chainlesschain 0.161.12 → 0.162.1

package/src/commands/crosschain.js

@@ -1,5 +1,10 @@
 /**
  * `cc crosschain` — CLI surface for Phase 89 Cross-Chain Interoperability.
+ *
+ * #21 B.5 Layer 1 PR1 (2026-05-15): `cc crosschain bridge --require-multisig`
+ * opt-in routes outbound bridge through m-of-n multisig (domain
+ * `crosschain.bridge.outbound`); `cc crosschain bridge-consume <proposalId>`
+ * finalizes after threshold is reached. Mirrors marketplace purchase/consume.
  */
 
 import fs from "node:fs";
@@ -8,6 +13,14 @@ import { Command } from "commander";
 
 import { bootstrap } from "../runtime/bootstrap.js";
 import { getHomeDir } from "../lib/paths.js";
+import {
+  openMultisigManager,
+  defaultMultisigDbPath,
+  defaultMultisigLogPath,
+  readSecretKey,
+} from "../lib/multisig-runtime.js";
+
+const MULTISIG_BRIDGE_OUTBOUND_DOMAIN = "crosschain.bridge.outbound";
 import {
   getCrossChainMtcDir,
   getBridgeMtcStatus,
@@ -111,6 +124,299 @@ function _maybeStageMtc(opts, opBuilder) {
   }
 }
 
