@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/telegram-doorbell.js

@@ -0,0 +1,140 @@
+/**
+ * M8C-TGDOOR-1: the Telegram doorbell.
+ *
+ * A daemon-owned bot pushes discrete, CONTENT-FREE events (session request / message waiting /
+ * state change) to one allowlisted operator chat. It is a convenience, never load-bearing: a
+ * network hiccup backs off and retries rather than killing the poller, and an unconfigured
+ * doorbell is INERT, not an error.
+ *
+ * Two invariants worth stating at the boundary, because the boundary is what enforces them now:
+ *
+ *   DOD-INV-CONTENTFREE — the doorbell sends a fixed label per event kind, NEVER message text.
+ *     This module cannot leak conversation content because it is never given any: its whole
+ *     dependency list is a logger, the stored settings, and a bot client.
+ *   D6 — an inbound Telegram message from ANY chat is acknowledged and dropped. Nothing from
+ *     Telegram enters a CELLO content path. Inside startDaemon that was a promise; here it is
+ *     structural — there is no session-send seam in this module to abuse.
+ */
+import { HttpTelegramBotClient } from "./telegram-bot-client.js";
+import { extractErrorMessage } from "./error-message.js";
+export function createTelegramDoorbell(deps) {
+    const { logger, getTelegramSettings, injectedClient } = deps;
+    // M8C-TGDOOR-1: Telegram Mode 1 doorbell — a daemon-owned bot pushes discrete, content-free
+    // events (session request / message-waiting / state change) to one allowlisted operator chat.
+    // "NO channel machinery" (DoD) — this talks to the Telegram Bot API directly, unrelated to the
+    // claude/channel MCP capability from Tiers 1-2. Inert until telegram_settings exist.
+    let telegramBotClient = injectedClient ?? null;
+    let telegramChatId = null;
+    let telegramBotToken = null; // tracked only to detect an actual token CHANGE
+    // Generation counter, NOT a shared boolean — a boolean flip-to-false-then-true-again (e.g. a
+    // settings update that restarts the poller) would let the OLD loop's `while` condition still
+    // read true on its next check, running TWO concurrent loops. Each loop instance captures its
+    // OWN generation at start and exits the instant the counter no longer matches (a new start, or
+    // shutdown, both just bump it).
+    let telegramPollerGeneration = 0;
+    let telegramUpdateOffset = 0;
+    // Coalescing: ring once for the FIRST message-waiting event since a session was last fully
+    // read; cleared on read (cello_receive advancing that session's watermark). Session
+    // requests and state changes bypass this Set entirely — DoD says they always ring.
+    const telegramRungUnread = new Set();
+    async function sendTelegramDoorbell(agentName, sessionId, kind, detail) {
+        if (!telegramBotClient || !telegramChatId)
+            return; // TGDOOR not configured — inert, not an error
+        if (kind === "message_waiting") {
+            const rungKey = `${agentName}:${sessionId}`;
+            if (telegramRungUnread.has(rungKey))
+                return; // already rung, still unread — coalesced
+            telegramRungUnread.add(rungKey);
+        }
+        // DOD-INV-CONTENTFREE: `detail` is a fixed, content-free label per kind — NEVER message text.
+        const text = `[${agentName} · ${sessionId.slice(0, 8)}] ${detail}`;
+        try {
+            const result = await telegramBotClient.sendMessage(telegramChatId, text);
+            if (!result.ok) {
+                logger.warn("telegram.doorbell.send.failed", { agentName, sessionId, kind, reason: result.error });
+                return;
+            }
+            logger.info("telegram.doorbell.sent", { agentName, sessionId, kind });
+        }
+        catch (err) {
+            logger.warn("telegram.doorbell.send.failed", { agentName, sessionId, kind, error: extractErrorMessage(err) });
+        }
+    }
+    // Read clears the ring (DoD: "ring-once-until-read") — called wherever a receive advances a
+    // session's read watermark, mirroring AWAY-1's own dedup-clear-on-attend pattern.
+    function clearTelegramRung(agentName, sessionId) {
+        telegramRungUnread.delete(`${agentName}:${sessionId}`);
+    }
+    async function handleInboundTelegramUpdate(update, client) {
+        const chatId = update.message?.chat?.id !== undefined ? String(update.message.chat.id) : undefined;
+        if (!chatId)
+            return;
+        if (chatId !== telegramChatId) {
+            // D6: any other chat is silently dropped — nothing enters CELLO content paths.
+            logger.info("telegram.inbound.rejected", { chatId });
+            return;
+        }
+        logger.info("telegram.inbound.acknowledged", { chatId });
+        try {
+            await client.sendMessage(chatId, "CELLO doesn't process messages here — this channel only sends you notifications. Use your CELLO client to reply.");
+        }
+        catch (err) {
+            logger.warn("telegram.inbound.ack.failed", { chatId, error: extractErrorMessage(err) });
+        }
+    }
+    // Single long-lived getUpdates poller (DoD) — one in-flight loop per daemon; started once
+    // settings exist, stopped on daemon shutdown. A network hiccup backs off and retries rather
+    // than killing the poller (best-effort — the doorbell is a convenience, never load-bearing).
+    // The client is a PARAMETER and must never be re-read from the shared, reassignable
+    // telegramBotClient: a settings update mid-await would otherwise let a stale response from the OLD
+    // client still be processed once (the generation check blocks the loop's NEXT iteration, not an
+    // in-flight call), and stomp telegramUpdateOffset with the OLD bot's update_id numbering, which is
+    // meaningless to a new token (Telegram scopes update_id per bot). Re-check the generation
+    // immediately after EVERY await, before acting on its result or touching shared state.
+    async function runTelegramPollerLoop(myGeneration, myClient) {
+        let myOffset = telegramUpdateOffset;
+        while (telegramPollerGeneration === myGeneration) {
+            try {
+                const updates = await myClient.getUpdates(myOffset, 25);
+                if (telegramPollerGeneration !== myGeneration)
+                    break; // superseded while awaiting — drop stale results
+                for (const u of updates) {
+                    myOffset = u.update_id + 1;
+                    telegramUpdateOffset = myOffset;
+                    if (u.message)
+                        void handleInboundTelegramUpdate(u, myClient);
+                }
+            }
+            catch (err) {
+                if (telegramPollerGeneration !== myGeneration)
+                    break; // superseded — don't retry under a dead generation
+                logger.warn("telegram.poller.error", { error: extractErrorMessage(err) });
+                await new Promise((r) => setTimeout(r, 2000)); // back off before retrying
+            }
+        }
+    }
+    // Always bumps the generation (invalidating any prior loop, which exits on its next check) and
+    // starts a fresh one — correct both for the first start AND a settings-change restart.
+    function startTelegramPollerIfConfigured() {
+        const settings = getTelegramSettings();
+        if (!settings)
+            return; // not configured — TGDOOR stays inert
+        // Reviewer MEDIUM fix: reset the offset on an actual token/chat CHANGE — a prior bot's
+        // update_id numbering is meaningless to a new one (Telegram scopes it per bot token).
+        if (telegramBotToken !== settings.botToken || telegramChatId !== settings.allowlistedChatId) {
+            telegramUpdateOffset = 0;
+        }
+        telegramBotToken = settings.botToken;
+        telegramChatId = settings.allowlistedChatId;
+        const client = injectedClient ?? new HttpTelegramBotClient(settings.botToken);
+        telegramBotClient = client;
+        telegramPollerGeneration += 1;
+        void runTelegramPollerLoop(telegramPollerGeneration, client);
+        logger.info("telegram.poller.started", {});
+    }
+    function stopTelegramPoller() {
+        telegramPollerGeneration += 1;
+    }
+    return { sendTelegramDoorbell, clearTelegramRung, startTelegramPollerIfConfigured, stopTelegramPoller };
+}
+//# sourceMappingURL=telegram-doorbell.js.map

