@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/boot-agents.js

@@ -1,241 +0,0 @@
-/**
- * Phase 2 of boot: the agents this daemon holds, and everything that acts on their behalf.
- *
- * Identities loaded from the encrypted `agents` table, their signing keys, the content park and its
- * recovery path, the reconnect drain, and the queue that retries a submission the directory would
- * not take. Phase 1 built the machinery; this is where it acquires subjects.
- *
- * ⚠️ FOUR VALUES ARRIVE AS GETTERS BECAUSE THEY DO NOT EXIST YET — `flushAwaitingContent`,
- * `onlineAgents`, `sharedSignaling` and `perAgentSignaling`, all declared BELOW this phase and all
- * read from callbacks that run long after boot.
- *
- * **They are LOUD, not silent, and the difference is the thing to remember.** Three of the four are
- * `const`, so a by-value pass is a temporal-dead-zone `ReferenceError` at boot — every test red
- * immediately. (An earlier version of this comment said `onlineAgents` would "freeze as an empty
- * set". It would not: it is a `const` below the call, and it is a `Set`, so even declared above it
- * would pass by reference and track later additions. Wrong twice over.)
- *
- * **The SILENT shape is a `let` that is assigned further down** — still `undefined`, no error, no
- * type complaint. That is what unit 4 shipped. Two of them are still live in the composition root
- * and every later phase crosses them: `reconcileScheduler` and `documentOwnerKeyForHook`. The test
- * to apply is "is this a `let` assigned below?", not "would this value freeze?" — the freezing cases
- * announce themselves.
- */
-import { loadAgents } from "./agent-loader.js";
-import { DbRegistrationPersistence } from "./db-identity-store.js";
-import { createContentPark } from "./content-park.js";
-import { createReconnectDrain } from "./reconnect-drain.js";
-import { SubmissionRetryQueue } from "./submission-retry.js";
-import { TrustSignalStore } from "./trust-signal-store.js";
-import { sendSealedSubmission } from "./signal-submission.js";
-import { extractErrorMessage } from "./error-message.js";
-export async function startBootAgents(deps) {
-    const { config, logger, sessionNodeManager, securityGateway, getFlushAwaitingContent, getOnlineAgents, getSharedSignaling, getPerAgentSignaling, } = deps;
-    // Load agent identities from the encrypted `agents` table (PERSIST-002 AC-007 — one path).
-    // (The encrypted store + lock were established above, before manifest verification.)
-    const { loaded: loadedAgents, failed: failedAgents } = await loadAgents(sessionNodeManager.getDb(), logger);
-    // PERSIST-002: per-agent DB-backed identity persistence. The registration handler and the
-    // ceremony/seal signer-reconstruction load the FROST share (and persist the identity) through this
-    // seam — the encrypted `agents` row, never a flat file.
-    const getPersistence = (agentName) => new DbRegistrationPersistence({ db: sessionNodeManager.getDb(), agentName, logger });
-    // Build agent state. `state` here is the LOAD outcome only — whether the identity opened at all.
-    // The state an operator sees is derived per call by resolveAgentState (agent-state.ts), because
-    // most of what it depends on (started, signaling, attendance, paused) changes while the daemon
-    // runs and cannot be baked into a record at boot.
-    const agents = [
-        ...loadedAgents.map((a) => ({
-            name: a.name,
-            state: "stopped",
-            pubkey: a.pubkey,
-        })),
-        ...failedAgents.map((a) => ({
-            name: a.name,
-            state: "load_failed",
-            error: a.error,
-        })),
-    ];
-    // M7-SESSION-001 (H-1): retain each agent's K_local signing key so the daemon
-    // can produce K_local-signed SEAL-INTERRUPTED leaves (both as initiator and as
-    // the bilateral responder). The KeyProvider keeps the private scalar internal —
-    // only signatures leave it.
