@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/manifest-validity.d.ts

@@ -1,153 +0,0 @@
-/**
- * DOD-M15-MANIFEST-EXPIRY-LIVE-1 — a running daemon notices its own trust anchor expiring.
- *
- * ─── The gap ───────────────────────────────────────────────────────────────────────────────────
- *
- The consortium manifest's validity window is enforced at boot (`verifyStartupManifest`) and, after
- * that, in exactly ONE consumer: `signal-submission.ts` re-checks the HELD manifest at request time
- * and refuses. Nothing else does — not directory identity authentication, not the ceremony roster.
- *
- * (An earlier version of this header said nothing re-checked the held manifest at all. That was
- * wrong — the third false claim I have shipped in three units — and the correction matters, because
- * the real shape is not "unchecked" but INCONSISTENT: the daemon refuses the lowest-stakes consumer
- * and permits the two highest-stakes ones, invisibly. See the decision note below.)
- *
- * There is also a check that reads like coverage and is not: `http-manifest-poll.ts` refuses to
- * ADOPT an expired manifest. That checks the manifest being FETCHED, never the one already held — so
- * a daemon whose anchor has lapsed keeps polling, keeps correctly refusing expired replacements, and
- * keeps using the expired anchor it already has.
- *
- * On the PRODUCTION DEFAULT it is worse: the bundled-manifest path wires no poll scheduler at all
- * ("the bundled roster is static"), so there is not even a fetch that might have noticed.
- *
- * ─── Why it matters, concretely ────────────────────────────────────────────────────────────────
- *
- The manifest is the trust anchor for directory identity authentication (step 6) and for the node
- * roster a threshold ceremony draws from — both re-read `getCurrentManifest()` at request time, so
- * both genuinely run on whatever is held.
- *
- * What expiry means precisely (review F10, correcting my own overstatement): it is the NOTICE that
- * the anchor may be out of date, not the mechanism by which it becomes so. The daemon trusts the
- * identical roster the day BEFORE expiry; what keeps a removed node trusted is never having adopted
- * v+1. So the accurate statement is that past expiry there is NO ASSURANCE the enforced roster is
- * current — a node removed since then would still be trusted, and nothing here can say whether one
- * was.
- *
- * ─── Found the wrong way round ─────────────────────────────────────────────────────────────────
- *
- * `DOD-M15-STALEROSTER-1` shipped a guidance string blaming an expired manifest for a state an
- * expired manifest cannot reach (that daemon refuses to start). Review corrected it and pointed at
- * where the hazard actually lives — here. After that unit, a daemon in this state reports its roster
- * reading as `stale: false`: a confidently fresh measurement taken against a dead anchor, which is
- * worse than the stale reading that line existed to fix.
- *
- * ─── Decision: report, do not kill ─────────────────────────────────────────────────────────────
- *
- A daemon does NOT tear itself down at the expiry instant. §2b invariant 2 backs this explicitly —
- * *"Loud does not mean blocking… treating every failure as fatal is its own defect."*
- *
- * But review corrected the FRAMING, and the correction is worth keeping: the availability argument I
- * originally made does not survive. The fleet-wide stop I claimed to be avoiding happens anyway, at
- * each operator's next restart, via ADV-002 — report-only DEFERS that outage, it does not prevent
- * it. The honest reason to warn rather than kill is that a wall-clock boundary is a bad trigger for
- * tearing down live conversations, not that it avoids the outage.
- *
- * The real question was never global report-vs-kill; it is PER CONSUMER, and the repo has already
- * ruled on one of them inconsistently. `signal-submission.ts` refuses a trust-signal submission on
- * expiry, while `register-handler.ts` deals a FROST share against a roster re-resolved from the same
- * lapsed manifest with no gate, and the challenge verifier authenticates a directory against it with
- * no gate. **The daemon refuses its lowest-stakes consumer and permits its two highest-stakes ones.**
- * That is not defended anywhere; it is carried as `DOD-M15-EXPIRY-CONSUMER-POLICY-1` rather than
- * settled inside a reporting unit.
- */
