@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/bundled-consortium-manifest.d.ts

@@ -1,47 +0,0 @@
-/**
- * FINDING-4 — the bundled consortium roster (sovereign-node REDUNDANCY invariant).
- *
- * This is the signed list of the sovereign directory nodes that make up the CELLO consortium,
- * COMPILED INTO the client. It is loaded by default (when the operator does not override it via
- * CELLO_CONSORTIUM_MANIFEST) so that a cold-boot daemon already knows every directory — and can
- * fail over to a reachable one — even when its configured/primary directory is unreachable. Without
- * a bundled roster the failover resolver has nothing to route to (the exact FINDING-4 gap: the
- * roster-aware dialer was correct but the roster was empty), so a single directory being down
- * stranded the client at startup, violating the redundancy invariant.
- *
- * Trust model:
- *   - The manifest is threshold-signed by the consortium officer key(s). At load the client
- *     RE-VERIFIES it against BUNDLED_CONSORTIUM_ROOT_KEYS (a self-consistency / anti-corruption
- *     gate — the manifest and root keys ship together, so this catches a bad regeneration, not a
- *     network adversary).
- *   - The node `pubkey`s are the directories' Ed25519 node keys. They are the trust anchor for
- *     step-6 directory identity auth (M7-MANIFEST-002): when the client connects to (or fails over
- *     to) a directory, the directory must sign the client's challenge with the matching node key,
- *     proving it is the real consortium node for that nodeId — defeating a MITM on the plaintext
- *     /bootstrap that would otherwise redirect the client to a rogue directory. THIS is the
- *     adversarial defense; it is enabled by default alongside the roster.
- *
- * nodeId MUST equal the directory's reported NODE_ID (`<cloud>-<region>`, e.g. `gcp-use1`); the step-6 verifier
- * looks the node up by nodeId. pubkey MUST equal the node's own Ed25519 signing key, which the
- * regeneration script below reads from GCP Secret Manager (`cello-<nodeId>-node-key`) rather than
- * being transcribed. endpoint is the HTTP /bootstrap base, and MUST be the node's ADDRESS — see
- * PRODUCTION_DIRECTORY_URL in directory-bootstrap.ts for why a hostname here disables step-6.
- *
- * Regeneration: on directory node-key or officer-key rotation, re-sign with
- * `infra/scripts/sign-gcp-consortium-manifest.mjs` (in the trustless-cello repo) and update this
- * constant + BUNDLED_CONSORTIUM_ROOT_KEYS. The officer signing key lives in GCP Secret Manager as
- * `cello-consortium-officer-key-0`; only its PUBLIC key is embedded here.
- *
- * Crypto reference: RFC 8032 (Ed25519 threshold signatures, verified by verifyManifest).
- */
-import type { ConsortiumManifestInput } from "@cello-protocol/crypto";
-/** The signed consortium manifest (roster of sovereign directory nodes). */
-export declare const BUNDLED_CONSORTIUM_MANIFEST: ConsortiumManifestInput;
-/**
- * Pinned consortium officer root public key(s). Officer 0's Ed25519 public key (hex). The client
- * verifies BUNDLED_CONSORTIUM_MANIFEST's threshold signatures against this set. Public data.
- */
-export declare const BUNDLED_CONSORTIUM_ROOT_KEYS: readonly string[];
-/** Minimum number of distinct valid officer signatures required (dev: single officer, threshold 1). */
-export declare const BUNDLED_CONSORTIUM_THRESHOLD = 1;
-//# sourceMappingURL=bundled-consortium-manifest.d.ts.map

package/dist/bundled-consortium-manifest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundled-consortium-manifest.d.ts","sourceRoot":"","sources":["../src/bundled-consortium-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,EAAE,uBAqEzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAEzD,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,4BAA4B,IAAI,CAAC"}

