@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/vocabulary.js

@@ -0,0 +1,386 @@
+/**
+ * The ONE vocabulary.
+ *
+ * A capability has exactly one name, and that name renders differently on each surface:
+ *
+ *     capability "agents"  →  MCP tool `cello_agents`  ·  CLI command `cello agents`
+ *
+ * The rule: **an MCP tool's name is `cello_` + the CLI command name**, snake_cased, keeping any
+ * sub-verb. Humans and agents learn a capability ONCE.
+ *
+ * Why this table exists rather than three lists of string literals:
+ *
+ *  - the CLI registry names its commands,
+ *  - the connect shim names its MCP tools,
+ *  - and the DAEMON names them BACK to you in ~50 error-guidance strings.
+ *
+ * That third one is the trap. The daemon is where a new user actually MEETS these names — a
+ * refused send says "call cello_receive first". Rename the tools without touching the daemon and
+ * every one of those strings points at a tool that no longer exists: an error message that hands
+ * you a wrong instruction is worse than no error message. So the names live HERE, once, and the
+ * daemon RENDERS them for whichever surface is asking (it knows: `clientType` is recorded at
+ * `ipc.connect`). A CLI caller is told `cello use-agent`; an MCP caller is told `cello_use_agent`.
+ *
+ * Enforced by dod-onboard-help-1-vocabulary.test.ts:
+ *  - every entry obeys the `cello_` + command rule (no hand-typed exceptions),
+ *  - every `cello_*` token in a daemon guidance string resolves here (a stale/typo'd name FAILS
+ *    the build rather than shipping a dead instruction),
+ *  - the CLI registry's command names == the CLI names here,
+ *  - the connect shim's tool names == the MCP names here.
+ */
+import { documentsEnabled } from "./document-flag.js";
+/**
+ * Every dual-surface capability that is ALWAYS present. Guidance naming one of these is rendered
+ * per caller.
+ *
+ * The one group that is not here is documents — see `DOCUMENT_VERBS` below, which joins this list
+ * only when the 074-DOCSFLAG gate is open. Read `DUAL_SURFACE_VERBS` rather than this constant;
+ * this half exists so the gate has something to add to.
+ *
+ * The `cli` string is what an operator would TYPE, so per-contact ops carry the `<pubkey>`
+ * placeholder — the CLI shape is `cello contact <pubkey> set-tier`, not `cello contact-set-tier`.
+ */
+const ALWAYS_ON_VERBS = [
+    // Agents
+    { mcp: "cello_agents", cli: "cello agents" },
+    { mcp: "cello_start_agent", cli: "cello start-agent" },
+    { mcp: "cello_set_agent_offline", cli: "cello set-agent-offline" },
+    { mcp: "cello_use_agent", cli: "cello use-agent" },
+    { mcp: "cello_stop_using_agent", cli: "cello stop-using-agent" },
+    { mcp: "cello_status", cli: "cello status" },
+    // Messaging
+    { mcp: "cello_initiate_session", cli: "cello initiate-session" },
+    { mcp: "cello_await_session", cli: "cello await-session" },
+    { mcp: "cello_close_session", cli: "cello close-session" },
+    { mcp: "cello_name_session", cli: "cello name-session" },
+    { mcp: "cello_dismiss", cli: "cello dismiss" },
+    { mcp: "cello_send", cli: "cello send" },
+    { mcp: "cello_receive", cli: "cello receive" },
+    { mcp: "cello_inbox", cli: "cello inbox" },
+    // Sessions & receipts
+    { mcp: "cello_sessions", cli: "cello sessions" },
+    { mcp: "cello_transcript", cli: "cello transcript" },
+    { mcp: "cello_quarantined", cli: "cello quarantined" },
+    { mcp: "cello_sealed_receipt", cli: "cello sealed-receipt" },
+    // Contacts
+    { mcp: "cello_contacts", cli: "cello contacts" },
+    { mcp: "cello_contact_add", cli: "cello contact <pubkey> add" },
+    { mcp: "cello_contact_remove", cli: "cello contact <pubkey> remove" },
+    { mcp: "cello_contact_set_tier", cli: "cello contact <pubkey> set-tier" },
+    { mcp: "cello_contact_set_away", cli: "cello contact <pubkey> set-away" },
+    { mcp: "cello_contact_set_moniker", cli: "cello contact <pubkey> set-moniker" },
+    { mcp: "cello_contact_set_signal", cli: "cello contact <pubkey> set-signal" },
+    // The wallet's own trust signals (M10B / DOD-END-SURFACE-1 — CLI-only until now)
+    { mcp: "cello_trust_signals_list", cli: "cello trust-signals list" },
+    { mcp: "cello_attestations_issue", cli: "cello attestations issue" },
+    { mcp: "cello_attestations_issued", cli: "cello attestations issued" },
+    { mcp: "cello_trust_signals_view", cli: "cello trust-signals view" },
+    { mcp: "cello_trust_signals_enable", cli: "cello trust-signals enable" },
+    { mcp: "cello_trust_signals_disable", cli: "cello trust-signals disable" },
+    { mcp: "cello_trust_signals_revoke", cli: "cello trust-signals revoke" },
+    // Consent (M10B / DOD-END-SURFACE-1) — deciding on signals others issued ABOUT this agent
+    { mcp: "cello_attestation_consent_list", cli: "cello attestation-consent list" },
+    { mcp: "cello_attestation_consent_accept", cli: "cello attestation-consent accept" },
+    { mcp: "cello_attestation_consent_refuse", cli: "cello attestation-consent refuse" },
+    // Other
+    { mcp: "cello_moniker", cli: "cello moniker" },
+    { mcp: "cello_settings_get", cli: "cello settings get" },
