@mcsherrylabs/evolver-mcp 0.11.0 → 0.13.0

package/dist/group-crypto.js

@@ -0,0 +1,135 @@
+// SDK-only inline crypto. No signing, submission, membership or key lifecycle mutation.
+import { randomGroupKey, wrapGroupKey, encryptMessage, decryptMessage, edSpkiToRaw, edToX25519Pub, hexToBytes, isValidPrincipalName } from "@mcsherrylabs/evolver-client";
+import { ok, partial } from "./result.js";
+import { GroupKeyHandles } from "./group-keys.js";
+import { validScope, validKeyLabel } from "./group-key-provider.js";
+export const GROUP_MESSAGE_MAX_BYTES = 32_768;
+// SDK0.21.1 AES-GCM message framing: 12-byte IV + plaintext + 16-byte tag.
+export const GROUP_CIPHERTEXT_MAX_BYTES = GROUP_MESSAGE_MAX_BYTES + 28;
+export const PLAINTEXT_CONFIRMATION = "return plaintext to this MCP client";
+/** Canonical padded RFC4648 base64 only; bound string BEFORE decoding. No coercion/whitespace. */
+export function groupCryptoBase64(input, minBytes, maxBytes) {
+    if (typeof input !== "string" || input.length > 4 * Math.ceil(maxBytes / 3) ||
+        !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(input))
+        throw new Error("invalid encoding or size");
+    const bytes = Buffer.from(input, "base64");
+    if (bytes.length < minBytes || bytes.length > maxBytes || bytes.toString("base64") !== input)
+        throw new Error("invalid encoding or size");
+    return bytes;
+}
+const base64 = (v) => Buffer.from(v).toString("base64");
+/** One instance per stdio process/client; injected capability, no singleton cross-client store. */
+export class GroupCrypto {
+    provider;
+    reads;
+    handles;
+    constructor(provider, reads) {
+        this.provider = provider;
+        this.reads = reads;
+        this.handles = new GroupKeyHandles(provider.identity);
+    }
+    #scope(scope) {
+        if (!validScope(scope) || !this.provider.scopes.includes(scope))
+            throw new Error("scope not authorized by host");
+    }
+    async #guard(operation) {
+        try {
+            return ok(await operation());
+        }
+        // SDK/provider/node exceptions may include supplied material. Never echo them into MCP/logs.
+        catch {
+            return partial("group crypto", "refused: invalid/unauthorized scope, recipient, handle, encoding, size or TTL; authentication failure, key unavailable or operation expired/disposed. No plaintext returned.");
+        }
+    }
+    create(scope, ttlSeconds) {
+        return this.#guard(async () => {
+            this.#scope(scope);
+            const key = randomGroupKey();
+            try {
+                return this.handles.insert(scope, key, ttlSeconds);
+            }
+            finally {
+                key.fill(0);
+            }
+        });
+    }
+    wrap(scope, handle, recipient) {
+        return this.#guard(async () => {
+            this.#scope(scope);
+            if (!recipient || !isValidPrincipalName(recipient.identity) || !validKeyLabel(recipient.keyLabel) ||
+                recipient.keyType !== "Ed25519" || !this.provider.approvedRecipients.some(r => r.identity === recipient.identity && r.keyType === recipient.keyType && r.keyLabel === recipient.keyLabel))
+                throw new Error("recipient not approved or unsupported");
+            // Do not resolve against stale applied state, even when it happens to contain a matching key.
+            const state = await this.reads.nodeStatus();
+            if (!Number.isSafeInteger(state.blockHeight) || state.blockHeight < 0 ||
+                (state.appliedRound !== null && (!Number.isSafeInteger(state.appliedRound) || state.appliedRound !== state.blockHeight)))
+                throw new Error("applied-state lag or unknown freshness");
+            const rows = await this.reads.getIdentityKeys(recipient.identity);
+            if (!Array.isArray(rows))
+                throw new Error("recipient unavailable");
+            const matches = rows.filter(r => r.nodeId === recipient.identity && r.keyType === recipient.keyType && r.label === recipient.keyLabel);
+            if (matches.length !== 1)
+                throw new Error("missing or ambiguous recipient key");
+            // Strictly validate hex before SDK conversion; never guess type or manually strip SPKI.
+            const hex = matches[0].publicKeyHex;
+            if (typeof hex !== "string" || !/^(?:[a-fA-F0-9]{2}){1,128}$/.test(hex))
+                throw new Error("invalid public key");
+            const pub = edToX25519Pub(edSpkiToRaw(hexToBytes(hex)));
+            return this.handles.withKey(scope, handle, async (key) => {
+                const wrapped = await wrapGroupKey(key, pub);
+                return { scope, recipient, ephPubBase64: base64(wrapped.ephPub), blobBase64: base64(wrapped.blob) };
+            });
+        });
+    }
+    unwrap(scope, ephPubBase64, blobBase64, ttlSeconds) {
+        return this.#guard(async () => {
+            this.#scope(scope);
+            const wrapped = { ephPub: groupCryptoBase64(ephPubBase64, 32, 32), blob: groupCryptoBase64(blobBase64, 60, 60) };
+            const key = await this.provider.unwrap(wrapped);
+            try {
+                return this.handles.insert(scope, key, ttlSeconds);
+            }
+            finally {
+                key.fill(0);
+            }
+        });
+    }
+    encrypt(scope, handle, plaintextBase64) {
+        return this.#guard(async () => {
+            this.#scope(scope);
+            const plaintext = groupCryptoBase64(plaintextBase64, 0, GROUP_MESSAGE_MAX_BYTES);
+            try {
+                return await this.handles.withKey(scope, handle, async (key) => ({
+                    scope, ciphertextBase64: base64(await encryptMessage(key, plaintext)), plaintextBytes: plaintext.length,
+                }));
+            }
+            finally {
+                plaintext.fill(0);
+            }
+        });
+    }
+    decrypt(scope, handle, ciphertextBase64, confirmation) {
+        return this.#guard(async () => {
+            this.#scope(scope);
+            if (!this.provider.allowPlaintext || confirmation !== PLAINTEXT_CONFIRMATION)
+                throw new Error("plaintext not authorized");
+            const ciphertext = groupCryptoBase64(ciphertextBase64, 28, GROUP_CIPHERTEXT_MAX_BYTES);
+            return this.handles.withKey(scope, handle, async (key) => {
+                // SDK GCM authentication MUST complete before converting or returning any plaintext.
+                const plaintext = await decryptMessage(key, ciphertext);
+                try {
+                    if (plaintext.length > GROUP_MESSAGE_MAX_BYTES)
+                        throw new Error("output exceeds bound");
+                    return { scope, plaintextBase64: base64(plaintext), plaintextBytes: plaintext.length };
+                }
+                finally {
+                    plaintext.fill(0);
+                }
+            });
+        });
+    }
+    dispose(scope, handle) {
+        return this.#guard(async () => { this.#scope(scope); this.handles.dispose(scope, handle); return { disposed: true }; });
+    }
+}
+//# sourceMappingURL=group-crypto.js.map

