@cello-protocol/daemon 0.0.181 → 0.0.182

package/dist/agent-id-migration.d.ts

@@ -41,6 +41,15 @@
  */
 import type { Logger } from "./types.js";
 import { type DaemonDatabase } from "./sqlcipher-db.js";
+/**
+ * The tables this migration rebuilds, derived from `REKEY_TARGETS` rather than written out again.
+ *
+ * Exported for the guards (`dod-m15-migration-guard-1`), which must cover exactly what the
+ * migration touches. A hand-typed copy over there would silently get SHORTER than this list the day
+ * an eighth table is added — so the one table nobody remembered to guard would be the one table
+ * nobody checks, which is the shape of every escape this migration has already had.
+ */
+export declare const REKEYED_TABLES: readonly string[];
 export interface AgentIdMigrationResult {
     readonly migrated: boolean;
     /** Rows copied, per rebuilt table. Absent tables are omitted. */

package/dist/agent-id-migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-id-migration.d.ts","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAwK5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAyDD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAyIxG"}
+{"version":3,"file":"agent-id-migration.d.ts","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAuO5E;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAsC,CAAC;AAEnF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAyDD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAyIxG"}

package/dist/agent-id-migration.js

@@ -79,6 +79,21 @@ const REKEY_TARGETS = [
         interrupted_by TEXT,
         restart_seal_gave_up_at INTEGER,
         restart_seal_gave_up_reason TEXT,
+        -- DOD-M15-DIVERGE-DURABLE-1. Omitting it here would delete the flag on the one boot a
+        -- legacy database upgrades, and a dropped divergence reads as HEALTHY — exactly the
+        -- failure the column was added to prevent, reintroduced by the migration that carries it.
+        diverged_at INTEGER,
+        -- Decisions Carried #8 — the session salt. Omitting it here drops the salt on the one boot
+        -- a legacy database upgrades, and a dropped salt is WORSE than no salt: every leaf hashed
+        -- under it becomes unverifiable, and the "does this session already have one?" lookup then
+        -- mints a fresh salt and splits the transcript silently. Same trap as diverged_at above.
+        content_salt BLOB,
+        -- DOD-M15-FREEZE-STATUS-1, carried for CELLO_Support's lane. Dropping these on upgrade would
+        -- un-freeze a session frozen because a party signed with a key that was not the
+        -- counterparty's — the failure that column exists to survive, reintroduced by the migration
+        -- that carries it.
+        frozen_at INTEGER,
+        frozen_reason TEXT,
         PRIMARY KEY (agent_id, session_id)
       )`,
         indexSql: () => [],
@@ -126,6 +141,14 @@ const REKEY_TARGETS = [
         direction TEXT NOT NULL,
         blob BLOB NOT NULL,
         created_at INTEGER NOT NULL,
+        -- DOD-M15-SEALWIRE-1 bullet 5. THE SECOND ENTRY. session-node-manager adds these by
+        -- inline ALTER before this rebuild runs, and the rebuild copies only the INTERSECTION --
+        -- so omitting them here DELETES a message's authorship proof on the one boot a legacy
+        -- database upgrades, then re-adds the columns empty. A transcript that silently stops
+        -- proving who wrote what is worse than one that never claimed to.
+        sender_pubkey TEXT,
+        sender_sig BLOB,
+        attribution TEXT NOT NULL DEFAULT 'local_session_state',
         PRIMARY KEY (agent_id, session_id, sequence, direction)
       )`,
         indexSql: () => [],
@@ -170,6 +193,43 @@ const REKEY_TARGETS = [
         // old semantics for them while giving each agent its own namespace.
         table: "retry_queue",
         backfill: "nullable",
+        /**
+         * ⚠️ THREE COLUMNS WERE MISSING FROM THE DDL BELOW. NOTHING WAS EVER LOST — AND WHAT KEPT IT
+         * THAT WAY IS THE ORDER OF TWO CALLS, NOT A CHECK.
+         *
+         * ⚠️ THIS COMMENT PREVIOUSLY CALLED IT *"a live data-loss bug"*, and that was WRONG. The other
+         * lane disproved it against git history and I verified it independently rather than take it:
+         * this re-key shipped 2026-07-10, `structure1_cbor` / `structure2_cbor` arrived in
+         * `retry-queue.ts` on 2026-08-05, and the re-key is one-shot. Every database that has ever run
+         * it did so a month before the columns existed, so there was never an ordering record present to
+         * drop. Recording the correction here because a comment stating a live bug that is not live is
+         * exactly the artifact this milestone keeps finding — one with the FORM of a verified finding
+         * and no verification behind it.
+         *
+         * **The real property, which is narrower and more fragile than the claim it replaces.** The
+         * rebuild copies the INTERSECTION of the two column lists, so omitting a column here does drop
+         * it — that mechanism is real and is what the header at the top of this file warns about. It is
+         * unreachable for this table only because `RetryQueue`'s constructor, which owns those
+         * `ALTER TABLE`s, runs AFTER `initialize()` — so at the moment this DDL executes, the columns do
+         * not exist to be copied. `daemon.ts` builds the queue roughly 1,400 lines after it calls
+         * `initialize()`, and nothing enforces that distance but a comment saying not to reorder.
+         *
+         * So the columns are listed here anyway. They cost nothing while the order holds, and they are
+         * the difference between a silent loss and no loss on the day someone moves the construction up.
+         *
+         * What that loss WOULD cost, if it ever became reachable: those two columns are the relay's
+         * signed ordering record, carried so a parked entry is self-ordering on recovery. Without it the
+         * recipient places the content at its ARRIVAL index rather than its witnessed sequence, the two
+         * trees part, and the session can no longer seal bilaterally.
+         *
+         * `content_hash_alg` is `DOD-M15-SEALWIRE-1` part B2b's own column, added here in the same edit
+         * as the two it would otherwise have joined. It is why the omission was found at all.
+         *
+         * The existing guard could not see any of it: `dod-agent-id-joinkey-migration` replays the inline
+         * ALTERs in the real boot order, but only the `sessions` ones — `retry_queue`'s live in a
+         * different file and run from a different constructor. `DOD-M15-MIGRATION-GUARD-1` is what now
+         * covers the cross-file case.
+         */
         createSql: (t) => `
       CREATE TABLE ${t} (
         id              INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -181,7 +241,10 @@ const REKEY_TARGETS = [
         attempts        INTEGER NOT NULL DEFAULT 1,
         position        INTEGER NOT NULL,
         awaiting_ack    INTEGER NOT NULL DEFAULT 0,
-        content_hash_hex TEXT
+        content_hash_hex TEXT,
+        structure1_cbor BLOB,
+        structure2_cbor BLOB,
+        content_hash_alg TEXT
       )`,
         indexSql: (t) => [
             `CREATE INDEX IF NOT EXISTS retry_queue_by_session_position ON ${t}(session_id, position ASC)`,
@@ -189,6 +252,15 @@ const REKEY_TARGETS = [
         ],
     },
 ];
+/**
+ * The tables this migration rebuilds, derived from `REKEY_TARGETS` rather than written out again.
+ *
+ * Exported for the guards (`dod-m15-migration-guard-1`), which must cover exactly what the
+ * migration touches. A hand-typed copy over there would silently get SHORTER than this list the day
+ * an eighth table is added — so the one table nobody remembered to guard would be the one table
+ * nobody checks, which is the shape of every escape this migration has already had.
+ */
+export const REKEYED_TABLES = REKEY_TARGETS.map((t) => t.table);
 function columnsOf(db, table) {
     return db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
 }

