@cello-protocol/daemon 0.0.189 → 0.0.191

package/dist/park-envelope.d.ts

@@ -44,6 +44,29 @@ export declare const PARK_ENVELOPE_VERSION = 2;
  * that, because "only a refusal" is a claim rather than a hope.
  */
 export declare const PARK_ENVELOPE_VERSION_ALG = 3;
+/**
+ * v4 — a v3 envelope plus THE SENDER'S SIGNATURE OVER `structure1Cbor` (034-CARRYLEAF review F1).
+ *
+ * ⚠️ **WITHOUT IT, A WITHHELD MESSAGE THAT ARRIVES BY MAILBOX CANNOT BE WITNESSED, and the
+ * withholding attack stays open on that route.**
+ *
+ * The direct path closed it: a message arriving with no relay ordering record is witnessed by its
+ * RECIPIENT, using the author's own signature carried beside the bytes it signs. The mailbox route
+ * had no such field — this envelope carried `structure1Cbor` and no signature over it, because
+ * `parkSig` covers `(session_id, recipient_pubkey, content_hash)`, a different statement. So the
+ * recipient held the author's words and nothing the relay would accept as proof of them, and a
+ * counterparty who parked instead of hand-delivering still truncated the record.
+ *
+ * The algorithm rides at index 6 exactly as on v3 and is ALWAYS present here, so the shape is a
+ * clean superset rather than a second optional tail nobody can parse positionally.
+ *
+ * **This is the emit half only.** A v2 or v3 envelope is still accepted — refusing one would destroy
+ * store-and-forward mail already sitting in every relay mailbox, which is the failure
+ * `SIGNED_ENVELOPE_VERSIONS` exists to prevent. Requiring v4 is a later step, once nothing in the
+ * field emits the older shapes; until then this route is closed against a stock client and open to
+ * one that deliberately strips the field.
+ */
+export declare const PARK_ENVELOPE_VERSION_S1SIG = 4;
 export interface ParkEnvelope {
     /** 1 = legacy/unsigned (bare content or the pre-SEC-1 shape). 2 = signed. */
     version: number;
@@ -53,8 +76,16 @@ export interface ParkEnvelope {
     structure2Cbor?: Uint8Array;
     /** SEC-1 — the sender's identity key. Present only on v2. */
     senderPubkey?: Uint8Array;
-    /** SEC-1 — Ed25519 over buildParkContentTbs(...). Present on v2 and v3. */
+    /** SEC-1 — Ed25519 over buildParkContentTbs(...). Present on v2, v3 and v4. */
     parkSig?: Uint8Array;
+    /**
+     * 034-CARRYLEAF — the sender's Ed25519 signature over `structure1Cbor`. Present only on v4.
+     *
+     * DISTINCT FROM `parkSig`, which signs `(session_id, recipient_pubkey, content_hash)`. This one
+     * signs the ordering claim itself, which is the only form the relay will accept when the recipient
+     * witnesses a leaf on its author's behalf.
+     */
+    structure1Signature?: Uint8Array;
     /**
      * The algorithm the sender used for `content_hash`. Present only on v3.
      *
@@ -64,6 +95,15 @@ export interface ParkEnvelope {
      * said nothing" — the same collapse B1's empty-string case exists to prevent.
      */
     contentHashAlg?: string;
+    /**
+     * 034-CARRYLEAF — the leaf DOMAIN this content belongs to (0x00 msg, 0x04 doc, …). Present only
+     * on v4.
+     *
+     * A leaf kind selects a hash domain, and documents ride this same envelope. Witnessing a recovered
+     * leaf under a guessed domain would put a wrong statement in the canonical record, so a recipient
+     * that does not see this does not witness at all.
+     */
+    leafKind?: number;
 }
 export type ParkAuthFailure = "unsigned_envelope" | "bad_signature" | "signer_not_counterparty" | "counterparty_unknown";
 export type ParkAuthVerdict = {
@@ -126,6 +166,16 @@ export declare function encodeParkEnvelope(args: {
     structure2Cbor?: Uint8Array;
     /** Omit, or pass the default, to emit a v2 envelope every current peer can read. */
     contentHashAlg?: string;
+    /**
+     * 034-CARRYLEAF — the sender's signature over `structure1Cbor`, which promotes the envelope to v4.
+     *
+     * It is what lets the RECIPIENT witness this leaf when the sender did not: the relay accepts a
+     * counter-submit only against the author's own signature over their own ordering claim, and
+     * `parkSig` signs a different statement.
+     */
+    structure1Signature?: Uint8Array;
+    /** The leaf domain, carried on v4 so a recovered leaf is never witnessed under a guessed one. */
+    leafKind?: number;
 }): Uint8Array;
 /**
  * SEC-1 — THE ONLY PRODUCER. Sign the entry as the sending agent, wrap it in a v2 envelope, and seal
@@ -147,6 +197,13 @@ export declare function sealParkEnvelope(args: {
     content: Uint8Array;
     structure1Cbor?: Uint8Array;
     structure2Cbor?: Uint8Array;
+    /**
+     * 034-CARRYLEAF — the sender's signature over `structure1Cbor`. Passing it promotes the envelope
+     * to v4 and is what lets the RECIPIENT witness this leaf if the sender never does.
+     */
+    structure1Signature?: Uint8Array;
+    /** The leaf domain, carried on v4 so a recovered leaf is never witnessed under a guessed one. */
+    leafKind?: number;
     /** The algorithm behind `contentHash`. Omit for the default; see `PARK_ENVELOPE_VERSION_ALG`. */
     contentHashAlg?: string;
 }): Promise<Uint8Array>;

package/dist/park-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"park-envelope.d.ts","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAInF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAW3F;AAED,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAY3C,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,qBAAqB;IAChC,mFAAmF;;CAE3E,CAAC;AAEX;;;;;;;;GAQG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAMxE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,UAAU,CAAC;IACzB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,UAAU,CAyCb;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,UAAU,GAAG,YAAY,CAwCtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,YAAY,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,GAAG,eAAe,CA8BlB;AAGD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CA4C9G"}
+{"version":3,"file":"park-envelope.d.ts","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAInF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAW3F;AAED,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAmB7C,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,qBAAqB;IAChC,mFAAmF;;CAE3E,CAAC;AAEX;;;;;;;;GAQG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAMxE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,UAAU,CAAC;IACzB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,UAAU,CA4Db;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,UAAU,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,UAAU,GAAG,YAAY,CAsDtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,YAAY,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,GAAG,eAAe,CA8BlB;AAGD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CA4C9G"}

