@optimystic/db-core 0.13.5 → 0.14.0

package/dist/src/cluster/structs.d.ts

@@ -56,6 +56,19 @@ export interface ClusterConsensusConfig {
     disputeEnabled?: boolean;
     /** Timeout for dispute arbitration in milliseconds (default 60000) */
     disputeArbitrationTimeoutMs?: number;
+    /**
+     * Hard horizon on an invalidation cascade: maximum number of recursive re-evaluation rounds
+     * (dependency-graph depth) before the cascade stops and escalates the affected collection(s)
+     * for operator full re-sync (default 32). Bounds unbounded automatic reversal.
+     */
+    maxCascadeDepth?: number;
+    /**
+     * Hard horizon on an invalidation cascade: maximum number of transactions (including the root)
+     * the cascade may invalidate before it stops and escalates for operator full re-sync
+     * (default 1000). On overflow the already-applied invalidations stand; the remainder is flagged,
+     * never silently dropped.
+     */
+    maxCascadeTransactions?: number;
     /** Initial scheduled-retry interval for failed commit broadcasts, ms (default 250) */
     commitBroadcastRetryInitialMs?: number;
     /** Backoff factor for commit-broadcast scheduled retries (default 2) */

package/dist/src/cluster/structs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../src/cluster/structs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,MAAM,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IAC1B,CAAC,EAAE,EAAE,MAAM,GAAG;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,wDAAwD;QACxD,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;CACF,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,WAAW,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAC1C,OAAO,EAAE;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACzC,8FAA8F;IAC9F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,eAAe,CAAC,EAAE;QACjB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE;YAAE,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC;KAC5C,CAAC;CACF,CAAA;AAED,MAAM,WAAW,sBAAsB;IACtC,iEAAiE;IACjE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,uBAAuB,EAAE,MAAM,CAAC;IAChC,gDAAgD;IAChD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,0EAA0E;IAC1E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,wBAAwB,EAAE,MAAM,CAAC;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sEAAsE;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,sFAAsF;IACtF,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,wEAAwE;IACxE,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C,sDAAsD;IACtD,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C,gEAAgE;IAChE,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,iFAAiF;IACjF,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,gLAAgL;IAChL,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IAC7C,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gIAAgI;IAChI,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"structs.d.ts","sourceRoot":"","sources":["../../../src/cluster/structs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,MAAM,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IAC1B,CAAC,EAAE,EAAE,MAAM,GAAG;QACb,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,wDAAwD;QACxD,SAAS,EAAE,MAAM,CAAC;KAClB,CAAC;CACF,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,WAAW,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAC1C,OAAO,EAAE;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACzC,8FAA8F;IAC9F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,eAAe,CAAC,EAAE;QACjB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE;YAAE,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC;KAC5C,CAAC;CACF,CAAA;AAED,MAAM,WAAW,sBAAsB;IACtC,iEAAiE;IACjE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,uBAAuB,EAAE,MAAM,CAAC;IAChC,gDAAgD;IAChD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,oBAAoB,EAAE,OAAO,CAAC;IAC9B,0EAA0E;IAC1E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,wBAAwB,EAAE,MAAM,CAAC;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sEAAsE;IACtE,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,wEAAwE;IACxE,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C,sDAAsD;IACtD,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C,gEAAgE;IAChE,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,iFAAiF;IACjF,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,gLAAgL;IAChL,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;IAC7C,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gIAAgI;IAChI,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/src/cohort-topic/addressing.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Cohort-topic substrate — tier addressing (`coord_d`).
+ *
+ * Transcribed from `docs/cohort-topic.md` §Tier addressing:
+ *
+ * ```
+ * coord_0(_, topicId) = H(0x00 ‖ topicId)
+ * coord_d(P, topicId) = H(d ‖ prefix(P, d·log₂F) ‖ topicId)   for d ≥ 1
+ * ```
+ *
+ * `H` is the injected {@link IRingHash} (db-core's own SHA-256 truncated to the ring width — **not**
+ * a FRET import). `prefix(P, n)` is the `n` most-significant bits of peer id `P`, left-padded if
+ * shorter. `F` is the fan-out (default 16, `log₂F = 4`); tier `d` has exactly `F^d` coordinates.
+ *
+ * The db-p2p binding is responsible for ensuring the coord byte layout (ring width) matches FRET's
+ * `RING_BITS` so the routing keys produced here line up with FRET's ring on the wire.
+ */
+import type { IRingHash, RingCoord } from "./ports.js";
+/** Tier-addressing surface — derives the ring coordinate for tier `d` of a topic. */
+export interface TierAddressing {
+    /** Fan-out per tier (default 16). */
+    readonly F: number;
+    /** Tier-0 root coordinate: `H(0x00 ‖ topicId)`. Peer-independent. */
+    coord0(topicId: Uint8Array): RingCoord;
+    /** Tier-`d` coordinate for `d ≥ 1`: `H(d ‖ prefix(peerId, d·log₂F) ‖ topicId)`. */
+    coordD(d: number, peerId: Uint8Array, topicId: Uint8Array): RingCoord;
+    /** Dispatches `d === 0` to {@link coord0}, otherwise to {@link coordD}. */
+    coord(d: number, peerId: Uint8Array, topicId: Uint8Array): RingCoord;
+}
+/** Default fan-out per tier (`log₂16 = 4`). */
+export declare const DEFAULT_FANOUT = 16;
+/**
+ * `prefix(P, n)` — the `n` most-significant bits of `P`, packed MSB-first into `⌈n/8⌉` bytes with
+ * the trailing partial byte's unused low bits zeroed. If `P` carries fewer than `n` bits it is
+ * **left-padded**: the high `(n − bits(P))` positions are zero and `P`'s bits occupy the low end, so
+ * the result is always exactly `n` bits wide. `n === 0` yields an empty array (the tier-0 case).
+ *
+ * Exported for tests; not part of the public substrate surface.
+ */
+export declare function prefixBits(peerId: Uint8Array, n: number): Uint8Array;
+/** Implements {@link TierAddressing} over an injected {@link IRingHash}. */
+export declare class HashTierAddressing implements TierAddressing {
+    private readonly hash;
+    readonly F: number;
+    private readonly log2F;
+    constructor(hash: IRingHash, F?: number);
+    coord0(topicId: Uint8Array): RingCoord;
+    coordD(d: number, peerId: Uint8Array, topicId: Uint8Array): RingCoord;
+    coord(d: number, peerId: Uint8Array, topicId: Uint8Array): RingCoord;
+}
+/** Convenience factory mirroring the db-p2p adapter construction style. */
+export declare function createTierAddressing(hash: IRingHash, F?: number): TierAddressing;
+//# sourceMappingURL=addressing.d.ts.map

