@cello-protocol/client 0.0.20 → 0.0.22

package/dist/signaling-manager.d.ts

@@ -0,0 +1,85 @@
+/**
+ * SignalingManager — persistent signaling stream, frame router, per-session directory streams.
+ *
+ * Extracted from CelloClientImpl. Owns all persistent signaling stream state:
+ *   #persistentSignalingStream, #persistentSignalingIter, #openingSignalingStream,
+ *   #pendingSessionRequestResolve, #pendingRegisterResolve, #pendingDkgReadyResolve.
+ */
+import type { Stream } from "@libp2p/interface";
+import type { Logger } from "@cello-protocol/interfaces";
+import type { CelloNode } from "@cello-protocol/transport";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { SessionAssignment } from "@cello-protocol/protocol-types";
+import type { InitiateSessionResult, ReceiveAssignmentResult, SessionRecord } from "./types.js";
+/**
+ * Narrow interface exposing only what SignalingManager needs from CelloClientImpl.
+ */
+export interface SignalingContext {
+    readonly node: CelloNode;
+    readonly keyProvider: KeyProvider;
+    readonly logger: Logger;
+    getMyPubkeyHex(): string | null;
+    setMyPubkeyHex(hex: string): void;
+    getDirectoryEndpoint(): {
+        peer_id: string;
+        multiaddrs: string[];
+    } | null;
+    getDirectoryStream(sessionIdHex: string): Stream | undefined;
+    setDirectoryStream(sessionIdHex: string, stream: Stream): void;
+    deleteDirectoryStream(sessionIdHex: string): void;
+    getPendingConnectionResolverCount(): number;
+    dispatchSignalingFrame(stream: Stream, frame: Record<string, unknown>): void;
+    onSignalingStreamClosed(stream: Stream): void;
+    getConnectionIdForPeer(pubkeyHex: string): string | undefined;
+    hasConnectionPolicy(): boolean;
+    receiveSessionAssignment(assignment: SessionAssignment, myPubkey: Uint8Array): Promise<ReceiveAssignmentResult>;
+    getSession(sessionIdHex: string): SessionRecord | undefined;
+}
+export declare class SignalingManager {
+    #private;
+    constructor(ctx: SignalingContext);
+    getPersistentSignalingStream(): Stream | null;
+    setPersistentSignalingStream(stream: Stream | null): void;
+    setPersistentSignalingIter(iter: AsyncIterator<Uint8Array> | null): void;
+    hasPendingSessionRequest(): boolean;
+    hasPendingRegister(): boolean;
+    hasPendingDkgReady(): boolean;
+    getPendingSessionRequestResolve(): ((frame: Record<string, unknown>) => void) | null;
+    setPendingSessionRequestResolve(resolve: ((frame: Record<string, unknown>) => void) | null): void;
+    setPendingRegisterResolve(resolve: ((frame: Record<string, unknown>) => void) | null): void;
+    setPendingDkgReadyResolve(resolve: ((frame: Record<string, unknown>) => void) | null): void;
+    resolvePendingRegister(frame: Record<string, unknown>): void;
+    resolvePendingDkgReady(frame: Record<string, unknown>): void;
+    /**
+     * Called when the signaling stream closes. Unblocks all pending resolvers.
+     */
+    onStreamClosed(stream: Stream): void;
+    /**
+     * Open and authenticate the persistent directory signaling stream.
+     * Serializes concurrent calls.
+     */
+    openPersistentSignalingStream(directoryPeerId?: string, directoryMultiaddr?: string): Promise<boolean>;
+    /**
+     * Reconnect the persistent signaling stream.
+     */
+    reconnectDirectory(): Promise<boolean>;
+    /**
+     * Open per-session directory signaling stream (SESSION-003).
+     */
+    connectDirectorySignalingStream(sessionIdHex: string, assignment: SessionAssignment, myPubkey: Uint8Array): Promise<void>;
+    /**
+     * FEDERATION-003 AC-004: Look up a relay's registered public key from the directory.
+     */
+    getRelayPublicKey(relayId: string): Promise<string | undefined>;
+    runPersistentSignalingReader(stream: Stream, iter: AsyncIterator<Uint8Array>): void;
+    /**
+     * ADAPTER-003: Send session_request on the persistent signaling stream and await
+     * session_assignment or error. SI-002: K_local never appears in any frame or log.
