@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/seal-local-terminus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-local-terminus.d.ts","sourceRoot":"","sources":["../src/seal-local-terminus.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AA2BlE,MAAM,WAAW,sBAAsB;IACrC,sFAAsF;IACtF,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAChC,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,SAAS,EAAE,UAAU,CAAC;IACtB,kEAAkE;IAClE,cAAc,EAAE,UAAU,CAAC;IAC3B,mGAAmG;IACnG,OAAO,EAAE,UAAU,CAAC;IACpB,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAClD;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA6FlC"}

package/dist/seal-local-terminus.js

@@ -0,0 +1,170 @@
+/**
+ * `DOD-M15-CARRIEDSEAL-1` — THE CLOSING LEAF THIS SIDE WRITES WHEN THERE IS NO RELAY LEFT TO ASK.
+ *
+ * ─── What this exists to fix ───────────────────────────────────────────────────────────────────
+ *
+ * A seal needed the relay alive, and for exactly one reason. Every message in a conversation is
+ * countersigned by the relay when it is ordered and held by BOTH parties from that moment
+ * (`069-ORDERPROOF`), so the record itself survives the relay being restarted, rolled or deleted.
+ * What did not survive was the last line: the SEAL control leaf that ends the record was handed to
+ * the relay for a sequence number like any other leaf, so a relay that was gone at close time cost
+ * the conversation its receipt — a record that was fully witnessed, fully held, and unusable.
+ *
+ * This writes that one leaf here instead.
+ *
+ * ─── Why nothing is being taken on trust ───────────────────────────────────────────────────────
+ *
+ * The leaf invents no facts. **Every field is read out of the carry it closes over**, which is the
+ * relay's own ordered log as both parties received it:
+ *
+ *   - **position** — one past the last carried leaf. Contiguity from 1 is checked first, so there is
+ *     no position to choose.
+ *   - **`prev_root`** — the RFC 6962 fold over the carried leaves in the Structure 2 domain. This is
+ *     the value the directory's own chain walk arrives at when it reaches this leaf, so naming any
+ *     other one breaks the walk rather than fooling it.
+ *   - **`last_seen`** — the counterparty's newest carried leaf, sequence and content hash.
+ *   - **`prev_own`** — this side's newest carried leaf.
+ *   - **`final_root`** — the content-only root, which is what each party signs and what the
+ *     counterparty's copy must agree with.
+ *
+ * So the only thing this side supplies that is genuinely its own is the CHOICE TO STOP HERE. That is
+ * truncation, it is bounded by design, the counterparty refutes it from their own copy, and the work
+ * order says in terms not to chase it.
+ *
+ * ⚠️ **THE RECEIPT FIELDS ARE ABSENT, AND ABSENT IS NOT THE SAME AS EMPTY.** A leaf carrying a blank
+ * relay id would be CLAIMING a witness it cannot produce, and the directory judges that as a
+ * malformed receipt — correctly, because missing and malformed must not be told apart. The
+ * directory's exemption is for a terminal control leaf with no receipt AT ALL, so this writes none.
+ *
+ * Crypto refs: RFC 8032 (Ed25519, the sender signature), RFC 6962 §2.1 (the Merkle fold).
+ */
+import { createHash } from "node:crypto";
+import { buildMerkleTree, merkleRoot } from "@cello-protocol/crypto";
+import { encodeSealPayload, encodeStructure1, encodeStructure2, decodeStructure1, SCAN_RESULT_SENTINEL, } from "@cello-protocol/protocol-types";
+/** The SEAL control leaf's kind byte — the same 0x02 the relay path hashes under. */
+const LEAF_KIND_CTRL = 0x02;
+/**
+ * ⚠️ FOUR DOMAINS, NOT TWO — review HIGH-2, and the collapsed form is a trust-boundary bug the
+ * directory's own `LEAF_KINDS` table already carries a comment about having removed.
+ *
+ * `prev_root` is a fold over `leafHashFor(kind, structure2)`, and that function prefixes each leaf
+ * with its own domain byte. Writing "anything but 0x02 is a message" here makes every session that
+ * ever exchanged a DOCUMENT (0x04) or carried a refusal leaf (0x05) compute a prefix root the
+ * directory cannot reproduce. It fails as a broken chain and reaches the operator as
+ * `unilateral_root_unverifiable`, whose guidance tells them their transcript ORDER is in dispute
+ * with their counterparty and to compare copies out of band — a hash-domain bug on this machine,
+ * reported as the other person's fault, on exactly the sessions where the receipt matters most.
+ *
+ * `undefined` for a byte this build cannot name. Guessing a domain for it produces a root nobody
+ * else computes, which is the same failure reached by coercion instead of by a refusal.
+ */
+const LEAF_DOMAINS = {
+    0x00: "msg",
+    0x02: "ctrl",
+    0x04: "doc",
+    0x05: "reject",
+};
+/**
+ * Refusals, and each one is a case where writing a leaf anyway would make things worse:
+ *
+ *   `seal_carry_empty`          nothing was ever witnessed, so there is no record to close.