package/dist/bundled-consortium-manifest.js

@@ -1,116 +0,0 @@
-/**
- * FINDING-4 — the bundled consortium roster (sovereign-node REDUNDANCY invariant).
- *
- * This is the signed list of the sovereign directory nodes that make up the CELLO consortium,
- * COMPILED INTO the client. It is loaded by default (when the operator does not override it via
- * CELLO_CONSORTIUM_MANIFEST) so that a cold-boot daemon already knows every directory — and can
- * fail over to a reachable one — even when its configured/primary directory is unreachable. Without
- * a bundled roster the failover resolver has nothing to route to (the exact FINDING-4 gap: the
- * roster-aware dialer was correct but the roster was empty), so a single directory being down
- * stranded the client at startup, violating the redundancy invariant.
- *
- * Trust model:
- *   - The manifest is threshold-signed by the consortium officer key(s). At load the client
- *     RE-VERIFIES it against BUNDLED_CONSORTIUM_ROOT_KEYS (a self-consistency / anti-corruption
- *     gate — the manifest and root keys ship together, so this catches a bad regeneration, not a
- *     network adversary).
- *   - The node `pubkey`s are the directories' Ed25519 node keys. They are the trust anchor for
- *     step-6 directory identity auth (M7-MANIFEST-002): when the client connects to (or fails over
- *     to) a directory, the directory must sign the client's challenge with the matching node key,
- *     proving it is the real consortium node for that nodeId — defeating a MITM on the plaintext
- *     /bootstrap that would otherwise redirect the client to a rogue directory. THIS is the
- *     adversarial defense; it is enabled by default alongside the roster.
- *
- * nodeId MUST equal the directory's reported NODE_ID (`<cloud>-<region>`, e.g. `gcp-use1`); the step-6 verifier
- * looks the node up by nodeId. pubkey MUST equal the node's own Ed25519 signing key, which the
- * regeneration script below reads from GCP Secret Manager (`cello-<nodeId>-node-key`) rather than
- * being transcribed. endpoint is the HTTP /bootstrap base, and MUST be the node's ADDRESS — see
- * PRODUCTION_DIRECTORY_URL in directory-bootstrap.ts for why a hostname here disables step-6.
- *
- * Regeneration: on directory node-key or officer-key rotation, re-sign with
- * `infra/scripts/sign-gcp-consortium-manifest.mjs` (in the trustless-cello repo) and update this
- * constant + BUNDLED_CONSORTIUM_ROOT_KEYS. The officer signing key lives in GCP Secret Manager as
- * `cello-consortium-officer-key-0`; only its PUBLIC key is embedded here.
- *
- * Crypto reference: RFC 8032 (Ed25519 threshold signatures, verified by verifyManifest).
- */
-/** The signed consortium manifest (roster of sovereign directory nodes). */
-export const BUNDLED_CONSORTIUM_MANIFEST = {
-    // ── v3, the TLS cutover (2026-09-10) ────────────────────────────────────────────────────────
-    // Every endpoint moved from `http://<raw ip>:9090` to `https://directory-<region>.cello.mygentic.ai`,
-    // terminated by that region's own load balancer, and every multiaddr from `/ip4/…/tcp/8080/ws` to
-    // `/dns4/…/tcp/443/tls/ws`. Proven against the running fleet before shipping: a real libp2p node
-    // dialled all three balancers over WSS and got Noise + yamux with the expected peer id.
-    //
-    // 🔴 THIS ROSTER AND THE ONE THE NODES SERVE MUST CARRY THE SAME ENDPOINTS. The daemon builds its
-    // directory-identity challenge verifier ONLY when the resolved directory URL matches one of the
-    // endpoints BELOW. If the fleet serves a name this file does not list, step 6 does not fail — it
