@cello-protocol/daemon 0.0.49 → 0.0.50

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAU/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAkhM7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAKpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAU/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAuB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA6kM7E"}

package/dist/daemon.js

@@ -48,12 +48,13 @@ import { RegistrationManager } from "./registration-manager.js";
 import { DaemonRegistrationContext } from "./registration-context.js";
 import { DbRegistrationPersistence, DbIdentityStore } from "./db-identity-store.js";
 import { DbManifestVersionStore } from "./manifest-version-store-db.js";
-import { verify as ed25519Verify, sealToRecipient, generateKLocalSeed, InMemoryKeyProvider, hash as cryptoHash } from "@cello-protocol/crypto";
+import { verify as ed25519Verify, generateKLocalSeed, InMemoryKeyProvider, hash as cryptoHash } from "@cello-protocol/crypto";
 import { attemptSealUpgrade as attemptSealUpgradeImpl, verifyUpgradeConfirmedCert } from "./seal-upgrade.js";
 import { upgradeAbsentToRecovered, hasAbsentParticipant } from "./seal-receipt-upgrade.js";
 // CELLO-M7-MSG-001 (AC-013/AC-018): the single application content-size cap, enforced
 // at the send point here (the receive point lives in the transport content decode).
 import { MAX_CONTENT_BYTES, computeGenesisPrevRoot, buildAgentRevocationTbs, MONIKER_RE, validateMoniker } from "@cello-protocol/protocol-types";
+import { sealParkEnvelope } from "./park-envelope.js";
 import { resolveCelloEnv, createTransportSelector, isProductionVariant, } from "./transport-composition.js";
 import { selectAdvertisedAddress } from "./transport-selector.js";
 import { parseSessionAssignment, sessionRequestErrorReason, parseDiscoveryLookupResult, discoveryLookupErrorReason, extractOfferedMoniker, resolveOutboundMoniker } from "./session-assignment-parser.js";
@@ -1508,7 +1509,7 @@ export async function startDaemon(config) {
     // the session's relay endpoint; we seal the content to the recipient (E2E — the relay never sees
     // plaintext, INV-3) and deposit it to that relay's store-and-forward mailbox via the standing
     // receiver node. The recipient pulls + recovers it at the witnessed sequence (R1) on next online.
-    sessionNodeManager.setContentParkHook(async ({ sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor }) => {
+    sessionNodeManager.setContentParkHook(async ({ agentName, sessionId, recipientPubkeyHex, relayPeerId, relayAddrs, contentHashHex, content, structure1Cbor, structure2Cbor }) => {
         const node = sessionNodeManager.getStandingReceiverNode();
         if (!node) {
             const reason = "standing_receiver_unavailable";
@@ -1519,10 +1520,32 @@ export async function startDaemon(config) {
             // parked when nothing was ever deposited.
             return { ok: false, reason };
         }
+        // SEC-1: sign the entry as the SENDING agent. Without a key we cannot produce an envelope the
+        // recipient will accept, so fail LOUD rather than depositing something that will be refused on
+        // recovery (a deposit the recipient must reject is worse than no deposit — it looks delivered).
+        const senderKp = keyProviders.get(agentName);
+        if (!senderKp) {
+            const reason = "signing_key_unavailable";
+            logger.warn("content.park.deposit.failed", { agentName, sessionId, contentHash: contentHashHex, reason });
+            return { ok: false, reason };
+        }
         const recipientPubkey = Buffer.from(recipientPubkeyHex, "hex");
+        const contentHashBytes = Buffer.from(contentHashHex, "hex");
+        logger.info("content.park.signed", { agentName, sessionId, contentHash: contentHashHex });
         // DOD-MSG-4 (2b): seal the ORDERING ENVELOPE (content + the relay's signed Structure2), not bare
         // content, so the parked entry is self-ordering on recover. The relay still holds only ciphertext.
-        const ciphertext = sealToRecipient(recipientPubkey, sessionNodeManager.encodeParkEnvelope(content, structure1Cbor, structure2Cbor));
+        // SEC-1: sealParkEnvelope is the SOLE producer — it signs (sender's K_local, over the
+        // session/recipient/content binding) and seals in one place, so the two park sites cannot drift
+        // apart on what gets signed.
+        const ciphertext = await sealParkEnvelope({
+            signer: senderKp,
+            sessionIdHex: sessionId,
+            recipientPubkey,
+            contentHash: contentHashBytes,
+            content,
+            structure1Cbor,
+            structure2Cbor,
+        });
         const client = new ContentParkClient({ relayPeerId, relayAddrs: [...relayAddrs], logger });
         const res = await client.deposit(node, {
             recipientPubkey,
@@ -1573,11 +1596,29 @@ export async function startDaemon(config) {
         const node = sessionNodeManager.getStandingReceiverNode(record.agent_name);
         if (!node)
             return { parked: false, error: "standing_receiver_unavailable" };
+        // SEC-1: the crash backstop must sign too — an unsigned re-park would be REFUSED on recovery,
+        // which would turn the message-loss backstop into a message-loss cause. This is why the SEC-1
+        // signature binds to the sender's own K_local and NOT to the relay's ordering record: the
+        // ordering record is not persisted in retry_queue (see below) and so cannot be reproduced here,
+        // but the KEY can — the owning agent still holds it after a crash. Hence: NO schema migration.
+        const senderKp = keyProviders.get(ownerName);
+        if (!senderKp)
+            return { parked: false, error: "signing_key_unavailable" };
