@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/session-node-manager.d.ts

@@ -0,0 +1,877 @@
+/**
+ * CELLO Daemon — SessionNodeManager
+ *
+ * Manages the lifecycle of all ephemeral session nodes:
+ *   1. Per-session nodes: fresh transport key + Peer ID, connectionGater allows
+ *      only the designated counterparty. Created during cello_initiate_session
+ *      (outbound) or cello_await_session (inbound, via standing receiver handoff).
+ *   2. Standing receiver node: pre-created, kept alive at all times, handed to the first inbound
+ *      session and immediately replaced. Its gater is NOT open — `DOD-M15-ASSIGN-1` made it admit
+ *      nobody inbound until a session offer names the dialer (see `standing-receivers.ts`). This
+ *      line said "open gater" for as long as that was true and for a while after it was not.
+ *   3. 32-node cap: enforced before any new node is created.
+ *   4. Session status in the DB: active → sealed (on close) or interrupted
+ *      (on graceful shutdown or SIGKILL-restart detection).
+ *
+ * Interrupted-session detection runs BEFORE the IPC socket opens, so a client cannot observe a
+ * stale 'active' row from a previous process.
+ */
+import { type ContentHashAlg } from "./wire-content-hash.js";
+import { type CapacityReason } from "./refusal-reasons.js";
+import { type SaltAgreementFrame } from "./session-salt-agreement.js";
+import { type DaemonDatabase } from "./sqlcipher-db.js";
+import { type RefusalKind } from "./refusal-reasons.js";
+import type { Logger, SessionRecord } from "./types.js";
+import { SessionTree, type WritableSessionTreeLeafKind } from "./session-tree.js";
+import { type CelloNode, type IAutoNatService } from "@cello-protocol/transport";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import { type SessionEphemeral } from "@cello-protocol/crypto";
+import { type ParkEnvelope } from "./park-envelope.js";
+import { AgentRelayClient, type RelayAuthRefusal, type RelayWitnessAlert } from "./session-relay-client.js";
+import { ParkRecovery } from "./park-recovery.js";
+import type { LivenessAnswer } from "./session-relay-client.js";
+import { SessionContentSender } from "./session-content-send.js";
+import { SessionContentIngest } from "./session-content-ingest.js";
+import { SessionSeal } from "./session-seal.js";
+import { SessionRelay } from "./session-relay.js";
+import { SessionLifecycle } from "./session-lifecycle.js";
+import { RelayReceiptStore } from "./relay-receipt-store.js";
+import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
+import { ChannelLogStore } from "./channel-log-store.js";
+import { SessionOwnChainStore } from "./session-own-chain-store.js";
+import type { SealFrontierLeaf } from "./seal-frontier-verify.js";
+import { type SecurityGatewayClient } from "@cello-protocol/gateway";
+import { type ISessionNodeFactory, type ParkedDrainReason, type QuarantinedRecord, type RefusalNotice, type SessionImpairment, type TranscriptEntry, type WitnessAlertNotice } from "./session-node-types.js";
+export { ABUSE_MAX_SESSIONS_PER_UNKNOWN_SENDER, ABUSE_MAX_SESSION_RECEIVED_BYTES, ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL, type AbandonNoticeResult, type AckHashReason, CAP_INTERRUPTED_TTL_MS, type ISessionNodeFactory, LEAF_FETCH_GRACE_MS, MAX_TERMINAL_REFUSALS_PER_SESSION, type ParkedDrainReason, type QuarantinedRecord, RELAY_QUARANTINE_MS, REVIVAL_BOUND_SWEEP_MS, REVIVAL_WINDOW_MS, REVIVE_RESERVATION_CANDIDATES, REVIVE_RESERVATION_TIMEOUT_MS, type RefusalNotice, type RelayConnectParams, SR_RESERVATION_MAX_RETRIES, type SentAuthorship, type SessionImpairment, type SessionNodeConfig, TERMINAL_REFUSAL_READ_RETRY_MS, TERMINAL_REFUSAL_REASONS, type TranscriptEntry, type WitnessAlertNotice, } from "./session-node-types.js";
+export declare class SessionNodeManager {
+    #private;
+    getChannelLogStore(): ChannelLogStore;
+    setDetachedRelayClientBuilder(fn: (agentName: string, relayPeerId: string, relayAddrs: string[], stores: {
+        receiptStore?: RelayReceiptStore;
+        sealLeafStore?: SessionSealLeafStore;
+        ownChainStore?: SessionOwnChainStore;
+        onlineToken: () => Uint8Array | undefined;
+    }) => AgentRelayClient | undefined): void;
+    /**
+     * Why this agent's standing receiver could not hold a reservation, in words the person running it
+     * can act on — or null when the last attempt succeeded or none has been made.
+     *
+     * This is the surface DoD clause 7 is about: the assertion that matters is what the CLIENT can
+     * show someone, not what the relay wrote in its own log.
+     */
+    getStandingReceiverRefusal(agentName: string): (RelayAuthRefusal & {
+        relayPeerId: string;
+    }) | null;
+    /** ─── DELEGATORS — the standing-receiver API other files call ───────────────────────── */
+    standingReceiverAbsenceReason(agentName: string): "daemon_shutting_down" | "standing_receiver_creating" | "agent_offline" | "no_standing_receiver";
+    getStandingReceiverInfo(agentName: string): {
+        peerId: string;
+        addrs: string[];
+    } | null;
+    getStandingReceiverReady(agentName?: string): boolean;
+    getStandingReceiverNode(agentName?: string): CelloNode | null;
+    getStandingReceiverReachability(agentName: string): "reserved" | "ready" | "retrying" | "unreachable" | "absent";
+    getStandingReceiverAutoNat(): IAutoNatService | null;
+    getStandingReceiverAllowedPeer(agentName: string): string | null;
+    admitOfferedDialer(a: string, p: string, sid: string): "narrowed" | "no_receiver" | "no_peer_named";
+    takeReservationForSession(a: string, c: string, cid: string, offerSid?: string): Promise<boolean>;
+    retakeReservationOn(a: string, node: CelloNode, c: string, cid: string): Promise<boolean>;
+    getStandingReceiverRelayIds(a: string): string[];
+    /** 055-ONDEMAND — a live session's own node. Its circuit is not the receiver's; see the release path. */
+    getSessionNodeForTest(a: string, sid: string): CelloNode | null;
+    getOfferedDialer(agentName: string, sessionIdHex: string): string | null;
+    clearOfferedDialer(agentName: string, sessionIdHex: string): void;
+    revokeOfferedDialer(agentName: string, sessionIdHex: string, offeredPeerId: string | null): void;
+    /** ─── DELEGATORS — the leaf-record API other files call ─────────────────────────────── */
+    recordSessionGenesis(agentName: string, sessionId: string, participantA: Uint8Array, participantB: Uint8Array, sessionTimestamp: number, sessionSignature: Uint8Array | undefined, relayAnchorHex?: string): void;
+    /** 069-ORDERPROOF: the relay key this session's ordering attestations are verified against. */
+    sessionRelayAnchor(agentName: string, sessionId: string): string | undefined;
+    persistRelayAnchor(agentName: string, sessionId: string, relayAnchorHex: string | undefined): void;
+    setSessionGenesisForTest(agentName: string, sessionId: string, genesis: Uint8Array): void;
+    recordCertifiedLeafSet(agentName: string, sessionId: string, signedLeaves: readonly SealFrontierLeaf[], sealedRootHex: string, correlationId?: string): boolean;
+    noteCertifiedLeafSetUnavailable(agentName: string, sessionId: string, state: "not_carried_absent_party" | "not_carried_present_party", detail: string): void;
+    getCertifiedLeafSet(agentName: string, sessionId: string): string[] | null;
