@cello-protocol/crypto 0.0.58 → 0.0.60

package/dist/index.d.ts

@@ -15,6 +15,10 @@ export { ed25519_FROST } from "@noble/curves/ed25519.js";
 export { buildCheckpointTbs, computeCheckpointHash } from "./checkpoint.js";
 export { buildRelayRegistrationTbs, verifyRelayRegistrationSignature } from "./relay-registration.js";
 export { sealToRecipient, openSealed, CONTENT_SEAL_OVERHEAD_BYTES } from "./content-seal.js";
+export { generateSaltContribution, deriveSessionSalt, saltFingerprint, saltedContentHash, SALT_CONTRIBUTION_BYTES, SALT_FINGERPRINT_BYTES, SESSION_SALT_BYTES, } from "./session-salt.js";
+export { generateSessionEphemeral, destroySessionEphemeral, deriveSessionSecrets, SESSION_KEY_BYTES, type SessionEphemeral, type SessionSecrets, } from "./session-key-agreement.js";
+export { ephemeralSigningMessage, signSessionEphemeral, verifySessionEphemeral, EPHEMERAL_AUTH_REFUSALS, EPHEMERAL_SIG_BYTES, EPHEMERAL_PUBLIC_BYTES, type EphemeralAuthRefusal, type EphemeralAuthResult, } from "./session-ephemeral-auth.js";
+export { sealSessionContent, openSessionContent, SESSION_CONTENT_SEAL_V1, SESSION_CONTENT_SEAL_OVERHEAD_BYTES, } from "./session-content-seal.js";
 export type { ManifestVerifyResult, ManifestVerifyDiagnostics, ManifestVerifySkipReason, ManifestVerifySkippedEntry, ConsortiumManifestInput } from "./manifest.js";
 export { canonicalManifestBody, verifyManifest } from "./manifest.js";
 export type { PreAuthCapability, PreAuthCapabilityBody, CapabilityVerifyResult, CapabilityVerifyReason } from "./preauth-capability.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACpI,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxI,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAIzE,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,YAAY,GACb,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG5E,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAGtG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAG7F,YAAY,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACpK,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEtE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACxI,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACxI,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAG3F,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACpI,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxI,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAIzE,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,YAAY,GACb,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG5E,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAGtG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAI7F,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,4BAA4B,CAAC;AAOpC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACpK,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEtE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACxI,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACxI,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAG3F,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9F,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -20,6 +20,21 @@ export { buildCheckpointTbs, computeCheckpointHash } from "./checkpoint.js";
 export { buildRelayRegistrationTbs, verifyRelayRegistrationSignature } from "./relay-registration.js";
 // M7-MSG-001: recipient content sealed box (E2E encryption for parked content)
 export { sealToRecipient, openSealed, CONTENT_SEAL_OVERHEAD_BYTES } from "./content-seal.js";
+// Decisions Carried #8/#9/#10: the SESSION SALT — agreed in the same exchange as the envelope key
+// but NOT derived from it, because the key must be destroyed at close and the salt must survive the
+// session. Both sides contribute; HMAC for the salted content hash; a fingerprint for the open check.
+export { generateSaltContribution, deriveSessionSalt, saltFingerprint, saltedContentHash, SALT_CONTRIBUTION_BYTES, SALT_FINGERPRINT_BYTES, SESSION_SALT_BYTES, } from "./session-salt.js";
+// DOD-M15-KEYAGREE-1: CELLO's own per-session key agreement — ephemeral-ephemeral X25519 with the
+// hybrid-PQ hook built in. ONE output, the envelope key: the salt is agreed separately above
+// (Decisions Carried #8), because the key is destroyed at close and the salt outlives the session.
+export { generateSessionEphemeral, destroySessionEphemeral, deriveSessionSecrets, SESSION_KEY_BYTES, } from "./session-key-agreement.js";
+// DOD-M15-EPHEMERAL-AUTH-1: the throwaway key is SIGNED with the agent's identity and the peer's is
+// verified BEFORE anything is derived from it — without this a relay substitutes both sides' keys
+// and reads everything while both ends see a working conversation. Plus the AEAD that encrypts a
+// message body under the agreed key: distinct from `content-seal.ts`, which seals PARKED content to
+// a long-term identity key and deliberately has no forward secrecy.
+export { ephemeralSigningMessage, signSessionEphemeral, verifySessionEphemeral, EPHEMERAL_AUTH_REFUSALS, EPHEMERAL_SIG_BYTES, EPHEMERAL_PUBLIC_BYTES, } from "./session-ephemeral-auth.js";
+export { sealSessionContent, openSessionContent, SESSION_CONTENT_SEAL_V1, SESSION_CONTENT_SEAL_OVERHEAD_BYTES, } from "./session-content-seal.js";
 export { canonicalManifestBody, verifyManifest } from "./manifest.js";
 export { canonicalCapabilityBody, signCapability, verifyCapability, encodeCapability, decodeCapability } from "./preauth-capability.js";
 export { CONSORTIUM_ROOT_KEYS, CONSORTIUM_THRESHOLD, TEST_CONSORTIUM_ROOT_KEYS, TEST_CONSORTIUM_THRESHOLD, } from "./consortium-keys.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEpI,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAExI,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU3F,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,iGAAiG;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,uGAAuG;AACvG,0FAA0F;AAC1F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,YAAY,GACb,MAAM,4BAA4B,CAAC;AAEpC,8FAA8F;AAC9F,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAE3C,qGAAqG;AACrG,mGAAmG;AACnG,qEAAqE;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,8EAA8E;AAC9E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,oEAAoE;AACpE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAEtG,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAI7F,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGtE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACxI,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAE3F,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEpI,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAExI,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU3F,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,iGAAiG;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,uGAAuG;AACvG,0FAA0F;AAC1F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,YAAY,GACb,MAAM,4BAA4B,CAAC;AAEpC,8FAA8F;AAC9F,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAE3C,qGAAqG;AACrG,mGAAmG;AACnG,qEAAqE;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,8EAA8E;AAC9E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,oEAAoE;AACpE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAEtG,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,sGAAsG;AACtG,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,kGAAkG;AAClG,6FAA6F;AAC7F,mGAAmG;AACnG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,GAGlB,MAAM,4BAA4B,CAAC;AAEpC,oGAAoG;AACpG,kGAAkG;AAClG,iGAAiG;AACjG,oGAAoG;AACpG,oEAAoE;AACpE,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAInC,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGtE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACxI,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAE3F,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/manifest-test-fixture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-test-fixture.d.ts","sourceRoot":"","sources":["../src/manifest-test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAM3F,CAAC;AAEX,sGAAsG;AACtG,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC/B,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,kBAAkB,EAAE,EAC3B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,uBAAuB,CAoBzB;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B;;;CAG9B,CAAC"}
+{"version":3,"file":"manifest-test-fixture.d.ts","sourceRoot":"","sources":["../src/manifest-test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAM3F,CAAC;AAEX,sGAAsG;AACtG,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC/B,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,kBAAkB,EAAE,EAC3B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,uBAAuB,CA+BzB;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B;;;CAG9B,CAAC"}

