@cello-protocol/daemon 0.0.3 → 0.0.5

package/dist/registration-context.js

@@ -0,0 +1,118 @@
+/**
+ * DaemonRegistrationContext — CELLO-M7-REGISTRATION (Action 2, step c part 2).
+ *
+ * Implements the RegistrationManager's RegistrationContext seam against daemon
+ * internals. The one non-trivial piece is the signaling bridge: the client wrote
+ * directly to a raw persistent libp2p Stream and ran its own read loop; the
+ * daemon's directory signaling lives behind SignalingManager. So this context:
+ *   - sends frames via SignalingManager.sendRaw (which CBOR/length-prefix-encodes),
+ *   - registers ONE inbound handler that routes the registration reply frames
+ *     (dkg_ready / register_success / register_error) to whichever pending
+ *     resolver RegistrationManager.register() has currently armed.
+ *
+ * register() drives the two stages strictly sequentially (await dkg_ready, then
+ * await register_success), so at most one resolver is armed at any moment — which
+ * is why a bare register_error can be routed to "whichever stage is waiting".
+ */
+const REGISTRATION_REPLY_TYPES = new Set(["dkg_ready", "register_success", "register_error"]);
+export class DaemonRegistrationContext {
+    keyProvider;
+    logger;
+    persistence;
+    mlDsaKeyFile;
+    #signaling;
+    #getDirectoryNode;
+    #getDirectoryEndpoint;
+    #unregisterInbound;
+    #myPubkeyHex = null;
+    #thresholdSigner = undefined;
+    #myPrimaryPubkey = null;
+    #pendingDkgReady = null;
+    #pendingRegister = null;
+    constructor(opts) {
+        this.#signaling = opts.signaling;
+        this.#getDirectoryNode = opts.getDirectoryNode;
+        this.#getDirectoryEndpoint = opts.getDirectoryEndpoint;
+        this.keyProvider = opts.keyProvider;
+        this.persistence = opts.persistence;
+        this.logger = opts.logger;
+        this.mlDsaKeyFile = opts.mlDsaKeyFile;
+        this.#unregisterInbound = this.#signaling.registerInboundHandler((frame) => this.#onInbound(frame));
+    }
+    // ─── Node + identity ────────────────────────────────────────────────────────
+    getNode() {
+        return this.#getDirectoryNode();
+    }
+    getMyPubkeyHex() {
+        return this.#myPubkeyHex;
+    }
+    setMyPubkeyHex(hex) {
+        this.#myPubkeyHex = hex;
+    }
+    getDirectoryEndpoint() {
+        return this.#getDirectoryEndpoint();
+    }
+    getThresholdSigner() {
+        return this.#thresholdSigner;
+    }
+    setThresholdSigner(signer) {
+        this.#thresholdSigner = signer;
+    }
+    getMyPrimaryPubkey() {
+        return this.#myPrimaryPubkey;
+    }
+    setMyPrimaryPubkey(pubkey) {
+        this.#myPrimaryPubkey = pubkey;
+    }
+    // ─── Signaling seam ──────────────────────────────────────────────────────────
+    isSignalingConnected() {
+        return this.#signaling.status === "connected";
+    }
+    async sendSignalingFrame(frame) {
+        return this.#signaling.sendRaw(frame);
+    }
+    setPendingDkgReadyResolve(resolve) {
+        this.#pendingDkgReady = resolve;
+    }
+    setPendingRegisterResolve(resolve) {
+        this.#pendingRegister = resolve;
+    }
+    /** Stop routing inbound frames (call when the owning agent is torn down). */
+    dispose() {
+        this.#unregisterInbound();
+        this.#pendingDkgReady = null;
+        this.#pendingRegister = null;
+    }
+    // ─── Inbound routing ──────────────────────────────────────────────────────────
+    #onInbound(frame) {
+        const type = frame["type"];
+        if (typeof type !== "string" || !REGISTRATION_REPLY_TYPES.has(type)) {
+            return; // not a registration reply — leave it for other inbound handlers
+        }
+        if (type === "dkg_ready") {
+            const resolve = this.#pendingDkgReady;
+            this.#pendingDkgReady = null;
+            resolve?.(frame);
+            return;
+        }
+        if (type === "register_success") {
+            const resolve = this.#pendingRegister;
+            this.#pendingRegister = null;
+            resolve?.(frame);
+            return;
+        }
+        // register_error → deliver to whichever stage is currently waiting.
+        // Stages are sequential, so at most one resolver is armed.
