@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/bundled-consortium-manifest.d.ts

@@ -0,0 +1,47 @@
+/**
+ * FINDING-4 — the bundled consortium roster (sovereign-node REDUNDANCY invariant).
+ *
+ * This is the signed list of the sovereign directory nodes that make up the CELLO consortium,
+ * COMPILED INTO the client. It is loaded by default (when the operator does not override it via
+ * CELLO_CONSORTIUM_MANIFEST) so that a cold-boot daemon already knows every directory — and can
+ * fail over to a reachable one — even when its configured/primary directory is unreachable. Without
+ * a bundled roster the failover resolver has nothing to route to (the exact FINDING-4 gap: the
+ * roster-aware dialer was correct but the roster was empty), so a single directory being down
+ * stranded the client at startup, violating the redundancy invariant.
+ *
+ * Trust model:
+ *   - The manifest is threshold-signed by the consortium officer key(s). At load the client
+ *     RE-VERIFIES it against BUNDLED_CONSORTIUM_ROOT_KEYS (a self-consistency / anti-corruption
+ *     gate — the manifest and root keys ship together, so this catches a bad regeneration, not a
+ *     network adversary).
+ *   - The node `pubkey`s are the directories' Ed25519 node keys. They are the trust anchor for
+ *     step-6 directory identity auth (M7-MANIFEST-002): when the client connects to (or fails over
+ *     to) a directory, the directory must sign the client's challenge with the matching node key,
+ *     proving it is the real consortium node for that nodeId — defeating a MITM on the plaintext
+ *     /bootstrap that would otherwise redirect the client to a rogue directory. THIS is the
+ *     adversarial defense; it is enabled by default alongside the roster.
+ *
+ * nodeId MUST equal the directory's reported NODE_ID (`<cloud>-<region>`, e.g. `gcp-use1`); the step-6 verifier
+ * looks the node up by nodeId. pubkey MUST equal the node's own Ed25519 signing key, which the
+ * regeneration script below reads from GCP Secret Manager (`cello-<nodeId>-node-key`) rather than
+ * being transcribed. endpoint is the HTTP /bootstrap base, and MUST be the node's ADDRESS — see
+ * PRODUCTION_DIRECTORY_URL in directory-bootstrap.ts for why a hostname here disables step-6.
+ *
+ * Regeneration: on directory node-key or officer-key rotation, re-sign with
+ * `infra/scripts/sign-gcp-consortium-manifest.mjs` (in the trustless-cello repo) and update this
+ * constant + BUNDLED_CONSORTIUM_ROOT_KEYS. The officer signing key lives in GCP Secret Manager as
+ * `cello-consortium-officer-key-0`; only its PUBLIC key is embedded here.
+ *
+ * Crypto reference: RFC 8032 (Ed25519 threshold signatures, verified by verifyManifest).
+ */
+import type { ConsortiumManifestInput } from "@cello-protocol/crypto";
+/** The signed consortium manifest (roster of sovereign directory nodes). */
+export declare const BUNDLED_CONSORTIUM_MANIFEST: ConsortiumManifestInput;
+/**
+ * Pinned consortium officer root public key(s). Officer 0's Ed25519 public key (hex). The client
+ * verifies BUNDLED_CONSORTIUM_MANIFEST's threshold signatures against this set. Public data.
+ */
+export declare const BUNDLED_CONSORTIUM_ROOT_KEYS: readonly string[];
+/** Minimum number of distinct valid officer signatures required (dev: single officer, threshold 1). */
+export declare const BUNDLED_CONSORTIUM_THRESHOLD = 1;
+//# sourceMappingURL=bundled-consortium-manifest.d.ts.map

package/dist/bundled-consortium-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-consortium-manifest.d.ts","sourceRoot":"","sources":["../src/bundled-consortium-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,EAAE,uBAqEzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAEzD,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,4BAA4B,IAAI,CAAC"}

