@joe-broadhead/messaging 0.7.0 → 0.8.0

package/dist/lib/modules/core/conversation/seal.js

@@ -0,0 +1,251 @@
+/**
+ * Sealing in conversations (spec §16.5, §16.6):
+ *
+ * - a `msg` body: base64url(nonce ‖ AES-256-GCM(mk, nonce, JCS(MsgBody), aad = JCS(header)) ‖ tag), with a fresh
+ *   12-byte nonce, under the author's message key for (`epoch`, `idx`);
+ * - `create.sealedMeta`: the same, of JCS(ConvMeta) under the creator's epoch-0 message key 0, with the create
+ *   event's header as AAD;
+ * - a `meta` or `setting` op's content: the same, under the author's key at the op's (`epoch`, `idx`), with
+ *   aad = JCS(event without `sig`, the op without `sealed`);
+ * - a `keys` share: JCS({shares}) sealed to its one recipient device under the envelope seal (spec §5, "Sealing": X25519
+ *   with a fresh ephemeral key, HKDF-SHA256 with salt epk ‖ recipient enc and info DOMAIN.seal, AES-256-GCM), with
+ *   aad = JCS({header, to}).
+ */
+import { createCipheriv, createDecipheriv, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
+import { b64u, utf8 } from "../b64u.js";
+import { asMessagingError, parseWith } from "../check.js";
+import { canonicalize } from "../jcs.js";
+import { privateKeyFromRaw, publicKeyFromRaw, rawPublicKey } from "../keys.js";
+import { DOMAIN, LIMITS } from "../schema/common.js";
+import { ConvMeta, KeySharePayload, MsgBody, SettingBody, } from "../schema/conversation.js";
+import { MessagingError } from "../schema/errors.js";
+import { parseWire } from "../wire.js";
+import { convEventHeader, signConvEvent } from "./event.js";
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+function aad(header) {
+    return utf8(canonicalize(header));
+}
+function aesSeal(key, nonce, plaintext, additional) {
+    if (nonce.length !== NONCE_BYTES)
+        throw new MessagingError("invalid_request", "a nonce is 12 bytes");
+    const cipher = createCipheriv("aes-256-gcm", key, nonce, { authTagLength: TAG_BYTES });
+    cipher.setAAD(additional);
+    return Buffer.concat([nonce, cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+}
+function aesOpen(key, sealed, additional, maxPlaintext) {
+    let data;
+    try {
+        data = b64u.decode(sealed);
+    }
+    catch {
+        throw new MessagingError("bad_signature", "sealed body is not base64url");
+    }
+    if (data.length - NONCE_BYTES - TAG_BYTES > maxPlaintext)
+        throw new MessagingError("too_large", "sealed body is too large");
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, data.subarray(0, NONCE_BYTES), { authTagLength: TAG_BYTES });
+        decipher.setAAD(additional);
+        decipher.setAuthTag(data.subarray(data.length - TAG_BYTES));
+        return Buffer.concat([decipher.update(data.subarray(NONCE_BYTES, data.length - TAG_BYTES)), decipher.final()]);
+    }
+    catch {
+        throw new MessagingError("bad_signature", "sealed body failed to open");
+    }
+}
+/** Decodes UTF-8 strictly and parses with `parseWire`. */
+function wireJson(bytes) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new MessagingError("invalid_request", "sealed body is not UTF-8");
+    }
+    return parseWire(text);
+}
+function plaintextOf(body) {
+    parseWith(MsgBody, body, "message body");
+    const bytes = utf8(canonicalize(body));
+    if (bytes.length > LIMITS.convPlaintextBytes)
+        throw new MessagingError("too_large", "message body is over LIMITS.convPlaintextBytes");
+    return bytes;
+}
+/** Seals `body` under `mk` as the body of `unsealed` and signs the event. Throws only MessagingError. */
+export function sealConvMsg(identity, unsealed, body, mk) {
+    return sealConvMsgWith(identity, unsealed, body, mk, randomBytes(NONCE_BYTES));
+}
+/** `sealConvMsg` with a caller-chosen nonce: for test vectors only (`@messaging/core/testing`). */
+export function sealConvMsgWith(identity, unsealed, body, mk, nonce) {
+    try {
+        const header = convEventHeader({ ...unsealed, class: "msg" });
+        const sealed = b64u.encode(aesSeal(mk, nonce, plaintextOf(body), aad(header)));
+        return signConvEvent(identity, { ...header, body: sealed });
+    }
+    catch (error) {
+        throw asMessagingError(error, "conversation message");
+    }
+}
+/**
+ * Opens a `msg` event's body with its message key: `bad_signature` when it fails to open, `too_large` over
+ * `LIMITS.convPlaintextBytes`, `invalid_request` when the plaintext is not a `MsgBody` (parsed with `parseWire`).
+ * The caller has verified the event's signature.
