@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/consortium-fingerprint.d.ts

@@ -0,0 +1,115 @@
+/**
+ * DOD-M15-CONSORTIUM-FINGERPRINT-1 — which consortium is this daemon actually verifying against?
+ *
+ * ─── The attack this answers ───────────────────────────────────────────────────────────────────
+ *
+ * Anyone can fork the open-source client, stand up three nodes, sign their own consortium manifest
+ * with their own officer root key and market the result as CELLO. The receipts that network issues
+ * mean nothing, and when it is broken into the headline says CELLO was hacked. This is the
+ * shadow-frontend attack from crypto, and it worked there for exactly one reason: a user had no
+ * cheap way to tell the real deployment from the copy.
+ *
+ * ─── What already works, and what did not ──────────────────────────────────────────────────────
+ *
+ * The VERIFICATION is not the gap. `EmbeddedManifestProvider.loadAndVerify` refuses any manifest
+ * whose officer signatures do not verify against the root keys it is handed, and fails CLOSED with
+ * `manifest_signature_invalid`. A fake consortium cannot fool a genuine client that is verifying
+ * against ours; it can only ship its own client.
+ *
+ * The gap is that the answer was never shown. "Am I on the real network?" was a judgement call
+ * instead of a command — this milestone's recurring shape, a check that runs, decides correctly, and
+ * tells nobody.
+ *
+ * ─── ⚠️ IT REPORTS THE ENFORCED KEYS, NOT THE COMPILED-IN ONES, AND THAT IS THE UNIT ───────────
+ *
+ * The first cut of this module read `BUNDLED_CONSORTIUM_ROOT_KEYS` unconditionally, and review
+ * measured that the daemon does not always verify against them. `buildManifestDeps` has three
+ * outcomes, not one:
+ *
+ *   BUNDLED      no `CELLO_CONSORTIUM_MANIFEST`, and the directory URL matches the bundled roster →
+ *                the compiled-in keys are what `loadAndVerify` is handed.
+ *   OVERRIDDEN   `CELLO_CONSORTIUM_MANIFEST` is set → `CELLO_CONSORTIUM_ROOT_KEYS` and
+ *                `CELLO_CONSORTIUM_THRESHOLD` are what it is handed. A different consortium.
+ *   NOT ANCHORED the resolved directory URL is not a bundled endpoint → `{}`: no provider, no root
+ *                keys, no manifest verification at all.
+ *
+ * Printing the bundled fingerprint in the last two postures is the precise failure this order exists
+ * to prevent, aimed the worst possible way: an operator talked into pointing at a fork reads the
+ * genuine CELLO fingerprint and concludes they are safe. So the block takes the keys the daemon
+ * hands the verifier, says which of the three postures it is in, and where nothing is anchored it
+ * reports that instead of a fingerprint — a value describing a check that is not running is the one
+ * output worse than silence.
+ *
+ * The value is still not configurable in the sense that matters: nothing here reads the environment,
+ * and an override cannot make this block SAY `bundled`. It can only make it say, out loud, that an
+ * override is in force.
+ *
+ * Crypto reference: RFC 6234 (SHA-256). The digest is an identifier, not a security boundary — the
+ * security boundary is the Ed25519 threshold verification in `verifyManifest` (RFC 8032). This makes
+ * that boundary's anchor readable by a human in one glance.
+ */
+import type { Logger } from "./types.js";
+/**
+ * Domain separator. Versioned so a future change to what the fingerprint covers produces a visibly
+ * different value rather than a silently different one over the same inputs.
+ */
+export declare const CONSORTIUM_FINGERPRINT_DOMAIN = "cello-consortium-root-v1";
+/** Where the genuine value is published, for an operator comparing what they just read. */
+export declare const CONSORTIUM_FINGERPRINT_PUBLISHED_AT = "https://cello.mygentic.ai/fingerprint";
+/**
+ * The canonical preimage: domain, then the root keys lowercased and SORTED, then the threshold.
+ *
+ * Sorting is what makes the fingerprint a property of the KEY SET rather than of the order someone
+ * happened to write the array in — otherwise a cosmetic reordering during an officer rotation would
+ * read as a different consortium and send an operator hunting an attack that is not there.