-    // is skipped, silently, on every connect and reconnect, and step 6 is what turns a /bootstrap
-    // MITM into a refused connection rather than a successful impersonation.
-    //
-    // `version` is a MONOTONICITY GATE, not a schema number: the daemon persists the highest version
-    // it has seen and rejects anything lower as a rollback. So a daemon carrying this v3 will refuse
-    // a fleet still serving v2 — which is why the two move together, and why this must only ever
-    // increase.
-    //
-    // Generated by trustless-cello/infra/scripts/sign-gcp-consortium-manifest.mjs. Do NOT hand-edit
-    // a field: the signature covers every one of them and an edited copy verifies against nothing.
-    version: 3,
-    not_before: "2026-01-01T00:00:00Z",
-    expires: "2030-01-01T00:00:00Z",
-    nodes: [
-        {
-            nodeId: "gcp-use1",
-            pubkey: "7969e22a7d95293ae343cb2667c2a4d7127aa8748478582fa637674c30e0113c",
-            region: "use1",
-            provider: "gcp",
-            endpoint: "https://directory-use1.cello.mygentic.ai",
-            peerId: "12D3KooWMH58hm8xpuwgwaNSvnvXBuc126jfuUMVbrGNcU2MeEAX",
-            multiaddr: "/dns4/directory-use1.cello.mygentic.ai/tcp/443/tls/ws",
-            role: "validator",
-        },
-        {
-            nodeId: "gcp-usc1",
-            pubkey: "ef961384100bb087f36b68e3a270acb8f22fdf62c4cd5e517e423afb7f399002",
-            region: "usc1",
-            provider: "gcp",
-            endpoint: "https://directory-usc1.cello.mygentic.ai",
-            peerId: "12D3KooWExQLMbvaioVqQCPkc1ZZgJ5kdoePymtMrg46ugMBs5zi",
-            multiaddr: "/dns4/directory-usc1.cello.mygentic.ai/tcp/443/tls/ws",
-            role: "validator",
-        },
-        {
-            nodeId: "gcp-euw1",
-            pubkey: "9cb77b68a98f49056fef232f4d56eeb9b66b1a6646fe06b966ff570a82ca6c14",
-            region: "euw1",
-            provider: "gcp",
-            endpoint: "https://directory-euw1.cello.mygentic.ai",
-            peerId: "12D3KooWP52VSVrakyRdPyt23kAuhgp3FV6tiVRByfdyVvHAaEeJ",
-            multiaddr: "/dns4/directory-euw1.cello.mygentic.ai/tcp/443/tls/ws",
-            role: "validator",
-        },
-    ],
-    // M10B / DOD-END-INGRESS-1 — the PORTAL INTAKE KEY. A submitting daemon seals its trust-signal
-    // submission to this key so the DIRECTORY cannot read it; without it `cello_attestations_issue`
-    // refuses with `intake_key_absent` rather than sending in the clear. It has to be in the BUNDLED
-    // manifest and not only in the served one, because a cold-boot daemon that cannot yet reach a
-    // directory falls back to this constant — and "your first submission fails until you have polled"
-    // is indistinguishable from the feature being broken.
-    intake_key: { key_id: "intake-dev-1", pubkey: "87da56bf2ca5ef75d62d88dfed1f667f9fa565ee0a5306aeeef50f5d7053b3d1" },
-    signatures: [
-        {
-            officerIndex: 0,
-            signature: "537de3ac39d6a5f261d576c8938e788b46d587b282be5e0166c5d7fad6dac55efed003277c5625d1b5930c328d0eb41044e8e7de7ea31a1021b22e7133317f09",
-        },
-    ],
-};
-/**
- * Pinned consortium officer root public key(s). Officer 0's Ed25519 public key (hex). The client
- * verifies BUNDLED_CONSORTIUM_MANIFEST's threshold signatures against this set. Public data.
- */
-export const BUNDLED_CONSORTIUM_ROOT_KEYS = [
-    "e8300a2b9de7be6f6d629f778dc319715ad0010c0639f3a1564181d56d3eb104",
-];
-/** Minimum number of distinct valid officer signatures required (dev: single officer, threshold 1). */
-export const BUNDLED_CONSORTIUM_THRESHOLD = 1;
-//# sourceMappingURL=bundled-consortium-manifest.js.map

