@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/held-content.js

@@ -1,389 +0,0 @@
-import { extractErrorMessage } from "./error-message.js";
-export class HeldContent {
-    #ctx;
-    constructor(ctx) {
-        this.#ctx = ctx;
-    }
-    /** A getter so the moved queries still read `this.#db` and narrow exactly as they did. */
-    get #db() {
-        return this.#ctx.db();
-    }
-    #heldRestored = new Set();
-    #heldReleased = new Set();
-    /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
-     *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
-     *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
-     *  exceeding it once #releaseHeld drains them. */
-    getHeldBytesTotal(agentName, sessionId) {
-        // DOD-M12B-STRAND-1: hydrate first. Reading the Map before the durable holds are back
-        // under-counts, and this gate exists to stop several held chunks each passing the size cap
-        // individually while cumulatively exceeding it — an under-count is the bypass.
-        this.ensureHeldRestored(agentName, sessionId);
-        const held = this.#ctx.heldContent.get(this.#ctx.sessionKey(agentName, sessionId));
-        if (!held)
-            return 0;
-        let total = 0;
-        for (const entry of held.values())
-            total += entry.content.length;
-        return total;
-    }
-    /**
-     * DOD-M12B-STRAND-1 — restore this session's held frames into memory.
-     *
-     * Called when a session node is (re)created, which is the moment the session becomes able to
-     * append again. Loading at daemon boot instead would be wrong for the same reason the old code
-     * was wrong: a frame is only releasable against a tree, and the tree is loaded per session.
-     *
-     * A frame whose content the tree ALREADY HOLDS at that position is dropped — re-appending it
-     * would change the root a seal signs over. That test is `hashAt`, not `canonical_seq < frontier`:
-     * the two counters are different spaces and this file documents them drifting, so the index
-     * comparison alone would destroy a frame the tree never held. See the drift branch below.
-     */
-    ensureHeldRestored(agentName, sessionId, opts) {
-        const key = this.#ctx.sessionKey(agentName, sessionId);
-        if (!this.#heldRestored.has(key)) {
-            // Set BEFORE restoring, so the #ensureHeldRestored inside #releaseHeld below returns straight
-            // away instead of recursing.
-            this.#heldRestored.add(key);
-            this.restoreHeldContent(agentName, sessionId);
-        }
-        // A RESTORED FRAME MAY ALREADY BE IN ORDER, and nothing else would ever notice.
-        //
-        // #releaseHeld has one caller: the tail of a successful inbound ingest. Every other way the tree
-        // grows — an outbound send leaf, a queued or rejected leaf — advances the frontier without
-        // draining. While holds died with the session node that cost seconds; now the hold is durable,
-        // so the stall is durable too: the counterparty's message sits on disk at exactly the next slot,
-        // is never delivered, and `sealReadiness` counts it, so the session cannot close either.
-        // Undeliverable AND unsealable, forever, from one restart.
-        //
-        // TRACKED SEPARATELY FROM THE HYDRATION. A read-only caller (the status surface) hydrates and
-        // must NOT release — otherwise `cello status` appends leaves, advances the session root, writes
-        // transcript rows and rings the doorbell, which makes a diagnostic command the thing that
-        // delivers messages. One shared flag would also let that read CONSUME the release the next real
-        // ingest was going to perform, which is the stall above, reintroduced.
-        if (opts?.release === false)
-            return;
-        if (this.#heldReleased.has(key))
-            return;
-        this.#heldReleased.add(key);
-        if (this.#ctx.heldContent.get(key)?.size) {
-            const counterparty = this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
-            if (counterparty)
-                this.releaseHeld(agentName, sessionId, counterparty);
-        }
-    }
-    restoreHeldContent(agentName, sessionId) {
-        if (!this.#db)
-            return;
-        let rows;
-        try {
-            rows = this.#db.prepare(`SELECT canonical_seq, content_blob, original_blob, content_hash_hex, screened_out, correlation_id, origin, leaf_kind
-           FROM held_content WHERE agent_id = ? AND session_id = ? ORDER BY canonical_seq ASC`).all(this.#ctx.requireAgentId(agentName), sessionId);
-        }
-        catch (err) {
-            this.#ctx.logger.error("session.content.held.restore.failed", {
-                agentName, sessionId,
-                impact: "verified content held before the restart is not in memory and cannot be released",
-                error: extractErrorMessage(err),
-            });
-            return;
-        }
-        if (rows.length === 0)
-            return;
-        const key = this.#ctx.sessionKey(agentName, sessionId);
-        let held = this.#ctx.heldContent.get(key);
-        if (!held) {
-            held = new Map();
-            this.#ctx.heldContent.set(key, held);
-        }
-        const tree = this.#ctx.getSessionTree(agentName, sessionId);
-        const frontier = tree.size();
-        let restored = 0;
-        let superseded = 0;
-        let drifted = 0;
-        for (const row of rows) {
-            // ASK THE TREE WHAT IS AT THAT POSITION — do not infer it from the index.
