@uuaid/pillar 0.2.0-alpha.13 → 0.2.0-alpha.17

package/bin/pillar-blob.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+/**
+ * pillar-blob — encrypted temporary-object transport through the UUAID broker.
+ *
+ *   pillar-blob send --to UUAID --recipient-pubkey HEX --data FILE [--broker URL]
+ *                    [--carriers URL,...] --key-id REGISTRY_KEY_ID [--ttl-ms N]
+ *   pillar-blob get  --ref-file FILE --expect-envelope ID --key-id REGISTRY_KEY_ID
+ *                    [--broker URL] [--out FILE|-]
+ *
+ * The broker never receives a DEK. `send` prints metadata only; the secret ref
+ * exists solely inside the recipient-encrypted Pillar envelope.
+ */
+import "../src/node-check.mjs"; // must stay the first import: refuses Node < 22 before any dependency loads
+import { readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { Keychain } from "../src/identity/keychain.mjs";
+import { Pillar } from "../src/pillar.mjs";
+import { PillarBlobHttpClient } from "../src/blob/http.mjs";
+import { fetchBrokerBlob, DEFAULT_BLOB_TTL_MS, BlobError } from "../src/blob/blob.mjs";
+
+function usage(code = 2) {
+  process.stderr.write("usage: pillar-blob send|get (run without arguments to see the source header)\n");
+  process.exit(code);
+}
+
+function parse(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const key = argv[i];
+    if (!key.startsWith("--") || i + 1 >= argv.length) usage();
+    out[key.slice(2)] = argv[++i];
+  }
+  return out;
+}
+
+function homeDir(args) {
+  return args.home ?? process.env.PILLAR_HOME ?? join(homedir(), ".pillar-fleet", "zz-master");
+}
+
+function loadHome(args) {
+  const home = homeDir(args);
+  const keychain = new Keychain(join(home, "keychain.json"));
+  keychain.load({ passphrase: process.env.PILLAR_PASSPHRASE ?? "" });
+  let config = {};
+  try { config = JSON.parse(readFileSync(join(home, "config.json"), "utf-8")); } catch (_error) {}
+  const keyId = args["key-id"] ?? process.env.PILLAR_PRESENTATION_KEY_ID ?? config.presentationKeyId;
+  if (!keyId) throw new Error("--key-id (registry-bound presentation key id) is required");
+  const broker = args.broker ?? process.env.PILLAR_BLOB_BROKER ?? "https://api.uuaid.org";
+  const client = new PillarBlobHttpClient({ baseUrl: broker, keychain, keyId });
+  return { home, keychain, config, client };
+}
+
+function fail(error) {
+  const code = error instanceof BlobError ? error.code : "error";
+  process.stderr.write(`pillar-blob: ${code}: ${error?.message ?? String(error)}\n`);
+  process.exit(code === "blob-not-found" || code === "blob-expired" ? 3 : code.includes("integrity") ? 5 : 6);
+}
+
+const [command, ...rest] = process.argv.slice(2);
+if (!command) usage();
+const args = parse(rest);
+
+try {
+  if (command === "send") {
+    if (!args.to || !args["recipient-pubkey"] || !args.data) usage();
+    const { home, keychain, config, client } = loadHome(args);
+    const carriers = (args.carriers ?? process.env.PILLAR_CARRIERS ?? (config.carriers ?? []).join(","))
+      .split(",").map((value) => value.trim()).filter(Boolean);
+    if (!carriers.length) throw new Error("no carriers configured");
+    const pillar = new Pillar({
+      keychain,
+      mailboxPath: join(home, "mailbox.db"),
+      carriers,
+      enableLibp2p: false,
+      blobClient: client,
+    });
+    await pillar.start();
+    try {
+      const result = await pillar.sendBlob({
+        recipient: args.to,
+        recipientPublicKey: args["recipient-pubkey"],
+        data: args.data === "-" ? readFileSync(0) : readFileSync(args.data),
+        ttlMs: Number(args["ttl-ms"] ?? DEFAULT_BLOB_TTL_MS),
+      });
+      process.stdout.write(`${JSON.stringify({
+        envelope_id: result.envelope.id,
+        via: result.via,
+        plaintext_bytes: result.blob.size,
+        ciphertext_sha256: result.blob.hash,
+      })}\n`);
+    } finally {
+      await pillar.stop();
+    }
+  } else if (command === "get") {
+    if (!args["ref-file"] || !args["expect-envelope"]) usage();
+    const { keychain, client } = loadHome(args);
+    const parsed = JSON.parse(readFileSync(args["ref-file"], "utf-8"));
+    const ref = parsed.blobRef ?? parsed;
+    const result = await fetchBrokerBlob({
+      ref,
+      envelopeId: args["expect-envelope"],
+      recipient: keychain._identity.uuaid,
+      client,
+    });
+    if (!args.out || args.out === "-") process.stdout.write(result.data);
+    else writeFileSync(args.out, result.data, { mode: 0o600 });
+    process.stderr.write(`pillar-blob: redeemed ${result.size} plaintext byte(s)\n`);
+  } else usage();
+} catch (error) {
+  fail(error);
+}
+

