@cello-protocol/protocol-types 0.0.43 → 0.0.44

package/dist/index.d.ts

@@ -28,8 +28,4 @@ export { IT_LENGTH_PREFIX_DEFAULT_MAX, CONTENT_PARK_PROTOCOL_ID, CONTENT_PARK_AU
 export type { SessionLiveness, SessionLivenessQuery, SessionLivenessResponse, } from "./session-liveness.js";
 export { encodeSessionLivenessQuery, decodeSessionLivenessQuery, encodeSessionLivenessResponse, decodeSessionLivenessResponse, } from "./session-liveness.js";
 export { MONIKER_RE, validateMoniker } from "./moniker.js";
-export { DOCUMENT_UPDATE_DOMAIN, DOCUMENT_UPDATE_ENCODING_V1, DOCUMENT_EPOCH_V1, buildDocumentUpdateTbs, encodeDocumentUpdateEnvelope, decodeDocumentUpdateEnvelope, documentEnvelopeHash, verifyDocumentChainLink, } from "./document-envelope.js";
-export type { DocumentUpdateEnvelope } from "./document-envelope.js";
-export { DOCUMENT_PROPOSAL_DOMAIN, DOCUMENT_FEATURE_VERSION, ASSURANCE_TIER_V1, TOPOLOGY_V1, buildDocumentProposalTbs, documentIdFromProposal, encodeDocumentProposal, decodeDocumentProposal, seamViolation, documentFeatureIncompatibility, } from "./document-proposal.js";
-export type { DocumentProposalEnvelope, DocumentProperties, DocumentConsentState, } from "./document-proposal.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAKnD,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACjK,YAAY,EACV,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EACnH,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAChI,eAAe,EAAE,cAAc,EAAE,yBAAyB,EAAE,0BAA0B,GACvF,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAKnD,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACjK,YAAY,EACV,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EACnH,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAChI,eAAe,EAAE,cAAc,EAAE,yBAAyB,EAAE,0BAA0B,GACvF,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AAGvB,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -19,6 +19,4 @@ export { IT_LENGTH_PREFIX_DEFAULT_MAX, CONTENT_PARK_PROTOCOL_ID, CONTENT_PARK_AU
 export { encodeSessionLivenessQuery, decodeSessionLivenessQuery, encodeSessionLivenessResponse, decodeSessionLivenessResponse, } from "./session-liveness.js";
 // MONIKER-0 — the single home of the agent-name / moniker charset rule (wire contract).
 export { MONIKER_RE, validateMoniker } from "./moniker.js";
-export { DOCUMENT_UPDATE_DOMAIN, DOCUMENT_UPDATE_ENCODING_V1, DOCUMENT_EPOCH_V1, buildDocumentUpdateTbs, encodeDocumentUpdateEnvelope, decodeDocumentUpdateEnvelope, documentEnvelopeHash, verifyDocumentChainLink, } from "./document-envelope.js";
-export { DOCUMENT_PROPOSAL_DOMAIN, DOCUMENT_FEATURE_VERSION, ASSURANCE_TIER_V1, TOPOLOGY_V1, buildDocumentProposalTbs, documentIdFromProposal, encodeDocumentProposal, decodeDocumentProposal, seamViolation, documentFeatureIncompatibility, } from "./document-proposal.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,8FAA8F;AAC9F,wFAAwF;AACxF,2BAA2B;AAC3B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAO3B,+FAA+F;AAC/F,qGAAqG;AACrG,wFAAwF;AACxF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,GACb,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGvE,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AA0BjK,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAmBjC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AA8DnF,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AAuBvB,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAE/B,wFAAwF;AACxF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,8FAA8F;AAC9F,wFAAwF;AACxF,2BAA2B;AAC3B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAO3B,+FAA+F;AAC/F,qGAAqG;AACrG,wFAAwF;AACxF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,GACb,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGvE,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AA0BjK,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAmBjC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEzF,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AA8DnF,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AAuBvB,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAE/B,wFAAwF;AACxF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/protocol-types",
-  "version": "0.0.43",
+  "version": "0.0.44",
   "private": false,
   "type": "module",
   "engines": {

package/dist/document-envelope.d.ts

@@ -1,132 +0,0 @@
-/**
- * DOD-DOC-ENVELOPE-1 — the document UPDATE envelope (§14).
- *
- * A distinct wire type from the handshake PROPOSAL envelope (whose hash mints the `document_id`).
- * The two share the word, not the shape.
- *
- * ── WHY THREE OF THESE FIELDS ARE SECURITY FIELDS, NOT METADATA ───────────────────────────────
- *
- * DOD-DOC-GATE-1 enforces three bindings that no property of a Yjs update's BYTES can establish.
- * The gate is only as trustworthy as the signature covering them, which is why all three sit
- * inside the TBS rather than beside it:
- *
- *   `document_id`      A Yjs update carries no document identity. A well-formed update authored
- *                      against a DIFFERENT document merges into this one silently and converges —
- *                      there is no error, and the result is a splice of two documents.
- *
- *   `update_encoding`  v2-encoded bytes are ACCEPTED by the v1 decoder and silently drop all
- *                      content. It cannot be sniffed either: a v2 update begins [0,0,…] and a
- *                      legitimate pure-delete v1 delta begins [0,1,…], so a first-byte heuristic
- *                      would refuse real deletions. The sender must SAY, under signature.
- *
- *   `sender_client_id` Authorship in Yjs IS the clientID, and the gate refuses any client whose
- *                      clock advances without being bound to the sender. §14 forbids persisting or
- *                      deriving a clientID (a shared one splices two authors together with an
- *                      empty pending set — measured in DOD-DOC-FUZZ-1), so an honest peer mints a
- *                      fresh one on every restart. The gate's rule is therefore correct ONLY if
- *                      the binding is LEARNABLE, and this envelope is where it is learned. Outside
- *                      the signature, "learnable" would mean "assertable by anyone on the wire".
- *
- * `epoch_id` and `doc_prev_hash` are not optional and are not defaulted (§14). An update that does
- * not state its epoch cannot be verified unambiguously after a compaction, and the chain link is
- * what lets the document log be extracted and verified across sealed sessions.
