@cello-protocol/daemon 0.0.182 → 0.0.183

package/dist/park-envelope.d.ts

@@ -80,6 +80,17 @@ export declare const PARK_ENVELOPE_REASONS: {
     /** The entry names a content-hash algorithm this build cannot itself reproduce. */
     readonly ALG_UNREADABLE: "park_envelope_alg_unreadable";
 };
+/**
+ * The relay's park-refusal codes.
+ *
+ * ⚠️ RE-EXPORTED FROM `@cello-protocol/protocol-types`, NOT declared here. They used to be a private
+ * copy that happened to agree with the relay's strings — verified by hand once, which is not a
+ * guard. A rename on the relay side would have left this copy silently unmatched, falling through to
+ * the generic "the relay link is down" wording: the exact defect this family of work removed,
+ * reintroduced by a change nobody would think of as a protocol change.
+ */
+import { RELAY_PARK_REFUSALS } from "@cello-protocol/protocol-types";
+export { RELAY_PARK_REFUSALS };
 export type ParkEnvelopeReason = (typeof PARK_ENVELOPE_REASONS)[keyof typeof PARK_ENVELOPE_REASONS];
 /**
  * A REFUSAL TO SEAL, carrying a code the caller can branch on — `DOD-M15-SEALWIRE-1` B2b-2
@@ -161,4 +172,16 @@ export declare function authenticateParkedEntry(args: {
     contentHash: Uint8Array;
     counterpartyPubkeyHex: string | undefined;
 }): ParkAuthVerdict;
+/**
+ * The operator-facing guidance for a refused park hand-off — **a pure function, deliberately.**
+ *
+ * ⚠️ It was an inline ternary inside `sendContent`, which meant the only way to assert any branch of
+ * it was to stand up a two-connection fixture and drive a real send. That is why the branch that was
+ * WRONG for a throttling relay survived: nothing cheap could reach it. A guidance string is a
+ * decision about what a person does next, and it deserves to be testable on its own.
+ *
+ * `durable` distinguishes "queued and will retry" from "not queued — it is lost", which is the one
+ * distinction that changes whether the reader must act right now.
+ */
+export declare function parkRefusalGuidance(cause: string | undefined, durable: boolean, retryAfterMs?: number): string;
 //# sourceMappingURL=park-envelope.d.ts.map

package/dist/park-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"park-envelope.d.ts","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAInF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAW3F;AAED,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAY3C,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,qBAAqB;IAChC,mFAAmF;;CAE3E,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAMxE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,UAAU,CAAC;IACzB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,UAAU,CAyCb;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,UAAU,GAAG,YAAY,CAwCtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,YAAY,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,GAAG,eAAe,CA8BlB"}
+{"version":3,"file":"park-envelope.d.ts","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA2B,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAInF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAW3F;AAED,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAY3C,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,qBAAqB;IAChC,mFAAmF;;CAE3E,CAAC;AAEX;;;;;;;;GAQG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAMxE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,UAAU,CAAC;IACzB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,UAAU,CAyCb;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,UAAU,GAAG,YAAY,CAwCtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,YAAY,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,UAAU,CAAC;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C,GAAG,eAAe,CA8BlB;AAGD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CA4C9G"}

package/dist/park-envelope.js

@@ -107,6 +107,17 @@ export const PARK_ENVELOPE_REASONS = {
     /** The entry names a content-hash algorithm this build cannot itself reproduce. */
     ALG_UNREADABLE: "park_envelope_alg_unreadable",
 };
+/**
+ * The relay's park-refusal codes.
+ *
+ * ⚠️ RE-EXPORTED FROM `@cello-protocol/protocol-types`, NOT declared here. They used to be a private
+ * copy that happened to agree with the relay's strings — verified by hand once, which is not a
+ * guard. A rename on the relay side would have left this copy silently unmatched, falling through to
+ * the generic "the relay link is down" wording: the exact defect this family of work removed,
+ * reintroduced by a change nobody would think of as a protocol change.
+ */
+import { RELAY_PARK_REFUSALS } from "@cello-protocol/protocol-types";
+export { RELAY_PARK_REFUSALS };
 /**
  * A REFUSAL TO SEAL, carrying a code the caller can branch on — `DOD-M15-SEALWIRE-1` B2b-2
  * constraint 6, inherited from B2a's review.
@@ -285,4 +296,69 @@ export function authenticateParkedEntry(args) {
     }
     return { ok: true };
 }
+/**
+ * The operator-facing guidance for a refused park hand-off — **a pure function, deliberately.**
+ *
+ * ⚠️ It was an inline ternary inside `sendContent`, which meant the only way to assert any branch of
+ * it was to stand up a two-connection fixture and drive a real send. That is why the branch that was
+ * WRONG for a throttling relay survived: nothing cheap could reach it. A guidance string is a
+ * decision about what a person does next, and it deserves to be testable on its own.
+ *
+ * `durable` distinguishes "queued and will retry" from "not queued — it is lost", which is the one
+ * distinction that changes whether the reader must act right now.
+ */
+export function parkRefusalGuidance(cause, durable, retryAfterMs) {
+    if (cause === PARK_ENVELOPE_REASONS.ALG_UNREADABLE) {
+        return ("This message names a content-hash algorithm your build cannot produce, so it could not be " +
+            "sealed for hand-off. The relay is NOT involved and this will not clear on its own — the " +
+            "message is safely stored but every retry fails the same way. Upgrade to a build that knows " +
+            "the algorithm, or start a new session with this counterparty. Re-sending on this build " +
+            "changes nothing.");
+    }
+    /**
+     * ⚠️ DIAGNOSIS AND ACTION ARE COMPOSED, NOT WRITTEN TOGETHER — and this shape is the fix for a
+     * defect review found in the first version.
+     *
+     * That version returned a complete paragraph per cause and **never consulted `durable`**, so all
+     * three new branches ended "The message is queued and re-sent automatically. Do not re-send it."
+     * `durable` is OBSERVED, not assumed: it is false when the durable enqueue was refused as a
+     * duplicate, or when the retry hook is unwired. In that case the daemon logs at ERROR that the
+     * content is *not* separately retained while the operator was simultaneously told it was queued
+     * and instructed not to re-send. **Nothing held the message.** That is precisely the lie this
+     * family of work exists to kill, reintroduced one layer up.
+     *
+     * Splitting them makes the mistake unavailable: the action half is produced in exactly one place
+     * and cannot be reached without reading the flag.
+     */
+    const diagnosis = cause === RELAY_PARK_REFUSALS.RATE_LIMITED
+        ? `The relay is healthy and deliberately rate-limiting this agent's hand-offs, so it refused this one. NOTHING IS WRONG with the link or the counterparty, and the limit clears on its own${describeRetryWindow(retryAfterMs)}.`
+        : cause === RELAY_PARK_REFUSALS.RECIPIENT_FULL
+            ? "The relay is holding as much undelivered content for THIS counterparty as it will, so it refused the hand-off. That is about their mailbox, not your connection, and another relay would refuse it too. It clears when they come online and collect it, or when older entries expire."
+            : cause === RELAY_PARK_REFUSALS.STORE_FULL
+                ? "The relay's parked-content store is full, so it refused the hand-off. The link is fine. If this persists the relay operator needs to know — it means the store is under sustained pressure."
+                : null;
+    if (diagnosis !== null) {
+        return durable
+            ? `${diagnosis} The message is queued and re-sent automatically. Do not re-send it: an identical re-send is not separately queued.`
+            : `${diagnosis} ⚠️ BUT THIS MESSAGE WAS NOT QUEUED — it is lost. Send it again.`;
+    }
+    return durable
+        ? "Direct delivery failed and the relay refused the hand-off, so the message is queued and will be re-sent automatically when the relay link is back. Do not re-send it: an identical re-send is not separately queued."
+        : "Direct delivery failed and the message could NOT be queued for retry — it is lost. Send it again.";
+}
+/**
+ * Render the relay's own retry delay, or say nothing at all.
+ *
+ * ⚠️ SAYS NOTHING WHEN THE RELAY DID NOT SAY — review MEDIUM-6. The first version of the guidance
+ * asserted the limit clears *"in about a minute"*, which is a hardcoded guess about the relay's
+ * CONFIGURABLE window: a relay run at ten minutes makes that a wrong promise, and a wrong number is
+ * worse than no number because the reader plans around it. When the relay tells us, we quote it;
+ * when it does not, the sentence simply ends.
+ */
+function describeRetryWindow(retryAfterMs) {
+    if (retryAfterMs === undefined || !Number.isFinite(retryAfterMs) || retryAfterMs <= 0)
+        return "";
+    const seconds = Math.ceil(retryAfterMs / 1000);
+    return seconds < 90 ? ` in about ${String(seconds)} seconds` : ` in about ${String(Math.ceil(seconds / 60))} minutes`;
+}
 //# sourceMappingURL=park-envelope.js.map

