@cello-protocol/gateway 0.0.12 → 0.0.14

package/dist/store/encrypted-db.d.ts

@@ -1,4 +1,4 @@
-export type GatewayStoreErrorCode = "store_key_unavailable" | "store_key_mismatch" | "store_engine_unavailable" | "store_open_failed";
+export type GatewayStoreErrorCode = "store_key_unavailable" | "store_key_mismatch" | "store_plaintext_file" | "store_locked" | "store_engine_unavailable" | "store_open_failed";
 export declare class GatewayStoreError extends Error {
     readonly code: GatewayStoreErrorCode;
     /** Actionable next step for the operator — never contains key material. */
@@ -18,10 +18,20 @@ export interface StoreDb {
     prepare(sql: string): StoreStatement;
     close(): void;
 }
+/**
+ * Where this module's events go. INJECTED, because the store now has two callers with opposite
+ * needs: the gateway BIN is a composition root with no logger, whose stdout is reserved for the
+ * READY handshake the spawner parses — so its events go to stderr, which the spawner drains and
+ * surfaces. The DAEMON has an injected logger and a hard rule against writing anywhere else
+ * (INV-7), so it passes one in. Defaulting to stderr would have put raw writes in daemon code.
+ */
+export type StoreEventSink = (event: string, context: Record<string, unknown>) => void;
+/** The gateway bin's sink: one structured line on stderr, never stdout. */
+export declare const stderrStoreEventSink: StoreEventSink;
 /**
  * Open (creating if absent) the gateway's encrypted store file, keyed by the raw 32-byte key in
  * `keyFilePath`. Verifies the key by reading sqlite_master; enables WAL only after verification.
  * Throws GatewayStoreError on every failure path — never returns a plaintext handle.
  */
-export declare function openEncryptedStoreDb(dbPath: string, keyFilePath: string): StoreDb;
+export declare function openEncryptedStoreDb(dbPath: string, keyFilePath: string, onEvent?: StoreEventSink): StoreDb;
 //# sourceMappingURL=encrypted-db.d.ts.map

package/dist/store/encrypted-db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encrypted-db.d.ts","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,qBAAqB,GAC7B,uBAAuB,GACvB,oBAAoB,GACpB,0BAA0B,GAC1B,mBAAmB,CAAC;AAExB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM3E;AA0BD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC1F,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAsED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CA2CjF"}
+{"version":3,"file":"encrypted-db.d.ts","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AA8CA,MAAM,MAAM,qBAAqB,GAC7B,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,0BAA0B,GAC1B,mBAAmB,CAAC;AAExB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM3E;AA0BD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC1F,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAkCD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAEvF,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,EAAE,cAElC,CAAC;AAsCF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAwF3G"}

