@serfab/cadre-core 0.9.0 → 0.11.0

package/dist/strand-formation-manager.d.ts

@@ -9,6 +9,14 @@ export interface StrandFormationManagerConfig {
     sessionTimeoutMs?: number;
     /** Step timeout in milliseconds */
     stepTimeoutMs?: number;
+    /**
+     * Provisioning budget in milliseconds for the RESPONDER's `provisionStrand` hook call.
+     * The initiator's `await-response` wait is derived automatically from this value plus
+     * `PROVISION_RESPONSE_TRAVEL_MARGIN_MS` (`strand-formation-protocol.ts`) — never set
+     * directly — so the ordering documented there (approval hook < responder provisioning <
+     * initiator await-response < session) cannot collapse when this is configured.
+     */
+    provisionTimeoutMs?: number;
     /** Maximum concurrent sessions */
     maxConcurrentSessions?: number;
     /** Enable debug logging */
@@ -73,10 +81,16 @@ export declare class StrandFormationManager {
      * Form a strand with a responder via an open invitation (initiator side).
      *
      * Builds a contact message carrying the real token + disclosure + this party's
-     * real cadre addresses, dials the responder over the native protocol, and
-     * validates the responder's result before returning.
+     * real cadre addresses + the joiner's consent (minted and signed by the
+     * solicitation layer — this manager only places it on the contact), dials the
+     * responder over the native protocol, and validates the responder's result
+     * before returning.
      */
-    formStrand(invitation: OpenInvitation, disclosure: StrandFormationDisclosure, node: Libp2p): Promise<FormStrandResult>;
+    formStrand(invitation: OpenInvitation, disclosure: StrandFormationDisclosure, consent: {
+        peerKey: string;
+        usageStampId: string;
+        peerSignature: string;
+    }, node: Libp2p): Promise<FormStrandResult>;
     /**
      * Get the number of active sessions
      */
@@ -84,6 +98,16 @@ export declare class StrandFormationManager {
         listeners: number;
         dialers: number;
     };
+    /**
+     * Derive the initiator's await-response budget from the configured RESPONDER budget —
+     * never the same number (see `StrandFormationManagerConfig.provisionTimeoutMs`). Mirrors
+     * `resolveProvisionTimeoutMs`'s own "`0`/negative means unset" rule so an unset config
+     * still lets both sides fall back to their own independent defaults; must NOT hardcode
+     * `DEFAULT_PROVISION_TIMEOUT_MS` here, or the per-role clamping downstream is defeated.
+     * A value too large for the session is clamped per role, and the responder's ceiling holds
+     * the same margin back, so the ordering survives there too.
+     */
+    private initiatorProvisionTimeoutMs;
     private validateToken;
     private validateDisclosure;
     /**
@@ -101,10 +125,15 @@ export declare class StrandFormationManager {
      *   deferred `StrandExists` CHECK at commit and drop the frame.
      * - **unbound** (no binding): the responder-provisions fallback — see {@link provisionUnbound}.
      *
-     * Defense-in-depth: known provisioning/redeem failures (notably the concurrent
-     * `(Token, UseNumber)` PK collision when two redemptions of one unbound single-use invite
-     * race) are caught and mapped to a logged, retry-suggesting rejection rather than a thrown
-     * insert + a silently-closed stream. The LOG-before-reject keeps this a deliberate
+     * Defense-in-depth: known provisioning/redeem failures are caught and mapped to a logged
+     * protocol rejection rather than a thrown insert + a silently-closed stream. The mapping is
+     * per-failure, NOT blanket retry-suggesting: an exhausted invitation
+     * ({@link InvitationExhaustedError}, raised by `ControlDatabase` when the count of recorded
+     * uses has reached the invite's seat budget — which is how the loser of a same-node race
+     * surfaces, the local write queue having serialized the two writes) is reported as
+     * `'Invalid token'`, because retrying it can never succeed. Concurrent redemptions never
+     * contend for a shared row key — each writes under its own `UsageStampId` — so there is no
+     * key collision to surface here at all. The LOG-before-reject keeps this a deliberate
      * internal-error→protocol-rejection conversion (AGENTS.md: don't eat exceptions silently),
      * not control-flow-by-exception.