package/dist/manifest-test-fixture.js

@@ -34,7 +34,18 @@ export function makeTestManifest(nodes, opts) {
     const manifest = {
         version: opts?.version ?? 1,
         not_before: opts?.notBefore ?? "2026-01-01T00:00:00Z",
-        expires: opts?.expires ?? "2027-01-01T00:00:00Z",
+        /**
+         * ⚠️ A FIXTURE THAT EXPIRES IS A TEST SUITE WITH A FUSE. This defaulted to `2027-01-01`, four
+         * months out when it was found (2026-08-24) — after which every default-fixture manifest becomes
+         * EXPIRED and every test that needs an in-window one goes red **on a date, with no code change**.
+         * It would also have silently switched on the lapsed-manifest branches added by
+         * `DOD-M15-EXPIRY-CONSUMER-POLICY-1` for every existing verifier test at the same moment.
+         *
+         * Far-future and FIXED, not `Date.now() + 1y`: a rolling default makes the fixture's window
+         * depend on the clock, and the tests that care about window boundaries pass their own dates
+         * anyway — which is the reason this default only ever needs to mean "in window".
+         */
+        expires: opts?.expires ?? "2099-01-01T00:00:00Z",
         nodes: nodes,
         signatures: [],
     };

package/dist/manifest-test-fixture.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-test-fixture.js","sourceRoot":"","sources":["../src/manifest-test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0E;IACvG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACrB,CAAC;AAqBX;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA2B,EAC3B,IAA2B;IAE3B,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC;QAC3B,UAAU,EAAE,IAAI,EAAE,SAAS,IAAI,sBAAsB;QACrD,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,sBAAsB;QAChD,KAAK,EAAE,KAA2C;QAClD,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,qCAAqC;IACrC,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAE7C,sDAAsD;IACtD,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACzC,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACpF,CAAC,CAAC,CAAC;IAEJ,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,aAAa,EAAE,kEAAkE;IACjF,YAAY,EAAE,kEAAkE;CACxE,CAAC"}
+{"version":3,"file":"manifest-test-fixture.js","sourceRoot":"","sources":["../src/manifest-test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0E;IACvG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACrB,CAAC;AAqBX;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA2B,EAC3B,IAA2B;IAE3B,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC;QAC3B,UAAU,EAAE,IAAI,EAAE,SAAS,IAAI,sBAAsB;QACrD;;;;;;;;;;WAUG;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,sBAAsB;QAChD,KAAK,EAAE,KAA2C;QAClD,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,qCAAqC;IACrC,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAE7C,sDAAsD;IACtD,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACzC,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACpF,CAAC,CAAC,CAAC;IAEJ,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,aAAa,EAAE,kEAAkE;IACjF,YAAY,EAAE,kEAAkE;CACxE,CAAC"}