+ *
+ * The threshold is inside the preimage because it is enforced alongside the keys: the same two
+ * officer keys at threshold 1 and at threshold 2 are different trust arrangements, and a fork that
+ * reused our keys at a weaker threshold would otherwise fingerprint identically to us.
+ */
+export declare function consortiumFingerprintPreimage(rootKeys: readonly string[], threshold: number): string;
+/** The full SHA-256 digest, hex, of the canonical preimage. */
+export declare function consortiumFingerprintFull(rootKeys: readonly string[], threshold: number): string;
+/**
+ * The SHORT form an operator actually compares by eye: the first 16 hex characters of the digest,
+ * in four groups of four.
+ *
+ * Grouped because an ungrouped hex run is where eye-comparison fails — a reader checks the first
+ * few characters and the last few and skips the middle, which is precisely the substitution an
+ * attacker would make. The full digest stays in the response beside it for anything automated.
+ */
+export declare function consortiumFingerprintShort(rootKeys: readonly string[], threshold: number): string;
+/** What the daemon actually hands `loadAndVerify` — the same two values, or neither. */
+export interface EnforcedConsortium {
+    rootKeys: readonly string[] | undefined;
+    threshold: number | undefined;
+}
+export type ConsortiumPosture = "bundled" | "overridden" | "not_anchored";
+/**
+ * Which of the three postures a set of enforced values represents.
+ *
+ * `bundled` is decided by comparing FINGERPRINTS rather than array contents, so a reordered or
+ * differently-cased copy of our own key set is still recognised as ours — the same normalisation the
+ * published value carries, applied to the decision that quotes it.
+ */
+export declare function consortiumPosture(enforced: EnforcedConsortium): ConsortiumPosture;
+/**
+ * The status block, for `cello status` and `cello_status`.
+ *
+ * NOTE the same inversion as `describeDirectoryAuth`: the HEALTHY case contributes a field here,
+ * against this milestone's general rule that a field on the good path is furniture. The defect being
+ * closed is that the real network and a fork are distinguished by nothing an operator can read, so
+ * "I checked, and it is ours" has to be an answer they can obtain — an absence proves nothing.
+ */
+export declare function describeConsortiumFingerprint(enforced: EnforcedConsortium): Record<string, unknown>;
+/**
+ * The startup event — clause 6: "which network is this daemon on" is one grep.
+ *
+ * Emitted unconditionally, on every startup and in all three postures, because the question is asked
+ * AFTER the fact. An operator reading a log days later, about a daemon that is no longer running,
+ * cannot go and run `cello status` on it; the status surface answers only for a process that still
+ * exists. It reports the ENFORCED keys for the same reason the status block does — a log line saying
+ * a daemon was anchored to CELLO when it was anchored to nothing is worse than no log line.
+ */
+export declare function logConsortiumAnchor(logger: Logger, enforced: EnforcedConsortium): void;
+//# sourceMappingURL=consortium-fingerprint.d.ts.map

package/dist/consortium-fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consortium-fingerprint.d.ts","sourceRoot":"","sources":["../src/consortium-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAOH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,2FAA2F;AAC3F,eAAO,MAAM,mCAAmC,0CAA0C,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGpG;AAED,+DAA+D;AAC/D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGjG;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAE1E;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,iBAAiB,CAKjF;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6CnG;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAWtF"}

package/dist/consortium-fingerprint.js

@@ -0,0 +1,175 @@
+/**
+ * DOD-M15-CONSORTIUM-FINGERPRINT-1 — which consortium is this daemon actually verifying against?
+ *
+ * ─── The attack this answers ───────────────────────────────────────────────────────────────────
+ *
+ * Anyone can fork the open-source client, stand up three nodes, sign their own consortium manifest
+ * with their own officer root key and market the result as CELLO. The receipts that network issues
+ * mean nothing, and when it is broken into the headline says CELLO was hacked. This is the
+ * shadow-frontend attack from crypto, and it worked there for exactly one reason: a user had no
+ * cheap way to tell the real deployment from the copy.