+ *   `seal_carry_noncontiguous`  a witnessed leaf never reached us; a terminus over a record with a
+ *                               hole in it would be signing a history we know is not the history.
+ *   `seal_carry_own_ctrl_present` we already closed. A SECOND control leaf from one party makes the
+ *                               session unsealable by any directory, permanently — the caller must
+ *                               reuse the one that is there, never add to it.
+ *   `seal_carry_unreadable`     a leaf this daemon cannot decode is one it cannot chain onto.
+ *   `seal_carry_leaf_kind_unknown` a leaf kind this build cannot name has no domain to hash in, and
+ *                               a guessed one yields a root nobody else computes.
+ */
+export async function buildLocalSealTerminus(input) {
+    const { carry, ownPubkeyHex, sessionIdBytes, genesis, finalRootHex, closeTimestamp, sign } = input;
+    if (carry.length === 0)
+        return { ok: false, reason: "seal_carry_empty" };
+    // Ascending and exactly 1..N. Sorted rather than assumed: the store returns rows ordered, and a
+    // terminus that trusted that ordering would be depending on a detail of a query it does not own.
+    const ordered = [...carry].sort((a, b) => a.sequenceNumber - b.sequenceNumber);
+    for (let i = 0; i < ordered.length; i++) {
+        if (ordered[i].sequenceNumber !== i + 1)
+            return { ok: false, reason: "seal_carry_noncontiguous" };
+    }
+    if (ordered.some((l) => l.leafKind === LEAF_KIND_CTRL && l.senderPubkeyHex === ownPubkeyHex)) {
+        return { ok: false, reason: "seal_carry_own_ctrl_present" };
+    }
+    // ── The links, read out of the leaves each party actually authored ──
+    // `ordered` is ascending, so the LAST match in each direction is that party's newest leaf. A
+    // decode failure anywhere refuses: this side cannot honestly say what it has seen if it cannot
+    // read what it holds.
+    let lastSeenSeq = 0;
+    let lastSeenHash = genesis;
+    let prevOwnHash = genesis;
+    for (const leaf of ordered) {
+        const s1 = decodeStructure1(leaf.structure1Cbor);
+        if (!s1.ok)
+            return { ok: false, reason: "seal_carry_unreadable" };
+        if (leaf.senderPubkeyHex === ownPubkeyHex) {
+            prevOwnHash = s1.fields.contentHash;
+        }
+        else {
+            lastSeenSeq = leaf.sequenceNumber;
+            lastSeenHash = s1.fields.contentHash;
+        }
+    }
+    /**
+     * The prefix root, in the STRUCTURE 2 domain — which is not the domain the certified root lives
+     * in, and conflating the two is the easiest mistake available here. `prev_root` is checked by the
+     * directory's incremental walk over `leafHashFor(kind, encodeStructure2(s2))`; the certified root
+     * is the fold over raw content hashes. Same leaves, different pre-images, different values.
+     */
+    const prefixInputs = [];
+    for (const l of ordered) {
+        const domain = LEAF_DOMAINS[l.leafKind];
+        if (!domain)
+            return { ok: false, reason: "seal_carry_leaf_kind_unknown" };
+        prefixInputs.push({ kind: domain, data: l.structure2Cbor });
+    }
+    const prevRoot = merkleRoot(buildMerkleTree(prefixInputs));
+    // The payload and its hash come from ONE derivation, deliberately. When they diverge the directory
+    // answers `seal_payload_unbound`, whose guidance accuses the relay of altering bytes — a correct
+    // relay named as an attacker for a mismatch made on this machine.
+    const payload = encodeSealPayload({
+        session_id: sessionIdBytes,
+        final_root: new Uint8Array(Buffer.from(finalRootHex, "hex")),
+        close_timestamp: closeTimestamp,
+        attestation: "PENDING",
+    });
+    const contentHash = new Uint8Array(createHash("sha256").update(new Uint8Array([LEAF_KIND_CTRL])).update(payload).digest());
+    const structure1Cbor = encodeStructure1({
+        contentHash,
+        senderPubkey: input.ownPubkey,
+        sessionId: sessionIdBytes,
+        lastSeenSeq,
+        timestamp: closeTimestamp,
+        lastSeenHash,
+        prevOwnHash,
+    });
+    const senderSignature = await sign(structure1Cbor);
+    const sequenceNumber = ordered.length + 1;
+    const structure2Cbor = encodeStructure2({
+        sequence_number: sequenceNumber,
+        sender_pubkey: input.ownPubkey,
+        content_hash: contentHash,
+        sender_signature: senderSignature,
+        scan_result: SCAN_RESULT_SENTINEL,
+        prev_root: prevRoot,
+    });
+    return {
+        ok: true,
+        payload,
+        contentHashHex: Buffer.from(contentHash).toString("hex"),
+        // No relay fields. See the header — absent, never blank.
+        leaf: {
+            sequenceNumber,
+            leafKind: LEAF_KIND_CTRL,
+            senderPubkeyHex: ownPubkeyHex,
+            structure2Cbor,
+            structure1Cbor,
+        },
+    };
+}
+//# sourceMappingURL=seal-local-terminus.js.map

