@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/session-connection-gater.js

@@ -0,0 +1,332 @@
+/**
+ * CELLO Daemon — SessionConnectionGater
+ *
+ * Implements the libp2p ConnectionGater interface to enforce per-session
+ * peer allowlists on ephemeral session nodes.
+ *
+ * Two modes:
+ *   1. Session node gater: allows exactly one counterparty Peer ID.
+ *      Created with the counterparty's Peer ID at session node creation.
+ *   2. Standing receiver gater: created with no allowed peer, which admits
+ *      NOBODY inbound (DOD-M15-ASSIGN-1 — it used to admit everyone) while
+ *      still permitting the outbound errands the receiver doubles as a dialer
+ *      for. Call setAllowedPeer() before handing the node's multiaddr to the
+ *      directory (AC-015); that is what opens the door, to exactly one peer.
+ *   3. Directory node gater: delegates to DirectoryPeerIdProvider.
+ *      Allows only known directory Peer IDs (MANIFEST-002 fills the real set).
+ *
+ * The gater uses denyInboundConnection (before Noise handshake) to reject
+ * unexpected peers as early as possible. Since PeerId is not yet known at
+ * that point, we use denyInboundEncryptedConnection (after Noise, before muxer)
+ * which has the PeerId and still occurs before any streams are opened.
+ *
+ * Observability: session.node.connection.rejected (WARN) is logged with
+ * sessionId, attemptedPeerId, and expectedPeerId.
+ */
+/** Permissive stub: allows all peers. Used for directory node in DAEMON-002. */
+export class PermissiveDirectoryPeerIdProvider {
+    isDirectoryPeer(_peerId) {
+        return true;
+    }
+}
+/** Restrictive stub: denies all peers. Used in unit tests (AC-016). */
+export class EmptyDirectoryPeerIdProvider {
+    isDirectoryPeer(_peerId) {
+        return false;
+    }
+}
+/**
+ * SessionConnectionGater — enforces a single allowed Peer ID on a session node.
+ *
+ * Starts CLOSED to inbound (allowedPeerId = null) for the standing receiver;
+ * setAllowedPeer(initiatorPeerId) names the one peer that may dial, and is
+ * called before the node's multiaddr is returned to the caller (AC-015).
+ */
+export class SessionConnectionGater {
+    #allowedPeerId;
+    /**
+     * M7 DOD-SPINE-6 / DOD-NAT-REACHABILITY-1: additional peers the session node may
+     * connect to OUTBOUND only. Originally a single slot for the relay witness
+     * (Structure-2 hash submit); now a SET, because the node also dials independent
+     * relays — its own reservation relays, and the relay embedded in the
+     * counterparty's /p2p-circuit address (which rides the FROST-signed assignment,
+     * so it is authorized by the same rail as the assigned witness). Kept
+     * OUTBOUND-only so the INBOUND counterparty-only invariant (INV-5 — a session
+     * node admits exactly one counterparty) is fully preserved.
+     */
+    #allowedOutboundPeerIds = new Set();
+    #sessionId;
+    #logger;
+    /**
+     * Is this node still acting as a STANDING RECEIVER, whose outbound dials are unrestricted?
+     *
+     * DOD-M15-ASSIGN-1 review F2. The outbound carve-out originally keyed off `#allowedPeerId ===
+     * null`, which broke the moment `admitInboundPeer` narrowed the inbound gate at offer time: the
+     * receiver was still the daemon's general-purpose dialer, but its outbound gate had silently
+     * closed to everything except the named dialer and the reservation relays.
+     *
+     * What that cost, concretely: the content-park deposit/pull and the restart-seal submission both
+     * dial relays that are NOT on the reservation list — the second one persisted from an EARLIER
+     * session. So an agent that merely RECEIVED one inbound offer would quietly stop being able to
+     * submit a seal, and the operator would see `relay_unavailable` — a transport label for what was
+     * actually a local gater decision. A seal leaf that does not land is not a papercut.
+     *
+     * So the two things are now tracked separately: narrowing WHO MAY DIAL IN (INV-5) does not
+     * revoke this node's own right to dial out. Only promotion into a session does that.
+     */
+    #standingReceiverOutbound;
+    /**
+     * The relays this receiver currently holds a live circuit reservation with. Empty by default.
+     *
+     * Review N3. The inbound AutoNAT carve-out below first keyed on `#allowedOutboundPeerIds`, and
+     * that set is populated from the relay peer ids **the directory hands out at signaling-auth
+     * time** — cumulatively, including relays whose reservation never completed. In a unit whose
+     * entire threat model is "one compromised directory", that handed the adversary back a narrow
+     * inbound foothold: name a relay, never complete a reservation, and dial in anyway.