package/dist/park-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"park-envelope.js","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,eAAe,EAAoB,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,SAA6B;IAChF,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,kGAAkG;IAClG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAgCrG;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,mFAAmF;IACnF,cAAc,EAAE,8BAA8B;CACtC,CAAC;AAIX;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAqB;IACpC,yFAAyF;IAChF,MAAM,CAAS;IACxB,YAAY,MAA0B,EAAE,MAAc,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAQlC;IACC,MAAM,IAAI,GAAG;QACX,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,OAAO;KACb,CAAC;IACF;;;;;;;;;;OAUG;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO,UAAU,CAAC,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAAe,CAAC;IACpE,CAAC;IACD;;;;;;;OAOG;IACH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,cAAc,EACpC,GAAG,EACH,2EAA2E,GAAG,gBAAgB;YAC9F,+FAA+F;YAC/F,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,yBAAyB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAe,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAUtC;IACC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpC,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAC/E,CAAC;IACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,YAAY;QACZ,OAAO;QACP,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,mGAAmG;IACnG,iFAAiF;IACjF,OAAO,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAqB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAc,CAAC;QAC/C,4EAA4E;QAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,yBAAyB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YACnH,OAAO;gBACL,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1D,4FAA4F;gBAC5F,+EAA+E;gBAC/E,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,qBAAqB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC/G,OAAO;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC3F,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAExF,kGAAkG;IAClG,yEAAyE;IACzE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IAED,gGAAgG;IAChG,yFAAyF;IACzF,MAAM,GAAG,GAAG,mBAAmB,CAAC,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,gGAAgG;IAChG,mGAAmG;IACnG,6FAA6F;IAC7F,6DAA6D;IAC7D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"park-envelope.js","sourceRoot":"","sources":["../src/park-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,eAAe,EAAoB,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,SAA6B;IAChF,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,kGAAkG;IAClG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAgCrG;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,mFAAmF;IACnF,cAAc,EAAE,8BAA8B;CACtC,CAAC;AAEX;;;;;;;;GAQG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAI/B;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAqB;IACpC,yFAAyF;IAChF,MAAM,CAAS;IACxB,YAAY,MAA0B,EAAE,MAAc,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAQlC;IACC,MAAM,IAAI,GAAG;QACX,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3B,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,OAAO;KACb,CAAC;IACF;;;;;;;;;;OAUG;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO,UAAU,CAAC,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAAe,CAAC;IACpE,CAAC;IACD;;;;;;;OAOG;IACH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,cAAc,EACpC,GAAG,EACH,2EAA2E,GAAG,gBAAgB;YAC9F,+FAA+F;YAC/F,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,yBAAyB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAe,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAUtC;IACC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CACpC,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAC/E,CAAC;IACF,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,YAAY;QACZ,OAAO;QACP,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,mGAAmG;IACnG,iFAAiF;IACjF,OAAO,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAqB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAc,CAAC;QAC/C,4EAA4E;QAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,yBAAyB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YACnH,OAAO;gBACL,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC1D,4FAA4F;gBAC5F,+EAA+E;gBAC/E,cAAc,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,qBAAqB,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC/G,OAAO;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC;YAC3F,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAExF,kGAAkG;IAClG,yEAAyE;IACzE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IAED,gGAAgG;IAChG,yFAAyF;IACzF,MAAM,GAAG,GAAG,mBAAmB,CAAC,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,gGAAgG;IAChG,mGAAmG;IACnG,6FAA6F;IAC7F,6DAA6D;IAC7D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAGD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,OAAgB,EAAE,YAAqB;IACpG,IAAI,KAAK,KAAK,qBAAqB,CAAC,cAAc,EAAE,CAAC;QACnD,OAAO,CACL,4FAA4F;YAC5F,0FAA0F;YAC1F,6FAA6F;YAC7F,yFAAyF;YACzF,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,SAAS,GACb,KAAK,KAAK,mBAAmB,CAAC,YAAY;QACxC,CAAC,CAAC,0LAA0L,mBAAmB,CAAC,YAAY,CAAC,GAAG;QAChO,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,cAAc;YAC5C,CAAC,CAAC,uRAAuR;YACzR,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,UAAU;gBACxC,CAAC,CAAC,6LAA6L;gBAC/L,CAAC,CAAC,IAAI,CAAC;IAEf,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,OAAO;YACZ,CAAC,CAAC,GAAG,SAAS,qHAAqH;YACnI,CAAC,CAAC,GAAG,SAAS,kEAAkE,CAAC;IACrF,CAAC;IAED,OAAO,OAAO;QACZ,CAAC,CAAC,sNAAsN;QACxN,CAAC,CAAC,mGAAmG,CAAC;AAC1G,CAAC;AAGD;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,YAAgC;IAC3D,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC;AACxH,CAAC"}

