@optimystic/db-core 0.13.5 → 0.14.0

package/dist/src/cohort-topic/wire/payloads.js

@@ -0,0 +1,102 @@
+/**
+ * Cohort-topic substrate — canonical participant-signature payloads.
+ *
+ * A participant peer-key-signs its outbound `RegisterV1` / `RenewV1` bodies (db-p2p supplies the
+ * libp2p peer key); a cohort member recomputes the identical byte image to verify that signature
+ * before admitting a register (anti-DoS) or honoring a crash-failover `reattach` attestation (so a
+ * stray/MITM'd ping cannot usurp a live primary — `docs/cohort-topic.md` §TTL and renewal).
+ *
+ * Signer and verifier must agree byte-for-byte. Exactly like {@link import("../sig/payloads.js")}
+ * for the threshold-signed notices, determinism comes from encoding an explicitly-ordered JSON
+ * array (array order is stable, unlike object key order) as UTF-8 — never the `signature` envelope.
+ * Optional fields are normalized to a fixed placeholder (`bootstrap`→`false`, `probe`→`false`,
+ * `appPayload`→`null`, `bootstrapEvidence`→`null` with an empty string treated as absent,
+ * `reattach`→`false`, `withdraw`→`false`) so an absent optional and a present-but-default optional can
+ * never disagree across the wire round-trip.
+ */
+const utf8 = new TextEncoder();
+/** Normalize the optional bootstrap-evidence slot: absent and empty-string both map to `null`. */
+function normalizeEvidence(bootstrapEvidence) {
+    return bootstrapEvidence === undefined || bootstrapEvidence === "" ? null : bootstrapEvidence;
+}
+/** Canonical signed byte image of a `RegisterV1` body (every field except `signature`). */
+export function registerSigningPayload(body) {
+    return utf8.encode(JSON.stringify([
+        "RegisterV1",
+        body.v,
+        body.topicId,
+        body.tier,
+        body.treeTier,
+        body.participantCoord,
+        body.ttl,
+        body.bootstrap ?? false,
+        body.appPayload ?? null,
+        normalizeEvidence(body.bootstrapEvidence),
+        body.timestamp,
+        body.correlationId,
+        // A read-only probe signs `probe: true`; a normal register signs `false`. Both sides recompute
+        // this image identically, so a probe and a register over the same fields produce distinct signatures.
+        body.probe ?? false,
+    ]));
+}
+/** Canonical signed byte image of a `RenewV1` body (every field except `signature`). */
+export function renewSigningPayload(body) {
+    return utf8.encode(JSON.stringify([
+        "RenewV1",
+        body.v,
+        body.topicId,
+        body.participantId,
+        body.correlationId,
+        body.timestamp,
+        body.reattach ?? false,
+        // A withdraw tombstone signs `withdraw: true`, a ping/reattach signs `false`. Strictly appended
+        // (array length 7→8) so the reattach-vs-ping distinction is preserved and a third party cannot
+        // evict someone else's registration. Signer (participant) + verifier (db-p2p) move together; no
+        // signatures are persisted, so there is no cross-version concern.
+        body.withdraw ?? false,
+    ]));
+}
+/**
+ * Canonical signed byte image of a `CohortGossipV1` (every field except `signature`). Intra-cohort
+ * gossip is peer-key-signed by the originating member so a receiver can drop a frame whose `fromMember`
+ * signature does not verify or that comes from a non-cohort member (it can never spoof willingness/load
+ * or replicate forged records). Like the other payload helpers, determinism comes from an
+ * explicitly-ordered array — nested records/summaries/evictions are emitted as fixed ordered tuples so
+ * the signer and the receiver (which re-derives this image from the validated frame) agree byte-for-byte.
+ * Absent optionals (`records`/`evicted`) normalize to `[]`, and `appState` to `null`.