+     *
+     * Entries added ONLY when a reservation actually succeeded is the honest version of the
+     * justification the carve-out's comment makes — "a peer this node already dials and holds a
+     * reservation with" — rather than a set that merely tends to contain those.
+     *
+     * 032-RELAYSPREAD widened this from ONE peer to a set, because the receiver now holds a
+     * reservation with every relay that will grant one. **The BOUND did not widen with it, and that
+     * is the security-sensitive part**: membership is still "this relay's own reservation is
+     * confirmed held", never "this relay is in the pool". Widening it to the candidate list would
+     * let a directory that merely NAMES a relay dial in behind the gate — the exact failure the
+     * single-relay version was written to prevent, multiplied by the size of the pool.
+     */
+    #reservedRelayPeerIds = new Set();
+    constructor(opts) {
+        this.#sessionId = opts.sessionId;
+        this.#allowedPeerId = opts.allowedPeerId;
+        // A gater built with no named peer is a standing receiver; one built naming its counterparty is
+        // a session node, which has never been allowed to dial anywhere but its counterparty and relays.
+        this.#standingReceiverOutbound = opts.allowedPeerId === null;
+        this.#logger = opts.logger;
+    }
+    /**
+     * PROMOTION — this node is now a session node serving exactly this counterparty.
+     *
+     * Narrows inbound AND ends the standing-receiver outbound latitude: from here the node may dial
+     * only its counterparty and the relays explicitly added to the outbound allowlist.
+     */
+    setAllowedPeer(peerId) {
+        this.#allowedPeerId = peerId;
+        this.#standingReceiverOutbound = false;
+    }
+    /**
+     * DOD-M15-ASSIGN-1 — name the one peer that may dial IN, without promoting the node.
+     *
+     * Used when a `session_offer` names the initiator, before any assignment exists. The node is
+     * still the daemon's general-purpose dialer at this point, so its outbound latitude is untouched;
+     * see `#standingReceiverOutbound`.
+     */
+    admitInboundPeer(peerId) {
+        this.#allowedPeerId = peerId;
+    }
+    /**
+     * Return to admitting NOBODY inbound — the resting state of an unclaimed receiver.
+     *
+     * DOD-M15-OFFER-SIGNED-1 review F4: when an offer is refused after the gate was already narrowed
+     * to the peer it named, leaving that peer admitted means the code has declared someone
+     * unauthorised and left the door open to exactly them. Outbound latitude is untouched; this node
+     * is still the daemon's general-purpose dialer.
+     */
+    closeInbound() {
+        this.#allowedPeerId = null;
+    }
+    /**
+     * Record the relays this receiver holds LIVE circuit reservations with — the only peers that earn
+     * the inbound AutoNAT carve-out.
+     *
+     * REPLACES the set rather than adding to it. A relay absent from `peerIds` loses its carve-out in
+     * the same call that notices the reservation is gone, so the bound stays "holds one now" and
+     * cannot drift into "granted one once". Pass `[]` when nothing is held.
+     */
+    /**
+     * Does this relay hold the inbound carve-out — i.e. would this gater ADMIT an inbound dial from
+     * it on the strength of a live reservation?
+     *
+     * **This IS the carve-out branch**, not a description of it: `denyInboundEncryptedConnection`
+     * calls this method rather than re-testing the set. One definition, so nothing observing the gate
+     * can be told something different from what the gate does — which matters because the review
+     * found that substituting the CANDIDATE list for the held list at the manager's
+     * `setReservedRelayPeers` call left every test in this unit green while opening exactly the hole
+     * the bound exists to close. Read-only and silent: an observation must not log a refusal.
+     */
+    holdsInboundCarveOut(peerId) {
+        return this.#standingReceiverOutbound && this.#reservedRelayPeerIds.has(peerId);
+    }
+    setReservedRelayPeers(peerIds) {
+        this.#reservedRelayPeerIds.clear();
+        for (const peerId of peerIds)
+            this.#reservedRelayPeerIds.add(peerId);
+    }
+    /**
+     * M7 DOD-SPINE-6: permit an OUTBOUND connection to a relay peer (the assigned
+     * witness, a reservation relay, or the relay inside the counterparty's circuit
+     * address — all authorized by the signed assignment / directory rail). ADDITIVE:
+     * each call widens the outbound set only. Does NOT widen the inbound allowlist.