package/dist/telegram-doorbell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-doorbell.js","sourceRoot":"","sources":["../src/telegram-doorbell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,qBAAqB,EAA0B,MAAM,0BAA0B,CAAC;AAEzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkBzD,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IAE7D,4FAA4F;IAC5F,8FAA8F;IAC9F,+FAA+F;IAC/F,qFAAqF;IACrF,IAAI,iBAAiB,GAA6B,cAAc,IAAI,IAAI,CAAC;IACzE,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,gBAAgB,GAAkB,IAAI,CAAC,CAAC,gDAAgD;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,gCAAgC;IAChC,IAAI,wBAAwB,GAAG,CAAC,CAAC;IACjC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,2FAA2F;IAC3F,oFAAoF;IACpF,mFAAmF;IACnF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,SAAiB,EACjB,IAA4D,EAC5D,MAAc;QAEd,IAAI,CAAC,iBAAiB,IAAI,CAAC,cAAc;YAAE,OAAO,CAAC,8CAA8C;QACjG,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;YAC5C,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,yCAAyC;YACtF,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,8FAA8F;QAC9F,MAAM,IAAI,GAAG,IAAI,SAAS,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,kFAAkF;IAClF,SAAS,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;QAC7D,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,2BAA2B,CACxC,MAA2E,EAC3E,MAAyB;QAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,+EAA+E;YAC/E,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CACtB,MAAM,EACN,kHAAkH,CACnH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,4FAA4F;IAC5F,6FAA6F;IAC7F,oFAAoF;IACpF,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,0FAA0F;IAC1F,uFAAuF;IACvF,KAAK,UAAU,qBAAqB,CAAC,YAAoB,EAAE,QAA2B;QACpF,IAAI,QAAQ,GAAG,oBAAoB,CAAC;QACpC,OAAO,wBAAwB,KAAK,YAAY,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACxD,IAAI,wBAAwB,KAAK,YAAY;oBAAE,MAAM,CAAC,iDAAiD;gBACvG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,QAAQ,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;oBAC3B,oBAAoB,GAAG,QAAQ,CAAC;oBAChC,IAAI,CAAC,CAAC,OAAO;wBAAE,KAAK,2BAA2B,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,wBAAwB,KAAK,YAAY;oBAAE,MAAM,CAAC,mDAAmD;gBACzG,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,2BAA2B;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,uFAAuF;IACvF,SAAS,+BAA+B;QACtC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,sCAAsC;QAC7D,uFAAuF;QACvF,sFAAsF;QACtF,IAAI,gBAAgB,KAAK,QAAQ,CAAC,QAAQ,IAAI,cAAc,KAAK,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC5F,oBAAoB,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACrC,cAAc,GAAG,QAAQ,CAAC,iBAAiB,CAAC;QAC5C,MAAM,MAAM,GAAG,cAAc,IAAI,IAAI,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9E,iBAAiB,GAAG,MAAM,CAAC;QAC3B,wBAAwB,IAAI,CAAC,CAAC;QAC9B,KAAK,qBAAqB,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,SAAS,kBAAkB;QACzB,wBAAwB,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,CAAC;AAC1G,CAAC"}

