@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/manifest-validity.d.ts

@@ -0,0 +1,153 @@
+/**
+ * DOD-M15-MANIFEST-EXPIRY-LIVE-1 — a running daemon notices its own trust anchor expiring.
+ *
+ * ─── The gap ───────────────────────────────────────────────────────────────────────────────────
+ *
+ The consortium manifest's validity window is enforced at boot (`verifyStartupManifest`) and, after
+ * that, in exactly ONE consumer: `signal-submission.ts` re-checks the HELD manifest at request time
+ * and refuses. Nothing else does — not directory identity authentication, not the ceremony roster.
+ *
+ * (An earlier version of this header said nothing re-checked the held manifest at all. That was
+ * wrong — the third false claim I have shipped in three units — and the correction matters, because
+ * the real shape is not "unchecked" but INCONSISTENT: the daemon refuses the lowest-stakes consumer
+ * and permits the two highest-stakes ones, invisibly. See the decision note below.)
+ *
+ * There is also a check that reads like coverage and is not: `http-manifest-poll.ts` refuses to
+ * ADOPT an expired manifest. That checks the manifest being FETCHED, never the one already held — so
+ * a daemon whose anchor has lapsed keeps polling, keeps correctly refusing expired replacements, and
+ * keeps using the expired anchor it already has.
+ *
+ * On the PRODUCTION DEFAULT it is worse: the bundled-manifest path wires no poll scheduler at all
+ * ("the bundled roster is static"), so there is not even a fetch that might have noticed.
+ *
+ * ─── Why it matters, concretely ────────────────────────────────────────────────────────────────
+ *
+ The manifest is the trust anchor for directory identity authentication (step 6) and for the node
+ * roster a threshold ceremony draws from — both re-read `getCurrentManifest()` at request time, so
+ * both genuinely run on whatever is held.
+ *
+ * What expiry means precisely (review F10, correcting my own overstatement): it is the NOTICE that
+ * the anchor may be out of date, not the mechanism by which it becomes so. The daemon trusts the
+ * identical roster the day BEFORE expiry; what keeps a removed node trusted is never having adopted
+ * v+1. So the accurate statement is that past expiry there is NO ASSURANCE the enforced roster is
+ * current — a node removed since then would still be trusted, and nothing here can say whether one
+ * was.
+ *
+ * ─── Found the wrong way round ─────────────────────────────────────────────────────────────────
+ *
+ * `DOD-M15-STALEROSTER-1` shipped a guidance string blaming an expired manifest for a state an
+ * expired manifest cannot reach (that daemon refuses to start). Review corrected it and pointed at
+ * where the hazard actually lives — here. After that unit, a daemon in this state reports its roster
+ * reading as `stale: false`: a confidently fresh measurement taken against a dead anchor, which is
+ * worse than the stale reading that line existed to fix.
+ *
+ * ─── Decision: report, do not kill ─────────────────────────────────────────────────────────────
+ *
+ A daemon does NOT tear itself down at the expiry instant. §2b invariant 2 backs this explicitly —
+ * *"Loud does not mean blocking… treating every failure as fatal is its own defect."*
+ *
+ * But review corrected the FRAMING, and the correction is worth keeping: the availability argument I
+ * originally made does not survive. The fleet-wide stop I claimed to be avoiding happens anyway, at
+ * each operator's next restart, via ADV-002 — report-only DEFERS that outage, it does not prevent
+ * it. The honest reason to warn rather than kill is that a wall-clock boundary is a bad trigger for
+ * tearing down live conversations, not that it avoids the outage.
+ *
+ * The real question was never global report-vs-kill; it is PER CONSUMER, and the repo has already
+ * ruled on one of them inconsistently. `signal-submission.ts` refuses a trust-signal submission on
+ * expiry, while `register-handler.ts` deals a FROST share against a roster re-resolved from the same
+ * lapsed manifest with no gate, and the challenge verifier authenticates a directory against it with
+ * no gate. **The daemon refuses its lowest-stakes consumer and permits its two highest-stakes ones.**
+ * That is not defended anywhere; it is carried as `DOD-M15-EXPIRY-CONSUMER-POLICY-1` rather than
+ * settled inside a reporting unit.
+ */
