@cello-protocol/daemon 0.0.137 → 0.0.139

package/dist/column-birth.d.ts

@@ -0,0 +1,40 @@
+/**
+ * COLUMN BIRTH — adding a column to a table an operator already holds data in.
+ *
+ * `ALTER TABLE … ADD COLUMN` throws when the column is already there, and that throw is the guard:
+ * it is how a birth-gated migration stays idempotent without a version table nobody maintains. The
+ * pattern is right. The way it was written twice in this codebase was not:
+ *
+ *     try { db.exec(sql); } catch { }
+ *
+ * A bare catch cannot tell "already present" — the expected, benign case, which happens on every
+ * start after the first — from a schema that is actually broken. So a real failure produced no log
+ * line, no throw, and no symptom at the point of failure. The only evidence would be every later
+ * query on that column failing, in a different subsystem, with a message that names neither the
+ * migration nor the table.
+ *
+ * That matters most exactly where it is least observable: the FIRST run on a new machine. A second
+ * operator, or a fresh database, is where a migration executes for real — and it was the one place
+ * the code was guaranteed to say nothing.
+ *
+ * So: match the benign case by its message and return; anything else is logged under its own event
+ * and rethrown. Rethrowing is the deliberate half. If the column cannot be added, every query that
+ * reads it fails anyway — the choice is not between working and failing, it is between failing at
+ * startup with the cause named and failing later somewhere else with the cause lost.
+ */
+import type { Logger } from "./types.js";
+/**
+ * Run one `ADD COLUMN`, treating "already present" as success and everything else as a fault.
+ *
+ * `table` and `column` are for the log line only — the SQL is the authority. They are separate
+ * arguments rather than parsed out of it because a regex over SQL is a second, worse parser, and
+ * the caller already knows both.
+ */
+export declare function addColumnIfMissing(db: {
+    exec(sql: string): void;
+}, logger: Logger, input: {
+    table: string;
+    column: string;
+    sql: string;
+}): void;
+//# sourceMappingURL=column-birth.d.ts.map

package/dist/column-birth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"column-birth.d.ts","sourceRoot":"","sources":["../src/column-birth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAYzC;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE;IAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpD,IAAI,CAgBN"}

package/dist/column-birth.js

@@ -0,0 +1,60 @@
+/**
+ * COLUMN BIRTH — adding a column to a table an operator already holds data in.
+ *
+ * `ALTER TABLE … ADD COLUMN` throws when the column is already there, and that throw is the guard:
+ * it is how a birth-gated migration stays idempotent without a version table nobody maintains. The
+ * pattern is right. The way it was written twice in this codebase was not:
+ *
+ *     try { db.exec(sql); } catch { }
+ *
+ * A bare catch cannot tell "already present" — the expected, benign case, which happens on every
+ * start after the first — from a schema that is actually broken. So a real failure produced no log
+ * line, no throw, and no symptom at the point of failure. The only evidence would be every later
+ * query on that column failing, in a different subsystem, with a message that names neither the
+ * migration nor the table.
+ *
+ * That matters most exactly where it is least observable: the FIRST run on a new machine. A second
+ * operator, or a fresh database, is where a migration executes for real — and it was the one place
+ * the code was guaranteed to say nothing.
+ *
+ * So: match the benign case by its message and return; anything else is logged under its own event
+ * and rethrown. Rethrowing is the deliberate half. If the column cannot be added, every query that
+ * reads it fails anyway — the choice is not between working and failing, it is between failing at
+ * startup with the cause named and failing later somewhere else with the cause lost.
+ */
+/**
+ * SQLite's wording for "this column is already here", which is the whole benign case.
+ *
+ * Matched on the MESSAGE rather than a code because the driver surfaces a plain `Error`. Anchored
+ * to the phrase rather than the column name so one expression covers every call site — and
+ * deliberately NOT a loose `/duplicate/`, which would also swallow a duplicate-table or
+ * duplicate-index failure that has nothing to do with this column.
+ */
+const ALREADY_PRESENT = /duplicate column name/i;
+/**
+ * Run one `ADD COLUMN`, treating "already present" as success and everything else as a fault.
+ *
+ * `table` and `column` are for the log line only — the SQL is the authority. They are separate
+ * arguments rather than parsed out of it because a regex over SQL is a second, worse parser, and
+ * the caller already knows both.
+ */
+export function addColumnIfMissing(db, logger, input) {
+    try {
+        db.exec(input.sql);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (ALREADY_PRESENT.test(message))
+            return;
+        // NAMED, at error, before the rethrow — so the cause is in the log even if something upstream
+        // catches the throw and reports it as a generic startup failure.
+        logger.error("db.column_birth.failed", {
+            table: input.table,
+            column: input.column,
+            sql: input.sql,
+            error: message,
+        });
+        throw err;
+    }
+}
+//# sourceMappingURL=column-birth.js.map

package/dist/column-birth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"column-birth.js","sourceRoot":"","sources":["../src/column-birth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAA+B,EAC/B,MAAc,EACd,KAAqD;IAErD,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QAC1C,8FAA8F;QAC9F,iEAAiE;QACjE,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;YACrC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/daemon.js

@@ -3333,6 +3333,48 @@ async function startDaemonHoldingLock(config, singletonLock) {
                 // `0x00` domain prefix, so a bare hash is discarded at the authenticity check.
                 return { bytes, hash: wireContentHash(bytes) };
             },
+            // The owner KEY, not the agent name — every document row is scoped by our own pubkey hex
+            // (M14-D5), and the store query behind this reads that column. Passing the name here
+            // returns no rows and the wait times out on every delivery.
+            awaitAck: async (envelopeHash, timeoutMs) => {
+                const ownerKey = documentOwnerKeyFor(agentName);
+                if (ownerKey === null) {
+                    // NOT "the peer stayed silent". `false` means the grace expired with no answer, and the
+                    // caller logs exactly that — `graceMs: 10000`, a claim that ten seconds elapsed when
+                    // none did, about a peer that was never asked. A delivery worker running for an agent
+                    // whose own pubkey cannot be resolved is a wiring bug, and it says so here rather than
+                    // arriving downstream dressed as a fact about the counterparty. Same distinction
+                    // `abandoned_at` exists to keep: giving up is our decision, not evidence about them.
+                    logger.error("document.delivery.ack_wait_unwired", { agentName, envelopeHash });
+                    return null;
+                }
+                return documentLayer.awaitAck(ownerKey, envelopeHash, timeoutMs);
+            },
+            drainHeld: async (sessionId, correlationId) => {
+                // ONLY WHEN THERE IS A GAP. `sealReadiness` already answers exactly this question, and
+                // gating on it keeps the ordinary delivery — the overwhelming majority — free of a relay
+                // round trip it does not need.
+                const readiness = sessionNodeManager.sealReadiness(agentName, sessionId);
+                if (readiness.heldCount === 0 && readiness.missingLeaves === 0)
+                    return;
+                logger.info("document.delivery.drain_held", {
+                    agentName,
+                    sessionId,
+                    heldCount: readiness.heldCount,
+                    missingLeaves: readiness.missingLeaves,
+                    correlationId,
+                });
+                await autoRecoverForAgent(agentName, "delivery_ack_grace").catch((err) => {
+                    // CONTAINED. A recovery that fails leaves the ack held and the grace expires — the same
+                    // outcome as before, and never a reason to fail a delivery whose content already left.
+                    logger.warn("document.delivery.drain_held_failed", {
+                        agentName,
+                        sessionId,
+                        correlationId,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                });
+            },
         });
         documentTransports.set(agentName, transport);
         return transport;