keri-ts 2.1.0 → 2.2.1

package/esm/keri/npm/src/acdc/dhking.js

@@ -8,7 +8,7 @@ import { hkdf } from "@noble/hashes/hkdf";
 import { sha256 } from "@noble/hashes/sha2";
 import { Hab } from "../app/identity/habbing.js";
 import { groupWitnesserSelection, isLocalGroupHab, latestGroupContribution, localGroupMember, } from "../app/multisig/group-members.js";
-import { copyAuxiliaryQuery, envelopeFromFrame, } from "../app/protocol/parsering.js";
+import { auxiliaryQueryWire, copyAuxiliaryQuery, envelopeFromFrame, restoreAuxiliaryQuery, } from "../app/protocol/parsering.js";
 import { Deck } from "../core/deck.js";
 import { ValidationError } from "../core/errors.js";
 import { verifyQueryAttachments } from "../core/exchange/exchange-proofing.js";
@@ -85,6 +85,72 @@ export function deriveRoot(privateKey, context) {
         shared.fill(0);
     }
 }
+/**
+ * The DH transaction id of a Grant: its own SAID when it opens the exchange (`xip`), and otherwise the exchange it
+ * continues (`x`). The one definition, so the owner and any workflow that names the transaction agree.
+ */
+export function grantTransactionId(grant) {
+    return grant.ilk === "xip" ? grant.said : grant.sad.x;
+}
+/** The parties and transaction of a Grant `hab` takes part in, or null when it is not a DH party of it. */
+function grantParties(hab, input) {
+    const message = input.serder, issuer = message.pre, issuee = message.sad.ri;
+    const xid = grantTransactionId(message);
+    return typeof xid === "string" && typeof issuee === "string" && issuer !== issuee
+        && [issuer, issuee].includes(hab.pre)
+        ? { issuer, issuee, xid }
+        : null;
+}
+/** Resolve the pending Grant `hab` may start DH for, or the reason it cannot. Reads only; creates no approval. */
+function freshScope(hab, exc, grant) {
+    const input = exc.retainedInput(grant, { pending: true });
+    if (!input)
+        return "DH requires an authenticated pending Grant";
+    const parties = grantParties(hab, input);
+    if (!parties)
+        return "Local habitat is not a DH party";
+    const context = exc.pendingGrant(grant, { ...parties, sender: parties.issuer, recipient: parties.issuee });
+    if (!context)
+        return "DH requires authenticated fresh registry scope";
+    return { input, ...parties, registries: [...context.registries] };
+}
+/**
+ * The scope of a completed exchange that can finish without new key exchange: the Grant is still pending
+ * inside its original deadline and `hab` holds a root for the registries it discloses. The scope is those
+ * registries; a registry that is still fresh must hold one. No fresh registry is required, because the
+ * issuer's update may already be accepted: {@link Dhke.finish} proves the held root against that update, so
+ * a root from any other exchange is rejected there. Pure read of stores. Null when nothing can resume.
+ */
+export function resumableExchange({ hab, exc }, grant) {
+    const input = exc.retainedInput(grant, { pending: true });
+    const parties = input && grantParties(hab, input);
+    if (!input || !parties)
+        return null;
+    const disclosed = (input.nests ?? []).map((nest) => nest.body.ked?.rd);
+    const held = [...new Set(disclosed)].filter((registry) => typeof registry === "string" && hab.mgr.hasRegistryRoot(hab.pre, registry));
+    const fresh = exc.pendingGrant(grant, { ...parties, sender: parties.issuer, recipient: parties.issuee });
+    if (!held.length || fresh?.registries.some((registry) => !held.includes(registry)))
+        return null;
+    return { input, ...parties, registries: held };
+}
+/**
+ * Whether `registry` has no committed state: its head is still the inception and no update is escrowed.
+ * A staged update waits in the missing-anchor or out-of-order escrow under its registry until the issuer's
+ * anchor is accepted, and an accepted one moves the head, so two keyed reads bounded by this registry
+ * decide it. Only then can a retained root be unused, because every derivation from a root, and every copy
+ * of it to another member (which `RegistryRoot` authorizes only for an accepted, issuer-anchored update),
+ * starts from a staged or accepted update. A remote update escrowed for this registry also counts, which
+ * is the conservative side.