+    getCertifiedLeafSetState(agentName: string, sessionId: string): {
+        state: string;
+        detail: string | null;
+    } | null;
+    /** ─── DELEGATORS — the held-content seams other files call ──────────────────────────── */
+    holdOwnLeafForTest(agentName: string, sessionId: string, canonicalSeq: number, contentHashHex: string): void;
+    /** ─── DELEGATORS — the witness-alert API other files call ────────────────────────────── */
+    recordRelayWitnessAlert(agentName: string, alert: RelayWitnessAlert): void;
+    getWitnessAlerts(agentName: string): ReadonlyArray<WitnessAlertNotice>;
+    witnessAlertsTruncated(agentName: string): boolean;
+    /** ─── DELEGATORS — the liveness API other files call, unchanged by the split ───────────── */
+    getSessionLiveness(agentName: string, sessionId: string): "alive" | "impaired" | "gone" | "unknown";
+    getSessionImpairment(agentName: string, sessionId: string): SessionImpairment | null;
+    markSessionLivenessForTest(agentName: string, sessionId: string, state: "alive" | "impaired" | "gone"): void;
+    /** ─── DELEGATORS — the test seams other files call, unchanged by the split ─────────────── */
+    mintSessionEphemeralForTest(agentName: string, sessionId: string): void;
+    sessionEphemeralPublicForTest(agentName: string, sessionId: string): Uint8Array | null;
+    setSessionEphemeralForTest(agentName: string, sessionId: string, ephemeral: SessionEphemeral): void;
+    setSessionContentKeyForTest(agentName: string, sessionId: string, key: Uint8Array): void;
+    forgetSessionContentKeyForTest(agentName: string, sessionId: string): void;
+    signOwnEphemeralForTest(agentName: string, sessionId: string): Promise<{
+        ephemeralPublic: Uint8Array;
+        signature: Uint8Array;
+    } | null>;
+    handleEphemeralFrameForTest(agentName: string, sessionId: string, frame: {
+        ephemeralPublic?: Uint8Array;
+        signature?: Uint8Array;
+    }, correlationId?: string): Promise<void>;
+    /**
+     * ─── DELEGATORS — the refusal-notice API other files call, unchanged by the split ──────────
+     *
+     * ⚠️ **REFUSALS LOGGED AND FILED NOTHING, AND THAT IS WHY THIS API EXISTS.** The encryption gate's
+     * three causes each carried a good `impact` and `guidance` at ERROR and none of them called
+     * `noteContentRefusal`, so the sentences an operator needed were in a file they have no reason to
+     * open. From their chair a message never arrived and the conversation went quiet — the exact defect
+     * `DOD-M15-NO-SILENT-REFUSAL-1` was built to end, three checks above the one that respected it.
+     *
+     * Both surfaces, always: the ERROR is the durable forensic record an investigation reads days
+     * later, and the notice is the control — the thing that actually reaches the person.
+     */
+    noteContentRefusal(agentName: string, sessionId: string, reason: string, detail: {
+        kind: RefusalKind;
+        impact: string;
+        guidance: string;
+    }): void;
+    takeContentRefusals(agentName: string, sessionId: string, consumerId: string): Array<Omit<RefusalNotice, "sessionId">>;
+    dismissContentRefusals(agentName: string, sessionId: string): number;
+    takeAgentContentRefusals(agentName: string, consumerId: string): {
+        notices: RefusalNotice[];
+        truncated: boolean;
+    };
+    /**
+     * ─── DELEGATORS — the query API other files call, unchanged by the split ────────────────────
+     */
+    listExpiredUnrevivableSessions(nowMs: number, windowMs: number): Array<{
+        agentName: string;
+        sessionId: string;
+        cause: string | null;
+    }>;
+    listRestartOrphanedSessions(): Array<{
+        agentName: string;
+        sessionId: string;
+        messageCount: number;
+        status: "interrupted" | "seal_interrupted_pending";
+    }>;
+    readQuarantined(agentName: string, sessionId: string, sequence?: number): QuarantinedRecord[];
+    getPinnedCounterpartyPrimary(agentName: string, counterpartyPubkeyHex: string): string | null;
+    recordSealedAnnex(agentName: string, sessionId: string, contentHashHex: string, content: Uint8Array, senderPubkeyHex: string | null): boolean;
+    findNextReceivedAfter(agentName: string, sessionId: string, afterSeq: number): {
+        sequence: number;
+        text: string;
+    } | null;
+    getSealInterruptedArtifacts(agentName: string, sessionId: string): {
+        role: string;
+        ownLeaf: unknown;
+        counterpartyLeaf: unknown;
+        merkleRoot: string;
+        nonce: string;
+    } | null;
+    getSessionsByStatus(status: "active" | "sealed" | "interrupted"): SessionRecord[];
+    recordRefusedSession(agentName: string, sessionId: string, reason: string): void;
+    getAgentRelayEndpoints(agentName: string): Array<{
+        relayPeerId: string;
+        relayAddrs: string[];
+    }>;
+    countActiveSessionsFromUnknownSenders(agentName: string): number;
+    getSealCertificate(agentName: string, sessionId: string): {
+        sealed_root: string;
+        legibility: unknown;
+    } | null;
+    setSessionName(agentName: string, sessionId: string, sessionName: string | null): boolean;
+    getPersistedRelayEndpoint(agentName: string, sessionId: string): {
+        relayPeerId: string;
+        relayAddrs: string[];
+    } | null;
+    markRestartSealGaveUp(agentName: string, sessionId: string, reason: string): void;
+    dismissSession(agentName: string, sessionId: string): {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    };
+    agentNameForId(agentId: string): string | null;
+    getRenameNotices(agentName: string): Array<{
+        pubkey: string;
+        offered_name: string;
+        noticed_at: number;
+        moniker: string | null;
+    }>;
+    sessionsConsumingCap(agentName: string, counterpartyPubkey: string, limit?: number): string[];
+    advanceLastDeliveredSeq(agentName: string, sessionId: string, seq: number): void;
+    countActiveSessionsForCounterparty(agentName: string, counterpartyPubkey: string): number;
+    getSessionRecord(agentName: string, sessionId: string): SessionRecord | null;
+    hasDatabase(): boolean;
+    readSealedAnnex(agentName: string, sessionId?: string): Array<{
+        session_id: string;
+        content_hash: string;
+        sender_pubkey: string | null;
+        text: string;
+        arrived_at: number;
+    }>;
+    counterpartyAbandonedAt(agentName: string, sessionId: string): number | null;
+    getSealedRootHex(agentName: string, sessionId: string): string | null;
+    getLastDeliveredSeq(agentName: string, sessionId: string): number;
+    markSessionsInterruptedByLocalShutdownForTest(): void;
+    wasSessionRefused(agentName: string, sessionId: string): boolean;
+    countReceivedMessages(agentName: string, sessionId: string): number;
+    markInterruptedByCounterpartyForTest(agentName: string, sessionId: string): void;
+    /**
+     * M7-SESSION-004 (AC-005): persist the seal certificate's legibility object with the
+     * sealed record. Stored as a JSON string (hex-encoded pubkeys) so it round-trips a
+     * daemon restart and is returned intact on the cert-read surface. The caller normalises
+     * the raw wire legibility (Uint8Array pubkeys) into a JSON-safe shape before storing.
