@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/directory-bootstrap.js

@@ -1,557 +0,0 @@
-/**
- * Directory endpoint bootstrap for the daemon.
- *
- * The logic lives here, not in the adapter: the daemon must not depend on the
- * adapter, which sits ABOVE it as a thin IPC proxy.
- *
- * Mechanism:
- *   1. resolveDirectoryUrl(env): CELLO_DIRECTORY_URL or a random bundled endpoint.
- *   2. GET ${url}/bootstrap → { multiaddr } containing "/p2p/<peerId>".
- *   3. The peer ID is the segment after the final "/p2p/" in the multiaddr.
- *
- * The resolver caches the first successful resolution and re-attempts on each
- * connect until it succeeds, so a daemon that starts before the directory is
- * reachable will connect once the bootstrap endpoint comes up (the transport
- * SignalingManager retries connect()).
- */
-import { BUNDLED_CONSORTIUM_MANIFEST } from "./bundled-consortium-manifest.js";
-import { extractErrorMessage } from "./error-message.js";
-/**
- * Production directory HTTP endpoint — the cold-boot fallback when CELLO_DIRECTORY_URL is unset.
- *
- * THIS MUST BE ONE OF THE `endpoint` VALUES IN THE BUNDLED MANIFEST, byte for byte. `buildManifestDeps`
- * loads the bundled roster only when the resolved directory URL matches a node in it, and otherwise
- * falls through to the pre-roster path with NO step-6 directory authentication — so a value that
- * merely reaches the same machine, such as a DNS name for the same host, silently disables the
- * defense against a MITM redirecting /bootstrap to a rogue directory. It fails open and quietly,
- * which is why the requirement is stated here rather than left to be rediscovered. That the match
- * is byte-exact and the miss is silent is `DOD-M15-STEP6-REPLAY-1` — tracked, not overlooked; the
- * TLS half that made a single bundled name possible at all is `DOD-M15-BOOTSTRAP-TLS-1`.
- *
- * A NAME as of 2026-09-10, and the condition the previous comment set is exactly what changed: it
- * said this "cannot be this constant until the manifest carries names", and the manifest now carries
- * names. Every node sits behind its own regional load balancer terminating TLS, and the bundled
- * roster moved to `https://directory-<region>.cello.mygentic.ai` in the same change. The two are
- * only ever correct together.
- *
- * No port: 443, and the balancer's URL map routes /bootstrap, /manifest, /health, /agent-lookup and
- * /registry to the node's HTTP listener while everything else — the libp2p WebSocket upgrade — goes
- * to the protocol listener. One port now serves what needed two.
- */
-export const PRODUCTION_DIRECTORY_URL = "https://directory-use1.cello.mygentic.ai";
-/**
- * The bundled manifest's endpoint list, used by resolveDirectoryUrl to distribute cold-boot
- * clients across the consortium instead of always landing on the same node.
- *
- * Import is lazy (inside the function) to avoid a circular dependency with bundled-consortium-manifest.
- * Extracted as a separate export for testing.
- */
-export function pickRandomBundledEndpoint(nodes) {
-    const endpoint = nodes[Math.floor(Math.random() * nodes.length)]["endpoint"];
-    return typeof endpoint === "string" ? endpoint : PRODUCTION_DIRECTORY_URL;
-}
-/**
- * Resolve the directory URL from the environment, falling back to a RANDOMLY SELECTED
- * bundled manifest endpoint when CELLO_DIRECTORY_URL is not set.
- *
- * Random, not fixed: every fresh daemon picks a different consortium node. Without this
- * all clients land on the same node (whichever `PRODUCTION_DIRECTORY_URL` names), and the
- * other nodes only ever appear as failover. That was fine with one user; it does not scale.
- *
- * The random pick changes on every process start. Daemons that are already running and have
- * established a directory connection are unaffected — they stay connected to their current node
- * and only re-pick on the next login/restart.
- */
-export function resolveDirectoryUrl(env = process.env) {
-    if (env["CELLO_DIRECTORY_URL"])
-        return env["CELLO_DIRECTORY_URL"];
-    return pickRandomBundledEndpoint(BUNDLED_CONSORTIUM_MANIFEST.nodes);
-}
-/**
- * DOD-M15-BOOTSTRAP-1 — retry budget for the bootstrap probe.
