@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/session-connection-gater.js

@@ -1,332 +0,0 @@
-/**
- * CELLO Daemon — SessionConnectionGater
- *
- * Implements the libp2p ConnectionGater interface to enforce per-session
- * peer allowlists on ephemeral session nodes.
- *
- * Two modes:
- *   1. Session node gater: allows exactly one counterparty Peer ID.
- *      Created with the counterparty's Peer ID at session node creation.
- *   2. Standing receiver gater: created with no allowed peer, which admits
- *      NOBODY inbound (DOD-M15-ASSIGN-1 — it used to admit everyone) while
- *      still permitting the outbound errands the receiver doubles as a dialer
- *      for. Call setAllowedPeer() before handing the node's multiaddr to the
- *      directory (AC-015); that is what opens the door, to exactly one peer.
- *   3. Directory node gater: delegates to DirectoryPeerIdProvider.
- *      Allows only known directory Peer IDs (MANIFEST-002 fills the real set).
- *
- * The gater uses denyInboundConnection (before Noise handshake) to reject
- * unexpected peers as early as possible. Since PeerId is not yet known at
- * that point, we use denyInboundEncryptedConnection (after Noise, before muxer)
- * which has the PeerId and still occurs before any streams are opened.
- *
- * Observability: session.node.connection.rejected (WARN) is logged with
- * sessionId, attemptedPeerId, and expectedPeerId.
- */
-/** Permissive stub: allows all peers. Used for directory node in DAEMON-002. */
-export class PermissiveDirectoryPeerIdProvider {
-    isDirectoryPeer(_peerId) {
-        return true;
-    }
-}
-/** Restrictive stub: denies all peers. Used in unit tests (AC-016). */
-export class EmptyDirectoryPeerIdProvider {
-    isDirectoryPeer(_peerId) {
-        return false;
-    }
-}
-/**
- * SessionConnectionGater — enforces a single allowed Peer ID on a session node.
- *
- * Starts CLOSED to inbound (allowedPeerId = null) for the standing receiver;
- * setAllowedPeer(initiatorPeerId) names the one peer that may dial, and is
- * called before the node's multiaddr is returned to the caller (AC-015).
- */
-export class SessionConnectionGater {
-    #allowedPeerId;
-    /**
-     * M7 DOD-SPINE-6 / DOD-NAT-REACHABILITY-1: additional peers the session node may
-     * connect to OUTBOUND only. Originally a single slot for the relay witness
-     * (Structure-2 hash submit); now a SET, because the node also dials independent
-     * relays — its own reservation relays, and the relay embedded in the
-     * counterparty's /p2p-circuit address (which rides the FROST-signed assignment,
-     * so it is authorized by the same rail as the assigned witness). Kept
-     * OUTBOUND-only so the INBOUND counterparty-only invariant (INV-5 — a session
-     * node admits exactly one counterparty) is fully preserved.
-     */
-    #allowedOutboundPeerIds = new Set();
-    #sessionId;
-    #logger;
-    /**
-     * Is this node still acting as a STANDING RECEIVER, whose outbound dials are unrestricted?
-     *
-     * DOD-M15-ASSIGN-1 review F2. The outbound carve-out originally keyed off `#allowedPeerId ===
-     * null`, which broke the moment `admitInboundPeer` narrowed the inbound gate at offer time: the
-     * receiver was still the daemon's general-purpose dialer, but its outbound gate had silently
-     * closed to everything except the named dialer and the reservation relays.
-     *
-     * What that cost, concretely: the content-park deposit/pull and the restart-seal submission both
-     * dial relays that are NOT on the reservation list — the second one persisted from an EARLIER
-     * session. So an agent that merely RECEIVED one inbound offer would quietly stop being able to
-     * submit a seal, and the operator would see `relay_unavailable` — a transport label for what was
-     * actually a local gater decision. A seal leaf that does not land is not a papercut.
-     *
-     * So the two things are now tracked separately: narrowing WHO MAY DIAL IN (INV-5) does not
-     * revoke this node's own right to dial out. Only promotion into a session does that.
-     */
-    #standingReceiverOutbound;
-    /**
-     * The relays this receiver currently holds a live circuit reservation with. Empty by default.
-     *
-     * Review N3. The inbound AutoNAT carve-out below first keyed on `#allowedOutboundPeerIds`, and
-     * that set is populated from the relay peer ids **the directory hands out at signaling-auth
-     * time** — cumulatively, including relays whose reservation never completed. In a unit whose
-     * entire threat model is "one compromised directory", that handed the adversary back a narrow
-     * inbound foothold: name a relay, never complete a reservation, and dial in anyway.
