@forgesworn/fold-kit 0.6.0 → 0.8.0

package/dist/member-epoch.d.ts

@@ -59,6 +59,8 @@ export interface RekeyEvidence {
     epoch: number;
     removed: string[];
     closed: boolean;
+    /** A scheduled turn of the key: see `RekeyNotice.scheduled`. */
+    scheduled?: true;
     /** The epoch commitment, when the authority wrote one. */
     commit?: string;
     /** The authority's member list, when it wrote one. */
@@ -118,6 +120,9 @@ export interface EncodeMemberEpochGrantOptions {
     epochs: RoomEpoch[];
     /** The authority's rekey event for each of `epochs`, in the same order. */
     rekeys: Event[];
+    /** The newest credential the member holds for the device: the grant is
+     *  sealed to its seal key when it names one (see `seal.ts`). */
+    credential?: DeviceCredential;
     now: number;
     expiresAt?: number;
 }
@@ -136,6 +141,9 @@ export interface DecodeMemberEpochGrantOptions {
     authority: string;
     /** The asking device's key. */
     deviceSk: Uint8Array;
+    /** The seal key secrets this device holds, newest first, tried before
+     *  the device key (see `seal.ts`). */
+    sealSks?: readonly Uint8Array[];
     /** The ids of this device's own outstanding member requests. */
     requests: ReadonlySet<string>;
     /** Where this device is: the chain starts from this epoch's key. */
@@ -161,8 +169,11 @@ export interface MemberEpochGrant {
     /** The epochs between the requester's and `epoch`, oldest first, each
      *  proven by the next rekey in the chain decrypting under it. Empty for a
      *  grant one epoch ahead. Kept, they let the requester read what was said
-     *  in the epochs it skipped, and hand them on from its own member desk. */
-    passed: RoomEpoch[];
+     *  in the epochs it skipped, and hand them on from its own member desk.
+     *  `leftAt` is the `created_at` of the authority's rekey out of each. */
+    passed: Array<RoomEpoch & {
+        leftAt?: number;
+    }>;
     /** The newest member list in the chain, when any rekey in it had one. */
     members?: string[];
 }
@@ -201,6 +212,10 @@ export interface HostMemberEpochDeskOptions {
      * answered (#207). Without it, after a removal, nobody is known.
      */
     known?: (participant: string) => boolean;
+    /** The newest credential this device has seen for another device, from
+     *  the roster: see `HostRoomEpochOptions.credentialFor`. Keep it
+     *  monotone. */
+    credentialFor?: (device: string) => DeviceCredential | undefined;
     /** Somebody the room does not know asked, after a removal. Called once
      *  per participant, and again every `reportUnknownEvery` seconds while
      *  they keep asking; nothing is published. Letting them in is making `known`
@@ -270,6 +285,9 @@ export interface MemberEpochRequestOptions {
     now?: () => number;
     /** How often a fresh request goes out. Default 4000 ms. */
     retryMs?: number;
+    /** The seal key secrets this device holds. Asked on every answer,
+     *  because a credential may renew while the ask is out. */
+    sealSks?: () => readonly Uint8Array[];
     expiresAt?: number;
 }
 /** What `requestRoomEpoch({ members })` takes: a second source of answers

package/dist/member-epoch.js

@@ -9,8 +9,9 @@ import { evaluateAccess } from './access.js';
 import { verifyEventUncached } from './verify.js';
 import { withExpiration } from './expiration.js';
 import { epochCommitment } from './epoch-commit.js';
+import { openSealed, sealTo } from './seal.js';
 import { KINDS } from './kinds.js';
-import { MAX_EPOCH, REPORT_UNKNOWN_EVERY_SECONDS, deriveEpoch, epochRequestAdmission, peekRekeyEvent, readMemberList, } from './epoch.js';
+import { MAX_EPOCH, REPORT_UNKNOWN_EVERY_SECONDS, deriveEpoch, epochRequestAdmission, peekRekeyEvent, readMemberList, sealCredential, } from './epoch.js';
 /**
  * Member-to-member epoch catch-up: any current member can bring an
  * admitted, non-removed member up to date.