+        if (this.#pendingDkgReady) {
+            const resolve = this.#pendingDkgReady;
+            this.#pendingDkgReady = null;
+            resolve(frame);
+        }
+        else if (this.#pendingRegister) {
+            const resolve = this.#pendingRegister;
+            this.#pendingRegister = null;
+            resolve(frame);
+        }
+    }
+}
+//# sourceMappingURL=registration-context.js.map

package/dist/registration-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-context.js","sourceRoot":"","sources":["../src/registration-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAoBH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE9F,MAAM,OAAO,yBAAyB;IAC3B,WAAW,CAAc;IACzB,MAAM,CAAS;IACf,WAAW,CAAuC;IAClD,YAAY,CAAqB;IAEjC,UAAU,CAAgB;IAC1B,iBAAiB,CAAyB;IAC1C,qBAAqB,CAAyD;IAC9E,kBAAkB,CAAa;IAExC,YAAY,GAAkB,IAAI,CAAC;IACnC,gBAAgB,GAAiC,SAAS,CAAC;IAC3D,gBAAgB,GAAsB,IAAI,CAAC;IAC3C,gBAAgB,GAAsD,IAAI,CAAC;IAC3E,gBAAgB,GAAsD,IAAI,CAAC;IAE3E,YAAY,IAQX;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC/C,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACvD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,+EAA+E;IAE/E,OAAO;QACL,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,cAAc,CAAC,GAAW;QACxB,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;IAC1B,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC;IACtC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,kBAAkB,CAAC,MAAwB;QACzC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;IACjC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,kBAAkB,CAAC,MAAkB;QACnC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;IACjC,CAAC;IAED,gFAAgF;IAEhF,oBAAoB;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAA8B;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,yBAAyB,CAAC,OAA0D;QAClF,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,yBAAyB,CAAC,OAA0D;QAClF,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,OAAO;QACL,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,iFAAiF;IAEjF,UAAU,CAAC,KAA8B;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,iEAAiE;QAC3E,CAAC;QAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACtC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACtC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,2DAA2D;QAC3D,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACtC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACtC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;CACF"}

package/dist/registration-manager.d.ts

@@ -0,0 +1,72 @@
+/**
+ * RegistrationManager — REG-001, ML-DSA keygen, DKG (daemon port).
+ *
+ * Ported from cello-client's RegistrationManager. Owns registration domain
+ * state (#registrationState, #mlDsaProvider). The only adaptation vs the client
+ * is the signaling seam: the client wrote directly to a raw persistent libp2p
+ * Stream, whereas the daemon's directory signaling lives behind SignalingManager.
+ * So RegistrationContext exposes `sendSignalingFrame` (→ SignalingManager.sendRaw,
+ * which CBOR/length-prefix-encodes internally) and `isSignalingConnected`, and a
+ * single daemon-owned inbound handler drives the pending dkg_ready/register
+ * resolvers (see DaemonRegistrationContext). The register() control flow is
+ * otherwise unchanged.
+ */
+import type { IThresholdSigner, MlDsaKeyProvider } from "@cello-protocol/crypto";
+import type { RegistrationState } from "@cello-protocol/protocol-types";
+import type { DaemonRegistrationPersistence } from "./registration-persistence.js";
+import type { Logger } from "./types.js";
+import type { CelloNode } from "@cello-protocol/transport";
+import type { KeyProvider } from "@cello-protocol/crypto";
+/** Result of attempting to send a frame over the daemon's directory signaling stream. */
+export interface SignalingSendResult {
+    ok: boolean;
+    reason?: string;
+}
+/**
+ * Narrow interface exposing only what RegistrationManager needs from the daemon.
+ * This avoids importing daemon internals and prevents circular dependencies.
+ */
+export interface RegistrationContext {
+    readonly keyProvider: KeyProvider;
+    readonly logger: Logger;
+    readonly persistence: DaemonRegistrationPersistence | null;
+    readonly mlDsaKeyFile: string | undefined;
+    /**
+     * The live directory-facing libp2p node FROST DKG opens streams on. May be
+     * null even when signaling reads connected (brief stream-death window) — the
+     * caller MUST null-check before constructing a NetworkDirectoryNode.
+     */
+    getNode(): CelloNode | null;
+    getMyPubkeyHex(): string | null;
+    setMyPubkeyHex(hex: string): void;
+    getDirectoryEndpoint(): {
+        peer_id: string;
+        multiaddrs: string[];
+    } | null;
+    getThresholdSigner(): IThresholdSigner | undefined;
+    setThresholdSigner(signer: IThresholdSigner): void;
+    getMyPrimaryPubkey(): Uint8Array | null;
+    setMyPrimaryPubkey(pubkey: Uint8Array): void;
+    /** True when the directory signaling stream is connected and a send can be attempted. */
+    isSignalingConnected(): boolean;
+    /** Send a frame object over directory signaling (SignalingManager encodes it). */
+    sendSignalingFrame(frame: Record<string, unknown>): Promise<SignalingSendResult>;
+    setPendingDkgReadyResolve(resolve: ((frame: Record<string, unknown>) => void) | null): void;
+    setPendingRegisterResolve(resolve: ((frame: Record<string, unknown>) => void) | null): void;
+}
+export declare class RegistrationManager {
+    #private;
+    constructor(ctx: RegistrationContext);
+    getRegistrationState(): RegistrationState | null;
+    setRegistrationState(state: RegistrationState | null): void;
+    getMlDsaProvider(): MlDsaKeyProvider | null;
+    setMlDsaProvider(provider: MlDsaKeyProvider | null): void;
+    /**
+     * Register this agent with the directory.