      */

package/dist/strand-formation-manager.js

@@ -1,6 +1,31 @@
 import debug from 'debug';
-import { FormationListener, dialFormation, isValidResponderCreatesResult } from './strand-formation-protocol.js';
+import { fromString as uint8ArrayFromString } from 'uint8arrays';
+import { FormationApprovalError } from './formation-approval.js';
+// control-database does not import this manager, so this import introduces no cycle.
+import { FormationAbortedError, InvitationExhaustedError } from './control-database.js';
+import { canonicalJson } from './canonical-json.js';
+import { FormationListener, INVALID_TOKEN_REASON, PROVISION_RESPONSE_TRAVEL_MARGIN_MS, dialFormation, isValidResponderCreatesResult } from './strand-formation-protocol.js';
 const log = debug('sereus:cadre:formation-manager');
+/**
+ * Largest serialized disclosure a responder will accept (8 KiB). The disclosure is
+ * attacker-influenced text destined for a replicated table (`FormationUsage.Disclosure`)
+ * and for the approval hook's signed digest — the cap bounds both, and is enforced BEFORE
+ * any database read or hook contact so an oversized blob costs nothing downstream.
+ */
+const MAX_DISCLOSURE_BYTES = 8 * 1024;
+/**
+ * Rejection reason a would-be joiner is told for each approval-failure category
+ * (see {@link FormationApprovalFailure}). Distinct per category on purpose: mapping any
+ * of these onto the generic 'Formation conflict, retry' would tell an operator to retry
+ * what retrying can never fix (e.g. a non-enrolled validation key).
+ */
+const APPROVAL_REJECTION_REASONS = {
+    refused: 'Formation approval refused',
+    unavailable: 'Formation approval unavailable, retry',
+    malformed: 'Formation approval invalid',
+    unenrolled: 'Formation approval key is not enrolled',
+    misconfigured: 'Formation approval misconfigured'
+};
 /**
  * StrandFormationManager drives the native cadre-core formation transport
  * (`strand-formation-protocol.ts`) from cadre-core's strand-solicitation interfaces.
@@ -28,10 +53,11 @@ export class StrandFormationManager {
         this.listener = new FormationListener({
             validateToken: (token) => this.validateToken(token),
             validateDisclosure: (token, disclosure) => this.validateDisclosure(token, disclosure),
-            provisionStrand: (token, initiatorPartyId, disclosure) => this.provisionAsResponder(token, initiatorPartyId, disclosure),
+            provisionStrand: (contact, signal) => this.provisionAsResponder(contact, signal),
             getResponderIdentity: () => ({ partyId: this.partyId, cadrePeerAddrs: this.cadrePeerAddrs }),
             sessionTimeoutMs: this.config.sessionTimeoutMs,
             stepTimeoutMs: this.config.stepTimeoutMs,
+            provisionTimeoutMs: this.config.provisionTimeoutMs,
             maxConcurrentSessions: this.config.maxConcurrentSessions
         });
         log('StrandFormationManager created for party: %s', this.partyId);
@@ -64,14 +90,19 @@ export class StrandFormationManager {
      * Form a strand with a responder via an open invitation (initiator side).
      *
      * Builds a contact message carrying the real token + disclosure + this party's
-     * real cadre addresses, dials the responder over the native protocol, and
-     * validates the responder's result before returning.
+     * real cadre addresses + the joiner's consent (minted and signed by the
+     * solicitation layer — this manager only places it on the contact), dials the
+     * responder over the native protocol, and validates the responder's result
+     * before returning.