package/dist/group-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-crypto.js","sourceRoot":"","sources":["../src/group-crypto.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAC3G,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,GAAG,EAAE,CAAC;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAE5E,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,QAAgB,EAAE,QAAgB;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvE,CAAC,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK;QAC1F,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEpE,mGAAmG;AACnG,MAAM,OAAO,WAAW;IAED;IAA6C;IADzD,OAAO,CAAkB;IAClC,YAAqB,QAA0B,EAAmB,KAAiB;QAA9D,aAAQ,GAAR,QAAQ,CAAkB;QAAmB,UAAK,GAAL,KAAK,CAAY;QACjF,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,CAAC,KAAc;QACnB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,SAAiC;QAC5C,IAAI,CAAC;YAAC,OAAO,EAAE,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;QACrC,6FAA6F;QAC7F,MAAM,CAAC;YAAC,OAAO,OAAO,CAAC,cAAc,EAAE,8KAA8K,CAAC,CAAC;QAAC,CAAC;IAC3N,CAAC;IACD,MAAM,CAAC,KAAc,EAAE,UAAmB;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;YAC7B,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAc,EAAE,MAAc,EAAE,SAA4B;QAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,CAAC,SAAS,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC7F,SAAS,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC5E,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC;gBAC9G,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,8FAA8F;YAC9F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC;gBACjE,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,QAAQ,CAAC,CAAC;YACvI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAChF,wFAAwF;YACxF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,YAAY,CAAC;YACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC/G,MAAM,GAAG,GAAG,aAAa,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;gBACrD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtG,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,KAAc,EAAE,YAAqB,EAAE,UAAmB,EAAE,UAAmB;QACpF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YACjH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,KAAc,EAAE,MAAc,EAAE,eAAwB;QAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,MAAM,SAAS,GAAG,iBAAiB,CAAC,eAAe,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAAC;YACjF,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,CAAC;oBAC7D,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM;iBACxG,CAAC,CAAC,CAAC;YACN,CAAC;oBAAS,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,KAAc,EAAE,MAAc,EAAE,gBAAyB,EAAE,YAAqB;QACtF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,YAAY,KAAK,sBAAsB;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC1H,MAAM,UAAU,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;gBACrD,qFAAqF;gBACrF,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACxD,IAAI,CAAC;oBACH,IAAI,SAAS,CAAC,MAAM,GAAG,uBAAuB;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;oBACxF,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;gBACzF,CAAC;wBAAS,CAAC;oBAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,KAAc,EAAE,MAAc;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1H,CAAC;CACF"}

