@cello-protocol/daemon 0.0.179 → 0.0.181

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAOrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAA6C,MAAM,2BAA2B,CAAC;AAO1G,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA2BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAYlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACpE;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CAuC3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAOrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAmC,KAAK,UAAU,EAAsB,MAAM,iBAAiB,CAAC;AAEvG,OAAO,EAAE,kBAAkB,EAA6C,MAAM,2BAA2B,CAAC;AAO1G,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiB7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAS5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA6BnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAYlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACpE;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACxC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CAuC3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}

package/dist/daemon.js

@@ -68,6 +68,8 @@ import { createSealCoordinator } from "./seal-coordinator.js";
 import { createTelegramDoorbell } from "./telegram-doorbell.js";
 import { registerSessionContentHandlers } from "./session-content-handlers.js";
 import { createDocumentLayer, agentPublicKeyFromId } from "./document-layer.js";
+import { isDocumentFrame } from "./document-frame-router.js";
+import { INBOUND_INJECTION_BLOCKED } from "@cello-protocol/gateway";
 import { registerDocumentHandlers } from "./document-handlers.js";
 import { wireContentHash } from "./wire-content-hash.js";
 import { DocumentPublish } from "./document-publish.js";
@@ -3629,6 +3631,63 @@ async function startDaemonHoldingLock(config, singletonLock) {
     const documentLayer = createDocumentLayer({
         db: sessionNodeManager.getDb(),
         logger,
+        // DOD-DOC-SCREEN-CONTENT-1 — the gateway, reached with TEXT for once.
+        //
+        // The same program that screens conversation messages, called from the document gate's shadow
+        // with the readable projected text instead of the signed binary envelope the wire carries.
+        //
+        // ── WHICH VERDICTS REFUSE, AND WHY IT IS NOT "ALL OF THEM" ────────────────────────────────
+        //
+        // ONLY the injection verdict. The gateway runs its whole inbound composition, and two of its
+        // other terminal blocks must not refuse a document:
+        //
+        //   - the LANGUAGE ALLOWLIST (default: Latin only). A shared document written in Japanese,
+        //     Arabic or Russian is ordinary use, and every update would be refused — permanently, since
+        //     the same bytes are the same language on redelivery. The allowlist exists so a jailbreak
+        //     phrased in a low-resource language cannot dodge English-trained screening; refusing a
+        //     colleague's document outright is a far worse trade than that gap, and the character
+        //     denylist still runs on every script.
+        //   - the SIZE CAP, which is the sanitizer's per-message cap and not this path's limit. The
+        //     gate already bounds an update and the whole document by its own numbers.
+        //
+        // A REDACT verdict is never honoured: rewriting one holder's replica is permanent divergence
+        // both sides converge on and neither can see.
+        //
+        // A TRANSIENT block means the gateway is DOWN or its screener faulted. The update is admitted —
+        // holding document convergence hostage to an optional layer breaks a layer that degrades by
+        // design — but it is LOGGED BY NAME, because a weaker guarantee that looks identical to the
+        // stronger one at every surface is how this whole class of defect survives.
+        screenProjected: async (text, ctx) => {
+            const verdict = await config.securityGateway.screenInbound(new TextEncoder().encode(text), {
+                direction: "inbound",
+                agentName: ctx.ownerAgentId,
+                sessionId: ctx.documentId,
+                ...(ctx.correlationId !== undefined ? { correlationId: ctx.correlationId } : {}),
+            });
+            if (verdict.disposition !== "block")
+                return { block: false };
+            if (verdict.terminal !== true) {
+                logger.warn("document.inbound.screen.unavailable", {
+                    documentId: ctx.documentId,
+                    senderAgentId: ctx.senderAgentId,
+                    reason: verdict.reason,
+                    consequence: "the update was admitted WITHOUT a semantic screen",
+                    correlationId: ctx.correlationId,
+                });
+                return { block: false };
+            }
+            if (verdict.reason !== INBOUND_INJECTION_BLOCKED) {
+                logger.info("document.inbound.screen.not_applicable", {
+                    documentId: ctx.documentId,
+                    senderAgentId: ctx.senderAgentId,
+                    reason: verdict.reason,
+                    consequence: "a terminal block this path does not apply to documents — admitted",
+                    correlationId: ctx.correlationId,
+                });
+                return { block: false };
+            }
+            return { block: true, reason: verdict.reason };
+        },
         // M14-D5: a remote agent's id IS its K_local pubkey hex, so this needs no lookup — and a lookup
         // on the critical path of every signature check is precisely what it must not have.
         publicKeyFor: agentPublicKeyFromId,
@@ -3694,7 +3753,9 @@ async function startDaemonHoldingLock(config, singletonLock) {
             return provider.sign(tbs);
         },
     });
-    sessionNodeManager.setOnDocumentFrame(documentLayer.onDocumentFrame);
+    // The classify-only half rides the same setter so the router and the ingest cannot disagree
+    // about what a document frame is (DOD-DOC-SCREEN-CLASSIFY-1).
+    sessionNodeManager.setOnDocumentFrame(documentLayer.onDocumentFrame, isDocumentFrame);
     // M14 / DOD-DOC-DELIVERY-2 — the outbound half, wired only now that INBOUND-2 is. The ordering
     // constraint on the DoD line is real and this is where it is honoured: a delivery worker with no
     // inbound counterpart publishes envelopes nobody can answer, so every document would stall at the