      */
-    async formStrand(invitation, disclosure, node) {
+    async formStrand(invitation, disclosure, consent, node) {
         log('Forming strand with invitation token: %s', invitation.token);
         const contact = {
             token: invitation.token,
             partyId: disclosure.partyId ?? this.partyId,
+            peerKey: consent.peerKey,
+            usageStampId: consent.usageStampId,
+            peerSignature: consent.peerSignature,
             disclosure,
             cadrePeerAddrs: this.cadrePeerAddrs
         };
@@ -83,6 +114,7 @@ export class StrandFormationManager {
                 validateResponse: (response) => this.validateResponse(invitation, disclosure, response),
                 sessionTimeoutMs: this.config.sessionTimeoutMs,
                 stepTimeoutMs: this.config.stepTimeoutMs,
+                provisionTimeoutMs: this.initiatorProvisionTimeoutMs(),
                 protocolId: this.config.protocolId
             });
             log('Strand formed: %s', provision.strand.strandId);
@@ -106,6 +138,19 @@ export class StrandFormationManager {
     getActiveSessionCounts() {
         return { listeners: this.listener.activeCount, dialers: this.dialerSessions };
     }
+    /**
+     * Derive the initiator's await-response budget from the configured RESPONDER budget —
+     * never the same number (see `StrandFormationManagerConfig.provisionTimeoutMs`). Mirrors
+     * `resolveProvisionTimeoutMs`'s own "`0`/negative means unset" rule so an unset config
+     * still lets both sides fall back to their own independent defaults; must NOT hardcode
+     * `DEFAULT_PROVISION_TIMEOUT_MS` here, or the per-role clamping downstream is defeated.
+     * A value too large for the session is clamped per role, and the responder's ceiling holds
+     * the same margin back, so the ordering survives there too.
+     */
+    initiatorProvisionTimeoutMs() {
+        const host = this.config.provisionTimeoutMs;
+        return host && host > 0 ? host + PROVISION_RESPONSE_TRAVEL_MARGIN_MS : undefined;
+    }
     // ── Responder-side hooks ─────────────────────────────────────────────────────
     async validateToken(token) {
         if (!this.formationUsageRecorder) {
@@ -145,14 +190,29 @@ export class StrandFormationManager {
      *   deferred `StrandExists` CHECK at commit and drop the frame.
      * - **unbound** (no binding): the responder-provisions fallback — see {@link provisionUnbound}.
      *
-     * Defense-in-depth: known provisioning/redeem failures (notably the concurrent
-     * `(Token, UseNumber)` PK collision when two redemptions of one unbound single-use invite
-     * race) are caught and mapped to a logged, retry-suggesting rejection rather than a thrown
-     * insert + a silently-closed stream. The LOG-before-reject keeps this a deliberate
+     * Defense-in-depth: known provisioning/redeem failures are caught and mapped to a logged
+     * protocol rejection rather than a thrown insert + a silently-closed stream. The mapping is
+     * per-failure, NOT blanket retry-suggesting: an exhausted invitation
+     * ({@link InvitationExhaustedError}, raised by `ControlDatabase` when the count of recorded
+     * uses has reached the invite's seat budget — which is how the loser of a same-node race
+     * surfaces, the local write queue having serialized the two writes) is reported as
+     * `'Invalid token'`, because retrying it can never succeed. Concurrent redemptions never
+     * contend for a shared row key — each writes under its own `UsageStampId` — so there is no
+     * key collision to surface here at all. The LOG-before-reject keeps this a deliberate
      * internal-error→protocol-rejection conversion (AGENTS.md: don't eat exceptions silently),
      * not control-flow-by-exception.
      */
-    async provisionAsResponder(token, initiatorPartyId, _disclosure) {
+    async provisionAsResponder(contact, signal) {
+        const token = contact.token;
+        // CANONICALLY serialized — both sides derive the identical string: this is the exact
+        // text the joiner signed (consent), the approver signs (vouch), and the recorder writes
+        // to `FormationUsage.Disclosure` — a re-serialization anywhere below would break the
+        // signature-over-stored-bytes invariant.
