@cello-protocol/daemon 0.0.165 → 0.0.167

package/dist/session-terminal-refusal.d.ts

@@ -0,0 +1,62 @@
+/**
+ * DOD-MP-SESSION-RETIRE-1 — what this daemon DOES when the relay says a session is over.
+ *
+ * ── WHY THIS IS A MODULE AND NOT A BRANCH IN `sendContent` ────────────────────────────────────
+ *
+ * It was a branch, and that is precisely why it knew without acting. Reaching it requires a live
+ * `#activeNodes` entry holding a real relay client and a real session node — state no unit test can
+ * construct — so nothing could assert the response, and the response was: log it, refuse the send,
+ * and leave the local row saying `active`.
+ *
+ * The seam that has to be substituted to test this is the RELAY'S ANSWER. The thing under test is
+ * what we do about it. Keeping them in one function meant you could not have the second without
+ * faking the first, which is the shape that makes a test agree with whatever the code does.
+ *
+ * ── WHY RETIRING THE ROW IS THE WHOLE POINT ───────────────────────────────────────────────────
+ *
+ * The relay pushes `session_sealed` exactly once. A daemon that is down or restarting at that
+ * instant never records it, so this side keeps a row saying `active` for a session the relay has
+ * finished. Everything that picks a session by local status then picks THAT one, forever:
+ * `activeSessionsWith` filters on `status === "active"` and only opens a fresh session when nothing
+ * matches. So a stale row is not merely stale — it is a permanent block on ever opening the
+ * replacement.
+ *
+ * Observed live 2026-08-13: the document delivery worker resubmitted the same sealed session every
+ * 60 seconds, was told terminally each time, and the row survived `cello logout && cello login`
+ * because it is persisted. Nothing recovered on its own, and the only symptom was a pending count
+ * that never fell.
+ *
+ * The CONVERSATION path already handles this by telling a human to start a new session, and the
+ * guidance below still says so because that advice is right for a human. **Document delivery has no
+ * human in the loop**, so the daemon must act for them — availability and fallback are first-class
+ * protocol concerns, and a route whose only session is dead has no fallback at all.
+ *
+ * Marking it sealed is also simply TRUE. The relay is the authority on whether it will witness
+ * again, and this message is the relay saying no.
+ */
+export interface TerminalRefusalDeps {
+    logger: {
+        error(event: string, ctx: Record<string, unknown>): void;
+    };
+    /**
+     * Retire the local session row. REQUIRED — a no-op default would restore the exact defect this
+     * module exists to remove, and it would do it silently.
+     */
+    retireSession(sessionId: string): void;
+}
+export interface TerminalRefusalInput {
+    sessionId: string;
+    /** The relay's own reason — `session_sealed` or `session_not_found`. */
+    reason: string;
+    correlationId: string | undefined;
+}
+export interface TerminalRefusalResult {
+    ok: false;
+    reason: string;
+    error: string;
+    /** Never durable: there is no later attempt that can succeed on this session. */
+    durable: false;
+    guidance: string;
+}
+export declare function terminalRelayRefusal(deps: TerminalRefusalDeps, input: TerminalRefusalInput): TerminalRefusalResult;
+//# sourceMappingURL=session-terminal-refusal.d.ts.map

package/dist/session-terminal-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-terminal-refusal.d.ts","sourceRoot":"","sources":["../src/session-terminal-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;IACrE;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,OAAO,EAAE,KAAK,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,oBAAoB,GAC1B,qBAAqB,CA8BvB"}

