@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/registration-persistence.d.ts

@@ -1,183 +0,0 @@
-/**
- * Daemon registration persistence — CELLO-M7-REGISTRATION.
- *
- * The daemon owns each agent's registration material (ML-DSA keypair, FROST key
- * share, registration state) as per-agent files under ~/.cello/agents/<name>/.
- * This mirrors the daemon's existing `key`-file model (see agent-loader.ts) and
- * deliberately does NOT drag the client's SQLCipher ClientStatePersistence into
- * the daemon — that layer is keyed by agent_pubkey in one shared DB, whereas the
- * daemon isolates each agent in its own directory (cleaner for multi-agent).
- *
- * Security posture: the FROST signing share and ML-DSA secret key are written
- * with 0o600 permissions, atomically (write-to-tmp + rename), consistent with the
- * daemon's existing plaintext K_local `key` file. Encryption-at-rest for the
- * daemon is a separate future concern and is intentionally NOT introduced
- * piecemeal here. The signing share (SI-001) and secret key blob (SI-002) must
- * never appear in a log event — only the files hold them.
- */
-import type { Logger } from "./types.js";
-export interface RegistrationStateRecord {
-    agentId: string;
-    primaryPubkey: string;
-    mlDsaPubkey: string;
-    registeredAt: number;
-    status: string;
-    /**
-     * 038-KEYBIND. Hex 64-byte Ed25519 signature by this agent's K_local over
-     * (k_local_pubkey, primaryPubkey). Null for an agent whose row predates the column.
-     *
-     * ⚠️ **WRITTEN, AND READ BY NOTHING YET** — said plainly rather than implied, because the careful
-     * null-handling around it otherwise reads as a decision some caller acts on, and no caller
-     * exists. The live copy is the one on the DIRECTORY's profile, which is what rides on every
-     * session assignment; this is the agent's own record of what it signed, kept so a future
-     * re-upload does not have to re-derive it from a value a directory supplied.
-     */
-    keyBinding: string | null;
-    /**
-     * M16: true when this identity is a broadcast channel. Recorded at registration from what the
-     * directory ECHOED, never changed. False for an ordinary agent and for a record written without it.
-     */
-    channel: boolean;
-    /** M16: hex pubkey of the agent that administers this channel; "" when `channel` is false. */
-    adminPubkey: string;
-}
-export interface MlDsaKeypairRecord {
-    mlDsaPubkey: string;
-    secretKeyBlob: Uint8Array;
-    algorithm: string;
-}
-export interface FrostKeyShareRecord {
-    epochId: string;
-    primaryPubkey: string;
-    identifier: string;
-    signingShare: Uint8Array;
-    threshold: number;
-    participants: number;
-    commitmentsCbor: Uint8Array;
-    verifyingSharesCbor: Uint8Array;
-    dkgMethod: string;
-    /** M8B quorum: the directory nodeIds (Q) the DKG ran among; a restored signer targets these. */
-    directoryNodeIds?: string[];
-}
-/**
- * The agent→user linkage captured at registration. The pre-authorization ticket
- * (issued by the CELLO Operations Agent) binds this agent to a user; recording it
- * here is the M7 "capture-now-or-lose-it" requirement — *using* the link (trust
- * signals that attach to the user) is future trust-layer work.
- */
-export interface AgentUserLinkRecord {
-    agentId: string;
-    preAuthToken: string;
-    linkedAt: number;
-}
-/**
- * Narrow persistence seam consumed by the daemon's RegistrationManager. Exactly
- * the three persist operations the registration flow performs, plus the matching
- * load operations needed to rehydrate an already-registered agent on restart.
- */
-export interface DaemonRegistrationPersistence {
-    persistMlDsaKeypair(opts: {
-        mlDsaPubkey: string;
-        secretKeyBlob: Uint8Array;
-    }): Promise<void>;
-    persistRegistrationState(opts: {
-        agentId: string;
-        primaryPubkey: string;
-        mlDsaPubkey: string;
-        registeredAt: number;
-        /**
-         * 038-KEYBIND. The binding minted at the tail of registration, hex. Persisted BESIDE the share
-         * because it is the same kind of artifact: produced once, for the life of the agent, from key
-         * material that is only ever together on this machine.