+import type { ConsortiumManifest } from "@cello-protocol/protocol-types";
+/**
+ * How long before expiry the warning starts.
+ *
+ * Warning at the expiry instant is useless — the operator finds out once they are already running
+ * on a dead anchor. Seven days is chosen to cover a weekend plus the working days either side, which
+ * is the realistic floor for noticing an alert and rotating a threshold-signed artefact.
+ */
+export declare const MANIFEST_EXPIRY_WARNING_MS: number;
+export type ManifestValidity = {
+    state: "not_configured";
+} | {
+    state: "not_yet_valid";
+    notBefore: string;
+}
+/**
+ * The window itself is unreadable — a `not_before` that does not parse.
+ *
+ * Its OWN state, deliberately not folded into `expired`: those need different words. "Expired"
+ * tells an operator to rotate a manifest that is stale; this tells them a field in the manifest is
+ * GARBAGE, which is a different problem with a different fix and is more likely to mean the
+ * artefact was hand-edited or produced by a broken generator.
+ */
+ | {
+    state: "unreadable_window";
+    notBefore: string;
+} | {
+    state: "valid";
+    expires: string;
+    secondsRemaining: number;
+} | {
+    state: "expiring_soon";
+    expires: string;
+    secondsRemaining: number;
+} | {
+    state: "expired";
+    expires: string;
+    secondsSince: number;
+};
+/**
+ * Where does this manifest sit in its validity window, as of `nowMs`?
+ *
+ * Clock injected so the boundaries are tested exactly rather than approximately.
+ */
+export declare function classifyManifestValidity(manifest: Pick<ConsortiumManifest, "not_before" | "expires"> | null | undefined, nowMs: number): ManifestValidity;
+/**
+ * The operator-facing fields for `cello_status`, or `undefined` when there is nothing to say.
+ *
+ * A healthy manifest contributes NOTHING. A field that is present on every status read for the
+ * years a manifest is valid is not a warning — it is furniture, and it teaches the reader to skip
+ * the block that matters. This is the finding this milestone has produced more often than any other.
+ */
+/**
+ * WHERE the manifest came from, because it decides what the remedy even IS — review F5.
+ *
+ * `bundled` is a compiled-in constant: there is no file to replace and no poll to adopt a
+ * replacement, so "rotate the manifest" is not an action that operator can take. Telling them to do
+ * it anyway is worse than unhelpful, because the workaround they will reach for — repointing
+ * `CELLO_DIRECTORY_URL` at something not byte-equal to a bundled endpoint — makes `buildManifestDeps`
+ * return nothing, which starts the daemon with directory identity authentication SILENTLY OFF.
+ * Guidance that routes a stuck operator toward disabling a security control is a defect in the
+ * guidance.
+ */
+export type ManifestOrigin = "bundled" | "file";
+/** What to actually DO about a manifest that needs replacing, given where it came from. */
+export declare function remedyFor(origin: ManifestOrigin): string;
+export declare function describeManifestValidity(v: ManifestValidity, origin?: ManifestOrigin): Record<string, unknown> | undefined;
+/** Minimal structural logger — `domain.noun.verb` taxonomy, injected. */
+export interface ManifestValidityLogger {
+    info(event: string, ctx?: Record<string, unknown>): void;
+    warn(event: string, ctx?: Record<string, unknown>): void;
+    error(event: string, ctx?: Record<string, unknown>): void;
+}
+/**
+ * A check to call periodically, which logs each TRANSITION once.
+ *
+ * Returns a function rather than owning a timer: the roster sweep already ticks every 90–180 s on
+ * exactly the path where a manifest provider exists, so this rides it. A second timer measuring the
+ * same subsystem would be two things to stop, two things to test, and two places for the interval
+ * to drift out of agreement with the freshness bound.
+ *
+ * The latch is keyed on the STATE PLUS the expiry string, so rotating the manifest re-arms it. A
+ * bare boolean would mean an operator who rotated once could never be warned again — the warning
+ * would have been spent on a manifest that is no longer installed.
+ */
+export declare function startManifestValidityWatch(opts: {
+    getManifest: () => Pick<ConsortiumManifest, "not_before" | "expires"> | null | undefined;
+    logger: ManifestValidityLogger;
+    now?: () => number;
+}): () => ManifestValidity;
+//# sourceMappingURL=manifest-validity.d.ts.map