+    { mcp: "cello_settings_set", cli: "cello settings set" },
+    // DOD-M9B-SURFACE-1. `set` appears on both surfaces but they are NOT equivalent, by decision
+    // (M9B-D3/D15): the CLI can confirm a loosening, MCP cannot and is refused with the command to
+    // run. Listed as a pair because the verb and its reads are genuinely parallel; the asymmetry is
+    // in what the daemon will accept, not in which names exist.
+    { mcp: "cello_config_list", cli: "cello config list" },
+    { mcp: "cello_config_get", cli: "cello config get" },
+    { mcp: "cello_config_set", cli: "cello config set" },
+    // DOD-M9B-AUDIT-1 — read-only on both surfaces.
+    { mcp: "cello_policy_log", cli: "cello policy log" },
+];
+/**
+ * Federated documents (M14 / DOD-DOC-TOOLS-1), behind the 074-DOCSFLAG gate.
+ *
+ * A vocabulary entry is a PROMISE TO AN OPERATOR that a command exists — declaring the names ahead
+ * of the handlers once failed three guards at once ("every declared tool has a handler behind it",
+ * "every dual-surface capability's CLI name is a real command", and the source audit). That is
+ * exactly why these move with the flag rather than staying declared: with documents off there is no
+ * handler, no CLI command and no MCP tool behind them, so leaving the rows here would make this
+ * table promise fourteen things the product does not do.
+ *
+ * NOTHING IS DELETED. The rows are here, in the shape they have always had, and they rejoin
+ * `DUAL_SURFACE_VERBS` the moment the flag is on.
+ */
+const DOCUMENT_VERBS = [
+    { mcp: "cello_doc_propose", cli: "cello doc propose" },
+    { mcp: "cello_doc_invite", cli: "cello doc invite" },
+    { mcp: "cello_doc_remove", cli: "cello doc remove" },
+    { mcp: "cello_doc_inbox", cli: "cello doc inbox" },
+    { mcp: "cello_doc_accept", cli: "cello doc accept" },
+    { mcp: "cello_doc_refuse", cli: "cello doc refuse" },
+    { mcp: "cello_doc_list", cli: "cello doc list" },
+    { mcp: "cello_doc_read", cli: "cello doc read" },
+    { mcp: "cello_doc_diff", cli: "cello doc diff" },
+    { mcp: "cello_doc_watch", cli: "cello doc watch" },
+    { mcp: "cello_doc_write", cli: "cello doc write" },
+    { mcp: "cello_doc_publish", cli: "cello doc publish" },
+    { mcp: "cello_doc_close", cli: "cello doc close" },
+    { mcp: "cello_doc_kill", cli: "cello doc kill" },
+];
+/**
+ * Is this IPC method name one of the document verbs?
+ *
+ * Lives HERE, in the file that owns every tool name, and not at the call site — `ipc-server.ts` needs
+ * the answer to name the right cause when a gated verb arrives, and a `"cello_doc_"` literal there is
+ * flagged by the source audit as a dead tool name. Correctly flagged: a bare prefix is not a tool, and
+ * the audit cannot tell it from a typo'd one. `vocabulary.ts` is the one file that audit excludes,
+ * because defining names is its job.
+ *
+ * ⚠️ THIS SENTENCE USED TO SAY *"answers by NAME, not by membership of `DOCUMENT_VERBS`"* AND THE BODY
+ * BELOW IS EXACTLY MEMBERSHIP OF `DOCUMENT_VERBS`. It meant `DUAL_SURFACE_VERBS`, and it shipped inside
+ * the commit whose whole subject was comments asserting what the code does not do. Rewritten rather than
+ * deleted, because a wrong comment in that commit is the evidence that the habit survives being named.
+ *
+ * What it actually does: answers from `DOCUMENT_VERBS` directly, never from `DUAL_SURFACE_VERBS`. The
+ * caller asks precisely when the gate is closed, and the document rows are not in that table then.
+ */
+export function isDocumentVerbName(method) {
+    return DOCUMENT_VERBS.some((v) => v.mcp === method);
+}
+/**
+ * Every capability with BOTH an MCP tool and a CLI command, for THIS process.
+ *
+ * Read at module load, which is where every other consumer of this table already reads it — the CLI
+ * renders its help in a fresh process per invocation, and the daemon builds its handler map once at
+ * boot. "Read once at startup" and "read at module load" are the same act here.
+ */
+export const DUAL_SURFACE_VERBS = documentsEnabled()
+    ? [...ALWAYS_ON_VERBS, ...DOCUMENT_VERBS]
+    : ALWAYS_ON_VERBS;
+/**
+ * Tools that exist ONLY on the MCP surface. Listed so the audit test can tell "known MCP-only" from
+ * "stale name".
+ *
+ * ⚠️ THIS COMMENT USED TO READ *"Their daemon handlers return `not_implemented`, so there is
+ * deliberately no CLI command to build a second broken path to."* That was true of all three when it
+ * was written and is now true of NONE of them — `cello_backup` and `cello_restore` were implemented
+ * by `DOD-M15-BACKUP-1`, and `cello_get_inclusion_proof` by `DOD-M15-INCLUSION-1`, which also added
+ * `cello_verify_inclusion_proof`. Rewritten rather than deleted, per the claim-truth lens: the
+ * sentence is the evidence that "MCP-only" was once a synonym for "unimplemented", and a reader who
+ * still believes that would take a working tool for a stub.
+ *
+ * What the list means NOW: these are implemented capabilities with no CLI twin. Membership is a
+ * statement about SURFACE, not about readiness.
+ */
+export const MCP_ONLY_TOOLS = [
+    "cello_backup",
+    "cello_restore",
+    "cello_get_inclusion_proof",
+    "cello_verify_inclusion_proof",
+];
+/**
