@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/seal-local-terminus.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-local-terminus.d.ts","sourceRoot":"","sources":["../src/seal-local-terminus.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AA2BlE,MAAM,WAAW,sBAAsB;IACrC,sFAAsF;IACtF,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,SAAS,EAAE,UAAU,CAAC;IACtB,kEAAkE;IAClE,cAAc,EAAE,UAAU,CAAC;IAC3B,mGAAmG;IACnG,OAAO,EAAE,UAAU,CAAC;IACpB,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAClD;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA6FlC"}

package/dist/seal-local-terminus.js

@@ -1,170 +0,0 @@
-/**
- * `DOD-M15-CARRIEDSEAL-1` — THE CLOSING LEAF THIS SIDE WRITES WHEN THERE IS NO RELAY LEFT TO ASK.
- *
- * ─── What this exists to fix ───────────────────────────────────────────────────────────────────
- *
- * A seal needed the relay alive, and for exactly one reason. Every message in a conversation is
- * countersigned by the relay when it is ordered and held by BOTH parties from that moment
- * (`069-ORDERPROOF`), so the record itself survives the relay being restarted, rolled or deleted.
- * What did not survive was the last line: the SEAL control leaf that ends the record was handed to
- * the relay for a sequence number like any other leaf, so a relay that was gone at close time cost
- * the conversation its receipt — a record that was fully witnessed, fully held, and unusable.
- *
- * This writes that one leaf here instead.
- *
- * ─── Why nothing is being taken on trust ───────────────────────────────────────────────────────
- *
- * The leaf invents no facts. **Every field is read out of the carry it closes over**, which is the
- * relay's own ordered log as both parties received it:
- *
- *   - **position** — one past the last carried leaf. Contiguity from 1 is checked first, so there is
- *     no position to choose.
- *   - **`prev_root`** — the RFC 6962 fold over the carried leaves in the Structure 2 domain. This is
- *     the value the directory's own chain walk arrives at when it reaches this leaf, so naming any
- *     other one breaks the walk rather than fooling it.
- *   - **`last_seen`** — the counterparty's newest carried leaf, sequence and content hash.
- *   - **`prev_own`** — this side's newest carried leaf.
- *   - **`final_root`** — the content-only root, which is what each party signs and what the
- *     counterparty's copy must agree with.
- *
- * So the only thing this side supplies that is genuinely its own is the CHOICE TO STOP HERE. That is
- * truncation, it is bounded by design, the counterparty refutes it from their own copy, and the work
- * order says in terms not to chase it.
- *
- * ⚠️ **THE RECEIPT FIELDS ARE ABSENT, AND ABSENT IS NOT THE SAME AS EMPTY.** A leaf carrying a blank
- * relay id would be CLAIMING a witness it cannot produce, and the directory judges that as a
- * malformed receipt — correctly, because missing and malformed must not be told apart. The
- * directory's exemption is for a terminal control leaf with no receipt AT ALL, so this writes none.
- *
- * Crypto refs: RFC 8032 (Ed25519, the sender signature), RFC 6962 §2.1 (the Merkle fold).
- */
-import { createHash } from "node:crypto";
-import { buildMerkleTree, merkleRoot } from "@cello-protocol/crypto";
-import { encodeSealPayload, encodeStructure1, encodeStructure2, decodeStructure1, SCAN_RESULT_SENTINEL, } from "@cello-protocol/protocol-types";
-/** The SEAL control leaf's kind byte — the same 0x02 the relay path hashes under. */
-const LEAF_KIND_CTRL = 0x02;
-/**
- * ⚠️ FOUR DOMAINS, NOT TWO — review HIGH-2, and the collapsed form is a trust-boundary bug the
- * directory's own `LEAF_KINDS` table already carries a comment about having removed.
- *
- * `prev_root` is a fold over `leafHashFor(kind, structure2)`, and that function prefixes each leaf
- * with its own domain byte. Writing "anything but 0x02 is a message" here makes every session that
- * ever exchanged a DOCUMENT (0x04) or carried a refusal leaf (0x05) compute a prefix root the
- * directory cannot reproduce. It fails as a broken chain and reaches the operator as
- * `unilateral_root_unverifiable`, whose guidance tells them their transcript ORDER is in dispute
- * with their counterparty and to compare copies out of band — a hash-domain bug on this machine,
- * reported as the other person's fault, on exactly the sessions where the receipt matters most.
- *
- * `undefined` for a byte this build cannot name. Guessing a domain for it produces a root nobody
- * else computes, which is the same failure reached by coercion instead of by a refusal.
- */
-const LEAF_DOMAINS = {
-    0x00: "msg",
-    0x02: "ctrl",
-    0x04: "doc",
-    0x05: "reject",
-};
-/**
- * Refusals, and each one is a case where writing a leaf anyway would make things worse:
- *
- *   `seal_carry_empty`          nothing was ever witnessed, so there is no record to close.
