@serfab/cadre-core 0.13.0 → 1.0.0

package/dist/strand-first-sync-gate.js

@@ -0,0 +1,208 @@
+/**
+ * The first-sync write gate for a JOINING machine.
+ *
+ * A machine that has never received anything from another member of a strand must not
+ * commit to it. With no strand peer connected, Optimystic's cohort for every block is the
+ * machine itself, so the first write to a table finds no collection locally and INVENTS
+ * one — exactly what a founder writing alone legitimately does. When the connection comes
+ * up, two independently created histories share one collection id: Optimystic keeps one and
+ * drops the other's commits, or never reconciles them at all. The joiner's own rows silently
+ * vanish (`joining-machine-writes-before-first-sync-fork-tables`). Optimystic cannot tell a
+ * founder from a joiner; sereus can, because the launch knows whether it is founding.
+ *
+ * The invariant this module enforces: **a machine that has never held this strand's
+ * `Strand.Header` row, and has not read every `App` table once, must not commit to it.**
+ * The founder writes the Header in its bootstrap; every other machine can only receive it
+ * from a peer, so "no local Header" means "never synced". The gate therefore holds the
+ * freshly initialized `StrandDatabase` back from the app — `StrandInstance.database` stays
+ * unset and the instance reports `'syncing'` — and probes on a cadence until the Header is
+ * readable AND a read of each app table settles, at which point the database is published
+ * and the instance goes `'active'`. A machine that already holds the Header (a restart, a
+ * hibernation resume, a founder) passes the probe on the first try and is never gated, so
+ * offline-first writes on a machine that has synced before keep working.
+ *
+ * Why the app tables too: the Header is ONE collection. It reaches a joiner ahead of the
+ * founder's app-table collections (peer-join backfill and pull-on-read deliver those
+ * separately), and a write to a table whose collection this machine has not yet fetched
+ * invents one exactly as a lone joiner did. Measured on the reference chat schema
+ * (2026-09-16, direct connections, Header-only probe): the joiner's participant + message
+ * written the instant `addStrand` resolved diverged in 3 of 4 runs. Reading each table once
+ * pulls its collection while the founder is reachable, so the write that follows appends.
+ *
+ * Every probe is a read (`Strand.Header`, then `select count(1)` on each `App` table). Reads
+ * never invent a collection (Optimystic's `Collection.open` resolves undefined on an
+ * authoritatively absent header, and throws on an unreachable one), so probing is safe to
+ * repeat and a throw is just "not yet". A table nobody has written yet reads as absent on
+ * every machine; the first write to it still creates its collection — see `docs/strands.md`
+ * ("Joining") for that residual.
+ *
+ * Owned by `StrandInstanceManager`: created in `buildStrandRuntime` for a non-founder launch
+ * whose first probe finds no Header, stopped and dropped in `releaseRuntime` (so a quiesce →
+ * resume rebuild re-probes over the same store), and force-opened when a founder request
+ * runs the bootstrap against the still-gated database (`foundExistingStrand`).
+ *
+ * NOTE: the gate covers app and membership tables, not the schema catalog. Every launch —
+ * joiner or founder — writes the catalog collection (`optimystic/schema` plus two
+ * hash-named blocks, measured 2026-09-16) alone, during `connectToStrand`'s schema apply,
+ * before any peer contact. That is the same "two histories under one id" shape this gate
+ * exists to prevent, and it is only safe because both sides derive byte-identical content
+ * from the same schema text. If the catalog ever carries per-machine or ordering-dependent
+ * content (optimystic's own `0.5-same-named-tables-in-two-schemas-share-storage` re-keys
+ * it), a joiner's catalog will fork against the founder's — gate the schema apply on the
+ * Header too, or have optimystic open the catalog read-only when a peer already holds it.
+ */
+import debug from 'debug';
+import { defaultTimeoutScheduler } from './timeout-scheduler.js';
+const log = debug('sereus:cadre:strand-first-sync');
+/** How often a gated launch re-probes (`Strand.Header`, then every `App` table) while waiting for its first sync. */
+export const DEFAULT_STRAND_FIRST_SYNC_POLL_MS = 500;
+/**
+ * How long `CadreNode.addStrand` waits for a joining machine's first sync before rejecting
+ * with {@link StrandAwaitingFirstSyncError}. Measured: over a direct connection the
+ * joiner reads the founder's rows about 1.3 s after `addStrand` would previously have
+ * resolved; a relayed path is slower, and a phone that just redeemed an invitation has the
+ * host reachable moments ago, so 30 s is generous without leaving an app hanging.
+ */
+export const DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS = 30000;
+/**
+ * Thrown by `CadreNode.addStrand` / `whenStrandWritable` when a joining machine has not
+ * received the strand's data from any other member within the wait budget. RETRYABLE: the
+ * strand stays launched and keeps probing, so a later `addStrand` (or `whenStrandWritable`)
+ * for the same strand completes the attach once another member is reachable; the
+ * `strand:writable` event fires at that moment too.