-import type { ConsortiumManifest } from "@cello-protocol/protocol-types";
-/**
- * How long before expiry the warning starts.
- *
- * Warning at the expiry instant is useless — the operator finds out once they are already running
- * on a dead anchor. Seven days is chosen to cover a weekend plus the working days either side, which
- * is the realistic floor for noticing an alert and rotating a threshold-signed artefact.
- */
-export declare const MANIFEST_EXPIRY_WARNING_MS: number;
-export type ManifestValidity = {
-    state: "not_configured";
-} | {
-    state: "not_yet_valid";
-    notBefore: string;
-}
-/**
- * The window itself is unreadable — a `not_before` that does not parse.
- *
- * Its OWN state, deliberately not folded into `expired`: those need different words. "Expired"
- * tells an operator to rotate a manifest that is stale; this tells them a field in the manifest is
- * GARBAGE, which is a different problem with a different fix and is more likely to mean the
- * artefact was hand-edited or produced by a broken generator.
- */
- | {
-    state: "unreadable_window";
-    notBefore: string;
-} | {
-    state: "valid";
-    expires: string;
-    secondsRemaining: number;
-} | {
-    state: "expiring_soon";
-    expires: string;
-    secondsRemaining: number;
-} | {
-    state: "expired";
-    expires: string;
-    secondsSince: number;
-};
-/**
- * Where does this manifest sit in its validity window, as of `nowMs`?
- *
- * Clock injected so the boundaries are tested exactly rather than approximately.
- */
-export declare function classifyManifestValidity(manifest: Pick<ConsortiumManifest, "not_before" | "expires"> | null | undefined, nowMs: number): ManifestValidity;
-/**
- * The operator-facing fields for `cello_status`, or `undefined` when there is nothing to say.
- *
- * A healthy manifest contributes NOTHING. A field that is present on every status read for the
- * years a manifest is valid is not a warning — it is furniture, and it teaches the reader to skip
- * the block that matters. This is the finding this milestone has produced more often than any other.
- */
-/**
- * WHERE the manifest came from, because it decides what the remedy even IS — review F5.
- *
- * `bundled` is a compiled-in constant: there is no file to replace and no poll to adopt a
- * replacement, so "rotate the manifest" is not an action that operator can take. Telling them to do
- * it anyway is worse than unhelpful, because the workaround they will reach for — repointing
- * `CELLO_DIRECTORY_URL` at something not byte-equal to a bundled endpoint — makes `buildManifestDeps`
- * return nothing, which starts the daemon with directory identity authentication SILENTLY OFF.
- * Guidance that routes a stuck operator toward disabling a security control is a defect in the
- * guidance.
- */
-export type ManifestOrigin = "bundled" | "file";
-/** What to actually DO about a manifest that needs replacing, given where it came from. */
-export declare function remedyFor(origin: ManifestOrigin): string;
-export declare function describeManifestValidity(v: ManifestValidity, origin?: ManifestOrigin): Record<string, unknown> | undefined;
-/** Minimal structural logger — `domain.noun.verb` taxonomy, injected. */
-export interface ManifestValidityLogger {
-    info(event: string, ctx?: Record<string, unknown>): void;
-    warn(event: string, ctx?: Record<string, unknown>): void;
-    error(event: string, ctx?: Record<string, unknown>): void;
-}
-/**
- * A check to call periodically, which logs each TRANSITION once.
- *
- * Returns a function rather than owning a timer: the roster sweep already ticks every 90–180 s on
- * exactly the path where a manifest provider exists, so this rides it. A second timer measuring the
- * same subsystem would be two things to stop, two things to test, and two places for the interval
- * to drift out of agreement with the freshness bound.
- *
- * The latch is keyed on the STATE PLUS the expiry string, so rotating the manifest re-arms it. A
- * bare boolean would mean an operator who rotated once could never be warned again — the warning
- * would have been spent on a manifest that is no longer installed.
- */
-export declare function startManifestValidityWatch(opts: {
-    getManifest: () => Pick<ConsortiumManifest, "not_before" | "expires"> | null | undefined;
-    logger: ManifestValidityLogger;
-    now?: () => number;
-}): () => ManifestValidity;
-//# sourceMappingURL=manifest-validity.d.ts.map

