@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/seal-certified-root-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-certified-root-check.js","sourceRoot":"","sources":["../src/seal-certified-root-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAA+E,EAC/E,cAAsB,EACtB,YAAoB,EACpB,aAAyB,EACzB,kBAA0B;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE/E;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CACjF,CAAC;IACF,MAAM,qBAAqB,GAAG,iBAAiB,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC;IAE1E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,IACE,WAAW,KAAK,IAAI;QACpB,KAAK,CAAC,MAAM,KAAK,kBAAkB;QACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EACvG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,iBAAiB;gBACvB,CAAC,CAAC,qBAAqB,WAAW,CAAC,IAAI,uCAAuC;gBAC9E,CAAC,CAAC,6BAA6B,KAAK,CAAC,MAAM,0CAA0C;SACxF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,uFAAuF;QACvF,sEAAsE;QACtE,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,IAAI,EAAE,2EAA2E;YAC7F,MAAM,EAAE,+DAA+D,KAAK,CAAC,MAAM,qCAAqC,kBAAkB,EAAE;SAC7I,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,mFAAmF;QACnF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC;QAC3E,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE;QACtB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,sEAAsE,EAAE,CAAC;AAC1H,CAAC"}

package/dist/seal-coordinator.d.ts

@@ -0,0 +1,118 @@
+import { SignalingManager } from "@cello-protocol/transport";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { DbRegistrationPersistence } from "./db-identity-store.js";
+import type { Logger } from "./types.js";
+/**
+ * M7-SESSION-004: the bilateral seal resolves with the sealed_root AND the legibility certificate.
+ *
+ * DOD-M15-SEALWIRE-1 bullet 2 (review F4) added the REFUSED shape. A root mismatch used to log and
+ * `return`, leaving the waiter unresolved — so the close sat out its eleven-minute wait, escalated,
+ * and told the operator *"the counterparty has not closed"* about a counterparty who had closed and
+ * whose certificate this daemon had just refused. Three failures in one sentence: it names a party
+ * the code never checked, the remedy cannot work (the seal frame is delivered once), and the one
+ * thing actually detected appears nowhere the operator looks.
+ *
+ * A detection whose only consumer is a log line is not a control.
+ */
+export type SealCompletion = {
+    rootHex: string;
+    legibility?: unknown;
+}
+/**
+ * `guidance` — `DOD-M15-SEALPARTIES-1`. A refusal used to have exactly one producer (this
+ * daemon's own root check), so the close handler could hardcode the remedy. There are now two,
+ * and the DIRECTORY's refusals have causes this side cannot infer — a counterparty who approved
+ * nothing, two participants who approved different transcripts. The party that knows the cause
+ * writes the remedy; a close handler guessing it would print the wrong next step confidently.
+ */
+ | {
+    refused: true;
+    reason: string;
+    detail: string;
+    ownRootHex: string | null;
+    guidance?: string;
+    /**
+     * WHO refused, and it decides whether the close is over — `DOD-M15-SEALPARTIES-1`, review F1.
+     *
+     * `"local"` — THIS daemon refused a certificate whose root does not describe its conversation.
+     * Terminal: there is nothing further to ask for, and the operator is told so.
+     *
+     * `"directory"` — the DIRECTORY refused to certify. The seal did not happen, and that is not
+     * the same as "no receipt is obtainable": the honest party's own carried chain can still be
+     * notarized the solo way. Before this field existed both landed on the same terminal branch,
+     * which took a receipt away from a party who used to get one after the eleven-minute wait —
+     * the exact trap the order names, arriving through the refusal listener rather than through
+     * the approval requirement.
+     *
+     * Optional so the pre-existing local producer keeps its shape; absent reads as `"local"`.
+     */
+    source?: "local" | "directory";
+};
+/**
+ * SESSION-002 / M8B FINDING-3: a unilateral seal carries the legibility certificate so the close
+ * returns it inline — the same RESPONSE SHAPE as a bilateral close, but NOT cryptographic parity:
+ * this cert is directory-attested (FINDING-5). `remainingSeconds` carries the directory's
+ * seal_unilateral_too_early countdown, so the close can tell the operator WHEN a unilateral seal
