@cello-protocol/crypto 0.0.2

package/dist/frost/frost-threshold-signer.js

@@ -0,0 +1,478 @@
+/**
+ * FrostThresholdSigner — FROST threshold signing over Ed25519 (RFC 9591)
+ *
+ * CELLO-CRYPTO-003
+ *
+ * Crypto reference: FROST / RFC 9591, Ed25519 / RFC 8032
+ * Implementation: @noble/curves/ed25519 — ed25519_FROST
+ *
+ * ─── Phase P: Pseudocode ─────────────────────────────────────────────────────
+ *
+ * bootstrapKeyShares(agentPubkey, config):
+ *   // TEST-ONLY shortcut — NOT real multi-round DKG (that's M3)
+ *   // Guard: only callable in NODE_ENV=test
+ *   assert NODE_ENV === 'test'
+ *   identifiers = [derive(stub.id) for stub in stubs]
+ *   dealerShares = trustedDealer({ min: threshold, max: participants }, identifiers)
+ *   // Distribute each stub its share (persists in stub.#key)
+ *   for each stub, share in dealerShares.secretShares:
+ *     stub.receiveShare(share, dealerShares.public)
+ *   // primary_pubkey = commitments[0] from the shared public package
+ *   primary_pubkey = dealerShares.public.commitments[0]
+ *   // Persist client's local key share (stored in module-level map keyed by agentPubkey)
+ *   storeLocalShare(agentPubkey, { share: agentShare, pub: dealerShares.public })
+ *   return { primaryPubkey: primary_pubkey }
+ *   // NOTE: signing share NEVER returned or logged
+ *
+ * FrostThresholdSigner.participateInCeremony(ceremonyId, tbs, context):
+ *   // Coordinator flow — RFC 9591 Section 5
+ *   frame(tbs, context) → msg = encode(context + '\0' + tbs)  // domain separation
+ *   localShare = loadLocalShare(agentPubkey)
+ *   if localShare is null: throw "not bootstrapped"
+ *   availableStubs = stubs (or directoryNodes via stream in production)
+ *
+ *   // Attempt loop — up to maxRetries
+ *   for attempt in 1..maxRetries (honoring ceremonyTimeout):
+ *     reachableStubs = stubs where not excluded
+ *     if |reachableStubs| < threshold: return DIRECTORY_BELOW_THRESHOLD
+ *     selectedStubs = reachableStubs[0..threshold-1]
+ *
+ *     // Round 1 — collect commitments (coordinator generates local nonce too)
+ *     localNonce = commit(localShare.secret)
+ *     commitments = [localNonce.commitments]
+ *     for each stub in selectedStubs:
+ *       c = stub.generateCommitment()
+ *       commitments.push(c.commitment)
+ *     commitmentList = sort(commitments, by identifier)
+ *
+ *     // Round 2 — collect partial signatures (with per-node timeout)
+ *     validShares = {}
+ *     excludedInThisRound = []
+ *     for each (stub, stubCommitment) in selectedStubs (with roundTimeout):
+ *       partialSig = await stub.signRound(pub, commitmentList, msg)  // timeout → null
+ *       if partialSig is null: excludedInThisRound.push(stub); continue
+ *       if !verifyShare(pub, commitmentList, msg, stub.id, partialSig):
+ *         excludedInThisRound.push(stub); continue  // invalid partial — same as timeout
+ *       validShares[stub.id] = partialSig
+ *
+ *     // Also compute coordinator's own partial sig
+ *     coordinatorPartialSig = signShare(localShare.secret, pub, localNonce.nonces, commitmentList, msg)
+ *     validShares[coordinatorId] = coordinatorPartialSig
+ *
+ *     if |validShares| >= threshold:
+ *       signature = aggregate(pub, commitmentList, msg, validShares)
+ *       return { ok: true, signature }
+ *     else:
+ *       // Not enough valid shares — retry with different participants
+ *       continue
+ *
+ *   return { ok: false, error: { reason: 'CEREMONY_EXHAUSTED' } }
+ *
+ * primary_pubkey derivation:
+ *   // In trustedDealer mode: commitments[0] is the group public key
+ *   // This is the constant term of the dealer's Shamir polynomial commitment
+ *   // It is deterministic given the dealer's secret polynomial
+ *   // All participants' public shares verify against the same commitments[0]
+ *   primary_pubkey = dealerShares.public.commitments[0]
+ *
+ * Round timeout / node replacement:
+ *   // Each stub.signRound wraps in Promise.race([real, timeoutPromise])
+ *   // If timeout wins → stub treated as excluded (same path as invalid sig)
+ *   // On retry, excluded stubs are filtered from available pool
+ *   // If available < threshold → DIRECTORY_BELOW_THRESHOLD (not retried)
+ *
+ * ─── End Pseudocode ──────────────────────────────────────────────────────────
+ */
+import { ed25519_FROST } from "@noble/curves/ed25519.js";
+import { CONTEXT_SESSION_ESTABLISHMENT, CONTEXT_SEAL } from "./types.js";
+// Module-level store for local key shares, keyed by agent pubkey hex.