package/dist/test-handlers.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The verbs that exist for TESTS, and nothing else.
+ *
+ * Two groups with different guards, and the difference is why this file has a header. The seven
+ * `__test_*` verbs sit inside `CELLO_ENV === "test"` and cannot be reached in production. The six
+ * above them — `queue_failed_send`, `debug_inject_park_fault`, `enqueue_awaiting_content`,
+ * `mark_content_acked`, `check_nonce`, `drain_session` — are NOT gated, and FOUR of them write state.
+ * `check_nonce` is the one to notice: it does not merely read, it `checkAndAdd`s, which INSERTs into
+ * `session_seen_nonces` and survives a restart — so pre-registering a nonce makes the real message
+ * carrying it arrive and be discarded as a duplicate, logged at debug and nowhere else. Their only
+ * callers are tests (measured: nothing in the CLI, nothing in the MCP shim), so a production daemon
+ * answers six verbs nobody outside a test has a use for.
+ *
+ * ⚠️ THE ASYMMETRY IS RECORDED, NOT FIXED HERE. Gating them changes behaviour and this is a movement
+ * order; the guard structure moved exactly as it was. It is written into the order's *Newly
+ * discovered* so it can be ranked — rather than inherited by the next reader, who would see the file
+ * name and assume the whole thing is unreachable in production.
+ *
+ * ⚠️ TWO PRODUCTION REGISTRATIONS DID NOT COME WITH IT. `contentPark.registerHandlers(handlers)` and
+ * `registerInboundSessionHandlers(handlers)` sit between the two groups in the original file and are
+ * real surfaces. They stay in the composition root; only the test verbs on either side moved. That
+ * DOES change registration order — those two now run after all thirteen instead of between them —
+ * and it is inert: dispatch resolves against the live map on each request rather than snapshotting
+ * it, the IPC server is not created until every registration has run, and none of these verb names
+ * collides. Written down because "do not reorder registration" is a rule of this order, and the
+ * next reader deserves the measurement rather than the worry.
+ */
+import type { IpcHandler } from "./ipc-server.js";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { Logger } from "./types.js";
+import type { RetryQueue } from "./retry-queue.js";
+import type { NonceDedupStore } from "./nonce-dedup.js";
+import { type AnyRefusalReason } from "./refusal-reasons.js";
+import type { InboundSessionEvent } from "./inbound-sessions.js";
+/** The per-connection agent selection, as these verbs need to read it. */
+export interface TestConnState {
+    currentAgent: string | null;
+}
+export interface TestHandlerDeps {
+    handlers: Map<string, IpcHandler>;
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    retryQueue: RetryQueue;
+    nonceDedupStore: NonceDedupStore;
+    /** Opens a delivery window and hands back the release. */
+    deliveryOpens: {
+        begin: (openerPubkey: string, targetPubkey: string) => () => void;
+    };
+    /** Name → pubkey, empty string when this daemon holds no such agent. */
+    pubkeyOfAgent: (name: string) => string;
+    /** The one dispatch path that also reaches Telegram — tests drive it to assert both halves. */
+    dispatchSessionStateChangedWithTelegram: (agentName: string, sessionId: string, state: string, counterpartyPubkey: string | null) => void;
+    /** The inbound-session queue machinery these verbs seed, injected rather than reached for. */
+    enqueueInboundSession: (agentName: string, event: InboundSessionEvent) => void;
+    recordRefusal: (agentName: string, sessionIdHex: string, counterpartyPubkeyHex: string, reason: AnyRefusalReason) => void;
+    /** The queue itself — one verb backdates the entry it just enqueued, which needs the container. */
+    inboundSessionQueues: Map<string, InboundSessionEvent[]>;
+    /** Read this connection's agent selection. The READ, not the container. */
+    getConnState: (connectionId: string) => TestConnState | undefined;
+}
+export declare function registerTestHandlers(deps: TestHandlerDeps): void;
+//# sourceMappingURL=test-handlers.d.ts.map

package/dist/test-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-handlers.d.ts","sourceRoot":"","sources":["../src/test-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAqC,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAAG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AAE/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,0DAA0D;IAC1D,aAAa,EAAE;QAAE,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,IAAI,CAAA;KAAE,CAAC;IACrF,wEAAwE;IACxE,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,+FAA+F;IAC/F,uCAAuC,EAAE,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GAAG,IAAI,KAC9B,IAAI,CAAC;IACV,8FAA8F;IAC9F,qBAAqB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC/E,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,gBAAgB,KACrB,IAAI,CAAC;IACV,mGAAmG;IACnG,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,2EAA2E;IAC3E,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,CAAC;CACnE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAqQhE"}

