@optimystic/db-p2p 0.13.4 → 0.14.0

package/dist/src/cohort-topic/reactivity-membership-gate.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Reactivity origination membership gate (`docs/reactivity.md` §Anchor, `docs/internals.md`
+ * §Cohort-Topic Origination Bridge).
+ *
+ * Builds the `selfIsCohortMember(event)` predicate the change-notifier bridge gates each member commit
+ * on: this node is responsible for a collection's reactivity-topic fan-out iff it sits in the FRET
+ * cohort around `coord_0(H(currentTailId ‖ "reactivity"))`. The tail comes from `event.tailId` (the seam
+ * ticket put the committed `CommitRequest.tailId` on the change event), so the decision is synchronous —
+ * no async storage read, no per-collection registry. A tail-less event (a read-driven promotion) is
+ * never a member; those never originate and are cert-gated out downstream anyway.
+ *
+ * Extracted from the node assembly so the encoding + coord derivation are unit-testable in isolation and
+ * reusable by the future reactivity origination wiring.
+ */
+import { type ReactivityTopicAnchor, type TierAddressing, type CollectionChangeEvent } from "@optimystic/db-core";
+import type { FretService } from "p2p-fret";
+export { reactivityTailBytes } from "../reactivity/topic-bytes.js";
+/** Construction inputs for {@link createReactivitySelfMembershipGate}. */
+export interface ReactivitySelfMembershipGateDeps {
+    /** FRET membership read — the cohort assembler around a served coord (returns peer-id strings). */
+    readonly fret: Pick<FretService, "assembleCohort">;
+    /** This node's peer-id string, compared against the assembled cohort. */
+    readonly selfPeerId: string;
+    /**
+     * Requested cohort size `wantK`. MUST equal the cohort-topic host's `wantK`, so the gate checks the
+     * exact cohort the host serves; a mismatch silently breaks origination.
+     */
+    readonly wantK: number;
+    /**
+     * Reactivity topic anchor. Default db-core's {@link createReactivityTopicAnchor} (256-bit SHA-256),
+     * byte-identical to the host's internal `new RingHash()` and the subscriber-side anchor.
+     */
+    readonly anchor?: ReactivityTopicAnchor;
+    /**
+     * Tier addressing. Default `createTierAddressing(createRingHash())`. `coord_0` is fan-out independent
+     * (`H(0x00 ‖ topicId)`), so the default fan-out is irrelevant to the tier-0 reactivity coord.
+     */
+    readonly addressing?: TierAddressing;
+}
+/**
+ * Build the synchronous `selfIsCohortMember(event)` gate for {@link attachCohortChangeBridge}.
+ *
+ * Returns `false` for a tail-less event; otherwise resolves `coord_0(H(event.tailId ‖ "reactivity"))`
+ * via the shared anchor + tier addressing and returns whether `fret.assembleCohort(coord, wantK)`
+ * includes this node's peer id. Pure aside from the live FRET read; membership churn between commits is
+ * fine because reactivity is hint-only.
+ */
+export declare function createReactivitySelfMembershipGate(deps: ReactivitySelfMembershipGateDeps): (event: CollectionChangeEvent) => boolean;
+//# sourceMappingURL=reactivity-membership-gate.d.ts.map

package/dist/src/cohort-topic/reactivity-membership-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reactivity-membership-gate.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/reactivity-membership-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAIN,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAM5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGnE,0EAA0E;AAC1E,MAAM,WAAW,gCAAgC;IAChD,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACnD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CACjD,IAAI,EAAE,gCAAgC,GACpC,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAW3C"}

