@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/session-views.js

@@ -1,278 +0,0 @@
-import { countAttendance } from "./co-attendance.js";
-import { renderFrontierMismatch } from "./frontier-mismatch.js";
-import { resolveAgentState } from "./agent-state.js";
-import { extractErrorMessage } from "./error-message.js";
-export function createSessionViews(deps) {
-    const { logger, sessionNodeManager, perConnectionState, onlineAgents, explicitlyOfflineAgents, perAgentSignaling, sharedSignaling, frontierMismatches, sealKey, sealInterruptedInProgress, pendingSealWaiters, } = deps;
-    // M7-SESSION-001 AC-006/AC-007 (and M-1 PULL): build the interrupted_sessions
-    // array from SQLite. Shared by both getStatus() (daemon-wide) and the
-    // cello_status MCP handler (per-connection) so live MCP clients see the same
-    // interrupted sessions a CLI `cello status` would.
-    // `cello status` is a health snapshot, not a session archive. It surfaces ONLY genuinely
-    // RESUMABLE sessions (interrupted with messages exchanged) — never failed inits (interrupted,
-    // 0 messages — a dead handshake), which classify as "failed" and would otherwise accumulate
-    // unbounded and confuse. The list is also capped; the full, queryable history is `cello sessions`
-    // / cello_list_sessions (with filter + limit flags).
-    const STATUS_RESUMABLE_CAP = 10;
-    /**
-     * DOD-M12B-SEAL-STUCK-1 — ask the seal gate for ONE session, and never let the answer take the
-     * status response with it.
-     *
-     * This runs per session on every `cello status` and every `cello_status`, and it touches the
-     * database. An unguarded throw here rejects the whole response, after which the CLI finds the
-     * singleton lock still held and prints `daemon: "broken_shutdown"` — telling the operator their
-     * healthy daemon has failed to stop, over one session row it could not read. There is a
-     * documented precedent in this codebase for exactly that shape.
-     *
-     * A failure yields `unknown`, never `ready`: "we could not check" must not read as "safe to
-     * close", because a close on a short chain is terminal.
-     */
-    function probeSealReadiness(agentName, sessionId) {
-        try {
-            return sessionNodeManager.sealReadinessView(agentName, sessionId);
-        }
-        catch (err) {
-            const message = extractErrorMessage(err);
-            logger.warn("session.seal.readiness.probe.failed", { agentName, sessionId, error: message });
-            return { state: "unknown", reason: `probe_failed: ${message}` };
-        }
-    }
-    function buildInterruptedSessions() {
-        return sessionNodeManager
-            .getSessionsByStatus("interrupted")
-            .filter((row) => (row.message_count ?? 0) > 0) // resumable only — drop failed 0-message inits
-            .slice(0, STATUS_RESUMABLE_CAP)
-            .map((row) => ({
-            sessionId: row.session_id,
-            agentName: row.agent_name,
-            counterpartyPubkey: row.counterparty_pubkey,
-            messageCount: row.message_count ?? 0,
-            interruptedAt: row.interrupted_at ?? new Date(row.updated_at).toISOString(),
-            // DOD-SESSION-NAME-1 (AC-A11): an interrupted session is one you may want to resume or seal
-            // — the name is how you tell which one it was.
-            sessionName: row.session_name ?? null,
-            // DOD-M12B-SEAL-STUCK-1: the same answer the active list carries, for the same reason —
-            // an interrupted session can seal, so it can also be blocked from sealing by a gap, and
-            // that is knowable here instead of only after a failed close. A plain property, never a
-            // spread: a spread bypasses excess-property checking, which is how `frontierMismatch`
-            // below came to typecheck while no renderer could read it.
-            sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
-            // DOD-FRONTIER-STRAND-1 AC3: if a seal exchange has already proved the two sides disagree on
-            // how many messages this session holds, SAY SO HERE. Otherwise a stranded session is listed
-            // exactly like a healthy paused one, and the only way to learn it can never seal is to
-            // attempt another close and read the error — which is how dbb93dfc… sat unnoticed a week.