-            //
-            // `canonical_seq` is the RELAY's sequence space; `frontier` is this tree's msg-leaf count.
-            // The two drift, on purpose and by documented cases: the relay counts CTRL leaves the tree
-            // never appends, and a first message whose relay submit failed leaves the tree one ahead.
-            // Under drift `canonical_seq < frontier` is TRUE for a frame the tree has never held, and
-            // deleting on that comparison destroys verified content while reporting it as tidy-up —
-            // the exact failure this unit exists to end, reintroduced on the recovery path.
-            const occupant = tree.hashAt(row.canonical_seq);
-            if (occupant === row.content_hash_hex) {
-                this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
-                superseded++;
-                continue;
-            }
-            if (row.canonical_seq < frontier) {
-                // The position is taken by DIFFERENT content. The frame cannot be appended (that would
-                // rewrite a committed leaf) and must not be deleted (it is verified content nobody else
-                // holds), so it goes to the annex that exists for exactly this — content that arrived for
-                // a chain that can no longer carry it — and only then does the row go.
-                const annexed = this.#ctx.queries.recordSealedAnnex(agentName, sessionId, row.content_hash_hex, new Uint8Array(row.content_blob), 
-                // DOD-M12B-INDEX-1: our own held send is attributed to US, never to the counterparty.
-                row.origin === "sent"
-                    ? this.#ctx.queries.ownPubkeyHex(agentName)
-                    : this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey ?? null);
-                this.#ctx.logger.error("session.content.held.position_drifted", {
-                    agentName, sessionId, canonicalSeq: row.canonical_seq, frontier,
-                    contentHash: row.content_hash_hex, occupant, annexed,
-                    correlationId: row.correlation_id ?? undefined,
-                    impact: annexed
-                        ? "the relay's position for this frame is occupied by different content — it cannot join the chain and is readable only from the annex"
-                        : "the relay's position for this frame is occupied by different content AND the annex write failed — the durable row is kept rather than destroyed",
-                });
-                if (annexed)
-                    this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
-                drifted++;
-                continue;
-            }
-            held.set(row.canonical_seq, {
-                content: new Uint8Array(row.content_blob),
-                ...(row.original_blob ? { originalContent: new Uint8Array(row.original_blob) } : {}),
-                contentHashHex: row.content_hash_hex,
-                ...(row.correlation_id ? { correlationId: row.correlation_id } : {}),
-                ...(row.screened_out ? { screenedOut: true } : {}),
-                ...(row.origin === "sent" ? { origin: "sent" } : {}),
-                ...(row.leaf_kind === "doc" ? { kind: "doc" } : {}),
-                /**
-                 * ⚠️ `restoredAcrossRestart` EXISTS TO NAME A LOSS, NOT TO CHANGE BEHAVIOUR — review pass 2, H1.
-                 *
-                 * `held_content` has no authorship columns, so a SENT message held behind a gap and released
-                 * after a daemon restart comes back with **no signature** — its transcript row records
-                 * `self_authored` with no proof, indistinguishable from an unwitnessed send. That is the
-                 * defect bullet 5 exists to end, reappearing on the recovery path, and it was silent.
-                 *
-                 * The proof cannot be reconstructed here: it was made over Structure-1 bytes this process no
-                 * longer holds. **So the honest move is to say so, not to fabricate one** — a proof that
-                 * cannot be checked, presented as one that can, is worse than the absence.
-                 *
-                 * Two BLOB columns would close it properly (this table already carries two `ALTER TABLE …
-                 * ADD COLUMN` migrations, so the pattern exists). Under a frozen gate a log is additive and
-                 * tightenable where a schema change is neither, so this announces the loss now and
-                 * `DOD-M15-HELD-AUTHORSHIP-1` carries the column.
-                 */
-                restoredAcrossRestart: true,
-            });
-            restored++;
-        }
-        if (held.size === 0)
-            this.#ctx.heldContent.delete(key);
-        this.#ctx.logger.info("session.content.held.restored", {
-            agentName, sessionId, restored, superseded, drifted, frontier,
-            canonicalSeqs: [...held.keys()].sort((a, b) => a - b),
-            // The flow ids of the frames that came back, so a restored message ties to the
-            // `session.content.held` that opened its flow before the restart.
-            correlationIds: rows.map((r) => r.correlation_id).filter((c) => c !== null),
-        });
-    }
-    /**
-     * DOD-MSG-4: drain held out-of-order content in canonical order. After a leaf is appended, any
-     * held entry whose canonical sequence equals the new next-expected index is now in order — append
-     * it, then check again (a single fill can release a run of consecutive held messages).