- *
- * Three attempts at 8 s, capped at 20 s in total. The numbers come from a measurement, not a guess:
- * over a mobile link one probe returned at **16.2 s** and another returned nothing in 30 s, while
- * the old code gave each node ONE attempt with a 5-second deadline. A packet lost during the TCP
- * handshake is abandoned inside the retransmit backoff, and the node is dropped from the roster —
- * for a normal user, on a normal lossy link, with nothing wrong anywhere in the system.
- *
- * A LONGER DEADLINE ALONE DOES NOT FIX IT, which is the counter-intuitive part and the reason this
- * is a retry rather than a bigger number: the win comes from a FRESH CONNECTION. Waiting 20 s on
- * the original socket keeps waiting on the same lost handshake; a new `fetch` starts a new one.
- *
- * The total cap exists so a genuinely dead node cannot hold startup for a minute — the roster has
- * other nodes to try, and spending 3 × 8 s on the first one delays reaching them.
- */
-const PROBE_ATTEMPTS = 3;
-const PROBE_TIMEOUT_MS = 8_000;
-const PROBE_TOTAL_BUDGET_MS = 20_000;
-/**
- * Failure classes worth a second look. A lost packet, a DNS server that blinked, a connection
- * refused during a node restart — all of these can succeed on a fresh connection moments later.
- *
- * `http_error` and `bad_response` are NOT here, deliberately: a 404, a 500, or a payload without a
- * `/p2p/` is a deterministic answer from a server that IS reachable. Retrying it spends the whole
- * budget to receive the same reply three times and delays every other node in the roster.
- */
-const RETRYABLE = new Set(["timeout", "connect_error", "dns_error"]);
-/** DNS-level getaddrinfo failures vs transport-level connection failures. */
-const DNS_CODES = new Set(["ENOTFOUND", "EAI_AGAIN"]);
-/** Walk an error's `cause` chain for the first Node `code` (undici nests the coded error). */
-function findErrorCode(err) {
-    let cur = err;
-    for (let depth = 0; depth < 5 && cur instanceof Error; depth++) {
-        const code = cur.code;
-        if (typeof code === "string")
-            return code;
-        cur = cur.cause;
-    }
-    return null;
-}
-function classifyFetchError(err) {
-    if (err instanceof Error && err.name === "AbortError")
-        return { reason: "timeout", detail: "AbortError" };
-    const code = findErrorCode(err);
-    if (code !== null) {
-        if (DNS_CODES.has(code))
-            return { reason: "dns_error", detail: code };
-        return { reason: "connect_error", detail: code };
-    }
-    return { reason: "connect_error", detail: extractErrorMessage(err) };
-}
-/**
- * The default: persistent. Used where nothing is waiting on the answer — the roster sweep, which
- * runs its nodes in parallel and would rather spend 16 s than drop a healthy node.
- */
-export const PERSISTENT_PROBE = {
-    attempts: PROBE_ATTEMPTS,
-    timeoutMs: PROBE_TIMEOUT_MS,
-    totalMs: PROBE_TOTAL_BUDGET_MS,
-};
-/**
- * FAIL-FAST, for the reconnect path — review F1, a regression the retry introduced.
- *
- * `createDirectoryEndpointResolver` runs on EVERY connect attempt, and the signaling stream turns
- * over roughly every 70 seconds. Giving that path the persistent budget meant a lossy link could
- * spend 16 s resolving before falling back to the last-known-good endpoint it already had — and
- * `outbound-sessions` waits only 10 s for signaling before giving up, so `cello_initiate_session`
- * would start returning `directory_signaling_timeout` where it used to get a usable endpoint in
- * time. A resilience fix that breaks the thing it was protecting.
- *
- * TWO PROBES AT 2 s, AND THE ARITHMETIC IS THE POINT. The blocked resolver has TWO legs inside that
- * one 10 s wait — the primary, and then the roster sweep, whose `Promise.all` waits for the slowest
- * node. So the budget has to fit TWICE: 2 × 2 s × 2 legs = 8 s, with headroom. A first attempt at
- * 4 s looked generous and was wrong for exactly this reason, and the test that now asserts it
- * against `SIGNALING_CONNECT_WAIT_MS` is what caught it.
- *
- * ISN'T 2 s TOO SHORT for a link where a probe was measured at 16.2 s? Yes — and that is the honest
- * answer rather than a problem. Inside a 10 s deadline you cannot afford a 16 s probe from either
- * leg, so pretending to try is how the deadline gets blown and the caller gets NOTHING. Failing fast
- * here preserves the thing that actually helps on a bad link: the last-known-good endpoint, and a
- * background sweep on the persistent budget that keeps the roster current without anyone waiting.