+     * Best-effort: a session row may not yet exist (the seal arrived before the row was
+     * persisted); in that case we no-op rather than throw — the cert still flows through the
+     * live return path. The legibility content is identical regardless of delivery timing.
+     *
+     * ⚠️ THIS BLOCK WAS STRANDED WHEN THE METHOD BECAME A DELEGATOR. It stayed behind and ended up
+     * stacked on top of `markSealed`'s own doc block, so that method showed two descriptions and the
+     * first one described a different method entirely — and the seal split then carried it into
+     * `session-seal.ts`, where `recordSealCertificate` does not appear at all. Returned to the call
+     * it describes. The row-writing itself lives in `session-queries.ts`.
+     */
+    recordSealCertificate(agentName: string, sessionId: string, sealedRootHex: string, legibilityJson: string): void;
+    recordCounterpartyPrimary(agentName: string, sessionId: string, primaryPubkeyHex: string): void;
+    /**
+     * ─── DELEGATORS — the salt API other files call, unchanged by the split ─────────────────────
+     *
+     * `daemon.ts` and `session-content-handlers.ts` still say `manager.contentHashForSession(...)`.
+     * Keeping the surface identical is what lets the suite stand as evidence that this was a
+     * restructure and not a rewrite.
+     */
+    setSaltContributionForTest(agentName: string, sessionId: string, contribution: Uint8Array): void;
+    forgetSaltContributionForTest(agentName: string, sessionId: string): void;
+    contentHashForSession(agentName: string, sessionId: string, content: Uint8Array): Promise<{
+        hash: Uint8Array;
+        alg: ContentHashAlg;
+    }>;
+    abandonUnsaltedHash(agentName: string, sessionId: string): void;
+    isContentSaltActive(agentName: string, sessionId: string): boolean;
+    expectSaltAgreement(agentName: string, sessionId: string): void;
+    saltForHashingForTest(agentName: string, sessionId: string): Promise<{
+        salt: Uint8Array | null;
+        reason?: string;
+    }>;
+    /**
+     * ─── DELEGATORS — the mailbox API other files call, unchanged by the split ───────────────────
+     *
+     * `content-park.ts` and `daemon.ts` still say `manager.recoverParkedEntry(...)` and
+     * `manager.setContentParkHook(...)`. Keeping the surface identical is what lets the full suite
+     * stand as evidence that this was a move: a caller that had to change would mean the contract
+     * moved with it.
+     */
+    injectParkFault(count: number, cause?: string): number;
+    getParkFaultRemaining(): number;
+    setContentParkHook(fn: (args: {
+        agentName: string;
+        sessionId: string;
+        recipientPubkeyHex: string;
+        relayPeerId: string;
+        relayAddrs: readonly string[];
+        contentHashHex: string;
+        content: Uint8Array;
+        structure1Cbor?: Uint8Array;
+        structure2Cbor?: Uint8Array;
+        structure1Signature?: Uint8Array;
+        leafKind?: number;
+        contentHashAlg: string | undefined;
+    }) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+        cause?: string;
+        retryAfterMs?: number;
+    }>): void;
+    setParkedDrainHook(fn: (agentName: string, reason: ParkedDrainReason) => void): void;
+    recoverOwnSealCtrlLeafForTest(agentName: string, sessionId: string): {
+        reportedRootHex: string;
+        sequenceNumber: number;
+    } | "none" | "unknown";
+    recoverParkedEntry(agentName: string, sessionId: string, recipientPubkey: Uint8Array, unsealed: Uint8Array, contentHash: Uint8Array, correlationId?: string): ReturnType<ParkRecovery["recoverParkedEntry"]>;
+    /**
+     * ─── DELEGATORS — the class API is unchanged by the split, deliberately ──────────────────────
+     *
+     * Every method below moved into `session-records.ts` with its implementation and its comments.
+     * These one-liners exist so that no CALLER had to change: `contact-handlers.ts`, the IPC surface
+     * and the tests all still say `manager.getTier(...)`. That is what lets the full suite stand as
+     * the evidence that this was a move and not a rewrite — a test that had to change would have
+     * meant behaviour moved (Rule B).
+     *
+     * They are the price of the split and they are the cheap half: one line each, no logic, and the
+     * prose that explains each rule lives beside the code that enforces it.
+     */
+    isContact(agentName: string, pubkey: string): boolean;
+    getTier(agentName: string, pubkey: string): number;
+    resolveTierBound(agentName: string, tier: number, field: "max_sessions" | "max_bytes"): number;
+    addContact(agentName: string, pubkey: string, moniker?: string | null, provenance?: string | null, tier?: number): void;
+    setContactMoniker(agentName: string, pubkey: string, moniker: string | null): boolean;
+    setContactSignalPref(agentName: string, pubkey: string, signalHash: string, present: boolean | null): void;
+    getContactSignalPrefs(agentName: string, pubkey: string): Map<string, boolean>;
+    setContactAwayMessage(agentName: string, pubkey: string, message: string | null): boolean;
+    setContactTier(agentName: string, pubkey: string, tier: number): boolean;
+    recordOfferedMoniker(agentName: string, pubkey: string, offered: string): void;
+    removeContact(agentName: string, pubkey: string): boolean;
+    getContactMoniker(agentName: string, pubkey: string): string | null;
+    listContacts(agentName: string): Array<{
+        pubkey: string;
+        added_at: number;
+        moniker: string | null;
+        tier: number | null;
+        provenance: string | null;
+        sealed_count: number;
+        last_spoke: number | null;
+    }>;
+    clearRenameNotice(agentName: string, pubkey: string): void;
+    clearPinnedCounterpartyPrimary(agentName: string, counterpartyPubkeyHex: string): number;
+    getTelegramSettings(): {
+        botToken: string;
+        allowlistedChatId: string;
+    } | null;
+    setTelegramSettings(botToken: string, allowlistedChatId: string): void;
+    getSetting(agentName: string, key: string): string | null;
+    deleteSetting(agentName: string, key: string): boolean;
+    setSetting(agentName: string, key: string, value: string): void;
+    getAllSettings(agentName: string): Array<{
+        key: string;
+        value: string;
+    }>;
+    recordRelayWitnessUnreadable(agentName: string, relayPeerId: string, why: string): void;
+    getWitnessUnreadable(agentName: string): ReadonlyArray<{
+        relayPeerId: string;
+        why: string;
+        count: number;
+    }>;
+    recordTranscriptMessage(agentName: string, sessionId: string, sequence: number, direction: "sent" | "received" | "quarantined", plaintext: Uint8Array, correlationId?: string, authorship?: {
+        senderPubkey: Uint8Array;
+        senderSig: Uint8Array;
+    }, quarantineReason?: string, senderPubkeyHexOverride?: string | null): boolean;
+    readTranscript(agentName: string, sessionId: string): {
+        messages: TranscriptEntry[];
+        undecryptable: number;
+    };
+    getUnreadSummary(agentName: string): Array<{
+        session_id: string;
+        unread_count: number;
+        last_seq: number;
+    }>;
+    getEndedUnread(agentName: string): Array<{
+        session_id: string;
+        unread_count: number;
+        last_seq: number;
+        status: string;
+    }>;
+    getUnreadReceivedCount(agentName: string, sessionId: string): number;
+    markSessionDiverged(agentName: string, sessionId: string): void;
+    /**
+     * DOD-M15-CLOSEDSESSION-1 — has THIS side committed its half of the seal? The state a status row
+     * cannot show; the reasoning is in `session-closed.ts`.
