@cello-protocol/crypto 0.0.7 → 0.0.9

package/dist/consortium-keys.d.ts

@@ -0,0 +1,32 @@
+/**
+ * M7-MANIFEST-001 — Consortium officer root key constants.
+ *
+ * These Ed25519 public keys are the root of trust for consortium manifest
+ * threshold signatures. A manifest is valid only if at least CONSORTIUM_THRESHOLD
+ * unique officer keys have signed it.
+ *
+ * Production keys are placeholder zeros until the initial key ceremony is
+ * conducted. Test keys are derived from deterministic seeds defined in
+ * manifest-test-fixture.ts (AC-011).
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ */
+/**
+ * Production consortium officer root keys.
+ *
+ * Pre-ceremony placeholder: all zeros. These will be replaced with real
+ * Ed25519 public keys after the initial officer key ceremony is conducted.
+ * Until then, no production manifest can pass verification — this is by design.
+ */
+export declare const CONSORTIUM_ROOT_KEYS: readonly [string, string, string, string, string];
+/** Minimum number of valid officer signatures required for manifest acceptance. */
+export declare const CONSORTIUM_THRESHOLD = 3;
+/**
+ * Test consortium officer root keys — real Ed25519 public keys derived from
+ * deterministic fixed seeds in manifest-test-fixture.ts. Completely disjoint
+ * from production keys (SI-003).
+ */
+export declare const TEST_CONSORTIUM_ROOT_KEYS: readonly [string, string, string, string, string];
+/** Test threshold — same as production for realistic test coverage. */
+export declare const TEST_CONSORTIUM_THRESHOLD = 3;
+//# sourceMappingURL=consortium-keys.d.ts.map

package/dist/consortium-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consortium-keys.d.ts","sourceRoot":"","sources":["../src/consortium-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAMzE,CAAC;AAEX,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAM9E,CAAC;AAEX,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,IAAI,CAAC"}

package/dist/consortium-keys.js

@@ -0,0 +1,48 @@
+/**
+ * M7-MANIFEST-001 — Consortium officer root key constants.
+ *
+ * These Ed25519 public keys are the root of trust for consortium manifest
+ * threshold signatures. A manifest is valid only if at least CONSORTIUM_THRESHOLD
+ * unique officer keys have signed it.
+ *
+ * Production keys are placeholder zeros until the initial key ceremony is
+ * conducted. Test keys are derived from deterministic seeds defined in
+ * manifest-test-fixture.ts (AC-011).
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ */
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { TEST_OFFICER_SEEDS } from "./manifest-test-fixture.js";
+// ─── Production constants ────────────────────────────────────────────────────
+/**
+ * Production consortium officer root keys.
+ *
+ * Pre-ceremony placeholder: all zeros. These will be replaced with real
+ * Ed25519 public keys after the initial officer key ceremony is conducted.
+ * Until then, no production manifest can pass verification — this is by design.
+ */
+export const CONSORTIUM_ROOT_KEYS = [
+    "0".repeat(64),
+    "0".repeat(64),
+    "0".repeat(64),
+    "0".repeat(64),
+    "0".repeat(64),
+];
+/** Minimum number of valid officer signatures required for manifest acceptance. */
+export const CONSORTIUM_THRESHOLD = 3;
+// ─── Test constants ──────────────────────────────────────────────────────────
+/**
+ * Test consortium officer root keys — real Ed25519 public keys derived from
+ * deterministic fixed seeds in manifest-test-fixture.ts. Completely disjoint
+ * from production keys (SI-003).
+ */
+export const TEST_CONSORTIUM_ROOT_KEYS = [
+    Buffer.from(ed25519.getPublicKey(TEST_OFFICER_SEEDS[0])).toString("hex"),
+    Buffer.from(ed25519.getPublicKey(TEST_OFFICER_SEEDS[1])).toString("hex"),
+    Buffer.from(ed25519.getPublicKey(TEST_OFFICER_SEEDS[2])).toString("hex"),
+    Buffer.from(ed25519.getPublicKey(TEST_OFFICER_SEEDS[3])).toString("hex"),
+    Buffer.from(ed25519.getPublicKey(TEST_OFFICER_SEEDS[4])).toString("hex"),
+];
+/** Test threshold — same as production for realistic test coverage. */
+export const TEST_CONSORTIUM_THRESHOLD = 3;
+//# sourceMappingURL=consortium-keys.js.map

package/dist/consortium-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consortium-keys.js","sourceRoot":"","sources":["../src/consortium-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsD;IACrF,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;CACN,CAAC;AAEX,mFAAmF;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsD;IAC1F,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;CAChE,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC"}