+ * `cello_*` identifiers that are NOT tools and must never be mistaken for one.
+ *
+ * `cello_message` is the doorbell NOTIFICATION frame type (and the stem of the
+ * `notification.cello_message.dispatch.failed` log event). It is wire vocabulary and log taxonomy,
+ * never a command an operator could run — so the audit must recognise it rather than demand it be
+ * renamed to a tool that would not exist.
+ */
+export const NON_TOOL_IDENTIFIERS = ["cello_message"];
+/** Every `cello_*` token the daemon is ALLOWED to name in guidance. Anything else is a bug. */
+export function knownToolNames() {
+    return new Set([
+        ...DUAL_SURFACE_VERBS.map((v) => v.mcp),
+        ...MCP_ONLY_TOOLS,
+        ...NON_TOOL_IDENTIFIERS,
+    ]);
+}
+/**
+ * CLI verbs that DO NOT EXIST. No string anywhere may hand one of these to an operator.
+ *
+ * This list is needed IN ADDITION to the tool audit: that audit matches `cello_*` tokens, so it is
+ * structurally BLIND to a dead *CLI* verb — `cello register` is just prose to it. A user handed a
+ * command that does not dispatch is worse off than one handed nothing.
+ *
+ * Anchoring is by NEGATIVE LOOKAHEAD, not a trailing space — see deadCliVerbPattern().
+ */
+export const DEAD_CLI_VERBS = [
+    "cello register",
+    "cello install",
+    "cello receipts",
+    "cello close",
+    "cello initiate",
+    // No replacement to point at: this was an alias of `cello receive` (same daemon handler) whose
+    // help claimed an accept/join step CELLO does not have. Listed so no string can offer it again.
+    "cello receive-session",
+    // Renamed to `cello set-agent-offline` (DOD-RELEASE-1). It was added to the CLI DISPATCH guard
+    // in cli-args.test.ts — "can you type it" — but that guard is blind to the thing this list
+    // exists for: a daemon STRING offering the verb to an operator. Same gap that leaked
+    // `cello register`.
+    "cello stop-agent",
+];
+/**
+ * Dead flat contact shape: `cello contact <op> <pubkey>`. The live shape REVERSES the arguments
+ * (`cello contact <pubkey> <op>`), so these are not merely renamed — following one silently targets
+ * a contact named "add". In the live shape an OP can never follow `contact` directly; a pubkey does.
+ */
+const DEAD_CONTACT_OPS = ["list", "add", "remove", "tier", "away", "set-tier", "set-away", "set-moniker"];
+/**
+ * Match any dead CLI verb, wherever it is SPOKEN — the one regex both audits share.
+ *
+ * The negative lookahead `(?![-\w])` is load-bearing; do NOT weaken it to a trailing SPACE. A verb
+ * followed by a quote, period, backtick, paren or comma would slip straight through, and dead verbs
+ * appear inside quotes and at end of sentence in real guidance strings. An audit defeated by a full
+ * stop is not an audit.
+ *
+ * The lookahead still lets the LIVE commands through, because each dead verb is a strict prefix of
+ * its replacement: `cello register-agent`, `cello close-session`, `cello initiate-session` all have
+ * a `-` right where the lookahead refuses one.
+ */
+export function deadCliVerbPattern() {
+    const verbs = DEAD_CLI_VERBS.map((v) => v.replace(/^cello /, "")).join("|");
+    const ops = DEAD_CONTACT_OPS.join("|");
+    return new RegExp(`cello\\s+(?:${verbs})(?![-\\w])|cello\\s+contact\\s+(?:${ops})(?![-\\w])`, "g");
+}
+/**
+ * MCP tool names that DO NOT EXIST. Nothing may hand one of these to an agent.
+ *
+ * Distinct from `knownToolNames()` (an allowlist: "every cello_* token must be in the table"). That
+ * allowlist works inside the daemon, where every `cello_*` token IS a tool name — but it cannot be
+ * used across the CLI package, where `cello_*` tokens are also IPC WIRE method names
+ * (`client.send("cello_list_agents")`, which deliberately do not move) and, in the scaffolded Hermes
+ * assets, plain config identifiers (`cello_socket_path`, `cello_dir`). An allowlist there would
+ * either drown in false positives or be so riddled with exceptions it stopped meaning anything.
+ *
+ * So outside the daemon assert the DENYLIST instead: whatever else a string says, it must not name a
+ * deleted tool. The exposure is real — non-code assets ship to the operator's disk and instruct
+ * their agent (the Hermes `platform_hint` is a live example).
+ */
+export const RENAMED_AWAY_TOOLS = [
+    // No replacement to point at: this was an alias of cello_receive — the same daemon handler —
+    // whose help claimed an accept/join step that does not exist. The capability was never real.
+    "cello_receive_session",
+    "cello_list_agents",
+    "cello_list_sessions",
+    "cello_check_notifications",
+    "cello_get_transcript",
+    "cello_get_sealed_receipt",
+    "cello_set_moniker",
+    "cello_contact_list",
+];
+/** Longest-first, so `cello_contact_set_moniker` is matched before a hypothetical `cello_contact`. */
+const CLI_BY_MCP = [...DUAL_SURFACE_VERBS].sort((a, b) => b.mcp.length - a.mcp.length);
+/**
+ * Instructions that carry ARGUMENTS, not just a name — rewritten whole, before the token pass.
+ *
+ * Renaming the tool is not enough when the instruction is a CALL. `cello inbox`'s rename notice ends
+ * with a literal, copy-pasteable invocation:
+ *