package/dist/group-key-provider.d.ts

@@ -0,0 +1,30 @@
+import type { GroupKeyUnwrapper } from "@mcsherrylabs/evolver-client";
+export interface GroupKeyRecipient {
+    readonly identity: string;
+    readonly keyType: "Ed25519" | "X25519";
+    readonly keyLabel: string;
+}
+/** Host policy + SDK decryption capability. NEVER inject the private seed or a Signer here.
+ * unwrap returns a symmetric key only to host code, which immediately puts it in GroupKeyHandles.
+ * These are process-owned policies, not client-supplied authorization assertions. */
+export interface GroupKeyProvider extends GroupKeyUnwrapper {
+    readonly identity: string;
+    readonly keyType: "Ed25519" | "X25519";
+    readonly keyLabel: string;
+    readonly scopes: readonly string[];
+    readonly approvedRecipients: readonly GroupKeyRecipient[];
+    readonly allowPlaintext: boolean;
+}
+export declare const validScope: (v: unknown) => v is string;
+export declare const validKeyLabel: (v: unknown) => v is string;
+/** Dedicated host secret file: absolute, no symlink, owned regular file, mode 0600/0400 only,
+ * at most 128 bytes, containing a 32-byte hex Ed seed or native X25519 scalar. No persistence
+ * of AES keys. Host admins must protect ancestor directories, backups, env and process memory. */
+export declare function loadGroupKeyProviderFromEnv(env: NodeJS.ProcessEnv, identity: string): {
+    ok: true;
+    provider?: GroupKeyProvider;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=group-key-provider.d.ts.map

package/dist/group-key-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-key-provider.d.ts","sourceRoot":"","sources":["../src/group-key-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;qFAEqF;AACrF,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,eAAO,MAAM,UAAU,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAC2B,CAAC;AACzE,eAAO,MAAM,aAAa,GAAI,GAAG,OAAO,KAAG,CAAC,IAAI,MAC8B,CAAC;AAE/E;;kGAEkG;AAClG,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,GACvC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgD1E"}