+ */
+export function openConvMsg(event, mk) {
+    try {
+        if (mk.length !== 32)
+            throw new MessagingError("invalid_request", "a message key is 32 bytes");
+        const bytes = aesOpen(mk, event.body, aad(convEventHeader(event)), LIMITS.convPlaintextBytes);
+        return parseWith(MsgBody, wireJson(bytes), "message body");
+    }
+    catch (error) {
+        throw asMessagingError(error, "conversation message");
+    }
+}
+/** `create.sealedMeta`: JCS(meta) sealed under the creator's epoch-0 key 0, with the create event's header as AAD. */
+export function sealConvMeta(header, meta, mk0) {
+    return sealConvMetaWith(header, meta, mk0, randomBytes(NONCE_BYTES));
+}
+/** `sealConvMeta` with a caller-chosen nonce: for test vectors only. */
+export function sealConvMetaWith(header, meta, mk0, nonce) {
+    try {
+        const value = parseWith(ConvMeta, meta, "conversation meta");
+        return b64u.encode(aesSeal(mk0, nonce, utf8(canonicalize(value)), aad(convEventHeader(header))));
+    }
+    catch (error) {
+        throw asMessagingError(error, "conversation meta");
+    }
+}
+/** Opens a `create` event's `sealedMeta`. Errors as for `openConvMsg`; `not_found` when it has none. */
+export function openConvMeta(event, mk0) {
+    try {
+        if (event.body.op !== "create" || event.body.sealedMeta === undefined)
+            throw new MessagingError("not_found", "the event carries no sealed meta");
+        const bytes = aesOpen(mk0, event.body.sealedMeta, aad(convEventHeader(event)), 2048);
+        return parseWith(ConvMeta, wireJson(bytes), "conversation meta");
+    }
+    catch (error) {
+        throw asMessagingError(error, "conversation meta");
+    }
+}
+function shareAad(header, to) {
+    return utf8(canonicalize({ header, to }));
+}
+function shareKey(shared, epk, recipientEnc) {
+    return new Uint8Array(hkdfSync("sha256", shared, Buffer.concat([epk, recipientEnc]), DOMAIN.seal, 32));
+}
+/**
+ * Seals `shares` to one recipient device as the body of `unsealed`, and signs the event: one `keys` event per
+ * recipient device (spec §16.6), at most `LIMITS.keyShares` chain keys. Throws only MessagingError.
+ */
+export function sealKeyShare(identity, unsealed, recipient, shares) {
+    const { privateKey } = generateKeyPairSync("x25519");
+    return sealShare(identity, unsealed, recipient, shares, { ephemeral: privateKey, nonce: randomBytes(NONCE_BYTES) });
+}
+/** `sealKeyShare` with fixed randomness: for test vectors only. */
+export function sealKeyShareWith(identity, unsealed, recipient, shares, randomness) {
+    try {
+        return sealShare(identity, unsealed, recipient, shares, { ephemeral: privateKeyFromRaw("x25519", randomness.ephemeral), nonce: randomness.nonce });
+    }
+    catch (error) {
+        throw asMessagingError(error, "key shares");
+    }
+}
+function sealShare(identity, unsealed, recipient, shares, randomness) {
+    try {
+        const header = convEventHeader({ ...unsealed, class: "keys" });
+        const plaintext = utf8(canonicalize(parseWith(KeySharePayload, { shares }, "key shares")));
+        const to = { person: recipient.person, device: recipient.device };
+        const { ephemeral, nonce } = randomness;
+        const shared = diffieHellman({ privateKey: ephemeral, publicKey: publicKeyFromRaw("x25519", recipient.enc) });
+        const epk = rawPublicKey(ephemeral);
+        const key = shareKey(shared, b64u.decode(epk), b64u.decode(recipient.enc));
+        const data = aesSeal(key, nonce, plaintext, shareAad(header, to));
+        const body = { to, epk, nonce: b64u.encode(nonce), ct: b64u.encode(data.subarray(NONCE_BYTES)) };
+        return signConvEvent(identity, { ...header, body });
+    }
+    catch (error) {
+        throw asMessagingError(error, "key shares");
+    }
+}
+/**
+ * Opens a `keys` event sealed to `identity`'s device: `not_found` when it is another device's, `bad_signature` when it
+ * fails to open, `invalid_request` when the plaintext is not a share payload. The caller has checked the event
+ * (`ConvLog.checkShare`).