-    const keyProviders = new Map();
-    for (const a of loadedAgents) {
-        keyProviders.set(a.name, a.keyProvider);
-    }
-    // DOD-M15-EPHEMERAL-AUTH-1: the session manager signs each session's throwaway key with the
-    // agent's identity, so it needs the same providers. Injected here rather than through the
-    // constructor because this map is built after the manager exists — the same reason
-    // `setParkedDrainHook` is a setter.
-    sessionNodeManager.setKeyProviderResolver((agentName) => keyProviders.get(agentName));
-    // Constructed HERE, before ANY boot-time caller. autoRecoverForAgent is invoked from an agent's
-    // onConnected and from the seal-upgrade content gate — both of which run long before the IPC
-    // handler map exists. Its handlers register later (phase 2), which is what lets this sit up here.
-    const contentPark = createContentPark({
-        logger,
-        sessionNodeManager,
-        agents,
-        getKeyProvider: (agentName) => keyProviders.get(agentName),
-        // M12-P17: annexed content bypasses the live inbound funnel, so it is screened here instead.
-        securityGateway,
-    });
-    const autoRecoverForAgent = (agentName, trigger) => contentPark.autoRecoverForAgent(agentName, trigger);
-    // DOD-PARK-DRAIN-1: drain where the parking actually happens. Content parks when the RELAY link
-    // drops, and the manager tells us on every event that changes this agent's ability to pull — the
-    // first ensure, a reservation LOST, a reservation REGAINED, the slow backstop sweep. (056-SLOTDEAD:
-    // was "watchdog rebuild, auth_ok rebuild"; neither exists, and the pair names the cause instead.)
-    sessionNodeManager.setParkedDrainHook((agentName, reason) => {
-        // M12-P12 (review F1): the SENDER half of the same event. A refused park deposit leaves a
-        // durable retry_queue row, and until this call existed the only things that drained it were a
-        // daemon restart and cello_start_agent — so the fix made a lost message restart-recoverable
-        // while the DoD line promises "no restart". A lost reservation is where parking actually happens,
-        // so it is where the re-park fires (056-SLOTDEAD: was "the watchdog rebuild", now deleted).
-        void getFlushAwaitingContent()(agentName).catch((err) => {
-            logger.warn("content.park.flush.failed", { agentName, trigger: reason, stage: "drain_hook", error: extractErrorMessage(err) });
-        });
-        void autoRecoverForAgent(agentName, reason).catch((err) => {
-            // autoRecoverForAgent catches per-relay errors internally; this is the backstop, and it uses
-            // extractErrorMessage because the transport rejects with structured plain objects that
-            // String() renders as "[object Object]" — the reason 100+ real failures were undiagnosable.
-            logger.warn("content.recover.auto.failed", { agentName, trigger: reason, stage: "drain_hook", error: extractErrorMessage(err) });
-        });
-    });
-    // DOD-PARK-DRAIN-1: what an agent's signaling reconnect does — ensure THEN drain, never both at
-    // once. Constructed here, beside the content park it drains; `onlineAgents` is read inside the
-    // callback (at connect time), never during this construction, so its later declaration is not a
-    // temporal-dead-zone hazard.
-    const onSignalingConnected = createReconnectDrain({
-        logger,
-        isAgentOnline: (agentName) => getOnlineAgents().has(agentName),
-        ensureStandingReceiver: (agentName) => sessionNodeManager.ensureStandingReceiverForAgent(agentName),
-        drainParked: (agentName) => autoRecoverForAgent(agentName, "signaling_reconnect"),
-        // M12-P12 (review F1): ordered AFTER ensureStandingReceiver by createReconnectDrain's own
-        // ensure→drain contract — a re-park needs the receiver that the ensure step rebuilds.
-        flushSender: (agentName) => getFlushAwaitingContent()(agentName),
-    });
-    /**
-     * DOD-M15-ENDORSE-RETRY-1 — sealed submissions whose send reached no directory node.