+     *
+     * ⚠️ THE MARK IS MEMORY-ONLY, so the durable evidence is the second half of the answer (review
+     * F7). `#responderSealSubmitted` is cleared on teardown, so a daemon that stopped between the
+     * ctrl-leaf submit and the ceremony's status write comes back with an `active` row and no mark —
+     * and the original defect reproduces on the first send. Our own SEAL ctrl leaf is in
+     * `session_seal_leaves`, which is what the seal path itself consults before submitting a second.
+     *
+     * `"unknown"` — the read FAILED — is deliberately not treated as closed. It is the answer a
+     * broken database gives, and wedging every live session shut on it would be a far worse failure
+     * than the window it would close.
+     */
+    hasCommittedSealLeaf(agentName: string, sessionId: string): boolean;
+    /** DOD-M15-CLOSEDSESSION-1 test seam: commit this side's half with no relay, by marking the REAL map production reads. */
+    markSealLeafCommittedForTest(agentName: string, sessionId: string): void;
+    isSessionDiverged(agentName: string, sessionId: string): boolean;
+    /** Arm the direct-send fault — makes the next N sends take the dial-failure path. */
+    injectSendFault(count: number): number;
+    /** DOD-M12B-ACK-1: arm the delivery-ACK write fault — the sibling of injectSendFault for the
+     *  path that fails on a LISTENING agent. Without it the ACK failure branch (which impairs the
+     *  session and, until this milestone, could never clear it again) is unreachable from a test:
+     *  a listener sends no content, so the direct-send fault never fires for it. */
+    injectAckFault(count: number): number;
+    /** DOD-M12B-REDIAL-1: arm the connection-loss fault — the next N direct sends find no open
+     *  connection, exactly as they do after any blip. See #connectionLossRemaining. */
+    injectConnectionLoss(count: number): number;
+    constructor(opts: {
+        factory: ISessionNodeFactory;
+        logger: Logger;
+        dbPath: string;
+        contentTtfMs?: number;
+        /**
+         * CELLO-M7-TRANSPORT-001: provider for the AutoNAT directory-node prober set
+         * (SI-002). Defaults to () => [] (reconnecting — no probers), which makes
+         * dialability the conservative default and fires transport.autonat.unavailable.
+         */
+        autoNatProbers?: () => string[];
+        /**
+         * M8B F14: backoff schedule for standing-receiver create retries. Attempt 1 runs
+         * immediately; each entry is the delay before the next attempt. Default covers the
+         * fixed-port race where a teardown and a re-arm interleave (EADDRINUSE clears once
+         * the old node's port is released). Tests inject short delays or [] (no retries).
+         */
+        standingReceiverRetryDelaysMs?: number[];
+        /**
+         * DOD-NAT-REACHABILITY-1: how long a standing receiver may wait for its
+         * circuit-relay reservations before coming up WITHOUT them. libp2p's circuit
+         * listener has no timeout of its own — an unreachable relay would park start()
+         * forever and leave the agent with no receiver at all. See #startReceiverNode.
+         */
+        standingReceiverReservationTimeoutMs?: number;
+        /**
+         * DOD-NAT-REACHABILITY-1: how often to check that a standing receiver still HOLDS
+         * the reservation it came up with. A dead relay makes the /p2p-circuit address
+         * vanish silently — the agent looks healthy and is unreachable to every NAT'd peer.
+         */
+        standingReceiverWatchdogIntervalMs?: number;
+        /**
+         * DOD-M12B-RESERVATION-RETRY-1: base delay before re-attempting a circuit reservation the relay
+         * refused. Doubles per attempt. Default 5 minutes — deliberately NOT the watchdog's grid, because
+         * a reservation is a scarce resource the relay holds for its full TTL and churning attempts is
+         * how a fleet exhausts one.
+         */
+        standingReceiverReservationRetryMs?: number;
+        /**
+         * DOD-PARK-DRAIN-1: how often the parked-mailbox BACKSTOP drain runs for an agent with a
+         * healthy standing receiver. Rides the reservation watchdog's grid, so the effective period is
+         * this value rounded up to a watchdog interval. Default 5 minutes: the trigger-driven drains do
+         * the real work, and this only exists so a future missed trigger degrades to "late", never to
+         * "stranded until a human restarts the daemon".
+         */
+        parkedDrainBackstopMs?: number;
+        /**
+         * M9-CORE-001: the inbound security-screening seam. When absent, a
+         * REQUIRED — there is no always-allow default (INV-9). A caller that does not screen must
+         * say so by passing PassthroughGatewayClient from `@cello-protocol/gateway/testing`.
+         */
+        securityGateway: SecurityGatewayClient;
+    });
+    /**
+     * CELLO-M7-MSG-001: wire the durable-backstop side effects of the awaiting-ACK
+     * lifecycle. `onPersisted` clears the durable retry_queue entry when a persisted ACK
+     * arrives; `onTtf` records/parks the un-acked content when the TTF timer fires.
+     * Injected by the composition root (daemon.ts) after the RetryQueue exists.
+     */
+    setAwaitingAckHooks(hooks: {
+        onPersisted?: (agentName: string, sessionId: string, contentHashHex: string) => void;
+        onTtf?: (agentName: string, sessionId: string, contentHashHex: string, content: Uint8Array, structure1Cbor?: Uint8Array, structure2Cbor?: Uint8Array, contentHashAlg?: string, structure1Signature?: Uint8Array, leafKind?: number) => void;
+        onParkFailed?: (agentName: string, sessionId: string, contentHashHex: string, content: Uint8Array, structure1Cbor?: Uint8Array, structure2Cbor?: Uint8Array, contentHashAlg?: string, structure1Signature?: Uint8Array, leafKind?: number) => boolean;
+    }): void;
+    /**
+     * DOD-RETRYQ-STRAND-1: wire the disposition of durable state a session can no longer drain.
+     * Fires once per transition INTO a status from which no resend can succeed. Injected by the
+     * composition root (daemon.ts) after the RetryQueue exists.
+     */
+    setSessionTerminalHook(hook: (sessionId: string, terminalStatus: "sealed" | "abandoned") => void): void;
+    initialize(): Promise<void>;
+    /**
+     * Get the underlying DatabaseSync handle.
+     * Used by the composition root (daemon.ts) to pass to RetryQueue and
+     * NonceDedupStore — they share the same SQLCipher DB file (DAEMON-003 AC-008).
+     */
+    /**
+     * Get the underlying DaemonDatabase handle (the SQLCipher-backed adapter). Used by the
+     * composition root (daemon.ts) to pass to RetryQueue and NonceDedupStore — they share the same
+     * encrypted DB file.