-         */
-        keyBinding: string;
-        /** M16: set only for a channel the directory echoed as one. Absent means an ordinary agent. */
-        channel?: boolean;
-        adminPubkey?: string;
-    }): Promise<void>;
-    persistFrostKeyShare(opts: {
-        epochId: string;
-        primaryPubkey: string;
-        identifier: string;
-        signingShare: Uint8Array;
-        threshold: number;
-        participants: number;
-        commitmentsCbor: Uint8Array;
-        verifyingSharesCbor: Uint8Array;
-        dkgMethod: "trusted_dealer" | "network_dkg";
-        /** M8B quorum: the directory nodeIds (Q) the DKG ran among; a restored signer targets these. */
-        directoryNodeIds?: string[];
-    }): Promise<void>;
-    loadRegistrationState(): Promise<RegistrationStateRecord | null>;
-    loadMlDsaKeypair(): Promise<MlDsaKeypairRecord | null>;
-    loadActiveFrostKeyShare(): Promise<FrostKeyShareRecord | null>;
-}
-/**
- * M16: the channel facts of a registration write, checked. A channel without an admin is refused,
- * and so is any write that would CHANGE the facts already recorded for a registered identity:
- * `channel` and `adminPubkey` are fixed at registration. Writing the same facts again is allowed.
- * Shared by both stores so they cannot disagree.
- */
-export declare function checkChannelFacts(incoming: {
-    channel?: boolean;
-    adminPubkey?: string;
-}, existing: {
-    channel: boolean;
-    adminPubkey: string;
-} | null): {
-    channel: boolean;
-    adminPubkey: string;
-};
-/**
- * File-backed implementation. One instance is scoped to a single agent's
- * directory (e.g. ~/.cello/agents/alice/). The directory is created on first
- * write; load methods on a fresh agent return null (ENOENT is not an error).
- */
-export declare class FileRegistrationPersistence implements DaemonRegistrationPersistence {
-    #private;
-    constructor(opts: {
-        agentDir: string;
-        logger: Logger;
-    });
-    persistMlDsaKeypair(opts: {
-        mlDsaPubkey: string;
-        secretKeyBlob: Uint8Array;
-    }): Promise<void>;
-    persistRegistrationState(opts: {
-        agentId: string;
-        primaryPubkey: string;
-        mlDsaPubkey: string;
-        registeredAt: number;
-        keyBinding: string;
-        channel?: boolean;
-        adminPubkey?: string;
-    }): Promise<void>;
-    persistFrostKeyShare(opts: {
-        epochId: string;
-        primaryPubkey: string;
-        identifier: string;
-        signingShare: Uint8Array;
-        threshold: number;
-        participants: number;
-        commitmentsCbor: Uint8Array;
-        verifyingSharesCbor: Uint8Array;
-        dkgMethod: "trusted_dealer" | "network_dkg";
-        /** M8B quorum: the directory nodeIds (Q) the DKG ran among; a restored signer targets these. */
-        directoryNodeIds?: string[];
-    }): Promise<void>;
-    /**
-     * Capture the agent→user link at registration (M7 capture-now-or-lose-it). Not
-     * part of the RegistrationManager seam — called by the cello_register handler
-     * after a successful register(), since only the handler holds the pre-auth ticket.
-     */
-    persistAgentUserLink(opts: {
-        agentId: string;
-        preAuthToken: string;
-        linkedAt: number;
-    }): Promise<void>;
-    loadRegistrationState(): Promise<RegistrationStateRecord | null>;
-    loadMlDsaKeypair(): Promise<MlDsaKeypairRecord | null>;
-    loadActiveFrostKeyShare(): Promise<FrostKeyShareRecord | null>;
-    loadAgentUserLink(): Promise<AgentUserLinkRecord | null>;
-}
-//# sourceMappingURL=registration-persistence.d.ts.map

package/dist/registration-persistence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registration-persistence.d.ts","sourceRoot":"","sources":["../src/registration-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAIzC,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,UAAU,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,mBAAmB,EAAE,UAAU,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,mBAAmB,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,wBAAwB,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB;;;;WAIG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB,+FAA+F;QAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,oBAAoB,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,UAAU,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,UAAU,CAAC;QAC5B,mBAAmB,EAAE,UAAU,CAAC;QAChC,SAAS,EAAE,gBAAgB,GAAG,aAAa,CAAC;QAC5C,gGAAgG;QAChG,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACjE,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACvD,uBAAuB,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CAChE;AAWD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACrD,QAAQ,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GACzD;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAa3C;AA0BD;;;;GAIG;AACH,qBAAa,2BAA4B,YAAW,6BAA6B;;gBAKnE,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAOhD,mBAAmB,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5F,wBAAwB,CAAC,IAAI,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBX,oBAAoB,CAAC,IAAI,EAAE;QAC/B,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,UAAU,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,UAAU,CAAC;QAC5B,mBAAmB,EAAE,UAAU,CAAC;QAChC,SAAS,EAAE,gBAAgB,GAAG,aAAa,CAAC;QAC5C,gGAAgG;QAChG,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBjB;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtG,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAiBhE,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAUtD,uBAAuB,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAgB9D,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAyE/D"}

package/dist/registration-persistence.js

@@ -1,263 +0,0 @@
-/**
- * Daemon registration persistence — CELLO-M7-REGISTRATION.