package/dist/park-envelope.js

@@ -90,6 +90,31 @@ export const PARK_ENVELOPE_VERSION = 2;
  * that, because "only a refusal" is a claim rather than a hope.
  */
 export const PARK_ENVELOPE_VERSION_ALG = 3;
+/**
+ * v4 — a v3 envelope plus THE SENDER'S SIGNATURE OVER `structure1Cbor` (034-CARRYLEAF review F1).
+ *
+ * ⚠️ **WITHOUT IT, A WITHHELD MESSAGE THAT ARRIVES BY MAILBOX CANNOT BE WITNESSED, and the
+ * withholding attack stays open on that route.**
+ *
+ * The direct path closed it: a message arriving with no relay ordering record is witnessed by its
+ * RECIPIENT, using the author's own signature carried beside the bytes it signs. The mailbox route
+ * had no such field — this envelope carried `structure1Cbor` and no signature over it, because
+ * `parkSig` covers `(session_id, recipient_pubkey, content_hash)`, a different statement. So the
+ * recipient held the author's words and nothing the relay would accept as proof of them, and a
+ * counterparty who parked instead of hand-delivering still truncated the record.
+ *
+ * The algorithm rides at index 6 exactly as on v3 and is ALWAYS present here, so the shape is a
+ * clean superset rather than a second optional tail nobody can parse positionally.
+ *
+ * **This is the emit half only.** A v2 or v3 envelope is still accepted — refusing one would destroy
+ * store-and-forward mail already sitting in every relay mailbox, which is the failure
+ * `SIGNED_ENVELOPE_VERSIONS` exists to prevent. Requiring v4 is a later step, once nothing in the
+ * field emits the older shapes; until then this route is closed against a stock client and open to
+ * one that deliberately strips the field.
+ */
+export const PARK_ENVELOPE_VERSION_S1SIG = 4;
+/** The message leaf domain — the default a v4 envelope names when its caller does not. */
+const LEAF_KIND_MSG_DOMAIN = 0x00;
 /**
  * The versions that carry a sender signature and may therefore be authenticated.
  *
@@ -98,7 +123,11 @@ export const PARK_ENVELOPE_VERSION_ALG = 3;
  * 3 would have turned every v2 envelope sitting in every relay mailbox into `unsigned_envelope`:
  * store-and-forward mail destroyed, and reported as an attack.
  */
-const SIGNED_ENVELOPE_VERSIONS = new Set([PARK_ENVELOPE_VERSION, PARK_ENVELOPE_VERSION_ALG]);
+const SIGNED_ENVELOPE_VERSIONS = new Set([
+    PARK_ENVELOPE_VERSION,
+    PARK_ENVELOPE_VERSION_ALG,
+    PARK_ENVELOPE_VERSION_S1SIG,
+]);
 /**
  * Why this build refused to SEAL an entry — the producer side, distinct from `ParkAuthFailure`,
  * which is why it refused to ACCEPT one.
@@ -169,6 +198,21 @@ export function encodeParkEnvelope(args) {
      * tamper on a message nobody touched.
      */
     const alg = args.contentHashAlg;
+    /**
+     * v4 WHEN THE ORDERING CLAIM IS SIGNED — 034-CARRYLEAF. Checked before the algorithm branches,
+     * because v4 always carries the algorithm slot and a v2/v3 decision would drop the signature.
+     * Both fields must be present: a signature with no claim to check it against is not evidence.
+     */
+    if (args.structure1Signature && args.structure1Cbor) {
+        const named = alg === undefined || alg === null ? CONTENT_HASH_ALGS.SHA256 : alg;
+        if (!isKnownContentHashAlg(named)) {
+            throw new ParkEnvelopeError(PARK_ENVELOPE_REASONS.ALG_UNREADABLE, named, `PARK ENVELOPE: refusing to seal an entry naming content-hash algorithm "${named}", which ` +
+                "this build cannot itself reproduce.");
+        }
+        return encodeCbor([
+            PARK_ENVELOPE_VERSION_S1SIG, ...base, named, args.structure1Signature, args.leafKind ?? LEAF_KIND_MSG_DOMAIN,
+        ]);
+    }
     if (alg === undefined || alg === null || alg === CONTENT_HASH_ALGS.SHA256) {
         return encodeCbor([PARK_ENVELOPE_VERSION, ...base]);
     }
@@ -206,6 +250,8 @@ export async function sealParkEnvelope(args) {
         content: args.content,
         structure1Cbor: args.structure1Cbor,
         structure2Cbor: args.structure2Cbor,
+        structure1Signature: args.structure1Signature,
+        leafKind: args.leafKind,
         senderPubkey,
         parkSig,
         contentHashAlg: args.contentHashAlg,
@@ -223,6 +269,20 @@ export function decodeParkEnvelope(plaintext) {
     try {
         const arr = cborDecode(plaintext);
         // v3 first: a v2 envelope plus the content-hash algorithm as a 7th element.
+        // v4 FIRST — longest shape first, so a v4 array can never be read as a shorter one.
+        if (Array.isArray(arr) && arr.length === 9 && arr[0] === PARK_ENVELOPE_VERSION_S1SIG && arr[1] instanceof Uint8Array) {
+            return {
+                version: PARK_ENVELOPE_VERSION_S1SIG,
+                content: arr[1],
+                structure1Cbor: arr[2] instanceof Uint8Array ? arr[2] : undefined,
+                structure2Cbor: arr[3] instanceof Uint8Array ? arr[3] : undefined,
+                senderPubkey: arr[4] instanceof Uint8Array ? arr[4] : undefined,
+                parkSig: arr[5] instanceof Uint8Array ? arr[5] : undefined,
+                contentHashAlg: typeof arr[6] === "string" ? arr[6] : undefined,
+                structure1Signature: arr[7] instanceof Uint8Array ? arr[7] : undefined,
+                leafKind: typeof arr[8] === "number" ? arr[8] : undefined,
+            };
+        }
         if (Array.isArray(arr) && arr.length === 7 && arr[0] === PARK_ENVELOPE_VERSION_ALG && arr[1] instanceof Uint8Array) {
             return {
                 version: PARK_ENVELOPE_VERSION_ALG,