+// This keeps the signing share within the package boundary.
+// Private (#) module-level map — not exported.
+const _localShares = new Map();
+/**
+ * Clear all local key shares stored in the module-level map.
+ *
+ * TEST-ONLY: guards against accumulation of key material across test cases.
+ * Call in afterEach/afterAll to evict shares seeded by bootstrapKeyShares.
+ *
+ * Throws if called outside NODE_ENV=test so it can never be misused in
+ * production (where it would collapse multi-party FROST to zero-share state).
+ */
+export function clearTestShares() {
+    if (process.env.NODE_ENV !== "test") {
+        throw new Error("clearTestShares is test-only and must not be called in production");
+    }
+    _localShares.clear();
+}
+/**
+ * Store the client's local DKG key share after a real DKG ceremony completes.
+ *
+ * Production path: called after runNetworkDkg completes successfully.
+ * No NODE_ENV guard — this is the production key storage path (unlike bootstrapKeyShares).
+ *
+ * SECURITY: validates the secret against the public before storing.
+ * The FrostSecret is stored in the module-level map keyed by agentPubkeyHex.
+ */
+export function storeDkgResult(agentPubkeyHex, secret, pub) {
+    ed25519_FROST.validateSecret(secret, pub);
+    _localShares.set(agentPubkeyHex, { secret, pub });
+}
+// ─── Message framing for domain separation ────────────────────────────────────
+/**
+ * Frame a TBS with a context string for domain separation.
+ *
+ * Encoding: `<context>\0<tbs>`
+ * The null byte separator ensures unambiguous parsing: a context string
+ * cannot contain \0, so there is no collision between different contexts
+ * even when TBS bytes have the same content.
+ */
+function frameMessage(context, tbs) {
+    const enc = new TextEncoder();
+    const ctxBytes = enc.encode(context);
+    // context + 0x00 separator + tbs
+    const framed = new Uint8Array(ctxBytes.length + 1 + tbs.length);
+    framed.set(ctxBytes, 0);
+    framed[ctxBytes.length] = 0x00; // null separator
+    framed.set(tbs, ctxBytes.length + 1);
+    return framed;
+}
+// ─── Agent pubkey serialization ───────────────────────────────────────────────
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+// ─── bootstrapKeyShares ───────────────────────────────────────────────────────
+/**
+ * Test-harness shortcut for key share bootstrap.
+ *
+ * GUARD: Only callable in NODE_ENV=test. This is NOT a real multi-round DKG
+ * (that comes in M3). It uses trustedDealer to pre-populate shares for testing.
+ *
+ * Behavior:
+ * 1. Generate FROST shares via trustedDealer for all n stub nodes
+ * 2. Distribute each stub its signing share
+ * 3. One of the identifiers is the "client" (coordinator) — its share is stored locally
+ * 4. primary_pubkey = commitments[0] from the shared public package
+ * 5. Return { primaryPubkey } — no key material beyond the group public key
+ */
+export async function bootstrapKeyShares(agentPubkey, config) {
+    if (process.env.NODE_ENV !== "test") {
+        throw new Error("bootstrapKeyShares is a test-only shortcut. " +
+            "Real DKG (M3) is required in production.");
+    }
+    const stubs = config.directoryNodeStubs;
+    if (!stubs || stubs.length === 0) {
+        throw new Error("bootstrapKeyShares requires directoryNodeStubs in test mode");
+    }
+    const { threshold, participants } = config;
+    // Identifiers: one per stub node + one for the client (coordinator)
+    // The client acts as participant "client:<agentPubkeyHex>"
+    const clientIdStr = `client:${toHex(agentPubkey)}`;
+    const clientIdentifier = ed25519_FROST.Identifier.derive(clientIdStr);
+    const stubIdentifiers = stubs.map((stub) => ed25519_FROST.Identifier.derive(stub.id));
+    const allIdentifiers = [clientIdentifier, ...stubIdentifiers];
+    // trustedDealer: produces one FrostPublic + per-participant FrostSecret shares
+    // The dealer polynomial's constant term commitment is the group public key.