         const recipientPubkey = Buffer.from(record.counterparty_pubkey, "hex");
+        const contentHashBytes = Buffer.from(entry.contentHashHex, "hex");
+        logger.info("content.park.signed", { agentName: ownerName, sessionId: entry.sessionId, contentHash: entry.contentHashHex, source: "startup_flush" });
         // DOD-MSG-4 (2b): seal the envelope shape too (content only — the durable awaiting queue does not
         // persist the ordering record, so a crash-backstop re-park recovers in arrival order; the common
         // live-park path above carries the full Structure2). Keeps ONE envelope format on the recover side.
-        const ciphertext = sealToRecipient(recipientPubkey, sessionNodeManager.encodeParkEnvelope(entry.contentBlob));
+        // SEC-1: same sole producer as the live hook — the backstop signs from the persisted
+        // (sessionId, recipient, contentHash), which is why it survives a crash with NO schema migration.
+        const ciphertext = await sealParkEnvelope({
+            signer: senderKp,
+            sessionIdHex: entry.sessionId,
+            recipientPubkey,
+            contentHash: contentHashBytes,
+            content: entry.contentBlob,
+        });
         const client = new ContentParkClient({ relayPeerId: ep.relayPeerId, relayAddrs: [...ep.relayAddrs], logger });
         const res = await client.deposit(node, {
             recipientPubkey,
@@ -3706,22 +3747,28 @@ export async function startDaemon(config) {
         const client = new ContentParkClient({ relayPeerId, relayAddrs, logger });
         const entries = await client.pull(node, Buffer.from(recipientPubkey, "hex"), kp);
         let recovered = 0;
+        // SEC-1 / review M2: a REFUSED entry must not vanish behind `ok:true`. Report it — an operator
+        // seeing {ok:true, pulled:3, recovered:0} would otherwise have three messages evaporate with the
+        // only explanation buried in the daemon log. This is both the injection signal and, given the
+        // deliberate no-tolerant-window rollout, the lagging-peer signal.
+        const refusals = [];
+        // AC7: one correlationId per recover flow, threaded through every event it emits.
+        const correlationId = randomUUID();
         for (const e of entries) {
             const unsealed = await kp.openContentSeal(e.ciphertext);
             if (!unsealed) {
                 logger.warn("content.recover.unseal_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex });
                 continue;
             }
-            // DOD-MSG-4 (2b): the unsealed blob is the ordering envelope (content + the relay's signed
-            // Structure2). Extract the content; if the record is present, verify it and feed the strict-in-
-            // order gate the canonical sequence BEFORE ingest — so recovered messages order the same way a
-            // direct frame does (closes review finding #3). Old/bare-content seals decode to content alone.
-            const env = sessionNodeManager.decodeParkEnvelope(unsealed);
+            // SEC-1: authenticate THEN ingest — fused in recoverParkedEntry, which is now the ONLY way
+            // parked content can enter the transcript. It verifies the sender's signature over
+            // (session_id, recipient_pubkey, content_hash) and that the signer is this session's
+            // counterparty, and it still verifies + records the DOD-MSG-4 ordering record when present.
+            // Relay deposit is unauthenticated and the seal is anonymous, so WITHOUT this gate anyone
+            // holding the recipient's public key — the relay above all — could inject content that gets
+            // attributed to the honest counterparty and then notarized by the bilateral seal.
             const contentHashBytes = Buffer.from(e.contentHashHex, "hex");
-            if (env.structure1Cbor && env.structure2Cbor) {
-                sessionNodeManager.recordOrderingRecord(recipientAgent.name, e.sessionIdHex, env.structure1Cbor, env.structure2Cbor, contentHashBytes);
-            }
-            const ingest = await sessionNodeManager.ingestReceivedContent(recipientAgent.name, e.sessionIdHex, env.content, contentHashBytes);
+            const ingest = await sessionNodeManager.recoverParkedEntry(recipientAgent.name, e.sessionIdHex, Buffer.from(recipientPubkey, "hex"), unsealed, contentHashBytes, correlationId);
             if (ingest.ok && ingest.held) {
                 // DOD-MSG-4 (review finding #4): a held entry is NOT yet an appended leaf — its sequence is
                 // the FUTURE canonical index, not a completed recovery. Do not count it as recovered; log it
@@ -3758,10 +3805,14 @@ export async function startDaemon(config) {
                 }
             }
             else {
-                logger.warn("content.recover.ingest_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, reason: ingest.reason });
+                // SEC-1 (M2): carry the refusal out to the caller, not just to the log. Deliberately still
+                // NOT confirm-deleted — a forgery must not be able to evict itself from the mailbox, and a
+                // genuine v1-peer message must not be destroyed by our refusing it.
+                refusals.push({ contentHash: e.contentHashHex, sessionId: e.sessionIdHex, reason: ingest.reason });
+                logger.warn("content.recover.ingest_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, reason: ingest.reason, correlationId });
             }
         }
-        return { ok: true, recovered, pulled: entries.length };
+        return { ok: true, recovered, pulled: entries.length, refused: refusals.length, refusals };
     }
     // DOD-MSG-4 (auto-recover-on-reconnect): when an agent comes online, drain its parked mailbox from
     // every relay it has sessions on — symmetric to the SENDER's flushAwaitingContent. Without this,