+ */
+export class StrandAwaitingFirstSyncError extends Error {
+    constructor(strandId, waitedMs) {
+        super(`Strand ${strandId} is not writable yet: no member of this strand has been reachable ` +
+            `since this machine joined, so it has not received the strand's data (waited ${waitedMs} ms). ` +
+            'The strand stays launched and keeps trying — call addStrand again, or wait for the ' +
+            "'strand:writable' event, once another member is reachable.");
+        this.name = 'StrandAwaitingFirstSyncError';
+        this.strandId = strandId;
+        this.waitedMs = waitedMs;
+    }
+}
+/**
+ * Whether this machine holds the strand's `Strand.Header` row — the "has synced at least
+ * once (or founded)" signal. A read, never a write: it cannot invent the collection. A
+ * throwing read (an unreachable cohort mid-sync, a store still hydrating) reports `false`
+ * with a log, since the caller's only response to either answer is "probe again".
+ */
+export async function strandHeaderHeld(db, label) {
+    try {
+        for await (const row of db.eval('select count(1) as Count from Strand.Header')) {
+            return (row.Count ?? 0) > 0;
+        }
+        return false;
+    }
+    catch (error) {
+        log('[%s] Header probe failed (treated as not yet held): %s', label, error instanceof Error ? error.message : String(error));
+        return false;
+    }
+}
+/** The tables the sApp declared in the `App` schema, by name; views excluded. */
+function appTableNames(db) {
+    const app = db.schemaManager.getSchema('App');
+    return app ? Array.from(app.getAllTables()).filter((table) => !table.isView).map((table) => table.name) : [];
+}
+/**
+ * Whether a read of every `App` table settles on this machine — the "each app collection
+ * has been fetched from the cohort, or is authoritatively absent" signal. Only a throwing
+ * read (an unreachable cohort) reports `false`; an empty table is a settled read.
+ */
+export async function appTablesReadable(db, label) {
+    for (const table of appTableNames(db)) {
+        try {
+            for await (const _row of db.eval(`select count(1) as Count from App."${table}"`)) {
+                break;
+            }
+        }
+        catch (error) {
+            log('[%s] App.%s probe failed (treated as not yet synced): %s', label, table, error instanceof Error ? error.message : String(error));
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * The gate's whole probe: the Header is held AND every app table has been read once. The
+ * app tables are read only once the Header is — a joiner with no peer would otherwise pay
+ * one failing network read per table per probe for nothing.
+ */
+export async function strandFirstSyncComplete(db, label) {
+    return await strandHeaderHeld(db, label) && await appTablesReadable(db, label);
+}
+/**
+ * Holds one launch's `StrandDatabase` until {@link strandFirstSyncComplete}. Probes are
+ * sequential (the next is scheduled only after the previous read settles), so a slow
+ * network read never stacks probes.
+ */
+export class StrandFirstSyncGate {
+    constructor(deps, config) {
+        this.deps = deps;
+        this.stopped = false;
+        this.opened = false;
+        this.probing = false;
+        this.scheduler = deps.scheduler ?? defaultTimeoutScheduler;
+        this.pollIntervalMs = config?.pollIntervalMs ?? DEFAULT_STRAND_FIRST_SYNC_POLL_MS;
+    }
+    /** The database this gate is holding back. */
+    get database() {
+        return this.deps.database;
+    }
+    /** True once the Header was seen (or the gate was force-opened); the loop is then done. */
+    get isOpen() {
+        return this.opened;
+    }
+    /** Arm the probe loop. The first probe runs after one interval — the caller already probed once. */
+    start() {
+        if (this.stopped || this.opened || this.timer !== undefined)
+            return;
+        this.schedule();
+        log('[%s] first-sync gate armed: no Strand.Header held yet; probing every %dms', this.deps.label, this.pollIntervalMs);
+    }
+    /**
+     * Force-open: the caller has just written the Header itself (a founder bootstrap run
+     * against the gated database). Stops the loop; `onHeaderHeld` is NOT invoked.
+     */
+    open() {
+        if (this.opened)
+            return;
+        this.opened = true;
+        this.stop();
+        log('[%s] first-sync gate opened by the caller (Header written locally)', this.deps.label);
+    }
+    /** Disarm the loop; a probe already in flight completes and is then ignored. */
+    stop() {
+        this.stopped = true;
+        if (this.timer !== undefined) {
+            this.scheduler.clearTimeout(this.timer);
+            this.timer = undefined;
+        }
+    }
+    schedule() {
+        this.timer = this.scheduler.setTimeout(() => {
+            this.timer = undefined;
+            void this.probe();
+        }, this.pollIntervalMs);
+    }
+    async probe() {
+        if (this.stopped || this.opened || this.probing)
+            return;
+        this.probing = true;
+        const held = await strandFirstSyncComplete(this.deps.database.getDatabase(), this.deps.label)
+            .finally(() => { this.probing = false; });
+        // Re-check after the await: a release or a force-open may have landed mid-read.