package/dist/park-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"park-envelope.js","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,eAAe,EAAoB,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,SAA6B;IAChF,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,kGAAkG;IAClG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAgCrG;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,mFAAmF;IACnF,cAAc,EAAE,8BAA8B;CACtC,CAAC;AAEX;;;;;;;;GAQG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAI/B;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAqB;IACpC,yFAAyF;IAChF,MAAM,CAAS;IACxB,YAAY,MAA0B,EAAE,MAAc,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAQlC;IACC,MAAM,IAAI,GAAG;QACX,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,OAAO;KACb,CAAC;IACF;;;;;;;;;;OAUG;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO,UAAU,CAAC,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAAe,CAAC;IACpE,CAAC;IACD;;;;;;;OAOG;IACH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,cAAc,EACpC,GAAG,EACH,2EAA2E,GAAG,gBAAgB;YAC9F,+FAA+F;YAC/F,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,yBAAyB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAe,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAUtC;IACC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpC,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAC/E,CAAC;IACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,YAAY;QACZ,OAAO;QACP,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,mGAAmG;IACnG,iFAAiF;IACjF,OAAO,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAqB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAc,CAAC;QAC/C,4EAA4E;QAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,yBAAyB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YACnH,OAAO;gBACL,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1D,4FAA4F;gBAC5F,+EAA+E;gBAC/E,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,qBAAqB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC/G,OAAO;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC3F,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAExF,kGAAkG;IAClG,yEAAyE;IACzE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IAED,gGAAgG;IAChG,yFAAyF;IACzF,MAAM,GAAG,GAAG,mBAAmB,CAAC,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,gGAAgG;IAChG,mGAAmG;IACnG,6FAA6F;IAC7F,6DAA6D;IAC7D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAGD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,OAAgB,EAAE,YAAqB;IACpG,IAAI,KAAK,KAAK,qBAAqB,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,CACL,4FAA4F;YAC5F,0FAA0F;YAC1F,6FAA6F;YAC7F,yFAAyF;YACzF,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,SAAS,GACb,KAAK,KAAK,mBAAmB,CAAC,YAAY;QACxC,CAAC,CAAC,0LAA0L,mBAAmB,CAAC,YAAY,CAAC,GAAG;QAChO,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,cAAc;YAC5C,CAAC,CAAC,uRAAuR;YACzR,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,UAAU;gBACxC,CAAC,CAAC,6LAA6L;gBAC/L,CAAC,CAAC,IAAI,CAAC;IAEf,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,OAAO;YACZ,CAAC,CAAC,GAAG,SAAS,qHAAqH;YACnI,CAAC,CAAC,GAAG,SAAS,kEAAkE,CAAC;IACrF,CAAC;IAED,OAAO,OAAO;QACZ,CAAC,CAAC,sNAAsN;QACxN,CAAC,CAAC,mGAAmG,CAAC;AAC1G,CAAC;AAGD;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,YAAgC;IAC3D,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC;AACxH,CAAC"}
+{"version":3,"file":"park-envelope.js","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,eAAe,EAAoB,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,SAA6B;IAChF,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,kGAAkG;IAClG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS;IAC/C,qBAAqB;IACrB,yBAAyB;IACzB,2BAA2B;CAC5B,CAAC,CAAC;AAiDH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,mFAAmF;IACnF,cAAc,EAAE,8BAA8B;CACtC,CAAC;AAEX;;;;;;;;GAQG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAI/B;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAqB;IACpC,yFAAyF;IAChF,MAAM,CAAS;IACxB,YAAY,MAA0B,EAAE,MAAc,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAkBlC;IACC,MAAM,IAAI,GAAG;QACX,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,OAAO;KACb,CAAC;IACF;;;;;;;;;;OAUG;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;IAChC;;;;OAIG;IACH,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,cAAc,EACpC,KAAK,EACL,2EAA2E,KAAK,WAAW;gBAC3F,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,2BAA2B,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,QAAQ,IAAI,oBAAoB;SAC7G,CAAe,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO,UAAU,CAAC,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAAe,CAAC;IACpE,CAAC;IACD;;;;;;;OAOG;IACH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,cAAc,EACpC,GAAG,EACH,2EAA2E,GAAG,gBAAgB;YAC9F,+FAA+F;YAC/F,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,yBAAyB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAe,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAiBtC;IACC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpC,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAC/E,CAAC;IACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY;QACZ,OAAO;QACP,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,mGAAmG;IACnG,iFAAiF;IACjF,OAAO,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAqB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAc,CAAC;QAC/C,4EAA4E;QAC5E,oFAAoF;QACpF,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,2BAA2B,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YACrH,OAAO;gBACL,OAAO,EAAE,2BAA2B;gBACpC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1D,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtE,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,yBAAyB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YACnH,OAAO;gBACL,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1D,4FAA4F;gBAC5F,+EAA+E;gBAC/E,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,qBAAqB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC/G,OAAO;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC3F,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAExF,kGAAkG;IAClG,yEAAyE;IACzE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IAED,gGAAgG;IAChG,yFAAyF;IACzF,MAAM,GAAG,GAAG,mBAAmB,CAAC,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,gGAAgG;IAChG,mGAAmG;IACnG,6FAA6F;IAC7F,6DAA6D;IAC7D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAGD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,OAAgB,EAAE,YAAqB;IACpG,IAAI,KAAK,KAAK,qBAAqB,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,CACL,4FAA4F;YAC5F,0FAA0F;YAC1F,6FAA6F;YAC7F,yFAAyF;YACzF,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,SAAS,GACb,KAAK,KAAK,mBAAmB,CAAC,YAAY;QACxC,CAAC,CAAC,0LAA0L,mBAAmB,CAAC,YAAY,CAAC,GAAG;QAChO,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,cAAc;YAC5C,CAAC,CAAC,uRAAuR;YACzR,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,UAAU;gBACxC,CAAC,CAAC,6LAA6L;gBAC/L,CAAC,CAAC,IAAI,CAAC;IAEf,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,OAAO;YACZ,CAAC,CAAC,GAAG,SAAS,qHAAqH;YACnI,CAAC,CAAC,GAAG,SAAS,kEAAkE,CAAC;IACrF,CAAC;IAED,OAAO,OAAO;QACZ,CAAC,CAAC,sNAAsN;QACxN,CAAC,CAAC,mGAAmG,CAAC;AAC1G,CAAC;AAGD;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,YAAgC;IAC3D,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC;AACxH,CAAC"}