@@ -116,6 +117,8 @@ export function readRekeyEvidence(event, opts) {
             removed: [...new Set(body.removed.map(normaliseHex))].sort(),
             closed: body.closed === true,
         };
+        if (body.scheduled === true && evidence.removed.length === 0 && !evidence.closed)
+            evidence.scheduled = true;
         if (typeof body.commit === 'string' && HEX64.test(body.commit))
             evidence.commit = normaliseHex(body.commit);
         const members = readMemberList(body.members);
@@ -153,6 +156,12 @@ export function encodeMemberEpochRequest(opts) {
 /** Null for anything malformed, stale, from a device that cannot prove
  *  which participant it speaks for, or that cannot prove admission. */
 export function decodeMemberEpochRequest(event, opts) {
+    const read = readMemberEpochRequest(event, opts);
+    return read && read.request;
+}
+/** `decodeMemberEpochRequest`, keeping the credential the request was made
+ *  under: what the desk seals its answer by. */
+function readMemberEpochRequest(event, opts) {
     try {
         if (event.kind !== MEMBER_EPOCH_KINDS.REQUEST)
             return null;
@@ -187,7 +196,10 @@ export function decodeMemberEpochRequest(event, opts) {
             if (!evaluateAccess(opts.policy, verdict.participant, proof, opts.now, roomId).admitted)
                 return null;
         }
-        return { device: verdict.device, participant: verdict.participant, request: event.id, have: body.have };
+        return {
+            request: { device: verdict.device, participant: verdict.participant, request: event.id, have: body.have },
+            credential: body.credential,
+        };
     }
     catch {
         return null;
@@ -239,7 +251,7 @@ export function encodeMemberEpochGrant(opts) {
             ['d', roomId],
             ['p', device],
         ], opts.expiresAt),
-        content: nip44.v2.encrypt(JSON.stringify(body), nip44.v2.utils.getConversationKey(signerSk, device)),
+        content: sealTo(JSON.stringify(body), signerSk, device, opts.credential),
     }, signerSk);
 }
 /**
@@ -262,7 +274,7 @@ export function decodeMemberEpochGrant(event, opts) {
         const addressed = event.tags.find((t) => t[0] === 'p')?.[1];
         if (addressed === undefined || !hexEquals(addressed, device))
             return null;
-        const body = JSON.parse(nip44.v2.decrypt(event.content, nip44.v2.utils.getConversationKey(opts.deviceSk, event.pubkey)));
+        const body = JSON.parse(openSealed(event.content, event.pubkey, opts.deviceSk, opts.sealSks));
         if (body.v !== 1 || typeof body.request !== 'string' || !HEX64.test(body.request))
             return null;
         if (![...opts.requests].some((r) => hexEquals(r, body.request)))
@@ -311,8 +323,10 @@ export function decodeMemberEpochGrant(event, opts) {
                     return null;
             }
             previous = deriveEpoch({ epoch: evidence.epoch, secret });
+            // The next rekey, signed and checked on the next turn, is when the
+            // room left this epoch.
             if (i < length - 1)
-                passed.push({ epoch: evidence.epoch, secret });
+                passed.push({ epoch: evidence.epoch, secret, leftAt: body.rekeys[i + 1].created_at });
         }
         return { epoch: { epoch: top, secret: secret }, removed: [...removed].sort(), passed, ...(members ? { members } : {}) };
     }
@@ -404,7 +418,7 @@ export function hostMemberEpochDesk(opts) {
             return false;
         return removed.size === 0 || opts.known?.(request.participant) === true;
     };
-    const answer = (request) => {
+    const answer = (request, presented) => {
         if (closed)
             return;
         if (grantSeen.has(request.device) && !stoodDown.has(request.device)) {
@@ -432,6 +446,7 @@ export function hostMemberEpochDesk(opts) {
                 request: request.request,
                 epochs: chain.epochs,
                 rekeys: chain.rekeys,
+                credential: sealCredential(request, presented, opts.credentialFor, roomId, now()),
                 now: now(),
                 expiresAt: opts.expiresAt,
             });
@@ -458,9 +473,10 @@ export function hostMemberEpochDesk(opts) {
     const unsubRequests = opts.transport.subscribe([{ kinds: [MEMBER_EPOCH_KINDS.REQUEST], '#d': [roomId] }], (event) => {
         if (closed || hexEquals(event.pubkey, self))
             return;
-        const request = decodeMemberEpochRequest(event, { roomId, authority, roomKey: opts.roomKey, now: now(), policy: opts.policy });
-        if (!request || answered.has(request.request))
+        const read = readMemberEpochRequest(event, { roomId, authority, roomKey: opts.roomKey, now: now(), policy: opts.policy });
+        if (!read || answered.has(read.request.request))
             return;
+        const { request, credential } = read;
         if (opts.closed?.()) {
             answered.add(request.request);
             bound(answered);
@@ -493,12 +509,12 @@ export function hostMemberEpochDesk(opts) {
         grantSeen.delete(request.device);
         const delay = jitterMs === 0 ? 0 : Math.floor(random() * jitterMs);
         if (delay === 0) {
-            answer(request);
+            answer(request, credential);
             return;
         }
         const timer = setTimeout(() => {
             timers.delete(timer);
-            answer(request);
+            answer(request, credential);
         }, delay);
         timer.unref?.();
         timers.add(timer);
@@ -589,6 +605,7 @@ export function memberEpochSource(opts) {
                     roomId,
                     authority,
                     deviceSk: opts.deviceSk,
+                    sealSks: opts.sealSks?.(),
                     requests,
                     current: current(),
                     participant,

package/dist/seal.d.ts

@@ -0,0 +1,77 @@
+import type { DeviceCredential } from './types.js';
+/**
+ * Seal keys: how a device heals after its key is copied.