+        if (this.stopped || this.opened)
+            return;
+        if (!held) {
+            this.schedule();
+            return;
+        }
+        this.opened = true;
+        this.stop();
+        log('[%s] first-sync gate opened: Strand.Header and every App table read from a peer', this.deps.label);
+        this.deps.onHeaderHeld();
+    }
+}
+//# sourceMappingURL=strand-first-sync-gate.js.map

package/dist/strand-first-sync-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strand-first-sync-gate.js","sourceRoot":"","sources":["../src/strand-first-sync-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAExF,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,KAAM,CAAC;AAc3D;;;;;;GAMG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,QAAgB,EAAE,QAAgB;QAC5C,KAAK,CACH,UAAU,QAAQ,oEAAoE;YACtF,+EAA+E,QAAQ,QAAQ;YAC/F,qFAAqF;YACrF,4DAA4D,CAC7D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAa;IAChE,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAE,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,wDAAwD,EAAE,KAAK,EACjE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,EAAY;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IACjE,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,sCAAsC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjF,MAAM;YACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,0DAA0D,EAAE,KAAK,EAAE,KAAK,EAC1E,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAY,EAAE,KAAa;IACvE,OAAO,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACjF,CAAC;AAiBD;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAQ9B,YAA6B,IAA6B,EAAE,MAA8B;QAA7D,SAAI,GAAJ,IAAI,CAAyB;QAJlD,YAAO,GAAG,KAAK,CAAC;QAChB,WAAM,GAAG,KAAK,CAAC;QACf,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,iCAAiC,CAAC;IACpF,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,2FAA2F;IAC3F,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,oGAAoG;IACpG,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,GAAG,CAAC,2EAA2E,EAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,oEAAoE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,gFAAgF;IAChF,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE;YAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1F,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,gFAAgF;QAChF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,GAAG,CAAC,iFAAiF,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/strand-formation-manager.d.ts

@@ -1,6 +1,36 @@
 import type { Libp2p } from '@libp2p/interface';
-import type { OpenInvitation, FormStrandResult, StrandFormationDisclosure } from './types.js';
+import type { OpenInvitation, FormStrandResult, StrandFormationDisclosure, StrandMembershipInvite } from './types.js';
 import type { DisclosureValidator, FormationUsageRecorder, StrandProvisioner, FormationResponseValidator } from './strand-solicitation.js';
+/**
+ * How long a formation-issued strand membership invitation stays redeemable (7 days).
+ * The responder's {@link StrandFormationManagerOptions.issueMembershipInvite} hook stamps
+ * `now + this` as the `Strand.Invite.Expiration`. Long enough for a slow joiner to bring
+ * its strand node up and redeem; short enough that a lost formation result does not leave
+ * a live bearer credential in the strand forever. An expired invitation rolls the
+ * redemption back cleanly (the schema's `NotExpired` gate) — the joiner's recovery is a
+ * fresh formation, which issues a fresh invitation.
+ */
+export declare const MEMBERSHIP_INVITE_TTL_MS: number;
+/**
+ * Rejection reason for a bound CLOSED-strand redemption whose responder could not issue
+ * the joiner's membership invitation — the host strand runtime not live on this
+ * responder, no party identity key yet, or the strand DB refusing the `Strand.Invite`
+ * write. Retryable on purpose, and rejected BEFORE the consent row is recorded, so the
+ * formation token stays unspent: approving without an invitation would admit a joiner
+ * that looks joined but can never become a member, and a responder not running the
+ * strand cannot serve the joiner's sync anyway. The one permanent failure,
+ * a pre-split host strand, gets {@link HOST_STRAND_MUST_BE_RECREATED_REASON} instead.
+ */
+export declare const MEMBERSHIP_INVITE_UNAVAILABLE_REASON = "Strand membership invitation unavailable, retry";
+/**
+ * Rejection reason for a bound CLOSED-strand redemption whose host strand was founded
+ * before the per-party identity split: the responder's founder launch refused it
+ * (`PreSplitStrandIdentityError`), so no invitation can ever be issued into it. Not
+ * retryable — the host must recreate the strand and issue a fresh invitation. Like
+ * {@link MEMBERSHIP_INVITE_UNAVAILABLE_REASON}, rejected before consent is recorded, so
+ * the formation token stays unspent.
+ */
+export declare const HOST_STRAND_MUST_BE_RECREATED_REASON = "Host strand must be recreated";
 /**
  * Configuration for StrandFormationManager
  */
@@ -51,6 +81,27 @@ export interface StrandFormationManagerOptions {
      * addresses and cross-party joiners fall back to an empty seed.
      */
     resolveStrandAddrs?: (strandId: string) => string[];
+    /**
+     * Issue a single-use `Strand.Invite` against the live host strand a BOUND redemption
+     * resolved to (responder side) — the seam that gets the JOINER its own membership.
+     * Like {@link resolveStrandAddrs}, the formation layer cannot reach the strand
+     * runtime itself, so `CadreNode` wires this to its own running-instance +
+     * `StrandPartyKey` lookup.
+     *
+     * Contract: return the issued invitation for a CLOSED host strand; return `null`
+     * for an open one (no members, nothing to invite into); THROW when a closed strand's
+     * invitation cannot be issued (runtime not live, no party key, strand DB write
+     * rejected) — the manager then rejects the whole redemption with
+     * {@link MEMBERSHIP_INVITE_UNAVAILABLE_REASON} BEFORE recording consent, so the
+     * formation token stays unspent and the joiner can retry. Throw a
+     * `PreSplitStrandIdentityError` for a host strand that can never issue one; that maps
+     * to the non-retryable {@link HOST_STRAND_MUST_BE_RECREATED_REASON}.