- *   `seal_carry_noncontiguous`  a witnessed leaf never reached us; a terminus over a record with a
- *                               hole in it would be signing a history we know is not the history.
- *   `seal_carry_own_ctrl_present` we already closed. A SECOND control leaf from one party makes the
- *                               session unsealable by any directory, permanently — the caller must
- *                               reuse the one that is there, never add to it.
- *   `seal_carry_unreadable`     a leaf this daemon cannot decode is one it cannot chain onto.
- *   `seal_carry_leaf_kind_unknown` a leaf kind this build cannot name has no domain to hash in, and
- *                               a guessed one yields a root nobody else computes.
- */
-export async function buildLocalSealTerminus(input) {
-    const { carry, ownPubkeyHex, sessionIdBytes, genesis, finalRootHex, closeTimestamp, sign } = input;
-    if (carry.length === 0)
-        return { ok: false, reason: "seal_carry_empty" };
-    // Ascending and exactly 1..N. Sorted rather than assumed: the store returns rows ordered, and a
-    // terminus that trusted that ordering would be depending on a detail of a query it does not own.
-    const ordered = [...carry].sort((a, b) => a.sequenceNumber - b.sequenceNumber);
-    for (let i = 0; i < ordered.length; i++) {
-        if (ordered[i].sequenceNumber !== i + 1)
-            return { ok: false, reason: "seal_carry_noncontiguous" };
-    }
-    if (ordered.some((l) => l.leafKind === LEAF_KIND_CTRL && l.senderPubkeyHex === ownPubkeyHex)) {
-        return { ok: false, reason: "seal_carry_own_ctrl_present" };
-    }
-    // ── The links, read out of the leaves each party actually authored ──
-    // `ordered` is ascending, so the LAST match in each direction is that party's newest leaf. A
-    // decode failure anywhere refuses: this side cannot honestly say what it has seen if it cannot
-    // read what it holds.
-    let lastSeenSeq = 0;
-    let lastSeenHash = genesis;
-    let prevOwnHash = genesis;
-    for (const leaf of ordered) {
-        const s1 = decodeStructure1(leaf.structure1Cbor);
-        if (!s1.ok)
-            return { ok: false, reason: "seal_carry_unreadable" };
-        if (leaf.senderPubkeyHex === ownPubkeyHex) {
-            prevOwnHash = s1.fields.contentHash;
-        }
-        else {
-            lastSeenSeq = leaf.sequenceNumber;
-            lastSeenHash = s1.fields.contentHash;
-        }
-    }
-    /**
-     * The prefix root, in the STRUCTURE 2 domain — which is not the domain the certified root lives
-     * in, and conflating the two is the easiest mistake available here. `prev_root` is checked by the
-     * directory's incremental walk over `leafHashFor(kind, encodeStructure2(s2))`; the certified root
-     * is the fold over raw content hashes. Same leaves, different pre-images, different values.
-     */
-    const prefixInputs = [];
-    for (const l of ordered) {
-        const domain = LEAF_DOMAINS[l.leafKind];
-        if (!domain)
-            return { ok: false, reason: "seal_carry_leaf_kind_unknown" };
-        prefixInputs.push({ kind: domain, data: l.structure2Cbor });
-    }
-    const prevRoot = merkleRoot(buildMerkleTree(prefixInputs));
-    // The payload and its hash come from ONE derivation, deliberately. When they diverge the directory
-    // answers `seal_payload_unbound`, whose guidance accuses the relay of altering bytes — a correct
-    // relay named as an attacker for a mismatch made on this machine.
-    const payload = encodeSealPayload({
-        session_id: sessionIdBytes,
-        final_root: new Uint8Array(Buffer.from(finalRootHex, "hex")),
-        close_timestamp: closeTimestamp,
-        attestation: "PENDING",
-    });
-    const contentHash = new Uint8Array(createHash("sha256").update(new Uint8Array([LEAF_KIND_CTRL])).update(payload).digest());
-    const structure1Cbor = encodeStructure1({
-        contentHash,
-        senderPubkey: input.ownPubkey,
-        sessionId: sessionIdBytes,
-        lastSeenSeq,
-        timestamp: closeTimestamp,
-        lastSeenHash,
-        prevOwnHash,
-    });
-    const senderSignature = await sign(structure1Cbor);
-    const sequenceNumber = ordered.length + 1;
-    const structure2Cbor = encodeStructure2({
-        sequence_number: sequenceNumber,
-        sender_pubkey: input.ownPubkey,
-        content_hash: contentHash,
-        sender_signature: senderSignature,
-        scan_result: SCAN_RESULT_SENTINEL,
-        prev_root: prevRoot,
-    });
-    return {
-        ok: true,
-        payload,
-        contentHashHex: Buffer.from(contentHash).toString("hex"),
-        // No relay fields. See the header — absent, never blank.
-        leaf: {
-            sequenceNumber,
-            leafKind: LEAF_KIND_CTRL,
-            senderPubkeyHex: ownPubkeyHex,
-            structure2Cbor,
-            structure1Cbor,
-        },
-    };
-}
-//# sourceMappingURL=seal-local-terminus.js.map