package/dist/bundled-consortium-manifest.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bundled-consortium-manifest.js","sourceRoot":"","sources":["../src/bundled-consortium-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAA4B;IAClE,+FAA+F;IAC/F,sGAAsG;IACtG,kGAAkG;IAClG,iGAAiG;IACjG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,yEAAyE;IACzE,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,6FAA6F;IAC7F,YAAY;IACZ,EAAE;IACF,gGAAgG;IAChG,+FAA+F;IAC/F,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE,sBAAsB;IAC/B,KAAK,EAAE;QACL;YACE,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,0CAA0C;YACpD,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,uDAAuD;YAClE,IAAI,EAAE,WAAW;SAClB;QACD;YACE,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,0CAA0C;YACpD,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,uDAAuD;YAClE,IAAI,EAAE,WAAW;SAClB;QACD;YACE,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,0CAA0C;YACpD,MAAM,EAAE,sDAAsD;YAC9D,SAAS,EAAE,uDAAuD;YAClE,IAAI,EAAE,WAAW;SAClB;KACF;IACD,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,sDAAsD;IACtD,UAAU,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kEAAkE,EAAE;IAClH,UAAU,EAAE;QACV;YACE,YAAY,EAAE,CAAC;YACf,SAAS,EACP,kIAAkI;SACrI;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,kEAAkE;CACnE,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC"}

package/dist/cbor-blob-migration.d.ts

@@ -1,8 +0,0 @@
-import type { DaemonDatabase } from "./sqlcipher-db.js";
-import type { Logger } from "./types.js";
-/**
- * Rewrite any non-canonically-encoded FROST blob in `agents` to the canonical encoding.
- * Idempotent. Safe to run on every daemon start.
- */
-export declare function migrateCborBlobsToCanonical(db: DaemonDatabase, logger: Logger): void;
-//# sourceMappingURL=cbor-blob-migration.d.ts.map

package/dist/cbor-blob-migration.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cbor-blob-migration.d.ts","sourceRoot":"","sources":["../src/cbor-blob-migration.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAwCzC;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA+DpF"}

