@claudian-collab/protocol 3.3.0 → 3.3.1

package/README.md

@@ -37,7 +37,7 @@ fixed part of the detail so the whole detail stays within
 has one compatible final-serialization limit. Request comments and Ticket
 accepted relations also have shared authority-enforced total limits; summary
 counts let complete consumers reject partial or cross-snapshot assembly.
-Cloud binding v2 adds the authority-neutral Project snapshot, nine redacted durable event kinds plus `snapshot.required`, eighteen capability tokens, the exact ordinary Project/Git route catalog, bounded authority-transfer artifact routes, and six private-development bootstrap bindings. Wire v6 includes the additive Cloud Project-membership operation family while preserving every existing operation contract. The shared checkpoint container is exactly `checkpoint.json`, `coordination.ndjson`, and `repository.bundle`; authority-transfer and export retain wire-visible coordination format v1, while the pre-production offline backup contract is directly replaced by format v3. Backup v3 adds Project invitations, protected invitation and transferred-claim override envelopes, manager-responsibility offers, membership recovery journals, and secret-replay tombstones to the existing continuity records. Portable profiles exclude engine storage, paths, credentials, tokens, private keys, and operational refs, and backups exclude plaintext invitation secrets, raw claims, and private keys. Domain-separated canonical UTF-8 inputs define protected-claim AEAD associated data and bind every declared field of transferred-membership redemption receipts and authority-relinquishment proofs before consumer-owned Ed25519 signing or verification. Existing LAN v9 Join, invitation, endpoint, membership lifecycle, Host-transfer, snapshot, event, and HTTP bindings remain independently application-owned; the dedicated LAN authority-transfer transport binds these shared payloads without creating another shared operation registry.
+Cloud binding v2 adds the authority-neutral Project snapshot, nine redacted durable event kinds plus `snapshot.required`, eighteen capability tokens, the exact ordinary Project/Git route catalog, bounded authority-transfer artifact routes, and six private-development bootstrap bindings. Wire v6 includes the additive Cloud Project-membership operation family while preserving every existing operation contract. The shared checkpoint container is exactly `checkpoint.json`, `coordination.ndjson`, and `repository.bundle`; authority-transfer and export retain wire-visible coordination format v1, while the pre-production offline backup contract is directly replaced by format v3. Backup v3 adds Project invitations, protected invitation and transferred-claim override envelopes, manager-responsibility offers, membership recovery journals, secret-replay tombstones, and compacted Manager-responsibility idempotency tombstones to the existing continuity records. Portable profiles exclude engine storage, paths, credentials, tokens, private keys, and operational refs, and backups exclude plaintext invitation secrets, raw claims, and private keys. Domain-separated canonical UTF-8 inputs define protected-claim AEAD associated data and bind every declared field of transferred-membership redemption receipts and authority-relinquishment proofs before consumer-owned Ed25519 signing or verification. Existing LAN v9 Join, invitation, endpoint, membership lifecycle, Host-transfer, snapshot, event, and HTTP bindings remain independently application-owned; the dedicated LAN authority-transfer transport binds these shared payloads without creating another shared operation registry.
 
 ## Usage
 
@@ -62,7 +62,7 @@ part of the public surface.
 
 Package SemVer, canonical wire version, and Cloud binding version are independent concepts.
 
-- **Package version** (this `package.json`): `3.3.0`. Patch releases preserve
+- **Package version** (this `package.json`): `3.3.1`. Patch releases preserve
   every existing public declaration and runtime behavior baseline. Minor
   releases may add backward-compatible API. Removing or changing an existing
   declaration, export, runtime behavior, codec, error, limit, ref rule,
@@ -74,7 +74,10 @@ Package SemVer, canonical wire version, and Cloud binding version are independen
   operation family and capability tokens and directly replaces the pre-production
   offline backup contract with coordination format v3, without changing
   authority-transfer/export format v1, canonical wire v6, or Cloud binding v2.
-  Backup v2 has no supported decoder or migration path. The package version never
+  Backup v2 has no supported decoder or migration path. The pre-production
+  `3.3.1` corrective patch adds only the missing backup-v3 tombstone needed to
+  compact terminal Manager-responsibility offers and exact responses without
+  allowing their idempotency identities to be reused. The package version never
   signals wire compatibility by itself.
 - **Wire version** (`COLLAB_PROTOCOL_VERSION`): currently `6`. The supported
   range is exactly `[6, 6]`. This is independent from Cloud binding version `2` and the existing application

