@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/consortium-fingerprint.d.ts

@@ -1,115 +0,0 @@
-/**
- * DOD-M15-CONSORTIUM-FINGERPRINT-1 — which consortium is this daemon actually verifying against?
- *
- * ─── The attack this answers ───────────────────────────────────────────────────────────────────
- *
- * Anyone can fork the open-source client, stand up three nodes, sign their own consortium manifest
- * with their own officer root key and market the result as CELLO. The receipts that network issues
- * mean nothing, and when it is broken into the headline says CELLO was hacked. This is the
- * shadow-frontend attack from crypto, and it worked there for exactly one reason: a user had no
- * cheap way to tell the real deployment from the copy.
- *
- * ─── What already works, and what did not ──────────────────────────────────────────────────────
- *
- * The VERIFICATION is not the gap. `EmbeddedManifestProvider.loadAndVerify` refuses any manifest
- * whose officer signatures do not verify against the root keys it is handed, and fails CLOSED with
- * `manifest_signature_invalid`. A fake consortium cannot fool a genuine client that is verifying
- * against ours; it can only ship its own client.
- *
- * The gap is that the answer was never shown. "Am I on the real network?" was a judgement call
- * instead of a command — this milestone's recurring shape, a check that runs, decides correctly, and
- * tells nobody.
- *
- * ─── ⚠️ IT REPORTS THE ENFORCED KEYS, NOT THE COMPILED-IN ONES, AND THAT IS THE UNIT ───────────
- *
- * The first cut of this module read `BUNDLED_CONSORTIUM_ROOT_KEYS` unconditionally, and review
- * measured that the daemon does not always verify against them. `buildManifestDeps` has three
- * outcomes, not one:
- *
- *   BUNDLED      no `CELLO_CONSORTIUM_MANIFEST`, and the directory URL matches the bundled roster →
- *                the compiled-in keys are what `loadAndVerify` is handed.
- *   OVERRIDDEN   `CELLO_CONSORTIUM_MANIFEST` is set → `CELLO_CONSORTIUM_ROOT_KEYS` and
- *                `CELLO_CONSORTIUM_THRESHOLD` are what it is handed. A different consortium.
- *   NOT ANCHORED the resolved directory URL is not a bundled endpoint → `{}`: no provider, no root
- *                keys, no manifest verification at all.
- *
- * Printing the bundled fingerprint in the last two postures is the precise failure this order exists
- * to prevent, aimed the worst possible way: an operator talked into pointing at a fork reads the
- * genuine CELLO fingerprint and concludes they are safe. So the block takes the keys the daemon
- * hands the verifier, says which of the three postures it is in, and where nothing is anchored it
- * reports that instead of a fingerprint — a value describing a check that is not running is the one
- * output worse than silence.
- *
- * The value is still not configurable in the sense that matters: nothing here reads the environment,
- * and an override cannot make this block SAY `bundled`. It can only make it say, out loud, that an
- * override is in force.
- *
- * Crypto reference: RFC 6234 (SHA-256). The digest is an identifier, not a security boundary — the
- * security boundary is the Ed25519 threshold verification in `verifyManifest` (RFC 8032). This makes
- * that boundary's anchor readable by a human in one glance.
- */
-import type { Logger } from "./types.js";
-/**
- * Domain separator. Versioned so a future change to what the fingerprint covers produces a visibly
- * different value rather than a silently different one over the same inputs.
- */
-export declare const CONSORTIUM_FINGERPRINT_DOMAIN = "cello-consortium-root-v1";
-/** Where the genuine value is published, for an operator comparing what they just read. */
-export declare const CONSORTIUM_FINGERPRINT_PUBLISHED_AT = "https://cello.mygentic.ai/fingerprint";
-/**
- * The canonical preimage: domain, then the root keys lowercased and SORTED, then the threshold.
- *
- * Sorting is what makes the fingerprint a property of the KEY SET rather than of the order someone
- * happened to write the array in — otherwise a cosmetic reordering during an officer rotation would
- * read as a different consortium and send an operator hunting an attack that is not there.
