@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/delivery-open-registry.js

@@ -1,121 +0,0 @@
-/**
- * DOD-M12B-DELIVERY-QUIET-1 — which sessions this daemon's DOCUMENT DELIVERY worker is opening.
- *
- * ── THE LOOP THIS EXISTS TO BREAK ────────────────────────────────────────────────────────────────
- *
- * Two reachability triggers fire when a session comes up, and both are correct when a PEER caused
- * the session:
- *
- *   1. The initiator half — `onSessionOpened` in `initiate-session-handler.ts`, fired by the side
- *      that dialled.
- *   2. The inbound half — `dispatchSessionStateChangedWithTelegram` on `state === "created"`,
- *      fired by the side that accepted, which ALSO rings the conversation doorbell and pushes a
- *      Telegram notification.
- *
- * Either one calls `ReconcileScheduler.onReachable`, and that is not a nudge: it sets
- * `failures = 0` and `nextAttemptMs = 0` and sweeps every shared document immediately. The stated
- * rationale is sound — "the backoff modeled 'they do not answer', and here they demonstrably just
- * did" (SYNC-P5 R39 trigger 2) — but it is only sound when the peer caused the session.
- *
- * When the DELIVERY WORKER opened it, the "signal" is our own outbound act reflected back at us. We
- * learn nothing about the peer, and we wipe a backoff that a refusal — possibly that same peer's
- * refusal, seconds earlier — had just set. Then:
- *
- *   the sweep needs a session → it opens one → creation fires the trigger → the trigger zeroes the
- *   backoff and sweeps every document → the sweep needs sessions → …
- *
- * Measured 2026-08-17: 321 reconcile attempts in 85 minutes driving 53 sessions and 63 standing-
- * receiver rebuilds. After `DOD-SYNC-REFUSAL-BACKOFF-1` removed the refusal storm, still 55
- * attempts in 20 minutes with 0 refusals — the volume that fix did not reach is this trigger.
- *
- * ── WHY AN INTENT, KEYED ON THE PEER, AND NOT A SESSION ID ───────────────────────────────────────
- *
- * The obvious design is to record the session id the delivery worker opened. It does not work: the
- * id is minted by the DIRECTORY and only reaches the opener at the end of negotiation, whereas the
- * directory has already pushed the assignment to the counterparty — which, when both agents live on
- * one daemon (the measured configuration), is this same process. The inbound doorbell therefore
- * fires BEFORE the opener ever learns the id, so a session-id registry is always too late.
- *
- * So what is registered is the INTENT — "this local agent's delivery worker is opening a session
- * with this peer right now" — before negotiation starts, and released when the open returns.
- *
- * ── THE KNOWN IMPRECISION, STATED RATHER THAN HIDDEN ─────────────────────────────────────────────
- *
- * If a delivery open to peer P is in flight for agent A at the same instant A's OPERATOR opens a
- * session to the same P, the inbound half cannot tell the two assignments apart and will suppress
- * the operator's doorbell too. It is narrow (same local agent, same peer, overlapping windows) and
- * it costs one missed notification for a session the operator started themselves and is therefore
- * already watching. The alternative — suppressing nothing — is the storm. This is the same class of
- * accepted, journaled imprecision as the away-ack coalescing guard in `attendance-wiring.ts`.
- *
- * Counting, not a boolean: two documents can be delivering to the same peer concurrently, and a
- * boolean cleared by whichever finishes first would re-open the loop for the other.
- */
-/**
- * How long an entry may claim to be "in flight" before it is ignored.
- *
- * `openSessionAs` carries no deadline of its own, so a dial that never settles would leave the
- * intent registered and silence that peer's doorbell for the life of the process — a worse outage
- * than the storm this exists to stop. A dial that has been in flight for two minutes is not in
- * flight; it is stuck, and a stuck dial must not be able to mute anything.
- */
-export const DELIVERY_OPEN_STALE_MS = 120_000;
-export function createDeliveryOpenRegistry(now = Date.now) {
-    // Pubkeys reach this code from a wire assignment on one side and from a caller's parameter on the
-    // other, and those two do not agree on case. Lowercased at the boundary so a comparison here can
-    // never be the reason the suppression silently stops working.