-     */
-    releaseHeld(agentName, sessionId, senderPubkey) {
-        const key = this.#ctx.sessionKey(agentName, sessionId);
-        // DOD-M12B-STRAND-1: hydrate before scanning. Restoring eagerly at session-node creation put
-        // it behind writes that can fail — one failed `sessions` row upsert and the frames stayed on
-        // disk, invisible, which is the same outcome as losing them.
-        this.ensureHeldRestored(agentName, sessionId);
-        const held = this.#ctx.heldContent.get(key);
-        if (!held)
-            return 0;
-        let released = 0;
-        for (;;) {
-            const nextExpected = this.#ctx.getSessionTree(agentName, sessionId).size();
-            const entry = held.get(nextExpected);
-            if (!entry)
-                break;
-            held.delete(nextExpected);
-            // DOD-M12B-STRAND-1: released content leaves the durable store in the same breath. A row
-            // that outlives its release would re-append the same content on the next boot — growing the
-            // tree and changing a root that has already been signed.
-            this.#ctx.queries.deleteHeldContent(agentName, sessionId, nextExpected);
-            // DOD-M12B-INDEX-1: OUR OWN held message. It leafs at its canonical index and is transcribed
-            // as SENT — never routed down the received path, which would attribute our words to the
-            // counterparty in the sealed record and hand them back to our own agent as inbound.
-            if (entry.origin === "sent") {
-                // The KIND the leaf was placed with, not a hardcoded "msg" — a document leaf that had to
-                // wait for its position must come back as a document leaf, or the two sides disagree about
-                // what the chain contains.
-                this.#ctx.appendSessionLeaf(agentName, sessionId, entry.kind ?? "msg", entry.contentHashHex, entry.correlationId);
-                // A DOCUMENT frame takes a leaf and NO transcript row — matching what the immediate-append
-                // path does for one. Writing one would put raw CBOR into the operator's transcript as
-                // something they said, which is the same attribution failure as releasing it inbound.
-                if (entry.kind === "doc") {
-                    released++;
-                    this.#ctx.logger.info("session.content.released", {
-                        sessionId, sequenceNumber: nextExpected, leafKind: "doc", correlationId: entry.correlationId,
-                    });
-                    if (held.size === 0) {
-                        this.#ctx.heldContent.delete(key);
-                        break;
-                    }
-                    continue;
-                }
-                // OBSERVED, not assumed — the received path already does this. The leaf commits either way,
-                // so a dropped transcript write means the operator's OWN message is missing from their own
-                // transcript with the chain saying it is there, and nothing anywhere said so.
-                // bullet 5: the proof was captured at submit time and rides the held entry — see #heldContent.
-                /**
-                 * THE RESTART LOSS, ANNOUNCED — review pass 2, H1. Only for an entry that actually crossed a
-                 * restart: an in-memory held entry carries its proof, and an unwitnessed send legitimately
-                 * has none, so warning on every absent proof would fire on a designed benign state and bury
-                 * the one occurrence that means something.
-                 */
-                if (entry.restoredAcrossRestart === true && entry.authorship === undefined) {
-                    this.#ctx.logger.warn("session.content.released.authorship.lost", {
-                        agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
-                        impact: "this message was held behind a gap, survived a daemon restart, and is now committed with " +
-                            "attribution 'self_authored' and NO signature. Its transcript row asserts its author rather " +
-                            "than proving one, and is indistinguishable from a send the relay never witnessed.",
-                        guidance: "Not recoverable after the fact — the signature covered Structure-1 bytes this process no longer " +
-                            "holds, and fabricating one would be worse than the absence. Tracked as DOD-M15-HELD-AUTHORSHIP-1: " +
-                            "held_content needs the two proof columns so a restart carries them.",
-                    });
-                }
-                if (!this.#ctx.records.recordTranscriptMessage(agentName, sessionId, nextExpected, "sent", entry.content, entry.correlationId, entry.authorship)) {
-                    this.#ctx.logger.error("session.content.released.transcript.failed", {
-                        agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
-                        impact: "this side's own message is committed to the chain but missing from its transcript",
-                    });
-                }
-            }
-            else if (entry.screenedOut) {
-                this.#ctx.appendSessionLeaf(agentName, sessionId, "msg", entry.contentHashHex, entry.correlationId);
-                // The SAME witness leak as the immediate-append terminal-block branch (see the block comment
-                // at the `if (terminalBlock)` append in `ingestReceivedContent`), on the held path. This
-                // branch also bypasses `#appendVerifiedContent`, where the drop lives — so a blocked message
-                // that arrived out of order left `missingLeaves` stuck at 1 and the session unsealable.