+ *     Adopt it: cello_contact_set_moniker { pubkey: "abcd…", moniker: "Zoe" }, or ignore.
+ *
+ * Rewriting only the token would give a CLI operator the tool's name with the tool's JSON still
+ * bolted on, and a literal `<pubkey>` placeholder next to the real key — it looks like a command and
+ * is not one; pasting it trips the invalid_pubkey gate. Half a translation is its own kind of wrong
+ * answer.
+ *
+ * So the call form is translated as a unit, arguments and all, and the result is a line the operator
+ * can actually paste. MUST run BEFORE the token pass, which would otherwise have eaten the name.
+ */
+const CALL_FORMS = [
+    {
+        re: /cello_contact_set_moniker\s*\{\s*pubkey:\s*"([^"]*)",\s*moniker:\s*"([^"]*)"\s*\}/g,
+        cli: (m) => `cello contact ${m[1]} set-moniker "${m[2]}"`,
+    },
+    {
+        // DOD-M15-DIVERGE-1 (review LOW-8) — the object form does not survive translation on its own.
+        // `CLI_BY_MCP` rewrites the VERB, so a CLI operator was handed
+        // `cello close-session <id> { force: true }`, and the real flag is `--force`. A guidance string
+        // that renders to an untypeable command is the failure `toCliGuidance` exists to prevent, and
+        // it was already reachable from two other refusals before this one duplicated it — so the fix
+        // belongs here, where it corrects all three at once, rather than in any single branch's prose.
+        re: /cello_close_session\s+(\S+)\s*\{\s*force:\s*true\s*\}/g,
+        cli: (m) => `cello close-session ${m[1]} --force`,
+    },
+];
+/**
+ * Rewrite MCP tool names in a guidance string into the CLI verbs an operator would type.
+ *
+ * Only `cello_*` tokens in DUAL_SURFACE_VERBS are rewritten. An MCP-only tool has no CLI verb to
+ * offer, so it is left alone — inventing one would send the operator to a command that does not
+ * exist, which is the exact failure this whole mechanism prevents.
+ */
+export function toCliGuidance(text) {
+    let out = text;
+    for (const { re, cli } of CALL_FORMS) {
+        out = out.replace(new RegExp(re.source, re.flags), (...args) => cli(args));
+    }
+    for (const { mcp, cli } of CLI_BY_MCP) {
+        // Word-boundary on the tail: `cello_agents` must not match inside `cello_agents_foo`.
+        out = out.replace(new RegExp(`${mcp}(?![a-z_])`, "g"), cli);
+    }
+    return out;
+}
+/**
+ * Does this response key carry an INSTRUCTION TO A HUMAN — one that names a command to run?
+ *
+ * A SUFFIX RULE, not a fixed set, and that is the whole point. It was a set of three literals until
+ * `pending_consent_guidance` was added by a handler that had no idea a registry existed; the key was
+ * therefore not rewritten, and a CLI operator was told to run `cello_attestation_consent_list` — a thing you
+ * cannot type. The class of bug is "someone invents a new *_guidance key", so the fix has to close
+ * the class: any key ending in `guidance` is an instruction, whatever its prefix.
+ *
+ * `reason` is deliberately excluded and must stay excluded: it is a machine-readable code that
+ * scripts branch on (`reason === "session_not_current"`). Rewriting it would silently break every
+ * caller.
+ */
+function isInstructionKey(key) {
+    return key === "notice" || key.endsWith("guidance");
+}
+/**
+ * Render a handler's response for the surface that asked.
+ *
+ * Applied ONCE, at the IPC response boundary (daemon.ts wraps every handler), so a new handler
+ * cannot forget it and a new guidance string cannot drift. MCP callers get the response verbatim —
+ * the source strings already hold the canonical MCP names.
+ *
+ * MUST RECURSE into nested objects and arrays; rewriting only a TOP-LEVEL `guidance` is not enough.
+ * Real instructions live deep — `cello inbox`'s rename notices sit at
+ * `agents[i].rename_notices[j].notice`. A choke point that only covers the easy shape is not a choke
+ * point; it just moves the leak somewhere less visible.
+ */
+export function renderForSurface(result, surface) {
+    if (surface === "mcp")
+        return result;
+    return renderCli(result);
+}
+function renderCli(value) {
+    if (Array.isArray(value)) {
+        let changed = false;
+        const out = value.map((v) => {
+            const r = renderCli(v);
+            if (r !== v)
+                changed = true;
+            return r;
+        });
+        return changed ? out : value;
+    }
+    if (value === null || typeof value !== "object")
+        return value;
+    const record = value;
+    let changed = false;
+    const out = {};
+    for (const [key, v] of Object.entries(record)) {
+        let next = v;
+        if (isInstructionKey(key) && typeof v === "string") {
+            next = toCliGuidance(v);
+        }
+        else if (v !== null && typeof v === "object") {
+            next = renderCli(v);
+        }
+        if (next !== v)
+            changed = true;
+        out[key] = next;
+    }
+    // Identity-preserving when nothing changed — the MCP path and untouched CLI payloads keep the
+    // exact object the handler returned, so nothing downstream can depend on an incidental copy.
+    return changed ? out : value;
+}
+//# sourceMappingURL=vocabulary.js.map