package/dist/group-key-provider.js

@@ -0,0 +1,72 @@
+// Explicit encryption capability, independent of Signer. This module never reads signer env.
+import { constants, openSync, fstatSync, readFileSync, closeSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { edGroupKeyUnwrapper, x25519GroupKeyUnwrapper, isValidPrincipalName } from "@mcsherrylabs/evolver-client";
+export const validScope = (v) => typeof v === "string" && /^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(v);
+export const validKeyLabel = (v) => typeof v === "string" && v.length <= 128 && !/[\u0000-\u001f\u007f]/.test(v);
+/** Dedicated host secret file: absolute, no symlink, owned regular file, mode 0600/0400 only,
+ * at most 128 bytes, containing a 32-byte hex Ed seed or native X25519 scalar. No persistence
+ * of AES keys. Host admins must protect ancestor directories, backups, env and process memory. */
+export function loadGroupKeyProviderFromEnv(env, identity) {
+    const names = ["KEY_FILE", "KEY_TYPE", "KEY_LABEL", "SCOPES", "RECIPIENTS", "ALLOW_PLAINTEXT"];
+    if (!names.some(n => env[`EVOLVER_GROUP_CRYPTO_${n}`] !== undefined))
+        return { ok: true };
+    let fd;
+    let secret;
+    try {
+        const path = env.EVOLVER_GROUP_CRYPTO_KEY_FILE;
+        const keyType = env.EVOLVER_GROUP_CRYPTO_KEY_TYPE;
+        const keyLabel = env.EVOLVER_GROUP_CRYPTO_KEY_LABEL ?? "";
+        if (!path || !isAbsolute(path) || !["Ed25519", "X25519"].includes(keyType ?? "") ||
+            !validKeyLabel(keyLabel) || !isValidPrincipalName(identity))
+            throw new Error();
+        const scopes = JSON.parse(env.EVOLVER_GROUP_CRYPTO_SCOPES ?? "null");
+        const recipients = JSON.parse(env.EVOLVER_GROUP_CRYPTO_RECIPIENTS ?? "null");
+        if (!Array.isArray(scopes) || scopes.length < 1 || scopes.length > 32 || !scopes.every(validScope) ||
+            new Set(scopes).size !== scopes.length || !Array.isArray(recipients) || recipients.length > 64)
+            throw new Error();
+        for (const r of recipients) {
+            if (!r || typeof r !== "object" || Object.keys(r).sort().join(",") !== "identity,keyLabel,keyType" ||
+                !isValidPrincipalName(r.identity) || !["Ed25519", "X25519"].includes(r.keyType) || !validKeyLabel(r.keyLabel))
+                throw new Error();
+        }
+        const plaintext = env.EVOLVER_GROUP_CRYPTO_ALLOW_PLAINTEXT;
+        if (plaintext !== undefined && plaintext !== "0" && plaintext !== "1")
+            throw new Error();
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const st = fstatSync(fd);
+        if (!st.isFile() || st.size > 128 || st.uid !== process.getuid?.() || (st.mode & 0o777) & ~0o600 ||
+            !(st.mode & 0o400))
+            throw new Error();
+        secret = readFileSync(fd);
+        // Do not include file contents, paths, JSON parse errors or SDK exceptions in diagnostics.
+        const hex = secret.toString("utf8").trim();
+        if (!/^[a-fA-F0-9]{64}$/.test(hex))
+            throw new Error();
+        const seed = Buffer.from(hex, "hex");
+        let unwrapper;
+        try {
+            unwrapper = keyType === "Ed25519" ? edGroupKeyUnwrapper(seed) : x25519GroupKeyUnwrapper(new Uint8Array(seed));
+        }
+        finally {
+            seed.fill(0);
+        }
+        const provider = Object.freeze({
+            identity, keyType: keyType, keyLabel,
+            scopes: Object.freeze([...scopes]),
+            approvedRecipients: Object.freeze(recipients.map(r => Object.freeze({ ...r }))),
+            allowPlaintext: plaintext === "1",
+            unwrap: (w) => unwrapper.unwrap(w),
+        });
+        return { ok: true, provider };
+    }
+    catch {
+        return { ok: false, error: "invalid group encryption provider: require explicit Ed25519/X25519 KEY_TYPE, protected owned KEY_FILE, SCOPES and RECIPIENTS policy; BLS/signing keys cannot unwrap" };
+    }
+    finally {
+        secret?.fill(0);
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+//# sourceMappingURL=group-key-provider.js.map

package/dist/group-key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-key-provider.js","sourceRoot":"","sources":["../src/group-key-provider.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAqBlH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAU,EAAe,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,IAAI,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAU,EAAe,EAAE,CACvD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE/E;;kGAEkG;AAClG,MAAM,UAAU,2BAA2B,CACzC,GAAsB,EAAE,QAAgB;IAExC,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1F,IAAI,EAAsB,CAAC;IAC3B,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,6BAA6B,CAAC;QAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC;QAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;YAC5E,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACnF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,IAAI,MAAM,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,IAAI,MAAM,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtH,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,2BAA2B;gBAC9F,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACvI,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,oCAAoC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACzF,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK;YAC5F,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC1C,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1B,2FAA2F;QAC3F,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,SAA4B,CAAC;QACjC,IAAI,CAAC;YACH,SAAS,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAChH,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3B,MAAM,QAAQ,GAAqB,MAAM,CAAC,MAAM,CAAC;YAC/C,QAAQ,EAAE,OAAO,EAAE,OAAsC,EAAE,QAAQ;YACnE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,cAAc,EAAE,SAAS,KAAK,GAAG;YACjC,MAAM,EAAE,CAAC,CAA6C,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qKAAqK,EAAE,CAAC;IACrM,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/group-keys.d.ts