package/dist/register-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-handler.d.ts","sourceRoot":"","sources":["../src/register-handler.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAMnE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,yBAAyB,CAAC;IACjE,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,KAAK;QAAE,SAAS,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IACxJ,yBAAyB,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACrG,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,wBAAwB,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACrG,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAChF,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA+KvE"}
+{"version":3,"file":"register-handler.d.ts","sourceRoot":"","sources":["../src/register-handler.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOnE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,yBAAyB,CAAC;IACjE,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,KAAK;QAAE,SAAS,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,SAAS,GAAG,IAAI,CAAA;KAAE,CAAC;IACxJ,yBAAyB,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACrG,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,wBAAwB,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACrG,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAChF,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA4PvE"}

package/dist/register-handler.js

@@ -18,6 +18,7 @@ import { manifestNodesToEndpoints } from "./directory-bootstrap.js";
 import { DaemonRegistrationContext } from "./registration-context.js";
 import { RegistrationManager } from "./registration-manager.js";
 import { validatorNodes } from "@cello-protocol/protocol-types";
+import { classifyManifestValidity } from "./manifest-validity.js";
 export function registerRegisterHandler(deps) {
     const { handlers, logger, keyProviders, getPersistence, getAgentSignaling, waitForSignalingConnected, dropAgentSignaling, startAgentInternal, directoryEndpointResolver, loadedAgents, registrationGuidance, manifestProvider, } = deps;
     // Single-flight guard (M1): the directory's registration reply frames (dkg_ready /
@@ -107,6 +108,81 @@ export function registerRegisterHandler(deps) {
             // load-bearing: an empty roster (consortium configured but unreachable) must REFUSE in
             // registration-manager, NOT downgrade to single-node (code-reviewer B1 / fallback-finder).
             const currentManifest = manifestProvider?.getCurrentManifest();
+            /**
+             * DOD-M15-EXPIRY-CONSUMER-POLICY-1 — this consumer PROCEEDS on a lapsed manifest, and that is
+             * now a decision rather than an omission. Written down because the split looked accidental:
+             * `signal-submission` REFUSES on expiry while this, the higher-stakes consumer, did not even
+             * look.
+             *
+             * **Why it proceeds.** Startup already fails closed on an expired manifest, so a lapsed one
+             * exists only inside a LONG-RUNNING daemon. Refusing here sends the operator to the one remedy
+             * `signal-submission`'s own guidance warns against — *"a restart without a REPLACEMENT does not
+             * reload anything: the daemon refuses to come back and every agent goes offline."* So refusing
+             * would brick a running operator to close a window that needs a roster CHANGE to be
+             * exploitable at all: the risk is dealing a share to a validator removed since the manifest
+             * lapsed, not expiry itself.
+             *
+             * **Why `signal-submission` is different, and why "make them consistent" would be wrong.** It
+             * uses the manifest's PORTAL INTAKE KEY, and a rotated key means a message the portal cannot
+             * open and cannot attribute — unattributable poison, its own word, with no error anywhere.
+             * Different field, different failure, different answer.
+             *
+             * **What was actually missing was not the gate — it was the RECORD.** `cello_status` already
+             * reports an expired manifest, so the STATE was visible; nothing said a FROST share had been
+             * dealt against one. That is what this event is.
+             */
+            const manifestValidity = classifyManifestValidity(currentManifest ?? null, Date.now());
+            /**
+             * ⚠️ NOT ONLY `expired` — review F7. `unreadable_window` (a window field that does not parse)
+             * and `not_yet_valid` (a wrong clock, or a manifest rotated in early) both reached the DKG
+             * with no event at all. `unreadable_window` matters more than it looks: since the startup gate
+             * was hardened it cannot start a daemon, but a manifest POLLED IN after startup can still put
+             * a running daemon into it.
+             */
+            const lapsed = manifestValidity.state === "expired"
+                || manifestValidity.state === "unreadable_window"
+                || manifestValidity.state === "not_yet_valid";
+            if (lapsed) {
+                logger.warn("registration.manifest.lapsed", {
+                    agent: name,
+                    state: manifestValidity.state,
+                    window: manifestValidity.state === "expired" ? manifestValidity.expires : manifestValidity.notBefore,
+                    validators: currentManifest ? validatorNodes(currentManifest.nodes).length : 0,
+                    /**
+                     * ⚠️ THIS USED TO SAY "a share MAY BE DEALT to a node that is no longer authorized", and
+                     * that over-claimed in the very case it named. Review traced the path: a validator removed
+                     * since the lapse is either unreachable — dropped at the dial layer by the peerId
+                     * cross-check against the signed manifest — or reachable but absent from the DIRECTORY's
+                     * current manifest, in which case the roster/participants counts disagree and registration
+                     * REFUSES with `dkg_below_threshold`. **Dealing a share to a de-authorized node is not
+                     * reachable through this path.** The event was about to be emitted alongside a FAILED
+                     * registration while telling the operator a share may have gone somewhere.
+                     *
+                     * What it says now is what is actually true, and it is still worth saying: this event is
+                     * emitted immediately before that refusal, so it is the line that explains an otherwise
+                     * bare `dkg_below_threshold` — which names an exit point and not a cause.
+                     */
+                    /**
+                     * ⚠️ ONE CAUSE OF A MULTI-CAUSE EXIT — pass 2, and the previous wording inverted the
+                     * redundancy invariant in prose. `dkg_below_threshold` comes from a single comparison
+                     * (`roster.length !== participants`) whose own comment names TWO causes: a node we reported
+                     * is now unreachable, OR a manifest version skew. **An unreachable node is the routine
+                     * one** — under the sovereign-node design a node being down is the expected steady state,
+                     * not the exception. Saying "THIS is the cause" and "replace the trust anchor rather than
+                     * retrying" told the operator to replace a threshold-signed anchor in the case where the
+                     * correct move is to retry.
+                     */
+                    impact: "the consortium roster this registration works from came from a manifest whose validity " +
+                        "window is not currently open. This is ONE possible cause of a subsequent " +
+                        "dkg_below_threshold — a directory node being momentarily unreachable is the more common " +
+                        "one, and is expected rather than exceptional.",
+                    guidance: "Registration was NOT blocked here — blocking it would strand a running daemon, since a " +
+                        "restart without a replacement manifest does not come back. If it then fails with " +
+                        "dkg_below_threshold: RETRY FIRST, because an unreachable node is the usual cause. " +
+                        "Replace the trust anchor only if cello_status shows the manifest window is the " +
+                        "discrepancy.",
+                });
+            }
             const consortiumRoster = currentManifest
                 ? await manifestNodesToEndpoints(validatorNodes(currentManifest.nodes), { logger })
                 : null;