+/**
+ * #21 B.5 Layer 1 — open a multisig proposal for an outbound bridge.
+ * Does NOT insert into cc_bridges yet; bridge-consume does that after
+ * the proposal reaches threshold. Mirrors marketplace.purchase.
+ */
+async function _bridgePropose({
+  fromChain,
+  toChain,
+  amount,
+  asset,
+  sender,
+  recipient,
+  initiator,
+  alg,
+  key,
+  multisigDb,
+  multisigLog,
+  json,
+}) {
+  if (!initiator) {
+    const out = {
+      status: "blocked",
+      reason: "missing_initiator",
+      path: "multisig",
+    };
+    if (json) console.log(JSON.stringify(out, null, 2));
+    else
+      console.error(
+        "✗ --initiator <did> required when --require-multisig is set",
+      );
+    process.exitCode = 2;
+    return out;
+  }
+  if (!key) {
+    const out = {
+      status: "blocked",
+      reason: "missing_key",
+      path: "multisig",
+    };
+    if (json) console.log(JSON.stringify(out, null, 2));
+    else
+      console.error(
+        "✗ --key <hex|path> required when --require-multisig is set",
+      );
+    process.exitCode = 2;
+    return out;
+  }
+
+  const { store, mgr, close } = await openMultisigManager(
+    multisigDb,
+    multisigLog,
+  );
+  try {
+    const policy = store.getPolicy(MULTISIG_BRIDGE_OUTBOUND_DOMAIN);
+    if (!policy) {
+      const out = {
+        status: "blocked",
+        reason: "no_policy",
+        path: "multisig",
+        domain: MULTISIG_BRIDGE_OUTBOUND_DOMAIN,
+      };
+      if (json) console.log(JSON.stringify(out, null, 2));
+      else
+        console.error(
+          `✗ No multisig policy for domain "${MULTISIG_BRIDGE_OUTBOUND_DOMAIN}". Run: cc multisig policy set ${MULTISIG_BRIDGE_OUTBOUND_DOMAIN} --m <M> --members <json>`,
+        );
+      process.exitCode = 2;
+      return out;
+    }
+
+    const secretKey = readSecretKey(key);
+    const payload = {
+      fromChain,
+      toChain,
+      asset: asset || "native",
+      amount,
+      sender: sender || null,
+      recipient: recipient || null,
+    };
+    const result = mgr.propose({
+      domain: MULTISIG_BRIDGE_OUTBOUND_DOMAIN,
+      payload,
+      policy,
+      initiator: { did: initiator, alg: alg || "Ed25519", secretKey },
+    });
+    const out = {
+      status: "needs_co_sign",
+      path: "multisig",
+      proposalId: result.proposal.id,
+      reachedThreshold: result.reachedThreshold,
+      requiredSigs: policy.m,
+      memberCount: policy.members.length,
+      payload,
+    };
+    if (json) {
+      console.log(JSON.stringify(out, null, 2));
+    } else {
+      console.log(
+        `↪ Routed through multisig (domain ${MULTISIG_BRIDGE_OUTBOUND_DOMAIN})`,
+      );
+      console.log(`  proposalId: ${result.proposal.id}`);
+      console.log(`  needs ${policy.m} of ${policy.members.length} signatures`);
+      if (result.reachedThreshold)
+        console.log(
+          `  ✓ threshold reached on first signature — run: cc crosschain bridge-consume ${result.proposal.id}`,
+        );
+    }
+    return out;
+  } finally {
+    close();
+  }
+}
+
+/**
+ * #21 B.5 Layer 1 — finalize an outbound bridge after multisig threshold.
+ * Reads the proposal's payload, executes the actual bridgeAsset() insert,
+ * then marks the proposal consumed. Mirrors marketplace.consume.
+ *
+ * PR4 — when `mtc=true`, additionally stage the bridge op with multisig
+ * provenance via `_maybeStageMtc` so closeBatch carries it into the MTC
+ * envelope leaf (and downstream wrapper attachment / Layer 3 broadcast).
+ */
+async function _bridgeConsume({
+  db,
+  proposalId,
+  multisigDb,
+  multisigLog,
+  json,
+  mtc,
+  mtcConfigDir,
+}) {
+  const { mgr, close } = await openMultisigManager(multisigDb, multisigLog);
+  try {
+    const got = mgr.get(proposalId);
+    if (!got) {
+      const out = { status: "error", reason: "proposal_not_found" };
+      if (json) console.log(JSON.stringify(out, null, 2));
+      else console.error(`✗ No proposal: ${proposalId}`);
+      process.exitCode = 2;
+      return out;
+    }
+    if (got.proposal.domain !== MULTISIG_BRIDGE_OUTBOUND_DOMAIN) {
+      const out = {
+        status: "error",
+        reason: "wrong_domain",
+        expected: MULTISIG_BRIDGE_OUTBOUND_DOMAIN,
+        actual: got.proposal.domain,
+      };
+      if (json) console.log(JSON.stringify(out, null, 2));
+      else
+        console.error(
+          `✗ Proposal domain "${got.proposal.domain}" is not "${MULTISIG_BRIDGE_OUTBOUND_DOMAIN}" — use the matching consume command for that domain instead.`,
+        );
+      process.exitCode = 2;
+      return out;
+    }
+    if (got.proposal.state !== "reached") {
+      const out = {
+        status: "error",
+        reason: `proposal_state_${got.proposal.state}`,
+      };
+      if (json) console.log(JSON.stringify(out, null, 2));
+      else
+        console.error(
+          `✗ Proposal state is "${got.proposal.state}", need "reached" — sign more before consume.`,
+        );
+      process.exitCode = 2;
+      return out;
+    }
+
+    const payload = JSON.parse(got.proposal.payloadJcs);
+
+    // #21 B.5 Layer 2 PR1 — extract m-of-n provenance from the reached
+    // proposal and persist it alongside the bridge row. signatures are
+    // returned sorted by signer_did ASC (store.getSignatures), so the array
+    // ordering is canonical for any downstream onchain verifier.
+    const signatures = got.signatures || [];
+    // PR4 adds thresholdM + memberCountN so the carry-forward MTC staging
+    // can build the canonical multisig_provenance shape required by
+    // attachMultisigProvenance / verifyMultisigProvenance.
+    const multisigContext = {
+      proposalId: got.proposal.id,
+      thresholdM: got.proposal.thresholdM,
+      memberCountN: Array.isArray(got.proposal.memberSet)