-     *
-     * Entries added ONLY when a reservation actually succeeded is the honest version of the
-     * justification the carve-out's comment makes — "a peer this node already dials and holds a
-     * reservation with" — rather than a set that merely tends to contain those.
-     *
-     * 032-RELAYSPREAD widened this from ONE peer to a set, because the receiver now holds a
-     * reservation with every relay that will grant one. **The BOUND did not widen with it, and that
-     * is the security-sensitive part**: membership is still "this relay's own reservation is
-     * confirmed held", never "this relay is in the pool". Widening it to the candidate list would
-     * let a directory that merely NAMES a relay dial in behind the gate — the exact failure the
-     * single-relay version was written to prevent, multiplied by the size of the pool.
-     */
-    #reservedRelayPeerIds = new Set();
-    constructor(opts) {
-        this.#sessionId = opts.sessionId;
-        this.#allowedPeerId = opts.allowedPeerId;
-        // A gater built with no named peer is a standing receiver; one built naming its counterparty is
-        // a session node, which has never been allowed to dial anywhere but its counterparty and relays.
-        this.#standingReceiverOutbound = opts.allowedPeerId === null;
-        this.#logger = opts.logger;
-    }
-    /**
-     * PROMOTION — this node is now a session node serving exactly this counterparty.
-     *
-     * Narrows inbound AND ends the standing-receiver outbound latitude: from here the node may dial
-     * only its counterparty and the relays explicitly added to the outbound allowlist.
-     */
-    setAllowedPeer(peerId) {
-        this.#allowedPeerId = peerId;
-        this.#standingReceiverOutbound = false;
-    }
-    /**
-     * DOD-M15-ASSIGN-1 — name the one peer that may dial IN, without promoting the node.
-     *
-     * Used when a `session_offer` names the initiator, before any assignment exists. The node is
-     * still the daemon's general-purpose dialer at this point, so its outbound latitude is untouched;
-     * see `#standingReceiverOutbound`.
-     */
-    admitInboundPeer(peerId) {
-        this.#allowedPeerId = peerId;
-    }
-    /**
-     * Return to admitting NOBODY inbound — the resting state of an unclaimed receiver.
-     *
-     * DOD-M15-OFFER-SIGNED-1 review F4: when an offer is refused after the gate was already narrowed
-     * to the peer it named, leaving that peer admitted means the code has declared someone
-     * unauthorised and left the door open to exactly them. Outbound latitude is untouched; this node
-     * is still the daemon's general-purpose dialer.
-     */
-    closeInbound() {
-        this.#allowedPeerId = null;
-    }
-    /**
-     * Record the relays this receiver holds LIVE circuit reservations with — the only peers that earn
-     * the inbound AutoNAT carve-out.
-     *
-     * REPLACES the set rather than adding to it. A relay absent from `peerIds` loses its carve-out in
-     * the same call that notices the reservation is gone, so the bound stays "holds one now" and
-     * cannot drift into "granted one once". Pass `[]` when nothing is held.
-     */
-    /**
-     * Does this relay hold the inbound carve-out — i.e. would this gater ADMIT an inbound dial from
-     * it on the strength of a live reservation?
-     *
-     * **This IS the carve-out branch**, not a description of it: `denyInboundEncryptedConnection`
-     * calls this method rather than re-testing the set. One definition, so nothing observing the gate
-     * can be told something different from what the gate does — which matters because the review
-     * found that substituting the CANDIDATE list for the held list at the manager's
-     * `setReservedRelayPeers` call left every test in this unit green while opening exactly the hole
-     * the bound exists to close. Read-only and silent: an observation must not log a refusal.
-     */
-    holdsInboundCarveOut(peerId) {
-        return this.#standingReceiverOutbound && this.#reservedRelayPeerIds.has(peerId);
-    }
-    setReservedRelayPeers(peerIds) {
-        this.#reservedRelayPeerIds.clear();
-        for (const peerId of peerIds)
-            this.#reservedRelayPeerIds.add(peerId);
-    }
-    /**
-     * M7 DOD-SPINE-6: permit an OUTBOUND connection to a relay peer (the assigned
-     * witness, a reservation relay, or the relay inside the counterparty's circuit
-     * address — all authorized by the signed assignment / directory rail). ADDITIVE:
-     * each call widens the outbound set only. Does NOT widen the inbound allowlist.