- *
- * The retry is still the mechanism — two probes means a second, FRESH connection, which is what
- * recovers a lost handshake. One would be the original defect.
- */
-export const FAST_PROBE = { attempts: 2, timeoutMs: 2_000, totalMs: 5_000 };
-export async function fetchBootstrapResult(directoryUrl, fetchFn = fetch, nowMs = Date.now, budget = PERSISTENT_PROBE) {
-    const started = nowMs();
-    let last = { ok: false, reason: "connect_error", detail: "no attempt was made" };
-    for (let attempt = 1; attempt <= budget.attempts; attempt++) {
-        last = await probeOnce(directoryUrl, fetchFn, budget.timeoutMs);
-        if (last.ok)
-            return { ...last, attempts: attempt };
-        if (!RETRYABLE.has(last.reason))
-            return { ...last, attempts: attempt };
-        // Stop if another full attempt cannot finish inside the budget — better to let the caller move
-        // on to the next node than to spend the remainder proving this one is still unreachable.
-        const spent = nowMs() - started;
-        if (attempt === budget.attempts || spent + budget.timeoutMs > budget.totalMs) {
-            return { ...last, attempts: attempt };
-        }
-    }
-    return { ...last, attempts: budget.attempts };
-}
-/**
- * ONE probe, on its OWN connection. Separated from the retry loop above precisely because the fresh
- * connection is the mechanism — each call is a new `fetch`, so a handshake lost in TCP backoff is
- * abandoned rather than waited out.
- */
-async function probeOnce(directoryUrl, fetchFn, timeoutMs) {
-    const bootstrapUrl = `${directoryUrl.replace(/\/$/, "")}/bootstrap`;
-    const ac = new AbortController();
-    const timeout = setTimeout(() => ac.abort(), timeoutMs);
-    try {
-        let resp;
-        try {
-            resp = await fetchFn(bootstrapUrl, { signal: ac.signal });
-        }
-        catch (err) {
-            return { ok: false, ...classifyFetchError(err) };
-        }
-        if (!resp.ok)
-            return { ok: false, reason: "http_error", detail: String(resp.status) };
-        let json;
-        try {
-            json = (await resp.json());
-        }
-        catch (err) {
-            /**
-             * AN ABORTED BODY READ IS A TIMEOUT, NOT A MALFORMED PAYLOAD — review F3.
-             *
-             * The deadline covers the body as well as the request, so a server that sends headers and
-             * then stalls — the ordinary shape of a lossy mobile link, which is this unit's entire
-             * subject — aborts inside `resp.json()`. Reporting that as `bad_response` was wrong twice:
-             * it sent the operator to inspect a payload that was never received, and `bad_response` is
-             * deliberately NOT retryable, so the node got one probe and was dropped. Precisely the
-             * outcome the retry exists to prevent, reached through the retry's own policy.
-             */
-            const classified = classifyFetchError(err);
-            if (classified.reason === "timeout" || ac.signal.aborted) {
-                // Both conditions, deliberately. The signal alone is what production sees when the deadline
-                // fires, but keying ONLY on it makes the behaviour depend on controller state rather than on
-                // what was actually thrown — untestable, and wrong the moment a body read aborts for any
-                // other reason. `classifyFetchError` already knows an AbortError is a timeout; reuse it
-                // rather than growing a second opinion about the same error.
-                return { ok: false, reason: "timeout", detail: classified.detail ?? "aborted reading the response body" };
-            }
-            return { ok: false, reason: "bad_response", detail: extractErrorMessage(err) };
-        }
-        if (typeof json.multiaddr === "string" && json.multiaddr.includes("/p2p/")) {
-            return { ok: true, multiaddr: json.multiaddr };
-        }
-        return { ok: false, reason: "bad_response", detail: "multiaddr missing or lacks /p2p/" };
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-/**
- * Auto-discover the directory multiaddr via GET /bootstrap on the directory HTTP
- * endpoint. Returns the multiaddr (which embeds the peer ID after "/p2p/"), or null.
- * Thin compatibility wrapper over fetchBootstrapResult (which carries the failure class).
- */
-export async function fetchBootstrapMultiaddr(directoryUrl, fetchFn = fetch) {
-    const result = await fetchBootstrapResult(directoryUrl, fetchFn);
-    return result.ok ? result.multiaddr : null;
-}
-/**
- * Extract the libp2p peer ID from a multiaddr — the segment after the final
- * "/p2p/". Returns null if absent.
