@cello-protocol/daemon 0.0.181 → 0.0.183

package/dist/wire-content-hash.js

@@ -21,6 +21,89 @@
  * real daemons.
  */
 import { createHash } from "node:crypto";
+import { saltedContentHash } from "@cello-protocol/crypto";
+/**
+ * ─── THE ALGORITHM TRAVELS WITH THE HASH — `DOD-M15-SEALWIRE-1` part B1 ───────────────────────
+ *
+ * A salted content hash and an unsalted one are both 32 bytes in the same wire field. Nothing in
+ * the bytes distinguishes them, so a receiver handed one and told nothing has no way to know which
+ * it is holding — and gets `content_hash_mismatch` on every frame, which is the exact
+ * silent-discard failure this module's header says cost two real daemons.
+ *
+ * Hence a NAME on the wire, and three cases that must stay apart (Decisions Carried #15):
+ *
+ *   ABSENT            → `sha256`. A peer that predates the field. We know what it computed.
+ *   NAMED and KNOWN   → verify under that name.
+ *   NAMED and UNKNOWN → **refuse.** Not a legacy peer — an unreadable one. There is no correct hash
+ *                       to compare against, and falling back to `sha256` would compare two
+ *                       unrelated values and report a TAMPER for a version skew.
+ *
+ * ⚠️ RECEIVER FIRST — the ROLLOUT ORDER, which is still the rule. Every peer must be able to
+ * understand a salted frame before any peer sends one. Reversed, the first upgraded sender breaks
+ * every conversation it has with a peer that has not upgraded.
+ *
+ * > **⛔ THIS PARAGRAPH USED TO END "`no sender salts yet`", AND THAT IS NO LONGER TRUE.** It was
+ * > written during part B1, when the receiver had been taught to read the name and nothing produced
+ * > a salted one. **B2b-2 flipped it: a session holding an agreed salt now hashes under
+ * > `HMAC_SALT_V1`.** The sentence is rewritten rather than deleted because it is exactly the shape
+ * > `DOD-M15-CLAIM-COMMENTS-1` exists to catch — a comment asserting a property the code no longer
+ * > has — and deleting it would remove the evidence that someone reasoned from it.
+ * >
+ * > It was still being read as current on 2026-08-24: a spine test's park deposit declared `sha256`
+ * > on this comment's authority, the recipient recomputed under the name it was given, and the
+ * > mismatch surfaced as `content_hash_mismatch` — **a tamper verdict on a message nobody touched**,
+ * > which is precisely the failure the ALGORITHM-TRAVELS-WITH-THE-HASH rule above exists to prevent.
+ */
+export const CONTENT_HASH_ALGS = {
+    /** `sha256(0x00 ‖ content)` — what every build before the salt computes, and the absent-field default. */
+    SHA256: "sha256",
+    /** `hmac-sha256(salt, 0x00 ‖ content)` — Decision #9. HMAC, never `sha256(salt ‖ content)`. */
+    HMAC_SALT_V1: "hmac-sha256-salt-v1",
+};
+const KNOWN_ALGS = new Set(Object.values(CONTENT_HASH_ALGS));
+/** Whether this daemon can reproduce a hash under the given name. */
+export function isKnownContentHashAlg(alg) {
+    return KNOWN_ALGS.has(alg);
+}
+/**
+ * What a frame says it used, or a refusal naming the value.
+ *
+ * ABSENT is deliberately `undefined`/`null` ONLY — not "falsy". An empty string is a peer that sent
+ * a name we cannot read, not a peer that sent no name, and folding the two together would verify a
+ * malformed frame as legacy instead of telling its sender the frame is unreadable.
+ */
+export function resolveContentHashAlg(raw) {
+    if (raw === undefined || raw === null)
+        return { ok: true, alg: CONTENT_HASH_ALGS.SHA256 };
+    if (typeof raw !== "string" || !isKnownContentHashAlg(raw)) {
+        return { ok: false, value: typeof raw === "string" ? raw : `(${typeof raw})` };
+    }
+    return { ok: true, alg: raw };
+}
+/**
+ * The content hash under a named algorithm.
+ *
+ * THROWS rather than substituting, in both failure cases, and that is the point of the function. A
+ * 32-byte value returned for an unknown algorithm — or an unsalted one returned because the salt was
+ * missing — flows straight into the cross-check and surfaces as `content_hash_mismatch`: a TAMPER
+ * REPORT for what is really a version skew or a missing salt. The caller must handle those as what
+ * they are.
+ */
+export function contentHashFor(content, opts) {
+    if (opts.alg === CONTENT_HASH_ALGS.SHA256)
+        return wireContentHash(content);
+    if (opts.alg === CONTENT_HASH_ALGS.HMAC_SALT_V1) {
+        if (!opts.salt) {
+            throw new Error(`CONTENT HASH: ${CONTENT_HASH_ALGS.HMAC_SALT_V1} was requested with no session salt. Refusing rather ` +
+                "than computing the unsalted form — that would put bytes on the wire under a label they do not match, " +
+                "and the peer would report a tamper on a message nobody touched.");
+        }
+        return saltedContentHash(opts.salt, content);
+    }
+    throw new Error(`CONTENT HASH: unknown algorithm "${opts.alg}". This daemon cannot reproduce it, so there is no value to ` +
+        "compare against. Refusing rather than falling back to sha256, which would compare two unrelated hashes " +
+        "and report a tamper for what is a version difference.");
+}
 /**
  * Domain-separation prefix. Fixed at `0x00` for ALL content frames — see the header on why this is
  * not the leaf kind.

package/dist/wire-content-hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"wire-content-hash.js","sourceRoot":"","sources":["../src/wire-content-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnD,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,OAAmB;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,kBAAkB,CAAC,OAAmB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"wire-content-hash.js","sourceRoot":"","sources":["../src/wire-content-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,0GAA0G;IAC1G,MAAM,EAAE,QAAQ;IAChB,+FAA+F;IAC/F,YAAY,EAAE,qBAAqB;CAC3B,CAAC;AAIX,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAErE,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAA8B;IAE9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC;IAC1F,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAmB,EACnB,IAA8C;IAE9C,IAAI,IAAI,CAAC,GAAG,KAAK,iBAAiB,CAAC,MAAM;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,GAAG,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,iBAAiB,iBAAiB,CAAC,YAAY,uDAAuD;gBACtG,uGAAuG;gBACvG,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,GAAG,8DAA8D;QAC1G,yGAAyG;QACzG,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnD,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,OAAmB;IACjD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,kBAAkB,CAAC,OAAmB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/daemon",
-  "version": "0.0.181",
+  "version": "0.0.183",
   "private": false,
   "type": "module",
   "engines": {
@@ -35,10 +35,10 @@
     "@signalapp/sqlcipher": "^3.3.5",
     "cbor-x": "^1.6.0",
     "it-length-prefixed": "^10.0.1",
-    "@cello-protocol/gateway": "0.0.42",
-    "@cello-protocol/protocol-types": "0.0.62",
-    "@cello-protocol/transport": "0.0.64",
-    "@cello-protocol/crypto": "0.0.58"
+    "@cello-protocol/crypto": "0.0.60",
+    "@cello-protocol/protocol-types": "0.0.64",
+    "@cello-protocol/transport": "0.0.66",
+    "@cello-protocol/gateway": "0.0.44"
   },
   "devDependencies": {
     "@types/node": "^25.6.2",