@cello-protocol/protocol-types 0.0.54 → 0.0.56

package/dist/document-join-answer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-join-answer.js","sourceRoot":"","sources":["../src/document-join-answer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,sDAAsD;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAE3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAgBlD,MAAM,UAAU,0BAA0B,CACxC,MAA0B,EAC1B,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,2BAA2B;QAC3B,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,cAAc;QACrB,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,GAAG,UAAU;YAC7E,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,cAAc;KAC1B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA0B;IACjE,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,mCAAmC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,kCAAkC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAiB;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iEAAiE,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,qBAAqB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,2DAA2D,8BAA8B,QAAQ,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAC1C,gBAAgB,EAAE,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC9C,QAAQ;QACR,cAAc,EAAE,MAAM;QACtB,cAAc,EAAE,UAAU;QAC1B,SAAS,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/dist/document-join.d.ts

@@ -1,83 +0,0 @@
-/**
- * DOD-MP-JOIN-1 — the join offer: how a third party enters an existing document.
- *
- * The offer is a courier, not an authority. It carries the RECEIVED BYTES of the genesis
- * proposal, the full amendment chain (the pending `add_holder` last), and the envelope-log
- * snapshot — and the invitee's daemon DERIVES the arrangement from those bytes through the same
- * replay every holder runs. The invitee consents to what they computed, never to what they were
- * told: an offer whose chain does not replay admits nobody, whatever its prose.
- *
- * ── WHY THE SIGNATURE BINDS EVERY CARRIED BYTE ────────────────────────────────────────────────
- *
- * The TBS commits to the hash of the genesis bytes, of each amendment, and of each log envelope.
- * Each carried payload is ALSO independently verifiable (the genesis by its proposer's
- * signature, each amendment by its collection, each envelope by its sender) — the offer-level
- * binding exists so the inviter cannot assemble a misleading BUNDLE out of individually-valid
- * pieces and later disown the assembly. Who showed the invitee what is on the record.
- *
- * ── NEITHER ALONE ADMITS ANYONE ───────────────────────────────────────────────────────────────
- *
- * A valid offer makes a join POSSIBLE; the invitee's signed accept makes it REAL (the daemon
- * unit wires that consent through the settle-once ack pattern). This module rules only on the
- * offer's validity — GOVERN-1's dispositioned consent clause lands in the daemon receive path.
- */
-import { type DocumentProposalEnvelope } from "./document-proposal.js";
-import { type Arrangement, type ArrangementGenesis, type DocumentAmendmentEnvelope, type SignerPolicy } from "./document-amendment.js";
-/** Domain tag in slot 0 of the to-be-signed array. Sibling of the other CELLO-DOCUMENT-* tags. */
-export declare const DOCUMENT_JOIN_OFFER_DOMAIN = "CELLO-DOCUMENT-JOIN-OFFER-v1";
-export interface DocumentJoinOffer {
-    type: "document_join_offer";
-    feature_version: number;
-    /** The admin authoring this offer — must be a claimed signer of the pending amendment. */
-    inviter_agent_id: string;
-    invitee_agent_id: string;
-    document_id: string;
-    /** The genesis proposal AS RECEIVED — the invitee re-derives `document_id` from these bytes. */
-    genesis: Uint8Array;
-    /** The full amendment chain as received bytes, ordered, the pending `add_holder` LAST. */
-    amendments: Uint8Array[];
-    /** The update-envelope log snapshot (D1's cheap path) — may be empty for a young document. */
-    envelope_log: Uint8Array[];
-    offered_at_ms: number;
-    /** Ed25519 (RFC 8032) by the inviter over `buildDocumentJoinOfferTbs`. */
-    signature: Uint8Array;
-}
-/**
- * The canonical to-be-signed preimage. Payloads enter as HASHES (arrays of 32-byte digests are
- * deterministic CBOR — the multisig precedent), so the signature binds every carried byte
- * without re-encoding megabytes into the preimage.