package/dist/cbor-blob-migration.js

@@ -1,116 +0,0 @@
-/**
- * Normalize the persisted FROST blobs to the canonical CBOR encoding.
- *
- * `frost_commitments` and `frost_verifying_shares` may hold an older encoding (cbor-x tag-64 or its
- * record extension) alongside the canonical one; cbor-x decodes all three, which is why a mixed
- * column reads correctly and can go unnoticed. This makes the column hold ONE encoding, so a reader
- * that is not cbor-x can parse it.
- *
- * Decode, re-encode canonically, rewrite only if the bytes differ. Self-checking and idempotent: a
- * canonical blob re-encodes to itself and is skipped, so there is no "have I run yet?" flag to get
- * wrong and a second run is a no-op.
- *
- * FAILS SAFE, PER ROW. These blobs are FROST key material. A row that cannot be decoded is LEFT
- * EXACTLY AS IT WAS and reported — never dropped, never half-written, never guessed at. Destroying a
- * share makes the agent permanently unable to sign or seal, which is strictly worse than leaving it
- * in an old encoding that still decodes. Nobody may lose a key to this migration.
- */
-import { encodeCbor, decodeCbor } from "@cello-protocol/protocol-types";
-import { extractErrorMessage } from "./error-message.js";
-/** The columns written by both producers. Both hold CBOR; both must hold the canonical encoding. */
-const CBOR_BLOB_COLUMNS = ["frost_commitments", "frost_verifying_shares"];
-function toBytes(v) {
-    if (v instanceof Uint8Array)
-        return v;
-    if (Buffer.isBuffer(v))
-        return new Uint8Array(v);
-    return null;
-}
-/**
- * Do two decoded CBOR values carry the same DATA?
- *
- * Compares byte CONTENT, never container class. cbor-x decodes a byte string to a Node Buffer and a
- * tag-64 to a Uint8Array — identical bytes, different wrapper. A class-sensitive compare
- * (`JSON.stringify`, `toEqual`) calls those unequal and refuses every genuine migration.
- */
-function sameDecodedValue(a, b) {
-    const ab = toBytes(a);
-    const bb = toBytes(b);
-    if (ab || bb) {
-        return ab !== null && bb !== null && Buffer.from(ab).equals(Buffer.from(bb));
-    }
-    if (Array.isArray(a) || Array.isArray(b)) {
-        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
-            return false;
-        return a.every((v, i) => sameDecodedValue(v, b[i]));
-    }
-    if (a && b && typeof a === "object" && typeof b === "object") {
-        const ao = a;
-        const bo = b;
-        const ak = Object.keys(ao).sort();
-        const bk = Object.keys(bo).sort();
-        if (ak.length !== bk.length || ak.some((k, i) => k !== bk[i]))
-            return false;
-        return ak.every((k) => sameDecodedValue(ao[k], bo[k]));
-    }
-    return Object.is(a, b);
-}
-/**
- * Rewrite any non-canonically-encoded FROST blob in `agents` to the canonical encoding.
- * Idempotent. Safe to run on every daemon start.
- */
-export function migrateCborBlobsToCanonical(db, logger) {
-    // The table may predate these columns (fresh DB, or an install that never registered).
-    const columns = new Set(db.prepare("PRAGMA table_info(agents)").all().map((c) => c.name));
-    const present = CBOR_BLOB_COLUMNS.filter((c) => columns.has(c));
-    if (present.length === 0)
-        return;
-    const rows = db
-        .prepare(`SELECT agent_id, ${present.join(", ")} FROM agents`)
-        .all();
-    let rewritten = 0;
-    let skipped = 0;
-    for (const row of rows) {
-        const agentId = String(row["agent_id"]);
-        for (const column of present) {
-            const stored = toBytes(row[column]);
-            if (!stored || stored.length === 0)
-                continue; // never registered / no share — nothing to do
-            let canonical;
-            try {
-                canonical = encodeCbor(decodeCbor(stored));
-            }
-            catch (err) {
-                // Undecodable key material — leave it alone.
-                skipped++;
-                logger.warn("daemon.cbor.migration.undecodable", {
-                    agentId,
-                    column,
-                    bytes: stored.length,
-                    error: extractErrorMessage(err),
-                });
-                continue;
-            }
-            if (Buffer.from(canonical).equals(Buffer.from(stored)))
-                continue; // already canonical
-            // Verify BEFORE writing: re-encoding must preserve the VALUE, not merely produce bytes. If it
-            // ever altered the decoded content, refuse rather than persist a corrupted share.
-            if (!sameDecodedValue(decodeCbor(canonical), decodeCbor(stored))) {
-                skipped++;
-                logger.error("daemon.cbor.migration.value_changed", {
-                    agentId,
-                    column,
-                    guidance: "re-encoding altered the decoded value; the blob was NOT rewritten",
-                });
-                continue;
-            }
-            db.prepare(`UPDATE agents SET ${column} = ? WHERE agent_id = ?`).run(Buffer.from(canonical), agentId);
-            rewritten++;
-            logger.info("daemon.cbor.migration.rewritten", { agentId, column, bytes: canonical.length });
-        }
-    }
-    if (rewritten > 0 || skipped > 0) {
-        logger.info("daemon.cbor.migration.complete", { rewritten, skipped, rows: rows.length });
-    }
-}
-//# sourceMappingURL=cbor-blob-migration.js.map