+        const disclosureText = canonicalJson(contact.disclosure);
+        if (uint8ArrayFromString(disclosureText, 'utf8').byteLength > MAX_DISCLOSURE_BYTES) {
+            log('Disclosure over %d bytes; rejecting token %s', MAX_DISCLOSURE_BYTES, token);
+            return { approved: false, reason: 'Disclosure too large' };
+        }
         const recorder = this.formationUsageRecorder;
         const resolved = recorder?.resolveStrand
             ? await recorder.resolveStrand(token)
@@ -161,7 +221,15 @@ export class StrandFormationManager {
             switch (resolved.kind) {
                 case 'bound': {
                     // recorder is guaranteed non-null here: only resolveStrand can yield 'bound'.
-                    await recorder.recordUsage(token, initiatorPartyId, resolved.strandId);
+                    await recorder.recordUsage({
+                        token,
+                        peerKey: contact.peerKey,
+                        peerSignature: contact.peerSignature,
+                        usageStampId: contact.usageStampId,
+                        strandId: resolved.strandId,
+                        disclosure: disclosureText,
+                        signal
+                    });
                     return this.approve({
                         strand: { strandId: resolved.strandId, createdBy: 'responder' },
                         memberPrivateKey: resolved.memberPrivateKey ?? undefined,
@@ -173,10 +241,33 @@ export class StrandFormationManager {
                     return { approved: false, reason: 'Host strand not yet available on this responder' };
                 }
                 case 'unbound':
-                    return await this.provisionUnbound(token, initiatorPartyId);
+                    return await this.provisionUnbound(contact, disclosureText, signal);
             }
         }
         catch (err) {
+            if (err instanceof FormationAbortedError) {
+                // The listener's timeout path owns the reply for an abandoned provisioning; mapping
+                // this onto 'Formation conflict, retry' would misreport it as a conflict.
+                throw err;
+            }
+            if (err instanceof FormationApprovalError) {
+                log('approval failed (%s) for token %s: %o', err.failure, token, err);
+                return { approved: false, reason: APPROVAL_REJECTION_REASONS[err.failure] };
+            }
+            if (err instanceof InvitationExhaustedError) {
+                // Shares `INVALID_TOKEN_REASON` with the up-front `validateToken` rejection so the loser
+                // of the race that exposed the spent invite sees exactly what a non-racing latecomer
+                // sees. No wire-visible distinction between "invalid" and "exhausted" — the
+                // operator signal lives in this log line instead.
+                // NOTE: if a joining client ever has to tell "never valid" from "used up" WITHOUT node
+                // logs, that is a new protocol reason string, not a local change here.
+                log('invitation exhausted for token %s: %d of %d use(s) already recorded', err.token, err.usesRecorded, err.totalUses);
+                return { approved: false, reason: INVALID_TOKEN_REASON };
+            }
+            // An approval is never discarded to a lost key race: each redemption writes under its
+            // own `UsageStampId`, so no other writer can take its row key. Reaching this catch-all
+            // means the failure was never retryable at the database layer to begin with (or the
+            // transient-cluster retry inside `ControlDatabase.lockedWithRetry` ran out).
             log('provisionAsResponder failed for token %s: %o', token, err);
             return { approved: false, reason: 'Formation conflict, retry' };
         }
@@ -202,11 +293,20 @@ export class StrandFormationManager {
      * the responder-provisions placeholder as failure). The broader "should this fallback exist
      * at all?" question lives in backlog `formation-initiatorcreates-cover-or-remove`.