- */
-export declare function buildDocumentJoinOfferTbs(offer: DocumentJoinOffer, opts?: {
-    preHash?: boolean;
-}): Uint8Array;
-export declare function encodeDocumentJoinOffer(offer: DocumentJoinOffer): Uint8Array;
-export declare function decodeDocumentJoinOffer(input: Uint8Array): DocumentJoinOffer;
-/**
- * The replay's starting facts, computed from a decoded genesis proposal — ONE implementation for
- * every consumer (join validation, the daemon's amendment receive and accept paths), because two
- * copies of the everyone-admin default is how two holders derive different arrangements from one
- * genesis. Absent `admin_set` means both genesis participants govern (the bilateral default);
- * `admin_set` itself lives on the ARRANGEMENT, not in the scalar properties bag the replay
- * derives `change_property` against.
- */
-export declare function arrangementGenesisFromProposal(genesis: DocumentProposalEnvelope): ArrangementGenesis;
-export type JoinOfferValidation = {
-    ok: true;
-    /** Derived by REPLAY of the carried bytes — the consent surface, computed not trusted. */
-    arrangement: Arrangement;
-    genesis: DocumentProposalEnvelope;
-    amendments: DocumentAmendmentEnvelope[];
-    /** Hex hash of the pending `add_holder` — the settle key for the invitee's answer. */
-    pendingAmendmentHash: string;
-} | {
-    ok: false;
-    reason: string;
-};
-/**
- * The invitee's ruling on an offer. Order is the disclosure-and-trust boundary: the version
- * answer first (a mismatched build must get a sentence, not a failed signature), then the
- * inviter's signature (nothing else is worth computing on an unauthenticated bundle), then the
- * carried payloads each on their own signatures, then the replay.
- */
-export declare function validateDocumentJoinOffer(offer: DocumentJoinOffer, policy: SignerPolicy, verify: (agentId: string, tbs: Uint8Array, signature: Uint8Array) => boolean): JoinOfferValidation;
-//# sourceMappingURL=document-join.d.ts.map

package/dist/document-join.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-join.d.ts","sourceRoot":"","sources":["../src/document-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAEjC,kGAAkG;AAClG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,OAAO,EAAE,UAAU,CAAC;IACpB,0FAA0F;IAC1F,UAAU,EAAE,UAAU,EAAE,CAAC;IACzB,8FAA8F;IAC9F,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,UAAU,CAAC;CACvB;AAMD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,iBAAiB,EACxB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,UAAU,CAgBZ;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,iBAAiB,GAAG,UAAU,CAa5E;AAiCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CA8B5E;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,wBAAwB,GAChC,kBAAkB,CAgBpB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,0FAA0F;IAC1F,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,wBAAwB,CAAC;IAClC,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,sFAAsF;IACtF,oBAAoB,EAAE,MAAM,CAAC;CAC9B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMlC;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,GAC3E,mBAAmB,CAyFrB"}

package/dist/document-join.js

@@ -1,225 +0,0 @@
-/**
- * DOD-MP-JOIN-1 — the join offer: how a third party enters an existing document.
- *
- * The offer is a courier, not an authority. It carries the RECEIVED BYTES of the genesis
- * proposal, the full amendment chain (the pending `add_holder` last), and the envelope-log
- * snapshot — and the invitee's daemon DERIVES the arrangement from those bytes through the same
- * replay every holder runs. The invitee consents to what they computed, never to what they were
- * told: an offer whose chain does not replay admits nobody, whatever its prose.
- *
- * ── WHY THE SIGNATURE BINDS EVERY CARRIED BYTE ────────────────────────────────────────────────
- *
- * The TBS commits to the hash of the genesis bytes, of each amendment, and of each log envelope.
- * Each carried payload is ALSO independently verifiable (the genesis by its proposer's
- * signature, each amendment by its collection, each envelope by its sender) — the offer-level
- * binding exists so the inviter cannot assemble a misleading BUNDLE out of individually-valid
- * pieces and later disown the assembly. Who showed the invitee what is on the record.
- *
- * ── NEITHER ALONE ADMITS ANYONE ───────────────────────────────────────────────────────────────
- *
- * A valid offer makes a join POSSIBLE; the invitee's signed accept makes it REAL (the daemon
- * unit wires that consent through the settle-once ack pattern). This module rules only on the
- * offer's validity — GOVERN-1's dispositioned consent clause lands in the daemon receive path.