+ */
+export function openKeyShares(event, identity) {
+    try {
+        const share = event.body;
+        if (share.to.device !== identity.machine)
+            throw new MessagingError("not_found", "the share is for another device");
+        let key;
+        try {
+            const shared = diffieHellman({ privateKey: identity.encKey, publicKey: publicKeyFromRaw("x25519", share.epk) });
+            key = shareKey(shared, b64u.decode(share.epk), b64u.decode(identity.enc));
+        }
+        catch {
+            throw new MessagingError("bad_signature", "key share failed to open");
+        }
+        const bytes = aesOpen(key, share.nonce + share.ct, shareAad(convEventHeader(event), share.to), Number.MAX_SAFE_INTEGER);
+        return parseWith(KeySharePayload, wireJson(bytes), "key shares").shares;
+    }
+    catch (error) {
+        throw asMessagingError(error, "key shares");
+    }
+}
+/** AAD of a sealed op: JCS of the event without `sig`, with the op without `sealed`. */
+function stateAad(event) {
+    const { sealed: _sealed, ...op } = event.body;
+    return utf8(canonicalize({ ...convEventHeader(event), body: op }));
+}
+function statePlaintext(op, content) {
+    const value = op.op === "meta" ? parseWith(ConvMeta, content, "conversation meta") : parseWith(SettingBody, content, "setting");
+    if (op.op === "setting" && value.s !== op.kind)
+        throw new MessagingError("invalid_request", "a setting's body is of its op's kind");
+    const bytes = utf8(canonicalize(value));
+    if (bytes.length > LIMITS.convPlaintextBytes)
+        throw new MessagingError("too_large", "sealed op is over LIMITS.convPlaintextBytes");
+    return bytes;
+}
+/**
+ * Seals `content` (a `ConvMeta` for `meta`, a `SettingBody` of the op's kind for `setting`) under `mk`, the author's
+ * message key at the op's (`epoch`, `idx`), and signs the op event. Throws only MessagingError.
+ */
+export function sealConvState(identity, unsealed, content, mk) {
+    return sealConvStateWith(identity, unsealed, content, mk, randomBytes(NONCE_BYTES));
+}
+/** `sealConvState` with a caller-chosen nonce: for test vectors only. */
+export function sealConvStateWith(identity, unsealed, content, mk, nonce) {
+    try {
+        const event = { ...unsealed, class: "op" };
+        const sealed = b64u.encode(aesSeal(mk, nonce, statePlaintext(unsealed.body, content), stateAad(event)));
+        return signConvEvent(identity, { ...event, body: { ...unsealed.body, sealed } });
+    }
+    catch (error) {
+        throw asMessagingError(error, "sealed op");
+    }
+}
+/**
+ * Opens a `meta` or `setting` op with the author's message key at its (`epoch`, `idx`): a `ConvMeta`, or a
+ * `SettingBody` whose `s` is the op's `kind` (`invalid_request` otherwise). `not_found` for another op; errors as
+ * for `openConvMsg`. The caller has applied the event to the log.
+ */
+export function openConvState(event, mk) {
+    try {
+        const op = event.body;
+        if (op.op !== "meta" && op.op !== "setting")
+            throw new MessagingError("not_found", "the op carries no sealed content");
+        if (mk.length !== 32)
+            throw new MessagingError("invalid_request", "a message key is 32 bytes");
+        const value = wireJson(aesOpen(mk, op.sealed, stateAad(event), LIMITS.convPlaintextBytes));
+        if (op.op === "meta")
+            return parseWith(ConvMeta, value, "conversation meta");
+        const setting = parseWith(SettingBody, value, "setting");
+        if (setting.s !== op.kind)
+            throw new MessagingError("invalid_request", "a setting's body is of its op's kind");
+        return setting;
+    }
+    catch (error) {
+        throw asMessagingError(error, "sealed op");
+    }
+}

package/dist/lib/modules/core/conversation-agent-tools.js

@@ -0,0 +1,69 @@
+/** Shared conversation-model tools, including the retained task-envelope path. */
+import { z } from "../vendor/zod/index.js";
+import { AgentTool, TaskReadOutput, TaskSendFields, TaskSendOutput, TaskSource, ToolChainSchema, ToolConsentSchema, ToolExpect } from "./agent-tools.js";
+import { LIMITS, Millis, Ulid } from "./schema/common.js";
+import { ConvId, ConvKind, ParticipantId } from "./schema/conversation.js";
+const Cursor = z.string().min(1).max(512).optional();
+const Limit = z.number().int().min(1).max(50).optional();
+const Fenced = z.string().describe("Untrusted peer content, fenced and with closing delimiters neutralized");
+const Author = z.object({ person: Fenced, agent: Fenced.optional(), of: Fenced.optional(), side: z.enum(["ours", "peer"]) });
+const Citation = z.string().regex(/^messaging:(?:[ds]_[a-z2-7]{26}|c_[0-7][0-9A-HJKMNP-TV-Z]{25})\/[0-7][0-9A-HJKMNP-TV-Z]{25}$/);
+const ConvSource = z.strictObject({ kind: z.literal("conv"), cid: ConvId, event: Ulid });
+export const ToolSource = z.discriminatedUnion("kind", [ConvSource, TaskSource]);