package/dist/manifest-validity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-validity.d.ts","sourceRoot":"","sources":["../src/manifest-validity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GACxB;IAAE,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAC3B;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAC/C;;;;;;;GAOG;GACD;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/E,KAAK,EAAE,MAAM,GACZ,gBAAgB,CAgDlB;AAED;;;;;;GAMG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhD,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAQxD;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,gBAAgB,EACnB,MAAM,GAAE,cAAuB,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CA+ErC;AAED,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,WAAW,EAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACzF,MAAM,EAAE,sBAAsB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,MAAM,gBAAgB,CAqDzB"}

package/dist/manifest-validity.js

@@ -1,268 +0,0 @@
-/**
- * DOD-M15-MANIFEST-EXPIRY-LIVE-1 — a running daemon notices its own trust anchor expiring.
- *
- * ─── The gap ───────────────────────────────────────────────────────────────────────────────────
- *
- The consortium manifest's validity window is enforced at boot (`verifyStartupManifest`) and, after
- * that, in exactly ONE consumer: `signal-submission.ts` re-checks the HELD manifest at request time
- * and refuses. Nothing else does — not directory identity authentication, not the ceremony roster.
- *
- * (An earlier version of this header said nothing re-checked the held manifest at all. That was
- * wrong — the third false claim I have shipped in three units — and the correction matters, because
- * the real shape is not "unchecked" but INCONSISTENT: the daemon refuses the lowest-stakes consumer
- * and permits the two highest-stakes ones, invisibly. See the decision note below.)
- *
- * There is also a check that reads like coverage and is not: `http-manifest-poll.ts` refuses to
- * ADOPT an expired manifest. That checks the manifest being FETCHED, never the one already held — so
- * a daemon whose anchor has lapsed keeps polling, keeps correctly refusing expired replacements, and
- * keeps using the expired anchor it already has.
- *
- * On the PRODUCTION DEFAULT it is worse: the bundled-manifest path wires no poll scheduler at all
- * ("the bundled roster is static"), so there is not even a fetch that might have noticed.
- *
- * ─── Why it matters, concretely ────────────────────────────────────────────────────────────────
- *
- The manifest is the trust anchor for directory identity authentication (step 6) and for the node
- * roster a threshold ceremony draws from — both re-read `getCurrentManifest()` at request time, so
- * both genuinely run on whatever is held.
- *
- * What expiry means precisely (review F10, correcting my own overstatement): it is the NOTICE that
- * the anchor may be out of date, not the mechanism by which it becomes so. The daemon trusts the
- * identical roster the day BEFORE expiry; what keeps a removed node trusted is never having adopted
- * v+1. So the accurate statement is that past expiry there is NO ASSURANCE the enforced roster is
- * current — a node removed since then would still be trusted, and nothing here can say whether one
- * was.
- *
- * ─── Found the wrong way round ─────────────────────────────────────────────────────────────────
- *
- * `DOD-M15-STALEROSTER-1` shipped a guidance string blaming an expired manifest for a state an
- * expired manifest cannot reach (that daemon refuses to start). Review corrected it and pointed at
- * where the hazard actually lives — here. After that unit, a daemon in this state reports its roster
- * reading as `stale: false`: a confidently fresh measurement taken against a dead anchor, which is
- * worse than the stale reading that line existed to fix.
- *
- * ─── Decision: report, do not kill ─────────────────────────────────────────────────────────────
- *
- A daemon does NOT tear itself down at the expiry instant. §2b invariant 2 backs this explicitly —
- * *"Loud does not mean blocking… treating every failure as fatal is its own defect."*
- *
- * But review corrected the FRAMING, and the correction is worth keeping: the availability argument I
- * originally made does not survive. The fleet-wide stop I claimed to be avoiding happens anyway, at
- * each operator's next restart, via ADV-002 — report-only DEFERS that outage, it does not prevent
- * it. The honest reason to warn rather than kill is that a wall-clock boundary is a bad trigger for
- * tearing down live conversations, not that it avoids the outage.
- *
- * The real question was never global report-vs-kill; it is PER CONSUMER, and the repo has already
- * ruled on one of them inconsistently. `signal-submission.ts` refuses a trust-signal submission on
- * expiry, while `register-handler.ts` deals a FROST share against a roster re-resolved from the same
- * lapsed manifest with no gate, and the challenge verifier authenticates a directory against it with
- * no gate. **The daemon refuses its lowest-stakes consumer and permits its two highest-stakes ones.**
- * That is not defended anywhere; it is carried as `DOD-M15-EXPIRY-CONSUMER-POLICY-1` rather than
- * settled inside a reporting unit.
- */
-/**
- * How long before expiry the warning starts.
- *
- * Warning at the expiry instant is useless — the operator finds out once they are already running
- * on a dead anchor. Seven days is chosen to cover a weekend plus the working days either side, which
- * is the realistic floor for noticing an alert and rotating a threshold-signed artefact.
- */
-export const MANIFEST_EXPIRY_WARNING_MS = 7 * 86_400_000;
-/**
- * Where does this manifest sit in its validity window, as of `nowMs`?
- *
- * Clock injected so the boundaries are tested exactly rather than approximately.