- */
-import { createHash } from "node:crypto";
-import { encodeCbor, decodeCbor } from "./cbor.js";
-import { DOCUMENT_FEATURE_VERSION, decodeDocumentProposal, documentIdFromProposal, buildDocumentProposalTbs, } from "./document-proposal.js";
-import { decodeDocumentAmendment, deriveArrangement, } from "./document-amendment.js";
-/** Domain tag in slot 0 of the to-be-signed array. Sibling of the other CELLO-DOCUMENT-* tags. */
-export const DOCUMENT_JOIN_OFFER_DOMAIN = "CELLO-DOCUMENT-JOIN-OFFER-v1";
-function sha256(bytes) {
-    return new Uint8Array(createHash("sha256").update(bytes).digest());
-}
-/**
- * The canonical to-be-signed preimage. Payloads enter as HASHES (arrays of 32-byte digests are
- * deterministic CBOR — the multisig precedent), so the signature binds every carried byte
- * without re-encoding megabytes into the preimage.
- */
-export function buildDocumentJoinOfferTbs(offer, opts = {}) {
-    const preimage = encodeCbor([
-        DOCUMENT_JOIN_OFFER_DOMAIN,
-        offer.feature_version,
-        offer.inviter_agent_id,
-        offer.invitee_agent_id,
-        offer.document_id,
-        sha256(offer.genesis),
-        offer.amendments.map(sha256),
-        offer.envelope_log.map(sha256),
-        typeof offer.offered_at_ms === "number" && offer.offered_at_ms > 0xffffffff
-            ? BigInt(offer.offered_at_ms)
-            : offer.offered_at_ms,
-    ]);
-    if (opts.preHash === false)
-        return preimage;
-    return sha256(preimage);
-}
-export function encodeDocumentJoinOffer(offer) {
-    return encodeCbor({
-        type: offer.type,
-        feature_version: offer.feature_version,
-        inviter_agent_id: offer.inviter_agent_id,
-        invitee_agent_id: offer.invitee_agent_id,
-        document_id: offer.document_id,
-        genesis: offer.genesis,
-        amendments: offer.amendments,
-        envelope_log: offer.envelope_log,
-        offered_at_ms: offer.offered_at_ms,
-        signature: offer.signature,
-    });
-}
-function present(map, field) {
-    if (!(field in map)) {
-        throw new Error(`document_join_missing_field: ${field} is mandatory and was not present`);
-    }
-    return map[field];
-}
-function str(map, field) {
-    const v = present(map, field);
-    if (typeof v !== "string" || v.length === 0) {
-        throw new Error(`document_join_field_type: ${field} must be a non-empty text string`);
-    }
-    return v;
-}
-function bytes(map, field) {
-    const v = present(map, field);
-    if (!(v instanceof Uint8Array)) {
-        throw new Error(`document_join_field_type: ${field} must be a CBOR byte string`);
-    }
-    return new Uint8Array(v);
-}
-function byteArray(map, field) {
-    const v = present(map, field);
-    if (!Array.isArray(v) || v.some((e) => !(e instanceof Uint8Array))) {
-        throw new Error(`document_join_field_type: ${field} must be an array of CBOR byte strings`);
-    }
-    return v.map((e) => new Uint8Array(e));
-}
-export function decodeDocumentJoinOffer(input) {
-    const decoded = decodeCbor(input);
-    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
-        throw new Error("document_join_malformed: not a CBOR map");
-    }
-    const map = decoded;
-    const type = str(map, "type");
-    if (type !== "document_join_offer") {
-        throw new Error(`document_join_type: expected document_join_offer, got ${type}`);
-    }
-    const featureVersion = present(map, "feature_version");
-    if (typeof featureVersion !== "number" || !Number.isInteger(featureVersion) || featureVersion < 1) {
-        throw new Error("document_join_field_type: feature_version must be a positive integer");
-    }
-    const offeredAt = present(map, "offered_at_ms");
-    if (typeof offeredAt !== "number" || !Number.isInteger(offeredAt)) {
-        throw new Error("document_join_field_type: offered_at_ms must be an integer");
-    }
-    return {
-        type: "document_join_offer",
-        feature_version: featureVersion,
-        inviter_agent_id: str(map, "inviter_agent_id"),
-        invitee_agent_id: str(map, "invitee_agent_id"),
-        document_id: str(map, "document_id"),
-        genesis: bytes(map, "genesis"),
-        amendments: byteArray(map, "amendments"),
-        envelope_log: byteArray(map, "envelope_log"),
-        offered_at_ms: offeredAt,
-        signature: bytes(map, "signature"),
-    };
-}
-/**
- * The replay's starting facts, computed from a decoded genesis proposal — ONE implementation for
- * every consumer (join validation, the daemon's amendment receive and accept paths), because two
- * copies of the everyone-admin default is how two holders derive different arrangements from one
- * genesis. Absent `admin_set` means both genesis participants govern (the bilateral default);
- * `admin_set` itself lives on the ARRANGEMENT, not in the scalar properties bag the replay
- * derives `change_property` against.