package/dist/src/cohort-topic/addressing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressing.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/addressing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvD,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;IACvC,mFAAmF;IACnF,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;IACtE,2EAA2E;IAC3E,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;CACrE;AAED,+CAA+C;AAC/C,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,GAAG,UAAU,CAiBpE;AAED,4EAA4E;AAC5E,qBAAa,kBAAmB,YAAW,cAAc;IAI5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,SAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEF,IAAI,EAAE,SAAS,EAAE,CAAC,GAAE,MAAuB;IAYxE,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS;IAQtC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS;IAgBrE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS;CAGpE;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAE,MAAuB,GAAG,cAAc,CAEhG"}

package/dist/src/cohort-topic/addressing.js

@@ -0,0 +1,95 @@
+/**
+ * Cohort-topic substrate — tier addressing (`coord_d`).
+ *
+ * Transcribed from `docs/cohort-topic.md` §Tier addressing:
+ *
+ * ```
+ * coord_0(_, topicId) = H(0x00 ‖ topicId)
+ * coord_d(P, topicId) = H(d ‖ prefix(P, d·log₂F) ‖ topicId)   for d ≥ 1
+ * ```
+ *
+ * `H` is the injected {@link IRingHash} (db-core's own SHA-256 truncated to the ring width — **not**
+ * a FRET import). `prefix(P, n)` is the `n` most-significant bits of peer id `P`, left-padded if
+ * shorter. `F` is the fan-out (default 16, `log₂F = 4`); tier `d` has exactly `F^d` coordinates.
+ *
+ * The db-p2p binding is responsible for ensuring the coord byte layout (ring width) matches FRET's
+ * `RING_BITS` so the routing keys produced here line up with FRET's ring on the wire.
+ */
+/** Default fan-out per tier (`log₂16 = 4`). */
+export const DEFAULT_FANOUT = 16;
+/**
+ * `prefix(P, n)` — the `n` most-significant bits of `P`, packed MSB-first into `⌈n/8⌉` bytes with
+ * the trailing partial byte's unused low bits zeroed. If `P` carries fewer than `n` bits it is
+ * **left-padded**: the high `(n − bits(P))` positions are zero and `P`'s bits occupy the low end, so
+ * the result is always exactly `n` bits wide. `n === 0` yields an empty array (the tier-0 case).
+ *
+ * Exported for tests; not part of the public substrate surface.
+ */
+export function prefixBits(peerId, n) {
+    if (!Number.isInteger(n) || n < 0) {
+        throw new RangeError(`prefix bit count must be a non-negative integer, got ${n}`);
+    }
+    const outBytes = Math.ceil(n / 8);
+    const out = new Uint8Array(outBytes);
+    const available = peerId.length * 8;
+    const pad = Math.max(0, n - available);
+    for (let j = 0; j < n; j++) {
+        // Result bit j (MSB-first). High `pad` positions are zero (left-pad); the rest map to P.
+        if (j < pad)
+            continue;
+        const srcBit = j - pad;
+        const srcByte = peerId[srcBit >>> 3];
+        const bit = (srcByte >>> (7 - (srcBit & 7))) & 1;
+        if (bit)
+            out[j >>> 3] |= 1 << (7 - (j & 7));
+    }
+    return out;
+}
+/** Implements {@link TierAddressing} over an injected {@link IRingHash}. */
+export class HashTierAddressing {
+    hash;
+    F;
+    log2F;
+    constructor(hash, F = DEFAULT_FANOUT) {
+        this.hash = hash;
+        if (!Number.isInteger(F) || F < 2) {
+            throw new RangeError(`fan-out F must be an integer ≥ 2, got ${F}`);
+        }
+        const log2F = Math.log2(F);
+        if (!Number.isInteger(log2F)) {
+            throw new RangeError(`fan-out F must be a power of two, got ${F}`);
+        }
+        this.F = F;
+        this.log2F = log2F;
+    }
+    coord0(topicId) {
+        // H(0x00 ‖ topicId)
+        const input = new Uint8Array(1 + topicId.length);
+        input[0] = 0x00;
+        input.set(topicId, 1);
+        return this.hash.H(input);
+    }
+    coordD(d, peerId, topicId) {
+        if (!Number.isInteger(d) || d < 1) {
+            throw new RangeError(`coordD requires an integer tier d ≥ 1, got ${d}`);
+        }
+        if (d > 255) {
+            throw new RangeError(`tier d must fit in one byte (≤ 255), got ${d}`);
+        }
+        // H(d ‖ prefix(peerId, d·log₂F) ‖ topicId)
+        const prefix = prefixBits(peerId, d * this.log2F);
+        const input = new Uint8Array(1 + prefix.length + topicId.length);
+        input[0] = d;
+        input.set(prefix, 1);
+        input.set(topicId, 1 + prefix.length);
+        return this.hash.H(input);
+    }
+    coord(d, peerId, topicId) {
+        return d === 0 ? this.coord0(topicId) : this.coordD(d, peerId, topicId);
+    }
+}
+/** Convenience factory mirroring the db-p2p adapter construction style. */
+export function createTierAddressing(hash, F = DEFAULT_FANOUT) {
+    return new HashTierAddressing(hash, F);
+}
+//# sourceMappingURL=addressing.js.map