-            ...(() => {
-                const m = frontierMismatches.get(row.agent_name, row.session_id);
-                return m ? { frontierMismatch: renderFrontierMismatch(m, row.session_id) } : {};
-            })(),
-        }));
-    }
-    // CC-5/F21: reap dead half-open sessions on READ (compute-on-read, like reapExpiredInboundSessions —
-    // no background timer). A session the standing receiver opened from an inbound offer the initiator
-    // ABANDONED stays "active" forever (the counterparty never joins), clutters the open/active lists, and
-    // its normal close fires an unsealable bilateral seal. Mark such a session terminal ("abandoned") once
-    // it is PROVABLY dead: counterparty never established (liveness != "alive" AND 0 RECEIVED messages —
-    // message_count alone counts our own auto-"Dispatched." ack, so it is NOT the signal) + age past the
-    // grace TTL (a genuinely fresh session still setting up must survive).
-    // CC-10 (live 2026-07-08 Phase-2 block): scan 'interrupted' too, not just 'active'. A daemon restart
-    // flips dead half-opens to 'interrupted'; those classify as "failed" (invisible in every list) yet
-    // still count toward the unknown-sender acceptance bound (D18 deliberately counts 'interrupted') — so
-    // a stranger whose first handshakes died was silently locked out FOREVER. Reaping only 0-RECEIVED
-    // ghosts keeps D18 intact: the disconnect-evasion attacker's sessions always carry received content.
-    const HALF_OPEN_TTL_MS = Number(process.env["CELLO_HALF_OPEN_TTL_MS"]) || 5 * 60 * 1000;
-    function reapDeadHalfOpenSessions(agentName) {
-        const now = Date.now();
-        const candidates = [...sessionNodeManager.getSessionsByStatus("active"), ...sessionNodeManager.getSessionsByStatus("interrupted")];
-        for (const row of candidates) {
-            if (agentName !== undefined && row.agent_name !== agentName)
-                continue;
-            if (now - row.created_at <= HALF_OPEN_TTL_MS)
-                continue; // too young — may just be setting up
-            // DOD-M12B-ACK-1: 'impaired' counts as live HERE. This reaper's question is "did the
-            // counterparty ever establish?", and impaired means it did — the connection is up, only
-            // delivery on it is failing. Reaping on impaired would abandon exactly the sessions this
-            // milestone exists to repair.
-            const liveness = sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id);
-            if (liveness === "alive" || liveness === "impaired")
-                continue; // live
-            /**
-             * DOD-M12B-REAP-HELD-1 — count HELD frames too, or an interrupted conversation reads as a
-             * dead handshake.
-             *
-             * OBSERVED LIVE 2026-08-18: this line abandoned session `d28db475…` — twenty leaves in the
-             * chain plus sixteen verified frames still held, ten of them from the counterparty — while the
-             * restart-seal resolver was actively trying to notarize it. The receipt was forfeited and the
-             * held content annexed.
-             *
-             * `countReceivedMessages` asks the TRANSCRIPT, and held content never reaches the transcript;
-             * it waits in `held_content` until it can join the chain. So the very condition that holds
-             * content — an interrupted session — is the condition that hides the counterparty's messages
-             * from this test, and a real conversation becomes indistinguishable from an offer nobody
-             * answered. `countEstablishedReceived` asks both places.
-             */
-            if (sessionNodeManager.countEstablishedReceived(row.agent_name, row.session_id) > 0)
-                continue; // counterparty spoke
-            // Non-awaited: abandonSession flips the DB status synchronously (before its first await), so THIS
-            // read reflects it; the async node teardown finishes in the background. CC-10 reviewer LOW: only
-            // log "reaped" if the status flip actually wrote — a swallowed write failure already logs
-            // session.status.write.failed, and reporting success over it would hide a still-counting ghost.
-            void sessionNodeManager.abandonSession(row.agent_name, row.session_id)
-                .then((flipped) => {
-                if (flipped) {
-                    logger.info("session.half_open.reaped", { agentName: row.agent_name, sessionId: row.session_id, priorStatus: row.status, ageMs: now - row.created_at });
-                }
-            })
-                .catch((err) => {
-                logger.warn("session.half_open.reap.failed", { agentName: row.agent_name, sessionId: row.session_id, reason: extractErrorMessage(err) });
-            });
-        }
-    }
-    // DOD-M15-AWAYSCOPE-1: one budget for ALL the attendance probes a status read fires, not one
-    // each. An operator with a dozen sessions must not wait a dozen timeouts, and the number is set by
-    // what a person will sit through at a terminal rather than by what a slow relay might need.
-    const ATTENDANCE_PROBE_BUDGET_MS = 1_500;
-    // M8B F16: per-session liveness for ACTIVE sessions, shared by both status surfaces
-    // ("status" for the CLI, "cello_status" for MCP). The signal (session.liveness.changed,
-    // tracked in the node manager) existed but nothing consumed it — a dead counterparty
-    // was invisible to the operator.