-    //
-    // NUL separator, written as an escape rather than a raw byte: a literal U+0000 in the source made
-    // this file binary to git, so `git show` printed no diff for it at all and the one new module in
-    // the unit could not be reviewed through the normal path.
-    const key = (openerPubkey, targetPubkey) => `${openerPubkey.toLowerCase()}\u0000${targetPubkey.toLowerCase()}`;
-    // Start times, newest last. An array rather than a count so a stale entry can be dropped
-    // individually — a bare counter cannot tell which of two in-flight opens is the wedged one.
-    const opens = new Map();
-    const live = (k) => {
-        const all = opens.get(k);
-        if (all === undefined)
-            return [];
-        const cutoff = now() - DELIVERY_OPEN_STALE_MS;
-        const fresh = all.filter((startedAt) => startedAt > cutoff);
-        if (fresh.length === 0)
-            opens.delete(k);
-        else if (fresh.length !== all.length)
-            opens.set(k, fresh);
-        return fresh;
-    };
-    return {
-        begin(openerPubkey, targetPubkey) {
-            const k = key(openerPubkey, targetPubkey);
-            const startedAt = now();
-            opens.set(k, [...live(k), startedAt]);
-            let released = false;
-            return () => {
-                // Idempotent: a caller that releases twice must not drop someone else's entry and leave the
-                // doorbell suppressed for a peer whose open has not finished.
-                if (released)
-                    return;
-                released = true;
-                const remaining = opens.get(k);
-                if (remaining === undefined)
-                    return;
-                const at = remaining.indexOf(startedAt);
-                const next = at === -1 ? remaining : [...remaining.slice(0, at), ...remaining.slice(at + 1)];
-                if (next.length === 0)
-                    opens.delete(k);
-                else
-                    opens.set(k, next);
-            };
-        },
-        isDeliveryOpening(openerPubkey, targetPubkey) {
-            return live(key(openerPubkey, targetPubkey)).length > 0;
-        },
-        inFlight() {
-            let total = 0;
-            for (const k of [...opens.keys()])
-                total += live(k).length;
-            return total;
-        },
-    };
-}
-//# sourceMappingURL=delivery-open-registry.js.map

package/dist/delivery-open-registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delivery-open-registry.js","sourceRoot":"","sources":["../src/delivery-open-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAgCH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C,MAAM,UAAU,0BAA0B,CAAC,MAAoB,IAAI,CAAC,GAAG;IACrE,kGAAkG;IAClG,iGAAiG;IACjG,8DAA8D;IAC9D,EAAE;IACF,kGAAkG;IAClG,iGAAiG;IACjG,0DAA0D;IAC1D,MAAM,GAAG,GAAG,CAAC,YAAoB,EAAE,YAAoB,EAAU,EAAE,CACjE,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;IACrE,yFAAyF;IACzF,4FAA4F;IAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE1C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAY,EAAE;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,sBAAsB,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACnC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,YAAY,EAAE,YAAY;YAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,OAAO,GAAG,EAAE;gBACV,4FAA4F;gBAC5F,8DAA8D;gBAC9D,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO;gBACpC,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACxC,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC7F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;;oBAClC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,YAAY,EAAE,YAAY;YAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,QAAQ;YACN,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/delivery-session-suspects.d.ts

@@ -1,56 +0,0 @@
-/**
- * DOD-MP-SESSION-RETIRE-1, the remaining half — route around a session that keeps refusing,
- * WITHOUT destroying anything.
- *
- * ── WHY NOT JUST ADD THE STRING TO THE TERMINAL SET ───────────────────────────────────────────
- *
- * The fully-sealed case answers **`relay_session_gone`**, and the obvious fix is to add it to
- * `TERMINAL_RELAY_REFUSALS` so the session is retired like `session_sealed`. That is refused, on
- * evidence: `relay-node.ts` defaults to `InMemoryRelayStore`, so a relay restart or a MIG roll
- * wipes every session it holds and every client is then told `relay_session_gone` for sessions that
- * are perfectly alive. Made terminal, one relay bounce would retire every live session on every
- * client — an unreachable node making the system unusable instead of being routed around, which is
- * the sovereign-node invariant exactly inverted.