+/** Rendered model result: peer text and names are fenced by the client, never instructions. */
+export const ConversationToolEvent = z.object({
+    cite: Citation, cid: ConvId, id: Ulid, seq: z.number().int().positive().safe(), at: Millis,
+    conv: z.object({ kind: ConvKind, name: Fenced.optional() }), author: Author, thread: Ulid.optional(),
+    text: Fenced.max(LIMITS.toolTextChars).optional(), truncated: z.boolean().optional(), deleted: z.boolean().optional(), nextOffset: z.number().int().nonnegative().optional(),
+}).refine((e) => e.cite === `messaging:${e.cid}/${e.id}`, "citation names this event")
+    .refine((e) => !e.deleted || e.text === undefined, "deleted events contain no text");
+const Held = z.object({ stage: z.literal("held"), code: z.enum(["context", "audience"]), expect: z.literal("on_consent"), note: z.string().max(500) });
+const Events = z.array(ConversationToolEvent).max(50).refine((items) => items.reduce((n, item) => n + new TextEncoder().encode(item.text ?? "").length, 0) <= 32 * 1024, "at most 32 KiB of text");
+const EventPage = z.object({ events: Events, cursor: Cursor, notice: z.string().optional() });
+const Item = z.object({ item: z.union([
+        z.object({ id: Ulid, source: ConvSource, event: ConversationToolEvent }).refine((p) => p.source.cid === p.event.cid && p.source.event === p.event.id, "source names this event"),
+        TaskReadOutput.shape.item,
+    ]), notice: z.string().optional() });
+const Address = z.string().min(1).max(200).describe("me, person, person/agent or #channel");
+export const ConversationTools = {
+    contacts: AgentTool.contacts,
+    conversations: {
+        input: z.strictObject({ cid: ConvId.optional(), limit: Limit, cursor: Cursor }),
+        output: z.object({ conversations: z.array(z.object({ cid: ConvId, kind: ConvKind, name: Fenced.optional(), reason: z.enum(["seat", "allow", "ask"]), lookbackDays: z.number().int().positive().max(365), indexedFrom: Millis.optional(), complete: z.boolean() })).max(50), cursor: Cursor, notice: z.string().optional() }),
+    },
+    send: {
+        input: z.strictObject({ to: Address.optional(), cid: ConvId.optional(), text: z.string().min(1).max(40_000), thread: Ulid.optional(), answer: Ulid.optional(), ask: z.boolean().optional(), clientId: z.string().min(1).max(200).optional(),
+            ...TaskSendFields })
+            .refine((p) => (p.to === undefined) !== (p.cid === undefined), "choose exactly one destination"),
+        output: z.union([z.object({ source: ConvSource, stage: z.literal("pending"), clientId: z.string().max(200), expect: ToolExpect.optional() }),
+            TaskSendOutput, Held]),
+    },
+    inbox: {
+        input: z.strictObject({ unread: z.boolean().optional(), from: ParticipantId.optional(), limit: Limit }),
+        output: z.object({ items: z.array(z.object({ id: Ulid, source: ToolSource, from: Fenced, preview: Fenced.max(2000).optional(), at: Millis, stage: z.enum(["delivered", "handed_to_agent", "read"]),
+                consent: ToolConsentSchema, chain: ToolChainSchema.optional() })).max(50), unread: z.number().int().nonnegative(), notice: z.string().optional() }),
+    },
+    read: {
+        input: z.strictObject({ cid: ConvId.optional(), source: ToolSource.optional(), id: Ulid.optional().describe("A received envelope of the named task"), offset: z.number().int().min(0).max(LIMITS.lineChars).optional(), thread: Ulid.optional(), before: z.string().min(1).max(512).optional(), after: z.string().min(1).max(512).optional(), limit: Limit, cursor: Cursor })
+            .refine((p) => (p.cid === undefined) !== (p.source === undefined), "choose exactly one of cid or source")
+            .refine((p) => [p.before, p.after, p.cursor].filter((v) => v !== undefined).length <= 1, "choose one page position")
+            .refine((p) => p.offset === undefined || p.source?.kind === "conv", "offset requires a conversation event source")
+            .refine((p) => p.id === undefined || p.source?.kind === "task", "envelope id requires its task source")
+            .refine((p) => p.source === undefined || (p.thread === undefined && p.before === undefined && p.after === undefined && p.cursor === undefined), "item reads do not page"),
+        output: z.union([EventPage, Item, Held]),
+    },
+    search: {
+        input: z.strictObject({ query: z.string().min(1).max(200), cid: ConvId.optional(), from: ParticipantId.optional(), after: Millis.optional(), before: Millis.optional(), thread: Ulid.optional(), limit: Limit, cursor: Cursor }),
+        output: z.union([EventPage, Held]),
+    },
+    context: {
+        input: z.strictObject({ cid: ConvId, event: Ulid, before: z.number().int().min(0).max(20).optional(), after: z.number().int().min(0).max(20).optional() }),
+        output: z.union([z.object({ event: ConversationToolEvent, before: Events, after: Events, root: ConversationToolEvent.optional(), notice: z.string().optional() })