      */
-    async provisionUnbound(token, initiatorPartyId) {
+    async provisionUnbound(contact, disclosureText, signal) {
+        const token = contact.token;
         const recorder = this.formationUsageRecorder;
         if (recorder?.provisionAndRecord) {
             const sAppId = await this.resolveInviteSAppId(token);
-            const provisioned = await recorder.provisionAndRecord(token, initiatorPartyId, sAppId);
+            const provisioned = await recorder.provisionAndRecord({
+                token,
+                peerKey: contact.peerKey,
+                peerSignature: contact.peerSignature,
+                usageStampId: contact.usageStampId,
+                sAppId,
+                disclosure: disclosureText,
+                signal
+            });
             return this.approve({
                 strand: { strandId: provisioned.strandId, createdBy: 'responder' },
                 memberPrivateKey: provisioned.memberPrivateKey ?? undefined,
@@ -215,7 +315,7 @@ export class StrandFormationManager {
         }
         if (this.strandProvisioner) {
             const sAppId = await this.resolveInviteSAppId(token);
-            const result = await this.strandProvisioner.provisionStrand(sAppId, initiatorPartyId, this.partyId);
+            const result = await this.strandProvisioner.provisionStrand(sAppId, contact.partyId, this.partyId);
             return this.approve({
                 strand: { strandId: result.strandId, createdBy: 'responder' },
                 dbConnectionInfo: { endpoint: 'local', credentialsRef: '' }

package/dist/strand-formation-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-formation-manager.js","sourceRoot":"","sources":["../src/strand-formation-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAc1B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,6BAA6B,EAK9B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAsCpD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAsB;IAYjC,YAAY,OAAsC;QAHjC,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,mBAAc,GAAG,CAAC,CAAC;QAGzB,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC7D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACpC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YACnD,kBAAkB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC;YACrF,eAAe,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,CACvD,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,CAAC;YAChE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5F,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;SACzD,CAAC,CAAC;QAEH,GAAG,CAAC,8CAA8C,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY,EAAE,UAAmB;QACjD,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY,EAAE,UAAmB;QACnD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CACd,UAA0B,EAC1B,UAAqC,EACrC,IAAY;QAEZ,GAAG,CAAC,0CAA0C,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAElE,MAAM,OAAO,GAA4B;YACvC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAC3C,UAAU;YACV,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE;gBAC1C,OAAO;gBACP,cAAc,EAAE,UAAU,CAAC,SAAS;gBACpC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;gBACvF,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC,CAAC;YAEH,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEpD,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ;gBACnC,4FAA4F;gBAC5F,qFAAqF;gBACrF,+EAA+E;gBAC/E,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;aAC7C,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAChF,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,8CAA8C;YAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,UAAqC;QACnF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,oDAAoD;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,oBAAoB,CAChC,KAAa,EACb,gBAAwB,EACxB,WAAsC;QAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,MAAM,QAAQ,GAAuB,QAAQ,EAAE,aAAa;YAC1D,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAExB,IAAI,CAAC;YACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,8EAA8E;oBAC9E,MAAM,QAAS,CAAC,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACxE,OAAO,IAAI,CAAC,OAAO,CAAC;wBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;wBAC/D,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,SAAS;wBACxD,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;qBAC5D,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,GAAG,CAAC,wEAAwE,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBACxG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;gBACxF,CAAC;gBACD,KAAK,SAAS;oBACZ,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,gBAAgB,CAC5B,KAAa,EACb,gBAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,IAAI,QAAQ,EAAE,kBAAkB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAClE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,IAAI,SAAS;gBAC3D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACpG,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAC7D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;YAC5C,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,OAAO,CAAC,MAAgC;QAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB;YAAE,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,gBAAgB,CAC5B,UAA0B,EAC1B,UAAqC,EACrC,QAAgC;QAEhC,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"strand-formation-manager.js","sourceRoot":"","sources":["../src/strand-formation-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAOjE,OAAO,EACL,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,qFAAqF;AACrF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,mCAAmC,EACnC,aAAa,EACb,6BAA6B,EAK9B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,0BAA0B,GAA6C;IAC3E,