@cello-protocol/daemon 0.0.131 → 0.0.133

package/dist/document-ack-inbound.js

@@ -0,0 +1,174 @@
+/**
+ * DOD-DOC-INBOUND-2 — consuming an arriving ACK. This is what closes DELIVERY-2's loop.
+ *
+ * Without it a sent envelope's outcome is `admitted: null` forever: the worker knows the content
+ * left and nothing more, so it re-sends on the ack timeout and eventually stalls the document at
+ * the unacked ceiling.
+ *
+ * ── EVERY CHECK HERE GUARDS ONE OF TWO IRREVERSIBLE CONSEQUENCES ──────────────────────────────
+ *
+ * An ack SETTLES an envelope. Admitted, it stops being redelivered; rejected, the sender rolls back
+ * local work and supersedes. Both are things an unauthenticated party must not be able to cause, so
+ * the order is:
+ *
+ *   1. DECODE            — refuse malformed input before interpreting any of it.
+ *   2. KNOW the document — an ack for a document we do not hold settles nothing that exists.
+ *   3. ACKER is the peer — a document is a pairwise agreement; nobody else's answer settles it.
+ *   4. VERIFY            — before any write. An unsigned ack that silenced a delivery would drop
+ *                          the content from the pending set with neither operator ever learning it
+ *                          was never applied — the silent divergence the two-layer design exists to
+ *                          prevent.
+ *   5. THE ENVELOPE IS OURS — we authored it, and it is in the log. An ack for a peer-authored
+ *                          envelope settles a delivery that was never ours to make; an ack for an
+ *                          envelope that is not there is a bug or a probe, and recording it would
+ *                          put a claim about a nonexistent delivery into a permanent record.
+ *   6. SETTLE            — mark acked; on a rejection also record it durably on the publishing side,
+ *                          because an operator needs to know WHY their work was refused after a
+ *                          restart, not merely that it was.
+ */
+import { decodeDocumentAck, buildDocumentAckTbs } from "@cello-protocol/protocol-types";
+export class DocumentAckInbound {
+    #d;
+    constructor(deps) {
+        this.#d = deps;
+    }
+    receive(ownerAgentId, wire, nowMs, correlationId = "ack") {
+        // 1. DECODE.
+        let ack;
+        try {
+            ack = decodeDocumentAck(wire);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            this.#d.logger.warn("document.ack.malformed", { detail, correlationId });
+            // One reason code with the upstream message in the detail — the decoder's named refusals and
+            // raw CBOR errors both arrive here, and building a code out of the message turns the second
+            // kind into English prose nothing can match on.
+            return { ok: false, reason: "document_ack_malformed", detail };
+        }
+        // 2. KNOW the document.
+        const doc = this.#d.store.getDocument(ownerAgentId, ack.document_id);
+        if (!doc) {
+            return {
+                ok: false,
+                reason: "document_unknown",
+                detail: `no document ${ack.document_id.slice(0, 16)}… for this agent`,
+            };
+        }
+        // 3. The acker must be THIS document's peer.
+        if (ack.acker_agent_id !== doc.peerAgentId) {
+            this.#d.logger.warn("document.ack.not_peer", {
+                documentId: ack.document_id,
+                ackerAgentId: ack.acker_agent_id,
+                peerAgentId: doc.peerAgentId,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "document_ack_not_peer",
+                // The peer's identity is not disclosed to a party that has not authenticated.
+                detail: "you are not a party to this document",
+            };
+        }
+        // 4. VERIFY, before any write.
+        if (!this.#d.verifySignature(ack.acker_agent_id, buildDocumentAckTbs(ack), ack.signature)) {
+            this.#d.logger.error("document.ack.signature_invalid", {
+                documentId: ack.document_id,
+                ackerAgentId: ack.acker_agent_id,
+                envelopeHash: ack.envelope_hash,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "document_ack_signature_invalid",
+                detail: `the ack claims to come from ${ack.acker_agent_id} but its signature does not verify ` +
+                    `against that agent — nothing was settled`,
+            };
+        }
+        // 5. The envelope must be one WE authored, and it must exist.
+        const row = this.#d.store
+            .getEnvelopeLog(ownerAgentId, ack.document_id)
+            .find((e) => e.envelopeHash === ack.envelope_hash);
+        if (!row) {
+            return {
+                ok: false,
+                reason: "document_ack_envelope_unknown",
+                detail: `envelope ${ack.envelope_hash.slice(0, 16)}… is not in this document's log`,
+            };
+        }
+        if (row.senderAgentId !== ownerAgentId) {
+            return {
+                ok: false,
+                reason: "document_ack_not_author",
+                detail: `envelope ${ack.envelope_hash.slice(0, 16)}… was authored by ${row.senderAgentId}, not by ` +
+                    `you — there is no delivery of ours for this ack to settle`,
+            };
+        }
+        // 6. SETTLE ONCE. The wire type's own header states this contract: nothing binds an ack to the
+        // acker's chain, so one acker can produce a valid ADMISSION and a valid REJECTION for the same
+        // envelope. Applying the later one would let a peer that admitted an envelope later claim it
+        // refused it — and the sender would roll back work the peer already holds. A second,
+        // CONTRADICTING ack is an error; a second identical one is an ordinary redelivery.
+        const alreadyAcked = row.ackedAtMs != null;
+        if (alreadyAcked) {
+            // ENVELOPE-scoped. The document-scoped reader answers a different question, and using it
+            // here would make a rejection of any OTHER envelope in this document read as a rejection of
+            // this one — so an honest redelivered admission would be refused as a contradiction the
+            // moment anything else in the document had ever been refused.
+            const previouslyRejected = this.#d.store.rejectionReceivedFor(ownerAgentId, ack.document_id, ack.envelope_hash);
+            const contradicts = ack.admitted === previouslyRejected;
+            if (contradicts) {
+                this.#d.logger.error("document.ack.contradiction", {
+                    documentId: ack.document_id,
+                    envelopeHash: ack.envelope_hash,
+                    ackerAgentId: ack.acker_agent_id,
+                    nowSays: ack.admitted ? "admitted" : "rejected",
+                    correlationId,
+                });
+                return {
+                    ok: false,
+                    reason: "document_ack_contradiction",
+                    detail: `${ack.acker_agent_id} already settled envelope ${ack.envelope_hash.slice(0, 16)}… and ` +
+                        `now says the opposite — this envelope stays settled as it was, and both claims are ` +
+                        `retained`,
+                };
+            }
+            // An identical redelivery. Nothing to do, and nothing to complain about.
+            return { ok: true, admitted: ack.admitted, envelopeHash: ack.envelope_hash };
+        }
+        // `markAcked` is idempotent and returns whether this was the first — a redelivered ack must not
+        // move the recorded time, or the delivery record says the peer confirmed at a moment it did not.
+        const first = this.#d.store.markAcked(ownerAgentId, ack.document_id, ack.envelope_hash, nowMs);
+        if (!ack.admitted) {
+            // Durable on the publishing side. A log line would not survive the restart after which the
+            // operator asks why their work never landed — and this is also what bounds the retry on the
+            // side that actually loops.
+            this.#d.rejections.recordIncomingRejection(ownerAgentId, ack.document_id, {
+                rejectionEnvelopeHash: ackRecordHash(ack.envelope_hash, ack.acked_at_ms),
+                rejectedEnvelopeHash: ack.envelope_hash,
+                reason: ack.rejection_reason ?? "document_rejected",
+                fromAgentId: ack.acker_agent_id,
+            });
+            return { ok: true, admitted: false, envelopeHash: ack.envelope_hash };
+        }
+        this.#d.logger.info("document.ack.admitted", {
+            documentId: ack.document_id,
+            envelopeHash: ack.envelope_hash,
+            firstAck: first,
+            correlationId,
+        });
+        return { ok: true, admitted: true, envelopeHash: ack.envelope_hash };
+    }
+}
+/**
+ * The identity of the RECEIVED-rejection row.
+ *
+ * Derived from the acked envelope and the acker's own timestamp — both signed — so a redelivered
+ * ack collapses onto the same row instead of advancing the round. Deriving it from anything local
+ * (a clock read here, a counter) would make every redelivery a new rejection, and three of those
+ * stall the document.
+ */
+function ackRecordHash(envelopeHash, ackedAtMs) {
+    return `${envelopeHash}:${ackedAtMs}`;
+}
+//# sourceMappingURL=document-ack-inbound.js.map