package/dist/src/cohort-topic/reactivity-membership-gate.js

@@ -0,0 +1,42 @@
+/**
+ * Reactivity origination membership gate (`docs/reactivity.md` §Anchor, `docs/internals.md`
+ * §Cohort-Topic Origination Bridge).
+ *
+ * Builds the `selfIsCohortMember(event)` predicate the change-notifier bridge gates each member commit
+ * on: this node is responsible for a collection's reactivity-topic fan-out iff it sits in the FRET
+ * cohort around `coord_0(H(currentTailId ‖ "reactivity"))`. The tail comes from `event.tailId` (the seam
+ * ticket put the committed `CommitRequest.tailId` on the change event), so the decision is synchronous —
+ * no async storage read, no per-collection registry. A tail-less event (a read-driven promotion) is
+ * never a member; those never originate and are cert-gated out downstream anyway.
+ *
+ * Extracted from the node assembly so the encoding + coord derivation are unit-testable in isolation and
+ * reusable by the future reactivity origination wiring.
+ */
+import { createReactivityTopicAnchor, createTierAddressing, createRingHash, } from "@optimystic/db-core";
+// The pinned `BlockId` → raw tail-bytes encoding now lives in the reactivity surface so the origination
+// gate (here) and the subscriber-side subscribe factory import the SAME function — see `reactivity/
+// topic-bytes.ts` for the load-bearing rationale. Re-exported so this module's existing callers (tests,
+// node wiring) keep importing `reactivityTailBytes` from the gate.
+export { reactivityTailBytes } from "../reactivity/topic-bytes.js";
+import { reactivityTailBytes } from "../reactivity/topic-bytes.js";
+/**
+ * Build the synchronous `selfIsCohortMember(event)` gate for {@link attachCohortChangeBridge}.
+ *
+ * Returns `false` for a tail-less event; otherwise resolves `coord_0(H(event.tailId ‖ "reactivity"))`
+ * via the shared anchor + tier addressing and returns whether `fret.assembleCohort(coord, wantK)`
+ * includes this node's peer id. Pure aside from the live FRET read; membership churn between commits is
+ * fine because reactivity is hint-only.
+ */
+export function createReactivitySelfMembershipGate(deps) {
+    const anchor = deps.anchor ?? createReactivityTopicAnchor();
+    const addressing = deps.addressing ?? createTierAddressing(createRingHash());
+    return (event) => {
+        if (event.tailId === undefined) {
+            return false; // promotion / tail-less event never originates
+        }
+        const topicId = anchor.topicId(reactivityTailBytes(event.tailId));
+        const coord = addressing.coord0(topicId);
+        return deps.fret.assembleCohort(coord, deps.wantK).includes(deps.selfPeerId);
+    };
+}
+//# sourceMappingURL=reactivity-membership-gate.js.map

package/dist/src/cohort-topic/reactivity-membership-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reactivity-membership-gate.js","sourceRoot":"","sources":["../../../src/cohort-topic/reactivity-membership-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACN,2BAA2B,EAC3B,oBAAoB,EACpB,cAAc,GAId,MAAM,qBAAqB,CAAC;AAG7B,wGAAwG;AACxG,oGAAoG;AACpG,wGAAwG;AACxG,mEAAmE;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAyBnE;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC,CACjD,IAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,KAA4B,EAAW,EAAE;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,+CAA+C;QAC9D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC,CAAC;AACH,CAAC"}

package/dist/src/cohort-topic/size-estimator.d.ts

@@ -0,0 +1,16 @@
+import type { ISizeEstimator } from "@optimystic/db-core";
+import type { FretService } from "p2p-fret";
+/**
+ * FRET-backed {@link ISizeEstimator}: feeds `d_max` from FRET's network-size estimate
+ * (`FretService.getNetworkSizeEstimate`). A clean, total binding — db-core's `d_max` computer applies
+ * the low-confidence clamp itself, so this adapter only forwards FRET's `(size_estimate, confidence)`.
+ */
+export declare class FretSizeEstimator implements ISizeEstimator {
+    private readonly fret;
+    constructor(fret: FretService);
+    estimate(): {
+        nEst: number;
+        confidence: number;
+    };
+}
+//# sourceMappingURL=size-estimator.d.ts.map

package/dist/src/cohort-topic/size-estimator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"size-estimator.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/size-estimator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;GAIG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAE9C,QAAQ,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;CAIhD"}

package/dist/src/cohort-topic/size-estimator.js

@@ -0,0 +1,16 @@
+/**
+ * FRET-backed {@link ISizeEstimator}: feeds `d_max` from FRET's network-size estimate
+ * (`FretService.getNetworkSizeEstimate`). A clean, total binding — db-core's `d_max` computer applies
+ * the low-confidence clamp itself, so this adapter only forwards FRET's `(size_estimate, confidence)`.
+ */
+export class FretSizeEstimator {
+    fret;
+    constructor(fret) {
+        this.fret = fret;
+    }
+    estimate() {
+        const { size_estimate, confidence } = this.fret.getNetworkSizeEstimate();
+        return { nEst: size_estimate, confidence };
+    }
+}
+//# sourceMappingURL=size-estimator.js.map

package/dist/src/cohort-topic/size-estimator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"size-estimator.js","sourceRoot":"","sources":["../../../src/cohort-topic/size-estimator.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,OAAO,iBAAiB;IACA;IAA7B,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;IAAG,CAAC;IAElD,QAAQ;QACP,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;IAC5C,CAAC;CACD"}