package/dist/register-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-handler.js","sourceRoot":"","sources":["../src/register-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAOrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAiBhE,MAAM,UAAU,uBAAuB,CAAC,IAAyB;IAC/D,MAAM,EACJ,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAC9C,iBAAiB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,kBAAkB,EACpF,yBAAyB,EAAE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,GAChF,GAAG,IAAI,CAAC;IAET,mFAAmF;IACnF,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,uFAAuF;IACvF,6FAA6F;IAC7F,2FAA2F;IAC3F,IAAI,sBAAsB,GAAG,KAAK,CAAC;IAEnC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,KAA2B,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,EAAE,YAAkC,CAAC;QAChE,MAAM,SAAS,GAAI,MAAM,EAAE,SAAgC,IAAI,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iIAAiI,EAAE,CAAC;QAC9L,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,wIAAwI,EAAE,CAAC;QAC5M,CAAC;QACD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,IAAI,8DAA8D,IAAI,uCAAuC,EAAE,CAAC;QACrL,CAAC;QACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,yGAAyG,EAAE,CAAC;QAC7K,CAAC;QACD,6EAA6E;QAC7E,4DAA4D;QAC5D,IAAI,sBAAsB,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,QAAQ,EAAE,2PAA2P,EAAE,CAAC;QAC1U,CAAC;QACD,sBAAsB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,2EAA2E;YAC3E,wEAAwE;YACxE,sFAAsF;YACtF,mFAAmF;YACnF,uFAAuF;YACvF,2FAA2F;YAC3F,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,kCAAkC;YAClC,MAAM,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;YAC7C,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACzB,sEAAsE;gBACtE,yEAAyE;gBACzE,6EAA6E;gBAC7E,6FAA6F;gBAC7F,6FAA6F;gBAC7F,iGAAiG;gBACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,gLAAgL,EAAE,CAAC;YACpP,CAAC;YACD,MAAM,iBAAiB,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAE7E,iFAAiF;YACjF,iFAAiF;YACjF,sFAAsF;YACtF,2DAA2D;YAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC9D,MAAM,cAAc,GAAG,WAAW,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5G,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;YAElH,4EAA4E;YAC5E,oFAAoF;YACpF,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YACnF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,iFAAiF;gBACjF,oFAAoF;gBACpF,8EAA8E;gBAC9E,oEAAoE;gBACpE,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,6BAA6B;oBACrC,QAAQ,EAAE,UAAU,IAAI,oKAAoK;iBAC7L,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACzC,mFAAmF;YACnF,0FAA0F;YAC1F,yFAAyF;YACzF,0FAA0F;YAC1F,0FAA0F;YAC1F,2FAA2F;YAC3F,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,MAAM,eAAe,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;YAC/D,MAAM,gBAAgB,GAAG,eAAe;gBACtC,CAAC,CAAC,MAAM,wBAAwB,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;gBACnF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,GAAG,GAAG,IAAI,yBAAyB,CAAC;gBACxC,SAAS,EAAE,cAAc;gBACzB,gBAAgB,EAAE,YAAY;gBAC9B,oBAAoB,EAAE,GAAG,EAAE,CAAC,iBAAiB;gBAC7C,sBAAsB,EAAE,GAAG,EAAE,CAAC,gBAAgB;gBAC9C,WAAW;gBACX,WAAW;gBACX,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBACpF,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC9E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAC/B,2FAA2F;oBAC3F,sDAAsD;oBACtD,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,MAAM,CAAC,KAAK;wBACpB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAG,MAA8B,CAAC,MAAM,CAAC;qBACrF,CAAC;gBACJ,CAAC;gBACD,8FAA8F;gBAC9F,6FAA6F;gBAC7F,iEAAiE;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC5F,0FAA0F;gBAC1F,kFAAkF;gBAClF,+FAA+F;gBAC/F,gGAAgG;gBAChG,kGAAkG;gBAClG,sFAAsF;gBACtF,iFAAiF;gBACjF,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1G,CAAC;qBAAM,CAAC;oBACN,+FAA+F;oBAC/F,wFAAwF;oBACxF,2FAA2F;oBAC3F,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnF,CAAC;gBACD,0EAA0E;gBAC1E,yEAAyE;gBACzE,uEAAuE;gBACvE,0EAA0E;gBAC1E,gEAAgE;gBAChE,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACzG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;oBAC3H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxF,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;wBACnD,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,MAAM,CAAC,QAAQ;wBACxB,KAAK,EAAE,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;qBACpE,CAAC,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;oBAC3H,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,OAAO,EAAE,8BAA8B;qBACxC,CAAC;gBACJ,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,sBAAsB,GAAG,KAAK,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"register-handler.js","sourceRoot":"","sources":["../src/register-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAOrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAiBlE,MAAM,UAAU,uBAAuB,CAAC,IAAyB;IAC/D,MAAM,EACJ,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAC9C,iBAAiB,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,kBAAkB,EACpF,yBAAyB,EAAE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