- *
- * The threshold is inside the preimage because it is enforced alongside the keys: the same two
- * officer keys at threshold 1 and at threshold 2 are different trust arrangements, and a fork that
- * reused our keys at a weaker threshold would otherwise fingerprint identically to us.
- */
-export declare function consortiumFingerprintPreimage(rootKeys: readonly string[], threshold: number): string;
-/** The full SHA-256 digest, hex, of the canonical preimage. */
-export declare function consortiumFingerprintFull(rootKeys: readonly string[], threshold: number): string;
-/**
- * The SHORT form an operator actually compares by eye: the first 16 hex characters of the digest,
- * in four groups of four.
- *
- * Grouped because an ungrouped hex run is where eye-comparison fails — a reader checks the first
- * few characters and the last few and skips the middle, which is precisely the substitution an
- * attacker would make. The full digest stays in the response beside it for anything automated.
- */
-export declare function consortiumFingerprintShort(rootKeys: readonly string[], threshold: number): string;
-/** What the daemon actually hands `loadAndVerify` — the same two values, or neither. */
-export interface EnforcedConsortium {
-    rootKeys: readonly string[] | undefined;
-    threshold: number | undefined;
-}
-export type ConsortiumPosture = "bundled" | "overridden" | "not_anchored";
-/**
- * Which of the three postures a set of enforced values represents.
- *
- * `bundled` is decided by comparing FINGERPRINTS rather than array contents, so a reordered or
- * differently-cased copy of our own key set is still recognised as ours — the same normalisation the
- * published value carries, applied to the decision that quotes it.
- */
-export declare function consortiumPosture(enforced: EnforcedConsortium): ConsortiumPosture;
-/**
- * The status block, for `cello status` and `cello_status`.
- *
- * NOTE the same inversion as `describeDirectoryAuth`: the HEALTHY case contributes a field here,
- * against this milestone's general rule that a field on the good path is furniture. The defect being
- * closed is that the real network and a fork are distinguished by nothing an operator can read, so
- * "I checked, and it is ours" has to be an answer they can obtain — an absence proves nothing.
- */
-export declare function describeConsortiumFingerprint(enforced: EnforcedConsortium): Record<string, unknown>;
-/**
- * The startup event — clause 6: "which network is this daemon on" is one grep.
- *
- * Emitted unconditionally, on every startup and in all three postures, because the question is asked
- * AFTER the fact. An operator reading a log days later, about a daemon that is no longer running,
- * cannot go and run `cello status` on it; the status surface answers only for a process that still
- * exists. It reports the ENFORCED keys for the same reason the status block does — a log line saying
- * a daemon was anchored to CELLO when it was anchored to nothing is worse than no log line.
- */
-export declare function logConsortiumAnchor(logger: Logger, enforced: EnforcedConsortium): void;
-//# sourceMappingURL=consortium-fingerprint.d.ts.map

package/dist/consortium-fingerprint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"consortium-fingerprint.d.ts","sourceRoot":"","sources":["../src/consortium-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAOH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,2FAA2F;AAC3F,eAAO,MAAM,mCAAmC,0CAA0C,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGpG;AAED,+DAA+D;AAC/D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGjG;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAE1E;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,iBAAiB,CAKjF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6CnG;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAWtF"}

package/dist/consortium-fingerprint.js

@@ -1,175 +0,0 @@
-/**
- * DOD-M15-CONSORTIUM-FINGERPRINT-1 — which consortium is this daemon actually verifying against?
- *
- * ─── The attack this answers ───────────────────────────────────────────────────────────────────
- *
- * Anyone can fork the open-source client, stand up three nodes, sign their own consortium manifest
- * with their own officer root key and market the result as CELLO. The receipts that network issues
- * mean nothing, and when it is broken into the headline says CELLO was hacked. This is the
- * shadow-frontend attack from crypto, and it worked there for exactly one reason: a user had no
- * cheap way to tell the real deployment from the copy.