+     * REG-001: ML-DSA keygen → signaling stream → register_request → DKG → register_success.
+     */
+    register(phoneStub?: string, preAuthToken?: string): Promise<RegistrationState | {
+        error: string;
+    }>;
+}
+//# sourceMappingURL=registration-manager.d.ts.map

package/dist/registration-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-manager.d.ts","sourceRoot":"","sources":["../src/registration-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAMxE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,OAAO,IAAI,SAAS,GAAG,IAAI,CAAC;IAC5B,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,kBAAkB,IAAI,gBAAgB,GAAG,SAAS,CAAC;IACnD,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnD,kBAAkB,IAAI,UAAU,GAAG,IAAI,CAAC;IACxC,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7C,yFAAyF;IACzF,oBAAoB,IAAI,OAAO,CAAC;IAChC,kFAAkF;IAClF,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjF,yBAAyB,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5F,yBAAyB,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;CAC7F;AAED,qBAAa,mBAAmB;;gBAOlB,GAAG,EAAE,mBAAmB;IAMpC,oBAAoB,IAAI,iBAAiB,GAAG,IAAI;IAIhD,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI;IAI3D,gBAAgB,IAAI,gBAAgB,GAAG,IAAI;IAI3C,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI;IAIzD;;;OAGG;IACG,QAAQ,CAAC,SAAS,GAAE,MAAW,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA0O9G"}

package/dist/registration-manager.js

@@ -0,0 +1,267 @@
+/**
+ * RegistrationManager — REG-001, ML-DSA keygen, DKG (daemon port).
+ *
+ * Ported from cello-client's RegistrationManager. Owns registration domain
+ * state (#registrationState, #mlDsaProvider). The only adaptation vs the client
+ * is the signaling seam: the client wrote directly to a raw persistent libp2p
+ * Stream, whereas the daemon's directory signaling lives behind SignalingManager.
+ * So RegistrationContext exposes `sendSignalingFrame` (→ SignalingManager.sendRaw,
+ * which CBOR/length-prefix-encodes internally) and `isSignalingConnected`, and a
+ * single daemon-owned inbound handler drives the pending dkg_ready/register
+ * resolvers (see DaemonRegistrationContext). The register() control flow is
+ * otherwise unchanged.
+ */
+import { Encoder } from "cbor-x";
+import { mlDsaKeygen, mlDsaKeygenWithBytes, FileMlDsaKeyProvider } from "@cello-protocol/crypto";
+import { NetworkDirectoryNode, runNetworkDkg } from "./network-directory-node.js";
+// CBOR encoder for serializing FROST commitments/verifyingShares before
+// persistence (not signaling frames — those go through SignalingManager).
+const CBOR_ENC = new Encoder({ tagUint8Array: false });
+export class RegistrationManager {
+    #ctx;
+    // Registration state owned by this manager
+    #registrationState = null;
+    #mlDsaProvider = null;
+    constructor(ctx) {
+        this.#ctx = ctx;
+    }
+    // ─── Public state accessors ──────────────────────────────────────────────────
+    getRegistrationState() {
+        return this.#registrationState;
+    }
+    setRegistrationState(state) {
+        this.#registrationState = state;
+    }
+    getMlDsaProvider() {
+        return this.#mlDsaProvider;
+    }
+    setMlDsaProvider(provider) {
+        this.#mlDsaProvider = provider;
+    }
+    /**
+     * Register this agent with the directory.
+     * REG-001: ML-DSA keygen → signaling stream → register_request → DKG → register_success.