+ *
+ * A device key signs, and until now every rekey copy and every epoch grant
+ * was also sealed to it. Whoever copied it opened every one after, until
+ * somebody noticed and removed the device. Rotating a receiving key signed
+ * by the device key would heal nothing: the thief holds that key and signs
+ * their own rotation.
+ *
+ * So the receiving key rides in the device credential (kind 20460), which
+ * the participant signs. A device mints a fresh seal key at every renewal,
+ * and its participant's signer, not the device, binds it. Rekeys and grants
+ * are sealed to the seal key of the newest credential the sender holds for
+ * the device. A thief who copied the device once holds the seal keys minted
+ * up to then, and none minted after: once the copied credential has lapsed
+ * and the room has rekeyed, they are out.
+ *
+ * A device keeps its seal secrets as it keeps its device key, to open what
+ * was sealed to them when it reads the room again. Healing needs only that
+ * each new one is fresh; retiring old ones is a question of forward
+ * secrecy, not of healing.
+ *
+ * A credential with no `seal` tag is sealed to as before, to the device
+ * key, so a client that knows nothing of this keeps working, unhealed. See
+ * docs/seal-key.md.
+ */
+/** The credential tag that names a device's seal key. */
+export declare const SEAL_TAG = "seal";
+/** True for an x-only secp256k1 public key: 32-byte hex that lifts to a
+ *  point on the curve, so NIP-44 can agree a key with it. */
+export declare function isSealPubkey(value: unknown): value is string;
+export interface SealKey {
+    secretKey: Uint8Array;
+    /** x-only, lower-case hex: what `createDeviceCredential({ seal })` takes. */
+    pubkey: string;
+}
+/** A fresh seal key, for the next credential this device asks for. */
+export declare function generateSealKey(): SealKey;
+/**
+ * The seal key a credential names. Undefined when it names none, and null
+ * when its `seal` tags are unusable: more than one, or one that is not a
+ * point on the curve. Only the participant could have signed either, so
+ * nothing here is an attack, but a sender must not throw on it mid-rekey:
+ * it treats null as none.
+ */
+export declare function credentialSeal(credential: DeviceCredential): string | undefined | null;
+/**
+ * Where to seal something for `device`: the seal key `credential` names, or
+ * the device key when it names none, or is not this device's.
+ *
+ * Expiry is deliberately not checked. A device that has gone quiet for
+ * longer than its credential kept that seal key, and opens the copy when it
+ * is back. Falling back to the device key instead would hand that copy to
+ * anybody holding a stolen device key, which is the one person healing
+ * exists to shut out.
+ */
+export declare function sealTarget(device: string, credential?: DeviceCredential): string;
+/** Seal `plaintext` from `senderSk` to `device`, by `sealTarget`. */
+export declare function sealTo(plaintext: string, senderSk: Uint8Array, device: string, credential?: DeviceCredential): string;
+/**
+ * Open something sealed to this device by `sender`: under each seal key in
+ * turn, then under the device key. Throws when none of them opens it.
+ * NIP-44's MAC verifies under the right key only, so a wrong one fails
+ * rather than producing garbage.