package/dist/document-ack-inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-ack-inbound.js","sourceRoot":"","sources":["../src/document-ack-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAqBxF,MAAM,OAAO,kBAAkB;IACpB,EAAE,CAAyB;IAEpC,YAAY,IAA4B;QACtC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,OAAO,CACL,YAAoB,EACpB,IAAgB,EAChB,KAAa,EACb,aAAa,GAAG,KAAK;QAErB,aAAa;QACb,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACzE,6FAA6F;YAC7F,4FAA4F;YAC5F,gDAAgD;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,eAAe,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB;aACtE,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBAC3C,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,YAAY,EAAE,GAAG,CAAC,cAAc;gBAChC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uBAAuB;gBAC/B,8EAA8E;gBAC9E,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1F,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBACrD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,YAAY,EAAE,GAAG,CAAC,cAAc;gBAChC,YAAY,EAAE,GAAG,CAAC,aAAa;gBAC/B,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EACJ,+BAA+B,GAAG,CAAC,cAAc,qCAAqC;oBACtF,0CAA0C;aAC7C,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK;aACtB,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,+BAA+B;gBACvC,MAAM,EAAE,YAAY,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC;aACpF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,yBAAyB;gBACjC,MAAM,EACJ,YAAY,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,GAAG,CAAC,aAAa,WAAW;oBAC3F,2DAA2D;aAC9D,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,qFAAqF;QACrF,mFAAmF;QACnF,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,YAAY,EAAE,CAAC;YACjB,yFAAyF;YACzF,4FAA4F;YAC5F,wFAAwF;YACxF,8DAA8D;YAC9D,MAAM,kBAAkB,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAC3D,YAAY,EACZ,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,aAAa,CAClB,CAAC;YACF,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,kBAAkB,CAAC;YACxD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;oBACjD,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;oBAC/B,YAAY,EAAE,GAAG,CAAC,cAAc;oBAChC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;oBAC/C,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,4BAA4B;oBACpC,MAAM,EACJ,GAAG,GAAG,CAAC,cAAc,6BAA6B,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ;wBACxF,qFAAqF;wBACrF,UAAU;iBACb,CAAC;YACJ,CAAC;YACD,yEAAyE;YACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC/E,CAAC;QAED,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAE/F,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,2FAA2F;YAC3F,4FAA4F;YAC5F,4BAA4B;YAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;gBACxE,qBAAqB,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC;gBACxE,oBAAoB,EAAE,GAAG,CAAC,aAAa;gBACvC,MAAM,EAAE,GAAG,CAAC,gBAAgB,IAAI,mBAAmB;gBACnD,WAAW,EAAE,GAAG,CAAC,cAAc;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAC3C,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,QAAQ,EAAE,KAAK;YACf,aAAa;SACd,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;IACvE,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,YAAoB,EAAE,SAAiB;IAC5D,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC"}

