@optimystic/db-p2p 0.13.4 → 0.14.0

package/dist/src/cohort-topic/bootstrap-evidence-builder.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Cohort-topic substrate — participant-side bootstrap-evidence builder (db-p2p side of the `buildBootstrapEvidence` seam).
+ *
+ * Implements the db-core `CohortTopicServiceDeps.buildBootstrapEvidence` seam for the node's participant
+ * role: on a cold-start `bootstrap: true` re-issue the service calls this with the register's own
+ * canonical `(topicId, tier, participantCoord, timestamp)` tuple (base64url wire strings) and attaches the
+ * returned bytes — **before** signing — into `RegisterV1.bootstrapEvidence`.
+ *
+ * - **Tier ≤ maxNoPowTier (T0/T1):** proof-of-work is not the expected evidence. With an `endorse`
+ *   capability (a key-ful node) we mint a *self-vouch reputation endorsement* over the bound image so a
+ *   configured cohort's referee verifier admits it; without one we return `undefined` (parent-reference
+ *   origination is the follow-on `cohort-topic-bootstrap-parent-reference`). A T0/T1 bootstrap with no
+ *   evidence is denied by a configured cohort until that lands — but the single-tier-0 milestone's
+ *   cohort-side tests construct evidence directly, so this does not block them.
+ * - **Tier ≥ maxNoPowTier+1 (T2/T3):** mint a proof-of-work — loop nonces until
+ *   `meetsDifficulty(hash.H(powPreimage(reg, nonce)), bits)`. Bound work ≈ `2^bits` hashes (default 20 ≈
+ *   ~1 M, sub-second). The loop is capped ({@link DEFAULT_POW_MAX_ITERATIONS}); on cap-exceeded it returns
+ *   `undefined` so the register proceeds without evidence rather than ever hanging the register path.
+ *
+ * Returns the **raw** envelope JSON bytes (`utf8(JSON.stringify(env))`), NOT the already-base64url string
+ * from `serializeBootstrapEvidenceEnvelope` — the service base64url-encodes them itself (returning the
+ * serialized string's bytes would double-encode the field). We obtain the raw bytes by decoding the
+ * canonical serializer output once, so the byte layout matches exactly what a verifier reconstructs.
+ */
+import { type IRingHash, type BootstrapBoundFields, type ReputationEvidenceV1 } from "@optimystic/db-core";
+/**
+ * Defensive cap on the PoW nonce search (~16.7 M hashes). Comfortably above the ~`2^bits` expected for
+ * the default 20-bit difficulty (~1 M), so a real miner solves long before the cap; hitting it (a
+ * mis-set, very-high `bits`) returns `undefined` rather than hanging the register path.
+ */
+export declare const DEFAULT_POW_MAX_ITERATIONS: number;
+/** The bound tuple the service hands the builder — the same shape a verifier binds via {@link bootstrapBoundImage}. */
+export type BootstrapEvidenceBuildParams = BootstrapBoundFields;
+/** Inputs to {@link createBootstrapEvidenceBuilder}. */
+export interface BootstrapEvidenceBuilderDeps {
+    /** The node's ring hash (SHA-256) — the same `H` the PoW verifier checks against. */
+    readonly hash: IRingHash;
+    /** Difficulty bits to mint at. Default {@link DEFAULT_POW_DIFFICULTY_BITS}. `0` solves on the first nonce (test). */
+    readonly bits?: number;
+    /** Highest tier exempt from PoW (T0/T1 → 1). Default {@link DEFAULT_MAX_NO_POW_TIER}. */
+    readonly maxNoPowTier?: number;
+    /** Nonce-search cap. Default {@link DEFAULT_POW_MAX_ITERATIONS}. */
+    readonly maxIterations?: number;
+    /**
+     * Optional self-vouch endorsement capability for a key-ful node: signs the bound image with the node's
+     * peer key and returns the referee (= self) + signature. Supplied → T0/T1 mints a reputation
+     * endorsement (the interim T0/T1 path until parent-reference origination lands); absent → T0/T1 carries
+     * no evidence.
+     */
+    readonly endorse?: (boundImage: Uint8Array) => Promise<ReputationEvidenceV1>;
+}
+/**
+ * Build the {@link import("@optimystic/db-core").CohortTopicServiceDeps.buildBootstrapEvidence} seam:
+ * a `(params) => Promise<Uint8Array | undefined>` that mints the cold-start evidence for the node's own
+ * register. PoW for T2/T3; a self-vouch reputation endorsement (when `endorse` is supplied) or nothing
+ * for T0/T1. Never throws and never hangs (the nonce loop is capped).
+ */
+export declare function createBootstrapEvidenceBuilder(deps: BootstrapEvidenceBuilderDeps): (params: BootstrapEvidenceBuildParams) => Promise<Uint8Array | undefined>;
+//# sourceMappingURL=bootstrap-evidence-builder.d.ts.map

package/dist/src/cohort-topic/bootstrap-evidence-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence-builder.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/bootstrap-evidence-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EASN,KAAK,SAAS,EACd,KAAK,oBAAoB,EAEzB,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAG7B;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAU,CAAC;AAElD,uHAAuH;AACvH,MAAM,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AAEhE,wDAAwD;AACxD,MAAM,WAAW,4BAA4B;IAC5C,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,qHAAqH;IACrH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC7E;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC7C,IAAI,EAAE,4BAA4B,GAChC,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAiC3E"}