+    const deal = ed25519_FROST.trustedDealer({ min: threshold, max: participants + 1 }, // +1 for the client
+    allIdentifiers);
+    // Distribute shares to stubs
+    for (const stub of stubs) {
+        const stubId = ed25519_FROST.Identifier.derive(stub.id);
+        const stubShare = deal.secretShares[stubId];
+        if (!stubShare) {
+            throw new Error(`No share generated for stub ${stub.id}`);
+        }
+        await stub.receiveShare(stubShare, deal.public);
+    }
+    // Store client's local share
+    const clientShare = deal.secretShares[clientIdentifier];
+    if (!clientShare) {
+        throw new Error("No share generated for client");
+    }
+    _localShares.set(toHex(agentPubkey), {
+        secret: clientShare,
+        pub: deal.public,
+    });
+    // primary_pubkey = commitments[0] = the group public key (32-byte Ed25519 point)
+    const primaryPubkey = deal.public.commitments[0];
+    // Return ONLY primaryPubkey — no key material
+    return { primaryPubkey: new Uint8Array(primaryPubkey) };
+}
+// ─── FrostThresholdSigner ─────────────────────────────────────────────────────
+export class FrostThresholdSigner {
+    #config;
+    #agentPubkey;
+    static #DEFAULT_ROUND_TIMEOUT_MS = 3000;
+    static #DEFAULT_CEREMONY_TIMEOUT_MS = 30000;
+    static #DEFAULT_MAX_RETRIES = 3;
+    constructor(config, agentPubkey) {
+        this.#config = {
+            threshold: config.threshold,
+            participants: config.participants,
+            directoryNodes: config.directoryNodes,
+            directoryNodeStubs: config.directoryNodeStubs,
+            roundTimeoutMs: config.roundTimeoutMs ?? FrostThresholdSigner.#DEFAULT_ROUND_TIMEOUT_MS,
+            ceremonyTimeoutMs: config.ceremonyTimeoutMs ??
+                FrostThresholdSigner.#DEFAULT_CEREMONY_TIMEOUT_MS,
+            maxRetries: config.maxRetries ?? FrostThresholdSigner.#DEFAULT_MAX_RETRIES,
+        };
+        this.#agentPubkey = agentPubkey;
+    }
+    /**
+     * Get the group public key (primary_pubkey) for this signer.
+     * Returns the key from the stored local share (populated by bootstrapKeyShares).
+     */
+    getPrimaryPubkey() {
+        const localShare = _localShares.get(toHex(this.#agentPubkey));
+        if (!localShare) {
+            throw new Error("Not bootstrapped: call bootstrapKeyShares before using FrostThresholdSigner");
+        }
+        return new Uint8Array(localShare.pub.commitments[0]);
+    }
+    /**
+     * Verify a threshold signature against a public key and TBS with context.
+     * Used by callers (and tests) to verify signatures produced by participateInCeremony.
+     */
+    verifySignature(signature, tbs, context, publicKey) {
+        try {
+            const msg = frameMessage(context, tbs);
+            return ed25519_FROST.verify(signature, msg, publicKey);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Participate in a FROST threshold signing ceremony as coordinator.
+     *
+     * RFC 9591 Section 5 coordinator flow with in-process stubs.
+     * Full round coordination, timeout handling, and participant exclusion.
+     */
+    async participateInCeremony(ceremonyId, tbs, context, onProgress) {
+        const localShare = _localShares.get(toHex(this.#agentPubkey));
+        if (!localShare) {
+            throw new Error("Not bootstrapped: call bootstrapKeyShares before using FrostThresholdSigner");
+        }
+        const stubs = this.#config.directoryNodeStubs ?? [];
+        const { threshold, roundTimeoutMs, ceremonyTimeoutMs, maxRetries } = this.#config;
+        // Frame message for domain separation: context\0tbs
+        const msg = frameMessage(context, tbs);
+        const { pub } = localShare;
+        const clientId = ed25519_FROST.Identifier.derive(`client:${toHex(this.#agentPubkey)}`);
+        // Ceremony-level timeout: a deadline across all retry attempts
+        const ceremonyDeadline = Date.now() + ceremonyTimeoutMs;
+        // Pre-ceremony availability check (RFC 9591 §5 coordinator pre-check):
+        // Count nodes reachable at initiation. If fewer than (threshold - 1) are
+        // reachable, fail immediately — the ceremony cannot possibly succeed.