- *
- * The daemon owns each agent's registration material (ML-DSA keypair, FROST key
- * share, registration state) as per-agent files under ~/.cello/agents/<name>/.
- * This mirrors the daemon's existing `key`-file model (see agent-loader.ts) and
- * deliberately does NOT drag the client's SQLCipher ClientStatePersistence into
- * the daemon — that layer is keyed by agent_pubkey in one shared DB, whereas the
- * daemon isolates each agent in its own directory (cleaner for multi-agent).
- *
- * Security posture: the FROST signing share and ML-DSA secret key are written
- * with 0o600 permissions, atomically (write-to-tmp + rename), consistent with the
- * daemon's existing plaintext K_local `key` file. Encryption-at-rest for the
- * daemon is a separate future concern and is intentionally NOT introduced
- * piecemeal here. The signing share (SI-001) and secret key blob (SI-002) must
- * never appear in a log event — only the files hold them.
- */
-import { mkdir, readFile, rename, chmod, unlink, open as fsOpen } from "node:fs/promises";
-import { randomBytes } from "node:crypto";
-import { join, dirname } from "node:path";
-// ─── On-disk file names (relative to the agent directory) ────────────────────
-const FILE_REGISTRATION_STATE = "registration-state.json";
-const FILE_MLDSA_KEYPAIR = "ml-dsa-keypair.json";
-const FILE_FROST_SHARE = "frost-share.json";
-const FILE_AGENT_USER_LINK = "agent-user-link.json";
-const SECRET_FILE_MODE = 0o600;
-/**
- * M16: the channel facts of a registration write, checked. A channel without an admin is refused,
- * and so is any write that would CHANGE the facts already recorded for a registered identity:
- * `channel` and `adminPubkey` are fixed at registration. Writing the same facts again is allowed.
- * Shared by both stores so they cannot disagree.
- */
-export function checkChannelFacts(incoming, existing) {
-    const channel = incoming.channel === true;
-    const adminPubkey = channel ? (incoming.adminPubkey ?? "") : "";
-    if (channel && adminPubkey === "") {
-        throw new Error("invalid_channel_registration: a channel must name its admin pubkey");
-    }
-    if (existing && (existing.channel !== channel || existing.adminPubkey !== adminPubkey)) {
-        throw new Error(`channel_fields_immutable: this identity is registered with channel=${existing.channel}` +
-            `${existing.channel ? ` and admin ${existing.adminPubkey}` : ""}; a registration write cannot change that`);
-    }
-    return { channel, adminPubkey };
-}
-const hex = (b) => Buffer.from(b).toString("hex");
-const unhex = (s) => new Uint8Array(Buffer.from(s, "hex"));
-/**
- * Required-field accessors. A registration file that exists but is missing or
- * mistypes a field is corrupt — surface it loudly rather than silently coercing
- * to NaN / an empty buffer (which would read as "unregistered" or hand crypto a
- * zero-length key). Atomic writes make this unreachable in normal operation.
- */
-function reqStr(obj, key, file) {
-    const v = obj[key];
-    if (typeof v !== "string") {
-        throw new Error(`registration file '${file}' is corrupt: missing or non-string field '${key}'`);
-    }
-    return v;
-}
-function reqNum(obj, key, file) {
-    const v = obj[key];
-    if (typeof v !== "number" || !Number.isFinite(v)) {
-        throw new Error(`registration file '${file}' is corrupt: missing or non-numeric field '${key}'`);
-    }
-    return v;
-}
-/**
- * File-backed implementation. One instance is scoped to a single agent's
- * directory (e.g. ~/.cello/agents/alice/). The directory is created on first
- * write; load methods on a fresh agent return null (ENOENT is not an error).