+     */
+    initiateSession(targetPubkeyHex: string, opts?: {
+        directoryPeerId?: string;
+        directoryMultiaddr?: string;
+        timeoutMs?: number;
+    }): Promise<InitiateSessionResult>;
+}
+//# sourceMappingURL=signaling-manager.d.ts.map

package/dist/signaling-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signaling-manager.d.ts","sourceRoot":"","sources":["../src/signaling-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA6BhG;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACzE,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7D,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAElD,iCAAiC,IAAI,MAAM,CAAC;IAE5C,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7E,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9D,mBAAmB,IAAI,OAAO,CAAC;IAC/B,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAChH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;CAC7D;AAED,qBAAa,gBAAgB;;gBAWf,GAAG,EAAE,gBAAgB;IAMjC,4BAA4B,IAAI,MAAM,GAAG,IAAI;IAI7C,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIzD,0BAA0B,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI;IAIxE,wBAAwB,IAAI,OAAO;IAInC,kBAAkB,IAAI,OAAO;IAI7B,kBAAkB,IAAI,OAAO;IAI7B,+BAA+B,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI;IAIpF,+BAA+B,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAIjG,yBAAyB,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAI3F,yBAAyB,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAI3F,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAQ5D,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAQ5D;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAwBpC;;;OAGG;IACH,6BAA6B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IActG;;OAEG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC;IAU5C;;OAEG;IACG,+BAA+B,CACnC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC;IA2DhB;;OAEG;IACG,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAuGrE,4BAA4B,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,GAC9B,IAAI;IA0KP;;;OAGG;IACG,eAAe,CACnB,eAAe,EAAE,MAAM,EACvB,IAAI,CAAC,EAAE;QACL,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,qBAAqB,CAAC;CAqGlC"}

package/dist/signaling-manager.js

@@ -0,0 +1,597 @@
+/**
+ * SignalingManager — persistent signaling stream, frame router, per-session directory streams.
+ *
+ * Extracted from CelloClientImpl. Owns all persistent signaling stream state:
+ *   #persistentSignalingStream, #persistentSignalingIter, #openingSignalingStream,
+ *   #pendingSessionRequestResolve, #pendingRegisterResolve, #pendingDkgReadyResolve.
+ */
+import { createHash } from "node:crypto";
+import { Encoder, decode } from "cbor-x";
+import * as lp from "it-length-prefixed";
+import { parseSessionAssignment, mapSessionRequestErrorFrame } from "./session-assignment-parser.js";
+const SIGNALING_PROTOCOL_ID = "/cello/signaling/1.0.0";
+const AUTH_DOMAIN_DIR = "CELLO-DIR-AUTH-v1";
+const RELAY_AUTH_TIMEOUT_MS = 5_000;
+const CBOR_ENC = new Encoder({ tagUint8Array: false });
+function toU8(v) {
+    if (v instanceof Uint8Array)
+        return v;
+    if (Buffer.isBuffer(v))
+        return new Uint8Array(v);
+    if (typeof v.slice === "function") {
+        return v.slice();
+    }
+    throw new Error(`expected bytes, got ${typeof v}`);
+}
+async function nextWithTimeout(iter, timeoutMs) {
+    return Promise.race([
+        iter.next(),
+        new Promise((_, reject) => setTimeout(() => reject(new Error("auth_timeout")), timeoutMs)),
+    ]);
+}
+export class SignalingManager {
+    #ctx;
+    // Signaling state owned by this manager
+    #persistentSignalingStream = null;
+    #persistentSignalingIter = null;
+    #openingSignalingStream = null;
+    #pendingSessionRequestResolve = null;
+    #pendingRegisterResolve = null;
+    #pendingDkgReadyResolve = null;
+    constructor(ctx) {
+        this.#ctx = ctx;
+    }
+    // ─── Public state accessors (used by facade to wire other managers) ─────────
+    getPersistentSignalingStream() {
+        return this.#persistentSignalingStream;
+    }
+    setPersistentSignalingStream(stream) {
+        this.#persistentSignalingStream = stream;
+    }
+    setPersistentSignalingIter(iter) {
+        this.#persistentSignalingIter = iter;
+    }
+    hasPendingSessionRequest() {
+        return this.#pendingSessionRequestResolve !== null;
+    }
+    hasPendingRegister() {
+        return this.#pendingRegisterResolve !== null;
+    }
+    hasPendingDkgReady() {
+        return this.#pendingDkgReadyResolve !== null;
+    }
+    getPendingSessionRequestResolve() {
+        return this.#pendingSessionRequestResolve;
+    }
+    setPendingSessionRequestResolve(resolve) {
+        this.#pendingSessionRequestResolve = resolve;
+    }
+    setPendingRegisterResolve(resolve) {
+        this.#pendingRegisterResolve = resolve;
+    }
+    setPendingDkgReadyResolve(resolve) {
+        this.#pendingDkgReadyResolve = resolve;
+    }
+    resolvePendingRegister(frame) {
+        const resolve = this.#pendingRegisterResolve;
+        if (resolve) {
+            this.#pendingRegisterResolve = null;
+            resolve(frame);
+        }
+    }
+    resolvePendingDkgReady(frame) {
+        const resolve = this.#pendingDkgReadyResolve;
+        if (resolve) {
+            this.#pendingDkgReadyResolve = null;
+            resolve(frame);
+        }
+    }
+    /**
+     * Called when the signaling stream closes. Unblocks all pending resolvers.