package/dist/cbor-blob-migration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cbor-blob-migration.js","sourceRoot":"","sources":["../src/cbor-blob-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,oGAAoG;AACpG,MAAM,iBAAiB,GAAG,CAAC,mBAAmB,EAAE,wBAAwB,CAAU,CAAC;AAEnF,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,CAAU,EAAE,CAAU;IAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,EAAE,GAAG,CAA4B,CAAC;QACxC,MAAM,EAAE,GAAG,CAA4B,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAAkB,EAAE,MAAc;IAC5E,uFAAuF;IACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC9F,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;SAC7D,GAAG,EAAoC,CAAC;IAE3C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAExC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,8CAA8C;YAE5F,IAAI,SAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,6CAA6C;gBAC7C,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBAC/C,OAAO;oBACP,MAAM;oBACN,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS,CAAC,oBAAoB;YAEtF,8FAA8F;YAC9F,kFAAkF;YAClF,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;oBAClD,OAAO;oBACP,MAAM;oBACN,QAAQ,EAAE,mEAAmE;iBAC9E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,EAAE,CAAC,OAAO,CAAC,qBAAqB,MAAM,yBAAyB,CAAC,CAAC,GAAG,CAClE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,OAAO,CACR,CAAC;YACF,SAAS,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC"}

package/dist/challenge-verifier.d.ts

@@ -1,12 +0,0 @@
-/**
- * M7-MANIFEST-002 — Challenge verifier re-exports.
- *
- * The production verifier (ManifestDirectoryChallengeVerifier) and test stub
- * (TestDirectoryChallengeVerifier) are both defined in @cello-protocol/transport
- * to avoid creating a circular dependency between daemon and transport.
- *
- * This module re-exports them for consumers that import from the daemon package.
- */
-export { ManifestDirectoryChallengeVerifier, TestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
-export type { IDirectoryChallengeVerifier } from "@cello-protocol/transport";
-//# sourceMappingURL=challenge-verifier.d.ts.map

package/dist/challenge-verifier.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"challenge-verifier.d.ts","sourceRoot":"","sources":["../src/challenge-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/challenge-verifier.js

@@ -1,11 +0,0 @@
-/**
- * M7-MANIFEST-002 — Challenge verifier re-exports.
- *
- * The production verifier (ManifestDirectoryChallengeVerifier) and test stub
- * (TestDirectoryChallengeVerifier) are both defined in @cello-protocol/transport
- * to avoid creating a circular dependency between daemon and transport.
- *
- * This module re-exports them for consumers that import from the daemon package.
- */
-export { ManifestDirectoryChallengeVerifier, TestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
-//# sourceMappingURL=challenge-verifier.js.map

package/dist/challenge-verifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"challenge-verifier.js","sourceRoot":"","sources":["../src/challenge-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC"}

package/dist/close-commitment.d.ts

@@ -1,67 +0,0 @@
-/**
- * DOD-M15-CLOSEWAIT-1 — the answer a close gives at COMMITMENT, before notarization.
- *
- * ─── What this replaces ────────────────────────────────────────────────────────────────────────
- *
- * `cello_close_session` used to block until the seal ceremony finished. Measured 2026-08-17: leaf
- * submitted 16:48:55, ceremony completed 17:00:01 — **11 minutes 6 seconds of a frozen command.**
- *
- * It was working the whole time: the SEAL leaf was submitted, and it was waiting for the
- * counterparty to close too, escalating to a unilateral seal if they never did. But an operator
- * watching a dead terminal concluded it was broken and force-abandoned **seventeen sessions** —
- * which forfeits the exact receipt the wait was earning. A UX failure that destroys the artifact is
- * worse than the wait it was protecting.
- *
- * ─── The contract (Decisions Carried #4, decided before this code) ─────────────────────────────
- *
- * ANSWER ON COMMITMENT, NOT ON NOTARIZATION. Nothing about what is signed, by whom, or in what
- * order changes; only the response stops waiting for it.
- *
- * ─── Crash safety, CORRECTED after review ──────────────────────────────────────────────────────
- *
- * I wrote that a daemon dying mid-wait is covered because `RestartSealResolver` resolves
- * `seal_interrupted_pending`. **The conclusion holds; that mechanism is not the one.** During the
- * background wait the row is still `status = 'active'` — nothing writes `seal_interrupted_pending`
- * on this path.
- *
- * What actually covers it: the boot sweep flips `active → interrupted, interrupted_by = 'local'`,
- * which is branch (1) of `listRestartOrphanedSessions`, and the resolver seals it from there. Two
- * preconditions ride along and are worth knowing: `message_count > 0` (a never-messaged session is
- * a dead handshake and is deliberately not sealed) and `restart_seal_gave_up_at IS NULL` (a session
- * already exhausted is not retried forever).
- *
- * ─── The counterbalance this file exists to hold ───────────────────────────────────────────────
- *
- * The danger in answering early is the opposite of the one it fixes: an operator who believes a
- * COMMITTED session is a SEALED one is worse off than one who is merely kept waiting, because they
- * will never fetch the receipt. So this response:
- *
- *   - carries NO `sealed_root` and NO `sealed` field — there is nothing notarized yet to name;
- *   - says `seal_status: "committed"`, a word that is not "closed" and not "sealed";
- *   - names `cello_sealed_receipt` — the TOOL, not the internal IPC method `cello_get_sealed_receipt`.
- *     The vocabulary audit caught that slip here: naming the wrong one hands the operator a dead
- *     command. Without the verb at all, "committed" is a status an agent can do nothing with;
- *   - says the receipt is NOT YET available, so an agent polling immediately does not read an empty
- *     answer as failure;
- *   - warns what `force` costs, because that is the move the 11-minute freeze actually provoked.
- *
- * ONE definition, exported, used at every call site — a second copy is how two surfaces come to
- * disagree after one of them is reworded.
- */
-/** The guidance string for a committed-not-yet-notarized close. */
-export declare function CLOSE_COMMITTED_GUIDANCE(opts: {
-    sessionId: string;
-    deadlineMs: number;
-}): string;
-/**
- * The full response body for a close that has committed but not yet notarized.
- *
- * Deliberately NOT `{ ok: true, sealed_root }`-shaped. `ok: true` is correct — the operation the
- * caller asked for succeeded, their commitment is durable — but every field that would imply a
- * finished seal is absent by construction rather than by remembering to omit it.
- */
-export declare function describeSealCommitted(opts: {
-    sessionId: string;
-    deadlineMs: number;
-}): Record<string, unknown>;
-//# sourceMappingURL=close-commitment.d.ts.map

