@cello-protocol/protocol-types 0.0.53 → 0.0.55

package/dist/document-amendment.d.ts

@@ -0,0 +1,133 @@
+/**
+ * DOD-MP-AMEND-1 — the amendment record: an epoch event in its FINAL frame shape, and the replay
+ * that derives a document's arrangement from genesis + the chain.
+ *
+ * The genesis proposal stays the anchor — never edited, still hashing to `document_id`. What may
+ * change after it — who holds the document, who administers it, its amendable properties — is
+ * derived ONLY from this chain of signed amendments, replayed independently by every holder. An
+ * amendment whose signature collection does not meet its kind's requirement is INVALID everywhere,
+ * computed rather than detected; that is the invariant that replaced immutability (multiplayer log
+ * §6, rulings §13).
+ *
+ * ── THE FRAME IS FINAL (TIER2-READY constraint 1) ─────────────────────────────────────────────
+ *
+ * Signed, chained to its predecessor, epoch-incrementing, and carrying `state_hash` — the
+ * canonical-hash-at-boundary slot — as DEFINED-ABSENT (`null`) while the tier is `authenticated`.
+ * Tier 2 fills the slot; it does not migrate the frame. Dropping the slot "because Tier 1 doesn't
+ * use it" is the exact seam violation M14 forbade.
+ *
+ * ── WHO MUST SIGN IS INJECTED ─────────────────────────────────────────────────────────────────
+ *
+ * The replay owns MECHANICS: chaining, completeness, application order, and the arrangement
+ * invariants (admins ⊆ participants, admins never empty, the holder cap). WHICH signatures each
+ * kind requires is GOVERN-1's policy, consulted against the state BEFORE the amendment — so a
+ * newly-promoted admin is required on the NEXT amendment, not retroactively on their own
+ * promotion.
+ */
+import { type MultisigCollection } from "./document-multisig.js";
+/**
+ * Domain tag in slot 0 of the to-be-signed array. Sibling of the other CELLO-DOCUMENT-* tags.
+ * v2 (SYNC-P1): the preimage gained the causal fields — author, sequence, parents. A v1 frame is
+ * refused by the mandatory-field discipline below; no compatibility is owed (all holders upgrade
+ * together).
+ */
+export declare const DOCUMENT_AMENDMENT_DOMAIN = "CELLO-DOCUMENT-AMENDMENT-v3";
+/**
+ * Ceiling on an entry's parent list. The honest frontier is bounded by the holder cap (D5: 20);
+ * the ceiling exists so a hostile daemon cannot make every ancestry walk unbounded.
+ */
+export declare const MAX_ENTRY_PARENTS = 64;
+/** The `subject_kind` an amendment's multisig collection must carry. */
+export declare const AMENDMENT_SUBJECT_KIND = "document_amendment";
+/** D5 (ruled 2026-08-11): documents inherit the group-room cap. Enforced at amendment validation. */
+export declare const MAX_DOCUMENT_HOLDERS = 20;
+export declare const AMENDMENT_KINDS: readonly ["add_holder", "remove_holder", "promote_admin", "remove_admin", "change_property", "consent", "refuse_join", "close", "kill"];
+export type AmendmentKind = (typeof AMENDMENT_KINDS)[number];
+/**
+ * Properties an amendment may change. Deliberately NARROW to start: the seam properties are owned
+ * elsewhere (`assurance_tier` changes are the Tier 2 tier-upgrade epoch event; `schema_enforcement`
+ * is Tier 2's schema work; `topology` and `content_profile` are identity-shaped — changing them
+ * under a live document is a new agreement, not an amendment). Widening this set is a one-line,
+ * journaled decision; shrinking it after documents exist is a migration.
+ */
+export declare const AMENDABLE_PROPERTIES: Set<string>;
+export interface DocumentAmendmentBody {
+    document_id: string;
+    kind: AmendmentKind;
+    /** The holder the amendment is about (pubkey hex). Null exactly for `change_property`. */
+    subject_agent_id: string | null;
+    /** Non-null exactly for `change_property`. */
+    property_change: {
+        key: string;
+        value: string | number | boolean;
+    } | null;
+    /**
+     * Tier 2's canonical-hash-at-boundary slot. DEFINED-ABSENT (`null`) while the document's tier
+     * is `authenticated`; refused non-null at replay until the attested tier exists.