package/dist/src/cohort-topic/bootstrap-evidence-builder.js

@@ -0,0 +1,79 @@
+/**
+ * Cohort-topic substrate — participant-side bootstrap-evidence builder (db-p2p side of the `buildBootstrapEvidence` seam).
+ *
+ * Implements the db-core `CohortTopicServiceDeps.buildBootstrapEvidence` seam for the node's participant
+ * role: on a cold-start `bootstrap: true` re-issue the service calls this with the register's own
+ * canonical `(topicId, tier, participantCoord, timestamp)` tuple (base64url wire strings) and attaches the
+ * returned bytes — **before** signing — into `RegisterV1.bootstrapEvidence`.
+ *
+ * - **Tier ≤ maxNoPowTier (T0/T1):** proof-of-work is not the expected evidence. With an `endorse`
+ *   capability (a key-ful node) we mint a *self-vouch reputation endorsement* over the bound image so a
+ *   configured cohort's referee verifier admits it; without one we return `undefined` (parent-reference
+ *   origination is the follow-on `cohort-topic-bootstrap-parent-reference`). A T0/T1 bootstrap with no
+ *   evidence is denied by a configured cohort until that lands — but the single-tier-0 milestone's
+ *   cohort-side tests construct evidence directly, so this does not block them.
+ * - **Tier ≥ maxNoPowTier+1 (T2/T3):** mint a proof-of-work — loop nonces until
+ *   `meetsDifficulty(hash.H(powPreimage(reg, nonce)), bits)`. Bound work ≈ `2^bits` hashes (default 20 ≈
+ *   ~1 M, sub-second). The loop is capped ({@link DEFAULT_POW_MAX_ITERATIONS}); on cap-exceeded it returns
+ *   `undefined` so the register proceeds without evidence rather than ever hanging the register path.
+ *
+ * Returns the **raw** envelope JSON bytes (`utf8(JSON.stringify(env))`), NOT the already-base64url string
+ * from `serializeBootstrapEvidenceEnvelope` — the service base64url-encodes them itself (returning the
+ * serialized string's bytes would double-encode the field). We obtain the raw bytes by decoding the
+ * canonical serializer output once, so the byte layout matches exactly what a verifier reconstructs.
+ */
+import { serializeBootstrapEvidenceEnvelope, bootstrapBoundImage, powPreimage, meetsDifficulty, DEFAULT_POW_DIFFICULTY_BITS, DEFAULT_MAX_NO_POW_TIER, bytesToB64url, b64urlToBytes, } from "@optimystic/db-core";
+import { randomBytes } from "@libp2p/crypto";
+/**
+ * Defensive cap on the PoW nonce search (~16.7 M hashes). Comfortably above the ~`2^bits` expected for
+ * the default 20-bit difficulty (~1 M), so a real miner solves long before the cap; hitting it (a
+ * mis-set, very-high `bits`) returns `undefined` rather than hanging the register path.
+ */
+export const DEFAULT_POW_MAX_ITERATIONS = 1 << 24;
+/**
+ * Build the {@link import("@optimystic/db-core").CohortTopicServiceDeps.buildBootstrapEvidence} seam:
+ * a `(params) => Promise<Uint8Array | undefined>` that mints the cold-start evidence for the node's own
+ * register. PoW for T2/T3; a self-vouch reputation endorsement (when `endorse` is supplied) or nothing
+ * for T0/T1. Never throws and never hangs (the nonce loop is capped).
+ */
+export function createBootstrapEvidenceBuilder(deps) {
+    const bits = deps.bits ?? DEFAULT_POW_DIFFICULTY_BITS;
+    const maxNoPowTier = deps.maxNoPowTier ?? DEFAULT_MAX_NO_POW_TIER;
+    const maxIterations = deps.maxIterations ?? DEFAULT_POW_MAX_ITERATIONS;
+    return async (params) => {
+        const bound = {
+            topicId: params.topicId,
+            tier: params.tier,
+            participantCoord: params.participantCoord,
+            timestamp: params.timestamp,
+        };
+        if (params.tier <= maxNoPowTier) {
+            // T0/T1: PoW is not the expected evidence. A key-ful node self-vouches; otherwise no evidence
+            // (the parent-reference path is the follow-on ticket — documented deferral).
+            if (deps.endorse === undefined) {
+                return undefined;
+            }
+            const reputation = await deps.endorse(bootstrapBoundImage(bound));
+            return rawEnvelopeBytes({ v: 1, reputation });
+        }
+        // T2/T3: mint a proof-of-work — search nonces until the digest meets the difficulty target.
+        for (let i = 0; i < maxIterations; i++) {
+            const nonce = randomBytes(16); // CSPRNG nonce — bound to the register tuple via the preimage
+            if (meetsDifficulty(deps.hash.H(powPreimage(bound, nonce)), bits)) {
+                return rawEnvelopeBytes({ v: 1, pow: { nonce: bytesToB64url(nonce) } });
+            }
+        }
+        // Cap exceeded (mis-set difficulty): attach nothing rather than hang. A configured cohort denies it.
+        return undefined;
+    };
+}
+/**
+ * The raw envelope JSON bytes the service expects (`utf8(JSON.stringify(env))`). Reuses the db-core
+ * canonical serializer (fixed field order, deterministic JSON) and decodes its base64url output back to
+ * the underlying bytes — so the layout is byte-identical to what a verifier reconstructs, with zero
+ * duplicated canonicalization here.
+ */
+function rawEnvelopeBytes(env) {
+    return b64urlToBytes(serializeBootstrapEvidenceEnvelope(env));
+}
+//# sourceMappingURL=bootstrap-evidence-builder.js.map