+ */
+export function cohortGossipSigningPayload(g) {
+    return utf8.encode(JSON.stringify([
+        "CohortGossipV1",
+        g.v,
+        g.fromMember,
+        g.coord,
+        g.cohortEpoch,
+        g.willingnessBits,
+        g.loadBuckets,
+        g.windowSeconds,
+        g.topicSummaries.map((s) => [
+            s.topicId,
+            s.tier,
+            s.directParticipants,
+            s.arrivalsPerMin,
+            s.queriesPerMin,
+            s.promoted,
+            s.childCohortCount,
+        ]),
+        (g.records ?? []).map((r) => [
+            r.topicId,
+            r.participantId,
+            r.tier,
+            r.primary,
+            r.backups,
+            r.attachedAt,
+            r.lastPing,
+            r.ttl,
+            r.appState ?? null,
+        ]),
+        (g.evicted ?? []).map((e) => [e.topicId, e.participantId]),
+        g.timestamp,
+    ]));
+}
+//# sourceMappingURL=payloads.js.map

package/dist/src/cohort-topic/wire/payloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payloads.js","sourceRoot":"","sources":["../../../../src/cohort-topic/wire/payloads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAQ/B,kGAAkG;AAClG,SAAS,iBAAiB,CAAC,iBAAqC;IAC/D,OAAO,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAC/F,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,IAAsB;IAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,YAAY;QACZ,IAAI,CAAC,CAAC;QACN,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,gBAAgB;QACrB,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,SAAS,IAAI,KAAK;QACvB,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACzC,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,aAAa;QAClB,+FAA+F;QAC/F,sGAAsG;QACtG,IAAI,CAAC,KAAK,IAAI,KAAK;KACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACtD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,SAAS;QACT,IAAI,CAAC,CAAC;QACN,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,SAAS;QACd,IAAI,CAAC,QAAQ,IAAI,KAAK;QACtB,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,kEAAkE;QAClE,IAAI,CAAC,QAAQ,IAAI,KAAK;KACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,CAAuB;IACjE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,gBAAgB;QAChB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC3B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,gBAAgB;SAClB,CAAC;QACF,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,QAAQ,IAAI,IAAI;SAClB,CAAC;QACF,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QAC1D,CAAC,CAAC,SAAS;KACX,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/cohort-topic/wire/types.d.ts

@@ -0,0 +1,304 @@
+/**
+ * Cohort-topic substrate — V1 wire message types.
+ *
+ * Transcribed from `docs/cohort-topic.md` §Wire formats. These interfaces are the canonical
+ * on-the-wire shapes for the cohort-topic RPC surface; the codec in `./codec.ts` serializes
+ * them as length-prefixed UTF-8 JSON.
+ *
+ * Conventions (mandated by §Wire formats):
+ * - Every byte-typed field is carried as a base64url string (no padding) — never raw bytes.
+ * - Every timestamp is unix milliseconds.
+ * - `appPayload` is an opaque base64url string carrying application-defined bytes. The wire layer
+ *   never interprets it; reactivity / matchmaking define their own structures and serialize them
+ *   into this slot.
+ */
+/** Registration request. Walks toward the root via FRET `RouteAndMaybeAct`. */
+export interface RegisterV1 {
+    v: 1;
+    /** Topic id, 32 bytes, base64url. */
+    topicId: string;
+    /** Tier, 0..3. */
+    tier: number;
+    /** Current walk position `d`. */
+    treeTier: number;
+    /** Participant's ring coord, 32 bytes, base64url. */
+    participantCoord: string;
+    /** Registration TTL in ms (default 90000; Edge 60000). */
+    ttl: number;
+    /** True on a root cold-start request. */
+    bootstrap?: boolean;
+    /**
+     * Read-only lookup probe: classify + return the cohort snapshot without admitting (no record, no
+     * arrival, no promotion trigger, no topic-budget touch, and **never** a cold-start instantiation /
+     * `bootstrap`). A probe walks to the responsible cohort exactly as a register does and resolves the
+     * same {@link RegisterReplyV1} (`no_state` cold, `promoted` redirected, `accepted` snapshot served),
+     * but the terminal member action is the read-only {@link RegisterReplyV1} classify rather than an
+     * admission. Drives {@link import("../service.js").CohortTopicService.lookup}. Mutually exclusive with
+     * `bootstrap` (the walk never sets `bootstrap` on a probe).