+     */
+    state_hash: Uint8Array | null;
+    authored_at_ms: number;
+    /**
+     * SYNC-P1 — the causal fields. The accountable initiator (MUST appear in the collection's
+     * required set), their own-chain counter, and the frontier heads applied when authoring. For
+     * `author_seq > 1` the author's previous entry MUST be among the ancestors the parents reach —
+     * a direct parent is the common case, not the requirement. Signed: a forwarder cannot
+     * re-attribute, re-sequence, or re-parent without every signature failing (SYNC-R2).
+     */
+    author_agent_id: string;
+    author_seq: number;
+    /** Entry hashes (64-hex), CANONICAL: strictly ascending, no duplicates. Empty anchors to genesis. */
+    parents: readonly string[];
+}
+export interface DocumentAmendmentEnvelope {
+    body: DocumentAmendmentBody;
+    /** SIG-1 collection over `documentAmendmentHash(body)` with `subject_kind: "document_amendment"`. */
+    collection: MultisigCollection;
+}
+/**
+ * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
+ * `property_change` is FLATTENED into two slots — `encodeCbor` maps follow insertion order, and a
+ * nested map would make the hash depend on how the builder happened to assemble it.
+ */
+export declare function buildDocumentAmendmentTbs(body: DocumentAmendmentBody, opts?: {
+    preHash?: boolean;
+}): Uint8Array;
+/** The amendment's identity: SHA-256 over the TBS preimage — signature-independent, like `document_id`. */
+export declare function documentAmendmentHash(body: DocumentAmendmentBody): Uint8Array;
+export declare function encodeDocumentAmendment(env: DocumentAmendmentEnvelope): Uint8Array;
+export declare function decodeDocumentAmendment(input: Uint8Array): DocumentAmendmentEnvelope;
+/** The genesis facts replay starts from — all of them signed into the proposal (or its admin slot). */
+export interface ArrangementGenesis {
+    documentId: string;
+    proposerAgentId: string;
+    peerAgentId: string;
+    /** Pubkey-hex identities holding admin power at creation. Must be ⊆ {proposer, peer}, non-empty. */
+    adminSet: readonly string[];
+    properties: Record<string, string | number | boolean | undefined>;
+}
+export interface Arrangement {
+    epoch: number;
+    participants: ReadonlySet<string>;
+    /** SYNC-P2: admitted-not-yet-answered (R22). Optional while the interim join surface lives. */
+    invited?: ReadonlySet<string>;
+    admins: ReadonlySet<string>;
+    /** The DERIVED view — genesis properties + applied change_property amendments. */
+    properties: Record<string, string | number | boolean | undefined>;
+    lastAmendmentHash: string | null;
+}
+/**
+ * GOVERN-1's seam: is the collection's CLAIMED required-signer set acceptable for this amendment,
+ * given the arrangement as it stands BEFORE the amendment applies. A verdict rather than a
+ * minted set, because "any single admin" has no single answer — {a} and {b} are both acceptable
+ * claims — and the multisig layer then demands every claimed signature verify.
+ */
+export type SignerPolicy = (kind: AmendmentKind, subjectAgentId: string | null, state: {
+    participants: ReadonlySet<string>;
+    admins: ReadonlySet<string>;
+}, claimedRequiredSet: readonly string[]) => {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=document-amendment.d.ts.map

package/dist/document-amendment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-amendment.d.ts","sourceRoot":"","sources":["../src/document-amendment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,eAAO,MAAM,eAAe,yIAiBlB,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,aAA2B,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,aAAa,CAAC;IACpB,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8CAA8C;IAC9C,eAAe,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1E;;;OAGG;IACH,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,qGAAqG;IACrG,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,UAAU,CAmBZ;AAED,2GAA2G;AAC3G,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CAI7E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,yBAAyB,GAAG,UAAU,CAmBlF;AAiBD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,yBAAyB,CA0HpF;AAED,uGAAuG;AACvG,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAClE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,aAAa,EACnB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,KAAK,EAAE;IAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,EACzE,kBAAkB,EAAE,SAAS,MAAM,EAAE,KAClC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/document-amendment.js

@@ -0,0 +1,229 @@
+/**
+ * DOD-MP-AMEND-1 — the amendment record: an epoch event in its FINAL frame shape, and the replay
+ * that derives a document's arrangement from genesis + the chain.
