@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/control-formation-recorder.js

@@ -2,15 +2,14 @@ import debug from 'debug';
 import { FormationAbortedError, InvitationExhaustedError } from './control-database.js';
 import { mintStrandId } from './strand-id.js';
 import { createHttpFormationApprover, verifyFormationApproval, FormationApprovalError } from './formation-approval.js';
+import { isInviteExpired } from './formation-token.js';
 const log = debug('sereus:cadre:formation-recorder');
-/** Far-future sentinel for an invitation that never expires (max valid JS Date). */
-const NEVER_EXPIRES = new Date(8640000000000000);
 /**
  * {@link FormationUsageRecorder} backed by the real `CadreControl` tables.
  *
- * It reads `FormationInvite` / `FormationUsage` to answer token-validity and
- * usage questions, and writes the consent row that records a redemption. Two
- * provisioning shapes are supported, keyed on whether the invite binds a host strand:
+ * It reads a session's token once ({@link readToken}: the `FormationInvite` row and its
+ * `FormationUsage` count), and writes the consent row that records a redemption from that
+ * read. Two provisioning shapes are supported, keyed on whether the invite binds a host strand:
  *
  * - **Bound (provision-then-record):** the host strand already exists (owner-signed
  *   up front and named by the invite's `StrandId`), so {@link resolveStrand} reports it
@@ -48,38 +47,21 @@ export class ControlFormationUsageRecorder {
         this.controlDatabase = controlDatabase;
         this.approver = options?.approver ?? createHttpFormationApprover();
     }
-    /** A token is valid when a matching, unexpired `FormationInvite` exists. */
-    async isTokenValid(token) {
-        const invite = await this.controlDatabase.queryFormationInvite(token);
-        if (!invite) {
-            return { valid: false, reason: 'unknown' };
-        }
-        if (invite.expiresAtMs !== null && invite.expiresAtMs <= Date.now()) {
-            log('Token expired: %s', token);
-            return { valid: false, reason: 'expired' };
-        }
-        return {
-            valid: true,
-            invitation: {
-                token: invite.token,
-                sAppId: invite.sAppId,
-                expiration: invite.expiresAtMs !== null ? new Date(invite.expiresAtMs) : NEVER_EXPIRES,
-                bootstrap: [],
-            },
-        };
-    }
     /**
-     * A token is "used" when its recorded usage count has reached the invite's
-     * `TotalUses`. A null `TotalUses` (unlimited) is never used up; an unknown
-     * token is reported not-used (validity is handled by {@link isTokenValid}).
+     * One `FormationInvite` read, then one `FormationUsage` count only when the invite is
+     * metered (`TotalUses` set) and unexpired: an unknown, expired or unlimited token has no
+     * seat to count. This early count refuses a spent token before anything costly (the outside
+     * approval call, the strand-database write that issues the membership invite); the count
+     * inside the write lock decides.
      */
-    async isTokenUsed(token) {
+    async readToken(token) {
         const invite = await this.controlDatabase.queryFormationInvite(token);
-        if (!invite || invite.totalUses === null) {
-            return false;
-        }
-        const uses = await this.controlDatabase.countFormationUsage(token);
-        return uses >= invite.totalUses;
+        const metered = invite !== null && invite.totalUses !== null && !isInviteExpired(invite, Date.now());
+        return {
+            token,
+            invite,
+            usesRecorded: metered ? await this.controlDatabase.countFormationUsage(token) : null,
+        };
     }
     /**
      * Any `FormationInvite` row still unexpired and not fully consumed — the
@@ -157,66 +139,79 @@ export class ControlFormationUsageRecorder {
      * spent on AND provably the joiner that agreed. Use
      * {@link ControlDatabase.redeemInvitation} for the consent-creates-strand path instead.
      *
-     * Authorizes ({@link authorizeUsage}) and writes in one step, for callers with nothing to do
-     * in between.
+     * Reads the invite for itself (it is handed no session read) and the strand's stamp inside
+     * `recordFormationUsage`; otherwise authorizes as {@link authorizeUsage} does and writes in
+     * one step, for callers with nothing to do in between.
      */
     async recordUsage(params) {
-        await (await this.authorizeUsage(params)).record();
+        if (params.signal?.aborted) {
+            throw new FormationAbortedError(params.token, 'usage recording');
+        }
+        const invite = await this.controlDatabase.queryFormationInvite(params.token);
+        await (await this.authorize(params, invite, undefined)).record();
     }
     /**
      * Everything {@link recordUsage} does before its write, so the manager can issue the
      * joiner's membership pass into the host strand only once the redemption is cleared, and
-     * spend the token only after that.