- *
- * ─── What already works, and what did not ──────────────────────────────────────────────────────
- *
- * The VERIFICATION is not the gap. `EmbeddedManifestProvider.loadAndVerify` refuses any manifest
- * whose officer signatures do not verify against the root keys it is handed, and fails CLOSED with
- * `manifest_signature_invalid`. A fake consortium cannot fool a genuine client that is verifying
- * against ours; it can only ship its own client.
- *
- * The gap is that the answer was never shown. "Am I on the real network?" was a judgement call
- * instead of a command — this milestone's recurring shape, a check that runs, decides correctly, and
- * tells nobody.
- *
- * ─── ⚠️ IT REPORTS THE ENFORCED KEYS, NOT THE COMPILED-IN ONES, AND THAT IS THE UNIT ───────────
- *
- * The first cut of this module read `BUNDLED_CONSORTIUM_ROOT_KEYS` unconditionally, and review
- * measured that the daemon does not always verify against them. `buildManifestDeps` has three
- * outcomes, not one:
- *
- *   BUNDLED      no `CELLO_CONSORTIUM_MANIFEST`, and the directory URL matches the bundled roster →
- *                the compiled-in keys are what `loadAndVerify` is handed.
- *   OVERRIDDEN   `CELLO_CONSORTIUM_MANIFEST` is set → `CELLO_CONSORTIUM_ROOT_KEYS` and
- *                `CELLO_CONSORTIUM_THRESHOLD` are what it is handed. A different consortium.
- *   NOT ANCHORED the resolved directory URL is not a bundled endpoint → `{}`: no provider, no root
- *                keys, no manifest verification at all.
- *
- * Printing the bundled fingerprint in the last two postures is the precise failure this order exists
- * to prevent, aimed the worst possible way: an operator talked into pointing at a fork reads the
- * genuine CELLO fingerprint and concludes they are safe. So the block takes the keys the daemon
- * hands the verifier, says which of the three postures it is in, and where nothing is anchored it
- * reports that instead of a fingerprint — a value describing a check that is not running is the one
- * output worse than silence.
- *
- * The value is still not configurable in the sense that matters: nothing here reads the environment,
- * and an override cannot make this block SAY `bundled`. It can only make it say, out loud, that an
- * override is in force.
- *
- * Crypto reference: RFC 6234 (SHA-256). The digest is an identifier, not a security boundary — the
- * security boundary is the Ed25519 threshold verification in `verifyManifest` (RFC 8032). This makes
- * that boundary's anchor readable by a human in one glance.
- */
-import { createHash } from "node:crypto";
-import { BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD, } from "./bundled-consortium-manifest.js";
-/**
- * Domain separator. Versioned so a future change to what the fingerprint covers produces a visibly
- * different value rather than a silently different one over the same inputs.
- */
-export const CONSORTIUM_FINGERPRINT_DOMAIN = "cello-consortium-root-v1";
-/** Where the genuine value is published, for an operator comparing what they just read. */
-export const CONSORTIUM_FINGERPRINT_PUBLISHED_AT = "https://cello.mygentic.ai/fingerprint";
-/**
- * The canonical preimage: domain, then the root keys lowercased and SORTED, then the threshold.
- *
- * Sorting is what makes the fingerprint a property of the KEY SET rather than of the order someone
- * happened to write the array in — otherwise a cosmetic reordering during an officer rotation would
- * read as a different consortium and send an operator hunting an attack that is not there.
- *
- * The threshold is inside the preimage because it is enforced alongside the keys: the same two
- * officer keys at threshold 1 and at threshold 2 are different trust arrangements, and a fork that
- * reused our keys at a weaker threshold would otherwise fingerprint identically to us.
- */
-export function consortiumFingerprintPreimage(rootKeys, threshold) {
-    const keys = [...rootKeys].map((k) => k.trim().toLowerCase()).sort();
-    return [CONSORTIUM_FINGERPRINT_DOMAIN, ...keys, String(threshold)].join("\n") + "\n";
-}
-/** The full SHA-256 digest, hex, of the canonical preimage. */
-export function consortiumFingerprintFull(rootKeys, threshold) {
-    return createHash("sha256").update(consortiumFingerprintPreimage(rootKeys, threshold), "utf8").digest("hex");
-}
-/**
- * The SHORT form an operator actually compares by eye: the first 16 hex characters of the digest,
- * in four groups of four.