- */
-export function classifyManifestValidity(manifest, nowMs) {
-    if (!manifest)
-        return { state: "not_configured" };
-    const expiresMs = Date.parse(manifest.expires);
-    /**
-     * AN UNREADABLE EXPIRY IS EXPIRED.
-     *
-     * `new Date("nonsense") <= now` is FALSE — every comparison against NaN is false — so the
-     * startup check's own shape waves a garbage timestamp through as though it were in-window. Valid
-     * is the answer that costs security here, so nothing unmeasurable may reach it.
-     */
-    if (Number.isNaN(expiresMs))
-        return { state: "expired", expires: manifest.expires, secondsSince: 0 };
-    /**
-     * AN UNREADABLE `not_before` FAILS CLOSED TOO — review F3, and it was my own defect sitting
-     * directly under the comment above claiming it could not happen.
-     *
-     * The first cut wrote `if (!Number.isNaN(notBeforeMs) && nowMs < notBeforeMs)`, which SKIPS the
-     * window-open check entirely when the field is garbage and falls through to a possible `valid`.
-     * So `not_before: "2026-13-01T00:00:00Z"` — month thirteen, the shape a hand-edited or
-     * generator-bugged artefact actually has — classified as valid, contributed nothing to the status
-     * surface, and logged nothing. I handled the same case correctly for `expires` eleven lines up and
-     * then wrote the inverted guard for `not_before`, under a comment asserting the property.
-     *
-     * `signal-submission.ts` already had this right (`!Number.isFinite(expiresAt) || expiresAt <= now`)
-     * and is the precedent.
-     */
-    const notBeforeMs = Date.parse(manifest.not_before);
-    if (Number.isNaN(notBeforeMs)) {
-        return { state: "unreadable_window", notBefore: manifest.not_before };
-    }
-    if (nowMs < notBeforeMs) {
-        return { state: "not_yet_valid", notBefore: manifest.not_before };
-    }
-    if (expiresMs <= nowMs) {
-        return { state: "expired", expires: manifest.expires, secondsSince: Math.floor((nowMs - expiresMs) / 1000) };
-    }
-    const remainingMs = expiresMs - nowMs;
-    const secondsRemaining = Math.floor(remainingMs / 1000);
-    // The constant directly, not an injectable parameter — review F9. A `warningMs` argument had no
-    // caller anywhere, and it was the ONE seam by which the two surfaces could ever disagree: the
-    // status path could not pass a custom window while the watch could. An unused knob whose only
-    // possible effect is drift between two readings of the same fact.
-    return remainingMs <= MANIFEST_EXPIRY_WARNING_MS
-        ? { state: "expiring_soon", expires: manifest.expires, secondsRemaining }
-        : { state: "valid", expires: manifest.expires, secondsRemaining };
-}
-/** What to actually DO about a manifest that needs replacing, given where it came from. */
-export function remedyFor(origin) {
-    return origin === "bundled"
-        ? "This daemon uses the COMPILED-IN consortium manifest, so there is no file to replace: " +
-            "upgrade the @cello-protocol/connect package to get a newer one. Do NOT repoint " +
-            "CELLO_DIRECTORY_URL to get past this — an endpoint that is not byte-equal to a bundled one " +
-            "makes the daemon start with directory identity authentication switched off, which is a " +
-            "weaker client than the one you are trying to fix."
-        : "Replace the manifest file at CELLO_CONSORTIUM_MANIFEST with a current one.";
-}
-export function describeManifestValidity(v, origin = "file") {
-    /**
-     * `valid` contributes nothing — correct, and the rule this milestone repeats most.
-     *
-     * `not_configured` USED TO collapse into that silence, and it was the same defect one spread
-     * above: a daemon holding NO consortium manifest at all rendered byte-identically to one holding
-     * a fully valid, in-window trust anchor. Found by `DOD-M15-DIRAUTH-1`'s review, which noticed it
-     * is the exact condition that unit was writing 100+ lines to expose — same daemon, same boot.
-     *
-     * "Absent" and "healthy" must not look alike. That is `STALEROSTER-1`'s rule and it applies to the
-     * anchor as much as to the roster reading.
-     */
-    if (v.state === "valid")
-        return undefined;
-    if (v.state === "not_configured") {
-        return {
-            manifest_anchor: "none",
-            manifest_validity_guidance: "There is NO consortium manifest on this daemon, so there is no trust anchor to have a " +
-                "validity window at all — the absence of an expiry warning here is not evidence of a healthy " +
-                "one. Directory identity authentication is off for the same reason; see " +
-                "directory_authentication for what that costs and how to turn it on.",
-        };
-    }
-    if (v.state === "unreadable_window") {
-        return {
-            manifest_expired: false,
-            manifest_window_unreadable: true,
-            manifest_valid_from: v.notBefore,
-            manifest_validity_guidance: `The consortium manifest's not_before field cannot be parsed as a date (got ` +
-                `${JSON.stringify(v.notBefore)}), so this daemon cannot tell whether its trust anchor's ` +
-                "validity window has even opened. This is a MALFORMED manifest rather than a stale one — " +
-                "the usual causes are a hand-edited file or a broken generator. " + remedyFor(origin),
-        };
-    }
-    if (v.state === "not_yet_valid") {
-        return {
-            manifest_expired: false,
-            manifest_not_yet_valid: true,
-            manifest_valid_from: v.notBefore,
-            manifest_validity_guidance: `The consortium manifest does not become valid until ${v.notBefore}, and this daemon is ` +
-                "still running against it. Either this machine's clock is wrong — the common cause, and the " +