package/dist/src/cohort-topic/bootstrap-evidence-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence-builder.js","sourceRoot":"","sources":["../../../src/cohort-topic/bootstrap-evidence-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EACN,kCAAkC,EAClC,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,2BAA2B,EAC3B,uBAAuB,EACvB,aAAa,EACb,aAAa,GAKb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAI,EAAE,CAAC;AAwBlD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC7C,IAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,2BAA2B,CAAC;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,0BAA0B,CAAC;IAEvE,OAAO,KAAK,EAAE,MAAoC,EAAmC,EAAE;QACtF,MAAM,KAAK,GAAyB;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;YACjC,8FAA8F;YAC9F,6EAA6E;YAC7E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,OAAO,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,4FAA4F;QAC5F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,8DAA8D;YAC7F,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnE,OAAO,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QACD,qGAAqG;QACrG,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAgC;IACzD,OAAO,aAAa,CAAC,kCAAkC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/src/cohort-topic/bootstrap-evidence-verifiers.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Cohort-topic substrate — real bootstrap-evidence verifiers (db-p2p side of the anti-DoS gate).
+ *
+ * db-core owns the *policy* (which evidence kinds satisfy which tier) and the crypto-free envelope /
+ * bound-image / PoW-preimage helpers (`antidos/bootstrap-evidence-envelope.ts`); it deliberately embeds
+ * no specific PoW or reputation scheme. This module supplies the **self-contained cryptographic checks**
+ * the host injects into `createBootstrapEvidence`, binding the node's `RingHash` (the same SHA-256 the
+ * addressing uses) and the cohort-topic peer-key `verifyPeerSig` — no new crypto dependency.
+ *
+ * Both verifiers are **synchronous** (one hash, or one signature verify + two reputation-map reads) and
+ * **total** — any parse / decode / verify failure on attacker-supplied input yields `false`, never a
+ * throw — because `BootstrapEvidence.verify` runs inside `member-engine.ts`'s `runGuards` on every
+ * register and must do no network I/O (that would itself be a DoS amplifier).
+ */
+import { type IRingHash, type RegisterV1 } from "@optimystic/db-core";
+/**
+ * The slice of a peer-reputation service the bootstrap-evidence referee verifier consults — a subset of
+ * {@link import("../reputation/types.js").IPeerReputation} that `PeerReputationService` satisfies
+ * directly. "Sufficient reputation" is **stronger than mere non-ban**: the referee must be *both* not
+ * banned *and* below the deprioritize threshold.
+ */
+export interface BootstrapReputationView {
+    /** True when `peerId` (a peer-id string) is banned / excluded from operations. */
+    isBanned(peerId: string): boolean;
+    /** Effective reputation score for `peerId` (0 = a clean, unseen peer). Lower is better. */
+    getScore(peerId: string): number;
+}
+/**
+ * The default "sufficient reputation" cutoff: a referee with `score < deprioritize` is reputable enough
+ * to endorse a bootstrap. Mirrors the reputation service's default `deprioritize` threshold (20) so a
+ * default-configured node and the gate agree on "sufficient". Strict `<`, so a referee *at* the
+ * threshold is not sufficient.
+ */
+export declare const DEFAULT_DEPRIORITIZE_THRESHOLD: number;
+/** Inputs to {@link createPoWVerifier}. */
+export interface PoWVerifierDeps {
+    /** The node's ring hash (SHA-256) — the same `H` the addressing uses; hashes the PoW preimage. */
+    readonly hash: IRingHash;
+    /** Required leading-zero bits. Default {@link DEFAULT_POW_DIFFICULTY_BITS}. `0` admits any nonce (test). */
+    readonly bits?: number;
+}
+/**
+ * A real proof-of-work verifier for the T2/T3 evidence path. Self-contained — no subsystem, one hash.
+ *
+ * ```
+ * env = parseBootstrapEvidenceEnvelope(reg); if (!env?.pow) return false
+ * h = hash.H(powPreimage(reg, b64urlToBytes(env.pow.nonce)))
+ * return meetsDifficulty(h, bits)
+ * ```
+ *
+ * The preimage binds `(topicId, tier, participantCoord, timestamp)` (via {@link bootstrapBoundImage}),
+ * so a PoW minted for one topic / peer / time cannot bootstrap another. Any absent `pow`, malformed
+ * envelope, or non-base64url nonce → `false` (fails closed).
+ */
+export declare function createPoWVerifier(deps: PoWVerifierDeps): (reg: RegisterV1) => boolean;
+/** Inputs to {@link createReputationVerifier}. */
+export interface ReputationVerifierDeps {
+    /** Local reputation view the referee is scored against (not banned + below the threshold). */
+    readonly reputation: BootstrapReputationView;
+    /** Strict "sufficient reputation" cutoff. Default {@link DEFAULT_DEPRIORITIZE_THRESHOLD}. */
+    readonly deprioritizeThreshold?: number;
+}
+/**
+ * A real reputation-endorsement verifier: a *referee* peer endorses the bootstrap by peer-key-signing
+ * the {@link bootstrapBoundImage}, and the cohort checks the signature **and** that the referee is
+ * sufficiently reputable in the **local** reputation view.
+ *
+ * ```
+ * env = parseBootstrapEvidenceEnvelope(reg); if (!env?.reputation) return false
+ * refereeBytes = b64urlToBytes(env.reputation.referee)
+ * if (!verifyPeerSig(refereeBytes, bootstrapBoundImage(reg), b64urlToBytes(env.reputation.sig))) return false
+ * refereeId = bytesToPeerIdString(refereeBytes)
+ * return !reputation.isBanned(refereeId) && reputation.getScore(refereeId) < deprioritizeThreshold
+ * ```
+ *
+ * The `referee` MAY equal the participant (a reputable participant self-vouches with its own peer key).
+ * An unknown referee scores `0` (a clean, unseen peer) and so is sufficient; a referee exactly *at* the
+ * threshold is not (strict `<`). Bad sig / banned / over-threshold / malformed → `false` (fails closed).
+ */
+export declare function createReputationVerifier(deps: ReputationVerifierDeps): (reg: RegisterV1) => boolean;
+//# sourceMappingURL=bootstrap-evidence-verifiers.d.ts.map