+     */
+    onStreamClosed(stream) {
+        if (this.#persistentSignalingStream !== stream)
+            return;
+        this.#persistentSignalingStream = null;
+        this.#persistentSignalingIter = null;
+        const dkgReadyResolve = this.#pendingDkgReadyResolve;
+        if (dkgReadyResolve) {
+            this.#pendingDkgReadyResolve = null;
+            dkgReadyResolve({ type: "register_error", reason: "stream_closed" });
+        }
+        const regResolve = this.#pendingRegisterResolve;
+        if (regResolve) {
+            this.#pendingRegisterResolve = null;
+            regResolve({ type: "register_error", reason: "stream_closed" });
+        }
+        const sessionResolve = this.#pendingSessionRequestResolve;
+        if (sessionResolve) {
+            this.#pendingSessionRequestResolve = null;
+            sessionResolve({ type: "session_request_error", reason: "directory_unreachable" });
+        }
+    }
+    /**
+     * Open and authenticate the persistent directory signaling stream.
+     * Serializes concurrent calls.
+     */
+    openPersistentSignalingStream(directoryPeerId, directoryMultiaddr) {
+        if (this.#persistentSignalingStream)
+            return Promise.resolve(true);
+        const existing = this.#openingSignalingStream;
+        if (existing)
+            return existing;
+        const p = this.#doOpen(directoryPeerId, directoryMultiaddr).finally(() => {
+            if (this.#openingSignalingStream === p) {
+                this.#openingSignalingStream = null;
+            }
+        });
+        this.#openingSignalingStream = p;
+        return p;
+    }
+    /**
+     * Reconnect the persistent signaling stream.
+     */
+    async reconnectDirectory() {
+        const stream = this.#persistentSignalingStream;
+        if (stream) {
+            try {
+                stream.abort(new Error("reconnect"));
+            }
+            catch { }
+            this.#persistentSignalingStream = null;
+            this.#persistentSignalingIter = null;
+        }
+        return this.openPersistentSignalingStream();
+    }
+    /**
+     * Open per-session directory signaling stream (SESSION-003).