+ * becomes available.
+ */
+/**
+ * WHICH "not now" the directory meant — `DOD-M15-UNILATERAL-1`, review F1.
+ *
+ * The three refusals share one frame because the client's behaviour is the same for all of them
+ * (the session is intact, retry, never force-abandon). They do NOT share guidance: whether waiting
+ * will ever help is different in each, and telling someone to wait out a grace window that expired
+ * two hours ago is worse than saying nothing.
+ */
+/**
+ * 070-CARRIEDSEAL adds `already_sealed`: this session HAS a solo receipt, so the asker is late by an
+ * event rather than early by a clock. Ordinary rather than rare once a relay can be gone — with no
+ * relay there is no bilateral ceremony, so both parties close alone and the second one lands on it.
+ */
+export type UnilateralRefusalCause = "too_early" | "counterparty_present" | "high_stakes_evidence_required" | "already_sealed";
+export type UnilateralResult = {
+    ok: true;
+    sealedRootHex: string;
+    legibility?: unknown;
+} | {
+    ok: false;
+    reason: string;
+    remainingSeconds?: number;
+    cause?: UnilateralRefusalCause;
+};
+export interface SealCoordinatorDeps {
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    /** PERSIST-002: the agent's encrypted FROST-share persistence seam. */
+    getPersistence: (agentName: string) => DbRegistrationPersistence;
+    getKeyProvider: (agentName: string) => KeyProvider | undefined;
+    /**
+     * Recover parked content for an agent. THE KERNEL of DOD-UP-1 depends on this: the absent party
+     * ratifies a seal ONLY after it has recovered and integrity-verified the content behind the
+     * sealed root. It never co-signs content it could not verify.
+     */
+    recoverContent: (agentName: string) => Promise<void>;
+    /**
+     * DOD-M15-SEALPARTIES-1: record a seal that ended without a receipt, so the answer survives the
+     * close call that is waiting on it. Clause 6 asks for the refusal on TWO surfaces — the response
+     * and the session record — and the response is gone the moment the caller reads it.
+     */
+    recordSealFailure: (agentName: string, sessionId: string, reason: string, kind: "unresolved" | "refused") => void;
+}
+/**
+ * What an operator should DO about a seal the DIRECTORY refused.
+ *
+ * Exported so the wording is testable on its own and so there is one place to keep it true. Each
+ * branch names a different next step, because each reason accuses a different party: a counterparty
+ * whose agent sent no approval, a counterparty whose record disagrees, or a relay that altered the
+ * leaf set. Telling all three to "compare transcripts" would send two of them somewhere useless.
+ */
+export declare function sealRejectionGuidance(reason: string, detail: string): string;
+export declare function createSealCoordinator(deps: SealCoordinatorDeps): {
+    sealKey: (agentName: string, sessionId: string) => string;
+    sealInterruptedInProgress: Set<string>;
+    pendingSealWaiters: Map<string, (completion: SealCompletion) => void>;
+    pendingUnilateralWaiters: Map<string, (r: UnilateralResult) => void>;
+    registerSealListeners: (signaling: SignalingManager, agentName: string, agentPubkeyHex: string) => () => void;
+};
+//# sourceMappingURL=seal-coordinator.d.ts.map

package/dist/seal-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-coordinator.d.ts","sourceRoot":"","sources":["../src/seal-coordinator.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAO1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE;AAC3C;;;;;;GAMG;GACD;IACE,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;CAChC,CAAC;AA+FN;;;;;;GAMG;AACH;;;;;;;GAOG;AACH;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,sBAAsB,GAAG,+BAA+B,GAAG,gBAAgB,CAAC;AAwC/H,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAE7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,uEAAuE;IACvE,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,yBAAyB,CAAC;IACjE,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAC/D;;;;OAIG;IACH,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,SAAS,KAAK,IAAI,CAAC;CACnH;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAsC5E;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB;yBAOjC,MAAM,aAAa,MAAM,KAAG,MAAM;;iDAYN,cAAc,KAAK,IAAI;8CAsR1B,gBAAgB,KAAK,IAAI;uCA4dpC,gBAAgB,aAAa,MAAM,kBAAkB,MAAM,KAAG,MAAM,IAAI;EAoBnH"}