package/dist/manifest-validity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-validity.d.ts","sourceRoot":"","sources":["../src/manifest-validity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GACxB;IAAE,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAC3B;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAC/C;;;;;;;GAOG;GACD;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/E,KAAK,EAAE,MAAM,GACZ,gBAAgB,CAgDlB;AAED;;;;;;GAMG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhD,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAQxD;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,gBAAgB,EACnB,MAAM,GAAE,cAAuB,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CA+ErC;AAED,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,WAAW,EAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACzF,MAAM,EAAE,sBAAsB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,MAAM,gBAAgB,CAqDzB"}

package/dist/manifest-validity.js

@@ -0,0 +1,268 @@
+/**
+ * DOD-M15-MANIFEST-EXPIRY-LIVE-1 — a running daemon notices its own trust anchor expiring.
+ *
+ * ─── The gap ───────────────────────────────────────────────────────────────────────────────────
+ *
+ The consortium manifest's validity window is enforced at boot (`verifyStartupManifest`) and, after
+ * that, in exactly ONE consumer: `signal-submission.ts` re-checks the HELD manifest at request time
+ * and refuses. Nothing else does — not directory identity authentication, not the ceremony roster.
+ *
+ * (An earlier version of this header said nothing re-checked the held manifest at all. That was
+ * wrong — the third false claim I have shipped in three units — and the correction matters, because
+ * the real shape is not "unchecked" but INCONSISTENT: the daemon refuses the lowest-stakes consumer
+ * and permits the two highest-stakes ones, invisibly. See the decision note below.)
+ *
+ * There is also a check that reads like coverage and is not: `http-manifest-poll.ts` refuses to
+ * ADOPT an expired manifest. That checks the manifest being FETCHED, never the one already held — so
+ * a daemon whose anchor has lapsed keeps polling, keeps correctly refusing expired replacements, and
+ * keeps using the expired anchor it already has.
+ *
+ * On the PRODUCTION DEFAULT it is worse: the bundled-manifest path wires no poll scheduler at all
+ * ("the bundled roster is static"), so there is not even a fetch that might have noticed.
+ *
+ * ─── Why it matters, concretely ────────────────────────────────────────────────────────────────
+ *
+ The manifest is the trust anchor for directory identity authentication (step 6) and for the node
+ * roster a threshold ceremony draws from — both re-read `getCurrentManifest()` at request time, so
+ * both genuinely run on whatever is held.
+ *
+ * What expiry means precisely (review F10, correcting my own overstatement): it is the NOTICE that
+ * the anchor may be out of date, not the mechanism by which it becomes so. The daemon trusts the
+ * identical roster the day BEFORE expiry; what keeps a removed node trusted is never having adopted
+ * v+1. So the accurate statement is that past expiry there is NO ASSURANCE the enforced roster is
+ * current — a node removed since then would still be trusted, and nothing here can say whether one
+ * was.
+ *
+ * ─── Found the wrong way round ─────────────────────────────────────────────────────────────────
+ *
+ * `DOD-M15-STALEROSTER-1` shipped a guidance string blaming an expired manifest for a state an
+ * expired manifest cannot reach (that daemon refuses to start). Review corrected it and pointed at
+ * where the hazard actually lives — here. After that unit, a daemon in this state reports its roster
+ * reading as `stale: false`: a confidently fresh measurement taken against a dead anchor, which is
+ * worse than the stale reading that line existed to fix.
+ *
+ * ─── Decision: report, do not kill ─────────────────────────────────────────────────────────────
+ *
+ A daemon does NOT tear itself down at the expiry instant. §2b invariant 2 backs this explicitly —
+ * *"Loud does not mean blocking… treating every failure as fatal is its own defect."*
+ *
+ * But review corrected the FRAMING, and the correction is worth keeping: the availability argument I
+ * originally made does not survive. The fleet-wide stop I claimed to be avoiding happens anyway, at
+ * each operator's next restart, via ADV-002 — report-only DEFERS that outage, it does not prevent
+ * it. The honest reason to warn rather than kill is that a wall-clock boundary is a bad trigger for
+ * tearing down live conversations, not that it avoids the outage.
+ *
+ * The real question was never global report-vs-kill; it is PER CONSUMER, and the repo has already
+ * ruled on one of them inconsistently. `signal-submission.ts` refuses a trust-signal submission on
+ * expiry, while `register-handler.ts` deals a FROST share against a roster re-resolved from the same
+ * lapsed manifest with no gate, and the challenge verifier authenticates a directory against it with
+ * no gate. **The daemon refuses its lowest-stakes consumer and permits its two highest-stakes ones.**
+ * That is not defended anywhere; it is carried as `DOD-M15-EXPIRY-CONSUMER-POLICY-1` rather than
+ * settled inside a reporting unit.
+ */
+/**
+ * How long before expiry the warning starts.
+ *
+ * Warning at the expiry instant is useless — the operator finds out once they are already running
+ * on a dead anchor. Seven days is chosen to cover a weekend plus the working days either side, which
+ * is the realistic floor for noticing an alert and rotating a threshold-signed artefact.
+ */
+export const MANIFEST_EXPIRY_WARNING_MS = 7 * 86_400_000;
+/**
+ * Where does this manifest sit in its validity window, as of `nowMs`?
+ *
+ * Clock injected so the boundaries are tested exactly rather than approximately.
