@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/telegram-doorbell.js

@@ -1,140 +0,0 @@
-/**
- * M8C-TGDOOR-1: the Telegram doorbell.
- *
- * A daemon-owned bot pushes discrete, CONTENT-FREE events (session request / message waiting /
- * state change) to one allowlisted operator chat. It is a convenience, never load-bearing: a
- * network hiccup backs off and retries rather than killing the poller, and an unconfigured
- * doorbell is INERT, not an error.
- *
- * Two invariants worth stating at the boundary, because the boundary is what enforces them now:
- *
- *   DOD-INV-CONTENTFREE — the doorbell sends a fixed label per event kind, NEVER message text.
- *     This module cannot leak conversation content because it is never given any: its whole
- *     dependency list is a logger, the stored settings, and a bot client.
- *   D6 — an inbound Telegram message from ANY chat is acknowledged and dropped. Nothing from
- *     Telegram enters a CELLO content path. Inside startDaemon that was a promise; here it is
- *     structural — there is no session-send seam in this module to abuse.
- */
-import { HttpTelegramBotClient } from "./telegram-bot-client.js";
-import { extractErrorMessage } from "./error-message.js";
-export function createTelegramDoorbell(deps) {
-    const { logger, getTelegramSettings, injectedClient } = deps;
-    // M8C-TGDOOR-1: Telegram Mode 1 doorbell — a daemon-owned bot pushes discrete, content-free
-    // events (session request / message-waiting / state change) to one allowlisted operator chat.
-    // "NO channel machinery" (DoD) — this talks to the Telegram Bot API directly, unrelated to the
-    // claude/channel MCP capability from Tiers 1-2. Inert until telegram_settings exist.
-    let telegramBotClient = injectedClient ?? null;
-    let telegramChatId = null;
-    let telegramBotToken = null; // tracked only to detect an actual token CHANGE
-    // Generation counter, NOT a shared boolean — a boolean flip-to-false-then-true-again (e.g. a
-    // settings update that restarts the poller) would let the OLD loop's `while` condition still
-    // read true on its next check, running TWO concurrent loops. Each loop instance captures its
-    // OWN generation at start and exits the instant the counter no longer matches (a new start, or
-    // shutdown, both just bump it).
-    let telegramPollerGeneration = 0;
-    let telegramUpdateOffset = 0;
-    // Coalescing: ring once for the FIRST message-waiting event since a session was last fully
-    // read; cleared on read (cello_receive advancing that session's watermark). Session
-    // requests and state changes bypass this Set entirely — DoD says they always ring.
-    const telegramRungUnread = new Set();
-    async function sendTelegramDoorbell(agentName, sessionId, kind, detail) {
-        if (!telegramBotClient || !telegramChatId)
-            return; // TGDOOR not configured — inert, not an error
-        if (kind === "message_waiting") {
-            const rungKey = `${agentName}:${sessionId}`;
-            if (telegramRungUnread.has(rungKey))
-                return; // already rung, still unread — coalesced
-            telegramRungUnread.add(rungKey);
-        }
-        // DOD-INV-CONTENTFREE: `detail` is a fixed, content-free label per kind — NEVER message text.
-        const text = `[${agentName} · ${sessionId.slice(0, 8)}] ${detail}`;
-        try {
-            const result = await telegramBotClient.sendMessage(telegramChatId, text);
-            if (!result.ok) {
-                logger.warn("telegram.doorbell.send.failed", { agentName, sessionId, kind, reason: result.error });
-                return;
-            }
-            logger.info("telegram.doorbell.sent", { agentName, sessionId, kind });
-        }
-        catch (err) {
-            logger.warn("telegram.doorbell.send.failed", { agentName, sessionId, kind, error: extractErrorMessage(err) });
-        }
-    }
-    // Read clears the ring (DoD: "ring-once-until-read") — called wherever a receive advances a
-    // session's read watermark, mirroring AWAY-1's own dedup-clear-on-attend pattern.
-    function clearTelegramRung(agentName, sessionId) {
-        telegramRungUnread.delete(`${agentName}:${sessionId}`);
-    }
-    async function handleInboundTelegramUpdate(update, client) {
-        const chatId = update.message?.chat?.id !== undefined ? String(update.message.chat.id) : undefined;
-        if (!chatId)
-            return;
-        if (chatId !== telegramChatId) {
-            // D6: any other chat is silently dropped — nothing enters CELLO content paths.
-            logger.info("telegram.inbound.rejected", { chatId });
-            return;
-        }
-        logger.info("telegram.inbound.acknowledged", { chatId });
-        try {
-            await client.sendMessage(chatId, "CELLO doesn't process messages here — this channel only sends you notifications. Use your CELLO client to reply.");
-        }
-        catch (err) {
-            logger.warn("telegram.inbound.ack.failed", { chatId, error: extractErrorMessage(err) });
-        }
-    }
-    // Single long-lived getUpdates poller (DoD) — one in-flight loop per daemon; started once
-    // settings exist, stopped on daemon shutdown. A network hiccup backs off and retries rather
-    // than killing the poller (best-effort — the doorbell is a convenience, never load-bearing).
-    // The client is a PARAMETER and must never be re-read from the shared, reassignable
-    // telegramBotClient: a settings update mid-await would otherwise let a stale response from the OLD
-    // client still be processed once (the generation check blocks the loop's NEXT iteration, not an
-    // in-flight call), and stomp telegramUpdateOffset with the OLD bot's update_id numbering, which is
-    // meaningless to a new token (Telegram scopes update_id per bot). Re-check the generation
-    // immediately after EVERY await, before acting on its result or touching shared state.
-    async function runTelegramPollerLoop(myGeneration, myClient) {
-        let myOffset = telegramUpdateOffset;
-        while (telegramPollerGeneration === myGeneration) {
-            try {
-                const updates = await myClient.getUpdates(myOffset, 25);
-                if (telegramPollerGeneration !== myGeneration)
-                    break; // superseded while awaiting — drop stale results
-                for (const u of updates) {
-                    myOffset = u.update_id + 1;
-                    telegramUpdateOffset = myOffset;
-                    if (u.message)
-                        void handleInboundTelegramUpdate(u, myClient);
-                }
-            }
-            catch (err) {
-                if (telegramPollerGeneration !== myGeneration)
-                    break; // superseded — don't retry under a dead generation
-                logger.warn("telegram.poller.error", { error: extractErrorMessage(err) });
-                await new Promise((r) => setTimeout(r, 2000)); // back off before retrying
-            }
-        }
-    }
-    // Always bumps the generation (invalidating any prior loop, which exits on its next check) and
-    // starts a fresh one — correct both for the first start AND a settings-change restart.
-    function startTelegramPollerIfConfigured() {
-        const settings = getTelegramSettings();
-        if (!settings)
-            return; // not configured — TGDOOR stays inert
-        // Reviewer MEDIUM fix: reset the offset on an actual token/chat CHANGE — a prior bot's
-        // update_id numbering is meaningless to a new one (Telegram scopes it per bot token).
-        if (telegramBotToken !== settings.botToken || telegramChatId !== settings.allowlistedChatId) {
-            telegramUpdateOffset = 0;
-        }
-        telegramBotToken = settings.botToken;
-        telegramChatId = settings.allowlistedChatId;
-        const client = injectedClient ?? new HttpTelegramBotClient(settings.botToken);
-        telegramBotClient = client;
-        telegramPollerGeneration += 1;
-        void runTelegramPollerLoop(telegramPollerGeneration, client);
-        logger.info("telegram.poller.started", {});
-    }
-    function stopTelegramPoller() {
-        telegramPollerGeneration += 1;
-    }
-    return { sendTelegramDoorbell, clearTelegramRung, startTelegramPollerIfConfigured, stopTelegramPoller };
-}
-//# sourceMappingURL=telegram-doorbell.js.map