-                this.#ctx.witnessedSeq.get(key)?.delete(entry.contentHashHex);
-            }
-            else {
-                this.#ctx.appendVerifiedContent(agentName, sessionId, entry.content, entry.contentHashHex, senderPubkey, entry.correlationId, entry.originalContent);
-            }
-            released++;
-            this.#ctx.logger.info("session.content.released", {
-                sessionId,
-                sequenceNumber: nextExpected,
-                screenedOut: entry.screenedOut === true,
-                correlationId: entry.correlationId,
-            });
-            if (held.size === 0) {
-                this.#ctx.heldContent.delete(key);
-                break;
-            }
-        }
-        return released;
-    }
-    /**
-     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
-     *
-     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
-     * exists on this side and is not in the tree, while the counterparty already has it from the relay
-     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
-     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
-     * it.
-     */
-    holdOwnLeafForTest(agentName, sessionId, canonicalSeq, contentHashHex) {
-        const key = this.#ctx.sessionKey(agentName, sessionId);
-        let held = this.#ctx.heldContent.get(key);
-        if (!held) {
-            held = new Map();
-            this.#ctx.heldContent.set(key, held);
-        }
-        held.set(canonicalSeq, { content: new Uint8Array(), contentHashHex, origin: "sent", kind: "msg" });
-    }
-    /**
-     * ⚠️ **ORPHANED COMMENT, OWNER UNKNOWN — do not attach it to the method below.** It reads
-     * *"@returns true iff the UPDATE was executed without error (a failed write is logged, never
-     * thrown)"*, and `annexHeldContentOnTerminal` returns `void` and runs no such UPDATE. It was
-     * already stranded in `session-node-manager.ts` before 037 moved this code, and Rule C carried it
-     * verbatim rather than dropping a sentence that is true of SOMETHING.
-     *
-     * Kept, marked, and NOT reattached: the nearest candidate by behaviour is
-     * `SessionQueries.markCounterpartyAbandoned`, which already has its own doc — so attaching it
-     * there on a guess is the same defect this marker exists to stop. Delete it only once its owner is
-     * identified, or reattach it then.
-     */
-    /**
-     * DOD-M12B-STRAND-1 — move a terminal session's held frames to the annex.
-     *
-     * A held frame is content this agent RECEIVED and VERIFIED. When its session ends it can never
-     * join that chain (appending behind a committed root is not an option, and ingest refuses a
-     * terminal session outright), but it is still the operator's mail and no other copy exists —
-     * the sender was never acknowledged for it. `sealed_session_annex` is where M12-P17 already puts
-     * content that arrives for an ended session; this is the same content arriving slightly earlier.
-     *
-     * ANNEX FIRST, DELETE SECOND, per row. A crash between them costs a duplicate the annex's
-     * INSERT OR IGNORE absorbs; the other order costs the message. A row whose annex write fails is
-     * KEPT — the retention sweep will find it again, and a leftover row is cheaper than a lost one.
-     */
-    annexHeldContentOnTerminal(agentName, sessionId, status) {
-        if (!this.#db)
-            return;
-        let rows;
-        try {
-            rows = this.#db.prepare(`SELECT canonical_seq, content_blob, content_hash_hex, held_at, origin
-           FROM held_content WHERE agent_id = ? AND session_id = ? ORDER BY canonical_seq ASC`).all(this.#ctx.requireAgentId(agentName), sessionId);
-        }
-        catch (err) {
-            this.#ctx.logger.error("session.content.held.annex.scan.failed", {
-                agentName, sessionId, status,
-                impact: "held frames for a terminal session were not moved to the annex and remain unreadable",
-                error: extractErrorMessage(err),
-            });
-            return;
-        }
-        if (rows.length === 0)
-            return;
-        const counterparty = this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey ?? null;
-        let annexed = 0;
-        let kept = 0;
-        for (const row of rows) {
-            // DOD-M12B-INDEX-1: ATTRIBUTION. A `sent` row is our own message. Stamping the counterparty's
-            // pubkey on it would put our words in their mouth in the one record that survives the
-            // session — the same failure the release path was changed to avoid, on the drain it did not
-            // touch. `#ownPubkeyHex` is null only when the identity cannot be resolved, and a null sender
-            // reads as "unattributed", which is true, rather than as a false attribution.
-            const sender = row.origin === "sent" ? this.#ctx.queries.ownPubkeyHex(agentName) : counterparty;
-            if (this.#ctx.queries.recordSealedAnnex(agentName, sessionId, row.content_hash_hex, new Uint8Array(row.content_blob), sender)) {
-                this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
-                // AND OUT OF THE IN-MEMORY MAP. Measured live 2026-08-17 on daemon 0.0.170: this frame is
-                // now safe in the annex and its durable row is gone — but teardown still found it in the
-                // map, counted `held_content` for the session, got 0, and fired
-                // `session.content.held.lost`: "verified content was destroyed". Ten frames were annexed
-                // and the same ten were reported destroyed, in the same second. A false alarm on the most
-                // serious event in the system is worse than no alarm, because the next investigation goes
-                // looking for content that was never lost.