- *
- * The string conflates two facts — *"this session is over"* and *"the relay lost its memory"* — and
- * destroying durable local state on the ambiguous one is wrong under one of the two readings.
- *
- * ── WHAT THIS DOES INSTEAD ────────────────────────────────────────────────────────────────────
- *
- * Nothing is retired, marked, or deleted. A session that has refused repeatedly simply stops being
- * REUSED by document delivery, so the next acquire opens a fresh one. That is correct under BOTH
- * readings: if the session really is finished, delivery routes around it; if the relay merely
- * bounced, the cost is one extra session and the old one remains untouched — still listed, still
- * usable by the conversation path, still holding its record.
- *
- * DELIBERATELY IN MEMORY. This is a routing hint, not a judgement about the session, and a restart
- * is precisely when a stale local opinion should be discarded rather than preserved. Nothing here
- * belongs in the database; putting it there would be the destructive fix wearing a smaller hat.
- */
-/**
- * The refusals that say something about THE SESSION rather than about the peer.
- *
- * `relay_session_gone` is here and NOT in `TERMINAL_RELAY_REFUSALS` — that separation is the unit.
- * An offline counterparty is excluded on purpose: abandoning a session because the far end is
- * asleep would open a fresh session on every sweep for as long as they stay away.
- */
-export declare const TERMINAL_ISH_REFUSALS: ReadonlySet<string>;
-/** Consecutive terminal-ish refusals before delivery stops reusing a session. */
-export declare const SUSPECT_THRESHOLD = 2;
-/** Bounded so a long-lived daemon cannot accumulate a row per session it ever gave up on. */
-export declare const SUSPECT_MAX_TRACKED = 256;
-export interface SessionSuspects {
-    /** Record a refusal. Only terminal-ish reasons count toward suspicion. */
-    noteFailure(sessionId: string, reason: string): void;
-    /** A send worked — the run is broken, so the count resets. */
-    noteSuccess(sessionId: string): void;
-    /** Should document delivery avoid REUSING this session? */
-    isSuspect(sessionId: string): boolean;
-    /** Tracked-session count, for the bound's test. */
-    size(): number;
-}
-export declare function createSessionSuspects(opts?: {
-    threshold?: number;
-    maxTracked?: number;
-}): SessionSuspects;
-//# sourceMappingURL=delivery-session-suspects.d.ts.map

package/dist/delivery-session-suspects.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delivery-session-suspects.d.ts","sourceRoot":"","sources":["../src/delivery-session-suspects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CASpD,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACrD,8DAA8D;IAC9D,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,2DAA2D;IAC3D,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACtC,mDAAmD;IACnD,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACrD,eAAe,CAyCjB"}

package/dist/delivery-session-suspects.js

@@ -1,94 +0,0 @@
-/**
- * DOD-MP-SESSION-RETIRE-1, the remaining half — route around a session that keeps refusing,
- * WITHOUT destroying anything.
- *
- * ── WHY NOT JUST ADD THE STRING TO THE TERMINAL SET ───────────────────────────────────────────
- *
- * The fully-sealed case answers **`relay_session_gone`**, and the obvious fix is to add it to
- * `TERMINAL_RELAY_REFUSALS` so the session is retired like `session_sealed`. That is refused, on
- * evidence: `relay-node.ts` defaults to `InMemoryRelayStore`, so a relay restart or a MIG roll
- * wipes every session it holds and every client is then told `relay_session_gone` for sessions that
- * are perfectly alive. Made terminal, one relay bounce would retire every live session on every
- * client — an unreachable node making the system unusable instead of being routed around, which is
- * the sovereign-node invariant exactly inverted.
- *
- * The string conflates two facts — *"this session is over"* and *"the relay lost its memory"* — and
- * destroying durable local state on the ambiguous one is wrong under one of the two readings.