+     */
+    setAllowedOutboundPeer(peerId) {
+        this.#allowedOutboundPeerIds.add(peerId);
+    }
+    /**
+     * DOD-M15-FRAME-1: is this peer on the OUTBOUND allowlist?
+     *
+     * Read by the promotion-time eviction sweep, which disconnects peers that attached before the
+     * gate narrowed — libp2p does not re-run a gater against connections that already exist. Relay
+     * peers sit on this list because reservation refreshes ride them, and hanging one up would cost
+     * the agent its inbound reachability to remove a peer that cannot speak the content protocol
+     * anyway. Exposed as a question rather than by handing out the set, so the sweep cannot widen it.
+     */
+    isAllowedOutboundPeer(peerId) {
+        return this.#allowedOutboundPeerIds.has(peerId);
+    }
+    getSessionId() {
+        return this.#sessionId;
+    }
+    getAllowedPeerId() {
+        return this.#allowedPeerId;
+    }
+    /**
+     * denyInboundEncryptedConnection — called after Noise handshake, before muxer.
+     * This is the enforcement point for inbound connections: PeerId is known here.
+     * Return true to DENY the connection.
+     */
+    denyInboundEncryptedConnection(peerId, _maConn) {
+        return this.#denyIfNotAllowed(peerId, "inbound");
+    }
+    /**
+     * denyOutboundEncryptedConnection — symmetric gate for outbound connections.
+     * Session nodes should only connect to the designated counterparty.
+     * Return true to DENY the connection.
+     */
+    denyOutboundEncryptedConnection(peerId, _maConn) {
+        // Relay peers are an OUTBOUND-only allowance (the session node dials them).
+        if (this.#allowedOutboundPeerIds.has(peerId.toString())) {
+            return false; // allow
+        }
+        // Review F2: a standing receiver is also the daemon's dialer for errands that belong to no
+        // session — content-park deposit/pull, restart-seal submission to a PRIOR session's relay.
+        // Those targets are on no allowlist and cannot be, since they are chosen per errand.
+        if (this.#standingReceiverOutbound) {
+            return false; // allow — this node chose the dial; INV-5 governs who comes IN
+        }
+        return this.#denyIfNotAllowed(peerId, "outbound");
+    }
+    #denyIfNotAllowed(peerId, direction) {
+        /**
+         * DOD-M15-ASSIGN-1 — `null` ADMITS NOBODY INBOUND. It used to admit everyone, both ways.
+         *
+         * A standing receiver is built with `allowedPeerId: null` because the counterparty is unknown
+         * until a session exists. Reading that as "allow all" is what put a real open door on every
+         * operator's machine: a stranger could dial the receiver, hold the connection through
+         * promotion — libp2p never re-runs a gater against a live connection — and then speak the
+         * content protocol the moment it activated.
+         *
+         * NOBODY LEGITIMATELY DIALS AN UNCLAIMED RECEIVER. An inbound session begins with the directory
+         * sending a `session_offer` that NAMES `initiator_session_peer_id`, and the responder narrows
+         * the gate to that peer BEFORE it advertises its own address in `session_offer_accept`. So by
+         * the time the initiator can know where to dial, the gate already names them. The window this
+         * closes is the one where the receiver is up and no offer has arrived — where the only dialer
+         * is, by construction, someone who was not invited.
+         *
+         * OUTBOUND STAYS OPEN WHILE UNCLAIMED, and that asymmetry is deliberate, not an oversight. The
+         * standing receiver is also the daemon's general-purpose dialer for errands that belong to no
+         * session — the content-park deposit and pull against the relay (MSG-001-3b). Those dials are
+         * this agent choosing where to go; INV-5 governs who may come IN. Denying them would have cost
+         * message parking to close a door nobody was standing at.
+         */
+        /**
+         * Review F7: a RESERVATION RELAY dialling back is infrastructure, not a stranger.
+         *
+         * The standing receiver runs the libp2p AutoNAT *client*: it asks connected peers to dial its
+         * observed address so it can learn whether it is publicly reachable. Its connected peers are
+         * its own reservation relays. That dial-back arrives INBOUND, and the outbound allowlist was
+         * only consulted on the outbound path — so it was refused, and refused repeatedly.
+         *
+         * Two costs, and the second is the quiet one. It logged `connection.rejected` on every probe
+         * cycle, on the one line that is supposed to mean a stranger tried an unclaimed receiver — a
+         * signal that fires on the normal case is not a signal. And AutoNAT answers repeated dial
+         * failures by REMOVING the observed address, so an agent's own public address never becomes
+         * verified and never reaches `listenAddresses()` — the array shipped in `session_offer_accept`.