+     */
+    async connectDirectorySignalingStream(sessionIdHex, assignment, myPubkey) {
+        const dirPeerId = assignment.directory_endpoint.peer_id;
+        const dirMultiaddr = assignment.directory_endpoint.multiaddrs[0];
+        if (!dirPeerId)
+            return;
+        try {
+            if (dirMultiaddr) {
+                try {
+                    await this.#ctx.node.dial(dirMultiaddr);
+                }
+                catch { /* already connected */ }
+            }
+            let dirStream;
+            try {
+                dirStream = await this.#ctx.node.newStream(dirPeerId, SIGNALING_PROTOCOL_ID);
+            }
+            catch {
+                return;
+            }
+            this.#ctx.setDirectoryStream(sessionIdHex, dirStream);
+            const iter = lp.decode(dirStream)[Symbol.asyncIterator]();
+            const { value: challengeRaw, done } = await iter.next();
+            if (done || challengeRaw === undefined) {
+                dirStream.abort(new Error("dir_auth_error"));
+                return;
+            }
+            let challengeFrame;
+            try {
+                challengeFrame = decode(toU8(challengeRaw));
+            }
+            catch {
+                dirStream.abort(new Error("dir_auth_error"));
+                return;
+            }
+            if (challengeFrame["type"] !== "signaling_auth_challenge") {
+                dirStream.abort(new Error("dir_auth_error"));
+                return;
+            }
+            const nonce = toU8(challengeFrame["nonce"]);
+            const domain = Buffer.from(AUTH_DOMAIN_DIR, "utf8");
+            const authMsg = new Uint8Array(Buffer.concat([domain, nonce, myPubkey]));
+            const msgHash = new Uint8Array(createHash("sha256").update(authMsg).digest());
+            const sig = await this.#ctx.keyProvider.sign(msgHash);
+            const authResponseFrame = CBOR_ENC.encode({
+                type: "signaling_auth_response",
+                pubkey: myPubkey,
+                signature: sig,
+            });
+            dirStream.send(lp.encode.single(authResponseFrame));
+            const { value: ackRaw2, done: ackDone2 } = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+            if (ackDone2 || ackRaw2 === undefined) {
+                dirStream.abort(new Error("dir_auth_error"));
+                return;
+            }
+            let ackFrame2;
+            try {
+                ackFrame2 = decode(toU8(ackRaw2));
+            }
+            catch {
+                dirStream.abort(new Error("dir_auth_error"));
+                return;
+            }
+            if (ackFrame2["type"] !== "signaling_auth_ok") {
+                dirStream.abort(new Error("dir_auth_error"));
+                return;
+            }
+            void this.#runDirectoryStreamReader(sessionIdHex, dirStream, assignment.directory_pubkey, iter);
+        }
+        catch {
+            // Directory connection failure — session still active
+        }
+    }
+    /**
+     * FEDERATION-003 AC-004: Look up a relay's registered public key from the directory.
+     */
+    async getRelayPublicKey(relayId) {
+        const directoryEndpoint = this.#ctx.getDirectoryEndpoint();
+        if (!directoryEndpoint)
+            return undefined;
+        const dirPeerId = directoryEndpoint.peer_id;
+        const dirMultiaddr = directoryEndpoint.multiaddrs[0];
+        try {
+            if (dirMultiaddr) {
+                try {
+                    await this.#ctx.node.dial(dirMultiaddr);
+                }
+                catch { /* already connected */ }
+            }
+            let sigStream;
+            try {
+                sigStream = await this.#ctx.node.newStream(dirPeerId, SIGNALING_PROTOCOL_ID);
+            }
+            catch (err) {
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: err instanceof Error ? err.message : "stream_open_failed" });
+                return undefined;
+            }
+            const iter = lp.decode(sigStream)[Symbol.asyncIterator]();
+            const { value: challengeRaw, done } = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+            if (done || challengeRaw === undefined) {
+                sigStream.abort(new Error("dir_auth_error"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "no_auth_challenge" });
+                return undefined;
+            }
+            let challengeFrame;
+            try {
+                challengeFrame = decode(toU8(challengeRaw));
+            }
+            catch {
+                sigStream.abort(new Error("dir_auth_error"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "decode_failed" });
+                return undefined;
+            }
+            if (challengeFrame["type"] !== "signaling_auth_challenge") {
+                sigStream.abort(new Error("dir_auth_error"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "unexpected_frame" });
+                return undefined;
+            }
+            const nonce = toU8(challengeFrame["nonce"]);
+            if (!this.#ctx.getMyPubkeyHex()) {
+                const pubkey = await this.#ctx.keyProvider.getPublicKey();
+                this.#ctx.setMyPubkeyHex(Buffer.from(pubkey).toString("hex"));
+            }
+            const myPubkey = Buffer.from(this.#ctx.getMyPubkeyHex(), "hex");