+ */
+export function classifyManifestValidity(manifest, nowMs) {
+    if (!manifest)
+        return { state: "not_configured" };
+    const expiresMs = Date.parse(manifest.expires);
+    /**
+     * AN UNREADABLE EXPIRY IS EXPIRED.
+     *
+     * `new Date("nonsense") <= now` is FALSE — every comparison against NaN is false — so the
+     * startup check's own shape waves a garbage timestamp through as though it were in-window. Valid
+     * is the answer that costs security here, so nothing unmeasurable may reach it.
+     */
+    if (Number.isNaN(expiresMs))
+        return { state: "expired", expires: manifest.expires, secondsSince: 0 };
+    /**
+     * AN UNREADABLE `not_before` FAILS CLOSED TOO — review F3, and it was my own defect sitting
+     * directly under the comment above claiming it could not happen.
+     *
+     * The first cut wrote `if (!Number.isNaN(notBeforeMs) && nowMs < notBeforeMs)`, which SKIPS the
+     * window-open check entirely when the field is garbage and falls through to a possible `valid`.
+     * So `not_before: "2026-13-01T00:00:00Z"` — month thirteen, the shape a hand-edited or
+     * generator-bugged artefact actually has — classified as valid, contributed nothing to the status
+     * surface, and logged nothing. I handled the same case correctly for `expires` eleven lines up and
+     * then wrote the inverted guard for `not_before`, under a comment asserting the property.
+     *
+     * `signal-submission.ts` already had this right (`!Number.isFinite(expiresAt) || expiresAt <= now`)
+     * and is the precedent.
+     */
+    const notBeforeMs = Date.parse(manifest.not_before);
+    if (Number.isNaN(notBeforeMs)) {
+        return { state: "unreadable_window", notBefore: manifest.not_before };
+    }
+    if (nowMs < notBeforeMs) {
+        return { state: "not_yet_valid", notBefore: manifest.not_before };
+    }
+    if (expiresMs <= nowMs) {
+        return { state: "expired", expires: manifest.expires, secondsSince: Math.floor((nowMs - expiresMs) / 1000) };
+    }
+    const remainingMs = expiresMs - nowMs;
+    const secondsRemaining = Math.floor(remainingMs / 1000);
+    // The constant directly, not an injectable parameter — review F9. A `warningMs` argument had no
+    // caller anywhere, and it was the ONE seam by which the two surfaces could ever disagree: the
+    // status path could not pass a custom window while the watch could. An unused knob whose only
+    // possible effect is drift between two readings of the same fact.
+    return remainingMs <= MANIFEST_EXPIRY_WARNING_MS
+        ? { state: "expiring_soon", expires: manifest.expires, secondsRemaining }
+        : { state: "valid", expires: manifest.expires, secondsRemaining };
+}
+/** What to actually DO about a manifest that needs replacing, given where it came from. */
+export function remedyFor(origin) {
+    return origin === "bundled"
+        ? "This daemon uses the COMPILED-IN consortium manifest, so there is no file to replace: " +
+            "upgrade the @cello-protocol/connect package to get a newer one. Do NOT repoint " +
+            "CELLO_DIRECTORY_URL to get past this — an endpoint that is not byte-equal to a bundled one " +
+            "makes the daemon start with directory identity authentication switched off, which is a " +
+            "weaker client than the one you are trying to fix."
+        : "Replace the manifest file at CELLO_CONSORTIUM_MANIFEST with a current one.";
+}
+export function describeManifestValidity(v, origin = "file") {
+    /**
+     * `valid` contributes nothing — correct, and the rule this milestone repeats most.
+     *
+     * `not_configured` USED TO collapse into that silence, and it was the same defect one spread
+     * above: a daemon holding NO consortium manifest at all rendered byte-identically to one holding
+     * a fully valid, in-window trust anchor. Found by `DOD-M15-DIRAUTH-1`'s review, which noticed it
+     * is the exact condition that unit was writing 100+ lines to expose — same daemon, same boot.
+     *
+     * "Absent" and "healthy" must not look alike. That is `STALEROSTER-1`'s rule and it applies to the
+     * anchor as much as to the roster reading.
+     */
+    if (v.state === "valid")
+        return undefined;
+    if (v.state === "not_configured") {
+        return {
+            manifest_anchor: "none",
+            manifest_validity_guidance: "There is NO consortium manifest on this daemon, so there is no trust anchor to have a " +
+                "validity window at all — the absence of an expiry warning here is not evidence of a healthy " +
+                "one. Directory identity authentication is off for the same reason; see " +
+                "directory_authentication for what that costs and how to turn it on.",
+        };
+    }
+    if (v.state === "unreadable_window") {
+        return {
+            manifest_expired: false,
+            manifest_window_unreadable: true,
+            manifest_valid_from: v.notBefore,
+            manifest_validity_guidance: `The consortium manifest's not_before field cannot be parsed as a date (got ` +
+                `${JSON.stringify(v.notBefore)}), so this daemon cannot tell whether its trust anchor's ` +
+                "validity window has even opened. This is a MALFORMED manifest rather than a stale one — " +
+                "the usual causes are a hand-edited file or a broken generator. " + remedyFor(origin),
+        };
+    }
+    if (v.state === "not_yet_valid") {
+        return {
+            manifest_expired: false,
+            manifest_not_yet_valid: true,
+            manifest_valid_from: v.notBefore,
+            manifest_validity_guidance: `The consortium manifest does not become valid until ${v.notBefore}, and this daemon is ` +
+                "still running against it. Either this machine's clock is wrong — the common cause, and the " +