- */
-/** Domain tag in slot 0 of the to-be-signed array. */
-export declare const DOCUMENT_UPDATE_DOMAIN = "CELLO-DOCUMENT-UPDATE-v1";
-/**
- * The pinned Yjs update encoding (§16.7-8). Pinned in the protocol types precisely so that two
- * supporting clients can never disagree silently — the failure mode of disagreement is an empty
- * document, not an error.
- */
-export declare const DOCUMENT_UPDATE_ENCODING_V1 = "yjs-v1";
-/** V1 has exactly one epoch. Compaction (which mints new epochs) is V2. */
-export declare const DOCUMENT_EPOCH_V1 = 0;
-export interface DocumentUpdateEnvelope {
-    type: "document_update";
-    /** Hash of the handshake proposal envelope that minted this document. */
-    document_id: string;
-    /** Constant `DOCUMENT_EPOCH_V1` in V1 — carried explicitly, never omitted. */
-    epoch_id: number;
-    /**
-     * The per-sender chain link: the `documentEnvelopeHash` of this sender's previous envelope for
-     * this document, or `null` for this sender's FIRST envelope. `null` and absent are different
-     * facts and are treated differently — see `decodeDocumentUpdateEnvelope`.
-     */
-    doc_prev_hash: string | null;
-    sender_agent_id: string;
-    /** The Yjs clientID this update was authored under. See the header. */
-    sender_client_id: number;
-    /** Always `DOCUMENT_UPDATE_ENCODING_V1` in V1. See the header. */
-    update_encoding: string;
-    /** The sender's Yjs state vector at publish (§7) — what it had seen when it authored. */
-    state_vector: Uint8Array;
-    /** The Yjs update payload. */
-    update: Uint8Array;
-    /** Ed25519 (RFC 8032) over `buildDocumentUpdateTbs`. */
-    signature: Uint8Array;
-}
-/**
- * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
- *
- * An array, not a map, because `encodeCbor` is deliberately NOT deterministic for maps — keys
- * follow insertion order and the header is not minimal-length (see `cbor.ts`). Two honest senders
- * that built the same envelope in a different field order would produce different signatures over
- * it. Arrays are order-fixed and self-delimiting, which also removes the concatenation ambiguity
- * that length-framing exists to prevent.
- *
- * The `signature` is excluded, as it must be — a statement cannot cover its own signature.
- *
- * `preHash: false` returns the preimage itself rather than its digest; it exists for the hash
- * construction below and for tests that need to inspect the structure.
- */
-export declare function buildDocumentUpdateTbs(env: DocumentUpdateEnvelope, opts?: {
-    preHash?: boolean;
-}): Uint8Array;
-/**
- * The envelope's identity: SHA-256 over the same preimage that is signed.
- *
- * Deliberately the SAME preimage, so a chain link commits to exactly the bytes whose signature was
- * verified — a link can never point at an envelope other than the one that was authenticated.
- *
- * It therefore excludes the signature, which is the property the chain needs: a re-signed but
- * otherwise identical envelope keeps its hash, so anything already pointing at it (the next
- * envelope in the chain, a `0x05` rejection leaf) is not orphaned.
- */
-export declare function documentEnvelopeHash(env: DocumentUpdateEnvelope): string;
-export declare function encodeDocumentUpdateEnvelope(env: DocumentUpdateEnvelope): Uint8Array;
-/**
- * Decode and VALIDATE. Every refusal names the field, because the caller's next move is to tell an
- * operator which peer sent what — an unnamed refusal is a label on the exit point, not a diagnosis.
- */
-export declare function decodeDocumentUpdateEnvelope(bytes: Uint8Array): DocumentUpdateEnvelope;
-/**
- * The receive-time chain check: does this envelope link to what we already hold from this sender?
- *
- * `known` is every envelope hash we hold from this sender for this document, and `head` is their
- * most recent. Both, not just the head: replay is SET-based per §16.7-5, and delivery derives
- * pending from the log and retries across restarts — so an older envelope arriving again, because
- * its ack was lost while a later one landed, is designed behaviour. Comparing against the head
- * alone recognised only the newest redelivery and reported every other one as a broken chain.
- *
- * The set is also what separates the two failures. A predecessor we have never seen is a GAP; a
- * predecessor we hold that is not the head is a BRANCH. One reason string for both would hide a
- * fork inside a delivery-shaped error.
- *
- * The refusal reasons are deliberately the SAME STRINGS the daemon's whole-log verifier uses
- * (`DocumentStore.verifyChainLinkage`): `document_chain_forked` and `document_chain_broken`. Two
- * vocabularies for one fact means a policy-log query or an operator keyed on one silently misses
- * the other. The division of labour is real — this checks a single link on arrival, that one walks
- * the whole log for reachability — but they are the same two failures.
- *
- * **LINKAGE ONLY — this is not authenticity.** `documentEnvelopeHash` excludes the signature, so
- * `duplicate: true` means the TBS is byte-identical to one we hold, NOT that whoever sent it holds
- * the key. A caller must verify the signature before consulting the chain; `duplicate` is the
- * value most likely to be read as "already known, ack it and move on".
- */
-export declare function verifyDocumentChainLink(env: DocumentUpdateEnvelope, sender: {
-    head: string | null;
-    known: ReadonlySet<string>;
-}): {
-    duplicate: boolean;
-};
-//# sourceMappingURL=document-envelope.d.ts.map

package/dist/document-envelope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-envelope.d.ts","sourceRoot":"","sources":["../src/document-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,WAAW,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAKnC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,YAAY,EAAE,UAAU,CAAC;IACzB,8BAA8B;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,wDAAwD;IACxD,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,sBAAsB,EAC3B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,UAAU,CAcZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,sBAAsB,GAAG,MAAM,CAIxE;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,sBAAsB,GAAG,UAAU,CAapF;AAmCD;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,GAAG,sBAAsB,CAsEtF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,sBAAsB,EAC3B,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GAC1D;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,CAiCxB"}

package/dist/document-envelope.js

@@ -1,243 +0,0 @@
-/**
- * DOD-DOC-ENVELOPE-1 — the document UPDATE envelope (§14).
- *
- * A distinct wire type from the handshake PROPOSAL envelope (whose hash mints the `document_id`).
- * The two share the word, not the shape.
- *
- * ── WHY THREE OF THESE FIELDS ARE SECURITY FIELDS, NOT METADATA ───────────────────────────────
- *
- * DOD-DOC-GATE-1 enforces three bindings that no property of a Yjs update's BYTES can establish.
- * The gate is only as trustworthy as the signature covering them, which is why all three sit
- * inside the TBS rather than beside it:
- *
- *   `document_id`      A Yjs update carries no document identity. A well-formed update authored
- *                      against a DIFFERENT document merges into this one silently and converges —
- *                      there is no error, and the result is a splice of two documents.
- *
- *   `update_encoding`  v2-encoded bytes are ACCEPTED by the v1 decoder and silently drop all
- *                      content. It cannot be sniffed either: a v2 update begins [0,0,…] and a
- *                      legitimate pure-delete v1 delta begins [0,1,…], so a first-byte heuristic
- *                      would refuse real deletions. The sender must SAY, under signature.
- *
- *   `sender_client_id` Authorship in Yjs IS the clientID, and the gate refuses any client whose
- *                      clock advances without being bound to the sender. §14 forbids persisting or
- *                      deriving a clientID (a shared one splices two authors together with an
- *                      empty pending set — measured in DOD-DOC-FUZZ-1), so an honest peer mints a
- *                      fresh one on every restart. The gate's rule is therefore correct ONLY if
- *                      the binding is LEARNABLE, and this envelope is where it is learned. Outside
- *                      the signature, "learnable" would mean "assertable by anyone on the wire".
- *
- * `epoch_id` and `doc_prev_hash` are not optional and are not defaulted (§14). An update that does
- * not state its epoch cannot be verified unambiguously after a compaction, and the chain link is
- * what lets the document log be extracted and verified across sealed sessions.
- */
-import { createHash } from "node:crypto";
-import { encodeCbor, decodeCbor } from "./cbor.js";
-/** Domain tag in slot 0 of the to-be-signed array. */
-export const DOCUMENT_UPDATE_DOMAIN = "CELLO-DOCUMENT-UPDATE-v1";
-/**
- * The pinned Yjs update encoding (§16.7-8). Pinned in the protocol types precisely so that two
- * supporting clients can never disagree silently — the failure mode of disagreement is an empty
- * document, not an error.
- */
-export const DOCUMENT_UPDATE_ENCODING_V1 = "yjs-v1";
-/** V1 has exactly one epoch. Compaction (which mints new epochs) is V2. */
-export const DOCUMENT_EPOCH_V1 = 0;
-/** A 32-byte hex digest — the shape of `document_id` and of every chain link. */
-const HEX32 = /^[0-9a-f]{64}$/;
-/**
- * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
- *
- * An array, not a map, because `encodeCbor` is deliberately NOT deterministic for maps — keys
- * follow insertion order and the header is not minimal-length (see `cbor.ts`). Two honest senders
- * that built the same envelope in a different field order would produce different signatures over
- * it. Arrays are order-fixed and self-delimiting, which also removes the concatenation ambiguity
- * that length-framing exists to prevent.
- *
- * The `signature` is excluded, as it must be — a statement cannot cover its own signature.
- *
- * `preHash: false` returns the preimage itself rather than its digest; it exists for the hash
- * construction below and for tests that need to inspect the structure.
- */
-export function buildDocumentUpdateTbs(env, opts = {}) {
-    const preimage = encodeCbor([
-        DOCUMENT_UPDATE_DOMAIN,
-        env.document_id,
-        env.epoch_id,
-        env.doc_prev_hash, // null encodes distinctly from any string — genesis is unambiguous
-        env.sender_agent_id,
-        env.sender_client_id,
-        env.update_encoding,
-        env.state_vector,
-        env.update,
-    ]);
-    if (opts.preHash === false)
-        return preimage;
-    return new Uint8Array(createHash("sha256").update(preimage).digest());
-}
-/**
- * The envelope's identity: SHA-256 over the same preimage that is signed.
- *
- * Deliberately the SAME preimage, so a chain link commits to exactly the bytes whose signature was
- * verified — a link can never point at an envelope other than the one that was authenticated.
- *
- * It therefore excludes the signature, which is the property the chain needs: a re-signed but
- * otherwise identical envelope keeps its hash, so anything already pointing at it (the next
- * envelope in the chain, a `0x05` rejection leaf) is not orphaned.
- */
-export function documentEnvelopeHash(env) {
-    return createHash("sha256")
-        .update(buildDocumentUpdateTbs(env, { preHash: false }))
-        .digest("hex");
-}
-export function encodeDocumentUpdateEnvelope(env) {
-    return encodeCbor({
-        type: env.type,
-        document_id: env.document_id,
-        epoch_id: env.epoch_id,
-        doc_prev_hash: env.doc_prev_hash,
-        sender_agent_id: env.sender_agent_id,
-        sender_client_id: env.sender_client_id,
-        update_encoding: env.update_encoding,
-        state_vector: env.state_vector,
-        update: env.update,
-        signature: env.signature,
-    });
-}
-function requirePresent(map, field) {
-    // `in`, not a truthiness or nullish check. ABSENT and `null` are different facts: absent
-    // doc_prev_hash read as null would turn every gap in a chain into a fresh valid-looking genesis,
-    // and absent epoch_id read as 0 would make a post-compaction ambiguity silent. A decoder that
-    // supplies a default for a field the spec calls mandatory is manufacturing the sender's claim.