+     *
+     * Left unwired — mock/transport tests — the bound path approves with no invitation,
+     * mirroring the unwired {@link resolveStrandAddrs} posture. Production
+     * (`CadreNode.initializeStrandSolicitation`) always wires it.
+     */
+    issueMembershipInvite?: (strandId: string) => Promise<StrandMembershipInvite | null>;
     /** Configuration options */
     config?: StrandFormationManagerConfig;
 }
@@ -75,6 +126,7 @@ export declare class StrandFormationManager {
     private readonly partyId;
     private readonly cadrePeerAddrs;
     private readonly resolveStrandAddrs?;
+    private readonly issueMembershipInvite?;
     private readonly config;
     private readonly listener;
     private readonly registeredNodes;
@@ -110,6 +162,13 @@ export declare class StrandFormationManager {
         listeners: number;
         dialers: number;
     };
+    /**
+     * The provision result's membership invitation, iff well-formed — a malformed one
+     * (possible only past a custom {@link FormationResponseValidator} that skipped the
+     * structural check) is dropped with a log rather than cached: it could never redeem
+     * anyway, and carrying an unbounded hostile object outlives the session.
+     */
+    private membershipInviteFrom;
     /**
      * Derive the initiator's await-response budget from the configured RESPONDER budget —
      * never the same number (see `StrandFormationManagerConfig.provisionTimeoutMs`). Mirrors
@@ -128,10 +187,14 @@ export declare class StrandFormationManager {
      * {@link ResponderProvisionOutcome} with `approved: false` — `runSession` turns that
      * into a clean, non-disclosing reply instead of a dropped result frame.
      *
-     * - **bound** (host strand present): provision-then-record — write the single
-     *   `FormationUsage` consent row against the pre-existing strand (record-only) and
-     *   return it + its membership key (a read-gating secret disclosed only here, behind the
-     *   token + disclosure validation `runSession` already enforced).
+     * - **bound** (host strand present): provision-then-record — first issue the joiner's
+     *   single-use strand membership invitation via the wired `issueMembershipInvite` seam
+     *   ({@link issueBoundMembershipInvite}; a closed strand whose invitation cannot be
+     *   issued rejects retryably HERE, before any consent row spends the token), then write
+     *   the single `FormationUsage` consent row against the pre-existing strand
+     *   (record-only) and return it + its membership key + the invitation (all read-gating
+     *   secrets disclosed only here, behind the token + disclosure validation `runSession`
+     *   already enforced).
      * - **missing** (invite names a host strand absent on this responder, e.g. unconverged):
      *   reject cleanly + retryably, writing NO usage row — recording usage here would fail the
      *   deferred `StrandExists` CHECK at commit and drop the frame.
@@ -150,6 +213,25 @@ export declare class StrandFormationManager {
      * not control-flow-by-exception.
      */
     private provisionAsResponder;
+    /**
+     * Issue the joiner's membership invitation for a BOUND redemption via the wired
+     * {@link StrandFormationManagerOptions.issueMembershipInvite} seam.
+     *
+     * - Hook unwired (mock/transport tests): approve with no invitation, the same posture
+     *   as an unwired `resolveStrandAddrs`.
+     * - Hook returns an invitation (closed host strand): carry it on the approval.
+     * - Hook returns `null` (open host strand): approve with no invitation.
+     * - Hook throws (runtime not live, no party key, strand-DB write rejected): report
+     *   `ok: false` with {@link MEMBERSHIP_INVITE_UNAVAILABLE_REASON} — the caller rejects
+     *   BEFORE any consent row is written, so the formation token stays unspent.
+     * - Hook throws `PreSplitStrandIdentityError` (the host strand was founded before the
+     *   per-party identity split and can never issue one): same, but with the
+     *   non-retryable {@link HOST_STRAND_MUST_BE_RECREATED_REASON}.
+     *
+     * The LOG-before-reject keeps both a deliberate internal-error→protocol-rejection
+     * conversion, same as the catch-all in {@link provisionAsResponder}.
+     */
+    private issueBoundMembershipInvite;
     /**
      * Responder-provisions fallback (invite binds no host strand). Precedence:
      *

package/dist/strand-formation-manager.js

@@ -3,8 +3,9 @@ import { fromString as uint8ArrayFromString } from 'uint8arrays';
 import { FormationApprovalError } from './formation-approval.js';
 // control-database does not import this manager, so this import introduces no cycle.
 import { FormationAbortedError, InvitationExhaustedError } from './control-database.js';
+import { PreSplitStrandIdentityError } from './strand-membership-writer.js';
 import { canonicalJson } from './canonical-json.js';
-import { FormationListener, INVALID_TOKEN_REASON, PROVISION_RESPONSE_TRAVEL_MARGIN_MS, dialFormation, isValidResponderCreatesResult } from './strand-formation-protocol.js';
+import { FormationListener, INVALID_TOKEN_REASON, PROVISION_RESPONSE_TRAVEL_MARGIN_MS, dialFormation, isValidResponderCreatesResult, isWellFormedMembershipInvite } from './strand-formation-protocol.js';
 const log = debug('sereus:cadre:formation-manager');
 /**
  * Largest serialized disclosure a responder will accept (8 KiB). The disclosure is
@@ -13,6 +14,36 @@ const log = debug('sereus:cadre:formation-manager');
  * any database read or hook contact so an oversized blob costs nothing downstream.