package/bin/pillar-directory.mjs

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+/**
+ * pillar-directory — serve directory.json from the seed registry.
+ *
+ *   pillar-directory --port 8800 --carrier https://pillar.uuaid.org \
+ *                    --agents ./agents.json --db /opt/pillar-directory/registry.db
+ *
+ * Replaces the hand-edited directory.json that every agent bootstraps from.
+ * The file could only be changed by whoever had shell on the host serving it,
+ * which is the reason the mesh had exactly one seed. Here the seed list is a
+ * table any operator can enter by proving they run a live seed, and the rung
+ * they hold is computed from probes this process makes itself.
+ *
+ * Routes:
+ *   GET  /directory.json          the directory (carrier + agents + ranked seeds)
+ *   POST /v1/seeds                enroll { url, operator?, region? }
+ *   GET  /v1/seeds                every enrolled seed and its standing
+ *   GET  /v1/seeds/<uuaid>        one seed's standing + what is left to earn
+ *   GET  /v1/seeds/<uuaid>/grant  that seed's current earned tier grant
+ *   GET  /v1/health
+ *
+ * `agents.json` is passed through untouched: this process owns the seed list,
+ * not the address book.
+ */
+import "../src/node-check.mjs"; // must stay the first import: refuses Node < 22 before any dependency loads
+import { createServer } from "node:http";
+import { readFileSync, existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { SeedRegistry } from "../src/net/seed-registry.mjs";
+import { Keychain } from "../src/identity/keychain.mjs";
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--")) {
+      const k = a.slice(2);
+      args[k] = (argv[i + 1] && !argv[i + 1].startsWith("--")) ? argv[++i] : true;
+    }
+  }
+  return args;
+}
+
+const args = parseArgs(process.argv.slice(2));
+const home = args.home ?? process.env.DIRECTORY_HOME ?? join(homedir(), ".pillar-directory");
+const port = Number(args.port ?? process.env.DIRECTORY_PORT ?? 8800);
+const host = args.host ?? process.env.DIRECTORY_HOST ?? "127.0.0.1";
+const dbPath = args.db ?? process.env.DIRECTORY_DB ?? join(home, "registry.db");
+const carrier = args.carrier ?? process.env.DIRECTORY_CARRIER ?? null;
+const agentsPath = args.agents ?? process.env.DIRECTORY_AGENTS ?? null;
+const protocol = args.protocol ?? process.env.DIRECTORY_PROTOCOL ?? "uacp/1.0-draft";
+const probeMinutes = Number(args["probe-minutes"] ?? process.env.DIRECTORY_PROBE_MINUTES ?? 10);
+const allowPrivateUrls = Boolean(args["allow-private-urls"]);
+
+const MAX_ENROLLMENTS_PER_HOUR = 10; // per client IP
+const MAX_BODY = 8 * 1024;
+
+mkdirSync(home, { recursive: true });
+const keychain = new Keychain(join(home, "registry-keychain.json"));
+if (!keychain.exists()) {
+  keychain.save(Keychain.generate());
+  console.log(`minted registry identity -> ${join(home, "registry-keychain.json")}`);
+}
+keychain.load();
+
+const registry = new SeedRegistry({ keychain, carrierUrl: carrier, dbPath, protocol, allowPrivateUrls });
+
+/**
+ * agents[] is read fresh on each render rather than cached at boot, so
+ * updating the address book does not require restarting the directory and
+ * dropping every in-flight enrollment.
+ */
+function agents() {
+  if (!agentsPath || !existsSync(agentsPath)) return [];
+  try {
+    const raw = JSON.parse(readFileSync(agentsPath, "utf-8"));
+    return Array.isArray(raw) ? raw : (raw.agents ?? []);
+  } catch (e) {
+    console.error(`[directory] agents file unreadable: ${e.message}`);
+    return [];
+  }
+}
+
+const enrollRate = new Map(); // ip -> [ms]
+function enrollAllowed(ip) {
+  const now = Date.now();
+  const arr = (enrollRate.get(ip) ?? []).filter(t => t > now - 3600_000);
+  if (arr.length >= MAX_ENROLLMENTS_PER_HOUR) { enrollRate.set(ip, arr); return false; }
+  arr.push(now);
+  enrollRate.set(ip, arr);
+  if (enrollRate.size > 10_000) {
+    for (const [k, v] of enrollRate) if (!v.some(t => t > now - 3600_000)) enrollRate.delete(k);
+  }
+  return true;
+}
+
+function send(res, code, obj) {
+  const body = JSON.stringify(obj, null, 2);
+  res.writeHead(code, {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(body),
+    // The directory is public bootstrap data; browsers fetch it directly.
+    "access-control-allow-origin": "*",
+    "cache-control": "public, max-age=60",
+  });
+  res.end(body);
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let size = 0; const chunks = [];
+    req.on("data", c => {
+      size += c.length;