-     *
-     * Reads the invite first (one extra read per redemption) to learn its `ValidationUrl` and
-     * seat budget, obtains the approval through {@link obtainApproval} when one is demanded,
-     * re-checks the abort (the approval call may have been long), and pre-checks the seat
-     * budget ({@link assertSeatFree}). The returned `record()` closes over the captured fields
-     * and approval, so the nonce the approver signed is the nonce inserted without the caller
-     * ever passing it back.
+     * spend the token only after that. Takes the invite's `ValidationUrl` and seat budget from
+     * the session's `read`, and the host strand's stamp from `host`, so it reads neither again.
      */
-    async authorizeUsage(params) {
+    async authorizeUsage(params, read, host) {
+        return await this.authorize(params, read.invite, host.strandStampId);
+    }
+    /**
+     * Obtain the approval through {@link obtainApproval} when `invite` demands one, re-check the
+     * abort (the approval call may have been long), and after an obtained approval re-check the
+     * seat budget ({@link assertSeatFree}). The returned `record()` closes over the captured
+     * fields and approval, so the nonce the approver signed is the nonce inserted without the
+     * caller ever passing it back. `strandStampId` undefined makes `recordFormationUsage` read it.
+     */
+    async authorize(params, invite, strandStampId) {
         const { token, peerKey, peerSignature, usageStampId, strandId, disclosure, signal } = params;
         if (signal?.aborted) {
             throw new FormationAbortedError(token, 'usage recording');
         }
-        const invite = await this.controlDatabase.queryFormationInvite(token);
         // NOTE: a missing invite row reads as "no approval required" here and in
-        // `provisionAndRecord`, so an invite that vanished between `resolveStrand` and this read
-        // would be written unapproved. Safe only because the database's `FormationUsage.Authorized`
-        // CHECK demands a matching `FormationInvite` and rolls the write back regardless; if that
-        // CHECK ever loosens, reject on `invite === null` instead of defaulting to null.
+        // `provisionAndRecord`, so an invite that was absent from the session's read (or vanished
+        // before `recordUsage`'s) would be written unapproved. Safe only because the database's
+        // `FormationUsage.Authorized` CHECK demands a matching `FormationInvite` and rolls the write
+        // back regardless; if that CHECK ever loosens, reject on `invite === null` instead of
+        // defaulting to null.
+        const validationUrl = invite?.validationUrl ?? null;
         const approval = await this.obtainApproval({
-            token, usageStampId, strandId, peerKey, disclosure,
-            validationUrl: invite?.validationUrl ?? null,
+            token, usageStampId, strandId, peerKey, disclosure, validationUrl,
         }, signal);
         if (signal?.aborted) {
             throw new FormationAbortedError(token, 'usage recording');
         }
         const totalUses = invite?.totalUses ?? null;
-        await this.assertSeatFree(token, totalUses);
+        if (validationUrl !== null) {
+            await this.assertSeatFree(token, totalUses);
+        }
         return {
             record: async () => {
                 await this.controlDatabase.recordFormationUsage({
                     token, strandId, peerKey, peerSignature, usageStampId, disclosure, signal,
-                    totalUses, ...approval,
+                    totalUses, strandStampId, ...approval,
                 });
                 log('Recorded formation usage: token=%s strand=%s', token, strandId);
             }
         };
     }
     /**
-     * Refuse a redemption whose invite has no seat left, BEFORE anything is written — the
-     * authoritative check is the one `recordFormationUsage` repeats inside its write lock.
-     * Catches a same-node rival that took the last seat while this redemption waited on the
-     * approval hook, which `runSession`'s up-front `isTokenUsed` check could not see.
+     * Refuse a redemption whose invite lost its last seat while this redemption waited on its
+     * outside approval, BEFORE anything is written — the authoritative check is the one
+     * `recordFormationUsage` repeats inside its write lock. Runs only after an obtained approval:
+     * that call is the one long wait between the session's early count (`readToken`) and the
+     * membership pass, in which a same-node rival could take the seat unseen.
      *
-     * NOTE: two redemptions that both pass this check within the time one of them takes to
-     * issue its membership pass still both issue one, and the loser's pass is orphaned
-     * (expiry-bounded, never handed out). Holding the control write lock across issuance would
-     * close it, but `lockedWithRetry` re-runs locked bodies on transient failures (a re-run
-     * would double-issue) and every control write would stall behind a strand-database write.
-     * If orphaned passes from same-node races ever matter, reserve the seat before issuance.
+     * NOTE: two redemptions that both pass the last count before issuance (this one after an
+     * approval, `readToken`'s without one) within the time one of them takes to issue its
+     * membership pass still both issue one, and the loser's pass is orphaned (expiry-bounded,
+     * never handed out). Holding the control write lock across issuance would close it, but
+     * `lockedWithRetry` re-runs locked bodies on transient failures (a re-run would double-issue)
+     * and every control write would stall behind a strand-database write. If orphaned passes from
+     * same-node races ever matter, reserve the seat before issuance.
