@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/directory-connect.js

@@ -0,0 +1,106 @@
+/**
+ * How this daemon reaches a directory, and what it tells a relay about itself when it gets there.
+ *
+ * The relay-witness connect parameters — who is asking, over which circuit, with which online token
+ * — and the default signaling connect that carries them. Also the single shared signaling manager,
+ * which exists ONLY on the in-process test path: in production every agent dials its own, because
+ * the directory routes by the pubkey that authenticated the stream.
+ */
+import { SignalingManager } from "@cello-protocol/transport";
+export function createDirectoryConnect(deps) {
+    const { logger, keyProviders, signalingConnect, directoryEndpointResolver } = deps;
+    // M7 DOD-SPINE-6 / MSG-001-3b: assemble the relay-witness connect params for a
+    // session node from the FROST-signed assignment (relay endpoint + 16-byte session id)
+    // and the acting agent's K_local. Returns undefined when the agent key or relay
+    // endpoint is missing — the session then runs on the direct content path without a
+    // relay witness (degraded, never blocked).
+    const buildRelayConnectParams = async (agentName, assignment) => {
+        const kp = keyProviders.get(agentName);
+        const endpoint = assignment.relay_endpoint;
+        if (!kp || !endpoint || !endpoint.peer_id || !endpoint.multiaddrs || endpoint.multiaddrs.length === 0) {
+            return undefined;
+        }
+        // FED-OPTIONB-SETUP-001 (Option B): when the directory included the per-node relay-assignment
+        // signature, carry the assignment so the client presents it to its chosen relay (replacing the
+        // directory→relay dial). Built only for relay-mode assignments that carry relay_directory_signature;
+        // absent ⇒ the client skips client_record_assignment (direct/legacy/pre-M8B).
+        const relayDirSig = assignment.relay_directory_signature;
+        // FED-OPTIONB-SETUP-001 (fallback-finder #1/#5): a relay-mode assignment MUST carry a
+        // relay_directory_signature — the directory always signs one. If it is absent or malformed (the
+        // parser dropped it to undefined) for a relay-mode session, the session silently degrades to "no
+        // relay witness" and looks indistinguishable from a legitimate direct-mode session. Warn LOUD so the
+        // missing/corrupt witness has a named cause (this is the only diagnosable signal on a PURE RECEIVER,
+        // which never submits and so never surfaces relay_unavailable). Unwitnessed is an allowed sovereign-
+        // redundancy state, but it must not be invisible.
+        if (assignment.transport_mode === "relay" && !relayDirSig) {
+            logger.warn("session.relay.assignment.signature.missing", {
+                agentName,
+                sessionId: Buffer.from(assignment.session_id).toString("hex").slice(0, 16),
+                reason: "relay_mode_assignment_without_directory_signature",
+            });
+        }
+        /**
+         * 069-ORDERPROOF: the carry now exists for EITHER of two independent reasons — something to
+         * present to the relay, or the name of the relay whose ordering attestations this session will
+         * accept. Requiring both would mean a session that knows its relay but has no per-node
+         * signature verifies nothing at all, which hands the relay a way to opt out of being checked.
+         */
+        const relayAnchorHex = assignment.relay_id && /^[0-9a-f]{64}$/i.test(assignment.relay_id) ? assignment.relay_id : undefined;
+        const carry = relayDirSig || relayAnchorHex
+            ? {
+                participantA: assignment.participant_a.pubkey,
+                participantB: assignment.participant_b.pubkey,
+                sessionTimestamp: assignment.session_timestamp, sessionSignature: assignment.directory_signature,
+                initiatorSessionPeerId: assignment.initiator_session_peer_id,
+                counterpartySessionPeerId: assignment.counterparty_session_peer_id,
+                ...(relayDirSig ? { assignmentSignature: relayDirSig } : {}),
+                ...(relayAnchorHex ? { relayPubkeyHex: relayAnchorHex } : {}),
+            }
+            : undefined;
+        return {
+            relayPeerId: endpoint.peer_id,
+            relayAddrs: endpoint.multiaddrs,
+            keyProvider: kp,
+            senderPubkey: await kp.getPublicKey(),
+            sessionIdBytes: assignment.session_id,
+            assignment: carry,
+        };
+    };
+    // M7-SIGNAL-001: Instantiate SignalingManager — owns directory signaling stream lifecycle.
+    const defaultConnect = async () => {
+        throw new Error("directory_signaling_not_configured");
+    };
+    // CELLO-M7-CONN-001 (DOD-CONN-1): the keystone is DELETED. There is no shared directory
+    // connection borrowing the "primary" agent's identity. In PRODUCTION every agent operates its
+    // OWN directory signaling connection authenticated as itself (getAgentSignaling / signalingFor);
+    // removing any agent tears down only that agent's own connection, so the daemon never holds a
+    // connection authenticated as a removed agent (the Demo1 stranding bug). A single SHARED manager
+    // exists ONLY for the IN-PROCESS TEST path (NOT back-compat — there is no old client, and Rule F deletes back-compat on sight) (a single injected signalingConnect,
+    // no per-agent isolation) — in production it is undefined.