+        // (threshold - 1 because the client itself is one of the threshold signers)
+        const reachableAtInitiation = stubs.filter((s) => s.isReachable());
+        if (reachableAtInitiation.length < threshold - 1) {
+            return {
+                ok: false,
+                error: { reason: "DIRECTORY_BELOW_THRESHOLD" },
+            };
+        }
+        // Within-ceremony exclusion: stubs excluded during THIS ceremony.
+        // A stub is excluded (within this ceremony) when it: (a) times out or
+        // (b) returns an invalid partial signature (treated identically per story spec).
+        // On each new participateInCeremony call, the exclusion set resets.
+        const ceremonyExcluded = new Set();
+        for (let attempt = 0; attempt < maxRetries; attempt++) {
+            // Check ceremony-level timeout at the start of each attempt
+            if (Date.now() >= ceremonyDeadline) {
+                return {
+                    ok: false,
+                    error: { reason: "CEREMONY_TIMEOUT" },
+                };
+            }
+            // Available stubs: reachable at initiation and not excluded in this ceremony
+            const available = reachableAtInitiation.filter((s) => !ceremonyExcluded.has(s.id));
+            // Select (threshold - 1) stubs for this round (client counts as one signer)
+            const selected = available.slice(0, threshold - 1);
+            if (selected.length < threshold - 1) {
+                // Not enough non-excluded nodes remain for this attempt (fewer than
+                // threshold - 1 stubs available after excluding failed nodes). Since the
+                // client counts as one of the threshold signers, fewer than (threshold - 1)
+                // stub participants means the ceremony cannot possibly succeed regardless of
+                // further retries. Return DIRECTORY_BELOW_THRESHOLD immediately — same as
+                // the pre-ceremony check — rather than sleeping and timing out with
+                // CEREMONY_TIMEOUT (which would diverge from the spec).
+                return {
+                    ok: false,
+                    error: { reason: "DIRECTORY_BELOW_THRESHOLD" },
+                };
+            }
+            // Round 1: generate fresh nonces + commitment list
+            const localNonce = ed25519_FROST.commit(localShare.secret);
+            const stubCommits = await Promise.all(selected.map((s) => s.generateCommitment()));
+            const commitmentList = [
+                localNonce.commitments,
+                ...stubCommits.map((c) => c.nonceCommitment),
+            ];
+            // total = selected stubs + 1 client
+            const totalParticipants = selected.length + 1;
+            for (let ci = 0; ci < totalParticipants; ci++) {
+                onProgress?.({ type: "commit_collected", index: ci + 1, total: totalParticipants });
+            }
+            // Round 2: collect partial signatures with per-node timeout
+            const sigShares = {};
+            let anyFailedThisRound = false;
+            let partialSigCount = 0;
+            for (let i = 0; i < selected.length; i++) {
+                const stub = selected[i];
+                // Check ceremony timeout before each node
+                if (Date.now() >= ceremonyDeadline) {
+                    return {
+                        ok: false,
+                        error: { reason: "CEREMONY_TIMEOUT" },
+                    };
+                }
+                // Race stub response against per-node timeout
+                const timeoutPromise = new Promise((resolve) => setTimeout(() => resolve(null), roundTimeoutMs));
+                let partialSig;
+                try {
+                    partialSig = await Promise.race([
+                        stub.signRound({ pub, commitmentList, msg, ceremonyId }),
+                        timeoutPromise,
+                    ]);
+                }
+                catch {
+                    partialSig = null;
+                }
+                if (partialSig === null) {
+                    // Timeout — exclude this stub for the rest of this ceremony;
+                    // pick replacement (different stub) in the next attempt
+                    ceremonyExcluded.add(stub.id);
+                    anyFailedThisRound = true;
+                    continue;
+                }
+                // Verify partial sig — invalid treated identically to timeout (story spec §AC-006)
+                // The invalid partial is NEVER passed to the combiner/aggregator.
+                let isValid;
+                try {
+                    const stubId = ed25519_FROST.Identifier.derive(stub.id);
+                    isValid = ed25519_FROST.verifyShare(pub, commitmentList, msg, stubId, partialSig);
+                }
+                catch {
+                    isValid = false;
+                }
+                if (!isValid) {
+                    // Invalid partial sig — exclude for rest of this ceremony (same path as timeout)
+                    ceremonyExcluded.add(stub.id);
+                    anyFailedThisRound = true;
+                    continue;
+                }
+                const stubId = ed25519_FROST.Identifier.derive(stub.id);
+                // String(stubId) makes the bigint→string coercion explicit: @noble/curves
+                // Identifier is a bigint, and Record<string,…> keys are strings. Using
+                // String() here documents the conversion rather than relying on implicit
+                // JS coercion, and must match how aggregate() looks up shares.