+     */
+    getDb(): DaemonDatabase;
+    /** DOD-TIER-4: the DISPLAY/relationship check — is this counterparty a genuine contact (KNOWN or
+     *  above)? Replaces the old binary `isContact` for behaviour that keyed on "we have a relationship"
+     *  (e.g. the away-response wording). An UNKNOWN-tier contact (a mere row) is NOT known. */
+    isKnown(agentName: string, pubkey: string): boolean;
+    /** DOD-TIER-4: the POLICY gate — may an inbound session from this counterparty be auto-accepted
+     *  when the operator is unattended (WHITELISTED or VIP)? The behavioural consumer is the offline
+     *  relay mailbox (LEAVEMSG-1), out of scope for this unit; defined here as the seam. Being merely
+     *  KNOWN is NOT enough to auto-accept — whitelisting is the deliberate `cello_contact_set_tier` act. */
+    isAutoAccept(agentName: string, pubkey: string): boolean;
+    /** DOD-AWAY-TIER-1: resolve the most-specific CUSTOM away text for a counterparty, most-specific
+     *  first: per-contact `away_message` → per-tier away setting → agent default away setting. Returns
+     *  null when none is configured, so the CALLER applies the system default (code) — making the full
+     *  four-level resolution TOTAL. A pure read; the resolved text is screened on the outbound path by
+     *  the caller like any content (SI — it does not bypass the gateway). */
+    resolveAwayMessage(agentName: string, pubkey: string): string | null;
+    /** M8C-ABUSE-1 + DOD-TIER-2/3: is a NEW inbound session from this counterparty within the
+     *  acceptance bounds? The per-sender cap is now the sender's TIER cap (DEFAULT_TIER_BOUNDS), not a
+     *  flat "3 for strangers, unbounded for contacts". This is where DOD-TIER-3 falls out for free: a
+     *  BLOCKED sender's cap is 0, so `perSender (>= 0) >= 0` refuses it through the SAME reason and the
+     *  SAME path an over-cap UNKNOWN takes — no separate blocked branch, no distinguishing oracle. The
+     *  global anti-swarm cap then applies ONLY to UNKNOWN-tier senders (KNOWN+ are trusted, not part of
+     *  the stranger pool; BLOCKED never reaches it). Checked BEFORE accepting a fresh inbound session
+     *  (counts reflect sessions already active, not yet counting this one). */
+    checkUnknownSenderAcceptanceBound(agentName: string, counterpartyPubkey: string): {
+        ok: true;
+    } | {
+        ok: false;
+        reason: CapacityReason;
+    };
+    /**
+     * M7-SESSION-001 (M-1 PUSH): register the session-state-change callback.
+     * Called by the composition root (daemon.ts) after the NotificationDispatcher
+     * exists. Setter injection avoids a construction-order/circular dependency.
+     */
+    setOnSessionStateChanged(cb: (agentName: string, sessionId: string, state: string, counterpartyPubkey: string | null) => void): void;
+    /**
+     * M8C-MSGWAKE-1: inject the content-arrival callback (daemon.ts → NotificationDispatcher.
+     * dispatchCelloMessage). Setter injection, same construction-order reason as above.
+     */
+    setOnContentArrived(cb: (agentName: string, sessionId: string, senderPubkey: string) => void): void;
+    /** M14 / DOD-DOC-INBOUND-2: inject the document-frame interception. See the field's note. */
+    setOnDocumentFrame(cb: (agentName: string, sessionId: string, content: Uint8Array, senderPubkey: string, correlationId?: string) => {
+        consumed: boolean;
+        kind?: string;
+        ok?: boolean;
+        reason?: string;
+    }, classifyOnly?: (content: Uint8Array) => boolean): void;
+    /**
+     * DOD-AGENT-ID-JOINKEY-1: the public form of the name→stable-id resolver, for components that own
+     * agent-scoped tables of their own (RetryQueue) and must be handed the STABLE key, never a name.
+     * The daemon resolves ONCE, at its own boundary, exactly as this class does internally. Throws on
+     * an unresolvable name — see #requireAgentId for why null is not an option.
+     */
+    resolveAgentId(agentName: string): string;
+    /**
+     * DOD-M12B-ACK-1 — live `/cello/content/1.0.0` stream counts on a session's direct path, or null
+     * when the session has no active node.
+     *
+     * Answerable at runtime on purpose, in the same spirit as getConnectionMonitorPolicy: the count
+     * is what decides whether the next send survives, and until this existed it could only be
+     * recovered by measuring a log after the fact. It is also what lets the regression assert that a
+     * slot was RELEASED, rather than that some particular number of messages happened to fit.
+     */
+    countSessionContentStreams(agentName: string, sessionId: string): {
+        inbound: number;
+        outbound: number;
+    } | null;
+    gracefulShutdown(): Promise<void>;
+    /**
+     * DOD-M12B-REVIVAL-BOUND-1 — close every session the revival window has expired.
+     *
+     * `abandonSession` is the right instrument and already exists: it flips the status FIRST and
+     * synchronously, annexes held content so the operator does not lose mail that has nowhere to go,
+     * and retires the node. It notarizes nothing, which is the point — we are closing a door, not
+     * asserting how it came to be open.
+     *
+     * One session's failure must not strand the rest, so each is caught and logged; the sweep runs at
+     * boot beside the restart-seal resolver and a throw there would take the daemon with it.
+     *
+     * @returns how many sessions actually flipped — not how many were attempted.
+     */
+    closeExpiredUnrevivableSessions(nowMs: number, windowMs: number): Promise<number>;
+    getSessionsForAgent(agentName: string): SessionRecord[];
+    /**
+     * Every persisted session across ALL agents, most-recently-updated first. Backs the daemon-wide
+     * `cello sessions` CLI surface (which has no per-connection current agent, unlike the MCP
+     * cello_list_sessions). Classification + filtering + the count limit are applied by the caller.
+     */
+    getAllSessions(): SessionRecord[];
+    createSessionNode(...args: Parameters<SessionLifecycle["createSessionNode"]>): ReturnType<SessionLifecycle["createSessionNode"]>;
+    acceptSession(...args: Parameters<SessionLifecycle["acceptSession"]>): ReturnType<SessionLifecycle["acceptSession"]>;
+    destroySessionNode(...args: Parameters<SessionLifecycle["destroySessionNode"]>): ReturnType<SessionLifecycle["destroySessionNode"]>;
+    retireSessionNode(...args: Parameters<SessionLifecycle["retireSessionNode"]>): ReturnType<SessionLifecycle["retireSessionNode"]>;
+    markInterruptedWithDetails(...args: Parameters<SessionLifecycle["markInterruptedWithDetails"]>): ReturnType<SessionLifecycle["markInterruptedWithDetails"]>;
+    connectToCounterparty(...args: Parameters<SessionLifecycle["connectToCounterparty"]>): ReturnType<SessionLifecycle["connectToCounterparty"]>;
+    notifyCounterpartyAbandon(...args: Parameters<SessionLifecycle["notifyCounterpartyAbandon"]>): ReturnType<SessionLifecycle["notifyCounterpartyAbandon"]>;
+    retireOnCounterpartyAbandon(...args: Parameters<SessionLifecycle["retireOnCounterpartyAbandon"]>): ReturnType<SessionLifecycle["retireOnCounterpartyAbandon"]>;
+    reviveSessionNode(...args: Parameters<SessionLifecycle["reviveSessionNode"]>): ReturnType<SessionLifecycle["reviveSessionNode"]>;
+    reviveIfNeededForSend(...args: Parameters<SessionLifecycle["reviveIfNeededForSend"]>): ReturnType<SessionLifecycle["reviveIfNeededForSend"]>;
+    reviveIfNeededForRead(...args: Parameters<SessionLifecycle["reviveIfNeededForRead"]>): ReturnType<SessionLifecycle["reviveIfNeededForRead"]>;
+    abandonSession(...args: Parameters<SessionLifecycle["abandonSession"]>): ReturnType<SessionLifecycle["abandonSession"]>;
+    getSessionNodePeerId(...args: Parameters<SessionLifecycle["getSessionNodePeerId"]>): ReturnType<SessionLifecycle["getSessionNodePeerId"]>;
+    /**
+     * ⚠️ EVERY TRIVIAL DELEGATOR IN THIS FILE IS ONE LINE, and that is a ratchet decision rather than
+     * a formatting preference. Thirty-seven of them were five lines each: a signature line, a
+     * `Parameters<>` line, a `ReturnType<>` line, a forward and a brace. That is ~150 lines of the
+     * budget spent on punctuation, in the file the `max-lines` pin exists to shrink — and it is
+     * budget that cannot then be spent on the comments this file's prose is actually for.
