = this.event(registry, event ?? this.rgy.store.headEvent(registry).said, rip);
-        return rootExn(hab, recipient, gid, registry, root, { event: bup.said, td });
+        const [bup, sn] = this.event(registry, event ?? this.rgy.store.headEvent(registry).said, rip);
+        const uuid = makeBlindUuid({ salt: root.qb64, sn }).qb64;
+        let hint = td;
+        if (hint === undefined) {
+            hint = this.hint(gid, registry, uuid, bup) ?? undefined;
+            if (hint === undefined && hinted) {
+                throw new RootUnverified(`no held opening or stored Grant ACDC lets this root reproduce registry ${registry} update ${bup.said}; `
+                    + "send it with an ACDC hint");
+            }
+        }
+        else if (hint && !this.reproduces(bup.sad.b, uuid, hint, gid)) {
+            throw new ValidationError(`the local root does not reproduce registry ${registry} update ${bup.said} with ACDC hint ${hint}`);
+        }
+        return rootExn(hab, recipient, gid, registry, root, { event: bup.said, td: hint });
+    }
+    /**
+     * Return the ACDC SAID by which `uuid` reproduces `bup`'s commitment, or null.
+     *
+     * Derived per registry, never shared across registries: the ACDC of the
+     * BUP's locally held opening first, then each ACDC of `registry` nested in a
+     * locally stored exchange. A candidate counts only when it reproduces the
+     * commitment, which is the sender self-check.
+     */
+    hint(gid, registry, uuid, bup) {
+        const held = this.rgy.store.publicOpening(bup.said)?.td.nonce;
+        const blid = bup.sad.b;
+        if (held && this.reproduces(blid, uuid, held, gid))
+            return held;
+        for (const td of this.acdcs(registry)) {
+            if (this.reproduces(blid, uuid, td, gid))
+                return td;
+        }
+        return null;
+    }
+    /**
+     * Yield SAIDs of ACDCs in `registry` nested in any locally stored exchange.
+     *
+     * A custodian finds them in its own `/ipex/grant`; a member holding only a
+     * received copy finds them nested in the `/multisig/exn` proposal it signed.
+     * Nests are walked recursively, so the wrapper depth does not matter, and no
+     * index table is needed. An exchange whose stored nests no longer decode is
+     * skipped: hint search is advisory and the self-check still guards the copy.
+     */
+    *acdcs(registry) {
+        const db = this.hby.db;
+        for (const [keys] of db.exns.getTopItemIter()) {
+            const said = keys.join(".");
+            if (!hasNests(db, said))
+                continue;
+            let nests;
+            try {
+                nests = loadNests(db, said);
+            }
+            catch (error) {
+                if (error instanceof ParserError || error instanceof ValidationError)
+                    continue;
+                throw error;
+            }
+            yield* RegistryRoot.nested(nests, registry);
+        }
+    }
+    /** Depth-first SAIDs of nested bodies whose `rd` is `registry`. */
+    static *nested(nests, registry) {
+        for (const nest of nests) {
+            if (nest.body.ked?.rd === registry && nest.body.said)
+                yield nest.body.said;
+            yield* RegistryRoot.nested(nest.nests ?? [], registry);
+        }
     }
     // receiving
     /** Recheck exact accepted BUP membership and issuer anchoring; return the BUP and its ordinal. */
@@ -589,6 +704,8 @@ export class RegistryRoot {
                 rd: registry,
             });
         }
+        if (added)
+            this.changes?.push({ kind: "root", id: registry });
         return added;
     }
     /** Try one escrowed copy: true retained, null still pending, false dropped. */

package/esm/keri/npm/src/acdc/scheming.js

@@ -286,72 +286,111 @@ class SchemaResources {
         return root;
     }
 }
+/** Most closures kept per store; the oldest is evicted first. */
+const COMPILED_SCHEMA_BOUND = 256;
+/**
+ * Compiled closures by store, then root SAID. A closure is fully determined by its root SAID: the root and every
+ * bundled or `$ref` resource is verified against its SAID when admitted, so a cached closure cannot go stale.
+ * Per store, so a store that does not hold the schema still reports it missing; only a valid closure is kept.
+ */
+const compiledSchemas = new WeakMap();
+let compilations = 0;
+/** How many schema closures this process has compiled; a diagnostic for tests of the cache. */
+export function schemaCompilationCount() {
+    return compilations;
+}
+function isCompiled(value) {
+    return "validate" in value;
+}
+/** Compile an admitted closure once; regular-expression and duplicate-id refusals are normal invalid outcomes. */
+function compileClosure(resources, root) {
+    const { roots, scopes } = resources;
+    // Compile only admitted private copies. Canonical local URNs remove URI-alias ambiguity without changing stored IDs.