+     */
+    probe?: boolean;
+    /** Opaque application-defined bytes, base64url. */
+    appPayload?: string;
+    /**
+     * Cold-start bootstrap-evidence envelope, base64url (a `BootstrapEvidenceEnvelopeV1` — see
+     * `../antidos/bootstrap-evidence-envelope.js`). Present only on a `bootstrap: true` root register;
+     * carries the tier-dependent proof a cold root demands (proof-of-work / reputation endorsement /
+     * signed parent reference — §Anti-DoS). This is a **dedicated** field, NOT `appPayload`: the cohort
+     * copies `appPayload` verbatim into the registration's `appState` and replicates it cluster-wide,
+     * whereas the bootstrap evidence is parsed-and-checked by the substrate, **covered by `signature`**
+     * (so a MITM cannot strip or swap it), and never stored as appState. Empty string is treated as
+     * absent (it normalizes to the same signed-image placeholder as an absent field).
+     */
+    bootstrapEvidence?: string;
+    /** Unix ms. */
+    timestamp: number;
+    /** 16 random bytes, base64url. */
+    correlationId: string;
+    /** Participant peer-key signature, base64url. */
+    signature: string;
+}
+export type RegisterResult = "accepted" | "no_state" | "promoted" | "unwilling_member" | "unwilling_cohort";
+/** Registration reply. Field presence is keyed by {@link RegisterResult}. */
+export interface RegisterReplyV1 {
+    v: 1;
+    result: RegisterResult;
+    /** PeerId. */
+    primary?: string;
+    /** PeerIds, 1-2. */
+    backups?: string[];
+    /** 32 bytes, base64url. */
+    cohortEpoch?: string;
+    /** Full cohort PeerIds, for client cache. */
+    cohortMembers?: string[];
+    /** Present on `accepted` and `promoted` only. */
+    topicTraffic?: TopicTrafficV1;
+    /** `d+1` typically; may leap. */
+    targetTier?: number;
+    /** PeerIds within the same cohort to try. */
+    candidateMembers?: string[];
+    retryAfterMs?: number;
+    /** Human-readable, optional. */
+    reason?: string;
+}
+/** Coarse traffic barometer attached to accepted/promoted replies. */
+export interface TopicTrafficV1 {
+    windowSeconds: number;
+    arrivalsPerMin: number;
+    queriesPerMin: number;
+    directParticipants: number;
+    childCohortCount: number;
+}
+/** Registration renewal (ping). */
+export interface RenewV1 {
+    v: 1;
+    topicId: string;
+    /** PeerId. */
+    participantId: string;
+    /** Matches the original {@link RegisterV1}. */
+    correlationId: string;
+    timestamp: number;
+    /**
+     * True on a crash-failover re-attach — the participant attests it could not reach its primary and
+     * asks the contacted backup to promote itself. Absent/false on a normal ping. Signed (part of the
+     * renew body) so a member can trust the attestation and a MITM cannot flip a ping into a promotion.
+     */
+    reattach?: boolean;
+    /**
+     * True on a withdraw tombstone — the participant attests it is leaving; the holder evicts the
+     * record immediately and gossips the eviction (freeing the cohort slot rather than holding it for a
+     * full TTL). Absent/false on a ping or reattach. Signed (part of the renew body) so a third party
+     * cannot evict someone else's registration. Mutually exclusive with {@link reattach} (the participant
+     * never sets both; on a malformed frame that sets both, the cohort side honors `withdraw`).
+     */
+    withdraw?: boolean;
+    signature: string;
+}
+/** Renewal reply. */
+export interface RenewReplyV1 {
+    v: 1;
+    /**
+     * `withdrawn` answers a {@link RenewV1.withdraw} tombstone the holder accepted (record evicted +
+     * gossiped); the participant ignores it (it is leaving), but the distinct result lets the cohort
+     * side branch unambiguously (re-touch the topic budget down, never count an arrival).