+      if (size > MAX_BODY) { reject(new Error("body too large")); req.destroy(); return; }
+      chunks.push(c);
+    });
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+    req.on("error", reject);
+  });
+}
+
+const clientIp = (req) => {
+  const fwd = req.headers["x-forwarded-for"];
+  return fwd ? String(fwd).split(",")[0].trim() : (req.socket.remoteAddress ?? "unknown");
+};
+
+const server = createServer(async (req, res) => {
+  try {
+    const url = new URL(req.url, `http://${req.headers.host ?? "localhost"}`);
+
+    if (req.method === "GET" && (url.pathname === "/directory.json" || url.pathname === "/")) {
+      return send(res, 200, registry.directory({ agents: agents() }));
+    }
+
+    if (req.method === "POST" && url.pathname === "/v1/seeds") {
+      const ip = clientIp(req);
+      if (!enrollAllowed(ip)) return send(res, 429, { ok: false, reason: "rate-limited" });
+      let payload;
+      try { payload = JSON.parse(await readBody(req)); }
+      catch { return send(res, 400, { ok: false, reason: "bad-json" }); }
+      const r = await registry.enroll({
+        url: payload?.url,
+        operator: payload?.operator ?? null,
+        region: payload?.region ?? null,
+      });
+      if (!r.ok) console.log(`[directory] enroll refused ${payload?.url}: ${r.reason}`);
+      else if (!r.already) console.log(`[directory] enrolled ${r.url} as ${r.uuaid}`);
+      return send(res, r.ok ? 200 : 400, r);
+    }
+
+    if (req.method === "GET" && url.pathname === "/v1/seeds") {
+      return send(res, 200, { seeds: registry.all().map(r => registry.status(r.uuaid)) });
+    }
+
+    const grantMatch = /^\/v1\/seeds\/([^/]+)\/grant$/.exec(url.pathname);
+    if (req.method === "GET" && grantMatch) {
+      const uuaid = decodeURIComponent(grantMatch[1]);
+      // Served unauthenticated on purpose: a grant is only usable by the
+      // identity it names, and using it means signing an envelope with that
+      // identity's key. Holding someone else's grant buys nothing.
+      const grant = registry.grantFor(uuaid);
+      if (!grant) {
+        const known = registry.get(uuaid);
+        return send(res, known ? 200 : 404,
+          known ? { ok: true, grant: null, reason: "tier-earns-no-grant", tier: known.tier }
+                : { ok: false, reason: "unknown-seed" });
+      }
+      return send(res, 200, { ok: true, grant });
+    }
+
+    const seedMatch = /^\/v1\/seeds\/([^/]+)$/.exec(url.pathname);
+    if (req.method === "GET" && seedMatch) {
+      const st = registry.status(decodeURIComponent(seedMatch[1]));
+      return send(res, st.ok ? 200 : 404, st);
+    }
+
+    if (req.method === "GET" && url.pathname === "/v1/health") {
+      return send(res, 200, {
+        ok: true,
+        seeds: registry.all().length,
+        issuer: registry.issuerKey,
+        uptimeMs: Date.now() - startedAt,
+      });
+    }
+
+    send(res, 404, { error: "not-found" });
+  } catch (e) {
+    console.error(`[directory] 500: ${e.message}`);
+    send(res, 500, { error: "internal-error" });
+  }
+});
+
+const startedAt = Date.now();
+await new Promise(r => server.listen(port, host, r));
+console.log(`pillar-directory listening on http://${host}:${port}`);
+console.log(`  issuer: ${registry.issuerKey}`);
+console.log(`  carrier: ${carrier ?? "(none — set --carrier)"}`);
+console.log(`  db: ${dbPath}`);
+console.log(`  seeds: ${registry.all().length}`);
+console.log(`  probing every ${probeMinutes} min`);
+
+/**
+ * The observation loop. Every seed is probed on the same cadence, so the
+ * probe counts in the ladder translate directly into wall-clock time:
+ * at the default 10 minutes, `steady`'s 20 probes is ~3.3 hours of proof on
+ * top of its 1-day minimum age.
+ */
+let probing = false;
+const probeTimer = setInterval(async () => {
+  if (probing) return; // never overlap: a slow seed must not stack rounds
+  probing = true;
+  try {
+    for (const r of await registry.observeAll()) {
+      if (r.changed) console.log(`[directory] ${r.url} ${r.previousTier} -> ${r.tier}`);
+      else if (!r.alive) console.log(`[directory] ${r.url} probe failed`);
+    }
+  } catch (e) {
+    console.error(`[directory] probe round failed: ${e.message}`);
+  } finally {
+    probing = false;
+  }
+}, Math.max(1, probeMinutes) * 60_000);
+
+const shutdown = async () => {
+  clearInterval(probeTimer);
+  await new Promise(r => server.close(r));
+  registry.close();
+  process.exit(0);
+};
+process.on("SIGINT", shutdown);
+process.on("SIGTERM", shutdown);