-                this.#ctx.heldContent.get(this.#ctx.sessionKey(agentName, sessionId))?.delete(row.canonical_seq);
-                annexed++;
-            }
-            else {
-                kept++;
-            }
-        }
-        this.#ctx.logger.warn("session.content.held.annexed", {
-            agentName, sessionId, status, annexed, kept,
-            // The consumer of `held_at`: how long the oldest frame waited before its session ended.
-            oldestHeldMs: Date.now() - Math.min(...rows.map((r) => r.held_at)),
-            impact: "these messages arrived and verified but never joined the chain — they are readable from the annex, not the transcript",
-        });
-    }
-    /**
-     * Forget the restore/release bookkeeping for a torn-down session.
-     *
-     * The held CONTENT itself is not dropped here — the map is shared and the manager's eviction still
-     * owns that line. What goes is this module's memory of whether a session was already hydrated from
-     * disk and already released, which must not survive a teardown: a revived session has to re-read
-     * from durable state rather than trust a flag about a process that is gone.
-     */
-    evictSession(agentName, sessionId) {
-        const key = this.#ctx.sessionKey(agentName, sessionId);
-        this.#heldRestored.delete(key);
-        this.#heldReleased.delete(key);
-    }
-}
-//# sourceMappingURL=held-content.js.map

package/dist/held-content.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"held-content.js","sourceRoot":"","sources":["../src/held-content.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAoDzD,MAAM,OAAO,WAAW;IACb,IAAI,CAAqB;IAElC,YAAY,GAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,0FAA0F;IAC1F,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC;;;sDAGkD;IAClD,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;QACpD,sFAAsF;QACtF,2FAA2F;QAC3F,+EAA+E;QAC/E,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB,EAAE,IAA4B;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,8FAA8F;YAC9F,6BAA6B;YAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,gFAAgF;QAChF,EAAE;QACF,iGAAiG;QACjG,2FAA2F;QAC3F,+FAA+F;QAC/F,iGAAiG;QACjG,yFAAyF;QACzF,2DAA2D;QAC3D,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,0FAA0F;QAC1F,gGAAgG;QAChG,uEAAuE;QACvE,IAAI,IAAI,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO;QACpC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QACxC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,CAAC;YACnG,IAAI,YAAY;gBAAE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,SAAiB,EAAE,SAAiB;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,IAA4M,CAAC;QACjN,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CACrB;8FACsF,CACvF,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAU,CAAC;QACjE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBAC5D,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,kFAAkF;gBAC1F,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAChC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,0EAA0E;YAC1E,EAAE;YACF,2FAA2F;YAC3F,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,gFAAgF;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAChD,IAAI,QAAQ,KAAK,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC7E,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;gBACjC,uFAAuF;gBACvF,wFAAwF;gBACxF,0FAA0F;gBAC1F,uEAAuE;gBACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CACjD,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC5E,sFAAsF;gBACtF,GAAG,CAAC,MAAM,KAAK,MAAM;oBACnB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;oBAC3C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,IAAI,IAAI,CAC1F,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBAC9D,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,QAAQ;oBAC/D,WAAW,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,OAAO;oBACpD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;oBAC9C,MAAM,EAAE,OAAO;wBACb,CAAC,CAAC,qIAAqI;wBACvI,CAAC,CAAC,iJAAiJ;iBACtJ,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC1F,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC1B,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,cAAc,EAAE,GAAG,CAAC,gBAAgB;gBACpC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D;;;;;;;;;;;;;;;;mBAgBG;gBACH,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACrD,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;YAC7D,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,+EAA+E;YAC/E,kEAAkE;YAClE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACzF,CAAC,CAAC;IACL,CAAC;IACD;;;;OAIG;IACH,WAAW,CAAC,SAAiB,EAAE,SAAiB,EAAE,YAAoB;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,6FAA6F;QAC7F,6FAA6F;QAC7F,6DAA6D;QAC7D,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,SAAS,CAAC;YACR,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1B,yFAAyF;YACzF,4FAA4F;YAC5F,yDAAyD;YACzD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACxE,6FAA6F;YAC7F,wFAAwF;YACxF,oFAAoF;YACpF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,yFAAyF;gBACzF,2FAA2F;gBAC3F,2BAA2B;gBAC3B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAClH,2FAA2F;gBAC3F,sFAAsF;gBACtF,sFAAsF;gBACtF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACzB,QAAQ,EAAE,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;wBAChD,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;qBAC7F,CAAC,CAAC;oBACH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAClE,SAAS;gBACX,CAAC;gBACD,4FAA4F;gBAC5F,2FAA2F;gBAC3F,8EAA8E;gBAC9E,+FAA+F;gBAC/F;;;;;mBAKG;gBACH,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;wBAChE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;wBACtF,MAAM,EACJ,2FAA2F;4BAC3F,6FAA6F;4BAC7F,mFAAmF;wBACrF,QAAQ,EACN,kGAAkG;4BAClG,oGAAoG;4BACpG,qEAAqE;qBACxE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjJ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;wBACnE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;wBACtF,MAAM,EAAE,mFAAmF;qBAC5F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBACpG,6FAA6F;gBAC7F,yFAAyF;gBACzF,6FAA6F;gBAC7F,wFAAwF;gBACxF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;YACvJ,CAAC;YACD,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBAChD,SAAS;gBACT,cAAc,EAAE,YAAY;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI;gBACvC,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACpE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD;;;;;;;;OAQG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB,EAAE,YAAoB,EAAE,cAAsB;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD;;;;;;;;;;;OAWG;IACH;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAA8B;QAC7F,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,IAAuH,CAAC;QAC5H,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CACrB;8FACsF,CACvF,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAU,CAAC;QACjE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;gBAC/D,SAAS,EAAE,SAAS,EAAE,MAAM;gBAC5B,MAAM,EAAE,sFAAsF;gBAC9F,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAChC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,IAAI,IAAI,CAAC;QAC3G,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,8FAA8F;YAC9F,sFAAsF;YACtF,4FAA4F;YAC5F,8FAA8F;YAC9F,8EAA8E;YAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAChG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC9H,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC7E,0FAA0F;gBAC1F,yFAAyF;gBACzF,gEAAgE;gBAChE,yFAAyF;gBACzF,0FAA0F;gBAC1F,0FAA0F;gBAC1F,2CAA2C;gBAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjG,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YACpD,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI;YAC3C,wFAAwF;YACxF,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,EAAE,uHAAuH;SAChI,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAiB,EAAE,SAAiB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/http-manifest-poll.d.ts

@@ -1,67 +0,0 @@
-/**
- * CELLO-M7-CONN-001 (DOD-CONN-3) — HTTP consortium-manifest poll.
- *
- * The manifest poll is the ONE daemon-level directory operation. With the keystone
- * deleted there is no shared authenticated signaling stream to carry it, so it moves
- * to unauthenticated HTTP: GET ${directoryUrl}/manifest. The manifest is PUBLIC,
- * self-authenticating data — threshold-signed by officer root keys that the daemon has
- * pinned LOCALLY (CELLO_CONSORTIUM_ROOT_KEYS). The directory is ONLY a transport, never
- * a trust anchor: a rogue/compromised directory cannot make us adopt a forged, expired,
- * not-yet-valid, or rolled-back manifest. The verify-before-adopt policy here is the
- * SAME TUF policy the deleted keystone signaling path enforced (SignalingManager
- * .handleManifestPollResponse), preserved unchanged across the transport move.
- *
- * Runs daemon-level — even with ZERO agents (the property the keystone, which borrowed
- * the primary agent's identity to authenticate, could never provide).
- *
- * Crypto reference: RFC 8032 (Ed25519 threshold verification via verifyManifest).
- */
-import type { IManifestProvider, IManifestVersionStore, IManifestPollScheduler } from "@cello-protocol/transport";
-/** Minimal structural logger — events use the `domain.noun.verb` taxonomy. */
-export interface ManifestPollLogger {
-    info(event: string, ctx?: Record<string, unknown>): void;
-    warn(event: string, ctx?: Record<string, unknown>): void;
-    error(event: string, ctx?: Record<string, unknown>): void;
-}
-export interface ManifestAdoptDeps {
-    manifestProvider: IManifestProvider;
-    manifestVersionStore: IManifestVersionStore;
-    /** Locally-pinned officer root keys (CELLO_CONSORTIUM_ROOT_KEYS). */
-    rootKeys: readonly string[];
-    threshold: number;
-    logger: ManifestPollLogger;
-}
-export type ManifestPollFailureReason = "manifest_http_unreachable" | "manifest_malformed" | "manifest_threshold_invalid" | "manifest_signature_invalid" | "manifest_not_yet_valid" | "manifest_expired" | "manifest_version_rollback" | "manifest_store_error";
-export type ManifestPollOutcome = {
-    ok: true;
-    adopted: boolean;
-    oldVersion: number | null;
-    newVersion: number;
-} | {
-    ok: false;
-    reason: ManifestPollFailureReason;
-};
-/**
- * Fetch the consortium manifest over HTTP, verify it (TUF), and adopt it if it is a
- * newer, validly-signed, unexpired manifest. Never throws — a poll failure returns a
- * distinct reason and leaves the cached manifest + trusted version untouched (DB-001).