+                "one to check first — or a manifest was rotated in ahead of its window. " + remedyFor(origin),
+        };
+    }
+    if (v.state === "expiring_soon") {
+        const days = Math.floor(v.secondsRemaining / 86_400);
+        return {
+            manifest_expired: false,
+            manifest_expires_at: v.expires,
+            manifest_expires_in_days: days,
+            manifest_validity_guidance: `The consortium manifest expires in ${days} day(s), at ${v.expires}. Rotate it before then. ` +
+                "After expiry this daemon KEEPS RUNNING on the old manifest — it does not fail closed the " +
+                "way startup does — so nothing will stop working at the deadline and nothing will announce " +
+                "it except this field and one log line. A daemon RESTARTED after expiry will refuse to " +
+                "start, which is how this usually gets discovered, at the worst moment. " + remedyFor(origin),
+        };
+    }
+    const days = Math.floor(v.secondsSince / 86_400);
+    return {
+        manifest_expired: true,
+        manifest_expires_at: v.expires,
+        manifest_expired_days_ago: days,
+        manifest_validity_guidance: `The consortium manifest EXPIRED at ${v.expires} (${days} day(s) ago) and this daemon is ` +
+            "still running on it. Its signatures no longer warrant the current consortium, so directory " +
+            "identity authentication and the threshold-ceremony roster are both being drawn from an " +
+            "anchor that has lapsed, so this daemon has NO ASSURANCE that the roster it enforces is the " +
+            "current one. A node removed from the consortium since then would still be trusted here, and " +
+            "nothing in this daemon can tell you whether one was. " + remedyFor(origin) + " Do NOT simply " +
+            "restart to clear this — a restart will REFUSE to start (startup fails closed on an expired " +
+            "manifest), so restarting without a fresh manifest turns a degraded daemon into a dead one.",
+    };
+}
+/**
+ * A check to call periodically, which logs each TRANSITION once.
+ *
+ * Returns a function rather than owning a timer: the roster sweep already ticks every 90–180 s on
+ * exactly the path where a manifest provider exists, so this rides it. A second timer measuring the
+ * same subsystem would be two things to stop, two things to test, and two places for the interval
+ * to drift out of agreement with the freshness bound.
+ *
+ * The latch is keyed on the STATE PLUS the expiry string, so rotating the manifest re-arms it. A
+ * bare boolean would mean an operator who rotated once could never be warned again — the warning
+ * would have been spent on a manifest that is no longer installed.
+ */
+export function startManifestValidityWatch(opts) {
+    const { getManifest, logger, now = Date.now } = opts;
+    let lastReported = null;
+    return () => {
+        const v = classifyManifestValidity(getManifest(), now());
+        const key = v.state === "not_configured" ? "not_configured"
+            : v.state === "not_yet_valid" || v.state === "unreadable_window" ? `${v.state}:${v.notBefore}`
+                : `${v.state}:${v.expires}`;
+        if (key === lastReported)
+            return v;
+        lastReported = key;
+        if (v.state === "expired") {
+            logger.error("directory.auth.manifest.expired.live", {
+                expiresAt: v.expires,
+                expiredDaysAgo: Math.floor(v.secondsSince / 86_400),
+                impact: "the daemon is STILL RUNNING on this manifest. Directory identity authentication and the " +
+                    "threshold-ceremony roster are drawn from it at request time, so there is NO ASSURANCE " +
+                    "the enforced roster is the current one — a node removed since then would still be " +
+                    "trusted, and nothing here can say whether one was.",
+                guidance: "Replace the manifest (a file at CELLO_CONSORTIUM_MANIFEST, or an @cello-protocol/connect " +
+                    "upgrade if this daemon uses the compiled-in one). Do not restart to clear it: startup " +
+                    "fails closed on an expired manifest, so a restart without a fresh one turns a degraded " +
+                    "daemon into a dead one.",
+            });
+        }
+        else if (v.state === "expiring_soon") {
+            logger.warn("directory.auth.manifest.expiring", {
+                expiresAt: v.expires,
+                daysRemaining: Math.floor(v.secondsRemaining / 86_400),
+                impact: "after this date the daemon keeps running on the expired manifest rather than failing closed.",
+                guidance: "Rotate before the date. A daemon RESTARTED after it will refuse to start.",
+            });
+        }
+        else if (v.state === "unreadable_window") {
+            logger.error("directory.auth.manifest.window.unreadable", {
+                notBefore: v.notBefore,
+                impact: "the manifest's not_before field does not parse as a date, so this daemon cannot tell " +
+                    "whether its trust anchor's validity window has opened. It is running against it anyway.",
+                guidance: "The manifest is MALFORMED, not stale — a hand-edited file or a broken generator. Replace it.",
+            });
+        }
+        else if (v.state === "not_yet_valid") {
+            logger.error("directory.auth.manifest.not.yet.valid.live", {
+                notBefore: v.notBefore,
+                impact: "the daemon is running against a manifest whose validity window has not opened.",
+                guidance: "Check this machine's clock first — that is the common cause.",
+            });
+        }
+        return v;
+    };
+}
+//# sourceMappingURL=manifest-validity.js.map