-     */
-    setAllowedOutboundPeer(peerId) {
-        this.#allowedOutboundPeerIds.add(peerId);
-    }
-    /**
-     * DOD-M15-FRAME-1: is this peer on the OUTBOUND allowlist?
-     *
-     * Read by the promotion-time eviction sweep, which disconnects peers that attached before the
-     * gate narrowed — libp2p does not re-run a gater against connections that already exist. Relay
-     * peers sit on this list because reservation refreshes ride them, and hanging one up would cost
-     * the agent its inbound reachability to remove a peer that cannot speak the content protocol
-     * anyway. Exposed as a question rather than by handing out the set, so the sweep cannot widen it.
-     */
-    isAllowedOutboundPeer(peerId) {
-        return this.#allowedOutboundPeerIds.has(peerId);
-    }
-    getSessionId() {
-        return this.#sessionId;
-    }
-    getAllowedPeerId() {
-        return this.#allowedPeerId;
-    }
-    /**
-     * denyInboundEncryptedConnection — called after Noise handshake, before muxer.
-     * This is the enforcement point for inbound connections: PeerId is known here.
-     * Return true to DENY the connection.
-     */
-    denyInboundEncryptedConnection(peerId, _maConn) {
-        return this.#denyIfNotAllowed(peerId, "inbound");
-    }
-    /**
-     * denyOutboundEncryptedConnection — symmetric gate for outbound connections.
-     * Session nodes should only connect to the designated counterparty.
-     * Return true to DENY the connection.
-     */
-    denyOutboundEncryptedConnection(peerId, _maConn) {
-        // Relay peers are an OUTBOUND-only allowance (the session node dials them).
-        if (this.#allowedOutboundPeerIds.has(peerId.toString())) {
-            return false; // allow
-        }
-        // Review F2: a standing receiver is also the daemon's dialer for errands that belong to no
-        // session — content-park deposit/pull, restart-seal submission to a PRIOR session's relay.
-        // Those targets are on no allowlist and cannot be, since they are chosen per errand.
-        if (this.#standingReceiverOutbound) {
-            return false; // allow — this node chose the dial; INV-5 governs who comes IN
-        }
-        return this.#denyIfNotAllowed(peerId, "outbound");
-    }
-    #denyIfNotAllowed(peerId, direction) {
-        /**
-         * DOD-M15-ASSIGN-1 — `null` ADMITS NOBODY INBOUND. It used to admit everyone, both ways.
-         *
-         * A standing receiver is built with `allowedPeerId: null` because the counterparty is unknown
-         * until a session exists. Reading that as "allow all" is what put a real open door on every
-         * operator's machine: a stranger could dial the receiver, hold the connection through
-         * promotion — libp2p never re-runs a gater against a live connection — and then speak the
-         * content protocol the moment it activated.
-         *
-         * NOBODY LEGITIMATELY DIALS AN UNCLAIMED RECEIVER. An inbound session begins with the directory
-         * sending a `session_offer` that NAMES `initiator_session_peer_id`, and the responder narrows
-         * the gate to that peer BEFORE it advertises its own address in `session_offer_accept`. So by
-         * the time the initiator can know where to dial, the gate already names them. The window this
-         * closes is the one where the receiver is up and no offer has arrived — where the only dialer
-         * is, by construction, someone who was not invited.
-         *
-         * OUTBOUND STAYS OPEN WHILE UNCLAIMED, and that asymmetry is deliberate, not an oversight. The
-         * standing receiver is also the daemon's general-purpose dialer for errands that belong to no
-         * session — the content-park deposit and pull against the relay (MSG-001-3b). Those dials are
-         * this agent choosing where to go; INV-5 governs who may come IN. Denying them would have cost
-         * message parking to close a door nobody was standing at.
-         */
-        /**
-         * Review F7: a RESERVATION RELAY dialling back is infrastructure, not a stranger.
-         *
-         * The standing receiver runs the libp2p AutoNAT *client*: it asks connected peers to dial its
-         * observed address so it can learn whether it is publicly reachable. Its connected peers are
-         * its own reservation relays. That dial-back arrives INBOUND, and the outbound allowlist was
-         * only consulted on the outbound path — so it was refused, and refused repeatedly.
-         *
-         * Two costs, and the second is the quiet one. It logged `connection.rejected` on every probe
-         * cycle, on the one line that is supposed to mean a stranger tried an unclaimed receiver — a
-         * signal that fires on the normal case is not a signal. And AutoNAT answers repeated dial
-         * failures by REMOVING the observed address, so an agent's own public address never becomes
-         * verified and never reaches `listenAddresses()` — the array shipped in `session_offer_accept`.