package/dist/content-seal.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CELLO-M7-MSG-001 — recipient content sealed box.
+ *
+ * E2E-encrypts a content blob to a recipient's stable Ed25519 identity key so that
+ * the relay store-and-forward queue holds only ciphertext it cannot read (SI-001).
+ *
+ * The relay never has any decryption key. Only the holder of the recipient's
+ * Ed25519 identity seed can open the blob.
+ *
+ * ─── Construction ────────────────────────────────────────────────────────────
+ *
+ * Pseudocode (SPARC Phase P):
+ *
+ *   sealToRecipient(recipientEd25519Pub, plaintext):
+ *     1. uPub      = edwardsToMontgomery(recipientEd25519Pub)   # RFC 7748 §4.1 map
+ *     2. ephSk     = random X25519 secret                        # RFC 7748
+ *        ephPk     = X25519 base * ephSk
+ *     3. shared    = X25519(ephSk, uPub)                         # ephemeral-static ECDH
+ *     4. key       = HKDF-SHA256(ikm=shared, salt=ephPk,
+ *                                info="cello-content-park-v1", 32)  # RFC 5869
+ *     5. iv        = random 12 bytes
+ *        ct||tag   = AES-256-GCM(key, iv, plaintext)             # NIST SP 800-38D
+ *     6. blob      = ephPk(32) || iv(12) || ct || tag(16)
+ *
+ *   openSealed(recipientEd25519Seed, blob):
+ *     1. ephPk, iv, ctAndTag = split(blob)
+ *     2. montSk  = clamp(SHA-512(seed)[0:32])                    # ed25519 → x25519 scalar
+ *     3. shared  = X25519(montSk, ephPk)
+ *     4. key     = HKDF-SHA256(ikm=shared, salt=ephPk, info=..., 32)
+ *     5. plaintext = AES-256-GCM-decrypt(key, iv, ct, tag)      # null on auth failure
+ *
+ * Correctness of the Ed25519→X25519 conversion is verified by the round-trip test:
+ * the sender converts the recipient's Ed25519 *public* key to a Montgomery
+ * u-coordinate; the recipient derives the matching Montgomery *scalar* from its
+ * Ed25519 seed; ECDH on both sides yields the same shared secret (RFC 7748 §4.1).
+ */
+/** Fixed bytes prepended before the AEAD ciphertext: ephemeral pubkey + IV. */
+export declare const CONTENT_SEAL_OVERHEAD_BYTES: number;
+/** Encrypt `plaintext` to a recipient identified by their Ed25519 public key. */
+export declare function sealToRecipient(recipientEd25519Pub: Uint8Array, plaintext: Uint8Array): Uint8Array;
+/**
+ * Decrypt a sealed blob using the recipient's Ed25519 identity seed.
+ * Returns null on any failure (wrong key, tamper, malformed) — never throws.
+ */
+export declare function openSealed(recipientEd25519Seed: Uint8Array, blob: Uint8Array): Uint8Array | null;
+//# sourceMappingURL=content-seal.d.ts.map

package/dist/content-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-seal.d.ts","sourceRoot":"","sources":["../src/content-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAaH,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,QAA2B,CAAC;AAsCpE,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,mBAAmB,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAiBlG;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,oBAAoB,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,CAoBhG"}

package/dist/content-seal.js

@@ -0,0 +1,123 @@
+/**
+ * CELLO-M7-MSG-001 — recipient content sealed box.
+ *
+ * E2E-encrypts a content blob to a recipient's stable Ed25519 identity key so that
+ * the relay store-and-forward queue holds only ciphertext it cannot read (SI-001).
+ *
+ * The relay never has any decryption key. Only the holder of the recipient's
+ * Ed25519 identity seed can open the blob.
+ *
+ * ─── Construction ────────────────────────────────────────────────────────────
+ *
+ * Pseudocode (SPARC Phase P):
+ *
+ *   sealToRecipient(recipientEd25519Pub, plaintext):
+ *     1. uPub      = edwardsToMontgomery(recipientEd25519Pub)   # RFC 7748 §4.1 map
+ *     2. ephSk     = random X25519 secret                        # RFC 7748
+ *        ephPk     = X25519 base * ephSk
+ *     3. shared    = X25519(ephSk, uPub)                         # ephemeral-static ECDH
+ *     4. key       = HKDF-SHA256(ikm=shared, salt=ephPk,
+ *                                info="cello-content-park-v1", 32)  # RFC 5869
+ *     5. iv        = random 12 bytes
+ *        ct||tag   = AES-256-GCM(key, iv, plaintext)             # NIST SP 800-38D
+ *     6. blob      = ephPk(32) || iv(12) || ct || tag(16)
+ *