package/dist/src/cohort-topic/bootstrap-evidence-verifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence-verifiers.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/bootstrap-evidence-verifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAON,KAAK,SAAS,EACd,KAAK,UAAU,EACf,MAAM,qBAAqB,CAAC;AAK7B;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAkC,CAAC;AAE9E,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC/B,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAcrF;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACtC,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,6FAA6F;IAC7F,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAmBnG"}

package/dist/src/cohort-topic/bootstrap-evidence-verifiers.js

@@ -0,0 +1,93 @@
+/**
+ * Cohort-topic substrate — real bootstrap-evidence verifiers (db-p2p side of the anti-DoS gate).
+ *
+ * db-core owns the *policy* (which evidence kinds satisfy which tier) and the crypto-free envelope /
+ * bound-image / PoW-preimage helpers (`antidos/bootstrap-evidence-envelope.ts`); it deliberately embeds
+ * no specific PoW or reputation scheme. This module supplies the **self-contained cryptographic checks**
+ * the host injects into `createBootstrapEvidence`, binding the node's `RingHash` (the same SHA-256 the
+ * addressing uses) and the cohort-topic peer-key `verifyPeerSig` — no new crypto dependency.
+ *
+ * Both verifiers are **synchronous** (one hash, or one signature verify + two reputation-map reads) and
+ * **total** — any parse / decode / verify failure on attacker-supplied input yields `false`, never a
+ * throw — because `BootstrapEvidence.verify` runs inside `member-engine.ts`'s `runGuards` on every
+ * register and must do no network I/O (that would itself be a DoS amplifier).
+ */
+import { parseBootstrapEvidenceEnvelope, powPreimage, bootstrapBoundImage, meetsDifficulty, DEFAULT_POW_DIFFICULTY_BITS, b64urlToBytes, } from "@optimystic/db-core";
+import { DEFAULT_THRESHOLDS } from "../reputation/types.js";
+import { verifyPeerSig } from "./peer-sig.js";
+import { bytesToPeerIdString } from "./peer-codec.js";
+/**
+ * The default "sufficient reputation" cutoff: a referee with `score < deprioritize` is reputable enough
+ * to endorse a bootstrap. Mirrors the reputation service's default `deprioritize` threshold (20) so a
+ * default-configured node and the gate agree on "sufficient". Strict `<`, so a referee *at* the
+ * threshold is not sufficient.
+ */
+export const DEFAULT_DEPRIORITIZE_THRESHOLD = DEFAULT_THRESHOLDS.deprioritize;
+/**
+ * A real proof-of-work verifier for the T2/T3 evidence path. Self-contained — no subsystem, one hash.
+ *
+ * ```
+ * env = parseBootstrapEvidenceEnvelope(reg); if (!env?.pow) return false
+ * h = hash.H(powPreimage(reg, b64urlToBytes(env.pow.nonce)))
+ * return meetsDifficulty(h, bits)
+ * ```
+ *
+ * The preimage binds `(topicId, tier, participantCoord, timestamp)` (via {@link bootstrapBoundImage}),
+ * so a PoW minted for one topic / peer / time cannot bootstrap another. Any absent `pow`, malformed
+ * envelope, or non-base64url nonce → `false` (fails closed).
+ */
+export function createPoWVerifier(deps) {
+    const bits = deps.bits ?? DEFAULT_POW_DIFFICULTY_BITS;
+    return (reg) => {
+        try {
+            const env = parseBootstrapEvidenceEnvelope(reg);
+            if (env?.pow === undefined) {
+                return false; // not offered / not a PoW envelope
+            }
+            const nonce = b64urlToBytes(env.pow.nonce);
+            return meetsDifficulty(deps.hash.H(powPreimage(reg, nonce)), bits);
+        }
+        catch {
+            return false; // any decode / hash failure on attacker input → fail closed
+        }
+    };
+}
+/**
+ * A real reputation-endorsement verifier: a *referee* peer endorses the bootstrap by peer-key-signing
+ * the {@link bootstrapBoundImage}, and the cohort checks the signature **and** that the referee is
+ * sufficiently reputable in the **local** reputation view.
+ *
+ * ```
+ * env = parseBootstrapEvidenceEnvelope(reg); if (!env?.reputation) return false
+ * refereeBytes = b64urlToBytes(env.reputation.referee)
+ * if (!verifyPeerSig(refereeBytes, bootstrapBoundImage(reg), b64urlToBytes(env.reputation.sig))) return false
+ * refereeId = bytesToPeerIdString(refereeBytes)
+ * return !reputation.isBanned(refereeId) && reputation.getScore(refereeId) < deprioritizeThreshold
+ * ```
+ *
+ * The `referee` MAY equal the participant (a reputable participant self-vouches with its own peer key).
+ * An unknown referee scores `0` (a clean, unseen peer) and so is sufficient; a referee exactly *at* the
+ * threshold is not (strict `<`). Bad sig / banned / over-threshold / malformed → `false` (fails closed).
+ */
+export function createReputationVerifier(deps) {
+    const threshold = deps.deprioritizeThreshold ?? DEFAULT_DEPRIORITIZE_THRESHOLD;
+    return (reg) => {
+        try {
+            const env = parseBootstrapEvidenceEnvelope(reg);
+            if (env?.reputation === undefined) {
+                return false; // not offered / not a reputation envelope
+            }
+            const refereeBytes = b64urlToBytes(env.reputation.referee);
+            const sig = b64urlToBytes(env.reputation.sig);
+            if (!verifyPeerSig(refereeBytes, bootstrapBoundImage(reg), sig)) {
+                return false; // signature does not bind this register's tuple to the referee key
+            }
+            const refereeId = bytesToPeerIdString(refereeBytes);
+            return !deps.reputation.isBanned(refereeId) && deps.reputation.getScore(refereeId) < threshold;
+        }
+        catch {
+            return false; // any decode / verify failure on attacker input → fail closed
+        }
+    };
+}
+//# sourceMappingURL=bootstrap-evidence-verifiers.js.map