package/dist/seal-local-terminus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-local-terminus.js","sourceRoot":"","sources":["../src/seal-local-terminus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAkB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EACL,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,oBAAoB,GAC9F,MAAM,gCAAgC,CAAC;AAGxC,qFAAqF;AACrF,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAgE;IAChF,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,QAAQ;CACf,CAAC;AAuBF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEnG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACzE,gGAAgG;IAChG,iGAAiG;IACjG,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;IAC/E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,cAAc,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,eAAe,KAAK,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,6FAA6F;IAC7F,+FAA+F;IAC/F,sBAAsB;IACtB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,OAAO,CAAC;IAC3B,IAAI,WAAW,GAAG,OAAO,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,eAAe,KAAK,YAAY,EAAE,CAAC;YAC1C,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC;YAClC,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,YAAY,GAAgB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC1E,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3D,mGAAmG;IACnG,iGAAiG;IACjG,kEAAkE;IAClE,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,UAAU,EAAE,cAAc;QAC1B,UAAU,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5D,eAAe,EAAE,cAAc;QAC/B,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,UAAU,CAChC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACvF,CAAC;IAEF,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,SAAS;QAC7B,SAAS,EAAE,cAAc;QACzB,WAAW;QACX,SAAS,EAAE,cAAc;QACzB,YAAY;QACZ,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC;IAEnD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,KAAK,CAAC,SAAS;QAC9B,YAAY,EAAE,WAAW;QACzB,gBAAgB,EAAE,eAAe;QACjC,WAAW,EAAE,oBAAoB;QACjC,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,yDAAyD;QACzD,IAAI,EAAE;YACJ,cAAc;YACd,QAAQ,EAAE,cAAc;YACxB,eAAe,EAAE,YAAY;YAC7B,cAAc;YACd,cAAc;SACf;KACF,CAAC;AACJ,CAAC"}

package/dist/seal-receipt-upgrade.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Client-side bilateral upgrade of a stored seal receipt.
+ *
+ * When the previously-absent party (B) ratifies a unilateral seal and the directory confirms the
+ * upgrade to bilateral (seal_upgrade_confirmed, cryptographically verified via verifyUpgradeConfirmedCert),
+ * BOTH parties upgrade their OWN already-persisted unilateral receipt: the counterparty that was
+ * recorded 'absent' becomes 'recovered' (it has now ratified + proved content possession via the
+ * KERNEL gate). This is done CLIENT-SIDE — the directory does not persist the seal leaves/legibility
+ * anywhere reachable at upgrade time, so there is nothing new to ship; the bilateral receipt is built
+ * from the cert each party already holds. The seal signatures do NOT bind the legibility, so mutating
+ * the stored (unsigned) legibility invalidates nothing.
+ *
+ * Never overstates: only the attestation_mode flips (absent → recovered); frontiers are unchanged
+ * (the honest floor). Attestation modes: 'live' | 'recovered' | 'absent' (seal-legibility-tbs.ts).
+ */
+/**
+ * Return the legibility with every participant marked 'absent' re-marked 'recovered'. Mutates in place
+ * and returns the same reference. Tolerant: a null/undefined/malformed legibility is returned unchanged
+ * rather than throwing (the caller persists whatever it had).
+ */
+export declare function upgradeAbsentToRecovered(legibility: unknown): unknown;
+/**
+ * True if the legibility still has any 'absent' participant — i.e. it has NOT yet been upgraded to
+ * bilateral (upgradeAbsentToRecovered flips the sole absent party to 'recovered'). The absent-party
+ * 3b persist uses this as a ONE-WAY RATCHET: a re-delivered seal_unilateral_notification (reconnect
+ * burst) must not overwrite an already-'recovered' stored receipt back to the stale 'absent' snapshot.
+ * A malformed/missing legibility returns false (nothing to protect; let the caller persist).
+ */
+export declare function hasAbsentParticipant(legibility: unknown): boolean;
+//# sourceMappingURL=seal-receipt-upgrade.d.ts.map

package/dist/seal-receipt-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-receipt-upgrade.d.ts","sourceRoot":"","sources":["../src/seal-receipt-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAUrE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAOjE"}