+ *   openSealed(recipientEd25519Seed, blob):
+ *     1. ephPk, iv, ctAndTag = split(blob)
+ *     2. montSk  = clamp(SHA-512(seed)[0:32])                    # ed25519 → x25519 scalar
+ *     3. shared  = X25519(montSk, ephPk)
+ *     4. key     = HKDF-SHA256(ikm=shared, salt=ephPk, info=..., 32)
+ *     5. plaintext = AES-256-GCM-decrypt(key, iv, ct, tag)      # null on auth failure
+ *
+ * Correctness of the Ed25519→X25519 conversion is verified by the round-trip test:
+ * the sender converts the recipient's Ed25519 *public* key to a Montgomery
+ * u-coordinate; the recipient derives the matching Montgomery *scalar* from its
+ * Ed25519 seed; ECDH on both sides yields the same shared secret (RFC 7748 §4.1).
+ */
+import { ed25519, x25519 } from "@noble/curves/ed25519.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { sha512 } from "@noble/hashes/sha2.js";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+const EPH_PUB_BYTES = 32;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+/** Fixed bytes prepended before the AEAD ciphertext: ephemeral pubkey + IV. */
+export const CONTENT_SEAL_OVERHEAD_BYTES = EPH_PUB_BYTES + IV_BYTES;
+const HKDF_INFO = new TextEncoder().encode("cello-content-park-v1");
+const Fp = ed25519.Point.Fp;
+/**
+ * Convert an Ed25519 public key (Edwards y) to a Montgomery u-coordinate
+ * (RFC 7748 §4.1): u = (1 + y) / (1 - y) mod p.
+ * Returns null if the point is invalid or maps to the singular point (y == 1).
+ */
+function edwardsPubToMontgomeryU(edPub) {
+    try {
+        const pt = ed25519.Point.fromBytes(edPub);
+        const y = pt.toAffine().y;
+        const denom = Fp.sub(Fp.ONE, y);
+        if (Fp.is0(denom))
+            return null;
+        const u = Fp.div(Fp.add(Fp.ONE, y), denom);
+        return Fp.toBytes(u);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Derive the X25519 (Montgomery) scalar from an Ed25519 seed, per RFC 8032 §5.1.5
+ * key-derivation + RFC 7748 clamping. This is the same scalar Ed25519 uses, which
+ * is birationally compatible with the public-key conversion above.
+ */
+function ed25519SeedToMontgomeryScalar(seed) {
+    const h = sha512(seed.subarray(0, 32));
+    const s = h.slice(0, 32);
+    s[0] &= 248;
+    s[31] &= 127;
+    s[31] |= 64;
+    return s;
+}
+/** Encrypt `plaintext` to a recipient identified by their Ed25519 public key. */
+export function sealToRecipient(recipientEd25519Pub, plaintext) {
+    const uPub = edwardsPubToMontgomeryU(recipientEd25519Pub);
+    if (!uPub) {
+        throw new Error("content-seal: invalid recipient Ed25519 public key");
+    }
+    const ephSk = x25519.utils.randomSecretKey();
+    const ephPk = x25519.getPublicKey(ephSk);
+    const shared = x25519.getSharedSecret(ephSk, uPub);
+    const key = hkdf(sha256, shared, ephPk, HKDF_INFO, KEY_BYTES);
+    const iv = new Uint8Array(randomBytes(IV_BYTES));
+    const cipher = createCipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
+    const ct = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return new Uint8Array(Buffer.concat([Buffer.from(ephPk), Buffer.from(iv), ct, tag]));
+}
+/**
+ * Decrypt a sealed blob using the recipient's Ed25519 identity seed.
+ * Returns null on any failure (wrong key, tamper, malformed) — never throws.
+ */
+export function openSealed(recipientEd25519Seed, blob) {
+    if (blob.length < CONTENT_SEAL_OVERHEAD_BYTES + TAG_BYTES)
+        return null;
+    try {
+        const ephPk = blob.subarray(0, EPH_PUB_BYTES);
+        const iv = blob.subarray(EPH_PUB_BYTES, EPH_PUB_BYTES + IV_BYTES);
+        const ctAndTag = blob.subarray(EPH_PUB_BYTES + IV_BYTES);
+        const ct = ctAndTag.subarray(0, ctAndTag.length - TAG_BYTES);
+        const tag = ctAndTag.subarray(ctAndTag.length - TAG_BYTES);
+        const montSk = ed25519SeedToMontgomeryScalar(recipientEd25519Seed);
+        const shared = x25519.getSharedSecret(montSk, ephPk);
+        const key = hkdf(sha256, shared, ephPk, HKDF_INFO, KEY_BYTES);
+        const decipher = createDecipheriv("aes-256-gcm", Buffer.from(key), Buffer.from(iv));
+        decipher.setAuthTag(Buffer.from(tag));
+        const pt = Buffer.concat([decipher.update(Buffer.from(ct)), decipher.final()]);
+        return new Uint8Array(pt);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=content-seal.js.map