-    if (!(field in map)) {
-        throw new Error(`document_envelope_missing_field: ${field} is mandatory and was not present`);
-    }
-    return map[field];
-}
-function requireBytes(map, field) {
-    const value = requirePresent(map, field);
-    if (!(value instanceof Uint8Array)) {
-        throw new Error(`document_envelope_field_type: ${field} must be a CBOR byte string`);
-    }
-    // COPIED, not returned as-is. Measured: cbor-x returns byte strings as VIEWS into the buffer it
-    // was handed (`decoded.buffer === input.buffer`), so an aliased update mutates when the caller
-    // reuses or zeroes its read buffer — and a pooled network read buffer is exactly that. Every
-    // check in this decoder, and every check the gate makes afterwards, would then have been made
-    // against bytes that are no longer the bytes applied. The copy is also what makes the return
-    // type honest: a Buffer view and a Uint8Array are not interchangeable to a structural comparison.
-    return new Uint8Array(value);
-}
-function requireString(map, field) {
-    const value = requirePresent(map, field);
-    if (typeof value !== "string") {
-        throw new Error(`document_envelope_field_type: ${field} must be a text string`);
-    }
-    return value;
-}
-/**
- * Decode and VALIDATE. Every refusal names the field, because the caller's next move is to tell an
- * operator which peer sent what — an unnamed refusal is a label on the exit point, not a diagnosis.
- */
-export function decodeDocumentUpdateEnvelope(bytes) {
-    const decoded = decodeCbor(bytes);
-    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
-        throw new Error("document_envelope_malformed: not a CBOR map");
-    }
-    const map = decoded;
-    const type = requireString(map, "type");
-    if (type !== "document_update") {
-        throw new Error(`document_envelope_type: expected document_update, got ${type}`);
-    }
-    const documentId = requireString(map, "document_id");
-    if (!HEX32.test(documentId)) {
-        throw new Error(`document_envelope_document_id: must be a 32-byte lowercase hex digest, got "${documentId}"`);
-    }
-    const epochId = requirePresent(map, "epoch_id");
-    if (typeof epochId !== "number" || !Number.isInteger(epochId)) {
-        throw new Error(`document_envelope_epoch: must be an integer, got ${String(epochId)}`);
-    }
-    if (epochId !== DOCUMENT_EPOCH_V1) {
-        // V2 introduces compaction and non-zero epochs. Accepting one now would mean applying an
-        // update whose base state this build cannot reconstruct.
-        throw new Error(`document_envelope_epoch: this build speaks epoch ${DOCUMENT_EPOCH_V1} only, got ${epochId}`);
-    }
-    const prev = requirePresent(map, "doc_prev_hash");
-    if (prev !== null && (typeof prev !== "string" || !HEX32.test(prev))) {
-        throw new Error(`document_envelope_prev_hash: must be a 32-byte hex digest or explicit null, got "${String(prev)}"`);
-    }
-    const senderAgentId = requireString(map, "sender_agent_id");
-    if (senderAgentId.length === 0) {
-        throw new Error("document_envelope_sender: sender_agent_id must not be empty");
-    }
-    const clientId = requirePresent(map, "sender_client_id");
-    if (typeof clientId !== "number" || !Number.isInteger(clientId) || clientId < 0) {
-        throw new Error(`document_envelope_client_id: must be a non-negative integer, got ${String(clientId)}`);
-    }
-    const encoding = requireString(map, "update_encoding");
-    if (encoding !== DOCUMENT_UPDATE_ENCODING_V1) {
-        // The one refusal that cannot be replaced by a heuristic. See the header.
-        throw new Error(`document_envelope_encoding: this build speaks ${DOCUMENT_UPDATE_ENCODING_V1} only, got "${encoding}"`);
-    }
-    return {
-        type: "document_update",
-        document_id: documentId,
-        epoch_id: epochId,
-        doc_prev_hash: prev,
-        sender_agent_id: senderAgentId,
-        sender_client_id: clientId,
-        update_encoding: encoding,
-        state_vector: requireBytes(map, "state_vector"),
-        update: requireBytes(map, "update"),
-        signature: requireBytes(map, "signature"),
-    };
-}
-/**
- * The receive-time chain check: does this envelope link to what we already hold from this sender?
- *
- * `known` is every envelope hash we hold from this sender for this document, and `head` is their
- * most recent. Both, not just the head: replay is SET-based per §16.7-5, and delivery derives
- * pending from the log and retries across restarts — so an older envelope arriving again, because
- * its ack was lost while a later one landed, is designed behaviour. Comparing against the head
- * alone recognised only the newest redelivery and reported every other one as a broken chain.
- *
- * The set is also what separates the two failures. A predecessor we have never seen is a GAP; a
- * predecessor we hold that is not the head is a BRANCH. One reason string for both would hide a
- * fork inside a delivery-shaped error.
- *
- * The refusal reasons are deliberately the SAME STRINGS the daemon's whole-log verifier uses
- * (`DocumentStore.verifyChainLinkage`): `document_chain_forked` and `document_chain_broken`. Two
- * vocabularies for one fact means a policy-log query or an operator keyed on one silently misses
- * the other. The division of labour is real — this checks a single link on arrival, that one walks
- * the whole log for reachability — but they are the same two failures.
- *
- * **LINKAGE ONLY — this is not authenticity.** `documentEnvelopeHash` excludes the signature, so
- * `duplicate: true` means the TBS is byte-identical to one we hold, NOT that whoever sent it holds
- * the key. A caller must verify the signature before consulting the chain; `duplicate` is the
- * value most likely to be read as "already known, ack it and move on".
- */
-export function verifyDocumentChainLink(env, sender) {
-    if (sender.known.has(documentEnvelopeHash(env)))
-        return { duplicate: true };
-    if (env.doc_prev_hash === null) {
-        if (sender.head !== null) {
-            // Two roots for one sender. DOD-DOC-REJECT-1 measured what this costs: the chain no longer
-            // verifies, so the document rebuilds until the next daemon restart and is permanently
-            // unopenable after it. The log is append-only; there is no repair.