package/dist/CollabProjectBackupCheckpoint.d.ts

@@ -5,7 +5,7 @@ import { type CollabManagerResponsibilityOfferState, type CollabManagerResponsib
 import type { CollabIsoTimestamp, CollabMemberId, CollabProjectId } from './types';
 export declare const COLLAB_PROJECT_BACKUP_COMPATIBILITY_STAGE: "pre-production-replaceable";
 export declare const COLLAB_PROJECT_BACKUP_COORDINATION_FORMAT_VERSION: 3;
-export declare const COLLAB_PROJECT_BACKUP_RECORD_KINDS: readonly ["project", "member", "request", "request-comment", "ticket", "ticket-comment", "ticket-relation", "ticket-mention", "cloud-event", "cloud-event-cursor", "idempotency-result", "principal-binding", "repository-placement", "lifecycle-journal", "authority-transfer-recovery", "transferred-membership-claim", "transfer-receipt-key", "transfer-claim-batch-receipt", "transfer-redemption-receipt", "terminal-principal", "terminal-responder-replay", "leave-former-principal-replay", "project-invitation", "protected-invitation-envelope", "transferred-membership-claim-override", "protected-claim-override-envelope", "manager-responsibility-offer", "project-membership-recovery", "secret-replay-tombstone", "terminal-responder", "protected-claim-envelope", "tombstone", "schema-catalog", "server-compatibility", "authority-volume-pair"];
+export declare const COLLAB_PROJECT_BACKUP_RECORD_KINDS: readonly ["project", "member", "request", "request-comment", "ticket", "ticket-comment", "ticket-relation", "ticket-mention", "cloud-event", "cloud-event-cursor", "idempotency-result", "principal-binding", "repository-placement", "lifecycle-journal", "authority-transfer-recovery", "transferred-membership-claim", "transfer-receipt-key", "transfer-claim-batch-receipt", "transfer-redemption-receipt", "terminal-principal", "terminal-responder-replay", "leave-former-principal-replay", "project-invitation", "protected-invitation-envelope", "transferred-membership-claim-override", "protected-claim-override-envelope", "manager-responsibility-offer", "membership-idempotency-tombstone", "project-membership-recovery", "secret-replay-tombstone", "terminal-responder", "protected-claim-envelope", "tombstone", "schema-catalog", "server-compatibility", "authority-volume-pair"];
 export type CollabProjectBackupRecordKind = typeof COLLAB_PROJECT_BACKUP_RECORD_KINDS[number];
 interface BackupRecordBase<Kind extends string, Value> {
     readonly kind: Kind;
@@ -208,6 +208,15 @@ export type CollabProjectBackupManagerResponsibilityOfferRecord = BackupRecordBa
     readonly targetMembershipRevisionAtOffer: number;
     readonly terminalAt: CollabIsoTimestamp | null;
 }>;
+type CollabProjectBackupCompactedMembershipOperation = Extract<CollabProjectMembershipOperation, 'createManagerResponsibilityOffer' | 'acknowledgeManagerResponsibility' | 'declineManagerResponsibility' | 'cancelManagerResponsibilityOffer' | 'promoteManager'>;