package/dist/session-content-seal.d.ts

@@ -0,0 +1,86 @@
+/**
+ * DOD-M15-EPHEMERAL-AUTH-1 — encrypting a message body under the AGREED SESSION KEY.
+ *
+ * ─── What this is for, and how it differs from `content-seal.ts` ───────────────────────────────
+ *
+ * Two encryption schemes exist in this codebase and they are NOT interchangeable. Which one applies
+ * is decided by the ROUTE a message takes, and getting that wrong is silent:
+ *
+ *   **This file — LIVE messages.** Encrypted under the per-session key both sides agreed from
+ *   throwaway keypairs (`session-key-agreement.ts`). Those keypairs are destroyed when the session
+ *   ends, so a recording of the traffic cannot be decrypted later even if both agents' long-term
+ *   identity keys are eventually compromised. That is forward secrecy, and it is the whole point.
+ *
+ *   **`content-seal.ts` — PARKED messages.** Encrypted to the recipient's LONG-TERM identity key,
+ *   because the recipient is offline and cannot take part in a handshake. It has no forward secrecy
+ *   by construction: whoever holds that identity key can open every message ever sealed to it. That
+ *   is an accepted trade for the mailbox and must not be copied here.
+ *
+ * ⚠️ A message that fails live delivery falls back to the mailbox, so the SAME message can take
+ * either scheme. The caller must encrypt the copy that goes on the wire and leave the plaintext it
+ * holds for the park backstop alone — sealing an already-encrypted body to the identity key gives
+ * the recipient bytes locked under a session key that is about to be destroyed.
+ *
+ * ─── Construction (SPARC Phase P) ──────────────────────────────────────────────────────────────
+ *
+ *   sealSessionContent(key, plaintext):
+ *     1. iv       = random 12 bytes                              # NIST SP 800-38D §8.2.2
+ *     2. ct||tag  = AES-256-GCM(key, iv, plaintext)              # NIST SP 800-38D
+ *     3. blob     = VERSION(1) || iv(12) || ct || tag(16)
+ *
+ *   openSessionContent(key, blob) -> plaintext | null
+ *
+ * AES-256-GCM matches `content-seal.ts` rather than introducing a second AEAD, so there is one
+ * primitive to reason about. RFCs: HKDF — RFC 5869 (upstream, in the key agreement); AES-GCM — NIST
+ * SP 800-38D.
+ *
+ * ─── Why a RANDOM IV rather than a counter ─────────────────────────────────────────────────────
+ *
+ * A counter is the stronger construction and it needs state that survives a restart. This session
+ * key does not: the secret is deliberately never persisted, and a revived session RE-KEYS
+ * (Decisions Carried #5), so a counter would restart at zero under a NEW key — which is safe, and
+ * would also have to be proven safe at every future change to the revival rule. A 96-bit random IV
+ * under a key that lives for one session, with a birthday bound around 2^32 messages, is not the
+ * limiting factor here and needs no state at all.
+ *
+ * ─── The VERSION byte is FRAMING, not compatibility ────────────────────────────────────────────
+ *
+ * There are no other builds to be compatible with — CELLO is pre-launch with no external installs —
+ * so this byte is not here to interoperate with anything. It is here because the alternative is a
+ * blob whose layout is implied by its length, and a reader that meets bytes it cannot frame would
+ * then hand attacker-chosen input to a decryptor under a guessed layout. One byte, one comparison,
+ * and an unknown value REFUSES rather than parsing.
+ *
+ * That is the only justification, and it is worth stating because the tempting one — "so a future
+ * version can change the format" — would be exactly the speculative scaffolding this codebase has
+ * ruled against building.
+ */
+/**
+ * The only version this build writes, and the only one it reads.
+ *
+ * `0x01` rather than `0x00`: a zero first byte is what an all-zero buffer and a truncated read both
+ * look like, so a version of zero cannot be told from an absent one.
+ */
+export declare const SESSION_CONTENT_SEAL_V1 = 1;
+/** Bytes added to every message: version + IV + tag. */
+export declare const SESSION_CONTENT_SEAL_OVERHEAD_BYTES: number;
+/**
+ * Encrypt a message body under the agreed session key.
+ *
+ * Throws on a wrong-width key rather than deriving from whatever it was given: a short key silently
+ * accepted is encryption that appears to work under something that is not the agreed secret.
+ */
+export declare function sealSessionContent(key: Uint8Array, plaintext: Uint8Array): Uint8Array;
+/**
+ * Decrypt a message body under the agreed session key.
+ *
+ * **Returns `null` on every failure and never throws** — wrong key, tampered ciphertext, truncated
+ * blob, unknown version. The caller cannot tell those apart and must not try: GCM's tag check is the
+ * only thing that distinguishes "not for us" from "modified in flight", and a caller that branched
+ * on the difference would be branching on attacker-controlled input.
+ *
+ * The caller's job on `null` is to refuse the message loudly, not to retry or to fall back to
+ * reading it as plaintext.
+ */
+export declare function openSessionContent(key: Uint8Array, blob: Uint8Array): Uint8Array | null;
+//# sourceMappingURL=session-content-seal.d.ts.map