-     *
-     * The consortium has three nodes and a submission used to die with whichever one this daemon
-     * happened to be connected to. It is held here instead and re-sent when the SignalingManager
-     * reconnects — that reconnect IS the failover, and nothing in this daemon picks a node for a
-     * submission (`sendSealedSubmission`'s header rules that out). Safe because `submission_id` is
-     * derived from the signed plaintext: a second node stores it once and the portal mints once.
-     */
-    const submissionRetries = new SubmissionRetryQueue({
-        logger,
-        send: async (pending) => {
-            /**
-             * THE AGENT MUST STILL BE HERE TO SIGN, and this failure has its own name.
-             *
-             * It borrowed `submission_refused_by_node` at first, which states that a directory node
-             * decoded, evaluated and refused the submission — none of which happened. Stacked on the
-             * give-up reason it produced, the operator saw two labels both pointing at the directory for
-             * a cause that is entirely local (review M5).
-             *
-             * Neither branch is reachable in this daemon today — nothing removes from `keyProviders` or
-             * `loadedAgents` — so this is a guard against a future unload path rather than a live case.
-             * That is said plainly instead of being implied by a comment describing a state the code
-             * cannot reach.
-             */
-            /**
-             * READ the agent's manager; never CREATE one, and this ONE guard is the whole check.
-             *
-             * `getAgentSignaling` is not a getter — for an agent with no manager it constructs one, which
-             * dials, authenticates, and installs an unbounded reconnect loop. `dropAgentSignaling` exists
-             * to stop and forget a manager for an agent whose registration failed terminally, and a
-             * background retry that silently rebuilt it would undo that decision from a timer nobody is
-             * watching.
-             *
-             * It replaces a `keyProviders` + `loadedAgents` pair that is now dead: the manager was built
-             * WITH this agent's key provider and pubkey, so its presence is the accurate statement of
-             * "this daemon can still send as this agent", and nothing prunes either of those two maps.
-             *
-             * There is always a manager here in practice — the first-pass send built one before this
-             * submission could ever have been held. Its absence means it was deliberately dropped, and
-             * the right answer is to stop trying, not to resurrect it.
-             */
-            // The SAME resolution `getAgentSignaling` performs, minus the construction: the shared
-            // manager first (the in-process path, where `getPerAgentSignaling()` is never populated at all),
-            // then this agent's own. Reading only the per-agent map would refuse every retry on the
-            // shared path — which is how this fix first failed its own live test.
-            const existing = getSharedSignaling()
-                ? { signaling: getSharedSignaling() }
-                : getPerAgentSignaling().get(pending.agentName);
-            if (!existing) {
-                return {
-                    ok: false,
-                    reason: "submission_agent_unloaded",
-                    guidance: `The directory connection for '${pending.agentName}' has been torn down, so the held ` +
-                        "submission cannot be sent. Start the agent with cello_start_agent and issue it again — " +
-                        "re-sending is safe, the submission id is derived from the content.",
-                };
-            }
-            return sendSealedSubmission({
-                signaling: existing.signaling,
-                submissionId: pending.submissionId,
-                intakeKeyId: pending.intakeKeyId,
-                ciphertext: pending.ciphertext,
-                logger,
-            });
-        },
-        onAccepted: (pending, stored) => {
-            // THE STABLE ID THE ENQUEUE CAPTURED, not a re-resolution from the mutable name (review M6).
-            // `agentName` is a display label and is reusable after a retire; re-deriving it here would
-            // write the accepted row under a different agent's id if a name were retired and reused
-            // inside the retry window. The correct value is already in the struct.