-         * We would have been advertising a shorter address list and blaming the network.
-         *
-         * These are peers this node already dials and holds reservations with. Admitting their
-         * dial-back grants nothing it did not already have.
-         *
-         * SCOPED TWICE, and each scope closed a hole the previous version had.
-         *
-         * To the STANDING-RECEIVER ROLE: the first attempt admitted relays inbound on every gater, which
-         * breaks INV-5 — a SESSION node admits exactly one counterparty, and the existing tests say so
-         * in those words. A promoted node has no AutoNAT probe to answer, so it needs nothing here.
-         *
-         * To THE RELAYS HOLDING A LIVE RESERVATION (`#reservedRelayPeerIds`), not the outbound
-         * allowlist. That allowlist is built from relay peer ids the DIRECTORY supplies, cumulatively,
-         * including ones whose reservation never completed — so keying on it let a compromised
-         * directory name a relay and dial in without ever holding a reservation. In a unit whose threat
-         * model is exactly that adversary, the outbound allowlist was the wrong thing to trust, and it
-         * still is: this set holds only relays whose own reservation was confirmed, however many relays
-         * the pool names.
-         */
-        if (direction === "inbound" && this.holdsInboundCarveOut(peerId.toString())) {
-            return false; // allow — a relay we hold a live reservation with, answering a probe we started
-        }
-        if (this.#allowedPeerId === null) {
-            if (direction === "outbound")
-                return false; // allow — we chose this dial; INV-5 is inbound-only
-            this.#logger.warn("session.node.connection.rejected", {
-                sessionId: this.#sessionId,
-                attemptedPeerId: peerId.toString(),
-                expectedPeerId: "(none — receiver unclaimed)",
-                impact: "a peer dialled a standing receiver that no session has claimed; nothing invited it, so it was refused before the muxer and it learned nothing",
-            });
-            return true; // DENY
-        }
-        const attemptedPeerId = peerId.toString();
-        if (attemptedPeerId === this.#allowedPeerId) {
-            return false; // allow
-        }
-        this.#logger.warn("session.node.connection.rejected", {
-            sessionId: this.#sessionId,
-            attemptedPeerId,
-            expectedPeerId: this.#allowedPeerId,
-        });
-        return true; // deny
-    }
-}
-/**
- * DirectoryConnectionGater — enforces directory-only connections on the
- * directory-facing node. Delegates to DirectoryPeerIdProvider.
- *
- * Logs session.node.connection.rejected (using sessionId='directory') when
- * a non-directory peer is denied.
- */
-export class DirectoryConnectionGater {
-    #provider;
-    #logger;
-    constructor(provider, logger) {
-        this.#provider = provider;
-        this.#logger = logger;
-    }
-    denyInboundEncryptedConnection(peerId, _maConn) {
-        return this.#denyIfNotDirectory(peerId);
-    }
-    denyOutboundEncryptedConnection(peerId, _maConn) {
-        return this.#denyIfNotDirectory(peerId);
-    }
-    #denyIfNotDirectory(peerId) {
-        const peerIdStr = peerId.toString();
-        if (this.#provider.isDirectoryPeer(peerIdStr)) {
-            return false; // allow
-        }
-        this.#logger.warn("session.node.connection.rejected", {
-            sessionId: "__directory_facing__",
-            attemptedPeerId: peerIdStr,
-            expectedPeerId: "known_directory_peer",
-        });
-        return true; // deny
-    }
-}
-//# sourceMappingURL=session-connection-gater.js.map

package/dist/session-connection-gater.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-connection-gater.js","sourceRoot":"","sources":["../src/session-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAcH,gFAAgF;AAChF,MAAM,OAAO,iCAAiC;IAC5C,eAAe,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,4BAA4B;IACvC,eAAe,CAAC,OAAe;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACjC,cAAc,CAAgB;IAC9B;;;;;;;;;OASG;IACM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,UAAU,CAAS;IACnB,OAAO,CAAS;IAEzB;;;;;;;;;;;;;;;;OAgBG;IACH,yBAAyB,CAAU;IAEnC;;;;;;;;;;;;;;;;;;;OAmBG;IACM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnD,YAAY,IAIX;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,gGAAgG;QAChG,iGAAiG;QACjG,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,yBAAyB,GAAG,KAAK,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,YAAY;QACV,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,MAAc;QACjC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,qBAAqB,CAAC,OAA0B;QAC9C,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,MAAc;QACnC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,2FAA2F;QAC3F,2FAA2F;QAC3F,qFAAqF;QACrF,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,+DAA+D;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,SAAiC;QACjE;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA+BG;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC5E,OAAO,KAAK,CAAC,CAAC,gFAAgF;QAChG,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,SAAS,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC,CAAC,oDAAoD;YAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACpD,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAClC,cAAc,EAAE,6BAA6B;gBAC7C,MAAM,EACJ,+IAA+I;aAClJ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,OAAO;QACtB,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,eAAe;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAC1B,SAAS,CAA0B;IACnC,OAAO,CAAS;IAEzB,YAAY,QAAiC,EAAE,MAAc;QAC3D,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,mBAAmB,CAAC,MAAc;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,sBAAsB;YACjC,eAAe,EAAE,SAAS;YAC1B,cAAc,EAAE,sBAAsB;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF"}

package/dist/session-content-context.d.ts

@@ -1,162 +0,0 @@
-/**
- * CELLO Daemon — WHAT THE CONTENT PATH NEEDS FROM THE MANAGER
- *
- * One context, shared by both halves of the content path — `session-content-send.ts` and
- * `session-content-ingest.ts`. It lives in its own file because two classes hold it and a shape
- * declared beside one of them reads as belonging to that one.