package/dist/seal-receipt-upgrade.js

@@ -0,0 +1,49 @@
+/**
+ * Client-side bilateral upgrade of a stored seal receipt.
+ *
+ * When the previously-absent party (B) ratifies a unilateral seal and the directory confirms the
+ * upgrade to bilateral (seal_upgrade_confirmed, cryptographically verified via verifyUpgradeConfirmedCert),
+ * BOTH parties upgrade their OWN already-persisted unilateral receipt: the counterparty that was
+ * recorded 'absent' becomes 'recovered' (it has now ratified + proved content possession via the
+ * KERNEL gate). This is done CLIENT-SIDE — the directory does not persist the seal leaves/legibility
+ * anywhere reachable at upgrade time, so there is nothing new to ship; the bilateral receipt is built
+ * from the cert each party already holds. The seal signatures do NOT bind the legibility, so mutating
+ * the stored (unsigned) legibility invalidates nothing.
+ *
+ * Never overstates: only the attestation_mode flips (absent → recovered); frontiers are unchanged
+ * (the honest floor). Attestation modes: 'live' | 'recovered' | 'absent' (seal-legibility-tbs.ts).
+ */
+/**
+ * Return the legibility with every participant marked 'absent' re-marked 'recovered'. Mutates in place
+ * and returns the same reference. Tolerant: a null/undefined/malformed legibility is returned unchanged
+ * rather than throwing (the caller persists whatever it had).
+ */
+export function upgradeAbsentToRecovered(legibility) {
+    if (!legibility || typeof legibility !== "object")
+        return legibility;
+    const participants = legibility.participants;
+    if (!Array.isArray(participants))
+        return legibility;
+    for (const p of participants) {
+        if (p && typeof p === "object" && p.attestation_mode === "absent") {
+            p.attestation_mode = "recovered";
+        }
+    }
+    return legibility;
+}
+/**
+ * True if the legibility still has any 'absent' participant — i.e. it has NOT yet been upgraded to
+ * bilateral (upgradeAbsentToRecovered flips the sole absent party to 'recovered'). The absent-party
+ * 3b persist uses this as a ONE-WAY RATCHET: a re-delivered seal_unilateral_notification (reconnect
+ * burst) must not overwrite an already-'recovered' stored receipt back to the stale 'absent' snapshot.
+ * A malformed/missing legibility returns false (nothing to protect; let the caller persist).
+ */
+export function hasAbsentParticipant(legibility) {
+    if (!legibility || typeof legibility !== "object")
+        return false;
+    const participants = legibility.participants;
+    if (!Array.isArray(participants))
+        return false;
+    return participants.some((p) => p && typeof p === "object" && p.attestation_mode === "absent");
+}
+//# sourceMappingURL=seal-receipt-upgrade.js.map

package/dist/seal-receipt-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-receipt-upgrade.js","sourceRoot":"","sources":["../src/seal-receipt-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAmB;IAC1D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IACrE,MAAM,YAAY,GAAI,UAAyC,CAAC,YAAY,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAoC,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YACrG,CAAkC,CAAC,gBAAgB,GAAG,WAAW,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAmB;IACtD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,YAAY,GAAI,UAAyC,CAAC,YAAY,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,YAAY,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAAoC,CAAC,gBAAgB,KAAK,QAAQ,CACzG,CAAC;AACJ,CAAC"}