- */
-export class FileRegistrationPersistence {
-    #agentDir;
-    #logger;
-    #tmpCounter = 0;
-    constructor(opts) {
-        this.#agentDir = opts.agentDir;
-        this.#logger = opts.logger;
-    }
-    // ─── Persist ───────────────────────────────────────────────────────────────
-    async persistMlDsaKeypair(opts) {
-        // SI-002: secretKeyBlob is written to disk only — never logged.
-        await this.#writeJsonAtomic(FILE_MLDSA_KEYPAIR, {
-            mlDsaPubkey: opts.mlDsaPubkey,
-            secretKeyBlob: hex(opts.secretKeyBlob),
-            algorithm: "ML-DSA-44",
-        });
-        this.#logger.info("registration.mldsa.persisted", { mlDsaPubkey: opts.mlDsaPubkey });
-    }
-    async persistRegistrationState(opts) {
-        const facts = checkChannelFacts(opts, await this.loadRegistrationState());
-        await this.#writeJsonAtomic(FILE_REGISTRATION_STATE, {
-            agentId: opts.agentId,
-            primaryPubkey: opts.primaryPubkey,
-            mlDsaPubkey: opts.mlDsaPubkey,
-            registeredAt: opts.registeredAt,
-            // 038-KEYBIND: a public signature, not a secret — but it lives with the rest of the
-            // registration record because it is meaningless apart from the two keys it names.
-            keyBinding: opts.keyBinding,
-            channel: facts.channel,
-            adminPubkey: facts.adminPubkey,
-            status: "active",
-        });
-        this.#logger.info("registration.state.persisted", {
-            agentId: opts.agentId,
-            primaryPubkey: opts.primaryPubkey,
-        });
-    }
-    async persistFrostKeyShare(opts) {
-        // A daemon agent holds exactly one active FROST share; a new DKG replaces it.
-        await this.#writeJsonAtomic(FILE_FROST_SHARE, {
-            epochId: opts.epochId,
-            primaryPubkey: opts.primaryPubkey,
-            identifier: opts.identifier,
-            signingShare: hex(opts.signingShare), // SI-001: on disk only, never logged
-            threshold: opts.threshold,
-            participants: opts.participants,
-            commitmentsCbor: hex(opts.commitmentsCbor),
-            verifyingSharesCbor: hex(opts.verifyingSharesCbor),
-            dkgMethod: opts.dkgMethod,
-            directoryNodeIds: opts.directoryNodeIds,
-        });
-        // SI-001: signingShare MUST NOT appear in this event.
-        this.#logger.info("registration.frost.share.persisted", {
-            epochId: opts.epochId,
-            threshold: opts.threshold,
-            participants: opts.participants,
-            dkgMethod: opts.dkgMethod,
-        });
-    }
-    /**
-     * Capture the agent→user link at registration (M7 capture-now-or-lose-it). Not
-     * part of the RegistrationManager seam — called by the cello_register handler
-     * after a successful register(), since only the handler holds the pre-auth ticket.
-     */
-    async persistAgentUserLink(opts) {
-        // SI: the preAuthToken is a bearer ticket — written to disk only, never logged.
-        await this.#writeJsonAtomic(FILE_AGENT_USER_LINK, {
-            agentId: opts.agentId,
-            preAuthToken: opts.preAuthToken,
-            linkedAt: opts.linkedAt,
-        });
-        this.#logger.info("registration.user_link.persisted", { agentId: opts.agentId });
-    }
-    // ─── Load (restart rehydration) ──────────────────────────────────────────────
-    async loadRegistrationState() {
-        const obj = await this.#readJson(FILE_REGISTRATION_STATE);
-        if (!obj)
-            return null;
-        return {
-            agentId: reqStr(obj, "agentId", FILE_REGISTRATION_STATE),
-            primaryPubkey: reqStr(obj, "primaryPubkey", FILE_REGISTRATION_STATE),
-            mlDsaPubkey: reqStr(obj, "mlDsaPubkey", FILE_REGISTRATION_STATE),
-            registeredAt: reqNum(obj, "registeredAt", FILE_REGISTRATION_STATE),
-            status: reqStr(obj, "status", FILE_REGISTRATION_STATE),
-            // NOT `reqStr`: a file written before 038-KEYBIND has no such field, and that is a value to
-            // report (null), not a corrupt-file throw that would make the agent unloadable.