+ */
+export function registryUncommitted(registryStore, registry) {
+    if (registryStore.headEvent(registry)?.ilk !== "rip")
+        return false;
+    for (const table of [registryStore.baser.maes, registryStore.baser.ooes]) {
+        for (const _ of table.getTopItemIter(registry))
+            return false;
+    }
+    return true;
+}
 /**
  * Issuer/issuee DH for an explicitly approved pending Grant. Wire
  * intake cannot approve work. Inject as ProtocolProcessor.qvy and register on
@@ -95,7 +161,7 @@ export function deriveRoot(privateKey, context) {
  */
 export class Dhke {
     /** Bind concrete local owners; construction grants no consent and writes nothing. */
-    constructor({ hab, exc, registryStore, rvy = hab.rvy, now = Date.now }) {
+    constructor({ hab, exc, registryStore, rvy = hab.rvy, now = Date.now, kram = true }) {
         Object.defineProperty(this, "resource", {
             enumerable: true,
             configurable: true,
@@ -108,6 +174,13 @@ export class Dhke {
             writable: true,
             value: new Deck()
         });
+        /** Completion cues for roots just retained by this group's custodian; feed `RootReplicator.replicate`. */
+        Object.defineProperty(this, "replicated", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Deck()
+        });
         Object.defineProperty(this, "pendingQueries", {
             enumerable: true,
             configurable: true,
@@ -156,6 +229,13 @@ export class Dhke {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "kram", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.kram = kram;
         if (!(hab instanceof Hab) || hab.db !== exc.hby.db || rvy.db !== hab.db
             || exc.hby.habs.get(hab.pre) !== hab)
             throw new ValidationError("DH requires a local signing habitat");
@@ -169,8 +249,20 @@ export class Dhke {
             throw new ValidationError("DH requires a local signing member");
         }
     }
-    /** Select one live fresh issuance and freeze its exact bodies, parties and registry order. */
+    /**
+     * Select one live fresh issuance and freeze its exact bodies, parties and registry order.
+     *
+     * A registry that already holds a root refuses (`Registry root conflicts with this live DH operation`)
+     * unless it has no committed state ({@link registryUncommitted}): then the held root was never used and
+     * this exchange, whose Grant is from the registry's issuer, overwrites it when it retains its own root,
+     * never at approval, so an interruption before retention leaves the old root. Once any update is staged
+     * or accepted the refusal is unchanged. A KERIpy peer keeps the old rule and refuses such a second
+     * exchange: with a KERIpy holder the issuer needs a fresh registry. One process also refuses a second
+     * live operation on a registry, so two pending Grants cannot clobber each other's root.
+     */
     approve(grant, { coordinator, custodian } = {}) {
+        if (!this.kram)
+            throw new ValidationError("DH requires KRAM: enable it with the runtime's kram option");
         this.pruneQueries();
         this.hab.mgr.requireRegistryRootAccess();
         for (const op of this.operations.values()) {
@@ -184,27 +276,68 @@ export class Dhke {
                 return op.xid;
             }
         }
-        const input = this.exc.retainedInput(grant, { pending: true });
-        if (!input)
-            throw new ValidationError("DH requires an authenticated pending Grant");
-        const message = input.serder, issuer = message.pre, issuee = message.sad.ri;
-        const xid = message.ilk === "xip" ? message.said : message.sad.x;
-        if (typeof xid !== "string" || typeof issuee !== "string" || issuer === issuee
-            || ![issuer, issuee].includes(this.hab.pre))
-            throw new ValidationError("Local habitat is not a DH party");
+        const scope = freshScope(this.hab, this.exc, grant);
+        if (typeof scope === "string")
+            throw new ValidationError(scope);
+        const op = this.frozen(scope, grant, { coordinator, custodian }, false);
+        for (const other of this.operations.values()) {
+            if (!other.abandoned && other.registries.some((registry) => op.registries.includes(registry))) {
+                throw new ValidationError("Another live DH operation uses this registry");
+            }
+        }
+        for (const registry of op.registries) {
+            if (this.hab.mgr.hasRegistryRoot(this.hab.pre, registry) && registryUncommitted(this.registryStore, registry)) {
+                op.replaces.add(registry);
+            }
+        }
+        this.roots(op);
+        this.operations.set(op.xid, op);
+        this.replayQuery(op.xid);
+        return op.xid;
+    }
+    /**
+     * Resume a completed exchange after a process restart, without new key exchange: rebuild the operation as
+     * completed from the roots held for the Grant's registries ({@link resumableExchange}). It holds no
+     * ephemeral key, so it cannot start, answer or renew a query; it can only {@link complete} and
+     * {@link finish}, which signs nothing and verifies the issuer's update against the held root. Needs an
+     * unlocked Keeper; wire intake never calls it. Repeating it returns the same transaction.