package/dist/vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.js","sourceRoot":"","sources":["../src/vocabulary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAQtD;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAA+B;IAClD,SAAS;IACT,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE;IAC5C,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACtD,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,yBAAyB,EAAE;IAClE,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE;IAClD,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,EAAE;IAChE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE;IAC5C,YAAY;IACZ,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,EAAE;IAChE,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,qBAAqB,EAAE;IAC1D,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,qBAAqB,EAAE;IAC1D,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE;IACxD,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE;IAC9C,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE;IACxC,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE;IAC9C,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE;IAC1C,sBAAsB;IACtB,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAChD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACpD,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACtD,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,sBAAsB,EAAE;IAC5D,WAAW;IACX,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAChD,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,EAAE;IAC/D,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,+BAA+B,EAAE;IACrE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,iCAAiC,EAAE;IACzE,EAAE,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,iCAAiC,EAAE;IACzE,EAAE,GAAG,EAAE,2BAA2B,EAAE,GAAG,EAAE,oCAAoC,EAAE;IAC/E,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,mCAAmC,EAAE;IAC7E,iFAAiF;IACjF,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,0BAA0B,EAAE;IACpE,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,0BAA0B,EAAE;IACpE,EAAE,GAAG,EAAE,2BAA2B,EAAE,GAAG,EAAE,2BAA2B,EAAE;IACtE,EAAE,GAAG,EAAE,0BAA0B,EAAE,GAAG,EAAE,0BAA0B,EAAE;IACpE,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,4BAA4B,EAAE;IACxE,EAAE,GAAG,EAAE,6BAA6B,EAAE,GAAG,EAAE,6BAA6B,EAAE;IAC1E,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,4BAA4B,EAAE;IACxE,0FAA0F;IAC1F,EAAE,GAAG,EAAE,gCAAgC,EAAE,GAAG,EAAE,gCAAgC,EAAE;IAChF,EAAE,GAAG,EAAE,kCAAkC,EAAE,GAAG,EAAE,kCAAkC,EAAE;IACpF,EAAE,GAAG,EAAE,kCAAkC,EAAE,GAAG,EAAE,kCAAkC,EAAE;IACpF,QAAQ;IACR,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE;IAC9C,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE;IACxD,EAAE,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE;IACxD,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,4DAA4D;IAC5D,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACtD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACpD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACpD,gDAAgD;IAChD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,cAAc,GAA+B;IACjD,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACtD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACpD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACpD,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE;IAClD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACpD,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACpD,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAChD,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAChD,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAChD,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE;IAClD,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE;IAClD,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACtD,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,EAAE;IAClD,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE;CACjD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA+B,gBAAgB,EAAE;IAC9E,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC;IACzC,CAAC,CAAC,eAAe,CAAC;AAEpB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,cAAc;IACd,eAAe;IACf,2BAA2B;IAC3B,8BAA8B;CAC/B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,eAAe,CAAC,CAAC;AAEzE,+FAA+F;AAC/F,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,GAAG,CAAC;QACb,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACvC,GAAG,cAAc;QACjB,GAAG,oBAAoB;KACxB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,+FAA+F;IAC/F,gGAAgG;IAChG,uBAAuB;IACvB,+FAA+F;IAC/F,2FAA2F;IAC3F,qFAAqF;IACrF,oBAAoB;IACpB,kBAAkB;CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAE1G;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,IAAI,MAAM,CAAC,eAAe,KAAK,sCAAsC,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,6FAA6F;IAC7F,6FAA6F;IAC7F,uBAAuB;IACvB,mBAAmB;IACnB,qBAAqB;IACrB,2BAA2B;IAC3B,sBAAsB;IACtB,0BAA0B;IAC1B,mBAAmB;IACnB,oBAAoB;CACrB,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,GAAmC,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAC7E,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CACtC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,GAAuE;IACrF;QACE,EAAE,EAAE,oFAAoF;QACxF,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG;KAC1D;IACD;QACE,8FAA8F;QAC9F,+DAA+D;QAC/D,gGAAgG;QAChG,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,EAAE,EAAE,wDAAwD;QAC5D,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,UAAU;KAClD;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;QACrC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAkC,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,KAAK,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;QACtC,sFAAsF;QACtF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,YAAY,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAKD;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAe,EAAE,OAAsB;IACtE,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;YAC5B,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,IAAI,IAAI,GAAY,CAAC,CAAC;QACtB,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnD,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,8FAA8F;IAC9F,6FAA6F;IAC7F,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/B,CAAC"}