package/bin/pillar-escrow.mjs

@@ -42,6 +42,7 @@
  * (who absorbs the fee: the seller, the buyer, or 50/50) or --payout N (the
  * parties' own number; a "mutual" agreement).  No default is ever derived.
  */
+import "../src/node-check.mjs"; // must stay the first import: refuses Node < 22 before any dependency loads
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";

package/bin/pillar-responder.mjs

@@ -31,6 +31,7 @@
  *     --reply-text "zz-master is away — left a message" \
  *     --forward-to uuaid:foundation:agent:… --forward-pubkey <hex>
  */
+import "../src/node-check.mjs"; // must stay the first import: refuses Node < 22 before any dependency loads
 import { existsSync, readFileSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";

package/bin/pillar-seed.mjs

@@ -4,6 +4,8 @@
  * the p2p store-and-forward mesh, like a LimeWire/BitTorrent seed peer.
  *
  *   pillar-seed --port 8799 --db /opt/pillar-seed/seed.db
+ *   pillar-seed --public-url https://seed.example.org --announce https://pillar.uuaid.org
+ *   pillar-seed --status --announce https://pillar.uuaid.org
  *
  * A seed IS a carrier server with a public URL — nothing else.  Agents
  * anywhere list your URL in their carriers[] and then:
@@ -13,18 +15,36 @@
  * Minimal ongoing requirements: one process, one SQLite file, outbound-free
  * (all traffic comes TO you).  That is the whole contract.
  *
- * Defaults to loopback (RedTeam F5).  To become a real seed, put it behind a
- * TLS-terminating proxy (nginx/Caddy) and advertise the PUBLIC https:// URL —
- * never the loopback one — as a seeds[] entry in a pillar directory.json:
+ * JOINING
+ *
+ * Announce yourself to a registry with --announce and you are enrolled: the
+ * registry fetches /v1/seed-info from the URL you gave, checks that it is
+ * signed by your seed key, and lists you.  No account, no review, no waiting
+ * on whoever owns the directory file.
+ *
+ * WHAT YOU EARN
+ *
+ * The registry then probes you — liveness plus a real envelope round-tripped
+ * through your seed — and promotes you as the evidence accumulates:
+ *
+ *   probation -> steady (a day) -> durable (a week) -> anchor (a month)
  *
- *   { "url": "https://<your-host>", "operator": "<you>", "region": "<region>", "since": "<ISO date>" }
+ * From `steady` up, your OWN identity is issued a signed tier grant: raised
+ * send budgets at every carrier that trusts the registry's issuer key.  From
+ * `durable` up that grant also carries priority, which reserves you
+ * admission capacity at those carriers when they are shedding load.  Run
+ * --status to see your rung and exactly what is left to reach the next one.
  *
- * Anyone running `pillar init --directory <directory-url>` then picks you up
- * automatically as one of their carriers.  You can also be someone's ENTIRE
- * carrier set (`--carriers https://<your-host>`) — two agents can talk with
- * only your seed between them, no official carrier involved.
+ * Defaults to loopback (RedTeam F5).  To become a real seed, put it behind a
+ * TLS-terminating proxy (nginx/Caddy) and pass the PUBLIC https:// URL as
+ * --public-url — never the loopback one.
  */
+import "../src/node-check.mjs"; // must stay the first import: refuses Node < 22 before any dependency loads
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { CarrierServer } from "../src/net/carrier-server.mjs";
+import { Keychain } from "../src/identity/keychain.mjs";
 
 function parseArgs(argv) {
   const args = {};
@@ -39,16 +59,68 @@ function parseArgs(argv) {
 }
 
 const args = parseArgs(process.argv.slice(2));
+const home = args.home ?? process.env.SEED_HOME ?? join(homedir(), ".pillar-seed");
 const port = Number(args.port ?? process.env.SEED_PORT ?? 8799);
 const host = args.host ?? process.env.SEED_HOST ?? "127.0.0.1";
 const dbPath = args.db ?? process.env.SEED_DB ?? "pillar-seed.db";
 const ttlDays = Number(args.ttl ?? process.env.SEED_TTL_DAYS ?? 14);
+const publicUrl = args["public-url"] ?? process.env.SEED_PUBLIC_URL ?? null;
+const registryUrl = typeof args.announce === "string" ? args.announce.replace(/\/+$/, "") : null;
+const operator = args.operator ?? process.env.SEED_OPERATOR ?? null;
+const region = args.region ?? process.env.SEED_REGION ?? null;
+
+/**
+ * The seed's identity. Distinct from any agent keychain on the box: it names
+ * the SEED, is what /v1/seed-info is signed with, and is the subject of any
+ * tier grant the seed earns.
+ */
+mkdirSync(home, { recursive: true });
+const keychain = new Keychain(join(home, "seed-keychain.json"));
+if (!keychain.exists()) {
+  keychain.save(Keychain.generate());
+  console.log(`minted seed identity -> ${join(home, "seed-keychain.json")}`);
+}
+keychain.load();
 