+     *
+     * @throws ValidationError unless the Grant is pending and holds a root for each registry in its scope.
+     */
+    resume(grant, { coordinator, custodian } = {}) {
+        this.pruneQueries();
+        this.hab.mgr.requireRegistryRootAccess();
+        for (const op of this.operations.values()) {
+            if (op.grant !== grant)
+                continue;
+            if (!op.completed)
+                throw new ValidationError("DH is still exchanging keys for this Grant; nothing to resume");
+            this.pending(op);
+            return op.xid;
+        }
+        const scope = resumableExchange(this, grant);
+        if (!scope)
+            throw new ValidationError("No root is held for this pending Grant's registries");
+        const op = this.frozen(scope, grant, { coordinator, custodian }, true);
+        this.roots(op);
+        this.operations.set(op.xid, op);
+        this.pendingQueries.delete(op.xid);
+        this.dropHeld(op.xid);
+        return op.xid;
+    }
+    /** Freeze the exact pending Grant, parties and registry order into an operation; registers nothing. */
+    frozen(scope, grant, { coordinator, custodian }, completed) {
+        const { input, issuer, issuee, xid, registries } = scope;
         if (this.operations.has(xid))
             throw new ValidationError("Another Grant is selected for this transaction");
-        const context = this.exc.pendingGrant(grant, { xid, sender: issuer, recipient: issuee });
-        if (!context)
-            throw new ValidationError("DH requires authenticated fresh registry scope");
         const op = {
             xid,
             grant,
             issuer,
             issuee,
-            raw: message.raw.slice(),
+            raw: input.serder.raw.slice(),
             bodies: (input.nests ?? []).map((nest) => nest.body.raw.slice()),
-            registries: [...context.registries],
+            registries,
             privateKeys: new Map(),
             publicKeys: {},
             peer: null,
@@ -213,7 +346,8 @@ export class Dhke {
             proposal: null,
             contribution: null,
             custody: null,
-            completed: false,
+            replaces: new Set(),
+            completed,
             abandoned: false,
         };
         if (this.group) {
@@ -235,10 +369,17 @@ export class Dhke {
         else if (coordinator !== undefined || custodian !== undefined) {
             throw new ValidationError("Individual DH has no group coordinator");
         }
-        this.roots(op);
-        this.operations.set(xid, op);
-        this.replayQuery(xid);
-        return xid;
+        return op;
+    }
+    /**
+     * Whether this owner already holds a live operation for `grant`. Two operation tables over one runtime
+     * (the host's and a command's own) use it so only the first to reach a Grant drives it.
+     */
+    holds(grant) {
+        for (const op of this.operations.values())
+            if (op.grant === grant && !op.abandoned)
+                return true;
+        return false;
     }
     /** Return the stable issuer proposal until own threshold intake supplies the complete query. */
     start(grant) {
@@ -506,12 +647,34 @@ export class Dhke {
     /** Drop local ephemeral key references and permanently refuse this operation. */
     abandon(xid) {
         const retained = this.pendingQueries.delete(xid);
+        this.dropHeld(xid);
         if (retained && !this.operations.has(xid))
             return;
         const op = this.operation(xid);
         this.clearPrivate(op);
         op.abandoned = true;
     }
+    /**
+     * Whether this local habitat is the party of DH transaction `xid` with `sender`.
+     *
+     * Messages carry no recipient, so a per-identifier registry selects the owner by transaction:
+     * an approved operation here, a stored Grant from `sender` addressed to this habitat, or, for a
+     * group, its own members' contributions, which KRAM must pool before this owner consents.