+         * We would have been advertising a shorter address list and blaming the network.
+         *
+         * These are peers this node already dials and holds reservations with. Admitting their
+         * dial-back grants nothing it did not already have.
+         *
+         * SCOPED TWICE, and each scope closed a hole the previous version had.
+         *
+         * To the STANDING-RECEIVER ROLE: the first attempt admitted relays inbound on every gater, which
+         * breaks INV-5 — a SESSION node admits exactly one counterparty, and the existing tests say so
+         * in those words. A promoted node has no AutoNAT probe to answer, so it needs nothing here.
+         *
+         * To THE RELAYS HOLDING A LIVE RESERVATION (`#reservedRelayPeerIds`), not the outbound
+         * allowlist. That allowlist is built from relay peer ids the DIRECTORY supplies, cumulatively,
+         * including ones whose reservation never completed — so keying on it let a compromised
+         * directory name a relay and dial in without ever holding a reservation. In a unit whose threat
+         * model is exactly that adversary, the outbound allowlist was the wrong thing to trust, and it
+         * still is: this set holds only relays whose own reservation was confirmed, however many relays
+         * the pool names.
+         */
+        if (direction === "inbound" && this.holdsInboundCarveOut(peerId.toString())) {
+            return false; // allow — a relay we hold a live reservation with, answering a probe we started
+        }
+        if (this.#allowedPeerId === null) {
+            if (direction === "outbound")
+                return false; // allow — we chose this dial; INV-5 is inbound-only
+            this.#logger.warn("session.node.connection.rejected", {
+                sessionId: this.#sessionId,
+                attemptedPeerId: peerId.toString(),
+                expectedPeerId: "(none — receiver unclaimed)",
+                impact: "a peer dialled a standing receiver that no session has claimed; nothing invited it, so it was refused before the muxer and it learned nothing",
+            });
+            return true; // DENY
+        }
+        const attemptedPeerId = peerId.toString();
+        if (attemptedPeerId === this.#allowedPeerId) {
+            return false; // allow
+        }
+        this.#logger.warn("session.node.connection.rejected", {
+            sessionId: this.#sessionId,
+            attemptedPeerId,
+            expectedPeerId: this.#allowedPeerId,
+        });
+        return true; // deny
+    }
+}
+/**
+ * DirectoryConnectionGater — enforces directory-only connections on the
+ * directory-facing node. Delegates to DirectoryPeerIdProvider.
+ *
+ * Logs session.node.connection.rejected (using sessionId='directory') when
+ * a non-directory peer is denied.
+ */
+export class DirectoryConnectionGater {
+    #provider;
+    #logger;
+    constructor(provider, logger) {
+        this.#provider = provider;
+        this.#logger = logger;
+    }
+    denyInboundEncryptedConnection(peerId, _maConn) {
+        return this.#denyIfNotDirectory(peerId);
+    }
+    denyOutboundEncryptedConnection(peerId, _maConn) {
+        return this.#denyIfNotDirectory(peerId);
+    }
+    #denyIfNotDirectory(peerId) {
+        const peerIdStr = peerId.toString();
+        if (this.#provider.isDirectoryPeer(peerIdStr)) {
+            return false; // allow
+        }
+        this.#logger.warn("session.node.connection.rejected", {
+            sessionId: "__directory_facing__",
+            attemptedPeerId: peerIdStr,
+            expectedPeerId: "known_directory_peer",
+        });
+        return true; // deny
+    }
+}
+//# sourceMappingURL=session-connection-gater.js.map

package/dist/session-connection-gater.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-connection-gater.js","sourceRoot":"","sources":["../src/session-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAcH,gFAAgF;AAChF,MAAM,OAAO,iCAAiC;IAC5C,eAAe,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,4BAA4B;IACvC,eAAe,CAAC,OAAe;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACjC,cAAc,CAAgB;IAC9B;;;;;;;;;OASG;IACM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,UAAU,CAAS;IACnB,OAAO,CAAS;IAEzB;;;;;;;;;;;;;;;;OAgBG;IACH,yBAAyB,CAAU;IAEnC;;;;;;;;;;;;;;;;;;;OAmBG;IACM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnD,YAAY,IAIX;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,gGAAgG;QAChG,iGAAiG;QACjG,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,yBAAyB,GAAG,KAAK,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,YAAY;QACV,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,MAAc;QACjC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,qBAAqB,CAAC,OAA0B;QAC9C,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,MAAc;QACnC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,2FAA2F;QAC3F,2FAA2F;QAC3F,qFAAqF;QACrF,