package/dist/agent-id-migration.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-id-migration.js","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAC;AAkB5E;;;;;;;;;;;;;GAaG;AACH,MAAM,aAAa,GAA2B;IAC5C;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;;;;;;;QAqBd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;QAUd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;QAKd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;QAMd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,EAAE;QACF,yFAAyF;QACzF,iGAAiG;QACjG,0FAA0F;QAC1F,iGAAiG;QACjG,+FAA+F;QAC/F,oEAAoE;QACpE,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;QAWd;QACJ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACf,iEAAiE,CAAC,4BAA4B;YAC9F,wEAAwE,CAAC,iDAAiD;SAC3H;KACF;CACO,CAAC;AAQX,SAAS,SAAS,CAAC,EAAkB,EAAE,KAAa;IAClD,OAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,WAAW,CAAC,EAAkB,EAAE,KAAa;IACpD,OAAO,CACL,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,CACrG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB,CAAC,EAAkB;IAC5C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,yCAAyC,CAAC;SAClD,GAAG,EAAgE,CAAC;IAEvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACjG,kGAAkG;YAClG,iGAAiG;YACjG,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,EAAkB,EAAE,KAAa;IACnD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAkB,EAAE,MAAc;IAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEpE,iGAAiG;IACjG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAG,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,0FAA0F;IAC1F,EAAE;IACF,4EAA4E;IAC5E,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,sCAAsC;IACtC,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,kFAAkF;IAClF,+FAA+F;IAC/F,+DAA+D;IAC/D,OAAO,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,YAAY,CAAC;gBAExC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE/B,8FAA8F;gBAC9F,8FAA8F;gBAC9F,6FAA6F;gBAC7F,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE/F,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,CAAC;oBACZ,6FAA6F;oBAC7F,yFAAyF;oBACzF,6FAA6F;oBAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;oBACjE,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,aAAa,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gCAC1D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;oBAChF,MAAM,CAAC,KAAK,MAAM,IAAI,0CAA0C,CACzE,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,6FAA6F;oBAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,uCAAuC,CAC5F,CAAC;oBACJ,CAAC;oBACD,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,IAAI,CACtH,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;gBACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;gBAC3C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,KAAK,SAAS,QAAQ,qBAAqB;wBAChG,GAAG,KAAK,qEAAqE,MAAM,CAAC,KAAK,cAAc;wBACvG,0FAA0F,CAC7F,CAAC;gBACJ,CAAC;gBAED,+FAA+F;gBAC/F,uEAAuE;gBACvE,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAC1B,CAAC,CAAE,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC;oBAClG,CAAC,CAAC,OAAO;wBACP,CAAC,CACG,EAAE;6BACC,OAAO,CACN,6BAA6B,MAAM,CAAC,KAAK;iGACkC,CAC5E;6BACA,GAAG,EACP,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC,CAAC;gBACV,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,SAAS,UAAU,gCAAgC;wBACrG,0FAA0F,CAC7F,CAAC;gBACJ,CAAC;gBAED,EAAE,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtC,EAAE,CAAC,IAAI,CAAC,eAAe,GAAG,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAE9D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;YAClC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oGAAoG;YACpG,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,SAAS;YACT,YAAY,EAAE,QAAQ,CAAC,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"agent-id-migration.js","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAC;AAkB5E;;;;;;;;;;;;;GAaG;AACH,MAAM,aAAa,GAA2B;IAC5C;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoCd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;QAUd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;;QAgBd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;QAKd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;QAMd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,EAAE;QACF,yFAAyF;QACzF,iGAAiG;QACjG,0FAA0F;QAC1F,iGAAiG;QACjG,+FAA+F;QAC/F,oEAAoE;QACpE,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,UAAU;QACpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAoCG;QACH,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;QAcd;QACJ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACf,iEAAiE,CAAC,4BAA4B;YAC9F,wEAAwE,CAAC,iDAAiD;SAC3H;KACF;CACO,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAQnF,SAAS,SAAS,CAAC,EAAkB,EAAE,KAAa;IAClD,OAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,WAAW,CAAC,EAAkB,EAAE,KAAa;IACpD,OAAO,CACL,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,CACrG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB,CAAC,EAAkB;IAC5C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,yCAAyC,CAAC;SAClD,GAAG,EAAgE,CAAC;IAEvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACjG,kGAAkG;YAClG,iGAAiG;YACjG,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,EAAkB,EAAE,KAAa;IACnD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAkB,EAAE,MAAc;IAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEpE,iGAAiG;IACjG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAG,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,0FAA0F;IAC1F,EAAE;IACF,4EAA4E;IAC5E,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,sCAAsC;IACtC,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,kFAAkF;IAClF,+FAA+F;IAC/F,+DAA+D;IAC/D,OAAO,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,YAAY,CAAC;gBAExC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE/B,8FAA8F;gBAC9F,8FAA8F;gBAC9F,6FAA6F;gBAC7F,