package/dist/document-control-notifier.d.ts

@@ -0,0 +1,61 @@
+/**
+ * DOD-DOC-TOOLS-1 — telling the peer a document has ended.
+ *
+ * `DocumentLifecycle` ends a document locally without asking anyone, deliberately: a kill is a
+ * safety verb, and a safety verb that needs the counterparty's cooperation is not one. But a peer
+ * who is never told keeps publishing into a document that will never answer — their updates refused
+ * at the far end forever, with nothing on their screen explaining why. So the notification is
+ * REQUIRED to be attempted, ALLOWED to fail, and the operator is told which happened.
+ *
+ * ── WHY THIS IS A MODULE AND NOT A CLOSURE IN THE COMPOSITION ROOT ────────────────────────────
+ *
+ * It was one, and that is precisely how the surface tests passed while the feature did nothing.
+ * `createDocumentLayer` takes `notifyPeer` as an injected seam, so the two-party test wired it to
+ * `async () => ({ ok: true })` — which reported success, sent nothing, and agreed with whatever the
+ * near side did. Kill "worked" on both sides of the assertion and on neither side of the wire.
+ *
+ * That is the same shape as the two defects the DELIVERY-2 review found: a stub on the far side
+ * cannot disagree with you. So the construction lives here, and both the daemon and the test build
+ * it from this function — the test can still substitute the TRANSPORT, which is the part that has
+ * to be substituted, without also substituting the logic under test.
+ *
+ * ── WHY THE DOCUMENT IS FOUND BY SCANNING ─────────────────────────────────────────────────────
+ *
+ * `notifyPeer`'s signature carries no owner: lifecycle calls it knowing only the document id, and
+ * widening that interface would push a multi-agent daemon concern into a unit that deliberately has
+ * none. So the owner is resolved here, by asking each agent this daemon holds whether the document
+ * is theirs. A document id is a hash committing to both parties and a nonce, so at most one agent
+ * can answer.
+ */
+import { type DocumentControlVerb } from "@cello-protocol/protocol-types";
+import type { DocumentStore } from "./document-store.js";
+export interface DocumentControlNotifierDeps {
+    store: DocumentStore;
+    /** The agents this daemon holds — name for signing and sending, owner key for scoping the store. */
+    owners(): ReadonlyArray<{
+        agentName: string;
+        ownerAgentId: string;
+    }>;
+    /** Sign as the named agent. A miss must REFUSE, not substitute another agent's key. */
+    sign(agentName: string, tbs: Uint8Array): Promise<Uint8Array>;
+    send(agentName: string, input: {
+        peerAgentId: string;
+        documentId: string;
+        bytes: Uint8Array;
+        correlationId: string;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    now(): number;
+}
+export type NotifyPeer = (documentId: string, verb: DocumentControlVerb) => Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export declare function createDocumentControlNotifier(deps: DocumentControlNotifierDeps): NotifyPeer;
+//# sourceMappingURL=document-control-notifier.d.ts.map