- */
-export function parsePeerIdFromMultiaddr(multiaddr) {
-    const idx = multiaddr.lastIndexOf("/p2p/");
-    if (idx === -1)
-        return null;
-    const peerId = multiaddr.slice(idx + "/p2p/".length).split("/")[0];
-    return peerId && peerId.length > 0 ? peerId : null;
-}
-/**
- * Validate + normalise a manifest node `endpoint` to the HTTP(S) base used for its
- * `/bootstrap` probe, or return `null` if it is not a usable bootstrap base.
- *
- * CONTRACT: a manifest `endpoint` is the node's HTTP(S) `/bootstrap` base — production
- * directories serve `/bootstrap` over plaintext HTTP on port 9090, directly (there is no load
- * balancer in front of them), matching PRODUCTION_DIRECTORY_URL. 8080 on the same host speaks the
- * libp2p WebSocket upgrade and answers plain HTTP with 400, so pointing this at 8080 resolves as
- * zero reachable nodes from a perfectly valid manifest. The wss libp2p DIAL address is
- * returned BY `/bootstrap`; it is NOT the endpoint. Do NOT accept (or port-guess) a
- * `wss://host:443` value — mapping that to `http://host:443` speaks plaintext to the
- * TLS port and silently fails. Anything
- * that is not `http(s)://` (a bare multiaddr, a wss dial address, a typo) is a config
- * error in officer-SIGNED data: return null so the caller logs it DISTINCTLY from a
- * transient outage and never dials a wrong port. A single trailing slash is stripped
- * (fetchBootstrapMultiaddr appends `/bootstrap`).
- */
-export function mapEndpointToBootstrapBase(endpoint) {
-    const noSlash = endpoint.replace(/\/$/, "");
-    if (noSlash.startsWith("http://") || noSlash.startsWith("https://"))
-        return noSlash;
-    return null;
-}
-/**
- * Resolve every consortium node in the manifest's node set to a live directory
- * endpoint by probing each node's `/bootstrap` (in parallel, order preserved).
- *
- * AVAILABILITY-AWARE (the sovereign-node redundancy invariant): a node whose bootstrap is
- * unreachable is SKIPPED with a warning — one node down must never strand the others,
- * because a T-of-N ceremony only needs T of the N. Returns the resolved subset
- * (possibly empty). The CALLER decides whether the resolved count meets the threshold;
- * this function NEVER silently substitutes the single hardcoded endpoint for a missing
- * node — that would defeat sovereignty by masking a down/forged node as healthy.
- */
-export async function manifestNodesToEndpoints(nodes, opts) {
-    const fetchFn = opts.fetchFn ?? fetch;
-    const resolved = await Promise.all(nodes.map(async (node) => {
-        const base = mapEndpointToBootstrapBase(node.endpoint);
-        if (base === null) {
-            // PERMANENT config error in SIGNED manifest data — logged distinctly from a
-            // transient `unresolved` so a bad endpoint is never mistaken for a node that's
-            // merely down (fail loud, don't silently skip-as-if-outage).
-            opts.logger.error("directory.consortium.node.endpoint_invalid", {
-                nodeId: node.nodeId,
-                endpoint: node.endpoint,
-            });
-            return null;
-        }
-        const probe = await fetchBootstrapResult(base, fetchFn, Date.now, opts.probeBudget ?? PERSISTENT_PROBE);
-        if (!probe.ok) {
-            opts.logger.warn("directory.consortium.node.unresolved", {
-                nodeId: node.nodeId,
-                endpoint: node.endpoint,
-                reason: probe.reason,
-                detail: probe.detail,
-                // DOD-M15-BOOTSTRAP-1: how many probes were spent before giving up. Without it, a node
-                // dropped after one deterministic 404 and a node dropped after three timed-out probes on
-                // a lossy link read identically — and they call for opposite responses.
-                attempts: probe.attempts,
-            });
-            opts.onNodeUnresolved?.({
-                nodeId: node.nodeId,
-                endpoint: node.endpoint,
-                reason: probe.reason,
-                detail: probe.detail,
-                // Review F2: this is the OPERATOR SURFACE (it feeds cello_status), and it was left
-                // without the count while the log got it. This file's own comment says it: "a `warn` in
-                // the log is not a surface." One 404 and three timed-out probes are different problems.
-                attempts: probe.attempts,
-            });
-            return null;
-        }
-        /**
-         * DOD-M15-BOOTSTRAP-1 — a node that only answered on a RETRY is not the same as one that
-         * answered first time, and a silent success hides that difference.