package/dist/content-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-seal.js","sourceRoot":"","sources":["../src/content-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEpE,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAEpE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAE5B;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,KAAiB;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,IAAgB;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACZ,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC;IACb,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,mBAA+B,EAAE,SAAqB;IACpF,MAAM,IAAI,GAAG,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAE9D,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,oBAAgC,EAAE,IAAgB;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,2BAA2B,GAAG,SAAS;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,QAAQ,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,6BAA6B,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/E,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/ed25519.d.ts

@@ -5,6 +5,8 @@ export declare class InMemoryKeyProvider implements KeyProvider {
     constructor(seed: Uint8Array);
     getPublicKey(): Promise<PublicKey>;
     sign(data: Uint8Array): Promise<Signature>;
+    /** CELLO-M7-MSG-001: open a content-park sealed blob addressed to this identity key. */
+    openContentSeal(blob: Uint8Array): Promise<Uint8Array | null>;
     toJSON(): Record<string, string>;
     toString(): string;
     [INSPECT](): string;
@@ -15,6 +17,8 @@ export declare class FileKeyProvider implements KeyProvider {
     static load(path: string): Promise<FileKeyProvider>;
     getPublicKey(): Promise<PublicKey>;
     sign(data: Uint8Array): Promise<Signature>;
+    /** CELLO-M7-MSG-001: open a content-park sealed blob addressed to this identity key. */
+    openContentSeal(blob: Uint8Array): Promise<Uint8Array | null>;
     toJSON(): Record<string, unknown>;
     toString(): string;
     [INSPECT](): string;

package/dist/ed25519.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEpE,QAAA,MAAM,OAAO,eAA2C,CAAC;AAOzD,qBAAa,mBAAoB,YAAW,WAAW;;gBAIzC,IAAI,EAAE,UAAU;IAMtB,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAIlC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAIhD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIhC,QAAQ,IAAI,MAAM;IAIlB,CAAC,OAAO,CAAC,IAAI,MAAM;CAGpB;AAED,qBAAa,eAAgB,YAAW,WAAW;;IAGjD,OAAO;WAIM,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAuDnD,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAIlC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAIhD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC,QAAQ,IAAI,MAAM;IAIlB,CAAC,OAAO,CAAC,IAAI,MAAM;CAGpB;AAED,wBAAgB,eAAe,IAAI,mBAAmB,CAErD;AAED,wBAAgB,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAM5F"}
+{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGpE,QAAA,MAAM,OAAO,eAA2C,CAAC;AAOzD,qBAAa,mBAAoB,YAAW,WAAW;;gBAIzC,IAAI,EAAE,UAAU;IAMtB,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAIlC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAIhD,wFAAwF;IAClF,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAInE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIhC,QAAQ,IAAI,MAAM;IAIlB,CAAC,OAAO,CAAC,IAAI,MAAM;CAGpB;AAED,qBAAa,eAAgB,YAAW,WAAW;;IAGjD,OAAO;WAIM,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAuDnD,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAIlC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAIhD,wFAAwF;IAClF,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAInE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjC,QAAQ,IAAI,MAAM;IAIlB,CAAC,OAAO,CAAC,IAAI,MAAM;CAGpB;AAED,wBAAgB,eAAe,IAAI,mBAAmB,CAErD;AAED,wBAAgB,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAM5F"}