,GAChF,GAAG,IAAI,CAAC;IAET,mFAAmF;IACnF,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,uFAAuF;IACvF,6FAA6F;IAC7F,2FAA2F;IAC3F,IAAI,sBAAsB,GAAG,KAAK,CAAC;IAEnC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,KAA2B,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,EAAE,YAAkC,CAAC;QAChE,MAAM,SAAS,GAAI,MAAM,EAAE,SAAgC,IAAI,EAAE,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iIAAiI,EAAE,CAAC;QAC9L,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,wIAAwI,EAAE,CAAC;QAC5M,CAAC;QACD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,IAAI,8DAA8D,IAAI,uCAAuC,EAAE,CAAC;QACrL,CAAC;QACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,yGAAyG,EAAE,CAAC;QAC7K,CAAC;QACD,6EAA6E;QAC7E,4DAA4D;QAC5D,IAAI,sBAAsB,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,QAAQ,EAAE,2PAA2P,EAAE,CAAC;QAC1U,CAAC;QACD,sBAAsB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,2EAA2E;YAC3E,wEAAwE;YACxE,sFAAsF;YACtF,mFAAmF;YACnF,uFAAuF;YACvF,2FAA2F;YAC3F,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,kCAAkC;YAClC,MAAM,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;YAC7C,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACzB,sEAAsE;gBACtE,yEAAyE;gBACzE,6EAA6E;gBAC7E,6FAA6F;gBAC7F,6FAA6F;gBAC7F,iGAAiG;gBACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,gLAAgL,EAAE,CAAC;YACpP,CAAC;YACD,MAAM,iBAAiB,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAE7E,iFAAiF;YACjF,iFAAiF;YACjF,sFAAsF;YACtF,2DAA2D;YAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC9D,MAAM,cAAc,GAAG,WAAW,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5G,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;YAElH,4EAA4E;YAC5E,oFAAoF;YACpF,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YACnF,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,iFAAiF;gBACjF,oFAAoF;gBACpF,8EAA8E;gBAC9E,oEAAoE;gBACpE,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,6BAA6B;oBACrC,QAAQ,EAAE,UAAU,IAAI,oKAAoK;iBAC7L,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACzC,mFAAmF;YACnF,0FAA0F;YAC1F,yFAAyF;YACzF,0FAA0F;YAC1F,0FAA0F;YAC1F,2FAA2F;YAC3F,2FAA2F;YAC3F,uFAAuF;YACvF,2FAA2F;YAC3F,MAAM,eAAe,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;YAC/D;;;;;;;;;;;;;;;;;;;;;;eAsBG;YACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,eAAe,IAAI,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvF;;;;;;eAMG;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,KAAK,SAAS;mBAC9C,gBAAgB,CAAC,KAAK,KAAK,mBAAmB;mBAC9C,gBAAgB,CAAC,KAAK,KAAK,eAAe,CAAC;YAChD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBAC1C,KAAK,EAAE,IAAI;oBACX,KAAK,EAAE,gBAAgB,CAAC,KAAK;oBAC7B,MAAM,EAAE,gBAAgB,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS;oBACpG,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC9E;;;;;;;;;;;;;uBAaG;oBACH;;;;;;;;;uBASG;oBACH,MAAM,EACJ,yFAAyF;wBACzF,2EAA2E;wBAC3E,0FAA0F;wBAC1F,+CAA+C;oBACjD,QAAQ,EACN,yFAAyF;wBACzF,mFAAmF;wBACnF,oFAAoF;wBACpF,iFAAiF;wBACjF,cAAc;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,gBAAgB,GAAG,eAAe;gBACtC,CAAC,CAAC,MAAM,wBAAwB,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;gBACnF,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,GAAG,GAAG,IAAI,yBAAyB,CAAC;gBACxC,SAAS,EAAE,cAAc;gBACzB,gBAAgB,EAAE,YAAY;gBAC9B,oBAAoB,EAAE,GAAG,EAAE,CAAC,iBAAiB;gBAC7C,sBAAsB,EAAE,GAAG,EAAE,CAAC,gBAAgB;gBAC9C,WAAW;gBACX,WAAW;gBACX,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBACpF,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC9E,+EAA+E;oBAC/E,8EAA8E;oBAC9E,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAC/B,2FAA2F;oBAC3F,sDAAsD;oBACtD,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,MAAM,CAAC,KAAK;wBACpB,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAG,MAA8B,CAAC,MAAM,CAAC;qBACrF,CAAC;gBACJ,CAAC;gBACD,8FAA8F;gBAC9F,6FAA6F;gBAC7F,iEAAiE;gBACjE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC5F,0FAA0F;gBAC1F,kFAAkF;gBAClF,+FAA+F;gBAC/F,gGAAgG;gBAChG,kGAAkG;gBAClG,sFAAsF;gBACtF,iFAAiF;gBACjF,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1G,CAAC;qBAAM,CAAC;oBACN,+FAA+F;oBAC/F,wFAAwF;oBACxF,2FAA2F;oBAC3F,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnF,CAAC;gBACD,0EAA0E;gBAC1E,yEAAyE;gBACzE,uEAAuE;gBACvE,0EAA0E;gBAC1E,gEAAgE;gBAChE,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACzG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;oBAC3H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxF,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;wBACnD,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,MAAM,CAAC,QAAQ;wBACxB,KAAK,EAAE,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;qBACpE,CAAC,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;oBAC3H,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,cAAc,EAAE,MAAM,CAAC,cAAc;wBACrC,OAAO,EAAE,8BAA8B;qBACxC,CAAC;gBACJ,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,sBAAsB,GAAG,KAAK,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/relay-only.d.ts