package/dist/who-label.d.ts

@@ -0,0 +1,28 @@
+/**
+ * MONIKER-4 AC1 — whoLabel: the one display-name resolution (M8C-MONIKER-SPEC §2).
+ *
+ *   who = localMoniker ?? offeredMoniker ?? fingerprint(pubkey)
+ *
+ * PURE and TOTAL: never throws, never returns an empty label. Both name inputs
+ * are re-validated with the shared wire rule — the boundaries (MONIKER-2/3)
+ * make invalid values unreachable here, but totality means this function is
+ * safe even if misused. `whoKnown` is true ONLY when the label came from the
+ * local address book (a deliberate operator act — CC-1); an offered name is an
+ * unverified hint and a fingerprint is derived identity, both unknown.
+ *
+ * The name-vs-fingerprint discriminator is unforgeable by construction:
+ * MONIKER_RE excludes spaces, and a fingerprint always contains one.
+ */
+export type WhoSource = "local" | "offered" | "fingerprint";
+/** `agent 178d420b…` — first 8 hex chars. Total: garbage still yields a non-empty label. */
+export declare function fingerprint(pubkeyHex: unknown): string;
+export declare function whoLabel(input: {
+    localMoniker?: string | null;
+    offeredMoniker?: string | null;
+    pubkeyHex: string;
+}): {
+    who: string;
+    whoKnown: boolean;
+    source: WhoSource;
+};
+//# sourceMappingURL=who-label.d.ts.map

package/dist/who-label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"who-label.d.ts","sourceRoot":"","sources":["../src/who-label.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,aAAa,CAAC;AAE5D,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAGtD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAMxD"}

package/dist/who-label.js

@@ -0,0 +1,31 @@
+/**
+ * MONIKER-4 AC1 — whoLabel: the one display-name resolution (M8C-MONIKER-SPEC §2).
+ *
+ *   who = localMoniker ?? offeredMoniker ?? fingerprint(pubkey)
+ *
+ * PURE and TOTAL: never throws, never returns an empty label. Both name inputs
+ * are re-validated with the shared wire rule — the boundaries (MONIKER-2/3)
+ * make invalid values unreachable here, but totality means this function is
+ * safe even if misused. `whoKnown` is true ONLY when the label came from the
+ * local address book (a deliberate operator act — CC-1); an offered name is an
+ * unverified hint and a fingerprint is derived identity, both unknown.
+ *
+ * The name-vs-fingerprint discriminator is unforgeable by construction:
+ * MONIKER_RE excludes spaces, and a fingerprint always contains one.
+ */
+import { validateMoniker } from "@cello-protocol/protocol-types";
+/** `agent 178d420b…` — first 8 hex chars. Total: garbage still yields a non-empty label. */
+export function fingerprint(pubkeyHex) {
+    const hex = typeof pubkeyHex === "string" && pubkeyHex.length >= 8 ? pubkeyHex.slice(0, 8) : null;
+    return hex !== null ? `agent ${hex}…` : "agent unknown…";
+}
+export function whoLabel(input) {
+    const local = input.localMoniker != null ? validateMoniker(input.localMoniker) : null;
+    if (local !== null)
+        return { who: local, whoKnown: true, source: "local" };
+    const offered = input.offeredMoniker != null ? validateMoniker(input.offeredMoniker) : null;
+    if (offered !== null)
+        return { who: offered, whoKnown: false, source: "offered" };
+    return { who: fingerprint(input.pubkeyHex), whoKnown: false, source: "fingerprint" };
+}
+//# sourceMappingURL=who-label.js.map

package/dist/who-label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"who-label.js","sourceRoot":"","sources":["../src/who-label.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAIjE,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,SAAkB;IAC5C,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAIxB;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClF,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACvF,CAAC"}