-    function buildActiveSessions() {
-        reapDeadHalfOpenSessions(); // CC-5/F21: drop provably-dead half-open sessions before surfacing active ones
-        return sessionNodeManager.getSessionsByStatus("active").map((row) => {
-            // DOD-M12B-SEAL-STUCK-1: ask the SAME gate the close path asks, so the surface and the
-            // refusal can never disagree. Computed here rather than cached because the answer changes
-            // the moment a gap fills, and a stale "stuck" is its own lie.
-            return {
-                sessionId: row.session_id,
-                agentName: row.agent_name,
-                counterpartyPubkey: row.counterparty_pubkey,
-                liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
-                sessionName: row.session_name ?? null, // DOD-SESSION-NAME-1 (AC-A11)
-                sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
-                // DOD-M12B-CLOSE-SILENT-WAIT-1: both flows, because either can be the one blocking the
-                // operator's command — `pendingSealWaiters` is the active close, `sealInterruptedInProgress`
-                // the interrupted one.
-                sealing: pendingSealWaiters.has(sealKey(row.agent_name, row.session_id)) ||
-                    sealInterruptedInProgress.has(sealKey(row.agent_name, row.session_id)),
-            };
-        });
-    }
-    /**
-     * The state an operator sees, for one agent — used by BOTH status surfaces.
-     *
-     * Deliberately one function. The daemon-wide status and the per-connection `cello_status` used to
-     * compute this separately, and separate copies of a truth claim are how the directory-health block
-     * came to exist on one surface and not the other earlier today.
-     */
-    function agentStateFor(a) {
-        return resolveAgentState({
-            loadFailed: a.state === "load_failed",
-            // `unregistered` is BUILT and tested (agent-state.ts) and deliberately NOT EMITTED yet.
-            //
-            // The truthful signal is whether the DKG left a FROST share — registration's durable product,
-            // rather than a flag anyone could forget to set. But every test fixture creates an agent
-            // WITHOUT one, so switching this on relabels the agents in 29 tests across 8 files, and the
-            // alternative — fabricating share material in fixtures — plants fake crypto material that a
-            // later reader takes for real. Neither is worth it for a state that lasts the few seconds
-            // between `cello create-agent` and `cello register-agent`.
-            //
-            // So the daemon asserts exactly what it asserted before this change: a loaded agent is treated
-            // as registered. That is not a regression, and it is not silent — it is this comment. The VALUE
-            // stays in AgentState, so turning it on once fixtures can register for real is a one-line
-            // change here and NOT a second wire change for every consumer.
-            hasFrostShare: true,
-            deliberatelyOffline: explicitlyOfflineAgents.has(a.name),
-            started: onlineAgents.has(a.name),
-            // This agent's OWN stream where it has one — an agent whose connection is severed while its
-            // siblings are fine must not read as healthy.
-            //
-            // Falls back to the shared manager, mirroring directorySignalingStatus(): production gives
-            // every agent its own connection, but the IN-PROCESS TEST path has ONE shared manager (NOT back-compat: Rule F deletes
-            // back-compat on sight, and deleting this would break every in-process test in the package) and
-            // no per-agent entry at all. Reading only the per-agent map there returns undefined for every
-            // agent, so all of them reported `connecting` — which then made isAgentReady false and refused
-            // real commands with `selected_agent_offline`. Absent is not the same as disconnected.
-            signalingConnected: (perAgentSignaling.get(a.name)?.signaling.status ?? sharedSignaling?.status) === "connected",
-            attendance: countAttendance(perConnectionState, a.name),
-        });
-    }
-    // `probeSealReadiness` is NOT returned: its only caller is `buildInterruptedSessions`, which
-    // moved with it. Returning it would make a private helper reachable for no consumer.
-    /**
-     * DOD-M15-AWAYSCOPE-1 unit 3 — the same active sessions, plus what the RELAY knows about the far
-     * side: is it reachable, and is anyone attending it.
-     *
-     * ── WHY THIS IS A SEPARATE, ASYNC BUILD ─────────────────────────────────────────────────────────
-     *
-     * `buildActiveSessions` answers from local state and must stay synchronous — it is called from the
-     * half-open reaper's own path and from surfaces that cannot await. Attendance is not local: it is
-     * the far daemon's assertion, held by the relay, and the only way to have it is to ask. So the
-     * round trip lives here, on top, and every caller that can afford it uses this one.