@@ -0,0 +1,133 @@
+/**
+ * CELLO Daemon — relay-only routing (`DOD-M15-RELAYONLY-1`).
+ *
+ * The feature half of the IP disclosure. A direct session reveals the operator's IP permanently;
+ * relay routing is the mitigation, and until now it was a footnote in an architecture document
+ * rather than something an operator could switch on.
+ *
+ * ─── ⚠️ WHY THIS IS NOT A `transport_mode` SETTING ─────────────────────────────────────────────
+ *
+ * `transport_mode` DOES NOT CONTROL WHETHER A DIRECT CONNECTION HAPPENS, and a setting that wrote it
+ * would be a privacy control that does not protect privacy:
+ *
+ *   - The directory already defaults the label to relay (`requestedTransportMode ?? "relay"`), so in
+ *     the ordinary case the label ALREADY reads "relay".
+ *   - And the client dials directly anyway — the gate is `counterparty_session_addrs.length > 0`,
+ *     *"regardless of the transport_mode LABEL"*, in `initiate-session-handler.ts`'s own words.
+ *
+ * So the IP is exposed today on a path whose label already claims otherwise, and an operator who set
+ * a label-only flag would be told they were protected while they were not.
+ *
+ * ─── The two halves, and why the second is the one that makes it a control ────────────────────
+ *
+ * A direct connection leaks the IP in BOTH directions:
+ *
+ *   1. **We dial only their CIRCUIT** — `dialableAddrs`. Dialling their direct address hands them
+ *      ours; dialling the circuit terminates at the relay and reveals nothing.
+ *   2. **We publish only our own CIRCUIT** — `publishableEndpoint`. The only route they hold points
+ *      at the relay, which protects the operator **even against a counterparty who ignores the flag**.
+ *
+ * The second is load-bearing: *a control that depends on the other side honouring it is not a
+ * control.* The first alone would leave us reachable by anyone who kept our address.
+ *
+ * ⚠️ **AND NEITHER HALF IS SUFFICIENT WHILE libp2p CAN SPEAK FOR US.** These functions filter what
+ * the DIRECTORY is told. `identify` hands a peer our listen addresses on the first relayed
+ * connection, and `dcutr` actively hole-punches a relayed connection into a direct one — the inbound
+ * side starts that upgrade, and a relay-only responder IS the inbound side. Both bypass everything
+ * here, peer-to-peer. `createNode`'s `holePunch: { enabled: false }` closes the second; the announce
+ * filter closes the first. **Without those, this file filters the paperwork and leaves the wire
+ * open** — see `DOD-M15-RELAYONLY-1`.
+ *
+ * `publishableEndpoint` is applied INSIDE `getStandingReceiverInfo` — the single method both publish
+ * paths draw from — rather than at its call sites. Suppressing at call sites would be a hand-kept
+ * list, and a fourth publish path added later would leak while every test stayed green. At the choke
+ * point a new caller inherits the protection instead of having to be told about it.
+ */
+/** The per-agent settings key. Lower-snake, dotted namespace, per `agent-settings-keys.ts`. */
+export declare const RELAY_ONLY_KEY = "transport.relay_only";
+/**
+ * Is relay-only routing ON for this agent?
+ *
+ * ⚠️ THE FAILURE DIRECTION IS CHOSEN, not incidental. **Only the exact string `"true"` is ON.**
+ * Unset reads OFF because the daemon must run correctly on defaults alone; a corrupt or unparseable
+ * value also reads OFF, because reading a value nobody validated as ON would silently break every
+ * ordinary direct session.
+ *
+ * That leaves one hazard — a typo'd value that the operator believes turned the control on — and it
+ * is closed at the WRITE boundary instead: `validateSettingValue` refuses anything but `"true"` and
+ * `"false"`, loudly, so a mistyped value can never be stored to be misread here.
+ */
+export declare function isRelayOnly(getSetting: (key: string) => string | null): boolean;
+/**
+ * The setting's state when the read itself may fail — `"on" | "off" | "unknown"`.
+ *
+ * ⚠️ **"THE DATABASE IS GONE" IS NOT A VALUE, AND TREATING IT AS ONE FAILS TOWARD DISCLOSURE.**
+ * `getSetting` returns `null` both for *unset* and for *no database*, and `isRelayOnly` reads both
+ * as OFF. Unset-means-off is right; **db-gone-means-off is not** — the standing receiver outlives
+ * the database during shutdown, so an offer arriving in that window would publish the operator's
+ * real addresses with relay-only switched on.
+ *
+ * A read that THROWS is also `"unknown"` rather than an escaping exception: this sits on a ceremony
+ * path with no catch, where a throw becomes an unhandled rejection and the offer vanishes with no
+ * local log — the initiator then sees `counterparty_did_not_accept` and blames its own subsystem.
+ *
+ * The caller decides what `"unknown"` costs. For publishing, it must cost a refusal, never a guess.
+ */
+export declare function relayOnlyState(getSetting: (key: string) => string | null, readable: boolean): "on" | "off" | "unknown";
+/** A session-transport endpoint as published to a counterparty. */
+export interface PublishableEndpoint {
+    peerId: string;
+    addrs: string[];
+}
+/**
+ * A relay-CIRCUIT multiaddr — the address that discloses nothing about the operator.
+ *
+ * ⚠️ THIS IS THE DISTINCTION THE WHOLE UNIT TURNS ON, and getting it wrong the first time took the
+ * operator OFF THE NETWORK rather than making them private. A `/p2p-circuit` address names the
+ * **RELAY's** address and our peer id. It terminates at the relay. Publishing one tells a
+ * counterparty how to reach us *through* the relay and tells them nothing about where we are;
+ * dialing one reveals us to the relay we already chose, not to them.
+ *
+ * So relay-only is not "no addresses". It is "circuit addresses only".
+ */
+export declare function isCircuitAddr(addr: string): boolean;
+/**
+ * The endpoint as it may leave this machine.
+ *
+ * ⚠️ **AN EMPTY ADDRESS ARRAY IS NOT A PRIVATE FRAME, IT IS A MALFORMED ONE.** The first build of
+ * this published `addrs: []` and the directory refuses exactly that on both sides — a
+ * `session_request` whose `initiator_session_addrs` is empty is rejected outright, and a
+ * `session_offer_accept` is only folded in `if (counterparty_session_addrs.length > 0)`, **with no
+ * `else`**, so the accept was silently dropped and the offer waiter never resolved. The operator
+ * switched on a privacy control and was told their counterparty was offline.
+ *
+ * So we publish the **circuit-only subset**: enough for the directory to build a real assignment and
+ * for the counterparty to reach us over the relay, and nothing that points at the operator.
+ *
+ * A genuinely empty result is meaningful and is NOT silently published — see `relayOnlyReachable`.
+ * A null endpoint stays null: "no standing receiver" and "a receiver at no address" are different
+ * facts, and collapsing them would let a caller advertise an endpoint that does not exist.
+ */
+export declare function publishableEndpoint<T extends PublishableEndpoint>(endpoint: T | null, relayOnly: boolean): T | PublishableEndpoint | null;
+/**
+ * Can a relay-only agent actually be reached with what it is about to publish?
+ *
+ * FALSE means it holds **no relay reservation yet**, so the circuit-only subset is empty. That must
+ * become a LOUD LOCAL REFUSAL rather than an empty publish: an empty publish is refused by the
+ * directory as malformed and surfaces to the operator as "the counterparty is offline", which is a
+ * lie about someone else's state caused by a setting on this machine.
+ */
+export declare function relayOnlyReachable(endpoint: PublishableEndpoint | null, relayOnly: boolean): boolean;
+/**
+ * Which of the counterparty's advertised addresses may we dial?
+ *
+ * ⚠️ Returns the FILTERED LIST, not a boolean, because "relay-only" does not mean "do not connect" —
+ * it means "connect only over the circuit". The first build refused every address including the
+ * `/p2p-circuit` one, which is the relay route this setting exists to force everything onto, so it
+ * dropped every session onto the store-and-forward backstop.
+ *
+ * The counterparty may not be relay-only themselves, so they will still advertise direct addresses:
+ * those are dropped, because dialing one hands them our IP with our own setting switched on.
+ */
+export declare function dialableAddrs(addrs: readonly string[], relayOnly: boolean): string[];
+//# sourceMappingURL=relay-only.d.ts.map