-                "one to check first — or a manifest was rotated in ahead of its window. " + remedyFor(origin),
-        };
-    }
-    if (v.state === "expiring_soon") {
-        const days = Math.floor(v.secondsRemaining / 86_400);
-        return {
-            manifest_expired: false,
-            manifest_expires_at: v.expires,
-            manifest_expires_in_days: days,
-            manifest_validity_guidance: `The consortium manifest expires in ${days} day(s), at ${v.expires}. Rotate it before then. ` +
-                "After expiry this daemon KEEPS RUNNING on the old manifest — it does not fail closed the " +
-                "way startup does — so nothing will stop working at the deadline and nothing will announce " +
-                "it except this field and one log line. A daemon RESTARTED after expiry will refuse to " +
-                "start, which is how this usually gets discovered, at the worst moment. " + remedyFor(origin),
-        };
-    }
-    const days = Math.floor(v.secondsSince / 86_400);
-    return {
-        manifest_expired: true,
-        manifest_expires_at: v.expires,
-        manifest_expired_days_ago: days,
-        manifest_validity_guidance: `The consortium manifest EXPIRED at ${v.expires} (${days} day(s) ago) and this daemon is ` +
-            "still running on it. Its signatures no longer warrant the current consortium, so directory " +
-            "identity authentication and the threshold-ceremony roster are both being drawn from an " +
-            "anchor that has lapsed, so this daemon has NO ASSURANCE that the roster it enforces is the " +
-            "current one. A node removed from the consortium since then would still be trusted here, and " +
-            "nothing in this daemon can tell you whether one was. " + remedyFor(origin) + " Do NOT simply " +
-            "restart to clear this — a restart will REFUSE to start (startup fails closed on an expired " +
-            "manifest), so restarting without a fresh manifest turns a degraded daemon into a dead one.",
-    };
-}
-/**
- * A check to call periodically, which logs each TRANSITION once.
- *
- * Returns a function rather than owning a timer: the roster sweep already ticks every 90–180 s on
- * exactly the path where a manifest provider exists, so this rides it. A second timer measuring the
- * same subsystem would be two things to stop, two things to test, and two places for the interval
- * to drift out of agreement with the freshness bound.
- *
- * The latch is keyed on the STATE PLUS the expiry string, so rotating the manifest re-arms it. A
- * bare boolean would mean an operator who rotated once could never be warned again — the warning
- * would have been spent on a manifest that is no longer installed.
- */
-export function startManifestValidityWatch(opts) {
-    const { getManifest, logger, now = Date.now } = opts;
-    let lastReported = null;
-    return () => {
-        const v = classifyManifestValidity(getManifest(), now());
-        const key = v.state === "not_configured" ? "not_configured"
-            : v.state === "not_yet_valid" || v.state === "unreadable_window" ? `${v.state}:${v.notBefore}`
-                : `${v.state}:${v.expires}`;
-        if (key === lastReported)
-            return v;
-        lastReported = key;
-        if (v.state === "expired") {
-            logger.error("directory.auth.manifest.expired.live", {
-                expiresAt: v.expires,
-                expiredDaysAgo: Math.floor(v.secondsSince / 86_400),
-                impact: "the daemon is STILL RUNNING on this manifest. Directory identity authentication and the " +
-                    "threshold-ceremony roster are drawn from it at request time, so there is NO ASSURANCE " +
-                    "the enforced roster is the current one — a node removed since then would still be " +
-                    "trusted, and nothing here can say whether one was.",
-                guidance: "Replace the manifest (a file at CELLO_CONSORTIUM_MANIFEST, or an @cello-protocol/connect " +
-                    "upgrade if this daemon uses the compiled-in one). Do not restart to clear it: startup " +
-                    "fails closed on an expired manifest, so a restart without a fresh one turns a degraded " +
-                    "daemon into a dead one.",
-            });
-        }
-        else if (v.state === "expiring_soon") {
-            logger.warn("directory.auth.manifest.expiring", {
-                expiresAt: v.expires,
-                daysRemaining: Math.floor(v.secondsRemaining / 86_400),
-                impact: "after this date the daemon keeps running on the expired manifest rather than failing closed.",
-                guidance: "Rotate before the date. A daemon RESTARTED after it will refuse to start.",
-            });
-        }
-        else if (v.state === "unreadable_window") {
-            logger.error("directory.auth.manifest.window.unreadable", {
-                notBefore: v.notBefore,
-                impact: "the manifest's not_before field does not parse as a date, so this daemon cannot tell " +
-                    "whether its trust anchor's validity window has opened. It is running against it anyway.",
-                guidance: "The manifest is MALFORMED, not stale — a hand-edited file or a broken generator. Replace it.",
-            });
-        }
-        else if (v.state === "not_yet_valid") {
-            logger.error("directory.auth.manifest.not.yet.valid.live", {
-                notBefore: v.notBefore,
-                impact: "the daemon is running against a manifest whose validity window has not opened.",
-                guidance: "Check this machine's clock first — that is the common cause.",
-            });
-        }
-        return v;
-    };
-}
-//# sourceMappingURL=manifest-validity.js.map