-            recordIssuedSubmission(pending.agentName, pending.agentId, {
-                submissionId: pending.submissionId,
-                subject: pending.subject,
-                op: pending.op,
-                intakeKeyId: pending.intakeKeyId,
-                stored,
-            });
-        },
-        ...(config.submissionRetryIntervalsMs?.staggerMs === undefined
-            ? {}
-            : { staggerMs: config.submissionRetryIntervalsMs.staggerMs }),
-        ...(config.submissionRetryIntervalsMs?.localPreconditionRetryMs === undefined
-            ? {}
-            : { localPreconditionRetryMs: config.submissionRetryIntervalsMs.localPreconditionRetryMs }),
-    });
-    /**
-     * KEEP THE HANDLE, or a withdrawal has nothing to name. The submission id is content-derived and
-     * so reproducible in principle, but only by re-composing the exact original body — which the
-     * operator no longer has once they have sent it.
-     *
-     * Best-effort on purpose: the submission IS accepted by the time this runs, and failing the call
-     * over a local bookkeeping write would turn a success into a reported failure and invite a
-     * re-send of something already queued. Logged loudly instead.
-     *
-     * Shared by the first-pass send and the retry, so the two cannot drift about what a landed
-     * submission records.
-     */
-    function recordIssuedSubmission(agentName, 
-    /** The STABLE key, supplied by the caller. Never re-derived from `agentName` here — that is a
-     *  display label, and this table is keyed by identity. */
-    agentId, s) {
-        try {
-            const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
-            store.recordIssuedSubmission({
-                agentId,
-                submissionId: s.submissionId,
-                subjectPubkey: s.subject,
-                op: s.op,
-                intakeKeyId: s.intakeKeyId,
-                stored: s.stored,
-            });
-        }
-        catch (err) {
-            logger.error("signal.submission.record_failed", {
-                agentName,
-                submissionId: s.submissionId,
-                reason: extractErrorMessage(err),
-            });
-        }
-    }
-    return {
-        loadedAgents, getPersistence, agents, keyProviders, contentPark,
-        autoRecoverForAgent, onSignalingConnected, submissionRetries, recordIssuedSubmission,
-    };
-}
-//# sourceMappingURL=boot-agents.js.map

package/dist/boot-agents.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot-agents.js","sourceRoot":"","sources":["../src/boot-agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAwBzD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAoB;IACxD,MAAM,EACJ,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,eAAe,EACnD,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,oBAAoB,GACnF,GAAG,IAAI,CAAC;IAET,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE5G,0FAA0F;IAC1F,mGAAmG;IACnG,wDAAwD;IACxD,MAAM,cAAc,GAAG,CAAC,SAAiB,EAA6B,EAAE,CACtE,IAAI,yBAAyB,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvF,iGAAiG;IACjG,gGAAgG;IAChG,+FAA+F;IAC/F,kDAAkD;IAClD,MAAM,MAAM,GAAgB;QAC1B,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,SAAkB;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;QACH,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,aAAsB;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;KACJ,CAAC;IAEF,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwD,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,4FAA4F;IAC5F,0FAA0F;IAC1F,mFAAmF;IACnF,oCAAoC;IACpC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,SAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAE9F,gGAAgG;IAChG,6FAA6F;IAC7F,kGAAkG;IAClG,MAAM,WAAW,GAAG,iBAAiB,CAAC;QACpC,MAAM;QACN,kBAAkB;QAClB,MAAM;QACN,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;QAClE,6FAA6F;QAC7F,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAE,OAAgB,EAAiB,EAAE,CACjF,WAAW,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEtD,gGAAgG;IAChG,iGAAiG;IACjG,oGAAoG;IACpG,kGAAkG;IAClG,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAE;QAC1E,0FAA0F;QAC1F,8FAA8F;QAC9F,4FAA4F;QAC5F,kGAAkG;QAClG,4FAA4F;QAC5F,KAAK,uBAAuB,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC/D,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjI,CAAC,CAAC,CAAC;QACH,KAAK,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACjE,6FAA6F;YAC7F,uFAAuF;YACvF,4FAA4F;YAC5F,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnI,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gGAAgG;IAChG,+FAA+F;IAC/F,gGAAgG;IAChG,6BAA6B;IAC7B,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;QAChD,MAAM;QACN,aAAa,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;QACtE,sBAAsB,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,SAAS,CAAC;QAC3G,WAAW,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,qBAAqB,CAAC;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,WAAW,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,uBAAuB,EAAE,CAAC,SAAS,CAAC;KACzE,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,MAAM,iBAAiB,GAAG,IAAI,oBAAoB,CAAC;QACjD,MAAM;QACN,IAAI,EAAE,KAAK,EAAE,OAA0B,EAAE,EAAE;YACzC;;;;;;;;;;;;eAYG;YACH;;;;;;;;;;;;;;;;eAgBG;YACH,uFAAuF;YACvF,iGAAiG;YACjG,wFAAwF;YACxF,sEAAsE;YACtE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;gBACnC,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAG,EAAE;gBACtC,CAAC,CAAC,oBAAoB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,EAAE,EAAE,KAAc;oBAClB,MAAM,EAAE,2BAAoC;oBAC5C,QAAQ,EACN,iCAAiC,OAAO,CAAC,SAAS,oCAAoC;wBACtF,yFAAyF;wBACzF,oEAAoE;iBACvE,CAAC;YACJ,CAAC;YACD,OAAO,oBAAoB,CAAC;gBAC1B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9B,6FAA6F;YAC7F,2FAA2F;YAC3F,wFAAwF;YACxF,uEAAuE;YACvE,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE;gBACzD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,SAAS,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,0BAA0B,CAAC,SAAS,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,wBAAwB,KAAK,SAAS;YAC3E,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,0BAA0B,CAAC,wBAAwB,EAAE,CAAC;KAC9F,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,SAAS,sBAAsB,CAC7B,SAAiB;IACjB;8DAC0D;IAC1D,OAAe,EACf,CAAoG;QAEpG,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;YACvE,KAAK,CAAC,sBAAsB,CAAC;gBAC3B,OAAO;gBACP,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,aAAa,EAAE,CAAC,CAAC,OAAO;gBACxB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC9C,SAAS;gBACT,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW;QAC/D,mBAAmB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB;KACrF,CAAC;AACJ,CAAC"}

package/dist/boot-connection-state.d.ts

@@ -1,38 +0,0 @@
-/**
- * Phase 3 of boot: what the daemon remembers per IPC CONNECTION, rather than per agent.
- *
- * Which agent a connection has selected, which agents are online or explicitly offline, and the two
- * read positions — where a connection has read up to in a session, and how far the durable watermark
- * has been advanced on its behalf. A connection is not an agent: several connections can attend one
- * agent at once, and each keeps its own place in the conversation.
- *
- * ONE dependency — the session manager — and nothing late-bound.
- *
- * ⚠️ `forgetConnection` LIVES HERE FOR THE SAME REASON THE MAPS DO. A first cut left the eviction in
- * the composition root, 1,600 lines from the containers it releases, and with it the two comments
- * that say WHY each must die with its connection: the delivery bookmark was once the one
- * per-connection structure that outlived its connection — an unbounded leak on a daemon the CLI
- * reconnects to on every command — and a surviving take ledger made every reconnect look like a
- * theft, because a fresh connection starts at cursor -1 and every take the dead one recorded sits
- * above that bar. A module holding state with no visible release path reads as a leak. This was pure state with a few guards over it, sitting in
- * the middle of the boot sequence because that is where it happened to get written.