- *
- * ⚠️ **IT IS WIDE ON PURPOSE, AND THAT IS THE TRADE THIS SPLIT MAKES.** The narrow contexts the
- * earlier collaborators hold (a dozen members each) are not reachable here: inbound ingest reads
- * session state, held content, salts, ephemeral keys, the relay client, the ordering record, the
- * screening gateway and the transcript, and it does so inside ONE method whose forty guards each
- * read locals the guards above them declared. A narrower seam would have to be bought with a
- * rewrite of that method, and a rewrite of the ingest path is a correctness risk on the most
- * load-bearing code in the daemon. Explicit and typed but wide beats implicit and narrow: every
- * member below is named, so what these files can reach is a list a reader can check, not a `this`.
- *
- * **Nothing here is state the content path owns.** The maps are shared BY REFERENCE with the
- * manager and with the other collaborators — one Map object, not a copy — for the same reason
- * `HeldContent` shares `heldContent`: two sources of truth for "what is in flight" is worse than
- * one shared one.
- */
-import { type KeyProvider } from "@cello-protocol/crypto";
-import { type CelloNode } from "@cello-protocol/transport";
-import { type SecurityGatewayClient } from "@cello-protocol/gateway";
-import type { Logger } from "./types.js";
-import type { SessionTree, WritableSessionTreeLeafKind } from "./session-tree.js";
-import { AgentRelayClient } from "./session-relay-client.js";
-import type { SessionOwnChainStore } from "./session-own-chain-store.js";
-import type { AuthorshipVerifier } from "./authorship-verification.js";
-import type { InboundRefusals } from "./inbound-refusals.js";
-import type { SessionRecords } from "./session-records.js";
-import type { ParkRecovery } from "./park-recovery.js";
-import type { SessionSalts } from "./session-salts.js";
-import type { SessionQueries } from "./session-queries.js";
-import type { RefusalNotices } from "./refusal-notices.js";
-import type { SessionEphemerals } from "./session-ephemerals.js";
-import type { SessionLiveness } from "./session-liveness.js";
-import type { HeldContent, HeldEntry } from "./held-content.js";
-import type { SessionLeafRecords } from "./session-leaf-records.js";
-import { type ActiveSessionEntry, type AwaitingAckEntry } from "./session-node-types.js";
-/**
- * What the content pipeline needs from the manager.
- *
- * Three shapes appear here and the difference between them is load-bearing:
- *
- * - **Plain readonly properties** are things the manager may REPLACE after this object is built —
- *   the wired-in hooks, the own-chain store (opened with the database, long after construction).
- *   The manager implements each as a getter over its own field, so this file always sees the
- *   current value rather than a snapshot taken during construction. A captured VALUE here would
- *   have frozen `null` in place for the life of the process; that exact mistake once left signing
- *   silently disabled while every test stayed green.
- * - **Mutable properties** are the three fault-injection counters, which this file both reads and
- *   decrements. They are accessor pairs on the manager's side.
- * - **Methods** are calls back into the manager, and the shared maps are passed by reference.