+ *
+ * The genesis proposal stays the anchor — never edited, still hashing to `document_id`. What may
+ * change after it — who holds the document, who administers it, its amendable properties — is
+ * derived ONLY from this chain of signed amendments, replayed independently by every holder. An
+ * amendment whose signature collection does not meet its kind's requirement is INVALID everywhere,
+ * computed rather than detected; that is the invariant that replaced immutability (multiplayer log
+ * §6, rulings §13).
+ *
+ * ── THE FRAME IS FINAL (TIER2-READY constraint 1) ─────────────────────────────────────────────
+ *
+ * Signed, chained to its predecessor, epoch-incrementing, and carrying `state_hash` — the
+ * canonical-hash-at-boundary slot — as DEFINED-ABSENT (`null`) while the tier is `authenticated`.
+ * Tier 2 fills the slot; it does not migrate the frame. Dropping the slot "because Tier 1 doesn't
+ * use it" is the exact seam violation M14 forbade.
+ *
+ * ── WHO MUST SIGN IS INJECTED ─────────────────────────────────────────────────────────────────
+ *
+ * The replay owns MECHANICS: chaining, completeness, application order, and the arrangement
+ * invariants (admins ⊆ participants, admins never empty, the holder cap). WHICH signatures each
+ * kind requires is GOVERN-1's policy, consulted against the state BEFORE the amendment — so a
+ * newly-promoted admin is required on the NEXT amendment, not retroactively on their own
+ * promotion.
+ */
+import { createHash } from "node:crypto";
+import { encodeCbor, decodeCbor } from "./cbor.js";
+import { encodeMultisigCollection, decodeMultisigCollection, } from "./document-multisig.js";
+/**
+ * Domain tag in slot 0 of the to-be-signed array. Sibling of the other CELLO-DOCUMENT-* tags.
+ * v2 (SYNC-P1): the preimage gained the causal fields — author, sequence, parents. A v1 frame is
+ * refused by the mandatory-field discipline below; no compatibility is owed (all holders upgrade
+ * together).
+ */
+export const DOCUMENT_AMENDMENT_DOMAIN = "CELLO-DOCUMENT-AMENDMENT-v3";
+/**
+ * Ceiling on an entry's parent list. The honest frontier is bounded by the holder cap (D5: 20);
+ * the ceiling exists so a hostile daemon cannot make every ancestry walk unbounded.
+ */
+export const MAX_ENTRY_PARENTS = 64;
+/** The `subject_kind` an amendment's multisig collection must carry. */
+export const AMENDMENT_SUBJECT_KIND = "document_amendment";
+/** D5 (ruled 2026-08-11): documents inherit the group-room cap. Enforced at amendment validation. */
+export const MAX_DOCUMENT_HOLDERS = 20;
+export const AMENDMENT_KINDS = [
+    "add_holder",
+    "remove_holder",
+    "promote_admin",
+    "remove_admin",
+    "change_property",
+    // SYNC-P2 (R21/R24): the subject's own acts. A `consent` answers an admission and names what
+    // it agrees to in the signed property slots ({ key: "consents_to", value: "<tier>/<version>" });
+    // a `refuse_join` ends the invitation. Both are authored, subject-ed, and signed by the same
+    // party — nobody consents for you.
+    "consent",
+    "refuse_join",
+    // SYNC-P4 (R26-R28): endings are governance entries like everything else. A `close` is the
+    // closer's own signed agreement to end; the document is CLOSED when every current participant
+    // holds one (derived, never tracked). A `kill` is any single admin's immediate one-sided end.