+                .refine((p) => p.before.length <= 20 && p.after.length <= 20, "at most 20 neighbours on each side")
+                .refine((p) => [...p.before, ...p.after].reduce((n, e) => n + new TextEncoder().encode(e.text ?? "").length, 0) <= 32 * 1024, "at most 32 KiB of neighbour text"), Held]),
+    },
+    tasks: AgentTool.tasks,
+    task_update: AgentTool.task_update,
+    task_cancel: AgentTool.task_cancel,
+};
+export const CONVERSATION_TOOL_VERBS = ["contacts", "conversations", "send", "inbox", "read", "search", "context", "tasks", "task_update", "task_cancel"];

package/dist/lib/modules/core/federation/directory-proof.js

@@ -0,0 +1,83 @@
+import { z } from "../../vendor/zod/index.js";
+import { parseWith } from "../check.js";
+import { DeviceLog } from "../directory/device-log.js";
+import { adoptSth } from "../directory/epoch.js";
+import { verifyPersonView } from "../directory/person-view.js";
+import { DirectoryRealmConfig, directoryRealmId } from "../directory/realm.js";
+import { DOMAIN, Hash, HostedPersonId } from "../schema/common.js";
+import { KeyRotation } from "../schema/directory.js";
+import { verify } from "../sign.js";
+import { admitForeignProof, checkContext, FOREIGN_BUDGET, FOREIGN_LIMITS, ForeignProofError, proofDigest, proofFailure, requireProof, verifiedProof } from "./proof-state.js";
+const Bundle = z.strictObject({ sth: z.unknown(), head: z.unknown(), view: z.unknown(), rotations: z.array(KeyRotation), consistency: z.array(Hash) });
+/** Key resolution is trusted issuer configuration, never keys embedded in a foreign response.
+ * `options.heads` may only shrink the recent-head working window (tests exercise eviction with a
+ * few heads); it never exceeds FOREIGN_BUDGET.heads. */
+export function verifyForeignDirectory(input, key, options = {}) {
+    const window = options.heads ?? FOREIGN_BUDGET.heads;
+    if (!Number.isSafeInteger(window) || window < 1 || window > FOREIGN_BUDGET.heads)
+        throw new RangeError("invalid-head-window");
+    try {
+        admitForeignProof(input.proof, "directory");
+        checkContext(input, "directory");
+        const person = parseWith(HostedPersonId, input.subject.person, "foreign person");
+        const pin = parseWith(DirectoryRealmConfig, input.pin.root, "directory pin");
+        requireProof(directoryRealmId(pin) === input.pin.realm, "directory-root", "root");
+        const bundle = parseWith(Bundle, input.proof, "directory proof");
+        // Require the full rotation chain from the original pin on every bundle. Strict schemas preserve
+        // signed JSON exactly; they reject extra fields rather than stripping them before verification.
+        // adoptSth intentionally skips already-applied rotations. A full foreign bundle must authenticate
+        // those too, before their keys become service-unbind authorities or enter the retained cursor.
+        let rotationKey = pin.key;
+        for (const rotation of bundle.rotations) {
+            const { sigOld, sigNew, ...unsigned } = rotation;
+            requireProof(verify(rotation.old, DOMAIN.dirKey, unsigned, sigOld) && verify(rotation.new, DOMAIN.dirKey, unsigned, sigNew), "rotation-signature");
+            requireProof(rotation.realm === input.pin.realm && rotation.old === rotationKey && rotation.new !== rotationKey, "rotation-chain");
+            rotationKey = rotation.new;
+        }
+        const anchored = adoptSth(undefined, pin.key, { realm: input.pin.realm, next: bundle.sth, rotations: bundle.rotations });
+        const previous = input.realm?.cursor;
+        const heldHeads = [...(previous?.heads ?? []), ...[input.realm?.head, input.known?.head, input.observedHead].filter((head) => head !== undefined)];
+        const comparable = heldHeads.filter((held) => held.position === anchored.sth.size);
+        for (const held of comparable)
+            requireProof(anchored.sth.root === held.hash, "directory-fork", "fork");
+        for (const held of [input.realm?.head, input.known?.head]) {
+            if (!held)
+                continue;
+            requireProof(anchored.sth.size >= held.position, "directory-rollback", "rollback", comparable.length > 0);
+            requireProof(anchored.sth.ts >= held.issuedAt, "directory-time-rollback", "rollback", comparable.length > 0);
+        }
+        requireProof(!input.known || previous !== undefined, "missing-realm-continuity");
+        const after = previous ? bundle.rotations.findIndex((rotation) => rotation.new === previous.adopted.key) + 1 : 0;
+        let adopted;
+        try {
+            adopted = adoptSth(previous?.adopted, pin.key, { realm: input.pin.realm, next: bundle.sth, rotations: bundle.rotations.slice(after), consistency: bundle.consistency });
+        }
+        catch {
+            // A stale consistency base does not prove compatibility with the current head.