package/dist/test-handlers.js

@@ -0,0 +1,240 @@
+import { REFUSAL_REASONS, CAPACITY_REASONS } from "./refusal-reasons.js";
+export function registerTestHandlers(deps) {
+    const { handlers, logger, sessionNodeManager, retryQueue, nonceDedupStore, deliveryOpens, pubkeyOfAgent, dispatchSessionStateChangedWithTelegram, enqueueInboundSession, recordRefusal, inboundSessionQueues, getConnState, } = deps;
+    handlers.set("queue_failed_send", async (params, _connectionId) => {
+        const sessionId = params?.sessionId;
+        const nonceHex = params?.nonce;
+        const contentHex = params?.content;
+        if (!sessionId || !nonceHex || !contentHex) {
+            return { error: "missing_params", guidance: "Provide sessionId, nonce (hex), and content (hex)." };
+        }
+        const nonce = Buffer.from(nonceHex, "hex");
+        const content = Buffer.from(contentHex, "hex");
+        retryQueue.enqueue(sessionId, nonce, content);
+        return { queued: true, queueDepth: retryQueue.getSessionDepth(sessionId) };
+    });
+    // CELLO-M7-MSG-001 (AC-004/AC-005): the send path records un-acked content here when
+    // its TTF timer fires, so a crash before the relay park confirms is recoverable at the
+    // next startup flush. Stored in the SAME retry_queue table (awaiting_ack = 1).
+    // M12-P12 verification surface. REFUSES unless the daemon was started with
+    // CELLO_FAULT_INJECTION=1 — the gate is here rather than at the call site so a normal daemon
+    // cannot be talked into dropping messages by anything that can reach the socket, and the refusal
+    // names why rather than silently no-opping.
+    handlers.set("debug_inject_park_fault", async (params) => {
+        if (process.env.CELLO_FAULT_INJECTION !== "1") {
+            return {
+                error: "fault_injection_disabled",
+                guidance: "Start the daemon with CELLO_FAULT_INJECTION=1 to enable. This is a verification surface for M12-P12 and is inert in a normal daemon.",
+            };
+        }
+        const count = typeof params?.count === "number" ? params.count : 1;
+        const cause = typeof params?.cause === "string" ? params.cause : undefined;
+        const armed = sessionNodeManager.injectParkFault(count, cause);
+        // The park fault alone reproduces nothing — the counterparty's session node accepts the frame
+        // and the park path is never entered. Arm the dial failure with it unless told otherwise.
+        const sendArmed = params?.withSendFault === false ? 0 : sessionNodeManager.injectSendFault(count);
+        logger.warn("content.park.fault.armed", { count: armed, sendArmed, cause: cause ?? "standing_receiver_creating" });
+        return { armed, sendArmed };
+    });
+    handlers.set("enqueue_awaiting_content", async (params, connectionId) => {
+        const sessionId = params?.sessionId;
+        const contentHashHex = params?.contentHash;
+        const contentHex = params?.content;
+        if (!sessionId || !contentHashHex || !contentHex) {
+            return { error: "missing_params", guidance: "Provide sessionId, contentHash (hex), and content (hex)." };
+        }
+        // DOD-LOOP-1: awaiting content is keyed by the OWNING agent. Prefer an explicit agentName param;
+        // fall back to the connection's current agent.
+        // DOD-AGENT-ID-JOINKEY-1: the old `?? ""` fell back to an EMPTY-STRING agent, silently merging
+        // every unaddressed caller's awaiting content into one nameless queue. There is no such agent.
+        const agentName = params?.agentName
+            ?? getConnState(connectionId)?.currentAgent;
+        if (!agentName) {
+            return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
+        }
+        const agentId = sessionNodeManager.resolveAgentId(agentName);
+        // The fault-injection IPC seam. It states all three trailing values explicitly rather than
+        // relying on defaults (B2b-1 pass-2 F1): `undefined` for the ordering record and the algorithm
+        // is what this path genuinely has — it injects a bare queued entry — and saying so keeps the
+        // seam honest about what it is producing rather than inheriting whatever the signature assumed.
+        retryQueue.enqueueAwaitingContent(agentId, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"), undefined, undefined, undefined);
+        return { queued: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
+    });
+    // CELLO-M7-MSG-001: a `persisted` delivery ACK (or a confirmed park) clears the durable
+    // awaiting-ACK entry so the startup flush does not re-park already-delivered content.
+    handlers.set("mark_content_acked", async (params, connectionId) => {
+        const sessionId = params?.sessionId;
+        const contentHashHex = params?.contentHash;
+        if (!sessionId || !contentHashHex) {
+            return { error: "missing_params", guidance: "Provide sessionId and contentHash (hex)." };
+        }
+        const agentName = params?.agentName
+            ?? getConnState(connectionId)?.currentAgent;
+        if (!agentName) {
+            return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
+        }
+        const agentId = sessionNodeManager.resolveAgentId(agentName);