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,uCAAuC;IACpD,SAAS,EAAE,4BAA4B;IACvC,UAAU,EAAE,wCAAwC;IACpD,aAAa,EAAE,kCAAkC;CAClD,CAAC;AA8CF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAsB;IAYjC,YAAY,OAAsC;QAHjC,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,mBAAc,GAAG,CAAC,CAAC;QAGzB,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACvD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC7D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;QACrE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACpC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YACnD,kBAAkB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC;YACrF,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC;YAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5F,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,qBAAqB;SACzD,CAAC,CAAC;QAEH,GAAG,CAAC,8CAA8C,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY,EAAE,UAAmB;QACjD,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY,EAAE,UAAmB;QACnD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACd,UAA0B,EAC1B,UAAqC,EACrC,OAAyE,EACzE,IAAY;QAEZ,GAAG,CAAC,0CAA0C,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAElE,MAAM,OAAO,GAA4B;YACvC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU;YACV,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE;gBAC1C,OAAO;gBACP,cAAc,EAAE,UAAU,CAAC,SAAS;gBACpC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;gBACvF,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,kBAAkB,EAAE,IAAI,CAAC,2BAA2B,EAAE;gBACtD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;aACnC,CAAC,CAAC;YAEH,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEpD,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,gBAAgB,EAAE,EAAE;gBACpB,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ;gBACnC,4FAA4F;gBAC5F,qFAAqF;gBACrF,+EAA+E;gBAC/E,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;aAC7C,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;;;OAQG;IACK,2BAA2B;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC5C,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,8CAA8C;YAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,UAAqC;QACnF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,oDAAoD;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACK,KAAK,CAAC,oBAAoB,CAChC,OAAgC,EAChC,MAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,qFAAqF;QACrF,wFAAwF;QACxF,qFAAqF;QACrF,yCAAyC;QACzC,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;YACnF,GAAG,CAAC,8CAA8C,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,MAAM,QAAQ,GAAuB,QAAQ,EAAE,aAAa;YAC1D,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAExB,IAAI,CAAC;YACH,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,8EAA8E;oBAC9E,MAAM,QAAS,CAAC,WAAW,CAAC;wBAC1B,KAAK;wBACL,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;wBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,UAAU,EAAE,cAAc;wBAC1B,MAAM;qBACP,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,OAAO,CAAC;wBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;wBAC/D,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,SAAS;wBACxD,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;qBAC5D,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,GAAG,CAAC,wEAAwE,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBACxG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;gBACxF,CAAC;gBACD,KAAK,SAAS;oBACZ,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,oFAAoF;gBACpF,0EAA0E;gBAC1E,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,GAAG,CAAC,uCAAuC,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,CAAC;YACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,yFAAyF;gBACzF,qFAAqF;gBACrF,4EAA4E;gBAC5E,kDAAkD;gBAClD,uFAAuF;gBACvF,uEAAuE;gBACvE,GAAG,CACD,qEAAqE,EACrE,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,SAAS,CACd,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC3D,CAAC;YACD,sFAAsF;YACtF,uFAAuF;YACvF,oFAAoF;YACpF,6EAA6E;YAC7E,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAgC,EAChC,cAAsB,EACtB,MAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,IAAI,QAAQ,EAAE,kBAAkB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;gBACpD,KAAK;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM;gBACN,UAAU,EAAE,cAAc;gBAC1B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAClE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,IAAI,SAAS;gBAC3D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC,OAAO,CAAC;gBAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;gBAC7D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE;YAC5C,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,OAAO,CAAC,MAAgC;QAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,IAAI,CAAC,IAAI,CAAC,sBAAsB;YAAE,OAAO,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,gFAAgF;IAExE,KAAK,CAAC,gBAAgB,CAC5B,UAA0B,EAC1B,UAAqC,EACrC,QAAgC;QAEhC,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/strand-formation-protocol.d.ts

@@ -21,6 +21,30 @@ import type { Libp2p } from '@libp2p/interface';
 import type { StrandFormationDisclosure } from './types.js';
 /** Protocol id for the native formation transport (parallel to `/sereus/seed/1.0.0`). */
 export declare const FORMATION_PROTOCOL = "/sereus/formation/1.0.0";
+/**
+ * Rejection reason for an invitation that cannot be redeemed at all — unknown, expired, or
+ * fully spent. Shared with `StrandFormationManager`, which reports an
+ * `InvitationExhaustedError` (an invite spent out from under a redemption already in flight)
+ * with this SAME wording on purpose: a joiner that lost the race must be indistinguishable
+ * from a non-racing latecomer, so the two sites must never drift apart.