+ *
+ * ─── What already works, and what did not ──────────────────────────────────────────────────────
+ *
+ * The VERIFICATION is not the gap. `EmbeddedManifestProvider.loadAndVerify` refuses any manifest
+ * whose officer signatures do not verify against the root keys it is handed, and fails CLOSED with
+ * `manifest_signature_invalid`. A fake consortium cannot fool a genuine client that is verifying
+ * against ours; it can only ship its own client.
+ *
+ * The gap is that the answer was never shown. "Am I on the real network?" was a judgement call
+ * instead of a command — this milestone's recurring shape, a check that runs, decides correctly, and
+ * tells nobody.
+ *
+ * ─── ⚠️ IT REPORTS THE ENFORCED KEYS, NOT THE COMPILED-IN ONES, AND THAT IS THE UNIT ───────────
+ *
+ * The first cut of this module read `BUNDLED_CONSORTIUM_ROOT_KEYS` unconditionally, and review
+ * measured that the daemon does not always verify against them. `buildManifestDeps` has three
+ * outcomes, not one:
+ *
+ *   BUNDLED      no `CELLO_CONSORTIUM_MANIFEST`, and the directory URL matches the bundled roster →
+ *                the compiled-in keys are what `loadAndVerify` is handed.
+ *   OVERRIDDEN   `CELLO_CONSORTIUM_MANIFEST` is set → `CELLO_CONSORTIUM_ROOT_KEYS` and
+ *                `CELLO_CONSORTIUM_THRESHOLD` are what it is handed. A different consortium.
+ *   NOT ANCHORED the resolved directory URL is not a bundled endpoint → `{}`: no provider, no root
+ *                keys, no manifest verification at all.
+ *
+ * Printing the bundled fingerprint in the last two postures is the precise failure this order exists
+ * to prevent, aimed the worst possible way: an operator talked into pointing at a fork reads the
+ * genuine CELLO fingerprint and concludes they are safe. So the block takes the keys the daemon
+ * hands the verifier, says which of the three postures it is in, and where nothing is anchored it
+ * reports that instead of a fingerprint — a value describing a check that is not running is the one
+ * output worse than silence.
+ *
+ * The value is still not configurable in the sense that matters: nothing here reads the environment,
+ * and an override cannot make this block SAY `bundled`. It can only make it say, out loud, that an
+ * override is in force.
+ *
+ * Crypto reference: RFC 6234 (SHA-256). The digest is an identifier, not a security boundary — the
+ * security boundary is the Ed25519 threshold verification in `verifyManifest` (RFC 8032). This makes
+ * that boundary's anchor readable by a human in one glance.
+ */
+import { createHash } from "node:crypto";
+import { BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD, } from "./bundled-consortium-manifest.js";
+/**
+ * Domain separator. Versioned so a future change to what the fingerprint covers produces a visibly
+ * different value rather than a silently different one over the same inputs.
+ */
+export const CONSORTIUM_FINGERPRINT_DOMAIN = "cello-consortium-root-v1";
+/** Where the genuine value is published, for an operator comparing what they just read. */
+export const CONSORTIUM_FINGERPRINT_PUBLISHED_AT = "https://cello.mygentic.ai/fingerprint";
+/**
+ * The canonical preimage: domain, then the root keys lowercased and SORTED, then the threshold.
+ *
+ * Sorting is what makes the fingerprint a property of the KEY SET rather than of the order someone
+ * happened to write the array in — otherwise a cosmetic reordering during an officer rotation would
+ * read as a different consortium and send an operator hunting an attack that is not there.
+ *
+ * The threshold is inside the preimage because it is enforced alongside the keys: the same two
+ * officer keys at threshold 1 and at threshold 2 are different trust arrangements, and a fork that
+ * reused our keys at a weaker threshold would otherwise fingerprint identically to us.