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE/F,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,CAAC;oBACZ,6FAA6F;oBAC7F,yFAAyF;oBACzF,6FAA6F;oBAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;oBACjE,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,aAAa,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gCAC1D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;oBAChF,MAAM,CAAC,KAAK,MAAM,IAAI,0CAA0C,CACzE,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,6FAA6F;oBAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,uCAAuC,CAC5F,CAAC;oBACJ,CAAC;oBACD,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,IAAI,CACtH,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;gBACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;gBAC3C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,KAAK,SAAS,QAAQ,qBAAqB;wBAChG,GAAG,KAAK,qEAAqE,MAAM,CAAC,KAAK,cAAc;wBACvG,0FAA0F,CAC7F,CAAC;gBACJ,CAAC;gBAED,+FAA+F;gBAC/F,uEAAuE;gBACvE,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAC1B,CAAC,CAAE,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC;oBAClG,CAAC,CAAC,OAAO;wBACP,CAAC,CACG,EAAE;6BACC,OAAO,CACN,6BAA6B,MAAM,CAAC,KAAK;iGACkC,CAC5E;6BACA,GAAG,EACP,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC,CAAC;gBACV,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,SAAS,UAAU,gCAAgC;wBACrG,0FAA0F,CAC7F,CAAC;gBACJ,CAAC;gBAED,EAAE,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtC,EAAE,CAAC,IAAI,CAAC,eAAe,GAAG,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAE9D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;YAClC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oGAAoG;YACpG,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,SAAS;YACT,YAAY,EAAE,QAAQ,CAAC,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent-selection.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Which agent a call acts as, and HOW that was decided — `DOD-M15-SELECTION-1`,
+ * `DOD-M15-IPCVISIBLE-1`.
+ *
+ * ─── The defect this is extracted from ─────────────────────────────────────────────────────────
+ *
+ * This logic was four lines inside `daemon.ts`, ending in:
+ *
+ *     if (onlineAgents.size === 1) return [...onlineAgents][0];
+ *
+ * A connection that had selected nothing therefore acted as whichever agent happened to be the only
+ * one online. On a shared daemon that can be a DIFFERENT operator's agent, which is how it was
+ * found: after a restart a released agent was silently reinstated under someone else's name.
+ *
+ * ─── Why the fallback is worse than it looks even when it picks the "right" agent ──────────────
+ *
+ * It produces a HALF-ATTENDED state. Tools resolve a subject and work; the notification dispatcher
+ * routes doorbells by the connection's REGISTERED current agent, which this never sets. So the
+ * session sends and receives on request but never wakes — and an operator reads that as the
+ * protocol dropping messages, not as a selection that was never made.
+ *
+ * ─── AND WHY IT IS STILL HERE ──────────────────────────────────────────────────────────────────
+ *
+ * My first version switched the fallback OFF for MCP on that reasoning, and four tests said no. CC-3
+ * added it deliberately, to fix "the post-/mcp-reconnect papercut": a reconnected session with
+ * exactly one agent online used to hard-fail `no_current_agent`.
+ *
+ * `DOD-M15-SELECTION-1`'s answer is narrower than removal — *"if a fallback is wanted it is EXPLICIT
+ * in the response, not announced as an accomplished fact"* — and it sequences the work: *"diagnosis
+ * first… with the trigger field from DOD-M15-IPCVISIBLE-1 distinguishing replay from fallback in one
+ * run."* So this module makes the decision ATTRIBUTABLE, which is the precondition, and changing
+ * what the fallback DOES waits for the diagnosis that attribution makes possible.
+ *
+ * ─── Every path reports how it got there ───────────────────────────────────────────────────────
+ *
+ * Two agent switches fired one second after a reconnect on 2026-08-09 and neither could be
+ * attributed, because an operator's explicit selection and the shim's reconnect replay arrive
+ * identically. `fallback` is the third value `DOD-M15-IPCVISIBLE-1` asks for, and the one that was
+ * invisible.
+ */
+/** How a call's acting agent was arrived at. Every branch reports one. */
+export type SelectionTrigger = 
+/** The caller named an agent on this call. */
+"explicit"
+/** The connection had selected one earlier with `cello_use_agent`. */
+ | "selected"
+/** Nothing was selected and one agent was online — a CLI convenience, never for a live session. */
+ | "fallback"
+/**
+ * The connection's choice was TAKEN AWAY — the agent was shut down or removed underneath it.
+ *
+ * NOT a voluntary release. `cello_stop_using_agent` deliberately does not set this: the operator
+ * choosing to hold nothing stays eligible for the sole-online fallback, whereas a connection whose
+ * agent vanished must not have a replacement guessed for it.
+ */
+ | "cleared"
+/** No agent could be determined. */
+ | "none";
+export interface SelectionConnState {
+    currentAgent: string | null;
+    /** Set by `cello_stop_using_agent`: this connection HAD an intent and gave it up. */
+    clearedAgent?: string;
+    /** `"mcp"` is a live session; anything else is treated as an ephemeral CLI invocation. */
+    clientType?: string;
+}
+export declare function resolveCurrentAgentFor(opts: {
+    connState: SelectionConnState | undefined;
+    onlineAgents: ReadonlySet<string>;
+    explicitAgent?: string;
+    /** Called exactly once with the outcome, so the decision is attributable in the log. */
+    onResolved?: (agent: string | null, trigger: SelectionTrigger) => void;
+}): string | null;
+//# sourceMappingURL=agent-selection.d.ts.map