+            const domain = Buffer.from(AUTH_DOMAIN_DIR, "utf8");
+            const authMsg = new Uint8Array(Buffer.concat([domain, nonce, myPubkey]));
+            const msgHash = new Uint8Array(createHash("sha256").update(authMsg).digest());
+            const sig = await this.#ctx.keyProvider.sign(msgHash);
+            sigStream.send(lp.encode.single(CBOR_ENC.encode({
+                type: "signaling_auth_response",
+                pubkey: myPubkey,
+                signature: sig,
+            })));
+            const { value: ackRaw, done: ackDone } = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+            if (ackDone || ackRaw === undefined) {
+                sigStream.abort(new Error("dir_auth_error"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "no_auth_ack" });
+                return undefined;
+            }
+            let ackFrame;
+            try {
+                ackFrame = decode(toU8(ackRaw));
+            }
+            catch {
+                sigStream.abort(new Error("dir_auth_error"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "decode_failed" });
+                return undefined;
+            }
+            if (ackFrame["type"] !== "signaling_auth_ok") {
+                sigStream.abort(new Error("dir_auth_error"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "auth_failed" });
+                return undefined;
+            }
+            sigStream.send(lp.encode.single(CBOR_ENC.encode({
+                type: "relay_pubkey_request",
+                relay_id: relayId,
+            })));
+            const { value: respRaw, done: respDone } = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+            if (respDone || respRaw === undefined) {
+                sigStream.abort(new Error("no_response"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "no_response" });
+                return undefined;
+            }
+            let respFrame;
+            try {
+                respFrame = decode(toU8(respRaw));
+            }
+            catch {
+                sigStream.abort(new Error("decode_failed"));
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: "decode_failed" });
+                return undefined;
+            }
+            sigStream.close().catch(() => { });
+            if (respFrame["type"] === "relay_pubkey_response") {
+                return respFrame["public_key_hex"];
+            }
+            const errorReason = respFrame["reason"] ?? "not_found";
+            if (errorReason !== "not_found") {
+                this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: errorReason });
+            }
+            return undefined;
+        }
+        catch (err) {
+            this.#ctx.logger.warn("relay.pubkey.lookup.failed", { relayId, reason: err instanceof Error ? err.message : "unknown" });
+            return undefined;
+        }
+    }
+    // ─── Persistent signaling reader ──────────────────────────────────────────────
+    runPersistentSignalingReader(stream, iter) {
+        void this.#doRunPersistentSignalingReader(stream, iter);
+    }
+    async #doRunPersistentSignalingReader(stream, iter) {
+        this.#ctx.logger.debug("signaling.stream.frame.received", { frameType: "reader_started" });
+        try {
+            while (true) {
+                let result;
+                try {
+                    result = await iter.next();
+                }
+                catch (iterErr) {
+                    this.#ctx.logger.debug("signaling.stream.iter.error", { error: iterErr instanceof Error ? iterErr.message : String(iterErr) });
+                    break;
+                }
+                if (result.done || result.value === undefined) {
+                    this.#ctx.logger.debug("signaling.stream.closed", {
+                        pendingSessionRequest: this.hasPendingSessionRequest(),
+                        pendingRegister: this.hasPendingRegister(),
+                        pendingDkgReady: this.hasPendingDkgReady(),
+                        pendingConnectionResolvers: this.#ctx.getPendingConnectionResolverCount(),
+                    });
+                    break;
+                }
+                let frame;
+                try {
+                    frame = decode(toU8(result.value));
+                }
+                catch (decErr) {
+                    this.#ctx.logger.debug("signaling.stream.decode.error", { error: decErr instanceof Error ? decErr.message : String(decErr) });
+                    continue;
+                }
+                this.#ctx.logger.debug("signaling.stream.frame.received", { frameType: String(frame["type"]) });
+                // Dispatch all frames to the facade which routes them to the appropriate manager
+                this.#ctx.dispatchSignalingFrame(stream, frame);
+            }
+        }
+        catch (outerErr) {
+            this.#ctx.logger.debug("signaling.stream.iter.error", { error: outerErr instanceof Error ? outerErr.message : String(outerErr) });
+        }
+        // Notify facade that stream is closed — clears stream refs and unblocks pending resolvers
+        this.onStreamClosed(stream);
+        // Also notify facade for seal reconnect scheduling
+        this.#ctx.onSignalingStreamClosed(stream);
+    }
+    // ─── Per-session directory stream reader ───────────────────────────────────────