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,+DAA+D;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,iBAAiB,CAAC,MAAc,EAAE,SAAiC;QACjE;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA+BG;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC5E,OAAO,KAAK,CAAC,CAAC,gFAAgF;QAChG,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,SAAS,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC,CAAC,oDAAoD;YAChG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACpD,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAClC,cAAc,EAAE,6BAA6B;gBAC7C,MAAM,EACJ,+IAA+I;aAClJ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,OAAO;QACtB,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,eAAe;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAC1B,SAAS,CAA0B;IACnC,OAAO,CAAS;IAEzB,YAAY,QAAiC,EAAE,MAAc;QAC3D,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,8BAA8B,CAAC,MAAc,EAAE,OAA4B;QACzE,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,+BAA+B,CAAC,MAAc,EAAE,OAA4B;QAC1E,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,mBAAmB,CAAC,MAAc;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,CAAC,QAAQ;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACpD,SAAS,EAAE,sBAAsB;YACjC,eAAe,EAAE,SAAS;YAC1B,cAAc,EAAE,sBAAsB;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,OAAO;IACtB,CAAC;CACF"}

package/dist/session-content-context.d.ts

@@ -0,0 +1,162 @@
+/**
+ * CELLO Daemon — WHAT THE CONTENT PATH NEEDS FROM THE MANAGER
+ *
+ * One context, shared by both halves of the content path — `session-content-send.ts` and
+ * `session-content-ingest.ts`. It lives in its own file because two classes hold it and a shape
+ * declared beside one of them reads as belonging to that one.
+ *
+ * ⚠️ **IT IS WIDE ON PURPOSE, AND THAT IS THE TRADE THIS SPLIT MAKES.** The narrow contexts the
+ * earlier collaborators hold (a dozen members each) are not reachable here: inbound ingest reads
+ * session state, held content, salts, ephemeral keys, the relay client, the ordering record, the
+ * screening gateway and the transcript, and it does so inside ONE method whose forty guards each
+ * read locals the guards above them declared. A narrower seam would have to be bought with a
+ * rewrite of that method, and a rewrite of the ingest path is a correctness risk on the most
+ * load-bearing code in the daemon. Explicit and typed but wide beats implicit and narrow: every
+ * member below is named, so what these files can reach is a list a reader can check, not a `this`.
+ *
+ * **Nothing here is state the content path owns.** The maps are shared BY REFERENCE with the
+ * manager and with the other collaborators — one Map object, not a copy — for the same reason
+ * `HeldContent` shares `heldContent`: two sources of truth for "what is in flight" is worse than
+ * one shared one.
+ */
+import { type KeyProvider } from "@cello-protocol/crypto";
+import { type CelloNode } from "@cello-protocol/transport";
+import { type SecurityGatewayClient } from "@cello-protocol/gateway";
+import type { Logger } from "./types.js";
+import type { SessionTree, WritableSessionTreeLeafKind } from "./session-tree.js";
+import { AgentRelayClient } from "./session-relay-client.js";
+import type { SessionOwnChainStore } from "./session-own-chain-store.js";
+import type { AuthorshipVerifier } from "./authorship-verification.js";
+import type { InboundRefusals } from "./inbound-refusals.js";
+import type { SessionRecords } from "./session-records.js";
+import type { ParkRecovery } from "./park-recovery.js";
+import type { SessionSalts } from "./session-salts.js";
+import type { SessionQueries } from "./session-queries.js";
+import type { RefusalNotices } from "./refusal-notices.js";
+import type { SessionEphemerals } from "./session-ephemerals.js";
+import type { SessionLiveness } from "./session-liveness.js";
+import type { HeldContent, HeldEntry } from "./held-content.js";
+import type { SessionLeafRecords } from "./session-leaf-records.js";
+import { type ActiveSessionEntry, type AwaitingAckEntry } from "./session-node-types.js";
+/**
+ * What the content pipeline needs from the manager.
+ *
+ * Three shapes appear here and the difference between them is load-bearing:
+ *
+ * - **Plain readonly properties** are things the manager may REPLACE after this object is built —
+ *   the wired-in hooks, the own-chain store (opened with the database, long after construction).
+ *   The manager implements each as a getter over its own field, so this file always sees the
+ *   current value rather than a snapshot taken during construction. A captured VALUE here would
+ *   have frozen `null` in place for the life of the process; that exact mistake once left signing
+ *   silently disabled while every test stayed green.
+ * - **Mutable properties** are the three fault-injection counters, which this file both reads and
+ *   decrements. They are accessor pairs on the manager's side.