- *
- * ── WHAT THIS DOES INSTEAD ────────────────────────────────────────────────────────────────────
- *
- * Nothing is retired, marked, or deleted. A session that has refused repeatedly simply stops being
- * REUSED by document delivery, so the next acquire opens a fresh one. That is correct under BOTH
- * readings: if the session really is finished, delivery routes around it; if the relay merely
- * bounced, the cost is one extra session and the old one remains untouched — still listed, still
- * usable by the conversation path, still holding its record.
- *
- * DELIBERATELY IN MEMORY. This is a routing hint, not a judgement about the session, and a restart
- * is precisely when a stale local opinion should be discarded rather than preserved. Nothing here
- * belongs in the database; putting it there would be the destructive fix wearing a smaller hat.
- */
-/**
- * The refusals that say something about THE SESSION rather than about the peer.
- *
- * `relay_session_gone` is here and NOT in `TERMINAL_RELAY_REFUSALS` — that separation is the unit.
- * An offline counterparty is excluded on purpose: abandoning a session because the far end is
- * asleep would open a fresh session on every sweep for as long as they stay away.
- */
-export const TERMINAL_ISH_REFUSALS = new Set([
-    "session_sealed",
-    "session_not_found",
-    "relay_session_gone",
-    // DOD-M15-TERMINAL-REASON-1: the relay now names WHY it ended a session, and this set was keyed
-    // on the old catch-all literal. A merits refusal must count as a suspect here for the same reason
-    // `session_sealed` does — the session is over and a document that keeps being pushed down it is
-    // being pushed at nothing.
-    "seal_refused",
-]);
-/** Consecutive terminal-ish refusals before delivery stops reusing a session. */
-export const SUSPECT_THRESHOLD = 2;
-/** Bounded so a long-lived daemon cannot accumulate a row per session it ever gave up on. */
-export const SUSPECT_MAX_TRACKED = 256;
-export function createSessionSuspects(opts = {}) {
-    const threshold = opts.threshold ?? SUSPECT_THRESHOLD;
-    const maxTracked = opts.maxTracked ?? SUSPECT_MAX_TRACKED;
-    // Insertion-ordered, so the oldest entry is the first key — a Map is the eviction order already.
-    const runs = new Map();
-    return {
-        noteFailure(sessionId, reason) {
-            if (!TERMINAL_ISH_REFUSALS.has(reason))
-                return;
-            const next = (runs.get(sessionId) ?? 0) + 1;
-            // Re-insert so a session we are actively judging is the LAST to be evicted; otherwise the
-            // bound could drop the very session about to cross the threshold.
-            runs.delete(sessionId);
-            runs.set(sessionId, next);
-            while (runs.size > maxTracked) {
-                const oldest = runs.keys().next();
-                if (oldest.done === true)
-                    break;
-                runs.delete(oldest.value);
-            }
-        },
-        noteSuccess(sessionId) {
-            runs.delete(sessionId);
-        },
-        isSuspect(sessionId) {
-            const run = runs.get(sessionId) ?? 0;
-            // TOUCH ON READ. Re-inserting only on FAILURE protects a session that keeps failing, and gets
-            // the crossed-threshold case exactly backwards: once a session is suspect it is filtered out
-            // of the candidate list, so it never fails again, ages to the front of the insertion order,
-            // and is evicted FIRST — silently un-suspecting itself. Measured in review: a suspect session
-            // followed by 256 others came back not-suspect. Every acquire asks about each candidate, so
-            // reading is the signal that this judgement is still in use.
-            if (run > 0) {
-                runs.delete(sessionId);
-                runs.set(sessionId, run);
-            }
-            return run >= threshold;
-        },
-        size() {
-            return runs.size;
-        },
-    };
-}
-//# sourceMappingURL=delivery-session-suspects.js.map

package/dist/delivery-session-suspects.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delivery-session-suspects.js","sourceRoot":"","sources":["../src/delivery-session-suspects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,gBAAgB;IAChB,mBAAmB;IACnB,oBAAoB;IACpB,gGAAgG;IAChG,kGAAkG;IAClG,gGAAgG;IAChG,2BAA2B;IAC3B,cAAc;CACf,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAavC,MAAM,UAAU,qBAAqB,CACnC,OAAoD,EAAE;IAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,iGAAiG;IACjG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,OAAO;QACL,WAAW,CAAC,SAAiB,EAAE,MAAc;YAC3C,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO;YAC/C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,0FAA0F;YAC1F,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;oBAAE,MAAM;gBAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,WAAW,CAAC,SAAiB;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QACD,SAAS,CAAC,SAAiB;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrC,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,8FAA8F;YAC9F,4FAA4F;YAC5F,6DAA6D;YAC7D,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,GAAG,IAAI,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI;YACF,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/directory-auth-posture.d.ts

@@ -1,87 +0,0 @@
-/**
- * DOD-M15-DIRAUTH-1 — directory authentication cannot be silently skipped.