package/dist/telegram-doorbell.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"telegram-doorbell.js","sourceRoot":"","sources":["../src/telegram-doorbell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,qBAAqB,EAA0B,MAAM,0BAA0B,CAAC;AAEzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkBzD,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE7D,4FAA4F;IAC5F,8FAA8F;IAC9F,+FAA+F;IAC/F,qFAAqF;IACrF,IAAI,iBAAiB,GAA6B,cAAc,IAAI,IAAI,CAAC;IACzE,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,gBAAgB,GAAkB,IAAI,CAAC,CAAC,gDAAgD;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,gCAAgC;IAChC,IAAI,wBAAwB,GAAG,CAAC,CAAC;IACjC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,2FAA2F;IAC3F,oFAAoF;IACpF,mFAAmF;IACnF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,SAAiB,EACjB,IAA4D,EAC5D,MAAc;QAEd,IAAI,CAAC,iBAAiB,IAAI,CAAC,cAAc;YAAE,OAAO,CAAC,8CAA8C;QACjG,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5C,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,yCAAyC;YACtF,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,8FAA8F;QAC9F,MAAM,IAAI,GAAG,IAAI,SAAS,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,kFAAkF;IAClF,SAAS,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;QAC7D,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,2BAA2B,CACxC,MAA2E,EAC3E,MAAyB;QAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,+EAA+E;YAC/E,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CACtB,MAAM,EACN,kHAAkH,CACnH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,4FAA4F;IAC5F,6FAA6F;IAC7F,oFAAoF;IACpF,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,0FAA0F;IAC1F,uFAAuF;IACvF,KAAK,UAAU,qBAAqB,CAAC,YAAoB,EAAE,QAA2B;QACpF,IAAI,QAAQ,GAAG,oBAAoB,CAAC;QACpC,OAAO,wBAAwB,KAAK,YAAY,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACxD,IAAI,wBAAwB,KAAK,YAAY;oBAAE,MAAM,CAAC,iDAAiD;gBACvG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,QAAQ,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;oBAC3B,oBAAoB,GAAG,QAAQ,CAAC;oBAChC,IAAI,CAAC,CAAC,OAAO;wBAAE,KAAK,2BAA2B,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,wBAAwB,KAAK,YAAY;oBAAE,MAAM,CAAC,mDAAmD;gBACzG,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,2BAA2B;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,uFAAuF;IACvF,SAAS,+BAA+B;QACtC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,sCAAsC;QAC7D,uFAAuF;QACvF,sFAAsF;QACtF,IAAI,gBAAgB,KAAK,QAAQ,CAAC,QAAQ,IAAI,cAAc,KAAK,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC5F,oBAAoB,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACrC,cAAc,GAAG,QAAQ,CAAC,iBAAiB,CAAC;QAC5C,MAAM,MAAM,GAAG,cAAc,IAAI,IAAI,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9E,iBAAiB,GAAG,MAAM,CAAC;QAC3B,wBAAwB,IAAI,CAAC,CAAC;QAC9B,KAAK,qBAAqB,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,SAAS,kBAAkB;QACzB,wBAAwB,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,CAAC;AAC1G,CAAC"}