-const server = new CarrierServer({ dbPath, ttlDays });
+/** Ask a registry where we stand and print the ladder position. */
+async function printStanding(registry, uuaid) {
+  try {
+    const res = await fetch(`${registry}/v1/seeds/${encodeURIComponent(uuaid)}`);
+    if (res.status === 404) {
+      console.log(`  standing: not enrolled at ${registry} — run with --announce ${registry}`);
+      return;
+    }
+    if (!res.ok) { console.log(`  standing: registry ${res.status}`); return; }
+    const s = await res.json();
+    console.log(`  tier:    ${s.tier}${s.demoted ? " (DEMOTED — failing probes)" : ""} — ${s.blurb}`);
+    console.log(`  earned:  ${s.grantTier ? `${s.grantTier} grant${s.priority ? " + priority delivery" : ""}` : "nothing yet"}`);
+    const o = s.observed ?? {};
+    console.log(`  observed: ${o.probes?.passed ?? 0}/${o.probes?.total ?? 0} probes (${((o.uptime ?? 0) * 100).toFixed(1)}% uptime), ${o.roundTrips?.passed ?? 0} relay round-trips`);
+    if (s.next) console.log(`  next:    ${s.next} — needs ${s.missing.join(", ")}`);
+    else if (!s.demoted) console.log(`  next:    top of the ladder`);
+  } catch (e) {
+    console.log(`  standing: unreachable — ${e.message}`);
+  }
+}
+
+// --status is a query, not a server: report and exit.
+if (args.status) {
+  if (!registryUrl) {
+    console.error("--status needs --announce <registry-url> to know which registry to ask");
+    process.exit(1);
+  }
+  console.log(`seed ${keychain._identity.uuaid}`);
+  await printStanding(registryUrl, keychain._identity.uuaid);
+  process.exit(0);
+}
+
+const server = new CarrierServer({ dbPath, ttlDays, keychain, publicUrl });
 const addr = await server.listen(port, host);
 console.log(`pillar-seed listening on http://${addr.address}:${addr.port}`);
+console.log(`  uuaid: ${keychain._identity.uuaid}`);
 console.log(`  db:  ${dbPath}`);
 console.log(`  ttl: ${ttlDays} days`);
+if (publicUrl) console.log(`  public url: ${publicUrl}`);
 
 // Boot self-check on the address we actually serve — verify before claim.
 try {
@@ -60,11 +132,39 @@ try {
   console.log(`  health: unreachable — ${e.message}`);
 }
 