package/dist/document-control-notifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-control-notifier.d.ts","sourceRoot":"","sources":["../src/document-control-notifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,aAAa,CAAC;IACrB,oGAAoG;IACpG,MAAM,IAAI,aAAa,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,uFAAuF;IACvF,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,CACF,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAC3F,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,GAAG,IAAI,MAAM,CAAC;CACf;AAED,MAAM,MAAM,UAAU,GAAG,CACvB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,mBAAmB,KACtB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3D,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,2BAA2B,GAAG,UAAU,CAqC3F"}

package/dist/document-control-notifier.js

@@ -0,0 +1,70 @@
+/**
+ * DOD-DOC-TOOLS-1 — telling the peer a document has ended.
+ *
+ * `DocumentLifecycle` ends a document locally without asking anyone, deliberately: a kill is a
+ * safety verb, and a safety verb that needs the counterparty's cooperation is not one. But a peer
+ * who is never told keeps publishing into a document that will never answer — their updates refused
+ * at the far end forever, with nothing on their screen explaining why. So the notification is
+ * REQUIRED to be attempted, ALLOWED to fail, and the operator is told which happened.
+ *
+ * ── WHY THIS IS A MODULE AND NOT A CLOSURE IN THE COMPOSITION ROOT ────────────────────────────
+ *
+ * It was one, and that is precisely how the surface tests passed while the feature did nothing.
+ * `createDocumentLayer` takes `notifyPeer` as an injected seam, so the two-party test wired it to
+ * `async () => ({ ok: true })` — which reported success, sent nothing, and agreed with whatever the
+ * near side did. Kill "worked" on both sides of the assertion and on neither side of the wire.
+ *
+ * That is the same shape as the two defects the DELIVERY-2 review found: a stub on the far side
+ * cannot disagree with you. So the construction lives here, and both the daemon and the test build
+ * it from this function — the test can still substitute the TRANSPORT, which is the part that has
+ * to be substituted, without also substituting the logic under test.
+ *
+ * ── WHY THE DOCUMENT IS FOUND BY SCANNING ─────────────────────────────────────────────────────
+ *
+ * `notifyPeer`'s signature carries no owner: lifecycle calls it knowing only the document id, and
+ * widening that interface would push a multi-agent daemon concern into a unit that deliberately has
+ * none. So the owner is resolved here, by asking each agent this daemon holds whether the document
+ * is theirs. A document id is a hash committing to both parties and a nonce, so at most one agent
+ * can answer.
+ */
+import { randomUUID } from "node:crypto";
+import { encodeDocumentControl, buildDocumentControlTbs, DOCUMENT_CONTROL_VERSION, } from "@cello-protocol/protocol-types";
+export function createDocumentControlNotifier(deps) {
+    return async (documentId, verb) => {
+        for (const { agentName, ownerAgentId } of deps.owners()) {
+            const doc = deps.store.getDocument(ownerAgentId, documentId);
+            if (!doc)
+                continue;
+            const control = {
+                type: "document_control",
+                control_version: DOCUMENT_CONTROL_VERSION,
+                document_id: documentId,
+                sender_agent_id: ownerAgentId,
+                verb,
+                sent_at_ms: deps.now(),
+                signature: new Uint8Array(0),
+            };
+            let signature;
+            try {
+                signature = await deps.sign(agentName, buildDocumentControlTbs(control));
+            }
+            catch {
+                // REFUSED, not skipped and not sent unsigned. The peer must reject an unsigned control
+                // frame, so shipping one would report a notification that cannot possibly land — and the
+                // caller reports `peerNotified` straight to the operator.
+                return { ok: false, reason: "document_control_unsigned" };
+            }
+            control.signature = signature;
+            return deps.send(agentName, {
+                peerAgentId: doc.peerAgentId,
+                documentId,
+                bytes: encodeDocumentControl(control),
+                correlationId: randomUUID(),
+            });
+        }
+        // No agent on this daemon holds it. Named as such rather than reported as a transport failure:
+        // the two want different things from whoever reads the log.
+        return { ok: false, reason: "document_unknown" };
+    };
+}
+//# sourceMappingURL=document-control-notifier.js.map