+    //
+    // The SHARED (in-process test / pre-resolver) signaling path has no directory-facing node of its
+    // own: nodes are per-agent, published by each agent's manager (getAgentSignaling → `nodeRef`).
+    // There is nothing to return here, and saying so explicitly is the point.
+    //
+    // Consequence, and it is load-bearing: session-ceremony's hydrateShareAndStubs leaves
+    // `directoryNodeStubs` UNDEFINED when getNode() is null, so FrostThresholdSigner runs with an
+    // EMPTY set of counterparties and its pre-check (reachable < threshold-1) REFUSES. That is the
+    // sovereign-node invariant holding — a daemon with no directory nodes must never sign alone. Do
+    // NOT "fix" an empty stub set by substituting in-process stubs; that converts a refusal into a
+    // forged seal. Pinned by frost.test.ts, "SOVEREIGN-NODE INVARIANT".
+    const noSharedDirectoryNode = () => null;
+    // H1: a long-running daemon must ride out directory outages — notably the 25-30 min multi-region
+    // directory deploy. Use an effectively-unbounded reconnect budget with a capped backoff so each
+    // connection keeps retrying and reconnects within ~maxBackoffMs of the directory returning.
+    const sharedSignaling = directoryEndpointResolver
+        ? undefined
+        : new SignalingManager({
+            connect: signalingConnect ?? defaultConnect,
+            logger,
+            maxReconnectAttempts: Number.MAX_SAFE_INTEGER,
+            maxBackoffMs: 30_000,
+        });
+    // `defaultConnect` is not returned: its only consumer is the shared manager built here.
+    return { buildRelayConnectParams, noSharedDirectoryNode, sharedSignaling };
+}
+//# sourceMappingURL=directory-connect.js.map

package/dist/directory-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-connect.js","sourceRoot":"","sources":["../src/directory-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAsC,MAAM,2BAA2B,CAAC;AAgBjG,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,GAAG,IAAI,CAAC;IAEnF,+EAA+E;IAC/E,sFAAsF;IACtF,gFAAgF;IAChF,mFAAmF;IACnF,2CAA2C;IAC3C,MAAM,uBAAuB,GAAG,KAAK,EACnC,SAAiB,EACjB,UAAkE,EACzB,EAAE;QAC3C,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtG,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,8FAA8F;QAC9F,+FAA+F;QAC/F,qGAAqG;QACrG,8EAA8E;QAC9E,MAAM,WAAW,GAAG,UAAU,CAAC,yBAAyB,CAAC;QACzD,sFAAsF;QACtF,gGAAgG;QAChG,iGAAiG;QACjG,qGAAqG;QACrG,qGAAqG;QACrG,qGAAqG;QACrG,kDAAkD;QAClD,IAAI,UAAU,CAAC,cAAc,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBACxD,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC1E,MAAM,EAAE,mDAAmD;aAC5D,CAAC,CAAC;QACL,CAAC;QACD;;;;;WAKG;QACH,MAAM,cAAc,GAClB,UAAU,CAAC,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,KAAK,GAAqC,WAAW,IAAI,cAAc;YAC3E,CAAC,CAAC;gBACE,YAAY,EAAE,UAAU,CAAC,aAAa,CAAC,MAAM;gBAC7C,YAAY,EAAE,UAAU,CAAC,aAAa,CAAC,MAAM;gBAC7C,gBAAgB,EAAE,UAAU,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,CAAC,mBAAmB;gBAChG,sBAAsB,EAAE,UAAU,CAAC,yBAAyB;gBAC5D,yBAAyB,EAAE,UAAU,CAAC,4BAA4B;gBAClE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;YACH,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,OAAO;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,MAAM,EAAE,CAAC,YAAY,EAAE;YACrC,cAAc,EAAE,UAAU,CAAC,UAAU;YACrC,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC,CAAC;IAEF,2FAA2F;IAC3F,MAAM,cAAc,GAAG,KAAK,IAA4B,EAAE;QACxD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,wFAAwF;IACxF,8FAA8F;IAC9F,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,oKAAoK;IACpK,2DAA2D;IAC3D,EAAE;IACF,iGAAiG;IACjG,+FAA+F;IAC/F,0EAA0E;IAC1E,EAAE;IACF,sFAAsF;IACtF,8FAA8F;IAC9F,+FAA+F;IAC/F,gGAAgG;IAChG,+FAA+F;IAC/F,oEAAoE;IACpE,MAAM,qBAAqB,GAAG,GAAqB,EAAE,CAAC,IAAI,CAAC;IAE3D,iGAAiG;IACjG,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,eAAe,GAAiC,yBAAyB;QAC7E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACnB,OAAO,EAAE,gBAAgB,IAAI,cAAc;YAC3C,MAAM;YACN,oBAAoB,EAAE,MAAM,CAAC,gBAAgB;YAC7C,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;IAEP,wFAAwF;IACxF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,eAAe,EAAE,CAAC;AAC7E,CAAC"}

package/dist/disconnect-cleanup.d.ts

@@ -0,0 +1,51 @@
+/**
+ * What the daemon forgets, and what it says, when an IPC connection closes.