+                sigShares[String(stubId)] = partialSig;
+                partialSigCount++;
+                onProgress?.({ type: "partial_sig_collected", index: partialSigCount, total: totalParticipants });
+            }
+            // If any stub failed, this round's commitment list is inconsistent —
+            // the failed stubs committed but did not sign valid shares.
+            // Restart with a fresh participant set on the next attempt.
+            if (anyFailedThisRound) {
+                continue;
+            }
+            // All selected stubs provided valid partial sigs. Compute client's partial sig.
+            let clientSig;
+            try {
+                clientSig = ed25519_FROST.signShare(localShare.secret, pub, localNonce.nonces, commitmentList, msg);
+                sigShares[String(clientId)] = clientSig;
+                partialSigCount++;
+                onProgress?.({ type: "partial_sig_collected", index: partialSigCount, total: totalParticipants });
+            }
+            catch {
+                continue;
+            }
+            if (Object.keys(sigShares).length < threshold) {
+                continue;
+            }
+            // Aggregate
+            let signature;
+            try {
+                signature = ed25519_FROST.aggregate(pub, commitmentList, msg, sigShares);
+            }
+            catch {
+                continue;
+            }
+            return { ok: true, signature };
+        }
+        // Check if we timed out or exhausted retries
+        if (Date.now() >= ceremonyDeadline) {
+            return {
+                ok: false,
+                error: { reason: "CEREMONY_TIMEOUT" },
+            };
+        }
+        return {
+            ok: false,
+            error: { reason: "CEREMONY_EXHAUSTED" },
+        };
+    }
+}
+// ─── Standalone FROST signature verification ─────────────────────────────────
+/**
+ * Verify a FROST threshold signature without a signer instance.
+ *
+ * Used by the client when it is the counterparty (participant B) and has no
+ * IThresholdSigner injected. Verifies the domain-separated FROST signature
+ * against the provided public key.
+ *
+ * @param signature - 64-byte threshold signature from the SessionAssignment
+ * @param tbs - to-be-signed bytes (from buildSessionEstablishmentTbs)
+ * @param context - domain context string (e.g. CONTEXT_SESSION_ESTABLISHMENT)
+ * @param publicKey - 32-byte Ed25519 group public key to verify against
+ * @returns true if signature verifies; false otherwise (never throws)
+ */
+export function verifyFrostSignature(signature, tbs, context, publicKey) {
+    try {
+        const msg = frameMessage(context, tbs);
+        return ed25519_FROST.verify(signature, msg, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+// ─── MockThresholdSigner ──────────────────────────────────────────────────────
+/**
+ * MockThresholdSigner: confirms the IThresholdSigner swap point is real.
+ *
+ * Implements IThresholdSigner without any FROST crypto. Used by AC-010 to
+ * verify that callers work correctly against the interface without knowing
+ * the concrete implementation.
+ *
+ * Returns a deterministic 64-byte signature (not cryptographically valid,
+ * but structurally correct for interface tests).
+ */
+export class MockThresholdSigner {
+    async participateInCeremony(_ceremonyId, tbs, _context, _onProgress) {
+        // Return a 64-byte mock signature derived from the TBS
+        // Not cryptographically valid — only for interface shape testing
+        const sig = new Uint8Array(64);
+        for (let i = 0; i < Math.min(tbs.length, 32); i++) {
+            sig[i] = tbs[i];
+        }
+        sig[63] = 0x42; // marker
+        return { ok: true, signature: sig };
+    }
+    /**
+     * Return a deterministic 32-byte mock primary pubkey.
+     * Not a real Ed25519 point — only for interface shape testing.