package/dist/src/cohort-topic/bootstrap-evidence-verifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-evidence-verifiers.js","sourceRoot":"","sources":["../../../src/cohort-topic/bootstrap-evidence-verifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACN,8BAA8B,EAC9B,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,2BAA2B,EAC3B,aAAa,GAGb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAetD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,kBAAkB,CAAC,YAAY,CAAC;AAU9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,2BAA2B,CAAC;IACtD,OAAO,CAAC,GAAe,EAAW,EAAE;QACnC,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,mCAAmC;YAClD,CAAC;YACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC,CAAC,4DAA4D;QAC3E,CAAC;IACF,CAAC,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,IAAI,8BAA8B,CAAC;IAC/E,OAAO,CAAC,GAAe,EAAW,EAAE;QACnC,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC,CAAC,0CAA0C;YACzD,CAAC;YACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,KAAK,CAAC,CAAC,mEAAmE;YAClF,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC,CAAC,8DAA8D;QAC7E,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/src/cohort-topic/bootstrap-parent-reference.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Cohort-topic substrate — real signed-parent-reference bootstrap-evidence verifier (db-p2p side).
+ *
+ * The committed-work proxy for the no-proof-of-work path: a `bootstrap: true` register carries a **signed
+ * reference to a parent topic that actually exists**, and the cohort admits it only after confirming the
+ * parent topic exists in locally-available committed / membership state. This is the *only* accepted
+ * evidence for the committed tiers (T0/T1) and the third option for T2/T3 (`PoW || reputation || parent-ref`).
+ *
+ * It replaces the interim reputation stand-in for `verifyParentReference` that
+ * `cohort-topic-bootstrap-evidence-verifiers` left in `host.ts`.
+ *
+ * The verifier is **synchronous** (it runs in `member-engine.ts`'s `runGuards` on every register) and
+ * **total** (any parse / decode / verify failure on attacker input yields `false`, never a throw). The
+ * existence check therefore consults a **synchronous local view** — never a network fetch, which inside an
+ * admission gate would itself be a DoS amplifier.
+ *
+ * Two independent checks, both must pass (`docs/cohort-topic.md` §Anti-DoS bullet 4):
+ *
+ * 1. **Signed reference (anti-replay).** The participant peer-key-signs the {@link parentRefSigningImage}
+ *    — the bound tuple extended with `parentTopicId` — so a reference minted for one
+ *    `(topic, tier, peer, time, parent)` cannot be lifted onto another register. Verified against the
+ *    participant's own peer key, so it stands alone even in key-less mode (where the outer register
+ *    signature is absent).
+ * 2. **Existence.** The referenced parent topic must exist in locally-available committed / membership
+ *    state, via the injectable synchronous {@link BootstrapParentTopicView}.
+ *
+ * A node only admits a parent-ref bootstrap for a parent topic it has *locally cached* a cert/commit for
+ * (fail-closed when unknown). That is acceptable for an admission gate: a participant whose parent the node
+ * does not know retries / uses PoW (T2/T3); a genuinely-new committed (T0/T1) topic is bootstrapped by
+ * nodes that already serve the parent's committed work, which hold its cert. A *richer* check — that the
+ * parent's commit certificate names *this* child topic — is the follow-on
+ * `cohort-topic-parent-ref-tx-log-content`, not this module.
+ */
+import { type RegisterV1, type RingCoord } from "@optimystic/db-core";
+/**
+ * A synchronous local view answering "does this node locally know parent topic `parentTopicId` exists?".
+ * Backed (in the host default) by the committed / FRET membership state the node already holds — never a
+ * network lookup (a round-trip inside an admission gate is a DoS amplifier).
+ */
+export interface BootstrapParentTopicView {
+    /**
+     * True iff the node locally knows parent topic `parentTopicId` exists (a committed cohort serves it /
+     * its membership cert is cached) for a cohort at `tier`. `tier` is the registering child's tier and
+     * routes the lookup to the committed (T0/T1) or FRET (T2/T3) backing, mirroring the membership source.
+     */
+    exists(parentTopicId: Uint8Array, tier: number): boolean;
+}
+/** Inputs to {@link createParentReferenceVerifier}. */
+export interface ParentReferenceVerifierDeps {
+    /** The synchronous local existence view the verifier consults (no network I/O). */
+    readonly parentTopicView: BootstrapParentTopicView;
+}
+/**
+ * The real, all-tiers `verifyParentReference(reg) => boolean`. Total and synchronous:
+ *
+ * ```
+ * env = parseBootstrapEvidenceEnvelope(reg); if (!env?.parentRef) return false
+ * if (parentRef.parentTopicId === reg.topicId) return false            // a topic cannot vouch for itself
+ * if (!verifyPeerSig(participantCoord, parentRefSigningImage(reg, parentTopicId), parentRef.sig)) return false
+ * return parentTopicView.exists(parentTopicId, reg.tier)
+ * ```
+ *
+ * - Absent `parentRef`, a malformed envelope, a bad/non-base64url signature, or an unknown parent → `false`
+ *   (fails closed → `unwilling_cohort`).
+ * - The self-referential guard rejects `parentTopicId === reg.topicId`: a topic cannot reference itself to
+ *   prove its own existence (a circular bootstrap).
+ */
+export declare function createParentReferenceVerifier(deps: ParentReferenceVerifierDeps): (reg: RegisterV1) => boolean;
+/** A synchronous local "is a cohort cached for this coord?" read — the {@link FretMembershipSource} cache shape. */
+export interface LocalCohortExistence {
+    /** True iff a `MembershipCertV1` is locally cached for `coord`. */
+    has(coord: RingCoord): boolean;
+}
+/** Inputs to {@link createDefaultParentTopicView}. */
+export interface DefaultParentTopicViewDeps {
+    /** The FRET membership cache (T2/T3 backing): a cached cert means a cohort genuinely serves the parent. */
+    readonly membershipSource: LocalCohortExistence;
+    /** Tier addressing — supplies `coord0(parentTopicId)`, the parent topic's root cohort coordinate. */
+    readonly addressing: {
+        coord0(topicId: Uint8Array): RingCoord;
+    };
+    /**
+     * Optional committed-state backing for the committed tiers (T0/T1). Reads `coord_0(parentTopicId)`. When
+     * **omitted the committed tiers fail closed** (return `false`) — a FRET-cached cert (T2/T3 membership)
+     * must NOT vouch for committed-tier parent existence (committed-tier integrity). A node supplies a real
+     * committed-by-coord reader (e.g. a future tx-log / commit-cert index) here when one is available.
+     */
+    readonly committedReader?: (coord: RingCoord) => boolean;
+    /** Highest tier exempt from PoW / served by committed work (T0/T1 → 1). Default {@link DEFAULT_MAX_NO_POW_TIER}. */
+    readonly maxNoPowTier?: number;
+}
+/**
+ * The host-default {@link BootstrapParentTopicView}, tier-routed exactly like the membership source
+ * (`docs/cohort-topic.md` §Membership source):
+ *
+ * - **T0/T1 (committed tiers):** consult `committedReader` — the committed-state backing. Absent → `false`
+ *   (fail closed). A FRET-cached cert never satisfies a committed-tier existence check, so committed-tier
+ *   integrity holds: a parent known only as a FRET (T2/T3) cohort cannot back a committed parent reference.
+ * - **T2/T3:** `membershipSource.has(coord_0(parentTopicId))` — a cached `MembershipCertV1` means a cohort
+ *   is genuinely serving the parent topic.
+ *
+ * **Known limitation (interim).** No coord-keyed committed-membership index exists yet (the transaction-log
+ * commit certificate is keyed by action, not by `coord_0`), so a node typically wires no `committedReader`
+ * and T0/T1 parent-ref existence fails closed. T2/T3 parent-ref is fully real today. The dedicated committed
+ * backing is the follow-on `cohort-topic-parent-ref-tx-log-content`.
+ */
+export declare function createDefaultParentTopicView(deps: DefaultParentTopicViewDeps): BootstrapParentTopicView;
+//# sourceMappingURL=bootstrap-parent-reference.d.ts.map