package/dist/refusal-reasons.d.ts

@@ -122,4 +122,25 @@ export type AnyRefusalReason = RefusalReason | CapacityReason;
  * `session_refused` frame, which goes to the side that can act on it.
  */
 export declare const REFUSAL_GUIDANCE: Record<RefusalReason, string>;
+/**
+ * 033-ACKEMIT — what the operator is told when the RELAY refuses to witness a message because the
+ * acknowledgement this daemon signed contradicts the relay's own record.
+ *
+ * ⚠️ **A PURE FUNCTION, AND THAT IS THE POINT.** The two sentences it returns lived inline at the
+ * one call site, which sits behind a real relay answering a real `hash_submit_error` — so nothing in
+ * the suite could reach them, and the guard's own comment invoked the "a refusal nobody hears"
+ * pattern while being, itself, untestable. Review F6 then found the `relay_fault` remedy naming a
+ * move that does not exist ("sending again usually picks a healthy one" — a session keeps the relay
+ * its assignment names, and there is no handover anywhere). Pulling the text out is what lets a test
+ * hold it.
+ *
+ * `relayFault` is `ack_hash_unverifiable`: the relay's counter reached a position its own leaf log
+ * did not, which is a fault on the relay and NOT something either participant did. It is separate
+ * from a mismatch for that reason — sending an operator to ask their counterparty about a problem
+ * the witness caused spends their attention on the wrong party.
+ */
+export declare function relayAckHashRefusalNotice(relayFault: boolean, mailboxRouteAvailable: boolean): {
+    impact: string;
+    guidance: string;
+};
 //# sourceMappingURL=refusal-reasons.d.ts.map

package/dist/refusal-reasons.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal-reasons.d.ts","sourceRoot":"","sources":["../src/refusal-reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa;IACxB,6FAA6F;;IAE7F,2FAA2F;;IAE3F,mGAAmG;;IAEnG,gGAAgG;;IAEhG,0FAA0F;;CAElF,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE7E;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,QAQoC,CAAC;AAExE,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAsD7D,CAAC;AAEF,eAAO,MAAM,eAAe;IAC1B,4FAA4F;;IAE5F,6FAA6F;;IAE7F,gFAAgF;;CAExE,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,cAAc,CAAC;AAE9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAoB1D,CAAC"}
+{"version":3,"file":"refusal-reasons.d.ts","sourceRoot":"","sources":["../src/refusal-reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa;IACxB,6FAA6F;;IAE7F,2FAA2F;;IAE3F,mGAAmG;;IAEnG,gGAAgG;;IAEhG,0FAA0F;;CAElF,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE7E;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,QAQoC,CAAC;AAExE,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAsD7D,CAAC;AAEF,eAAO,MAAM,eAAe;IAC1B,4FAA4F;;IAE5F,6FAA6F;;IAE7F,gFAAgF;;CAExE,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,cAAc,CAAC;AAE9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAoB1D,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAG;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CASA"}

package/dist/refusal-reasons.js

@@ -175,4 +175,31 @@ export const REFUSAL_GUIDANCE = {
         "start a new one. If it repeats for the SAME counterparty, do not accept anything from them " +
         "until you have confirmed out of band that they still control the identity you know them by.",
 };
+/**
+ * 033-ACKEMIT — what the operator is told when the RELAY refuses to witness a message because the
+ * acknowledgement this daemon signed contradicts the relay's own record.
+ *
+ * ⚠️ **A PURE FUNCTION, AND THAT IS THE POINT.** The two sentences it returns lived inline at the
+ * one call site, which sits behind a real relay answering a real `hash_submit_error` — so nothing in
+ * the suite could reach them, and the guard's own comment invoked the "a refusal nobody hears"
+ * pattern while being, itself, untestable. Review F6 then found the `relay_fault` remedy naming a
+ * move that does not exist ("sending again usually picks a healthy one" — a session keeps the relay
+ * its assignment names, and there is no handover anywhere). Pulling the text out is what lets a test
+ * hold it.
+ *
+ * `relayFault` is `ack_hash_unverifiable`: the relay's counter reached a position its own leaf log
+ * did not, which is a fault on the relay and NOT something either participant did. It is separate
+ * from a mismatch for that reason — sending an operator to ask their counterparty about a problem
+ * the witness caused spends their attention on the wrong party.
+ */
+export function relayAckHashRefusalNotice(relayFault, mailboxRouteAvailable) {
+    const impact = relayFault
+        ? "the relay could not check what this agent said it had received, so it did not witness this message. The message was still sent; it has no place in the notarized record."
+        : "the relay REFUSED to witness this message: what this agent signed as the last thing it received from your counterparty does not match what the relay recorded at that position. The message was still sent, and it has no place in the notarized record. Your copy of this conversation and the witness's copy have stopped agreeing.";
+    const guidance = relayFault
+        ? "Nothing to change on your machine — the fault is on the relay this session is bound to, and it cannot be moved: a session keeps the relay its assignment names. Your messages still reach your counterparty; what stops is the notarized record growing. Close the session (cello_close_session) while its record is still worth notarizing, and open a new one, which will be assigned a relay afresh."
+        : "Do NOT rely on a receipt for this conversation until this stops. Send one more message: if it is witnessed, this was a one-off. If it repeats, the two records genuinely disagree — confirm what your counterparty actually sent you OUT OF BAND, then close this session and open a new one." +
+            (mailboxRouteAvailable ? "" : "");
+    return { impact, guidance };
+}
 //# sourceMappingURL=refusal-reasons.js.map