package/dist/bundled-consortium-manifest.js

@@ -0,0 +1,116 @@
+/**
+ * FINDING-4 — the bundled consortium roster (sovereign-node REDUNDANCY invariant).
+ *
+ * This is the signed list of the sovereign directory nodes that make up the CELLO consortium,
+ * COMPILED INTO the client. It is loaded by default (when the operator does not override it via
+ * CELLO_CONSORTIUM_MANIFEST) so that a cold-boot daemon already knows every directory — and can
+ * fail over to a reachable one — even when its configured/primary directory is unreachable. Without
+ * a bundled roster the failover resolver has nothing to route to (the exact FINDING-4 gap: the
+ * roster-aware dialer was correct but the roster was empty), so a single directory being down
+ * stranded the client at startup, violating the redundancy invariant.
+ *
+ * Trust model:
+ *   - The manifest is threshold-signed by the consortium officer key(s). At load the client
+ *     RE-VERIFIES it against BUNDLED_CONSORTIUM_ROOT_KEYS (a self-consistency / anti-corruption
+ *     gate — the manifest and root keys ship together, so this catches a bad regeneration, not a
+ *     network adversary).
+ *   - The node `pubkey`s are the directories' Ed25519 node keys. They are the trust anchor for
+ *     step-6 directory identity auth (M7-MANIFEST-002): when the client connects to (or fails over
+ *     to) a directory, the directory must sign the client's challenge with the matching node key,
+ *     proving it is the real consortium node for that nodeId — defeating a MITM on the plaintext
+ *     /bootstrap that would otherwise redirect the client to a rogue directory. THIS is the
+ *     adversarial defense; it is enabled by default alongside the roster.
+ *
+ * nodeId MUST equal the directory's reported NODE_ID (`<cloud>-<region>`, e.g. `gcp-use1`); the step-6 verifier
+ * looks the node up by nodeId. pubkey MUST equal the node's own Ed25519 signing key, which the
+ * regeneration script below reads from GCP Secret Manager (`cello-<nodeId>-node-key`) rather than
+ * being transcribed. endpoint is the HTTP /bootstrap base, and MUST be the node's ADDRESS — see
+ * PRODUCTION_DIRECTORY_URL in directory-bootstrap.ts for why a hostname here disables step-6.
+ *
+ * Regeneration: on directory node-key or officer-key rotation, re-sign with
+ * `infra/scripts/sign-gcp-consortium-manifest.mjs` (in the trustless-cello repo) and update this
+ * constant + BUNDLED_CONSORTIUM_ROOT_KEYS. The officer signing key lives in GCP Secret Manager as
+ * `cello-consortium-officer-key-0`; only its PUBLIC key is embedded here.
+ *
+ * Crypto reference: RFC 8032 (Ed25519 threshold signatures, verified by verifyManifest).
+ */
+/** The signed consortium manifest (roster of sovereign directory nodes). */
+export const BUNDLED_CONSORTIUM_MANIFEST = {
+    // ── v3, the TLS cutover (2026-09-10) ────────────────────────────────────────────────────────
+    // Every endpoint moved from `http://<raw ip>:9090` to `https://directory-<region>.cello.mygentic.ai`,
+    // terminated by that region's own load balancer, and every multiaddr from `/ip4/…/tcp/8080/ws` to
+    // `/dns4/…/tcp/443/tls/ws`. Proven against the running fleet before shipping: a real libp2p node
+    // dialled all three balancers over WSS and got Noise + yamux with the expected peer id.
+    //
+    // 🔴 THIS ROSTER AND THE ONE THE NODES SERVE MUST CARRY THE SAME ENDPOINTS. The daemon builds its
+    // directory-identity challenge verifier ONLY when the resolved directory URL matches one of the
+    // endpoints BELOW. If the fleet serves a name this file does not list, step 6 does not fail — it