@@ -0,0 +1,34 @@
+export declare const GROUP_KEY_TTL_SECONDS = 900;
+export declare const GROUP_KEY_MAX_TTL_SECONDS = 3600;
+export declare const GROUP_KEY_MAX_HANDLES = 128;
+export interface GroupKeyHandle {
+    readonly handle: string;
+    readonly scope: string;
+    readonly expiresAt: number;
+}
+/** Host-only stream/output authorization. Never return this object or the callback key to tools.
+ * commit() is called synchronously at the output boundary after its final authorization check.
+ * A completed commit stays a truthful success even if disposal happens while returning metadata. */
+export interface GroupKeyLease {
+    readonly signal: AbortSignal;
+    check(): void;
+    commit(): void;
+}
+export declare class GroupKeyHandles {
+    #private;
+    readonly owner: string;
+    private readonly now;
+    constructor(owner: string, now?: () => number);
+    insert(scope: string, key: Uint8Array, ttlSeconds?: number): GroupKeyHandle;
+    /** Never expose this callback or key to tools. It MUST NOT return key material. A temporary
+     * copy keeps asynchronous SDK calls safe from zeroization; disposal/expiry invalidates their
+     * result. All copies are wiped even on rejection. Owner is fixed by the injected store instance. */
+    withKey<T>(scope: string, handle: string, operation: (key: Uint8Array) => Promise<T>): Promise<T>;
+    /** Unlike withKey's inline-result check, a stream lease spans ACTUAL consumption and output
+     * completion. Disposal/expiry aborts pending IO; check() also observes an injected clock.
+     * Call commit ONLY after an output's final authorization check, never before async staging. */
+    withLease<T>(scope: string, handle: string, operation: (key: Uint8Array, lease: GroupKeyLease) => Promise<T>): Promise<T>;
+    dispose(scope: string, handle: string): void;
+    close(): void;
+}
+//# sourceMappingURL=group-keys.d.ts.map

package/dist/group-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-keys.d.ts","sourceRoot":"","sources":["../src/group-keys.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,MAAM,WAAW,cAAc;IAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAC/G;;oGAEoG;AACpG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC;IACd,MAAM,IAAI,IAAI,CAAC;CAChB;AAGD,qBAAa,eAAe;;IAGd,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAnC,KAAK,EAAE,MAAM,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAEjF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,SAAwB,GAAG,cAAc;IAa1F;;wGAEoG;IAC9F,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAUvG;;mGAE+F;IACzF,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAc/H,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAC5C,KAAK,IAAI,IAAI;CAYd"}