+ */
+export declare function openSealed(ciphertext: string, sender: string, deviceSk: Uint8Array, sealSks?: readonly Uint8Array[]): string;
+/**
+ * The newer of two credentials: the later expiry, then the later
+ * `created_at`. Expiry first because some remote signers restamp
+ * `created_at` with their own clock (kithmoot#205), while the expiry is the
+ * device's own request, inside the signature either way. Ties keep `a`.
+ *
+ * Neither is checked here; compare only credentials already verified for
+ * the same device.
+ */
+export declare function newerCredential(a: DeviceCredential, b: DeviceCredential): DeviceCredential;

package/dist/seal.js

@@ -0,0 +1,128 @@
+import { schnorr } from '@noble/curves/secp256k1.js';
+import { nip44 } from 'nostr-tools';
+import { generateSecretKey, getPublicKey } from 'nostr-tools/pure';
+import { hexEquals, normaliseHex } from './hex.js';
+/**
+ * Seal keys: how a device heals after its key is copied.
+ *
+ * A device key signs, and until now every rekey copy and every epoch grant
+ * was also sealed to it. Whoever copied it opened every one after, until
+ * somebody noticed and removed the device. Rotating a receiving key signed
+ * by the device key would heal nothing: the thief holds that key and signs
+ * their own rotation.
+ *
+ * So the receiving key rides in the device credential (kind 20460), which
+ * the participant signs. A device mints a fresh seal key at every renewal,
+ * and its participant's signer, not the device, binds it. Rekeys and grants
+ * are sealed to the seal key of the newest credential the sender holds for
+ * the device. A thief who copied the device once holds the seal keys minted
+ * up to then, and none minted after: once the copied credential has lapsed
+ * and the room has rekeyed, they are out.
+ *
+ * A device keeps its seal secrets as it keeps its device key, to open what
+ * was sealed to them when it reads the room again. Healing needs only that
+ * each new one is fresh; retiring old ones is a question of forward
+ * secrecy, not of healing.
+ *
+ * A credential with no `seal` tag is sealed to as before, to the device
+ * key, so a client that knows nothing of this keeps working, unhealed. See
+ * docs/seal-key.md.
+ */
+/** The credential tag that names a device's seal key. */
+export const SEAL_TAG = 'seal';
+const HEX64 = /^[0-9a-f]{64}$/i;
+/** True for an x-only secp256k1 public key: 32-byte hex that lifts to a
+ *  point on the curve, so NIP-44 can agree a key with it. */
+export function isSealPubkey(value) {
+    if (typeof value !== 'string' || !HEX64.test(value))
+        return false;
+    try {
+        schnorr.utils.lift_x(BigInt(`0x${value}`));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** A fresh seal key, for the next credential this device asks for. */
+export function generateSealKey() {
+    const secretKey = generateSecretKey();
+    return { secretKey, pubkey: getPublicKey(secretKey) };
+}
+/**
+ * The seal key a credential names. Undefined when it names none, and null
+ * when its `seal` tags are unusable: more than one, or one that is not a
+ * point on the curve. Only the participant could have signed either, so
+ * nothing here is an attack, but a sender must not throw on it mid-rekey:
+ * it treats null as none.
+ */
+export function credentialSeal(credential) {
+    const tags = credential.tags.filter((t) => t[0] === SEAL_TAG);
+    if (tags.length === 0)
+        return undefined;
+    if (tags.length > 1)
+        return null;
+    const value = tags[0][1];
+    return isSealPubkey(value) ? normaliseHex(value) : null;
+}
+/**
+ * Where to seal something for `device`: the seal key `credential` names, or
+ * the device key when it names none, or is not this device's.
+ *
+ * Expiry is deliberately not checked. A device that has gone quiet for
+ * longer than its credential kept that seal key, and opens the copy when it
+ * is back. Falling back to the device key instead would hand that copy to
+ * anybody holding a stolen device key, which is the one person healing
+ * exists to shut out.
+ */
+export function sealTarget(device, credential) {
+    const to = normaliseHex(device);
+    if (!credential)
+        return to;
+    const named = credential.tags.find((t) => t[0] === 'device')?.[1];
+    if (named === undefined || !hexEquals(named, to))
+        return to;
+    return credentialSeal(credential) ?? to;
+}
+/** Seal `plaintext` from `senderSk` to `device`, by `sealTarget`. */
+export function sealTo(plaintext, senderSk, device, credential) {
+    return nip44.v2.encrypt(plaintext, nip44.v2.utils.getConversationKey(senderSk, sealTarget(device, credential)));
+}
+/**
+ * Open something sealed to this device by `sender`: under each seal key in
+ * turn, then under the device key. Throws when none of them opens it.