package/dist/src/cohort-topic/stream-util.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cohort-topic libp2p stream helpers.
+ *
+ * The cohort-topic protocols exchange a single self-delimiting cohort frame each way (the db-core wire
+ * codec already length-prefixes the body), so request/response is one `send` + one bounded read. This
+ * mirrors FRET's `rpc/maybe-act.ts` exactly and reuses FRET's exported `readAllBounded`, keeping the
+ * stream lifecycle (open → send → close-write → read → close) consistent across both protocol families.
+ */
+import type { Libp2p } from "libp2p";
+import type { PeerId } from "@libp2p/interface";
+/** Default per-frame ceiling — matches FRET's 512 KiB maybe-act bound. */
+export declare const DEFAULT_STREAM_MAX_BYTES: number;
+/** Open `protocol` to `peer`, send `frame`, and read the bounded reply frame. */
+export declare function requestResponse(node: Libp2p, peer: PeerId, protocol: string, frame: Uint8Array, maxBytes?: number): Promise<Uint8Array>;
+/** Open `protocol` to `peer` and send `frame` without awaiting a reply (fire-and-forget gossip). */
+export declare function sendOneWay(node: Libp2p, peer: PeerId, protocol: string, frame: Uint8Array): Promise<void>;
+/** Register a request/response handler for `protocol`: read one bounded frame, reply with one frame. */
+export declare function handleRequestResponse(node: Libp2p, protocol: string, handle: (frame: Uint8Array, from: PeerId) => Promise<Uint8Array | undefined>, maxBytes?: number): void;
+//# sourceMappingURL=stream-util.d.ts.map

package/dist/src/cohort-topic/stream-util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-util.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/stream-util.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAc,MAAM,EAAU,MAAM,mBAAmB,CAAC;AAGpE,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,iFAAiF;AACjF,wBAAsB,eAAe,CACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,SAA2B,GACjC,OAAO,CAAC,UAAU,CAAC,CAiBrB;AAED,oGAAoG;AACpG,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB/G;AAED,wGAAwG;AACxG,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EAC5E,QAAQ,SAA2B,GACjC,IAAI,CAmBN"}

package/dist/src/cohort-topic/stream-util.js

@@ -0,0 +1,76 @@
+/**
+ * Cohort-topic libp2p stream helpers.
+ *
+ * The cohort-topic protocols exchange a single self-delimiting cohort frame each way (the db-core wire
+ * codec already length-prefixes the body), so request/response is one `send` + one bounded read. This
+ * mirrors FRET's `rpc/maybe-act.ts` exactly and reuses FRET's exported `readAllBounded`, keeping the
+ * stream lifecycle (open → send → close-write → read → close) consistent across both protocol families.
+ */
+import { readAllBounded } from "p2p-fret";
+/** Default per-frame ceiling — matches FRET's 512 KiB maybe-act bound. */
+export const DEFAULT_STREAM_MAX_BYTES = 512 * 1024;
+/** Open `protocol` to `peer`, send `frame`, and read the bounded reply frame. */
+export async function requestResponse(node, peer, protocol, frame, maxBytes = DEFAULT_STREAM_MAX_BYTES) {
+    const conns = node.getConnections(peer);
+    let stream;
+    try {
+        stream = conns.length > 0 ? await conns[0].newStream([protocol]) : await node.dialProtocol(peer, [protocol]);
+        stream.send(frame);
+        await stream.close();
+        return await readAllBounded(stream, maxBytes);
+    }
+    finally {
+        if (stream != null) {
+            try {
+                await stream.close();
+            }
+            catch {
+                /* already closed */
+            }
+        }
+    }
+}
+/** Open `protocol` to `peer` and send `frame` without awaiting a reply (fire-and-forget gossip). */
+export async function sendOneWay(node, peer, protocol, frame) {
+    const conns = node.getConnections(peer);
+    let stream;
+    try {
+        stream = conns.length > 0 ? await conns[0].newStream([protocol]) : await node.dialProtocol(peer, [protocol]);
+        stream.send(frame);
+        await stream.close();
+    }
+    finally {
+        if (stream != null) {
+            try {
+                await stream.close();
+            }
+            catch {
+                /* already closed */
+            }
+        }
+    }
+}
+/** Register a request/response handler for `protocol`: read one bounded frame, reply with one frame. */
+export function handleRequestResponse(node, protocol, handle, maxBytes = DEFAULT_STREAM_MAX_BYTES) {
+    void node.handle(protocol, (stream, connection) => {
+        void (async () => {
+            try {
+                const frame = await readAllBounded(stream, maxBytes);
+                const reply = await handle(frame, connection.remotePeer);
+                if (reply !== undefined) {
+                    stream.send(reply);
+                }
+                await stream.close();
+            }
+            catch {
+                try {
+                    stream.abort(new Error("cohort-topic stream handler error"));
+                }
+                catch {
+                    /* already aborted */
+                }
+            }
+        })();
+    });
+}
+//# sourceMappingURL=stream-util.js.map