- */
-export function arrangementGenesisFromProposal(genesis) {
-    return {
-        documentId: documentIdFromProposal(genesis),
-        proposerAgentId: genesis.proposer_agent_id,
-        peerAgentId: genesis.peer_agent_id,
-        adminSet: genesis.properties.admin_set ?? [genesis.proposer_agent_id, genesis.peer_agent_id],
-        properties: {
-            assurance_tier: genesis.properties.assurance_tier,
-            schema_enforcement: genesis.properties.schema_enforcement,
-            topology: genesis.properties.topology,
-            append_only: genesis.properties.append_only,
-            ...(genesis.properties.content_profile !== undefined
-                ? { content_profile: genesis.properties.content_profile }
-                : {}),
-        },
-    };
-}
-function refuse(reason) {
-    return { ok: false, reason };
-}
-/**
- * The invitee's ruling on an offer. Order is the disclosure-and-trust boundary: the version
- * answer first (a mismatched build must get a sentence, not a failed signature), then the
- * inviter's signature (nothing else is worth computing on an unauthenticated bundle), then the
- * carried payloads each on their own signatures, then the replay.
- */
-export function validateDocumentJoinOffer(offer, policy, verify) {
-    if (offer.feature_version !== DOCUMENT_FEATURE_VERSION) {
-        const side = offer.feature_version > DOCUMENT_FEATURE_VERSION
-            ? "upgrade this client to join it"
-            : "ask the inviter to upgrade theirs";
-        return refuse(`join_feature_version: the offer speaks document feature version ${offer.feature_version} ` +
-            `and this build speaks ${DOCUMENT_FEATURE_VERSION} — ${side}`);
-    }
-    if (!verify(offer.inviter_agent_id, buildDocumentJoinOfferTbs(offer), offer.signature)) {
-        return refuse(`join_signature_invalid: the offer claims to come from ${offer.inviter_agent_id} but its ` +
-            `signature does not verify against that agent — nothing about the bundle is trustworthy`);
-    }
-    let genesis;
-    try {
-        genesis = decodeDocumentProposal(offer.genesis);
-    }
-    catch (err) {
-        return refuse(`join_genesis_undecodable: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (documentIdFromProposal(genesis) !== offer.document_id) {
-        return refuse(`join_genesis_mismatch: the carried genesis hashes to a different document than the offer ` +
-            `names — the anchor cannot be swapped`);
-    }
-    if (!verify(genesis.proposer_agent_id, buildDocumentProposalTbs(genesis), genesis.signature)) {
-        return refuse(`join_genesis_signature_invalid: the genesis proposal does not verify against its named ` +
-            `proposer ${genesis.proposer_agent_id}`);
-    }
-    if (offer.amendments.length === 0) {
-        return refuse("join_no_pending_amendment: an offer must carry the amendment chain ending in the " +
-            "add_holder that admits the invitee — an empty chain admits nobody");
-    }
-    let amendments;
-    try {
-        amendments = offer.amendments.map((a) => decodeDocumentAmendment(a));
-    }
-    catch (err) {
-        return refuse(`join_amendment_undecodable: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    const derived = deriveArrangement(arrangementGenesisFromProposal(genesis), amendments, policy, verify);
-    if (!derived.ok) {
-        // The replay's reason IS the diagnosis — passed through, never substituted.