-            throw new Error(`document_chain_forked: ${env.sender_agent_id} sent a genesis envelope for document ` +
-                `${env.document_id}, but we already hold their chain at ${sender.head}`);
-        }
-        return { duplicate: false };
-    }
-    if (!sender.known.has(env.doc_prev_hash)) {
-        throw new Error(`document_chain_broken: ${env.sender_agent_id} chained to ${env.doc_prev_hash} for document ` +
-            `${env.document_id}, which we have never seen — their last envelope we hold is ` +
-            `${sender.head ?? "none (no envelope from this sender yet)"}`);
-    }
-    if (env.doc_prev_hash !== sender.head) {
-        throw new Error(`document_chain_forked: ${env.sender_agent_id} chained to ${env.doc_prev_hash} for document ` +
-            `${env.document_id}, which we hold but which is not their head ${sender.head} — a chain ` +
-            `branches nowhere`);
-    }
-    return { duplicate: false };
-}
-//# sourceMappingURL=document-envelope.js.map

package/dist/document-envelope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-envelope.js","sourceRoot":"","sources":["../src/document-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,sDAAsD;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAEpD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,iFAAiF;AACjF,MAAM,KAAK,GAAG,gBAAgB,CAAC;AA2B/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAA2B,EAC3B,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,sBAAsB;QACtB,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,aAAa,EAAE,mEAAmE;QACtF,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,MAAM;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAA2B;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAA2B;IACtE,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,KAAa;IACjE,yFAAyF;IACzF,iGAAiG;IACjG,8FAA8F;IAC9F,+FAA+F;IAC/F,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,mCAAmC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,6FAA6F;IAC7F,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa;IAChE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,wBAAwB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAiB;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAE/C,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+EAA+E,UAAU,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,yFAAyF;QACzF,yDAAyD;QACzD,MAAM,IAAI,KAAK,CACb,oDAAoD,iBAAiB,cAAc,OAAO,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,oFAAoF,MAAM,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,CAAC,QAAQ,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QAC7C,0EAA0E;QAC1E,MAAM,IAAI,KAAK,CACb,iDAAiD,2BAA2B,eAAe,QAAQ,GAAG,CACvG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,OAAO;QACjB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,aAAa;QAC9B,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,QAAQ;QACzB,YAAY,EAAE,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC;QAC/C,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC;QACnC,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAA2B,EAC3B,MAA2D;IAE3D,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE5E,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,2FAA2F;YAC3F,sFAAsF;YACtF,mEAAmE;YACnE,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,eAAe,wCAAwC;gBACnF,GAAG,GAAG,CAAC,WAAW,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,eAAe,eAAe,GAAG,CAAC,aAAa,gBAAgB;YAC3F,GAAG,GAAG,CAAC,WAAW,8DAA8D;YAChF,GAAG,MAAM,CAAC,IAAI,IAAI,yCAAyC,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,eAAe,eAAe,GAAG,CAAC,aAAa,gBAAgB;YAC3F,GAAG,GAAG,CAAC,WAAW,+CAA+C,MAAM,CAAC,IAAI,aAAa;YACzF,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC"}

package/dist/document-proposal.d.ts

@@ -1,127 +0,0 @@
-/**
- * DOD-DOC-HANDSHAKE-1 — the document PROPOSAL envelope (§16.3).
- *
- * A distinct wire type from `document-envelope.ts`'s UPDATE envelope. The two share the word
- * "envelope" and nothing else: this one is proposed once, consented to once, and its hash becomes
- * the `document_id` that every subsequent update names.
- *
- * **`document_id` is the hash of this envelope** — globally unique with no minting authority and
- * no coordination round. That is the property that makes the whole scheme federated, and it is why
- * the proposal must be canonically encodable: two parties that hash it differently are on two
- * different documents while believing they are on one.
- *
- * ── THE SEAM (§3.4, §11.1) ────────────────────────────────────────────────────────────────────
- *
- * Three properties are DECLARED in V1 but support exactly one value each, and the pattern is
- * deliberate — §3.3 chose it for `schema_enforcement` and §16.1 generalized it. Declaring a field
- * that only accepts one value looks redundant until you need the second value: the field is
- * already on the wire and already signed, so V2 is a validation change rather than a wire break
- * that strands every document created before it.
- *
- * Refused at BOTH ends — at proposal and again at accept. Not belt-and-braces: the proposer and
- * the accepter run different builds. A V2 peer proposing `topology: "mesh"` to a V1 peer must be
- * refused by the V1 accepter, and a V1 proposer must not be able to emit a value it cannot honour.
- * One-sided validation means whichever side is newer silently decides for both.
- *
- * ── THE FEATURE VERSION (§16.7-8) ─────────────────────────────────────────────────────────────
- *
- * Alpha owes no backward compatibility, so this is not a negotiation — it is the difference
- * between a human answer and a timeout. A peer whose client predates documents does not understand
- * the proposal at all, and without a version the symptom is silence: the proposal is never
- * answered and the operator sees a hang. `documentFeatureIncompatibility` turns that into "your
- * peer's client doesn't support shared documents yet — ask them to upgrade".
- */
-/** Domain tag in slot 0 of the to-be-signed array. Distinct from the UPDATE envelope's domain. */
-export declare const DOCUMENT_PROPOSAL_DOMAIN = "CELLO-DOCUMENT-PROPOSAL-v1";
-/**
- * The document feature version this build speaks. Bumped when the document wire changes in a way
- * a peer must understand; see `documentFeatureIncompatibility` for what a mismatch produces.
- */
-export declare const DOCUMENT_FEATURE_VERSION = 1;
-/** §6 — Tier 1. Tier 2 (attested) is V2; the field exists so V2 is a validation change. */
-export declare const ASSURANCE_TIER_V1 = "authenticated";
-/** §11 — the pairwise two-document form. Mesh is deferred (§11.1). */
-export declare const TOPOLOGY_V1 = "hub-and-spoke";
-export type DocumentConsentState = "pending" | "accepted" | "refused";
-/**
- * The properties agreed at handshake (§3.4). **Immutable after accept** — a property change is an
- * epoch event and therefore V2 (§16.3), so no mutate call exists in V1. That is not an omission to
- * fill in later: mutating a property after acceptance would silently change the rules the other
- * party consented to, which is the one thing the handshake exists to prevent.