- *
- * Grouped because an ungrouped hex run is where eye-comparison fails — a reader checks the first
- * few characters and the last few and skips the middle, which is precisely the substitution an
- * attacker would make. The full digest stays in the response beside it for anything automated.
- */
-export function consortiumFingerprintShort(rootKeys, threshold) {
-    const full = consortiumFingerprintFull(rootKeys, threshold);
-    return (full.slice(0, 16).match(/.{4}/g) ?? []).join("-");
-}
-/**
- * Which of the three postures a set of enforced values represents.
- *
- * `bundled` is decided by comparing FINGERPRINTS rather than array contents, so a reordered or
- * differently-cased copy of our own key set is still recognised as ours — the same normalisation the
- * published value carries, applied to the decision that quotes it.
- */
-export function consortiumPosture(enforced) {
-    const { rootKeys, threshold } = enforced;
-    if (!rootKeys || rootKeys.length === 0 || threshold === undefined || threshold < 1)
-        return "not_anchored";
-    const bundled = consortiumFingerprintFull(BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD);
-    return consortiumFingerprintFull(rootKeys, threshold) === bundled ? "bundled" : "overridden";
-}
-/**
- * The status block, for `cello status` and `cello_status`.
- *
- * NOTE the same inversion as `describeDirectoryAuth`: the HEALTHY case contributes a field here,
- * against this milestone's general rule that a field on the good path is furniture. The defect being
- * closed is that the real network and a fork are distinguished by nothing an operator can read, so
- * "I checked, and it is ours" has to be an answer they can obtain — an absence proves nothing.
- */
-export function describeConsortiumFingerprint(enforced) {
-    const posture = consortiumPosture(enforced);
-    const bundledShort = consortiumFingerprintShort(BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD);
-    if (posture === "not_anchored") {
-        return {
-            consortium_root_fingerprint: null,
-            consortium_root_fingerprint_state: "not_anchored",
-            consortium_root_fingerprint_guidance: "This daemon is verifying NO consortium manifest, so there is no root key set to fingerprint " +
-                "and nothing here tells you which network you are on. It happens when the resolved directory " +
-                "URL is not one of the endpoints in the bundled roster — local development and the e2e " +
-                "harness are the designed cases. A daemon started through the normal CLI with " +
-                "CELLO_DIRECTORY_URL unset anchors to the bundled roster automatically; " +
-                "directory_authentication in this same output reports the related posture and names the URL " +
-                "that failed to match. The CELLO consortium's own fingerprint is " + bundledShort +
-                ", published at " + CONSORTIUM_FINGERPRINT_PUBLISHED_AT + ".",
-        };
-    }
-    const rootKeys = enforced.rootKeys;
-    const threshold = enforced.threshold;
-    return {
-        consortium_root_fingerprint: consortiumFingerprintShort(rootKeys, threshold),
-        consortium_root_fingerprint_full: consortiumFingerprintFull(rootKeys, threshold),
-        consortium_root_fingerprint_state: posture,
-        // Only when they differ. On the bundled path the two are the same value, and printing it twice
-        // invites a reader to compare a number with itself and conclude something from the match.
-        ...(posture === "overridden" ? { consortium_root_fingerprint_bundled: bundledShort } : {}),
-        consortium_root_fingerprint_guidance: posture === "bundled"
-            ? "This is the consortium root key set this daemon verifies every manifest against; a " +
-                "manifest signed by any other root key is refused. It is the set compiled into this " +
-                "client, and no setting is overriding it. Compare it with the value published at " +
-                CONSORTIUM_FINGERPRINT_PUBLISHED_AT + " — if they differ, this client is not talking to " +
-                "the CELLO consortium, whatever it calls itself."