package/dist/close-commitment.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"close-commitment.d.ts","sourceRoot":"","sources":["../src/close-commitment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,mEAAmE;AACnE,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAYhG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO1B"}

package/dist/close-commitment.js

@@ -1,78 +0,0 @@
-/**
- * DOD-M15-CLOSEWAIT-1 — the answer a close gives at COMMITMENT, before notarization.
- *
- * ─── What this replaces ────────────────────────────────────────────────────────────────────────
- *
- * `cello_close_session` used to block until the seal ceremony finished. Measured 2026-08-17: leaf
- * submitted 16:48:55, ceremony completed 17:00:01 — **11 minutes 6 seconds of a frozen command.**
- *
- * It was working the whole time: the SEAL leaf was submitted, and it was waiting for the
- * counterparty to close too, escalating to a unilateral seal if they never did. But an operator
- * watching a dead terminal concluded it was broken and force-abandoned **seventeen sessions** —
- * which forfeits the exact receipt the wait was earning. A UX failure that destroys the artifact is
- * worse than the wait it was protecting.
- *
- * ─── The contract (Decisions Carried #4, decided before this code) ─────────────────────────────
- *
- * ANSWER ON COMMITMENT, NOT ON NOTARIZATION. Nothing about what is signed, by whom, or in what
- * order changes; only the response stops waiting for it.
- *
- * ─── Crash safety, CORRECTED after review ──────────────────────────────────────────────────────
- *
- * I wrote that a daemon dying mid-wait is covered because `RestartSealResolver` resolves
- * `seal_interrupted_pending`. **The conclusion holds; that mechanism is not the one.** During the
- * background wait the row is still `status = 'active'` — nothing writes `seal_interrupted_pending`
- * on this path.
- *
- * What actually covers it: the boot sweep flips `active → interrupted, interrupted_by = 'local'`,
- * which is branch (1) of `listRestartOrphanedSessions`, and the resolver seals it from there. Two
- * preconditions ride along and are worth knowing: `message_count > 0` (a never-messaged session is
- * a dead handshake and is deliberately not sealed) and `restart_seal_gave_up_at IS NULL` (a session
- * already exhausted is not retried forever).
- *
- * ─── The counterbalance this file exists to hold ───────────────────────────────────────────────
- *
- * The danger in answering early is the opposite of the one it fixes: an operator who believes a
- * COMMITTED session is a SEALED one is worse off than one who is merely kept waiting, because they
- * will never fetch the receipt. So this response:
- *
- *   - carries NO `sealed_root` and NO `sealed` field — there is nothing notarized yet to name;
- *   - says `seal_status: "committed"`, a word that is not "closed" and not "sealed";
- *   - names `cello_sealed_receipt` — the TOOL, not the internal IPC method `cello_get_sealed_receipt`.
- *     The vocabulary audit caught that slip here: naming the wrong one hands the operator a dead
- *     command. Without the verb at all, "committed" is a status an agent can do nothing with;
- *   - says the receipt is NOT YET available, so an agent polling immediately does not read an empty
- *     answer as failure;
- *   - warns what `force` costs, because that is the move the 11-minute freeze actually provoked.
- *
- * ONE definition, exported, used at every call site — a second copy is how two surfaces come to
- * disagree after one of them is reworded.
- */
-/** The guidance string for a committed-not-yet-notarized close. */
-export function CLOSE_COMMITTED_GUIDANCE(opts) {
-    const minutes = Math.max(1, Math.round(opts.deadlineMs / 60_000));
-    return (`Your SEAL commitment for session ${opts.sessionId} is recorded and the notarization is now ` +
-        `running in the background. The receipt is NOT YET available: the seal completes as soon as the ` +
-        `counterparty also closes, and if they never do it escalates to a unilateral seal after about ` +
-        `${minutes} minutes. Fetch it with cello_sealed_receipt (session_id ${opts.sessionId}) — an ` +
-        `empty answer before then means "still running", not "failed". Do NOT re-close with force:true ` +
-        `to hurry it: forcing ABANDONS the session and forfeits the receipt this is earning, which is ` +
-        `exactly how seventeen sessions were lost when this call used to block. If the daemon restarts ` +
-        `before the seal finishes, it resumes the notarization on its next start.`);
-}
-/**
- * The full response body for a close that has committed but not yet notarized.
- *
- * Deliberately NOT `{ ok: true, sealed_root }`-shaped. `ok: true` is correct — the operation the
- * caller asked for succeeded, their commitment is durable — but every field that would imply a
- * finished seal is absent by construction rather than by remembering to omit it.
- */
-export function describeSealCommitted(opts) {
-    return {
-        ok: true,
-        session_id: opts.sessionId,
-        seal_status: "committed",
-        guidance: CLOSE_COMMITTED_GUIDANCE(opts),
-    };
-}
-//# sourceMappingURL=close-commitment.js.map