- *
- * ─── The map, grepped rather than assumed ──────────────────────────────────────────────────────
- *
- *   DECIDED   `manifest-deps.ts` builds a challenge verifier ONLY when the resolved directory URL
- *             byte-matches a bundled endpoint; otherwise it returns `{}` and logs
- *             `daemon.manifest.bundled.skipped` once at startup.
- *   ENFORCED  `signaling-connect.ts` step 6 — `if (verifier) { … }`. With a verifier it fails CLOSED
- *             correctly: missing proof throws, bad signature throws.
- *   SKIPPED   the same `if (verifier)`. Without one the block is stepped over on every connect and
- *             every reconnect, and nothing is logged at that site at all.
- *
- * NOT the live path, despite a comment claiming it is: `signaling-manager.ts`'s `processStep5Frame`
- * has no production caller. Its `no_challenge_verifier` branch returns silently and nothing reaches
- * it. Mistaking that for the enforcement point is the error this header exists to prevent.
- *
- * ─── Why the skip exists, and why it is still a hole ───────────────────────────────────────────
- *
- * The bundled manifest is the trust anchor for the PRODUCTION consortium only. Local dev and the
- * e2e harness run their own directory on 127.0.0.1, which the bundle cannot describe, so enforcing
- * there would reject every connection. The skip is correct for them.
- *
- * The hole is the test itself. It compares against the bundled roster after NORMALISATION — trimmed,
- * trailing slash dropped, lowercased (`manifest-deps.ts`) — so case and a trailing slash are
- * forgiven. **A DNS name pointing at the very same machine is not**, so an operator doing the most
- * natural thing available — putting a hostname in `CELLO_DIRECTORY_URL` — silently loses directory
- * identity authentication.
- *
- * (Review F7: this said "byte-equality" three times, including in operator-facing text. An operator
- * told that would hunt a trailing slash or a capital letter — both of which are tolerated — and not
- * find it.)
- * The DoD line is explicit that this is a workaround rather than a fix: *"That is why the production
- * directory URL is a raw IP."*
- *
- * Step 6 is what stops a `/bootstrap` MITM redirecting failover to a rogue directory — precisely, it
- * CONVERTS the redirect into a refused connection: the rogue host cannot produce a signature over
- * `nodeId ‖ our agent pubkey ‖ nonce ‖ timestamp` without a manifest node's private key, so the
- * connect throws and the failover resolver moves on. The attacker keeps denial-of-service; they do
- * not get impersonation. Without step 6 the client authenticates to whatever answers.
- *
- * ─── Scope ─────────────────────────────────────────────────────────────────────────────────────
- *
- * This does not remove the skip. It makes it impossible to MISS (the posture is stated in the agent
- * response, both directions) and makes it REFUSABLE (`CELLO_REQUIRE_DIRECTORY_AUTH`). Resolving the
- * bootstrap coordinate over an authenticated channel is the line's second bullet, and is carried.
- */
-/**
- * Should a missing challenge verifier be a REFUSAL rather than a skip?
- *
- * Default OFF, and that is not timidity: enforcing unconditionally would reject every local-dev and
- * e2e connection, since those directories cannot be described by the bundled manifest at all.
- *
- * The parsing is deliberately lopsided — anything set that is not an explicit negative counts as ON.