package/dist/document-control-notifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-control-notifier.js","sourceRoot":"","sources":["../src/document-control-notifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GAGzB,MAAM,gCAAgC,CAAC;AAqBxC,MAAM,UAAU,6BAA6B,CAAC,IAAiC;IAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;QAChC,KAAK,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,OAAO,GAAoB;gBAC/B,IAAI,EAAE,kBAAkB;gBACxB,eAAe,EAAE,wBAAwB;gBACzC,WAAW,EAAE,UAAU;gBACvB,eAAe,EAAE,YAAY;gBAC7B,IAAI;gBACJ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;gBACtB,SAAS,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;aAC7B,CAAC;YACF,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,uFAAuF;gBACvF,yFAAyF;gBACzF,0DAA0D;gBAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;YAE9B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,UAAU;gBACV,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC;gBACrC,aAAa,EAAE,UAAU,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,+FAA+F;QAC/F,4DAA4D;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC"}

package/dist/document-delivery-transport.d.ts

@@ -0,0 +1,94 @@
+/**
+ * DOD-DOC-DELIVERY-2 — the transport behind `DocumentDeliveryTransport` (§16.4).
+ *
+ * DELIVERY-1 built the scheduler and the bookkeeping against an injected seam. This is the seam's
+ * implementation: the first NON-HANDLER consumer of the session machinery, which is what makes it
+ * interesting — every other caller of `SessionNegotiator` runs because an agent asked for
+ * something, and this one runs because a document has a pending envelope and nobody is watching.
+ *
+ * ── REUSE BEFORE OPEN, AND WHY THAT ORDER ─────────────────────────────────────────────────────
+ *
+ * §16.4: "the daemon uses the most recent active session with that peer or opens one". Reuse first,
+ * because opening is the expensive half — a directory negotiation, a dial, and a seal — and a
+ * backlog of pending envelopes for one peer would otherwise pay it per envelope. It is also the
+ * behaviour an operator expects when they are mid-conversation about the document: the change lands
+ * in the same sealed record as the discussion, without anyone passing a session hint.
+ *
+ * An explicit `sessionHint` overrides the choice but NOT the validation — a hint naming a session
+ * that is not active with this peer is refused rather than silently replaced by the daemon's own
+ * pick, because the one reason to pass a hint is to control which sealed record the change lands
+ * in, and quietly choosing a different one defeats exactly that.
+ *
+ * ── WHAT AN ACK IS HERE, AND WHAT IT IS NOT ───────────────────────────────────────────────────
+ *
+ * `sendContent` reports that the content left, or was PARKED at the relay for an offline peer. That
+ * is a transport fact. The DoD's ack is a different one — "the peer's daemon confirms admission (or
+ * rejection)" — and it can only come from the peer's inbound document handler, which is its own
+ * line. So this adapter returns `admitted: null`: SENT, not acked.
+ *
+ * That third state is not hedging; both two-valued answers are dishonest here. `true` would mark
+ * the envelope acknowledged in the log while the peer may never have applied it, and the log being
+ * right about what the peer holds is the entire reason pending is derived from it. `false` would
+ * count a send that WORKED as a failure and re-send content already in flight — the
+ * permanent-redelivery shape this milestone has already fixed once. The worker records the envelope
+ * as delivered, leaves it unacked, and asks again on the capped backoff.
+ */
+import type { DocumentDeliveryTransport } from "./document-delivery.js";
+import type { DocumentEnvelopeRow } from "./document-store.js";
+import { DiscoveryUnavailableError } from "./document-reachability.js";
+import type { DiscoveryOutcome } from "./cross-node-negotiation.js";
+import type { Logger } from "./types.js";
+export interface DocumentTransportDeps {
+    /**
+     * Take this frame's position in OUR OWN session tree, after it has gone out — the `0x04` doc leaf.
+     *
+     * `cello_send` does this and the document path did not, and the consequence is not a missing
+     * audit record: the tree is the sequence space both sides count in, so a sender that skips it
+     * falls one behind per frame and the peer silently drops what it has already consumed.
+     */
+    appendLeaf(agentName: string, sessionId: string, contentHash: Uint8Array, correlationId: string): void;
+    /** The agent this worker delivers for. One worker per attended agent. */
+    agentName: string;
+    /** `runDiscoveryLookup`, supplied by the composition root — it lives in a closure there. */
+    lookupPeer(peerAgentId: string, correlationId: string): Promise<DiscoveryOutcome>;
+    /**
+     * Close and SEAL a session this adapter opened. §16.4: the autonomous session "still happens
+     * because it carries signing, encryption, and the seal" — an opened session left running is a
+     * live node the operator did not start and that never produces the sealed record the whole
+     * design exists for.
+     */
+    sealSession(agentName: string, sessionId: string, correlationId: string): Promise<void>;
+    /** Active sessions with this peer, most recent LAST. */
+    activeSessionsWith(agentName: string, peerAgentId: string): string[];
+    /** The existing initiate path: negotiate, dial, create the session node. */
+    openSession(agentName: string, peerAgentId: string, correlationId: string): Promise<{
+        ok: true;
+        sessionId: string;
+    } | {
+        ok: false;
+        reason: string;
+        guidance?: string;
+    }>;
+    /** `SessionNodeManager.sendContent`. */
+    sendContent(agentName: string, sessionId: string, content: Uint8Array, contentHash: Uint8Array, correlationId: string): Promise<{
+        ok: true;
+        delivered: true;
+    } | {
+        ok: true;
+        delivered: false;
+        parked: true;
+    } | {
+        ok: false;
+        reason: string;
+        error: string;
+    }>;
+    /** Encode a document envelope row onto the wire, and its content hash. */
+    encodeEnvelope(envelope: DocumentEnvelopeRow): {
+        bytes: Uint8Array;
+        hash: Uint8Array;
+    };
+    logger: Logger;
+}
+export declare function createDocumentDeliveryTransport(deps: DocumentTransportDeps): DocumentDeliveryTransport;
+export { DiscoveryUnavailableError };
+//# sourceMappingURL=document-delivery-transport.d.ts.map