package/dist/ed25519.js

@@ -2,6 +2,7 @@ import { ed25519 } from "@noble/curves/ed25519.js";
 import { randomBytes } from "@noble/hashes/utils.js";
 import { readFile, rename, mkdir, open as fsOpen } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { openSealed } from "./content-seal.js";
 const INSPECT = Symbol.for("nodejs.util.inspect.custom");
 const KEY_FILE_MAGIC = new Uint8Array([0xce, 0x11, 0x0e, 0x01]); // "CELLO\x01"
 const KEY_FILE_VERSION = 1;
@@ -23,6 +24,10 @@ export class InMemoryKeyProvider {
     async sign(data) {
         return ed25519.sign(data, this.#seed);
     }
+    /** CELLO-M7-MSG-001: open a content-park sealed blob addressed to this identity key. */
+    async openContentSeal(blob) {
+        return openSealed(this.#seed, blob);
+    }
     toJSON() {
         return { type: "InMemoryKeyProvider", publicKey: Buffer.from(this.#publicKey).toString("hex") };
     }
@@ -96,6 +101,10 @@ export class FileKeyProvider {
     async sign(data) {
         return this.#inner.sign(data);
     }
+    /** CELLO-M7-MSG-001: open a content-park sealed blob addressed to this identity key. */
+    async openContentSeal(blob) {
+        return this.#inner.openContentSeal(blob);
+    }
     toJSON() {
         return { type: "FileKeyProvider", publicKey: this.#inner.toJSON().publicKey };
     }

package/dist/ed25519.js.map

@@ -1 +1 @@
-{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AACzD,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc;AAC/E,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,8CAA8C;AAC9C,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC;AAE7D,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAa;IAClB,UAAU,CAAY;IAE/B,YAAY,IAAgB;QAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,QAAQ;QACN,OAAO,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;IACvF,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAsB;IAErC,YAAoB,KAA0B;QAC5C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY;QAC5B,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YACnG,CAAC;YACD,sCAAsC;QACxC,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACjC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,aAAa,SAAS,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3H,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,gBAAgB,EAAE,CAAC;gBACpD,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,qCAAqC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACnH,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;YAC1F,OAAO,IAAI,eAAe,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,gDAAgD;QAChD,qFAAqF;QACrF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAExB,OAAO,IAAI,eAAe,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;IAChF,CAAC;IAED,QAAQ;QACN,OAAO,0BAA0B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,SAAS,GAAG,CAAC;IACrE,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,mBAAmB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAoB,EAAE,IAAgB,EAAE,SAAoB;IACjF,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../src/ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AACzD,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc;AAC/E,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,8CAA8C;AAC9C,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC;AAE7D,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAAa;IAClB,UAAU,CAAY;IAE/B,YAAY,IAAgB;QAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,eAAe,CAAC,IAAgB;QACpC,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,QAAQ;QACN,OAAO,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;IACvF,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAsB;IAErC,YAAoB,KAA0B;QAC5C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY;QAC5B,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YACnG,CAAC;YACD,sCAAsC;QACxC,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACjC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,uCAAuC,aAAa,SAAS,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3H,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,gBAAgB,EAAE,CAAC;gBACpD,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,qCAAqC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACnH,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;YAC1F,OAAO,IAAI,eAAe,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,gDAAgD;QAChD,qFAAqF;QACrF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAExB,OAAO,IAAI,eAAe,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,eAAe,CAAC,IAAgB;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,CAAC;IAChF,CAAC;IAED,QAAQ;QACN,OAAO,0BAA0B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,SAAS,GAAG,CAAC;IACrE,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,mBAAmB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAoB,EAAE,IAAgB,EAAE,SAAoB;IACjF,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -11,4 +11,10 @@ export { verifyFrostSignature } from "./frost/frost-threshold-signer.js";
 export { ed25519_FROST } from "@noble/curves/ed25519.js";
 export { buildCheckpointTbs, computeCheckpointHash } from "./checkpoint.js";
 export { buildRelayRegistrationTbs, verifyRelayRegistrationSignature } from "./relay-registration.js";
+export { sealToRecipient, openSealed, CONTENT_SEAL_OVERHEAD_BYTES } from "./content-seal.js";
+export type { ManifestVerifyResult, ManifestVerifyDiagnostics, ManifestVerifySkipReason, ManifestVerifySkippedEntry, ConsortiumManifestInput } from "./manifest.js";
+export { canonicalManifestBody, verifyManifest } from "./manifest.js";
+export { CONSORTIUM_ROOT_KEYS, CONSORTIUM_THRESHOLD, TEST_CONSORTIUM_ROOT_KEYS, TEST_CONSORTIUM_THRESHOLD, } from "./consortium-keys.js";
+export type { TestConsortiumNode, MakeTestManifestOpts } from "./manifest-test-fixture.js";
+export { makeTestManifest, TEST_DIRECTORY_NODE_KEYPAIR } from "./manifest-test-fixture.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC7F,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGzE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG5E,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC7F,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClG,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3F,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3F,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGzE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAG5E,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAGtG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAG7F,YAAY,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACpK,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -11,4 +11,9 @@ export { ed25519_FROST } from "@noble/curves/ed25519.js";
 export { buildCheckpointTbs, computeCheckpointHash } from "./checkpoint.js";
 // FEDERATION-003: relay registration TBS and signature verification
 export { buildRelayRegistrationTbs, verifyRelayRegistrationSignature } from "./relay-registration.js";
+// M7-MSG-001: recipient content sealed box (E2E encryption for parked content)
+export { sealToRecipient, openSealed, CONTENT_SEAL_OVERHEAD_BYTES } from "./content-seal.js";
+export { canonicalManifestBody, verifyManifest } from "./manifest.js";
+export { CONSORTIUM_ROOT_KEYS, CONSORTIUM_THRESHOLD, TEST_CONSORTIUM_ROOT_KEYS, TEST_CONSORTIUM_THRESHOLD, } from "./consortium-keys.js";
+export { makeTestManifest, TEST_DIRECTORY_NODE_KEYPAIR } from "./manifest-test-fixture.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7F,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE3F,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU3F,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,iGAAiG;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,iFAAiF;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,8EAA8E;AAC9E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,oEAAoE;AACpE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7F,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE3F,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAU3F,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,iGAAiG;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,iFAAiF;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,8EAA8E;AAC9E,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,oEAAoE;AACpE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAEtG,+EAA+E;AAC/E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAI7F,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/manifest-test-fixture.d.ts