package/dist/src/cohort-topic/stream-util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-util.js","sourceRoot":"","sources":["../../../src/cohort-topic/stream-util.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEnD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,KAAiB,EACjB,QAAQ,GAAG,wBAAwB;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACJ,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACV,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACR,oBAAoB;YACrB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,QAAgB,EAAE,KAAiB;IAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACJ,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACV,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACR,oBAAoB;YACrB,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CACpC,IAAY,EACZ,QAAgB,EAChB,MAA4E,EAC5E,QAAQ,GAAG,wBAAwB;IAEnC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAc,EAAE,UAAsB,EAAE,EAAE;QACrE,KAAK,CAAC,KAAK,IAAmB,EAAE;YAC/B,IAAI,CAAC;gBACJ,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACrD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;gBACzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;gBACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACR,IAAI,CAAC;oBACJ,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACR,qBAAqB;gBACtB,CAAC;YACF,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACN,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/cohort-topic/threshold-crypto.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Cohort-topic `k − x` threshold-signature crypto — real collected Ed25519 multi-signature.
+ *
+ * Closes gap 1 (the interim single-signer `sha256(payload)` digest, which could never satisfy
+ * `CohortSigner.verifyThreshold`'s `≥ minSigs` distinct-member rule at `minSigs = 14`). The scheme is
+ * a **collected multisig**: `thresholdSig` is the aligned concatenation of fixed-width 64-byte Ed25519
+ * signatures, one per `signers[i]`, each produced by that member's libp2p peer key over the *exact*
+ * canonical payload. It needs **no trusted setup, no new crypto dependency, and no aggregation round**
+ * (unlike BLS or FROST), maps directly onto the existing `(thresholdSig, signers)` contract, and reuses
+ * the per-member peer-key signing primitive (`peer-sig.ts`) the codebase already uses for cluster-repo
+ * commit signatures. Size is O(k) (≤ ~14 × 64 = 896 bytes at production `minSigs`) — negligible for
+ * k ≤ 16; if size ever matters at larger k the scheme can be swapped behind the unchanged
+ * {@link ICohortThresholdCrypto} port.
+ *
+ * **Coord-scoped.** `assemble(payload, minSigs)` carries no coord, so the adapter is constructed per
+ * served coord (one per {@link import("./host.js").CoordEngine}): it knows the cohort around its coord,
+ * the node's peer key (to add self's own signature without an RPC), and a `dialSign` seam over the
+ * `/sign` protocol to collect the other members' endorsements.
+ *
+ * **Verify is synchronous** — `ICohortThresholdCrypto.verify` is called from the sync
+ * `CohortSigner.verifyThreshold` on the participant path. {@link verifyCollectedMultisig} splits the
+ * blob into `signers.length` 64-byte chunks and {@link verifyPeerSig}-checks each against the
+ * corresponding signer's embedded Ed25519 key (noble, sync). Do not make it async.
+ */
+import type { PrivateKey } from "@libp2p/interface";
+import type { ICohortThresholdCrypto, RingCoord, SignKind, SignReplyV1, SignRequestV1 } from "@optimystic/db-core";
+/** Width of an Ed25519 signature in bytes — the fixed stride of the concatenated `thresholdSig`. */
+export declare const ED25519_SIG_BYTES = 64;
+/** Default per-round deadline for collecting cohort endorsements (ms). */
+export declare const DEFAULT_SIGN_COLLECT_TIMEOUT_MS = 5000;
+/**
+ * Verify a collected Ed25519 multi-signature: `thresholdSig` must be exactly `signers.length × 64`
+ * bytes, and chunk `i` must be a valid peer-key signature by `signers[i]` over `payload`. Pure and
+ * synchronous; total (returns `false`, never throws). The db-core `CohortSigner.verifyThreshold` layer
+ * adds the distinct-signer / `signers ⊆ cert.members` / `≥ minSigs` checks on top of this.
+ */
+export declare function verifyCollectedMultisig(payload: Uint8Array, thresholdSig: Uint8Array, signers: readonly Uint8Array[]): boolean;
+/**
+ * Dependencies for a coord-scoped {@link FretCohortThresholdCrypto}. The host supplies these per
+ * {@link import("./host.js").CoordEngine}; the `kind` selects the endorsement policy the dialed
+ * members apply (membership cert vs promotion / demotion notice).
+ */
+export interface CohortThresholdCryptoDeps {
+    /** What this signer assembles — sent in each {@link SignRequestV1} so members apply the right policy. */
+    readonly kind: SignKind;
+    /** The node's libp2p Ed25519 private key — signs self's own chunk locally (no RPC to self). */
+    readonly privateKey: PrivateKey;
+    /** Self's dialable member id (UTF-8 of the peer-id string); self is always a signer. */
+    readonly selfMember: Uint8Array;
+    /** The served coord whose cohort threshold-signs. */
+    readonly coord: () => RingCoord;
+    /** Current cohort epoch (raw bytes) for {@link coord}. */
+    readonly cohortEpoch: () => Uint8Array;
+    /** Current cohort member peer-id strings around {@link coord} (self may be included; excluded internally). */
+    readonly cohortMembers: () => string[];
+    /** Dial one cohort member's `/sign` RPC and return its reply. */
+    readonly dialSign: (peerIdStr: string, request: SignRequestV1) => Promise<SignReplyV1>;
+    /** Per-round collection deadline (ms). Default {@link DEFAULT_SIGN_COLLECT_TIMEOUT_MS}. */
+    readonly collectTimeoutMs?: number;
+    /**
+     * Whether self may contribute its own signature to this assembly. Default `true` (self is always a
+     * member of the cohort it signs over). The **rotation** producer scopes the assembly to the
+     * *predecessor* cohort (`cohortMembers` = the prior epoch's members); when self was not a member of
+     * that prior cohort it must NOT self-sign — its chunk would be dropped by the verifier (a signer not in
+     * the predecessor cert's `members`), desyncing the count from what the verifier accepts. Returning
+     * `false` then makes the quorum genuinely the outgoing cohort. See `cohort-topic-trust-anchor-rotation-production`.
+     */
+    readonly selfEligible?: () => boolean;
+}
+/**
+ * Real coord-scoped {@link ICohortThresholdCrypto}. `assemble` signs locally, concurrently dials the
+ * rest of the cohort over the `/sign` protocol, verifies each returned signature before counting it,
+ * and concatenates `≥ minSigs` distinct signatures into the threshold blob — or throws if a quorum is
+ * unreachable (it must **never** fabricate a single-signer sig, the interim bug). `verify` is the pure
+ * split-and-check.
+ */
+export declare class FretCohortThresholdCrypto implements ICohortThresholdCrypto {
+    private readonly deps;
+    constructor(deps: CohortThresholdCryptoDeps);
+    assemble(payload: Uint8Array, minSigs: number): Promise<{
+        thresholdSig: Uint8Array;
+        signers: Uint8Array[];
+    }>;
+    verify(payload: Uint8Array, thresholdSig: Uint8Array, signers: readonly Uint8Array[]): boolean;
+    /** Dial one member, verify-before-count its endorsement, and add it to `collected` (dropping bad/dupe). */
+    private collectFrom;
+}
+/**
+ * A verify-only {@link ICohortThresholdCrypto} for the participant-side verifier, which never assembles
+ * (it only checks inbound threshold-signed messages). `assemble` rejects so a misuse surfaces loudly
+ * rather than fabricating a signature.
+ */
+export declare function createVerifyOnlyThresholdCrypto(): ICohortThresholdCrypto;
+//# sourceMappingURL=threshold-crypto.d.ts.map