package/dist/seal-relay-silence.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `DOD-M15-CARRIEDSEAL-1` — WHEN THE RELAY GAVE NO ANSWER, as opposed to giving a bad one.
+ *
+ * The seal writes its own closing leaf only when there was nobody to ask. That is a narrower
+ * condition than "the submit failed", and the difference is load-bearing: a relay that REFUSED a
+ * leaf has ruled on it, and routing around a ruling is exactly the behaviour a trust layer must not
+ * have. A relay that never answered has ruled on nothing.
+ *
+ * ⚠️ **THE LIST IS AN ALLOW-SET, AND THE DEFAULT IS THE OLD BEHAVIOUR.** A reason that is not here
+ * does not unlock the local terminus — the close fails as it does today. That asymmetry is the whole
+ * design: a new relay refusal reason added next year cannot silently widen this, because widening
+ * requires someone to come here and add it. The reverse default — "fall back unless the reason is
+ * one of these known refusals" — would have let every future refusal become a bypass.
+ *
+ * Every reason below is produced by THIS daemon, in `session-relay-client.ts` or
+ * `session-seal.ts`'s transport resolution, at a point where no `hash_submit_ack` came back.
+ *
+ * Three that are deliberately NOT here, and why each one is an answer rather than a silence:
+ *   - `relay_assignment_rejected` — the relay considered the session and declined it.
+ *   - `relay_ack_unverified` / `relay_ack_malformed` — the relay ANSWERED and the answer did not
+ *     check out. That is a relay to distrust, and letting distrust promote us onto a path with
+ *     weaker evidence is the wrong direction entirely.
+ *   - `standing_receiver_unavailable` — this agent is not started. Local, fixable, and the existing
+ *     guidance ("start the agent and retry") is the correct thing to tell someone.
+ */
+/**
+ * ⚠️ THE ALLOW-SET IS NOT SUFFICIENT ON ITS OWN, AND THIS IS THE HALF THAT MAKES IT SOUND.
+ *
+ * The submit boundary COLLAPSES almost every relay refusal into `relay_unavailable`. Only three
+ * token faults survive under their own names (`DOD-M15-TOKENSTALE-1` split those out); everything
+ * else the relay actually said — rate limited, over its slot cap, this agent's token rejected as
+ * invalid, and by that code's own documented default every future relay-side reason — arrives at
+ * this file wearing the label for an outage.
+ *
+ * So the reason string alone cannot tell "nobody was there" from "they authenticated me and said
+ * no". A relay exercising judgement about this agent would have been read as silence and sealed
+ * around, which is the one thing this whole design says must never happen.
+ *
+ * The standing refusal is the signal the boundary drops, and the client still holds it. Ask for it
+ * directly rather than trying to infer it from a label that was never going to carry it.
+ *
+ * **A ruling is anything the relay answered with.** Not a list of known-bad reasons: a set like that
+ * defaults to "silence" for anything unfamiliar, which is the wrong direction here — a reason added
+ * next year would quietly become a bypass. Present means refused.
+ */
+export declare function relayRefusedUs(refusal: {
+    reason: string;
+} | null | undefined): boolean;
+/** The relay never ruled. See the header — this is an allow-set and the default is to fail as before. */
+export declare const RELAY_GAVE_NO_ANSWER: ReadonlySet<string>;
+//# sourceMappingURL=seal-relay-silence.d.ts.map

package/dist/seal-relay-silence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-relay-silence.d.ts","sourceRoot":"","sources":["../src/seal-relay-silence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEtF;AAED,yGAAyG;AACzG,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAyBnD,CAAC"}

package/dist/seal-relay-silence.js

@@ -0,0 +1,76 @@
+/**
+ * `DOD-M15-CARRIEDSEAL-1` — WHEN THE RELAY GAVE NO ANSWER, as opposed to giving a bad one.
+ *
+ * The seal writes its own closing leaf only when there was nobody to ask. That is a narrower
+ * condition than "the submit failed", and the difference is load-bearing: a relay that REFUSED a
+ * leaf has ruled on it, and routing around a ruling is exactly the behaviour a trust layer must not
+ * have. A relay that never answered has ruled on nothing.
+ *
+ * ⚠️ **THE LIST IS AN ALLOW-SET, AND THE DEFAULT IS THE OLD BEHAVIOUR.** A reason that is not here
+ * does not unlock the local terminus — the close fails as it does today. That asymmetry is the whole
+ * design: a new relay refusal reason added next year cannot silently widen this, because widening
+ * requires someone to come here and add it. The reverse default — "fall back unless the reason is
+ * one of these known refusals" — would have let every future refusal become a bypass.
+ *
+ * Every reason below is produced by THIS daemon, in `session-relay-client.ts` or
+ * `session-seal.ts`'s transport resolution, at a point where no `hash_submit_ack` came back.
+ *
+ * Three that are deliberately NOT here, and why each one is an answer rather than a silence:
+ *   - `relay_assignment_rejected` — the relay considered the session and declined it.
+ *   - `relay_ack_unverified` / `relay_ack_malformed` — the relay ANSWERED and the answer did not
+ *     check out. That is a relay to distrust, and letting distrust promote us onto a path with
+ *     weaker evidence is the wrong direction entirely.
+ *   - `standing_receiver_unavailable` — this agent is not started. Local, fixable, and the existing
+ *     guidance ("start the agent and retry") is the correct thing to tell someone.
+ */
+/**
+ * ⚠️ THE ALLOW-SET IS NOT SUFFICIENT ON ITS OWN, AND THIS IS THE HALF THAT MAKES IT SOUND.
+ *
+ * The submit boundary COLLAPSES almost every relay refusal into `relay_unavailable`. Only three
+ * token faults survive under their own names (`DOD-M15-TOKENSTALE-1` split those out); everything
+ * else the relay actually said — rate limited, over its slot cap, this agent's token rejected as
+ * invalid, and by that code's own documented default every future relay-side reason — arrives at
+ * this file wearing the label for an outage.
+ *
+ * So the reason string alone cannot tell "nobody was there" from "they authenticated me and said
+ * no". A relay exercising judgement about this agent would have been read as silence and sealed
+ * around, which is the one thing this whole design says must never happen.
+ *
+ * The standing refusal is the signal the boundary drops, and the client still holds it. Ask for it
+ * directly rather than trying to infer it from a label that was never going to carry it.
+ *
+ * **A ruling is anything the relay answered with.** Not a list of known-bad reasons: a set like that
+ * defaults to "silence" for anything unfamiliar, which is the wrong direction here — a reason added
+ * next year would quietly become a bypass. Present means refused.
+ */
+export function relayRefusedUs(refusal) {
+    return refusal != null;
+}
+/** The relay never ruled. See the header — this is an allow-set and the default is to fail as before. */
+export const RELAY_GAVE_NO_ANSWER = new Set([
+    // No relay client, no stream, or the session is gone from the relay's side.
+    "relay_unavailable",
+    "relay_client_unavailable",
+    "relay_client_closed",
+    "relay_stream_closed",
+    /**
+     * ⚠️ KEPT DELIBERATELY, against a review finding that called it "a relay answer". It is one, and
+     * it is still the right side of this line.
+     *
+     * The relay answers `session_not_found` for a session it no longer holds — and a relay that has
+     * RESTARTED holds nothing, because its leaf log is a map in process memory. That is precisely the
+     * scenario this order exists for: the witness is gone even though the process is up and talking.
+     * Excluding it would mean a restarted relay still costs a conversation its receipt, which is the
+     * defect, not the fix.
+     *
+     * The refusals that must NOT unlock this path are the relay exercising judgement about this agent,
+     * and those are caught by `relayRefusedUs` above rather than by this list.
+     */
+    "relay_session_gone",
+    // The frame never left, or left and was never answered.
+    "relay_submit_send_failed",
+    "relay_submit_timeout",
+    // This daemon has no endpoint to dial any more — the relay is gone as far as it can tell.
+    "no_persisted_relay_endpoint",
+]);
+//# sourceMappingURL=seal-relay-silence.js.map