- */
-export interface DocumentProperties {
-    /** Only `authenticated` in V1. */
-    assurance_tier: string;
-    /** Only `false` in V1 — the schema-as-first-update path (§3.3) is V2. */
-    schema_enforcement: boolean;
-    /** Only `hub-and-spoke` in V1. */
-    topology: string;
-    /** Receiver-local append-only enforcement (§16.7-1). Freely settable — not a seam field. */
-    append_only: boolean;
-}
-export interface DocumentProposalEnvelope {
-    type: "document_proposal";
-    /** Which build proposed this. A peer that cannot read it answers with a human-readable refusal. */
-    feature_version: number;
-    proposer_agent_id: string;
-    peer_agent_id: string;
-    /** Free-form label chosen by the proposer, e.g. "markdown". Not a seam field. */
-    document_type: string;
-    properties: DocumentProperties;
-    /**
-     * The epoch-zero template (§16.3 step 1), or null. A Yjs update in the pinned encoding, so both
-     * sides mint byte-identical starting state rather than each building their own from a template
-     * string — two "identical" documents built independently do not converge.
-     */
-    starting_content: Uint8Array | null;
-    /** Distinguishes two otherwise identical proposals, so each gets its own document_id. */
-    nonce: Uint8Array;
-    proposed_at_ms: number;
-    /** Ed25519 (RFC 8032) over `buildDocumentProposalTbs`. */
-    signature: Uint8Array;
-}
-/**
- * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
- *
- * The properties are flattened into their own slots rather than nested as a map. `encodeCbor` is
- * not deterministic for maps — keys follow insertion order — so a nested `properties` object would
- * make the signature depend on the order the proposer happened to build it in, and two honest
- * builds of the same proposal would produce different `document_id`s. For this envelope that is
- * worse than a bad signature: the id IS the hash, so the two parties would be on two documents.
- */
-export declare function buildDocumentProposalTbs(env: DocumentProposalEnvelope, opts?: {
-    preHash?: boolean;
-}): Uint8Array;
-/**
- * `document_id` = the hash of the proposal envelope (§16.3).
- *
- * Over the same preimage that is signed, and therefore NOT over the signature — so the id a party
- * computes is the id of the thing whose signature it verified, and re-signing cannot change the
- * identity of an already-accepted document.
- */
-export declare function documentIdFromProposal(env: DocumentProposalEnvelope): string;
-/**
- * Refuse any seam value this build cannot honour, at proposal AND at accept.
- *
- * Returns the reason, or null when the properties are acceptable. A REASON rather than a boolean
- * because the operator on the refusing side has to be able to tell "your peer asked for mesh
- * topology, which this version does not support" from a generic refusal — a handshake that fails
- * without saying which property failed is indistinguishable from the peer being unreachable.
- */
-export declare function seamViolation(props: DocumentProperties): string | null;
-/**
- * A human answer for a version mismatch, or null when the peer is compatible.
- *
- * Deliberately phrased for the operator rather than for a log: the alternative to this string is a
- * proposal that is never answered, which surfaces as a hang and gets diagnosed as a network fault.
- */
-export declare function documentFeatureIncompatibility(peerFeatureVersion: number | null): string | null;
-export declare function encodeDocumentProposal(env: DocumentProposalEnvelope): Uint8Array;
-/**
- * Decode and validate. Does NOT check the seam — `seamViolation` is called separately at both the
- * proposal and the accept step, because a decoder that refused seam values would make a
- * V2 proposal undecodable and therefore unanswerable, which is exactly the silent hang the feature
- * version exists to replace.
- */
-export declare function decodeDocumentProposal(input: Uint8Array): DocumentProposalEnvelope;
-//# sourceMappingURL=document-proposal.d.ts.map

package/dist/document-proposal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-proposal.d.ts","sourceRoot":"","sources":["../src/document-proposal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,sEAAsE;AACtE,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,mGAAmG;IACnG,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,yFAAyF;IACzF,KAAK,EAAE,UAAU,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,wBAAwB,EAC7B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,UAAU,CAiBZ;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,wBAAwB,GAAG,MAAM,CAI5E;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAoBtE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAoB/F;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,wBAAwB,GAAG,UAAU,CAkBhF;AA6BD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,wBAAwB,CA8DlF"}

package/dist/document-proposal.js

@@ -1,233 +0,0 @@
-/**
- * DOD-DOC-HANDSHAKE-1 — the document PROPOSAL envelope (§16.3).
- *
- * A distinct wire type from `document-envelope.ts`'s UPDATE envelope. The two share the word
- * "envelope" and nothing else: this one is proposed once, consented to once, and its hash becomes
- * the `document_id` that every subsequent update names.
- *
- * **`document_id` is the hash of this envelope** — globally unique with no minting authority and
- * no coordination round. That is the property that makes the whole scheme federated, and it is why
- * the proposal must be canonically encodable: two parties that hash it differently are on two
- * different documents while believing they are on one.
- *
- * ── THE SEAM (§3.4, §11.1) ────────────────────────────────────────────────────────────────────
- *
- * Three properties are DECLARED in V1 but support exactly one value each, and the pattern is
- * deliberate — §3.3 chose it for `schema_enforcement` and §16.1 generalized it. Declaring a field
- * that only accepts one value looks redundant until you need the second value: the field is
- * already on the wire and already signed, so V2 is a validation change rather than a wire break
- * that strands every document created before it.
- *
- * Refused at BOTH ends — at proposal and again at accept. Not belt-and-braces: the proposer and
- * the accepter run different builds. A V2 peer proposing `topology: "mesh"` to a V1 peer must be
- * refused by the V1 accepter, and a V1 proposer must not be able to emit a value it cannot honour.
- * One-sided validation means whichever side is newer silently decides for both.
- *
- * ── THE FEATURE VERSION (§16.7-8) ─────────────────────────────────────────────────────────────
- *
- * Alpha owes no backward compatibility, so this is not a negotiation — it is the difference
- * between a human answer and a timeout. A peer whose client predates documents does not understand
- * the proposal at all, and without a version the symptom is silence: the proposal is never
- * answered and the operator sees a hang. `documentFeatureIncompatibility` turns that into "your
- * peer's client doesn't support shared documents yet — ask them to upgrade".