+     */
+    async register(phoneStub = "", preAuthToken) {
+        // Step 1: already registered
+        if (this.#registrationState) {
+            return { error: "already_registered" };
+        }
+        // Step 2: generate or load ML-DSA-44 keypair
+        let mlDsaProvider;
+        let mlDsaSecretKeyBlob = null;
+        if (this.#ctx.mlDsaKeyFile) {
+            mlDsaProvider = await FileMlDsaKeyProvider.load(this.#ctx.mlDsaKeyFile);
+        }
+        else if (this.#ctx.persistence) {
+            const { provider, secretKeyBlob } = await mlDsaKeygenWithBytes();
+            mlDsaProvider = provider;
+            mlDsaSecretKeyBlob = secretKeyBlob;
+        }
+        else {
+            mlDsaProvider = await mlDsaKeygen();
+        }
+        const mlDsaPubkey = await mlDsaProvider.getPublicKey();
+        const mlDsaPubkeyHex = Buffer.from(mlDsaPubkey).toString("hex");
+        // Step 3: require the directory signaling stream to be connected.
+        // (The daemon keeps it connected via SignalingManager; we don't open it here.)
+        if (!this.#ctx.isSignalingConnected()) {
+            return { error: "directory_unreachable" };
+        }
+        // Step 4: get K_local pubkey hex
+        if (!this.#ctx.getMyPubkeyHex()) {
+            const pubkey = await this.#ctx.keyProvider.getPublicKey();
+            this.#ctx.setMyPubkeyHex(Buffer.from(pubkey).toString("hex"));
+        }
+        const kLocalPubkeyHex = this.#ctx.getMyPubkeyHex();
+        // Step 5: send register_request (SignalingManager CBOR/lp-encodes the frame)
+        const regSent = await this.#ctx.sendSignalingFrame({
+            type: "register_request",
+            phone_stub: phoneStub,
+            k_local_pubkey: kLocalPubkeyHex,
+            ml_dsa_pubkey: mlDsaPubkeyHex,
+        });
+        if (!regSent.ok) {
+            return { error: regSent.reason ?? "directory_unreachable" };
+        }
+        // Step 5a: await dkg_ready
+        const DKG_READY_TIMEOUT_MS = 15_000;
+        let dkgReadyTimeoutHandle;
+        const dkgReadyFrame = await Promise.race([
+            new Promise((resolve) => {
+                this.#ctx.setPendingDkgReadyResolve(resolve);
+            }),
+            new Promise((resolve) => {
+                dkgReadyTimeoutHandle = setTimeout(() => {
+                    this.#ctx.setPendingDkgReadyResolve(null);
+                    resolve({ type: "register_error", reason: "timeout" });
+                }, DKG_READY_TIMEOUT_MS);
+            }),
+        ]);
+        clearTimeout(dkgReadyTimeoutHandle);
+        if (dkgReadyFrame["type"] !== "dkg_ready") {
+            const reason = dkgReadyFrame["reason"] ?? "unknown";
+            if (reason === "already_registered" &&
+                dkgReadyFrame["agent_id"] &&
+                dkgReadyFrame["primary_pubkey"]) {
+                const state = {
+                    agent_id: dkgReadyFrame["agent_id"],
+                    primary_pubkey: dkgReadyFrame["primary_pubkey"],
+                    ml_dsa_pubkey: dkgReadyFrame["ml_dsa_pubkey"] ?? mlDsaPubkeyHex,
+                    registered_at: Date.now(),
+                    status: "active",
+                };
+                this.#registrationState = state;
+                this.#mlDsaProvider = mlDsaProvider;
+                if (this.#ctx.persistence && mlDsaSecretKeyBlob) {
+                    void this.#ctx.persistence.persistMlDsaKeypair({
+                        mlDsaPubkey: mlDsaPubkeyHex,
+                        secretKeyBlob: mlDsaSecretKeyBlob,
+                    });
+                    void this.#ctx.persistence.persistRegistrationState({
+                        agentId: state.agent_id,
+                        primaryPubkey: state.primary_pubkey,
+                        mlDsaPubkey: state.ml_dsa_pubkey,
+                        registeredAt: state.registered_at,
+                    });
+                }
+                return state;
+            }
+            return { error: reason };
+        }
+        // Step 5b: run real FROST DKG
+        const epochId = dkgReadyFrame["epochId"];
+        const participants = dkgReadyFrame["participants"];
+        const threshold = dkgReadyFrame["threshold"];
+        const directoryEndpoint = this.#ctx.getDirectoryEndpoint();
+        if (!directoryEndpoint) {
+            return { error: "directory_unreachable" };
+        }
+        // getNode() may be null even when signaling reads connected (brief
+        // stream-death window) — null-check before FROST DKG opens streams on it.