package/dist/agent-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-selection.d.ts","sourceRoot":"","sources":["../src/agent-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB;AAC1B,8CAA8C;AAC5C,UAAU;AACZ,sEAAsE;GACpE,UAAU;AACZ,mGAAmG;GACjG,UAAU;AACZ;;;;;;GAMG;GACD,SAAS;AACX,oCAAoC;GAClC,MAAM,CAAC;AAEX,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,SAAS,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC1C,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACxE,GAAG,MAAM,GAAG,IAAI,CAsChB"}

package/dist/agent-selection.js

@@ -0,0 +1,80 @@
+/**
+ * Which agent a call acts as, and HOW that was decided — `DOD-M15-SELECTION-1`,
+ * `DOD-M15-IPCVISIBLE-1`.
+ *
+ * ─── The defect this is extracted from ─────────────────────────────────────────────────────────
+ *
+ * This logic was four lines inside `daemon.ts`, ending in:
+ *
+ *     if (onlineAgents.size === 1) return [...onlineAgents][0];
+ *
+ * A connection that had selected nothing therefore acted as whichever agent happened to be the only
+ * one online. On a shared daemon that can be a DIFFERENT operator's agent, which is how it was
+ * found: after a restart a released agent was silently reinstated under someone else's name.
+ *
+ * ─── Why the fallback is worse than it looks even when it picks the "right" agent ──────────────
+ *
+ * It produces a HALF-ATTENDED state. Tools resolve a subject and work; the notification dispatcher
+ * routes doorbells by the connection's REGISTERED current agent, which this never sets. So the
+ * session sends and receives on request but never wakes — and an operator reads that as the
+ * protocol dropping messages, not as a selection that was never made.
+ *
+ * ─── AND WHY IT IS STILL HERE ──────────────────────────────────────────────────────────────────
+ *
+ * My first version switched the fallback OFF for MCP on that reasoning, and four tests said no. CC-3
+ * added it deliberately, to fix "the post-/mcp-reconnect papercut": a reconnected session with
+ * exactly one agent online used to hard-fail `no_current_agent`.
+ *
+ * `DOD-M15-SELECTION-1`'s answer is narrower than removal — *"if a fallback is wanted it is EXPLICIT
+ * in the response, not announced as an accomplished fact"* — and it sequences the work: *"diagnosis
+ * first… with the trigger field from DOD-M15-IPCVISIBLE-1 distinguishing replay from fallback in one
+ * run."* So this module makes the decision ATTRIBUTABLE, which is the precondition, and changing
+ * what the fallback DOES waits for the diagnosis that attribution makes possible.
+ *
+ * ─── Every path reports how it got there ───────────────────────────────────────────────────────
+ *
+ * Two agent switches fired one second after a reconnect on 2026-08-09 and neither could be
+ * attributed, because an operator's explicit selection and the shim's reconnect replay arrive
+ * identically. `fallback` is the third value `DOD-M15-IPCVISIBLE-1` asks for, and the one that was
+ * invisible.
+ */
+export function resolveCurrentAgentFor(opts) {
+    const report = (agent, trigger) => {
+        opts.onResolved?.(agent, trigger);
+        return agent;
+    };
+    if (opts.explicitAgent)
+        return report(opts.explicitAgent, "explicit");
+    if (opts.connState?.currentAgent)
+        return report(opts.connState.currentAgent, "selected");
+    /**
+     * AN INVOLUNTARY CLEAR BLOCKS THE FALLBACK. Pre-existing behaviour, preserved.
+     *
+     * `clearedAgent` means the connection's agent was shut down or removed underneath it — do not
+     * guess a replacement. A VOLUNTARY release (`cello_stop_using_agent`) deliberately does not set
+     * it, because the operator choosing to hold nothing is not the same as having the choice taken,
+     * and they stay eligible for the fallback.
+     */
+    if (opts.connState?.clearedAgent)
+        return report(null, "cleared");
+    /**
+     * THE SOLE-ONLINE FALLBACK — behaviour UNCHANGED, visibility added.
+     *
+     * `DOD-M15-SELECTION-1` names this as the place a live MCP session gets bound to an identity it
+     * never asked for, and the instinct is to switch it off for MCP. That is wrong, and the tests say
+     * why: CC-3 introduced it deliberately to fix "the post-/mcp-reconnect papercut", where a
+     * reconnected session hard-failed `no_current_agent` with exactly one agent online.
+     *
+     * The line's own answer is narrower than removal: *"if a fallback is wanted it is EXPLICIT in the
+     * response, not announced as an accomplished fact."* And it sequences the work — *"diagnosis
+     * first… with the trigger field from DOD-M15-IPCVISIBLE-1 distinguishing replay from fallback in
+     * one run."* So this reports itself, and changing what it DOES waits for that diagnosis.
+     *
+     * Exactly one, never a guess between two: choosing between identities is a coin flip with the
+     * operator's name on it, not a convenience.
+     */
+    if (opts.onlineAgents.size === 1)
+        return report([...opts.onlineAgents][0], "fallback");
+    return report(null, "none");
+}
+//# sourceMappingURL=agent-selection.js.map