package/dist/refusal-reasons.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusal-reasons.js","sourceRoot":"","sources":["../src/refusal-reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,6FAA6F;IAC7F,OAAO,EAAE,SAAS;IAClB,2FAA2F;IAC3F,OAAO,EAAE,SAAS;IAClB,mGAAmG;IACnG,QAAQ,EAAE,UAAU;IACpB,gGAAgG;IAChG,IAAI,EAAE,MAAM;IACZ,0FAA0F;IAC1F,QAAQ,EAAE,UAAU;CACZ,CAAC;AAIX;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,+FAA+F;IAC/F,iGAAiG;IACjG,0FAA0F;IAC1F,gGAAgG;IAChG,kGAAkG;IAClG,+FAA+F;IAC/F,4FAA4F;IAC5F,qEAAqE,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAgC;IAChE;;;;OAIG;IACH,CAAC,aAAa,CAAC,OAAO,CAAC;IACrB;;;;;;;;;OASG;IACH,2FAA2F;QAC3F;;;;;;;;;WASG;QACH,oEAAoE;QACpE,qEAAqE;QACrE,kGAAkG;QAClG,iGAAiG;QACjG,sBAAsB;IACxB,CAAC,aAAa,CAAC,OAAO,CAAC,EACrB,+FAA+F;QAC/F,8FAA8F;QAC9F,iGAAiG;QACjG,6FAA6F;QAC7F,2BAA2B;IAC7B,CAAC,aAAa,CAAC,QAAQ,CAAC,EACtB,4FAA4F;QAC5F,+FAA+F;QAC/F,kGAAkG;QAClG,iGAAiG;QACjG,QAAQ;IACV,CAAC,aAAa,CAAC,IAAI,CAAC,EAClB,gGAAgG;QAChG,2FAA2F;QAC3F,gGAAgG;QAChG,yEAAyE;IAC3E,CAAC,aAAa,CAAC,QAAQ,CAAC,EACtB,kGAAkG;QAClG,8FAA8F;QAC9F,iFAAiF;CACpF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,4FAA4F;IAC5F,gCAAgC,EAAE,kCAAkC;IACpE,6FAA6F;IAC7F,gCAAgC,EAAE,kCAAkC;IACpE,gFAAgF;IAChF,0BAA0B,EAAE,4BAA4B;CAChD,CAAC;AAIX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,+BAA+B,EAAE,iCAAiC;IAClE,mCAAmC,EAAE,qCAAqC;CAClE,CAAC;AAuBX;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkC;IAC7D,CAAC,eAAe,CAAC,gCAAgC,CAAC,EAChD,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,mEAAmE;IACrE,CAAC,eAAe,CAAC,gCAAgC,CAAC,EAChD,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,0FAA0F;IAC5F,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAC1C,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;CAChG,CAAC"}
+{"version":3,"file":"refusal-reasons.js","sourceRoot":"","sources":["../src/refusal-reasons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,6FAA6F;IAC7F,OAAO,EAAE,SAAS;IAClB,2FAA2F;IAC3F,OAAO,EAAE,SAAS;IAClB,mGAAmG;IACnG,QAAQ,EAAE,UAAU;IACpB,gGAAgG;IAChG,IAAI,EAAE,MAAM;IACZ,0FAA0F;IAC1F,QAAQ,EAAE,UAAU;CACZ,CAAC;AAIX;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,+FAA+F;IAC/F,iGAAiG;IACjG,0FAA0F;IAC1F,gGAAgG;IAChG,kGAAkG;IAClG,+FAA+F;IAC/F,4FAA4F;IAC5F,qEAAqE,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAgC;IAChE;;;;OAIG;IACH,CAAC,aAAa,CAAC,OAAO,CAAC;IACrB;;;;;;;;;OASG;IACH,2FAA2F;QAC3F;;;;;;;;;WASG;QACH,oEAAoE;QACpE,qEAAqE;QACrE,kGAAkG;QAClG,iGAAiG;QACjG,sBAAsB;IACxB,CAAC,aAAa,CAAC,OAAO,CAAC,EACrB,+FAA+F;QAC/F,8FAA8F;QAC9F,iGAAiG;QACjG,6FAA6F;QAC7F,2BAA2B;IAC7B,CAAC,aAAa,CAAC,QAAQ,CAAC,EACtB,4FAA4F;QAC5F,+FAA+F;QAC/F,kGAAkG;QAClG,iGAAiG;QACjG,QAAQ;IACV,CAAC,aAAa,CAAC,IAAI,CAAC,EAClB,gGAAgG;QAChG,2FAA2F;QAC3F,gGAAgG;QAChG,yEAAyE;IAC3E,CAAC,aAAa,CAAC,QAAQ,CAAC,EACtB,kGAAkG;QAClG,8FAA8F;QAC9F,iFAAiF;CACpF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,4FAA4F;IAC5F,gCAAgC,EAAE,kCAAkC;IACpE,6FAA6F;IAC7F,gCAAgC,EAAE,kCAAkC;IACpE,gFAAgF;IAChF,0BAA0B,EAAE,4BAA4B;CAChD,CAAC;AAIX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,+BAA+B,EAAE,iCAAiC;IAClE,mCAAmC,EAAE,qCAAqC;CAClE,CAAC;AAuBX;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkC;IAC7D,CAAC,eAAe,CAAC,gCAAgC,CAAC,EAChD,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,mEAAmE;IACrE,CAAC,eAAe,CAAC,gCAAgC,CAAC,EAChD,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,0FAA0F;IAC5F,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAC1C,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;CAChG,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAmB,EAAE,qBAA8B;IAI3F,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,0KAA0K;QAC5K,CAAC,CAAC,uUAAuU,CAAC;IAC5U,MAAM,QAAQ,GAAG,UAAU;QACzB,CAAC,CAAC,yYAAyY;QAC3Y,CAAC,CAAC,+RAA+R;YAC/R,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/session-connection-gater.d.ts