package/dist/store/encrypted-db.js

@@ -17,8 +17,33 @@
  * writes config and reads records).
  */
 import { createRequire } from "node:module";
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync, openSync, readSync, closeSync } from "node:fs";
 const STORE_KEY_BYTES = 32; // AES-256 — the daemon's key size
+/**
+ * A plaintext SQLite file begins with these bytes; a SQLCipher file encrypts its header, so its
+ * first bytes are ciphertext and never match. Used to tell "someone left a plaintext store here"
+ * apart from "wrong key" — two very different operator actions.
+ */
+const SQLITE_PLAINTEXT_MAGIC = Buffer.concat([Buffer.from("SQLite format 3", "latin1"), Buffer.from([0x00])]);
+function isPlaintextSqliteFile(dbPath) {
+    if (!existsSync(dbPath))
+        return false;
+    const head = Buffer.alloc(SQLITE_PLAINTEXT_MAGIC.length);
+    try {
+        const fd = openSync(dbPath, "r");
+        try {
+            if (readSync(fd, head, 0, head.length, 0) < head.length)
+                return false;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        return false;
+    }
+    return head.equals(SQLITE_PLAINTEXT_MAGIC);
+}
 export class GatewayStoreError extends Error {
     code;
     /** Actionable next step for the operator — never contains key material. */
@@ -60,6 +85,10 @@ class AdaptedDb {
         this.#inner.close();
     }
 }
+/** The gateway bin's sink: one structured line on stderr, never stdout. */
+export const stderrStoreEventSink = (event, context) => {
+    process.stderr.write(`${JSON.stringify({ level: "info", event, ...context })}\n`);
+};
 function loadEngine() {
     const require = createRequire(import.meta.url);
     try {
@@ -89,8 +118,18 @@ function readStoreKey(keyFilePath) {
  * `keyFilePath`. Verifies the key by reading sqlite_master; enables WAL only after verification.
  * Throws GatewayStoreError on every failure path — never returns a plaintext handle.
  */
-export function openEncryptedStoreDb(dbPath, keyFilePath) {
+export function openEncryptedStoreDb(dbPath, keyFilePath, onEvent) {
+    const emit = (event, context) => onEvent?.(event, context);
     const key = readStoreKey(keyFilePath);
+    // Distinguish "a plaintext store was left here" from "wrong key" BEFORE trying to decrypt.
+    // Both surface as an unreadable header, and they call for opposite operator actions: one is
+    // "delete this stale file", the other is "restore your key from backup" — advice that destroys
+    // data if given for the wrong cause.
+    if (isPlaintextSqliteFile(dbPath)) {
+        throw new GatewayStoreError("store_plaintext_file", `the file at ${dbPath} is an UNENCRYPTED SQLite database`, "The gateway store must be encrypted. This is a leftover plaintext store from before the " +
+            "store was encrypted; it is not migrated and not read. Move or delete it and restart — a " +
+            "fresh encrypted store is created automatically.");
+    }
     const mod = loadEngine();
     const Ctor = mod.Database ?? mod.default;
     let inner;
@@ -104,28 +143,52 @@ export function openEncryptedStoreDb(dbPath, keyFilePath) {
     // Key set outside the message-bearing try: key hex must never reach an error string.
     const keyHex = Buffer.from(key).toString("hex");
     inner.pragma(`key = "x'${keyHex}'"`);
+    // busy_timeout FIRST — before the verify read and before the WAL pragma, both of which take
+    // locks. This file is shared with the daemon (M9C-D9), so a contended startup is ordinary, and
+    // with the SQLite default timeout of 0 the very first contended open returns SQLITE_BUSY
+    // instantly — which the verify-read catch below would then report as a wrong key. Setting it
+    // last (as this did) turns lock contention into "your key is wrong. Restore it from backup."
+    inner.pragma("busy_timeout = 3000");
     try {
         inner.prepare("SELECT count(*) AS c FROM sqlite_master").get([]);
     }
-    catch {
+    catch (err) {
         try {
             inner.close();
         }
         catch {
             /* ignore */
         }
-        throw new GatewayStoreError("store_key_mismatch", "gateway store did not decrypt with the supplied key", "The daemon's key does not match this gateway store file. Restore the matching key file; " +
+        // The upstream reason MUST survive. A wrong key, a locked file, a truncated file and an I/O
+        // error all surface here, and a label that names only the exit point sends the operator to
+        // the wrong subsystem. No key material can appear in this string — the key is only ever in
+        // the pragma above, which is not part of the thrown error. (The daemon's opener does the
+        // same at sqlcipher-db.ts; this copy dropped it, which is the defect being fixed.)
+        const reason = err instanceof Error ? err.message : String(err);
+        const locked = /SQLITE_BUSY|database is locked/i.test(reason);
+        if (locked) {
+            throw new GatewayStoreError("store_locked", `gateway store is locked by another process (${reason})`, "Another process holds the gateway store's write lock — usually an orphaned gateway from " +
+                "a previous daemon. Stop it and restart the daemon. The key is not the problem.");
+        }
+        throw new GatewayStoreError("store_key_mismatch", `gateway store did not decrypt with the supplied key (${reason})`, "The daemon's key does not match this gateway store file. Restore the matching key file; " +
             "the gateway will not fall back to a plaintext store.");
     }
-    // WAL after verification so WAL/SHM are ciphertext; busy_timeout tolerates the daemon's own
-    // connection to the same file (SURFACE-1 config writes, AUDIT-1 record reads).
+    // WAL after verification so WAL/SHM are ciphertext. CHECK the result rather than assuming it:
+    // the file is shared with the daemon, and a silent fall back to rollback-journal mode means a
+    // daemon write blocks gateway reads, which surfaces to the user as messages fail-closed with a
+    // generic screen error. Not fatal — SQLCipher encrypts the rollback journal too, so custody
+    // holds either way — but never silent.
     try {
-        inner.pragma("journal_mode=WAL", { simple: true });
+        const mode = inner.pragma("journal_mode=WAL", { simple: true });
+        if (mode !== "wal")
+            emit("gateway.store.wal_unavailable", { mode: String(mode) });
     }
-    catch {
-        /* non-WAL degrades performance, not custody — SQLCipher encrypts the rollback journal too */
+    catch (err) {
+        emit("gateway.store.wal_unavailable", { error: err instanceof Error ? err.message : String(err) });
     }
-    inner.pragma("busy_timeout = 3000");
+    // The store is open and encrypted. Structured, on stderr: stdout carries the READY handshake the
+    // parent parses, so nothing else may go there. Never the key, and never the key file's contents.
+    emit("gateway.store.opened", { encrypted: true, path: dbPath });
     return new AdaptedDb(inner);
 }
 //# sourceMappingURL=encrypted-db.js.map