- */
-import type { SessionNodeManager } from "./session-node-manager.js";
-export interface BootConnectionStateDeps {
-    sessionNodeManager: SessionNodeManager;
-}
-export declare function startBootConnectionState(deps: BootConnectionStateDeps): {
-    perConnectionState: Map<string, {
-        currentAgent: string | null;
-        clearedAgent?: string;
-        clientType: string;
-    }>;
-    onlineAgents: Set<string>;
-    explicitlyOfflineAgents: Set<string>;
-    forgetConnection: (connectionId: string) => void;
-    getConnectionCursor: (connectionId: string, sessionId: string) => number;
-    advanceConnectionCursor: (connectionId: string, sessionId: string, seq: number) => void;
-    safeCursorAdvance: (connectionId: string, sessionId: string, deliveredSeqs: ReadonlySet<number>) => void;
-    safeWatermarkAdvance: (agentName: string, sessionId: string, deliveredSeqs: ReadonlySet<number>) => void;
-};
-//# sourceMappingURL=boot-connection-state.d.ts.map

package/dist/boot-connection-state.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot-connection-state.d.ts","sourceRoot":"","sources":["../src/boot-connection-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,uBAAuB;;sBAQT,MAAM,GAAG,IAAI;uBAAiB,MAAM;oBAAc,MAAM;;;;qCAwE3E,MAAM,KAAG,IAAI;wCAjDV,MAAM,aAAa,MAAM,KAAG,MAAM;4CAG9B,MAAM,aAAa,MAAM,OAAO,MAAM,KAAG,IAAI;sCAenD,MAAM,aAAa,MAAM,iBAAiB,WAAW,CAAC,MAAM,CAAC,KAAG,IAAI;sCAqBpE,MAAM,aAAa,MAAM,iBAAiB,WAAW,CAAC,MAAM,CAAC,KAAG,IAAI;EAsB9G"}

package/dist/boot-connection-state.js

@@ -1,95 +0,0 @@
-export function startBootConnectionState(deps) {
-    const { sessionNodeManager } = deps;
-    // Per-connection state: tracks which agent is "current" for each IPC connection.
-    // Key = connectionId (assigned by IPC server), Value = current agent name or null.
-    // `clearedAgent` remembers a selection this connection ONCE made and that was taken away (the agent
-    // was stopped or retired). It is what stops resolveCurrentAgent from quietly re-targeting the next
-    // call at some other agent that happens to be online — see there.
-    const perConnectionState = new Map();
-    // Set of agents currently in "online" state (transitioned via cello_start_agent)
-    const onlineAgents = new Set();
-    /**
-     * M12-P16 (review F1): agents an operator DELIBERATELY took offline.
-     *
-     * Deliberately NOT `onlineAgents`. That set answers "has this agent been started through
-     * cello_start_agent", which is not the same question as "may this agent receive": several
-     * legitimate paths serve inbound sessions without ever populating it, so gating the inbound path
-     * on it refuses real traffic (proven — it broke 27 tests across 7 suites). This set is empty
-     * unless someone actually pressed the switch, so it can only ever refuse what the operator asked
-     * to have refused.
-     */
-    const explicitlyOfflineAgents = new Set();
-    // M8C-CURSOR-1: per-connection, per-session read cursor (read-before-write gating).
-    // Distinct from message_watermarks (INBOX-1, per-AGENT delivery watermark, persisted) — this is
-    // per-CONNECTION, in-memory only, and intentionally dies with the connection (a fresh connection
-    // has read nothing yet, so it must catch up before it may send — the WhatsApp-group-chat model
-    // for two attended sessions on one agent). Key = connectionId → sessionId → highest sequence this
-    // connection has read (or authored). Absent entry = -1 (nothing read yet).
-    const connectionCursors = new Map();
-    function getConnectionCursor(connectionId, sessionId) {
-        return connectionCursors.get(connectionId)?.get(sessionId) ?? -1;
-    }
-    function advanceConnectionCursor(connectionId, sessionId, seq) {
-        let byId = connectionCursors.get(connectionId);
-        if (!byId) {
-            byId = new Map();
-            connectionCursors.set(connectionId, byId);
-        }
-        const prior = byId.get(sessionId) ?? -1;
-        if (seq > prior)
-            byId.set(sessionId, seq); // monotonic — never lowers
-    }
-    // M8C-CURSOR-1 (cello-unit-reviewer HIGH finding, confirmed by live reproduction): a
-    // received-only delivery (cello_get_transcript's received view) must NOT blindly advance the
-    // cursor to the max sequence it happened to see — leaf indices are shared and strictly
-    // contiguous across BOTH directions (appendSessionLeaf always assigns leafCount, no gaps), so a
-    // gap between the connection's actual cursor and that max can hide an unread SENT leaf authored
-    // by a DIFFERENT local connection. Advancing past it would silently let this connection send
-    // without ever having seen it — defeating the read-before-write guarantee (C4/C5). Only advance
-    // through a CONTIGUOUS run of sequence numbers that were actually in this delivery, starting
-    // right after the connection's current cursor; stop at the first gap.