package/dist/src/cohort-topic/threshold-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threshold-crypto.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/threshold-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKnH,oGAAoG;AACpG,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,0EAA0E;AAC1E,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAc9H;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACzC,yGAAyG;IACzG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,SAAS,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,UAAU,CAAC;IACvC,8GAA8G;IAC9G,QAAQ,CAAC,aAAa,EAAE,MAAM,MAAM,EAAE,CAAC;IACvC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACvF,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;CACtC;AAQD;;;;;;GAMG;AACH,qBAAa,yBAA0B,YAAW,sBAAsB;IAC3D,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,yBAAyB;IAEtD,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IA4ClH,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO;IAI9F,2GAA2G;YAC7F,WAAW;CA8BzB;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,IAAI,sBAAsB,CAMxE"}

package/dist/src/cohort-topic/threshold-crypto.js

@@ -0,0 +1,178 @@
+/**
+ * Cohort-topic `k − x` threshold-signature crypto — real collected Ed25519 multi-signature.
+ *
+ * Closes gap 1 (the interim single-signer `sha256(payload)` digest, which could never satisfy
+ * `CohortSigner.verifyThreshold`'s `≥ minSigs` distinct-member rule at `minSigs = 14`). The scheme is
+ * a **collected multisig**: `thresholdSig` is the aligned concatenation of fixed-width 64-byte Ed25519
+ * signatures, one per `signers[i]`, each produced by that member's libp2p peer key over the *exact*
+ * canonical payload. It needs **no trusted setup, no new crypto dependency, and no aggregation round**
+ * (unlike BLS or FROST), maps directly onto the existing `(thresholdSig, signers)` contract, and reuses
+ * the per-member peer-key signing primitive (`peer-sig.ts`) the codebase already uses for cluster-repo
+ * commit signatures. Size is O(k) (≤ ~14 × 64 = 896 bytes at production `minSigs`) — negligible for
+ * k ≤ 16; if size ever matters at larger k the scheme can be swapped behind the unchanged
+ * {@link ICohortThresholdCrypto} port.
+ *
+ * **Coord-scoped.** `assemble(payload, minSigs)` carries no coord, so the adapter is constructed per
+ * served coord (one per {@link import("./host.js").CoordEngine}): it knows the cohort around its coord,
+ * the node's peer key (to add self's own signature without an RPC), and a `dialSign` seam over the
+ * `/sign` protocol to collect the other members' endorsements.
+ *
+ * **Verify is synchronous** — `ICohortThresholdCrypto.verify` is called from the sync
+ * `CohortSigner.verifyThreshold` on the participant path. {@link verifyCollectedMultisig} splits the
+ * blob into `signers.length` 64-byte chunks and {@link verifyPeerSig}-checks each against the
+ * corresponding signer's embedded Ed25519 key (noble, sync). Do not make it async.
+ */
+import { bytesToB64url, b64urlToBytes, compareBytes } from "@optimystic/db-core";
+import { signPeer, verifyPeerSig } from "./peer-sig.js";
+import { bytesToPeerIdString } from "./peer-codec.js";
+/** Width of an Ed25519 signature in bytes — the fixed stride of the concatenated `thresholdSig`. */
+export const ED25519_SIG_BYTES = 64;
+/** Default per-round deadline for collecting cohort endorsements (ms). */
+export const DEFAULT_SIGN_COLLECT_TIMEOUT_MS = 5_000;
+/**
+ * Verify a collected Ed25519 multi-signature: `thresholdSig` must be exactly `signers.length × 64`
+ * bytes, and chunk `i` must be a valid peer-key signature by `signers[i]` over `payload`. Pure and
+ * synchronous; total (returns `false`, never throws). The db-core `CohortSigner.verifyThreshold` layer
+ * adds the distinct-signer / `signers ⊆ cert.members` / `≥ minSigs` checks on top of this.
+ */
+export function verifyCollectedMultisig(payload, thresholdSig, signers) {
+    if (signers.length === 0) {
+        return false;
+    }
+    if (thresholdSig.length !== signers.length * ED25519_SIG_BYTES) {
+        return false;
+    }
+    for (let i = 0; i < signers.length; i++) {
+        const chunk = thresholdSig.subarray(i * ED25519_SIG_BYTES, (i + 1) * ED25519_SIG_BYTES);
+        if (!verifyPeerSig(signers[i], payload, chunk)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Real coord-scoped {@link ICohortThresholdCrypto}. `assemble` signs locally, concurrently dials the
+ * rest of the cohort over the `/sign` protocol, verifies each returned signature before counting it,
+ * and concatenates `≥ minSigs` distinct signatures into the threshold blob — or throws if a quorum is
+ * unreachable (it must **never** fabricate a single-signer sig, the interim bug). `verify` is the pure
+ * split-and-check.
+ */
+export class FretCohortThresholdCrypto {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async assemble(payload, minSigs) {
+        const collected = new Map();
+        const selfStr = bytesToPeerIdString(this.deps.selfMember);
+        // Self is normally a signer — it is the acting member, even if a stale table omits it from its own
+        // assembly. Sign locally (no RPC to self). A rotation producer that was NOT in the predecessor cohort