-            : "This daemon is verifying manifests against a root key set supplied by " +
-                "CELLO_CONSORTIUM_ROOT_KEYS / CELLO_CONSORTIUM_THRESHOLD, NOT the set compiled into this " +
-                "client (" + bundledShort + "). That is a different consortium, and receipts from it say " +
-                "nothing about CELLO. If you did not choose that deliberately, unset all three of " +
-                "CELLO_CONSORTIUM_MANIFEST, CELLO_CONSORTIUM_ROOT_KEYS and CELLO_CONSORTIUM_THRESHOLD and " +
-                "restart the daemon, which returns it to the bundled roster. The genuine CELLO value is " +
-                "published at " + CONSORTIUM_FINGERPRINT_PUBLISHED_AT + ".",
-    };
-}
-/**
- * The startup event — clause 6: "which network is this daemon on" is one grep.
- *
- * Emitted unconditionally, on every startup and in all three postures, because the question is asked
- * AFTER the fact. An operator reading a log days later, about a daemon that is no longer running,
- * cannot go and run `cello status` on it; the status surface answers only for a process that still
- * exists. It reports the ENFORCED keys for the same reason the status block does — a log line saying
- * a daemon was anchored to CELLO when it was anchored to nothing is worse than no log line.
- */
-export function logConsortiumAnchor(logger, enforced) {
-    const posture = consortiumPosture(enforced);
-    const anchored = posture !== "not_anchored";
-    logger.info("daemon.consortium.anchored", {
-        posture,
-        fingerprint: anchored ? consortiumFingerprintShort(enforced.rootKeys, enforced.threshold) : null,
-        fingerprintFull: anchored ? consortiumFingerprintFull(enforced.rootKeys, enforced.threshold) : null,
-        bundledFingerprint: consortiumFingerprintShort(BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD),
-        rootKeyCount: enforced.rootKeys?.length ?? 0,
-        threshold: enforced.threshold ?? null,
-    });
-}
-//# sourceMappingURL=consortium-fingerprint.js.map

package/dist/consortium-fingerprint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"consortium-fingerprint.js","sourceRoot":"","sources":["../src/consortium-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAG1C;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAA2B,EAAE,SAAiB;IAC1F,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,CAAC,6BAA6B,EAAE,GAAG,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACvF,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,yBAAyB,CAAC,QAA2B,EAAE,SAAiB;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B,EAAE,SAAiB;IACvF,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B;IAC5D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IAC1G,MAAM,OAAO,GAAG,yBAAyB,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;IACtG,OAAO,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;AAC/F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAA4B;IACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,0BAA0B,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;IAE5G,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO;YACL,2BAA2B,EAAE,IAAI;YACjC,iCAAiC,EAAE,cAAc;YACjD,oCAAoC,EAClC,8FAA8F;gBAC9F,8FAA8F;gBAC9F,wFAAwF;gBACxF,+EAA+E;gBAC/E,yEAAyE;gBACzE,6FAA6F;gBAC7F,kEAAkE,GAAG,YAAY;gBACjF,iBAAiB,GAAG,mCAAmC,GAAG,GAAG;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA6B,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAmB,CAAC;IAE/C,OAAO;QACL,2BAA2B,EAAE,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5E,gCAAgC,EAAE,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC;QAChF,iCAAiC,EAAE,OAAO;QAC1C,+FAA+F;QAC/F,0FAA0F;QAC1F,GAAG,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,mCAAmC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,oCAAoC,EAClC,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,qFAAqF;gBACrF,qFAAqF;gBACrF,kFAAkF;gBAClF,mCAAmC,GAAG,mDAAmD;gBACzF,iDAAiD;YACnD,CAAC,CAAC,wEAAwE;gBACxE,0FAA0F;gBAC1F,UAAU,GAAG,YAAY,GAAG,8DAA8D;gBAC1F,mFAAmF;gBACnF,2FAA2F;gBAC3F,yFAAyF;gBACzF,eAAe,GAAG,mCAAmC,GAAG,GAAG;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,QAA4B;IAC9E,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,KAAK,cAAc,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,OAAO;QACP,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAS,EAAE,QAAQ,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QAClG,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAS,EAAE,QAAQ,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QACrG,kBAAkB,EAAE,0BAA0B,CAAC,4BAA4B,EAAE,4BAA4B,CAAC;QAC1G,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;QAC5C,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;KACtC,CAAC,CAAC;AACL,CAAC"}