      */
     async assertSeatFree(token, totalUses) {
         if (totalUses === null) {
@@ -228,29 +223,32 @@ export class ControlFormationUsageRecorder {
         }
     }
     /**
-     * Classify the host strand this invite binds to (see {@link ResolvedHostStrand}):
+     * Classify the host strand the read invite binds to (see {@link ResolvedHostStrand}), with
+     * one `Strand` read and no invite read:
      *
      * - no invite / no `StrandId` → `unbound` (responder-provisions path).
-     * - `StrandId` set AND the strand row is present → `bound`, carrying its
-     *   `MemberPrivateKey` (the closed-strand read-gating secret) for delivery to a
-     *   validated invitee.
+     * - `StrandId` set AND the strand row is present → `bound`, carrying its type, its
+     *   `StampId` (which the consent row names) and its `MemberPrivateKey` (the closed-strand
+     *   read-gating secret) for delivery to a validated invitee.
      * - `StrandId` set but the strand row is absent → `missing` (the host strand has not
      *   converged on this responder yet); the manager rejects cleanly instead of recording
      *   usage against a non-existent strand, which would fail the deferred `StrandExists`
      *   CHECK at commit and drop the result frame.
      */
-    async resolveStrand(token) {
-        const invite = await this.controlDatabase.queryFormationInvite(token);
-        if (!invite || !invite.strandId) {
+    async resolveStrand(read) {
+        const strandId = read.invite?.strandId;
+        if (!strandId) {
             return { kind: 'unbound' };
         }
-        const strand = await this.controlDatabase.queryStrand(invite.strandId);
+        const strand = await this.controlDatabase.queryStrandWithStamp(strandId);
         if (!strand) {
-            return { kind: 'missing', strandId: invite.strandId };
+            return { kind: 'missing', strandId };
         }
         return {
             kind: 'bound',
-            strandId: invite.strandId,
+            strandId,
+            strandType: strand.Type,
+            strandStampId: strand.StampId,
             memberPrivateKey: strand.MemberPrivateKey ?? null,
         };
     }
@@ -269,7 +267,8 @@ export class ControlFormationUsageRecorder {
      *
      * The strand is open (`'o'`) — an unbound responder-provisioned strand has no membership
      * key — so the returned `memberPrivateKey` is null. `sAppId` is accepted for parity/future
-     * use; `redeemInvitation` does not currently thread it into the `Strand` row.
+     * use; `redeemInvitation` does not currently thread it into the `Strand` row. The invite's
+     * `ValidationUrl` and seat budget come from the session's `read`.
      *
      * A concurrent redemption of the same single-use invite still THROWS for the loser — the
      * manager maps that to a clean protocol rejection (it never lets the dropped insert close
@@ -282,13 +281,13 @@ export class ControlFormationUsageRecorder {
      * removal), chosen over a fought-over shared key whose failure mode was the silent loss of
      * a consented join.
      */
-    async provisionAndRecord(params) {
+    async provisionAndRecord(params, read) {
         const { token, peerKey, peerSignature, usageStampId, disclosure, signal } = params;
         if (signal?.aborted) {
             throw new FormationAbortedError(token, 'redemption');
         }
         const strandId = mintStrandId();
-        const invite = await this.controlDatabase.queryFormationInvite(token);
+        const invite = read.invite;
         const approval = await this.obtainApproval({
             token, usageStampId, strandId, peerKey, disclosure,
             validationUrl: invite?.validationUrl ?? null,

package/dist/control-formation-recorder.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-formation-recorder.js","sourceRoot":"","sources":["../src/control-formation-recorder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAwB,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EAIvB,MAAM,yBAAyB,CAAC;AASjC,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD,oFAAoF;AACpF,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,6BAA6B;IAGxC;;;;OAIG;IACH,YACmB,eAAgC,EACjD,OAA0C;QADzB,oBAAe,GAAf,eAAe,CAAiB;QAGjD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,2BAA2B,EAAE,CAAC;IACrE,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpE,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa;gBACtF,SAAS,EAAE,EAAE;aACd;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB;QAC5B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,6BAA6B,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,cAAc,CAC1B,OAA2F,EAC3F,MAAoB;QAEpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QAC7C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAA6B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAsB,CAC9B,WAAW,EACX,kEAAkE,MAAM,CAAC,KAAK,GAAG,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1F,MAAM,IAAI,sBAAsB,CAC9B,YAAY,EACZ,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,WAAW,CACvB,OAAiC,EACjC,MAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,MAA4B;QAC5C,MAAM,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,cAAc,CAAC,MAA4B;QAC/C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC7F,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,yEAAyE;QACzE,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;YAClD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;SAC7C,EAAE,MAAM,CAAC,CAAC;QACX,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC;QAC5C,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;oBAC9C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;oBACzE,SAAS,EAAE,GAAG,QAAQ;iBACvB,CAAC,CAAC;gBACH,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvE,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,SAAwB;QAClE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAQxB;QACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACnF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;YAClD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;SAC7C,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YAC1C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;YACzE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,QAAQ;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,2DAA2D,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"control-formation-recorder.js","sourceRoot":"","sources":["../src/control-formation-recorder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAwB,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EAIvB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,eAAe,EAAsD,MAAM,sBAAsB,CAAC;AAE3G,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,6BAA6B;IAGxC;;;;OAIG;IACH,YACmB,eAAgC,EACjD,OAA0C;QADzB,oBAAe,GAAf,eAAe,CAAiB;QAGjD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,2BAA2B,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrG,OAAO;YACL,KAAK;YACL,MAAM;YACN,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;SACrF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB;QAC5B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,6BAA6B,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,cAAc,CAC1B,OAA2F,EAC3F,MAAoB;QAEpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QAC7C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAA6B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAsB,CAC9B,WAAW,EACX,kEAAkE,MAAM,CAAC,KAAK,GAAG,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1F,MAAM,IAAI,sBAAsB,CAC9B,YAAY,EACZ,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,WAAW,CACvB,OAAiC,EACjC,MAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,WAAW,CAAC,MAA4B;QAC5C,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,MAA4B,EAC5B,IAAwB,EACxB,IAAqB;QAErB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS,CACrB,MAA4B,EAC5B,MAAmC,EACnC,aAAiC;QAEjC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC7F,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,yEAAyE;QACzE,0FAA0F;QAC1F,wFAAwF;QACxF,6FAA6F;QAC7F,sFAAsF;QACtF,sBAAsB;QACtB,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa;SAClE,EAAE,MAAM,CAAC,CAAC;QACX,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC;QAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;oBAC9C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;oBACzE,SAAS,EAAE,aAAa,EAAE,GAAG,QAAQ;iBACtC,CAAC,CAAC;gBACH,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvE,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,SAAwB;QAClE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CAAC,IAAwB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,aAAa,EAAE,MAAM,CAAC,OAAO;YAC7B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAQxB,EAAE,IAAwB;QACzB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACnF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;YAClD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;SAC7C,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YAC1C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;YACzE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,QAAQ;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,2DAA2D,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/control-protocol-guard.d.ts

@@ -14,9 +14,10 @@
  *
  * ## The classes
  *
- *  - `stranger-open` — seed delivery, strand formation, cadre-invitation redemption. Any peer;
- *    each handler makes its own trust decision in-protocol (a seed signature against the
- *    anchored trust policy, a formation token, an invitation's possession proof).
+ *  - `stranger-open` — seed delivery, strand formation, cadre-invitation redemption, owner-grant
+ *    redemption. Any peer; each handler makes its own trust decision in-protocol (a seed
+ *    signature against the anchored trust policy, a formation token, an invitation's or a
+ *    grant's possession proof).
  *  - `transport` — libp2p plumbing (identify, ping, hole punching, AutoNAT, the circuit-relay
  *    stop and hop protocols, WebRTC signaling). Every connection runs these, the redeeming
  *    device's own included: refusing identify would make that device treat the member as
@@ -78,7 +79,7 @@
 import type { Libp2p } from '@libp2p/interface';
 /** What a peer must be to open a stream on a control-node protocol (see the module doc). */
 export type ControlProtocolClass = 
-/** Any peer. The handler makes its own trust decision in-protocol (seed, formation, cadre-invite). */
+/** Any peer. The handler makes its own trust decision in-protocol (seed, formation, cadre-invite, owner-grant). */
 'stranger-open'
 /** libp2p plumbing that a stranger's connection needs or that carries no party data. */
  | 'transport'
@@ -111,6 +112,12 @@ export declare class ControlStreamRefusedError extends Error {
  * storage scope key already does.
  */
 export declare function controlNetworkName(partyId: string): string;
+/**
+ * Whether a peer whose protocol list is `protocols` serves the control database. Optimystic
+ * counts a peer into a control block's cohort by the same test (`servesThisNetwork` in db-p2p's
+ * `libp2p-key-network.ts`), before its membership check.
+ */
+export declare function servesControlDatabase(partyId: string, protocols: readonly string[]): boolean;
 /**
  * The class of every protocol a control node serves, by exact protocol id: the single
  * declaration the guard enforces. See the module doc for what each class admits and why each

package/dist/control-protocol-guard.js

@@ -14,9 +14,10 @@
  *
  * ## The classes
  *
- *  - `stranger-open` — seed delivery, strand formation, cadre-invitation redemption. Any peer;
- *    each handler makes its own trust decision in-protocol (a seed signature against the
- *    anchored trust policy, a formation token, an invitation's possession proof).