+ */
+export declare const INVALID_TOKEN_REASON = "Invalid token";
+/**
+ * Wire-latency margin (ms) added to the responder's provisioning budget to get the
+ * initiator's await-response budget — the travel time for the result frame to come back
+ * after the responder finishes (see {@link DEFAULT_PROVISION_TIMEOUT_MS}).
+ * `StrandFormationManager` reuses this constant so a CONFIGURED budget preserves the same
+ * margin the defaults do, instead of applying the same number to both sides and racing the
+ * initiator's own timeout against the responder's clean rejection reply. The responder's
+ * clamp ({@link provisionCeilingMs}) holds the same margin back, so the ordering survives a
+ * budget large enough that BOTH roles get clamped.
+ *
+ * NOTE: 3 s is a fixed assumption about how long the result frame takes to travel back. If
+ * formation ever runs over paths where that frame can take longer (a slow circuit relay, a
+ * congested mobile link), the margin is too thin and the initiator's timeout races the
+ * responder's reply again — raise it, or derive it from an observed round-trip.
+ */
+export declare const PROVISION_RESPONSE_TRAVEL_MARGIN_MS = 3000;
 export type FormationParty = 'initiator' | 'responder';
 export interface FormationStrandInfo {
     strandId: string;
@@ -62,8 +86,20 @@ export type ResponderProvisionOutcome = {
 export interface FormationContactMessage {
     /** The real invitation token. */
     token: string;
-    /** Initiator's member key (peer id). */
+    /** Initiator's member key (peer id) — human-facing identity in logs and `FormStrandResult.memberKey`. */
     partyId: string;
+    /**
+     * Initiator's base64url ed25519 public key — the key behind `partyId`, written to
+     * `FormationUsage.PeerKey` and covered by BOTH signed digests.
+     */
+    peerKey: string;
+    /** Joiner-minted single-use nonce for THIS redemption; both signed digests cover it. */
+    usageStampId: string;
+    /**
+     * The joiner's signature over the `'consent'` digest (see `formationConsentMessage`
+     * in control-database.ts) — proof the named peer agreed to this redemption.
+     */
+    peerSignature: string;
     /** The real disclosure, carried verbatim. */
     disclosure: StrandFormationDisclosure;
     /** Initiator's real multiaddrs. */
@@ -104,14 +140,19 @@ export interface FormationListenerOptions {
     validateDisclosure(token: string, disclosure: StrandFormationDisclosure): Promise<boolean>;
     /**
      * Provision (or, for provision-then-record, resolve + record consent against) the
-     * strand (`responderCreates`) for the given initiator. The REAL token is threaded
-     * in so the hook can map it to the bound host strand and its membership key.
+     * strand (`responderCreates`) for the given initiator. The WHOLE contact message is
+     * threaded in: the hook needs the REAL token to map the bound host strand, and the
+     * joiner's `peerKey`/`usageStampId`/`peerSignature` to write the consent columns.
      *
      * Returns a {@link ResponderProvisionOutcome}: the hook may REJECT post-validation
      * (e.g. an unconverged host strand) and the listener turns that into a clean,
      * non-disclosing `approved: false` reply rather than dropping the result frame.
+     *
+     * `signal` is aborted when the listener's work budget expires: a hook that observes it
+     * BEFORE writing abandons the redemption and leaves the invite unspent. Optional so
+     * signal-unaware hooks (tests, mocks) stay assignable.
      */
-    provisionStrand(token: string, initiatorPartyId: string, disclosure: StrandFormationDisclosure): Promise<ResponderProvisionOutcome>;
+    provisionStrand(contact: FormationContactMessage, signal?: AbortSignal): Promise<ResponderProvisionOutcome>;
     /** Responder identity, disclosed only AFTER token + disclosure validation passes. */
     getResponderIdentity(): {
         partyId: string;
@@ -119,6 +160,14 @@ export interface FormationListenerOptions {
     };
     sessionTimeoutMs?: number;
     stepTimeoutMs?: number;
+    /**
+     * Budget for the `provisionStrand` hook call — distinct from `stepTimeoutMs` because
+     * provisioning is real work, not a bare wire read/write. Default 12 s; `0`/unset uses
+     * the default; a value that would outlive the session is clamped ({@link
+     * provisionCeilingMs}). See {@link DEFAULT_PROVISION_TIMEOUT_MS} for the full ordering
+     * rationale.