+    "close",
+    "kill",
+];
+/**
+ * Properties an amendment may change. Deliberately NARROW to start: the seam properties are owned
+ * elsewhere (`assurance_tier` changes are the Tier 2 tier-upgrade epoch event; `schema_enforcement`
+ * is Tier 2's schema work; `topology` and `content_profile` are identity-shaped — changing them
+ * under a live document is a new agreement, not an amendment). Widening this set is a one-line,
+ * journaled decision; shrinking it after documents exist is a migration.
+ */
+export const AMENDABLE_PROPERTIES = new Set(["append_only"]);
+/**
+ * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
+ * `property_change` is FLATTENED into two slots — `encodeCbor` maps follow insertion order, and a
+ * nested map would make the hash depend on how the builder happened to assemble it.
+ */
+export function buildDocumentAmendmentTbs(body, opts = {}) {
+    const preimage = encodeCbor([
+        DOCUMENT_AMENDMENT_DOMAIN,
+        body.document_id,
+        body.kind,
+        body.subject_agent_id,
+        body.property_change?.key ?? null,
+        body.property_change?.value ?? null,
+        body.state_hash,
+        // BIGINT past 0xffffffff — the same float64-vs-uint64 coercion every sibling builder carries.
+        typeof body.authored_at_ms === "number" && body.authored_at_ms > 0xffffffff
+            ? BigInt(body.authored_at_ms)
+            : body.authored_at_ms,
+        body.author_agent_id,
+        body.author_seq,
+        [...body.parents],
+    ]);
+    if (opts.preHash === false)
+        return preimage;
+    return new Uint8Array(createHash("sha256").update(preimage).digest());
+}
+/** The amendment's identity: SHA-256 over the TBS preimage — signature-independent, like `document_id`. */
+export function documentAmendmentHash(body) {
+    return new Uint8Array(createHash("sha256").update(buildDocumentAmendmentTbs(body, { preHash: false })).digest());
+}
+export function encodeDocumentAmendment(env) {
+    return encodeCbor({
+        // The FRAME discriminator — how the session router tells an amendment from conversation.
+        // Not part of the TBS (the hash and every signature are over the body's preimage), so its
+        // absence in early builds cost classification, never integrity.
+        type: "document_amendment",
+        body: {
+            document_id: env.body.document_id,
+            kind: env.body.kind,
+            subject_agent_id: env.body.subject_agent_id,
+            property_change: env.body.property_change,
+            state_hash: env.body.state_hash,
+            authored_at_ms: env.body.authored_at_ms,
+            author_agent_id: env.body.author_agent_id,
+            author_seq: env.body.author_seq,
+            parents: [...env.body.parents],
+        },
+        collection: encodeMultisigCollection(env.collection),
+    });
+}
+function present(map, field) {
+    if (!(field in map)) {
+        throw new Error(`document_amendment_missing_field: ${field} is mandatory and was not present`);
+    }
+    return map[field];
+}
+function str(map, field) {
+    const v = present(map, field);
+    if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`document_amendment_field_type: ${field} must be a non-empty text string`);
+    }
+    return v;
+}
+export function decodeDocumentAmendment(input) {
+    const decoded = decodeCbor(input);
+    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+        throw new Error("document_amendment_malformed: not a CBOR map");
+    }
+    const map = decoded;
+    const frameType = present(map, "type");
+    if (frameType !== "document_amendment") {
+        throw new Error(`document_amendment_type: expected document_amendment, got ${String(frameType)}`);
+    }
+    const rawBody = present(map, "body");
+    if (typeof rawBody !== "object" || rawBody === null || Array.isArray(rawBody)) {
+        throw new Error("document_amendment_field_type: body must be a CBOR map");
+    }
+    const b = rawBody;
+    const kind = str(b, "kind");
+    if (!AMENDMENT_KINDS.includes(kind)) {
+        throw new Error(`document_amendment_kind: "${kind}" is not an amendment kind this build knows ` +
+            `(${AMENDMENT_KINDS.join(", ")})`);
+    }
+    const subject = present(b, "subject_agent_id");