+    // is skipped, silently, on every connect and reconnect, and step 6 is what turns a /bootstrap
+    // MITM into a refused connection rather than a successful impersonation.
+    //
+    // `version` is a MONOTONICITY GATE, not a schema number: the daemon persists the highest version
+    // it has seen and rejects anything lower as a rollback. So a daemon carrying this v3 will refuse
+    // a fleet still serving v2 — which is why the two move together, and why this must only ever
+    // increase.
+    //
+    // Generated by trustless-cello/infra/scripts/sign-gcp-consortium-manifest.mjs. Do NOT hand-edit
+    // a field: the signature covers every one of them and an edited copy verifies against nothing.
+    version: 3,
+    not_before: "2026-01-01T00:00:00Z",
+    expires: "2030-01-01T00:00:00Z",
+    nodes: [
+        {
+            nodeId: "gcp-use1",
+            pubkey: "7969e22a7d95293ae343cb2667c2a4d7127aa8748478582fa637674c30e0113c",
+            region: "use1",
+            provider: "gcp",
+            endpoint: "https://directory-use1.cello.mygentic.ai",
+            peerId: "12D3KooWMH58hm8xpuwgwaNSvnvXBuc126jfuUMVbrGNcU2MeEAX",
+            multiaddr: "/dns4/directory-use1.cello.mygentic.ai/tcp/443/tls/ws",
+            role: "validator",
+        },
+        {
+            nodeId: "gcp-usc1",
+            pubkey: "ef961384100bb087f36b68e3a270acb8f22fdf62c4cd5e517e423afb7f399002",
+            region: "usc1",
+            provider: "gcp",
+            endpoint: "https://directory-usc1.cello.mygentic.ai",
+            peerId: "12D3KooWExQLMbvaioVqQCPkc1ZZgJ5kdoePymtMrg46ugMBs5zi",
+            multiaddr: "/dns4/directory-usc1.cello.mygentic.ai/tcp/443/tls/ws",
+            role: "validator",
+        },
+        {
+            nodeId: "gcp-euw1",
+            pubkey: "9cb77b68a98f49056fef232f4d56eeb9b66b1a6646fe06b966ff570a82ca6c14",
+            region: "euw1",
+            provider: "gcp",
+            endpoint: "https://directory-euw1.cello.mygentic.ai",
+            peerId: "12D3KooWP52VSVrakyRdPyt23kAuhgp3FV6tiVRByfdyVvHAaEeJ",
+            multiaddr: "/dns4/directory-euw1.cello.mygentic.ai/tcp/443/tls/ws",
+            role: "validator",
+        },
+    ],
+    // M10B / DOD-END-INGRESS-1 — the PORTAL INTAKE KEY. A submitting daemon seals its trust-signal
+    // submission to this key so the DIRECTORY cannot read it; without it `cello_attestations_issue`
+    // refuses with `intake_key_absent` rather than sending in the clear. It has to be in the BUNDLED
+    // manifest and not only in the served one, because a cold-boot daemon that cannot yet reach a
+    // directory falls back to this constant — and "your first submission fails until you have polled"
+    // is indistinguishable from the feature being broken.
+    intake_key: { key_id: "intake-dev-1", pubkey: "87da56bf2ca5ef75d62d88dfed1f667f9fa565ee0a5306aeeef50f5d7053b3d1" },
+    signatures: [
+        {
+            officerIndex: 0,
+            signature: "537de3ac39d6a5f261d576c8938e788b46d587b282be5e0166c5d7fad6dac55efed003277c5625d1b5930c328d0eb41044e8e7de7ea31a1021b22e7133317f09",
+        },
+    ],
+};
+/**
+ * Pinned consortium officer root public key(s). Officer 0's Ed25519 public key (hex). The client
+ * verifies BUNDLED_CONSORTIUM_MANIFEST's threshold signatures against this set. Public data.
+ */
+export const BUNDLED_CONSORTIUM_ROOT_KEYS = [
+    "e8300a2b9de7be6f6d629f778dc319715ad0010c0639f3a1564181d56d3eb104",
+];
+/** Minimum number of distinct valid officer signatures required (dev: single officer, threshold 1). */
+export const BUNDLED_CONSORTIUM_THRESHOLD = 1;
+//# sourceMappingURL=bundled-consortium-manifest.js.map

