@cello-protocol/daemon 0.0.15 → 0.0.17

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAoB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA8vH7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAoB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAyzH7E"}

package/dist/daemon.js

@@ -55,7 +55,7 @@ import { wireSessionCeremonyHandler, wireSessionOfferHandler, wireSealCeremonyHa
 import { reDeriveFrontiers, findInflatedFrontier } from "./seal-frontier-verify.js";
 import { LocalAutoNatStub } from "@cello-protocol/transport";
 import { startHttpManifestPoll } from "./http-manifest-poll.js";
-import { resolveDirectoryUrl } from "./directory-bootstrap.js";
+import { resolveDirectoryUrl, manifestNodesToEndpoints } from "./directory-bootstrap.js";
 /**
  * M7-SESSION-001 (H-1): canonical byte encoding of a SEAL-INTERRUPTED leaf for
  * Ed25519 signing/verification. Field order is fixed and deterministic. Both the
@@ -226,6 +226,10 @@ export async function startDaemon(config) {
     // M7 Keystone: the version of the verified manifest, surfaced in ConnectResult.
     // Stays 0 when no manifestProvider is configured (the M6 backward-compat path).
     let verifiedManifestVersion = 0;
+    // DOD-MANIFEST-1: the consortium node set resolved to live directory endpoints from
+    // the VERIFIED manifest — the N-node roster a T-of-N ceremony (DOD-DKG-1) fans out to.
+    // Empty in the M6 backward-compat path (no manifest) or if no node resolves.
+    let consortiumEndpoints = [];
     if (manifestProvider && manifestRootKeys && manifestThreshold !== undefined) {
         try {
             const manifest = await manifestProvider.loadAndVerify(manifestRootKeys, manifestThreshold);
@@ -262,6 +266,38 @@ export async function startDaemon(config) {
                         manifestVersion: manifest.version,
                         signerCount: manifest.signatures.length,
                     });
+                    // DOD-MANIFEST-1: resolve the FULL verified node set to live directory
+                    // endpoints (replaces the implicit single-endpoint assumption). This is the
+                    // roster T-of-N ceremonies fan out to. Availability-aware — a node that is
+                    // down is skipped, the rest still resolve (redundancy invariant: a ceremony
+                    // needs only T of N). The resolved count is logged so an operator sees the
+                    // real reachable consortium at startup; the ceremony layer (DOD-DKG-1)
+                    // re-checks the threshold against this roster and never silently falls back
+                    // to the single hardcoded endpoint for a missing/forged node.
+                    consortiumEndpoints = await manifestNodesToEndpoints(manifest.nodes, { logger });
+                    const declaredNodes = manifest.nodes.length;
+                    const resolvedNodes = consortiumEndpoints.length;
+                    // Carry the nodeId↔peerId pairing (not just peerIds) so a consumer/test can verify
+                    // each manifest identity bound to the right live directory, not merely the set.
+                    const consortiumLog = {
+                        manifestVersion: manifest.version,
+                        declaredNodes,
+                        resolvedNodes,
+                        nodes: consortiumEndpoints.map((e) => ({ nodeId: e.nodeId, peerId: e.peerId })),
+                    };
+                    // Degraded ≠ healthy: a verified manifest whose nodes don't all resolve must NOT
+                    // log at the same severity as a full roster. Threshold-REFUSAL (refusing to run a
+                    // ceremony below T) is DOD-DKG-1's gate; here we make the health signal loud so a
+                    // shrunken/empty roster is visible and never buried at info.
+                    if (resolvedNodes === 0) {
+                        logger.error("directory.consortium.none", consortiumLog);
+                    }
+                    else if (resolvedNodes < declaredNodes) {
+                        logger.warn("directory.consortium.partial", consortiumLog);
+                    }
+                    else {
+                        logger.info("directory.consortium.resolved", consortiumLog);
+                    }
                 }
             }
         }
@@ -286,6 +322,14 @@ export async function startDaemon(config) {
         throw new Error("Manifest verification failed. The daemon cannot start with an unverified manifest when manifestProvider is configured. " +
             "Check the logs for the specific failure reason (manifest_signature_invalid, manifest_expired, or manifest_version_rollback).");
     }
+    // DOD-SIGN-1: resolve the consortium roster for a session/seal FROST ceremony (same source as
+    // registration's DOD-DKG-1 path — the verified manifest, re-resolved at ceremony time). NULL when
+    // no consortium manifest is configured → single-node ceremony (M6/M7 back-compat). Shared by all
+    // wireSessionCeremonyHandler / wireSealCeremonyHandler call sites below.
+    const resolveConsortiumRoster = async () => {
+        const m = manifestProvider?.getCurrentManifest();
+        return m ? await manifestNodesToEndpoints(m.nodes, { logger }) : null;
+    };
     // CELLO-M7-CONN-001 (DOD-CONN-3): start the daemon-level HTTP manifest poll. It fetches
     // ${directoryHttpUrl}/manifest, verifies the threshold signature against the locally-pinned
     // root keys, applies anti-rollback + expiry, and adopts a newer manifest — independent of any
@@ -440,6 +484,7 @@ export async function startDaemon(config) {
             agentPubkeyHex,
             getNode: entry.getNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -450,6 +495,7 @@ export async function startDaemon(config) {
             agentPubkeyHex,
             getNode: entry.getNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -516,6 +562,7 @@ export async function startDaemon(config) {
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -525,6 +572,7 @@ export async function startDaemon(config) {
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
             getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
         });
@@ -1373,10 +1421,21 @@ export async function startDaemon(config) {
                 };
             }
             const persistence = getPersistence(name);
+            // DOD-DKG-1: resolve the full consortium roster from the VERIFIED manifest so the DKG fans
+            // across all N directory nodes. Re-resolved here (ceremony time) for fresh failover
+            // coordinates. NULL when NO manifest is configured (→ single-node DKG, M6/M7 back-compat);
+            // a (possibly EMPTY) array when a manifest IS configured. The null-vs-empty distinction is
+            // load-bearing: an empty roster (consortium configured but unreachable) must REFUSE in
+            // registration-manager, NOT downgrade to single-node (code-reviewer B1 / fallback-finder).
+            const currentManifest = manifestProvider?.getCurrentManifest();
+            const consortiumRoster = currentManifest
+                ? await manifestNodesToEndpoints(currentManifest.nodes, { logger })
+                : null;
             const ctx = new DaemonRegistrationContext({
                 signaling: agentSignaling,
                 getDirectoryNode: agentGetNode,
                 getDirectoryEndpoint: () => directoryEndpoint,
+                getConsortiumEndpoints: () => consortiumRoster,
                 keyProvider,
                 persistence,
                 logger,