package/dist/src/cohort-topic/addressing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressing.js","sourceRoot":"","sources":["../../../src/cohort-topic/addressing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,CAAS;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,wDAAwD,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,yFAAyF;QACzF,IAAI,CAAC,GAAG,GAAG;YAAE,SAAS;QACtB,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAE,CAAC;QACtC,MAAM,GAAG,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,GAAG;YAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,4EAA4E;AAC5E,MAAM,OAAO,kBAAkB;IAID;IAHb,CAAC,CAAS;IACT,KAAK,CAAS;IAE/B,YAA6B,IAAe,EAAE,IAAY,cAAc;QAA3C,SAAI,GAAJ,IAAI,CAAW;QAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,OAAmB;QACzB,oBAAoB;QACpB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAChB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,CAAS,EAAE,MAAkB,EAAE,OAAmB;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2CAA2C;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,CAAS,EAAE,MAAkB,EAAE,OAAmB;QACvD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;CACD;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,IAAe,EAAE,IAAY,cAAc;IAC/E,OAAO,IAAI,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/cohort-topic/antidos/bootstrap-evidence-envelope.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Cohort-topic substrate — bootstrap-evidence envelope (anti-DoS, crypto-free).
+ *
+ * The on-the-wire structure a participant attaches to a cold-start `bootstrap: true` register, and the
+ * byte-level canonicalization both sides agree on. This module owns only the **format** — the versioned
+ * envelope, the canonical anti-replay bound image, and the proof-of-work puzzle's preimage/difficulty.
+ * It embeds **no cryptography**: the actual PoW hashing, reputation-signature checks, and parent-topic
+ * verification live in db-p2p (which binds the node's `RingHash` and peer-key crypto). The sibling
+ * discipline of `wire/payloads.ts` / `sig/payloads.ts` — explicitly-ordered arrays, deterministic UTF-8
+ * JSON, base64url without padding — so a participant who *mints* evidence and a cohort that *verifies*
+ * it never re-canonicalize bytes independently.
+ *
+ * The envelope rides in the dedicated, signature-covered {@link RegisterV1.bootstrapEvidence} field
+ * (not `appPayload`). A verifier reads only the kind its tier accepts; an absent kind, a malformed
+ * envelope, or a wrong/future version all surface as "this kind not offered" (the parse is **total** —
+ * like `verifyPeerSig`, any decode error yields `undefined`, never a throw), so a verifier fails its
+ * check (→ `unwilling_cohort`) rather than crashing on attacker-supplied input.
+ */
+import type { RegisterV1 } from "../wire/types.js";
+/** Proof-of-work evidence (T2/T3 path). `nonce` is base64url, bound via {@link powPreimage}. */
+export interface PowEvidenceV1 {
+    /** Base64url nonce; `hash(powPreimage(reg, nonce))` must satisfy {@link meetsDifficulty}. */
+    nonce: string;
+}
+/** Signed parent-topic reference (all tiers). Both base64url; `sig` is over {@link parentRefSigningImage}. */
+export interface ParentRefEvidenceV1 {
+    /** The committed parent topic id, base64url. */
+    parentTopicId: string;
+    /** Participant peer-key signature over {@link parentRefSigningImage} (the bound tuple extended with `parentTopicId`), base64url. */
+    sig: string;
+}
+/**
+ * Reputation endorsement (T2/T3 path). `referee` is the endorsing peer-id-string bytes (base64url) and
+ * `sig` is that referee's peer-key signature over the bound image. The referee MAY equal the
+ * participant (a reputable participant self-vouches).
+ */
+export interface ReputationEvidenceV1 {
+    /** Endorsing peer-id-string bytes, base64url. */
+    referee: string;
+    /** Referee's peer-key signature over the bound image, base64url. */
+    sig: string;
+}
+/** V1 bootstrap-evidence envelope, base64url-encoded into {@link RegisterV1.bootstrapEvidence}. */
+export interface BootstrapEvidenceEnvelopeV1 {
+    v: 1;
+    /** Proof-of-work (T2/T3 path). Absent → no PoW offered. */
+    pow?: PowEvidenceV1;
+    /** Signed parent-topic reference (all tiers). Absent → none offered. */