+     */
+    result: "ok" | "unknown_registration" | "primary_moved" | "withdrawn";
+    newPrimary?: string;
+    newBackups?: string[];
+    cohortEpoch?: string;
+}
+/** Threshold-signed promotion notice. */
+export interface PromotionNoticeV1 {
+    v: 1;
+    topicId: string;
+    fromTier: number;
+    /** Typically `fromTier + 1`. */
+    toTier: number;
+    /** Unix ms. */
+    effectiveAt: number;
+    /** Cohort threshold signature, base64url. */
+    thresholdSig: string;
+    /** PeerIds, `>= minSigs`. */
+    signers: string[];
+    cohortEpoch: string;
+}
+/** Threshold-signed demotion notice. */
+export interface DemotionNoticeV1 {
+    v: 1;
+    topicId: string;
+    tier: number;
+    /** 32 bytes, base64url. */
+    parentCohortCoord: string;
+    effectiveAt: number;
+    thresholdSig: string;
+    signers: string[];
+    cohortEpoch: string;
+}
+/**
+ * A registration record carried in cohort gossip for cross-member replication (so any member can
+ * fail over to serving it). Byte fields are base64url; mirrors the local `RegistrationRecord`.
+ */
+export interface GossipRecordV1 {
+    /** Topic id, 32 bytes, base64url. */
+    topicId: string;
+    /** Registering participant peer id, base64url. */
+    participantId: string;
+    /** Tier 0..3. */
+    tier: number;
+    /** Assigned primary peer id, base64url. */
+    primary: string;
+    /** 1..2 warm-failover peer ids, base64url. */
+    backups: string[];
+    /** Unix ms the registration first attached. */
+    attachedAt: number;
+    /** Unix ms of the most recent ping/touch (the convergence key — newest wins). */
+    lastPing: number;
+    /** Registration TTL in ms. */
+    ttl: number;
+    /** Opaque application-defined per-registration state, base64url. */
+    appState?: string;
+}
+/** Reference to a single registration in an eviction delta. */
+export interface GossipRecordRefV1 {
+    /** Topic id, 32 bytes, base64url. */
+    topicId: string;
+    /** Participant peer id, base64url. */
+    participantId: string;
+}
+/** Intra-cohort gossip: willingness vector, load barometer, exact per-topic summaries, record deltas. */
+export interface CohortGossipV1 {
+    v: 1;
+    /** PeerId. */
+    fromMember: string;
+    /**
+     * The cohort coord this gossip is for, 32 bytes, base64url — the inbound routing key. A node serving
+     * many cohorts fans a delivered frame to every coord engine's bus; each bus merges only the gossip
+     * naming its own coord, so a gossip for one cohort never pollutes a sibling cohort's store/view.
+     */
+    coord: string;
+    cohortEpoch: string;
+    /** 4 bits T0..T3, hex. */
+    willingnessBits: string;
+    /** 4 entries, 0..7 per tier. */
+    loadBuckets: number[];
+    /** Cohort-wide observation window for the rate fields in `topicSummaries`. */
+    windowSeconds: number;
+    topicSummaries: CohortTopicSummary[];
+    /**
+     * Registration records this member is advertising (fresh or touched), for cross-member
+     * replication. Absent when this gossip carries no record changes. Merge is last-writer-wins by
+     * {@link GossipRecordV1.lastPing}.
+     */
+    records?: GossipRecordV1[];
+    /** Registrations this member evicted (stale), so all members converge on the active set. */
+    evicted?: GossipRecordRefV1[];
+    timestamp: number;
+    signature: string;
+}
+/** Per-topic summary inside {@link CohortGossipV1}; counts are exact, intra-cohort only. */
+export interface CohortTopicSummary {
+    topicId: string;
+    tier: number;
+    /** Exact, intra-cohort only. */
+    directParticipants: number;
+    /** Exact, fresh + renewals over the gossip window. */
+    arrivalsPerMin: number;
+    queriesPerMin: number;
+    promoted: boolean;
+    childCohortCount: number;
+}
+/**
+ * What a {@link SignRequestV1} asks a cohort member to endorse — drives the signer's endorsement policy.
+ *
+ * - `membership` / `promotion` / `demotion` — the requester and endorser must share the **current**
+ *   cohort + epoch around `coord`.
+ * - `rotation` — an epoch hand-off: the endorser attests it was a member of the cohort at the **prior**
+ *   epoch carried as `cohortEpoch` (the predecessor cohort threshold-signs the successor cert's payload),
+ *   so the gate checks *prior*-epoch membership rather than current. See `cohort-topic-trust-anchor-rotation-production`.