+     */
+    inTransaction(sender, xid) {
+        return this.operations.has(xid) || (this.group && sender === this.hab.pre)
+            || Dhke.recipients(this.hab.db, sender, xid).includes(this.hab.pre);
+    }
+    /** Recipients of the pending Grants `sender` opened in DH transaction `xid`, from KRAM-accepted store rows. */
+    static recipients(db, sender, xid) {
+        const recipients = [];
+        for (const [key] of db.tmsc.getTopItemIter([sender, xid])) {
+            const recipient = db.epse.get([key[2]])?.sad?.ri;
+            if (typeof recipient === "string")
+                recipients.push(recipient);
+        }
+        return recipients;
+    }
     /** Release all process-local approvals and retry bytes; zero owned ephemeral scalar arrays. */
     close() {
         for (const op of this.operations.values())
@@ -519,6 +682,7 @@ export class Dhke {
         this.operations.clear();
         this.pendingQueries.clear();
         this.outgoing.clear();
+        this.replicated.clear();
     }
     /** Retain public query evidence against one exact pending Grant, without creating keys or consent. */
     retainQuery(envelope) {
@@ -540,11 +704,22 @@ export class Dhke {
         for (const [, key] of entries)
             decodePublicKey(key);
         const expires = this.retainUntil(envelope, grant);
-        const prior = this.pendingQueries.get(data.x);
-        if (prior && !bytesEqual(prior.envelope.serder.raw, query.raw))
-            throw new ValidationError("Conflicting DH query");
-        if (!prior) {
+        // After a restart the persisted copy is the prior one, so a successor is judged as it is before one.
+        const prior = this.pendingQueries.get(data.x) ?? this.loadHeld(data.x, grant.said);
+        if (prior && !bytesEqual(prior.envelope.serder.raw, query.raw)) {
+            // The issuer re-dates a query that aged before this side consented (`requery`): same sender, keys and
+            // Grant under a new date. It replaces the held one; any other difference is a conflict.
+            const held = this.parameters(prior.envelope.serder, "q");
+            const same = prior.envelope.serder.pre === query.pre && prior.grant === grant.said
+                && JSON.stringify(Object.entries(held.pk).sort()) === JSON.stringify(entries.sort());
+            if (!same)
+                throw new ValidationError("Conflicting DH query");
+        }
+        if (!prior || !bytesEqual(prior.envelope.serder.raw, query.raw)) {
             this.pendingQueries.set(data.x, { envelope: copyAuxiliaryQuery(envelope), expires, grant: grant.said });
+            // KRAM now holds this query as seen, so a resend of it is a replay: the held copy must outlive this process.
+            if (!envelope.nests.length)
+                this.hab.db.heldq.pin([data.x], auxiliaryQueryWire(envelope));
         }
     }
     /** Expired evidence cannot survive another owner interaction. */
@@ -557,11 +732,32 @@ export class Dhke {
     }
     /** Consume the first authenticated request only after explicit approval; never renew either clock. */
     replayQuery(xid) {
-        const pending = this.pendingQueries.get(xid);
+        const grant = this.operations.get(xid)?.grant;
+        const pending = this.pendingQueries.get(xid) ?? (grant ? this.loadHeld(xid, grant) : undefined);
         this.pendingQueries.delete(xid);
-        if (pending && pending.grant === this.operations.get(xid)?.grant
-            && BigInt(this.now()) * 1000n < pending.expires)
+        this.dropHeld(xid);
+        if (pending && pending.grant === grant && BigInt(this.now()) * 1000n < pending.expires) {
             this.processQuery(pending.envelope);
+        }
+    }
+    /** The persisted query for `xid` after a restart, with its lifetime recomputed from KRAM's durable records. */
+    loadHeld(xid, grant) {
+        const wire = this.hab.db.heldq.get([xid]);
+        const input = this.exc.retainedInput(grant, { pending: true });
+        if (!wire || !input)
+            return undefined;
+        try {
+            const envelope = restoreAuxiliaryQuery(wire);
+            return { envelope, expires: this.retainUntil(envelope, input.serder), grant };
+        }
+        catch (error) {
+            if (error instanceof ValidationError)
+                return undefined;
+            throw error;
+        }
+    }
+    dropHeld(xid) {
+        this.hab.db.heldq.rem([xid]);
     }
     /** Bound process-local public evidence by the original query and accepted Grant lifetimes. */
     retainUntil(envelope, grant) {
@@ -610,8 +806,12 @@ export class Dhke {
     }
     roots(op) {
         for (const registry of op.registries) {
-            if ((this.hab.mgr.getRegistryRoot(this.hab.pre, registry) !== null) !== op.completed) {
-                throw new ValidationError("Registry root conflicts with this live DH operation");
+            const held = this.hab.mgr.hasRegistryRoot(this.hab.pre, registry);
+            if (held !== op.completed && !(held && op.replaces.has(registry))) {
+                throw new ValidationError(held
+                    ? "Registry root conflicts with this live DH operation: a DH-issued registry must not have a custody root, "
+                        + "so do not call createCustody for it before issuance (use a registry without custody)"
+                    : "Registry root conflicts with this live DH operation");
             }
         }
     }
@@ -648,6 +848,9 @@ export class Dhke {
         return { op, peer };
     }
     generate(op) {
+        // A completed operation, including a resumed one, never holds or makes ephemeral keys again.