-            keyBinding: typeof obj["keyBinding"] === "string" ? obj["keyBinding"] : null,
-            channel: obj["channel"] === true,
-            adminPubkey: obj["channel"] === true && typeof obj["adminPubkey"] === "string" ? obj["adminPubkey"] : "",
-        };
-    }
-    async loadMlDsaKeypair() {
-        const obj = await this.#readJson(FILE_MLDSA_KEYPAIR);
-        if (!obj)
-            return null;
-        return {
-            mlDsaPubkey: reqStr(obj, "mlDsaPubkey", FILE_MLDSA_KEYPAIR),
-            secretKeyBlob: unhex(reqStr(obj, "secretKeyBlob", FILE_MLDSA_KEYPAIR)),
-            algorithm: reqStr(obj, "algorithm", FILE_MLDSA_KEYPAIR),
-        };
-    }
-    async loadActiveFrostKeyShare() {
-        const obj = await this.#readJson(FILE_FROST_SHARE);
-        if (!obj)
-            return null;
-        return {
-            epochId: reqStr(obj, "epochId", FILE_FROST_SHARE),
-            primaryPubkey: reqStr(obj, "primaryPubkey", FILE_FROST_SHARE),
-            identifier: reqStr(obj, "identifier", FILE_FROST_SHARE),
-            signingShare: unhex(reqStr(obj, "signingShare", FILE_FROST_SHARE)),
-            threshold: reqNum(obj, "threshold", FILE_FROST_SHARE),
-            participants: reqNum(obj, "participants", FILE_FROST_SHARE),
-            commitmentsCbor: unhex(reqStr(obj, "commitmentsCbor", FILE_FROST_SHARE)),
-            verifyingSharesCbor: unhex(reqStr(obj, "verifyingSharesCbor", FILE_FROST_SHARE)),
-            dkgMethod: reqStr(obj, "dkgMethod", FILE_FROST_SHARE),
-        };
-    }
-    async loadAgentUserLink() {
-        const obj = await this.#readJson(FILE_AGENT_USER_LINK);
-        if (!obj)
-            return null;
-        return {
-            agentId: reqStr(obj, "agentId", FILE_AGENT_USER_LINK),
-            preAuthToken: reqStr(obj, "preAuthToken", FILE_AGENT_USER_LINK),
-            linkedAt: reqNum(obj, "linkedAt", FILE_AGENT_USER_LINK),
-        };
-    }
-    // ─── Internals ───────────────────────────────────────────────────────────────
-    async #readJson(name) {
-        let raw;
-        try {
-            raw = await readFile(join(this.#agentDir, name));
-        }
-        catch (err) {
-            if (err.code === "ENOENT")
-                return null;
-            throw err;
-        }
-        return JSON.parse(raw.toString("utf8"));
-    }
-    /** Write JSON atomically (tmp + rename) with 0o600 so partial writes never surface. */
-    async #writeJsonAtomic(name, value) {
-        await mkdir(this.#agentDir, { recursive: true });
-        const finalPath = join(this.#agentDir, name);
-        // Random suffix (not just pid+counter) so two FileRegistrationPersistence
-        // instances sharing an agentDir in one process can never collide on the tmp
-        // path and truncate each other's write.
-        const tmpPath = join(dirname(finalPath), `.cello-reg-tmp-${process.pid}-${++this.#tmpCounter}-${randomBytes(6).toString("hex")}-${name}`);
-        const body = Buffer.from(JSON.stringify(value), "utf8");
-        try {
-            const fd = await fsOpen(tmpPath, "w", SECRET_FILE_MODE);
-            try {
-                await fd.write(body);
-                await fd.chmod(SECRET_FILE_MODE);
-                // fsync the data before rename so a crash between write and rename can't
-                // surface an empty/partial key file on recovery.
-                await fd.sync();
-            }
-            finally {
-                await fd.close();
-            }
-            await rename(tmpPath, finalPath);
-            // rename preserves the tmp file's mode; chmod the final path defensively in
-            // case it pre-existed with looser permissions.