package/dist/manifest-validity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-validity.js","sourceRoot":"","sources":["../src/manifest-validity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,UAAU,CAAC;AAkBzD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA+E,EAC/E,KAAa;IAEb,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAErG;;;;;;;;;;;;;OAaG;IACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,GAAG,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAC/G,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,GAAG,KAAK,CAAC;IACtC,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACxD,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,kEAAkE;IAClE,OAAO,WAAW,IAAI,0BAA0B;QAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE;QACzE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;AACtE,CAAC;AAsBD,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,MAAsB;IAC9C,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,wFAAwF;YACxF,iFAAiF;YACjF,6FAA6F;YAC7F,yFAAyF;YACzF,mDAAmD;QACrD,CAAC,CAAC,4EAA4E,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,CAAmB,EACnB,SAAyB,MAAM;IAE/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;QACjC,OAAO;YACL,eAAe,EAAE,MAAM;YACvB,0BAA0B,EACxB,wFAAwF;gBACxF,8FAA8F;gBAC9F,yEAAyE;gBACzE,qEAAqE;SACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;QACpC,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,0BAA0B,EAAE,IAAI;YAChC,mBAAmB,EAAE,CAAC,CAAC,SAAS;YAChC,0BAA0B,EACxB,6EAA6E;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,2DAA2D;gBACzF,0FAA0F;gBAC1F,iEAAiE,GAAG,SAAS,CAAC,MAAM,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,IAAI;YAC5B,mBAAmB,EAAE,CAAC,CAAC,SAAS;YAChC,0BAA0B,EACxB,uDAAuD,CAAC,CAAC,SAAS,uBAAuB;gBACzF,6FAA6F;gBAC7F,yEAAyE,GAAG,SAAS,CAAC,MAAM,CAAC;SAChG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAAC;QACrD,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,mBAAmB,EAAE,CAAC,CAAC,OAAO;YAC9B,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EACxB,sCAAsC,IAAI,eAAe,CAAC,CAAC,OAAO,2BAA2B;gBAC7F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,wFAAwF;gBACxF,yEAAyE,GAAG,SAAS,CAAC,MAAM,CAAC;SAChG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC;IACjD,OAAO;QACL,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,CAAC,CAAC,OAAO;QAC9B,yBAAyB,EAAE,IAAI;QAC/B,0BAA0B,EACxB,sCAAsC,CAAC,CAAC,OAAO,KAAK,IAAI,kCAAkC;YAC1F,6FAA6F;YAC7F,yFAAyF;YACzF,6FAA6F;YAC7F,8FAA8F;YAC9F,uDAAuD,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,iBAAiB;YAC/F,6FAA6F;YAC7F,4FAA4F;KAC/F,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAI1C;IACC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACrD,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,OAAO,GAAqB,EAAE;QAC5B,MAAM,CAAC,GAAG,wBAAwB,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GACP,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YAC/C,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE;gBAC9F,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAE9B,IAAI,GAAG,KAAK,YAAY;YAAE,OAAO,CAAC,CAAC;QACnC,YAAY,GAAG,GAAG,CAAC;QAEnB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACnD,SAAS,EAAE,CAAC,CAAC,OAAO;gBACpB,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC;gBACnD,MAAM,EACJ,0FAA0F;oBAC1F,wFAAwF;oBACxF,oFAAoF;oBACpF,oDAAoD;gBACtD,QAAQ,EACN,2FAA2F;oBAC3F,wFAAwF;oBACxF,yFAAyF;oBACzF,yBAAyB;aAC5B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,SAAS,EAAE,CAAC,CAAC,OAAO;gBACpB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,GAAG,MAAM,CAAC;gBACtD,MAAM,EAAE,8FAA8F;gBACtG,QAAQ,EAAE,2EAA2E;aACtF,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EACJ,uFAAuF;oBACvF,yFAAyF;gBAC3F,QAAQ,EAAE,8FAA8F;aACzG,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBACzD,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,gFAAgF;gBACxF,QAAQ,EAAE,8DAA8D;aACzE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC"}