package/dist/test-handlers.d.ts

@@ -1,62 +0,0 @@
-/**
- * The verbs that exist for TESTS, and nothing else.
- *
- * Two groups with different guards, and the difference is why this file has a header. The seven
- * `__test_*` verbs sit inside `CELLO_ENV === "test"` and cannot be reached in production. The six
- * above them — `queue_failed_send`, `debug_inject_park_fault`, `enqueue_awaiting_content`,
- * `mark_content_acked`, `check_nonce`, `drain_session` — are NOT gated, and FOUR of them write state.
- * `check_nonce` is the one to notice: it does not merely read, it `checkAndAdd`s, which INSERTs into
- * `session_seen_nonces` and survives a restart — so pre-registering a nonce makes the real message
- * carrying it arrive and be discarded as a duplicate, logged at debug and nowhere else. Their only
- * callers are tests (measured: nothing in the CLI, nothing in the MCP shim), so a production daemon
- * answers six verbs nobody outside a test has a use for.
- *
- * ⚠️ THE ASYMMETRY IS RECORDED, NOT FIXED HERE. Gating them changes behaviour and this is a movement
- * order; the guard structure moved exactly as it was. It is written into the order's *Newly
- * discovered* so it can be ranked — rather than inherited by the next reader, who would see the file
- * name and assume the whole thing is unreachable in production.
- *
- * ⚠️ TWO PRODUCTION REGISTRATIONS DID NOT COME WITH IT. `contentPark.registerHandlers(handlers)` and
- * `registerInboundSessionHandlers(handlers)` sit between the two groups in the original file and are
- * real surfaces. They stay in the composition root; only the test verbs on either side moved. That
- * DOES change registration order — those two now run after all thirteen instead of between them —
- * and it is inert: dispatch resolves against the live map on each request rather than snapshotting
- * it, the IPC server is not created until every registration has run, and none of these verb names
- * collides. Written down because "do not reorder registration" is a rule of this order, and the
- * next reader deserves the measurement rather than the worry.
- */
-import type { IpcHandler } from "./ipc-server.js";
-import type { SessionNodeManager } from "./session-node-manager.js";
-import type { Logger } from "./types.js";
-import type { RetryQueue } from "./retry-queue.js";
-import type { NonceDedupStore } from "./nonce-dedup.js";
-import { type AnyRefusalReason } from "./refusal-reasons.js";
-import type { InboundSessionEvent } from "./inbound-sessions.js";
-/** The per-connection agent selection, as these verbs need to read it. */
-export interface TestConnState {
-    currentAgent: string | null;
-}
-export interface TestHandlerDeps {
-    handlers: Map<string, IpcHandler>;
-    logger: Logger;
-    sessionNodeManager: SessionNodeManager;
-    retryQueue: RetryQueue;
-    nonceDedupStore: NonceDedupStore;
-    /** Opens a delivery window and hands back the release. */
-    deliveryOpens: {
-        begin: (openerPubkey: string, targetPubkey: string) => () => void;
-    };
-    /** Name → pubkey, empty string when this daemon holds no such agent. */
-    pubkeyOfAgent: (name: string) => string;
-    /** The one dispatch path that also reaches Telegram — tests drive it to assert both halves. */
-    dispatchSessionStateChangedWithTelegram: (agentName: string, sessionId: string, state: string, counterpartyPubkey: string | null) => void;
-    /** The inbound-session queue machinery these verbs seed, injected rather than reached for. */
-    enqueueInboundSession: (agentName: string, event: InboundSessionEvent) => void;
-    recordRefusal: (agentName: string, sessionIdHex: string, counterpartyPubkeyHex: string, reason: AnyRefusalReason) => void;
-    /** The queue itself — one verb backdates the entry it just enqueued, which needs the container. */
-    inboundSessionQueues: Map<string, InboundSessionEvent[]>;
-    /** Read this connection's agent selection. The READ, not the container. */
-    getConnState: (connectionId: string) => TestConnState | undefined;
-}
-export declare function registerTestHandlers(deps: TestHandlerDeps): void;
-//# sourceMappingURL=test-handlers.d.ts.map

package/dist/test-handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-handlers.d.ts","sourceRoot":"","sources":["../src/test-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAqC,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAAG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AAE/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,0DAA0D;IAC1D,aAAa,EAAE;QAAE,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,IAAI,CAAA;KAAE,CAAC;IACrF,wEAAwE;IACxE,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,+FAA+F;IAC/F,uCAAuC,EAAE,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GAAG,IAAI,KAC9B,IAAI,CAAC;IACV,8FAA8F;IAC9F,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC/E,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,gBAAgB,KACrB,IAAI,CAAC;IACV,mGAAmG;IACnG,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,2EAA2E;IAC3E,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,CAAC;CACnE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAqQhE"}