package/dist/seal-relay-silence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-relay-silence.js","sourceRoot":"","sources":["../src/seal-relay-silence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8C;IAC3E,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,4EAA4E;IAC5E,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;IACrB,qBAAqB;IACrB;;;;;;;;;;;;OAYG;IACH,oBAAoB;IACpB,wDAAwD;IACxD,0BAA0B;IAC1B,sBAAsB;IACtB,0FAA0F;IAC1F,6BAA6B;CAC9B,CAAC,CAAC"}

package/dist/seal-settle.d.ts

@@ -0,0 +1,38 @@
+/**
+ * DOD-M15-SEALPRECOND-1 — wait for this side's own record to stop moving before signing it.
+ *
+ * ⚠️ THIS IS NOT A DELAY, AND THE DISTINCTION IS THE WHOLE UNIT. On 2026-09-11 the daemon held the
+ * relay's ordering confirmation for 352 milliseconds and signed without it; a 14-millisecond gap
+ * and a 14-second gap fail identically, so nothing here may be tuned to a window. What is waited
+ * ON is a condition of state — `sealReadiness().ownLeavesOrdered`, the leaves of ours the relay has
+ * already ordered and this tree has not placed. The bound exists only so a send that never
+ * resolves cannot hold the operator's close forever; it is the escape, not the mechanism.
+ *
+ * The condition is re-read every poll and the wait returns the instant it clears, which is what a
+ * fixed sleep cannot do and what the tests assert.
+ */
+import type { SessionNodeManager } from "./session-node-manager.js";
+/**
+ * How long a close may wait for its own in-flight send to take its place in the record.
+ *
+ * Two seconds against a condition that resolved in 14ms when it was measured. Generous on purpose:
+ * the cost of waiting too long is an operator's close taking a moment, and the cost of not waiting
+ * is a signature no directory can verify and a receipt that is gone for both parties permanently.
+ */
+export declare const SEAL_SETTLE_DEADLINE_MS = 2000;
+export type SealSettleOutcome = {
+    settled: true;
+    waitedMs: number;
+} | {
+    settled: false;
+    waitedMs: number;
+    ownLeavesOrdered: number;
+};
+/**
+ * Block until this session has no own leaf the relay has ordered and the tree has not placed.
+ *
+ * Returns immediately — no timer, no microtask hop beyond the read — when the record is already
+ * level, which is every ordinary close.
+ */
+export declare function awaitOwnRecordSettled(sessionNodeManager: Pick<SessionNodeManager, "sealReadiness">, agentName: string, sessionId: string, deadlineMs?: number): Promise<SealSettleOutcome>;
+//# sourceMappingURL=seal-settle.d.ts.map