+        retryQueue.markContentAcked(agentId, sessionId, Buffer.from(contentHashHex, "hex"));
+        return { acked: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
+    });
+    handlers.set("check_nonce", async (params, _connectionId) => {
+        const sessionId = params?.sessionId;
+        const nonceHex = params?.nonce;
+        const senderPubkeyHex = params?.senderPubkey;
+        if (!sessionId || !nonceHex || !senderPubkeyHex) {
+            return { error: "missing_params", guidance: "Provide sessionId, nonce (hex), and senderPubkey (hex)." };
+        }
+        const nonce = Buffer.from(nonceHex, "hex");
+        const senderPubkey = Buffer.from(senderPubkeyHex, "hex");
+        const duplicate = nonceDedupStore.checkAndAdd(sessionId, nonce, senderPubkey);
+        return { duplicate };
+    });
+    // DAEMON-003: drain_session IPC handler — triggered on peer reconnect.
+    // Returns pending entry metadata (nonces only — SI-002 forbids content in IPC frames).
+    // The actual drain+delivery is triggered separately when a real sendFn is available.
+    handlers.set("drain_session", async (params, _connectionId) => {
+        const sessionId = params?.sessionId;
+        if (!sessionId) {
+            return { error: "missing_params", guidance: "Provide sessionId." };
+        }
+        const depth = retryQueue.getSessionDepth(sessionId);
+        const entries = retryQueue.getSessionEntries(sessionId);
+        return { pendingCount: depth, nonces: entries.map(e => e.nonceHex) };
+    });
+    // MCP-002: Test-only handler to emit session lifecycle events.
+    // Guarded by CELLO_ENV=test — never available in production.
+    if (process.env["CELLO_ENV"] === "test") {
+        handlers.set("__test_emit_session_event", async (params, _connectionId) => {
+            const type = params?.type;
+            const sessionId = params?.sessionId;
+            const agentName = params?.agentName;
+            const counterpartyPubkey = params?.counterpartyPubkey ?? null;
+            if (!type || !sessionId || !agentName) {
+                return { error: "missing_params", guidance: "Provide type, sessionId, and agentName." };
+            }
+            if (type === "created") {
+                const sessionPeerId = params?.sessionPeerId ?? "";
+                const correlationId = params?.correlationId ?? "";
+                logger.info("session.node.created", { sessionId, agentName, sessionPeerId, correlationId });
+                dispatchSessionStateChangedWithTelegram(agentName, sessionId, "created", counterpartyPubkey);
+            }
+            else if (type === "destroyed") {
+                const state = params?.state ?? "interrupted";
+                const reason = params?.reason ?? state;
+                logger.info("session.node.destroyed", { sessionId, agentName, reason });
+                dispatchSessionStateChangedWithTelegram(agentName, sessionId, state, counterpartyPubkey);
+            }
+            return { ok: true };
+        });
+        // DOD-M12B-DELIVERY-QUIET-1: drive the delivery-open intent directly, so the doorbell exemption
+        // is testable without standing up a document, a peer daemon and a real directory negotiation.
+        // The registry's begin() hands back a closure, so the releases are held here by key.
+        // The hook takes AGENT NAMES and resolves both to pubkeys through `pubkeyOfAgent`, exactly as the
+        // real delivery adapter does. That is deliberate: the first version of this hook let a test
+        // register a tuple production never produces — an agent registered as the dialler and then
+        // emitted as the receiver of its own dial — so the suite proved the guard's boolean logic and
+        // nothing about the wiring, and stayed green against a guard that could never fire.
+        const testDeliveryReleases = new Map();
+        // DOD-M12B-INBOX-TRUTH-1: seed a refusal, so the ended-unread return branch's lost
+        // `refused_session_requests` has a regression test. The field had none before or after the fix.
+        handlers.set("__test_record_refusal", async (params, _connectionId) => {
+            const agentName = params?.agentName;
+            const sessionId = params?.sessionId;
+            if (!agentName || !sessionId)
+                return { error: "missing_params", guidance: "Provide agentName and sessionId." };
+            // The reason is VALIDATED against the closed union rather than cast through it. A test seam
+            // that can inject a reason production cannot produce would let a test prove the inbox handles a
+            // code no refusal path emits — which is the shape DOD-M15-GUARD-HEARD-1 exists to remove, and a
+            // seam is not exempt from it.
+            const asked = params?.reason ?? CAPACITY_REASONS.ABUSE_BOUND_SESSIONS_PER_SENDER;
+            const known = [
+                ...Object.values(REFUSAL_REASONS),
+                ...Object.values(CAPACITY_REASONS),
+            ];
+            if (!known.includes(asked)) {
+                return {
+                    error: "unknown_refusal_reason",
+                    guidance: `"${asked}" is not a reason any refusal path can emit. Use one of: ${known.join(", ")}. ` +