package/dist/test-handlers.js

@@ -1,240 +0,0 @@
-import { REFUSAL_REASONS, CAPACITY_REASONS } from "./refusal-reasons.js";
-export function registerTestHandlers(deps) {
-    const { handlers, logger, sessionNodeManager, retryQueue, nonceDedupStore, deliveryOpens, pubkeyOfAgent, dispatchSessionStateChangedWithTelegram, enqueueInboundSession, recordRefusal, inboundSessionQueues, getConnState, } = deps;
-    handlers.set("queue_failed_send", async (params, _connectionId) => {
-        const sessionId = params?.sessionId;
-        const nonceHex = params?.nonce;
-        const contentHex = params?.content;
-        if (!sessionId || !nonceHex || !contentHex) {
-            return { error: "missing_params", guidance: "Provide sessionId, nonce (hex), and content (hex)." };
-        }
-        const nonce = Buffer.from(nonceHex, "hex");
-        const content = Buffer.from(contentHex, "hex");
-        retryQueue.enqueue(sessionId, nonce, content);
-        return { queued: true, queueDepth: retryQueue.getSessionDepth(sessionId) };
-    });
-    // CELLO-M7-MSG-001 (AC-004/AC-005): the send path records un-acked content here when
-    // its TTF timer fires, so a crash before the relay park confirms is recoverable at the
-    // next startup flush. Stored in the SAME retry_queue table (awaiting_ack = 1).
-    // M12-P12 verification surface. REFUSES unless the daemon was started with
-    // CELLO_FAULT_INJECTION=1 — the gate is here rather than at the call site so a normal daemon
-    // cannot be talked into dropping messages by anything that can reach the socket, and the refusal
-    // names why rather than silently no-opping.
-    handlers.set("debug_inject_park_fault", async (params) => {
-        if (process.env.CELLO_FAULT_INJECTION !== "1") {
-            return {
-                error: "fault_injection_disabled",
-                guidance: "Start the daemon with CELLO_FAULT_INJECTION=1 to enable. This is a verification surface for M12-P12 and is inert in a normal daemon.",
-            };
-        }
-        const count = typeof params?.count === "number" ? params.count : 1;
-        const cause = typeof params?.cause === "string" ? params.cause : undefined;
-        const armed = sessionNodeManager.injectParkFault(count, cause);
-        // The park fault alone reproduces nothing — the counterparty's session node accepts the frame
-        // and the park path is never entered. Arm the dial failure with it unless told otherwise.
-        const sendArmed = params?.withSendFault === false ? 0 : sessionNodeManager.injectSendFault(count);
-        logger.warn("content.park.fault.armed", { count: armed, sendArmed, cause: cause ?? "standing_receiver_creating" });
-        return { armed, sendArmed };
-    });
-    handlers.set("enqueue_awaiting_content", async (params, connectionId) => {
-        const sessionId = params?.sessionId;
-        const contentHashHex = params?.contentHash;
-        const contentHex = params?.content;
-        if (!sessionId || !contentHashHex || !contentHex) {
-            return { error: "missing_params", guidance: "Provide sessionId, contentHash (hex), and content (hex)." };
-        }
-        // DOD-LOOP-1: awaiting content is keyed by the OWNING agent. Prefer an explicit agentName param;
-        // fall back to the connection's current agent.
-        // DOD-AGENT-ID-JOINKEY-1: the old `?? ""` fell back to an EMPTY-STRING agent, silently merging
-        // every unaddressed caller's awaiting content into one nameless queue. There is no such agent.
-        const agentName = params?.agentName
-            ?? getConnState(connectionId)?.currentAgent;
-        if (!agentName) {
-            return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
-        }
-        const agentId = sessionNodeManager.resolveAgentId(agentName);
-        // The fault-injection IPC seam. It states all three trailing values explicitly rather than
-        // relying on defaults (B2b-1 pass-2 F1): `undefined` for the ordering record and the algorithm
-        // is what this path genuinely has — it injects a bare queued entry — and saying so keeps the
-        // seam honest about what it is producing rather than inheriting whatever the signature assumed.
-        retryQueue.enqueueAwaitingContent(agentId, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"), undefined, undefined, undefined);
-        return { queued: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
-    });
-    // CELLO-M7-MSG-001: a `persisted` delivery ACK (or a confirmed park) clears the durable
-    // awaiting-ACK entry so the startup flush does not re-park already-delivered content.
-    handlers.set("mark_content_acked", async (params, connectionId) => {
-        const sessionId = params?.sessionId;
-        const contentHashHex = params?.contentHash;
-        if (!sessionId || !contentHashHex) {
-            return { error: "missing_params", guidance: "Provide sessionId and contentHash (hex)." };
-        }
-        const agentName = params?.agentName
-            ?? getConnState(connectionId)?.currentAgent;
-        if (!agentName) {
-            return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
-        }