+    if (subject !== null && (typeof subject !== "string" || subject.length === 0)) {
+        throw new Error("document_amendment_field_type: subject_agent_id must be a non-empty string or explicit null");
+    }
+    const rawChange = present(b, "property_change");
+    let propertyChange = null;
+    if (rawChange !== null) {
+        if (typeof rawChange !== "object" || Array.isArray(rawChange)) {
+            throw new Error("document_amendment_field_type: property_change must be a CBOR map or null");
+        }
+        const c = rawChange;
+        const key = str(c, "key");
+        const value = present(c, "value");
+        if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
+            throw new Error("document_amendment_field_type: property_change.value must be a string, number, or boolean");
+        }
+        propertyChange = { key, value };
+    }
+    const stateHash = present(b, "state_hash");
+    if (stateHash !== null && !(stateHash instanceof Uint8Array)) {
+        throw new Error("document_amendment_field_type: state_hash must be a CBOR byte string or explicit null");
+    }
+    const authoredAt = present(b, "authored_at_ms");
+    if (typeof authoredAt !== "number" || !Number.isInteger(authoredAt)) {
+        throw new Error("document_amendment_field_type: authored_at_ms must be an integer");
+    }
+    const author = present(b, "author_agent_id");
+    if (typeof author !== "string" || !/^[0-9a-f]{64}$/.test(author)) {
+        throw new Error("document_amendment_field_type: author_agent_id must be a 64-hex agent pubkey");
+    }
+    const authorSeq = present(b, "author_seq");
+    if (typeof authorSeq !== "number" || !Number.isInteger(authorSeq) || authorSeq < 1) {
+        throw new Error(`document_amendment_author_seq: must be a positive integer (an author's own chain starts ` +
+            `at 1), got ${String(authorSeq)}`);
+    }
+    const rawParents = present(b, "parents");
+    if (!Array.isArray(rawParents)) {
+        throw new Error("document_amendment_field_type: parents must be an array of entry hashes");
+    }
+    if (rawParents.length > MAX_ENTRY_PARENTS) {
+        throw new Error(`document_amendment_parents_cap: ${rawParents.length} parents exceeds the ceiling of ` +
+            `${MAX_ENTRY_PARENTS} — an honest frontier is bounded by the holder cap`);
+    }
+    for (const p of rawParents) {
+        if (typeof p !== "string" || !/^[0-9a-f]{64}$/.test(p)) {
+            throw new Error("document_amendment_field_type: parents must be 64-hex entry hashes");
+        }
+    }
+    const parents = rawParents;
+    for (let i = 1; i < parents.length; i++) {
+        if (parents[i] <= parents[i - 1]) {
+            throw new Error("document_amendment_parents_canonical: parents must be strictly ascending with no " +
+                "duplicates — one entry, one identity");
+        }
+    }
+    const rawCollection = present(map, "collection");
+    if (!(rawCollection instanceof Uint8Array)) {
+        throw new Error("document_amendment_field_type: collection must be a CBOR byte string");
+    }
+    return {
+        body: {
+            document_id: str(b, "document_id"),
+            kind: kind,
+            subject_agent_id: subject,
+            property_change: propertyChange,
+            state_hash: stateHash === null ? null : new Uint8Array(stateHash),
+            authored_at_ms: authoredAt,
+            author_agent_id: author,
+            author_seq: authorSeq,
+            parents,
+        },
+        collection: decodeMultisigCollection(new Uint8Array(rawCollection)),
+    };
+}
+//# sourceMappingURL=document-amendment.js.map