- * A security opt-in that silently fails to apply is worse than not offering one: an operator who
- * writes `CELLO_REQUIRE_DIRECTORY_AUTH=yes` believes they have demanded authentication, and a
- * parser that recognised only `1`/`true` would hand them the permissive default while they believed
- * the opposite. Getting it wrong in the safe direction costs a startup error the operator can read.
- */
-export declare function directoryAuthRequired(env: Record<string, string | undefined>): boolean;
-/**
- * The posture, for `cello_status`.
- *
- * NOTE the inversion from the rest of this milestone: here the healthy case DOES contribute a field.
- * Everywhere else a field on the good path is furniture that teaches the reader to skip the block
- * that matters — but the whole defect being fixed is that ON and OFF are distinguished only by the
- * absence of a log line nobody reads. "I checked, and it is on" has to be an answer an operator can
- * actually obtain. Only the GUIDANCE is conditional.
- */
-export declare function describeDirectoryAuth(opts: {
-    verifierPresent: boolean;
-    directoryUrl: string;
-    /**
-     * Did the operator actually SET `CELLO_DIRECTORY_URL` — review F5.
-     *
-     * With it unset, `resolveDirectoryUrl` returns a RANDOM bundled endpoint, freshly picked on every
-     * call. So the first cut printed a different URL on consecutive status reads, and worse, the
-     * refusal asserted *"the usual cause is a DNS hostname"* while quoting a URL that IS a bundled
-     * endpoint — naming a cause that could not have produced the state it was describing. Exactly the
-     * error-substitution class this milestone exists to kill.
-     *
-     * When it is unset there is no configured URL to blame, and the honest explanation is different:
-     * no challenge verifier was supplied to this daemon at all.
-     */
-    urlExplicitlyConfigured?: boolean;
-}): Record<string, unknown>;
-//# sourceMappingURL=directory-auth-posture.d.ts.map

package/dist/directory-auth-posture.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"directory-auth-posture.d.ts","sourceRoot":"","sources":["../src/directory-auth-posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAKH;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAMtF;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsD1B"}

package/dist/directory-auth-posture.js

@@ -1,134 +0,0 @@
-/**
- * DOD-M15-DIRAUTH-1 — directory authentication cannot be silently skipped.
- *
- * ─── The map, grepped rather than assumed ──────────────────────────────────────────────────────
- *
- *   DECIDED   `manifest-deps.ts` builds a challenge verifier ONLY when the resolved directory URL
- *             byte-matches a bundled endpoint; otherwise it returns `{}` and logs
- *             `daemon.manifest.bundled.skipped` once at startup.
- *   ENFORCED  `signaling-connect.ts` step 6 — `if (verifier) { … }`. With a verifier it fails CLOSED
- *             correctly: missing proof throws, bad signature throws.
- *   SKIPPED   the same `if (verifier)`. Without one the block is stepped over on every connect and
- *             every reconnect, and nothing is logged at that site at all.
- *
- * NOT the live path, despite a comment claiming it is: `signaling-manager.ts`'s `processStep5Frame`
- * has no production caller. Its `no_challenge_verifier` branch returns silently and nothing reaches
- * it. Mistaking that for the enforcement point is the error this header exists to prevent.
- *
- * ─── Why the skip exists, and why it is still a hole ───────────────────────────────────────────
- *
- * The bundled manifest is the trust anchor for the PRODUCTION consortium only. Local dev and the
- * e2e harness run their own directory on 127.0.0.1, which the bundle cannot describe, so enforcing
- * there would reject every connection. The skip is correct for them.
- *
- * The hole is the test itself. It compares against the bundled roster after NORMALISATION — trimmed,
- * trailing slash dropped, lowercased (`manifest-deps.ts`) — so case and a trailing slash are
- * forgiven. **A DNS name pointing at the very same machine is not**, so an operator doing the most
- * natural thing available — putting a hostname in `CELLO_DIRECTORY_URL` — silently loses directory
- * identity authentication.
- *
- * (Review F7: this said "byte-equality" three times, including in operator-facing text. An operator
- * told that would hunt a trailing slash or a capital letter — both of which are tolerated — and not
- * find it.)