-        const agentId = sessionNodeManager.resolveAgentId(agentName);
-        retryQueue.markContentAcked(agentId, sessionId, Buffer.from(contentHashHex, "hex"));
-        return { acked: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
-    });
-    handlers.set("check_nonce", async (params, _connectionId) => {
-        const sessionId = params?.sessionId;
-        const nonceHex = params?.nonce;
-        const senderPubkeyHex = params?.senderPubkey;
-        if (!sessionId || !nonceHex || !senderPubkeyHex) {
-            return { error: "missing_params", guidance: "Provide sessionId, nonce (hex), and senderPubkey (hex)." };
-        }
-        const nonce = Buffer.from(nonceHex, "hex");
-        const senderPubkey = Buffer.from(senderPubkeyHex, "hex");
-        const duplicate = nonceDedupStore.checkAndAdd(sessionId, nonce, senderPubkey);
-        return { duplicate };
-    });
-    // DAEMON-003: drain_session IPC handler — triggered on peer reconnect.
-    // Returns pending entry metadata (nonces only — SI-002 forbids content in IPC frames).
-    // The actual drain+delivery is triggered separately when a real sendFn is available.
-    handlers.set("drain_session", async (params, _connectionId) => {
-        const sessionId = params?.sessionId;
-        if (!sessionId) {
-            return { error: "missing_params", guidance: "Provide sessionId." };
-        }
-        const depth = retryQueue.getSessionDepth(sessionId);
-        const entries = retryQueue.getSessionEntries(sessionId);
-        return { pendingCount: depth, nonces: entries.map(e => e.nonceHex) };
-    });
-    // MCP-002: Test-only handler to emit session lifecycle events.
-    // Guarded by CELLO_ENV=test — never available in production.
-    if (process.env["CELLO_ENV"] === "test") {
-        handlers.set("__test_emit_session_event", async (params, _connectionId) => {
-            const type = params?.type;
-            const sessionId = params?.sessionId;
-            const agentName = params?.agentName;
-            const counterpartyPubkey = params?.counterpartyPubkey ?? null;
-            if (!type || !sessionId || !agentName) {
-                return { error: "missing_params", guidance: "Provide type, sessionId, and agentName." };
-            }
-            if (type === "created") {
-                const sessionPeerId = params?.sessionPeerId ?? "";
-                const correlationId = params?.correlationId ?? "";
-                logger.info("session.node.created", { sessionId, agentName, sessionPeerId, correlationId });
-                dispatchSessionStateChangedWithTelegram(agentName, sessionId, "created", counterpartyPubkey);
-            }
-            else if (type === "destroyed") {
-                const state = params?.state ?? "interrupted";
-                const reason = params?.reason ?? state;
-                logger.info("session.node.destroyed", { sessionId, agentName, reason });
-                dispatchSessionStateChangedWithTelegram(agentName, sessionId, state, counterpartyPubkey);
-            }
-            return { ok: true };
-        });
-        // DOD-M12B-DELIVERY-QUIET-1: drive the delivery-open intent directly, so the doorbell exemption
-        // is testable without standing up a document, a peer daemon and a real directory negotiation.
-        // The registry's begin() hands back a closure, so the releases are held here by key.
-        // The hook takes AGENT NAMES and resolves both to pubkeys through `pubkeyOfAgent`, exactly as the
-        // real delivery adapter does. That is deliberate: the first version of this hook let a test
-        // register a tuple production never produces — an agent registered as the dialler and then
-        // emitted as the receiver of its own dial — so the suite proved the guard's boolean logic and
-        // nothing about the wiring, and stayed green against a guard that could never fire.
-        const testDeliveryReleases = new Map();
-        // DOD-M12B-INBOX-TRUTH-1: seed a refusal, so the ended-unread return branch's lost
-        // `refused_session_requests` has a regression test. The field had none before or after the fix.
-        handlers.set("__test_record_refusal", async (params, _connectionId) => {
-            const agentName = params?.agentName;
-            const sessionId = params?.sessionId;
-            if (!agentName || !sessionId)
-                return { error: "missing_params", guidance: "Provide agentName and sessionId." };
-            // The reason is VALIDATED against the closed union rather than cast through it. A test seam
-            // that can inject a reason production cannot produce would let a test prove the inbox handles a
-            // code no refusal path emits — which is the shape DOD-M15-GUARD-HEARD-1 exists to remove, and a
-            // seam is not exempt from it.
-            const asked = params?.reason ?? CAPACITY_REASONS.ABUSE_BOUND_SESSIONS_PER_SENDER;
-            const known = [
-                ...Object.values(REFUSAL_REASONS),
-                ...Object.values(CAPACITY_REASONS),
-            ];
-            if (!known.includes(asked)) {
-                return {
-                    error: "unknown_refusal_reason",