package/dist/store/encrypted-db.js.map

@@ -1 +1 @@
-{"version":3,"file":"encrypted-db.js","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAQ9D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IACrC,2EAA2E;IAClE,QAAQ,CAAS;IAC1B,YAAY,IAA2B,EAAE,OAAe,EAAE,QAAgB;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAsCD,MAAM,gBAAgB;IACX,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,SAAS;IACJ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,sBAAsB,CAAiB,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,MAAM,EAAE,EAChD,iGAAiG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,uCAAuC,WAAW,EAAE,EACpD,8FAA8F;YAC5F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,6BAA6B,GAAG,CAAC,MAAM,oBAAoB,eAAe,EAAE,EAC5E,mBAAmB,WAAW,wCAAwC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB;IACtE,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAEzC,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,EAAE,uCAAuC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,MAAM,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,qDAAqD,EACrD,0FAA0F;YACxF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,+EAA+E;IAC/E,IAAI,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;IAC/F,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEpC,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"encrypted-db.js","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAElF,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAE9D;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9G,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAC7C,CAAC;AAUD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IACrC,2EAA2E;IAClE,QAAQ,CAAS;IAC1B,YAAY,IAA2B,EAAE,OAAe,EAAE,QAAgB;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAsCD,MAAM,gBAAgB;IACX,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,SAAS;IACJ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAWD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC,CAAC;AAEF,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,sBAAsB,CAAiB,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,MAAM,EAAE,EAChD,iGAAiG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,uCAAuC,WAAW,EAAE,EACpD,8FAA8F;YAC5F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,6BAA6B,GAAG,CAAC,MAAM,oBAAoB,eAAe,EAAE,EAC5E,mBAAmB,WAAW,wCAAwC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB,EAAE,OAAwB;IAChG,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAgC,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAEtC,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,qCAAqC;IACrC,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CACzB,sBAAsB,EACtB,eAAe,MAAM,oCAAoC,EACzD,0FAA0F;YACxF,0FAA0F;YAC1F,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAEzC,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,EAAE,uCAAuC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,MAAM,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC;IAErC,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,mFAAmF;QACnF,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,+CAA+C,MAAM,GAAG,EACxD,0FAA0F;gBACxF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,wDAAwD,MAAM,GAAG,EACjE,0FAA0F;YACxF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,4FAA4F;IAC5F,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,iGAAiG;IACjG,iGAAiG;IACjG,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEhE,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/testing.d.ts

@@ -0,0 +1,14 @@
+/**
+ * TEST-ONLY exports. Reachable as `@cello-protocol/gateway/testing`, deliberately NOT from the
+ * package barrel (DOD-M9C-WIRE-1: "the stub moves to test-only visibility").
+ *
+ * `PassthroughGatewayClient` screens nothing and allows everything. It was the daemon's DEFAULT
+ * once, and because no production caller ever overrode it, the entire security layer shipped inert
+ * while the daemon logged that its gateway was connected. It still has to EXIST — tests are
+ * out-of-tree consumers and need a way to satisfy the now-required `securityGateway` field — but
+ * putting it on the main barrel leaves an always-allow client one ordinary import away from any
+ * production file. A separate entry point makes reaching for it a deliberate act that shows up in
+ * a diff.
+ */
+export { PassthroughGatewayClient } from "./passthrough.js";
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/testing.js