-        return refuse(derived.reason);
-    }
-    const pending = amendments[amendments.length - 1];
-    if (pending.body.kind !== "add_holder" || pending.body.subject_agent_id !== offer.invitee_agent_id) {
-        return refuse(`join_not_for_invitee: the chain's last amendment does not admit ${offer.invitee_agent_id} — ` +
-            `an offer is addressed to the holder its pending amendment names`);
-    }
-    if (!pending.collection.required_signers.includes(offer.inviter_agent_id)) {
-        return refuse(`join_inviter_not_signer: ${offer.inviter_agent_id} authored the offer but is not a claimed ` +
-            `signer of the admitting amendment — the offer's author must be behind the admission`);
-    }
-    return {
-        ok: true,
-        arrangement: derived.arrangement,
-        genesis,
-        amendments,
-        // Unconditional: after a successful replay the subject_hash provably equals the amendment
-        // hash, and a conditional empty-string key would collide every document on "" if the
-        // invariant ever broke — better to emit the hex of whatever verified.
-        pendingAmendmentHash: Buffer.from(pending.collection.subject_hash).toString("hex"),
-    };
-}
-//# sourceMappingURL=document-join.js.map

package/dist/document-join.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-join.js","sourceRoot":"","sources":["../src/document-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAKlB,MAAM,yBAAyB,CAAC;AAEjC,kGAAkG;AAClG,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AAoBzE,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAwB,EACxB,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,0BAA0B;QAC1B,KAAK,CAAC,eAAe;QACrB,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,WAAW;QACjB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QACrB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAC9B,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,GAAG,UAAU;YACzE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;YAC7B,CAAC,CAAC,KAAK,CAAC,aAAa;KACxB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAwB;IAC9D,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,mCAAmC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,kCAAkC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAA4B,EAAE,KAAa;IACxD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,6BAA6B,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,GAA4B,EAAE,KAAa;IAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,wCAAwC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,CAAe,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAiB;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,eAAe,EAAE,cAAc;QAC/B,gBAAgB,EAAE,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC9C,gBAAgB,EAAE,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC;QAC9B,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC;QACxC,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC;QAC5C,aAAa,EAAE,SAAS;QACxB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAiC;IAEjC,OAAO;QACL,UAAU,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,OAAO,CAAC,iBAAiB;QAC1C,WAAW,EAAE,OAAO,CAAC,aAAa;QAClC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC;QAC5F,UAAU,EAAE;YACV,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc;YACjD,kBAAkB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB;YACzD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ;YACrC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW;YAC3C,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,KAAK,SAAS;gBAClD,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAcD,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAwB,EACxB,MAAoB,EACpB,MAA4E;IAE5E,IAAI,KAAK,CAAC,eAAe,KAAK,wBAAwB,EAAE,CAAC;QACvD,MAAM,IAAI,GACR,KAAK,CAAC,eAAe,GAAG,wBAAwB;YAC9C,CAAC,CAAC,gCAAgC;YAClC,CAAC,CAAC,mCAAmC,CAAC;QAC1C,OAAO,MAAM,CACX,mEAAmE,KAAK,CAAC,eAAe,GAAG;YACzF,yBAAyB,wBAAwB,MAAM,IAAI,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvF,OAAO,MAAM,CACX,yDAAyD,KAAK,CAAC,gBAAgB,WAAW;YACxF,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,MAAM,CACX,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1D,OAAO,MAAM,CACX,2FAA2F;YACzF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7F,OAAO,MAAM,CACX,yFAAyF;YACvF,YAAY,OAAO,CAAC,iBAAiB,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CACX,mFAAmF;YACjF,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,UAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,MAAM,CACX,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAC/B,8BAA8B,CAAC,OAAO,CAAC,EACvC,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,4EAA4E;QAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACnG,OAAO,MAAM,CACX,mEAAmE,KAAK,CAAC,gBAAgB,KAAK;YAC5F,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1E,OAAO,MAAM,CACX,4BAA4B,KAAK,CAAC,gBAAgB,2CAA2C;YAC3F,qFAAqF,CACxF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO;QACP,UAAU;QACV,0FAA0F;QAC1F,qFAAqF;QACrF,sEAAsE;QACtE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACnF,CAAC;AACJ,CAAC"}