@adapt-toolkit/mufl 0.10.7 → 0.10.9

package/mufl_stdlib/cryptography/address_document.mm

@@ -201,6 +201,40 @@ library address_document loads libraries address_document_types, key_storage, ke
         RETURN ($version->1, $identity->my_identity, $authorizations->signatures).
     }
 
+    // The address document for the TRANSPORT identity-proof (node_description) —
+    // the self-attestation attached to EVERY outgoing external transaction. The
+    // identity is the full v2 record (the $e2e_bundle stays: receivers read the
+    // sender's e2e identity key off it for the inbound E2E decode hook), but
+    // $authorizations carries TWO self-signatures per SIGN key: one over
+    // _value_id(v2 identity) and one over _value_id(v1 bundle-less identity).
+    // A pre-e2e_bundle validator (SDK <= 0.9.x schema, e.g. the deployed
+    // ours-mcp 0.10.1) re-hashes the identity WITHOUT $e2e_bundle and finds the
+    // v1-hash signature in its any-match loop; a current validator finds the
+    // v2-hash signature. NOT memoised and used ONLY by node_description::create,
+    // so the main address document (invites, delegation certs, readvertise
+    // payloads — and every cert ad-hash binding) stays strict v2-sig-only.
+    produce_transport_address_document = fn (_) -> t_address_document
+    {
+        base_identity = key_storage::get_my_identity().
+        my_identity = ( $key_list     -> (base_identity $key_list),
+                        $default_keys -> (base_identity $default_keys),
+                        $container_id -> (base_identity $container_id),
+                        $e2e_bundle   -> e2e::my_public_bundle() ).
+        v1_identity = ( $key_list     -> (base_identity $key_list),
+                        $default_keys -> (base_identity $default_keys),
+                        $container_id -> (base_identity $container_id) ).
+        signatures IS crypto_signature(,) = (,).
+        hash_v2 = _value_id my_identity.
+        hash_v1 = _value_id v1_identity.
+
+        sc my_identity $key_list -- (key -> ) ?? key_get_function key == $SIGN {
+            signatures (key_storage::sign hash_v2 (_crypto_get_key_id key)) -> TRUE.
+            signatures (key_storage::sign hash_v1 (_crypto_get_key_id key)) -> TRUE.
+        }
+
+        RETURN ($version->m_current_version, $identity->my_identity, $authorizations->signatures).
+    }
+
     // The address document to hand a peer, down-levelled when the peer is a v1
     // (pre-E2E) node. peer_is_v1 NIL/FALSE => the current (v2) document (memoised as
     // usual); TRUE => a freshly built v1 document (not memoised). This is the single

package/mufl_stdlib/cryptography/attestation/node_description.mm

@@ -2,7 +2,9 @@ library node_description loads libraries address_document, container_associated_
     metadef t_node_description: identity_proof_document_types::t_node_description.
 
     create = fn (_) -> t_node_description {
-        ad = address_document::get_my_address_document().
+        // Transport self-attestation: dual-signed (v2-hash + v1-hash) so both
+        // current and pre-e2e_bundle-schema peers can verify the self-signature.
+        ad = address_document::produce_transport_address_document().
         associated_data = container_associated_data::create().
         return ($address_document -> ad, $container_associated_data -> associated_data).
     }

package/mufl_stdlib/cryptography/e2e.mm

@@ -394,6 +394,25 @@ loads libraries key_storage, address_document_types
         return session_id (s as bin).
     }
 
+    // Decrypt an olm_type=0 (pre-key) message ON the EXISTING session it matches — the
+    // born-DR pre-key phase, where the sender keeps prefixing the pre-key until the peer
+    // replies, so genuine 2nd+ messages are pre-keys on the live session. Decrypts on the
+    // given session (advancing its ratchet); a TRUE replay (already-consumed index)
+    // provisional-aborts in the crate -> $ok FALSE. DISTINCT from `decrypt` olm_type=0,
+    // which ESTABLISHES a fresh inbound session (first contact / self-heal) — this one
+    // never re-establishes, so it cannot double-deliver or reset the ratchet.
+    fn decrypt_prekey_on_existing (session: bin, ciphertext: bin) -> e2e_result
+    {
+        WHEN provisional abort err
+        {
+            r = _e2e_decrypt session 0 ciphertext (pickle_key()).
+            return ( $ok -> TRUE, $plaintext -> r $plaintext, $session -> r $session,
+                     $account -> NIL, $error -> NIL ).
+        }
+        return ( $ok -> FALSE, $plaintext -> NIL, $session -> NIL, $account -> NIL,
+                 $error -> (map_error err) ).
+    }
+
     // RECEIVE: decrypt an inbound envelope for a known sender and COMMIT the advanced session
     // (and, on the establish path only, the rotated account). Returns the typed e2e_result.
     // The caller (the __t_wrapper decode hook) authenticates $emsignature FIRST and supplies
@@ -409,9 +428,20 @@ loads libraries key_storage, address_document_types
             // list), so a replayed olm_type=0 pre-key would re-establish successfully — re-running
             // the inner tx AND overwriting the (possibly advanced) session. session_matches is a
             // pure read; a genuine NEW handshake (different ephemeral) does not match.
-            //  (a) matches the LIVE session — idempotent re-delivery, drop recoverably.
+            //  (a) matches the LIVE session. This is the born-DR pre-key phase: until the
+            //      peer REPLIES, the sender keeps prefixing the pre-key preamble, so the
+            //      2nd, 3rd, ... GENUINE message is an olm_type=0 pre-key on the SAME live
+            //      session (session_matches TRUE). DECRYPT it on the existing session
+            //      (advancing the ratchet) instead of dropping it as a replay. A TRUE replay
+            //      (an already-consumed message index) fails the crate decrypt — vodozemac
+            //      tracks the index — surfacing $ok=FALSE, which we drop recoverably as
+            //      "replayed", so genuine replays still cannot double-deliver.
             if existing != NIL && (session_matches (existing as bin) ciphertext)
-            { return replayed(). }
+            {
+                rd = decrypt_prekey_on_existing (existing as bin) ciphertext.
+                if rd $ok { m_sessions from_cid -> (rd $session) as bin.  return rd. }
+                return replayed().
+            }
             //  (b) matches the STAGED session — a redelivered migration COMMIT after we already
             //      staged it (the lost-confirm case, spec §5.5). The wrapper turns this typed
             //      error into a re-confirm via core mig_handle_replayed_commit; NO inner

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adapt-toolkit/mufl",
-  "version": "0.10.7",
+  "version": "0.10.9",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "description": "The MUFL toolchain: prebuilt `mufl` (REPL) and `mufl-compile` (compiler) engine binaries plus the MUFL stdlib, meta, and transactions trees they need at run time. Linux x64 only; the binaries are proprietary (AEFL) — see LICENSE and NOTICE.",