@@ -80,10 +80,26 @@ export declare class SessionConnectionGater implements ConnectionGater {
      */
     closeInbound(): void;
     /**
-     * Record that this receiver now holds a LIVE circuit reservation with `peerId`, which is what
-     * earns that relay the inbound AutoNAT carve-out. Pass null when the reservation is lost.
+     * Record the relays this receiver holds LIVE circuit reservations with — the only peers that earn
+     * the inbound AutoNAT carve-out.
+     *
+     * REPLACES the set rather than adding to it. A relay absent from `peerIds` loses its carve-out in
+     * the same call that notices the reservation is gone, so the bound stays "holds one now" and
+     * cannot drift into "granted one once". Pass `[]` when nothing is held.
+     */
+    /**
+     * Does this relay hold the inbound carve-out — i.e. would this gater ADMIT an inbound dial from
+     * it on the strength of a live reservation?
+     *
+     * **This IS the carve-out branch**, not a description of it: `denyInboundEncryptedConnection`
+     * calls this method rather than re-testing the set. One definition, so nothing observing the gate
+     * can be told something different from what the gate does — which matters because the review
+     * found that substituting the CANDIDATE list for the held list at the manager's
+     * `setReservedRelayPeers` call left every test in this unit green while opening exactly the hole
+     * the bound exists to close. Read-only and silent: an observation must not log a refusal.
      */
-    setReservedRelayPeer(peerId: string | null): void;
+    holdsInboundCarveOut(peerId: string): boolean;
+    setReservedRelayPeers(peerIds: readonly string[]): void;
     /**
      * M7 DOD-SPINE-6: permit an OUTBOUND connection to a relay peer (the assigned
      * witness, a reservation relay, or the relay inside the counterparty's circuit

package/dist/session-connection-gater.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-connection-gater.d.ts","sourceRoot":"","sources":["../src/session-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C;AAED,gFAAgF;AAChF,qBAAa,iCAAkC,YAAW,uBAAuB;IAC/E,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;CAG1C;AAED,uEAAuE;AACvE,qBAAa,4BAA6B,YAAW,uBAAuB;IAC1E,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;CAG1C;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,YAAW,eAAe;;gBAkDhD,IAAI,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;KAChB;IASD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAKpC;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC;;;;;;;OAOG;IACH,YAAY,IAAI,IAAI;IAIpB;;;OAGG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIjD;;;;;OAKG;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5C;;;;;;;;OAQG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI9C,YAAY,IAAI,MAAM;IAItB,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC;;;;OAIG;IACH,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;IAIrF;;;;OAIG;IACH,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;CA4FvF;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,eAAe;;gBAIlD,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM;IAK7D,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;IAIrF,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;CAgBvF"}
+{"version":3,"file":"session-connection-gater.d.ts","sourceRoot":"","sources":["../src/session-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C;AAED,gFAAgF;AAChF,qBAAa,iCAAkC,YAAW,uBAAuB;IAC/E,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;CAG1C;AAED,uEAAuE;AACvE,qBAAa,4BAA6B,YAAW,uBAAuB;IAC1E,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;CAG1C;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,YAAW,eAAe;;gBAyDhD,IAAI,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;KAChB;IASD;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAKpC;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC;;;;;;;OAOG;IACH,YAAY,IAAI,IAAI;IAIpB;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI7C,qBAAqB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAKvD;;;;;OAKG;IACH,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5C;;;;;;;;OAQG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI9C,YAAY,IAAI,MAAM;IAItB,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC;;;;OAIG;IACH,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;IAIrF;;;;OAIG;IACH,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;CA8FvF;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,eAAe;;gBAIlD,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM;IAK7D,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;IAIrF,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO;CAgBvF"}