  */
 const MAX_DISCLOSURE_BYTES = 8 * 1024;
+/**
+ * How long a formation-issued strand membership invitation stays redeemable (7 days).
+ * The responder's {@link StrandFormationManagerOptions.issueMembershipInvite} hook stamps
+ * `now + this` as the `Strand.Invite.Expiration`. Long enough for a slow joiner to bring
+ * its strand node up and redeem; short enough that a lost formation result does not leave
+ * a live bearer credential in the strand forever. An expired invitation rolls the
+ * redemption back cleanly (the schema's `NotExpired` gate) — the joiner's recovery is a
+ * fresh formation, which issues a fresh invitation.
+ */
+export const MEMBERSHIP_INVITE_TTL_MS = 7 * 24 * 3600000;
+/**
+ * Rejection reason for a bound CLOSED-strand redemption whose responder could not issue
+ * the joiner's membership invitation — the host strand runtime not live on this
+ * responder, no party identity key yet, or the strand DB refusing the `Strand.Invite`
+ * write. Retryable on purpose, and rejected BEFORE the consent row is recorded, so the
+ * formation token stays unspent: approving without an invitation would admit a joiner
+ * that looks joined but can never become a member, and a responder not running the
+ * strand cannot serve the joiner's sync anyway. The one permanent failure,
+ * a pre-split host strand, gets {@link HOST_STRAND_MUST_BE_RECREATED_REASON} instead.
+ */
+export const MEMBERSHIP_INVITE_UNAVAILABLE_REASON = 'Strand membership invitation unavailable, retry';
+/**
+ * Rejection reason for a bound CLOSED-strand redemption whose host strand was founded
+ * before the per-party identity split: the responder's founder launch refused it
+ * (`PreSplitStrandIdentityError`), so no invitation can ever be issued into it. Not
+ * retryable — the host must recreate the strand and issue a fresh invitation. Like
+ * {@link MEMBERSHIP_INVITE_UNAVAILABLE_REASON}, rejected before consent is recorded, so
+ * the formation token stays unspent.
+ */
+export const HOST_STRAND_MUST_BE_RECREATED_REASON = 'Host strand must be recreated';
 /**
  * Rejection reason a would-be joiner is told for each approval-failure category
  * (see {@link FormationApprovalFailure}). Distinct per category on purpose: mapping any
@@ -50,6 +81,7 @@ export class StrandFormationManager {
         this.partyId = options.partyId;
         this.cadrePeerAddrs = options.cadrePeerAddrs ?? [];
         this.resolveStrandAddrs = options.resolveStrandAddrs;
+        this.issueMembershipInvite = options.issueMembershipInvite;
         this.config = options.config ?? {};
         this.listener = new FormationListener({
             validateToken: (token) => this.validateToken(token),
@@ -131,6 +163,10 @@ export class StrandFormationManager {
                 // Undefined for an open strand. Kept separate from invitePrivateKey (the initiator's
                 // generated signing key), which is set by the StrandSolicitationService layer.
                 memberPrivateKey: provision.memberPrivateKey,
+                // Carried only when well-formed. The DEFAULT response validator already rejects
+                // a malformed one; this re-check keeps a custom validator that skips the shape
+                // check from feeding a hostile responder's object into the joiner's invite cache.
+                membershipInvite: this.membershipInviteFrom(provision),
                 // Possibly empty — the responder may hold no live strand node yet.
                 strandAddrs: dialed.strandAddrs
             };
@@ -145,6 +181,22 @@ export class StrandFormationManager {
     getActiveSessionCounts() {
         return { listeners: this.listener.activeCount, dialers: this.dialerSessions };
     }
+    /**
+     * The provision result's membership invitation, iff well-formed — a malformed one
+     * (possible only past a custom {@link FormationResponseValidator} that skipped the
+     * structural check) is dropped with a log rather than cached: it could never redeem
+     * anyway, and carrying an unbounded hostile object outlives the session.
+     */
+    membershipInviteFrom(provision) {
+        if (provision.membershipInvite === undefined) {
+            return undefined;
+        }
+        if (!isWellFormedMembershipInvite(provision.membershipInvite)) {
+            log('formStrand: dropping malformed membershipInvite from responder for strand %s', provision.strand.strandId);
+            return undefined;
+        }
+        return { inviteKey: provision.membershipInvite.inviteKey, invitePrivateKey: provision.membershipInvite.invitePrivateKey };
+    }
     /**
      * Derive the initiator's await-response budget from the configured RESPONDER budget —
      * never the same number (see `StrandFormationManagerConfig.provisionTimeoutMs`). Mirrors
@@ -188,10 +240,14 @@ export class StrandFormationManager {
      * {@link ResponderProvisionOutcome} with `approved: false` — `runSession` turns that
      * into a clean, non-disclosing reply instead of a dropped result frame.