+ */
+export type SignKind = "membership" | "promotion" | "demotion" | "rotation";
+/**
+ * Intra-cohort sign request (`/optimystic/cohort-topic/1.0.0/sign`). A member assembling a `k − x`
+ * threshold signature dials each cohort member with this; the member endorses by Ed25519-signing the
+ * **exact** `payload` bytes (already canonicalized by the requester via `sig/payloads.ts`), so signer
+ * and verifier never re-canonicalize independently. `coord`/`cohortEpoch` scope the endorsement
+ * (the member checks it shares that cohort/epoch); `kind` selects the endorsement policy.
+ */
+export interface SignRequestV1 {
+    v: 1;
+    kind: SignKind;
+    /** Cohort coord the signature is for, 32 bytes, base64url. */
+    coord: string;
+    /** Cohort epoch the requester is collecting under, 32 bytes, base64url. */
+    cohortEpoch: string;
+    /** The already-canonical signing bytes (the requester's `sig/payloads.ts` image), base64url. */
+    payload: string;
+}
+/** A member's endorsement of a {@link SignRequestV1}: its peer-key signature over the request payload. */
+export interface SignReplyOkV1 {
+    v: 1;
+    /** The endorsing member's dialable id (UTF-8 peer-id string), base64url. */
+    signer: string;
+    /** Ed25519 signature over the request `payload`, base64url (64 bytes decoded). */
+    signature: string;
+}
+/** A member's refusal to endorse a {@link SignRequestV1} (not a cohort member, epoch mismatch, …). */
+export interface SignReplyRefusedV1 {
+    v: 1;
+    refused: true;
+    reason: string;
+}
+/** Reply to a {@link SignRequestV1}: an endorsement ({@link SignReplyOkV1}) or a refusal ({@link SignReplyRefusedV1}). */
+export type SignReplyV1 = SignReplyOkV1 | SignReplyRefusedV1;
+/** Membership certificate for a cohort. */
+export interface MembershipCertV1 {
+    v: 1;
+    /** 32 bytes, base64url. */
+    cohortCoord: string;
+    cohortEpoch: string;
+    /** PeerIds, sorted ascending, length `k`. */
+    members: string[];
+    /** Unix ms. */
+    stabilizedAt: number;
+    thresholdSig: string;
+    signers: string[];
+    /** Optional FRET stabilization proof, base64url. */
+    fretAttestation?: string;
+    /**
+     * Rotation attestation (epoch rotation). The three fields below are an all-or-nothing group: a cert
+     * either carries a full attestation (all three present) or none (all absent). They let a successor
+     * cohort inherit trust from its predecessor: the predecessor cohort threshold-signs **this** cert's
+     * `membershipCertSigningPayload`, so a verifier holding a trusted predecessor at {@link prevEpoch} can
+     * confirm the rotation is legitimate (the prior cohort signed off) rather than a forgery. The
+     * attestation is **not** part of `membershipCertSigningPayload` (it signs *over* that payload), so the
+     * signed image is unchanged and legacy certs (no rotation fields) still decode.
+     */
+    /** Predecessor cohort epoch this cert rotates from (32 bytes, base64url). Present only on a rotation. */
+    prevEpoch?: string;
+    /** Predecessor cohort's threshold signature over THIS cert's `membershipCertSigningPayload`, base64url. */
+    rotationSig?: string;
+    /** Predecessor cohort signers (PeerIds, base64url) that produced {@link rotationSig}; `>= minSigs`. */
+    rotationSigners?: string[];
+}
+/** Discriminated union over every V1 message carried by the cohort-topic protocols. */
+export type CohortMessageV1 = RegisterV1 | RegisterReplyV1 | RenewV1 | RenewReplyV1 | PromotionNoticeV1 | DemotionNoticeV1 | CohortGossipV1 | MembershipCertV1 | SignRequestV1 | SignReplyOkV1 | SignReplyRefusedV1;
+//# sourceMappingURL=types.d.ts.map

package/dist/src/cohort-topic/wire/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/wire/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,cAAc,GACvB,UAAU,GACV,UAAU,GACV,UAAU,GACV,kBAAkB,GAClB,kBAAkB,CAAC;AAEtB,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC/B,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,cAAc,CAAC;IAEvB,cAAc;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,iDAAiD;IACjD,YAAY,CAAC,EAAE,cAAc,CAAC;IAE9B,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,OAAO;IACvB,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,qBAAqB;AACrB,MAAM,WAAW,YAAY;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL;;;;OAIG;IACH,MAAM,EAAE,IAAI,GAAG,sBAAsB,GAAG,eAAe,GAAG,WAAW,CAAC;IAEtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IACjC,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAChC,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IACjC,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,yGAAyG;AACzG,MAAM,WAAW,cAAc;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,cAAc;IACd,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,kBAAkB,EAAE,CAAC;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,4FAA4F;IAC5F,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,QAAQ,CAAC;IACf,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,aAAa;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAClC,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CACf;AAED,0HAA0H;AAC1H,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,kBAAkB,CAAC;AAE7D,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAChC,CAAC,EAAE,CAAC,CAAC;IACL,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,yGAAyG;IACzG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uGAAuG;IACvG,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,uFAAuF;AACvF,MAAM,MAAM,eAAe,GACxB,UAAU,GACV,eAAe,GACf,OAAO,GACP,YAAY,GACZ,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,aAAa,GACb,kBAAkB,CAAC"}

package/dist/src/cohort-topic/wire/types.js

@@ -0,0 +1,16 @@
+/**
+ * Cohort-topic substrate — V1 wire message types.