- */
-import { createHash } from "node:crypto";
-import { encodeCbor, decodeCbor } from "./cbor.js";
-/** Domain tag in slot 0 of the to-be-signed array. Distinct from the UPDATE envelope's domain. */
-export const DOCUMENT_PROPOSAL_DOMAIN = "CELLO-DOCUMENT-PROPOSAL-v1";
-/**
- * The document feature version this build speaks. Bumped when the document wire changes in a way
- * a peer must understand; see `documentFeatureIncompatibility` for what a mismatch produces.
- */
-export const DOCUMENT_FEATURE_VERSION = 1;
-/** §6 — Tier 1. Tier 2 (attested) is V2; the field exists so V2 is a validation change. */
-export const ASSURANCE_TIER_V1 = "authenticated";
-/** §11 — the pairwise two-document form. Mesh is deferred (§11.1). */
-export const TOPOLOGY_V1 = "hub-and-spoke";
-/**
- * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
- *
- * The properties are flattened into their own slots rather than nested as a map. `encodeCbor` is
- * not deterministic for maps — keys follow insertion order — so a nested `properties` object would
- * make the signature depend on the order the proposer happened to build it in, and two honest
- * builds of the same proposal would produce different `document_id`s. For this envelope that is
- * worse than a bad signature: the id IS the hash, so the two parties would be on two documents.
- */
-export function buildDocumentProposalTbs(env, opts = {}) {
-    const preimage = encodeCbor([
-        DOCUMENT_PROPOSAL_DOMAIN,
-        env.feature_version,
-        env.proposer_agent_id,
-        env.peer_agent_id,
-        env.document_type,
-        env.properties.assurance_tier,
-        env.properties.schema_enforcement,
-        env.properties.topology,
-        env.properties.append_only,
-        env.starting_content,
-        env.nonce,
-        env.proposed_at_ms,
-    ]);
-    if (opts.preHash === false)
-        return preimage;
-    return new Uint8Array(createHash("sha256").update(preimage).digest());
-}
-/**
- * `document_id` = the hash of the proposal envelope (§16.3).
- *
- * Over the same preimage that is signed, and therefore NOT over the signature — so the id a party
- * computes is the id of the thing whose signature it verified, and re-signing cannot change the
- * identity of an already-accepted document.
- */
-export function documentIdFromProposal(env) {
-    return createHash("sha256")
-        .update(buildDocumentProposalTbs(env, { preHash: false }))
-        .digest("hex");
-}
-/**
- * Refuse any seam value this build cannot honour, at proposal AND at accept.
- *
- * Returns the reason, or null when the properties are acceptable. A REASON rather than a boolean
- * because the operator on the refusing side has to be able to tell "your peer asked for mesh
- * topology, which this version does not support" from a generic refusal — a handshake that fails
- * without saying which property failed is indistinguishable from the peer being unreachable.
- */
-export function seamViolation(props) {
-    if (props.assurance_tier !== ASSURANCE_TIER_V1) {
-        return (`document_seam_assurance_tier: this version supports "${ASSURANCE_TIER_V1}" only, and the ` +
-            `proposal asks for "${props.assurance_tier}" — attested documents (§6 Tier 2) are not yet built`);
-    }
-    if (props.schema_enforcement !== false) {
-        return ("document_seam_schema_enforcement: this version supports schema_enforcement: false only — " +
-            "schema-as-first-update validation (§3.3) is not yet built");
-    }
-    if (props.topology !== TOPOLOGY_V1) {
-        return (`document_seam_topology: this version supports "${TOPOLOGY_V1}" only, and the proposal asks ` +
-            `for "${props.topology}" — mesh documents (§11.1) are not yet built`);
-    }
-    return null;
-}
-/**
- * A human answer for a version mismatch, or null when the peer is compatible.
- *
- * Deliberately phrased for the operator rather than for a log: the alternative to this string is a
- * proposal that is never answered, which surfaces as a hang and gets diagnosed as a network fault.
- */
-export function documentFeatureIncompatibility(peerFeatureVersion) {
-    if (peerFeatureVersion === null) {
-        return ("your peer's client doesn't support shared documents yet — ask them to upgrade to a version " +
-            "that speaks the document protocol");
-    }
-    if (peerFeatureVersion > DOCUMENT_FEATURE_VERSION) {
-        return (`your peer's client speaks document feature version ${peerFeatureVersion} and this one ` +
-            `speaks ${DOCUMENT_FEATURE_VERSION} — upgrade this client to collaborate with them`);
-    }
-    if (peerFeatureVersion < DOCUMENT_FEATURE_VERSION) {
-        return (`your peer's client speaks document feature version ${peerFeatureVersion} and this one ` +
-            `speaks ${DOCUMENT_FEATURE_VERSION} — ask them to upgrade`);
-    }
-    return null;
-}
-export function encodeDocumentProposal(env) {
-    return encodeCbor({
-        type: env.type,
-        feature_version: env.feature_version,
-        proposer_agent_id: env.proposer_agent_id,
-        peer_agent_id: env.peer_agent_id,
-        document_type: env.document_type,
-        properties: {
-            assurance_tier: env.properties.assurance_tier,
-            schema_enforcement: env.properties.schema_enforcement,
-            topology: env.properties.topology,
-            append_only: env.properties.append_only,
-        },
-        starting_content: env.starting_content,
-        nonce: env.nonce,
-        proposed_at_ms: env.proposed_at_ms,
-        signature: env.signature,
-    });
-}
-function present(map, field) {
-    // `in`, not a nullish check — see document-envelope.ts. A defaulted seam field is a property the
-    // peer never actually declared, admitted under this build's own preference.
-    if (!(field in map)) {
-        throw new Error(`document_proposal_missing_field: ${field} is mandatory and was not present`);
-    }
-    return map[field];
-}
-function str(map, field) {
-    const v = present(map, field);
-    if (typeof v !== "string" || v.length === 0) {
-        throw new Error(`document_proposal_field_type: ${field} must be a non-empty text string`);
-    }
-    return v;
-}
-function bytes(map, field) {
-    const v = present(map, field);
-    if (!(v instanceof Uint8Array)) {
-        throw new Error(`document_proposal_field_type: ${field} must be a CBOR byte string`);
-    }
-    // COPIED — cbor-x returns byte strings as views into the decoded buffer, so a caller reusing a
-    // pooled read buffer would mutate the starting content after it was validated and hashed.