      *
-     * - **bound** (host strand present): provision-then-record — write the single
-     *   `FormationUsage` consent row against the pre-existing strand (record-only) and
-     *   return it + its membership key (a read-gating secret disclosed only here, behind the
-     *   token + disclosure validation `runSession` already enforced).
+     * - **bound** (host strand present): provision-then-record — first issue the joiner's
+     *   single-use strand membership invitation via the wired `issueMembershipInvite` seam
+     *   ({@link issueBoundMembershipInvite}; a closed strand whose invitation cannot be
+     *   issued rejects retryably HERE, before any consent row spends the token), then write
+     *   the single `FormationUsage` consent row against the pre-existing strand
+     *   (record-only) and return it + its membership key + the invitation (all read-gating
+     *   secrets disclosed only here, behind the token + disclosure validation `runSession`
+     *   already enforced).
      * - **missing** (invite names a host strand absent on this responder, e.g. unconverged):
      *   reject cleanly + retryably, writing NO usage row — recording usage here would fail the
      *   deferred `StrandExists` CHECK at commit and drop the frame.
@@ -227,6 +283,16 @@ export class StrandFormationManager {
         try {
             switch (resolved.kind) {
                 case 'bound': {
+                    // Issued BEFORE the consent row is recorded, so an issue failure rejects with
+                    // the formation token still unspent (retryable). The inverse window — invite
+                    // issued, then recordUsage fails/aborts — orphans a live `Strand.Invite` no
+                    // joiner ever received; bounded deliberately by its expiry
+                    // ({@link MEMBERSHIP_INVITE_TTL_MS}) rather than compensated, since nothing
+                    // here can atomically un-issue a strand-DB row.
+                    const issued = await this.issueBoundMembershipInvite(token, resolved.strandId);
+                    if (!issued.ok) {
+                        return { approved: false, reason: issued.reason };
+                    }
                     // recorder is guaranteed non-null here: only resolveStrand can yield 'bound'.
                     await recorder.recordUsage({
                         token,
@@ -240,6 +306,9 @@ export class StrandFormationManager {
                     return this.approve({
                         strand: { strandId: resolved.strandId, createdBy: 'responder' },
                         memberPrivateKey: resolved.memberPrivateKey ?? undefined,
+                        // Omitted (not sent undefined-valued) so rejection-parity and open-strand
+                        // assertions stay plain `toBeUndefined()` on the parsed frame.
+                        ...(issued.invite ? { membershipInvite: issued.invite } : {}),
                         dbConnectionInfo: { endpoint: 'local', credentialsRef: '' }
                     });
                 }
@@ -279,6 +348,41 @@ export class StrandFormationManager {
             return { approved: false, reason: 'Formation conflict, retry' };
         }
     }
+    /**
+     * Issue the joiner's membership invitation for a BOUND redemption via the wired
+     * {@link StrandFormationManagerOptions.issueMembershipInvite} seam.
+     *
+     * - Hook unwired (mock/transport tests): approve with no invitation, the same posture
+     *   as an unwired `resolveStrandAddrs`.
+     * - Hook returns an invitation (closed host strand): carry it on the approval.
+     * - Hook returns `null` (open host strand): approve with no invitation.
+     * - Hook throws (runtime not live, no party key, strand-DB write rejected): report
+     *   `ok: false` with {@link MEMBERSHIP_INVITE_UNAVAILABLE_REASON} — the caller rejects
+     *   BEFORE any consent row is written, so the formation token stays unspent.
+     * - Hook throws `PreSplitStrandIdentityError` (the host strand was founded before the
+     *   per-party identity split and can never issue one): same, but with the
+     *   non-retryable {@link HOST_STRAND_MUST_BE_RECREATED_REASON}.
+     *
+     * The LOG-before-reject keeps both a deliberate internal-error→protocol-rejection
+     * conversion, same as the catch-all in {@link provisionAsResponder}.