package/dist/session-content-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-content-seal.d.ts","sourceRoot":"","sources":["../src/session-content-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAWH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,IAAO,CAAC;AAE5C,wDAAwD;AACxD,eAAO,MAAM,mCAAmC,QAA2B,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAerF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAiBvF"}

package/dist/session-content-seal.js

@@ -0,0 +1,124 @@
+/**
+ * DOD-M15-EPHEMERAL-AUTH-1 — encrypting a message body under the AGREED SESSION KEY.
+ *
+ * ─── What this is for, and how it differs from `content-seal.ts` ───────────────────────────────
+ *
+ * Two encryption schemes exist in this codebase and they are NOT interchangeable. Which one applies
+ * is decided by the ROUTE a message takes, and getting that wrong is silent:
+ *
+ *   **This file — LIVE messages.** Encrypted under the per-session key both sides agreed from
+ *   throwaway keypairs (`session-key-agreement.ts`). Those keypairs are destroyed when the session
+ *   ends, so a recording of the traffic cannot be decrypted later even if both agents' long-term
+ *   identity keys are eventually compromised. That is forward secrecy, and it is the whole point.
+ *
+ *   **`content-seal.ts` — PARKED messages.** Encrypted to the recipient's LONG-TERM identity key,
+ *   because the recipient is offline and cannot take part in a handshake. It has no forward secrecy
+ *   by construction: whoever holds that identity key can open every message ever sealed to it. That
+ *   is an accepted trade for the mailbox and must not be copied here.
+ *
+ * ⚠️ A message that fails live delivery falls back to the mailbox, so the SAME message can take
+ * either scheme. The caller must encrypt the copy that goes on the wire and leave the plaintext it
+ * holds for the park backstop alone — sealing an already-encrypted body to the identity key gives
+ * the recipient bytes locked under a session key that is about to be destroyed.
+ *
+ * ─── Construction (SPARC Phase P) ──────────────────────────────────────────────────────────────
+ *
+ *   sealSessionContent(key, plaintext):
+ *     1. iv       = random 12 bytes                              # NIST SP 800-38D §8.2.2
+ *     2. ct||tag  = AES-256-GCM(key, iv, plaintext)              # NIST SP 800-38D
+ *     3. blob     = VERSION(1) || iv(12) || ct || tag(16)
+ *
+ *   openSessionContent(key, blob) -> plaintext | null
+ *
+ * AES-256-GCM matches `content-seal.ts` rather than introducing a second AEAD, so there is one
+ * primitive to reason about. RFCs: HKDF — RFC 5869 (upstream, in the key agreement); AES-GCM — NIST
+ * SP 800-38D.
+ *
+ * ─── Why a RANDOM IV rather than a counter ─────────────────────────────────────────────────────
+ *
+ * A counter is the stronger construction and it needs state that survives a restart. This session
+ * key does not: the secret is deliberately never persisted, and a revived session RE-KEYS
+ * (Decisions Carried #5), so a counter would restart at zero under a NEW key — which is safe, and
+ * would also have to be proven safe at every future change to the revival rule. A 96-bit random IV
+ * under a key that lives for one session, with a birthday bound around 2^32 messages, is not the
+ * limiting factor here and needs no state at all.
+ *
+ * ─── The VERSION byte is FRAMING, not compatibility ────────────────────────────────────────────
+ *
+ * There are no other builds to be compatible with — CELLO is pre-launch with no external installs —
+ * so this byte is not here to interoperate with anything. It is here because the alternative is a
+ * blob whose layout is implied by its length, and a reader that meets bytes it cannot frame would
+ * then hand attacker-chosen input to a decryptor under a guessed layout. One byte, one comparison,
+ * and an unknown value REFUSES rather than parsing.
+ *
+ * That is the only justification, and it is worth stating because the tempting one — "so a future
+ * version can change the format" — would be exactly the speculative scaffolding this codebase has
+ * ruled against building.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+/** AES-256. */
+const KEY_BYTES = 32;
+/** GCM's standard nonce length (NIST SP 800-38D §8.2). */
+const IV_BYTES = 12;
+/** GCM tag. Full length, never truncated. */
+const TAG_BYTES = 16;
+/**
+ * The only version this build writes, and the only one it reads.
+ *
+ * `0x01` rather than `0x00`: a zero first byte is what an all-zero buffer and a truncated read both
+ * look like, so a version of zero cannot be told from an absent one.
+ */
+export const SESSION_CONTENT_SEAL_V1 = 0x01;
+/** Bytes added to every message: version + IV + tag. */
+export const SESSION_CONTENT_SEAL_OVERHEAD_BYTES = 1 + IV_BYTES + TAG_BYTES;
+/**
+ * Encrypt a message body under the agreed session key.
+ *
+ * Throws on a wrong-width key rather than deriving from whatever it was given: a short key silently
+ * accepted is encryption that appears to work under something that is not the agreed secret.
+ */
+export function sealSessionContent(key, plaintext) {
+    if (key.length !== KEY_BYTES) {
+        throw new Error(`SESSION CONTENT SEAL: the session key must be ${KEY_BYTES} bytes, got ${key.length}. This is a ` +
+            "LOCAL defect — the key comes from this side's own agreement, not from the peer. Refusing " +
+            "rather than encrypting under something that is not the agreed secret.");
+    }
+    const iv = new Uint8Array(randomBytes(IV_BYTES));
+    const cipher = createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
+    const ct = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return new Uint8Array(Buffer.concat([Buffer.from([SESSION_CONTENT_SEAL_V1]), Buffer.from(iv), ct, tag]));
+}
+/**
+ * Decrypt a message body under the agreed session key.
+ *
+ * **Returns `null` on every failure and never throws** — wrong key, tampered ciphertext, truncated
+ * blob, unknown version. The caller cannot tell those apart and must not try: GCM's tag check is the
+ * only thing that distinguishes "not for us" from "modified in flight", and a caller that branched
+ * on the difference would be branching on attacker-controlled input.
+ *
+ * The caller's job on `null` is to refuse the message loudly, not to retry or to fall back to
+ * reading it as plaintext.
+ */
+export function openSessionContent(key, blob) {
+    if (key.length !== KEY_BYTES)
+        return null;
+    // A blob must have room for version + IV + tag, and one byte cannot be assumed present: an empty
+    // frame would otherwise index past the end and read `undefined` as a version.
+    if (blob.length < SESSION_CONTENT_SEAL_OVERHEAD_BYTES)
+        return null;
+    if (blob[0] !== SESSION_CONTENT_SEAL_V1)
+        return null;
+    const iv = blob.subarray(1, 1 + IV_BYTES);
+    const ct = blob.subarray(1 + IV_BYTES, blob.length - TAG_BYTES);
+    const tag = blob.subarray(blob.length - TAG_BYTES);
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
+        decipher.setAuthTag(Buffer.from(tag));
+        return new Uint8Array(Buffer.concat([decipher.update(Buffer.from(ct)), decipher.final()]));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=session-content-seal.js.map