-            await chmod(finalPath, SECRET_FILE_MODE);
-            // Best-effort durability of the rename itself (parent-dir fsync). Not all
-            // platforms/filesystems support directory fsync — ignore failures.
-            await this.#fsyncDir(this.#agentDir);
-        }
-        catch (err) {
-            // Never leave plaintext secret material (ML-DSA secret / FROST share) as
-            // orphaned tmp litter if the write or rename failed partway.
-            await unlink(tmpPath).catch(() => { });
-            throw err;
-        }
-    }
-    async #fsyncDir(dir) {
-        try {
-            const dh = await fsOpen(dir, "r");
-            try {
-                await dh.sync();
-            }
-            finally {
-                await dh.close();
-            }
-        }
-        catch {
-            // Directory fsync is best-effort; some platforms reject opening a dir for sync.
-        }
-    }
-}
-//# sourceMappingURL=registration-persistence.js.map

package/dist/registration-persistence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registration-persistence.js","sourceRoot":"","sources":["../src/registration-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwG1C,gFAAgF;AAEhF,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAC1D,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAqD,EACrD,QAA0D;IAE1D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,OAAO,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CACb,sEAAsE,QAAQ,CAAC,OAAO,EAAE;YACtF,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,2CAA2C,CAC7G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/E;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAA4B,EAAE,GAAW,EAAE,IAAY;IACrE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,8CAA8C,GAAG,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,MAAM,CAAC,GAA4B,EAAE,GAAW,EAAE,IAAY;IACrE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,+CAA+C,GAAG,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAC7B,SAAS,CAAS;IAClB,OAAO,CAAS;IACzB,WAAW,GAAG,CAAC,CAAC;IAEhB,YAAY,IAA0C;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAE9E,KAAK,CAAC,mBAAmB,CAAC,IAAwD;QAChF,gEAAgE;QAChE,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;YACtC,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,IAQ9B;QACC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE;YACnD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oFAAoF;YACpF,kFAAkF;YAClF,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAChD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAY1B;QACC,8EAA8E;QAC9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE;YAC5C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,qCAAqC;YAC3E,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YAC1C,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC;YAClD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC;QACH,sDAAsD;QACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAiE;QAC1F,gFAAgF;QAChF,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE;YAChD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,gFAAgF;IAEhF,KAAK,CAAC,qBAAqB;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,uBAAuB,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,uBAAuB,CAAC;YACpE,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,uBAAuB,CAAC;YAChE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,uBAAuB,CAAC;YAClE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,uBAAuB,CAAC;YACtD,4FAA4F;YAC5F,gFAAgF;YAChF,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YAC5E,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI;YAChC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;SACzG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,kBAAkB,CAAC;YAC3D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;YACtE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,kBAAkB,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,CAAC;YAC7D,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC;YACvD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;YAClE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,gBAAgB,CAAC;YACrD,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,gBAAgB,CAAC;YAC3D,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;YACxE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;YAChF,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,gBAAgB,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,CAAC;YACrD,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,oBAAoB,CAAC;YAC/D,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,oBAAoB,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAEhF,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACrE,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,KAA8B;QACjE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,0EAA0E;QAC1E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,OAAO,GAAG,IAAI,CAClB,OAAO,CAAC,SAAS,CAAC,EAClB,kBAAkB,OAAO,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAChG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrB,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACjC,yEAAyE;gBACzE,iDAAiD;gBACjD,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACjC,4EAA4E;YAC5E,+CAA+C;YAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACzC,0EAA0E;YAC1E,mEAAmE;YACnE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/registry-poll.d.ts

@@ -1,52 +0,0 @@
-/**
- * DOD-REGISTRY-1 (client half) — HTTP registry poll.
- *
- * Mirrors http-manifest-poll.ts: fetches the signed registry document from the directory,
- * verifies its Ed25519 signature against a BUILD-TIME-PINNED registry pubkey, enforces
- * anti-rollback (version must be strictly greater than last seen), and updates the
- * in-memory TypeRegistry on success. Never throws — a failure returns a distinct reason
- * and leaves the last-good cache untouched (a bad registry never blanks classification).
- *
- * INV-DIR-DUMB: the directory serves the registry as opaque bytes; the CLIENT is the
- * authoritative verifier.
- * INV-TYPE-CARRY: absent type → unclassified, never an error.