- */
-export interface SessionContentPipelineContext {
-    readonly logger: Logger;
-    /**
-     * M9-CORE-001: the inbound screening seam. Held rather than reached for, because a pipeline that
-     * could choose not to screen is one that will eventually be built to skip it (INV-9).
-     */
-    readonly securityGateway: SecurityGatewayClient;
-    readonly records: SessionRecords;
-    readonly authorship: AuthorshipVerifier;
-    readonly refusals: InboundRefusals;
-    readonly park: ParkRecovery;
-    readonly salts: SessionSalts;
-    readonly queries: SessionQueries;
-    readonly notices: RefusalNotices;
-    /**
-     * DOD-M15-CLOSEDSESSION-1 — has THIS side committed its half of the seal?
-     *
-     * A FUNCTION rather than the raw mark map, deliberately: the answer falls back to durable
-     * evidence when the in-memory mark is gone (a restart between the ctrl-leaf submit and the
-     * status write), and a context holding the map would let a second caller re-derive the answer
-     * without that fallback. One definition, on the manager. See `session-closed.ts`.
-     */
-    readonly hasCommittedSealLeaf: (agentName: string, sessionId: string) => boolean;
-    readonly ephemerals: SessionEphemerals;
-    readonly liveness: SessionLiveness;
-    readonly held: HeldContent;
-    readonly leafRecords: SessionLeafRecords;
-    readonly activeNodes: Map<string, ActiveSessionEntry>;
-    readonly awaitingAck: Map<string, Map<string, AwaitingAckEntry>>;
-    readonly heldContent: Map<string, Map<number, HeldEntry>>;
-    readonly witnessedSeq: Map<string, Map<string, number>>;
-    /**
-     * DOD-M15-SEALPRECOND-1 — content hash -> the sequence the relay assigned OUR OWN leaf, for the
-     * span between the relay ordering it and this tree placing it.
-     *
-     * Distinct from `witnessedSeq`, which gains an entry only for leaves NOT authored by us
-     * (`relayLeafHandler`), and that asymmetry is exactly what cost a receipt on 2026-09-11: the
-     * relay had ordered our third leaf, the tree still held two, and every counter the seal gate
-     * reads was zero. Gained at the assignment site in `sendContent`, lost in `placeOwnLeaf`.
-     */
-    readonly ownLeavesOrdered: Map<string, Map<string, number>>;
-    readonly leafFetchTimers: Map<string, ReturnType<typeof setTimeout>>;
-    readonly lastAck: Map<string, {
-        seq: number;
-        hash: Uint8Array;
-    }>;
-    readonly resolvedContent: Map<string, Set<string>>;
-    readonly undeliverableSeqs: Map<string, Set<number>>;
-    readonly highWaterSeq: Map<string, number>;
-    readonly counterpartyAddrs: Map<string, string[]>;
-    readonly lingeringStreams: Set<ReturnType<typeof setTimeout>>;
-    readonly redialNotBefore: Map<string, number>;
-    readonly orderingObserved: Set<string>;
-    readonly shuttingDown: boolean;
-    readonly contentTtfMs: number;
-    readonly leafFetchGraceMs: number;
-    /** Opened with the database, which happens long after this object is built — never a snapshot. */
-    readonly ownChainStore: SessionOwnChainStore | null;
-    /**
-     * ⚠️ **`null` AND "returns false" ARE DIFFERENT ANSWERS, everywhere below.** An absent durable
-     * queue is not a queue that refused; an absent document classifier is not a frame that is not a
-     * document. Each of these stays nullable so the code can keep saying which it was, which is why
-     * they are properties rather than pre-bound calls.