+ *  - `stranger-open` — seed delivery, strand formation, cadre-invitation redemption, owner-grant
+ *    redemption. Any peer; each handler makes its own trust decision in-protocol (a seed
+ *    signature against the anchored trust policy, a formation token, an invitation's or a
+ *    grant's possession proof).
  *  - `transport` — libp2p plumbing (identify, ping, hole punching, AutoNAT, the circuit-relay
  *    stop and hop protocols, WebRTC signaling). Every connection runs these, the redeeming
  *    device's own included: refusing identify would make that device treat the member as
@@ -79,6 +80,7 @@ import debug from 'debug';
 import { SEED_PROTOCOL } from './seed-bootstrap.js';
 import { FORMATION_PROTOCOL } from './strand-formation-protocol.js';
 import { CADRE_INVITE_PROTOCOL } from './cadre-invite-protocol.js';
+import { OWNER_GRANT_PROTOCOL } from './owner-grant-protocol.js';
 import { WAKE_PROTOCOL } from './strand-wake-protocol.js';
 import { STRAND_ADDR_PROTOCOL } from './strand-addr-protocol.js';
 import { withTimeout } from './control-stream.js';
@@ -113,6 +115,19 @@ export class ControlStreamRefusedError extends Error {
 export function controlNetworkName(partyId) {
     return `control-${partyId}`;
 }
+/** The control database's two storage protocols, `repo` and `cluster`. */
+function controlDatabaseProtocols(partyId) {
+    const prefix = `/optimystic/${controlNetworkName(partyId)}`;
+    return [`${prefix}/repo/1.0.0`, `${prefix}/cluster/1.0.0`];
+}
+/**
+ * Whether a peer whose protocol list is `protocols` serves the control database. Optimystic
+ * counts a peer into a control block's cohort by the same test (`servesThisNetwork` in db-p2p's
+ * `libp2p-key-network.ts`), before its membership check.
+ */
+export function servesControlDatabase(partyId, protocols) {
+    return controlDatabaseProtocols(partyId).some((protocol) => protocols.includes(protocol));
+}
 /**
  * The class of every protocol a control node serves, by exact protocol id: the single
  * declaration the guard enforces. See the module doc for what each class admits and why each
@@ -125,10 +140,10 @@ export function controlProtocolClasses(partyId) {
         [SEED_PROTOCOL, 'stranger-open'],
         [FORMATION_PROTOCOL, 'stranger-open'],
         [CADRE_INVITE_PROTOCOL, 'stranger-open'],
+        [OWNER_GRANT_PROTOCOL, 'stranger-open'],
         [WAKE_PROTOCOL, 'members'],
         [STRAND_ADDR_PROTOCOL, 'members'],
-        [`${prefix}/repo/1.0.0`, 'members-snapshot'],
-        [`${prefix}/cluster/1.0.0`, 'members-snapshot'],
+        ...controlDatabaseProtocols(partyId).map((protocol) => [protocol, 'members-snapshot']),
         [`${prefix}/db-p2p/sync/1.0.0`, 'members-snapshot'],
         [`${prefix}/db-p2p/block-transfer/1.0.0`, 'members-snapshot'],
         [`${fret}/neighbors`, 'members-snapshot'],

package/dist/control-protocol-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-protocol-guard.js","sourceRoot":"","sources":["../src/control-protocol-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,GAAG,GAAG,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAazD,sFAAsF;AACtF,MAAM,CAAC,MAAM,2BAA2B,GAAyB,kBAAkB,CAAC;AAEpF,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AAExE;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAGnD,YAAY,YAAoB,EAAE,QAAgB,EAAE,MAAc;QACjE,KAAK,CAAC,gCAAgC,YAAY,aAAa,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;QAHpF,SAAI,GAAG,2BAA2B,CAAC;QAI3C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,OAAO,WAAW,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,eAAe,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC;IACpC,OAAO,IAAI,GAAG,CAA+B;QAC5C,CAAC,aAAa,EAAE,eAAe,CAAC;QAChC,CAAC,kBAAkB,EAAE,eAAe,CAAC;QACrC,CAAC,qBAAqB,EAAE,eAAe,CAAC;QAExC,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1B,CAAC,oBAAoB,EAAE,SAAS,CAAC;QAEjC,CAAC,GAAG,MAAM,aAAa,EAAE,kBAAkB,CAAC;QAC5C,CAAC,GAAG,MAAM,gBAAgB,EAAE,kBAAkB,CAAC;QAC/C,CAAC,GAAG,MAAM,oBAAoB,EAAE,kBAAkB,CAAC;QACnD,CAAC,GAAG,MAAM,8BAA8B,EAAE,kBAAkB,CAAC;QAC7D,CAAC,GAAG,IAAI,YAAY,EAAE,kBAAkB,CAAC;QACzC,CAAC,GAAG,IAAI,qBAAqB,EAAE,kBAAkB,CAAC;QAClD,CAAC,GAAG,IAAI,WAAW,EAAE,kBAAkB,CAAC;QACxC,CAAC,GAAG,IAAI,QAAQ,EAAE,kBAAkB,CAAC;QACrC,CAAC,GAAG,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAEpC,CAAC,GAAG,MAAM,WAAW,EAAE,WAAW,CAAC;QACnC,CAAC,GAAG,MAAM,gBAAgB,EAAE,WAAW,CAAC;QACxC,CAAC,kBAAkB,EAAE,WAAW,CAAC;QACjC,CAAC,eAAe,EAAE,WAAW,CAAC;QAC9B,CAAC,uBAAuB,EAAE,WAAW,CAAC;QACtC,CAAC,kCAAkC,EAAE,WAAW,CAAC;QACjD,+EAA+E;QAC/E,CAAC,iCAAiC,EAAE,WAAW,CAAC;QAChD,2EAA2E;QAC3E,CAAC,yBAAyB,EAAE,WAAW,CAAC;KACxC,CAAC,CAAC;AACJ,CAAC;AAwBD,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;WAC9C,OAAQ,KAAkC,CAAC,UAAU,KAAK,UAAU,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,sFAAsF;QACtF,SAAS,GAAI,IAA4D,CAAC,UAAU,EAAE,SAAS,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,oGAAoG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,OAAoC;IAC7F,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,4FAA4F;IAC5F,SAAS,CAAC,UAAU,GAAG,CAAC,QAAgB,EAAuB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9G,GAAG,CAAC,2DAA2D,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,qEAAqE;AACrE,MAAM,oBAAoB;IAUzB,YAA6B,OAAoC;QAApC,YAAO,GAAP,OAAO,CAA6B;QARjE;;;;WAIG;QACc,YAAO,GAAG,IAAI,OAAO,EAA4C,CAAC;QAClE,uBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAGvD,IAAI,CAAC,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,MAA2B;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,aAAa,KAAK,eAAe,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QACf,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,QAAgB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,uBAAuB,QAAQ,iDAAiD;gBAC5F,+CAA+C,2BAA2B,oCAAoC;gBAC9G,oBAAoB,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,2BAA2B,CAAC;IACpC,CAAC;IAEO,IAAI,CAAC,QAAgB,EAAE,aAA6C,EAAE,OAAsB;QACnG,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,sFAAsF;YACtF,wFAAwF;YACxF,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,KAAK,EAAE,MAAc,EAAE,UAAsB,EAAiB,EAAE;gBACtE,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAChD,OAAO;gBACR,CAAC;gBACD,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnC,CAAC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAc,EAAE,UAAsB,EAAwB,EAAE;YACvE,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAChD,OAAO;YACR,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,WAAW,CAAC,YAAoB;QAC7C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAClC,wBAAwB,YAAY,EAAE,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAC7C,CAAC;YACF,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,CAAC;IACF,CAAC;IAED,0FAA0F;IAClF,eAAe,CAAC,YAAoB,EAAE,QAAgB;QAC7D,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,IAAI;gBACpE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,uCAAuC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;IACF,CAAC;CACD;AAED,kEAAkE;AAClE,SAAS,MAAM,CAAC,MAAc,EAAE,YAAoB,EAAE,QAAgB,EAAE,MAAc;IACrF,GAAG,CAAC,uBAAuB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC;QACJ,MAAM,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,iEAAiE;QACjE,GAAG,CAAC,sDAAsD,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;AACF,CAAC"}
+{"version":3,"file":"control-protocol-guard.js","sourceRoot":"","sources":["../src/control-protocol-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,GAAG,GAAG,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAazD,sFAAsF;AACtF,MAAM,CAAC,MAAM,2BAA2B,GAAyB,kBAAkB,CAAC;AAEpF,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AAExE;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAGnD,YAAY,YAAoB,EAAE,QAAgB,EAAE,MAAc;QACjE,KAAK,CAAC,gCAAgC,YAAY,aAAa,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;QAHpF,SAAI,GAAG,2BAA2B,CAAC;QAI3C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,OAAO,WAAW,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,wBAAwB,CAAC,OAAe;IAChD,MAAM,MAAM,GAAG,eAAe,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,OAAO,CAAC,GAAG,MAAM,aAAa,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,SAA4B;IAClF,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,eAAe,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC;IACpC,OAAO,IAAI,GAAG,CAA+B;QAC5C,CAAC,aAAa,EAAE,eAAe,CAAC;QAChC,CAAC,kBAAkB,EAAE,eAAe,CAAC;QACrC,CAAC,qBAAqB,EAAE,eAAe,CAAC;QACxC,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAEvC,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1B,CAAC,oBAAoB,EAAE,SAAS,CAAC;QAEjC,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAkC,EAAE,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACtH,CAAC,GAAG,MAAM,oBAAoB,EAAE,kBAAkB,CAAC;QACnD,CAAC,GAAG,MAAM,8BAA8B,EAAE,kBAAkB,CAAC;QAC7D,CAAC,GAAG,IAAI,YAAY,EAAE,kBAAkB,CAAC;QACzC,CAAC,GAAG,IAAI,qBAAqB,EAAE,kBAAkB,CAAC;QAClD,CAAC,GAAG,IAAI,WAAW,EAAE,kBAAkB,CAAC;QACxC,CAAC,GAAG,IAAI,QAAQ,EAAE,kBAAkB,CAAC;QACrC,CAAC,GAAG,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAEpC,CAAC,GAAG,MAAM,WAAW,EAAE,WAAW,CAAC;QACnC,CAAC,GAAG,MAAM,gBAAgB,EAAE,WAAW,CAAC;QACxC,CAAC,kBAAkB,EAAE,WAAW,CAAC;QACjC,CAAC,eAAe,EAAE,WAAW,CAAC;QAC9B,CAAC,uBAAuB,EAAE,WAAW,CAAC;QACtC,CAAC,kCAAkC,EAAE,WAAW,CAAC;QACjD,+EAA+E;QAC/E,CAAC,iCAAiC,EAAE,WAAW,CAAC;QAChD,2EAA2E;QAC3E,CAAC,yBAAyB,EAAE,WAAW,CAAC;KACxC,CAAC,CAAC;AACJ,CAAC;AAwBD,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;WAC9C,OAAQ,KAAkC,CAAC,UAAU,KAAK,UAAU,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,sFAAsF;QACtF,SAAS,GAAI,IAA4D,CAAC,UAAU,EAAE,SAAS,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,oGAAoG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,OAAoC;IAC7F,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,4FAA4F;IAC5F,SAAS,CAAC,UAAU,GAAG,CAAC,QAAgB,EAAuB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9G,GAAG,CAAC,2DAA2D,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,qEAAqE;AACrE,MAAM,oBAAoB;IAUzB,YAA6B,OAAoC;QAApC,YAAO,GAAP,OAAO,CAA6B;QARjE;;;;WAIG;QACc,YAAO,GAAG,IAAI,OAAO,EAA4C,CAAC;QAClE,uBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAGvD,IAAI,CAAC,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,MAA2B;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,aAAa,KAAK,eAAe,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QACf,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,QAAgB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,uBAAuB,QAAQ,iDAAiD;gBAC5F,+CAA+C,2BAA2B,oCAAoC;gBAC9G,oBAAoB,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,2BAA2B,CAAC;IACpC,CAAC;IAEO,IAAI,CAAC,QAAgB,EAAE,aAA6C,EAAE,OAAsB;QACnG,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,sFAAsF;YACtF,wFAAwF;YACxF,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,KAAK,EAAE,MAAc,EAAE,UAAsB,EAAiB,EAAE;gBACtE,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAChD,OAAO;gBACR,CAAC;gBACD,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnC,CAAC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAc,EAAE,UAAsB,EAAwB,EAAE;YACvE,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAChD,OAAO;YACR,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,WAAW,CAAC,YAAoB;QAC7C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAClC,wBAAwB,YAAY,EAAE,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAC7C,CAAC;YACF,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,CAAC;IACF,CAAC;IAED,0FAA0F;IAClF,eAAe,CAAC,YAAoB,EAAE,QAAgB;QAC7D,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,IAAI;gBACpE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,uCAAuC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;IACF,CAAC;CACD;AAED,kEAAkE;AAClE,SAAS,MAAM,CAAC,MAAc,EAAE,YAAoB,EAAE,QAAgB,EAAE,MAAc;IACrF,GAAG,CAAC,uBAAuB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC;QACJ,MAAM,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,iEAAiE;QACjE,GAAG,CAAC,sDAAsD,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;AACF,CAAC"}

package/dist/control-schema-version.d.ts

@@ -0,0 +1,97 @@
+/**
+ * control-schema-version.ts — the check `ControlDatabase.loadSchema` runs on a warm control
+ * store after declaring the control schema and before applying it.
+ *
+ * `apply schema CadreControl` runs whatever DDL makes the hydrated catalog equal the declared
+ * schema, and that apply is how a store written under an older control schema version is
+ * migrated in place: between consecutive versions the difference is limited to statements the
+ * optimystic module applies to a table's catalog record without rewriting a row, so running the
+ * diff from a store at version K to this build's declaration runs each version's changes from
+ * K+1 up to the build's, in order. This module decides, from the stored version and the pending
+ * DDL and before any of it runs, whether the apply may go ahead, and throws one typed error
+ * naming the reason when it may not.
+ *
+ * The same change classifier ({@link classifyControlSchemaChange}) is what
+ * `control-schema-versions.spec.ts` runs over each pair of consecutive control schema versions,
+ * so a schema edit that no store could be migrated across fails when it is made. Where the
+ * version lives, when it changes and what a new version may change: docs/architecture.md →
+ * "Control schema versions and migrations".