package/dist/session-connection-gater.js

@@ -76,7 +76,7 @@ export class SessionConnectionGater {
      */
     #standingReceiverOutbound;
     /**
-     * The ONE relay this receiver currently holds a live circuit reservation with, or null.
+     * The relays this receiver currently holds a live circuit reservation with. Empty by default.
      *
      * Review N3. The inbound AutoNAT carve-out below first keyed on `#allowedOutboundPeerIds`, and
      * that set is populated from the relay peer ids **the directory hands out at signaling-auth
@@ -84,11 +84,18 @@ export class SessionConnectionGater {
      * entire threat model is "one compromised directory", that handed the adversary back a narrow
      * inbound foothold: name a relay, never complete a reservation, and dial in anyway.
      *
-     * A single slot, set only when a reservation actually succeeds, is the honest version of the
+     * Entries added ONLY when a reservation actually succeeded is the honest version of the
      * justification the carve-out's comment makes — "a peer this node already dials and holds a
      * reservation with" — rather than a set that merely tends to contain those.
+     *
+     * 032-RELAYSPREAD widened this from ONE peer to a set, because the receiver now holds a
+     * reservation with every relay that will grant one. **The BOUND did not widen with it, and that
+     * is the security-sensitive part**: membership is still "this relay's own reservation is
+     * confirmed held", never "this relay is in the pool". Widening it to the candidate list would
+     * let a directory that merely NAMES a relay dial in behind the gate — the exact failure the
+     * single-relay version was written to prevent, multiplied by the size of the pool.
      */
-    #reservedRelayPeerId = null;
+    #reservedRelayPeerIds = new Set();
     constructor(opts) {
         this.#sessionId = opts.sessionId;
         this.#allowedPeerId = opts.allowedPeerId;
@@ -129,11 +136,31 @@ export class SessionConnectionGater {
         this.#allowedPeerId = null;
     }
     /**
-     * Record that this receiver now holds a LIVE circuit reservation with `peerId`, which is what
-     * earns that relay the inbound AutoNAT carve-out. Pass null when the reservation is lost.
+     * Record the relays this receiver holds LIVE circuit reservations with — the only peers that earn
+     * the inbound AutoNAT carve-out.
+     *
+     * REPLACES the set rather than adding to it. A relay absent from `peerIds` loses its carve-out in
+     * the same call that notices the reservation is gone, so the bound stays "holds one now" and
+     * cannot drift into "granted one once". Pass `[]` when nothing is held.
+     */
+    /**
+     * Does this relay hold the inbound carve-out — i.e. would this gater ADMIT an inbound dial from
+     * it on the strength of a live reservation?
+     *
+     * **This IS the carve-out branch**, not a description of it: `denyInboundEncryptedConnection`
+     * calls this method rather than re-testing the set. One definition, so nothing observing the gate
+     * can be told something different from what the gate does — which matters because the review
+     * found that substituting the CANDIDATE list for the held list at the manager's
+     * `setReservedRelayPeers` call left every test in this unit green while opening exactly the hole
+     * the bound exists to close. Read-only and silent: an observation must not log a refusal.
      */
-    setReservedRelayPeer(peerId) {
-        this.#reservedRelayPeerId = peerId;
+    holdsInboundCarveOut(peerId) {
+        return this.#standingReceiverOutbound && this.#reservedRelayPeerIds.has(peerId);
+    }
+    setReservedRelayPeers(peerIds) {
+        this.#reservedRelayPeerIds.clear();
+        for (const peerId of peerIds)
+            this.#reservedRelayPeerIds.add(peerId);
     }
     /**
      * M7 DOD-SPINE-6: permit an OUTBOUND connection to a relay peer (the assigned
@@ -235,14 +262,16 @@ export class SessionConnectionGater {
          * breaks INV-5 — a SESSION node admits exactly one counterparty, and the existing tests say so
          * in those words. A promoted node has no AutoNAT probe to answer, so it needs nothing here.
          *
-         * To the ONE RELAY HOLDING A LIVE RESERVATION (`#reservedRelayPeerId`), not the outbound
+         * To THE RELAYS HOLDING A LIVE RESERVATION (`#reservedRelayPeerIds`), not the outbound
          * allowlist. That allowlist is built from relay peer ids the DIRECTORY supplies, cumulatively,
          * including ones whose reservation never completed — so keying on it let a compromised
          * directory name a relay and dial in without ever holding a reservation. In a unit whose threat
-         * model is exactly that adversary, the set was the wrong thing to trust.
+         * model is exactly that adversary, the outbound allowlist was the wrong thing to trust, and it
+         * still is: this set holds only relays whose own reservation was confirmed, however many relays
+         * the pool names.
          */
-        if (direction === "inbound" && this.#standingReceiverOutbound && peerId.toString() === this.#reservedRelayPeerId) {
-            return false; // allow — the relay we hold a live reservation with, answering a probe we started
+        if (direction === "inbound" && this.holdsInboundCarveOut(peerId.toString())) {
+            return false; // allow — a relay we hold a live reservation with, answering a probe we started
         }
         if (this.#allowedPeerId === null) {
             if (direction === "outbound")

package/dist/session-connection-gater.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-connection-gater.js","sourceRoot":"","sources":["../src/session-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAcH,gFAAgF;AAChF,MAAM,OAAO,iCAAiC;IAC5C,eAAe,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,4BAA4B;IACvC,eAAe,CAAC,OAAe;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACjC,cAAc,CAAgB;IAC9B;;;;;;;;;OASG;IACM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,UAAU,CAAS;IACnB,OAAO,CAAS;IAEzB;;;;;;;;;;;;;;;;OAgBG;IACH,yBAAyB,CAAU;IAEnC;;;;;;;;;;;;OAYG;IACH,oBAAoB,GAAkB,IAAI,CAAC;IAE3C,YAAY,IAIX;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,gGAAgG;QAChG,iGAAiG;QACjG,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,yBAAyB,GAAG,KAAK,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,YAAY;QACV,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,MAAqB;QACxC,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,MAAc;QACnC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,2FAA2F;QAC3F,2FAA2F;QAC3F,qFAAqF;QACrF,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,+DAA+D;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,SAAiC;QACjE;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BG;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,yBAAyB,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACjH,OAAO,KAAK,CAAC,CAAC,kFAAkF;QAClG,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,SAAS,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC,CAAC,oDAAoD;YAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACpD,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAClC,cAAc,EAAE,6BAA6B;gBAC7C,MAAM,EACJ,+IAA+I;aAClJ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,OAAO;QACtB,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,eAAe;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAC1B,SAAS,CAA0B;IACnC,OAAO,CAAS;IAEzB,YAAY,QAAiC,EAAE,MAAc;QAC3D,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,mBAAmB,CAAC,MAAc;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,sBAAsB;YACjC,eAAe,EAAE,SAAS;YAC1B,cAAc,EAAE,sBAAsB;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF"}
+{"version":3,"file":"session-connection-gater.js","sourceRoot":"","sources":["../src/session-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAcH,gFAAgF;AAChF,MAAM,OAAO,iCAAiC;IAC5C,eAAe,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,4BAA4B;IACvC,eAAe,CAAC,OAAe;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACjC,cAAc,CAAgB;IAC9B;;;;;;;;;OASG;IACM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,UAAU,CAAS;IACnB,OAAO,CAAS;IAEzB;;;;;;;;;;;;;;;;OAgBG;IACH,yBAAyB,CAAU;IAEnC;;;;;;;;;;;;;;;;;;;OAmBG;IACM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnD,YAAY,IAIX;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,gGAAgG;QAChG,iGAAiG;QACjG,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,yBAAyB,GAAG,KAAK,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,YAAY;QACV,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,MAAc;QACjC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,qBAAqB,CAAC,OAA0B;QAC9C,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,MAAc;QACnC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,2FAA2F;QAC3F,2FAA2F;QAC3F,qFAAqF;QACrF,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,+DAA+D;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,SAAiC;QACjE;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA+BG;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC5E,OAAO,KAAK,CAAC,CAAC,gFAAgF;QAChG,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,SAAS,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC,CAAC,oDAAoD;YAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACpD,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAClC,cAAc,EAAE,6BAA6B;gBAC7C,MAAM,EACJ,+IAA+I;aAClJ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,OAAO;QACtB,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,eAAe;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAC1B,SAAS,CAA0B;IACnC,OAAO,CAAS;IAEzB,YAAY,QAAiC,EAAE,MAAc;QAC3D,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,mBAAmB,CAAC,MAAc;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,sBAAsB;YACjC,eAAe,EAAE,SAAS;YAC1B,cAAc,EAAE,sBAAsB;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF"}