package/dist/seal-local-terminus.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-local-terminus.js","sourceRoot":"","sources":["../src/seal-local-terminus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAkB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EACL,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,oBAAoB,GAC9F,MAAM,gCAAgC,CAAC;AAGxC,qFAAqF;AACrF,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAgE;IAChF,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,QAAQ;CACf,CAAC;AAuBF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEnG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,gGAAgG;IAChG,iGAAiG;IACjG,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IAC/E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,cAAc,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,eAAe,KAAK,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,6FAA6F;IAC7F,+FAA+F;IAC/F,sBAAsB;IACtB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,OAAO,CAAC;IAC3B,IAAI,WAAW,GAAG,OAAO,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,eAAe,KAAK,YAAY,EAAE,CAAC;YAC1C,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC;YAClC,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,YAAY,GAAgB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC1E,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3D,mGAAmG;IACnG,iGAAiG;IACjG,kEAAkE;IAClE,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,UAAU,EAAE,cAAc;QAC1B,UAAU,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5D,eAAe,EAAE,cAAc;QAC/B,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,UAAU,CAChC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACvF,CAAC;IAEF,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,SAAS;QAC7B,SAAS,EAAE,cAAc;QACzB,WAAW;QACX,SAAS,EAAE,cAAc;QACzB,YAAY;QACZ,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC;IAEnD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,KAAK,CAAC,SAAS;QAC9B,YAAY,EAAE,WAAW;QACzB,gBAAgB,EAAE,eAAe;QACjC,WAAW,EAAE,oBAAoB;QACjC,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,yDAAyD;QACzD,IAAI,EAAE;YACJ,cAAc;YACd,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,YAAY;YAC7B,cAAc;YACd,cAAc;SACf;KACF,CAAC;AACJ,CAAC"}

package/dist/seal-receipt-upgrade.d.ts

@@ -1,30 +0,0 @@
-/**
- * Client-side bilateral upgrade of a stored seal receipt.
- *
- * When the previously-absent party (B) ratifies a unilateral seal and the directory confirms the
- * upgrade to bilateral (seal_upgrade_confirmed, cryptographically verified via verifyUpgradeConfirmedCert),
- * BOTH parties upgrade their OWN already-persisted unilateral receipt: the counterparty that was
- * recorded 'absent' becomes 'recovered' (it has now ratified + proved content possession via the
- * KERNEL gate). This is done CLIENT-SIDE — the directory does not persist the seal leaves/legibility
- * anywhere reachable at upgrade time, so there is nothing new to ship; the bilateral receipt is built
- * from the cert each party already holds. The seal signatures do NOT bind the legibility, so mutating
- * the stored (unsigned) legibility invalidates nothing.
- *
- * Never overstates: only the attestation_mode flips (absent → recovered); frontiers are unchanged
- * (the honest floor). Attestation modes: 'live' | 'recovered' | 'absent' (seal-legibility-tbs.ts).
- */
-/**
- * Return the legibility with every participant marked 'absent' re-marked 'recovered'. Mutates in place
- * and returns the same reference. Tolerant: a null/undefined/malformed legibility is returned unchanged
- * rather than throwing (the caller persists whatever it had).
- */
-export declare function upgradeAbsentToRecovered(legibility: unknown): unknown;
-/**
- * True if the legibility still has any 'absent' participant — i.e. it has NOT yet been upgraded to
- * bilateral (upgradeAbsentToRecovered flips the sole absent party to 'recovered'). The absent-party
- * 3b persist uses this as a ONE-WAY RATCHET: a re-delivered seal_unilateral_notification (reconnect
- * burst) must not overwrite an already-'recovered' stored receipt back to the stale 'absent' snapshot.
- * A malformed/missing legibility returns false (nothing to protect; let the caller persist).
- */
-export declare function hasAbsentParticipant(legibility: unknown): boolean;
-//# sourceMappingURL=seal-receipt-upgrade.d.ts.map