+ *
+ * Why the close is reported at all — `DOD-M15-IPCVISIBLE-1` — is written below, at the code that
+ * builds the report. It is not repeated here: a paragraph kept in two places is one someone corrects
+ * in one of them.
+ *
+ * The three per-connection maps are released by the module that owns them; this is the reporting
+ * half, and it returns its context rather than logging its own line, because the IPC server merges
+ * it into the single `daemon.ipc.disconnected` entry. A second line under the same name left
+ * neither carrying the whole picture and doubled every count.
+ */
+import type { IpcServer } from "./ipc-server.js";
+import type { NotificationDispatcher } from "./notification-dispatcher.js";
+import type { InboundSessionWaiter } from "./inbound-sessions.js";
+export interface DisconnectCleanupDeps {
+    ipcServer: IpcServer;
+    /** Read this connection's selection before it is forgotten — the log needs what it was attending. */
+    getConnState: (connectionId: string) => {
+        currentAgent: string | null;
+        clientType?: string;
+    } | undefined;
+    /** How many connections still attend an agent, after this one goes. */
+    countAttendanceFor: (agentName: string) => number;
+    /**
+     * DOD-M15-AWAYSCOPE-1 — tell this agent's counterparties that the last attendee just left.
+     *
+     * Injected as a function rather than the whole manager: this module's job is releasing
+     * connection-scoped state, and handing it a session manager would invite it to grow one.
+     */
+    announceAttendance: (agentName: string, attendance: "attended" | "unattended" | "offline") => void;
+    /** Releases the three per-connection maps. Lives with the maps, not here. */
+    forgetConnection: (connectionId: string) => void;
+    /** Callers blocked in `cello_await_session` for an agent, so a dying connection releases them. */
+    inboundSessionWaiters: Map<string, InboundSessionWaiter[]>;
+    /**
+     * ⚠️ A GETTER, AND THE REASON IS NOT THE OBVIOUS ONE. The dispatcher is a `const` 82 lines ABOVE
+     * this wiring, so passing it by value would work today. The getter is there so that moving the
+     * construction below cannot break the disconnect path silently — the same shape as `getStop` in
+     * `ipc-surface.ts`.
+     *
+     * An earlier version of this comment said the dispatcher was constructed BELOW. It was not, and a
+     * false worked example of late binding is worse than none: the rule this order paid for is that a
+     * value assigned below a call site must be read through a getter, and the silent shape is a `let`
+     * (a `const` crashes loudly on TDZ). Teaching "getter because it is below" from a value that is
+     * above hands the next reader the wrong discriminator.
+     */
+    getNotificationDispatcher: () => NotificationDispatcher;
+}
+export declare function wireDisconnectCleanup(deps: DisconnectCleanupDeps): void;
+//# sourceMappingURL=disconnect-cleanup.d.ts.map

package/dist/disconnect-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disconnect-cleanup.d.ts","sourceRoot":"","sources":["../src/disconnect-cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,qGAAqG;IACrG,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACzG,uEAAuE;IACvE,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAClD;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,KAAK,IAAI,CAAC;IACnG,6EAA6E;IAC7E,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,kGAAkG;IAClG,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3D;;;;;;;;;;;OAWG;IACH,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;CACzD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAwEvE"}

package/dist/disconnect-cleanup.js

@@ -0,0 +1,72 @@
+export function wireDisconnectCleanup(deps) {
+    const { ipcServer, getConnState, countAttendanceFor, forgetConnection, announceAttendance, inboundSessionWaiters, getNotificationDispatcher, } = deps;
+    // MCP-001: Clean up per-connection state when a connection disconnects
+    // MCP-002: Also unregister from notification dispatcher
+    ipcServer.onDisconnect((connectionId) => {
+        /**
+         * DOD-M15-IPCVISIBLE-1: SAY THAT IT CLOSED, and say what it was attending.
+         *
+         * `daemon.ipc.connected` fired on every open and nothing on close, so a live client and a dead
+         * one that was never cleaned up looked identical in the log. The attended agent is the field
+         * that matters: attendance dropping was silent, and an agent losing its last attendee changes
+         * whether away-messages fire and who receives doorbells — so a session that stopped waking is
+         * diagnosable from the log rather than by guesswork.