package/dist/group-keys.js

@@ -0,0 +1,88 @@
+// Process-local, owner/scope-bound opaque AES-key handles. Host-only API for inline/stream crypto.
+import { randomUUID } from "node:crypto";
+import { validScope } from "./group-key-provider.js";
+export const GROUP_KEY_TTL_SECONDS = 900;
+export const GROUP_KEY_MAX_TTL_SECONDS = 3600;
+export const GROUP_KEY_MAX_HANDLES = 128;
+export class GroupKeyHandles {
+    owner;
+    now;
+    #entries = new Map();
+    #closed = false;
+    constructor(owner, now = Date.now) {
+        this.owner = owner;
+        this.now = now;
+    }
+    insert(scope, key, ttlSeconds = GROUP_KEY_TTL_SECONDS) {
+        this.#sweep();
+        if (this.#closed || !validScope(scope) || key.length !== 32 || !Number.isSafeInteger(ttlSeconds) ||
+            ttlSeconds < 1 || ttlSeconds > GROUP_KEY_MAX_TTL_SECONDS || this.#entries.size >= GROUP_KEY_MAX_HANDLES)
+            throw new Error("group key store unavailable, invalid key/TTL/scope, or handle capacity reached");
+        const handle = `gk_${randomUUID()}`;
+        const expiresAt = this.now() + ttlSeconds * 1000;
+        const timer = setTimeout(() => this.#remove(handle), ttlSeconds * 1000);
+        timer.unref();
+        this.#entries.set(handle, { key: new Uint8Array(key), scope, expiresAt, timer, lifetime: new AbortController() });
+        return { handle, scope, expiresAt };
+    }
+    /** Never expose this callback or key to tools. It MUST NOT return key material. A temporary
+     * copy keeps asynchronous SDK calls safe from zeroization; disposal/expiry invalidates their
+     * result. All copies are wiped even on rejection. Owner is fixed by the injected store instance. */
+    async withKey(scope, handle, operation) {
+        const entry = this.#get(scope, handle);
+        const copy = new Uint8Array(entry.key);
+        try {
+            const result = await operation(copy);
+            if (this.#get(scope, handle) !== entry)
+                throw new Error("group key handle no longer valid");
+            return result;
+        }
+        finally {
+            copy.fill(0);
+        }
+    }
+    /** Unlike withKey's inline-result check, a stream lease spans ACTUAL consumption and output
+     * completion. Disposal/expiry aborts pending IO; check() also observes an injected clock.
+     * Call commit ONLY after an output's final authorization check, never before async staging. */
+    async withLease(scope, handle, operation) {
+        const entry = this.#get(scope, handle);
+        const copy = new Uint8Array(entry.key);
+        let committed = false;
+        const check = () => { if (this.#get(scope, handle) !== entry)
+            throw new Error("group key handle no longer valid"); };
+        const lease = Object.freeze({ signal: entry.lifetime.signal, check,
+            commit: () => { check(); committed = true; } });
+        try {
+            const result = await operation(copy, lease);
+            if (!committed)
+                check();
+            return result;
+        }
+        finally {
+            copy.fill(0);
+        }
+    }
+    dispose(scope, handle) { this.#get(scope, handle); this.#remove(handle); }
+    close() { this.#closed = true; for (const h of this.#entries.keys())
+        this.#remove(h); }
+    #get(scope, handle) {
+        this.#sweep();
+        const entry = this.#entries.get(handle);
+        if (this.#closed || !entry || entry.scope !== scope)
+            throw new Error("invalid, expired, disposed or foreign-scope group key handle");
+        return entry;
+    }
+    #sweep() { for (const [h, e] of this.#entries)
+        if (e.expiresAt <= this.now())
+            this.#remove(h); }
+    #remove(handle) {
+        const entry = this.#entries.get(handle);
+        if (entry) {
+            clearTimeout(entry.timer);
+            entry.key.fill(0);
+            this.#entries.delete(handle);
+            entry.lifetime.abort();
+        }
+    }
+}
+//# sourceMappingURL=group-keys.js.map

package/dist/group-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-keys.js","sourceRoot":"","sources":["../src/group-keys.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAYzC,MAAM,OAAO,eAAe;IAGL;IAAgC;IAF5C,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IAC7C,OAAO,GAAG,KAAK,CAAC;IAChB,YAAqB,KAAa,EAAmB,MAAoB,IAAI,CAAC,GAAG;QAA5D,UAAK,GAAL,KAAK,CAAQ;QAAmB,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAErF,MAAM,CAAC,KAAa,EAAE,GAAe,EAAE,UAAU,GAAG,qBAAqB;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YAC5F,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,yBAAyB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,qBAAqB;YACzG,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;QACxE,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,eAAe,EAAE,EAAE,CAAC,CAAC;QAClH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAED;;wGAEoG;IACpG,KAAK,CAAC,OAAO,CAAI,KAAa,EAAE,MAAc,EAAE,SAA0C;QACxF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC5F,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC7B,CAAC;IAED;;mGAE+F;IAC/F,KAAK,CAAC,SAAS,CAAI,KAAa,EAAE,MAAc,EAAE,SAAgE;QAChH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,MAAM,KAAK,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK;YAC/E,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,KAAK,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,MAAc,IAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,KAAK,KAAW,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAa,EAAE,MAAc;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACrI,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAW,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,OAAO,CAAC,MAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACpH,CAAC;CACF"}