+    parentRef?: ParentRefEvidenceV1;
+    /** Reputation endorsement (T2/T3 path). Absent → none offered. */
+    reputation?: ReputationEvidenceV1;
+}
+/**
+ * The four register fields every bootstrap-evidence kind is bound to (the anti-replay tuple). The full
+ * {@link RegisterV1} satisfies this, so a verifier passes its decoded register directly; the
+ * participant-side builder passes just these fields (it has no full register yet).
+ */
+export type BootstrapBoundFields = Pick<RegisterV1, "topicId" | "tier" | "participantCoord" | "timestamp">;
+/** Default PoW difficulty: leading zero bits required. ~2^bits hashes to mint, one hash to verify. */
+export declare const DEFAULT_POW_DIFFICULTY_BITS = 20;
+/**
+ * The canonical bytes every bootstrap-evidence kind is bound to: `(topicId, tier, participantCoord,
+ * timestamp)`. `topicId`/`participantCoord` are bound as their base64url wire strings verbatim (matching
+ * `sig/payloads.ts`) so signer and verifier never re-canonicalize bytes independently. Binding all four
+ * means evidence minted for one (topic, tier, peer, time) cannot be replayed for another; binding
+ * `timestamp` additionally bounds a captured proof's reuse window, since the register replay guard drops
+ * a `timestamp` older than its acceptance window.
+ */
+export declare function bootstrapBoundImage(reg: BootstrapBoundFields): Uint8Array;
+/**
+ * The canonical bytes a **signed parent-topic reference** binds: the {@link bootstrapBoundImage} tuple
+ * `(topicId, tier, participantCoord, timestamp)` **extended with the referenced `parentTopicId`**, under a
+ * distinct discriminator tag (`"BootstrapParentRefV1"`). Extending the image with `parentTopicId` means a
+ * reference minted for one `(topic, tier, peer, time, parent)` cannot be lifted onto another register —
+ * including onto a register naming a *different* parent; the distinct tag keeps it from colliding with a
+ * {@link bootstrapBoundImage} reputation/PoW signature (domain separation). `topicId`/`participantCoord`/
+ * `parentTopicId` are bound as their base64url wire strings verbatim, like {@link bootstrapBoundImage}, so
+ * the participant who *signs* the reference and the cohort that *verifies* it never re-canonicalize bytes.
+ */
+export declare function parentRefSigningImage(reg: BootstrapBoundFields, parentTopicId: string): Uint8Array;
+/**
+ * The proof-of-work hash preimage: {@link bootstrapBoundImage} concatenated with `nonce`. db-p2p hashes
+ * this (via the node's `RingHash`) and checks the digest against {@link meetsDifficulty}. Bound to the
+ * register tuple ⇒ no cross-topic / cross-peer replay; cheap to verify (one hash + bit check), tunably
+ * costly to produce.
+ */
+export declare function powPreimage(reg: BootstrapBoundFields, nonce: Uint8Array): Uint8Array;
+/**
+ * True iff the first `bits` most-significant bits of `hash` are zero (the PoW difficulty target). Bits
+ * are read MSB-first per byte (mirroring `addressing.ts`'s `prefixBits`). `bits = 0` is trivially met
+ * (lets a config disable PoW cost for tests); a non-finite `bits` is a guard-failure (never met); a
+ * negative `bits` clamps to 0; `bits` larger than `hash.length * 8` requires every bit of `hash` to be
+ * zero and so is effectively unsatisfiable for a random hash.
+ */
+export declare function meetsDifficulty(hash: Uint8Array, bits: number): boolean;
+/** Serialize an envelope to the base64url JSON string carried in {@link RegisterV1.bootstrapEvidence}. */
+export declare function serializeBootstrapEvidenceEnvelope(env: BootstrapEvidenceEnvelopeV1): string;
+/**
+ * Decode {@link RegisterV1.bootstrapEvidence} (base64url → JSON), structurally validate it, and return
+ * the {@link BootstrapEvidenceEnvelopeV1}. **Total**: returns `undefined` on an absent/empty field, a
+ * non-base64url or non-JSON body, a wrong/future `v`, or a structurally-invalid kind — never throws. A
+ * verifier treats `undefined` as "this kind not offered" and fails its check (fails closed).
+ */
+export declare function parseBootstrapEvidenceEnvelope(reg: Pick<RegisterV1, "bootstrapEvidence">): BootstrapEvidenceEnvelopeV1 | undefined;
+//# sourceMappingURL=bootstrap-evidence-envelope.d.ts.map