+         */
+        const closing = getConnState(connectionId);
+        const stillAttending = closing?.currentAgent
+            ? countAttendanceFor(closing.currentAgent) - 1
+            : null;
+        // RETURNED, not logged here — `ipcServer` merges this into its single
+        // `daemon.ipc.disconnected` line. A second line under the same name left neither carrying the
+        // whole picture and doubled every count (review F8).
+        const disconnectContext = {
+            clientType: closing?.clientType ?? "unknown",
+            attendedAgent: closing?.currentAgent ?? null,
+            ...(stillAttending !== null ? { remainingAttendance: stillAttending } : {}),
+            ...(stillAttending === 0
+                ? {
+                    impact: "that agent has no attending session left — inbound sessions are now answered with " +
+                        "its away message rather than a live reply, and its doorbells reach nobody",
+                }
+                : {}),
+        };
+        // The three per-connection maps are released by the module that owns them; the reasons each
+        // must die with its connection live there, beside the containers.
+        forgetConnection(connectionId);
+        /**
+         * DOD-M15-AWAYSCOPE-1 — the counterparty is told, the moment the LAST attendee leaves.
+         *
+         * ⚠️ AFTER `forgetConnection`, and that ordering is the whole correctness of this line. The count
+         * above is computed as "minus one" precisely because this connection is still in the map; here
+         * it is gone, so `countAttendanceFor` reads the truth and a co-attended agent — legitimate and
+         * permanent — does not get reported as unattended because one of several clients closed.
+         *
+         * This is what the away reply used to do by sending a message into the conversation, which took
+         * a hash-chain leaf and cost a completed exchange its receipt. Saying it out of band costs
+         * nothing and is readable by the counterparty whenever they ask.
+         */
+        if (closing?.currentAgent && countAttendanceFor(closing.currentAgent) === 0) {
+            announceAttendance(closing.currentAgent, "unattended");
+        }
+        getNotificationDispatcher().unregisterConnection(connectionId);
+        // Seam 2 (review H2): evict any cello_await_session waiters owned by this connection.
+        // Otherwise enqueueInboundSession would hand the next inbound session to a closed
+        // connection's waiter and the event would be lost. deliver(null) clears the waiter's
+        // timer and resolves its (now-orphaned) promise as a timeout.
+        for (const [agentName, waiters] of inboundSessionWaiters) {
+            const survivors = [];
+            for (const w of waiters) {
+                if (w.connectionId === connectionId)
+                    w.deliver(null);
+                else
+                    survivors.push(w);
+            }
+            if (survivors.length > 0)
+                inboundSessionWaiters.set(agentName, survivors);
+            else
+                inboundSessionWaiters.delete(agentName);
+        }
+        return disconnectContext;
+    });
+}
+//# sourceMappingURL=disconnect-cleanup.js.map

package/dist/disconnect-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disconnect-cleanup.js","sourceRoot":"","sources":["../src/disconnect-cleanup.ts"],"names":[],"mappings":"AAgDA,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,EACJ,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EACjF,qBAAqB,EACrB,yBAAyB,GAC1B,GAAG,IAAI,CAAC;IAET,uEAAuE;IACvE,wDAAwD;IACxD,SAAS,CAAC,YAAY,CAAC,CAAC,YAAY,EAAE,EAAE;QACtC;;;;;;;;WAQG;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,OAAO,EAAE,YAAY;YAC1C,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QACT,sEAAsE;QACtE,8FAA8F;QAC9F,qDAAqD;QACrD,MAAM,iBAAiB,GAA4B;YACjD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,SAAS;YAC5C,aAAa,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI;YAC5C,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,cAAc,KAAK,CAAC;gBACtB,CAAC,CAAC;oBACE,MAAM,EACJ,oFAAoF;wBACpF,2EAA2E;iBAC9E;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,4FAA4F;QAC5F,kEAAkE;QAClE,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC/B;;;;;;;;;;;WAWG;QACH,IAAI,OAAO,EAAE,YAAY,IAAI,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACzD,CAAC;QACD,yBAAyB,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC/D,sFAAsF;QACtF,kFAAkF;QAClF,qFAAqF;QACrF,8DAA8D;QAC9D,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACzD,MAAM,SAAS,GAAmB,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY;oBAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;;oBAChD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;;gBACrE,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,iBAAiB,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/document-amendment-store.d.ts

@@ -0,0 +1,120 @@
+/**
+ * SYNC-P1 (daemon half) — the fork-tolerant entry store.
+ *
+ * One row per ENTRY (keyed by entry hash — never by an epoch slot), holding the entry AS
+ * RECEIVED — the wire bytes, never a re-encode. The bytes are the truth: `chain` decodes them on
+ * read, so what the fold consumes is exactly what was signed, and a codec asymmetry can never
+ * silently rewrite an agreed record (the class of defect TRACE-1 found in the proposal codec).