+        if (op.completed)
+            throw new ValidationError("DH operation has already completed");
         this.custody(op, true);
         if (op.privateKeys.size)
             return;
@@ -675,11 +878,20 @@ export class Dhke {
         ]));
     }
     retain(op, peer, roots) {
-        for (const [registry, root] of roots)
-            this.hab.mgr.putRegistryRoot(this.hab.pre, registry, root);
+        for (const [registry, root] of roots) {
+            const replacing = op.replaces.has(registry);
+            // Recheck at commit time, from stores: the held root must still be unused.
+            if (replacing && !registryUncommitted(this.registryStore, registry)) {
+                throw new ValidationError("Registry root conflicts with this live DH operation");
+            }
+            this.hab.mgr.putRegistryRoot(this.hab.pre, registry, root, replacing);
+        }
         op.peer = { ...peer };
         op.completed = true;
         this.clearPrivate(op);
+        // Every current member must hold every root; the custodian replicates.
+        if (this.group)
+            this.replicated.push({ gid: this.hab.pre, registries: [...roots.keys()] });
     }
     clearPrivate(op) {
         for (const key of op.privateKeys.values())

package/esm/keri/npm/src/acdc/regbasing.js

@@ -1,6 +1,8 @@
 /** Public ACDC registry database layout and joined LMDB lifecycle. */
 import { Diger, NumberPrimitive, Saider, SerderACDC } from "cesr-ts";
+import { DerivedUpdateRecord } from "../core/records.js";
 import { StoreOwner } from "../db/core/store-owner.js";
+import { Komer } from "../db/koming.js";
 import { B64OnIoSetSuber, BytesSuber, CatCesrSuber, CesrOnSuber, CesrSuber, SerderSuber } from "../db/subing.js";
 /**
  * Own one environment for public registry TEL bodies, accepted ordinals and heads.
@@ -39,6 +41,13 @@ export class RegBaser extends StoreOwner {
             writable: true,
             value: void 0
         });
+        /** keri-ts only. BUP SAID -> public blind-derivation coordinates; never a salt or opening. */
+        Object.defineProperty(this, "dvus", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         /** Event-SAID -> earliest verified KEL source couple, in the current store. */
         Object.defineProperty(this, "ancs", {
             enumerable: true,
@@ -71,6 +80,7 @@ export class RegBaser extends StoreOwner {
             this.tels = new CesrOnSuber(this.store, { subkey: "tels.", ctor: Saider });
             this.heads = new CesrSuber(this.store, { subkey: "heds.", ctor: Saider });
             this.openings = new BytesSuber(this.store, { subkey: "openings." });
+            this.dvus = new Komer(this.store, { subkey: "dvus.", recordClass: DerivedUpdateRecord });
             this.ancs = new CatCesrSuber(this.store, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
             this.maes = new B64OnIoSetSuber(this.store, { subkey: "maes." });
             this.ooes = new B64OnIoSetSuber(this.store, { subkey: "ooes." });

package/esm/keri/npm/src/acdc/salting.js

@@ -177,7 +177,7 @@ export function rootExn(hab, recipient, gid, registry, root, { event, td }) {
  * keeps the copy escrowed rather than refusing it.