package/dist/src/cohort-topic/antidos/bootstrap-evidence-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence-envelope.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC7B,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;CACd;AAED,8GAA8G;AAC9G,MAAM,WAAW,mBAAmB;IACnC,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,oIAAoI;IACpI,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,mGAAmG;AACnG,MAAM,WAAW,2BAA2B;IAC3C,CAAC,EAAE,CAAC,CAAC;IACL,2DAA2D;IAC3D,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,kEAAkE;IAClE,UAAU,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,MAAM,GAAG,kBAAkB,GAAG,WAAW,CAAC,CAAC;AAE3G,sGAAsG;AACtG,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,GAAG,UAAU,CAQzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,GAAG,UAAU,CASlG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAMpF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BvE;AAED,0GAA0G;AAC1G,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,2BAA2B,GAAG,MAAM,CAc3F;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAAG,2BAA2B,GAAG,SAAS,CAYlI"}

package/dist/src/cohort-topic/antidos/bootstrap-evidence-envelope.js

@@ -0,0 +1,197 @@
+/**
+ * Cohort-topic substrate — bootstrap-evidence envelope (anti-DoS, crypto-free).
+ *
+ * The on-the-wire structure a participant attaches to a cold-start `bootstrap: true` register, and the
+ * byte-level canonicalization both sides agree on. This module owns only the **format** — the versioned
+ * envelope, the canonical anti-replay bound image, and the proof-of-work puzzle's preimage/difficulty.
+ * It embeds **no cryptography**: the actual PoW hashing, reputation-signature checks, and parent-topic
+ * verification live in db-p2p (which binds the node's `RingHash` and peer-key crypto). The sibling
+ * discipline of `wire/payloads.ts` / `sig/payloads.ts` — explicitly-ordered arrays, deterministic UTF-8
+ * JSON, base64url without padding — so a participant who *mints* evidence and a cohort that *verifies*
+ * it never re-canonicalize bytes independently.
+ *
+ * The envelope rides in the dedicated, signature-covered {@link RegisterV1.bootstrapEvidence} field
+ * (not `appPayload`). A verifier reads only the kind its tier accepts; an absent kind, a malformed
+ * envelope, or a wrong/future version all surface as "this kind not offered" (the parse is **total** —
+ * like `verifyPeerSig`, any decode error yields `undefined`, never a throw), so a verifier fails its
+ * check (→ `unwilling_cohort`) rather than crashing on attacker-supplied input.
+ */
+import { b64urlToBytes, bytesToB64url } from "../wire/codec.js";
+const utf8 = new TextEncoder();
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+/** Default PoW difficulty: leading zero bits required. ~2^bits hashes to mint, one hash to verify. */
+export const DEFAULT_POW_DIFFICULTY_BITS = 20;
+/**
+ * The canonical bytes every bootstrap-evidence kind is bound to: `(topicId, tier, participantCoord,
+ * timestamp)`. `topicId`/`participantCoord` are bound as their base64url wire strings verbatim (matching
+ * `sig/payloads.ts`) so signer and verifier never re-canonicalize bytes independently. Binding all four
+ * means evidence minted for one (topic, tier, peer, time) cannot be replayed for another; binding
+ * `timestamp` additionally bounds a captured proof's reuse window, since the register replay guard drops
+ * a `timestamp` older than its acceptance window.
+ */
+export function bootstrapBoundImage(reg) {
+    return utf8.encode(JSON.stringify([
+        "BootstrapEvidenceV1",
+        reg.topicId,
+        reg.tier,
+        reg.participantCoord,
+        reg.timestamp,
+    ]));
+}
+/**
+ * The canonical bytes a **signed parent-topic reference** binds: the {@link bootstrapBoundImage} tuple
+ * `(topicId, tier, participantCoord, timestamp)` **extended with the referenced `parentTopicId`**, under a
+ * distinct discriminator tag (`"BootstrapParentRefV1"`). Extending the image with `parentTopicId` means a
+ * reference minted for one `(topic, tier, peer, time, parent)` cannot be lifted onto another register —
+ * including onto a register naming a *different* parent; the distinct tag keeps it from colliding with a
+ * {@link bootstrapBoundImage} reputation/PoW signature (domain separation). `topicId`/`participantCoord`/
+ * `parentTopicId` are bound as their base64url wire strings verbatim, like {@link bootstrapBoundImage}, so
+ * the participant who *signs* the reference and the cohort that *verifies* it never re-canonicalize bytes.
+ */
+export function parentRefSigningImage(reg, parentTopicId) {
+    return utf8.encode(JSON.stringify([
+        "BootstrapParentRefV1",
+        reg.topicId,
+        reg.tier,
+        reg.participantCoord,
+        reg.timestamp,
+        parentTopicId,
+    ]));
+}
+/**
+ * The proof-of-work hash preimage: {@link bootstrapBoundImage} concatenated with `nonce`. db-p2p hashes
+ * this (via the node's `RingHash`) and checks the digest against {@link meetsDifficulty}. Bound to the
+ * register tuple ⇒ no cross-topic / cross-peer replay; cheap to verify (one hash + bit check), tunably
+ * costly to produce.
+ */
+export function powPreimage(reg, nonce) {