+            throw new ForeignProofError("invalid", "continuity-proof");
+        }
+        const directoryKeys = [pin.key, ...bundle.rotations.map((rotation) => rotation.new)];
+        const context = { realm: input.pin.realm, person, jelly: { issuer: pin.issuer, audience: pin.resource, key }, directoryKeys };
+        const saved = input.known?.cursor;
+        const known = saved ? { person, log: DeviceLog.fromEntries(saved.log, context), keys: new Map(saved.keys.map((statement) => [statement.device, statement])), erased: saved.erased } : undefined;
+        const state = verifyPersonView(bundle.view, { ...context, sth: adopted.sth, head: bundle.head, known });
+        requireProof(state.person === person, "requested-person");
+        requireProof(!known?.erased || state.erased, "erasure-reversal", "rollback");
+        const head = { position: adopted.sth.size, hash: adopted.sth.root, issuedAt: adopted.sth.ts, expiresAt: adopted.sth.ts + FOREIGN_LIMITS.headMs };
+        // A working window, never a lifetime limit. The caller archives every authenticated
+        // observation and supplies observedHead for comparisons outside this window.
+        const heads = [...(previous?.heads ?? []).filter((held) => held.position !== head.position), head].slice(-window);
+        const devices = state.erased ? [] : state.log.devices().map((device) => {
+            const statement = state.keys.get(device.device);
+            return { signingKey: device.device, encryptionKey: statement?.enc, keyVersion: statement?.seq ?? -1, review: null };
+        });
+        const removed = state.log.allDevices().filter((device) => state.erased || !device.current).map((device) => device.device);
+        return verifiedProof({
+            realm: { realm: input.pin.realm, pinDigest: proofDigest(input.pin), head, cursor: { adopted, keys: directoryKeys, heads } },
+            identity: { subject: { ...input.subject }, head, devices, removed, erased: state.erased, proofDigest: proofDigest(input.proof), cursor: { log: [...state.log.entries()], keys: [...state.keys.values()], erased: state.erased } },
+        }, input.now);
+    }
+    catch (error) {
+        return proofFailure(error, input.proof);
+    }
+}

package/dist/lib/modules/core/federation/proof-state.js

@@ -0,0 +1,167 @@
+/** Internal X3-3 boundary. No discovery response is a pin and no result is human approval. */
+import { canonicalize } from "../jcs.js";
+import { sha256 } from "../hash.js";
+import { LIMITS } from "../schema/common.js";
+export const FOREIGN_LIMITS = { fetchMs: 10 * 60_000, headMs: 20 * 60_000, futureMs: LIMITS.clockSkewMs };
+/** Internal work budgets, independent of transport limits. `heads` bounds the recent-head
+ * working window only; the caller's durable archive retains observations beyond it. */
+export const FOREIGN_BUDGET = { proofBytes: 1_048_576, stateBytes: 4_194_304, nodes: 32_768, depth: 32, rosterEntries: 1024, rotations: 64, consistency: 64, heads: 1024 };
+export class ForeignInputError extends Error {
+    constructor() { super("foreign-input-limit"); }
+}
+/** Bound traversal before canonicalization allocates/sorts the complete value. No accessors run. */
+export function checkForeignValue(value, maxBytes = FOREIGN_BUDGET.proofBytes) {
+    let bytes = 0, nodes = 0;
+    const maxNodes = FOREIGN_BUDGET.nodes * Math.max(1, maxBytes / FOREIGN_BUDGET.proofBytes);
+    const add = (size) => { bytes += size; if (bytes > maxBytes)
+        throw new ForeignInputError(); };
+    const text = (s) => {
+        if (s.length > maxBytes - bytes)
+            throw new ForeignInputError();
+        add(Buffer.byteLength(JSON.stringify(s), "utf8"));
+    };
+    const visit = (item, depth) => {
+        if (++nodes > maxNodes)
+            throw new ForeignInputError();
+        if (item === null) {
+            add(4);
+            return;
+        }
+        if (typeof item === "string") {
+            text(item);
+            return;
+        }
+        if (typeof item === "boolean") {
+            add(item ? 4 : 5);
+            return;
+        }
+        if (typeof item === "number" && Number.isFinite(item)) {
+            add(String(item).length);
+            return;
+        }
+        if (typeof item !== "object" || depth >= FOREIGN_BUDGET.depth)
+            throw new ForeignInputError();
+        add(2);
+        if (Array.isArray(item)) {
+            if (item.length > maxNodes - nodes)
+                throw new ForeignInputError();
+            for (let i = 0; i < item.length; i++) {
+                const field = Object.getOwnPropertyDescriptor(item, String(i));
+                if (!field || !("value" in field))
+                    throw new ForeignInputError();
+                if (i)
+                    add(1);
+                visit(field.value, depth + 1);
+            }
+            return;
+        }
+        const proto = Object.getPrototypeOf(item);
+        if (proto !== Object.prototype && proto !== null && Object.getPrototypeOf(proto) !== null)
+            throw new ForeignInputError();
+        let count = 0;
+        for (const key in item) {
+            if (!Object.hasOwn(item, key))
+                continue;
+            if (++nodes > maxNodes)
+                throw new ForeignInputError();
+            const field = Object.getOwnPropertyDescriptor(item, key);
+            if (!("value" in field))
+                throw new ForeignInputError();
+            if (field.value === undefined)
+                continue;
+            if (count++)
+                add(1);
+            text(key);
+            add(1);
+            visit(field.value, depth + 1);
+        }
+    };
+    visit(value, 0);
+}
+export function admitForeignProof(proof, kind) {
+    checkForeignValue(proof);
+    if (typeof proof !== "object" || proof === null)
+        return; // The verifier owns schema errors.