+ */
+export function consortiumFingerprintPreimage(rootKeys, threshold) {
+    const keys = [...rootKeys].map((k) => k.trim().toLowerCase()).sort();
+    return [CONSORTIUM_FINGERPRINT_DOMAIN, ...keys, String(threshold)].join("\n") + "\n";
+}
+/** The full SHA-256 digest, hex, of the canonical preimage. */
+export function consortiumFingerprintFull(rootKeys, threshold) {
+    return createHash("sha256").update(consortiumFingerprintPreimage(rootKeys, threshold), "utf8").digest("hex");
+}
+/**
+ * The SHORT form an operator actually compares by eye: the first 16 hex characters of the digest,
+ * in four groups of four.
+ *
+ * Grouped because an ungrouped hex run is where eye-comparison fails — a reader checks the first
+ * few characters and the last few and skips the middle, which is precisely the substitution an
+ * attacker would make. The full digest stays in the response beside it for anything automated.
+ */
+export function consortiumFingerprintShort(rootKeys, threshold) {
+    const full = consortiumFingerprintFull(rootKeys, threshold);
+    return (full.slice(0, 16).match(/.{4}/g) ?? []).join("-");
+}
+/**
+ * Which of the three postures a set of enforced values represents.
+ *
+ * `bundled` is decided by comparing FINGERPRINTS rather than array contents, so a reordered or
+ * differently-cased copy of our own key set is still recognised as ours — the same normalisation the
+ * published value carries, applied to the decision that quotes it.
+ */
+export function consortiumPosture(enforced) {
+    const { rootKeys, threshold } = enforced;
+    if (!rootKeys || rootKeys.length === 0 || threshold === undefined || threshold < 1)
+        return "not_anchored";
+    const bundled = consortiumFingerprintFull(BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD);
+    return consortiumFingerprintFull(rootKeys, threshold) === bundled ? "bundled" : "overridden";
+}
+/**
+ * The status block, for `cello status` and `cello_status`.
+ *
+ * NOTE the same inversion as `describeDirectoryAuth`: the HEALTHY case contributes a field here,
+ * against this milestone's general rule that a field on the good path is furniture. The defect being
+ * closed is that the real network and a fork are distinguished by nothing an operator can read, so
+ * "I checked, and it is ours" has to be an answer they can obtain — an absence proves nothing.
+ */
+export function describeConsortiumFingerprint(enforced) {
+    const posture = consortiumPosture(enforced);
+    const bundledShort = consortiumFingerprintShort(BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD);
+    if (posture === "not_anchored") {
+        return {
+            consortium_root_fingerprint: null,
+            consortium_root_fingerprint_state: "not_anchored",
+            consortium_root_fingerprint_guidance: "This daemon is verifying NO consortium manifest, so there is no root key set to fingerprint " +
+                "and nothing here tells you which network you are on. It happens when the resolved directory " +
+                "URL is not one of the endpoints in the bundled roster — local development and the e2e " +
+                "harness are the designed cases. A daemon started through the normal CLI with " +
+                "CELLO_DIRECTORY_URL unset anchors to the bundled roster automatically; " +
+                "directory_authentication in this same output reports the related posture and names the URL " +
+                "that failed to match. The CELLO consortium's own fingerprint is " + bundledShort +
+                ", published at " + CONSORTIUM_FINGERPRINT_PUBLISHED_AT + ".",
+        };
+    }
+    const rootKeys = enforced.rootKeys;
+    const threshold = enforced.threshold;
+    return {
+        consortium_root_fingerprint: consortiumFingerprintShort(rootKeys, threshold),
+        consortium_root_fingerprint_full: consortiumFingerprintFull(rootKeys, threshold),
+        consortium_root_fingerprint_state: posture,
+        // Only when they differ. On the bundled path the two are the same value, and printing it twice
+        // invites a reader to compare a number with itself and conclude something from the match.
+        ...(posture === "overridden" ? { consortium_root_fingerprint_bundled: bundledShort } : {}),
+        consortium_root_fingerprint_guidance: posture === "bundled"
+            ? "This is the consortium root key set this daemon verifies every manifest against; a " +
+                "manifest signed by any other root key is refused. It is the set compiled into this " +
+                "client, and no setting is overriding it. Compare it with the value published at " +
+                CONSORTIUM_FINGERPRINT_PUBLISHED_AT + " — if they differ, this client is not talking to " +
+                "the CELLO consortium, whatever it calls itself."