-         *
-         * This is the operator's early warning: the link to that node is losing packets. Before the
-         * retry existed, the same conditions dropped it from the roster outright, and the log said
-         * only "unresolved". Reported at INFO, not WARN — nothing is wrong yet, and a warning that
-         * fires on a recovered probe would be noise.
-         */
-        if ((probe.attempts ?? 1) > 1) {
-            opts.logger.info("directory.consortium.node.resolved_after_retry", {
-                nodeId: node.nodeId,
-                endpoint: node.endpoint,
-                attempts: probe.attempts,
-                impact: "this node answered only after a repeated probe, which means the path to it is dropping packets; before the retry existed this node would have been skipped entirely",
-            });
-        }
-        const multiaddr = probe.multiaddr;
-        const peerId = parsePeerIdFromMultiaddr(multiaddr);
-        if (!peerId) {
-            opts.logger.error("directory.consortium.node.no_peer_id", { nodeId: node.nodeId, multiaddr });
-            return null;
-        }
-        // The manifest DECLARES this node's peer id, and it is inside the signed body — so when the
-        // plaintext /bootstrap probe answers with a different one, the signed roster and the live
-        // response disagree about who this node is. Refuse rather than dial.
-        //
-        // Without this the declared value was decorative: the client dialled whatever the probe
-        // returned and the signature covered a field nobody read. Step-6 still authenticates the
-        // directory by challenge, so this is defence in depth at the DIAL layer — it declines to open a
-        // connection to the wrong peer at all, instead of opening one and rejecting it a round later.
-        //
-        // Absent `peerId` is tolerated: manifests written before the field existed carry none, and
-        // treating "not declared" as "mismatch" would strand every node in them.
-        const declaredPeerId = node.peerId;
-        if (declaredPeerId && declaredPeerId !== peerId) {
-            opts.logger.error("directory.consortium.node.peer_id_mismatch", {
-                nodeId: node.nodeId,
-                declaredPeerId,
-                probePeerId: peerId,
-            });
-            return null;
-        }
-        return { nodeId: node.nodeId, pubkey: node.pubkey, peerId, multiaddr };
-    }));
-    return resolved.filter((e) => e !== null);
-}
-/**
- * Build an async `getDirectoryEndpoint` for createSignalingConnect.
- *
- * Re-resolves the bootstrap on EVERY call (i.e. every connect attempt) so a
- * directory address change — failover, DNS/port change, or peer-ID rotation — is
- * picked up on the next reconnect. The last successfully-resolved endpoint is kept
- * only as a fallback: if a fresh fetch fails, the resolver returns the last
- * known-good endpoint so a transient /bootstrap blip doesn't strand a working daemon.
- */
-export function createDirectoryEndpointResolver(opts) {
-    const directoryUrl = opts.directoryUrl ?? resolveDirectoryUrl();
-    const fetchFn = opts.fetchFn ?? fetch;
-    const staleFallback = opts.staleFallback ?? true;
-    let lastGood = null;
-    return async function getDirectoryEndpoint() {
-        // FAST_PROBE, not the persistent one: a caller is blocked on this. See its definition.
-        const probe = await fetchBootstrapResult(directoryUrl, fetchFn, Date.now, FAST_PROBE);
-        if (probe.ok) {
-            const multiaddr = probe.multiaddr;
-            const peerId = parsePeerIdFromMultiaddr(multiaddr);
-            if (peerId) {
-                // Log only when the resolved endpoint actually changes (avoids per-connect noise).
-                if (!lastGood || lastGood.multiaddr !== multiaddr) {
-                    opts.logger.info("directory.bootstrap.resolved", { directoryUrl, peerId });
-                }
-                lastGood = { peerId, multiaddr };
-                return lastGood;
-            }
-            opts.logger.error("directory.bootstrap.no_peer_id", { directoryUrl, multiaddr });
-        }
-        else {
-            opts.logger.warn("directory.bootstrap.unavailable", {
-                directoryUrl,
-                reason: probe.reason,
-                detail: probe.detail,
-            });
-        }
-        // Fresh resolution failed — reuse the last known-good endpoint if we have one AND stale fallback
-        // is enabled. When disabled (the failover-wrapper's primary probe), a fresh failure is reported
-        // as null so the roster can take over instead of the caller looping on a dead endpoint.