package/dist/document-delivery-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-delivery-transport.d.ts","sourceRoot":"","sources":["../src/document-delivery-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAExE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAA6B,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACvG,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClF;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,wDAAwD;IACxD,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrE,4EAA4E;IAC5E,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,wCAAwC;IACxC,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,UAAU,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,GAC5C;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAC/C,CAAC;IACF,0EAA0E;IAC1E,cAAc,CAAC,QAAQ,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,qBAAqB,GAC1B,yBAAyB,CAqJ3B;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAC"}

package/dist/document-delivery-transport.js

@@ -0,0 +1,179 @@
+/**
+ * DOD-DOC-DELIVERY-2 — the transport behind `DocumentDeliveryTransport` (§16.4).
+ *
+ * DELIVERY-1 built the scheduler and the bookkeeping against an injected seam. This is the seam's
+ * implementation: the first NON-HANDLER consumer of the session machinery, which is what makes it
+ * interesting — every other caller of `SessionNegotiator` runs because an agent asked for
+ * something, and this one runs because a document has a pending envelope and nobody is watching.
+ *
+ * ── REUSE BEFORE OPEN, AND WHY THAT ORDER ─────────────────────────────────────────────────────
+ *
+ * §16.4: "the daemon uses the most recent active session with that peer or opens one". Reuse first,
+ * because opening is the expensive half — a directory negotiation, a dial, and a seal — and a
+ * backlog of pending envelopes for one peer would otherwise pay it per envelope. It is also the
+ * behaviour an operator expects when they are mid-conversation about the document: the change lands
+ * in the same sealed record as the discussion, without anyone passing a session hint.
+ *
+ * An explicit `sessionHint` overrides the choice but NOT the validation — a hint naming a session
+ * that is not active with this peer is refused rather than silently replaced by the daemon's own
+ * pick, because the one reason to pass a hint is to control which sealed record the change lands
+ * in, and quietly choosing a different one defeats exactly that.
+ *
+ * ── WHAT AN ACK IS HERE, AND WHAT IT IS NOT ───────────────────────────────────────────────────
+ *
+ * `sendContent` reports that the content left, or was PARKED at the relay for an offline peer. That
+ * is a transport fact. The DoD's ack is a different one — "the peer's daemon confirms admission (or
+ * rejection)" — and it can only come from the peer's inbound document handler, which is its own
+ * line. So this adapter returns `admitted: null`: SENT, not acked.
+ *
+ * That third state is not hedging; both two-valued answers are dishonest here. `true` would mark
+ * the envelope acknowledged in the log while the peer may never have applied it, and the log being
+ * right about what the peer holds is the entire reason pending is derived from it. `false` would
+ * count a send that WORKED as a failure and re-send content already in flight — the
+ * permanent-redelivery shape this milestone has already fixed once. The worker records the envelope
+ * as delivered, leaves it unacked, and asks again on the capped backoff.
+ */
+import { wireContentHash } from "./wire-content-hash.js";
+import { reachabilityFromDiscovery, DiscoveryUnavailableError } from "./document-reachability.js";
+export function createDocumentDeliveryTransport(deps) {
+    /**
+     * Acquire a session with the peer — the hint, then the most recent active one, then a fresh dial.
+     *
+     * ONE implementation for every document frame kind. A proposal that opened its own session by a
+     * separate code path would drift on which session gets reused and on whether a session this
+     * daemon opened is sealed, and both are unrecoverable after the fact.
+     */
+    async function acquireSession(peerAgentId, sessionHint, correlationId) {
+        const active = deps.activeSessionsWith(deps.agentName, peerAgentId);
+        if (sessionHint !== undefined) {
+            if (!active.includes(sessionHint)) {
+                // Refused, not replaced. The only reason to pass a hint is to control which sealed record
+                // the change lands in; quietly substituting the daemon's own pick would defeat exactly
+                // that, and it would do so silently.
+                return {
+                    ok: false,
+                    reason: "document_session_hint_invalid",
+                    detail: `session ${sessionHint.slice(0, 16)}… is not an active session with ${peerAgentId}, ` +
+                        `so the change cannot be placed in that record`,
+                };
+            }
+            return { ok: true, sessionId: sessionHint, sessionOpened: false };
+        }
+        // Most recent LAST — activeSessionsWith is ordered oldest-first by the daemon's adapter.
+        if (active.length > 0)
+            return { ok: true, sessionId: active[active.length - 1], sessionOpened: false };
+        const opened = await deps.openSession(deps.agentName, peerAgentId, correlationId);
+        if (!opened.ok) {
+            // The upstream reason verbatim. `document_delivery_threw` is reserved for a genuine
+            // programming fault; a dial that was refused should say it was refused.
+            return { ok: false, reason: opened.reason, detail: opened.guidance };
+        }
+        return { ok: true, sessionId: opened.sessionId, sessionOpened: true };
+    }
+    return {
+        async isPeerReachable(peerAgentId, correlationId) {
+            // The PASS's correlation id, threaded through. A per-peer constant was fabricated here, so
+            // every `directory.discovery.lookup` this worker ever emitted carried the same string and
+            // none of them joined to the pass — breaking the thread at exactly the hop an operator needs
+            // when nothing is syncing.
+            const outcome = await deps.lookupPeer(peerAgentId, correlationId);
+            // Throws on everything that is not an answer about the peer — see document-reachability.ts.
+            // The worker treats the throw as `lookup_failed` and keeps it out of the offline-peer count.