+ * NIP-44's MAC verifies under the right key only, so a wrong one fails
+ * rather than producing garbage.
+ */
+export function openSealed(ciphertext, sender, deviceSk, sealSks = []) {
+    for (const sk of sealSks) {
+        try {
+            return nip44.v2.decrypt(ciphertext, nip44.v2.utils.getConversationKey(sk, sender));
+        }
+        catch {
+            // Not this one: try the next, then the device key.
+        }
+    }
+    return nip44.v2.decrypt(ciphertext, nip44.v2.utils.getConversationKey(deviceSk, sender));
+}
+function expirationOf(credential) {
+    const raw = credential.tags.find((t) => t[0] === 'expiration')?.[1];
+    const at = raw === undefined ? NaN : Number(raw);
+    return Number.isFinite(at) ? at : -Infinity;
+}
+/**
+ * The newer of two credentials: the later expiry, then the later
+ * `created_at`. Expiry first because some remote signers restamp
+ * `created_at` with their own clock (kithmoot#205), while the expiry is the
+ * device's own request, inside the signature either way. Ties keep `a`.
+ *
+ * Neither is checked here; compare only credentials already verified for
+ * the same device.
+ */
+export function newerCredential(a, b) {
+    const ea = expirationOf(a);
+    const eb = expirationOf(b);
+    if (eb !== ea)
+        return eb > ea ? b : a;
+    return b.created_at > a.created_at ? b : a;
+}

package/llms.txt

@@ -81,6 +81,8 @@ Not yet published to npm under this API. Until it is, pin an immutable Git commi
 - `hostRoomEpoch(opts)` / `requestRoomEpoch(opts)` / `EpochRefusedError` - the live request/grant desk, both sides
 - Member epoch catch-up (see `docs/member-epoch-catch-up.md`): `encodeRekeyEvent({ ..., commit: true })` writes `epochCommitment(roomId, epoch, secret)` into the rekey body; `hostMemberEpochDesk(opts)` lets any current member answer; `requestRoomEpoch({ ..., members: memberEpochSource(opts) })` asks the authority and members, first verifiable answer wins; `requestMemberEpoch(opts)` asks members alone. Kinds `MEMBER_EPOCH_KINDS` = `{ REQUEST: 20471, GRANT: 20472 }`. A member grant carries the authority-signed rekeys from the asker's epoch to the current one; the asker verifies the chain itself (`decodeMemberEpochGrant`) and refuses a last epoch with no commitment (legacy: authority only), a chain that removes it or closes the room, and one that stops short of `expected`. A verified grant is `{ epoch, removed, passed }`: `passed` holds the epochs between the asker's and `epoch`, oldest first, and `requestRoomEpoch` carries it as an optional `passed` when a member answered. Codecs: `encodeMemberEpochRequest`, `decodeMemberEpochRequest`, `encodeMemberEpochGrant`, `readRekeyEvidence`, `deriveMemberEpochRequestKey`, `MAX_MEMBER_EPOCH_CHAIN` (32)
 - The known-members gate (#207, see `docs/member-epoch-catch-up.md`): once a room has removed anybody (`removed()` not empty), `hostRoomEpoch` and `hostMemberEpochDesk` grant only to a participant for which `known(participant)` is true; anybody else is reported through `onUnknown` (once per participant, and again every `reportUnknownEvery` seconds, default `REPORT_UNKNOWN_EVERY_SECONDS` = 60, while they keep asking) and refused: the authority answers `refused: 'unknown'` (an `EpochRefusal`), a member stays silent. `unknown` is not final: `requestRoomEpoch` keeps asking, calls its `onUnknown` once, and rejects with `EpochRefusedError('unknown')` only at its timeout; a desk looks at the requester's next ask afresh, so letting somebody in is making `known` say yes. No `known` after a removal means nobody is known. Member lists: `encodeRekeyEvent({ members })` writes the authority's list (removed dropped, sorted) into the body, read back as `RekeyNotice.members` and `RekeyEvidence.members`, and as `MemberEpochGrant.members` (newest in the chain); `hostRoomEpoch({ members })` puts it in its grants (`EpochGrant.members`). `readMemberList(raw)` reads one, undefined when malformed. Without `members` and with no removal every event is byte-identical to 0.5.1