-        if (staleFallback && lastGood) {
-            opts.logger.warn("directory.bootstrap.using_last_known", { directoryUrl, peerId: lastGood.peerId });
-            return lastGood;
-        }
-        return null;
-    };
-}
-/** In-place-safe Fisher-Yates shuffle returning a NEW array (never mutates the input). */
-function fisherYatesShuffle(items) {
-    const out = items.slice();
-    for (let i = out.length - 1; i > 0; i--) {
-        const j = Math.floor(Math.random() * (i + 1));
-        [out[i], out[j]] = [out[j], out[i]];
-    }
-    return out;
-}
-/**
- * Wrap a single-node primary resolver with the consortium roster so the signaling
- * dialer (and the ceremony endpoint that shares this instance) route AROUND a down
- * primary directory node instead of retrying the single primary URL forever — the
- * sovereign-node REDUNDANCY invariant.
- *
- * Selection policy, per getDirectoryEndpoint() call:
- *   1. Sticky-until-fail — while riding a non-primary fallback, KEEP it as long as it's
- *      still in the reachable roster. Do NOT churn back to the primary when it recovers
- *      (no flapping / reconnect storm). The fallback's multiaddr is refreshed from the
- *      fresh roster match each call.
- *   2. Primary-first — otherwise try the configured node. This is also the healthy
- *      steady state: when the primary resolves, we return WITHOUT probing the roster
- *      (no per-connect roster cost while everything is nominal).
- *   3. Fallback — if the primary is down, fail over to a reachable roster member. The
- *      order is randomized (across the members other than the dead primary) so clients
- *      spread across the survivors. Emits directory.bootstrap.failover on a change so an
- *      operator sees the client is now running on a non-home node.
- *   4. Return null only when NOTHING resolves (primary down AND roster empty/absent) —
- *      the unchanged all-nodes-down failure mode, no crash.
- *
- * ONE instance is shared across the daemon's signaling connect and its ceremony
- * getDirectoryEndpoint so signaling + ceremonies stay on the SAME directory node and
- * fail over together (a coherent per-daemon directory selection).
- *
- * Scope note: stickiness here is by ROSTER REACHABILITY, not by observed connect success
- * — the resolver is not told whether a dial/auth against the returned endpoint actually
- * succeeded. A node whose /bootstrap resolves is served by that same node, so resolvable ≈
- * connectable in practice; only a live kill-primary failover test proves that presence
- * resolution, relay assignment, and the FROST ceremony all work against a non-home directory.
- */
-export function createRosterAwareEndpointResolver(opts) {
-    const shuffle = opts.shuffle ?? fisherYatesShuffle;
-    // The endpoint we last returned, and whether it is a non-primary fallback we're riding.
-    let current = null;
-    let stuckToFallback = false;
-    // The primary's own identity, learned whenever the primary last resolved. Used to EXCLUDE the
-    // primary from the fallback set even when `current` no longer points at it — a flapping primary
-    // whose independent roster probe still lists it must never be re-picked as its own fallback.
-    let primaryPeerId = null;
-    /** Pick a reachable roster member that is neither the current pointer nor the primary. */
-    function selectFallback(roster) {
-        const excluded = new Set([current?.peerId, primaryPeerId].filter((p) => !!p));
-        const others = roster.filter((e) => !excluded.has(e.peerId));
-        const ordered = shuffle(others.length > 0 ? others : roster);
-        const chosen = ordered[0];
-        const next = { peerId: chosen.peerId, multiaddr: chosen.multiaddr };
-        if (!current || current.peerId !== chosen.peerId) {
-            opts.logger.warn("directory.bootstrap.failover", {
-                from: current?.peerId ?? null,
-                to: chosen.peerId,
-                nodeId: chosen.nodeId,
-            });
-        }
-        current = next;
-        stuckToFallback = true;
-        return next;
-    }
-    return async function getDirectoryEndpoint() {
-        // 1. Sticky-until-fail: keep the current fallback while it is still reachable.
-        if (stuckToFallback && current) {
-            const roster = await opts.getConsortiumRoster();
-            const match = roster?.find((e) => e.peerId === current.peerId);
-            if (match) {
-                // Refresh the multiaddr from the fresh roster resolution; identity is unchanged.
-                current = { peerId: match.peerId, multiaddr: match.multiaddr };
-                return current;
-            }
-            // The fallback fell out of the reachable roster → re-select below.
-            opts.logger.warn("directory.bootstrap.failover.lost", { peerId: current.peerId });
-        }
-        // 2. Primary-first (and the healthy steady state — no roster probe once the primary is known
-        //    to be a consortium member).