+    const image = bootstrapBoundImage(reg);
+    const out = new Uint8Array(image.length + nonce.length);
+    out.set(image, 0);
+    out.set(nonce, image.length);
+    return out;
+}
+/**
+ * True iff the first `bits` most-significant bits of `hash` are zero (the PoW difficulty target). Bits
+ * are read MSB-first per byte (mirroring `addressing.ts`'s `prefixBits`). `bits = 0` is trivially met
+ * (lets a config disable PoW cost for tests); a non-finite `bits` is a guard-failure (never met); a
+ * negative `bits` clamps to 0; `bits` larger than `hash.length * 8` requires every bit of `hash` to be
+ * zero and so is effectively unsatisfiable for a random hash.
+ */
+export function meetsDifficulty(hash, bits) {
+    if (!Number.isFinite(bits)) {
+        return false; // NaN / ±Infinity → defensive guard, never satisfiable
+    }
+    let remaining = Math.floor(bits);
+    if (remaining <= 0) {
+        return true; // 0 (or clamped-negative) leading zero bits is trivially met
+    }
+    for (let i = 0; i < hash.length && remaining > 0; i++) {
+        const byte = hash[i];
+        if (remaining >= 8) {
+            if (byte !== 0) {
+                return false;
+            }
+            remaining -= 8;
+        }
+        else {
+            // Check only the top `remaining` MSBs of this partial final byte (MSB-first).
+            const mask = (0xff << (8 - remaining)) & 0xff;
+            if ((byte & mask) !== 0) {
+                return false;
+            }
+            remaining = 0;
+        }
+    }
+    // Exhausted the hash before satisfying `bits` (oversize target) → unsatisfiable.
+    return remaining === 0;
+}
+/** Serialize an envelope to the base64url JSON string carried in {@link RegisterV1.bootstrapEvidence}. */
+export function serializeBootstrapEvidenceEnvelope(env) {
+    // Rebuild in a fixed field order so serialization is a pure function of the logical content
+    // (serialize∘parse is stable regardless of how a caller ordered the source object's keys).
+    const out = { v: 1 };
+    if (env.pow !== undefined) {
+        out.pow = { nonce: env.pow.nonce };
+    }
+    if (env.parentRef !== undefined) {
+        out.parentRef = { parentTopicId: env.parentRef.parentTopicId, sig: env.parentRef.sig };
+    }
+    if (env.reputation !== undefined) {
+        out.reputation = { referee: env.reputation.referee, sig: env.reputation.sig };
+    }
+    return bytesToB64url(utf8.encode(JSON.stringify(out)));
+}
+/**
+ * Decode {@link RegisterV1.bootstrapEvidence} (base64url → JSON), structurally validate it, and return
+ * the {@link BootstrapEvidenceEnvelopeV1}. **Total**: returns `undefined` on an absent/empty field, a
+ * non-base64url or non-JSON body, a wrong/future `v`, or a structurally-invalid kind — never throws. A
+ * verifier treats `undefined` as "this kind not offered" and fails its check (fails closed).
+ */
+export function parseBootstrapEvidenceEnvelope(reg) {
+    const raw = reg.bootstrapEvidence;
+    if (raw === undefined || raw === "") {
+        return undefined; // not offered
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(utf8Decoder.decode(b64urlToBytes(raw)));
+    }
+    catch {
+        return undefined; // not base64url / not UTF-8 / not JSON → fail closed
+    }
+    return narrowEnvelope(parsed);
+}
+/** Structurally narrow an already-parsed value to a v1 envelope, or `undefined`. */
+function narrowEnvelope(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const obj = value;
+    if (obj["v"] !== 1) {
+        return undefined; // wrong / future version → fail closed under the v1 reader
+    }
+    const out = { v: 1 };
+    if (obj["pow"] !== undefined) {
+        const nonce = b64urlSubfield(obj["pow"], "nonce");
+        if (nonce === undefined) {
+            return undefined;
+        }
+        out.pow = { nonce };
+    }
+    if (obj["parentRef"] !== undefined) {
+        const parentTopicId = b64urlSubfield(obj["parentRef"], "parentTopicId");
+        const sig = b64urlSubfield(obj["parentRef"], "sig");
+        if (parentTopicId === undefined || sig === undefined) {
+            return undefined;
+        }
+        out.parentRef = { parentTopicId, sig };
+    }
+    if (obj["reputation"] !== undefined) {
+        const referee = b64urlSubfield(obj["reputation"], "referee");
+        const sig = b64urlSubfield(obj["reputation"], "sig");
+        if (referee === undefined || sig === undefined) {
+            return undefined;
+        }
+        out.reputation = { referee, sig };
+    }
+    return out;
+}
+/** A required base64url sub-field: a non-empty string that decodes cleanly, else `undefined`. */
+function b64urlSubfield(container, key) {
+    if (typeof container !== "object" || container === null || Array.isArray(container)) {
+        return undefined;
+    }
+    const value = container[key];
+    if (typeof value !== "string" || value === "") {
+        return undefined; // missing, non-string, or empty → treat as absent
+    }
+    try {
+        b64urlToBytes(value); // structural: must decode as base64url
+    }
+    catch {
+        return undefined;
+    }
+    return value;
+}
+//# sourceMappingURL=bootstrap-evidence-envelope.js.map