package/dist/bundled-consortium-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-consortium-manifest.js","sourceRoot":"","sources":["../src/bundled-consortium-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAA4B;IAClE,+FAA+F;IAC/F,sGAAsG;IACtG,kGAAkG;IAClG,iGAAiG;IACjG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,yEAAyE;IACzE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,6FAA6F;IAC7F,YAAY;IACZ,EAAE;IACF,gGAAgG;IAChG,+FAA+F;IAC/F,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE,sBAAsB;IAC/B,KAAK,EAAE;QACL;YACE,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,0CAA0C;YACpD,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,uDAAuD;YAClE,IAAI,EAAE,WAAW;SAClB;QACD;YACE,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,0CAA0C;YACpD,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,uDAAuD;YAClE,IAAI,EAAE,WAAW;SAClB;QACD;YACE,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,0CAA0C;YACpD,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,uDAAuD;YAClE,IAAI,EAAE,WAAW;SAClB;KACF;IACD,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,sDAAsD;IACtD,UAAU,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kEAAkE,EAAE;IAClH,UAAU,EAAE;QACV;YACE,YAAY,EAAE,CAAC;YACf,SAAS,EACP,kIAAkI;SACrI;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,kEAAkE;CACnE,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC"}

package/dist/cbor-blob-migration.d.ts

@@ -0,0 +1,8 @@
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+/**
+ * Rewrite any non-canonically-encoded FROST blob in `agents` to the canonical encoding.
+ * Idempotent. Safe to run on every daemon start.
+ */
+export declare function migrateCborBlobsToCanonical(db: DaemonDatabase, logger: Logger): void;
+//# sourceMappingURL=cbor-blob-migration.d.ts.map

package/dist/cbor-blob-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor-blob-migration.d.ts","sourceRoot":"","sources":["../src/cbor-blob-migration.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAwCzC;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA+DpF"}

package/dist/cbor-blob-migration.js

@@ -0,0 +1,116 @@
+/**
+ * Normalize the persisted FROST blobs to the canonical CBOR encoding.
+ *
+ * `frost_commitments` and `frost_verifying_shares` may hold an older encoding (cbor-x tag-64 or its
+ * record extension) alongside the canonical one; cbor-x decodes all three, which is why a mixed
+ * column reads correctly and can go unnoticed. This makes the column hold ONE encoding, so a reader
+ * that is not cbor-x can parse it.
+ *
+ * Decode, re-encode canonically, rewrite only if the bytes differ. Self-checking and idempotent: a
+ * canonical blob re-encodes to itself and is skipped, so there is no "have I run yet?" flag to get
+ * wrong and a second run is a no-op.
+ *
+ * FAILS SAFE, PER ROW. These blobs are FROST key material. A row that cannot be decoded is LEFT
+ * EXACTLY AS IT WAS and reported — never dropped, never half-written, never guessed at. Destroying a
+ * share makes the agent permanently unable to sign or seal, which is strictly worse than leaving it
+ * in an old encoding that still decodes. Nobody may lose a key to this migration.
+ */
+import { encodeCbor, decodeCbor } from "@cello-protocol/protocol-types";
+import { extractErrorMessage } from "./error-message.js";
+/** The columns written by both producers. Both hold CBOR; both must hold the canonical encoding. */
+const CBOR_BLOB_COLUMNS = ["frost_commitments", "frost_verifying_shares"];
+function toBytes(v) {
+    if (v instanceof Uint8Array)
+        return v;
+    if (Buffer.isBuffer(v))
+        return new Uint8Array(v);
+    return null;
+}
+/**
+ * Do two decoded CBOR values carry the same DATA?
+ *
+ * Compares byte CONTENT, never container class. cbor-x decodes a byte string to a Node Buffer and a
+ * tag-64 to a Uint8Array — identical bytes, different wrapper. A class-sensitive compare
+ * (`JSON.stringify`, `toEqual`) calls those unequal and refuses every genuine migration.
+ */
+function sameDecodedValue(a, b) {
+    const ab = toBytes(a);
+    const bb = toBytes(b);
+    if (ab || bb) {
+        return ab !== null && bb !== null && Buffer.from(ab).equals(Buffer.from(bb));
+    }
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((v, i) => sameDecodedValue(v, b[i]));
+    }
+    if (a && b && typeof a === "object" && typeof b === "object") {
+        const ao = a;
+        const bo = b;
+        const ak = Object.keys(ao).sort();
+        const bk = Object.keys(bo).sort();
+        if (ak.length !== bk.length || ak.some((k, i) => k !== bk[i]))
+            return false;
+        return ak.every((k) => sameDecodedValue(ao[k], bo[k]));
+    }
+    return Object.is(a, b);
+}
+/**
+ * Rewrite any non-canonically-encoded FROST blob in `agents` to the canonical encoding.
+ * Idempotent. Safe to run on every daemon start.
+ */
+export function migrateCborBlobsToCanonical(db, logger) {
+    // The table may predate these columns (fresh DB, or an install that never registered).
+    const columns = new Set(db.prepare("PRAGMA table_info(agents)").all().map((c) => c.name));
+    const present = CBOR_BLOB_COLUMNS.filter((c) => columns.has(c));
+    if (present.length === 0)
+        return;
+    const rows = db
+        .prepare(`SELECT agent_id, ${present.join(", ")} FROM agents`)
+        .all();
+    let rewritten = 0;
+    let skipped = 0;
+    for (const row of rows) {
+        const agentId = String(row["agent_id"]);
+        for (const column of present) {
+            const stored = toBytes(row[column]);
+            if (!stored || stored.length === 0)
+                continue; // never registered / no share — nothing to do
+            let canonical;
+            try {
+                canonical = encodeCbor(decodeCbor(stored));
+            }
+            catch (err) {
+                // Undecodable key material — leave it alone.
+                skipped++;
+                logger.warn("daemon.cbor.migration.undecodable", {
+                    agentId,
+                    column,
+                    bytes: stored.length,
+                    error: extractErrorMessage(err),
+                });
+                continue;
+            }
+            if (Buffer.from(canonical).equals(Buffer.from(stored)))
+                continue; // already canonical
+            // Verify BEFORE writing: re-encoding must preserve the VALUE, not merely produce bytes. If it
+            // ever altered the decoded content, refuse rather than persist a corrupted share.
+            if (!sameDecodedValue(decodeCbor(canonical), decodeCbor(stored))) {
+                skipped++;
+                logger.error("daemon.cbor.migration.value_changed", {
+                    agentId,
+                    column,
+                    guidance: "re-encoding altered the decoded value; the blob was NOT rewritten",
+                });
+                continue;
+            }
+            db.prepare(`UPDATE agents SET ${column} = ? WHERE agent_id = ?`).run(Buffer.from(canonical), agentId);
+            rewritten++;
+            logger.info("daemon.cbor.migration.rewritten", { agentId, column, bytes: canonical.length });
+        }
+    }
+    if (rewritten > 0 || skipped > 0) {
+        logger.info("daemon.cbor.migration.complete", { rewritten, skipped, rows: rows.length });
+    }
+}
+//# sourceMappingURL=cbor-blob-migration.js.map