package/dist/document-amendment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-amendment.js","sourceRoot":"","sources":["../src/document-amendment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,YAAY;IACZ,eAAe;IACf,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,6FAA6F;IAC7F,iGAAiG;IACjG,6FAA6F;IAC7F,mCAAmC;IACnC,SAAS;IACT,aAAa;IACb,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,OAAO;IACP,MAAM;CACE,CAAC;AAGX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAkC7D;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAA2B,EAC3B,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,yBAAyB;QACzB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,gBAAgB;QACrB,IAAI,CAAC,eAAe,EAAE,GAAG,IAAI,IAAI;QACjC,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,IAAI;QACnC,IAAI,CAAC,UAAU;QACf,8FAA8F;QAC9F,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,GAAG,UAAU;YACzE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,cAAc;QACvB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,UAAU;QACf,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;KAClB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,OAAO,IAAI,UAAU,CACnB,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAA8B;IACpE,OAAO,UAAU,CAAC;QAChB,yFAAyF;QACzF,0FAA0F;QAC1F,gEAAgE;QAChE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE;YACJ,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;YACjC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;YACnB,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB;YAC3C,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YACzC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU;YAC/B,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc;YACvC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe;YACzC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU;YAC/B,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;SAC/B;QACD,UAAU,EAAE,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC;KACrD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,mCAAmC,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,kCAAkC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAiB;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,6DAA6D,MAAM,CAAC,SAAS,CAAC,EAAE,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAE7C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,8CAA8C;YAC7E,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAChD,IAAI,cAAc,GAA6C,IAAI,CAAC;IACpE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,GAAG,SAAoC,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,cAAc,MAAM,CAAC,SAAS,CAAC,EAAE,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,CAAC,MAAM,kCAAkC;YACpF,GAAG,iBAAiB,oDAAoD,CAC3E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,UAAsB,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAE,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACjF,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,aAAa,YAAY,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;QACL,IAAI,EAAE;YACJ,WAAW,EAAE,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC;YAClC,IAAI,EAAE,IAAqB;YAC3B,gBAAgB,EAAE,OAAO;YACzB,eAAe,EAAE,cAAc;YAC/B,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC;YACjE,cAAc,EAAE,UAAU;YAC1B,eAAe,EAAE,MAAM;YACvB,UAAU,EAAE,SAAS;YACrB,OAAO;SACR;QACD,UAAU,EAAE,wBAAwB,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC"}

package/dist/document-derive.d.ts

@@ -0,0 +1,96 @@
+/**
+ * SYNC-P1 — the causal derivation. ONE derivation of a document's state for every holder: the
+ * fold over the entry DAG in a deterministic total order. Same entry set → same state, everywhere,
+ * always. This file replaces the linear epoch replay; the fold rules are M14B Build Journal
+ * Entries 48–49 (SYNC-G2's finding plus its admin-floor addendum).
+ *
+ * The total order is Kahn's topological sort refined by ascending entry hash — a pure function of
+ * the entry SET. The hash tie-break resolves only what is semantically arbitrary (which property
+ * value wins). It never resolves authority: causal concurrency is author-claimable (a modified
+ * daemon backdates its parents at will), so any rule where a concurrent act could beat a removal
+ * would make removal defeatable. Hence the fold rules:
+ *
+ *  F1. A non-removal entry takes effect iff it validates against the folded state at its position
+ *      AND it is not concurrent with an ancestor-valid removal of its author.
+ *  F2. A removal is judged at its OWN ancestors (the state derived from its ancestor closure) and
+ *      is exempt from F1's concurrency void — the exemption is what keeps mutual removals from
+ *      being circular. At fold position it is void only by the admin floor: a removal that would
+ *      leave zero admins does not take effect.
+ *  F3. Content admissibility is R20's (ancestor-based) and is NOT this module's concern.
+ *  F4. A void entry stays in the linearization — history, not refusal — and contributes nothing.