-        const primary = await opts.primaryResolver();
-        if (primary) {
-            // A primary that RESOLVES but is not a MEMBER of this consortium is a black hole, and used to
-            // be a permanent one: failover triggered only on UNREACHABILITY, so the compiled-in default
-            // URL after a consortium move resolved forever while every connection died at step-6 identity
-            // auth with `key_not_in_manifest`. Reachability was never the right test.
-            //
-            // Checked against DECLARED manifest membership, never against the reachable roster. The
-            // roster is the set that answered /bootstrap just now; a genuine member that is momentarily
-            // down is absent from it, and disqualifying on that would route around a node that is merely
-            // restarting — turning a blip into a failover. Membership is also LOCAL, so this costs no
-            // probe at all and the healthy path is unchanged.
-            const members = opts.getManifestPeerIds?.() ?? null;
-            if (members && members.size > 0 && !members.has(primary.peerId)) {
-                opts.logger.warn("directory.bootstrap.primary.not_in_consortium", {
-                    peerId: primary.peerId,
-                    memberCount: members.size,
-                });
-                primaryPeerId = primary.peerId; // exclude it from the fallback pick below
-                const roster = await opts.getConsortiumRoster();
-                if (roster && roster.length > 0)
-                    return selectFallback(roster);
-                // No reachable member either — return null so the caller retries rather than hand back a
-                // directory we KNOW will reject us.
-                return null;
-            }
-            if (stuckToFallback) {
-                opts.logger.info("directory.bootstrap.failover", { to: primary.peerId, restored: true });
-            }
-            current = primary;
-            primaryPeerId = primary.peerId;
-            stuckToFallback = false;
-            return primary;
-        }
-        // 3. Primary is down → fail over to a reachable roster member (randomized order).
-        const roster = await opts.getConsortiumRoster();
-        if (roster && roster.length > 0) {
-            // Exclude the (now-dead/flapping) primary and the current pointer; any OTHER reachable member
-            // is valid. Falls back to the full roster only if excluding leaves nothing (all members are
-            // the excluded ones — e.g. the roster is just the primary itself).
-            const excluded = new Set([current?.peerId, primaryPeerId].filter((p) => !!p));
-            const others = roster.filter((e) => !excluded.has(e.peerId));
-            const ordered = shuffle(others.length > 0 ? others : roster);
-            const chosen = ordered[0];
-            const next = { peerId: chosen.peerId, multiaddr: chosen.multiaddr };
-            if (!current || current.peerId !== chosen.peerId) {
-                opts.logger.warn("directory.bootstrap.failover", {
-                    from: current?.peerId ?? null,
-                    to: chosen.peerId,
-                    nodeId: chosen.nodeId,
-                });
-            }
-            current = next;
-            stuckToFallback = true;
-            return next;
-        }
-        // 4. Nothing resolves.
-        return null;
-    };
-}
-//# sourceMappingURL=directory-bootstrap.js.map

package/dist/directory-bootstrap.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"directory-bootstrap.js","sourceRoot":"","sources":["../src/directory-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAG/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,0CAA0C,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAA6C;IAE7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC7E,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,IAAI,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,OAAO,yBAAyB,CAAC,2BAA2B,CAAC,KAA+C,CAAC,CAAC;AAChH,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAwC,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1G,6EAA6E;AAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAEtD,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,YAAY,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAI,GAAkC,CAAC,IAAI,CAAC;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC1G,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAgB;IAC3C,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,gBAAgB;IAC3B,OAAO,EAAE,qBAAqB;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,UAAwB,KAAK,EAC7B,QAAsB,IAAI,CAAC,GAAG,EAC9B,SAAsB,gBAAgB;IAEtC,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;IACxB,IAAI,IAAI,GAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAElG,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAEvE,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,KAAK,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QAChC,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,YAAoB,EAAE,OAAqB,EAAE,SAAiB;IACrF,MAAM,YAAY,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC;IACpE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QACxD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB;;;;;;;;;eASG;YACH,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzD,4FAA4F;gBAC5F,6FAA6F;gBAC7F,yFAAyF;gBACzF,wFAAwF;gBACxF,6DAA6D;gBAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,mCAAmC,EAAE,CAAC;YAC5G,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,UAAwB,KAAK;IAE7B