package/dist/src/cohort-topic/bootstrap-parent-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-parent-reference.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/bootstrap-parent-reference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAKN,KAAK,UAAU,EACf,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAG7B;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACxC;;;;OAIG;IACH,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACzD;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;CACnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,2BAA2B,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAwB7G;AAED,oHAAoH;AACpH,MAAM,WAAW,oBAAoB;IACpC,mEAAmE;IACnE,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;CAC/B;AAED,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,2GAA2G;IAC3G,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,qGAAqG;IACrG,QAAQ,CAAC,UAAU,EAAE;QAAE,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC;IACzD,oHAAoH;IACpH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B,GAAG,wBAAwB,CAevG"}

package/dist/src/cohort-topic/bootstrap-parent-reference.js

@@ -0,0 +1,108 @@
+/**
+ * Cohort-topic substrate — real signed-parent-reference bootstrap-evidence verifier (db-p2p side).
+ *
+ * The committed-work proxy for the no-proof-of-work path: a `bootstrap: true` register carries a **signed
+ * reference to a parent topic that actually exists**, and the cohort admits it only after confirming the
+ * parent topic exists in locally-available committed / membership state. This is the *only* accepted
+ * evidence for the committed tiers (T0/T1) and the third option for T2/T3 (`PoW || reputation || parent-ref`).
+ *
+ * It replaces the interim reputation stand-in for `verifyParentReference` that
+ * `cohort-topic-bootstrap-evidence-verifiers` left in `host.ts`.
+ *
+ * The verifier is **synchronous** (it runs in `member-engine.ts`'s `runGuards` on every register) and
+ * **total** (any parse / decode / verify failure on attacker input yields `false`, never a throw). The
+ * existence check therefore consults a **synchronous local view** — never a network fetch, which inside an
+ * admission gate would itself be a DoS amplifier.
+ *
+ * Two independent checks, both must pass (`docs/cohort-topic.md` §Anti-DoS bullet 4):
+ *
+ * 1. **Signed reference (anti-replay).** The participant peer-key-signs the {@link parentRefSigningImage}
+ *    — the bound tuple extended with `parentTopicId` — so a reference minted for one
+ *    `(topic, tier, peer, time, parent)` cannot be lifted onto another register. Verified against the
+ *    participant's own peer key, so it stands alone even in key-less mode (where the outer register
+ *    signature is absent).
+ * 2. **Existence.** The referenced parent topic must exist in locally-available committed / membership
+ *    state, via the injectable synchronous {@link BootstrapParentTopicView}.
+ *
+ * A node only admits a parent-ref bootstrap for a parent topic it has *locally cached* a cert/commit for
+ * (fail-closed when unknown). That is acceptable for an admission gate: a participant whose parent the node
+ * does not know retries / uses PoW (T2/T3); a genuinely-new committed (T0/T1) topic is bootstrapped by
+ * nodes that already serve the parent's committed work, which hold its cert. A *richer* check — that the
+ * parent's commit certificate names *this* child topic — is the follow-on
+ * `cohort-topic-parent-ref-tx-log-content`, not this module.
+ */
+import { parseBootstrapEvidenceEnvelope, parentRefSigningImage, DEFAULT_MAX_NO_POW_TIER, b64urlToBytes, } from "@optimystic/db-core";
+import { verifyPeerSig } from "./peer-sig.js";
+/**
+ * The real, all-tiers `verifyParentReference(reg) => boolean`. Total and synchronous:
+ *
+ * ```
+ * env = parseBootstrapEvidenceEnvelope(reg); if (!env?.parentRef) return false
+ * if (parentRef.parentTopicId === reg.topicId) return false            // a topic cannot vouch for itself
+ * if (!verifyPeerSig(participantCoord, parentRefSigningImage(reg, parentTopicId), parentRef.sig)) return false
+ * return parentTopicView.exists(parentTopicId, reg.tier)
+ * ```
+ *
+ * - Absent `parentRef`, a malformed envelope, a bad/non-base64url signature, or an unknown parent → `false`
+ *   (fails closed → `unwilling_cohort`).
+ * - The self-referential guard rejects `parentTopicId === reg.topicId`: a topic cannot reference itself to
+ *   prove its own existence (a circular bootstrap).
+ */
+export function createParentReferenceVerifier(deps) {