package/dist/src/cohort-topic/antidos/bootstrap-evidence-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence-envelope.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGhE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAC/B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AA8C9D,sGAAsG;AACtG,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAyB;IAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,qBAAqB;QACrB,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,SAAS;KACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAyB,EAAE,aAAqB;IACrF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,sBAAsB;QACtB,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,SAAS;QACb,aAAa;KACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAyB,EAAE,KAAiB;IACvE,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB,EAAE,IAAY;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,CAAC,uDAAuD;IACtE,CAAC;IACD,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,CAAC,6DAA6D;IAC3E,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACd,CAAC;YACD,SAAS,IAAI,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACP,8EAA8E;YAC9E,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACd,CAAC;YACD,SAAS,GAAG,CAAC,CAAC;QACf,CAAC;IACF,CAAC;IACD,iFAAiF;IACjF,OAAO,SAAS,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,kCAAkC,CAAC,GAAgC;IAClF,4FAA4F;IAC5F,2FAA2F;IAC3F,MAAM,GAAG,GAAgC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAClD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,UAAU,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAA0C;IACxF,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC,CAAC,cAAc;IACjC,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC,CAAC,qDAAqD;IACxE,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC,CAAC,2DAA2D;IAC9E,CAAC;IACD,MAAM,GAAG,GAAgC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAElD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,aAAa,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,SAAS,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,SAAkB,EAAE,GAAW;IACtD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAI,SAAqC,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC,CAAC,kDAAkD;IACrE,CAAC;IACD,IAAI,CAAC;QACJ,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,uCAAuC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/src/cohort-topic/antidos/bootstrap-evidence.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Cohort-topic substrate — bootstrap evidence policy (anti-DoS).
+ *
+ * Transcribed from `docs/cohort-topic.md` §Anti-DoS bullet 4. A cold root that accepts a
+ * `bootstrap: true` registration must demand evidence, so a cold topic cannot be instantiated for
+ * free by an attacker. The accepted evidence is **tier-dependent**:
+ *
+ * - **T0 / T1** — generally no proof-of-work, because these tiers correspond to committed work; a
+ *   *signed reference to a committed parent topic that does exist* is sufficient.
+ * - **T2 / T3** — a **proof-of-work** OR a **reputation-score signature** (a signature from a peer
+ *   with sufficient reputation, see `architecture.md` §Reputation) OR a **signed parent-topic
+ *   reference**.
+ *
+ * This module is the *policy* — which evidence kinds satisfy which tier. The cryptographic checks
+ * themselves (verifying a PoW, a reputation signature, a parent-topic reference) are injected, keeping
+ * db-core free of any specific PoW/reputation scheme (the same injection discipline as the threshold
+ * crypto port). The evidence travels in the registration's dedicated, signature-covered
+ * `bootstrapEvidence` field — a versioned `BootstrapEvidenceEnvelopeV1`
+ * (`./bootstrap-evidence-envelope.js`), parsed crypto-free here and checked by the injected verifiers;
+ * NOT the opaque `appPayload` slot (which the cohort copies verbatim into the registration's appState).
+ * A registration that is not a bootstrap needs no evidence and is admitted.
+ */
+import type { RegisterV1 } from "../wire/types.js";
+/** Tiers at/below this need no proof-of-work — a signed parent reference suffices (T0/T1). */
+export declare const DEFAULT_MAX_NO_POW_TIER = 1;
+export interface BootstrapEvidenceDeps {
+    /** Verify a proof-of-work attached to `reg` (T2/T3 path). Absent → PoW is never satisfiable. */
+    verifyPoW?: (reg: RegisterV1) => boolean;
+    /** Verify a sufficient-reputation signature on `reg` (T2/T3 path). Absent → never satisfiable. */
+    verifyReputation?: (reg: RegisterV1) => boolean;
+    /** Verify a signed reference to an existing committed parent topic (all tiers). Absent → never satisfiable. */
+    verifyParentReference?: (reg: RegisterV1) => boolean;
+    config?: BootstrapEvidenceConfig;
+}
+export interface BootstrapEvidenceConfig {
+    /** Highest tier exempt from proof-of-work (T0/T1 → 1). Default {@link DEFAULT_MAX_NO_POW_TIER}. */
+    maxNoPowTier?: number;
+}
+/** Tier-dependent bootstrap-evidence gate for cold-root registrations. */
+export interface BootstrapEvidence {
+    /**
+     * Whether `reg` carries acceptable bootstrap evidence for `tier`. A non-bootstrap registration is
+     * always acceptable (nothing to prove). For a bootstrap: T0/T1 require a signed parent reference;
+     * T2/T3 accept proof-of-work OR a reputation signature OR a signed parent reference.
+     */
+    verify(reg: RegisterV1, tier: number): boolean;
+}
+/** Build a {@link BootstrapEvidence} policy over the injected (db-p2p-supplied) evidence verifiers. */
+export declare function createBootstrapEvidence(deps?: BootstrapEvidenceDeps): BootstrapEvidence;
+//# sourceMappingURL=bootstrap-evidence.d.ts.map