+        const dkgNode = this.#ctx.getNode();
+        if (!dkgNode) {
+            return { error: "directory_unreachable" };
+        }
+        const dirNode = new NetworkDirectoryNode({
+            id: directoryEndpoint.peer_id,
+            node: dkgNode,
+            directoryPeerId: directoryEndpoint.peer_id,
+            directoryMultiaddrs: directoryEndpoint.multiaddrs,
+            logger: this.#ctx.logger,
+        });
+        void epochId;
+        const kLocalPubkeyBytes = Buffer.from(kLocalPubkeyHex, "hex");
+        let dkgPrimaryPubkeyHex;
+        try {
+            const dkgResult = await runNetworkDkg(kLocalPubkeyBytes, {
+                threshold,
+                participants,
+                directoryNodes: [dirNode],
+                preAuthToken,
+            });
+            dkgPrimaryPubkeyHex = Buffer.from(dkgResult.primaryPubkey).toString("hex");
+            this.#ctx.setThresholdSigner(dkgResult.signer);
+            this.#ctx.setMyPrimaryPubkey(new Uint8Array(dkgResult.primaryPubkey));
+            if (this.#ctx.persistence) {
+                const commitmentsCbor = CBOR_ENC.encode(dkgResult.commitments);
+                const verifyingSharesCbor = CBOR_ENC.encode(dkgResult.verifyingShares);
+                void this.#ctx.persistence.persistFrostKeyShare({
+                    epochId,
+                    primaryPubkey: dkgPrimaryPubkeyHex,
+                    identifier: dkgResult.identifier,
+                    signingShare: dkgResult.signingShare,
+                    threshold: dkgResult.threshold,
+                    participants: dkgResult.participants,
+                    commitmentsCbor,
+                    verifyingSharesCbor,
+                    dkgMethod: "network_dkg",
+                });
+            }
+        }
+        catch {
+            return { error: "dkg_failed" };
+        }
+        // Step 5c: send dkg_complete (SignalingManager CBOR/lp-encodes the frame)
+        const dkgSent = await this.#ctx.sendSignalingFrame({
+            type: "dkg_complete",
+            primary_pubkey: dkgPrimaryPubkeyHex,
+        });
+        if (!dkgSent.ok) {
+            return { error: dkgSent.reason ?? "directory_unreachable" };
+        }
+        // Step 6: await register_success or register_error
+        const REGISTER_TIMEOUT_MS = 15_000;
+        let timeoutHandle;
+        const responseWithTimeout = await Promise.race([
+            new Promise((resolve) => {
+                this.#ctx.setPendingRegisterResolve(resolve);
+            }),
+            new Promise((resolve) => {
+                timeoutHandle = setTimeout(() => {
+                    this.#ctx.setPendingRegisterResolve(null);
+                    resolve({ type: "register_error", reason: "timeout" });
+                }, REGISTER_TIMEOUT_MS);
+            }),
+        ]);
+        clearTimeout(timeoutHandle);
+        if (responseWithTimeout["type"] !== "register_success") {
+            const reason = responseWithTimeout["reason"] ?? "unknown";
+            if (reason === "already_registered" &&
+                responseWithTimeout["agent_id"] &&
+                responseWithTimeout["primary_pubkey"]) {
+                const state = {
+                    agent_id: responseWithTimeout["agent_id"],
+                    primary_pubkey: responseWithTimeout["primary_pubkey"],
+                    ml_dsa_pubkey: responseWithTimeout["ml_dsa_pubkey"] ?? mlDsaPubkeyHex,
+                    registered_at: Date.now(),
+                    status: "active",
+                };
+                this.#registrationState = state;
+                this.#mlDsaProvider = mlDsaProvider;
+                if (this.#ctx.persistence && mlDsaSecretKeyBlob) {
+                    void this.#ctx.persistence.persistMlDsaKeypair({
+                        mlDsaPubkey: mlDsaPubkeyHex,
+                        secretKeyBlob: mlDsaSecretKeyBlob,
+                    });
+                    void this.#ctx.persistence.persistRegistrationState({
+                        agentId: state.agent_id,
+                        primaryPubkey: state.primary_pubkey,
+                        mlDsaPubkey: state.ml_dsa_pubkey,
+                        registeredAt: state.registered_at,
+                    });
+                }
+                return state;
+            }
+            return { error: reason };
+        }
+        // Step 7: build RegistrationState and cache
+        const agentId = responseWithTimeout["agent_id"];
+        const primaryPubkey = responseWithTimeout["primary_pubkey"];
+        const state = {
+            agent_id: agentId,
+            primary_pubkey: primaryPubkey,
+            ml_dsa_pubkey: mlDsaPubkeyHex,