package/dist/session-content-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-content-seal.js","sourceRoot":"","sources":["../src/session-content-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,eAAe;AACf,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,0DAA0D;AAC1D,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,6CAA6C;AAC7C,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,wDAAwD;AACxD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,SAAqB;IACvE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iDAAiD,SAAS,eAAe,GAAG,CAAC,MAAM,cAAc;YACjG,2FAA2F;YAC3F,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,IAAI,UAAU,CACnB,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAClF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,IAAgB;IAClE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,iGAAiG;IACjG,8EAA8E;IAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,mCAAmC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/session-ephemeral-auth.d.ts

@@ -0,0 +1,96 @@
+/**
+ * DOD-M15-EPHEMERAL-AUTH-1 — binding the throwaway key to the agent's identity.
+ *
+ * ─── The attack this closes, step by step ──────────────────────────────────────────────────────
+ *
+ * The key agreement mixes two throwaway keys into a shared secret, and the secret itself never
+ * crosses the wire. But if nobody SIGNS the throwaway key, an arriving one carries no evidence of
+ * who sent it:
+ *
+ *   1. Alice sends her throwaway public key. The relay is carrying the traffic.
+ *   2. The relay keeps Alice's and forwards its OWN key to Bob instead.
+ *   3. It does the same in the other direction.
+ *   4. It now shares one secret with Alice and a different one with Bob.
+ *   5. It decrypts everything, reads it, re-encrypts it, and passes it on. Neither side sees
+ *      anything wrong, because both halves of the conversation decrypt perfectly.
+ *
+ * So the unauthenticated layer stops a PASSIVE recorder — which is what harvest-now-decrypt-later
+ * is about — and does nothing against the party actually carrying the messages. **And we run the
+ * relays**, so without this the guarantee reduces to "trust us", which is the one thing CELLO exists
+ * so nobody has to do.
+ *
+ * ─── What is signed, and why the session id is in it ───────────────────────────────────────────
+ *
+ *   message = "cello/session/v1/ephemeral" || sessionId || ephemeralPublic
+ *
+ * The LABEL makes this signature unusable as any other kind of CELLO signature, and vice versa: an
+ * agent signs many things, and a signature that is valid in two contexts is a signature an attacker
+ * can move between them.
+ *
+ * The SESSION ID binds the ephemeral to the conversation it was minted for. Without it, a signed
+ * ephemeral captured from one session could be replayed into another between the same two agents —
+ * the signature verifies, both sides derive, and the relay that replayed it knows the secret from
+ * the session it harvested. The session id is length-prefixed so that `sessionId ‖ ephemeral` cannot
+ * be re-split at a different point to produce the same bytes from different inputs.
+ *
+ * ⚠️ WHAT THIS DOES NOT DO. It proves the ephemeral came from the holder of that identity key. It
+ * does not prove the identity key is the agent you meant to talk to — that is the counterparty
+ * identity the caller passes in, and the caller must take it from what the OPERATOR asked for, never
+ * from a value the directory or the relay handed back. Verifying against a key the attacker chose is
+ * relocating the trust rather than closing it.
+ */
+/** Ed25519 signatures are 64 bytes; X25519 publics are 32. */
+export declare const EPHEMERAL_SIG_BYTES = 64;
+export declare const EPHEMERAL_PUBLIC_BYTES = 32;
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * Written once and used by BOTH directions on purpose. A signer and a verifier that each build the
+ * message from their own reading of a spec is how two implementations end up disagreeing about a
+ * byte and rejecting each other for a reason neither can see.
+ */
+export declare function ephemeralSigningMessage(sessionId: Uint8Array, ephemeralPublic: Uint8Array): Uint8Array;
+/** Sign this side's throwaway public key with the agent's long-term identity key. */
+export declare function signSessionEphemeral(signer: {
+    sign(data: Uint8Array): Promise<Uint8Array>;
+}, sessionId: Uint8Array, ephemeralPublic: Uint8Array): Promise<Uint8Array>;
+/**
+ * Why a peer's ephemeral was refused. A CLOSED set — a free-form string is what lets a new code
+ * reach a caller with nothing to act on (`refusal-reasons.ts` records what that cost).
+ */
+export declare const EPHEMERAL_AUTH_REFUSALS: {
+    /** No signature at all. */
+    readonly SIGNATURE_MISSING: "ephemeral_signature_missing";
+    /** Present but the wrong width, or the public key is the wrong width. */
+    readonly MALFORMED: "ephemeral_malformed";
+    /** Verified against the expected identity and did not match. */
+    readonly SIGNATURE_MISMATCH: "ephemeral_signature_mismatch";
+};
+export type EphemeralAuthRefusal = (typeof EPHEMERAL_AUTH_REFUSALS)[keyof typeof EPHEMERAL_AUTH_REFUSALS];
+export type EphemeralAuthResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: EphemeralAuthRefusal;
+    detail: string;
+};
+/**
+ * VERIFY A PEER'S EPHEMERAL BEFORE ANYTHING IS DERIVED FROM IT.
+ *
+ * 🚨 MISSING, MALFORMED AND MISMATCHED ALL FAIL. They are separate REASONS because they send an
+ * operator to different places, and they are the same OUTCOME because an attacker evading a mismatch
+ * check simply supplies no signature at all. "We could not tell" must never be more forgiving than
+ * "we proved it wrong" — that is the hole, not the mismatch.
+ *
+ * Called BEFORE `deriveSessionSecrets`, never alongside it. Deriving first and checking after means
+ * a key exists, briefly, that was agreed with someone unproven — and every "briefly" in this
+ * codebase eventually turns out to be long enough for something to read it.
+ */
+export declare function verifySessionEphemeral(opts: {
+    /** The identity we EXPECT — from what the operator asked for, never from the directory or relay. */
+    expectedIdentityPublic: Uint8Array;
+    sessionId: Uint8Array;
+    peerEphemeralPublic: Uint8Array | undefined;
+    peerSignature: Uint8Array | undefined;
+}): EphemeralAuthResult;
+//# sourceMappingURL=session-ephemeral-auth.d.ts.map

package/dist/session-ephemeral-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-ephemeral-auth.d.ts","sourceRoot":"","sources":["../src/session-ephemeral-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AASH,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,GAAG,UAAU,CActG;AAED,qFAAqF;AACrF,wBAAsB,oBAAoB,CACxC,MAAM,EAAE;IAAE,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,EACvD,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,UAAU,CAAC,CAErB;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB;IAClC,2BAA2B;;IAE3B,yEAAyE;;IAEzE,gEAAgE;;CAExD,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAEzE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,oGAAoG;IACpG,sBAAsB,EAAE,UAAU,CAAC;IACnC,SAAS,EAAE,UAAU,CAAC;IACtB,mBAAmB,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,UAAU,GAAG,SAAS,CAAC;CACvC,GAAG,mBAAmB,CAwCtB"}