+            // The unknown-agent bit is RETURNED rather than logged here, so the worker can announce it
+            // against the document it belongs to.
+            return reachabilityFromDiscovery(outcome);
+        },
+        async sendBytes(input) {
+            const { peerAgentId, documentId, bytes, sessionHint, correlationId } = input;
+            const session = await acquireSession(peerAgentId, sessionHint, correlationId);
+            if (!session.ok)
+                return session;
+            // THE WIRE HASH, domain-separated. This was `sha256(bytes)`, and the receiver recomputes
+            // `sha256(0x00 || bytes)` for every frame — so the send reported success, `parked: false`,
+            // and the peer discarded it at the authenticity check before the document layer was ever
+            // consulted. Found by two real daemons; no in-process test could see it, because both sides
+            // of those compute the hash with the same function.
+            const hash = wireContentHash(bytes);
+            const sent = await deps.sendContent(deps.agentName, session.sessionId, bytes, hash, correlationId);
+            if (!sent.ok) {
+                // Sealed even on a send failure, for the same reason as below: a session this daemon opened
+                // and walked away from is a live node the operator never started. A failed send is exactly
+                // when that is most likely to happen.
+                if (session.sessionOpened)
+                    await deps.sealSession(deps.agentName, session.sessionId, correlationId);
+                return { ok: false, reason: sent.reason, detail: sent.error };
+            }
+            // APPEND OUR OWN LEAF, exactly as `cello_send` does after a successful send.
+            //
+            // Not bookkeeping. The daemon's session tree is the sequence space both sides count in, and a
+            // sender that puts content on the wire without taking its leaf position leaves its own chain
+            // one behind for every frame it sends. The peer then sees a sequence it has already consumed
+            // and drops the frame — silently, because a duplicate is a normal event, so nothing is logged
+            // anywhere and the send reports success with `parked: false`.
+            //
+            // It hid behind an accident: with no prior traffic every frame is sequence 0, so the FIRST
+            // document frame in a fresh session arrives and everything after it does not. Adding one
+            // ordinary message before the exchange moved the failure earlier, which is what named the
+            // cause.
+            deps.appendLeaf(deps.agentName, session.sessionId, hash, correlationId);
+            deps.logger.info("document.frame.sent", {
+                documentId,
+                sessionId: session.sessionId,
+                sessionOpened: session.sessionOpened,
+                bytes: bytes.length,
+                parked: sent.delivered === false,
+                correlationId,
+            });
+            if (session.sessionOpened)
+                await deps.sealSession(deps.agentName, session.sessionId, correlationId);
+            return { ok: true, sessionId: session.sessionId, sessionOpened: session.sessionOpened };
+        },
+        async deliver(input) {
+            const { peerAgentId, documentId, envelope, sessionHint, correlationId } = input;
+            const session = await acquireSession(peerAgentId, sessionHint, correlationId);
+            if (!session.ok)
+                return session;
+            const { sessionId, sessionOpened } = session;
+            const { bytes, hash } = deps.encodeEnvelope(envelope);
+            const sent = await deps.sendContent(deps.agentName, sessionId, bytes, hash, correlationId);
+            if (sent.ok)
+                deps.appendLeaf(deps.agentName, sessionId, hash, correlationId);
+            if (!sent.ok) {
+                // SEAL WHAT WE OPENED, on the failure path too. This branch walked away from a session it
+                // had just dialled — a live node the operator never started, with no sealed record, which
+                // is precisely what the rule twenty lines below says the seal exists to prevent. A failed
+                // send is when it is most likely to happen, not least.
+                if (sessionOpened)
+                    await deps.sealSession(deps.agentName, sessionId, correlationId);
+                return { ok: false, reason: sent.reason, detail: sent.error };
+            }
+            deps.logger.info("document.delivery.sent", {
+                documentId,
+                sessionId,
+                sessionOpened,
+                parked: sent.delivered === false,
+                correlationId,
+            });
+            // SEAL what we opened. §16.4: the autonomous session still happens because it carries
+            // signing, encryption and the seal — the ceremony goes to zero, the seal does not. A session
+            // this adapter opened and walked away from is a live node the operator never started, and
+            // the sealed record the design exists to produce is never produced. A session we REUSED is
+            // not ours to close: its owner decides when that conversation ends.
+            if (sessionOpened) {
+                await deps.sealSession(deps.agentName, sessionId, correlationId);
+            }
+            // SENT, NOT ACKED — `admitted: null`. The content left (or was parked for an offline peer),
+            // which is a transport fact; the DoD's ack is the peer's daemon confirming admission, and
+            // that answer comes from the inbound document handler, which is its own line.
+            //
+            // Neither of the two-valued answers is available honestly. `true` would mark the envelope
+            // acknowledged in the log while the peer may never have applied it — and the log being right
+            // about what the peer holds is the entire reason pending is derived from it. `false` would
+            // count a send that WORKED as a failure and re-send content already in flight, which is the
+            // permanent-redelivery shape this milestone already fixed once.
+            return { ok: true, sessionId, sessionOpened, admitted: null };
+        },
+    };
+}
+export { DiscoveryUnavailableError };
+//# sourceMappingURL=document-delivery-transport.js.map