package/dist/seal-receipt-upgrade.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-receipt-upgrade.d.ts","sourceRoot":"","sources":["../src/seal-receipt-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAUrE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAOjE"}

package/dist/seal-receipt-upgrade.js

@@ -1,49 +0,0 @@
-/**
- * Client-side bilateral upgrade of a stored seal receipt.
- *
- * When the previously-absent party (B) ratifies a unilateral seal and the directory confirms the
- * upgrade to bilateral (seal_upgrade_confirmed, cryptographically verified via verifyUpgradeConfirmedCert),
- * BOTH parties upgrade their OWN already-persisted unilateral receipt: the counterparty that was
- * recorded 'absent' becomes 'recovered' (it has now ratified + proved content possession via the
- * KERNEL gate). This is done CLIENT-SIDE — the directory does not persist the seal leaves/legibility
- * anywhere reachable at upgrade time, so there is nothing new to ship; the bilateral receipt is built
- * from the cert each party already holds. The seal signatures do NOT bind the legibility, so mutating
- * the stored (unsigned) legibility invalidates nothing.
- *
- * Never overstates: only the attestation_mode flips (absent → recovered); frontiers are unchanged
- * (the honest floor). Attestation modes: 'live' | 'recovered' | 'absent' (seal-legibility-tbs.ts).
- */
-/**
- * Return the legibility with every participant marked 'absent' re-marked 'recovered'. Mutates in place
- * and returns the same reference. Tolerant: a null/undefined/malformed legibility is returned unchanged
- * rather than throwing (the caller persists whatever it had).
- */
-export function upgradeAbsentToRecovered(legibility) {
-    if (!legibility || typeof legibility !== "object")
-        return legibility;
-    const participants = legibility.participants;
-    if (!Array.isArray(participants))
-        return legibility;
-    for (const p of participants) {
-        if (p && typeof p === "object" && p.attestation_mode === "absent") {
-            p.attestation_mode = "recovered";
-        }
-    }
-    return legibility;
-}
-/**
- * True if the legibility still has any 'absent' participant — i.e. it has NOT yet been upgraded to
- * bilateral (upgradeAbsentToRecovered flips the sole absent party to 'recovered'). The absent-party
- * 3b persist uses this as a ONE-WAY RATCHET: a re-delivered seal_unilateral_notification (reconnect
- * burst) must not overwrite an already-'recovered' stored receipt back to the stale 'absent' snapshot.
- * A malformed/missing legibility returns false (nothing to protect; let the caller persist).
- */
-export function hasAbsentParticipant(legibility) {
-    if (!legibility || typeof legibility !== "object")
-        return false;
-    const participants = legibility.participants;
-    if (!Array.isArray(participants))
-        return false;
-    return participants.some((p) => p && typeof p === "object" && p.attestation_mode === "absent");
-}
-//# sourceMappingURL=seal-receipt-upgrade.js.map

package/dist/seal-receipt-upgrade.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-receipt-upgrade.js","sourceRoot":"","sources":["../src/seal-receipt-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAmB;IAC1D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IACrE,MAAM,YAAY,GAAI,UAAyC,CAAC,YAAY,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAoC,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YACrG,CAAkC,CAAC,gBAAgB,GAAG,WAAW,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAmB;IACtD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,YAAY,GAAI,UAAyC,CAAC,YAAY,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,YAAY,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAoC,CAAC,gBAAgB,KAAK,QAAQ,CACzG,CAAC;AACJ,CAAC"}