+            registered_at: Date.now(),
+            status: "active",
+        };
+        this.#registrationState = state;
+        this.#mlDsaProvider = mlDsaProvider;
+        if (this.#ctx.persistence && mlDsaSecretKeyBlob) {
+            void this.#ctx.persistence.persistMlDsaKeypair({
+                mlDsaPubkey: mlDsaPubkeyHex,
+                secretKeyBlob: mlDsaSecretKeyBlob,
+            });
+        }
+        if (this.#ctx.persistence) {
+            void this.#ctx.persistence.persistRegistrationState({
+                agentId: state.agent_id,
+                primaryPubkey: state.primary_pubkey,
+                mlDsaPubkey: state.ml_dsa_pubkey,
+                registeredAt: state.registered_at,
+            });
+        }
+        return state;
+    }
+}
+//# sourceMappingURL=registration-manager.js.map

package/dist/registration-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-manager.js","sourceRoot":"","sources":["../src/registration-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGjG,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAElF,wEAAwE;AACxE,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;AA0CvD,MAAM,OAAO,mBAAmB;IACrB,IAAI,CAAsB;IAEnC,2CAA2C;IAC3C,kBAAkB,GAA6B,IAAI,CAAC;IACpD,cAAc,GAA4B,IAAI,CAAC;IAE/C,YAAY,GAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,gFAAgF;IAEhF,oBAAoB;QAClB,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,oBAAoB,CAAC,KAA+B;QAClD,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,gBAAgB,CAAC,QAAiC;QAChD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,YAAoB,EAAE,EAAE,YAAqB;QAC1D,6BAA6B;QAC7B,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,6CAA6C;QAC7C,IAAI,aAA+B,CAAC;QACpC,IAAI,kBAAkB,GAAsB,IAAI,CAAC;QACjD,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,aAAa,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;YACjE,aAAa,GAAG,QAAQ,CAAC;YACzB,kBAAkB,GAAG,aAAa,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,WAAW,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEhE,kEAAkE;QAClE,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAG,CAAC;QAEpD,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC;YACjD,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC9D,CAAC;QAED,2BAA2B;QAC3B,MAAM,oBAAoB,GAAG,MAAM,CAAC;QACpC,IAAI,qBAAgE,CAAC;QACrE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,IAAI,CAA0B;YAChE,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,EAAE;gBAC/C,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC,CAAC;YACF,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,EAAE;gBAC/C,qBAAqB,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;oBAC1C,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAC3B,CAAC,CAAC;SACH,CAAC,CAAC;QACH,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAEpC,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,WAAW,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAI,aAAa,CAAC,QAAQ,CAAwB,IAAI,SAAS,CAAC;YAC5E,IACE,MAAM,KAAK,oBAAoB;gBAC/B,aAAa,CAAC,UAAU,CAAC;gBACzB,aAAa,CAAC,gBAAgB,CAAC,EAC/B,CAAC;gBACD,MAAM,KAAK,GAAsB;oBAC/B,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAW;oBAC7C,cAAc,EAAE,aAAa,CAAC,gBAAgB,CAAW;oBACzD,aAAa,EAAG,aAAa,CAAC,eAAe,CAAwB,IAAI,cAAc;oBACvF,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,QAAQ;iBACjB,CAAC;gBACF,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;gBAChC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;oBAChD,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC;wBAC7C,WAAW,EAAE,cAAc;wBAC3B,aAAa,EAAE,kBAAkB;qBAClC,CAAC,CAAC;oBACH,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;wBAClD,OAAO,EAAE,KAAK,CAAC,QAAQ;wBACvB,aAAa,EAAE,KAAK,CAAC,cAAc;wBACnC,WAAW,EAAE,KAAK,CAAC,aAAa;wBAChC,YAAY,EAAE,KAAK,CAAC,aAAa;qBAClC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,8BAA8B;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAW,CAAC;QACnD,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,CAAW,CAAC;QAC7D,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAW,CAAC;QACvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QACD,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC;YACvC,EAAE,EAAE,iBAAiB,CAAC,OAAO;YAC7B,IAAI,EAAE,OAAO;YACb,eAAe,EAAE,iBAAiB,CAAC,OAAO;YAC1C,mBAAmB,EAAE,iBAAiB,CAAC,UAAU;YACjD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,KAAK,OAAO,CAAC;QACb,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,mBAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,iBAAiB,EAAE;gBACvD,SAAS;gBACT,YAAY;gBACZ,cAAc,EAAE,CAAC,OAAO,CAAC;gBACzB,YAAY;aACb,CAAC,CAAC;YACH,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1B,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAe,CAAC;gBAC7E,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAe,CAAC;gBACrF,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC;oBAC9C,OAAO;oBACP,aAAa,EAAE,mBAAmB;oBAClC,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,YAAY,EAAE,SAAS,CAAC,YAAY;oBACpC,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;oBACpC,eAAe;oBACf,mBAAmB;oBACnB,SAAS,EAAE,aAAa;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACjC,CAAC;QAED,0EAA0E;QAC1E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC;YACjD,IAAI,EAAE,cAAc;YACpB,cAAc,EAAE,mBAAmB;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC9D,CAAC;QAED,mDAAmD;QACnD,MAAM,mBAAmB,GAAG,MAAM,CAAC;QACnC,IAAI,aAAwD,CAAC;QAC7D,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,IAAI,CAA0B;YACtE,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,EAAE;gBAC/C,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC,CAAC;YACF,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,EAAE;gBAC/C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;oBAC1C,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC1B,CAAC,CAAC;SACH,CAAC,CAAC;QACH,YAAY,CAAC,aAAa,CAAC,CAAC;QAE5B,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACvD,MAAM,MAAM,GAAI,mBAAmB,CAAC,QAAQ,CAAwB,IAAI,SAAS,CAAC;YAClF,IACE,MAAM,KAAK,oBAAoB;gBAC/B,mBAAmB,CAAC,UAAU,CAAC;gBAC/B,mBAAmB,CAAC,gBAAgB,CAAC,EACrC,CAAC;gBACD,MAAM,KAAK,GAAsB;oBAC/B,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAW;oBACnD,cAAc,EAAE,mBAAmB,CAAC,gBAAgB,CAAW;oBAC/D,aAAa,EAAG,mBAAmB,CAAC,eAAe,CAAwB,IAAI,cAAc;oBAC7F,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,QAAQ;iBACjB,CAAC;gBACF,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;gBAChC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;oBAChD,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC;wBAC7C,WAAW,EAAE,cAAc;wBAC3B,aAAa,EAAE,kBAAkB;qBAClC,CAAC,CAAC;oBACH,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;wBAClD,OAAO,EAAE,KAAK,CAAC,QAAQ;wBACvB,aAAa,EAAE,KAAK,CAAC,cAAc;wBACnC,WAAW,EAAE,KAAK,CAAC,aAAa;wBAChC,YAAY,EAAE,KAAK,CAAC,aAAa;qBAClC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,4CAA4C;QAC5C,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAW,CAAC;QAC1D,MAAM,aAAa,GAAG,mBAAmB,CAAC,gBAAgB,CAAW,CAAC;QAEtE,MAAM,KAAK,GAAsB;YAC/B,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,aAAa;YAC7B,aAAa,EAAE,cAAc;YAC7B,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,QAAQ;SACjB,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC;gBAC7C,WAAW,EAAE,cAAc;gBAC3B,aAAa,EAAE,kBAAkB;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;gBAClD,OAAO,EAAE,KAAK,CAAC,QAAQ;gBACvB,aAAa,EAAE,KAAK,CAAC,cAAc;gBACnC,WAAW,EAAE,KAAK,CAAC,aAAa;gBAChC,YAAY,EAAE,KAAK,CAAC,aAAa;aAClC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/registration-persistence.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Daemon registration persistence — CELLO-M7-REGISTRATION.
+ *
+ * The daemon owns each agent's registration material (ML-DSA keypair, FROST key
+ * share, registration state) as per-agent files under ~/.cello/agents/<name>/.
+ * This mirrors the daemon's existing `key`-file model (see agent-loader.ts) and
+ * deliberately does NOT drag the client's SQLCipher ClientStatePersistence into
+ * the daemon — that layer is keyed by agent_pubkey in one shared DB, whereas the
+ * daemon isolates each agent in its own directory (cleaner for multi-agent).
+ *
+ * Security posture: the FROST signing share and ML-DSA secret key are written
+ * with 0o600 permissions, atomically (write-to-tmp + rename), consistent with the
+ * daemon's existing plaintext K_local `key` file. Encryption-at-rest for the
+ * daemon is a separate future concern and is intentionally NOT introduced
+ * piecemeal here. The signing share (SI-001) and secret key blob (SI-002) must
+ * never appear in a log event — only the files hold them.
+ */
+import type { Logger } from "./types.js";
+export interface RegistrationStateRecord {
+    agentId: string;
+    primaryPubkey: string;
+    mlDsaPubkey: string;
+    registeredAt: number;
+    status: string;
+}
+export interface MlDsaKeypairRecord {
+    mlDsaPubkey: string;
+    secretKeyBlob: Uint8Array;
+    algorithm: string;
+}
+export interface FrostKeyShareRecord {
+    epochId: string;
+    primaryPubkey: string;
+    identifier: string;
+    signingShare: Uint8Array;
+    threshold: number;
+    participants: number;
+    commitmentsCbor: Uint8Array;
+    verifyingSharesCbor: Uint8Array;
+    dkgMethod: string;
+}
+/**
+ * The agent→user linkage captured at registration. The pre-authorization ticket
+ * (issued by the CELLO Operations Agent) binds this agent to a user; recording it
+ * here is the M7 "capture-now-or-lose-it" requirement — *using* the link (trust
+ * signals that attach to the user) is future trust-layer work.