package/dist/document-delivery-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-delivery-transport.js","sourceRoot":"","sources":["../src/document-delivery-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAiDlG,MAAM,UAAU,+BAA+B,CAC7C,IAA2B;IAE3B;;;;;;OAMG;IACH,KAAK,UAAU,cAAc,CAC3B,WAAmB,EACnB,WAA+B,EAC/B,aAAqB;QAKrB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,0FAA0F;gBAC1F,uFAAuF;gBACvF,qCAAqC;gBACrC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,+BAA+B;oBACvC,MAAM,EACJ,WAAW,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mCAAmC,WAAW,IAAI;wBACrF,+CAA+C;iBAClD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACpE,CAAC;QACD,yFAAyF;QACzF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,oFAAoF;YACpF,wEAAwE;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,aAAqB;YAC9D,2FAA2F;YAC3F,0FAA0F;YAC1F,6FAA6F;YAC7F,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAClE,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,sCAAsC;YACtC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;YAC7E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC;YAEhC,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,4FAA4F;YAC5F,oDAAoD;YACpD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,4FAA4F;gBAC5F,2FAA2F;gBAC3F,sCAAsC;gBACtC,IAAI,OAAO,CAAC,aAAa;oBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChE,CAAC;YACD,6EAA6E;YAC7E,EAAE;YACF,8FAA8F;YAC9F,6FAA6F;YAC7F,6FAA6F;YAC7F,8FAA8F;YAC9F,8DAA8D;YAC9D,EAAE;YACF,2FAA2F;YAC3F,yFAAyF;YACzF,0FAA0F;YAC1F,SAAS;YACT,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACtC,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;gBAChC,aAAa;aACd,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1F,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;YAEhF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC;YAChC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;YAE7C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC3F,IAAI,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,0FAA0F;gBAC1F,0FAA0F;gBAC1F,0FAA0F;gBAC1F,uDAAuD;gBACvD,IAAI,aAAa;oBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;gBACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACzC,UAAU;gBACV,SAAS;gBACT,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;gBAChC,aAAa;aACd,CAAC,CAAC;YAEH,sFAAsF;YACtF,6FAA6F;YAC7F,0FAA0F;YAC1F,2FAA2F;YAC3F,oEAAoE;YACpE,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACnE,CAAC;YAED,4FAA4F;YAC5F,0FAA0F;YAC1F,8EAA8E;YAC9E,EAAE;YACF,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,4FAA4F;YAC5F,gEAAgE;YAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAC"}