+    const bundle = proof;
+    const collection = (name, max) => {
+        const entries = bundle[name];
+        if (Array.isArray(entries) && entries.length > max)
+            throw new ForeignInputError();
+    };
+    if (kind === "roster") {
+        collection("entries", FOREIGN_BUDGET.rosterEntries);
+        if (Array.isArray(bundle.entries))
+            for (const entry of bundle.entries)
+                checkForeignValue(entry, LIMITS.rosterEntryBytes);
+    }
+    else {
+        collection("rotations", FOREIGN_BUDGET.rotations);
+        collection("consistency", FOREIGN_BUDGET.consistency);
+    }
+}
+export class ForeignProofError extends Error {
+    reason;
+    code;
+    compatible;
+    constructor(reason, code, compatible = false) {
+        super(code);
+        this.reason = reason;
+        this.code = code;
+        this.compatible = compatible;
+    }
+}
+export function requireProof(condition, code, reason = "invalid", compatible = false) {
+    if (!condition)
+        throw new ForeignProofError(reason, code, compatible);
+}
+export function proofDigest(value) { checkForeignValue(value); return sha256(canonicalize(value)); }
+export function proofFailure(error, proof) {
+    let digest;
+    if (error instanceof ForeignInputError)
+        return { ok: false, reason: "invalid", evidence: { code: "foreign-input-limit", digest: sha256("foreign-input-limit") } };
+    try {
+        digest = proofDigest(proof);
+    }
+    catch {
+        digest = sha256("non-json-proof");
+    }
+    return { ok: false, reason: error instanceof ForeignProofError && error.reason !== "stale" ? error.reason : "invalid", evidence: { code: error instanceof ForeignProofError ? error.code : "invalid-proof", digest, ...(error instanceof ForeignProofError && error.reason === "rollback" && error.compatible ? { compatible: true } : {}) } };
+}
+/** Expiry changes key eligibility, never the authenticated history we must retain. */
+export function verifiedProof(verified, now) {
+    try {
+        checkHeadTime(verified.realm.head, now);
+    }
+    catch (error) {
+        if (!(error instanceof ForeignProofError) || error.reason !== "stale")
+            throw error;
+        return { ok: false, reason: "stale", verified, evidence: { code: error.code, digest: verified.identity.proofDigest } };
+    }
+    return { ok: true, ...verified };
+}
+export function checkContext(input, kind) {
+    requireProof(Number.isSafeInteger(input.now) && input.now >= 0, "clock");
+    requireProof(input.pin.kind === kind && input.subject.realm === input.pin.realm, "pinned-realm", "root");
+    if (input.realm)
+        requireProof(input.realm.realm === input.pin.realm && input.realm.pinDigest === proofDigest(input.pin), "known-root", "root");
+    if (input.known)
+        requireProof(input.known.subject.realm === input.subject.realm && input.known.subject.person === input.subject.person, "known-person");
+}
+export function checkHeadTime(head, now) {
+    requireProof(Number.isSafeInteger(head.issuedAt) && Number.isSafeInteger(head.expiresAt), "head-time");
+    requireProof(head.issuedAt <= now + FOREIGN_LIMITS.futureMs, "future-head");
+    requireProof(head.expiresAt > head.issuedAt && head.expiresAt - head.issuedAt <= FOREIGN_LIMITS.headMs, "head-lifetime");
+    requireProof(now - head.issuedAt <= FOREIGN_LIMITS.headMs && now < head.expiresAt, "expired-head", "stale");
+}
+/** Caller clock only. A future local fetch time (including clock rollback) fails closed. */
+export function foreignFresh(head, fetchedAt, now) {
+    if (!Number.isSafeInteger(now) || !Number.isSafeInteger(fetchedAt) || fetchedAt > now || now - fetchedAt > FOREIGN_LIMITS.fetchMs)
+        return false;
+    try {
+        checkHeadTime(head, now);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/lib/modules/core/federation/roster-proof.js

@@ -0,0 +1,74 @@
+import { z } from "../../vendor/zod/index.js";
+import { parseWith } from "../check.js";
+import { Roster, entryHash } from "../roster.js";
+import { Hash, MachineId, Millis, PersonName } from "../schema/common.js";
+import { verify } from "../sign.js";
+import { admitForeignProof, checkContext, proofDigest, proofFailure, requireProof, verifiedProof } from "./proof-state.js";
+/** Internal until X3-2/3 supplies the normative contract. */
+export const DOMAIN = { rosterCheckpoint: "messaging/1/federation/roster-checkpoint\n" };