-     */
-    readonly onParkFailed: ((agentName: string, sessionId: string, contentHashHex: string, content: Uint8Array, structure1Cbor?: Uint8Array, structure2Cbor?: Uint8Array, contentHashAlg?: string) => boolean) | null;
-    readonly onContentArrived: ((agentName: string, sessionId: string, senderPubkey: string) => void) | null;
-    readonly onDocumentFrame: ((agentName: string, sessionId: string, content: Uint8Array, senderPubkey: string, correlationId?: string) => {
-        consumed: boolean;
-        kind?: string;
-    }) | null;
-    readonly isDocumentFrame: ((content: Uint8Array) => boolean) | null;
-    readonly onAwaitingPersisted: ((agentName: string, sessionId: string, contentHashHex: string) => void) | null;
-    readonly inboundFrameObserver: ((frame: Record<string, unknown>) => void) | null;
-    sendFaultRemaining: number;
-    ackFaultRemaining: number;
-    connectionLossRemaining: number;
-    /** DOD-LOOP-1: (agentName, sessionId), never sessionId alone — see the manager's own note. */
-    sessionKey(agentName: string, sessionId: string): string;
-    keyProvider(agentName: string): KeyProvider | undefined;
-    getSessionTree(agentName: string, sessionId: string): SessionTree;
-    appendSessionLeaf(agentName: string, sessionId: string, kind: WritableSessionTreeLeafKind, leafHashHex: string, correlationId?: string): {
-        leafIndex: number;
-        newRootHex: string;
-    };
-    mailboxRouteAvailable(agentName: string): boolean;
-    streamCensus(node: CelloNode, peerId: string): Record<string, number>;
-    freezeOnIdentityFailure(agentName: string, sessionId: string, reason: string, correlationId?: string): Promise<void>;
-    handleTtfExpiry(agentName: string, sessionId: string, hashHex: string): void;
-    markContentUnverifiable(agentName: string, sessionId: string, why: "tampered" | "unverifiable"): void;
-    maybeAutoAcknowledgeSeal(agentName: string, sessionId: string, correlationId: string): void;
-    ownChainOf(agentName: string, sessionId: string, entry: {
-        relayClient?: AgentRelayClient;
-        relaySessionIdBytes?: Uint8Array;
-    } | undefined, ownPubkey: Uint8Array): Uint8Array | undefined;
-    updateSessionStatus(agentName: string, sessionId: string, status: "active" | "sealed" | "interrupted" | "abandoned", interruptedBy?: "local"): boolean;
-    abandonSession(agentName: string, sessionId: string): Promise<boolean>;
-    connectToCounterparty(agentName: string, sessionId: string, addrs: string[]): Promise<{
-        ok: true;
-    } | {
-        ok: false;
-        reason: string;
-        error: string;
-    }>;
-    destroySessionNode(agentName: string, sessionId: string, reason: "sealed" | "interrupted" | "error"): Promise<void>;
-    retireOnCounterpartyAbandon(agentName: string, sessionId: string, correlationId?: string): Promise<boolean>;
-}
-//# sourceMappingURL=session-content-context.d.ts.map

package/dist/session-content-context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-content-context.d.ts","sourceRoot":"","sources":["../src/session-content-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAGhD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjF,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IAGzC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;IACrE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAGvC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAGpD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EACjB,CAAC,CACC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EACnB,cAAc,CAAC,EAAE,UAAU,EAC3B,cAAc,CAAC,EAAE,UAAU,EAC3B,cAAc,CAAC,EAAE,MAAM,KACpB,OAAO,CAAC,GACb,IAAI,CAAC;IACT,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACzG,QAAQ,CAAC,eAAe,EACpB,CAAC,CACC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,KACnB;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAC1C,IAAI,CAAC;IACT,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC;IACpE,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9G,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAGjF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;IAGhC,8FAA8F;IAC9F,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IACxD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAClE,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,2BAA2B,EACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtE,uBAAuB,CACrB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;IACtG,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5F,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC;QAAC,mBAAmB,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,SAAS,EACvF,SAAS,EAAE,UAAU,GACpB,UAAU,GAAG,SAAS,CAAC;IAC1B,mBAAmB,CACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,WAAW,EACzD,aAAa,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;IACX,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,kBAAkB,CAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,GACzC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7G"}

package/dist/session-content-context.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=session-content-context.js.map

package/dist/session-content-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-content-context.js","sourceRoot":"","sources":["../src/session-content-context.ts"],"names":[],"mappings":""}

package/dist/session-content-handlers.d.ts

@@ -1,82 +0,0 @@
-import { type SecurityGatewayClient } from "@cello-protocol/gateway";
-import type { IpcHandler } from "./ipc-server.js";
-import type { SessionNodeManager } from "./session-node-manager.js";
-import type { SendClaims } from "./send-claims.js";
-import type { RetryQueue } from "./retry-queue.js";
-import type { Logger } from "./types.js";
-import type { ConnState } from "./contact-handlers.js";
-/**
- * DOD-M15-SEALWIRE-1 bullet 5, SENT half — the proof for a message THIS agent sent.
- *
- * Present only when the relay WITNESSED the leaf: an unwitnessed send never put a Structure-1 on the
- * wire, so there is nothing signed to store, and the row must record `self_authored` with no proof
- * rather than imply one. `sendContent` returns it per-send rather than stashing it by session,
- * because a side map hands a caller the wrong send's signature the moment two are in flight.