- * The DoD line is explicit that this is a workaround rather than a fix: *"That is why the production
- * directory URL is a raw IP."*
- *
- * Step 6 is what stops a `/bootstrap` MITM redirecting failover to a rogue directory — precisely, it
- * CONVERTS the redirect into a refused connection: the rogue host cannot produce a signature over
- * `nodeId ‖ our agent pubkey ‖ nonce ‖ timestamp` without a manifest node's private key, so the
- * connect throws and the failover resolver moves on. The attacker keeps denial-of-service; they do
- * not get impersonation. Without step 6 the client authenticates to whatever answers.
- *
- * ─── Scope ─────────────────────────────────────────────────────────────────────────────────────
- *
- * This does not remove the skip. It makes it impossible to MISS (the posture is stated in the agent
- * response, both directions) and makes it REFUSABLE (`CELLO_REQUIRE_DIRECTORY_AUTH`). Resolving the
- * bootstrap coordinate over an authenticated channel is the line's second bullet, and is carried.
- */
-/** Private/loopback ranges — a directory here is local dev or the e2e harness, by design. */
-const LOCAL_URL = /^https?:\/\/(localhost|127\.|\[::1\]|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/;
-/**
- * Should a missing challenge verifier be a REFUSAL rather than a skip?
- *
- * Default OFF, and that is not timidity: enforcing unconditionally would reject every local-dev and
- * e2e connection, since those directories cannot be described by the bundled manifest at all.
- *
- * The parsing is deliberately lopsided — anything set that is not an explicit negative counts as ON.
- * A security opt-in that silently fails to apply is worse than not offering one: an operator who
- * writes `CELLO_REQUIRE_DIRECTORY_AUTH=yes` believes they have demanded authentication, and a
- * parser that recognised only `1`/`true` would hand them the permissive default while they believed
- * the opposite. Getting it wrong in the safe direction costs a startup error the operator can read.
- */
-export function directoryAuthRequired(env) {
-    const raw = env["CELLO_REQUIRE_DIRECTORY_AUTH"];
-    if (raw === undefined)
-        return false;
-    const v = raw.trim().toLowerCase();
-    if (v === "" || v === "0" || v === "false" || v === "no" || v === "off")
-        return false;
-    return true;
-}
-/**
- * The posture, for `cello_status`.
- *
- * NOTE the inversion from the rest of this milestone: here the healthy case DOES contribute a field.
- * Everywhere else a field on the good path is furniture that teaches the reader to skip the block
- * that matters — but the whole defect being fixed is that ON and OFF are distinguished only by the
- * absence of a log line nobody reads. "I checked, and it is on" has to be an answer an operator can
- * actually obtain. Only the GUIDANCE is conditional.
- */
-export function describeDirectoryAuth(opts) {
-    if (opts.verifierPresent) {
-        return { directory_authentication: "enforced" };
-    }
-    const configured = opts.urlExplicitlyConfigured !== false;
-    // NORMALISE FIRST — review F6. `manifest-deps.ts` applies its local/public test to the normalised
-    // URL; applying it to the raw one here made the two classifiers disagree on `HTTP://127.0.0.1`
-    // (the regex is case-sensitive) and on a leading space from a .env or compose value. The result
-    // was the rogue-directory alarm firing on a loopback dev run — a signal on the designed case.
-    const expected = LOCAL_URL.test(opts.directoryUrl.trim().toLowerCase());
-    return {
-        directory_authentication: "disabled",
-        /**
-         * Two very different situations, which must not read the same.
-         *
-         * A loopback or private address is local dev or the e2e harness pointing at its own directory —
-         * designed, and an alarm there would fire on every local run. Anything else is a client talking
-         * to a PUBLIC directory with identity authentication off, which is weaker than its operator
-         * believes, and the only previous signal was the absence of a log line.
-         */
-        directory_authentication_expected: expected,
-        // Only reported when the operator actually chose it. An unset CELLO_DIRECTORY_URL yields a fresh
-        // RANDOM bundled endpoint per call, and printing that as "the directory URL" invites an operator
-        // to debug a value nothing decided anything from (review F5).