+     */
+    async issueBoundMembershipInvite(token, strandId) {
+        if (!this.issueMembershipInvite) {
+            return { ok: true };
+        }
+        try {
+            const invite = await this.issueMembershipInvite(strandId);
+            return { ok: true, invite: invite ?? undefined };
+        }
+        catch (err) {
+            if (err instanceof PreSplitStrandIdentityError) {
+                log('host strand %s is pre-split (token %s); rejecting — it must be recreated: %o', strandId, token, err);
+                return { ok: false, reason: HOST_STRAND_MUST_BE_RECREATED_REASON };
+            }
+            log('membership-invite issue for strand %s failed (token %s); rejecting retryably: %o', strandId, token, err);
+            return { ok: false, reason: MEMBERSHIP_INVITE_UNAVAILABLE_REASON };
+        }
+    }
     /**
      * Responder-provisions fallback (invite binds no host strand). Precedence:
      *

package/dist/strand-formation-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-formation-manager.js","sourceRoot":"","sources":["../src/strand-formation-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAOjE,OAAO,EACL,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,qFAAqF;AACrF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,mCAAmC,EACnC,aAAa,EACb,6BAA6B,EAK9B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,0BAA0B,GAA6C;IAC3E,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,uCAAuC;IACpD,SAAS,EAAE,4BAA4B;IACvC,UAAU,EAAE,wCAAwC;IACpD,aAAa,EAAE,kCAAkC;CAClD,CAAC;AAyDF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAsB;IAajC,YAAY,OAAsC;QAHjC,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,mBAAc,GAAG,CAAC,CAAC;QAGzB,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC7D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACpC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YACnD,kBAAkB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC;YACrF,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC;YAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5F,8EAA8E;YAC9E,mFAAmF;YACnF,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/E,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;SACzD,CAAC,CAAC;QAEH,GAAG,CAAC,8CAA8C,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY,EAAE,UAAmB;QACjD,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY,EAAE,UAAmB;QACnD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACd,UAA0B,EAC1B,UAAqC,EACrC,OAAyE,EACzE,IAAY;QAEZ,GAAG,CAAC,0CAA0C,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAElE,MAAM,OAAO,GAA4B;YACvC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU;YACV,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE;gBACvC,OAAO;gBACP,cAAc,EAAE,UAAU,CAAC,SAAS;gBACpC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;gBACvF,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,kBAAkB,EAAE,IAAI,CAAC,2BAA2B,EAAE;gBACtD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,GAAG,CAAC,mDAAmD,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/G,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ;gBACnC,4FAA4F;gBAC5F,qFAAqF;gBACrF,+EAA+E;gBAC/E,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;gBAC5C,mEAAmE;gBACnE,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;;;OAQG;IACK,2BAA2B;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC5C,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,8CAA8C;YAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,UAAqC;QACnF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,oDAAoD;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAgC,EAChC,MAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,qFAAqF;QACrF,wFAAwF;QACxF,qFAAqF;QACrF,yCAAyC;QACzC,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;YACnF,GAAG,CAAC,8CAA8C,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,MAAM,QAAQ,GAAuB,QAAQ,EAAE,aAAa;YAC1D,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAExB,IAAI,CAAC;YACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,8EAA8E;oBAC9E,MAAM,QAAS,CAAC,WAAW,CAAC;wBAC1B,KAAK;wBACL,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;wBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,UAAU,EAAE,cAAc;wBAC1B,MAAM;qBACP,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,OAAO,CAAC;wBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;wBAC/D,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,SAAS;wBACxD,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;qBAC5D,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,GAAG,CAAC,wEAAwE,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBACxG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;gBACxF,CAAC;gBACD,KAAK,SAAS;oBACZ,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,oFAAoF;gBACpF,0EAA0E;gBAC1E,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,GAAG,CAAC,uCAAuC,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,yFAAyF;gBACzF,qFAAqF;gBACrF,4EAA4E;gBAC5E,kDAAkD;gBAClD,uFAAuF;gBACvF,uEAAuE;gBACvE,GAAG,CACD,qEAAqE,EACrE,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,SAAS,CACd,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC3D,CAAC;YACD,sFAAsF;YACtF,uFAAuF;YACvF,oFAAoF;YACpF,6EAA6E;YAC7E,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAgC,EAChC,cAAsB,EACtB,MAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,IAAI,QAAQ,EAAE,kBAAkB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;gBACpD,KAAK;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM;gBACN,UAAU,EAAE,cAAc;gBAC1B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAClE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,IAAI,SAAS;gBAC3D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAC7D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;YAC5C,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,OAAO,CAAC,MAAgC;QAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB;YAAE,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,gBAAgB,CAC5B,UAA0B,EAC1B,UAAqC,EACrC,QAAgC;QAEhC,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"strand-formation-manager.js","sourceRoot":"","sources":["../src/strand-formation-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAQjE,OAAO,EACL,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,qFAAqF;AACrF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,mCAAmC,EACnC,aAAa,EACb,6BAA6B,EAC7B,4BAA4B,EAK7B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,OAAQ,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,iDAAiD,CAAC;AAEtG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,+BAA+B,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,0BAA0B,GAA6C;IAC3E,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,uCAAuC;IACpD,SAAS,EAAE,4BAA4B;IACvC,UAAU,EAAE,wCAAwC;IACpD,aAAa,EAAE,kCAAkC;CAClD,CAAC;AA8EF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAsB;IAcjC,YAAY,OAAsC;QAHjC,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,mBAAc,GAAG,CAAC,CAAC;QAGzB,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC7D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACpC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YACnD,kBAAkB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC;YACrF,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC;YAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5F,8EAA8E;YAC9E,mFAAmF;YACnF,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/E,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;SACzD,CAAC,CAAC;QAEH,GAAG,CAAC,8CAA8C,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY,EAAE,UAAmB;QACjD,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY,EAAE,UAAmB;QACnD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACd,UAA0B,EAC1B,UAAqC,EACrC,OAAyE,EACzE,IAAY;QAEZ,GAAG,CAAC,0CAA0C,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAElE,MAAM,OAAO,GAA4B;YACvC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU;YACV,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE;gBACvC,OAAO;gBACP,cAAc,EAAE,UAAU,CAAC,SAAS;gBACpC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;gBACvF,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,kBAAkB,EAAE,IAAI,CAAC,2BAA2B,EAAE;gBACtD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,GAAG,CAAC,mDAAmD,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/G,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ;gBACnC,4FAA4F;gBAC5F,qFAAqF;gBACrF,+EAA+E;gBAC/E,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;gBAC5C,gFAAgF;gBAChF,+EAA+E;gBAC/E,kFAAkF;gBAClF,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;gBACtD,mEAAmE;gBACnE,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,SAAmC;QAC9D,IAAI,SAAS,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,8EAA8E,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/G,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;IAC5H,CAAC;IAED;;;;;;;;OAQG;IACK,2BAA2B;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC5C,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,8CAA8C;YAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,UAAqC;QACnF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,oDAAoD;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAgC,EAChC,MAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,qFAAqF;QACrF,wFAAwF;QACxF,qFAAqF;QACrF,yCAAyC;QACzC,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;YACnF,GAAG,CAAC,8CAA8C,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,MAAM,QAAQ,GAAuB,QAAQ,EAAE,aAAa;YAC1D,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAExB,IAAI,CAAC;YACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,8EAA8E;oBAC9E,6EAA6E;oBAC7E,4EAA4E;oBAC5E,2DAA2D;oBAC3D,4EAA4E;oBAC5E,gDAAgD;oBAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;wBACf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;oBACpD,CAAC;oBACD,8EAA8E;oBAC9E,MAAM,QAAS,CAAC,WAAW,CAAC;wBAC1B,KAAK;wBACL,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;wBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,UAAU,EAAE,cAAc;wBAC1B,MAAM;qBACP,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,OAAO,CAAC;wBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;wBAC/D,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,SAAS;wBACxD,0EAA0E;wBAC1E,+DAA+D;wBAC/D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;qBAC5D,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,GAAG,CAAC,wEAAwE,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBACxG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;gBACxF,CAAC;gBACD,KAAK,SAAS;oBACZ,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,oFAAoF;gBACpF,0EAA0E;gBAC1E,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,GAAG,CAAC,uCAAuC,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,yFAAyF;gBACzF,qFAAqF;gBACrF,4EAA4E;gBAC5E,kDAAkD;gBAClD,uFAAuF;gBACvF,uEAAuE;gBACvE,GAAG,CACD,qEAAqE,EACrE,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,SAAS,CACd,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC3D,CAAC;YACD,sFAAsF;YACtF,uFAAuF;YACvF,oFAAoF;YACpF,6EAA6E;YAC7E,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,0BAA0B,CACtC,KAAa,EACb,QAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;gBAC/C,GAAG,CAAC,8EAA8E,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC1G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;YACrE,CAAC;YACD,GAAG,CAAC,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAgC,EAChC,cAAsB,EACtB,MAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,IAAI,QAAQ,EAAE,kBAAkB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;gBACpD,KAAK;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM;gBACN,UAAU,EAAE,cAAc;gBAC1B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAClE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,IAAI,SAAS;gBAC3D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAC7D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;YAC5C,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,OAAO,CAAC,MAAgC;QAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB;YAAE,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,gBAAgB,CAC5B,UAA0B,EAC1B,UAAqC,EACrC,QAAgC;QAEhC,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/strand-formation-protocol.d.ts

@@ -18,7 +18,7 @@
  * discloses none of them.
  */
 import type { Libp2p } from '@libp2p/interface';
-import type { StrandFormationDisclosure } from './types.js';
+import type { StrandFormationDisclosure, StrandMembershipInvite } from './types.js';
 /** Protocol id for the native formation transport (parallel to `/sereus/seed/1.0.0`). */
 export declare const FORMATION_PROTOCOL = "/sereus/formation/1.0.0";
 /**
@@ -74,6 +74,16 @@ export interface FormationProvisionResult {
      * already-used token discloses neither identity nor key. Absent for open strands.
      */
     memberPrivateKey?: string;
+    /**
+     * The joiner's single-use membership invitation into the (closed, bound) host
+     * strand — issued by the responder's live strand runtime against `Strand.Invite`
+     * just before the consent row was recorded. Same disclosure timing as
+     * {@link memberPrivateKey}: present only on an approved result, absent for open
+     * strands and the responder-provisions path. Bounded and shape-checked on the
+     * initiator side ({@link isWellFormedMembershipInvite}) — a hostile responder's
+     * malformed field fails validation rather than crashing the initiator.
+     */
+    membershipInvite?: StrandMembershipInvite;
     dbConnectionInfo: FormationDbConnectionInfo;
 }
 /**
@@ -154,6 +164,16 @@ export interface FormationResultMessage {
  * cost a formation that has otherwise succeeded.
  */
 export declare function sanitizeStrandAddrs(addrs: unknown): string[];
+/**
+ * Is `value` a well-formed {@link StrandMembershipInvite} — exactly two bounded
+ * base64url strings? The initiator-side shape check for the one attacker-influenced
+ * OBJECT the formation result carries (`strandAddrs` gets the equivalent treatment in
+ * {@link sanitizeStrandAddrs}): a malformed field from a hostile responder must fail
+ * validation, never crash the initiator or be carried into the joiner's invite cache.
+ * `undefined` is NOT well-formed — absence is legal on the result and callers gate on
+ * presence first.
+ */
+export declare function isWellFormedMembershipInvite(value: unknown): value is StrandMembershipInvite;
 /**
  * Structural check on a `responderCreates` result: the responder must have approved,
  * disclosed a non-empty real identity + cadre (not the legacy `cadre-*.local`