@@ -0,0 +1,59 @@
+/**
+ * M7-MANIFEST-001 / M7-MANIFEST-002 — Test fixture for consortium manifest creation.
+ *
+ * Provides makeTestManifest() which creates a fully-signed ConsortiumManifest
+ * using deterministic test officer keys. The manifest is signed with officer
+ * indices 0, 1, 2 (meeting the threshold of 3).
+ *
+ * The private keys (TEST_OFFICER_SEEDS) are defined here and NOT exported from
+ * the package index (AC-011). They are only available via direct import of this
+ * file for internal test use.
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ */
+import type { ConsortiumManifestInput } from "./manifest.js";
+/**
+ * Deterministic test officer seeds (private keys). Used to derive
+ * TEST_CONSORTIUM_ROOT_KEYS and to sign test manifests.
+ *
+ * NOT exported from the package index — only from this file for internal use.
+ */
+export declare const TEST_OFFICER_SEEDS: readonly [Uint8Array, Uint8Array, Uint8Array, Uint8Array, Uint8Array];
+/** Node entry for makeTestManifest input. Structurally matches ConsortiumNode from protocol-types. */
+export type TestConsortiumNode = {
+    nodeId: string;
+    pubkey: string;
+    region: string;
+    provider: "aws" | "gcp" | "azure";
+    endpoint: string;
+};
+export interface MakeTestManifestOpts {
+    version?: number;
+    notBefore?: string;
+    expires?: string;
+}
+/**
+ * Create a test ConsortiumManifest signed by officers 0, 1, 2.
+ *
+ * Pseudocode:
+ *   1. Build the manifest body with provided nodes and optional overrides.
+ *   2. Compute canonical body bytes via canonicalManifestBody.
+ *   3. Sign with TEST_OFFICER_SEEDS[0], [1], [2] using Ed25519 (RFC 8032).
+ *   4. Return the complete manifest with 3 valid signatures.
+ */
+export declare function makeTestManifest(nodes: TestConsortiumNode[], opts?: MakeTestManifestOpts): ConsortiumManifestInput;
+/**
+ * Deterministic test directory node keypair for step-5 challenge signing tests.
+ *
+ * Derived from SHA-256("cello-test-directory-node-key-0") as a 32-byte seed.
+ * This seed is DISTINCT from TEST_OFFICER_SEEDS (0x01..0x05) — it is NOT an
+ * officer key. It represents a directory node's per-node Ed25519 signing key.
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ * Seed derivation: SHA-256("cello-test-directory-node-key-0") — deterministic.
+ */
+export declare const TEST_DIRECTORY_NODE_KEYPAIR: {
+    readonly privateKeyHex: "707a125efaed6d467e8cac1758b3a87af260a5b9c7a6f0d6a74d364c1d5dacd9";
+    readonly publicKeyHex: "b93092dd6bf675c00a895abc05503dfd1214a170a2d945d97bab81fd5cfe6a1b";
+};
+//# sourceMappingURL=manifest-test-fixture.d.ts.map

package/dist/manifest-test-fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-test-fixture.d.ts","sourceRoot":"","sources":["../src/manifest-test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAM3F,CAAC;AAEX,sGAAsG;AACtG,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,kBAAkB,EAAE,EAC3B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,uBAAuB,CAoBzB;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B;;;CAG9B,CAAC"}