+ *
+ * The store owns persistence and ANCESTRY CLOSURE:
+ * - **Held until whole (R14)** — an entry lands in `document_entries` only when every parent has
+ *   landed. Otherwise it waits in `document_entries_pending`: recorded, never applied, never in a
+ *   watermark, promoted the moment its ancestry completes — cascade included. The invariant this
+ *   buys: everything in `document_entries` has its FULL ancestry there too.
+ * - **Fork tolerance** — two entries claiming the same epoch or the same author seq are BOTH
+ *   stored. Ruling on conflicts is the causal fold's job (`deriveDocumentState`), not the
+ *   store's; the old chain-gap and epoch-conflict refusals are gone WITH the epoch spine.
+ * - **Idempotent redelivery** — the same bytes again is `recorded: false`, not an error and not
+ *   a second row.
+ * - **Watermarks** — per author, the highest CONTIGUOUS seq with its head hash(es). Two heads at
+ *   one seq is an equivocation made visible for the exchange to resolve, never silently picked.
+ *
+ * What the store does NOT judge: signatures, policy, subject semantics. The fold rules on those
+ * at every consumption, and the inbound path rules BEFORE appending. A row in these tables is a
+ * claim to be folded, not an admitted fact.
+ */
+import { type DocumentAmendmentEnvelope } from "@cello-protocol/protocol-types";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+/**
+ * The PRE-PIVOT table, epoch-keyed. Still created because `DocumentStore` execs this too and the
+ * pre-pivot readers live until P4 deletes them (SYNC-D2); the entry store neither reads nor
+ * writes it. Rows predating the pivot stay untouched — old-shape bytes are not decodable by the
+ * v2 codec and are not migrated (no compatibility owed; essentially no documents exist).
+ */
+/**
+ * Shared with `DocumentStore` (the :352 shared-definition precedent): its membership walk and
+ * epoch read consume `document_entries`, so the tables must exist whichever module constructs
+ * first. Keep both consumers on THIS string.
+ */
+/**
+ * D7 — the epoch spine is deleted. A database born before that carries a NOT NULL `epoch_id`
+ * with no default, which would refuse every insert from this build. Dropped in place (SQLite
+ * ≥3.35 / SQLCipher 4.5); a fresh database never has it.
+ */
+type ColumnDropper = {
+    exec(sql: string): void;
+    prepare(sql: string): {
+        all(...a: unknown[]): unknown[];
+    };
+};
+/**
+ * Drop columns a previous milestone left behind, birth-gated: only what the table actually still
+ * has is touched, so this is safe on a database created yesterday and on one created before the
+ * column existed. Dead schema is not free — it is the design a future author reads and rebuilds.
+ */
+export declare function dropLegacyColumns(db: ColumnDropper, table: string, columns: readonly string[]): void;
+export declare function dropLegacyEpochColumn(db: ColumnDropper, table: string): void;
+export declare const DOCUMENT_ENTRIES_CREATE_SQL = "\n  CREATE TABLE IF NOT EXISTS document_entries (\n    owner_agent_id  TEXT    NOT NULL,\n    document_id     TEXT    NOT NULL,\n    entry_hash      TEXT    NOT NULL,\n    author_agent_id TEXT    NOT NULL,\n    author_seq      INTEGER NOT NULL,\n    received_bytes  BLOB    NOT NULL,\n    recorded_at     INTEGER NOT NULL,\n    PRIMARY KEY (owner_agent_id, document_id, entry_hash)\n  );\n  CREATE INDEX IF NOT EXISTS idx_document_entries_author\n    ON document_entries (owner_agent_id, document_id, author_agent_id, author_seq);\n  CREATE TABLE IF NOT EXISTS document_entries_pending (\n    owner_agent_id  TEXT    NOT NULL,\n    document_id     TEXT    NOT NULL,\n    entry_hash      TEXT    NOT NULL,\n    author_agent_id TEXT    NOT NULL,\n    received_bytes  BLOB    NOT NULL,\n    recorded_at     INTEGER NOT NULL,\n    PRIMARY KEY (owner_agent_id, document_id, entry_hash)\n  );\n";
+export interface AmendmentAppendResult {
+    /** False on an idempotent redelivery — the entry (or its pending row) already existed. */
+    recorded: boolean;
+    /** True when the entry is waiting on missing parents (R14) — recorded but not yet applied. */
+    held: boolean;
+    /** Hex of the entry's TBS hash. */
+    entryHash: string;
+    /** Previously-held entries this arrival completed, now applied — envelopes included, so the
+     *  caller can run the same post-apply surfacing it runs for a direct arrival (review F2: the
+     *  held path silently dropped removal notices and lifecycle completion). */
+    promoted: PromotedEntry[];
+}
+export interface PromotedEntry {
+    entryHash: string;
+    envelope: DocumentAmendmentEnvelope;
+}
+export interface PendingEntry {
+    entryHash: string;
+    /** The parents not yet held — the exchange asks for exactly these. */
+    missingParents: string[];
+    recordedAtMs: number;
+}
+/**
+ * Ceiling on HELD entries per (document, author). An honest author's pending set is a short gap
+ * awaiting one delivery; a hostile known author fabricating parents could otherwise grow the
+ * pending table without bound (review F4).