+    async #runDirectoryStreamReader(sessionIdHex, stream, directoryPubkey, iter) {
+        try {
+            while (true) {
+                let result;
+                try {
+                    result = await iter.next();
+                }
+                catch {
+                    break;
+                }
+                if (result.done || result.value === undefined)
+                    break;
+                let frame;
+                try {
+                    frame = decode(toU8(result.value));
+                }
+                catch {
+                    continue;
+                }
+                // Wrap frame with session context and dispatch
+                frame["__session_id_hex"] = sessionIdHex;
+                frame["__directory_pubkey"] = directoryPubkey;
+                this.#ctx.dispatchSignalingFrame(stream, frame);
+            }
+        }
+        catch { /* stream closed */ }
+        if (this.#ctx.getDirectoryStream(sessionIdHex) === stream) {
+            this.#ctx.deleteDirectoryStream(sessionIdHex);
+        }
+    }
+    // ─── Private: open implementation ──────────────────────────────────────────────
+    async #doOpen(directoryPeerId, directoryMultiaddr) {
+        const directoryEndpoint = this.#ctx.getDirectoryEndpoint();
+        if (!directoryEndpoint && !directoryPeerId)
+            return false;
+        if (this.#persistentSignalingStream)
+            return true;
+        const dirPeerId = directoryPeerId ?? directoryEndpoint.peer_id;
+        const dirMultiaddr = directoryMultiaddr ?? directoryEndpoint?.multiaddrs[0];
+        try {
+            if (dirMultiaddr) {
+                try {
+                    await this.#ctx.node.dial(dirMultiaddr);
+                }
+                catch { /* non-fatal */ }
+            }
+            let sigStream;
+            try {
+                sigStream = await this.#ctx.node.newStream(dirPeerId, SIGNALING_PROTOCOL_ID);
+            }
+            catch {
+                return false;
+            }
+            const iter = lp.decode(sigStream)[Symbol.asyncIterator]();
+            const { value: challengeRaw, done } = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+            if (done || challengeRaw === undefined) {
+                sigStream.abort(new Error("dir_auth_error"));
+                return false;
+            }
+            let challengeFrame;
+            try {
+                challengeFrame = decode(toU8(challengeRaw));
+            }
+            catch {
+                sigStream.abort(new Error("dir_auth_error"));
+                return false;
+            }
+            if (challengeFrame["type"] !== "signaling_auth_challenge") {
+                sigStream.abort(new Error("dir_auth_error"));
+                return false;
+            }
+            const nonce = toU8(challengeFrame["nonce"]);
+            if (nonce.length !== 32) {
+                sigStream.abort(new Error("dir_auth_error"));
+                return false;
+            }
+            if (!this.#ctx.getMyPubkeyHex()) {
+                const pubkey = await this.#ctx.keyProvider.getPublicKey();
+                this.#ctx.setMyPubkeyHex(Buffer.from(pubkey).toString("hex"));
+            }
+            const myPubkey = Buffer.from(this.#ctx.getMyPubkeyHex(), "hex");
+            const domain = Buffer.from(AUTH_DOMAIN_DIR, "utf8");
+            const authMsg = new Uint8Array(Buffer.concat([domain, nonce, myPubkey]));
+            const msgHash = new Uint8Array(createHash("sha256").update(authMsg).digest());
+            const sig = await this.#ctx.keyProvider.sign(msgHash);
+            const authResponseFrame = CBOR_ENC.encode({
+                type: "signaling_auth_response",
+                pubkey: myPubkey,
+                signature: sig,
+            });
+            sigStream.send(lp.encode.single(authResponseFrame));
+            const { value: ackRaw, done: ackDone } = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+            if (ackDone || ackRaw === undefined) {
+                sigStream.abort(new Error("dir_auth_error"));
+                return false;
+            }
+            let ackFrame;
+            try {
+                ackFrame = decode(toU8(ackRaw));
+            }
+            catch {
+                sigStream.abort(new Error("dir_auth_error"));
+                return false;
+            }
+            if (ackFrame["type"] !== "signaling_auth_ok") {
+                sigStream.abort(new Error("dir_auth_error"));
+                return false;
+            }
+            const peerInfoFrame = CBOR_ENC.encode({
+                type: "peer_info_announce",
+                peer_id: this.#ctx.node.getPeerId(),
+                multiaddrs: this.#ctx.node.listenAddresses(),
+            });
+            sigStream.send(lp.encode.single(peerInfoFrame));
+            this.#persistentSignalingStream = sigStream;
+            this.#persistentSignalingIter = iter;
+            this.runPersistentSignalingReader(sigStream, iter);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    // ─── ADAPTER-003: initiateSession ────────────────────────────────────────────
+    /**
+     * ADAPTER-003: Send session_request on the persistent signaling stream and await
+     * session_assignment or error. SI-002: K_local never appears in any frame or log.