package/dist/agent-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-selection.js","sourceRoot":"","sources":["../src/agent-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AA6BH,MAAM,UAAU,sBAAsB,CAAC,IAMtC;IACC,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,OAAyB,EAAiB,EAAE;QAChF,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,SAAS,EAAE,YAAY;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAEzF;;;;;;;OAOG;IACH,IAAI,IAAI,CAAC,SAAS,EAAE,YAAY;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEjE;;;;;;;;;;;;;;;OAeG;IACH,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAC;IAExF,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9B,CAAC"}

package/dist/assignment-verify.d.ts

@@ -0,0 +1,62 @@
+import type { SessionAssignment } from "@cello-protocol/protocol-types";
+import type { DbRegistrationPersistence } from "./db-identity-store.js";
+import type { Logger } from "./types.js";
+/**
+ * DOD-M15-ASSIGN-1 — verify a session assignment's signature before anything trusts it.
+ *
+ * REFUSES, never logs-and-continues. The whole finding here is a comment naming a verification the
+ * tree does not perform, so a check that ran and then let the session proceed anyway would be the
+ * same defect with more code. `DOD-M15-ASSIGN-1`'s receiver gate reads this assignment; gating on a
+ * document nobody verified relocates trust rather than closing it.
+ */
+export declare function verifyAssignmentSignature(assignment: SessionAssignment, persistence: DbRegistrationPersistence, logger: Logger, agentName: string, correlationId: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+    guidance: string;
+}>;
+/**
+ * DOD-M15-RESPONDER-VERIFY-1 — the RESPONDER's half, which until now did not exist.
+ *
+ * The initiator verifies its assignment against its own threshold group key (above). The responder
+ * did not verify at all: it logged `session.inbound.assignment.unverified` and proceeded, so every
+ * field it then acted on — the dialer it opens its receiver to, the `signer_pubkey` it persists as
+ * the seal trust anchor — was whatever the directory said.
+ *
+ * ─── Why this could not simply reuse the function above ────────────────────────────────────────
+ *
+ * That one compares `signer_pubkey` against the agent's OWN persisted `primaryPubkey`. The responder
+ * is not the signer — the assignment is signed by the INITIATOR's quorum — so it has no equivalent
+ * value, and verifying a frame's signature against a key from the same frame is circular: mint a
+ * key, sign with it, name it. That circularity is why the check was deferred rather than written.
+ *
+ * ─── What breaks the circle ────────────────────────────────────────────────────────────────────
+ *
+ * The TOFU pin. For a counterparty this agent has completed a session with, `expectedSignerHex` is
+ * what THIS daemon recorded then — a value no directory can retroactively change. Verifying against
+ * that is a real check: a compromised directory can produce a signature, but not one that verifies
+ * under a key it does not hold.
+ *
+ * ─── Two modes, and the weaker one is honest about being weaker ────────────────────────────────
+ *
+ * PINNED (`expectedSignerHex` given): the signature must verify under the PINNED key. Non-circular.
+ * This is the mode that matters, and it covers every repeat counterparty.
+ *
+ * UNPINNED (first contact): there is nothing independent to verify against, so this checks INTERNAL
+ * CONSISTENCY only — the signature verifies over the TBS recomputed from the assignment's own
+ * contents, under the key the frame names. That does NOT authenticate the directory, and it is not
+ * claimed to. What it does catch is a TAMPERED or garbage assignment — one whose fields were altered
+ * after signing, or whose signature is noise — which today reaches the seal path unchallenged and
+ * gets PINNED, poisoning every later session with that counterparty. Refusing it here is what stops
+ * a bad first contact becoming a permanent one.
+ */
+export declare function verifyInboundAssignment(assignment: SessionAssignment, expectedSignerHex: string | null): {
+    ok: true;
+    mode: "pinned" | "internal";
+} | {
+    ok: false;
+    reason: string;
+    detail: string;
+};
+//# sourceMappingURL=assignment-verify.d.ts.map