+    const { parentTopicView } = deps;
+    return (reg) => {
+        try {
+            const env = parseBootstrapEvidenceEnvelope(reg);
+            if (env?.parentRef === undefined) {
+                return false; // not offered / not a parent-reference envelope
+            }
+            const { parentTopicId, sig } = env.parentRef;
+            // A topic cannot vouch for its own existence (self-referential / circular bootstrap).
+            if (parentTopicId === reg.topicId) {
+                return false;
+            }
+            // 1. Signed reference (anti-replay): the participant binds THIS parent to THIS register.
+            const image = parentRefSigningImage(reg, parentTopicId);
+            if (!verifyPeerSig(b64urlToBytes(reg.participantCoord), image, b64urlToBytes(sig))) {
+                return false;
+            }
+            // 2. Existence: the parent topic must exist in locally-available committed / membership state.
+            return parentTopicView.exists(b64urlToBytes(parentTopicId), reg.tier);
+        }
+        catch {
+            return false; // any decode / verify failure on attacker input → fail closed
+        }
+    };
+}
+/**
+ * The host-default {@link BootstrapParentTopicView}, tier-routed exactly like the membership source
+ * (`docs/cohort-topic.md` §Membership source):
+ *
+ * - **T0/T1 (committed tiers):** consult `committedReader` — the committed-state backing. Absent → `false`
+ *   (fail closed). A FRET-cached cert never satisfies a committed-tier existence check, so committed-tier
+ *   integrity holds: a parent known only as a FRET (T2/T3) cohort cannot back a committed parent reference.
+ * - **T2/T3:** `membershipSource.has(coord_0(parentTopicId))` — a cached `MembershipCertV1` means a cohort
+ *   is genuinely serving the parent topic.
+ *
+ * **Known limitation (interim).** No coord-keyed committed-membership index exists yet (the transaction-log
+ * commit certificate is keyed by action, not by `coord_0`), so a node typically wires no `committedReader`
+ * and T0/T1 parent-ref existence fails closed. T2/T3 parent-ref is fully real today. The dedicated committed
+ * backing is the follow-on `cohort-topic-parent-ref-tx-log-content`.
+ */
+export function createDefaultParentTopicView(deps) {
+    const { membershipSource, addressing, committedReader } = deps;
+    const maxNoPowTier = deps.maxNoPowTier ?? DEFAULT_MAX_NO_POW_TIER;
+    return {
+        exists(parentTopicId, tier) {
+            const coord = addressing.coord0(parentTopicId);
+            if (tier <= maxNoPowTier) {
+                // Committed tiers (T0/T1): require a committed backing; fail closed without one. The FRET cache
+                // must not vouch for committed-tier existence (committed-tier integrity).
+                return committedReader !== undefined && committedReader(coord);
+            }
+            // T2/T3: the FRET membership cache reflects a cohort serving the parent topic.
+            return membershipSource.has(coord);
+        },
+    };
+}
+//# sourceMappingURL=bootstrap-parent-reference.js.map

package/dist/src/cohort-topic/bootstrap-parent-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-parent-reference.js","sourceRoot":"","sources":["../../../src/cohort-topic/bootstrap-parent-reference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACN,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,GAGb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAsB9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAiC;IAC9E,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,GAAe,EAAW,EAAE;QACnC,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,CAAC,gDAAgD;YAC/D,CAAC;YACD,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;YAC7C,sFAAsF;YACtF,IAAI,aAAa,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC;YACd,CAAC;YACD,yFAAyF;YACzF,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpF,OAAO,KAAK,CAAC;YACd,CAAC;YACD,+FAA+F;YAC/F,OAAO,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC,CAAC,8DAA8D;QAC7E,CAAC;IACF,CAAC,CAAC;AACH,CAAC;AAyBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC5E,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAC;IAClE,OAAO;QACN,MAAM,CAAC,aAAyB,EAAE,IAAY;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,IAAI,IAAI,YAAY,EAAE,CAAC;gBAC1B,gGAAgG;gBAChG,0EAA0E;gBAC1E,OAAO,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC;YACD,+EAA+E;YAC/E,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/src/cohort-topic/change-bridge.d.ts