+ */
+export declare const MAX_PENDING_PER_AUTHOR = 64;
+export interface AuthorWatermark {
+    /** Highest CONTIGUOUS seq held from this author. */
+    seq: number;
+    /** Entry hash(es) at that seq — more than one is an equivocation, visible by design. */
+    headHashes: string[];
+}
+export declare class DocumentAmendmentStore {
+    #private;
+    constructor(db: DaemonDatabase, logger: Logger);
+    /**
+     * Append one entry from its wire bytes. Decodes first — malformed bytes refuse with the
+     * decoder's named reason and nothing is stored. An entry with missing parents is HELD; an
+     * arrival that completes held ancestry promotes the whole cascade.
+     */
+    append(ownerAgentId: string, documentId: string, receivedBytes: Uint8Array, nowMs: number): AmendmentAppendResult;
+    /** Every applied entry, decoded from the stored received bytes. The set is ancestry-closed. */
+    chain(ownerAgentId: string, documentId: string): DocumentAmendmentEnvelope[];
+    /** Held entries and exactly which parents they still wait on (R37's receiver-side record). */
+    pending(ownerAgentId: string, documentId: string): PendingEntry[];
+    /**
+     * This author's applied entries with seq strictly beyond `afterSeq`, as WIRE BYTES in seq
+     * order — what a reconcile reply carries to a peer whose watermark for this author is behind
+     * ours (R10 step 2/3). Forked seqs both ship: the peer's fold rules on them like ours did.
+     */
+    entriesByAuthorAfter(ownerAgentId: string, documentId: string, authorAgentId: string, afterSeq: number): Uint8Array[];
+    /**
+     * Per-author position: the highest CONTIGUOUS seq held and the head hash(es) at it. A held
+     * (pending) entry is not counted — a gap ends the walk (R13: report contiguous, never highest
+     * received).
+     */
+    watermarks(ownerAgentId: string, documentId: string): Map<string, AuthorWatermark>;
+}
+export {};
+//# sourceMappingURL=document-amendment-store.d.ts.map

package/dist/document-amendment-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-amendment-store.d.ts","sourceRoot":"","sources":["../src/document-amendment-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;GAKG;AACH;;;;GAIG;AACH;;;;GAIG;AACH,KAAK,aAAa,GAAG;IAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAOpG;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5E;AAED,eAAO,MAAM,2BAA2B,63BAsBvC,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,QAAQ,EAAE,OAAO,CAAC;IAClB,8FAA8F;IAC9F,IAAI,EAAE,OAAO,CAAC;IACd,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB;;gFAE4E;IAC5E,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,yBAAyB,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,qBAAa,sBAAsB;;gBAIrB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAW9C;;;;OAIG;IACH,MAAM,CACJ,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,UAAU,EACzB,KAAK,EAAE,MAAM,GACZ,qBAAqB;IA0DxB,+FAA+F;IAC/F,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,yBAAyB,EAAE;IAW5E,8FAA8F;IAC9F,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,EAAE;IAwBjE;;;;OAIG;IACH,oBAAoB,CAClB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,UAAU,EAAE;IAaf;;;;OAIG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;CAqInF"}

package/dist/document-amendment-store.js

@@ -0,0 +1,266 @@
+/**
+ * SYNC-P1 (daemon half) — the fork-tolerant entry store.
+ *
+ * One row per ENTRY (keyed by entry hash — never by an epoch slot), holding the entry AS
+ * RECEIVED — the wire bytes, never a re-encode. The bytes are the truth: `chain` decodes them on
+ * read, so what the fold consumes is exactly what was signed, and a codec asymmetry can never
+ * silently rewrite an agreed record (the class of defect TRACE-1 found in the proposal codec).
+ *
+ * The store owns persistence and ANCESTRY CLOSURE:
+ * - **Held until whole (R14)** — an entry lands in `document_entries` only when every parent has
+ *   landed. Otherwise it waits in `document_entries_pending`: recorded, never applied, never in a
+ *   watermark, promoted the moment its ancestry completes — cascade included. The invariant this
+ *   buys: everything in `document_entries` has its FULL ancestry there too.