package/dist/relay-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-only.d.ts","sourceRoot":"","sources":["../src/relay-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,+FAA+F;AAC/F,eAAO,MAAM,cAAc,yBAAyB,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC1C,QAAQ,EAAE,OAAO,GAChB,IAAI,GAAG,KAAK,GAAG,SAAS,CAO1B;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA4BnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,EAC/D,QAAQ,EAAE,CAAC,GAAG,IAAI,EAClB,SAAS,EAAE,OAAO,GACjB,CAAC,GAAG,mBAAmB,GAAG,IAAI,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAIpG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAGpF"}

package/dist/relay-only.js

@@ -0,0 +1,183 @@
+/**
+ * CELLO Daemon — relay-only routing (`DOD-M15-RELAYONLY-1`).
+ *
+ * The feature half of the IP disclosure. A direct session reveals the operator's IP permanently;
+ * relay routing is the mitigation, and until now it was a footnote in an architecture document
+ * rather than something an operator could switch on.
+ *
+ * ─── ⚠️ WHY THIS IS NOT A `transport_mode` SETTING ─────────────────────────────────────────────
+ *
+ * `transport_mode` DOES NOT CONTROL WHETHER A DIRECT CONNECTION HAPPENS, and a setting that wrote it
+ * would be a privacy control that does not protect privacy:
+ *
+ *   - The directory already defaults the label to relay (`requestedTransportMode ?? "relay"`), so in
+ *     the ordinary case the label ALREADY reads "relay".
+ *   - And the client dials directly anyway — the gate is `counterparty_session_addrs.length > 0`,
+ *     *"regardless of the transport_mode LABEL"*, in `initiate-session-handler.ts`'s own words.
+ *
+ * So the IP is exposed today on a path whose label already claims otherwise, and an operator who set
+ * a label-only flag would be told they were protected while they were not.
+ *
+ * ─── The two halves, and why the second is the one that makes it a control ────────────────────
+ *
+ * A direct connection leaks the IP in BOTH directions:
+ *
+ *   1. **We dial only their CIRCUIT** — `dialableAddrs`. Dialling their direct address hands them
+ *      ours; dialling the circuit terminates at the relay and reveals nothing.
+ *   2. **We publish only our own CIRCUIT** — `publishableEndpoint`. The only route they hold points
+ *      at the relay, which protects the operator **even against a counterparty who ignores the flag**.
+ *
+ * The second is load-bearing: *a control that depends on the other side honouring it is not a
+ * control.* The first alone would leave us reachable by anyone who kept our address.
+ *
+ * ⚠️ **AND NEITHER HALF IS SUFFICIENT WHILE libp2p CAN SPEAK FOR US.** These functions filter what
+ * the DIRECTORY is told. `identify` hands a peer our listen addresses on the first relayed
+ * connection, and `dcutr` actively hole-punches a relayed connection into a direct one — the inbound
+ * side starts that upgrade, and a relay-only responder IS the inbound side. Both bypass everything
+ * here, peer-to-peer. `createNode`'s `holePunch: { enabled: false }` closes the second; the announce
+ * filter closes the first. **Without those, this file filters the paperwork and leaves the wire
+ * open** — see `DOD-M15-RELAYONLY-1`.
+ *
+ * `publishableEndpoint` is applied INSIDE `getStandingReceiverInfo` — the single method both publish
+ * paths draw from — rather than at its call sites. Suppressing at call sites would be a hand-kept
+ * list, and a fourth publish path added later would leak while every test stayed green. At the choke
+ * point a new caller inherits the protection instead of having to be told about it.
+ */
+/** The per-agent settings key. Lower-snake, dotted namespace, per `agent-settings-keys.ts`. */
+export const RELAY_ONLY_KEY = "transport.relay_only";
+/**
+ * Is relay-only routing ON for this agent?
+ *
+ * ⚠️ THE FAILURE DIRECTION IS CHOSEN, not incidental. **Only the exact string `"true"` is ON.**
+ * Unset reads OFF because the daemon must run correctly on defaults alone; a corrupt or unparseable
+ * value also reads OFF, because reading a value nobody validated as ON would silently break every
+ * ordinary direct session.
+ *
+ * That leaves one hazard — a typo'd value that the operator believes turned the control on — and it
+ * is closed at the WRITE boundary instead: `validateSettingValue` refuses anything but `"true"` and
+ * `"false"`, loudly, so a mistyped value can never be stored to be misread here.
+ */
+export function isRelayOnly(getSetting) {
+    return getSetting(RELAY_ONLY_KEY) === "true";
+}
+/**
+ * The setting's state when the read itself may fail — `"on" | "off" | "unknown"`.
+ *
+ * ⚠️ **"THE DATABASE IS GONE" IS NOT A VALUE, AND TREATING IT AS ONE FAILS TOWARD DISCLOSURE.**
+ * `getSetting` returns `null` both for *unset* and for *no database*, and `isRelayOnly` reads both
+ * as OFF. Unset-means-off is right; **db-gone-means-off is not** — the standing receiver outlives
+ * the database during shutdown, so an offer arriving in that window would publish the operator's
+ * real addresses with relay-only switched on.
+ *
+ * A read that THROWS is also `"unknown"` rather than an escaping exception: this sits on a ceremony
+ * path with no catch, where a throw becomes an unhandled rejection and the offer vanishes with no
+ * local log — the initiator then sees `counterparty_did_not_accept` and blames its own subsystem.
+ *
+ * The caller decides what `"unknown"` costs. For publishing, it must cost a refusal, never a guess.
+ */
+export function relayOnlyState(getSetting, readable) {
+    if (!readable)
+        return "unknown";
+    try {
+        return getSetting(RELAY_ONLY_KEY) === "true" ? "on" : "off";
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * A relay-CIRCUIT multiaddr — the address that discloses nothing about the operator.
+ *
+ * ⚠️ THIS IS THE DISTINCTION THE WHOLE UNIT TURNS ON, and getting it wrong the first time took the
+ * operator OFF THE NETWORK rather than making them private. A `/p2p-circuit` address names the