+        ? got.proposal.memberSet.length
+        : signatures.length,
+      signers: signatures.map((s) => s.signerDid),
+      partialSigs: signatures.map((s) => ({
+        did: s.signerDid,
+        alg: s.alg,
+        sig: Buffer.isBuffer(s.sig) ? s.sig.toString("hex") : String(s.sig),
+      })),
+    };
+
+    const bridgeResult = bridgeAsset(
+      db,
+      {
+        fromChain: payload.fromChain,
+        toChain: payload.toChain,
+        asset: payload.asset,
+        amount: payload.amount,
+        senderAddress: payload.sender,
+        recipientAddress: payload.recipient,
+      },
+      multisigContext,
+    );
+    if (!bridgeResult.bridgeId) {
+      const out = {
+        status: "error",
+        reason: `bridge_insert_failed_${bridgeResult.reason}`,
+        proposalId,
+      };
+      if (json) console.log(JSON.stringify(out, null, 2));
+      else
+        console.error(
+          `✗ Bridge insert failed: ${bridgeResult.reason} — proposal left in "reached" state`,
+        );
+      process.exitCode = 1;
+      return out;
+    }
+    const finalizeRes = mgr.finalize(proposalId);
+    if (!finalizeRes.ok) {
+      const out = {
+        status: "error",
+        reason: finalizeRes.reason,
+        proposalId,
+        bridgeId: bridgeResult.bridgeId,
+      };
+      if (json) console.log(JSON.stringify(out, null, 2));
+      else
+        console.error(
+          `✗ Finalize failed: ${finalizeRes.reason} (bridge row ${bridgeResult.bridgeId} already inserted)`,
+        );
+      process.exitCode = 1;
+      return out;
+    }
+
+    // PR4 — opt-in MTC staging carries the multisig provenance forward into
+    // closeBatch / wrapper envelope. Same `_maybeStageMtc` helper as the
+    // legacy direct-bridge path, just with an enriched op shape including
+    // the canonical `multisig_provenance` field.
+    const mtcStaged = _maybeStageMtc({ mtc, mtcConfigDir }, () => ({
+      bridge_op: "lock",
+      src_chain: payload.fromChain,
+      dst_chain: payload.toChain,
+      src_tx_hash: bridgeResult.bridgeId,
+      amount: String(payload.amount),
+      asset: payload.asset || "native",
+      src_did: payload.sender || null,
+      dst_did: payload.recipient || null,
+      issued_at: new Date().toISOString(),
+      multisig_provenance: {
+        proposal_id: multisigContext.proposalId,
+        threshold_m: multisigContext.thresholdM,
+        member_count_n: multisigContext.memberCountN,
+        signers: multisigContext.signers,
+        partial_sigs: multisigContext.partialSigs,
+      },
+    }));
+
+    const out = {
+      status: "consumed",
+      proposalId,
+      bridgeId: bridgeResult.bridgeId,
+      fee: bridgeResult.fee,
+      payload,
+      // Layer 2 provenance — surface what was persisted on the bridge row.
+      signers: multisigContext.signers,
+      partialSigCount: multisigContext.partialSigs.length,
+      // PR4 — surface MTC staging result when --mtc was passed.
+      mtc: mtcStaged,
+    };
+    if (json) {
+      console.log(JSON.stringify(out, null, 2));
+    } else {
+      console.log(
+        `✓ Bridge consumed — ${payload.fromChain} → ${payload.toChain}, amount ${payload.amount} ${payload.asset}`,
+      );
+      console.log(
+        `  bridgeId: ${bridgeResult.bridgeId} (fee ${bridgeResult.fee})`,
+      );
+      console.log(`  proposalId: ${proposalId}`);
+      if (mtcStaged?.staged)
+        console.log(`  MTC envelope staged: ${mtcStaged.path}`);
+      else if (mtcStaged && !mtcStaged.staged)
+        console.log(`  MTC stage skipped: ${mtcStaged.reason}`);
+    }
+    return out;
+  } finally {
+    close();
+  }
+}
+
 export function registerCrossChainCommand(program) {
   const cc = new Command("crosschain")
     .description("Cross-chain interoperability (Phase 89)")
@@ -174,9 +480,49 @@ export function registerCrossChainCommand(program) {
       "On success, stage an MTC bridge envelope (requires cc crosschain mtc-batch to close)",
     )
     .option("--mtc-config-dir <dir>", "Override MTC config root")
+    .option(
+      "--require-multisig",
+      "Route through m-of-n multisig (domain crosschain.bridge.outbound). Requires --initiator + --key + policy set.",
+    )
+    .option(
+      "--initiator <did>",
+      "Initiator DID for multisig proposal (required when --require-multisig)",
+    )
+    .option("--alg <alg>", "Initiator signing alg", "Ed25519")
+    .option(
+      "--key <hex|path>",
+      "Initiator secret key hex or path to hex file (required when --require-multisig)",
+    )
+    .option(
+      "--multisig-db <path>",
+      "Multisig SQLite DB path (default ~/.chainlesschain/multisig.db)",
+    )
+    .option(
+      "--multisig-log <path>",
+      "Multisig governance log path (default ~/.chainlesschain/multisig.governance.log)",
+    )
     .option("--json", "JSON output")
-    .action((fromChain, toChain, amount, opts) => {
+    .action(async (fromChain, toChain, amount, opts) => {
       const db = _dbFromCtx(cc);
+
+      if (opts.requireMultisig) {
+        return _bridgePropose({
+          db,
+          fromChain,
+          toChain,
+          amount: parseFloat(amount),
+          asset: opts.asset,
+          sender: opts.sender,
+          recipient: opts.recipient,
+          initiator: opts.initiator,
+          alg: opts.alg,
+          key: opts.key,
+          multisigDb: opts.multisigDb || defaultMultisigDbPath(),
+          multisigLog: opts.multisigLog || defaultMultisigLogPath(),
+          json: opts.json,
+        });
+      }
+
       const result = bridgeAsset(db, {
         fromChain,
         toChain,
@@ -208,6 +554,37 @@ export function registerCrossChainCommand(program) {
         console.log(`MTC stage skipped: ${mtc.reason}`);
     });
 