-        ...(configured ? { directory_authentication_directory_url: opts.directoryUrl } : {}),
-        directory_authentication_guidance: !configured
-            ? "Directory identity authentication (step 6) is OFF: no challenge verifier was supplied to " +
-                "this daemon, and CELLO_DIRECTORY_URL is not set, so there is no configured directory URL " +
-                "to have failed the roster match. This is the shape an in-process embedder or a test harness " +
-                "produces. A daemon started through the normal CLI builds a verifier automatically when its " +
-                "directory URL matches the bundled roster."
-            : expected
-                ? `Directory identity authentication (step 6) is OFF because ${opts.directoryUrl} is a local ` +
-                    "address, which the bundled consortium manifest cannot describe. This is the designed " +
-                    "configuration for local development and the e2e harness — enforcing here would reject " +
-                    "every connection. To turn it on, supply a matching manifest with CELLO_CONSORTIUM_MANIFEST " +
-                    "AND CELLO_CONSORTIUM_ROOT_KEYS AND CELLO_CONSORTIUM_THRESHOLD — all three are required " +
-                    "together, and setting only the first makes the daemon refuse to start with a different error."
-                : `Directory identity authentication (step 6) is OFF, because ${opts.directoryUrl} is not ` +
-                    "in the bundled consortium manifest after normalisation (trimmed, trailing slash dropped, " +
-                    "lowercased — so case and a trailing slash are forgiven). This client is weaker than " +
-                    "it looks: step 6 is what stops a MITM on the plaintext /bootstrap endpoint redirecting " +
-                    "failover to a ROGUE DIRECTORY, and without it this daemon will authenticate to whatever " +
-                    "answers. The usual cause is a HOSTNAME — normalisation forgives case and slashes but not " +
-                    "DNS, so a name pointing at exactly the right machine still does not match, which is why the " +
-                    "production " +
-                    "directory URL is a raw address. Either use a bundled endpoint address, or supply a matching " +
-                    "manifest with CELLO_CONSORTIUM_MANIFEST AND CELLO_CONSORTIUM_ROOT_KEYS AND " +
-                    "CELLO_CONSORTIUM_THRESHOLD — all three are required together, and setting only the first " +
-                    "makes the daemon refuse to start with a different error. Set CELLO_REQUIRE_DIRECTORY_AUTH=1 " +
-                    "to refuse to start rather than run without step 6; to turn that demand back off set it to " +
-                    "0, false, no or off (an unrecognised value counts as ON, deliberately).",
-    };
-}
-//# sourceMappingURL=directory-auth-posture.js.map

package/dist/directory-auth-posture.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"directory-auth-posture.js","sourceRoot":"","sources":["../src/directory-auth-posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,6FAA6F;AAC7F,MAAM,SAAS,GAAG,iFAAiF,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAgBrC;IACC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,KAAK,KAAK,CAAC;IAC1D,kGAAkG;IAClG,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,wBAAwB,EAAE,UAAU;QACpC;;;;;;;WAOG;QACH,iCAAiC,EAAE,QAAQ;QAC3C,iGAAiG;QACjG,iGAAiG;QACjG,8DAA8D;QAC9D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,sCAAsC,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,iCAAiC,EAAE,CAAC,UAAU;YAC5C,CAAC,CAAC,2FAA2F;gBAC3F,2FAA2F;gBAC3F,8FAA8F;gBAC9F,6FAA6F;gBAC7F,2CAA2C;YAC7C,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,6DAA6D,IAAI,CAAC,YAAY,cAAc;oBAC5F,uFAAuF;oBACvF,wFAAwF;oBACxF,6FAA6F;oBAC7F,yFAAyF;oBACzF,+FAA+F;gBACjG,CAAC,CAAC,8DAA8D,IAAI,CAAC,YAAY,UAAU;oBACzF,2FAA2F;oBAC3F,sFAAsF;oBACtF,yFAAyF;oBACzF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,8FAA8F;oBAC9F,aAAa;oBACb,8FAA8F;oBAC9F,6EAA6E;oBAC7E,2FAA2F;oBAC3F,8FAA8F;oBAC9F,4FAA4F;oBAC5F,yEAAyE;KAC9E,CAAC;AACJ,CAAC"}