@adapt-toolkit/mufl 0.10.10 → 0.10.12

package/mufl_stdlib/cryptography/e2e.mm

@@ -247,6 +247,83 @@ loads libraries key_storage, address_document_types
             if m_account == NIL { m_account -> create_account(). }
             return m_account as bin.
         }
+    }
+
+    // =====================================================================================
+    // LOCAL SESSION PERSISTENCE (core 0.11, Signal-model restart survival). The Olm account +
+    // per-peer session pickles are opaque, pickle_key-SEALED `bin` (the pickle_key is re-derived
+    // deterministically from this identity's stable SIGN secret on every boot — see pickle_key).
+    // These two calls let the host round-trip that sealed state through a LOCAL-ONLY sidecar so a
+    // daemon restart RESUMES the exact ratchet instead of re-minting a fresh account (the cause of
+    // the post-restart desync). INV-4 is preserved: this material is written to a local sidecar
+    // (never the portable export blob, never a peer/broker), exactly like the identity.key secret.
+    // The blob is opaque sealed bytes — no raw secretkey type crosses the serializer.
+    //
+    // import_sessions MUST run on boot BEFORE the first account()/encrypt_to (which would lazily
+    // create a fresh account); with a live m_account present, account() returns it and no
+    // regeneration happens.
+    // Persist ONLY the Olm account + LIVE per-peer sessions. m_staged is DELIBERATELY excluded
+    // (Dev-1 reconcile): it is transient in-flight migration state held for at most the commit
+    // window; a restart mid-migration drops it and the existing migration sweep supersedes the
+    // stalled rotation with a fresh offer — cleaner than restoring a staged session the peer may
+    // already have discarded. The live session (m_sessions) is what carries steady-state traffic
+    // and MUST survive; that is what this persists.
+    fn export_sessions (_) -> ( $v -> int, $account -> bin+, $sessions -> (global_id ->> bin) )
+    {
+        return ( $v -> 1, $account -> m_account, $sessions -> m_sessions ).
+    }
+
+    // Restore a previously exported bundle into the hidden session state. Version-guarded so a
+    // future layout bump degrades to "no restore" (a fresh account is then lazily minted, and the
+    // self-heal fallback re-establishes) rather than mis-parsing. m_staged is left empty (a
+    // pending migration re-drives via the sweep).
+    //
+    // VALIDATED, FAIL-BY-ABORT (finding C, CodexFullReview redo): every pickle (account AND
+    // each session) is proved to unseal under pickle_key BEFORE anything is assigned — a blob
+    // whose STRUCTURE survived the outer safe-cast can still carry garbled sealed bytes, and
+    // assigning those un-validated turns later uses (my_bundle / encrypt_to / decode) into
+    // hard aborts (the reproduced cyclic BAD_PICKLE). A corrupt pickle makes the probe below
+    // raise the engine's HARD error (BAD_PICKLE is a CEvalError, NOT a provisional — it cannot
+    // be caught in MUFL), which FAILS THE WHOLE TRANSACTION: the caller MUST run this in a
+    // DEDICATED transaction (a2a commit_e2e_restore) so the failure rolls back atomically
+    // (nothing assigned) and the HOST observes it as that transaction's typed failure —
+    // cleanly distinguished from wire-decode errors because nothing else runs in that txn.
+    // Probe results are BOUND and guarded (abort WHEN) so they cannot be elided as dead code
+    // — the unguarded bare-statement probes of the first attempt validated nothing.
+    // An account-NIL blob with sessions present is structurally impossible for a genuine
+    // export (sessions exist only under an account) and aborts too.
+    // Returns the restored session count; never returns on a corrupt blob (the txn dies).
+    fn import_sessions (blob: ( $v -> int, $account -> bin+, $sessions -> (global_id ->> bin)+ )) -> int
+    {
+        if (blob $v) != 1 { return 0. }
+        acct = blob $account.
+        sess is (global_id ->> bin)+ = blob $sessions.
+        nsess is int = 0.
+        if sess != NIL { sc (sess?) -- ( -> ) { nsess -> nsess + 1. } }
+        abort "e2e::import_sessions: account NIL with sessions present (corrupt export)" WHEN acct == NIL && nsess > 0.
+        if acct != NIL
+        {
+            // Unpickles the sealed account under pickle_key — hard BAD_PICKLE on garbled
+            // bytes. The raw bundle is >= 101 bytes by layout (see my_bundle); binding +
+            // guarding the result keeps the probe live.
+            aprobe = _e2e_account_bundle (acct as bin) (pickle_key()).
+            abort "e2e::import_sessions: account pickle failed validation (short bundle)" WHEN (_binlen aprobe) < 101.
+        }
+        if sess != NIL
+        {
+            sc (sess?) -- ( -> s)
+            {
+                sprobe = _e2e_session_id s (pickle_key()).
+                abort "e2e::import_sessions: session pickle failed validation (bad session id)" WHEN (_binlen sprobe) != 32.
+            }
+        }
+        if acct != NIL { m_account -> acct as bin. }
+        if sess != NIL { m_sessions -> sess?. }
+        return nsess.
+    }
+
+    hidden
+    {
 
         // The idempotent pre-key re-delivery result (a live- or staged-session replay). No
         // plaintext, no state change — the session lives; the wrapper drops it (or, for a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adapt-toolkit/mufl",
-  "version": "0.10.10",
+  "version": "0.10.12",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "description": "The MUFL toolchain: prebuilt `mufl` (REPL) and `mufl-compile` (compiler) engine binaries plus the MUFL stdlib, meta, and transactions trees they need at run time. Linux x64 only; the binaries are proprietary (AEFL) — see LICENSE and NOTICE.",