package/dist/manifest-validity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-validity.js","sourceRoot":"","sources":["../src/manifest-validity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,UAAU,CAAC;AAkBzD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA+E,EAC/E,KAAa;IAEb,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAErG;;;;;;;;;;;;;OAaG;IACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,GAAG,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IAC/G,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,GAAG,KAAK,CAAC;IACtC,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACxD,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,kEAAkE;IAClE,OAAO,WAAW,IAAI,0BAA0B;QAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE;QACzE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;AACtE,CAAC;AAsBD,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,MAAsB;IAC9C,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,wFAAwF;YACxF,iFAAiF;YACjF,6FAA6F;YAC7F,yFAAyF;YACzF,mDAAmD;QACrD,CAAC,CAAC,4EAA4E,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,CAAmB,EACnB,SAAyB,MAAM;IAE/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;QACjC,OAAO;YACL,eAAe,EAAE,MAAM;YACvB,0BAA0B,EACxB,wFAAwF;gBACxF,8FAA8F;gBAC9F,yEAAyE;gBACzE,qEAAqE;SACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;QACpC,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,0BAA0B,EAAE,IAAI;YAChC,mBAAmB,EAAE,CAAC,CAAC,SAAS;YAChC,0BAA0B,EACxB,6EAA6E;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,2DAA2D;gBACzF,0FAA0F;gBAC1F,iEAAiE,GAAG,SAAS,CAAC,MAAM,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,sBAAsB,EAAE,IAAI;YAC5B,mBAAmB,EAAE,CAAC,CAAC,SAAS;YAChC,0BAA0B,EACxB,uDAAuD,CAAC,CAAC,SAAS,uBAAuB;gBACzF,6FAA6F;gBAC7F,yEAAyE,GAAG,SAAS,CAAC,MAAM,CAAC;SAChG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAAC;QACrD,OAAO;YACL,gBAAgB,EAAE,KAAK;YACvB,mBAAmB,EAAE,CAAC,CAAC,OAAO;YAC9B,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EACxB,sCAAsC,IAAI,eAAe,CAAC,CAAC,OAAO,2BAA2B;gBAC7F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,wFAAwF;gBACxF,yEAAyE,GAAG,SAAS,CAAC,MAAM,CAAC;SAChG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,CAAC;IACjD,OAAO;QACL,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,CAAC,CAAC,OAAO;QAC9B,yBAAyB,EAAE,IAAI;QAC/B,0BAA0B,EACxB,sCAAsC,CAAC,CAAC,OAAO,KAAK,IAAI,kCAAkC;YAC1F,6FAA6F;YAC7F,yFAAyF;YACzF,6FAA6F;YAC7F,8FAA8F;YAC9F,uDAAuD,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,iBAAiB;YAC/F,6FAA6F;YAC7F,4FAA4F;KAC/F,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAI1C;IACC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACrD,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,OAAO,GAAqB,EAAE;QAC5B,MAAM,CAAC,GAAG,wBAAwB,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GACP,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YAC/C,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE;gBAC9F,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAE9B,IAAI,GAAG,KAAK,YAAY;YAAE,OAAO,CAAC,CAAC;QACnC,YAAY,GAAG,GAAG,CAAC;QAEnB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACnD,SAAS,EAAE,CAAC,CAAC,OAAO;gBACpB,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC;gBACnD,MAAM,EACJ,0FAA0F;oBAC1F,wFAAwF;oBACxF,oFAAoF;oBACpF,oDAAoD;gBACtD,QAAQ,EACN,2FAA2F;oBAC3F,wFAAwF;oBACxF,yFAAyF;oBACzF,yBAAyB;aAC5B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,SAAS,EAAE,CAAC,CAAC,OAAO;gBACpB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,GAAG,MAAM,CAAC;gBACtD,MAAM,EAAE,8FAA8F;gBACtG,QAAQ,EAAE,2EAA2E;aACtF,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EACJ,uFAAuF;oBACvF,yFAAyF;gBAC3F,QAAQ,EAAE,8FAA8F;aACzG,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBACzD,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,gFAAgF;gBACxF,QAAQ,EAAE,8DAA8D;aACzE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC"}