package/dist/seal-relay-silence.d.ts

@@ -1,51 +0,0 @@
-/**
- * `DOD-M15-CARRIEDSEAL-1` — WHEN THE RELAY GAVE NO ANSWER, as opposed to giving a bad one.
- *
- * The seal writes its own closing leaf only when there was nobody to ask. That is a narrower
- * condition than "the submit failed", and the difference is load-bearing: a relay that REFUSED a
- * leaf has ruled on it, and routing around a ruling is exactly the behaviour a trust layer must not
- * have. A relay that never answered has ruled on nothing.
- *
- * ⚠️ **THE LIST IS AN ALLOW-SET, AND THE DEFAULT IS THE OLD BEHAVIOUR.** A reason that is not here
- * does not unlock the local terminus — the close fails as it does today. That asymmetry is the whole
- * design: a new relay refusal reason added next year cannot silently widen this, because widening
- * requires someone to come here and add it. The reverse default — "fall back unless the reason is
- * one of these known refusals" — would have let every future refusal become a bypass.
- *
- * Every reason below is produced by THIS daemon, in `session-relay-client.ts` or
- * `session-seal.ts`'s transport resolution, at a point where no `hash_submit_ack` came back.
- *
- * Three that are deliberately NOT here, and why each one is an answer rather than a silence:
- *   - `relay_assignment_rejected` — the relay considered the session and declined it.
- *   - `relay_ack_unverified` / `relay_ack_malformed` — the relay ANSWERED and the answer did not
- *     check out. That is a relay to distrust, and letting distrust promote us onto a path with
- *     weaker evidence is the wrong direction entirely.
- *   - `standing_receiver_unavailable` — this agent is not started. Local, fixable, and the existing
- *     guidance ("start the agent and retry") is the correct thing to tell someone.
- */
-/**
- * ⚠️ THE ALLOW-SET IS NOT SUFFICIENT ON ITS OWN, AND THIS IS THE HALF THAT MAKES IT SOUND.
- *
- * The submit boundary COLLAPSES almost every relay refusal into `relay_unavailable`. Only three
- * token faults survive under their own names (`DOD-M15-TOKENSTALE-1` split those out); everything
- * else the relay actually said — rate limited, over its slot cap, this agent's token rejected as
- * invalid, and by that code's own documented default every future relay-side reason — arrives at
- * this file wearing the label for an outage.
- *
- * So the reason string alone cannot tell "nobody was there" from "they authenticated me and said
- * no". A relay exercising judgement about this agent would have been read as silence and sealed
- * around, which is the one thing this whole design says must never happen.
- *
- * The standing refusal is the signal the boundary drops, and the client still holds it. Ask for it
- * directly rather than trying to infer it from a label that was never going to carry it.
- *
- * **A ruling is anything the relay answered with.** Not a list of known-bad reasons: a set like that
- * defaults to "silence" for anything unfamiliar, which is the wrong direction here — a reason added
- * next year would quietly become a bypass. Present means refused.
- */
-export declare function relayRefusedUs(refusal: {
-    reason: string;
-} | null | undefined): boolean;
-/** The relay never ruled. See the header — this is an allow-set and the default is to fail as before. */
-export declare const RELAY_GAVE_NO_ANSWER: ReadonlySet<string>;
-//# sourceMappingURL=seal-relay-silence.d.ts.map

package/dist/seal-relay-silence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-relay-silence.d.ts","sourceRoot":"","sources":["../src/seal-relay-silence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEtF;AAED,yGAAyG;AACzG,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAyBnD,CAAC"}

package/dist/seal-relay-silence.js

@@ -1,76 +0,0 @@
-/**
- * `DOD-M15-CARRIEDSEAL-1` — WHEN THE RELAY GAVE NO ANSWER, as opposed to giving a bad one.
- *
- * The seal writes its own closing leaf only when there was nobody to ask. That is a narrower
- * condition than "the submit failed", and the difference is load-bearing: a relay that REFUSED a
- * leaf has ruled on it, and routing around a ruling is exactly the behaviour a trust layer must not
- * have. A relay that never answered has ruled on nothing.
- *
- * ⚠️ **THE LIST IS AN ALLOW-SET, AND THE DEFAULT IS THE OLD BEHAVIOUR.** A reason that is not here
- * does not unlock the local terminus — the close fails as it does today. That asymmetry is the whole
- * design: a new relay refusal reason added next year cannot silently widen this, because widening
- * requires someone to come here and add it. The reverse default — "fall back unless the reason is
- * one of these known refusals" — would have let every future refusal become a bypass.
- *
- * Every reason below is produced by THIS daemon, in `session-relay-client.ts` or
- * `session-seal.ts`'s transport resolution, at a point where no `hash_submit_ack` came back.
- *
- * Three that are deliberately NOT here, and why each one is an answer rather than a silence:
- *   - `relay_assignment_rejected` — the relay considered the session and declined it.
- *   - `relay_ack_unverified` / `relay_ack_malformed` — the relay ANSWERED and the answer did not
- *     check out. That is a relay to distrust, and letting distrust promote us onto a path with
- *     weaker evidence is the wrong direction entirely.
- *   - `standing_receiver_unavailable` — this agent is not started. Local, fixable, and the existing
- *     guidance ("start the agent and retry") is the correct thing to tell someone.
- */
-/**
- * ⚠️ THE ALLOW-SET IS NOT SUFFICIENT ON ITS OWN, AND THIS IS THE HALF THAT MAKES IT SOUND.
- *
- * The submit boundary COLLAPSES almost every relay refusal into `relay_unavailable`. Only three
- * token faults survive under their own names (`DOD-M15-TOKENSTALE-1` split those out); everything
- * else the relay actually said — rate limited, over its slot cap, this agent's token rejected as
- * invalid, and by that code's own documented default every future relay-side reason — arrives at
- * this file wearing the label for an outage.
- *
- * So the reason string alone cannot tell "nobody was there" from "they authenticated me and said
- * no". A relay exercising judgement about this agent would have been read as silence and sealed
- * around, which is the one thing this whole design says must never happen.
- *
- * The standing refusal is the signal the boundary drops, and the client still holds it. Ask for it
- * directly rather than trying to infer it from a label that was never going to carry it.
- *
- * **A ruling is anything the relay answered with.** Not a list of known-bad reasons: a set like that
- * defaults to "silence" for anything unfamiliar, which is the wrong direction here — a reason added
- * next year would quietly become a bypass. Present means refused.
- */
-export function relayRefusedUs(refusal) {
-    return refusal != null;
-}
-/** The relay never ruled. See the header — this is an allow-set and the default is to fail as before. */
-export const RELAY_GAVE_NO_ANSWER = new Set([
-    // No relay client, no stream, or the session is gone from the relay's side.
-    "relay_unavailable",
-    "relay_client_unavailable",
-    "relay_client_closed",
-    "relay_stream_closed",
-    /**
-     * ⚠️ KEPT DELIBERATELY, against a review finding that called it "a relay answer". It is one, and
-     * it is still the right side of this line.
-     *
-     * The relay answers `session_not_found` for a session it no longer holds — and a relay that has
-     * RESTARTED holds nothing, because its leaf log is a map in process memory. That is precisely the
-     * scenario this order exists for: the witness is gone even though the process is up and talking.
-     * Excluding it would mean a restarted relay still costs a conversation its receipt, which is the
-     * defect, not the fix.
-     *
-     * The refusals that must NOT unlock this path are the relay exercising judgement about this agent,
-     * and those are caught by `relayRefusedUs` above rather than by this list.
-     */
-    "relay_session_gone",
-    // The frame never left, or left and was never answered.
-    "relay_submit_send_failed",
-    "relay_submit_timeout",
-    // This daemon has no endpoint to dial any more — the relay is gone as far as it can tell.
-    "no_persisted_relay_endpoint",
-]);
-//# sourceMappingURL=seal-relay-silence.js.map