- * INV-ZERO-BUMP: a registry update requires NO release anywhere.
- *
- * Crypto reference: RFC 8032 (Ed25519 single-key verification of the inner document).
- */
-import type { TypeRegistry } from "./type-registry.js";
-import type { IRegistryVersionStore } from "./registry-version-store-db.js";
-import type { IManifestPollScheduler } from "@cello-protocol/transport";
-export interface RegistryPollLogger {
-    info(event: string, ctx?: Record<string, unknown>): void;
-    warn(event: string, ctx?: Record<string, unknown>): void;
-    error(event: string, ctx?: Record<string, unknown>): void;
-}
-export type RegistryPollFailureReason = "registry_http_unreachable" | "registry_not_published" | "registry_malformed" | "registry_signature_invalid" | "registry_version_rollback" | "registry_store_error";
-export type RegistryPollOutcome = {
-    ok: true;
-    adopted: boolean;
-    oldVersion: number | null;
-    newVersion: number;
-} | {
-    ok: false;
-    reason: RegistryPollFailureReason;
-};
-export interface RegistryPollDeps {
-    typeRegistry: TypeRegistry;
-    registryVersionStore: IRegistryVersionStore;
-    registryPubkey: string;
-    logger: RegistryPollLogger;
-}
-export declare function pollRegistryOverHttp(opts: {
-    directoryUrl: string;
-    fetchFn?: typeof fetch;
-    correlationId?: string;
-} & RegistryPollDeps): Promise<RegistryPollOutcome>;
-export declare function startRegistryPoll(opts: {
-    scheduler: IManifestPollScheduler;
-    directoryUrl: string;
-    fetchFn?: typeof fetch;
-    mintCorrelationId?: () => string;
-} & RegistryPollDeps): () => void;
-//# sourceMappingURL=registry-poll.d.ts.map

package/dist/registry-poll.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-poll.d.ts","sourceRoot":"","sources":["../src/registry-poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGxE,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED,MAAM,MAAM,yBAAyB,GACjC,2BAA2B,GAC3B,wBAAwB,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,2BAA2B,GAC3B,sBAAsB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AA0BD,wBAAsB,oBAAoB,CACxC,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,gBAAgB,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAsF9B;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IACJ,SAAS,EAAE,sBAAsB,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC,GAAG,gBAAgB,GACnB,MAAM,IAAI,CAyBZ"}

package/dist/registry-poll.js

@@ -1,140 +0,0 @@
-/**
- * DOD-REGISTRY-1 (client half) — HTTP registry poll.
- *
- * Mirrors http-manifest-poll.ts: fetches the signed registry document from the directory,
- * verifies its Ed25519 signature against a BUILD-TIME-PINNED registry pubkey, enforces
- * anti-rollback (version must be strictly greater than last seen), and updates the
- * in-memory TypeRegistry on success. Never throws — a failure returns a distinct reason
- * and leaves the last-good cache untouched (a bad registry never blanks classification).
- *
- * INV-DIR-DUMB: the directory serves the registry as opaque bytes; the CLIENT is the
- * authoritative verifier.
- * INV-TYPE-CARRY: absent type → unclassified, never an error.
- * INV-ZERO-BUMP: a registry update requires NO release anywhere.
- *
- * Crypto reference: RFC 8032 (Ed25519 single-key verification of the inner document).