+     */
+    async initiateSession(targetPubkeyHex, opts) {
+        const timeoutMs = opts?.timeoutMs ?? 30_000;
+        // SESSION-006: check local connections map before touching the signaling stream.
+        const connectionId = this.#ctx.getConnectionIdForPeer(targetPubkeyHex);
+        if (this.#ctx.hasConnectionPolicy() && !connectionId) {
+            return { ok: false, reason: "no_connection" };
+        }
+        if (!this.#ctx.getDirectoryEndpoint() && !opts?.directoryPeerId) {
+            return { ok: false, reason: "directory_unreachable" };
+        }
+        // Ensure myPubkeyHex is set
+        if (!this.#ctx.getMyPubkeyHex()) {
+            const pubkey = await this.#ctx.keyProvider.getPublicKey();
+            this.#ctx.setMyPubkeyHex(Buffer.from(pubkey).toString("hex"));
+        }
+        const myPubkey = Buffer.from(this.#ctx.getMyPubkeyHex(), "hex");
+        // Open persistent signaling stream if not already open (DB-001)
+        if (!this.#persistentSignalingStream) {
+            const opened = await this.openPersistentSignalingStream(opts?.directoryPeerId, opts?.directoryMultiaddr);
+            if (!opened) {
+                const retried = await this.openPersistentSignalingStream(opts?.directoryPeerId, opts?.directoryMultiaddr);
+                if (!retried) {
+                    return { ok: false, reason: "directory_unreachable" };
+                }
+            }
+        }
+        // SESSION-006: include connection_id in session_request if available
+        const sessionRequestPayload = {
+            type: "session_request",
+            target_pubkey: new Uint8Array(Buffer.from(targetPubkeyHex, "hex")),
+        };
+        if (connectionId) {
+            sessionRequestPayload["connection_id"] = connectionId;
+        }
+        const sessionRequestFrame = CBOR_ENC.encode(sessionRequestPayload);
+        // Set up Promise that resolves when the directory responds
+        let responseResolve;
+        const responsePromise = new Promise((resolve) => {
+            responseResolve = resolve;
+        });
+        this.#pendingSessionRequestResolve = responseResolve;
+        try {
+            this.#persistentSignalingStream.send(lp.encode.single(sessionRequestFrame));
+        }
+        catch {
+            this.#pendingSessionRequestResolve = null;
+            return { ok: false, reason: "directory_unreachable" };
+        }
+        // Race: directory response vs timeout
+        let responseFrame = null;
+        let timedOut = false;
+        await Promise.race([
+            responsePromise.then((f) => { responseFrame = f; }),
+            new Promise((resolve) => setTimeout(() => { timedOut = true; resolve(); }, timeoutMs)),
+        ]);
+        if (timedOut) {
+            this.#pendingSessionRequestResolve = null;
+            return { ok: false, reason: "timeout" };
+        }
+        const frame = responseFrame;
+        if (frame["type"] === "session_request_error") {
+            return mapSessionRequestErrorFrame(frame);
+        }
+        if (frame["type"] === "session_assignment") {
+            const rawAssignment = frame["assignment"];
+            if (!rawAssignment)
+                return { ok: false, reason: "directory_unreachable" };
+            const assignment = parseSessionAssignment(rawAssignment);
+            if (!assignment)
+                return { ok: false, reason: "directory_unreachable" };
+            const result = await this.#ctx.receiveSessionAssignment(assignment, myPubkey);
+            if (!result.ok) {
+                return { ok: false, reason: "directory_unreachable" };
+            }
+            const sessionIdHex = Buffer.from(result.sessionId).toString("hex");
+            const record = this.#ctx.getSession(sessionIdHex);
+            if (!record)
+                return { ok: false, reason: "directory_unreachable" };
+            return {
+                ok: true,
+                sessionId: result.sessionId,
+                genesisPrevRoot: record.genesis_prev_root,
+            };
+        }
+        return { ok: false, reason: "directory_unreachable" };
+    }
+}
+//# sourceMappingURL=signaling-manager.js.map