package/dist/seal-relay-silence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-relay-silence.js","sourceRoot":"","sources":["../src/seal-relay-silence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8C;IAC3E,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,4EAA4E;IAC5E,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;IACrB,qBAAqB;IACrB;;;;;;;;;;;;OAYG;IACH,oBAAoB;IACpB,wDAAwD;IACxD,0BAA0B;IAC1B,sBAAsB;IACtB,0FAA0F;IAC1F,6BAA6B;CAC9B,CAAC,CAAC"}

package/dist/seal-settle.d.ts

@@ -1,38 +0,0 @@
-/**
- * DOD-M15-SEALPRECOND-1 — wait for this side's own record to stop moving before signing it.
- *
- * ⚠️ THIS IS NOT A DELAY, AND THE DISTINCTION IS THE WHOLE UNIT. On 2026-09-11 the daemon held the
- * relay's ordering confirmation for 352 milliseconds and signed without it; a 14-millisecond gap
- * and a 14-second gap fail identically, so nothing here may be tuned to a window. What is waited
- * ON is a condition of state — `sealReadiness().ownLeavesOrdered`, the leaves of ours the relay has
- * already ordered and this tree has not placed. The bound exists only so a send that never
- * resolves cannot hold the operator's close forever; it is the escape, not the mechanism.
- *
- * The condition is re-read every poll and the wait returns the instant it clears, which is what a
- * fixed sleep cannot do and what the tests assert.
- */
-import type { SessionNodeManager } from "./session-node-manager.js";
-/**
- * How long a close may wait for its own in-flight send to take its place in the record.
- *
- * Two seconds against a condition that resolved in 14ms when it was measured. Generous on purpose:
- * the cost of waiting too long is an operator's close taking a moment, and the cost of not waiting
- * is a signature no directory can verify and a receipt that is gone for both parties permanently.
- */
-export declare const SEAL_SETTLE_DEADLINE_MS = 2000;
-export type SealSettleOutcome = {
-    settled: true;
-    waitedMs: number;
-} | {
-    settled: false;
-    waitedMs: number;
-    ownLeavesOrdered: number;
-};
-/**
- * Block until this session has no own leaf the relay has ordered and the tree has not placed.
- *
- * Returns immediately — no timer, no microtask hop beyond the read — when the record is already
- * level, which is every ordinary close.
- */
-export declare function awaitOwnRecordSettled(sessionNodeManager: Pick<SessionNodeManager, "sealReadiness">, agentName: string, sessionId: string, deadlineMs?: number): Promise<SealSettleOutcome>;
-//# sourceMappingURL=seal-settle.d.ts.map