+                        `Seeding an invented reason would test the inbox against a code production never produces.`,
+                };
+            }
+            recordRefusal(agentName, sessionId, params?.counterpartyPubkey ?? "", asked);
+            return { ok: true };
+        });
+        handlers.set("__test_delivery_open_begin", async (params, _connectionId) => {
+            const openerAgent = params?.openerAgent;
+            const targetAgent = params?.targetAgent;
+            if (!openerAgent || !targetAgent)
+                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
+            const openerPubkey = pubkeyOfAgent(openerAgent);
+            const targetPubkey = pubkeyOfAgent(targetAgent);
+            testDeliveryReleases.set(`${openerAgent}>${targetAgent}`, deliveryOpens.begin(openerPubkey, targetPubkey));
+            return { ok: true, openerPubkey, targetPubkey };
+        });
+        handlers.set("__test_delivery_open_end", async (params, _connectionId) => {
+            const openerAgent = params?.openerAgent;
+            const targetAgent = params?.targetAgent;
+            if (!openerAgent || !targetAgent)
+                return { error: "missing_params", guidance: "Provide openerAgent and targetAgent (both agent NAMES)." };
+            const key = `${openerAgent}>${targetAgent}`;
+            testDeliveryReleases.get(key)?.();
+            testDeliveryReleases.delete(key);
+            return { ok: true };
+        });
+        // M8C-INBOX-1: test hook to enqueue a pending inbound session request (mirrors the real inbound
+        // flow's enqueueInboundSession) so cello_check_notifications' pending_session_requests is testable
+        // without standing up the full libp2p inbound path.
+        handlers.set("__test_enqueue_inbound_session", async (params, _connectionId) => {
+            const agentName = params?.agentName;
+            const sessionIdHex = params?.sessionId;
+            const counterpartyPubkeyHex = params?.counterpartyPubkey ?? "";
+            if (!agentName || !sessionIdHex) {
+                return { error: "missing_params", guidance: "Provide agentName and sessionId." };
+            }
+            enqueueInboundSession(agentName, { sessionIdHex, counterpartyPubkeyHex, genesisPrevRootHex: "" });
+            // M8C-TTL-1: let a test backdate the just-enqueued entry's timestamp (simulating age) without
+            // waiting real hours or faking global timers — enqueueInboundSession always stamps Date.now().
+            const enqueuedAtOverride = params?.enqueuedAtOverride;
+            if (enqueuedAtOverride !== undefined) {
+                const q = inboundSessionQueues.get(agentName);
+                const entry = q?.[q.length - 1];
+                if (entry)
+                    entry.enqueuedAt = enqueuedAtOverride;
+            }
+            return { ok: true };
+        });
+        // TTL-terminal-reap: seed a session row at a given terminal status so tests can assert that
+        // reapExpiredInboundSessions drops the matching inbound queue entry without waiting 24h.
+        handlers.set("__test_insert_session_row", async (params, _connectionId) => {
+            const agentName = params?.agentName;
+            const sessionId = params?.sessionId;
+            const status = params?.status;
+            const counterpartyPubkey = params?.counterpartyPubkey ?? "testpubkey";
+            if (!agentName || !sessionId || !status) {
+                return { error: "missing_params", guidance: "Provide agentName, sessionId, status." };
+            }
+            const db = sessionNodeManager.getDb();
+            const now = Date.now();
+            const agentRow = db.prepare("SELECT agent_id FROM agents WHERE agent_name = ?").get(agentName);
+            if (!agentRow)
+                return { error: "agent_not_found" };
+            db.prepare("INSERT OR REPLACE INTO sessions (session_id, agent_id, counterparty_pubkey, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)").run(sessionId, agentRow.agent_id, counterpartyPubkey, status, now, now);
+            return { ok: true };
+        });
+        // M8C-INBOX-1 (F1): seed a received message so a test can drive a live cello_receive and assert the
+        // watermark advances (N3), without a session tree. It seeded the arrival buffer until that buffer
+        // was deleted for having no production reader; the transcript row is what cello_receive serves.
+        handlers.set("__test_buffer_received", async (params, _connectionId) => {
+            const agentName = params?.agentName;
+            const sessionId = params?.sessionId;
+            const seq = params?.seq;
+            const content = params?.content ?? "hello";
+            if (!agentName || !sessionId || typeof seq !== "number") {
+                return { error: "missing_params", guidance: "Provide agentName, sessionId, seq." };
+            }
+            sessionNodeManager.recordTranscriptMessage(agentName, sessionId, seq, "received", new TextEncoder().encode(content), "test-seed");
+            return { ok: true };
+        });
+    } // end CELLO_ENV=test guard
+}
+//# sourceMappingURL=test-handlers.js.map