+- Seal keys (see `docs/seal-key.md`): `createDeviceCredential({ ..., seal })` appends `["seal", <x-only pubkey>]` last, under the participant's signature; mint a fresh one per credential with `generateSealKey()` and keep its secret as you keep the device key (old copies are sealed to old seal keys; healing needs only that each new one is fresh). `encodeRekeyEvent` recipients may be `{ device, credential }`; `encodeEpochGrant` and `encodeMemberEpochGrant` take `credential`; each copy is sealed to `sealTarget(device, credential)`: the credential's seal key, else the device key (never back to the device key because the credential lapsed). Readers take `sealSks` (`decodeRekeyEvent`, `decodeEpochGrant`, `decodeMemberEpochGrant`) or a `sealSks()` getter (`requestRoomEpoch`, `memberEpochSource`) and try them before the device key (`openSealed`); a rekey copy nothing opens reads as no copy. Desks take `credentialFor(device)`, the newest credential the room has seen (keep it monotone), and seal to the newer of that and the presented one (`sealCredential`, `newerCredential`: later expiration, then later created_at). `credentialSeal(c)` is the pubkey, undefined for none, null when doubled or off the curve (sealed to the device key). Without seal keys every event is byte-identical to 0.6.0
+- Scheduled rekeys and the history window (see `docs/scheduled-rekey.md`): `encodeRekeyEvent({ ..., scheduled: true })` writes `"scheduled": true` inside the encrypted body (never a tag), and throws beside a non-empty `removed` or `closed`; `decodeRekeyEvent` (`RekeyNotice.scheduled`) and `readRekeyEvidence` (`RekeyEvidence.scheduled`) report `true` only when `removed` is empty and the room is not closed, so a contradictory body is still announced. `HISTORY_WINDOW_SECONDS` (30 days) and `MAX_HISTORY_EPOCHS` (16); `epochsInWindow(left, now)` keeps entries with `leftAt >= now - HISTORY_WINDOW_SECONDS`, newest first by epoch, first of a doubled epoch, at most 16, never throws. `encodeEpochGrant({ ..., passed })` takes `LeftEpoch[]` (`{ epoch, secret, leftAt }`) and writes `passed: [{ epoch, secret (base64url), left }]` oldest first, only when non-empty; it throws on more than 16, epoch 0 (the room secret is never carried), an epoch not below the granted one, a doubled epoch, a non-32-byte secret or a bad `leftAt`. `hostRoomEpoch({ past })` is asked on every grant, filtered to what the encoder accepts and to `epochsInWindow`, so a bad `past()` costs the history, not the grant. `decodeEpochGrant` returns `EpochGrant.passed` (`leftAt` set) only when the list is exactly in that form, else drops the field and keeps the grant; `decodeMemberEpochGrant` sets `leftAt` on each passed epoch from the next rekey's `created_at`. `MAX_MEMBER_EPOCH_CHAIN` (32) is a different limit. Without the marker and `passed` every event is byte-identical to 0.7.0, and a 0.7.0 reader ignores both
 - `canonicalAdmins(admins)` / `signAdmins(opts)` / `verifyAdmins(opts)` - the authority's signed admin list
 - `canonicalChannels(channels)` / `signChannels(opts)` / `verifyChannels(opts)` - the authority's signed channel list; `CHANNEL_NAME`, `RESERVED_CHANNELS`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/fold-kit",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Circle primitives for private Nostr groups nobody operates: epoch keys, link invites, removal by rekey, device credentials.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,6 +21,8 @@
     "vectors/kithmoot-vectors.json",
     "vectors/circle-vectors.json",
     "vectors/member-epoch-vectors.json",
+    "vectors/seal-vectors.json",
+    "vectors/schedule-vectors.json",
     "LICENSE",
     "README.md",
     "llms.txt"
@@ -33,6 +35,8 @@
     "diff-source": "node scripts/diff-source.mjs",
     "generate-fold": "node scripts/generate-fold.mjs",
     "generate-member-epoch": "node scripts/generate-member-epoch.mjs",
+    "generate-seal": "node scripts/generate-seal.mjs",
+    "generate-schedule": "node scripts/generate-schedule.mjs",
     "bundle-check": "node scripts/bundle-check.mjs",
     "tarball-smoke": "node scripts/tarball-smoke.mjs",
     "vectors": "vitest run vectors/",