+export type CollabProjectBackupMembershipIdempotencyTombstoneRecord = BackupRecordBase<'membership-idempotency-tombstone', {
+    readonly actorMemberId: CollabMemberId;
+    readonly compactedAt: CollabIsoTimestamp;
+    readonly idempotencyKey: string;
+    readonly operation: CollabProjectBackupCompactedMembershipOperation;
+    readonly projectId: CollabProjectId;
+    readonly requestFingerprint: string;
+}>;
 export type CollabProjectBackupMembershipRecoveryRecord = BackupRecordBase<'project-membership-recovery', {
     readonly expectedMainOid: string;
     readonly expectedPersonalRefOid: string;
@@ -229,7 +238,7 @@ export type CollabProjectBackupSecretReplayTombstoneRecord = BackupRecordBase<'s
     readonly projectId: CollabProjectId;
     readonly requestFingerprint: string;
 }>;
-export type CollabProjectBackupContinuityRecord = CollabProjectBackupLifecycleJournalRecord | CollabProjectBackupAuthorityTransferRecoveryRecord | CollabProjectBackupTransferredMembershipClaimRecord | CollabProjectBackupTransferReceiptKeyRecord | CollabProjectBackupTransferClaimBatchReceiptRecord | CollabProjectBackupTransferRedemptionReceiptRecord | CollabProjectBackupTerminalPrincipalRecord | CollabProjectBackupTerminalResponderReplayRecord | CollabProjectBackupLeaveFormerPrincipalReplayRecord | CollabProjectBackupInvitationRecord | CollabProjectBackupProtectedInvitationEnvelopeRecord | CollabProjectBackupTransferredMembershipClaimOverrideRecord | CollabProjectBackupProtectedClaimOverrideEnvelopeRecord | CollabProjectBackupManagerResponsibilityOfferRecord | CollabProjectBackupMembershipRecoveryRecord | CollabProjectBackupSecretReplayTombstoneRecord;
+export type CollabProjectBackupContinuityRecord = CollabProjectBackupLifecycleJournalRecord | CollabProjectBackupAuthorityTransferRecoveryRecord | CollabProjectBackupTransferredMembershipClaimRecord | CollabProjectBackupTransferReceiptKeyRecord | CollabProjectBackupTransferClaimBatchReceiptRecord | CollabProjectBackupTransferRedemptionReceiptRecord | CollabProjectBackupTerminalPrincipalRecord | CollabProjectBackupTerminalResponderReplayRecord | CollabProjectBackupLeaveFormerPrincipalReplayRecord | CollabProjectBackupInvitationRecord | CollabProjectBackupProtectedInvitationEnvelopeRecord | CollabProjectBackupTransferredMembershipClaimOverrideRecord | CollabProjectBackupProtectedClaimOverrideEnvelopeRecord | CollabProjectBackupManagerResponsibilityOfferRecord | CollabProjectBackupMembershipIdempotencyTombstoneRecord | CollabProjectBackupMembershipRecoveryRecord | CollabProjectBackupSecretReplayTombstoneRecord;
 type CollabProjectBackupBaseRecord = Exclude<CollabCheckpointBackupRecord, {
     readonly kind: 'lifecycle-state';
 }>;