package/dist/cbor-blob-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbor-blob-migration.js","sourceRoot":"","sources":["../src/cbor-blob-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,oGAAoG;AACpG,MAAM,iBAAiB,GAAG,CAAC,mBAAmB,EAAE,wBAAwB,CAAU,CAAC;AAEnF,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,CAAU,EAAE,CAAU;IAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,EAAE,GAAG,CAA4B,CAAC;QACxC,MAAM,EAAE,GAAG,CAA4B,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAAkB,EAAE,MAAc;IAC5E,uFAAuF;IACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC9F,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;SAC7D,GAAG,EAAoC,CAAC;IAE3C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAExC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,8CAA8C;YAE5F,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,6CAA6C;gBAC7C,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBAC/C,OAAO;oBACP,MAAM;oBACN,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS,CAAC,oBAAoB;YAEtF,8FAA8F;YAC9F,kFAAkF;YAClF,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;oBAClD,OAAO;oBACP,MAAM;oBACN,QAAQ,EAAE,mEAAmE;iBAC9E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,EAAE,CAAC,OAAO,CAAC,qBAAqB,MAAM,yBAAyB,CAAC,CAAC,GAAG,CAClE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,OAAO,CACR,CAAC;YACF,SAAS,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC"}

package/dist/challenge-verifier.d.ts

@@ -0,0 +1,12 @@
+/**
+ * M7-MANIFEST-002 — Challenge verifier re-exports.
+ *
+ * The production verifier (ManifestDirectoryChallengeVerifier) and test stub
+ * (TestDirectoryChallengeVerifier) are both defined in @cello-protocol/transport
+ * to avoid creating a circular dependency between daemon and transport.
+ *
+ * This module re-exports them for consumers that import from the daemon package.
+ */
+export { ManifestDirectoryChallengeVerifier, TestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
+export type { IDirectoryChallengeVerifier } from "@cello-protocol/transport";
+//# sourceMappingURL=challenge-verifier.d.ts.map

package/dist/challenge-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-verifier.d.ts","sourceRoot":"","sources":["../src/challenge-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/challenge-verifier.js