+ */
+import { type DocumentAmendmentEnvelope, type ArrangementGenesis, type SignerPolicy } from "./document-amendment.js";
+export interface DocumentStateView {
+    participants: ReadonlySet<string>;
+    /** Admitted, not yet answered (R22) — a seat at the table, not a voice. Counts toward the cap. */
+    invited: ReadonlySet<string>;
+    admins: ReadonlySet<string>;
+    /** R27/R28 — DERIVED, never tracked: "closed" when every current participant has closed;
+     *  "killed" on any admin's kill; null while live. */
+    ended: "closed" | "killed" | null;
+    /** Who has agreed to close — the surface's "waiting on" list is its complement. */
+    closedBy: ReadonlySet<string>;
+    properties: Record<string, string | number | boolean | undefined>;
+    /** The total order actually folded (applied AND void entries — F4 keeps voids in history). */
+    order: readonly string[];
+    /** Heads: included entries no other included entry names as a parent. Ascending. */
+    frontier: readonly string[];
+    /** Fold-void entries, each with the reason it contributed nothing. */
+    voids: readonly {
+        hash: string;
+        reason: string;
+    }[];
+    /** Entries whose ancestry is not fully present — held out entirely, never guessed at (R14). */
+    excluded: readonly {
+        hash: string;
+        reason: string;
+    }[];
+    /** Highest seq per author among included entries — the watermark seed. */
+    authorSeqs: ReadonlyMap<string, number>;
+    /** Interim carrier fields until P4 deletes the epoch spine (D7, gated on SYNC-G1). */
+    interimLastHash: string | null;
+}
+export type DeriveDocumentStateResult = {
+    ok: true;
+    state: DocumentStateView;
+} | {
+    ok: false;
+    reason: string;
+};
+type VerifyFn = (agentId: string, tbs: Uint8Array, signature: Uint8Array) => boolean;
+/**
+ * SYNC-G1 — the derivation AT a named governance frontier: the fold restricted to the ancestor
+ * closure of `frontierHashes`. This is what content admissibility rules on (R20/R30): was the
+ * envelope's author a participant in the world its signed `governance_parents` name? Judged
+ * from the named ancestors alone — the same bounded backdating concession Entry 48 accepted
+ * for governance: a lying daemon admits exactly what an honest holder AT THAT POSITION could
+ * have authored, and the fold's removal dominance keeps it out of governance regardless.
+ *
+ * A frontier hash not present in `entries` is the caller's signal to reconcile first — this
+ * function reports it rather than guessing (`missing`).
+ */
+export declare function deriveDocumentStateAt(genesis: ArrangementGenesis, entries: readonly DocumentAmendmentEnvelope[], frontierHashes: readonly string[], policy: SignerPolicy, verify: VerifyFn): {
+    ok: true;
+    state: DocumentStateView;
+} | {
+    ok: false;
+    reason: string;
+    missing?: string[];
+};
+/**
+ * The STATE-INDEPENDENT admission check — what an inbound path may refuse outright, because no
+ * future entry can ever make it good: the collection must bind to this entry, the claimed author
+ * must be in the required set, and every claimed signature must verify. Everything else — subject
+ * semantics, policy, concurrency — is the fold's ruling, and a fold-void entry is still HISTORY
+ * (F4): it must be stored and shared, never bounced at the door, or two holders end up holding
+ * different sets.
+ */
+export declare function checkEntryAdmissible(env: DocumentAmendmentEnvelope, verify: VerifyFn): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function deriveDocumentState(genesis: ArrangementGenesis, entries: readonly DocumentAmendmentEnvelope[], policy: SignerPolicy, verify: VerifyFn): DeriveDocumentStateResult;
+export {};
+//# sourceMappingURL=document-derive.d.ts.map

package/dist/document-derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-derive.d.ts","sourceRoot":"","sources":["../src/document-derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAKL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,kGAAkG;IAClG,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B;yDACqD;IACrD,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IAClC,mFAAmF;IACnF,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAClE,8FAA8F;IAC9F,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,oFAAoF;IACpF,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,sEAAsE;IACtE,KAAK,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD,+FAA+F;IAC/F,QAAQ,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,0EAA0E;IAC1E,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC;AAErF;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,SAAS,yBAAyB,EAAE,EAC7C,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,QAAQ,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA8B5F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,yBAAyB,EAC9B,MAAM,EAAE,QAAQ,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CA0C9C;AAqBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,SAAS,yBAAyB,EAAE,EAC7C,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,QAAQ,GACf,yBAAyB,CAkhB3B"}