-    function safeCursorAdvance(connectionId, sessionId, deliveredSeqs) {
-        let cursor = getConnectionCursor(connectionId, sessionId);
-        while (deliveredSeqs.has(cursor + 1))
-            cursor += 1;
-        advanceConnectionCursor(connectionId, sessionId, cursor);
-    }
-    // The per-connection DELIVERY bookmark that lived here is gone (2026-09-13). It started empty on
-    // every new connection, so a reconnect re-served the whole conversation. `cello_receive` now reads
-    // against the agent's persisted watermark — one bookmark per (agent, session).
-    /**
-     * DOD-CURSOR-DURABLE-1: the same hole-safe walk, applied to the PERSISTED per-(agent, session)
-     * read watermark. Used by cello_get_transcript, whose delivery covers BOTH directions.
-     *
-     * Walks a CONTIGUOUS run from the agent's current watermark, stopping at the first gap — for the
-     * identical reason safeCursorAdvance does: leaf indices are contiguous across both directions, so
-     * a gap can hide an unread RECEIVED message (e.g. a row that failed to decrypt is absent from
-     * `messages`). Advancing past it would mark unseen counterparty content as read and unblock a
-     * send that never saw it — defeating the very guarantee this gate exists to enforce. Monotonic:
-     * advanceLastDeliveredSeq takes MAX, so this can never lower a watermark.
-     */
-    function safeWatermarkAdvance(agentName, sessionId, deliveredSeqs) {
-        let frontier = sessionNodeManager.getLastDeliveredSeq(agentName, sessionId);
-        while (deliveredSeqs.has(frontier + 1))
-            frontier += 1;
-        if (frontier >= 0)
-            sessionNodeManager.advanceLastDeliveredSeq(agentName, sessionId, frontier);
-    }
-    /**
-     * Release everything this connection held. The log context is built by the CALLER — the IPC server
-     * merges it into its single `daemon.ipc.disconnected` line, and a second line under the same name
-     * left neither carrying the whole picture.
-     */
-    function forgetConnection(connectionId) {
-        perConnectionState.delete(connectionId);
-        connectionCursors.delete(connectionId); // M8C-CURSOR-1: cursor is connection-scoped, dies with it
-    }
-    // The two cursor MAPS are not returned — nothing outside reads them directly now that eviction
-    // lives here. What escapes is the operations over them.