@@ -0,0 +1,65 @@
+import type { CohortTopicService, CollectionChangeEvent, CollectionChangeListener, CommitCert, IBlockChangeNotifier } from "@optimystic/db-core";
+/**
+ * The local commit feed the bridge observes: a {@link IBlockChangeNotifier} (the node's
+ * `StorageRepo`) extended with the catch-all {@link onAnyCollectionChange} the bridge needs to see
+ * EVERY commit — it cannot enumerate collection ids ahead of time to subscribe per-collection, and
+ * origination must fire whether or not anyone subscribed to that collection.
+ */
+export interface ChangeBridgeSource extends IBlockChangeNotifier {
+    onAnyCollectionChange(listener: CollectionChangeListener): () => void;
+}
+export interface CohortTopicChangeNotifierDeps {
+    /** The local node's commit feed (its `StorageRepo`). */
+    readonly source: ChangeBridgeSource;
+    /** The cohort-topic substrate whose `onLocalCommit` origination hook receives member commits. */
+    readonly service: CohortTopicService;
+    /**
+     * True iff this node is a cohort member responsible for this change event's reactivity-topic fan-out.
+     * Receives the whole {@link CollectionChangeEvent} (not just the collection id) because the reactivity
+     * topic is tail-anchored — `H(event.tailId ‖ "reactivity")` — so the gate needs `event.tailId` to
+     * derive the topic's `coord_0` cohort. A tail-less event (a read-driven promotion) is never a member.
+     */
+    readonly selfIsCohortMember: (event: CollectionChangeEvent) => boolean;
+    /** Resolve the pass-through commit cert for a change event (e.g. the cluster commit-cert store). */
+    readonly extractCommitCert: (event: CollectionChangeEvent) => CommitCert | undefined;
+}
+/**
+ * The reactivity/matchmaking **origination point**: bridge the local single-node change-notifier
+ * primitive into the networked cohort-topic substrate.
+ *
+ * On EVERY commit landing on this node (via the catch-all {@link ChangeBridgeSource.onAnyCollectionChange}
+ * feed), if this node is a cohort member for the collection's reactivity topic, the bridge hands the
+ * `CollectionChangeEvent` plus the pass-through {@link CommitCert} to `service.onLocalCommit` —
+ * reactivity reuses the commit cert's threshold signature directly and never re-signs. A commit on a
+ * non-member node (no fan-out responsibility) or one for which no cert is retained (nothing
+ * authoritative to forward) is a no-op. A throwing downstream hook is isolated + logged so
+ * origination can never break the commit (matching the {@link IBlockChangeNotifier} listener contract).
+ *
+ * The returned value IS an {@link IBlockChangeNotifier}: it is what `network-transactor` takes as its
+ * `localChangeNotifier`, so per-collection {@link IBlockChangeNotifier.onCollectionChange} subscribers
+ * (e.g. the Quereus reactive-watch vtab) keep working — those subscriptions delegate straight to
+ * `source`. Origination runs independently on the catch-all feed.
+ *
+ * `makeCohortTopicChangeNotifier` discards the catch-all unsubscribe (node-lifetime by intent) for the
+ * unit tests; the node assembly uses {@link attachCohortChangeBridge}, which returns the teardown.
+ */
+export declare function makeCohortTopicChangeNotifier(deps: CohortTopicChangeNotifierDeps): IBlockChangeNotifier;
+/**
+ * Wire the cohort-topic origination bridge as `node`'s `blockChangeNotifier` (the value the
+ * `NetworkTransactor` consumes as its `localChangeNotifier`). Call this from the node assembly once a
+ * {@link CohortTopicService} is running on the node, passing the node's `StorageRepo` as `source` and
+ * the membership + cert-extraction seams.
+ *
+ * Returns the installed `notifier` plus an idempotent `unsubscribe` that tears down the catch-all
+ * origination subscription — the node assembly calls it on node stop (alongside `host.stop()`) so the
+ * origination feed is released before the node's transports close. Tearing it down stops further
+ * origination but leaves the per-collection `onCollectionChange` delegation intact (those subscriptions
+ * live on the `source` `StorageRepo`, not on the bridge).
+ */
+export declare function attachCohortChangeBridge(node: {
+    blockChangeNotifier?: IBlockChangeNotifier;
+}, deps: CohortTopicChangeNotifierDeps): {
+    notifier: IBlockChangeNotifier;
+    unsubscribe: () => void;
+};
+//# sourceMappingURL=change-bridge.d.ts.map

package/dist/src/cohort-topic/change-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-bridge.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/change-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAKjJ;;;;;GAKG;AACH,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC/D,qBAAqB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,MAAM,IAAI,CAAC;CACtE;AAED,MAAM,WAAW,6BAA6B;IAC7C,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC;IACvE,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,UAAU,GAAG,SAAS,CAAC;CACrF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,6BAA6B,GAAG,oBAAoB,CAEvG;AAoCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACvC,IAAI,EAAE;IAAE,mBAAmB,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACpD,IAAI,EAAE,6BAA6B,GACjC;IAAE,QAAQ,EAAE,oBAAoB,CAAC;IAAC,WAAW,EAAE,MAAM,IAAI,CAAA;CAAE,CAI7D"}