package/dist/session-terminal-refusal.js

@@ -0,0 +1,66 @@
+/**
+ * DOD-MP-SESSION-RETIRE-1 — what this daemon DOES when the relay says a session is over.
+ *
+ * ── WHY THIS IS A MODULE AND NOT A BRANCH IN `sendContent` ────────────────────────────────────
+ *
+ * It was a branch, and that is precisely why it knew without acting. Reaching it requires a live
+ * `#activeNodes` entry holding a real relay client and a real session node — state no unit test can
+ * construct — so nothing could assert the response, and the response was: log it, refuse the send,
+ * and leave the local row saying `active`.
+ *
+ * The seam that has to be substituted to test this is the RELAY'S ANSWER. The thing under test is
+ * what we do about it. Keeping them in one function meant you could not have the second without
+ * faking the first, which is the shape that makes a test agree with whatever the code does.
+ *
+ * ── WHY RETIRING THE ROW IS THE WHOLE POINT ───────────────────────────────────────────────────
+ *
+ * The relay pushes `session_sealed` exactly once. A daemon that is down or restarting at that
+ * instant never records it, so this side keeps a row saying `active` for a session the relay has
+ * finished. Everything that picks a session by local status then picks THAT one, forever:
+ * `activeSessionsWith` filters on `status === "active"` and only opens a fresh session when nothing
+ * matches. So a stale row is not merely stale — it is a permanent block on ever opening the
+ * replacement.
+ *
+ * Observed live 2026-08-13: the document delivery worker resubmitted the same sealed session every
+ * 60 seconds, was told terminally each time, and the row survived `cello logout && cello login`
+ * because it is persisted. Nothing recovered on its own, and the only symptom was a pending count
+ * that never fell.
+ *
+ * The CONVERSATION path already handles this by telling a human to start a new session, and the
+ * guidance below still says so because that advice is right for a human. **Document delivery has no
+ * human in the loop**, so the daemon must act for them — availability and fallback are first-class
+ * protocol concerns, and a route whose only session is dead has no fallback at all.
+ *
+ * Marking it sealed is also simply TRUE. The relay is the authority on whether it will witness
+ * again, and this message is the relay saying no.
+ */
+export function terminalRelayRefusal(deps, input) {
+    // RETIRE FIRST, THEN REPORT — and the code now matches the comment, which it did not. The logger
+    // is an injected dependency and can throw; logging first meant a throw there left the row live,
+    // which is the pre-fix state exactly. The retirement is the load-bearing act, so it goes first.
+    deps.retireSession(input.sessionId);
+    deps.logger.error("session.relay.hash.submit.terminal", {
+        sessionId: input.sessionId,
+        reason: input.reason,
+        correlationId: input.correlationId,
+        impact: "the relay has ended this session — nothing sent now can ever be part of its record",
+    });
+    return {
+        ok: false,
+        reason: input.reason,
+        error: input.reason === "session_sealed"
+            ? "the relay has already sealed this session, so nothing further can enter its record"
+            : "the relay no longer holds this session, so nothing further can enter its record",
+        durable: false,
+        // WORDED FOR BOTH CALLERS. `sendContent` is shared with `cello_send`, so a human reads this
+        // too — and "the next send will start a fresh one" is true only for the document worker, which
+        // opens sessions on its own. A person has to start one. Saying otherwise would leave them
+        // waiting for an automatic recovery that never comes, which is the same wrong-audience mistake
+        // as telling someone to wait out a fault on their own machine.
+        guidance: `This session is over as far as the relay is concerned, and anything sent now would be ` +
+            `invisible to the receipt. Nothing was sent. This daemon has now retired the session on its ` +
+            `side, so nothing is stuck on it: document delivery will open a fresh session by itself, and ` +
+            `a conversation needs you to start a new one. The conversation so far is not lost.`,
+    };
+}
+//# sourceMappingURL=session-terminal-refusal.js.map

package/dist/session-terminal-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-terminal-refusal.js","sourceRoot":"","sources":["../src/session-terminal-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA2BH,MAAM,UAAU,oBAAoB,CAClC,IAAyB,EACzB,KAA2B;IAE3B,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;QACtD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,MAAM,EAAE,oFAAoF;KAC7F,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EACH,KAAK,CAAC,MAAM,KAAK,gBAAgB;YAC/B,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,iFAAiF;QACvF,OAAO,EAAE,KAAK;QACd,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,+FAA+F;QAC/F,+DAA+D;QAC/D,QAAQ,EACN,wFAAwF;YACxF,6FAA6F;YAC7F,8FAA8F;YAC9F,mFAAmF;KACtF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cello-protocol/daemon",
-  "version": "0.0.165",
+  "version": "0.0.167",
   "private": false,
   "type": "module",
   "engines": {
@@ -36,9 +36,9 @@
     "cbor-x": "^1.6.0",
     "it-length-prefixed": "^10.0.1",
     "@cello-protocol/crypto": "0.0.50",
+    "@cello-protocol/gateway": "0.0.34",
     "@cello-protocol/protocol-types": "0.0.54",
-    "@cello-protocol/transport": "0.0.56",
-    "@cello-protocol/gateway": "0.0.34"
+    "@cello-protocol/transport": "0.0.56"
   },
   "devDependencies": {
     "@types/node": "^25.6.2",