-                    guidance: `"${asked}" is not a reason any refusal path can emit. Use one of: ${known.join(", ")}. ` +
-                        `Seeding an invented reason would test the inbox against a code production never produces.`,
-                };
-            }
-            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", asked);
-            return { ok: true };
-        });
-        handlers.set("__test_delivery_open_begin", async (params, _connectionId) => {
-            const openerAgent = params?.openerAgent;
-            const targetAgent = params?.targetAgent;
-            if (!openerAgent || !targetAgent)
-                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
-            const openerPubkey = pubkeyOfAgent(openerAgent);
-            const targetPubkey = pubkeyOfAgent(targetAgent);
-            testDeliveryReleases.set(`${openerAgent}>${targetAgent}`, deliveryOpens.begin(openerPubkey, targetPubkey));
-            return { ok: true, openerPubkey, targetPubkey };
-        });
-        handlers.set("__test_delivery_open_end", async (params, _connectionId) => {
-            const openerAgent = params?.openerAgent;
-            const targetAgent = params?.targetAgent;
-            if (!openerAgent || !targetAgent)
-                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
-            const key = `${openerAgent}>${targetAgent}`;
-            testDeliveryReleases.get(key)?.();
-            testDeliveryReleases.delete(key);
-            return { ok: true };
-        });
-        // M8C-INBOX-1: test hook to enqueue a pending inbound session request (mirrors the real inbound
-        // flow's enqueueInboundSession) so cello_check_notifications' pending_session_requests is testable
-        // without standing up the full libp2p inbound path.
-        handlers.set("__test_enqueue_inbound_session", async (params, _connectionId) => {
-            const agentName = params?.agentName;
-            const sessionIdHex = params?.sessionId;
-            const counterpartyPubkeyHex = params?.counterpartyPubkey ?? "";
-            if (!agentName || !sessionIdHex) {
-                return { error: "missing_params", guidance: "Provide agentName and sessionId." };
-            }
-            enqueueInboundSession(agentName, { sessionIdHex, counterpartyPubkeyHex, genesisPrevRootHex: "" });
-            // M8C-TTL-1: let a test backdate the just-enqueued entry's timestamp (simulating age) without
-            // waiting real hours or faking global timers — enqueueInboundSession always stamps Date.now().
-            const enqueuedAtOverride = params?.enqueuedAtOverride;
-            if (enqueuedAtOverride !== undefined) {
-                const q = inboundSessionQueues.get(agentName);
-                const entry = q?.[q.length - 1];
-                if (entry)
-                    entry.enqueuedAt = enqueuedAtOverride;
-            }
-            return { ok: true };
-        });
-        // TTL-terminal-reap: seed a session row at a given terminal status so tests can assert that
-        // reapExpiredInboundSessions drops the matching inbound queue entry without waiting 24h.
-        handlers.set("__test_insert_session_row", async (params, _connectionId) => {
-            const agentName = params?.agentName;
-            const sessionId = params?.sessionId;
-            const status = params?.status;
-            const counterpartyPubkey = params?.counterpartyPubkey ?? "testpubkey";
-            if (!agentName || !sessionId || !status) {
-                return { error: "missing_params", guidance: "Provide agentName, sessionId, status." };
-            }
-            const db = sessionNodeManager.getDb();
-            const now = Date.now();
-            const agentRow = db.prepare("SELECT agent_id FROM agents WHERE agent_name = ?").get(agentName);
-            if (!agentRow)
-                return { error: "agent_not_found" };
-            db.prepare("INSERT OR REPLACE INTO sessions (session_id, agent_id, counterparty_pubkey, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)").run(sessionId, agentRow.agent_id, counterpartyPubkey, status, now, now);
-            return { ok: true };
-        });
-        // M8C-INBOX-1 (F1): seed a received message so a test can drive a live cello_receive and assert the
-        // watermark advances (N3), without a session tree. It seeded the arrival buffer until that buffer
-        // was deleted for having no production reader; the transcript row is what cello_receive serves.
-        handlers.set("__test_buffer_received", async (params, _connectionId) => {
-            const agentName = params?.agentName;
-            const sessionId = params?.sessionId;
-            const seq = params?.seq;
-            const content = params?.content ?? "hello";
-            if (!agentName || !sessionId || typeof seq !== "number") {
-                return { error: "missing_params", guidance: "Provide agentName, sessionId, seq." };
-            }
-            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, seq, "received", new TextEncoder().encode(content), "test-seed");
-            return { ok: true };
-        });
-    } // end CELLO_ENV=test guard
-}
-//# sourceMappingURL=test-handlers.js.map