+ *
+ * Transcribed from `docs/cohort-topic.md` §Wire formats. These interfaces are the canonical
+ * on-the-wire shapes for the cohort-topic RPC surface; the codec in `./codec.ts` serializes
+ * them as length-prefixed UTF-8 JSON.
+ *
+ * Conventions (mandated by §Wire formats):
+ * - Every byte-typed field is carried as a base64url string (no padding) — never raw bytes.
+ * - Every timestamp is unix milliseconds.
+ * - `appPayload` is an opaque base64url string carrying application-defined bytes. The wire layer
+ *   never interprets it; reactivity / matchmaking define their own structures and serialize them
+ *   into this slot.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/cohort-topic/wire/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cohort-topic/wire/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/src/cohort-topic/wire/validate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Cohort-topic substrate — per-message structural validation.
+ *
+ * Each validator narrows an already-parsed `unknown` (the output of `JSON.parse` on a decoded
+ * frame) to a concrete V1 interface, throwing {@link CohortWireError} on any structural defect:
+ * missing required field, wrong `v`, out-of-enum discriminant, a byte field that does not decode
+ * as base64url, or an out-of-range numeric. Validators never return partial data — they either
+ * narrow cleanly or throw.
+ */
+import type { CohortGossipV1, DemotionNoticeV1, MembershipCertV1, PromotionNoticeV1, RegisterReplyV1, RegisterV1, RenewReplyV1, RenewV1, SignRequestV1, SignReplyV1 } from "./types.js";
+/** Thrown for any malformed, oversized, or structurally invalid cohort-topic frame. */
+export declare class CohortWireError extends Error {
+    constructor(message: string);
+}
+export declare function validateRegisterV1(value: unknown): RegisterV1;
+export declare function validateRegisterReplyV1(value: unknown): RegisterReplyV1;
+export declare function validateRenewV1(value: unknown): RenewV1;
+export declare function validateRenewReplyV1(value: unknown): RenewReplyV1;
+export declare function validatePromotionNoticeV1(value: unknown): PromotionNoticeV1;
+export declare function validateDemotionNoticeV1(value: unknown): DemotionNoticeV1;
+export declare function validateCohortGossipV1(value: unknown): CohortGossipV1;
+export declare function validateSignRequestV1(value: unknown): SignRequestV1;
+export declare function validateSignReplyV1(value: unknown): SignReplyV1;
+export declare function validateMembershipCertV1(value: unknown): MembershipCertV1;
+//# sourceMappingURL=validate.d.ts.map

package/dist/src/cohort-topic/wire/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../../src/cohort-topic/wire/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EACX,cAAc,EAEd,gBAAgB,EAGhB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EAEf,UAAU,EACV,YAAY,EACZ,OAAO,EAEP,aAAa,EACb,WAAW,EAEX,MAAM,YAAY,CAAC;AAEpB,uFAAuF;AACvF,qBAAa,eAAgB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI3B;AAmID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAmC7D;AAcD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAuBvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAevD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAejE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAc3E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAczE;AAgDD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAgDrE;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAWnE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAgB/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAmBzE"}