package/dist/seal-settle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-settle.d.ts","sourceRoot":"","sources":["../src/seal-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAK7C,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,EAC7D,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,MAAgC,GAC3C,OAAO,CAAC,iBAAiB,CAAC,CAe5B"}

package/dist/seal-settle.js

@@ -0,0 +1,33 @@
+/**
+ * How long a close may wait for its own in-flight send to take its place in the record.
+ *
+ * Two seconds against a condition that resolved in 14ms when it was measured. Generous on purpose:
+ * the cost of waiting too long is an operator's close taking a moment, and the cost of not waiting
+ * is a signature no directory can verify and a receipt that is gone for both parties permanently.
+ */
+export const SEAL_SETTLE_DEADLINE_MS = 2_000;
+/** How often the condition is re-read. Short enough that a settled record is not made to wait. */
+const SEAL_SETTLE_POLL_MS = 20;
+/**
+ * Block until this session has no own leaf the relay has ordered and the tree has not placed.
+ *
+ * Returns immediately — no timer, no microtask hop beyond the read — when the record is already
+ * level, which is every ordinary close.
+ */
+export async function awaitOwnRecordSettled(sessionNodeManager, agentName, sessionId, deadlineMs = SEAL_SETTLE_DEADLINE_MS) {
+    const started = Date.now();
+    let readiness = sessionNodeManager.sealReadiness(agentName, sessionId);
+    while (readiness.ownLeavesOrdered > 0 && Date.now() - started < deadlineMs) {
+        await new Promise((resolve) => {
+            const t = setTimeout(resolve, SEAL_SETTLE_POLL_MS);
+            // Never hold the process — or a test runner — open on a session that is going nowhere.
+            t.unref?.();
+        });
+        readiness = sessionNodeManager.sealReadiness(agentName, sessionId);
+    }
+    const waitedMs = Date.now() - started;
+    return readiness.ownLeavesOrdered > 0
+        ? { settled: false, waitedMs, ownLeavesOrdered: readiness.ownLeavesOrdered }
+        : { settled: true, waitedMs };
+}
+//# sourceMappingURL=seal-settle.js.map

package/dist/seal-settle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-settle.js","sourceRoot":"","sources":["../src/seal-settle.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAM/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,kBAA6D,EAC7D,SAAiB,EACjB,SAAiB,EACjB,aAAqB,uBAAuB;IAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,SAAS,CAAC,gBAAgB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACnD,uFAAuF;YACvF,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QACH,SAAS,GAAG,kBAAkB,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACtC,OAAO,SAAS,CAAC,gBAAgB,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE;QAC5E,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC"}