+     *
+     * The signatures stay DERIVED, which is the property that matters: a change to the moved method
+     * changes this one, so a copy can never drift from its original.
+     */
+    setDirectoryRelayEndpoints(...args: Parameters<SessionRelay["setDirectoryRelayEndpoints"]>): ReturnType<SessionRelay["setDirectoryRelayEndpoints"]>;
+    registerRelayStream(...args: Parameters<SessionRelay["registerRelayStream"]>): ReturnType<SessionRelay["registerRelayStream"]>;
+    isRelayCarvedOutInbound(...args: Parameters<SessionRelay["isRelayCarvedOutInbound"]>): ReturnType<SessionRelay["isRelayCarvedOutInbound"]>;
+    isRelayQuarantined(...args: Parameters<SessionRelay["isRelayQuarantined"]>): ReturnType<SessionRelay["isRelayQuarantined"]>;
+    quarantineRefusedInbound(...args: Parameters<SessionRelay["quarantineRefusedInbound"]>): ReturnType<SessionRelay["quarantineRefusedInbound"]>;
+    quarantineFrameMeta(...args: Parameters<SessionRelay["quarantineFrameMeta"]>): ReturnType<SessionRelay["quarantineFrameMeta"]>;
+    getRelayReceipts(...args: Parameters<SessionRelay["getRelayReceipts"]>): ReturnType<SessionRelay["getRelayReceipts"]>;
+    patchRelayClientForTest(...args: Parameters<SessionRelay["patchRelayClientForTest"]>): ReturnType<SessionRelay["patchRelayClientForTest"]>;
+    getSessionRelayForTest(...args: Parameters<SessionRelay["getSessionRelayForTest"]>): ReturnType<SessionRelay["getSessionRelayForTest"]>;
+    submitSealLeaf(...args: Parameters<SessionSeal["submitSealLeaf"]>): ReturnType<SessionSeal["submitSealLeaf"]>;
+    setCurrentAttendanceSource(fn: (agentName: string) => "attended" | "unattended" | "offline"): void;
+    announceAttendance(agentName: string, attendance: "attended" | "unattended" | "offline"): void;
+    /**
+     * DOD-M15-AWAYSCOPE-1 — ask the relay what it knows about the counterparty of ONE session.
+     *
+     * ⚠️ NOT `getSessionLiveness`, which is a different question with a different answer. That one is
+     * daemon-local: does THIS process hold a libp2p connection for the session, and it has a fourth
+     * value (`impaired`) the wire type does not. This one asks the RELAY, which sees the counterparty's
+     * standing connection even when this daemon has no direct link to them, and it is the only path
+     * that can carry attendance — because attendance is the far daemon's own assertion, relayed.
+     *
+     * Returns null when there is nothing to ask: no session, or a session with no relay behind it.
+     * That is distinct from an answer of 'unknown', which means the relay was asked and did not know.
+     */
+    queryRelayLiveness(agentName: string, sessionId: string): Promise<LivenessAnswer | null>;
+    sealReadiness(...args: Parameters<SessionSeal["sealReadiness"]>): ReturnType<SessionSeal["sealReadiness"]>;
+    sealReadinessView(...args: Parameters<SessionSeal["sealReadinessView"]>): ReturnType<SessionSeal["sealReadinessView"]>;
+    verifyCertifiedRoot(...args: Parameters<SessionSeal["verifyCertifiedRoot"]>): ReturnType<SessionSeal["verifyCertifiedRoot"]>;
+    getSealCarry(...args: Parameters<SessionSeal["getSealCarry"]>): ReturnType<SessionSeal["getSealCarry"]>;
+    markSealed(...args: Parameters<SessionSeal["markSealed"]>): ReturnType<SessionSeal["markSealed"]>;
+    recordSealCertificateEnsuringRow(...args: Parameters<SessionSeal["recordSealCertificateEnsuringRow"]>): ReturnType<SessionSeal["recordSealCertificateEnsuringRow"]>;
+    persistSealInterruptedCommitment(...args: Parameters<SessionSeal["persistSealInterruptedCommitment"]>): ReturnType<SessionSeal["persistSealInterruptedCommitment"]>;
+    getSealUpgradeReadiness(...args: Parameters<SessionSeal["getSealUpgradeReadiness"]>): ReturnType<SessionSeal["getSealUpgradeReadiness"]>;
+    countersignedThroughSeqFromCarry(...args: Parameters<SessionSeal["countersignedThroughSeqFromCarry"]>): ReturnType<SessionSeal["countersignedThroughSeqFromCarry"]>;
+    setEnsureSealBroker(...args: Parameters<SessionSeal["setEnsureSealBroker"]>): ReturnType<SessionSeal["setEnsureSealBroker"]>;
+    ingestReceivedContent(...args: Parameters<SessionContentIngest["ingestReceivedContent"]>): ReturnType<SessionContentIngest["ingestReceivedContent"]>;
+    /**
+     * ⚠️ **THE CHOKE POINT, AND THE GATE BELONGS HERE RATHER THAN ON `cello_send` ALONE — review F2.**
+     *
+     * `DOD-M15-CLOSEDSESSION-1` put a closed-session refusal on the `cello_send` handler, which is
+     * where the operator's sentence is shaped. Three other production callers place content leaves
+     * without passing through it — the document delivery transport, and both away-reply sends in the
+     * attendance wiring — and each reuses a session whose row says `active`, which is exactly the
+     * row the seal ceremony leaves standing while it finishes. So a document push could still land a
+     * leaf in a conversation this side had already sealed.
+     *
+     * This is the argument the inbound path already makes for its own shared gate: placing the check
+     * above the dispatch makes it the DEFAULT, so a fourth caller added later is covered by
+     * construction rather than by whoever adds it reading this comment.
+     *
+     * `durable: false` is the load-bearing field: it tells the caller nothing was witnessed and
+     * nothing was queued, so no leaf may be committed for this.