package/dist/assignment-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignment-verify.d.ts","sourceRoot":"","sources":["../src/assignment-verify.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,iBAAiB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA0GzE;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,iBAAiB,EAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAsD3F"}

package/dist/assignment-verify.js

@@ -0,0 +1,185 @@
+/**
+ * assignment-verify.ts — DOD-M15-ASSIGN-1.
+ *
+ * `session-assignment-parser.ts` shape-validates a session assignment. Its header said the
+ * signature "is verified downstream by the transport/session layer against the directory's pinned
+ * key" — and that site did not exist: `buildSessionEstablishmentTbs` was called to SIGN, and
+ * nowhere to verify. This module is the downstream the comment promised.
+ *
+ * SEPARATE FROM THE PARSER on purpose. Parsing answers "is this the right shape"; verifying answers
+ * "did the right party say it". Keeping them apart means the second cannot be quietly skipped by a
+ * caller that only wanted the first — which is how the gap existed.
+ */
+// `verify` (plain Ed25519) is deliberately NOT imported: the single-key branch that used it was
+// removed with the downgrade refusal (review F1). Verifying `directory_signature` against the
+// `directory_pubkey` riding beside it in the same unsigned frame checks a key against itself, and
+// having that call available is how a future edit reintroduces the bypass.
+import { verifyFrostSignature, CONTEXT_SESSION_ESTABLISHMENT } from "@cello-protocol/crypto";
+import { buildSessionEstablishmentTbs, computeGenesisPrevRoot } from "@cello-protocol/protocol-types";
+/**
+ * DOD-M15-ASSIGN-1 — verify a session assignment's signature before anything trusts it.
+ *
+ * REFUSES, never logs-and-continues. The whole finding here is a comment naming a verification the
+ * tree does not perform, so a check that ran and then let the session proceed anyway would be the
+ * same defect with more code. `DOD-M15-ASSIGN-1`'s receiver gate reads this assignment; gating on a
+ * document nobody verified relocates trust rather than closing it.
+ */
+export async function verifyAssignmentSignature(assignment, persistence, logger, agentName, correlationId) {
+    // RECOMPUTED, not taken from the frame — and that is a strengthening rather than a workaround.
+    // `genesis_prev_root` is not on the wire at all: the directory derives it from
+    // (pubA, pubB, session_id, timestamp) and so must we. A value we derive cannot be chosen for us,
+    // so the TBS we verify against is anchored to the assignment's own participants and id.
+    const genesisPrevRoot = computeGenesisPrevRoot(assignment.participant_a.pubkey, assignment.participant_b.pubkey, assignment.session_id, assignment.session_timestamp);
+    const tbs = buildSessionEstablishmentTbs(assignment.session_id, assignment.participant_a.pubkey, assignment.participant_b.pubkey, genesisPrevRoot, assignment.session_timestamp, assignment.initiator_session_peer_id, assignment.initiator_session_addrs, assignment.counterparty_session_peer_id, assignment.counterparty_session_addrs, assignment.transport_mode);
+    /**
+     * LOAD THE REGISTRATION BEFORE BRANCHING ON `signature_type` — review F1, and this ordering is
+     * the entire fix.
+     *
+     * `signature_type` rides in the frame and is covered by no signature. The parser reads any value
+     * that is not the string "frost" — including an ABSENT field — as "single". So while this load
+     * lived inside the frost branch, a hostile directory disabled every check below by omitting one
+     * field: it put its own freshly-minted key in `directory_pubkey`, signed a TBS naming an
+     * impostor as the counterparty, and the single-key branch verified that signature against that
+     * same key and returned ok. The anti-circularity comparison, the threshold verify and the
+     * fail-closed were all simply stepped over.
+     *
+     * Reading the registration first closes it: an agent that HAS a threshold registration knows its
+     * assignments are FROST-signed, so a non-FROST one is a downgrade attempt and is refused by
+     * name — never quietly routed to a weaker check.
+     */
+    const reg = await persistence.loadRegistrationState();
+    if (!reg) {
+        // FAIL CLOSED. Without our own registration we cannot know whose quorum should have signed,
+        // so the signature is unverifiable — which is not the same as valid.
+        logger.warn("session.assignment.verify.no_identity", {
+            agentName, correlationId,
+            impact: "this agent has no persisted registration, so the signer of its own session assignment cannot be established; the session was refused rather than accepted unverified",
+        });
+        return {
+            ok: false,
+            reason: "assignment_unverifiable_no_registration",
+            guidance: "This agent has no registration on record, so the directory's session assignment cannot be checked against the key that should have signed it. Re-register with cello register-agent, then try again.",
+        };
+    }
+    if (assignment.signature_type !== "frost") {
+        /**
+         * THE DOWNGRADE REFUSAL. Checked against the producer, not assumed: the directory constructs
+         * `signature_type: "frost"` unconditionally at a single site (`directory-node.ts`), with no
+         * branch that can emit anything else. There is no legitimate producer of a single-key session
+         * assignment for a registered agent, so this is not a compatibility path being closed — it is
+         * a shape that only an attacker or a broken directory can send.
+         */
+        logger.error("session.assignment.signature_type_downgraded", {
+            agentName, correlationId,
+            offeredType: assignment.signature_type,
+            impact: "the assignment claimed a weaker signature type than this agent's registration can produce, which would have routed it to a check that verifies a key against itself; it was refused, and no session was established",
+        });
+        return {
+            ok: false,
+            reason: "assignment_signature_type_downgraded",
+            guidance: "The directory returned a session assignment that does not carry a threshold signature, though this agent is registered with one. Nothing was established and no message was sent. Retry the session; if it repeats, the directory you reached is not producing valid assignments and cello status will show which one that is.",
+        };
+    }
+    {
+        // THE ANTI-CIRCULARITY CHECK. `signer_pubkey` comes from the frame; `reg.primaryPubkey` comes
+        // from this machine's own registration. Comparing them is what makes verifying against