package/dist/test-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-handlers.js","sourceRoot":"","sources":["../src/test-handlers.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAyB,MAAM,sBAAsB,CAAC;AAqChG,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,aAAa,EACb,aAAa,EACb,uCAAuC,EACvC,qBAAqB,EACrB,aAAa,EACb,oBAAoB,EACpB,YAAY,GACb,GAAG,IAAI,CAAC;IAET,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,KAA2B,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,EAAE,OAA6B,CAAC;QACzD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oDAAoD,EAAE,CAAC;QACrG,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/C,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,qFAAqF;IACrF,uFAAuF;IACvF,+EAA+E;IAC/E,2EAA2E;IAC3E,6FAA6F;IAC7F,iGAAiG;IACjG,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,EAAE,CAAC;YAC9C,OAAO;gBACL,KAAK,EAAE,0BAA0B;gBACjC,QAAQ,EAAE,sIAAsI;aACjJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,KAAK,GAAG,kBAAkB,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/D,8FAA8F;QAC9F,0FAA0F;QAC1F,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,IAAI,4BAA4B,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QACtE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,cAAc,GAAG,MAAM,EAAE,WAAiC,CAAC;QACjE,MAAM,UAAU,GAAG,MAAM,EAAE,OAA6B,CAAC;QACzD,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,0DAA0D,EAAE,CAAC;QAC3G,CAAC;QACD,iGAAiG;QACjG,+CAA+C;QAC/C,+FAA+F;QAC/F,+FAA+F;QAC/F,MAAM,SAAS,GAAI,MAAM,EAAE,SAAgC;eACtD,YAAY,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,0DAA0D,EAAE,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,gGAAgG;QAChG,UAAU,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3J,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,wFAAwF;IACxF,sFAAsF;IACtF,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,cAAc,GAAG,MAAM,EAAE,WAAiC,CAAC;QACjE,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,0CAA0C,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,SAAS,GAAI,MAAM,EAAE,SAAgC;eACtD,YAAY,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,0DAA0D,EAAE,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC7D,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;QACpF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,KAA2B,CAAC;QACrD,MAAM,eAAe,GAAG,MAAM,EAAE,YAAkC,CAAC;QACnE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yDAAyD,EAAE,CAAC;QAC1G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,uFAAuF;IACvF,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,6DAA6D;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,CAAC;QAC1C,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACxE,MAAM,IAAI,GAAG,MAAM,EAAE,IAA0B,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,kBAAkB,GAAI,MAAM,EAAE,kBAA6B,IAAI,IAAI,CAAC;YAE1E,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yCAAyC,EAAE,CAAC;YAC1F,CAAC;YAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,aAAa,GAAI,MAAM,EAAE,aAAwB,IAAI,EAAE,CAAC;gBAC9D,MAAM,aAAa,GAAI,MAAM,EAAE,aAAwB,IAAI,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC5F,uCAAuC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;YAC/F,CAAC;iBAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAI,MAAM,EAAE,KAAgB,IAAI,aAAa,CAAC;gBACzD,MAAM,MAAM,GAAI,MAAM,EAAE,MAAiB,IAAI,KAAK,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxE,uCAAuC,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC3F,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,gGAAgG;QAChG,8FAA8F;QAC9F,qFAAqF;QACrF,kGAAkG;QAClG,4FAA4F;QAC5F,2FAA2F;QAC3F,8FAA8F;QAC9F,oFAAoF;QACpF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3D,mFAAmF;QACnF,gGAAgG;QAChG,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kCAAkC,EAAE,CAAC;YAC/G,4FAA4F;YAC5F,gGAAgG;YAChG,gGAAgG;YAChG,8BAA8B;YAC9B,MAAM,KAAK,GAAI,MAAM,EAAE,MAAiB,IAAI,gBAAgB,CAAC,+BAA+B,CAAC;YAC7F,MAAM,KAAK,GAAsB;gBAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;gBACjC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACnC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,KAAK,EAAE,wBAAwB;oBAC/B,QAAQ,EACN,IAAI,KAAK,4DAA4D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;wBACzF,2FAA2F;iBAC9F,CAAC;YACJ,CAAC;YACD,aAAa,CAAC,SAAS,EAAE,SAAS,EAAG,MAAM,EAAE,kBAA6B,IAAI,EAAE,EAAE,KAAyB,CAAC,CAAC;YAC7G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACzE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yDAAyD,EAAE,CAAC;YAC1I,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;YAChD,oBAAoB,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,WAAW,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;YAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACvE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,MAAM,WAAW,GAAG,MAAM,EAAE,WAAiC,CAAC;YAC9D,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yDAAyD,EAAE,CAAC;YAC1I,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;YAC5C,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAClC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,gGAAgG;QAChG,mGAAmG;QACnG,oDAAoD;QACpD,QAAQ,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YAC7E,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,YAAY,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC7D,MAAM,qBAAqB,GAAI,MAAM,EAAE,kBAA6B,IAAI,EAAE,CAAC;YAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kCAAkC,EAAE,CAAC;YACnF,CAAC;YACD,qBAAqB,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,8FAA8F;YAC9F,+FAA+F;YAC/F,MAAM,kBAAkB,GAAG,MAAM,EAAE,kBAAwC,CAAC;YAC5E,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAChC,IAAI,KAAK;oBAAE,KAAK,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,yFAAyF;QACzF,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACxE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,MAA4B,CAAC;YACpD,MAAM,kBAAkB,GAAI,MAAM,EAAE,kBAA6B,IAAI,YAAY,CAAC;YAClF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,uCAAuC,EAAE,CAAC;YACxF,CAAC;YACD,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAqC,CAAC;YACnI,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;YACnD,EAAE,CAAC,OAAO,CACR,uIAAuI,CACxI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,oGAAoG;QACpG,kGAAkG;QAClG,gGAAgG;QAChG,QAAQ,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YACrE,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,SAA+B,CAAC;YAC1D,MAAM,GAAG,GAAG,MAAM,EAAE,GAAyB,CAAC;YAC9C,MAAM,OAAO,GAAI,MAAM,EAAE,OAAkB,IAAI,OAAO,CAAC;YACvD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oCAAoC,EAAE,CAAC;YACrF,CAAC;YACD,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;YAClI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACH,CAAC,CAAC,2BAA2B;AAC/B,CAAC"}