package/dist/close-commitment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"close-commitment.js","sourceRoot":"","sources":["../src/close-commitment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,mEAAmE;AACnE,MAAM,UAAU,wBAAwB,CAAC,IAA+C;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;IAClE,OAAO,CACL,oCAAoC,IAAI,CAAC,SAAS,2CAA2C;QAC7F,iGAAiG;QACjG,+FAA+F;QAC/F,GAAG,OAAO,4DAA4D,IAAI,CAAC,SAAS,SAAS;QAC7F,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,0EAA0E,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAGrC;IACC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,wBAAwB,CAAC,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/close-session-handler.d.ts

@@ -1,94 +0,0 @@
-import { SignalingManager } from "@cello-protocol/transport";
-import type { KeyProvider } from "@cello-protocol/crypto";
-import type { IpcHandler } from "./ipc-server.js";
-import type { SessionNodeManager } from "./session-node-manager.js";
-import { type DiscoveryOutcome } from "./cross-node-negotiation.js";
-import type { Logger, SessionRecord } from "./types.js";
-import type { ConnState } from "./contact-handlers.js";
-import type { SealFlowResult, ActiveSealResult } from "./seal-flows.js";
-import type { SealCompletion, UnilateralResult } from "./seal-coordinator.js";
-import type { DirectoryEndpoint } from "./signaling-connect.js";
-import type { ConsortiumEndpoint } from "./directory-bootstrap.js";
-export interface CloseSessionDeps {
-    handlers: Map<string, IpcHandler>;
-    logger: Logger;
-    sessionNodeManager: SessionNodeManager;
-    /** M12-P14: drain this agent's parked mailbox before judging seal readiness (contentPark.autoRecoverForAgent). */
-    recoverParkedContent?: (agentName: string, trigger: string) => Promise<void>;
-    getConnState: (connectionId: string) => ConnState | undefined;
-    resolveCurrentAgent: (connState: ConnState | undefined, explicitAgent?: string) => string | null;
-    NO_CURRENT_AGENT_RESPONSE: unknown;
-    getKeyProvider: (agentName: string) => KeyProvider | undefined;
-    signalingFor: (agentName: string) => SignalingManager | undefined;
-    sendOver: (agentName: string, frame: Record<string, unknown>) => Promise<{
-        ok: boolean;
-        reason?: string;
-    }>;
-    waitForSignalingConnected: (mgr: SignalingManager, timeoutMs: number) => Promise<boolean>;
-    openVisitingConnection: (agentName: string, agentKeyProvider: KeyProvider, agentPubkeyHex: string, endpoint: DirectoryEndpoint, correlationId: string, nodeId: string) => {
-        mgr: SignalingManager;
-        stop: (reason: string) => Promise<void>;
-    };
-    /**
-     * ASK the directory for a seal certificate this daemon was never pushed
-     * (`DOD-TERMINAL-STATE-DIVERGENCE-1`).
-     *
-     * The `session_sealed` frame is pushed ONCE. If this daemon's stream was down at that instant it
-     * is gone — the re-delivery queue is per-node and clients roam. The session IS notarized and the
-     * counterparty holds a receipt; this side holds a non-terminal row and, without asking, can never
-     * produce one.
-     *
-     * Wired here because THIS is where the operator gets stuck: they run a close, it fails, and the
-     * failure is indistinguishable from "the seal has not happened". Asking turns that into "it
-     * happened, here is your receipt". The directory is not trusted for the answer — the certificate
-     * is re-verified against its FROST signature before anything is recorded.
-     */
-    pullSealCertificate?: (agentName: string, sessionIdHex: string) => Promise<{
-        ok: boolean;
-        reason?: string;
-    }>;
-    /**
-     * Ask the directory where an agent is homed RIGHT NOW. Needed because `crossNodeBrokerBySession`
-     * is in-memory and a restart empties it — and a restart is what makes a session interrupted.
-     */
-    runDiscoveryLookup?: (signaling: SignalingManager, targetHex: string, timeoutMs: number, correlationId: string) => Promise<DiscoveryOutcome>;
-    /** sessionId → the broker node id that brokered this cross-node session. */
-    crossNodeBrokerBySession: Map<string, string>;
-    /**
-     * DOD-M15-CLOSEWAIT-1 review MEDIUM-6: hand a detached seal tail to the daemon so `stop()` can
-     * drain it. Optional so an embedder or a test harness constructs without one — but when it is
-     * absent the tail is genuinely untracked, which is why the daemon always passes it.
-     */
-    registerBackgroundSeal?: (p: Promise<unknown>) => void;
-    /**
-     * DOD-M15-SEAL-FAILED-TERMINAL-1: record/clear the last background ceremony failure, so
-     * `cello_sealed_receipt` can tell a DEAD seal from a slow one.
-     *
-     * REQUIRED, not optional — review HIGH-3. Optionality made a missing wiring silent: deleting the
-     * daemon's `getSealFailure` line left tests, lint and typecheck all green while the whole unit was
-     * inert. There is exactly one composition root, so optionality buys nothing and costs the compiler
-     * the ability to catch a wiring that was never done. (`RestartSealResolverDeps.markGaveUp` makes
-     * the same argument in its own docstring.)
-     */
-    sealFailures: {
-        record: (a: string, s: string, reason: string, at: string, kind: "unresolved" | "threw") => void;
-        clear: (a: string, s: string) => void;
-    };
-    sealKey: (agentName: string, sessionId: string) => string;
-    sealInterruptedInProgress: Set<string>;
-    pendingSealWaiters: Map<string, (completion: SealCompletion) => void>;
-    pendingUnilateralWaiters: Map<string, (r: UnilateralResult) => void>;
-    /** The verified consortium roster, re-resolved at ceremony time. */
-    resolveConsortiumRoster: () => Promise<ConsortiumEndpoint[] | null>;
-    /**
-     * DOD-M12B-INTERRUPTED-ESCALATE-1: how long to wait for the directory's answer to a
-     * `seal_unilateral` request. Default 30_000. Injectable because this wait now sits on the
-     * INTERRUPTED close path too, and a suite that exercises it should not spend half a minute per
-     * case discovering that a stub never answers.
-     */
-    unilateralTimeoutMs?: number;
-    handleSealInterruptedFlow: (sessionId: string, record: SessionRecord, correlationId: string, merkleRootAtInterruption: string, via?: SignalingManager) => Promise<SealFlowResult>;
-    handleActiveSealFlow: (sessionId: string, record: SessionRecord, correlationId: string) => Promise<ActiveSealResult>;
-}
-export declare function registerCloseSessionHandler(deps: CloseSessionDeps): void;
-//# sourceMappingURL=close-session-handler.d.ts.map

package/dist/close-session-handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"close-session-handler.d.ts","sourceRoot":"","sources":["../src/close-session-handler.ts"],"names":[],"mappings":"AA+DA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,kHAAkH;IAClH,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,yBAAyB,EAAE,OAAO,CAAC;IACnC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAC/D,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,GAAG,SAAS,CAAC;IAClE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3G,yBAAyB,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,sBAAsB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK;QAAE,GAAG,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAC7O;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7G;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CACnB,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,KAClB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,wBAAwB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACvD;;;;;;;;;OASG;IACH,YAAY,EAAE;QACZ,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,KAAK,IAAI,CAAC;QACjG,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;KACvC,CAAC;IAEF,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,IAAI,CAAC,CAAC;IACtE,wBAAwB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC,CAAC;IACrE,oEAAoE;IACpE,uBAAuB,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,yBAAyB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClL,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACtH;AAGD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CA64CxE"}