+ * - **Fork tolerance** — two entries claiming the same epoch or the same author seq are BOTH
+ *   stored. Ruling on conflicts is the causal fold's job (`deriveDocumentState`), not the
+ *   store's; the old chain-gap and epoch-conflict refusals are gone WITH the epoch spine.
+ * - **Idempotent redelivery** — the same bytes again is `recorded: false`, not an error and not
+ *   a second row.
+ * - **Watermarks** — per author, the highest CONTIGUOUS seq with its head hash(es). Two heads at
+ *   one seq is an equivocation made visible for the exchange to resolve, never silently picked.
+ *
+ * What the store does NOT judge: signatures, policy, subject semantics. The fold rules on those
+ * at every consumption, and the inbound path rules BEFORE appending. A row in these tables is a
+ * claim to be folded, not an admitted fact.
+ */
+import { decodeDocumentAmendment, documentAmendmentHash, } from "@cello-protocol/protocol-types";
+/**
+ * Drop columns a previous milestone left behind, birth-gated: only what the table actually still
+ * has is touched, so this is safe on a database created yesterday and on one created before the
+ * column existed. Dead schema is not free — it is the design a future author reads and rebuilds.
+ */
+export function dropLegacyColumns(db, table, columns) {
+    const held = new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name));
+    for (const column of columns) {
+        if (held.has(column))
+            db.exec(`ALTER TABLE ${table} DROP COLUMN ${column}`);
+    }
+}
+export function dropLegacyEpochColumn(db, table) {
+    dropLegacyColumns(db, table, ["epoch_id"]);
+}
+export const DOCUMENT_ENTRIES_CREATE_SQL = `
+  CREATE TABLE IF NOT EXISTS document_entries (
+    owner_agent_id  TEXT    NOT NULL,
+    document_id     TEXT    NOT NULL,
+    entry_hash      TEXT    NOT NULL,
+    author_agent_id TEXT    NOT NULL,
+    author_seq      INTEGER NOT NULL,
+    received_bytes  BLOB    NOT NULL,
+    recorded_at     INTEGER NOT NULL,
+    PRIMARY KEY (owner_agent_id, document_id, entry_hash)
+  );
+  CREATE INDEX IF NOT EXISTS idx_document_entries_author
+    ON document_entries (owner_agent_id, document_id, author_agent_id, author_seq);
+  CREATE TABLE IF NOT EXISTS document_entries_pending (
+    owner_agent_id  TEXT    NOT NULL,
+    document_id     TEXT    NOT NULL,
+    entry_hash      TEXT    NOT NULL,
+    author_agent_id TEXT    NOT NULL,
+    received_bytes  BLOB    NOT NULL,
+    recorded_at     INTEGER NOT NULL,
+    PRIMARY KEY (owner_agent_id, document_id, entry_hash)
+  );
+`;
+/**
+ * Ceiling on HELD entries per (document, author). An honest author's pending set is a short gap
+ * awaiting one delivery; a hostile known author fabricating parents could otherwise grow the
+ * pending table without bound (review F4).
+ */
+export const MAX_PENDING_PER_AUTHOR = 64;
+export class DocumentAmendmentStore {
+    #db;
+    #logger;
+    constructor(db, logger) {
+        this.#db = db;
+        this.#logger = logger;
+        // D7/D9 residue sweep (review F5/F6): the epoch-keyed legacy table and the withdrawals
+        // table have no reader or writer left — never born on a fresh database, dropped in place
+        // on one that predates the pivot.
+        this.#db.exec(`DROP TABLE IF EXISTS document_amendments`);
+        this.#db.exec(DOCUMENT_ENTRIES_CREATE_SQL);
+        dropLegacyEpochColumn(this.#db, "document_entries");
+    }
+    /**
+     * Append one entry from its wire bytes. Decodes first — malformed bytes refuse with the
+     * decoder's named reason and nothing is stored. An entry with missing parents is HELD; an
+     * arrival that completes held ancestry promotes the whole cascade.