+     */
+    getPrimaryPubkey() {
+        const key = new Uint8Array(32);
+        key[0] = 0x02; // marker byte indicating mock
+        key[31] = 0x4d; // 'M' for Mock
+        return key;
+    }
+    verifySignature(_signature, _tbs, _context, _publicKey) {
+        // Mock: always returns false (not a real verifier)
+        return false;
+    }
+}
+// Re-export context constants for convenience
+export { CONTEXT_SESSION_ESTABLISHMENT, CONTEXT_SEAL };
+//# sourceMappingURL=frost-threshold-signer.js.map

package/dist/frost/frost-threshold-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frost-threshold-signer.js","sourceRoot":"","sources":["../../src/frost/frost-threshold-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAazD,OAAO,EAAE,6BAA6B,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAWzE,sEAAsE;AACtE,4DAA4D;AAC5D,+CAA+C;AAC/C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,cAAsB,EACtB,MAAmB,EACnB,GAAgB;IAEhB,aAAa,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,GAAe;IACpD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,iCAAiC;IACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,iBAAiB;IACjD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAuB,EACvB,MAAkC;IAElC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,8CAA8C;YAC5C,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAE3C,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,WAAW,GAAG,UAAU,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CACzC,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,GAAG,eAAe,CAAC,CAAC;IAE9D,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,CACtC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,CAAC,EAAE,EAAE,oBAAoB;IAC/D,cAAc,CACf,CAAC;IAEF,6BAA6B;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACnC,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,IAAI,CAAC,MAAM;KACjB,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEjD,8CAA8C;IAC9C,OAAO,EAAE,aAAa,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,iFAAiF;AAEjF,MAAM,OAAO,oBAAoB;IACtB,OAAO,CAKd;IACO,YAAY,CAAa;IAElC,MAAM,CAAU,yBAAyB,GAAG,IAAI,CAAC;IACjD,MAAM,CAAU,4BAA4B,GAAG,KAAK,CAAC;IACrD,MAAM,CAAU,oBAAoB,GAAG,CAAC,CAAC;IAEzC,YAAY,MAAkC,EAAE,WAAuB;QACrE,IAAI,CAAC,OAAO,GAAG;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,cAAc,EACZ,MAAM,CAAC,cAAc,IAAI,oBAAoB,CAAC,yBAAyB;YACzE,iBAAiB,EACf,MAAM,CAAC,iBAAiB;gBACxB,oBAAoB,CAAC,4BAA4B;YACnD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,oBAAoB,CAAC,oBAAoB;SAC3E,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACd,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,eAAe,CACb,SAAqB,EACrB,GAAe,EACf,OAAe,EACf,SAAqB;QAErB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CACzB,UAAkB,EAClB,GAAe,EACf,OAAqB,EACrB,UAA0D;QAE1D,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACpD,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAChE,IAAI,CAAC,OAAO,CAAC;QAEf,oDAAoD;QACpD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAEvC,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,CAC9C,UAAU,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CACrC,CAAC;QAEF,+DAA+D;QAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;QAExD,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnE,IAAI,qBAAqB,CAAC,MAAM,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAC/C,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,sEAAsE;QACtE,iFAAiF;QACjF,oEAAoE;QACpE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE3C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACtD,4DAA4D;YAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,gBAAgB,EAAE,CAAC;gBACnC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACtC,CAAC;YACJ,CAAC;YAED,6EAA6E;YAC7E,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACnC,CAAC;YAEF,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;YAEnD,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBACpC,oEAAoE;gBACpE,yEAAyE;gBACzE,4EAA4E;gBAC5E,6EAA6E;gBAC7E,0EAA0E;gBAC1E,oEAAoE;gBACpE,wDAAwD;gBACxD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;iBAC/C,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;YACnF,MAAM,cAAc,GAAG;gBACrB,UAAU,CAAC,WAAW;gBACtB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;aAC7C,CAAC;YACF,oCAAoC;YACpC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9C,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,iBAAiB,EAAE,EAAE,EAAE,EAAE,CAAC;gBAC9C,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACtF,CAAC;YAED,4DAA4D;YAC5D,MAAM,SAAS,GAA+B,EAAE,CAAC;YACjD,IAAI,kBAAkB,GAAG,KAAK,CAAC;YAC/B,IAAI,eAAe,GAAG,CAAC,CAAC;YAExB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAEzB,0CAA0C;gBAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,gBAAgB,EAAE,CAAC;oBACnC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACtC,CAAC;gBACJ,CAAC;gBAED,8CAA8C;gBAC9C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAChD,CAAC;gBAEF,IAAI,UAA6B,CAAC;gBAClC,IAAI,CAAC;oBACH,