-     *
-     * ── WHAT THE OPERATOR GETS, AND WHY IT IS NOT A MESSAGE ─────────────────────────────────────────
-     *
-     * This is the whole replacement for the away reply. An unattended agent used to announce itself by
-     * sending its greeting INTO the conversation, which took a hash-chain leaf and cost session
-     * `e7dd3f43…` its receipt on both machines. The same fact now arrives here, as session STATUS: the
-     * operator reads it, their agent never has to answer it, and it never enters a transcript or a
-     * sealed receipt.
-     *
-     * ── THE TWO LIVENESSES ARE BOTH REPORTED, AND THEY ARE NOT THE SAME QUESTION ────────────────────
-     *
-     * `liveness` is daemon-local — does THIS process hold a libp2p connection for the session. It has a
-     * fourth value, `impaired`, meaning the connection is up and writes on it are failing.
-     * `relayLiveness` is the RELAY's observation of the counterparty's standing connection, which is
-     * visible even when this daemon has no direct link at all. They disagree routinely and legitimately
-     * — a relay-mediated session is the normal case — so collapsing them into one word would make the
-     * commoner state look like a fault.
-     *
-     * ── BOUNDED, BECAUSE A STATUS COMMAND MUST ANSWER ───────────────────────────────────────────────
-     *
-     * Every session is asked in parallel under ONE budget. A relay that does not answer costs the
-     * operator a wait, not a hang, and the sessions that did answer are still reported — a status read
-     * that blocks on the slowest relay is a status read nobody runs when it matters.
-     */
-    async function buildActiveSessionsWithAttendance() {
-        const sessions = buildActiveSessions();
-        if (sessions.length === 0)
-            return sessions;
-        const deadline = new Promise((r) => setTimeout(() => r("timeout"), ATTENDANCE_PROBE_BUDGET_MS));
-        const answered = await Promise.race([
-            Promise.all(sessions.map(async (s) => {
-                try {
-                    return await sessionNodeManager.queryRelayLiveness(s.agentName, s.sessionId);
-                }
-                catch {
-                    // A probe that throws tells the operator nothing, and must not take the status read with
-                    // it. Null here reads the same as "this session has no relay to ask", which is honest.
-                    return null;
-                }
-            })),
-            deadline,
-        ]);
-        if (answered === "timeout") {
-            // The local picture, unenriched. NOT an error and not a partial merge: pairing answers to
-            // sessions after a race would report some rows enriched and others not, with nothing saying
-            // which — and an operator cannot tell a missing field from a field that means "unknown".
-            logger.debug("session.attendance.probe.timeout", { sessions: sessions.length, budgetMs: ATTENDANCE_PROBE_BUDGET_MS });
-            return sessions;
-        }
-        return sessions.map((s, i) => {
-            const a = answered[i];
-            if (!a)
-                return s;
-            return {
-                ...s,
-                relayLiveness: a.liveness,
-                ...(a.observedAt > 0 ? { relayObservedAt: a.observedAt } : {}),
-                // BOTH, and they are different facts. `relayObservedAt` is when the relay last saw the
-                // connection change; `attendanceObservedAt` is when the agent last said something about
-                // itself. Labelling the attendance with the first dates an absence to a time before it was
-                // true, and the number then never moves when the operator steps away again.