package/dist/group-ownership.d.ts

@@ -0,0 +1,78 @@
+import type { Signer } from "@mcsherrylabs/evolver-client";
+import type { ChainReads } from "./read.js";
+import type { ToolResult } from "./result.js";
+import type { SignedGroup } from "./write.js";
+export interface OwnershipDeps {
+    readonly identity: string;
+    readonly signer: Signer;
+    readonly reads: ChainReads;
+}
+/** Rounds of life for a two-party transfer. Longer than `DEFAULT_TTL_OFFSET` (50, sized for no
+ *  human wait) because a second party must act, but never beyond the node's default
+ *  `max-ttl-offset` (RoutingConfig.DefaultMaxTtlOffset = 100): a longer ttl is `ttl_too_far`, and
+ *  a long-lived co-signed envelope is a bearer artefact. The default stays 10 rounds inside that
+ *  bound so the two parties' nodes may disagree slightly about the tip. Expiry is final. */
+export declare const OWNERSHIP_TTL_MAX = 100;
+export declare const OWNERSHIP_TTL_DEFAULT = 90;
+/** The one key type whose consent can be verified with a published SDK primitive. */
+export declare const CONSENT_KEY_TYPE = "Ed25519";
+export declare const INTENT_KIND = "evolver.group_ownership_intent.v1";
+export declare const CONSENT_KIND = "evolver.group_ownership_consent.v1";
+declare const PURPOSE = "AUTHORIZE";
+export interface OwnershipIntent {
+    readonly kind: typeof INTENT_KIND;
+    readonly txId: string;
+    readonly ledgerId: string;
+    readonly groupName: string;
+    readonly outgoingOwner: string;
+    readonly incomingOwner: string;
+    readonly expiresAtRound: number;
+    readonly preparedAtRound: number;
+    readonly maxToll: "0";
+    readonly next: string;
+}
+export interface OwnershipConsent {
+    readonly kind: typeof CONSENT_KIND;
+    readonly txId: string;
+    readonly ledgerId: string;
+    readonly groupName: string;
+    readonly outgoingOwner: string;
+    readonly incomingOwner: string;
+    readonly expiresAtRound: number;
+    readonly maxToll: "0";
+    readonly auth: {
+        readonly nodeId: string;
+        readonly keyType: string;
+        readonly keyLabel: string;
+        readonly purpose: typeof PURPOSE;
+        readonly signatureHex: string;
+    };
+    readonly next: string;
+}
+/**
+ * PREPARE (outgoing owner). Signs nothing; returns the public intent for the incoming owner.
+ */
+export declare function prepareOwnershipTransfer(deps: OwnershipDeps, params: {
+    groupName: unknown;
+    incomingOwner: unknown;
+    ttlRounds?: unknown;
+}): Promise<ToolResult<OwnershipIntent>>;
+/**
+ * CONSENT (incoming owner). Recomputes the intent's txId and signs it with THIS session's key.
+ */
+export declare function consentOwnershipTransfer(deps: OwnershipDeps, params: {
+    txId: unknown;
+    groupName: unknown;
+    outgoingOwner: unknown;
+    incomingOwner: unknown;
+    expiresAtRound: unknown;
+}): Promise<ToolResult<OwnershipConsent>>;
+/**
+ * FINALIZE (outgoing owner). Verifies the consent, signs as sender, assembles both auths, records.
+ */
+export declare function finalizeOwnershipTransfer(deps: OwnershipDeps, params: {
+    txId: unknown;
+    consent: unknown;
+}): Promise<ToolResult<SignedGroup>>;
+export {};
+//# sourceMappingURL=group-ownership.d.ts.map

package/dist/group-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-ownership.d.ts","sourceRoot":"","sources":["../src/group-ownership.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAAQ,MAAM,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAW9C,OAAO,KAAK,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED;;;;4FAI4F;AAC5F,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAC1C,eAAO,MAAM,WAAW,sCAAsC,CAAC;AAC/D,eAAO,MAAM,YAAY,uCAAuC,CAAC;AACjE,QAAA,MAAM,OAAO,cAAc,CAAC;AAG5B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,WAAW,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,YAAY,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,OAAO,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KACjE,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAgGD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAoCtC;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GACrH,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAgDvC;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC1C,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAoElC"}