+     */
+    sendContent(...args: Parameters<SessionContentSender["sendContent"]>): ReturnType<SessionContentSender["sendContent"]>;
+    /** DOD-M15-SEALPRECOND-1 — see SessionContentSender.noteOwnLeafOrdered. */
+    noteOwnLeafOrdered(...args: Parameters<SessionContentSender["noteOwnLeafOrdered"]>): ReturnType<SessionContentSender["noteOwnLeafOrdered"]>;
+    placeOwnLeaf(...args: Parameters<SessionContentSender["placeOwnLeaf"]>): ReturnType<SessionContentSender["placeOwnLeaf"]>;
+    recordWitnessedSequence(...args: Parameters<SessionContentIngest["recordWitnessedSequence"]>): ReturnType<SessionContentIngest["recordWitnessedSequence"]>;
+    getUndeliverableSeqs(...args: Parameters<SessionContentIngest["getUndeliverableSeqs"]>): ReturnType<SessionContentIngest["getUndeliverableSeqs"]>;
+    handleContentFrameForTest(...args: Parameters<SessionContentIngest["handleContentFrameForTest"]>): ReturnType<SessionContentIngest["handleContentFrameForTest"]>;
+    /** Loaded from SQLite on first access so it survives a restart (AC-007). NEVER null: an unknown session yields an EMPTY tree. */
+    getSessionTree(agentName: string, sessionId: string): SessionTree;
+    /** Current daemon-owned tree root for a session, as hex. */
+    getSessionTreeRootHex(agentName: string, sessionId: string): string;
+    /**
+     * Append a leaf (by its 32-byte leaf-hash hex) to the daemon-owned tree,
+     * persist it, advance the root, and fire session.tree.appended.
+     *
+     * @returns the new leaf index and the recomputed root hex.
+     */
+    appendSessionLeaf(agentName: string, sessionId: string, kind: WritableSessionTreeLeafKind, leafHashHex: string, correlationId?: string): {
+        leafIndex: number;
+        newRootHex: string;
+    };
+    /** DOD-M12B-LEAF-TRIGGERS-FETCH-1 test seams. */
+    setLeafFetchGraceMsForTest(ms: number): void;
+    markContentPresentForTest(agentName: string, sessionId: string, contentHashHex: string): void;
+    /**
+     * DOD-CAP-SELF-HEAL-1 — the numbers behind a cap refusal, for the OPERATOR'S alarm only.
+     *
+     * Kept off `checkUnknownSenderAcceptanceBound`'s return on purpose. That refusal is byte-identical
+     * across tiers by design (DOD-TIER-3) so a blocked party cannot tell blocking from throttling;
+     * attaching the counts to it would put the oracle straight into the value the refusal path
+     * carries. This is a separate, purely local read, and nothing it returns crosses the wire.
+     */
+    capDiagnostics(agentName: string, counterpartyPubkey: string): {
+        tier: number;
+        cap: number;
+        counted: number;
+        mustClear: number;
+        blocked: boolean;
+    };
+    /**
+     * THE IN-MEMORY ARRIVAL BUFFER WAS HERE, with `takeReceivedContent`, `pushReceivedContentForTest`
+     * and `peekLatestReceivedContentHex`. All three are gone, and so is the buffer.
+     *
+     * It kept the plaintext of the last 32 messages of every live session in daemon memory for the
+     * life of the process. `cello_receive` stopped draining it at DOD-COATTEND-1, when delivery moved
+     * onto the durable transcript; the away responder's peek at its tail was the last reader, and
+     * DOD-M15-AWAYSCOPE-1 deleted that with the branch that answered an accepted session. What
+     * remained was every conversation this agent had, held in memory, for nobody.
+     *
+     * Tests that asked it "did this message reach the agent" now ask the transcript, which is what
+     * production serves — see `__tests__/helpers/received-rows.ts` for why the answer is the same.
+     */
+    /**
+     * F1-b: the terminal answer for a session that sealed while a blocking receive was (or could be)
+     * waiting. Idempotent — a sealed session always answers "sealed" to a receive. Null while active.
+     *
+     * DOD-TERMINAL-WAKE-1: the in-memory marker is written only by `destroySessionNode`, so it does
+     * NOT survive a restart — while the `sealed` row on disk does. Reading the absent marker as "not
+     * terminal" is what let a sealed session's unread message come back as live work hours later, and
+     * an agent obey a `[[STANDBY]]` directive out of a conversation that had already ended. Absent is
+     * not fine: fall through to the durable record, which is the authority the marker only caches.
+     */
+    peekTerminalMarker(agentName: string, sessionId: string): {
+        type: "sealed";
+        unreadCount: number;
+    } | null;
+    /**
+     * DOD-MSG-4 (self-ordering content frame): verify the relay's signed ordering record carried IN the
+     * content frame and record the canonical sequence for the strict-in-order gate — so ordering does
+     * not depend on the separate leaf_deliver witness arriving first. Best-effort: any failure (malformed,
+     * hash mismatch, bad signature, wrong signer) is logged and ignored — the content still ingests and
+     * orders via the witness stream / arrival, so a bad record cannot block delivery.
+     *
+     * structure1_cbor = [1, content_hash(32), sender_pubkey(32), session_id(16), last_seen_seq, ts] —
+     *   the EXACT bytes the sender signed (needed to verify; Structure2 omits session_id/last_seen/ts).
+     * structure2_cbor = [seq, sender_pubkey, content_hash, sender_signature, scan_result, prev_root].
+     */
+    /**
+     * DOD-MSG-4 (2b) / SEC-1: decode a park envelope. Legacy/unsigned shapes still DECODE so that
+     * `recoverParkedEntry` can refuse them BY NAME (`unsigned_envelope`) — decoding is not accepting.
+     * Encoding lives in park-envelope.ts and REQUIRES a sender signature (see SEC-1); it is not
+     * exposed here, so no caller can seal an unsigned envelope through this class.
+     */
+    decodeParkEnvelope(plaintext: Uint8Array): ParkEnvelope;
+    /**
+     * DOD-MSG-4 (2b): public entry for the recover path to verify + record a parked entry's ordering
+     * record (the recover handler lives in daemon.ts, which has no access to the private method).
+     */
+    recordOrderingRecord(agentName: string, sessionId: string, structure1Cbor: Uint8Array, structure2Cbor: Uint8Array, contentHash: Uint8Array, correlationId?: string): number | null;
+    /**
+     * Test seam: see every decoded inbound content frame, as it arrived.
+     *
+     * Review F4. The "bytes on the wire are ciphertext" claim needs the ACTUAL frame; asserting on a
+     * freshly sealed stand-in tests the crypto primitive and stays green when the send path is
+     * reverted to putting plaintext on the wire. There is no other way to reach the decoded frame from
+     * outside — the handler consumes it and hands ingest the plaintext.
+     *
+     * Read-only by construction: the callback receives the frame and cannot influence routing.
+     */
+    observeInboundContentFramesForTest(cb: (frame: Record<string, unknown>) => void): void;
+    /** Injected by the daemon once its per-agent key providers exist. See `#keyProviderResolver`. */
+    setKeyProviderResolver(resolver: (agentName: string) => KeyProvider | undefined): void;
+    /**
+     * Test seam: run the auto-acknowledge gate, exactly as the counterparty's SEAL ctrl leaf does.
+     *
+     * `DOD-M15-SEALWIRE-1` part B1, review F-B. The gate has ONE production call site — inside the
+     * relay leaf handler, behind `leaf_kind === CTRL && !authored_by_us` — so reaching it from a test
+     * needs a live relay client delivering a real ctrl leaf. The consequence was measured: my
+     * "tampered never downgrades" test wrapped its decisive assertion in
+     * `if (skipped.length > 0)`, which was ALWAYS FALSE, so the whole `content_tamper` vs
+     * `content_verification_unavailable` branch had no coverage anywhere in the repo and two mutants
+     * on it survived the full gate.