+        // `signer_pubkey` mean anything at all.
+        const expected = reg.primaryPubkey.toLowerCase();
+        const offered = Buffer.from(assignment.signer_pubkey).toString("hex").toLowerCase();
+        if (offered !== expected) {
+            logger.error("session.assignment.signer_mismatch", {
+                agentName, correlationId,
+                expectedPrefix: expected.slice(0, 16), offeredPrefix: offered.slice(0, 16),
+                impact: "the assignment was signed by a key that is not this agent's own threshold group key; it was refused, and no session was established",
+            });
+            return {
+                ok: false,
+                reason: "assignment_signer_not_this_agent",
+                guidance: "The directory returned a session assignment signed by a key that is not this agent's own. Nothing was established and no message was sent. This is refused rather than reported as an error because the observation cannot distinguish a directory fault from an attempt to broker a session on your behalf; cause undetermined.",
+            };
+        }
+        if (!verifyFrostSignature(assignment.directory_signature, tbs, CONTEXT_SESSION_ESTABLISHMENT, assignment.signer_pubkey)) {
+            logger.error("session.assignment.signature_invalid", {
+                agentName, correlationId, signatureType: "frost",
+                impact: "the assignment's threshold signature did not verify over its own contents; it was refused, and no session was established",
+            });
+            return {
+                ok: false,
+                reason: "assignment_signature_invalid",
+                guidance: "The directory's session assignment did not verify against the key that should have signed it. Nothing was established. Retry the session; if it repeats, the directory you reached is not producing valid assignments and cello status will show which one that is.",
+            };
+        }
+        return { ok: true };
+    }
+}
+/**
+ * DOD-M15-RESPONDER-VERIFY-1 — the RESPONDER's half, which until now did not exist.
+ *
+ * The initiator verifies its assignment against its own threshold group key (above). The responder
+ * did not verify at all: it logged `session.inbound.assignment.unverified` and proceeded, so every
+ * field it then acted on — the dialer it opens its receiver to, the `signer_pubkey` it persists as
+ * the seal trust anchor — was whatever the directory said.
+ *
+ * ─── Why this could not simply reuse the function above ────────────────────────────────────────
+ *
+ * That one compares `signer_pubkey` against the agent's OWN persisted `primaryPubkey`. The responder
+ * is not the signer — the assignment is signed by the INITIATOR's quorum — so it has no equivalent
+ * value, and verifying a frame's signature against a key from the same frame is circular: mint a
+ * key, sign with it, name it. That circularity is why the check was deferred rather than written.
+ *
+ * ─── What breaks the circle ────────────────────────────────────────────────────────────────────
+ *
+ * The TOFU pin. For a counterparty this agent has completed a session with, `expectedSignerHex` is
+ * what THIS daemon recorded then — a value no directory can retroactively change. Verifying against
+ * that is a real check: a compromised directory can produce a signature, but not one that verifies
+ * under a key it does not hold.
+ *
+ * ─── Two modes, and the weaker one is honest about being weaker ────────────────────────────────
+ *
+ * PINNED (`expectedSignerHex` given): the signature must verify under the PINNED key. Non-circular.
+ * This is the mode that matters, and it covers every repeat counterparty.
+ *
+ * UNPINNED (first contact): there is nothing independent to verify against, so this checks INTERNAL
+ * CONSISTENCY only — the signature verifies over the TBS recomputed from the assignment's own
+ * contents, under the key the frame names. That does NOT authenticate the directory, and it is not
+ * claimed to. What it does catch is a TAMPERED or garbage assignment — one whose fields were altered
+ * after signing, or whose signature is noise — which today reaches the seal path unchallenged and
+ * gets PINNED, poisoning every later session with that counterparty. Refusing it here is what stops
+ * a bad first contact becoming a permanent one.
+ */
+export function verifyInboundAssignment(assignment, expectedSignerHex) {
+    if (assignment.signature_type !== "frost") {
+        return {
+            ok: false,
+            reason: "inbound_assignment_not_frost",
+            detail: `signature_type was ${String(assignment.signature_type)}; the directory produces frost for every session assignment`,
+        };
+    }
+    const signer = assignment.signer_pubkey;
+    if (!signer || signer.length !== 32) {
+        return { ok: false, reason: "inbound_assignment_no_signer", detail: "signer_pubkey missing or not 32 bytes" };
+    }
+    // PINNED beats named. When we hold an independent value, the frame's own claim about who signed is
+    // not consulted at all — using it would reintroduce the circularity the pin exists to break.
+    const verifyAgainst = expectedSignerHex !== null ? Buffer.from(expectedSignerHex, "hex") : signer;
+    if (expectedSignerHex !== null && Buffer.from(signer).toString("hex").toLowerCase() !== expectedSignerHex.toLowerCase()) {
+        return {
+            ok: false,
+            reason: "inbound_assignment_signer_not_pinned",
+            detail: "the assignment names a different signer than this agent recorded for this counterparty",
+        };
+    }
+    const genesisPrevRoot = computeGenesisPrevRoot(assignment.participant_a.pubkey, assignment.participant_b.pubkey, assignment.session_id, assignment.session_timestamp);
+    const tbs = buildSessionEstablishmentTbs(assignment.session_id, assignment.participant_a.pubkey, assignment.participant_b.pubkey, genesisPrevRoot, assignment.session_timestamp, assignment.initiator_session_peer_id, assignment.initiator_session_addrs, assignment.counterparty_session_peer_id, assignment.counterparty_session_addrs, assignment.transport_mode);
+    if (!verifyFrostSignature(assignment.directory_signature, tbs, CONTEXT_SESSION_ESTABLISHMENT, new Uint8Array(verifyAgainst))) {
+        return {
+            ok: false,
+            reason: "inbound_assignment_signature_invalid",
+            detail: expectedSignerHex !== null
+                ? "the signature did not verify under the key this agent recorded for this counterparty"
+                : "the signature did not verify over the assignment's own recomputed contents — the frame is tampered or malformed",
+        };
+    }
+    return { ok: true, mode: expectedSignerHex !== null ? "pinned" : "internal" };
+}
+//# sourceMappingURL=assignment-verify.js.map