+const Checkpoint = z.strictObject({ realm: Hash, seq: z.number().int().nonnegative(), hash: Hash, issuedAt: Millis, expiresAt: Millis, by: MachineId, sig: z.string() });
+const Bundle = z.strictObject({ entries: z.array(z.unknown()).min(1), checkpoint: z.unknown() });
+/** Full history only; the caller has separately authorized its disclosure. */
+export function verifyForeignRoster(input) {
+    try {
+        admitForeignProof(input.proof, "roster");
+        checkContext(input, "roster");
+        parseWith(PersonName, input.subject.person, "foreign person");
+        const pin = parseWith(z.strictObject({ genesis: Hash }), input.pin.root, "roster pin");
+        requireProof(pin.genesis === input.pin.realm, "genesis-pin", "root");
+        const bundle = parseWith(Bundle, input.proof, "roster proof");
+        // Roster retains and verifies raw signed entries, including unknown signed fields.
+        const roster = Roster.fromEntries(bundle.entries);
+        requireProof(roster.realm === pin.genesis, "genesis-root", "root");
+        const raw = bundle.checkpoint;
+        requireProof(typeof raw === "object" && raw !== null, "checkpoint-shape");
+        const { sig, ...unsigned } = raw;
+        requireProof(typeof raw.by === "string" && typeof sig === "string" && verify(raw.by, DOMAIN.rosterCheckpoint, unsigned, sig), "checkpoint-signature");
+        const checkpoint = parseWith(Checkpoint, raw, "roster checkpoint");
+        const current = roster.head();
+        requireProof(checkpoint.realm === input.pin.realm, "checkpoint-realm");
+        requireProof(checkpoint.seq === current.seq && checkpoint.hash === current.hash, "checkpoint-head");
+        requireProof(roster.isAdmin(checkpoint.by), "checkpoint-admin");
+        // Compare every available common prefix before classifying an older response as rollback.
+        // The realm cursor also protects persons for whom we have never retained a separate view.
+        const hashes = roster.entries().map(entryHash);
+        for (const held of [input.realm, input.known]) {
+            if (!held)
+                continue;
+            const position = Math.min(current.seq, held.head.position);
+            const expected = position === held.head.position ? held.head.hash : held.cursor.hashes[position];
+            requireProof(hashes[position] === expected, "roster-fork", "fork");
+        }
+        for (const held of [input.realm?.head, input.known?.head]) {
+            if (!held)
+                continue;
+            requireProof(current.seq >= held.position, "roster-rollback", "rollback", true);
+            requireProof(checkpoint.issuedAt >= held.issuedAt, "checkpoint-rollback", "rollback", true);
+        }
+        const head = { position: current.seq, hash: current.hash, issuedAt: checkpoint.issuedAt, expiresAt: checkpoint.expiresAt };
+        const removed = new Set();
+        const people = new Map();
+        const reviews = new Map();
+        const versions = new Map();
+        for (const entry of roster.entries()) {
+            const member = entry.kind === "genesis" ? entry.body.founder : entry.kind === "member.add" ? entry.body : entry.kind === "invite.redeem" ? entry.body.member : undefined;
+            if (member)
+                people.set(member.machine, member.person);
+            if (entry.kind === "member.remove" && people.get(entry.body.machine) === input.subject.person)
+                removed.add(entry.body.machine);
+            if (entry.kind === "member.rekey") {
+                versions.set(entry.body.machine, entry.seq);
+                if (entry.by !== entry.body.machine)
+                    reviews.set(entry.body.machine, entryHash(entry));
+            }
+        }
+        const devices = roster.members().filter((member) => member.person === input.subject.person).map((member) => ({ signingKey: member.machine, encryptionKey: member.enc, keyVersion: versions.get(member.machine) ?? 0, review: reviews.get(member.machine) ?? null }));
+        return verifiedProof({
+            realm: { realm: input.pin.realm, pinDigest: proofDigest(input.pin), head, cursor: { hashes } },
+            identity: { subject: { ...input.subject }, head, devices, removed: [...removed], erased: false, proofDigest: proofDigest(input.proof), cursor: { hashes } },
+        }, input.now);
+    }
+    catch (error) {
+        return proofFailure(error, input.proof);
+    }
+}