+     *
+     * It calls the REAL method (public on `SessionSeal` since the split, private before it) rather than reproducing its logic, so a test cannot pass
+     * against a decision production does not make.
+     */
+    runAutoAcknowledgeGateForTest(agentName: string, sessionId: string, correlationId?: string): void;
+    /**
+     * Test seam: deliver an inbound salt frame, exactly as the content-stream decoder does.
+     *
+     * 006-CRYPTO finding 2. WHICH of the four reasons the peer gave decides what the operator is told,
+     * and reaching that decision from a test otherwise needs a second live daemon that has closed
+     * adoption for a specific reason — which is not something a counterparty can be asked to do on
+     * demand. The four labels are the whole point of the finding, so they need to be reachable.
+     *
+     * It calls the REAL private handler rather than reproducing its routing, so a test cannot pass
+     * against a decision production does not make. It takes the DECODED frame, so it deliberately
+     * does NOT stand in for the decoder above it — the length and vocabulary checks there have their
+     * own tests driving `handleContentFrameForTest`.
+     */
+    handleSaltFrameForTest(agentName: string, sessionId: string, frame: SaltAgreementFrame, correlationId?: string): Promise<void>;
+    /**
+    
+  
+    /**
+      /**
+     * TEST SEAM — put a session into the state a real one is in between announcing and being answered.
+     *
+     * Reaching that state for real needs a live counterparty connection, which the daemon-level fixtures
+     * do not have. It calls the same private registration the announce path calls, so it cannot drift.
+     */
+    markSaltAgreementPendingForTest(agentName: string, sessionId: string, boundMs?: number): void;
+    getSessionContentSalt(agentName: string, sessionId: string): Uint8Array | null;
+    /**
+     * THE SALT, OR WHY THERE ISN'T ONE — `DOD-M15-INCLUSION-1`, fallback-finder finding 2.
+     *
+     * `getSessionContentSalt` above answers `null` for THREE different situations, and a caller that
+     * turns that null into a sentence for an operator gets two of them wrong:
+     *
+     *   `none`       — no salt was ever agreed. The session really is unsalted.
+     *   `unreadable` — a salt row EXISTS and could not be used: the wrong width (corruption on this
+     *                  operator's own disk), or the read threw.
+     *
+     * The distinction is not cosmetic. `unreadable` means the session's leaves WERE hashed under a
+     * salt, so telling its operator *"this session's content hashes are UNSALTED … start a session
+     * while you are both connected"* is an affirmatively false statement about a security property
+     * their session has, and it points them at their counterparty over damage to their own database.
+     * That is the same defect `#getSessionSalt`'s own F8 note was written to end, re-committed one
+     * surface out.
+     *
+     * ⚠️ IT DELEGATES — there is no second read here. Calling `#getSessionSalt` first means the salt
+     * this reports is the salt the hashing path uses, including its cache and its wrong-width refusal.
+     * A parallel query would be free to disagree with it, which is the whole failure this returns a
+     * reason to prevent.
+     */
+    getSessionContentSaltState(agentName: string, sessionId: string): {
+        salt: Uint8Array;
+    } | {
+        salt: null;
+        reason: "none" | "unreadable";
+    };
+    /**
+     * DOD-M15-RELAYSLOTS-1: accept the directory's online token for an agent. Called on every
+     * signaling connect and reconnect, which is what keeps it fresh.
+     */
+    setDirectoryOnlineToken(agentName: string, token: Uint8Array): void;
+    setDirectoryOnlineTokenAbsent(agentName: string, reason: "not_registered_here" | "issue_failed" | undefined): void;
+    /**
+     * The current token, or `undefined` when the directory has not issued one — either no directory
+     * connection yet, or this key has no agent profile there. Undefined is a real answer, not a
+     * missing one: the relay refuses without a token, which is the intended outcome for a key the
+     * directory does not recognise.
+     */
+    getDirectoryOnlineToken(agentName: string): Uint8Array | undefined;
+    /** DOD-M12B-SESSION-SEED-1 test seams: the counterparty addresses a re-dial depends on. Not
+     *  otherwise observable — they are set from a signed relay assignment that a fixture cannot mint. */
+    setCounterpartyAddrsForTest(agentName: string, sessionId: string, addrs: string[]): void;
+    getCounterpartyAddrsForTest(agentName: string, sessionId: string): string[];
+    /** DOD-M12B-SESSION-SEED-1 test seam: drop a seed WITHOUT zeroing or a status change — what a
+     *  process restart does to it. The refusal that follows is the one an operator most needs named. */
+    forgetSessionSeedForTest(agentName: string, sessionId: string): void;
+    /**
+     * DOD-M12B-SESSION-SEED-1 — drain the direct-resend queue when a session comes back.
+     *
+     * `retryQueue.drainSession` had NO production caller. The send path enqueues into it on a failed
+     * delivery and tells the operator the message will be "retried on reconnect", and nothing ever
+     * reconnected it — the row sat there until the session went terminal and was reaped. Measured
+     * live 2026-08-18: two of the operator's messages went in, and the response told them both were
+     * lost and to send again, which is how a transcript gets duplicates.
+     *
+     * A revival IS the reconnect that sentence promised. This is the hook that makes it true.
+     */
+    setRetryDrainHook(fn: (agentName: string, sessionId: string) => void): void;
+    /** DOD-M12B-SESSION-SEED-1 test seam: does this session still hold a revivable identity? */
+    hasSessionSeedForTest(agentName: string, sessionId: string): boolean;
+    getStandingReceiverSeedForTest(agentName: string): Uint8Array | undefined;
+    ensureStandingReceiverForAgent(agentName: string): Promise<void>;
+    removeStandingReceiverForAgent(agentName: string): Promise<void>;
+    /** CC-5/F21: count of RECEIVED messages on a session — the "did the counterparty ever speak"
+     *  signal the dead-half-open reaper uses (message_count also counts our own auto-"Dispatched." ack,
+     *  so it is NOT a reliable half-open discriminator). Mirrors #getReceivedBytesTotal. */
+    /**
+     * DOD-M12B-REAP-HELD-1 — did the counterparty EVER establish? Counted from every place their
+     * messages can be, not just the one.
+     *
+     * OBSERVED LIVE 2026-08-18: the half-open reaper abandoned session `d28db475…` — twenty leaves in
+     * the chain and sixteen more frames verified and held, ten of them from the counterparty — while
+     * the restart-seal resolver was actively trying to notarize it. The receipt was forfeited.
+     *
+     * `countReceivedMessages` asks the TRANSCRIPT, and **held content never reaches the transcript**;
+     * it sits in `held_content` until it can join the chain. So the very condition that holds content
+     * — an interrupted session — is the condition that makes the counterparty's messages invisible,
+     * and a fully-established conversation reads identically to an offer nobody ever answered.
+     *
+     * `origin = 'received'` is load-bearing. Our OWN held frames prove nothing about them, and
+     * counting those would make every session we ever spoke into un-reapable — which is exactly the
+     * clutter the reaper exists to clear. D18 also depends on the zero case staying zero: reaping only
+     * genuinely 0-received ghosts is what stops a stranger whose first handshakes died from being
+     * locked out by the acceptance bound forever.
+     */
+    countEstablishedReceived(agentName: string, sessionId: string): number;
+}
+//# sourceMappingURL=session-node-manager.d.ts.map