package/dist/assignment-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignment-verify.js","sourceRoot":"","sources":["../src/assignment-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,gGAAgG;AAChG,8FAA8F;AAC9F,kGAAkG;AAClG,2EAA2E;AAC3E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAKtG;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAA6B,EAC7B,WAAsC,EACtC,MAAc,EACd,SAAiB,EACjB,aAAqB;IAErB,+FAA+F;IAC/F,+EAA+E;IAC/E,iGAAiG;IACjG,wFAAwF;IACxF,MAAM,eAAe,GAAG,sBAAsB,CAC5C,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC7B,CAAC;IACF,MAAM,GAAG,GAAG,4BAA4B,CACtC,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,eAAe,EACf,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,yBAAyB,EACpC,UAAU,CAAC,uBAAuB,EAClC,UAAU,CAAC,4BAA4B,EACvC,UAAU,CAAC,0BAA0B,EACrC,UAAU,CAAC,cAAc,CAC1B,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,qBAAqB,EAAE,CAAC;IACtD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,4FAA4F;QAC5F,qEAAqE;QACrE,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACnD,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,sKAAsK;SAC/K,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yCAAyC;YACjD,QAAQ,EAAE,sMAAsM;SACjN,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QAC1C;;;;;;WAMG;QACH,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;YAC3D,SAAS,EAAE,aAAa;YACxB,WAAW,EAAE,UAAU,CAAC,cAAc;YACtC,MAAM,EAAE,qNAAqN;SAC9N,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sCAAsC;YAC9C,QAAQ,EAAE,gUAAgU;SAC3U,CAAC;IACJ,CAAC;IAED,CAAC;QACC,8FAA8F;QAC9F,uFAAuF;QACvF,wCAAwC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACpF,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACjD,SAAS,EAAE,aAAa;gBACxB,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC1E,MAAM,EAAE,qIAAqI;aAC9I,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kCAAkC;gBAC1C,QAAQ,EAAE,kUAAkU;aAC7U,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,6BAA6B,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACxH,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACnD,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO;gBAChD,MAAM,EAAE,2HAA2H;aACpI,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,8BAA8B;gBACtC,QAAQ,EAAE,qQAAqQ;aAChR,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAA6B,EAC7B,iBAAgC;IAEhC,IAAI,UAAU,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B;YACtC,MAAM,EAAE,sBAAsB,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,6DAA6D;SAC7H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAChH,CAAC;IAED,mGAAmG;IACnG,6FAA6F;IAC7F,MAAM,aAAa,GAAG,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClG,IAAI,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE,EAAE,CAAC;QACxH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EAAE,wFAAwF;SACjG,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAC5C,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC7B,CAAC;IACF,MAAM,GAAG,GAAG,4BAA4B,CACtC,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,UAAU,CAAC,aAAa,CAAC,MAAM,EAC/B,eAAe,EACf,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,yBAAyB,EACpC,UAAU,CAAC,uBAAuB,EAClC,UAAU,CAAC,4BAA4B,EACvC,UAAU,CAAC,0BAA0B,EACrC,UAAU,CAAC,cAAc,CAC1B,CAAC;IAEF,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,6BAA6B,EAAE,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7H,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sCAAsC;YAC9C,MAAM,EACJ,iBAAiB,KAAK,IAAI;gBACxB,CAAC,CAAC,sFAAsF;gBACxF,CAAC,CAAC,iHAAiH;SACxH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAChF,CAAC"}