package/dist/who-resolver.d.ts

@@ -0,0 +1,15 @@
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { Logger } from "./types.js";
+export interface WhoLabelDeps {
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    /** The display name the counterparty offered for this session, if any. */
+    getOfferedMoniker: (agentName: string, sessionIdHex: string) => string | null;
+}
+export declare function createWhoResolver(deps: WhoLabelDeps): {
+    resolveWho: (agentName: string, pubkeyHex: string, sessionIdHex: string) => {
+        who: string;
+        whoKnown: boolean;
+    };
+};
+//# sourceMappingURL=who-resolver.d.ts.map

package/dist/who-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"who-resolver.d.ts","sourceRoot":"","sources":["../src/who-resolver.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC/E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY;4BAOnB,MAAM,aAAa,MAAM,gBAAgB,MAAM,KAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE;EA6BpH"}

package/dist/who-resolver.js

@@ -0,0 +1,47 @@
+/**
+ * What to CALL a counterparty in a message an operator reads.
+ *
+ * Three tiers, and the order matters: the local pet name an operator chose, then the display name
+ * the counterparty offered for this session, then the key fingerprint. A label can never block a
+ * message and can never stand in for identity — the pubkey is the identity, and this only decides
+ * what a human sees beside it.
+ */
+import { whoLabel } from "./who-label.js";
+import { extractErrorMessage } from "./error-message.js";
+export function createWhoResolver(deps) {
+    const { logger, sessionNodeManager, getOfferedMoniker } = deps;
+    // MONIKER-4 AC2: resolve the counterparty's display label — local pet name (MONIKER-3) ??
+    // offered name for this session (MONIKER-2) ?? fingerprint. Total: any failure inside
+    // resolution degrades to fingerprint via whoLabel's own tiers; a label can never block a
+    // doorbell (spec §8).
+    function resolveWho(agentName, pubkeyHex, sessionIdHex) {
+        let localMoniker = null;
+        try {
+            localMoniker = sessionNodeManager.getContactMoniker(agentName, pubkeyHex);
+        }
+        catch (err) {
+            logger.warn("moniker.local.read_failed", { agentName, pubkey: pubkeyHex, reason: extractErrorMessage(err) });
+        }
+        // DOD-MONIKER-6: read only the box written FOR this agent — never a co-resident agent's.
+        const resolved = whoLabel({ localMoniker, offeredMoniker: getOfferedMoniker(agentName, sessionIdHex), pubkeyHex });
+        // `sessionId` is load-bearing for diagnosis, not decoration. `source:"offered"` is CORRECT for a
+        // RECEIVER and wrong only for an INITIATOR (an initiator must never find a box — see DOD-MONIKER-6),
+        // so a line cannot be judged without knowing who opened the session. Join on sessionId against
+        // `session.inbound.accepted`, which names the receiver; any other agent on that session is the
+        // initiator. Without this field the M8C live run produced a wrong verdict twice (journal Entry 76).
+        //
+        // The resolved LABEL is never logged: for an unverified offer it is an attacker-chosen string, and
+        // MONIKER-2 AC2 already forbids echoing the raw value (`moniker.rejected` logs the reason, not the
+        // name). `whoKnown` carries the trust bit without the payload.
+        logger.debug("moniker.resolved", {
+            agentName,
+            sessionId: sessionIdHex,
+            pubkey: pubkeyHex,
+            source: resolved.source,
+            whoKnown: resolved.whoKnown,
+        });
+        return { who: resolved.who, whoKnown: resolved.whoKnown };
+    }
+    return { resolveWho };
+}
+//# sourceMappingURL=who-resolver.js.map

package/dist/who-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"who-resolver.js","sourceRoot":"","sources":["../src/who-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AASzD,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAE/D,0FAA0F;IAC1F,sFAAsF;IACtF,yFAAyF;IACzF,sBAAsB;IACtB,SAAS,UAAU,CAAC,SAAiB,EAAE,SAAiB,EAAE,YAAoB;QAC5E,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,CAAC;YACH,YAAY,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,yFAAyF;QACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACnH,iGAAiG;QACjG,qGAAqG;QACrG,+FAA+F;QAC/F,+FAA+F;QAC/F,oGAAoG;QACpG,EAAE;QACF,mGAAmG;QACnG,mGAAmG;QACnG,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE;YAC/B,SAAS;YACT,SAAS,EAAE,YAAY;YACvB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}