package/dist/session-ephemeral-auth.js

@@ -0,0 +1,137 @@
+/**
+ * DOD-M15-EPHEMERAL-AUTH-1 — binding the throwaway key to the agent's identity.
+ *
+ * ─── The attack this closes, step by step ──────────────────────────────────────────────────────
+ *
+ * The key agreement mixes two throwaway keys into a shared secret, and the secret itself never
+ * crosses the wire. But if nobody SIGNS the throwaway key, an arriving one carries no evidence of
+ * who sent it:
+ *
+ *   1. Alice sends her throwaway public key. The relay is carrying the traffic.
+ *   2. The relay keeps Alice's and forwards its OWN key to Bob instead.
+ *   3. It does the same in the other direction.
+ *   4. It now shares one secret with Alice and a different one with Bob.
+ *   5. It decrypts everything, reads it, re-encrypts it, and passes it on. Neither side sees
+ *      anything wrong, because both halves of the conversation decrypt perfectly.
+ *
+ * So the unauthenticated layer stops a PASSIVE recorder — which is what harvest-now-decrypt-later
+ * is about — and does nothing against the party actually carrying the messages. **And we run the
+ * relays**, so without this the guarantee reduces to "trust us", which is the one thing CELLO exists
+ * so nobody has to do.
+ *
+ * ─── What is signed, and why the session id is in it ───────────────────────────────────────────
+ *
+ *   message = "cello/session/v1/ephemeral" || sessionId || ephemeralPublic
+ *
+ * The LABEL makes this signature unusable as any other kind of CELLO signature, and vice versa: an
+ * agent signs many things, and a signature that is valid in two contexts is a signature an attacker
+ * can move between them.
+ *
+ * The SESSION ID binds the ephemeral to the conversation it was minted for. Without it, a signed
+ * ephemeral captured from one session could be replayed into another between the same two agents —
+ * the signature verifies, both sides derive, and the relay that replayed it knows the secret from
+ * the session it harvested. The session id is length-prefixed so that `sessionId ‖ ephemeral` cannot
+ * be re-split at a different point to produce the same bytes from different inputs.
+ *
+ * ⚠️ WHAT THIS DOES NOT DO. It proves the ephemeral came from the holder of that identity key. It
+ * does not prove the identity key is the agent you meant to talk to — that is the counterparty
+ * identity the caller passes in, and the caller must take it from what the OPERATOR asked for, never
+ * from a value the directory or the relay handed back. Verifying against a key the attacker chose is
+ * relocating the trust rather than closing it.
+ */
+import { verify as edVerify } from "./ed25519.js";
+const ENC = new TextEncoder();
+/** Domain separation. Versioned, so a future change is a new label rather than a reinterpretation. */
+const EPHEMERAL_SIG_LABEL = ENC.encode("cello/session/v1/ephemeral");
+/** Ed25519 signatures are 64 bytes; X25519 publics are 32. */
+export const EPHEMERAL_SIG_BYTES = 64;
+export const EPHEMERAL_PUBLIC_BYTES = 32;
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * Written once and used by BOTH directions on purpose. A signer and a verifier that each build the
+ * message from their own reading of a spec is how two implementations end up disagreeing about a
+ * byte and rejecting each other for a reason neither can see.
+ */
+export function ephemeralSigningMessage(sessionId, ephemeralPublic) {
+    // The session id is LENGTH-PREFIXED (4 bytes, big-endian). Concatenating two variable-length
+    // fields lets a crafted pair re-split at a different boundary and produce identical bytes from
+    // different inputs — the signature would then cover something other than what it appears to.
+    const out = new Uint8Array(EPHEMERAL_SIG_LABEL.length + 4 + sessionId.length + ephemeralPublic.length);
+    let o = 0;
+    out.set(EPHEMERAL_SIG_LABEL, o);
+    o += EPHEMERAL_SIG_LABEL.length;