-if (host === "127.0.0.1") {
+if (registryUrl) {
+  if (!publicUrl) {
+    console.log(`\n  --announce needs --public-url <https://your-host>: the registry enrolls a URL,`);
+    console.log(`  and it must be one it can reach and that you can prove you operate.`);
+  } else {
+    console.log(`\n  announcing ${publicUrl} to ${registryUrl} ...`);
+    try {
+      const res = await fetch(`${registryUrl}/v1/seeds`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ url: publicUrl, operator, region }),
+      });
+      const body = await res.json().catch(() => ({}));
+      if (res.ok && body.ok) {
+        console.log(`  enrolled${body.already ? " (already)" : ""} as ${body.uuaid}`);
+        await printStanding(registryUrl, keychain._identity.uuaid);
+      } else {
+        console.log(`  enrollment refused: ${body.reason ?? res.status}`);
+        if (String(body.reason ?? "").startsWith("seed-unreachable")) {
+          console.log(`  (the registry could not fetch ${publicUrl}/v1/seed-info — check DNS, TLS, and your proxy)`);
+        }
+      }
+    } catch (e) {
+      console.log(`  enrollment failed: ${e.message}`);
+    }
+  }
+} else if (host === "127.0.0.1") {
   console.log(`\n  loopback seed — reachable only from this machine.`);
-  console.log(`  To join the mesh as a real seed: TLS-terminate a public URL and list it:`);
-  console.log(`    { "url": "https://<your-host>", "operator": "<you>", "region": "<region>", "since": "${new Date().toISOString().slice(0, 10)}" }`);
-  console.log(`  in the seeds[] array of your pillar directory.json.`);
+  console.log(`  To join the mesh as a real seed: TLS-terminate a public URL, then`);
+  console.log(`    pillar-seed --host 0.0.0.0 --public-url https://<your-host> \\`);
+  console.log(`                --announce https://pillar.uuaid.org --operator <you> --region <region>`);
+  console.log(`  Enrollment is permissionless: the registry verifies the URL against your`);
+  console.log(`  seed key and lists you. Staying up is what earns the rest.`);
 }
 
 // Vacuum expired envelopes hourly.