package/dist/CollabProjectBackupCheckpoint.js

@@ -32,6 +32,7 @@ const BACKUP_CONTINUITY_RECORD_KINDS = Object.freeze([
     'transferred-membership-claim-override',
     'protected-claim-override-envelope',
     'manager-responsibility-offer',
+    'membership-idempotency-tombstone',
     'project-membership-recovery',
     'secret-replay-tombstone',
 ]);
@@ -1183,6 +1184,41 @@ function membershipRecoveryRecord(source, recordId, revision) {
         },
     };
 }
+function membershipIdempotencyTombstoneRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'actorMemberId',
+        'compactedAt',
+        'idempotencyKey',
+        'operation',
+        'projectId',
+        'requestFingerprint',
+    ]);
+    const actorMemberId = token(value, 'actorMemberId', CollabValidation_1.isCollabMemberId);
+    const idempotencyKey = token(value, 'idempotencyKey');
+    const operation = literal(value, 'operation', [
+        'createManagerResponsibilityOffer',
+        'acknowledgeManagerResponsibility',
+        'declineManagerResponsibility',
+        'cancelManagerResponsibilityOffer',
+        'promoteManager',
+    ]);
+    if (recordId !== `${operation}:${actorMemberId}:${idempotencyKey}`) {
+        throw invalidPayload('recordId');
+    }
+    return {
+        kind: 'membership-idempotency-tombstone',
+        recordId,
+        revision,
+        value: {
+            actorMemberId,
+            compactedAt: timestamp(value, 'compactedAt'),
+            idempotencyKey,
+            operation,
+            projectId: token(value, 'projectId', CollabValidation_1.isCollabProjectId),
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+        },
+    };
+}
 function secretReplayTombstoneRecord(source, recordId, revision) {
     const value = exactRecord(source.value, 'value', [
         'actorMemberId',
@@ -1240,6 +1276,8 @@ function decodeContinuityRecord(kind, source, recordId, revision) {
             return protectedClaimOverrideEnvelopeRecord(source, recordId, revision);
         case 'manager-responsibility-offer':
             return managerResponsibilityOfferRecord(source, recordId, revision);
+        case 'membership-idempotency-tombstone':
+            return membershipIdempotencyTombstoneRecord(source, recordId, revision);
         case 'project-membership-recovery':
             return membershipRecoveryRecord(source, recordId, revision);
         case 'secret-replay-tombstone':
@@ -1409,6 +1447,7 @@ function validateContinuity(records) {
         item,
     ]));
     const managerOffers = records.filter((item) => (item.kind === 'manager-responsibility-offer'));
+    const membershipIdempotencyTombstones = records.filter((item) => (item.kind === 'membership-idempotency-tombstone'));
     const membershipRecoveries = new Map(records
         .filter((item) => (item.kind === 'project-membership-recovery'))
         .map(item => [item.value.operationId, item]));
@@ -1792,6 +1831,18 @@ function validateContinuity(records) {
             throw invalidPayload('records');
         }
     }
+    for (const tombstone of membershipIdempotencyTombstones) {
+        const exactResult = records.some(item => (item.kind === 'idempotency-result'
+            && item.value.memberId === tombstone.value.actorMemberId
+            && item.value.operation === tombstone.value.operation
+            && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        const exactOffer = tombstone.value.operation === 'createManagerResponsibilityOffer'
+            && managerOffers.some(item => (item.value.sourceManagerMemberId === tombstone.value.actorMemberId
+                && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        if (!members.has(tombstone.value.actorMemberId) || exactResult || exactOffer) {
+            throw invalidPayload('records');
+        }
+    }
     for (const item of records) {
         if (item.kind === 'idempotency-result' && !members.has(item.value.memberId)) {
             throw invalidPayload('records');
@@ -2069,6 +2120,9 @@ function validateCollabProjectBackupCheckpointConsistency(manifest, records) {
         if (item.kind === 'secret-replay-tombstone') {
             return Date.parse(item.value.expiredAt) > captureTime;
         }
+        if (item.kind === 'membership-idempotency-tombstone') {
+            return Date.parse(item.value.compactedAt) > captureTime;
+        }
         if (item.kind === 'project-invitation') {
             return captureTime < Date.parse(item.value.createdAt)
                 || (captureTime < Date.parse(item.value.secretReplayExpiresAt))