package/dist/manifest-version-store-db.d.ts

@@ -0,0 +1,24 @@
+/**
+ * CELLO-M7-PERSIST-002 (AC-008): DB-backed IManifestVersionStore.
+ *
+ * The last-seen manifest version (which backs the anti-rollback monotonicity invariant across daemon
+ * restarts) lives in the `manifest_state` singleton row of the SQLCipher-encrypted daemon DB — not a
+ * plaintext `manifest-version.json` file. Same interface as the old FileManifestVersionStore, so the
+ * SignalingManager that consumes it is unchanged.
+ *
+ * Crypto reference: RFC 8032 context — the version number is not itself cryptographic, but its
+ * correct, durable persistence is load-bearing for anti-rollback security (a reset enables a manifest
+ * downgrade attack). Whole-DB SQLCipher now protects it at rest along with all other client state.
+ */
+import type { IManifestVersionStore } from "@cello-protocol/transport";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+/** Idempotent schema for the singleton manifest-version row. */
+export declare function ensureManifestSchema(db: DaemonDatabase): void;
+export declare class DbManifestVersionStore implements IManifestVersionStore {
+    #private;
+    constructor(db: DaemonDatabase, logger: Logger);
+    getLastSeenVersion(): Promise<number | null>;
+    persistVersion(version: number): Promise<void>;
+}
+//# sourceMappingURL=manifest-version-store-db.d.ts.map

package/dist/manifest-version-store-db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-version-store-db.d.ts","sourceRoot":"","sources":["../src/manifest-version-store-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAQ7D;AAED,qBAAa,sBAAuB,YAAW,qBAAqB;;gBAItD,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAMxC,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAO5C,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBrD"}