package/dist/src/cohort-topic/antidos/bootstrap-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,MAAM,WAAW,qBAAqB;IACrC,gGAAgG;IAChG,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IACzC,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IAChD,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC;IACrD,MAAM,CAAC,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACvC,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/C;AAoCD,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,qBAA0B,GAAG,iBAAiB,CAE3F"}

package/dist/src/cohort-topic/antidos/bootstrap-evidence.js

@@ -0,0 +1,62 @@
+/**
+ * Cohort-topic substrate — bootstrap evidence policy (anti-DoS).
+ *
+ * Transcribed from `docs/cohort-topic.md` §Anti-DoS bullet 4. A cold root that accepts a
+ * `bootstrap: true` registration must demand evidence, so a cold topic cannot be instantiated for
+ * free by an attacker. The accepted evidence is **tier-dependent**:
+ *
+ * - **T0 / T1** — generally no proof-of-work, because these tiers correspond to committed work; a
+ *   *signed reference to a committed parent topic that does exist* is sufficient.
+ * - **T2 / T3** — a **proof-of-work** OR a **reputation-score signature** (a signature from a peer
+ *   with sufficient reputation, see `architecture.md` §Reputation) OR a **signed parent-topic
+ *   reference**.
+ *
+ * This module is the *policy* — which evidence kinds satisfy which tier. The cryptographic checks
+ * themselves (verifying a PoW, a reputation signature, a parent-topic reference) are injected, keeping
+ * db-core free of any specific PoW/reputation scheme (the same injection discipline as the threshold
+ * crypto port). The evidence travels in the registration's dedicated, signature-covered
+ * `bootstrapEvidence` field — a versioned `BootstrapEvidenceEnvelopeV1`
+ * (`./bootstrap-evidence-envelope.js`), parsed crypto-free here and checked by the injected verifiers;
+ * NOT the opaque `appPayload` slot (which the cohort copies verbatim into the registration's appState).
+ * A registration that is not a bootstrap needs no evidence and is admitted.
+ */
+import { createLogger } from "../../logger.js";
+const log = createLogger("cohort-topic:antidos");
+/** Tiers at/below this need no proof-of-work — a signed parent reference suffices (T0/T1). */
+export const DEFAULT_MAX_NO_POW_TIER = 1;
+class TieredBootstrapEvidence {
+    maxNoPowTier;
+    verifyPoW;
+    verifyReputation;
+    verifyParentReference;
+    constructor(deps = {}) {
+        this.maxNoPowTier = deps.config?.maxNoPowTier ?? DEFAULT_MAX_NO_POW_TIER;
+        this.verifyPoW = deps.verifyPoW ?? (() => false);
+        this.verifyReputation = deps.verifyReputation ?? (() => false);
+        this.verifyParentReference = deps.verifyParentReference ?? (() => false);
+    }
+    verify(reg, tier) {
+        if (reg.bootstrap !== true) {
+            return true; // only a cold-root bootstrap must carry evidence
+        }
+        if (tier <= this.maxNoPowTier) {
+            // T0/T1: a signed reference to a committed parent topic is sufficient (no PoW expected).
+            const ok = this.verifyParentReference(reg);
+            if (!ok) {
+                log("bootstrap-evidence reject: tier=%d needs a signed parent reference", tier);
+            }
+            return ok;
+        }
+        // T2/T3: any one of PoW, a reputation signature, or a signed parent reference.
+        const ok = this.verifyPoW(reg) || this.verifyReputation(reg) || this.verifyParentReference(reg);
+        if (!ok) {
+            log("bootstrap-evidence reject: tier=%d needs PoW / reputation / parent reference", tier);
+        }
+        return ok;
+    }
+}
+/** Build a {@link BootstrapEvidence} policy over the injected (db-p2p-supplied) evidence verifiers. */
+export function createBootstrapEvidence(deps = {}) {
+    return new TieredBootstrapEvidence(deps);
+}
+//# sourceMappingURL=bootstrap-evidence.js.map

package/dist/src/cohort-topic/antidos/bootstrap-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence.js","sourceRoot":"","sources":["../../../../src/cohort-topic/antidos/bootstrap-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AA2BzC,MAAM,uBAAuB;IACX,YAAY,CAAS;IACrB,SAAS,CAA+B;IACxC,gBAAgB,CAA+B;IAC/C,qBAAqB,CAA+B;IAErE,YAAY,OAA8B,EAAE;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,IAAI,uBAAuB,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAY,EAAE,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,GAAe,EAAE,IAAY;QACnC,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAC/D,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,yFAAyF;YACzF,MAAM,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACT,GAAG,CAAC,oEAAoE,EAAE,IAAI,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,EAAE,CAAC;QACX,CAAC;QACD,+EAA+E;QAC/E,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,GAAG,CAAC,8EAA8E,EAAE,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,CAAC;IACX,CAAC;CACD;AAED,uGAAuG;AACvG,MAAM,UAAU,uBAAuB,CAAC,OAA8B,EAAE;IACvE,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/cohort-topic/antidos/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./rate-limiter.js";
+export * from "./topic-budget.js";
+export * from "./replay-guard.js";
+export * from "./bootstrap-evidence.js";
+export * from "./bootstrap-evidence-envelope.js";
+//# sourceMappingURL=index.d.ts.map