+ *
+ * The stored tag is the version of the last start that applied the schema to the store: the
+ * apply's `alter table OwnerKey set tags (…)` persists since Optimystic 1.16.0, so after a
+ * migrating start the store records this build's version. A store additively upgraded by a build
+ * from before that still reads the version it was created under, which is harmless: the diff is
+ * computed from the catalog, not from the number, and the number only has to tell a store that
+ * a newer release migrated from one this build can migrate.
+ */
+import { type Database } from '@quereus/quereus';
+/**
+ * Why a warm control store is refused, in the order the check decides them:
+ *  - `newer-release`: the store records a version above this build's, so a newer release has
+ *    migrated it (this machine before a downgrade, or another machine sharing its catalog
+ *    lineage); this machine is the one to update.
+ *  - `before-migrations`: the store records a version below {@link CONTROL_SCHEMA_BASELINE_VERSION}
+ *    (written by 1.16.0 or earlier); it cannot be migrated and must be recreated.
+ *  - `not-migratable`: a pending statement would rewrite or discard rows. Reachable only from a
+ *    development or hand-made store, since the edit-time check refuses such a version.
+ */
+export type ControlStoreIncompatibility = 'newer-release' | 'before-migrations' | 'not-migratable';
+/** A warm control store this build cannot apply its control schema to. */
+export declare class ControlStoreIncompatibleError extends Error {
+    readonly reason: ControlStoreIncompatibility;
+    readonly partyId: string;
+    /** The version the store records: the one its last migrating start declared; 0 = before versions were recorded. */
+    readonly storeVersion: number;
+    /** The version this build declares. */
+    readonly buildVersion: number;
+    /** The DDL the apply would have run, from `diff schema`; for diagnostics, not for parsing. */
+    readonly pendingDdl: readonly string[];
+    /** `controlStorageScope(partyId)`: the storage the embedder deletes to recreate (docs/architecture.md). */
+    readonly storageScope: string;
+    constructor(reason: ControlStoreIncompatibility, partyId: string, storeVersion: number, buildVersion: number, pendingDdl: readonly string[]);
+}
+/**
+ * Throw {@link ControlStoreIncompatibleError} when the declared control schema must not be applied
+ * to the hydrated store; return having run nothing otherwise, and the apply then migrates the
+ * store. Needs `declare schema CadreControl` to have run, and runs only `diff schema`, which
+ * executes no DDL.
+ *
+ * A cold store (the hydrated catalog lists no control table) passes without a diff: the apply
+ * creates everything. A warm store is refused for the first of these that holds
+ * ({@link ControlStoreIncompatibility}):
+ *  - its version is above the build's: even a diff that only adds (the newer release no longer
+ *    declares something this build does) would put back what that release removed, and the newer
+ *    release would then refuse its own store;
+ *  - its version is below the baseline, whatever the diff: a store written by 1.16.0 or earlier,
+ *    which the baseline paragraph of docs/architecture.md explains cannot be migrated;
+ *  - any pending statement is `unmigratable` ({@link classifyControlSchemaChange}).
+ *
+ * Every `additive` and `catalog-only` change passes, so a store from an older migratable
+ * release warm-starts and the apply brings it to this build's version. A store that is both
+ * older than the baseline and not migratable reports `before-migrations`, whose message gives the
+ * recreate advice and points at the explanation.
+ */
+export declare function refuseIncompatibleControlStore(db: Database, partyId: string): Promise<void>;
+/** The version the declared control schema carries on its version table; 0 when it carries none. */
+export declare function declaredSchemaVersion(db: Database): number;
+/**
+ * How applying one `diff schema` statement to a warm store treats its rows, from most to least
+ * migratable (docs/architecture.md → "Control schema versions and migrations"):
+ *  - `additive`: a new table, a new index, or a table tag change, which the optimystic module
+ *    applies without touching a row;
+ *  - `catalog-only`: a change the optimystic module applies to the table's catalog record without
+ *    rewriting a row (since Optimystic 1.16.0);
+ *  - `unmigratable`: everything else, which rewrites or discards rows.
+ */
+export type ControlSchemaChangeKind = 'additive' | 'catalog-only' | 'unmigratable';
+/** One row of `diff schema CadreControl`, classified. */
+export interface PendingControlSchemaChange {
+    readonly ddl: string;
+    /** The least migratable kind among the row's statements. */
+    readonly kind: ControlSchemaChangeKind;
+}
+/**
+ * The DDL `apply schema CadreControl` would run now, one entry per `diff schema` row, each
+ * classified against the catalog `db` holds. Needs `declare schema CadreControl` to have run.
+ */
+export declare function pendingControlSchemaChanges(db: Database): Promise<PendingControlSchemaChange[]>;