+ */
+export interface AgentUserLinkRecord {
+    agentId: string;
+    preAuthToken: string;
+    linkedAt: number;
+}
+/**
+ * Narrow persistence seam consumed by the daemon's RegistrationManager. Exactly
+ * the three persist operations the registration flow performs, plus the matching
+ * load operations needed to rehydrate an already-registered agent on restart.
+ */
+export interface DaemonRegistrationPersistence {
+    persistMlDsaKeypair(opts: {
+        mlDsaPubkey: string;
+        secretKeyBlob: Uint8Array;
+    }): Promise<void>;
+    persistRegistrationState(opts: {
+        agentId: string;
+        primaryPubkey: string;
+        mlDsaPubkey: string;
+        registeredAt: number;
+    }): Promise<void>;
+    persistFrostKeyShare(opts: {
+        epochId: string;
+        primaryPubkey: string;
+        identifier: string;
+        signingShare: Uint8Array;
+        threshold: number;
+        participants: number;
+        commitmentsCbor: Uint8Array;
+        verifyingSharesCbor: Uint8Array;
+        dkgMethod: "trusted_dealer" | "network_dkg";
+    }): Promise<void>;
+    loadRegistrationState(): Promise<RegistrationStateRecord | null>;
+    loadMlDsaKeypair(): Promise<MlDsaKeypairRecord | null>;
+    loadActiveFrostKeyShare(): Promise<FrostKeyShareRecord | null>;
+}
+/**
+ * File-backed implementation. One instance is scoped to a single agent's
+ * directory (e.g. ~/.cello/agents/alice/). The directory is created on first
+ * write; load methods on a fresh agent return null (ENOENT is not an error).
+ */
+export declare class FileRegistrationPersistence implements DaemonRegistrationPersistence {
+    #private;
+    constructor(opts: {
+        agentDir: string;
+        logger: Logger;
+    });
+    persistMlDsaKeypair(opts: {
+        mlDsaPubkey: string;
+        secretKeyBlob: Uint8Array;
+    }): Promise<void>;
+    persistRegistrationState(opts: {
+        agentId: string;
+        primaryPubkey: string;
+        mlDsaPubkey: string;
+        registeredAt: number;
+    }): Promise<void>;
+    persistFrostKeyShare(opts: {
+        epochId: string;
+        primaryPubkey: string;
+        identifier: string;
+        signingShare: Uint8Array;
+        threshold: number;
+        participants: number;
+        commitmentsCbor: Uint8Array;
+        verifyingSharesCbor: Uint8Array;
+        dkgMethod: "trusted_dealer" | "network_dkg";
+    }): Promise<void>;
+    /**
+     * Capture the agent→user link at registration (M7 capture-now-or-lose-it). Not
+     * part of the RegistrationManager seam — called by the cello_register handler
+     * after a successful register(), since only the handler holds the pre-auth ticket.
+     */
+    persistAgentUserLink(opts: {
+        agentId: string;
+        preAuthToken: string;
+        linkedAt: number;
+    }): Promise<void>;
+    loadRegistrationState(): Promise<RegistrationStateRecord | null>;
+    loadMlDsaKeypair(): Promise<MlDsaKeypairRecord | null>;
+    loadActiveFrostKeyShare(): Promise<FrostKeyShareRecord | null>;
+    loadAgentUserLink(): Promise<AgentUserLinkRecord | null>;
+}
+//# sourceMappingURL=registration-persistence.d.ts.map

package/dist/registration-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-persistence.d.ts","sourceRoot":"","sources":["../src/registration-persistence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAIzC,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,UAAU,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,UAAU,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,mBAAmB,EAAE,UAAU,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,mBAAmB,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,wBAAwB,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,oBAAoB,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,UAAU,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,UAAU,CAAC;QAC5B,mBAAmB,EAAE,UAAU,CAAC;QAChC,SAAS,EAAE,gBAAgB,GAAG,aAAa,CAAC;KAC7C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACjE,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACvD,uBAAuB,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CAChE;AAmCD;;;;GAIG;AACH,qBAAa,2BAA4B,YAAW,6BAA6B;;gBAKnE,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAOhD,mBAAmB,CAAC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5F,wBAAwB,CAAC,IAAI,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC;IAcX,oBAAoB,CAAC,IAAI,EAAE;QAC/B,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,UAAU,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,UAAU,CAAC;QAC5B,mBAAmB,EAAE,UAAU,CAAC;QAChC,SAAS,EAAE,gBAAgB,GAAG,aAAa,CAAC;KAC7C,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBjB;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtG,qBAAqB,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAYhE,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAUtD,uBAAuB,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAgB9D,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAyE/D"}