+            : "This daemon is verifying manifests against a root key set supplied by " +
+                "CELLO_CONSORTIUM_ROOT_KEYS / CELLO_CONSORTIUM_THRESHOLD, NOT the set compiled into this " +
+                "client (" + bundledShort + "). That is a different consortium, and receipts from it say " +
+                "nothing about CELLO. If you did not choose that deliberately, unset all three of " +
+                "CELLO_CONSORTIUM_MANIFEST, CELLO_CONSORTIUM_ROOT_KEYS and CELLO_CONSORTIUM_THRESHOLD and " +
+                "restart the daemon, which returns it to the bundled roster. The genuine CELLO value is " +
+                "published at " + CONSORTIUM_FINGERPRINT_PUBLISHED_AT + ".",
+    };
+}
+/**
+ * The startup event — clause 6: "which network is this daemon on" is one grep.
+ *
+ * Emitted unconditionally, on every startup and in all three postures, because the question is asked
+ * AFTER the fact. An operator reading a log days later, about a daemon that is no longer running,
+ * cannot go and run `cello status` on it; the status surface answers only for a process that still
+ * exists. It reports the ENFORCED keys for the same reason the status block does — a log line saying
+ * a daemon was anchored to CELLO when it was anchored to nothing is worse than no log line.
+ */
+export function logConsortiumAnchor(logger, enforced) {
+    const posture = consortiumPosture(enforced);
+    const anchored = posture !== "not_anchored";
+    logger.info("daemon.consortium.anchored", {
+        posture,
+        fingerprint: anchored ? consortiumFingerprintShort(enforced.rootKeys, enforced.threshold) : null,
+        fingerprintFull: anchored ? consortiumFingerprintFull(enforced.rootKeys, enforced.threshold) : null,
+        bundledFingerprint: consortiumFingerprintShort(BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD),
+        rootKeyCount: enforced.rootKeys?.length ?? 0,
+        threshold: enforced.threshold ?? null,
+    });
+}
+//# sourceMappingURL=consortium-fingerprint.js.map

package/dist/consortium-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consortium-fingerprint.js","sourceRoot":"","sources":["../src/consortium-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAG1C;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAExE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,uCAAuC,CAAC;AAE3F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAA2B,EAAE,SAAiB;IAC1F,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,CAAC,6BAA6B,EAAE,GAAG,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACvF,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,yBAAyB,CAAC,QAA2B,EAAE,SAAiB;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA2B,EAAE,SAAiB;IACvF,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B;IAC5D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IAC1G,MAAM,OAAO,GAAG,yBAAyB,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;IACtG,OAAO,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;AAC/F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAA4B;IACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,0BAA0B,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;IAE5G,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO;YACL,2BAA2B,EAAE,IAAI;YACjC,iCAAiC,EAAE,cAAc;YACjD,oCAAoC,EAClC,8FAA8F;gBAC9F,8FAA8F;gBAC9F,wFAAwF;gBACxF,+EAA+E;gBAC/E,yEAAyE;gBACzE,6FAA6F;gBAC7F,kEAAkE,GAAG,YAAY;gBACjF,iBAAiB,GAAG,mCAAmC,GAAG,GAAG;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA6B,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAmB,CAAC;IAE/C,OAAO;QACL,2BAA2B,EAAE,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC5E,gCAAgC,EAAE,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC;QAChF,iCAAiC,EAAE,OAAO;QAC1C,+FAA+F;QAC/F,0FAA0F;QAC1F,GAAG,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,mCAAmC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,oCAAoC,EAClC,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,qFAAqF;gBACrF,qFAAqF;gBACrF,kFAAkF;gBAClF,mCAAmC,GAAG,mDAAmD;gBACzF,iDAAiD;YACnD,CAAC,CAAC,wEAAwE;gBACxE,0FAA0F;gBAC1F,UAAU,GAAG,YAAY,GAAG,8DAA8D;gBAC1F,mFAAmF;gBACnF,2FAA2F;gBAC3F,yFAAyF;gBACzF,eAAe,GAAG,mCAAmC,GAAG,GAAG;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,QAA4B;IAC9E,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,KAAK,cAAc,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,OAAO;QACP,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAS,EAAE,QAAQ,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QAClG,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAS,EAAE,QAAQ,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QACrG,kBAAkB,EAAE,0BAA0B,CAAC,4BAA4B,EAAE,4BAA4B,CAAC;QAC1G,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;QAC5C,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;KACtC,CAAC,CAAC;AACL,CAAC"}