package/dist/manifest-version-store-db.d.ts

@@ -1,24 +0,0 @@
-/**
- * CELLO-M7-PERSIST-002 (AC-008): DB-backed IManifestVersionStore.
- *
- * The last-seen manifest version (which backs the anti-rollback monotonicity invariant across daemon
- * restarts) lives in the `manifest_state` singleton row of the SQLCipher-encrypted daemon DB — not a
- * plaintext `manifest-version.json` file. Same interface as the old FileManifestVersionStore, so the
- * SignalingManager that consumes it is unchanged.
- *
- * Crypto reference: RFC 8032 context — the version number is not itself cryptographic, but its
- * correct, durable persistence is load-bearing for anti-rollback security (a reset enables a manifest
- * downgrade attack). Whole-DB SQLCipher now protects it at rest along with all other client state.
- */
-import type { IManifestVersionStore } from "@cello-protocol/transport";
-import type { DaemonDatabase } from "./sqlcipher-db.js";
-import type { Logger } from "./types.js";
-/** Idempotent schema for the singleton manifest-version row. */
-export declare function ensureManifestSchema(db: DaemonDatabase): void;
-export declare class DbManifestVersionStore implements IManifestVersionStore {
-    #private;
-    constructor(db: DaemonDatabase, logger: Logger);
-    getLastSeenVersion(): Promise<number | null>;
-    persistVersion(version: number): Promise<void>;
-}
-//# sourceMappingURL=manifest-version-store-db.d.ts.map

package/dist/manifest-version-store-db.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-version-store-db.d.ts","sourceRoot":"","sources":["../src/manifest-version-store-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAQ7D;AAED,qBAAa,sBAAuB,YAAW,qBAAqB;;gBAItD,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAMxC,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAO5C,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBrD"}