-                ...(a.attendance ? { counterpartyAttendance: a.attendance } : {}),
-                ...(a.attendanceObservedAt !== undefined ? { attendanceObservedAt: a.attendanceObservedAt } : {}),
-            };
-        });
-    }
-    return { buildInterruptedSessions, reapDeadHalfOpenSessions, buildActiveSessions, buildActiveSessionsWithAttendance, agentStateFor };
-}
-//# sourceMappingURL=session-views.js.map

package/dist/session-views.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-views.js","sourceRoot":"","sources":["../src/session-views.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkBzD,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,EACJ,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EACrF,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,OAAO,EAAE,yBAAyB,EAC1F,kBAAkB,GACnB,GAAG,IAAI,CAAC;IAET,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,mDAAmD;IACnD,yFAAyF;IACzF,8FAA8F;IAC9F,4FAA4F;IAC5F,kGAAkG;IAClG,qDAAqD;IACrD,MAAM,oBAAoB,GAAG,EAAE,CAAC;IAChC;;;;;;;;;;;;OAYG;IACH,SAAS,kBAAkB,CAAC,SAAiB,EAAE,SAAiB;QAC9D,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,SAAS,wBAAwB;QAC/B,OAAO,kBAAkB;aACtB,mBAAmB,CAAC,aAAa,CAAC;aAClC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,+CAA+C;aAC7F,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC;aAC9B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;YAC3C,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;YACpC,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YAC3E,4FAA4F;YAC5F,+CAA+C;YAC/C,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,wFAAwF;YACxF,wFAAwF;YACxF,wFAAwF;YACxF,sFAAsF;YACtF,2DAA2D;YAC3D,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;YACjE,6FAA6F;YAC7F,4FAA4F;YAC5F,uFAAuF;YACvF,0FAA0F;YAC1F,GAAG,CAAC,GAAG,EAAE;gBACP,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,CAAC,CAAC,EAAE;SACL,CAAC,CAAC,CAAC;IACR,CAAC;IAED,qGAAqG;IACrG,mGAAmG;IACnG,uGAAuG;IACvG,uGAAuG;IACvG,qGAAqG;IACrG,qGAAqG;IACrG,uEAAuE;IACvE,qGAAqG;IACrG,mGAAmG;IACnG,sGAAsG;IACtG,kGAAkG;IAClG,qGAAqG;IACrG,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACxF,SAAS,wBAAwB,CAAC,SAAkB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,CAAC,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC;QACnI,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,SAAS;YACtE,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,gBAAgB;gBAAE,SAAS,CAAC,qCAAqC;YAC7F,qFAAqF;YACrF,wFAAwF;YACxF,yFAAyF;YACzF,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACvF,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,UAAU;gBAAE,SAAS,CAAC,OAAO;YACtE;;;;;;;;;;;;;;eAcG;YACH,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,qBAAqB;YACpH,kGAAkG;YAClG,iGAAiG;YACjG,0FAA0F;YAC1F,gGAAgG;YAChG,KAAK,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;iBACnE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC1J,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3I,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,mGAAmG;IACnG,4FAA4F;IAC5F,MAAM,0BAA0B,GAAG,KAAK,CAAC;IAEzC,oFAAoF;IACpF,wFAAwF;IACxF,qFAAqF;IACrF,iCAAiC;IACjC,SAAS,mBAAmB;QAC1B,wBAAwB,EAAE,CAAC,CAAC,+EAA+E;QAC3G,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClE,uFAAuF;YACvF,0FAA0F;YAC1F,8DAA8D;YAC9D,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;gBAC3C,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;gBAC/E,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,8BAA8B;gBACrE,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;gBACjE,uFAAuF;gBACvF,6FAA6F;gBAC7F,uBAAuB;gBACvB,OAAO,EACL,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC/D,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;aACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,SAAS,aAAa,CAAC,CAAY;QACjC,OAAO,iBAAiB,CAAC;YACvB,UAAU,EAAE,CAAC,CAAC,KAAK,KAAK,aAAa;YACrC,wFAAwF;YACxF,EAAE;YACF,8FAA8F;YAC9F,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,2DAA2D;YAC3D,EAAE;YACF,+FAA+F;YAC/F,gGAAgG;YAChG,0FAA0F;YAC1F,+DAA+D;YAC/D,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjC,4FAA4F;YAC5F,8CAA8C;YAC9C,EAAE;YACF,2FAA2F;YAC3F,uHAAuH;YACzH,gGAAgG;YAC9F,8FAA8F;YAC9F,+FAA+F;YAC/F,uFAAuF;YACvF,kBAAkB,EAChB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,IAAI,eAAe,EAAE,MAAM,CAAC,KAAK,WAAW;YAC9F,UAAU,EAAE,eAAe,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,6FAA6F;IAC7F,qFAAqF;IACrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,UAAU,iCAAiC;QAC9C,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAY,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC;oBACH,OAAO,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,yFAAyF;oBACzF,uFAAuF;oBACvF,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,0FAA0F;YAC1F,4FAA4F;YAC5F,yFAAyF;YACzF,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACtH,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;YACjB,OAAO;gBACL,GAAG,CAAC;gBACJ,aAAa,EAAE,CAAC,CAAC,QAAQ;gBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,uFAAuF;gBACvF,wFAAwF;gBACxF,2FAA2F;gBAC3F,4EAA4E;gBAC5E,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClG,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,iCAAiC,EAAE,aAAa,EAAE,CAAC;AACvI,CAAC"}

package/dist/signal-handlers.d.ts