+ * - **Methods** are calls back into the manager, and the shared maps are passed by reference.
+ */
+export interface SessionContentPipelineContext {
+    readonly logger: Logger;
+    /**
+     * M9-CORE-001: the inbound screening seam. Held rather than reached for, because a pipeline that
+     * could choose not to screen is one that will eventually be built to skip it (INV-9).
+     */
+    readonly securityGateway: SecurityGatewayClient;
+    readonly records: SessionRecords;
+    readonly authorship: AuthorshipVerifier;
+    readonly refusals: InboundRefusals;
+    readonly park: ParkRecovery;
+    readonly salts: SessionSalts;
+    readonly queries: SessionQueries;
+    readonly notices: RefusalNotices;
+    /**
+     * DOD-M15-CLOSEDSESSION-1 — has THIS side committed its half of the seal?
+     *
+     * A FUNCTION rather than the raw mark map, deliberately: the answer falls back to durable
+     * evidence when the in-memory mark is gone (a restart between the ctrl-leaf submit and the
+     * status write), and a context holding the map would let a second caller re-derive the answer
+     * without that fallback. One definition, on the manager. See `session-closed.ts`.
+     */
+    readonly hasCommittedSealLeaf: (agentName: string, sessionId: string) => boolean;
+    readonly ephemerals: SessionEphemerals;
+    readonly liveness: SessionLiveness;
+    readonly held: HeldContent;
+    readonly leafRecords: SessionLeafRecords;
+    readonly activeNodes: Map<string, ActiveSessionEntry>;
+    readonly awaitingAck: Map<string, Map<string, AwaitingAckEntry>>;
+    readonly heldContent: Map<string, Map<number, HeldEntry>>;
+    readonly witnessedSeq: Map<string, Map<string, number>>;
+    /**
+     * DOD-M15-SEALPRECOND-1 — content hash -> the sequence the relay assigned OUR OWN leaf, for the
+     * span between the relay ordering it and this tree placing it.
+     *
+     * Distinct from `witnessedSeq`, which gains an entry only for leaves NOT authored by us
+     * (`relayLeafHandler`), and that asymmetry is exactly what cost a receipt on 2026-09-11: the
+     * relay had ordered our third leaf, the tree still held two, and every counter the seal gate
+     * reads was zero. Gained at the assignment site in `sendContent`, lost in `placeOwnLeaf`.
+     */
+    readonly ownLeavesOrdered: Map<string, Map<string, number>>;
+    readonly leafFetchTimers: Map<string, ReturnType<typeof setTimeout>>;
+    readonly lastAck: Map<string, {
+        seq: number;
+        hash: Uint8Array;
+    }>;
+    readonly resolvedContent: Map<string, Set<string>>;
+    readonly undeliverableSeqs: Map<string, Set<number>>;
+    readonly highWaterSeq: Map<string, number>;
+    readonly counterpartyAddrs: Map<string, string[]>;
+    readonly lingeringStreams: Set<ReturnType<typeof setTimeout>>;
+    readonly redialNotBefore: Map<string, number>;
+    readonly orderingObserved: Set<string>;
+    readonly shuttingDown: boolean;
+    readonly contentTtfMs: number;
+    readonly leafFetchGraceMs: number;
+    /** Opened with the database, which happens long after this object is built — never a snapshot. */
+    readonly ownChainStore: SessionOwnChainStore | null;
+    /**
+     * ⚠️ **`null` AND "returns false" ARE DIFFERENT ANSWERS, everywhere below.** An absent durable
+     * queue is not a queue that refused; an absent document classifier is not a frame that is not a
+     * document. Each of these stays nullable so the code can keep saying which it was, which is why
+     * they are properties rather than pre-bound calls.