+    const uri = (said) => `urn:said:${said}`;
+    const registered = new Set();
+    const copy = (value) => {
+        if (Array.isArray(value))
+            return value.map(copy);
+        if (!object(value))
+            return value;
+        const result = Object.fromEntries(Object.entries(value).map(([key, item]) => [key, copy(item)]));
+        const owner = scopes.get(value);
+        if (!owner)
+            return result;
+        if ("$id" in value) {
+            if (registered.has(owner.said))
+                delete result.$id;
+            else {
+                result.$id = uri(owner.said);
+                registered.add(owner.said);
+            }
+        }
+        if ("$ref" in value) {
+            const parsed = reference(value.$ref);
+            result.$ref = uri(parsed.said ?? owner.said) + parsed.fragment;
+        }
+        // Python treats these AJV extension/obsolete applicator keywords as annotations.
+        for (const key of ["$async", "nullable", "dependencies", "additionalItems"])
+            delete result[key];
+        return result;
+    };
+    const validator = new ValidatorCtor({ strict: false, validateFormats: false });
+    for (const schema of scopes.keys()) {
+        if (!validator.validateSchema(schema))
+            throw new InvalidSchema("Invalid Draft 2020-12 schema");
+    }
+    const copies = roots.map(copy);
+    let validate;
+    try {
+        for (const schema of copies)
+            validator.addSchema(schema);
+        validate = validator.getSchema(uri(root.said));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError && error.message.includes("regular expression")) {
+            return { kind: "invalid", subject: "schema", reason: error.message };
+        }
+        if (error instanceof Error && /^reference "urn:said:[^"]+" resolves to more than one schema$/.test(error.message)) {
+            return { kind: "invalid", subject: "schema", reason: error.message };
+        }
+        throw error;
+    }
+    if (!validate)
+        throw new Error("Admitted schema was not registered");
+    compilations++;
+    return { validator, validate };
+}
 /** Local static schema closure plus a synchronous Draft 2020-12 validator; legacy Schemer behavior is unchanged. */
 export function validateSchema(acdc, db, override) {
-    const resources = new SchemaResources(db);
     try {
+        // The closure is always admitted: that verifies every SAID, and the verified root SAID names the cached validator.
+        const resources = new SchemaResources(db);
         const root = resources.admit(override ?? acdc.schema);
         if (!root) {
             return resources.missing
                 ? { kind: "missing", said: resources.missing }
                 : { kind: "invalid", subject: "schema", reason: "Invalid ACDC schema field" };
         }
-        const { roots, scopes } = resources;
-        // Compile only admitted private copies. Canonical local URNs remove URI-alias ambiguity without changing stored IDs.
-        const uri = (said) => `urn:said:${said}`;
-        const registered = new Set();
-        const copy = (value) => {
-            if (Array.isArray(value))
-                return value.map(copy);
-            if (!object(value))
-                return value;
-            const result = Object.fromEntries(Object.entries(value).map(([key, item]) => [key, copy(item)]));
-            const owner = scopes.get(value);
-            if (!owner)
-                return result;
-            if ("$id" in value) {
-                if (registered.has(owner.said))
-                    delete result.$id;
-                else {
-                    result.$id = uri(owner.said);
-                    registered.add(owner.said);
-                }
+        // An override object is checked against the document it replaces each time and is never kept.
+        const keep = typeof override !== "object";
+        let store = compiledSchemas.get(db);
+        let compiled = keep ? store?.get(root.said) : undefined;
+        if (!compiled) {
+            const built = compileClosure(resources, root);
+            if (!isCompiled(built))
+                return built;
+            compiled = built;
+            if (keep) {
+                if (!store)
+                    compiledSchemas.set(db, store = new Map());
+                if (store.size >= COMPILED_SCHEMA_BOUND)
+                    store.delete(store.keys().next().value);
+                store.set(root.said, compiled);
             }
-            if ("$ref" in value) {
-                const parsed = reference(value.$ref);
-                result.$ref = uri(parsed.said ?? owner.said) + parsed.fragment;
-            }
-            // Python treats these AJV extension/obsolete applicator keywords as annotations.
-            for (const key of ["$async", "nullable", "dependencies", "additionalItems"])
-                delete result[key];
-            return result;
-        };
-        const validator = new ValidatorCtor({ strict: false, validateFormats: false });
-        for (const schema of scopes.keys()) {
-            if (!validator.validateSchema(schema))
-                throw new InvalidSchema("Invalid Draft 2020-12 schema");
-        }
-        const copies = roots.map(copy);
-        let validate;
-        try {
-            for (const schema of copies)
-                validator.addSchema(schema);
-            validate = validator.getSchema(uri(root.said));
-        }
-        catch (error) {
-            if (error instanceof SyntaxError && error.message.includes("regular expression")) {
-                return { kind: "invalid", subject: "schema", reason: error.message };
-            }
-            if (error instanceof Error && /^reference "urn:said:[^"]+" resolves to more than one schema$/.test(error.message)) {
-                return { kind: "invalid", subject: "schema", reason: error.message };
-            }
-            throw error;
         }
-        if (!validate)
-            throw new Error("Admitted schema was not registered");
-        return validate(acdc.sad)
+        return compiled.validate(acdc.sad)
             ? { kind: "valid" }
-            : { kind: "invalid", subject: "credential", reason: validator.errorsText(validate.errors) };
+            : { kind: "invalid", subject: "credential", reason: compiled.validator.errorsText(compiled.validate.errors) };
     }
     catch (error) {
         if (error instanceof InvalidSchema)