- */
-export declare function pollManifestOverHttp(opts: {
-    directoryUrl: string;
-    fetchFn?: typeof fetch;
-    now?: Date;
-    correlationId?: string;
-} & ManifestAdoptDeps): Promise<ManifestPollOutcome>;
-/**
- * Wire the daemon-level HTTP manifest poll onto a scheduler. Self-rearming: each tick
- * polls then schedules the next. Returns a stop function. The poll runs regardless of
- * how many agents exist (including zero) — it has no agent identity and opens no
- * signaling connection.
- */
-export declare function startHttpManifestPoll(opts: {
-    scheduler: IManifestPollScheduler;
-    directoryUrl: string;
-    fetchFn?: typeof fetch;
-    mintCorrelationId?: () => string;
-} & ManifestAdoptDeps): () => void;
-//# sourceMappingURL=http-manifest-poll.d.ts.map

package/dist/http-manifest-poll.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-manifest-poll.d.ts","sourceRoot":"","sources":["../src/http-manifest-poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGlH,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,qEAAqE;IACrE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,MAAM,yBAAyB,GACjC,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,4BAA4B,GAC5B,wBAAwB,GACxB,kBAAkB,GAClB,2BAA2B,GAC3B,sBAAsB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAIrD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,iBAAiB,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAsG9B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IACJ,SAAS,EAAE,sBAAsB,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC,GAAG,iBAAiB,GACpB,MAAM,IAAI,CA6BZ"}

package/dist/http-manifest-poll.js

@@ -1,150 +0,0 @@
-/**
- * CELLO-M7-CONN-001 (DOD-CONN-3) — HTTP consortium-manifest poll.
- *
- * The manifest poll is the ONE daemon-level directory operation. With the keystone
- * deleted there is no shared authenticated signaling stream to carry it, so it moves
- * to unauthenticated HTTP: GET ${directoryUrl}/manifest. The manifest is PUBLIC,
- * self-authenticating data — threshold-signed by officer root keys that the daemon has
- * pinned LOCALLY (CELLO_CONSORTIUM_ROOT_KEYS). The directory is ONLY a transport, never
- * a trust anchor: a rogue/compromised directory cannot make us adopt a forged, expired,
- * not-yet-valid, or rolled-back manifest. The verify-before-adopt policy here is the
- * SAME TUF policy the deleted keystone signaling path enforced (SignalingManager
- * .handleManifestPollResponse), preserved unchanged across the transport move.
- *
- * Runs daemon-level — even with ZERO agents (the property the keystone, which borrowed
- * the primary agent's identity to authenticate, could never provide).
- *
- * Crypto reference: RFC 8032 (Ed25519 threshold verification via verifyManifest).
- */
-import { verifyManifest } from "@cello-protocol/crypto";
-import { extractErrorMessage } from "./error-message.js";
-const FETCH_TIMEOUT_MS = 10_000;
-/**
- * Fetch the consortium manifest over HTTP, verify it (TUF), and adopt it if it is a
- * newer, validly-signed, unexpired manifest. Never throws — a poll failure returns a
- * distinct reason and leaves the cached manifest + trusted version untouched (DB-001).
- */
-export async function pollManifestOverHttp(opts) {
-    const { directoryUrl, fetchFn = fetch, now = new Date(), correlationId, manifestProvider, manifestVersionStore, rootKeys, threshold, logger, } = opts;
-    const manifestUrl = `${directoryUrl.replace(/\/$/, "")}/manifest`;
-    // DOD-AUTH-2 observability: announce each poll dispatch (domain.noun.verb taxonomy, matching the
-    // manifest LOAD events `directory.auth.manifest.*`). Lets an operator/alarm see the daemon is
-    // actively polling even when every poll is a no-op (already-current) or a transient failure.
-    logger.info("directory.auth.manifest.poll.dispatched", { directoryUrl, correlationId });
-    // 1. Fetch. Any network error / non-200 / timeout → unreachable. DB-001: the caller
-    //    keeps the cached manifest; a poll failure never disturbs agent connections.
-    let raw;
-    try {
-        const ac = new AbortController();
-        const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS);
-        let resp;
-        try {
-            resp = await fetchFn(manifestUrl, { signal: ac.signal });
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        if (!resp.ok) {
-            logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_http_unreachable", status: resp.status, directoryUrl, correlationId });
-            return { ok: false, reason: "manifest_http_unreachable" };
-        }
-        raw = await resp.json();
-    }
-    catch (err) {
-        logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_http_unreachable", directoryUrl, correlationId, error: extractErrorMessage(err) });
-        return { ok: false, reason: "manifest_http_unreachable" };
-    }
-    // 2. Structural check before verify — a junk body must fail loudly, not be cached.