@@ -0,0 +1,11 @@
+/**
+ * M7-MANIFEST-002 — Challenge verifier re-exports.
+ *
+ * The production verifier (ManifestDirectoryChallengeVerifier) and test stub
+ * (TestDirectoryChallengeVerifier) are both defined in @cello-protocol/transport
+ * to avoid creating a circular dependency between daemon and transport.
+ *
+ * This module re-exports them for consumers that import from the daemon package.
+ */
+export { ManifestDirectoryChallengeVerifier, TestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
+//# sourceMappingURL=challenge-verifier.js.map

package/dist/challenge-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-verifier.js","sourceRoot":"","sources":["../src/challenge-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC"}

package/dist/channel-log-store.d.ts

@@ -0,0 +1,80 @@
+/**
+ * ChannelLogStore — M16 016-CLIENTREWORK.
+ *
+ * A broadcast channel publishes a signed post once and it is delivered many times. The publisher
+ * keeps ONE append-only log of everything it published, not one per subscriber, and that log is the
+ * durable copy: when a relay loses content, it is refilled from here. Beside each post sit the
+ * relays' signed receipts — the publisher's proof of what it sent and when each relay took it. So:
+ *
+ *   - ROWS ARE IMMUTABLE. Nothing rewrites a published post. The only deletion is `pruneThrough`,
+ *     and it only ever removes from the OLDEST end, because a hole in the middle is indistinguishable
+ *     to a subscriber from a post it has not received yet.
+ *   - THE STORE NEVER DECIDES A POSITION. The number is inside both signatures, so `nextPosition`
+ *     reports what the next append must carry, the publisher signs that, and `append` checks it. A
+ *     wrong position throws its own code; nothing is auto-corrected.
+ *   - A RECEIPT IS VERIFIED BEFORE IT IS STORED, against the post it names as this log holds it. An
+ *     unverified receipt is worthless as proof, and storing one would only be discovered at the
+ *     moment it was needed.
+ *
+ * Keyed on the channel's pubkey — the daemon's own channel identity — never on an agent name.
+ */
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+import type { BroadcastArtifact, RelayPostReceipt } from "@cello-protocol/protocol-types";
+export declare const CHANNEL_LOG_CREATE_SQL = "\n  -- `post_cbor` is AUTHORITATIVE: every read path decodes it. `published_at` and `title` are lifted\n  -- out of the signed bytes so a digest or an index query does not have to decode every row, and a\n  -- reader that needs certainty must still go through `post_cbor`.\n  CREATE TABLE IF NOT EXISTS channel_log (\n    channel_pubkey   TEXT    NOT NULL,\n    seq              INTEGER NOT NULL,\n    published_at     INTEGER NOT NULL,\n    title            TEXT    NOT NULL,\n    post_cbor        BLOB    NOT NULL,\n    PRIMARY KEY (channel_pubkey, seq)\n  );\n  CREATE TABLE IF NOT EXISTS channel_log_receipts (\n    channel_pubkey   TEXT    NOT NULL,\n    seq              INTEGER NOT NULL,\n    relay_pubkey     TEXT    NOT NULL,\n    received_at      INTEGER NOT NULL,\n    receipt_cbor     BLOB    NOT NULL,\n    PRIMARY KEY (channel_pubkey, seq, relay_pubkey)\n  );\n  CREATE TABLE IF NOT EXISTS channel_state (\n    channel_pubkey   TEXT    NOT NULL PRIMARY KEY,\n    next_seq         INTEGER NOT NULL,\n    pruned_through   INTEGER NOT NULL DEFAULT 0\n  );\n";
+export type ChannelLogErrorCode = "channel_unknown" | "seq_not_next" | "position_taken" | "post_invalid" | "receipt_invalid" | "post_pruned" | "prune_regression" | "log_row_corrupt";
+export declare class ChannelLogError extends Error {
+    readonly code: ChannelLogErrorCode;
+    constructor(code: ChannelLogErrorCode, message: string);
+}
+export interface ChannelHead {
+    /** Oldest post still held, or null when the log holds none. */
+    first_seq: number | null;
+    /** Newest post held, or null when the log holds none. */
+    last_seq: number | null;