+  cc.command("bridge-consume <proposalId>")
+    .description(
+      "Finalize a multisig-gated bridge after threshold reached — performs the SQLite insert and marks proposal consumed",
+    )
+    .option(
+      "--multisig-db <path>",
+      "Multisig SQLite DB path (default ~/.chainlesschain/multisig.db)",
+    )
+    .option(
+      "--multisig-log <path>",
+      "Multisig governance log path (default ~/.chainlesschain/multisig.governance.log)",
+    )
+    .option(
+      "--mtc",
+      "On success, stage an MTC bridge envelope carrying the multisig provenance (requires cc crosschain mtc-batch to close)",
+    )
+    .option("--mtc-config-dir <dir>", "Override MTC config root")
+    .option("--json", "JSON output")
+    .action(async (proposalId, opts) => {
+      const db = _dbFromCtx(cc);
+      return _bridgeConsume({
+        db,
+        proposalId,
+        multisigDb: opts.multisigDb || defaultMultisigDbPath(),
+        multisigLog: opts.multisigLog || defaultMultisigLogPath(),
+        json: opts.json,
+        mtc: opts.mtc,
+        mtcConfigDir: opts.mtcConfigDir,
+      });
+    });
+
   cc.command("bridge-status <bridge-id> <status>")
     .description("Update bridge status")
     .option("-t, --tx-hash <hash>", "Transaction hash")
@@ -242,6 +619,31 @@ export function registerCrossChainCommand(program) {
       if (b.lock_tx_hash) console.log(`Lock TX:   ${b.lock_tx_hash}`);
       if (b.mint_tx_hash) console.log(`Mint TX:   ${b.mint_tx_hash}`);
       if (b.error_message) console.log(`Error:     ${b.error_message}`);
+      // #21 B.5 Layer 2 PR1 — surface m-of-n provenance when present.
+      if (b.multisig_proposal_id) {
+        console.log(`Multisig:  ${b.multisig_proposal_id}`);
+        try {
+          const signers = b.signers_did_json
+            ? JSON.parse(b.signers_did_json)
+            : [];
+          const sigs = b.partial_sigs_json
+            ? JSON.parse(b.partial_sigs_json)
+            : [];
+          console.log(
+            `Signers:   ${signers.length} — ${signers.join(", ") || "(none)"}`,
+          );
+          if (sigs.length) {
+            const algs = [...new Set(sigs.map((s) => s.alg))].join("+");
+            console.log(`Sigs:      ${sigs.length} partial (${algs})`);
+          }
+        } catch (_err) {
+          /* malformed provenance JSON — show raw cell content */
+          if (b.signers_did_json)
+            console.log(`Signers:   ${b.signers_did_json}`);
+          if (b.partial_sigs_json)
+            console.log(`Sigs:      ${b.partial_sigs_json}`);
+        }
+      }
     });
 
   cc.command("bridges")