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;wBAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;wBACxD,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;gBAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACxB,6DAA6D;oBAC7D,wDAAwD;oBACxD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC9B,kBAAkB,GAAG,IAAI,CAAC;oBAC1B,SAAS;gBACX,CAAC;gBAED,mFAAmF;gBACnF,kEAAkE;gBAClE,IAAI,OAAgB,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACxD,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gBACpF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,GAAG,KAAK,CAAC;gBAClB,CAAC;gBAED,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,iFAAiF;oBACjF,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC9B,kBAAkB,GAAG,IAAI,CAAC;oBAC1B,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxD,0EAA0E;gBAC1E,uEAAuE;gBACvE,yEAAyE;gBACzE,+DAA+D;gBAC/D,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC;gBACvC,eAAe,EAAE,CAAC;gBAClB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACpG,CAAC;YAED,qEAAqE;YACrE,4DAA4D;YAC5D,4DAA4D;YAC5D,IAAI,kBAAkB,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,gFAAgF;YAChF,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,SAAS,GAAG,aAAa,CAAC,SAAS,CACjC,UAAU,CAAC,MAAM,EACjB,GAAG,EACH,UAAU,CAAC,MAAM,EACjB,cAAc,EACd,GAAG,CACJ,CAAC;gBACF,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,CAAC;gBACxC,eAAe,EAAE,CAAC;gBAClB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACpG,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC9C,SAAS;YACX,CAAC;YAED,YAAY;YACZ,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QAED,6CAA6C;QAC7C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,gBAAgB,EAAE,CAAC;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACtC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;SACxC,CAAC;IACJ,CAAC;;AAGH,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAqB,EACrB,GAAe,EACf,OAAe,EACf,SAAqB;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,qBAAqB,CACzB,WAAmB,EACnB,GAAe,EACf,QAAsB,EACtB,WAA2D;QAE3D,uDAAuD;QACvD,iEAAiE;QACjE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACd,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,8BAA8B;QAC7C,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,eAAe;QAC/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,eAAe,CACb,UAAsB,EACtB,IAAgB,EAChB,QAAsB,EACtB,UAAsB;QAEtB,mDAAmD;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,8CAA8C;AAC9C,OAAO,EAAE,6BAA6B,EAAE,YAAY,EAAE,CAAC"}

package/dist/frost/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * FROST threshold signing public API — CELLO-CRYPTO-003
+ *
+ * Exports:
+ * - IThresholdSigner: the swap point interface
+ * - ThresholdSignature: result type
+ * - FrostThresholdSigner: FROST/Ed25519 implementation
+ * - MockThresholdSigner: test double confirming the swap point
+ * - CONTEXT_SESSION_ESTABLISHMENT / CONTEXT_SEAL: domain context constants
+ *
+ * Note: bootstrapKeyShares and clearTestShares are test-only — NOT exported
+ * from this barrel. Test files import them directly from
+ * ./frost-threshold-signer.js to prevent accidental use in production.
+ *
+ * Note: createInProcessStubs and stub types (DirectoryNodeStub, StubSignParams,
+ * StubCommitment) are NOT exported from this barrel. Test files import them
+ * directly from ./stubs.js and ./types.js to keep test infrastructure out of
+ * the production package surface.
+ */
+export type { IThresholdSigner, ThresholdSignature, ThresholdSignatureOk, ThresholdSignatureError, FrostThresholdSignerConfig, FrostContext, BootstrapResult, } from "./types.js";
+export { CONTEXT_SESSION_ESTABLISHMENT, CONTEXT_SEAL, } from "./types.js";
+export { FrostThresholdSigner, MockThresholdSigner, } from "./frost-threshold-signer.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/frost/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/frost/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,6BAA6B,EAC7B,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC"}

package/dist/frost/index.js

@@ -0,0 +1,22 @@
+/**
+ * FROST threshold signing public API — CELLO-CRYPTO-003
+ *
+ * Exports:
+ * - IThresholdSigner: the swap point interface
+ * - ThresholdSignature: result type
+ * - FrostThresholdSigner: FROST/Ed25519 implementation
+ * - MockThresholdSigner: test double confirming the swap point
+ * - CONTEXT_SESSION_ESTABLISHMENT / CONTEXT_SEAL: domain context constants
+ *
+ * Note: bootstrapKeyShares and clearTestShares are test-only — NOT exported
+ * from this barrel. Test files import them directly from
+ * ./frost-threshold-signer.js to prevent accidental use in production.
+ *
+ * Note: createInProcessStubs and stub types (DirectoryNodeStub, StubSignParams,
+ * StubCommitment) are NOT exported from this barrel. Test files import them
+ * directly from ./stubs.js and ./types.js to keep test infrastructure out of
+ * the production package surface.