package/bin/pillar.mjs

@@ -16,6 +16,7 @@
  * All commands respect --home to point at an alternate pillar directory,
  * useful for running multiple pillars on one machine (Zestro dogfood etc.).
  */
+import "../src/node-check.mjs"; // must stay the first import: refuses Node < 22 before any dependency loads
 import { mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
@@ -436,8 +437,12 @@ async function cmdInbox(args) {
   // senders loaded, or every fresh envelope counts as a stranger.
   loadFleetAddressBook(fleetPath(args), p);
   const pulled = await p.drainCarrierInbox();
+  // fromPublicKey: the sender's verified Ed25519 key (transportSignature —
+  // open() binds it to `from`). Lets a drain-and-reply consumer (the fleet
+  // courier's auto-ack, a bot) seal back to a sender who is NOT in fleet.json
+  // via `pillar send … --to-pubkey <fromPublicKey>`. Additive field.
   for (const env of fresh) {
-    console.log(JSON.stringify({ new: true, id: env.id, from: env.sender, kind: env.kind, at: env.createdAt, payload: env.payload }));
+    console.log(JSON.stringify({ new: true, id: env.id, from: env.sender, fromPublicKey: env.transportSignature?.publicKey ?? null, kind: env.kind, at: env.createdAt, payload: env.payload }));
   }
   // Backlog: rows stored earlier (e.g. by a recv daemon) but never surfaced.
   const { decrypt } = await import("../src/net/envelope.mjs");
@@ -448,7 +453,7 @@ async function cmdInbox(args) {
       const env = JSON.parse(row.envelope_json);
       let payload = null;
       try { payload = decrypt(p.keychain, env); } catch (_e) { payload = { error: "decrypt failed" }; }
-      console.log(JSON.stringify({ new: false, id: env.id, from: env.sender, kind: env.kind, at: env.createdAt, payload }));
+      console.log(JSON.stringify({ new: false, id: env.id, from: env.sender, fromPublicKey: env.transportSignature?.publicKey ?? null, kind: env.kind, at: env.createdAt, payload }));
     }
   }
   const qCount = (p.mailbox.inboxQuarantined?.(500) ?? []).length;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@uuaid/pillar",
-  "version": "0.2.0-alpha.13",
-  "description": "Pillar (Protocol for Inter-agent Linked Ledger And Relay) — the secure delivery layer of UACP, the Universal Agent Communication Protocol. UACP = UUAID (identity) + Envelope (signed, encrypted container) + Pillar (relay, mailbox, routing, store-and-forward). IAASO-3050 reference implementation: one command to mint an identity and join the network.",
+  "version": "0.2.0-alpha.17",
+  "description": "Pillar (Protocol for Inter-agent Linked Ledger And Relay) \u2014 the secure delivery layer of UACP, the Universal Agent Communication Protocol. UACP = UUAID (identity) + Envelope (signed, encrypted container) + Pillar (relay, mailbox, routing, store-and-forward). Reference implementation of the UACP delivery layer; includes VDA-1 (IAASO-3901, in ballot) delivery attestation and a blind escrow for the Zilligon ZGN / EVM rails.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "src/index.mjs",