package/dist/seal-settle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-settle.d.ts","sourceRoot":"","sources":["../src/seal-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAK7C,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,EAC7D,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,MAAgC,GAC3C,OAAO,CAAC,iBAAiB,CAAC,CAe5B"}

package/dist/seal-settle.js

@@ -1,33 +0,0 @@
-/**
- * How long a close may wait for its own in-flight send to take its place in the record.
- *
- * Two seconds against a condition that resolved in 14ms when it was measured. Generous on purpose:
- * the cost of waiting too long is an operator's close taking a moment, and the cost of not waiting
- * is a signature no directory can verify and a receipt that is gone for both parties permanently.
- */
-export const SEAL_SETTLE_DEADLINE_MS = 2_000;
-/** How often the condition is re-read. Short enough that a settled record is not made to wait. */
-const SEAL_SETTLE_POLL_MS = 20;
-/**
- * Block until this session has no own leaf the relay has ordered and the tree has not placed.
- *
- * Returns immediately — no timer, no microtask hop beyond the read — when the record is already
- * level, which is every ordinary close.
- */
-export async function awaitOwnRecordSettled(sessionNodeManager, agentName, sessionId, deadlineMs = SEAL_SETTLE_DEADLINE_MS) {
-    const started = Date.now();
-    let readiness = sessionNodeManager.sealReadiness(agentName, sessionId);
-    while (readiness.ownLeavesOrdered > 0 && Date.now() - started < deadlineMs) {
-        await new Promise((resolve) => {
-            const t = setTimeout(resolve, SEAL_SETTLE_POLL_MS);
-            // Never hold the process — or a test runner — open on a session that is going nowhere.
-            t.unref?.();
-        });
-        readiness = sessionNodeManager.sealReadiness(agentName, sessionId);
-    }
-    const waitedMs = Date.now() - started;
-    return readiness.ownLeavesOrdered > 0
-        ? { settled: false, waitedMs, ownLeavesOrdered: readiness.ownLeavesOrdered }
-        : { settled: true, waitedMs };
-}
-//# sourceMappingURL=seal-settle.js.map

package/dist/seal-settle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-settle.js","sourceRoot":"","sources":["../src/seal-settle.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAM/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,kBAA6D,EAC7D,SAAiB,EACjB,SAAiB,EACjB,aAAqB,uBAAuB;IAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,SAAS,CAAC,gBAAgB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACnD,uFAAuF;YACvF,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACtC,OAAO,SAAS,CAAC,gBAAgB,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;QAC5E,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC"}