package/dist/contact-handlers.d.ts

@@ -1,59 +0,0 @@
-import type { IpcHandler } from "./ipc-server.js";
-import type { SessionNodeManager } from "./session-node-manager.js";
-import type { Logger } from "./types.js";
-import type { AgentInfo } from "./types.js";
-/** The per-connection agent selection, as the address book needs to read it. */
-export interface ConnState {
-    currentAgent: string | null;
-    clearedAgent?: string;
-}
-export interface ContactHandlerDeps {
-    handlers: Map<string, IpcHandler>;
-    sessionNodeManager: SessionNodeManager;
-    /**
-     * Read this connection's agent selection. The READ, not the container: these handlers only ever
-     * `.get(connectionId)`, and injecting the whole Map would hand the address book the power to
-     * mutate connection state it has no business touching.
-     */
-    getConnState: (connectionId: string) => ConnState | undefined;
-    /** The daemon's single agent-selection rule. Injected, never re-implemented here. */
-    resolveCurrentAgent: (connState: ConnState | undefined, explicitAgent?: string) => string | null;
-    /** DOD-INBOX-AGENT-1: every agent, so an explicitly NAMED one can be validated before we WRITE. */
-    agents: ReadonlyArray<AgentInfo>;
-    /**
-     * Set (or clear, with null) an agent's outbound-name override. False when no such agent exists.
-     *
-     * Injected as a capability rather than reached for, because `cello_set_moniker` was the ONE
-     * address-book handler that bypassed the store interface entirely and grabbed the raw SQLite
-     * handle (`sessionNodeManager.getDb()`) to build a DbIdentityStore. Every other handler goes
-     * through a store method. Inside the closure that asymmetry was invisible; the extraction made it
-     * the single thing standing between this module and "needs no database". Same call, same
-     * behavior — the daemon still constructs the DbIdentityStore. It just says so out loud now.
-     */
-    setAgentMoniker: (agentName: string, moniker: string | null) => boolean;
-    logger: Logger;
-    /** M8C-TGDOOR-1: restart the poller after a token change, with no daemon restart. */
-    startTelegramPollerIfConfigured: () => void;
-}
-type Refusal = {
-    ok: false;
-    reason: string;
-    guidance: string;
-};
-/**
- * Review finding 7 — a contact pubkey must LOOK like a pubkey, or the row can never work.
- *
- * The address-book handlers took `params.pubkey` as any string and stored it. So
- * `cello contact tier add` — a plausible slip under the `contact <pubkey> <op>` shape, where the
- * FIRST positional is the pubkey — persisted a contact whose pubkey is the literal text "tier",
- * and answered ok:true. Nothing would ever match it: it is not a key, so it can never be a
- * counterparty. The operator is told they added someone; they added a typo.
- *
- * A key is 32 bytes, hex: 64 characters. Anything else is refused, loudly, with the value echoed
- * so the slip is obvious. Returns null when the pubkey is absent — the caller's own missing_params
- * check owns that case and says something more useful.
- */
-export declare function invalidPubkey(pubkey: string | undefined): Refusal | null;
-export declare function registerContactHandlers(deps: ContactHandlerDeps): void;
-export {};
-//# sourceMappingURL=contact-handlers.d.ts.map

package/dist/contact-handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"contact-handlers.d.ts","sourceRoot":"","sources":["../src/contact-handlers.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAWzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC;;;;OAIG;IACH,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,mGAAmG;IACnG,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,+BAA+B,EAAE,MAAM,IAAI,CAAC;CAC7C;AAED,KAAK,OAAO,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CA2StE"}