-    const manifest = raw;
-    if (typeof manifest?.version !== "number" ||
-        !Array.isArray(manifest?.nodes) ||
-        !Array.isArray(manifest?.signatures)) {
-        logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_malformed", directoryUrl, correlationId });
-        return { ok: false, reason: "manifest_malformed" };
-    }
-    // 3. Defense-in-depth: never adopt against a 0/missing threshold (verifyManifest would
-    //    accept an unsigned manifest at threshold 0). The composition root rejects
-    //    threshold < 1 before wiring, but guard the policy directly too.
-    if (threshold < 1) {
-        logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_threshold_invalid", threshold, correlationId });
-        return { ok: false, reason: "manifest_threshold_invalid" };
-    }
-    // 4. Threshold signature (RFC 8032) against locally-pinned root keys.
-    const verifyResult = verifyManifest(manifest, rootKeys, threshold);
-    if (!verifyResult.ok) {
-        // Distinct security event (a rogue/compromised directory served a forged manifest) — kept as its
-        // own name so alarms can key on it separately from ordinary poll failures. DOD-AUTH-2.
-        logger.warn("directory.auth.manifest.signature.invalid", { reason: "manifest_signature_invalid", manifestVersion: manifest.version, detail: verifyResult.reason, correlationId });
-        return { ok: false, reason: "manifest_signature_invalid" };
-    }
-    // 5. Validity window.
-    if (now < new Date(manifest.not_before)) {
-        logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_not_yet_valid", manifestVersion: manifest.version, notBefore: manifest.not_before, correlationId });
-        return { ok: false, reason: "manifest_not_yet_valid" };
-    }
-    if (new Date(manifest.expires) <= now) {
-        logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_expired", manifestVersion: manifest.version, expiresAt: manifest.expires, correlationId });
-        return { ok: false, reason: "manifest_expired" };
-    }
-    // 6-7. Anti-rollback + adopt. The version store / provider are I/O (the version store is
-    // DB-backed in production), so they can THROW — wrap them so a store error becomes a distinct,
-    // LOGGED failure (manifest_store_error) instead of an invisible throw that silently disables
-    // manifest adoption forever (fallback-finder MED).
-    try {
-        const lastSeen = await manifestVersionStore.getLastSeenVersion();
-        if (lastSeen !== null && manifest.version < lastSeen) {
-            logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_version_rollback", manifestVersion: manifest.version, lastSeenVersion: lastSeen, correlationId });
-            return { ok: false, reason: "manifest_version_rollback" };
-        }
-        if (lastSeen !== null && manifest.version === lastSeen) {
-            // Already current — nothing to adopt.
-            return { ok: true, adopted: false, oldVersion: lastSeen, newVersion: manifest.version };
-        }
-        const oldVersion = manifestProvider.getCurrentManifest()?.version ?? null;
-        manifestProvider.updateManifest(manifest);
-        await manifestVersionStore.persistVersion(manifest.version);
-        logger.info("directory.auth.manifest.poll.success", { oldVersion, newVersion: manifest.version, directoryUrl, correlationId });
-        return { ok: true, adopted: true, oldVersion, newVersion: manifest.version };
-    }
-    catch (err) {
-        logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_store_error", manifestVersion: manifest.version, directoryUrl, correlationId, error: extractErrorMessage(err) });
-        return { ok: false, reason: "manifest_store_error" };
-    }
-}
-/**
- * Wire the daemon-level HTTP manifest poll onto a scheduler. Self-rearming: each tick
- * polls then schedules the next. Returns a stop function. The poll runs regardless of
- * how many agents exist (including zero) — it has no agent identity and opens no
- * signaling connection.
- */
-export function startHttpManifestPoll(opts) {
-    const { scheduler, directoryUrl, fetchFn, mintCorrelationId, manifestProvider, manifestVersionStore, rootKeys, threshold, logger } = opts;
-    let stopped = false;
-    const tick = async () => {
-        if (stopped)
-            return;
-        await pollManifestOverHttp({
-            directoryUrl,
-            fetchFn,
-            correlationId: mintCorrelationId?.(),
-            manifestProvider,
-            manifestVersionStore,
-            rootKeys,
-            threshold,
-            logger,
-        }).catch((err) => {
-            // pollManifestOverHttp is designed never to throw (all failures return a reason). If it ever
-            // does, LOG it (never swallow silently — that would hide a permanently-disabled poll) and let
-            // the loop self-heal by re-arming below.
-            logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_poll_unexpected_error", directoryUrl, error: extractErrorMessage(err) });
-        });
-        if (!stopped)
-            scheduler.scheduleNext(tick);
-    };
-    scheduler.scheduleNext(tick);
-    return () => {
-        stopped = true;
-        scheduler.cancel();
-    };
-}
-//# sourceMappingURL=http-manifest-poll.js.map