package/dist/session-node-manager.d.ts

@@ -410,6 +410,35 @@ export interface SentAuthorship {
     senderPubkey: Uint8Array;
     senderSig: Uint8Array;
 }
+/**
+ * ─── 033-ACKEMIT: the three things that can be wrong with an ACKNOWLEDGEMENT ─────────────────────
+ *
+ * All three are `unusable` — the message is refused and the session lives. None of them is an
+ * identity fault: by the time any is returned the signature has verified, the signer IS this
+ * session's counterparty, and the claim is about this content in this conversation. What is wrong is
+ * what the claim says the sender had SEEN.
+ *
+ * They are three names and not one because the operator's next move differs for each, and because an
+ * investigator who cannot tell "your counterparty is on an older build" from "your counterparty
+ * acknowledged something you never sent" is looking at the wrong half of the problem.
+ *
+ * ⚠️ **NAME WHAT WAS OBSERVED, NEVER AN INFERRED CONCLUSION** (`DOD-M15-ERRSTRING-1`). Not one of
+ * these says "peer is malicious" — a mismatch is equally what a genuine software fault on the other
+ * side looks like, and an error that names a party the code did not check is this milestone's
+ * founding defect.
+ */
+/** A v1 claim: it carries no `last_seen_hash`, so it asserts a POSITION and no content at all. */
+declare const AUTHORSHIP_ACK_HASH_ABSENT = "ack_hash_absent";
+/** The hash names content this side does not hold at the position the claim names. */
+declare const AUTHORSHIP_ACK_HASH_MISMATCH = "ack_hash_mismatch";
+/** The hash names content this side has never held — not in the tree, and not held pending a gap. */
+declare const AUTHORSHIP_ACK_HASH_UNKNOWN = "ack_hash_unknown_content";
+/**
+ * The set that routes an `unusable` reason to the acknowledgement wording rather than the generic
+ * one. A SET, not a string prefix test: a name-shaped check would silently adopt any future reason
+ * someone happens to call `ack_*`, and give it a sentence written for these four.
+ */
+export type AckHashReason = typeof AUTHORSHIP_ACK_HASH_ABSENT | typeof AUTHORSHIP_ACK_HASH_MISMATCH | typeof AUTHORSHIP_ACK_HASH_UNKNOWN;
 /**
  * One row of a session's durable transcript as a reader sees it.
  *
@@ -601,6 +630,8 @@ export declare class SessionNodeManager {
         content: Uint8Array;
         structure1Cbor?: Uint8Array;
         structure2Cbor?: Uint8Array;
+        structure1Signature?: Uint8Array;
+        leafKind?: number;
         contentHashAlg: string | undefined;
     }) => Promise<{
         ok: true;
@@ -1101,6 +1132,19 @@ export declare class SessionNodeManager {
      * counterparty_session_* fields. Read-only — does NOT consume the standing receiver
      * (unlike acceptSession, which hands it off).
      */
+    /**
+     * 032-RELAYSPREAD — would this receiver ADMIT an inbound dial from this relay?
+     *
+     * The gater's inbound carve-out is the security-sensitive half of the spread: only relays whose
+     * own reservation is confirmed held earn it, so a directory that merely NAMES a relay cannot dial
+     * in behind the gate. Nothing could observe that from outside the manager, and the review found
+     * the consequence: substituting the CANDIDATE list for the held list at the `setReservedRelayPeers`
+     * call kept every test in the unit green while shipping exactly that hole. A guard whose wiring
+     * cannot be observed is a guard nothing can test.
+     *
+     * Reads the live gater rather than a copy, so it cannot drift from what the gate actually does.
+     */
+    isRelayCarvedOutInbound(agentName: string, relayPeerId: string): boolean;
     getStandingReceiverInfo(agentName: string): {
         peerId: string;
         addrs: string[];
@@ -1728,11 +1772,6 @@ export declare class SessionNodeManager {
         relayPeerId: string;
         relayAddrs: string[];
     }>;
-    /**
-     * Return the daemon-owned Merkle tree for a session, loading it from SQLite
-     * on first access (so it survives a restart — AC-007). Never returns null;
-     * an unknown session yields an empty tree.
-     */
     getSessionTree(agentName: string, sessionId: string): SessionTree;
     /** Current daemon-owned tree root for a session, as hex. */
     getSessionTreeRootHex(agentName: string, sessionId: string): string;
@@ -2428,6 +2467,31 @@ export declare class SessionNodeManager {
      * itself drive the real signed frames and must not use this.
      */
     setSessionContentKeyForTest(agentName: string, sessionId: string, key: Uint8Array): void;
+    /**
+     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
+     *
+     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
+     * exists on this side and is not in the tree, while the counterparty already has it from the relay
+     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
+     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
+     * it.
+     */
+    holdOwnLeafForTest(agentName: string, sessionId: string, canonicalSeq: number, contentHashHex: string): void;
+    /**
+     * Test seam: put the session's genesis prev_root where a completed session open leaves it —
+     * 033-ACKEMIT.
+     *
+     * ⚠️ THE STATE IS THE PRODUCTION ONE; ONLY HOW IT GOT THERE IS SHORT-CIRCUITED, exactly as
+     * `setSessionContentKeyForTest` short-circuits the key exchange next door.
+     *
+     * In production this value is derived from the directory-signed relay assignment and written to
+     * the session row the moment the session learns it, so every real session has one. A fixture that
+     * builds a session node directly never sees an assignment — so without this seam every content
+     * test built on the fixture would be exercising the "no starting point" REFUSAL path instead of
+     * the thing it was written for, and would report that as a pass or a mysterious failure depending
+     * on which side of the send it sat on.
+     */
+    setSessionGenesisForTest(agentName: string, sessionId: string, genesis: Uint8Array): void;
     /**
      * Test seam: drop the agreed key while leaving the session up — the state before an exchange
      * completes, and after a teardown evicts one. Its mirror above is what a completed exchange