+     */
+    readonly onParkFailed: ((agentName: string, sessionId: string, contentHashHex: string, content: Uint8Array, structure1Cbor?: Uint8Array, structure2Cbor?: Uint8Array, contentHashAlg?: string) => boolean) | null;
+    readonly onContentArrived: ((agentName: string, sessionId: string, senderPubkey: string) => void) | null;
+    readonly onDocumentFrame: ((agentName: string, sessionId: string, content: Uint8Array, senderPubkey: string, correlationId?: string) => {
+        consumed: boolean;
+        kind?: string;
+    }) | null;
+    readonly isDocumentFrame: ((content: Uint8Array) => boolean) | null;
+    readonly onAwaitingPersisted: ((agentName: string, sessionId: string, contentHashHex: string) => void) | null;
+    readonly inboundFrameObserver: ((frame: Record<string, unknown>) => void) | null;
+    sendFaultRemaining: number;
+    ackFaultRemaining: number;
+    connectionLossRemaining: number;
+    /** DOD-LOOP-1: (agentName, sessionId), never sessionId alone — see the manager's own note. */
+    sessionKey(agentName: string, sessionId: string): string;
+    keyProvider(agentName: string): KeyProvider | undefined;
+    getSessionTree(agentName: string, sessionId: string): SessionTree;
+    appendSessionLeaf(agentName: string, sessionId: string, kind: WritableSessionTreeLeafKind, leafHashHex: string, correlationId?: string): {
+        leafIndex: number;
+        newRootHex: string;
+    };
+    mailboxRouteAvailable(agentName: string): boolean;
+    streamCensus(node: CelloNode, peerId: string): Record<string, number>;
+    freezeOnIdentityFailure(agentName: string, sessionId: string, reason: string, correlationId?: string): Promise<void>;
+    handleTtfExpiry(agentName: string, sessionId: string, hashHex: string): void;
+    markContentUnverifiable(agentName: string, sessionId: string, why: "tampered" | "unverifiable"): void;
+    maybeAutoAcknowledgeSeal(agentName: string, sessionId: string, correlationId: string): void;
+    ownChainOf(agentName: string, sessionId: string, entry: {
+        relayClient?: AgentRelayClient;
+        relaySessionIdBytes?: Uint8Array;
+    } | undefined, ownPubkey: Uint8Array): Uint8Array | undefined;
+    updateSessionStatus(agentName: string, sessionId: string, status: "active" | "sealed" | "interrupted" | "abandoned", interruptedBy?: "local"): boolean;
+    abandonSession(agentName: string, sessionId: string): Promise<boolean>;
+    connectToCounterparty(agentName: string, sessionId: string, addrs: string[]): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+        error: string;
+    }>;
+    destroySessionNode(agentName: string, sessionId: string, reason: "sealed" | "interrupted" | "error"): Promise<void>;
+    retireOnCounterpartyAbandon(agentName: string, sessionId: string, correlationId?: string): Promise<boolean>;
+}
+//# sourceMappingURL=session-content-context.d.ts.map

package/dist/session-content-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-content-context.d.ts","sourceRoot":"","sources":["../src/session-content-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAGhD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjF,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IAGzC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;IACrE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAGvC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAGpD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EACjB,CAAC,CACC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,UAAU,EACnB,cAAc,CAAC,EAAE,UAAU,EAC3B,cAAc,CAAC,EAAE,UAAU,EAC3B,cAAc,CAAC,EAAE,MAAM,KACpB,OAAO,CAAC,GACb,IAAI,CAAC;IACT,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACzG,QAAQ,CAAC,eAAe,EACpB,CAAC,CACC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,KACnB;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAC1C,IAAI,CAAC;IACT,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC;IACpE,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9G,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAGjF,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;IAGhC,8FAA8F;IAC9F,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IACxD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAClE,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,2BAA2B,EACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtE,uBAAuB,CACrB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;IACtG,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5F,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC;QAAC,mBAAmB,CAAC,EAAE,UAAU,CAAA;KAAE,GAAG,SAAS,EACvF,SAAS,EAAE,UAAU,GACpB,UAAU,GAAG,SAAS,CAAC;IAC1B,mBAAmB,CACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,WAAW,EACzD,aAAa,CAAC,EAAE,OAAO,GACtB,OAAO,CAAC;IACX,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,kBAAkB,CAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,GACzC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7G"}

package/dist/session-content-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-content-context.js.map

package/dist/session-content-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-content-context.js","sourceRoot":"","sources":["../src/session-content-context.ts"],"names":[],"mappings":""}

package/dist/session-content-handlers.d.ts

@@ -0,0 +1,82 @@
+import { type SecurityGatewayClient } from "@cello-protocol/gateway";
+import type { IpcHandler } from "./ipc-server.js";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { SendClaims } from "./send-claims.js";
+import type { RetryQueue } from "./retry-queue.js";
+import type { Logger } from "./types.js";
+import type { ConnState } from "./contact-handlers.js";
+/**
+ * DOD-M15-SEALWIRE-1 bullet 5, SENT half — the proof for a message THIS agent sent.
+ *
+ * Present only when the relay WITNESSED the leaf: an unwitnessed send never put a Structure-1 on the
+ * wire, so there is nothing signed to store, and the row must record `self_authored` with no proof
+ * rather than imply one. `sendContent` returns it per-send rather than stashing it by session,
+ * because a side map hands a caller the wrong send's signature the moment two are in flight.