package/dist/seal-upgrade.d.ts

@@ -0,0 +1,107 @@
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { Logger } from "./types.js";
+import type { DaemonRegistrationPersistence } from "./registration-persistence.js";
+/**
+ * Domain separator for the upgrade-ack TBS. B's daemon and the directory MUST build byte-identical
+ * bytes — same domain string, same cbor-x encoder options (tagUint8Array:false); the directory side
+ * must be kept byte-identical. Domain separation prevents replay as any other CELLO signature.
+ */
+export declare const SEAL_UPGRADE_ACK_DOMAIN = "cello-seal-upgrade-ack-v1";
+/** The exact upgrade-ack TBS B signs / the directory + present party verify. */
+export declare function buildSealUpgradeAckTbs(sessionId: Uint8Array, sealedRoot: Uint8Array): Uint8Array;
+/**
+ * Verifiability of a session for B to ratify a unilateral seal — the SAME bar as the auto-ack.
+ *
+ * `unverifiable` carries WHY, not just whether — `DOD-M15-SEALWIRE-1` part B1, review F-A.
+ *
+ * It was `tampered: boolean`, which was true while a hash mismatch was the only way to fail the
+ * cross-check. B1 added two more, and BOTH ARE ORDINARY: a peer on a newer build naming an
+ * algorithm this daemon cannot reproduce, and a salted frame arriving before the salt agreement
+ * landed. A boolean forces this file to call all three a tamper.
+ */
+export interface SealUpgradeReadiness {
+    known: boolean;
+    /** `null` when the content verified. Otherwise WHY it could not be verified. */
+    unverifiable: "tampered" | "unverifiable" | null;
+}
+/**
+ * THE KERNEL DECISION. B may sign its ratification ONLY when it genuinely possesses + integrity-
+ * verified the content behind R1. A session B has no record of (content_unrecoverable) or whose
+ * content it could not verify is REFUSED. Verified-but-disliked content is NOT a refusal —
+ * disagreement ≠ unverifiable.
+ *
+ * ⚠️ THE REFUSAL IS THE SAME FOR BOTH CAUSES; ONLY THE NAME DIFFERS. Never ratify content you could
+ * not verify — that is binary and it is the kernel. But `content_tamper` is a SECURITY claim, and
+ * emitting it for an honest peer on a newer build is the defect this split exists to remove: an
+ * alarm that fires on the benign case teaches an operator to dismiss the one that matters.
+ */
+export declare function evaluateSealUpgrade(readiness: SealUpgradeReadiness): {
+    proceed: true;
+} | {
+    proceed: false;
+    refuseReason: "content_unrecoverable" | "content_tamper" | "content_verification_unavailable";
+};
+export interface AttemptSealUpgradeDeps {
+    logger: Logger;
+    agentName: string;
+    agentPubkeyHex: string;
+    /** B's session verifiability for this session (SessionNodeManager.getSealUpgradeReadiness). */
+    getReadiness: (agentName: string, sessionIdHex: string) => SealUpgradeReadiness;
+    /**
+     * The number of content leaves B holds for this session (SessionNodeManager.getSessionTree
+     * (...).size()). R1 has leaf_count leaves = content leaves + A's single SEAL ctrl leaf, so B's
+     * content tree must hold at least leaf_count-1 leaves or B is missing content it would over-attest.
+     */
+    getContentLeafCount: (agentName: string, sessionIdHex: string) => number;
+    /** Recover parked content so B holds everything behind R1 before the gate (autoRecoverForAgent). */
+    recoverContent: (agentName: string) => Promise<void>;
+    /** B's K_local signer for this agent (keyProviders.get). */
+    getKeyProvider: (agentName: string) => KeyProvider | undefined;
+    /** Send a signaling frame to the directory (signaling.sendRaw). */
+    sendRaw: (frame: Record<string, unknown>) => Promise<{
+        ok: boolean;
+    }>;
+}
+/**
+ * THE KERNEL, wired. Recover content → consult the gate → REFUSE (no signature, no request) on
+ * content_unrecoverable / content_tamper → else sign the ack over R1 with B's OWN K_local and send
+ * seal_upgrade_request. Returns whether a request was sent (and the refuse reason if not) so a unit
+ * test asserts the gate is genuinely consulted, not bypassed. Never throws.
+ */
+export declare function attemptSealUpgrade(deps: AttemptSealUpgradeDeps, sessionIdHex: string, frame: Record<string, unknown>): Promise<{
+    sent: boolean;
+    reason?: string;
+}>;
+export interface VerifyUpgradeConfirmedDeps {
+    logger: Logger;
+    agentName: string;
+    agentPubkeyHex: string;
+    /** DB-backed identity persistence (the FROST share for cert verification). */
+    persistence: DaemonRegistrationPersistence;
+    /**
+     * The counterparty pubkey (hex) of the LOCAL session record for sessionIdHex, or null if this
+     * agent has no such session. Binds the cert's present/returning pubkeys to the REAL participants so
+     * a malicious directory cannot sign the ack with a throwaway key and force a state transition on a
+     * session we are in (or push a confirmed frame for a session we never had).
+     */
+    getCounterpartyHex: (agentName: string, sessionIdHex: string) => string | null;
+}
+/**
+ * Dual-attestation verify. NEVER trust the directory's "bilateral" claim.
+ *
+ *  - ALWAYS verify the RETURNING attestation (B's ack) over R1 — proves B genuinely ratified, catches
+ *    a directory that fabricated or swapped B's signature. The load-bearing check (anyone can do it).
+ *  - If THIS agent is the PRESENT party (A, holds its primary key), ALSO verify the present attestation
+ *    over the rebuilt seal TBS (leaf_count-bound). The responder (B) cannot (no initiator key).
+ *
+ * Returns { ok:false, reason } on any malformed/forged cert — the caller must NOT mark the session
+ * bilateral in that case. Returns the party so the caller can log accurately.
+ */
+export declare function verifyUpgradeConfirmedCert(deps: VerifyUpgradeConfirmedDeps, sessionIdHex: string, frame: Record<string, unknown>): Promise<{
+    ok: true;
+    party: "present" | "returning";
+} | {
+    ok: false;
+    reason: string;
+}>;
+//# sourceMappingURL=seal-upgrade.d.ts.map

package/dist/seal-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-upgrade.d.ts","sourceRoot":"","sources":["../src/seal-upgrade.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAGnF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,UAAU,CAEhG;AAMD;;;;;;;;;GASG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,YAAY,EAAE,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;CAClD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,oBAAoB,GAC9B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,YAAY,EAAE,uBAAuB,GAAG,gBAAgB,GAAG,kCAAkC,CAAC;CAC/F,CAKA;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IAChF;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,oGAAoG;IACpG,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,4DAA4D;IAC5D,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAC/D,mEAAmE;IACnE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACvE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqF7C;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,EAAE,6BAA6B,CAAC;IAC3C;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAChF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,0BAA0B,EAChC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA0DvF"}