-    return {
-        perConnectionState, onlineAgents, explicitlyOfflineAgents, forgetConnection,
-        getConnectionCursor, advanceConnectionCursor, safeCursorAdvance,
-        safeWatermarkAdvance,
-    };
-}
-//# sourceMappingURL=boot-connection-state.js.map

package/dist/boot-connection-state.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot-connection-state.js","sourceRoot":"","sources":["../src/boot-connection-state.ts"],"names":[],"mappings":"AAyBA,MAAM,UAAU,wBAAwB,CAAC,IAA6B;IACpE,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAEpC,iFAAiF;IACjF,mFAAmF;IACnF,oGAAoG;IACpG,mGAAmG;IACnG,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAsF,CAAC;IAEzH,iFAAiF;IACjF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC;;;;;;;;;OASG;IACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAElD,oFAAoF;IACpF,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA+B,CAAC;IACjE,SAAS,mBAAmB,CAAC,YAAoB,EAAE,SAAiB;QAClE,OAAO,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,SAAS,uBAAuB,CAAC,YAAoB,EAAE,SAAiB,EAAE,GAAW;QACnF,IAAI,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,GAAG,GAAG,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,2BAA2B;IACxE,CAAC;IACD,qFAAqF;IACrF,6FAA6F;IAC7F,uFAAuF;IACvF,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,6FAA6F;IAC7F,sEAAsE;IACtE,SAAS,iBAAiB,CAAC,YAAoB,EAAE,SAAiB,EAAE,aAAkC;QACpG,IAAI,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC1D,OAAO,aAAa,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,CAAC,CAAC;QAClD,uBAAuB,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,iGAAiG;IACjG,mGAAmG;IACnG,+EAA+E;IAE/E;;;;;;;;;;OAUG;IACH,SAAS,oBAAoB,CAAC,SAAiB,EAAE,SAAiB,EAAE,aAAkC;QACpG,IAAI,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAE,QAAQ,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChG,CAAC;IACD;;;;OAIG;IACH,SAAS,gBAAgB,CAAC,YAAoB;QAC5C,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,0DAA0D;IACpG,CAAC;IAED,+FAA+F;IAC/F,wDAAwD;IACxD,OAAO;QACL,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB;QAC3E,mBAAmB,EAAE,uBAAuB,EAAE,iBAAiB;QAC/D,oBAAoB;KACrB,CAAC;AACJ,CAAC"}

package/dist/boot-core.d.ts

@@ -1,36 +0,0 @@
-import type { SecurityGatewayClient } from "@cello-protocol/gateway";
-import { SessionNodeManager } from "./session-node-manager.js";
-import { type ManifestOrigin } from "./manifest-validity.js";
-import type { DaemonConfig, Logger } from "./types.js";
-export interface BootCoreDeps {
-    config: DaemonConfig;
-    logger: Logger;
-    /** The configured directory URL, or undefined when nothing was configured. */
-    directoryHttpUrl: string | undefined;
-}
-export declare function startBootCore(deps: BootCoreDeps): Promise<{
-    failoverEndpointResolver: (() => Promise<import("./signaling-connect.js").DirectoryEndpoint | null>) | undefined;
-    getDeclaredNodeCount: () => number | null;
-    getFailoverEndpoint: () => Promise<import("./signaling-connect.js").DirectoryEndpoint | null>;
-    getUnresolvedNodes: () => import("./directory-bootstrap.js").NodeResolveFailure[];
-    getUnresolvedSweptAt: () => string | null;
-    manifestOrigin: ManifestOrigin;
-    manifestVerified: boolean;
-    resolveConsortiumRoster: () => Promise<import("./directory-bootstrap.js").ConsortiumEndpoint[] | null>;
-    rosterSweepScheduler: import("@cello-protocol/transport").IManifestPollScheduler | undefined;
-    securityGateway: SecurityGatewayClient;
-    sessionNodeManager: SessionNodeManager;
-    stopHttpManifestPoll: (() => void) | undefined;
-    stopRosterSweep: (() => void) | undefined;
-    transportSelector: import("./transport-selector.js").ITransportSelector;
-    verifiedManifest: import("@cello-protocol/protocol-types").ConsortiumManifest | null;
-    verifiedManifestVersion: number;
-    /** A READER. See the header — a snapshot here reports a healthy roster forever. */
-    lastRosterSweepError: () => {
-        event: string;
-        error: string;
-        at: string;
-        consecutive: number;
-    } | undefined;
-}>;
-//# sourceMappingURL=boot-core.d.ts.map

package/dist/boot-core.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot-core.d.ts","sourceRoot":"","sources":["../src/boot-core.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/D,OAAO,EAA8B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGvD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;;;;;;;IAgSlD,mFAAmF;;;;;;;GAGtF"}