package/dist/seal-upgrade.d.ts

@@ -1,107 +0,0 @@
-import type { KeyProvider } from "@cello-protocol/crypto";
-import type { Logger } from "./types.js";
-import type { DaemonRegistrationPersistence } from "./registration-persistence.js";
-/**
- * Domain separator for the upgrade-ack TBS. B's daemon and the directory MUST build byte-identical
- * bytes — same domain string, same cbor-x encoder options (tagUint8Array:false); the directory side
- * must be kept byte-identical. Domain separation prevents replay as any other CELLO signature.
- */
-export declare const SEAL_UPGRADE_ACK_DOMAIN = "cello-seal-upgrade-ack-v1";
-/** The exact upgrade-ack TBS B signs / the directory + present party verify. */
-export declare function buildSealUpgradeAckTbs(sessionId: Uint8Array, sealedRoot: Uint8Array): Uint8Array;
-/**
- * Verifiability of a session for B to ratify a unilateral seal — the SAME bar as the auto-ack.
- *
- * `unverifiable` carries WHY, not just whether — `DOD-M15-SEALWIRE-1` part B1, review F-A.
- *
- * It was `tampered: boolean`, which was true while a hash mismatch was the only way to fail the
- * cross-check. B1 added two more, and BOTH ARE ORDINARY: a peer on a newer build naming an
- * algorithm this daemon cannot reproduce, and a salted frame arriving before the salt agreement
- * landed. A boolean forces this file to call all three a tamper.
- */
-export interface SealUpgradeReadiness {
-    known: boolean;
-    /** `null` when the content verified. Otherwise WHY it could not be verified. */
-    unverifiable: "tampered" | "unverifiable" | null;
-}
-/**
- * THE KERNEL DECISION. B may sign its ratification ONLY when it genuinely possesses + integrity-
- * verified the content behind R1. A session B has no record of (content_unrecoverable) or whose
- * content it could not verify is REFUSED. Verified-but-disliked content is NOT a refusal —
- * disagreement ≠ unverifiable.
- *
- * ⚠️ THE REFUSAL IS THE SAME FOR BOTH CAUSES; ONLY THE NAME DIFFERS. Never ratify content you could
- * not verify — that is binary and it is the kernel. But `content_tamper` is a SECURITY claim, and
- * emitting it for an honest peer on a newer build is the defect this split exists to remove: an
- * alarm that fires on the benign case teaches an operator to dismiss the one that matters.
- */
-export declare function evaluateSealUpgrade(readiness: SealUpgradeReadiness): {
-    proceed: true;
-} | {
-    proceed: false;
-    refuseReason: "content_unrecoverable" | "content_tamper" | "content_verification_unavailable";
-};
-export interface AttemptSealUpgradeDeps {
-    logger: Logger;
-    agentName: string;
-    agentPubkeyHex: string;
-    /** B's session verifiability for this session (SessionNodeManager.getSealUpgradeReadiness). */
-    getReadiness: (agentName: string, sessionIdHex: string) => SealUpgradeReadiness;
-    /**
-     * The number of content leaves B holds for this session (SessionNodeManager.getSessionTree
-     * (...).size()). R1 has leaf_count leaves = content leaves + A's single SEAL ctrl leaf, so B's
-     * content tree must hold at least leaf_count-1 leaves or B is missing content it would over-attest.
-     */
-    getContentLeafCount: (agentName: string, sessionIdHex: string) => number;
-    /** Recover parked content so B holds everything behind R1 before the gate (autoRecoverForAgent). */
-    recoverContent: (agentName: string) => Promise<void>;
-    /** B's K_local signer for this agent (keyProviders.get). */
-    getKeyProvider: (agentName: string) => KeyProvider | undefined;
-    /** Send a signaling frame to the directory (signaling.sendRaw). */
-    sendRaw: (frame: Record<string, unknown>) => Promise<{
-        ok: boolean;
-    }>;
-}
-/**
- * THE KERNEL, wired. Recover content → consult the gate → REFUSE (no signature, no request) on
- * content_unrecoverable / content_tamper → else sign the ack over R1 with B's OWN K_local and send
- * seal_upgrade_request. Returns whether a request was sent (and the refuse reason if not) so a unit
- * test asserts the gate is genuinely consulted, not bypassed. Never throws.
- */
-export declare function attemptSealUpgrade(deps: AttemptSealUpgradeDeps, sessionIdHex: string, frame: Record<string, unknown>): Promise<{
-    sent: boolean;
-    reason?: string;
-}>;
-export interface VerifyUpgradeConfirmedDeps {
-    logger: Logger;
-    agentName: string;
-    agentPubkeyHex: string;
-    /** DB-backed identity persistence (the FROST share for cert verification). */
-    persistence: DaemonRegistrationPersistence;
-    /**
-     * The counterparty pubkey (hex) of the LOCAL session record for sessionIdHex, or null if this
-     * agent has no such session. Binds the cert's present/returning pubkeys to the REAL participants so
-     * a malicious directory cannot sign the ack with a throwaway key and force a state transition on a
-     * session we are in (or push a confirmed frame for a session we never had).
-     */
-    getCounterpartyHex: (agentName: string, sessionIdHex: string) => string | null;
-}
-/**
- * Dual-attestation verify. NEVER trust the directory's "bilateral" claim.
- *
- *  - ALWAYS verify the RETURNING attestation (B's ack) over R1 — proves B genuinely ratified, catches
- *    a directory that fabricated or swapped B's signature. The load-bearing check (anyone can do it).
- *  - If THIS agent is the PRESENT party (A, holds its primary key), ALSO verify the present attestation
- *    over the rebuilt seal TBS (leaf_count-bound). The responder (B) cannot (no initiator key).
- *
- * Returns { ok:false, reason } on any malformed/forged cert — the caller must NOT mark the session
- * bilateral in that case. Returns the party so the caller can log accurately.
- */
-export declare function verifyUpgradeConfirmedCert(deps: VerifyUpgradeConfirmedDeps, sessionIdHex: string, frame: Record<string, unknown>): Promise<{
-    ok: true;
-    party: "present" | "returning";
-} | {
-    ok: false;
-    reason: string;
-}>;
-//# sourceMappingURL=seal-upgrade.d.ts.map

package/dist/seal-upgrade.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seal-upgrade.d.ts","sourceRoot":"","sources":["../src/seal-upgrade.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAGnF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,UAAU,CAEhG;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,YAAY,EAAE,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;CAClD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,oBAAoB,GAC9B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,YAAY,EAAE,uBAAuB,GAAG,gBAAgB,GAAG,kCAAkC,CAAC;CAC/F,CAKA;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IAChF;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,oGAAoG;IACpG,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,4DAA4D;IAC5D,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAC/D,mEAAmE;IACnE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACvE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqF7C;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAChF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,0BAA0B,EAChC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA0DvF"}