package/dist/test-handlers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-handlers.js","sourceRoot":"","sources":["../src/test-handlers.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAyB,MAAM,sBAAsB,CAAC;AAqChG,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,aAAa,EACb,aAAa,EACb,uCAAuC,EACvC,qBAAqB,EACrB,aAAa,EACb,oBAAoB,EACpB,YAAY,GACb,GAAG,IAAI,CAAC;IAET,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,KAA2B,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,EAAE,OAA6B,CAAC;QACzD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oDAAoD,EAAE,CAAC;QACrG,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/C,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,qFAAqF;IACrF,uFAAuF;IACvF,+EAA+E;IAC/E,2EAA2E;IAC3E,6FAA6F;IAC7F,iGAAiG;IACjG,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,EAAE,CAAC;YAC9C,OAAO;gBACL,KAAK,EAAE,0BAA0B;gBACjC,QAAQ,EAAE,sIAAsI;aACjJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,KAAK,GAAG,kBAAkB,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/D,8FAA8F;QAC9F,0FAA0F;QAC1F,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,IAAI,4BAA4B,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QACtE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,cAAc,GAAG,MAAM,EAAE,WAAiC,CAAC;QACjE,MAAM,UAAU,GAAG,MAAM,EAAE,OAA6B,CAAC;QACzD,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,0DAA0D,EAAE,CAAC;QAC3G,CAAC;QACD,iGAAiG;QACjG,+CAA+C;QAC/C,+FAA+F;QAC/F,+FAA+F;QAC/F,MAAM,SAAS,GAAI,MAAM,EAAE,SAAgC;eACtD,YAAY,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,0DAA0D,EAAE,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,gGAAgG;QAChG,UAAU,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3J,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,wFAAwF;IACxF,sFAAsF;IACtF,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,cAAc,GAAG,MAAM,EAAE,WAAiC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,0CAA0C,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,SAAS,GAAI,MAAM,EAAE,SAAgC;eACtD,YAAY,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,0DAA0D,EAAE,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;QACpF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,KAA2B,CAAC;QACrD,MAAM,eAAe,GAAG,MAAM,EAAE,YAAkC,CAAC;QACnE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yDAAyD,EAAE,CAAC;QAC1G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,uFAAuF;IACvF,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACxE,MAAM,IAAI,GAAG,MAAM,EAAE,IAA0B,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,kBAAkB,GAAI,MAAM,EAAE,kBAA6B,IAAI,IAAI,CAAC;YAE1E,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yCAAyC,EAAE,CAAC;YAC1F,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,GAAI,MAAM,EAAE,aAAwB,IAAI,EAAE,CAAC;gBAC9D,MAAM,aAAa,GAAI,MAAM,EAAE,aAAwB,IAAI,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC5F,uCAAuC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;YAC/F,CAAC;iBAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAI,MAAM,EAAE,KAAgB,IAAI,aAAa,CAAC;gBACzD,MAAM,MAAM,GAAI,MAAM,EAAE,MAAiB,IAAI,KAAK,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxE,uCAAuC,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3F,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,gGAAgG;QAChG,8FAA8F;QAC9F,qFAAqF;QACrF,kGAAkG;QAClG,4FAA4F;QAC5F,2FAA2F;QAC3F,8FAA8F;QAC9F,oFAAoF;QACpF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3D,mFAAmF;QACnF,gGAAgG;QAChG,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kCAAkC,EAAE,CAAC;YAC/G,4FAA4F;YAC5F,gGAAgG;YAChG,gGAAgG;YAChG,8BAA8B;YAC9B,MAAM,KAAK,GAAI,MAAM,EAAE,MAAiB,IAAI,gBAAgB,CAAC,+BAA+B,CAAC;YAC7F,MAAM,KAAK,GAAsB;gBAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;gBACjC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACnC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,KAAK,EAAE,wBAAwB;oBAC/B,QAAQ,EACN,IAAI,KAAK,4DAA4D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;wBACzF,2FAA2F;iBAC9F,CAAC;YACJ,CAAC;YACD,aAAa,CAAC,SAAS,EAAE,SAAS,EAAG,MAAM,EAAE,kBAA6B,IAAI,EAAE,EAAE,KAAyB,CAAC,CAAC;YAC7G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACzE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yDAAyD,EAAE,CAAC;YAC1I,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAChD,oBAAoB,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,WAAW,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;YAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACvE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yDAAyD,EAAE,CAAC;YAC1I,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;YAC5C,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAClC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,gGAAgG;QAChG,mGAAmG;QACnG,oDAAoD;QACpD,QAAQ,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YAC7E,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,YAAY,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC7D,MAAM,qBAAqB,GAAI,MAAM,EAAE,kBAA6B,IAAI,EAAE,CAAC;YAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kCAAkC,EAAE,CAAC;YACnF,CAAC;YACD,qBAAqB,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,8FAA8F;YAC9F,+FAA+F;YAC/F,MAAM,kBAAkB,GAAG,MAAM,EAAE,kBAAwC,CAAC;YAC5E,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAChC,IAAI,KAAK;oBAAE,KAAK,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,yFAAyF;QACzF,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACxE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,MAA4B,CAAC;YACpD,MAAM,kBAAkB,GAAI,MAAM,EAAE,kBAA6B,IAAI,YAAY,CAAC;YAClF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,uCAAuC,EAAE,CAAC;YACxF,CAAC;YACD,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAqC,CAAC;YACnI,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;YACnD,EAAE,CAAC,OAAO,CACR,uIAAuI,CACxI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,oGAAoG;QACpG,kGAAkG;QAClG,gGAAgG;QAChG,QAAQ,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACrE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,EAAE,GAAyB,CAAC;YAC9C,MAAM,OAAO,GAAI,MAAM,EAAE,OAAkB,IAAI,OAAO,CAAC;YACvD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oCAAoC,EAAE,CAAC;YACrF,CAAC;YACD,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;YAClI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACH,CAAC,CAAC,2BAA2B;AAC/B,CAAC"}