- */
-import { verify } from "@cello-protocol/crypto";
-import { extractErrorMessage } from "./error-message.js";
-const FETCH_TIMEOUT_MS = 10_000;
-function canonicalRegistryBody(doc) {
-    const body = {};
-    for (const key of Object.keys(doc)) {
-        if (key !== "signature") {
-            body[key] = doc[key];
-        }
-    }
-    const json = JSON.stringify(body, sortedReplacer);
-    return new TextEncoder().encode(json);
-}
-function sortedReplacer(_key, value) {
-    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-        const sorted = {};
-        for (const k of Object.keys(value).sort()) {
-            sorted[k] = value[k];
-        }
-        return sorted;
-    }
-    return value;
-}
-export async function pollRegistryOverHttp(opts) {
-    const { directoryUrl, fetchFn = fetch, correlationId, typeRegistry, registryVersionStore, registryPubkey, logger, } = opts;
-    const registryUrl = `${directoryUrl.replace(/\/$/, "")}/registry`;
-    logger.info("registry.poll.dispatched", { directoryUrl, correlationId });
-    let rawBytes;
-    try {
-        const ac = new AbortController();
-        const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS);
-        let resp;
-        try {
-            resp = await fetchFn(registryUrl, { signal: ac.signal });
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        if (resp.status === 404) {
-            logger.info("registry.poll.not_published", { directoryUrl, correlationId });
-            return { ok: false, reason: "registry_not_published" };
-        }
-        if (!resp.ok) {
-            logger.warn("registry.poll.failed", { reason: "registry_http_unreachable", status: resp.status, directoryUrl, correlationId });
-            return { ok: false, reason: "registry_http_unreachable" };
-        }
-        rawBytes = await resp.arrayBuffer();
-    }
-    catch (err) {
-        logger.warn("registry.poll.failed", { reason: "registry_http_unreachable", directoryUrl, correlationId, error: extractErrorMessage(err) });
-        return { ok: false, reason: "registry_http_unreachable" };
-    }
-    let doc;
-    try {
-        const text = new TextDecoder().decode(rawBytes);
-        doc = JSON.parse(text);
-    }
-    catch {
-        logger.warn("registry.poll.failed", { reason: "registry_malformed", directoryUrl, correlationId });
-        return { ok: false, reason: "registry_malformed" };
-    }
-    if (typeof doc.version !== "number" || typeof doc.signature !== "string" || typeof doc.types !== "object" || doc.types === null) {
-        logger.warn("registry.poll.failed", { reason: "registry_malformed", directoryUrl, correlationId });
-        return { ok: false, reason: "registry_malformed" };
-    }
-    const version = doc.version;
-    const signature = doc.signature;
-    // Verify Ed25519 signature against pinned pubkey
-    const bodyBytes = canonicalRegistryBody(doc);
-    const sigBytes = new Uint8Array(Buffer.from(signature, "hex"));
-    const pubBytes = new Uint8Array(Buffer.from(registryPubkey, "hex"));
-    if (!verify(pubBytes, bodyBytes, sigBytes)) {
-        logger.warn("registry.signature.invalid", { version, directoryUrl, correlationId });
-        return { ok: false, reason: "registry_signature_invalid" };
-    }
-    // Anti-rollback + adopt
-    try {
-        const lastSeen = registryVersionStore.getLastSeenVersion();
-        if (lastSeen !== null && version <= lastSeen) {
-            if (version < lastSeen) {
-                logger.warn("registry.poll.failed", { reason: "registry_version_rollback", version, lastSeenVersion: lastSeen, correlationId });
-                return { ok: false, reason: "registry_version_rollback" };
-            }
-            // Equal — already current
-            return { ok: true, adopted: false, oldVersion: lastSeen, newVersion: version };
-        }
-        const oldVersion = typeRegistry.currentVersion;
-        typeRegistry.update(doc);
-        registryVersionStore.persistVersion(version);
-        logger.info("registry.poll.success", { oldVersion, newVersion: version, directoryUrl, correlationId });
-        return { ok: true, adopted: true, oldVersion, newVersion: version };
-    }
-    catch (err) {
-        logger.error("registry.poll.failed", { reason: "registry_store_error", version, directoryUrl, correlationId, error: extractErrorMessage(err) });
-        return { ok: false, reason: "registry_store_error" };
-    }
-}
-export function startRegistryPoll(opts) {
-    const { scheduler, directoryUrl, fetchFn, mintCorrelationId, typeRegistry, registryVersionStore, registryPubkey, logger } = opts;
-    let stopped = false;
-    const tick = async () => {
-        if (stopped)
-            return;
-        await pollRegistryOverHttp({
-            directoryUrl,
-            fetchFn,
-            correlationId: mintCorrelationId?.(),
-            typeRegistry,
-            registryVersionStore,
-            registryPubkey,
-            logger,
-        }).catch((err) => {
-            logger.error("registry.poll.failed", { reason: "registry_poll_unexpected_error", directoryUrl, error: extractErrorMessage(err) });
-        });
-        if (!stopped)
-            scheduler.scheduleNext(tick);
-    };
-    scheduler.scheduleNext(tick);
-    return () => {
-        stopped = true;
-        scheduler.cancel();
-    };
-}
-//# sourceMappingURL=registry-poll.js.map