-    return new Uint8Array(v);
-}
-/**
- * Decode and validate. Does NOT check the seam — `seamViolation` is called separately at both the
- * proposal and the accept step, because a decoder that refused seam values would make a
- * V2 proposal undecodable and therefore unanswerable, which is exactly the silent hang the feature
- * version exists to replace.
- */
-export function decodeDocumentProposal(input) {
-    const decoded = decodeCbor(input);
-    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
-        throw new Error("document_proposal_malformed: not a CBOR map");
-    }
-    const map = decoded;
-    const type = str(map, "type");
-    if (type !== "document_proposal") {
-        throw new Error(`document_proposal_type: expected document_proposal, got ${type}`);
-    }
-    const featureVersion = present(map, "feature_version");
-    if (typeof featureVersion !== "number" || !Number.isInteger(featureVersion) || featureVersion < 1) {
-        throw new Error(`document_proposal_feature_version: must be a positive integer, got ${String(featureVersion)}`);
-    }
-    const rawProps = present(map, "properties");
-    if (typeof rawProps !== "object" || rawProps === null || Array.isArray(rawProps)) {
-        throw new Error("document_proposal_properties: must be a CBOR map");
-    }
-    const p = rawProps;
-    const schemaEnforcement = present(p, "schema_enforcement");
-    if (typeof schemaEnforcement !== "boolean") {
-        throw new Error("document_proposal_field_type: properties.schema_enforcement must be a boolean");
-    }
-    const appendOnly = present(p, "append_only");
-    if (typeof appendOnly !== "boolean") {
-        throw new Error("document_proposal_field_type: properties.append_only must be a boolean");
-    }
-    const startingContent = present(map, "starting_content");
-    if (startingContent !== null && !(startingContent instanceof Uint8Array)) {
-        throw new Error("document_proposal_field_type: starting_content must be a CBOR byte string or explicit null");
-    }
-    const proposedAt = present(map, "proposed_at_ms");
-    if (typeof proposedAt !== "number" || !Number.isInteger(proposedAt)) {
-        throw new Error(`document_proposal_field_type: proposed_at_ms must be an integer`);
-    }
-    return {
-        type: "document_proposal",
-        feature_version: featureVersion,
-        proposer_agent_id: str(map, "proposer_agent_id"),
-        peer_agent_id: str(map, "peer_agent_id"),
-        document_type: str(map, "document_type"),
-        properties: {
-            assurance_tier: str(p, "assurance_tier"),
-            schema_enforcement: schemaEnforcement,
-            topology: str(p, "topology"),
-            append_only: appendOnly,
-        },
-        starting_content: startingContent === null ? null : new Uint8Array(startingContent),
-        nonce: bytes(map, "nonce"),
-        proposed_at_ms: proposedAt,
-        signature: bytes(map, "signature"),
-    };
-}
-//# sourceMappingURL=document-proposal.js.map

package/dist/document-proposal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-proposal.js","sourceRoot":"","sources":["../src/document-proposal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,kGAAkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AA2C3C;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA6B,EAC7B,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,wBAAwB;QACxB,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,iBAAiB;QACrB,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,UAAU,CAAC,cAAc;QAC7B,GAAG,CAAC,UAAU,CAAC,kBAAkB;QACjC,GAAG,CAAC,UAAU,CAAC,QAAQ;QACvB,GAAG,CAAC,UAAU,CAAC,WAAW;QAC1B,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,KAAK;QACT,GAAG,CAAC,cAAc;KACnB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAA6B;IAClE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SACzD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,KAAK,CAAC,cAAc,KAAK,iBAAiB,EAAE,CAAC;QAC/C,OAAO,CACL,wDAAwD,iBAAiB,kBAAkB;YAC3F,sBAAsB,KAAK,CAAC,cAAc,sDAAsD,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QACvC,OAAO,CACL,2FAA2F;YAC3F,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CACL,kDAAkD,WAAW,gCAAgC;YAC7F,QAAQ,KAAK,CAAC,QAAQ,8CAA8C,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,kBAAiC;IAC9E,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,CACL,6FAA6F;YAC7F,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,GAAG,wBAAwB,EAAE,CAAC;QAClD,OAAO,CACL,sDAAsD,kBAAkB,gBAAgB;YACxF,UAAU,wBAAwB,iDAAiD,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,kBAAkB,GAAG,wBAAwB,EAAE,CAAC;QAClD,OAAO,CACL,sDAAsD,kBAAkB,gBAAgB;YACxF,UAAU,wBAAwB,wBAAwB,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAA6B;IAClE,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,UAAU,EAAE;YACV,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,cAAc;YAC7C,kBAAkB,EAAE,GAAG,CAAC,UAAU,CAAC,kBAAkB;YACrD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ;YACjC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW;SACxC;QACD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B,EAAE,KAAa;IAC1D,iGAAiG;IACjG,4EAA4E;IAC5E,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,mCAAmC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,kCAAkC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAA4B,EAAE,KAAa;IACxD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,+FAA+F;IAC/F,0FAA0F;IAC1F,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAiB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAE/C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CACb,sEAAsE,MAAM,CAAC,cAAc,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,CAAC,GAAG,QAAmC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,OAAO,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzD,IAAI,eAAe,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,YAAY,UAAU,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,eAAe,EAAE,cAAc;QAC/B,iBAAiB,EAAE,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAChD,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC;QACxC,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC;QACxC,UAAU,EAAE;YACV,cAAc,EAAE,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC;YACxC,kBAAkB,EAAE,iBAAiB;YACrC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC;YAC5B,WAAW,EAAE,UAAU;SACxB;QACD,gBAAgB,EAAE,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC;QACnF,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;QAC1B,cAAc,EAAE,UAAU;QAC1B,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC"}