+    out[o++] = (sessionId.length >>> 24) & 0xff;
+    out[o++] = (sessionId.length >>> 16) & 0xff;
+    out[o++] = (sessionId.length >>> 8) & 0xff;
+    out[o++] = sessionId.length & 0xff;
+    out.set(sessionId, o);
+    o += sessionId.length;
+    out.set(ephemeralPublic, o);
+    return out;
+}
+/** Sign this side's throwaway public key with the agent's long-term identity key. */
+export async function signSessionEphemeral(signer, sessionId, ephemeralPublic) {
+    return signer.sign(ephemeralSigningMessage(sessionId, ephemeralPublic));
+}
+/**
+ * Why a peer's ephemeral was refused. A CLOSED set — a free-form string is what lets a new code
+ * reach a caller with nothing to act on (`refusal-reasons.ts` records what that cost).
+ */
+export const EPHEMERAL_AUTH_REFUSALS = {
+    /** No signature at all. */
+    SIGNATURE_MISSING: "ephemeral_signature_missing",
+    /** Present but the wrong width, or the public key is the wrong width. */
+    MALFORMED: "ephemeral_malformed",
+    /** Verified against the expected identity and did not match. */
+    SIGNATURE_MISMATCH: "ephemeral_signature_mismatch",
+};
+/**
+ * VERIFY A PEER'S EPHEMERAL BEFORE ANYTHING IS DERIVED FROM IT.
+ *
+ * 🚨 MISSING, MALFORMED AND MISMATCHED ALL FAIL. They are separate REASONS because they send an
+ * operator to different places, and they are the same OUTCOME because an attacker evading a mismatch
+ * check simply supplies no signature at all. "We could not tell" must never be more forgiving than
+ * "we proved it wrong" — that is the hole, not the mismatch.
+ *
+ * Called BEFORE `deriveSessionSecrets`, never alongside it. Deriving first and checking after means
+ * a key exists, briefly, that was agreed with someone unproven — and every "briefly" in this
+ * codebase eventually turns out to be long enough for something to read it.
+ */
+export function verifySessionEphemeral(opts) {
+    if (opts.peerSignature === undefined) {
+        return {
+            ok: false,
+            reason: EPHEMERAL_AUTH_REFUSALS.SIGNATURE_MISSING,
+            detail: "the peer sent a session key with no signature over it, so there is nothing to tie it to " +
+                "your counterparty. An unsigned key is exactly what a relay substituting its own would send, " +
+                "and it is refused on the same path as a wrong signature — a check that is lenient about a " +
+                "missing proof is a check an attacker skips.",
+        };
+    }
+    if (opts.peerSignature.length !== EPHEMERAL_SIG_BYTES ||
+        opts.peerEphemeralPublic === undefined ||
+        opts.peerEphemeralPublic.length !== EPHEMERAL_PUBLIC_BYTES) {
+        return {
+            ok: false,
+            reason: EPHEMERAL_AUTH_REFUSALS.MALFORMED,
+            detail: `the peer's session key material is the wrong shape — signature ${opts.peerSignature.length} ` +
+                `bytes (expected ${EPHEMERAL_SIG_BYTES}), key ${opts.peerEphemeralPublic?.length ?? 0} bytes ` +
+                `(expected ${EPHEMERAL_PUBLIC_BYTES}). Refusing rather than padding: a short value silently ` +
+                "zero-extended is an agreement with something that is not the peer.",
+        };
+    }
+    const message = ephemeralSigningMessage(opts.sessionId, opts.peerEphemeralPublic);
+    if (!edVerify(opts.expectedIdentityPublic, message, opts.peerSignature)) {
+        return {
+            ok: false,
+            reason: EPHEMERAL_AUTH_REFUSALS.SIGNATURE_MISMATCH,
+            detail: "the peer's session key is signed, but not by the counterparty this session is with. That " +
+                "is what a relay substituting its own key looks like: it would then share one secret with " +
+                "you and another with them, and read everything in between while both sides saw a working " +
+                "conversation. Refusing.",
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=session-ephemeral-auth.js.map