+        // (`selfEligible` → false) skips this: its chunk would be dropped by the verifier (signer ∉ predecessor
+        // cert members), so it must collect a quorum purely from the outgoing cohort instead.
+        if (this.deps.selfEligible?.() ?? true) {
+            const selfSig = await signPeer(this.deps.privateKey, payload);
+            if (selfSig.length !== ED25519_SIG_BYTES) {
+                throw new Error(`cohort threshold sign: self produced a ${selfSig.length}-byte signature (expected ${ED25519_SIG_BYTES}); non-Ed25519 identity?`);
+            }
+            collected.set(bytesToB64url(this.deps.selfMember), { signer: this.deps.selfMember, sig: selfSig });
+        }
+        // Concurrently collect endorsements from the rest of the cohort, up to the deadline.
+        const others = this.deps.cohortMembers().filter((m) => m !== selfStr);
+        if (others.length > 0 && collected.size < minSigs) {
+            const request = {
+                v: 1,
+                kind: this.deps.kind,
+                coord: bytesToB64url(this.deps.coord()),
+                cohortEpoch: bytesToB64url(this.deps.cohortEpoch()),
+                payload: bytesToB64url(payload),
+            };
+            const timeoutMs = this.deps.collectTimeoutMs ?? DEFAULT_SIGN_COLLECT_TIMEOUT_MS;
+            await Promise.all(others.map((peerStr) => this.collectFrom(peerStr, request, payload, collected, timeoutMs)));
+        }
+        if (collected.size < minSigs) {
+            // Quorum unreachable / unwilling: no notice this round. The promotion / cert path re-fires next
+            // tick. NEVER fabricate a single-signer sig — that is exactly the interim bug this replaces.
+            throw new Error(`cohort threshold sign: gathered ${collected.size} of ${minSigs} required signatures`);
+        }
+        // Deterministic order (ascending by signer id) so the concatenation is reproducible and aligns
+        // signers[i] ↔ chunk i for the verifier.
+        const ordered = [...collected.values()].sort((a, b) => compareBytes(a.signer, b.signer));
+        const signers = ordered.map((e) => e.signer);
+        const thresholdSig = concatSigs(ordered.map((e) => e.sig));
+        return { thresholdSig, signers };
+    }
+    verify(payload, thresholdSig, signers) {
+        return verifyCollectedMultisig(payload, thresholdSig, signers);
+    }
+    /** Dial one member, verify-before-count its endorsement, and add it to `collected` (dropping bad/dupe). */
+    async collectFrom(peerStr, request, payload, collected, timeoutMs) {
+        try {
+            const reply = await withTimeout(this.deps.dialSign(peerStr, request), timeoutMs);
+            if (reply === undefined || "refused" in reply) {
+                return; // unreachable (timed out) or the member declined to endorse
+            }
+            const signerBytes = b64urlToBytes(reply.signer);
+            const sigBytes = b64urlToBytes(reply.signature);
+            if (sigBytes.length !== ED25519_SIG_BYTES) {
+                return; // a malformed chunk would desync the fixed-stride concatenation
+            }
+            // Verify before counting: a member must not be able to poison the blob with a bad signature.
+            if (!verifyPeerSig(signerBytes, payload, sigBytes)) {
+                return;
+            }
+            const key = bytesToB64url(signerBytes);
+            if (collected.has(key)) {
+                return; // a duplicate signer cannot pad the count toward minSigs
+            }
+            collected.set(key, { signer: signerBytes, sig: sigBytes });
+        }
+        catch {
+            // Unreachable member or malformed reply — drop it; collection continues with the rest.
+        }
+    }
+}
+/**
+ * A verify-only {@link ICohortThresholdCrypto} for the participant-side verifier, which never assembles
+ * (it only checks inbound threshold-signed messages). `assemble` rejects so a misuse surfaces loudly
+ * rather than fabricating a signature.
+ */
+export function createVerifyOnlyThresholdCrypto() {
+    return {
+        assemble: () => Promise.reject(new Error("verify-only cohort threshold crypto cannot assemble signatures")),
+        verify: verifyCollectedMultisig,
+    };
+}
+/** Concatenate equal-width signature chunks into one fixed-stride blob aligned with the signer order. */
+function concatSigs(sigs) {
+    const out = new Uint8Array(sigs.length * ED25519_SIG_BYTES);
+    for (let i = 0; i < sigs.length; i++) {
+        out.set(sigs[i], i * ED25519_SIG_BYTES);
+    }
+    return out;
+}
+/** Resolve `p`, or `undefined` if `timeoutMs` elapses first (bounds wall-clock against an unreachable peer). */
+function withTimeout(p, timeoutMs) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                resolve(undefined);
+            }
+        }, timeoutMs);
+        void p.then((value) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve(value);
+            }
+        }, () => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve(undefined);
+            }
+        });
+    });
+}
+//# sourceMappingURL=threshold-crypto.js.map