+     */
+    provisionTimeoutMs?: number;
     maxConcurrentSessions?: number;
 }
 /**
@@ -131,6 +180,8 @@ export declare class FormationListener {
     private readonly options;
     private readonly sessionTimeoutMs;
     private readonly stepTimeoutMs;
+    private readonly provisionWorkMs;
+    private readonly provisionGraceMs;
     private readonly maxConcurrentSessions;
     private readonly registered;
     private activeSessions;
@@ -141,6 +192,48 @@ export declare class FormationListener {
     register(node: Libp2p, protocolId?: string): void;
     unregister(node: Libp2p, protocolId?: string): void;
     private handleStream;
+    /**
+     * Run the provisioning hook under its WORK budget — the configured provisioning budget minus
+     * the trailing settle grace ({@link splitProvisionBudget}, {@link PROVISION_SETTLE_GRACE_MS}).
+     *
+     * When the work budget expires the hook's signal is aborted, then
+     * {@link settleWithinGrace} waits out the grace for the aborted work to settle anyway.
+     * Returns `undefined` for "timed out" — which the caller turns into a retryable rejection
+     * frame — and rethrows every other failure so it reaches the internal-error path.
+     *
+     * Deliberately not `withDeadline`: that exposes neither the timed-out flag nor the signal
+     * outside its `op`, and both are needed here.
+     */
+    private provision;
+    /**
+     * Wait out the settle grace for an ABORTED provisioning, adopting a late success.
+     *
+     * A hook that observed the abort before issuing its `FormationUsage` insert rejects (with
+     * `FormationAbortedError`) and leaves the invite unspent → reported as a timeout. A hook
+     * that had already written cannot be un-written (the table is append-only), so if it lands
+     * inside the grace its outcome is ADOPTED — the joiner is told the truth (approved, or the
+     * hook's own rejection reason) rather than "timed out" over a spent invite.
+     *
+     * NOTE: one window stays open — a work budget that expires after the `FormationUsage`
+     * insert was issued AND a commit that outlasts the grace. The joiner is told 'timed out'
+     * while its one-time invite is in fact spent, and since every retry mints a fresh keypair
+     * no recovery path can match it. Nothing can un-spend an append-only row, so the late-settle
+     * logging below is the observability for it; widen the grace only if it is seen in the wild.
+     */
+    private settleWithinGrace;
+    /**
+     * Joiner-consent pre-check — the legibility twin of the schema's
+     * `FormationUsage.PeerConsented` CHECK, exactly as `verifyFormationApproval` is for the
+     * approver's vouch. The database constraint stays the authority; this turns a bad consent
+     * into a clean 'Invalid joiner consent' rejection instead of an opaque CHECK failure at
+     * commit. Runs BEFORE token/disclosure validation: it is the cheapest check (pure local
+     * crypto, no DB read) and a rejection discloses nothing.
+     *
+     * Also pins `partyId` to `peerKey`: an ed25519 peer id is an identity multihash of the
+     * very key, and this is the ONLY layer that can check the match — SQL cannot unwrap a
+     * multihash, and `partyId` itself is never stored.
+     */
+    private isJoinerConsentValid;
     private runSession;
 }
 export interface FormationDialOptions {
@@ -152,6 +245,12 @@ export interface FormationDialOptions {
     validateResponse(response: FormationResultMessage): Promise<boolean>;
     sessionTimeoutMs?: number;
     stepTimeoutMs?: number;
+    /**
+     * Budget for the `await-response` read only (the responder's provisioning + reply travel
+     * time) — `dial-connect` keeps using `stepTimeoutMs`. Default 15 s; `0`/unset uses the
+     * default. See {@link DEFAULT_PROVISION_TIMEOUT_MS} for the full ordering rationale.
+     */
+    provisionTimeoutMs?: number;
     protocolId?: string;
 }
 /**