+ */
+/**
+ * Did the RELAY witness this leaf — the single fact every `witnessed` in this file is read from.
+ *
+ * `016-RELAYLOSS` review HIGH-2. The first version of the fix put `witnessed` on two of `cello_send`'s
+ * FIVE return paths, which defeats the reason it was added at all: a field that is present on some
+ * outcomes and absent on others cannot be branched on, and its absence reads as an older daemon
+ * rather than as an answer. Worse, the two it missed are the two that matter most — the diverged
+ * path is reachable ONLY after an unwitnessed leaf, and the durably-queued path is the one
+ * production takes when the relay is also the transport (behind NAT, content and witness die
+ * together), where it was telling operators "No action needed."
+ *
+ * Read off the PLACEMENT, not re-derived from the sequence number, so this and the
+ * `session.tree.own_leaf_unwitnessed` ERROR beside it can never disagree about the same send.
+ *
+ * ⚠️ A HELD leaf (`placed: false`) is WITNESSED, and that is not a special case being papered over.
+ * A leaf is held precisely BECAUSE the relay assigned it a position beyond this side's tail — being
+ * held is itself proof of an assignment. Reporting `witnessed: false` there would tell an operator
+ * their record had lost a message when the opposite is true.
+ */
+export declare function wasWitnessed(p: {
+    placed: true;
+    unwitnessed?: true;
+} | {
+    placed: false;
+}): boolean;
+/**
+ * The durably-queued path's guidance: the relay's OWN words, plus what a missing witness costs.
+ *
+ * **Exported so the test can call THIS rather than re-implement it.** The first version of the
+ * composition test rebuilt the string inline and asserted on its own copy — which stays green if
+ * production stops composing entirely, and is therefore the hollow shape this milestone keeps
+ * finding. A rule worth pinning has to be pinned on the code that runs.
+ *
+ * The rule, and why it is a composition rather than a choice: `upstream` is where the relay's own
+ * retry window reaches the operator ("try again in about 45 seconds"), and a rate-limited park is
+ * unwitnessed BY CONSTRUCTION — so choosing between the two messages silently drops the more
+ * specific one exactly when it is most useful. Both are true at once and the operator needs both.
+ *
+ * The default splits on `witnessed` for one reason only: "No action needed" is false for a leaf the
+ * relay never recorded.
+ */
+export declare function queuedSendGuidance(upstream: string | undefined, witnessed: boolean): string;
+export declare function sentAuthorship(r: Awaited<ReturnType<SessionNodeManager["sendContent"]>>): {
+    senderPubkey: Uint8Array;
+    senderSig: Uint8Array;
+} | undefined;
+export interface SessionContentDeps {
+    handlers: Map<string, IpcHandler>;
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    securityGateway: SecurityGatewayClient;
+    retryQueue: RetryQueue;
+    getConnState: (connectionId: string) => ConnState | undefined;
+    resolveCurrentAgent: (connState: ConnState | undefined, explicitAgent?: string) => string | null;
+    NO_CURRENT_AGENT_RESPONSE: unknown;
+    /** M8C-CURSOR-1: the per-connection read cursor (read-before-write gating). */
+    getConnectionCursor: (connectionId: string, sessionId: string) => number;
+    advanceConnectionCursor: (connectionId: string, sessionId: string, seq: number) => void;
+    /** M8C-TGDOOR-1: a read clears the doorbell's ring-once-until-read. */
+    clearTelegramRung: (agentName: string, sessionId: string) => void;
+    /** DOD-COATTEND-VISIBLE-1: how many connections attend this agent right now (reporting only). */
+    attendanceCount: (agentName: string) => number;
+    /** Sends on the wire right now — shared with the away one-shot, which must not close under one. */
+    sendClaims: SendClaims;
+}
+export declare function registerSessionContentHandlers(deps: SessionContentDeps): void;
+//# sourceMappingURL=session-content-handlers.d.ts.map

package/dist/session-content-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-content-handlers.d.ts","sourceRoot":"","sources":["../src/session-content-handlers.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA2C,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC9G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA8HvD;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GAAG,OAAO,CAEjG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAY3F;AAED,wBAAgB,cAAc,CAC5B,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,GACxD;IAAE,YAAY,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GAAG,SAAS,CAUjE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,qBAAqB,CAAC;IACvC,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,yBAAyB,EAAE,OAAO,CAAC;IACnC,+EAA+E;IAC/E,mBAAmB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACzE,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxF,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,iGAAiG;IACjG,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,mGAAmG;IACnG,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAgsC7E"}