package/dist/src/cohort-topic/threshold-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threshold-crypto.js","sourceRoot":"","sources":["../../../src/cohort-topic/threshold-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,oGAAoG;AACpG,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAmB,EAAE,YAAwB,EAAE,OAA8B;IACpH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,GAAG,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;QACxF,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAyCD;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACR;IAA7B,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;IAAG,CAAC;IAEhE,KAAK,CAAC,QAAQ,CAAC,OAAmB,EAAE,OAAe;QAClD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;QAClD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1D,mGAAmG;QACnG,sGAAsG;QACtG,wGAAwG;QACxG,sFAAsF;QACtF,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,CAAC,MAAM,6BAA6B,iBAAiB,0BAA0B,CAAC,CAAC;YACnJ,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,qFAAqF;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;YACnD,MAAM,OAAO,GAAkB;gBAC9B,CAAC,EAAE,CAAC;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACpB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACvC,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;aAC/B,CAAC;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,+BAA+B,CAAC;YAChF,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;YAC9B,gGAAgG;YAChG,6FAA6F;YAC7F,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,IAAI,OAAO,OAAO,sBAAsB,CAAC,CAAC;QACxG,CAAC;QAED,+FAA+F;QAC/F,yCAAyC;QACzC,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,OAAmB,EAAE,YAAwB,EAAE,OAA8B;QACnF,OAAO,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,2GAA2G;IACnG,KAAK,CAAC,WAAW,CACxB,OAAe,EACf,OAAsB,EACtB,OAAmB,EACnB,SAAoC,EACpC,SAAiB;QAEjB,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;YACjF,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,4DAA4D;YACrE,CAAC;YACD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;gBAC3C,OAAO,CAAC,gEAAgE;YACzE,CAAC;YACD,6FAA6F;YAC7F,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpD,OAAO;YACR,CAAC;YACD,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,yDAAyD;YAClE,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACR,uFAAuF;QACxF,CAAC;IACF,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B;IAC9C,OAAO;QACN,QAAQ,EAAE,GAAiE,EAAE,CAC5E,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAC5F,MAAM,EAAE,uBAAuB;KAC/B,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAS,UAAU,CAAC,IAA2B;IAC9C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,gHAAgH;AAChH,SAAS,WAAW,CAAI,CAAa,EAAE,SAAiB;IACvD,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;QACF,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACF,CAAC,EACD,GAAG,EAAE;YACJ,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC;QACF,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/cohort-topic/topic-router.d.ts