package/dist/testing.d.ts

@@ -0,0 +1,10 @@
+/**
+ * TEST-ONLY exports. Reachable as `@cello-protocol/daemon/testing`, deliberately NOT from the
+ * package barrel (DOD-M9B-WIRE-1).
+ *
+ * `DaemonConfig.securityGateway` is REQUIRED (INV-9), so every caller needs a way to satisfy it —
+ * including a test that deliberately does not screen. That test says so by importing from here.
+ * The daemon's own barrel stays free of an always-allow client.
+ */
+export { PassthroughGatewayClient } from "@cello-protocol/gateway/testing";
+//# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/testing.js

@@ -0,0 +1,10 @@
+/**
+ * TEST-ONLY exports. Reachable as `@cello-protocol/daemon/testing`, deliberately NOT from the
+ * package barrel (DOD-M9B-WIRE-1).
+ *
+ * `DaemonConfig.securityGateway` is REQUIRED (INV-9), so every caller needs a way to satisfy it —
+ * including a test that deliberately does not screen. That test says so by importing from here.
+ * The daemon's own barrel stays free of an always-allow client.
+ */
+export { PassthroughGatewayClient } from "@cello-protocol/gateway/testing";
+//# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/transport-composition.d.ts

@@ -0,0 +1,31 @@
+/**
+ * CELLO Daemon — transport-composition.ts (CELLO-M7-TRANSPORT-001)
+ *
+ * Composition-root selection of the transport adapters by CELLO_ENV. Per CLAUDE.md
+ * the daemon composition root instantiates all adapters and fails fast at startup
+ * (not at first session) when a production environment is missing required config.
+ *
+ *   'local' | 'test'                   → in-process stubs (no network).
+ *   'dev' | 'staging' | 'production'   → real adapters; require their backing
+ *                                         dependencies (a TransportDialer for the
+ *                                         selector). Missing config → throw at
+ *                                         startup naming what is missing (AC-010).
+ */
+import { type ITransportSelector, type TransportDialer } from "./transport-selector.js";
+import type { Logger } from "./types.js";
+export type CelloEnv = "local" | "test" | "dev" | "staging" | "production";
+/** Resolve CELLO_ENV. Unknown/undefined defaults to 'local' (in-process stubs). */
+export declare function resolveCelloEnv(raw: string | undefined): CelloEnv;
+/** True for environments that require real (network-backed) transport adapters. */
+export declare function isProductionVariant(env: CelloEnv): boolean;
+/**
+ * Build the transport selector for the given environment. Stub for local/test;
+ * real TransportSelector for production variants (requires a TransportDialer).
+ */
+export declare function createTransportSelector(opts: {
+    env: CelloEnv;
+    logger: Logger;
+    transportDialer?: TransportDialer;
+    directDialTimeoutMs?: number;
+}): ITransportSelector;
+//# sourceMappingURL=transport-composition.d.ts.map

package/dist/transport-composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-composition.d.ts","sourceRoot":"","sources":["../src/transport-composition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3E,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAWjE;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,QAAQ,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,kBAAkB,CAcrB"}

package/dist/transport-composition.js

@@ -0,0 +1,55 @@
+/**
+ * CELLO Daemon — transport-composition.ts (CELLO-M7-TRANSPORT-001)
+ *
+ * Composition-root selection of the transport adapters by CELLO_ENV. Per CLAUDE.md
+ * the daemon composition root instantiates all adapters and fails fast at startup
+ * (not at first session) when a production environment is missing required config.
+ *
+ *   'local' | 'test'                   → in-process stubs (no network).
+ *   'dev' | 'staging' | 'production'   → real adapters; require their backing
+ *                                         dependencies (a TransportDialer for the
+ *                                         selector). Missing config → throw at
+ *                                         startup naming what is missing (AC-010).
+ */
+import { LocalTransportSelectorStub, TransportSelector, } from "./transport-selector.js";
+/** Resolve CELLO_ENV. Unknown/undefined defaults to 'local' (in-process stubs). */
+export function resolveCelloEnv(raw) {
+    switch (raw) {
+        case "local":
+        case "test":
+        case "dev":
+        case "staging":
+        case "production":
+            return raw;
+        default:
+            return "local";
+    }
+}
+/** True for environments that require real (network-backed) transport adapters. */
+export function isProductionVariant(env) {
+    return env === "dev" || env === "staging" || env === "production";
+}
+/**
+ * Build the transport selector for the given environment. Stub for local/test;
+ * real TransportSelector for production variants (requires a TransportDialer).
+ */
+export function createTransportSelector(opts) {
+    const { env, logger, transportDialer, directDialTimeoutMs } = opts;
+    if (!isProductionVariant(env)) {
+        return new LocalTransportSelectorStub();
+    }
+    if (!transportDialer) {
+        throw new Error(`CELLO_ENV='${env}' requires a transport dialer (directory/relay-backed) for the ` +
+            `transport selector, but none was provided to the daemon composition root. The ` +
+            `transport selector cannot dial a counterparty without it — fix the daemon ` +
+            `configuration (config.transportDialer) before startup.`);
+    }
+    return new TransportSelector({ dialer: transportDialer, logger, directDialTimeoutMs });
+}
+// NOTE (CELLO-M7-TRANSPORT-001): there is no createAutoNatService here. The
+// daemon's runtime IAutoNatService is the NodeAutoNatService wrapping the standing
+// receiver node — that node is created inside startDaemon (after this composition
+// runs), so the AutoNAT service is resolved from SessionNodeManager.
+// getStandingReceiverAutoNat() rather than constructed in the composition root.
+// config.autoNatService remains an explicit test override.
+//# sourceMappingURL=transport-composition.js.map

package/dist/transport-composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-composition.js","sourceRoot":"","sources":["../src/transport-composition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AAKjC,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,YAAY;YACf,OAAO,GAAG,CAAC;QACb;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,GAAa;IAC/C,OAAO,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC;IACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IACnE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,0BAA0B,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,cAAc,GAAG,iEAAiE;YAChF,gFAAgF;YAChF,4EAA4E;YAC5E,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,4EAA4E;AAC5E,mFAAmF;AACnF,kFAAkF;AAClF,qEAAqE;AACrE,gFAAgF;AAChF,2DAA2D"}