+ * **RELAY's** address and our peer id. It terminates at the relay. Publishing one tells a
+ * counterparty how to reach us *through* the relay and tells them nothing about where we are;
+ * dialing one reveals us to the relay we already chose, not to them.
+ *
+ * So relay-only is not "no addresses". It is "circuit addresses only".
+ */
+export function isCircuitAddr(addr) {
+    // ⚠️ PARSED, never substring-matched. `addr.includes("/p2p-circuit")` was defeatable by the
+    // COUNTERPARTY, who controls these strings — the directory copies them verbatim and the FROST
+    // signature attests that the quorum agreed on the assignment, NOT that its contents are circuits.
+    //
+    //     /dns4/p2p-circuit.attacker.example/tcp/443/p2p/12D3KooWTheirs
+    //
+    // contains the literal text, resolves through the DNS transport, and would have been dialled
+    // directly — handing over the operator's IP with relay-only switched ON, while the suppression log
+    // reported `suppressed: 0`. A control a peer can defeat by naming a host is precisely what this
+    // line rules out.
+    //
+    // EXACT SEGMENT match on the multiaddr's own `/`-delimited components. `p2p-circuit` is a
+    // standalone protocol with no value, so it appears as a whole segment; a hostname that merely
+    // CONTAINS the text appears as `p2p-circuit.attacker.example`, which is a different segment and is
+    // correctly rejected.
+    //
+    // Deliberately NOT `multiaddr().protoNames()`, which would be the stricter parse: that lives in
+    // `@multiformats/multiaddr`, a dependency `core/daemon` does not have. Reaching for it here would
+    // add a package to the daemon to make one boolean stricter, and this client is installed on
+    // operators' machines where install weight is a user-facing cost. The exact-segment test defeats
+    // the demonstrated bypass with no new dependency.
+    //
+    // ⚠️ RESIDUAL, stated rather than left implied: this proves the address CLAIMS a circuit hop, not
+    // that the circuit runs through a relay we chose. A peer could name a relay we hold no reservation
+    // with. Binding the embedded relay peer id to our own reservations is the stronger check and is
+    // NOT done here.
+    return addr.split("/").includes("p2p-circuit");
+}
+/**
+ * The endpoint as it may leave this machine.
+ *
+ * ⚠️ **AN EMPTY ADDRESS ARRAY IS NOT A PRIVATE FRAME, IT IS A MALFORMED ONE.** The first build of
+ * this published `addrs: []` and the directory refuses exactly that on both sides — a
+ * `session_request` whose `initiator_session_addrs` is empty is rejected outright, and a
+ * `session_offer_accept` is only folded in `if (counterparty_session_addrs.length > 0)`, **with no
+ * `else`**, so the accept was silently dropped and the offer waiter never resolved. The operator
+ * switched on a privacy control and was told their counterparty was offline.
+ *
+ * So we publish the **circuit-only subset**: enough for the directory to build a real assignment and
+ * for the counterparty to reach us over the relay, and nothing that points at the operator.
+ *
+ * A genuinely empty result is meaningful and is NOT silently published — see `relayOnlyReachable`.
+ * A null endpoint stays null: "no standing receiver" and "a receiver at no address" are different
+ * facts, and collapsing them would let a caller advertise an endpoint that does not exist.
+ */
+export function publishableEndpoint(endpoint, relayOnly) {
+    if (endpoint === null)
+        return null;
+    if (!relayOnly)
+        return endpoint;
+    return { peerId: endpoint.peerId, addrs: endpoint.addrs.filter(isCircuitAddr) };
+}
+/**
+ * Can a relay-only agent actually be reached with what it is about to publish?
+ *
+ * FALSE means it holds **no relay reservation yet**, so the circuit-only subset is empty. That must
+ * become a LOUD LOCAL REFUSAL rather than an empty publish: an empty publish is refused by the
+ * directory as malformed and surfaces to the operator as "the counterparty is offline", which is a
+ * lie about someone else's state caused by a setting on this machine.
+ */
+export function relayOnlyReachable(endpoint, relayOnly) {
+    if (!relayOnly)
+        return true;
+    if (endpoint === null)
+        return false;
+    return endpoint.addrs.some(isCircuitAddr);
+}
+/**
+ * Which of the counterparty's advertised addresses may we dial?
+ *
+ * ⚠️ Returns the FILTERED LIST, not a boolean, because "relay-only" does not mean "do not connect" —
+ * it means "connect only over the circuit". The first build refused every address including the
+ * `/p2p-circuit` one, which is the relay route this setting exists to force everything onto, so it
+ * dropped every session onto the store-and-forward backstop.
+ *
+ * The counterparty may not be relay-only themselves, so they will still advertise direct addresses:
+ * those are dropped, because dialing one hands them our IP with our own setting switched on.
+ */
+export function dialableAddrs(addrs, relayOnly) {
+    if (!relayOnly)
+        return [...addrs];
+    return addrs.filter(isCircuitAddr);
+}
+//# sourceMappingURL=relay-only.js.map

package/dist/relay-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-only.js","sourceRoot":"","sources":["../src/relay-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,UAA0C;IACpE,OAAO,UAAU,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,UAA0C,EAC1C,QAAiB;IAEjB,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,4FAA4F;IAC5F,8FAA8F;IAC9F,kGAAkG;IAClG,EAAE;IACF,oEAAoE;IACpE,EAAE;IACF,6FAA6F;IAC7F,mGAAmG;IACnG,gGAAgG;IAChG,kBAAkB;IAClB,EAAE;IACF,0FAA0F;IAC1F,8FAA8F;IAC9F,mGAAmG;IACnG,sBAAsB;IACtB,EAAE;IACF,gGAAgG;IAChG,kGAAkG;IAClG,4FAA4F;IAC5F,iGAAiG;IACjG,kDAAkD;IAClD,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,iBAAiB;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,SAAkB;IAElB,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAoC,EAAE,SAAkB;IACzF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB,EAAE,SAAkB;IACxE,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACrC,CAAC"}