+ */
+export { CONTEXT_SESSION_ESTABLISHMENT, CONTEXT_SEAL, } from "./types.js";
+export { FrostThresholdSigner, MockThresholdSigner, } from "./frost-threshold-signer.js";
+//# sourceMappingURL=index.js.map

package/dist/frost/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/frost/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,OAAO,EACL,6BAA6B,EAC7B,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC"}

package/dist/frost/stubs.d.ts

@@ -0,0 +1,82 @@
+/**
+ * In-process directory node stubs for FROST tests.
+ *
+ * CELLO-CRYPTO-003
+ *
+ * These stubs mimic the behavior of a real directory node's /cello/frost/1.0.0
+ * protocol handler. They exercise the same ceremony protocol logic as real nodes
+ * but run in-process for fast, deterministic tests.
+ *
+ * Stub configuration options:
+ * - Normal: responds with valid partial signatures
+ * - Unreachable: node is not reachable at initiation (caught by pre-ceremony check)
+ * - Unresponsive: reachable at initiation, but signRound times out (returns null)
+ * - InvalidResponse: returns random bytes (simulates malformed partial sig)
+ */
+import type { FrostPublic, FrostSecret } from "@noble/curves/abstract/frost.js";
+import type { DirectoryNodeStub, StubSignParams, StubCommitment } from "./types.js";
+export declare class InProcessDirectoryNodeStub implements DirectoryNodeStub {
+    #private;
+    readonly id: string;
+    constructor(id: string);
+    /**
+     * Receive a FROST signing share from the bootstrap ceremony.
+     * Called by bootstrapKeyShares during setup.
+     */
+    receiveShare(secret: FrostSecret, pub: FrostPublic): Promise<void>;
+    /**
+     * TEST-ONLY: Return the stored FROST key pair for use by external test harnesses
+     * (e.g., to inject a share into a FrostDirectoryHandler via injectShareForTest).
+     *
+     * This deliberately exposes the raw FrostSecret for test setup purposes.
+     * MUST NOT be called outside of test code.
+     */
+    getShareForTest(): {
+        secret: FrostSecret;
+        pub: FrostPublic;
+    } | null;
+    /**
+     * Mark this node as unreachable at ceremony initiation.
+     * isReachable() will return false, causing the coordinator to exclude
+     * this node before any rounds begin.
+     */
+    setUnreachable(flag: boolean): void;
+    /**
+     * Mark this node as unresponsive during signing rounds.
+     * isReachable() returns true (node is connectable) but signRound returns null
+     * (simulates a timeout after connection is established).
+     */
+    setUnresponsive(flag: boolean): void;
+    /** Make this stub return random bytes (simulate malformed partial sig) */
+    setInvalidResponse(flag: boolean): void;
+    /**
+     * Returns whether this node is reachable at ceremony initiation.
+     * The coordinator uses this for the pre-ceremony availability check:
+     * if fewer than `threshold` nodes are reachable, fail immediately
+     * with DIRECTORY_BELOW_THRESHOLD.
+     */
+    isReachable(): boolean;
+    /**
+     * Generate a nonce commitment for the next signing round.
+     * Called by the coordinator before collecting partial signatures.
+     * Caches the nonce scalars for use in signRound().
+     */
+    generateCommitment(): Promise<StubCommitment>;
+    /**
+     * Participate in a signing round.
+     *
+     * Uses the nonce cached from the preceding generateCommitment() call.
+     * Returns a never-resolving Promise to simulate timeout (the coordinator's
+     * per-node timer will fire first). Returns random bytes to simulate
+     * an invalid partial sig.
+     *
+     * @returns Partial signature bytes, or a hanging Promise (simulate timeout)
+     */
+    signRound(params: StubSignParams): Promise<Uint8Array | null>;
+}
+/**
+ * Create n in-process directory node stubs.
+ * Each stub has a unique deterministic ID.
+ */
+export declare function createInProcessStubs(n: number): InProcessDirectoryNodeStub[];
+//# sourceMappingURL=stubs.d.ts.map

package/dist/frost/stubs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stubs.d.ts","sourceRoot":"","sources":["../../src/frost/stubs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EAEZ,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AAIpB,qBAAa,0BAA2B,YAAW,iBAAiB;;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAaR,EAAE,EAAE,MAAM;IAMtB;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE;;;;;;OAMG;IACH,eAAe,IAAI;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,GAAG,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI;IAMnE;;;;OAIG;IACH,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAInC;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAIpC,0EAA0E;IAC1E,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAMvC;;;;;OAKG;IACH,WAAW,IAAI,OAAO;IAQtB;;;;OAIG;IACG,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC;IAcnD;;;;;;;;;OASG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;CAyCpE;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,0BAA0B,EAAE,CAM5E"}