  */
 export class RegistryRoot {
-    constructor(hby, rgy, notifier = null) {
+    constructor(hby, rgy, notifier = null, changes) {
         Object.defineProperty(this, "resource", {
             enumerable: true,
             configurable: true,
@@ -208,11 +208,19 @@ export class RegistryRoot {
             writable: true,
             value: void 0
         });
+        /** Told `{kind: "root", id: registry}` after a copy is retained, so an embedder that waited for the root can act. */
+        Object.defineProperty(this, "changes", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         if (rgy.hby !== hby)
             throw new ValidationError("registry root replication requires the Habery's registry owner");
         this.hby = hby;
         this.rgy = rgy;
         this.notifier = notifier;
+        this.changes = changes;
         if (!hby.readonly)
             this.reconcile();
     }
@@ -371,6 +379,11 @@ export class RegistryRoot {
         }
         return found.sort((left, right) => left[0] - right[0]).map(([, aid]) => aid);
     }
+    /** Public key by which `member` currently contributes to `gid`, or null while not a known current signing member. */
+    contributor(gid, member) {
+        const gkever = this.hby.db.getKever(gid);
+        return gkever ? contribution(this.hby.db, member, gkever.verfers)?.key ?? null : null;
+    }
     /** Return the registry SAIDs with a root retained locally for `gid`. */
     held(gid) {
         const found = [];
@@ -691,6 +704,8 @@ export class RegistryRoot {
                 rd: registry,
             });
         }
+        if (added)
+            this.changes?.push({ kind: "root", id: registry });
         return added;
     }
     /** Try one escrowed copy: true retained, null still pending, false dropped. */

package/esm/keri/npm/src/acdc/scheming.js

@@ -286,72 +286,111 @@ class SchemaResources {
         return root;
     }
 }
+/** Most closures kept per store; the oldest is evicted first. */
+const COMPILED_SCHEMA_BOUND = 256;
+/**
+ * Compiled closures by store, then root SAID. A closure is fully determined by its root SAID: the root and every
+ * bundled or `$ref` resource is verified against its SAID when admitted, so a cached closure cannot go stale.
+ * Per store, so a store that does not hold the schema still reports it missing; only a valid closure is kept.
+ */
+const compiledSchemas = new WeakMap();
+let compilations = 0;
+/** How many schema closures this process has compiled; a diagnostic for tests of the cache. */
+export function schemaCompilationCount() {
+    return compilations;
+}
+function isCompiled(value) {
+    return "validate" in value;
+}
+/** Compile an admitted closure once; regular-expression and duplicate-id refusals are normal invalid outcomes. */
+function compileClosure(resources, root) {
+    const { roots, scopes } = resources;
+    // Compile only admitted private copies. Canonical local URNs remove URI-alias ambiguity without changing stored IDs.
+    const uri = (said) => `urn:said:${said}`;
+    const registered = new Set();
+    const copy = (value) => {
+        if (Array.isArray(value))
+            return value.map(copy);
+        if (!object(value))
+            return value;
+        const result = Object.fromEntries(Object.entries(value).map(([key, item]) => [key, copy(item)]));
+        const owner = scopes.get(value);
+        if (!owner)
+            return result;
+        if ("$id" in value) {
+            if (registered.has(owner.said))
+                delete result.$id;
+            else {
+                result.$id = uri(owner.said);
+                registered.add(owner.said);
+            }
+        }
+        if ("$ref" in value) {
+            const parsed = reference(value.$ref);
+            result.$ref = uri(parsed.said ?? owner.said) + parsed.fragment;
+        }
+        // Python treats these AJV extension/obsolete applicator keywords as annotations.