package/dist/esm/CollabProjectBackupCheckpoint.mjs

@@ -22,6 +22,7 @@ const BACKUP_CONTINUITY_RECORD_KINDS = Object.freeze([
     'transferred-membership-claim-override',
     'protected-claim-override-envelope',
     'manager-responsibility-offer',
+    'membership-idempotency-tombstone',
     'project-membership-recovery',
     'secret-replay-tombstone',
 ]);
@@ -1173,6 +1174,41 @@ function membershipRecoveryRecord(source, recordId, revision) {
         },
     };
 }
+function membershipIdempotencyTombstoneRecord(source, recordId, revision) {
+    const value = exactRecord(source.value, 'value', [
+        'actorMemberId',
+        'compactedAt',
+        'idempotencyKey',
+        'operation',
+        'projectId',
+        'requestFingerprint',
+    ]);
+    const actorMemberId = token(value, 'actorMemberId', isCollabMemberId);
+    const idempotencyKey = token(value, 'idempotencyKey');
+    const operation = literal(value, 'operation', [
+        'createManagerResponsibilityOffer',
+        'acknowledgeManagerResponsibility',
+        'declineManagerResponsibility',
+        'cancelManagerResponsibilityOffer',
+        'promoteManager',
+    ]);
+    if (recordId !== `${operation}:${actorMemberId}:${idempotencyKey}`) {
+        throw invalidPayload('recordId');
+    }
+    return {
+        kind: 'membership-idempotency-tombstone',
+        recordId,
+        revision,
+        value: {
+            actorMemberId,
+            compactedAt: timestamp(value, 'compactedAt'),
+            idempotencyKey,
+            operation,
+            projectId: token(value, 'projectId', isCollabProjectId),
+            requestFingerprint: sha256(value, 'requestFingerprint'),
+        },
+    };
+}
 function secretReplayTombstoneRecord(source, recordId, revision) {
     const value = exactRecord(source.value, 'value', [
         'actorMemberId',
@@ -1230,6 +1266,8 @@ function decodeContinuityRecord(kind, source, recordId, revision) {
             return protectedClaimOverrideEnvelopeRecord(source, recordId, revision);
         case 'manager-responsibility-offer':
             return managerResponsibilityOfferRecord(source, recordId, revision);
+        case 'membership-idempotency-tombstone':
+            return membershipIdempotencyTombstoneRecord(source, recordId, revision);
         case 'project-membership-recovery':
             return membershipRecoveryRecord(source, recordId, revision);
         case 'secret-replay-tombstone':
@@ -1399,6 +1437,7 @@ function validateContinuity(records) {
         item,
     ]));
     const managerOffers = records.filter((item) => (item.kind === 'manager-responsibility-offer'));
+    const membershipIdempotencyTombstones = records.filter((item) => (item.kind === 'membership-idempotency-tombstone'));
     const membershipRecoveries = new Map(records
         .filter((item) => (item.kind === 'project-membership-recovery'))
         .map(item => [item.value.operationId, item]));
@@ -1782,6 +1821,18 @@ function validateContinuity(records) {
             throw invalidPayload('records');
         }
     }
+    for (const tombstone of membershipIdempotencyTombstones) {
+        const exactResult = records.some(item => (item.kind === 'idempotency-result'
+            && item.value.memberId === tombstone.value.actorMemberId
+            && item.value.operation === tombstone.value.operation
+            && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        const exactOffer = tombstone.value.operation === 'createManagerResponsibilityOffer'
+            && managerOffers.some(item => (item.value.sourceManagerMemberId === tombstone.value.actorMemberId
+                && item.value.idempotencyKey === tombstone.value.idempotencyKey));
+        if (!members.has(tombstone.value.actorMemberId) || exactResult || exactOffer) {
+            throw invalidPayload('records');
+        }
+    }
     for (const item of records) {
         if (item.kind === 'idempotency-result' && !members.has(item.value.memberId)) {
             throw invalidPayload('records');
@@ -2059,6 +2110,9 @@ export function validateCollabProjectBackupCheckpointConsistency(manifest, recor
         if (item.kind === 'secret-replay-tombstone') {
             return Date.parse(item.value.expiredAt) > captureTime;
         }
+        if (item.kind === 'membership-idempotency-tombstone') {
+            return Date.parse(item.value.compactedAt) > captureTime;
+        }
         if (item.kind === 'project-invitation') {
             return captureTime < Date.parse(item.value.createdAt)
                 || (captureTime < Date.parse(item.value.secretReplayExpiresAt))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudian-collab/protocol",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Canonical Collab wire and Cloud binding contract for Claudian clients and servers.",
   "license": "MIT",
   "repository": {