@@ -0,0 +1,14 @@
+/**
+ * TEST-ONLY exports. Reachable as `@cello-protocol/gateway/testing`, deliberately NOT from the
+ * package barrel (DOD-M9C-WIRE-1: "the stub moves to test-only visibility").
+ *
+ * `PassthroughGatewayClient` screens nothing and allows everything. It was the daemon's DEFAULT
+ * once, and because no production caller ever overrode it, the entire security layer shipped inert
+ * while the daemon logged that its gateway was connected. It still has to EXIST — tests are
+ * out-of-tree consumers and need a way to satisfy the now-required `securityGateway` field — but
+ * putting it on the main barrel leaves an always-allow client one ordinary import away from any
+ * production file. A separate entry point makes reaching for it a deliberate act that shows up in
+ * a diff.
+ */
+export { PassthroughGatewayClient } from "./passthrough.js";
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/types.d.ts

@@ -102,7 +102,17 @@ export interface ScreenVerdict {
  * deadline. A timeout or unreachable gateway resolves to a fail-closed `block`
  * (`gateway_unavailable`), never a rejected/never-settling promise (INV-6 / SI-001).
  */
+/** What a client actually does to content. `enforcing` screens; `passthrough` allows everything. */
+export type GatewayMode = "enforcing" | "passthrough";
 export interface SecurityGatewayClient {
+    /**
+     * Declared by the implementation, never computed by the caller (M9C-D11). The daemon announces
+     * this at boot, and it is the field an operator greps to know whether their agent is screened —
+     * so it must come from the object that will actually do (or not do) the screening. The defect
+     * this closes: the daemon used to announce `config.securityGateway ? "sidecar" : "passthrough"`,
+     * so the boot line described the caller's intent rather than the object's behavior.
+     */
+    readonly mode: GatewayMode;
     screenOutbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
     screenInbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtE,yGAAyG;AACzG,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChF;AAED,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD;0EAC0E;AAC1E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,GAAE,MAA4B,GAAG,aAAa,CAcjH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtE,yGAAyG;AACzG,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,oGAAoG;AACpG,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChF;AAED,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD;0EAC0E;AAC1E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,GAAE,MAA4B,GAAG,aAAa,CAcjH"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAyGH,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA0B,EAAE,SAAiB,mBAAmB;IAChG,MAAM,KAAK,GAAG,MAAM,KAAK,kBAAkB;QACzC,CAAC,CAAC,6EAA6E;QAC/E,CAAC,CAAC,2CAA2C,CAAC;IAChD,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,MAAM;QACN,QAAQ,EACN,SAAS,KAAK,UAAU;YACtB,CAAC,CAAC,gBAAgB,KAAK,4DAA4D;gBACjF,wDAAwD;YAC1D,CAAC,CAAC,gBAAgB,KAAK,mEAAmE;gBACxF,sGAAsG;KAC7G,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoHH,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA0B,EAAE,SAAiB,mBAAmB;IAChG,MAAM,KAAK,GAAG,MAAM,KAAK,kBAAkB;QACzC,CAAC,CAAC,6EAA6E;QAC/E,CAAC,CAAC,2CAA2C,CAAC;IAChD,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,MAAM;QACN,QAAQ,EACN,SAAS,KAAK,UAAU;YACtB,CAAC,CAAC,gBAAgB,KAAK,4DAA4D;gBACjF,wDAAwD;YAC1D,CAAC,CAAC,gBAAgB,KAAK,mEAAmE;gBACxF,sGAAsG;KAC7G,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/gateway",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "private": false,
   "type": "module",
   "engines": {
@@ -16,6 +16,10 @@
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
+    "./testing": {
+      "import": "./dist/testing.js",
+      "types": "./dist/testing.d.ts"
+    },
     "./detect": {
       "import": "./dist/detect/index.js",
       "types": "./dist/detect/index.d.ts"
@@ -30,10 +34,10 @@
     "package.json"
   ],
   "dependencies": {
-    "@signalapp/sqlcipher": "^3.3.5",
     "re2-wasm": "^1.0.2"
   },
   "optionalDependencies": {
+    "@signalapp/sqlcipher": "^3.3.5",
     "re2": "^1.25.0"
   },
   "devDependencies": {