+        for (const key of ["$async", "nullable", "dependencies", "additionalItems"])
+            delete result[key];
+        return result;
+    };
+    const validator = new ValidatorCtor({ strict: false, validateFormats: false });
+    for (const schema of scopes.keys()) {
+        if (!validator.validateSchema(schema))
+            throw new InvalidSchema("Invalid Draft 2020-12 schema");
+    }
+    const copies = roots.map(copy);
+    let validate;
+    try {
+        for (const schema of copies)
+            validator.addSchema(schema);
+        validate = validator.getSchema(uri(root.said));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError && error.message.includes("regular expression")) {
+            return { kind: "invalid", subject: "schema", reason: error.message };
+        }
+        if (error instanceof Error && /^reference "urn:said:[^"]+" resolves to more than one schema$/.test(error.message)) {
+            return { kind: "invalid", subject: "schema", reason: error.message };
+        }
+        throw error;
+    }
+    if (!validate)
+        throw new Error("Admitted schema was not registered");
+    compilations++;
+    return { validator, validate };
+}
 /** Local static schema closure plus a synchronous Draft 2020-12 validator; legacy Schemer behavior is unchanged. */
 export function validateSchema(acdc, db, override) {
-    const resources = new SchemaResources(db);
     try {
+        // The closure is always admitted: that verifies every SAID, and the verified root SAID names the cached validator.
+        const resources = new SchemaResources(db);
         const root = resources.admit(override ?? acdc.schema);
         if (!root) {
             return resources.missing
                 ? { kind: "missing", said: resources.missing }
                 : { kind: "invalid", subject: "schema", reason: "Invalid ACDC schema field" };
         }
-        const { roots, scopes } = resources;
-        // Compile only admitted private copies. Canonical local URNs remove URI-alias ambiguity without changing stored IDs.
-        const uri = (said) => `urn:said:${said}`;
-        const registered = new Set();
-        const copy = (value) => {
-            if (Array.isArray(value))
-                return value.map(copy);
-            if (!object(value))
-                return value;
-            const result = Object.fromEntries(Object.entries(value).map(([key, item]) => [key, copy(item)]));
-            const owner = scopes.get(value);
-            if (!owner)
-                return result;
-            if ("$id" in value) {
-                if (registered.has(owner.said))
-                    delete result.$id;
-                else {
-                    result.$id = uri(owner.said);
-                    registered.add(owner.said);
-                }
+        // An override object is checked against the document it replaces each time and is never kept.
+        const keep = typeof override !== "object";
+        let store = compiledSchemas.get(db);
+        let compiled = keep ? store?.get(root.said) : undefined;
+        if (!compiled) {
+            const built = compileClosure(resources, root);
+            if (!isCompiled(built))
+                return built;
+            compiled = built;
+            if (keep) {
+                if (!store)
+                    compiledSchemas.set(db, store = new Map());
+                if (store.size >= COMPILED_SCHEMA_BOUND)
+                    store.delete(store.keys().next().value);
+                store.set(root.said, compiled);
             }
-            if ("$ref" in value) {
-                const parsed = reference(value.$ref);
-                result.$ref = uri(parsed.said ?? owner.said) + parsed.fragment;
-            }
-            // Python treats these AJV extension/obsolete applicator keywords as annotations.
-            for (const key of ["$async", "nullable", "dependencies", "additionalItems"])
-                delete result[key];
-            return result;
-        };
-        const validator = new ValidatorCtor({ strict: false, validateFormats: false });
-        for (const schema of scopes.keys()) {
-            if (!validator.validateSchema(schema))
-                throw new InvalidSchema("Invalid Draft 2020-12 schema");
-        }
-        const copies = roots.map(copy);
-        let validate;
-        try {
-            for (const schema of copies)
-                validator.addSchema(schema);
-            validate = validator.getSchema(uri(root.said));
-        }
-        catch (error) {
-            if (error instanceof SyntaxError && error.message.includes("regular expression")) {
-                return { kind: "invalid", subject: "schema", reason: error.message };
-            }
-            if (error instanceof Error && /^reference "urn:said:[^"]+" resolves to more than one schema$/.test(error.message)) {
-                return { kind: "invalid", subject: "schema", reason: error.message };
-            }
-            throw error;
         }
-        if (!validate)
-            throw new Error("Admitted schema was not registered");
-        return validate(acdc.sad)
+        return compiled.validate(acdc.sad)
             ? { kind: "valid" }
-            : { kind: "invalid", subject: "credential", reason: validator.errorsText(validate.errors) };
+            : { kind: "invalid", subject: "credential", reason: compiled.validator.errorsText(compiled.validate.errors) };
     }
     catch (error) {
         if (error instanceof InvalidSchema)