package/dist/manifest-version-store-db.js

@@ -0,0 +1,58 @@
+/**
+ * CELLO-M7-PERSIST-002 (AC-008): DB-backed IManifestVersionStore.
+ *
+ * The last-seen manifest version (which backs the anti-rollback monotonicity invariant across daemon
+ * restarts) lives in the `manifest_state` singleton row of the SQLCipher-encrypted daemon DB — not a
+ * plaintext `manifest-version.json` file. Same interface as the old FileManifestVersionStore, so the
+ * SignalingManager that consumes it is unchanged.
+ *
+ * Crypto reference: RFC 8032 context — the version number is not itself cryptographic, but its
+ * correct, durable persistence is load-bearing for anti-rollback security (a reset enables a manifest
+ * downgrade attack). Whole-DB SQLCipher now protects it at rest along with all other client state.
+ */
+import { extractErrorMessage } from "./error-message.js";
+/** Idempotent schema for the singleton manifest-version row. */
+export function ensureManifestSchema(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS manifest_state (
+      id                INTEGER PRIMARY KEY CHECK (id = 1),
+      last_seen_version INTEGER,
+      updated_at        INTEGER NOT NULL
+    )
+  `);
+}
+export class DbManifestVersionStore {
+    #db;
+    #logger;
+    constructor(db, logger) {
+        this.#db = db;
+        this.#logger = logger;
+        ensureManifestSchema(db);
+    }
+    async getLastSeenVersion() {
+        const row = this.#db
+            .prepare("SELECT last_seen_version FROM manifest_state WHERE id = 1")
+            .get();
+        return row && row.last_seen_version != null ? Number(row.last_seen_version) : null;
+    }
+    async persistVersion(version) {
+        // Upsert the singleton row. Atomic within the encrypted DB — no temp-file rename dance.
+        try {
+            this.#db
+                .prepare(`INSERT INTO manifest_state (id, last_seen_version, updated_at)
+           VALUES (1, ?, ?)
+           ON CONFLICT(id) DO UPDATE SET last_seen_version = excluded.last_seen_version, updated_at = excluded.updated_at`)
+                .run(version, Date.now());
+        }
+        catch (err) {
+            // AC-012: a distinct, actionable failure — never a silent no-op (a lost anti-rollback version
+            // would re-open a manifest-downgrade window).
+            this.#logger.error("persist.manifest.persist.failed", { version, error: extractErrorMessage(err) });
+            const e = new Error(`manifest_persist_failed: ${extractErrorMessage(err)}`);
+            e.code = "manifest_persist_failed";
+            throw e;
+        }
+        this.#logger.info("persist.manifest.version.persisted", { version });
+    }
+}
+//# sourceMappingURL=manifest-version-store-db.js.map

package/dist/manifest-version-store-db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-version-store-db.js","sourceRoot":"","sources":["../src/manifest-version-store-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,EAAkB;IACrD,EAAE,CAAC,IAAI,CAAC;;;;;;GAMP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,sBAAsB;IACxB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,2DAA2D,CAAC;aACpE,GAAG,EAAsD,CAAC;QAC7D,OAAO,GAAG,IAAI,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,wFAAwF;QACxF,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;0HAEgH,CACjH;iBACA,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,8FAA8F;YAC9F,8CAA8C;YAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpG,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,4BAA4B,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3E,CAA+B,CAAC,IAAI,GAAG,yBAAyB,CAAC;YAClE,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/manifest-version-store.d.ts

@@ -0,0 +1,16 @@
+/**
+ * M7-MANIFEST-002 — Manifest version store re-exports.
+ *
+ * IManifestVersionStore persists the last-seen manifest version number to enforce
+ * version monotonicity across daemon restarts. A manifest with a lower version
+ * number than the last-seen version is rejected as a potential rollback attack.
+ *
+ * InMemoryManifestVersionStore: stub for tests and initial deployments.
+ * DbManifestVersionStore (manifest-version-store-db.ts): the production store — the version lives in
+ * the SQLCipher-encrypted manifest_state table (PERSIST-002 AC-008). The old file-backed store was
+ * removed.
+ */
+import type { IManifestVersionStore } from "@cello-protocol/transport";
+export { InMemoryManifestVersionStore } from "@cello-protocol/transport";
+export type { IManifestVersionStore };
+//# sourceMappingURL=manifest-version-store.d.ts.map

package/dist/manifest-version-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-version-store.d.ts","sourceRoot":"","sources":["../src/manifest-version-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEzE,YAAY,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/manifest-version-store.js

@@ -0,0 +1,15 @@
+/**
+ * M7-MANIFEST-002 — Manifest version store re-exports.
+ *
+ * IManifestVersionStore persists the last-seen manifest version number to enforce
+ * version monotonicity across daemon restarts. A manifest with a lower version
+ * number than the last-seen version is rejected as a potential rollback attack.
+ *
+ * InMemoryManifestVersionStore: stub for tests and initial deployments.
+ * DbManifestVersionStore (manifest-version-store-db.ts): the production store — the version lives in
+ * the SQLCipher-encrypted manifest_state table (PERSIST-002 AC-008). The old file-backed store was
+ * removed.
+ */
+// Re-export from transport stubs for convenience
+export { InMemoryManifestVersionStore } from "@cello-protocol/transport";
+//# sourceMappingURL=manifest-version-store.js.map

package/dist/manifest-version-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-version-store.js","sourceRoot":"","sources":["../src/manifest-version-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,iDAAiD;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC"}