package/dist/contact-handlers.d.ts

@@ -0,0 +1,59 @@
+import type { IpcHandler } from "./ipc-server.js";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { Logger } from "./types.js";
+import type { AgentInfo } from "./types.js";
+/** The per-connection agent selection, as the address book needs to read it. */
+export interface ConnState {
+    currentAgent: string | null;
+    clearedAgent?: string;
+}
+export interface ContactHandlerDeps {
+    handlers: Map<string, IpcHandler>;
+    sessionNodeManager: SessionNodeManager;
+    /**
+     * Read this connection's agent selection. The READ, not the container: these handlers only ever
+     * `.get(connectionId)`, and injecting the whole Map would hand the address book the power to
+     * mutate connection state it has no business touching.
+     */
+    getConnState: (connectionId: string) => ConnState | undefined;
+    /** The daemon's single agent-selection rule. Injected, never re-implemented here. */
+    resolveCurrentAgent: (connState: ConnState | undefined, explicitAgent?: string) => string | null;
+    /** DOD-INBOX-AGENT-1: every agent, so an explicitly NAMED one can be validated before we WRITE. */
+    agents: ReadonlyArray<AgentInfo>;
+    /**
+     * Set (or clear, with null) an agent's outbound-name override. False when no such agent exists.
+     *
+     * Injected as a capability rather than reached for, because `cello_set_moniker` was the ONE
+     * address-book handler that bypassed the store interface entirely and grabbed the raw SQLite
+     * handle (`sessionNodeManager.getDb()`) to build a DbIdentityStore. Every other handler goes
+     * through a store method. Inside the closure that asymmetry was invisible; the extraction made it
+     * the single thing standing between this module and "needs no database". Same call, same
+     * behavior — the daemon still constructs the DbIdentityStore. It just says so out loud now.
+     */
+    setAgentMoniker: (agentName: string, moniker: string | null) => boolean;
+    logger: Logger;
+    /** M8C-TGDOOR-1: restart the poller after a token change, with no daemon restart. */
+    startTelegramPollerIfConfigured: () => void;
+}
+type Refusal = {
+    ok: false;
+    reason: string;
+    guidance: string;
+};
+/**
+ * Review finding 7 — a contact pubkey must LOOK like a pubkey, or the row can never work.
+ *
+ * The address-book handlers took `params.pubkey` as any string and stored it. So
+ * `cello contact tier add` — a plausible slip under the `contact <pubkey> <op>` shape, where the
+ * FIRST positional is the pubkey — persisted a contact whose pubkey is the literal text "tier",
+ * and answered ok:true. Nothing would ever match it: it is not a key, so it can never be a
+ * counterparty. The operator is told they added someone; they added a typo.
+ *
+ * A key is 32 bytes, hex: 64 characters. Anything else is refused, loudly, with the value echoed
+ * so the slip is obvious. Returns null when the pubkey is absent — the caller's own missing_params
+ * check owns that case and says something more useful.
+ */
+export declare function invalidPubkey(pubkey: string | undefined): Refusal | null;
+export declare function registerContactHandlers(deps: ContactHandlerDeps): void;
+export {};
+//# sourceMappingURL=contact-handlers.d.ts.map

package/dist/contact-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contact-handlers.d.ts","sourceRoot":"","sources":["../src/contact-handlers.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAWzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC;;;;OAIG;IACH,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,mGAAmG;IACnG,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,+BAA+B,EAAE,MAAM,IAAI,CAAC;CAC7C;AAED,KAAK,OAAO,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CA2StE"}