package/dist/testing.d.ts

@@ -1,10 +0,0 @@
-/**
- * TEST-ONLY exports. Reachable as `@cello-protocol/daemon/testing`, deliberately NOT from the
- * package barrel (DOD-M9B-WIRE-1).
- *
- * `DaemonConfig.securityGateway` is REQUIRED (INV-9), so every caller needs a way to satisfy it —
- * including a test that deliberately does not screen. That test says so by importing from here.
- * The daemon's own barrel stays free of an always-allow client.
- */
-export { PassthroughGatewayClient } from "@cello-protocol/gateway/testing";
-//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/testing.js

@@ -1,10 +0,0 @@
-/**
- * TEST-ONLY exports. Reachable as `@cello-protocol/daemon/testing`, deliberately NOT from the
- * package barrel (DOD-M9B-WIRE-1).
- *
- * `DaemonConfig.securityGateway` is REQUIRED (INV-9), so every caller needs a way to satisfy it —
- * including a test that deliberately does not screen. That test says so by importing from here.
- * The daemon's own barrel stays free of an always-allow client.
- */
-export { PassthroughGatewayClient } from "@cello-protocol/gateway/testing";
-//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/transport-composition.d.ts

@@ -1,31 +0,0 @@
-/**
- * CELLO Daemon — transport-composition.ts (CELLO-M7-TRANSPORT-001)
- *
- * Composition-root selection of the transport adapters by CELLO_ENV. Per CLAUDE.md
- * the daemon composition root instantiates all adapters and fails fast at startup
- * (not at first session) when a production environment is missing required config.
- *
- *   'local' | 'test'                   → in-process stubs (no network).
- *   'dev' | 'staging' | 'production'   → real adapters; require their backing
- *                                         dependencies (a TransportDialer for the
- *                                         selector). Missing config → throw at
- *                                         startup naming what is missing (AC-010).
- */
-import { type ITransportSelector, type TransportDialer } from "./transport-selector.js";
-import type { Logger } from "./types.js";
-export type CelloEnv = "local" | "test" | "dev" | "staging" | "production";
-/** Resolve CELLO_ENV. Unknown/undefined defaults to 'local' (in-process stubs). */
-export declare function resolveCelloEnv(raw: string | undefined): CelloEnv;
-/** True for environments that require real (network-backed) transport adapters. */
-export declare function isProductionVariant(env: CelloEnv): boolean;
-/**
- * Build the transport selector for the given environment. Stub for local/test;
- * real TransportSelector for production variants (requires a TransportDialer).
- */
-export declare function createTransportSelector(opts: {
-    env: CelloEnv;
-    logger: Logger;
-    transportDialer?: TransportDialer;
-    directDialTimeoutMs?: number;
-}): ITransportSelector;
-//# sourceMappingURL=transport-composition.d.ts.map

package/dist/transport-composition.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport-composition.d.ts","sourceRoot":"","sources":["../src/transport-composition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3E,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAWjE;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,QAAQ,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,kBAAkB,CAcrB"}

package/dist/transport-composition.js

@@ -1,55 +0,0 @@
-/**
- * CELLO Daemon — transport-composition.ts (CELLO-M7-TRANSPORT-001)
- *
- * Composition-root selection of the transport adapters by CELLO_ENV. Per CLAUDE.md
- * the daemon composition root instantiates all adapters and fails fast at startup
- * (not at first session) when a production environment is missing required config.
- *
- *   'local' | 'test'                   → in-process stubs (no network).
- *   'dev' | 'staging' | 'production'   → real adapters; require their backing
- *                                         dependencies (a TransportDialer for the
- *                                         selector). Missing config → throw at
- *                                         startup naming what is missing (AC-010).
- */
-import { LocalTransportSelectorStub, TransportSelector, } from "./transport-selector.js";
-/** Resolve CELLO_ENV. Unknown/undefined defaults to 'local' (in-process stubs). */
-export function resolveCelloEnv(raw) {
-    switch (raw) {
-        case "local":
-        case "test":
-        case "dev":
-        case "staging":
-        case "production":
-            return raw;
-        default:
-            return "local";
-    }
-}
-/** True for environments that require real (network-backed) transport adapters. */
-export function isProductionVariant(env) {
-    return env === "dev" || env === "staging" || env === "production";
-}
-/**
- * Build the transport selector for the given environment. Stub for local/test;
- * real TransportSelector for production variants (requires a TransportDialer).
- */
-export function createTransportSelector(opts) {
-    const { env, logger, transportDialer, directDialTimeoutMs } = opts;
-    if (!isProductionVariant(env)) {
-        return new LocalTransportSelectorStub();
-    }
-    if (!transportDialer) {
-        throw new Error(`CELLO_ENV='${env}' requires a transport dialer (directory/relay-backed) for the ` +
-            `transport selector, but none was provided to the daemon composition root. The ` +
-            `transport selector cannot dial a counterparty without it — fix the daemon ` +
-            `configuration (config.transportDialer) before startup.`);
-    }
-    return new TransportSelector({ dialer: transportDialer, logger, directDialTimeoutMs });
-}
-// NOTE (CELLO-M7-TRANSPORT-001): there is no createAutoNatService here. The
-// daemon's runtime IAutoNatService is the NodeAutoNatService wrapping the standing
-// receiver node — that node is created inside startDaemon (after this composition
-// runs), so the AutoNAT service is resolved from SessionNodeManager.
-// getStandingReceiverAutoNat() rather than constructed in the composition root.
-// config.autoNatService remains an explicit test override.
-//# sourceMappingURL=transport-composition.js.map

package/dist/transport-composition.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"transport-composition.js","sourceRoot":"","sources":["../src/transport-composition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AAKjC,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,YAAY;YACf,OAAO,GAAG,CAAC;QACb;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,GAAa;IAC/C,OAAO,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC;IACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IACnE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,0BAA0B,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,cAAc,GAAG,iEAAiE;YAChF,gFAAgF;YAChF,4EAA4E;YAC5E,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,4EAA4E;AAC5E,mFAAmF;AACnF,kFAAkF;AAClF,qEAAqE;AACrE,gFAAgF;AAChF,2DAA2D"}