package/dist/manifest-test-fixture.js

@@ -0,0 +1,71 @@
+/**
+ * M7-MANIFEST-001 / M7-MANIFEST-002 — Test fixture for consortium manifest creation.
+ *
+ * Provides makeTestManifest() which creates a fully-signed ConsortiumManifest
+ * using deterministic test officer keys. The manifest is signed with officer
+ * indices 0, 1, 2 (meeting the threshold of 3).
+ *
+ * The private keys (TEST_OFFICER_SEEDS) are defined here and NOT exported from
+ * the package index (AC-011). They are only available via direct import of this
+ * file for internal test use.
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ */
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { canonicalManifestBody } from "./manifest.js";
+/**
+ * Deterministic test officer seeds (private keys). Used to derive
+ * TEST_CONSORTIUM_ROOT_KEYS and to sign test manifests.
+ *
+ * NOT exported from the package index — only from this file for internal use.
+ */
+export const TEST_OFFICER_SEEDS = [
+    new Uint8Array(32).fill(0x01),
+    new Uint8Array(32).fill(0x02),
+    new Uint8Array(32).fill(0x03),
+    new Uint8Array(32).fill(0x04),
+    new Uint8Array(32).fill(0x05),
+];
+/**
+ * Create a test ConsortiumManifest signed by officers 0, 1, 2.
+ *
+ * Pseudocode:
+ *   1. Build the manifest body with provided nodes and optional overrides.
+ *   2. Compute canonical body bytes via canonicalManifestBody.
+ *   3. Sign with TEST_OFFICER_SEEDS[0], [1], [2] using Ed25519 (RFC 8032).
+ *   4. Return the complete manifest with 3 valid signatures.
+ */
+export function makeTestManifest(nodes, opts) {
+    const manifest = {
+        version: opts?.version ?? 1,
+        not_before: opts?.notBefore ?? "2026-01-01T00:00:00Z",
+        expires: opts?.expires ?? "2027-01-01T00:00:00Z",
+        nodes: nodes,
+        signatures: [],
+    };
+    // Compute canonical body for signing
+    const body = canonicalManifestBody(manifest);
+    // Sign with officers 0, 1, 2 — meeting threshold of 3
+    const signatures = [0, 1, 2].map((idx) => ({
+        officerIndex: idx,
+        signature: Buffer.from(ed25519.sign(body, TEST_OFFICER_SEEDS[idx])).toString("hex"),
+    }));
+    manifest.signatures = signatures;
+    return manifest;
+}
+// ─── M7-MANIFEST-002: Test directory node keypair ────────────────────────────
+/**
+ * Deterministic test directory node keypair for step-5 challenge signing tests.
+ *
+ * Derived from SHA-256("cello-test-directory-node-key-0") as a 32-byte seed.
+ * This seed is DISTINCT from TEST_OFFICER_SEEDS (0x01..0x05) — it is NOT an
+ * officer key. It represents a directory node's per-node Ed25519 signing key.
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ * Seed derivation: SHA-256("cello-test-directory-node-key-0") — deterministic.
+ */
+export const TEST_DIRECTORY_NODE_KEYPAIR = {
+    privateKeyHex: "707a125efaed6d467e8cac1758b3a87af260a5b9c7a6f0d6a74d364c1d5dacd9",
+    publicKeyHex: "b93092dd6bf675c00a895abc05503dfd1214a170a2d945d97bab81fd5cfe6a1b",
+};
+//# sourceMappingURL=manifest-test-fixture.js.map

package/dist/manifest-test-fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-test-fixture.js","sourceRoot":"","sources":["../src/manifest-test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0E;IACvG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACrB,CAAC;AAiBX;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAA2B,EAC3B,IAA2B;IAE3B,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC;QAC3B,UAAU,EAAE,IAAI,EAAE,SAAS,IAAI,sBAAsB;QACrD,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,sBAAsB;QAChD,KAAK,EAAE,KAA2C;QAClD,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,qCAAqC;IACrC,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAE7C,sDAAsD;IACtD,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACzC,YAAY,EAAE,GAAG;QACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACpF,CAAC,CAAC,CAAC;IAEJ,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,aAAa,EAAE,kEAAkE;IACjF,YAAY,EAAE,kEAAkE;CACxE,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,89 @@
+/**
+ * M7-MANIFEST-001 — Consortium manifest verification.
+ *
+ * Provides canonical serialization and threshold signature verification for
+ * ConsortiumManifest instances. The verification logic:
+ *
+ * 1. Computes the canonical body bytes (all fields except `signatures`,
+ *    object keys sorted lexicographically at every nesting level, no whitespace,
+ *    UTF-8 encoded).
+ * 2. For each signature entry, verifies it against the officer key at the
+ *    specified index.
+ * 3. Counts only unique valid officer indices — duplicates count once.
+ * 4. Returns ok: true if unique valid count >= threshold.
+ *
+ * Security properties:
+ * - Out-of-bounds officer indices are silently skipped (AC-008).
+ * - Malformed hex is caught gracefully, never throws (AC-009).
+ * - Duplicate officer indices count as 1 (SI-001).
+ * - Canonical serialization is insertion-order independent (SI-002).
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ */
+/**
+ * Structural type for ConsortiumManifest — compatible with
+ * @cello-protocol/protocol-types without creating a circular dependency
+ * (protocol-types depends on crypto).
+ */
+export interface ConsortiumManifestInput {
+    version: number;
+    not_before: string;
+    expires: string;
+    nodes: readonly Record<string, unknown>[];
+    signatures: readonly {
+        officerIndex: number;
+        signature: string;
+    }[];
+    [key: string]: unknown;
+}
+export type ManifestVerifySkipReason = "out_of_bounds" | "duplicate" | "malformed_signature" | "malformed_key" | "verification_failed";
+export interface ManifestVerifySkippedEntry {
+    index: number;
+    reason: ManifestVerifySkipReason;
+    error?: string;
+}
+export interface ManifestVerifyDiagnostics {
+    threshold: number;
+    validOfficers: number[];
+    skippedEntries: ManifestVerifySkippedEntry[];
+}
+export type ManifestVerifyResult = {
+    ok: true;
+    signerCount: number;
+} | {
+    ok: false;
+    reason: "manifest_signature_invalid";
+    detail: string;
+    diagnostics: ManifestVerifyDiagnostics;
+};
+/**
+ * Produce the canonical byte representation of a manifest body for signing.
+ *
+ * Pseudocode (RFC 8032 — signing input):
+ *   1. Copy all fields from manifest EXCEPT `signatures`.
+ *   2. Sort object keys lexicographically at EVERY nesting level (recursive).
+ *   3. Serialize as JSON with no whitespace and no trailing newline.
+ *   4. Encode as UTF-8 bytes.
+ *
+ * The resulting bytes are the message that officers sign with Ed25519.
+ */
+export declare function canonicalManifestBody(manifest: ConsortiumManifestInput): Uint8Array;
+/**
+ * Verify a consortium manifest against a set of officer root keys.
+ *
+ * Pseudocode (RFC 8032 — Ed25519 verification):
+ *   1. Compute canonical body bytes via canonicalManifestBody.
+ *   2. For each signature entry in manifest.signatures:
+ *      a. If officerIndex is out of bounds (< 0 or >= rootKeys.length), skip.
+ *      b. Decode the hex signature to bytes. If malformed, skip.
+ *      c. Decode the root key at officerIndex to bytes. If malformed, skip.
+ *      d. Verify: ed25519.verify(signature, body, publicKey).
+ *      e. If valid AND officerIndex not already in verified set, add it (SI-001).
+ *      f. If valid BUT officerIndex already verified, mark as duplicate.
+ *   3. If |verified signers| >= threshold → { ok: true, signerCount }.
+ *   4. Otherwise → { ok: false, reason, detail }.
+ *
+ * This function NEVER throws. All error conditions produce a result value.
+ */
+export declare function verifyManifest(manifest: ConsortiumManifestInput, rootKeys: readonly string[], threshold: number): ManifestVerifyResult;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC1C,UAAU,EAAE,SAAS;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG,WAAW,GAAG,qBAAqB,GAAG,eAAe,GAAG,qBAAqB,CAAC;AAEvI,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,wBAAwB,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,0BAA0B,EAAE,CAAC;CAC9C;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,4BAA4B,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAIhH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,UAAU,CAcnF;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,uBAAuB,EACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,SAAS,EAAE,MAAM,GAChB,oBAAoB,CA8EtB"}