package/dist/wire-content-hash.d.ts

@@ -0,0 +1,93 @@
+/**
+ * THE content hash every session content frame carries on the wire.
+ *
+ * `sha256(0x00 || content)`. The `0x00` is a domain-separation prefix, and it is NOT the leaf kind:
+ * the receiver recomputes with `0x00` for every frame regardless of what the content turns out to
+ * be (`session-node-manager.ts` cross-check), and the leaf KIND — `msg`, `doc`, `ctrl` — is decided
+ * afterwards, when the leaf is appended. Confusing the two is the mistake this module exists to
+ * stop, because it produces a hash that is individually plausible and rejected by every peer.
+ *
+ * ── WHY IT IS A MODULE ────────────────────────────────────────────────────────────────────────
+ *
+ * The expression was written out at five call sites. The two DOCUMENT senders — added last — wrote
+ * `sha256(content)` without the prefix, and the failure is the least debuggable shape there is:
+ * the send succeeds, `parked: false`, the sender's log says the frame left, and the receiver
+ * discards it at the authenticity check with `content_hash_mismatch` before the document layer is
+ * ever consulted. The receiving side logs nothing about documents at all, so the evidence points at
+ * classification, at the router, at the gateway — everywhere except the sender's hash.
+ *
+ * No unit test could see it: both sides of every in-process test compute the hash with the same
+ * function, so they agree with each other whether or not either agrees with the wire. It took two
+ * real daemons.
+ */
+/**
+ * ─── THE ALGORITHM TRAVELS WITH THE HASH — `DOD-M15-SEALWIRE-1` part B1 ───────────────────────
+ *
+ * A salted content hash and an unsalted one are both 32 bytes in the same wire field. Nothing in
+ * the bytes distinguishes them, so a receiver handed one and told nothing has no way to know which
+ * it is holding — and gets `content_hash_mismatch` on every frame, which is the exact
+ * silent-discard failure this module's header says cost two real daemons.
+ *
+ * Hence a NAME on the wire, and three cases that must stay apart (Decisions Carried #15):
+ *
+ *   ABSENT            → `sha256`. A peer that predates the field. We know what it computed.
+ *   NAMED and KNOWN   → verify under that name.
+ *   NAMED and UNKNOWN → **refuse.** Not a legacy peer — an unreadable one. There is no correct hash
+ *                       to compare against, and falling back to `sha256` would compare two
+ *                       unrelated values and report a TAMPER for a version skew.
+ *
+ * ⚠️ RECEIVER FIRST — the ROLLOUT ORDER, which is still the rule. Every peer must be able to
+ * understand a salted frame before any peer sends one. Reversed, the first upgraded sender breaks
+ * every conversation it has with a peer that has not upgraded.
+ *
+ * > **⛔ THIS PARAGRAPH USED TO END "`no sender salts yet`", AND THAT IS NO LONGER TRUE.** It was
+ * > written during part B1, when the receiver had been taught to read the name and nothing produced
+ * > a salted one. **B2b-2 flipped it: a session holding an agreed salt now hashes under
+ * > `HMAC_SALT_V1`.** The sentence is rewritten rather than deleted because it is exactly the shape
+ * > `DOD-M15-CLAIM-COMMENTS-1` exists to catch — a comment asserting a property the code no longer
+ * > has — and deleting it would remove the evidence that someone reasoned from it.
+ * >
+ * > It was still being read as current on 2026-08-24: a spine test's park deposit declared `sha256`
+ * > on this comment's authority, the recipient recomputed under the name it was given, and the
+ * > mismatch surfaced as `content_hash_mismatch` — **a tamper verdict on a message nobody touched**,
+ * > which is precisely the failure the ALGORITHM-TRAVELS-WITH-THE-HASH rule above exists to prevent.
+ */
+export declare const CONTENT_HASH_ALGS: {
+    /** `sha256(0x00 ‖ content)` — what every build before the salt computes, and the absent-field default. */
+    readonly SHA256: "sha256";
+    /** `hmac-sha256(salt, 0x00 ‖ content)` — Decision #9. HMAC, never `sha256(salt ‖ content)`. */
+    readonly HMAC_SALT_V1: "hmac-sha256-salt-v1";
+};
+export type ContentHashAlg = (typeof CONTENT_HASH_ALGS)[keyof typeof CONTENT_HASH_ALGS];
+/** Whether this daemon can reproduce a hash under the given name. */
+export declare function isKnownContentHashAlg(alg: string): alg is ContentHashAlg;
+/**
+ * What a frame says it used, or a refusal naming the value.
+ *
+ * ABSENT is deliberately `undefined`/`null` ONLY — not "falsy". An empty string is a peer that sent
+ * a name we cannot read, not a peer that sent no name, and folding the two together would verify a
+ * malformed frame as legacy instead of telling its sender the frame is unreadable.
+ */
+export declare function resolveContentHashAlg(raw: string | null | undefined): {
+    ok: true;
+    alg: ContentHashAlg;
+} | {
+    ok: false;
+    value: string;
+};
+/**
+ * The content hash under a named algorithm.
+ *
+ * THROWS rather than substituting, in both failure cases, and that is the point of the function. A
+ * 32-byte value returned for an unknown algorithm — or an unsalted one returned because the salt was
+ * missing — flows straight into the cross-check and surfaces as `content_hash_mismatch`: a TAMPER
+ * REPORT for what is really a version skew or a missing salt. The caller must handle those as what
+ * they are.
+ */
+export declare function contentHashFor(content: Uint8Array, opts: {
+    alg: string;
+    salt: Uint8Array | null;
+}): Uint8Array;
+/** The hash a sender puts on the wire and the receiver recomputes to authenticate it. */
+export declare function wireContentHash(content: Uint8Array): Uint8Array;
+//# sourceMappingURL=wire-content-hash.d.ts.map

package/dist/wire-content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-content-hash.d.ts","sourceRoot":"","sources":["../src/wire-content-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,iBAAiB;IAC5B,0GAA0G;;IAE1G,+FAA+F;;CAEvF,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAIxF,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,IAAI,cAAc,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAMlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,GAC7C,UAAU,CAiBZ;AAQD,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAE/D"}