- */
-/**
- * Did the RELAY witness this leaf — the single fact every `witnessed` in this file is read from.
- *
- * `016-RELAYLOSS` review HIGH-2. The first version of the fix put `witnessed` on two of `cello_send`'s
- * FIVE return paths, which defeats the reason it was added at all: a field that is present on some
- * outcomes and absent on others cannot be branched on, and its absence reads as an older daemon
- * rather than as an answer. Worse, the two it missed are the two that matter most — the diverged
- * path is reachable ONLY after an unwitnessed leaf, and the durably-queued path is the one
- * production takes when the relay is also the transport (behind NAT, content and witness die
- * together), where it was telling operators "No action needed."
- *
- * Read off the PLACEMENT, not re-derived from the sequence number, so this and the
- * `session.tree.own_leaf_unwitnessed` ERROR beside it can never disagree about the same send.
- *
- * ⚠️ A HELD leaf (`placed: false`) is WITNESSED, and that is not a special case being papered over.
- * A leaf is held precisely BECAUSE the relay assigned it a position beyond this side's tail — being
- * held is itself proof of an assignment. Reporting `witnessed: false` there would tell an operator
- * their record had lost a message when the opposite is true.
- */
-export declare function wasWitnessed(p: {
-    placed: true;
-    unwitnessed?: true;
-} | {
-    placed: false;
-}): boolean;
-/**
- * The durably-queued path's guidance: the relay's OWN words, plus what a missing witness costs.
- *
- * **Exported so the test can call THIS rather than re-implement it.** The first version of the
- * composition test rebuilt the string inline and asserted on its own copy — which stays green if
- * production stops composing entirely, and is therefore the hollow shape this milestone keeps
- * finding. A rule worth pinning has to be pinned on the code that runs.
- *
- * The rule, and why it is a composition rather than a choice: `upstream` is where the relay's own
- * retry window reaches the operator ("try again in about 45 seconds"), and a rate-limited park is
- * unwitnessed BY CONSTRUCTION — so choosing between the two messages silently drops the more
- * specific one exactly when it is most useful. Both are true at once and the operator needs both.
- *
- * The default splits on `witnessed` for one reason only: "No action needed" is false for a leaf the
- * relay never recorded.
- */
-export declare function queuedSendGuidance(upstream: string | undefined, witnessed: boolean): string;
-export declare function sentAuthorship(r: Awaited<ReturnType<SessionNodeManager["sendContent"]>>): {
-    senderPubkey: Uint8Array;
-    senderSig: Uint8Array;
-} | undefined;
-export interface SessionContentDeps {
-    handlers: Map<string, IpcHandler>;
-    logger: Logger;
-    sessionNodeManager: SessionNodeManager;
-    securityGateway: SecurityGatewayClient;
-    retryQueue: RetryQueue;
-    getConnState: (connectionId: string) => ConnState | undefined;
-    resolveCurrentAgent: (connState: ConnState | undefined, explicitAgent?: string) => string | null;
-    NO_CURRENT_AGENT_RESPONSE: unknown;
-    /** M8C-CURSOR-1: the per-connection read cursor (read-before-write gating). */
-    getConnectionCursor: (connectionId: string, sessionId: string) => number;
-    advanceConnectionCursor: (connectionId: string, sessionId: string, seq: number) => void;
-    /** M8C-TGDOOR-1: a read clears the doorbell's ring-once-until-read. */
-    clearTelegramRung: (agentName: string, sessionId: string) => void;
-    /** DOD-COATTEND-VISIBLE-1: how many connections attend this agent right now (reporting only). */
-    attendanceCount: (agentName: string) => number;
-    /** Sends on the wire right now — shared with the away one-shot, which must not close under one. */
-    sendClaims: SendClaims;
-}
-export declare function registerSessionContentHandlers(deps: SessionContentDeps): void;
-//# sourceMappingURL=session-content-handlers.d.ts.map

package/dist/session-content-handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-content-handlers.d.ts","sourceRoot":"","sources":["../src/session-content-handlers.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA2C,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC9G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA8HvD;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GAAG,OAAO,CAEjG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAY3F;AAED,wBAAgB,cAAc,CAC5B,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,GACxD;IAAE,YAAY,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GAAG,SAAS,CAUjE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,qBAAqB,CAAC;IACvC,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,yBAAyB,EAAE,OAAO,CAAC;IACnC,+EAA+E;IAC/E,mBAAmB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxF,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,iGAAiG;IACjG,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,mGAAmG;IACnG,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAgsC7E"}