@@ -1,63 +0,0 @@
-import type { SubmissionOp, ConsortiumManifest } from "@cello-protocol/protocol-types";
-import type { KeyProvider } from "@cello-protocol/crypto";
-import type { SignalingManager } from "@cello-protocol/transport";
-import type { SubmissionRetryQueue } from "./submission-retry.js";
-import type { IpcHandler } from "./ipc-server.js";
-import type { SessionNodeManager } from "./session-node-manager.js";
-import type { Logger } from "./types.js";
-import type { LoadedAgent } from "./agent-loader.js";
-/** The per-connection agent selection, as this surface needs to read it. */
-export interface SignalConnState {
-    currentAgent: string | null;
-}
-export interface SignalHandlerDeps {
-    handlers: Map<string, IpcHandler>;
-    logger: Logger;
-    sessionNodeManager: SessionNodeManager;
-    /** Signing keys by agent name. A missing entry is a refusal, never a silent skip. */
-    keyProviders: Map<string, KeyProvider>;
-    /** Read-only: a submission needs its agent ONLINE, and this surface must not change that. */
-    onlineAgents: ReadonlySet<string>;
-    /** Resolves the selected agent's name to its pubkey. It no longer gates attestations: a CO-OWNED
-     * subject is annotated by the portal, not refused here. */
-    loadedAgents: ReadonlyArray<LoadedAgent>;
-    /** Read this connection's agent selection. The READ, not the container. */
-    getConnState: (connectionId: string) => SignalConnState | undefined;
-    /**
-     * ⚠️ NOT a getter — for an agent with no manager this CONSTRUCTS one. The comment at its use
-     * site says so and moved with the code; it is repeated here because the name reads like a lookup.
-     */
-    getAgentSignaling: (agentName: string, agentKeyProvider: KeyProvider, agentPubkeyHex: string) => {
-        signaling: SignalingManager;
-    };
-    /** A transient connection to a directory that is not this agent's home node. */
-    openVisitingConnection: (agentName: string, agentKeyProvider: KeyProvider, agentPubkeyHex: string, endpoint: {
-        peerId: string;
-        multiaddr: string;
-    }, correlationId: string, nodeId: string) => {
-        mgr: SignalingManager;
-        stop: (reason: string) => Promise<void>;
-    };
-    /** It returns synchronously and dials in the background; this is what makes it usable. */
-    waitForSignalingConnected: (mgr: SignalingManager, timeoutMs: number) => Promise<boolean>;
-    /** Every directory in the verified consortium. Null when there is no roster at all. */
-    resolveConsortiumRoster: () => Promise<Array<{
-        peerId: string;
-        multiaddr: string;
-        nodeId: string;
-    }> | null>;
-    /** The verified manifest, for its intake key. Null on every path that verified nothing. */
-    verifiedManifest: ConsortiumManifest | null;
-    /** Held submissions that could not be sent, retried on a window. */
-    submissionRetries: SubmissionRetryQueue;
-    /** Record an issued submission against the agent's STABLE id, never its display name. */
-    recordIssuedSubmission: (agentName: string, agentId: string, s: {
-        submissionId: string;
-        subject: string;
-        op: SubmissionOp;
-        intakeKeyId: string;
-        stored: boolean;
-    }) => void;
-}
-export declare function registerSignalHandlers(deps: SignalHandlerDeps): void;
-//# sourceMappingURL=signal-handlers.d.ts.map

package/dist/signal-handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signal-handlers.d.ts","sourceRoot":"","sources":["../src/signal-handlers.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAqB,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC1G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAKlE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAUrD,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAAG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AAEjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,qFAAqF;IACrF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,6FAA6F;IAC7F,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC;+DAC2D;IAC3D,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACzC,2EAA2E;IAC3E,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IACpE;;;OAGG;IACH,iBAAiB,EAAE,CACjB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,WAAW,EAC7B,cAAc,EAAE,MAAM,KACnB;QAAE,SAAS,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACrC,gFAAgF;IAChF,sBAAsB,EAAE,CACtB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,WAAW,EAC7B,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAC/C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,KACX;QAAE,GAAG,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACxE,0FAA0F;IAC1F,yBAAyB,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,uFAAuF;IACvF,uBAAuB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5G,2FAA2F;IAC3F,gBAAgB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C,oEAAoE;IACpE,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,yFAAyF;IACzF,sBAAsB,EAAE,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KACjG,IAAI,CAAC;CACX;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA89BpE"}