package/dist/manifest.js

@@ -0,0 +1,170 @@
+/**
+ * M7-MANIFEST-001 — Consortium manifest verification.
+ *
+ * Provides canonical serialization and threshold signature verification for
+ * ConsortiumManifest instances. The verification logic:
+ *
+ * 1. Computes the canonical body bytes (all fields except `signatures`,
+ *    object keys sorted lexicographically at every nesting level, no whitespace,
+ *    UTF-8 encoded).
+ * 2. For each signature entry, verifies it against the officer key at the
+ *    specified index.
+ * 3. Counts only unique valid officer indices — duplicates count once.
+ * 4. Returns ok: true if unique valid count >= threshold.
+ *
+ * Security properties:
+ * - Out-of-bounds officer indices are silently skipped (AC-008).
+ * - Malformed hex is caught gracefully, never throws (AC-009).
+ * - Duplicate officer indices count as 1 (SI-001).
+ * - Canonical serialization is insertion-order independent (SI-002).
+ *
+ * Crypto reference: RFC 8032 (Ed25519).
+ */
+import { ed25519 } from "@noble/curves/ed25519.js";
+// ─── Canonical serialization ─────────────────────────────────────────────────
+/**
+ * Produce the canonical byte representation of a manifest body for signing.
+ *
+ * Pseudocode (RFC 8032 — signing input):
+ *   1. Copy all fields from manifest EXCEPT `signatures`.
+ *   2. Sort object keys lexicographically at EVERY nesting level (recursive).
+ *   3. Serialize as JSON with no whitespace and no trailing newline.
+ *   4. Encode as UTF-8 bytes.
+ *
+ * The resulting bytes are the message that officers sign with Ed25519.
+ */
+export function canonicalManifestBody(manifest) {
+    // Step 1: exclude signatures — build body object with all fields except signatures
+    const body = {};
+    for (const key of Object.keys(manifest)) {
+        if (key !== "signatures") {
+            body[key] = manifest[key];
+        }
+    }
+    // Step 2+3: sort keys recursively and serialize
+    const json = JSON.stringify(body, sortedReplacer);
+    // Step 4: UTF-8 encode
+    return new TextEncoder().encode(json);
+}
+/**
+ * JSON.stringify replacer that sorts object keys lexicographically at every level.
+ * Arrays preserve their order (insertion-order independent only for objects).
+ */
+function sortedReplacer(_key, value) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        const sorted = {};
+        for (const k of Object.keys(value).sort()) {
+            sorted[k] = value[k];
+        }
+        return sorted;
+    }
+    return value;
+}
+// ─── Threshold signature verification ────────────────────────────────────────
+/**
+ * Verify a consortium manifest against a set of officer root keys.
+ *
+ * Pseudocode (RFC 8032 — Ed25519 verification):
+ *   1. Compute canonical body bytes via canonicalManifestBody.
+ *   2. For each signature entry in manifest.signatures:
+ *      a. If officerIndex is out of bounds (< 0 or >= rootKeys.length), skip.
+ *      b. Decode the hex signature to bytes. If malformed, skip.
+ *      c. Decode the root key at officerIndex to bytes. If malformed, skip.
+ *      d. Verify: ed25519.verify(signature, body, publicKey).
+ *      e. If valid AND officerIndex not already in verified set, add it (SI-001).
+ *      f. If valid BUT officerIndex already verified, mark as duplicate.
+ *   3. If |verified signers| >= threshold → { ok: true, signerCount }.
+ *   4. Otherwise → { ok: false, reason, detail }.
+ *
+ * This function NEVER throws. All error conditions produce a result value.
+ */
+export function verifyManifest(manifest, rootKeys, threshold) {
+    // A manifest with no nodes is structurally invalid — the consumer has no nodes
+    // to connect to and cannot distinguish "empty by design" from "tampered" (AC-003(d)).
+    if (manifest.nodes.length === 0) {
+        return {
+            ok: false,
+            reason: "manifest_signature_invalid",
+            detail: "manifest contains no nodes",
+            diagnostics: { threshold, validOfficers: [], skippedEntries: [] },
+        };
+    }
+    const body = canonicalManifestBody(manifest);
+    const verifiedIndices = new Set();
+    const skippedEntries = [];
+    for (const entry of manifest.signatures) {
+        const { officerIndex, signature } = entry;
+        // Skip out-of-bounds indices (AC-008)
+        if (officerIndex < 0 || officerIndex >= rootKeys.length) {
+            skippedEntries.push({ index: officerIndex, reason: "out_of_bounds" });
+            continue;
+        }
+        // Decode signature hex to bytes (Ed25519 signature = 64 bytes)
+        const sigBytes = hexToBytes(signature, 64);
+        if (sigBytes === null) {
+            skippedEntries.push({ index: officerIndex, reason: "malformed_signature" });
+            continue;
+        }
+        // Decode public key hex to bytes (Ed25519 public key = 32 bytes)
+        const pubkeyBytes = hexToBytes(rootKeys[officerIndex], 32);
+        if (pubkeyBytes === null) {
+            skippedEntries.push({ index: officerIndex, reason: "malformed_key" });
+            continue;
+        }
+        // Verify Ed25519 signature (RFC 8032)
+        let isValid = false;
+        try {
+            isValid = ed25519.verify(sigBytes, body, pubkeyBytes);
+        }
+        catch (err) {
+            skippedEntries.push({ index: officerIndex, reason: "verification_failed", error: err instanceof Error ? err.message : String(err) });
+            continue;
+        }
+        if (!isValid) {
+            skippedEntries.push({ index: officerIndex, reason: "verification_failed" });
+            continue;
+        }
+        // Check uniqueness AFTER verification — only first valid sig per officer counts (SI-001)
+        if (verifiedIndices.has(officerIndex)) {
+            skippedEntries.push({ index: officerIndex, reason: "duplicate" });
+            continue;
+        }
+        verifiedIndices.add(officerIndex);
+    }
+    const signerCount = verifiedIndices.size;
+    if (signerCount >= threshold) {
+        return { ok: true, signerCount };
+    }
+    return {
+        ok: false,
+        reason: "manifest_signature_invalid",
+        detail: `${signerCount} valid of ${threshold} required`,
+        diagnostics: {
+            threshold,
+            validOfficers: Array.from(verifiedIndices).sort((a, b) => a - b),
+            skippedEntries,
+        },
+    };
+}
+// ─── Internal helpers ────────────────────────────────────────────────────────
+/**
+ * Decode a hex string to Uint8Array with expected byte length validation.
+ * Returns null if the input is not valid hex or doesn't match expectedBytes.
+ * Never throws.
+ */
+function hexToBytes(hex, expectedBytes) {
+    if (hex.length !== expectedBytes * 2) {
+        return null;
+    }
+    // Strict hex validation before parsing — parseInt("0g", 16) returns 0 (not NaN),
+    // so the NaN check alone does not catch strings with invalid non-leading characters.
+    if (!/^[0-9a-fA-F]+$/.test(hex)) {
+        return null;
+    }
+    const bytes = new Uint8Array(expectedBytes);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAoCnD,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiC;IACrE,mFAAmF;IACnF,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,GAAI,QAAoC,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAElD,uBAAuB;IACvB,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,KAAc;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,CAAC,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,QAA2B,EAC3B,SAAiB;IAEjB,+EAA+E;IAC/E,sFAAsF;IACtF,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4BAA4B;YACpC,MAAM,EAAE,4BAA4B;YACpC,WAAW,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,cAAc,GAAiC,EAAE,CAAC;IAExD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAE1C,sCAAsC;QACtC,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxD,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QAED,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QAED,iEAAiE;QACjE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QAED,sCAAsC;QACtC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrI,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QAED,yFAAyF;QACzF,IAAI,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC;IAEzC,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACnC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,GAAG,WAAW,aAAa,SAAS,WAAW;QACvD,WAAW,EAAE;YACX,SAAS;YACT,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAChE,cAAc;SACf;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,aAAqB;IACpD,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,iFAAiF;IACjF,qFAAqF;IACrF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/types.d.ts

@@ -3,6 +3,14 @@ export type Signature = Uint8Array;
 export interface KeyProvider {
     getPublicKey(): Promise<PublicKey>;
     sign(data: Uint8Array): Promise<Signature>;
+    /**
+     * CELLO-M7-MSG-001: open a content-park sealed blob addressed to THIS identity key
+     * (the receiver-side counterpart of `sealToRecipient`). Returns the plaintext, or
+     * null on any failure (wrong key / tamper / malformed). OPTIONAL — only providers
+     * that hold the Ed25519 seed (InMemory/File identity keys) implement it; threshold
+     * and signing-only providers do not. Callers must feature-detect before use.
+     */
+    openContentSeal?(blob: Uint8Array): Promise<Uint8Array | null>;
 }
 export interface KeyFileCorruptError {
     reason: "key_file_corrupt";

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AAEnC,MAAM,WAAW,WAAW;IAC1B,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AACnC,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC;AAEnC,MAAM,WAAW,WAAW;IAC1B,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/crypto",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "private": false,
   "type": "module",
   "engines": {