+    /** Everything at or below this number was pruned. NOT the same as `first_seq`. */
+    pruned_through: number;
+}
+export declare class ChannelLogStore {
+    #private;
+    constructor(db: DaemonDatabase, logger: Logger);
+    /** Idempotent: creates the state row {next_seq 1, pruned_through 0}. */
+    ensureChannel(channelPubkeyHex: string): void;
+    /** What the NEXT append will be assigned — the publisher signs with this before appending. */
+    nextPosition(channelPubkeyHex: string): {
+        seq: number;
+    };
+    /** Append an already-signed post. Throws ChannelLogError — never silently skips. */
+    append(channelPubkeyHex: string, post: BroadcastArtifact, correlationId?: string): {
+        seq: number;
+    };
+    /**
+     * Store one relay's receipt for a post this log holds. VERIFIES FIRST, against the stored post —
+     * not against whatever the caller passed alongside it — so a receipt for a different post at the
+     * same number is refused rather than filed as proof.
+     *
+     * WHAT THIS DOES NOT CHECK: that `relay_pubkey` is one of the relays this channel actually
+     * publishes to. Any keypair can sign a well-formed receipt for a post it has seen. The relay set
+     * lives with the channel's info record, so that check belongs to the publisher — order 018 —
+     * which knows which two relays it deposited on; here it would have nothing to compare against.
+     */
+    recordReceipt(channelPubkeyHex: string, receipt: RelayPostReceipt, correlationId?: string): void;
+    /** Every relay's receipt for one post, in relay order. Empty when none were stored. */
+    receiptsFor(channelPubkeyHex: string, seq: number): RelayPostReceipt[];
+    /** Range read, for refilling a relay and for verification. Inclusive, seq order. */
+    readRange(channelPubkeyHex: string, fromSeq: number, toSeq: number): BroadcastArtifact[];
+    /**
+     * Delete every post at or below `throughSeq`, with its receipts. The OLDEST END ONLY: a prune
+     * below what is already pruned is refused rather than silently ignored, because a caller that
+     * believes it pruned something it did not would keep re-sending it.
+     */
+    pruneThrough(channelPubkeyHex: string, throughSeq: number): {
+        pruned: number;
+    };
+    /**
+     * What this log holds. `pruned_through` is NOT `first_seq`: posts can also be absent because the
+     * log is empty, and a caller that conflated them would report gaps that are not gaps.
+     */
+    head(channelPubkeyHex: string): ChannelHead;
+}
+//# sourceMappingURL=channel-log-store.d.ts.map

package/dist/channel-log-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-log-store.d.ts","sourceRoot":"","sources":["../src/channel-log-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAUzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAE1F,eAAO,MAAM,sBAAsB,ijCAyBlC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GAAG,cAAc,GAAG,gBAAgB,GAAG,cAAc,GAGtE,iBAAiB,GAGjB,aAAa,GAEb,kBAAkB,GAElB,iBAAiB,CAAC;AAEtB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBACvB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAKvD;AAOD,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,kFAAkF;IAClF,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,qBAAa,eAAe;;gBAId,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAM9C,wEAAwE;IACxE,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI;IAM7C,8FAA8F;IAC9F,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE;IAIvD,oFAAoF;IACpF,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE;IA8DlG;;;;;;;;;OASG;IACH,aAAa,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IA6DhG,uFAAuF;IACvF,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE;IActE,oFAAoF;IACpF,SAAS,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAQxF;;;;OAIG;IACH,YAAY,CAAC,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;IAoC9E;;;OAGG;IACH,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,WAAW;CAyD5C"}