@@ -0,0 +1,41 @@
+import type { ITopicRouter, PeerRef, RingCoord } from "@optimystic/db-core";
+import type { Libp2p } from "libp2p";
+import type { FretService } from "p2p-fret";
+export interface FretTopicRouterOptions {
+    /** The `/register` protocol id (defaults to the canonical one). */
+    readonly registerProtocol?: string;
+    /** RPC TTL hops for `RouteAndMaybeAct`. Default 16. */
+    readonly ttl?: number;
+    /** Per-frame ceiling. Default {@link DEFAULT_STREAM_MAX_BYTES}. */
+    readonly maxBytes?: number;
+    /** Monotonic clock (unix ms); injectable for tests. Default `Date.now`. */
+    readonly clock?: () => number;
+}
+/**
+ * FRET-backed {@link ITopicRouter}.
+ *
+ * `routeAndAct` maps onto FRET's `RouteAndMaybeAct` (`FretService.routeAct`): the `RegisterV1` frame
+ * rides the `activity` field (base64url), routed to the cohort owning `key = coord_d(self, topicId)`,
+ * collecting `want_k = k` participants and `min_sigs = k − x`. The cohort's activity callback (set by
+ * the host) runs the willingness / cold-start / admission decision and returns the encoded
+ * `RegisterReplyV1` as the `commitCertificate`; this adapter decodes it back to bytes. A bare
+ * `NearAnchorV1` (no in-cluster activity ran) is surfaced to the walk as `no_state`.
+ *
+ * `dialMember` is the post-registration direct path: a libp2p dial of the `/register` protocol to the
+ * cached primary, used by the renewal ping (`docs/cohort-topic.md` §FRET integration L457-460).
+ */
+export declare class FretTopicRouter implements ITopicRouter {
+    private readonly node;
+    private readonly fret;
+    private readonly registerProtocol;
+    private readonly ttl;
+    private readonly maxBytes;
+    private readonly clock;
+    constructor(node: Libp2p, fret: FretService, options?: FretTopicRouterOptions);
+    routeAndAct(key: RingCoord, activity: Uint8Array, opts: {
+        wantK: number;
+        minSigs: number;
+    }): Promise<Uint8Array>;
+    dialMember(member: PeerRef, activity: Uint8Array): Promise<Uint8Array>;
+}
+//# sourceMappingURL=topic-router.d.ts.map

package/dist/src/cohort-topic/topic-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"topic-router.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/topic-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAoC,MAAM,UAAU,CAAC;AAU9E,MAAM,WAAW,sBAAsB;IACtC,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,YAAW,YAAY;IAMvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IALhE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAER,IAAI,EAAE,MAAM,EAAmB,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,sBAA2B;IAO7G,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAsBhH,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAI5E"}