@@ -11,17 +11,26 @@
     "pillar-ask": "bin/pillar-ask.mjs",
     "pillar-responder": "bin/pillar-responder.mjs",
     "pillar-seed": "bin/pillar-seed.mjs",
-    "pillar-escrow": "bin/pillar-escrow.mjs"
+    "pillar-directory": "bin/pillar-directory.mjs",
+    "pillar-escrow": "bin/pillar-escrow.mjs",
+    "pillar-blob": "bin/pillar-blob.mjs"
   },
   "exports": {
-    ".":               "./src/index.mjs",
-    "./keychain":      "./src/identity/keychain.mjs",
-    "./jcs":           "./src/identity/jcs.mjs",
-    "./tier":          "./src/identity/tier.mjs",
-    "./envelope":      "./src/net/envelope.mjs",
-    "./e2e":           "./src/crypto/e2e.mjs",
-    "./carrier-client":"./src/net/carrier-client.mjs",
-    "./package.json":  "./package.json"
+    ".": "./src/index.mjs",
+    "./keychain": "./src/identity/keychain.mjs",
+    "./jcs": "./src/identity/jcs.mjs",
+    "./tier": "./src/identity/tier.mjs",
+    "./envelope": "./src/net/envelope.mjs",
+    "./delegation": "./src/net/delegation.mjs",
+    "./e2e": "./src/crypto/e2e.mjs",
+    "./carrier-client": "./src/net/carrier-client.mjs",
+    "./seed-tier": "./src/net/seed-tier.mjs",
+    "./seed-registry": "./src/net/seed-registry.mjs",
+    "./blob": "./src/blob/blob.mjs",
+    "./blob/http": "./src/blob/http.mjs",
+    "./blob/store": "./src/blob/store.mjs",
+    "./blob/broker": "./src/blob/broker.mjs",
+    "./package.json": "./package.json"
   },
   "files": [
     "src",
@@ -34,14 +43,16 @@
     "test": "node --test --test-reporter spec test/unit/*.test.mjs",
     "test:int": "node --test --test-reporter spec test/integration/*.test.mjs",
     "test:chaos": "node --test --test-reporter spec test/chaos/*.test.mjs",
-    "test:all": "node --test --test-reporter spec test/unit/*.test.mjs test/integration/*.test.mjs test/chaos/*.test.mjs"
+    "test:all": "node --test --test-reporter spec test/unit/*.test.mjs test/integration/*.test.mjs test/chaos/*.test.mjs",
+    "preflight": "node scripts/preflight-publish.mjs",
+    "prepublishOnly": "node scripts/preflight-publish.mjs",
+    "postpublish": "node scripts/verify-publish.mjs"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "dependencies": {
     "@chainsafe/libp2p-noise": "^17.0.0",
-    "@noble/curves": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@chainsafe/libp2p-yamux": "^8.0.1",
     "@libp2p/autonat": "^3.0.26",
@@ -58,7 +69,7 @@
     "@libp2p/websockets": "^10.1.19",
     "@multiformats/multiaddr": "^13.0.3",
     "@noble/curves": "^2.3.0",
-    "better-sqlite3": "^11.10.0",
+    "better-sqlite3": "^12.11.1",
     "it-pipe": "^3.0.1",
     "it-pushable": "^3.2.4",
     "libp2p": "^3.3.8",