package/dist/manifest-version-store-db.js

@@ -1,58 +0,0 @@
-/**
- * CELLO-M7-PERSIST-002 (AC-008): DB-backed IManifestVersionStore.
- *
- * The last-seen manifest version (which backs the anti-rollback monotonicity invariant across daemon
- * restarts) lives in the `manifest_state` singleton row of the SQLCipher-encrypted daemon DB — not a
- * plaintext `manifest-version.json` file. Same interface as the old FileManifestVersionStore, so the
- * SignalingManager that consumes it is unchanged.
- *
- * Crypto reference: RFC 8032 context — the version number is not itself cryptographic, but its
- * correct, durable persistence is load-bearing for anti-rollback security (a reset enables a manifest
- * downgrade attack). Whole-DB SQLCipher now protects it at rest along with all other client state.
- */
-import { extractErrorMessage } from "./error-message.js";
-/** Idempotent schema for the singleton manifest-version row. */
-export function ensureManifestSchema(db) {
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS manifest_state (
-      id                INTEGER PRIMARY KEY CHECK (id = 1),
-      last_seen_version INTEGER,
-      updated_at        INTEGER NOT NULL
-    )
-  `);
-}
-export class DbManifestVersionStore {
-    #db;
-    #logger;
-    constructor(db, logger) {
-        this.#db = db;
-        this.#logger = logger;
-        ensureManifestSchema(db);
-    }
-    async getLastSeenVersion() {
-        const row = this.#db
-            .prepare("SELECT last_seen_version FROM manifest_state WHERE id = 1")
-            .get();
-        return row && row.last_seen_version != null ? Number(row.last_seen_version) : null;
-    }
-    async persistVersion(version) {
-        // Upsert the singleton row. Atomic within the encrypted DB — no temp-file rename dance.
-        try {
-            this.#db
-                .prepare(`INSERT INTO manifest_state (id, last_seen_version, updated_at)
-           VALUES (1, ?, ?)
-           ON CONFLICT(id) DO UPDATE SET last_seen_version = excluded.last_seen_version, updated_at = excluded.updated_at`)
-                .run(version, Date.now());
-        }
-        catch (err) {
-            // AC-012: a distinct, actionable failure — never a silent no-op (a lost anti-rollback version
-            // would re-open a manifest-downgrade window).
-            this.#logger.error("persist.manifest.persist.failed", { version, error: extractErrorMessage(err) });
-            const e = new Error(`manifest_persist_failed: ${extractErrorMessage(err)}`);
-            e.code = "manifest_persist_failed";
-            throw e;
-        }
-        this.#logger.info("persist.manifest.version.persisted", { version });
-    }
-}
-//# sourceMappingURL=manifest-version-store-db.js.map

package/dist/manifest-version-store-db.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-version-store-db.js","sourceRoot":"","sources":["../src/manifest-version-store-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,EAAkB;IACrD,EAAE,CAAC,IAAI,CAAC;;;;;;GAMP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,sBAAsB;IACxB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,EAAsD,CAAC;QAC7D,OAAO,GAAG,IAAI,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,wFAAwF;QACxF,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;0HAEgH,CACjH;iBACA,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,8FAA8F;YAC9F,8CAA8C;YAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpG,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,4BAA4B,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,CAA+B,CAAC,IAAI,GAAG,yBAAyB,CAAC;YAClE,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/manifest-version-store.d.ts

@@ -1,16 +0,0 @@
-/**
- * M7-MANIFEST-002 — Manifest version store re-exports.
- *
- * IManifestVersionStore persists the last-seen manifest version number to enforce
- * version monotonicity across daemon restarts. A manifest with a lower version
- * number than the last-seen version is rejected as a potential rollback attack.
- *
- * InMemoryManifestVersionStore: stub for tests and initial deployments.
- * DbManifestVersionStore (manifest-version-store-db.ts): the production store — the version lives in
- * the SQLCipher-encrypted manifest_state table (PERSIST-002 AC-008). The old file-backed store was
- * removed.
- */
-import type { IManifestVersionStore } from "@cello-protocol/transport";
-export { InMemoryManifestVersionStore } from "@cello-protocol/transport";
-export type { IManifestVersionStore };
-//# sourceMappingURL=manifest-version-store.d.ts.map

package/dist/manifest-version-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-version-store.d.ts","sourceRoot":"","sources":["../src/manifest-version-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEzE,YAAY,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/manifest-version-store.js

@@ -1,15 +0,0 @@
-/**
- * M7-MANIFEST-002 — Manifest version store re-exports.
- *
- * IManifestVersionStore persists the last-seen manifest version number to enforce
- * version monotonicity across daemon restarts. A manifest with a lower version
- * number than the last-seen version is rejected as a potential rollback attack.
- *
- * InMemoryManifestVersionStore: stub for tests and initial deployments.
- * DbManifestVersionStore (manifest-version-store-db.ts): the production store — the version lives in
- * the SQLCipher-encrypted manifest_state table (PERSIST-002 AC-008). The old file-backed store was
- * removed.
- */
-// Re-export from transport stubs for convenience
-export { InMemoryManifestVersionStore } from "@cello-protocol/transport";
-//# sourceMappingURL=manifest-version-store.js.map

package/dist/manifest-version-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-version-store.js","sourceRoot":"","sources":["../src/manifest-version-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,iDAAiD;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC"}