package/dist/session-ephemeral-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-ephemeral-auth.js","sourceRoot":"","sources":["../src/session-ephemeral-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAErE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAqB,EAAE,eAA2B;IACxF,6FAA6F;IAC7F,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvG,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC;IACjE,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IAC3C,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC;IAC7C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAuD,EACvD,SAAqB,EACrB,eAA2B;IAE3B,OAAO,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,2BAA2B;IAC3B,iBAAiB,EAAE,6BAA6B;IAChD,yEAAyE;IACzE,SAAS,EAAE,qBAAqB;IAChC,gEAAgE;IAChE,kBAAkB,EAAE,8BAA8B;CAC1C,CAAC;AASX;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAMtC;IACC,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB,CAAC,iBAAiB;YACjD,MAAM,EACJ,0FAA0F;gBAC1F,8FAA8F;gBAC9F,4FAA4F;gBAC5F,6CAA6C;SAChD,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,mBAAmB;QACjD,IAAI,CAAC,mBAAmB,KAAK,SAAS;QACtC,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,sBAAsB,EAC1D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB,CAAC,SAAS;YACzC,MAAM,EACJ,kEAAkE,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG;gBAC9F,mBAAmB,mBAAmB,UAAU,IAAI,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC,SAAS;gBAC9F,aAAa,sBAAsB,0DAA0D;gBAC7F,oEAAoE;SACvE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAClF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uBAAuB,CAAC,kBAAkB;YAClD,MAAM,EACJ,2FAA2F;gBAC3F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,yBAAyB;SAC5B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}