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAgBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AA+CD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAgC,EAChC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAsC,EAAE;QAC3D,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,4EAA4E;YAC5E,+EAA+E;YAC/E,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,uFAAuF;gBACvF,yFAAyF;gBACzF,wEAAwE;gBACxE,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mFAAmF;gBACnF,wFAAwF;gBACxF,wFAAwF;gBACxF,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD;;;;;;;;WAQG;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBACjE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EACJ,qKAAqK;aACxK,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,4FAA4F;QAC5F,0FAA0F;QAC1F,qEAAqE;QACrE,EAAE;QACF,wFAAwF;QACxF,yFAAyF;QACzF,gGAAgG;QAChG,8FAA8F;QAC9F,EAAE;QACF,2FAA2F;QAC3F,yEAAyE;QACzE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,cAAc,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,cAAc;gBACd,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAoBD;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,IAAI,QAAQ,GAA6B,IAAI,CAAC;IAE9C,OAAO,KAAK,UAAU,oBAAoB;QACxC,uFAAuF;QACvF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAClC,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,mFAAmF;gBACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,YAAY;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QACD,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAgCD,0FAA0F;AAC1F,SAAS,kBAAkB,CAAI,KAAU;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,wFAAwF;IACxF,IAAI,OAAO,GAA6B,IAAI,CAAC;IAC7C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,aAAa,GAAkB,IAAI,CAAC;IAExC,0FAA0F;IAC1F,SAAS,cAAc,CAAC,MAA4B;QAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAC/C,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;gBAC7B,EAAE,EAAE,MAAM,CAAC,MAAM;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,UAAU,oBAAoB;QAGxC,+EAA+E;QAC/E,IAAI,eAAe,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAQ,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iFAAiF;gBACjF,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,6FAA6F;QAC7F,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,8FAA8F;YAC9F,4FAA4F;YAC5F,8FAA8F;YAC9F,0EAA0E;YAC1E,EAAE;YACF,wFAAwF;YACxF,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,IAAI,CAAC;YACpD,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW,EAAE,OAAO,CAAC,IAAI;iBAC1B,CAAC,CAAC;gBACH,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,0CAA0C;gBAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAChD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC/D,yFAAyF;gBACzF,oCAAoC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,GAAG,OAAO,CAAC;YAClB,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,eAAe,GAAG,KAAK,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,8FAA8F;YAC9F,4FAA4F;YAC5F,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBAC/C,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;oBAC7B,EAAE,EAAE,MAAM,CAAC,MAAM;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,eAAe,GAAG,IAAI,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uBAAuB;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/directory-connect.d.ts

@@ -1,27 +0,0 @@
-/**
- * How this daemon reaches a directory, and what it tells a relay about itself when it gets there.
- *
- * The relay-witness connect parameters — who is asking, over which circuit, with which online token
- * — and the default signaling connect that carries them. Also the single shared signaling manager,
- * which exists ONLY on the in-process test path: in production every agent dials its own, because
- * the directory routes by the pubkey that authenticated the stream.
- */
-import { SignalingManager, type CelloNode } from "@cello-protocol/transport";
-import type { KeyProvider } from "@cello-protocol/crypto";
-import type { Logger } from "./types.js";
-import type { DirectoryEndpoint } from "./signaling-connect.js";
-import type { RelayConnectParams } from "./session-node-manager.js";
-import { parseSessionAssignment } from "./session-assignment-parser.js";
-export interface DirectoryConnectDeps {
-    logger: Logger;
-    keyProviders: Map<string, KeyProvider>;
-    /** Test seam. Its ABSENCE is what puts the daemon on the production per-agent path. */
-    signalingConnect: ConstructorParameters<typeof SignalingManager>[0]["connect"] | undefined;
-    directoryEndpointResolver: (() => Promise<DirectoryEndpoint | null>) | undefined;
-}
-export declare function createDirectoryConnect(deps: DirectoryConnectDeps): {
-    buildRelayConnectParams: (agentName: string, assignment: NonNullable<ReturnType<typeof parseSessionAssignment>>) => Promise<RelayConnectParams | undefined>;
-    noSharedDirectoryNode: () => CelloNode | null;
-    sharedSignaling: SignalingManager | undefined;
-};
-//# sourceMappingURL=directory-connect.d.ts.map

package/dist/directory-connect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"directory-connect.d.ts","sourceRoot":"","sources":["../src/directory-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAsB,MAAM,2BAA2B,CAAC;AACjG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,uFAAuF;IACvF,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC3F,yBAAyB,EAAE,CAAC,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CAClF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB;yCASlD,MAAM,cACL,WAAW,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,KACjE,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;iCA6ER,SAAS,GAAG,IAAI;;EAgBnD"}