+     */
+    append(ownerAgentId, documentId, receivedBytes, nowMs) {
+        const env = decodeDocumentAmendment(receivedBytes);
+        if (env.body.document_id !== documentId) {
+            throw new Error(`document_amendment_wrong_document: the bytes name ${env.body.document_id}, appending ` +
+                `under ${documentId}`);
+        }
+        const hash = Buffer.from(documentAmendmentHash(env.body)).toString("hex");
+        if (this.#hasEntry(ownerAgentId, documentId, hash)) {
+            return { recorded: false, held: false, entryHash: hash, promoted: [] };
+        }
+        if (this.#hasPending(ownerAgentId, documentId, hash)) {
+            return { recorded: false, held: true, entryHash: hash, promoted: [] };
+        }
+        const missing = env.body.parents.filter((p) => !this.#hasEntry(ownerAgentId, documentId, p));
+        if (missing.length > 0) {
+            const author = env.body.author_agent_id;
+            const backlog = this.#db
+                .prepare(`SELECT COUNT(*) AS n FROM document_entries_pending
+            WHERE owner_agent_id = ? AND document_id = ? AND author_agent_id = ?`)
+                .get(ownerAgentId, documentId, author);
+            if (backlog.n >= MAX_PENDING_PER_AUTHOR) {
+                throw new Error(`document_pending_cap: ${author} already has ${backlog.n} entries held awaiting ` +
+                    `parents — the ceiling is ${MAX_PENDING_PER_AUTHOR}, and an honest gap is never ` +
+                    `this deep; deliver the missing ancestry first`);
+            }
+            this.#db
+                .prepare(`INSERT INTO document_entries_pending
+             (owner_agent_id, document_id, entry_hash, author_agent_id, received_bytes, recorded_at)
+           VALUES (?, ?, ?, ?, ?, ?)`)
+                .run(ownerAgentId, documentId, hash, author, Buffer.from(receivedBytes), nowMs);
+            this.#logger.info("document.entry.held", {
+                documentId,
+                entryHash: hash,
+                author: env.body.author_agent_id,
+                authorSeq: env.body.author_seq,
+                kind: env.body.kind,
+                missingParents: missing,
+            });
+            return { recorded: true, held: true, entryHash: hash, promoted: [] };
+        }
+        this.#insertEntry(ownerAgentId, documentId, hash, env, receivedBytes, nowMs);
+        const promoted = this.#promoteReady(ownerAgentId, documentId, nowMs);
+        return { recorded: true, held: false, entryHash: hash, promoted };
+    }
+    /** Every applied entry, decoded from the stored received bytes. The set is ancestry-closed. */
+    chain(ownerAgentId, documentId) {
+        const rows = this.#db
+            .prepare(`SELECT received_bytes FROM document_entries
+          WHERE owner_agent_id = ? AND document_id = ?
+          ORDER BY author_seq ASC, entry_hash ASC`)
+            .all(ownerAgentId, documentId);
+        return rows.map((r) => decodeDocumentAmendment(new Uint8Array(r.received_bytes)));
+    }
+    /** Held entries and exactly which parents they still wait on (R37's receiver-side record). */
+    pending(ownerAgentId, documentId) {
+        const rows = this.#db
+            .prepare(`SELECT entry_hash, received_bytes, recorded_at FROM document_entries_pending
+          WHERE owner_agent_id = ? AND document_id = ?
+          ORDER BY recorded_at ASC, entry_hash ASC`)
+            .all(ownerAgentId, documentId);
+        return rows.map((r) => {
+            const env = decodeDocumentAmendment(new Uint8Array(r.received_bytes));
+            return {
+                entryHash: r.entry_hash,
+                missingParents: env.body.parents.filter((p) => !this.#hasEntry(ownerAgentId, documentId, p)),
+                recordedAtMs: r.recorded_at,
+            };
+        });
+    }
+    /**
+     * This author's applied entries with seq strictly beyond `afterSeq`, as WIRE BYTES in seq
+     * order — what a reconcile reply carries to a peer whose watermark for this author is behind
+     * ours (R10 step 2/3). Forked seqs both ship: the peer's fold rules on them like ours did.
+     */
+    entriesByAuthorAfter(ownerAgentId, documentId, authorAgentId, afterSeq) {
+        const rows = this.#db
+            .prepare(`SELECT received_bytes FROM document_entries
+          WHERE owner_agent_id = ? AND document_id = ? AND author_agent_id = ? AND author_seq > ?
+          ORDER BY author_seq ASC, entry_hash ASC`)
+            .all(ownerAgentId, documentId, authorAgentId, afterSeq);
+        return rows.map((r) => new Uint8Array(r.received_bytes));
+    }
+    /**
+     * Per-author position: the highest CONTIGUOUS seq held and the head hash(es) at it. A held
+     * (pending) entry is not counted — a gap ends the walk (R13: report contiguous, never highest
+     * received).
+     */
+    watermarks(ownerAgentId, documentId) {
+        const rows = this.#db
+            .prepare(`SELECT author_agent_id, author_seq, entry_hash FROM document_entries
+          WHERE owner_agent_id = ? AND document_id = ?
+          ORDER BY author_agent_id ASC, author_seq ASC, entry_hash ASC`)
+            .all(ownerAgentId, documentId);
+        const byAuthor = new Map();
+        for (const r of rows) {
+            let seqs = byAuthor.get(r.author_agent_id);
+            if (!seqs) {
+                seqs = new Map();
+                byAuthor.set(r.author_agent_id, seqs);
+            }
+            const at = seqs.get(r.author_seq);
+            if (at)
+                at.push(r.entry_hash);
+            else
+                seqs.set(r.author_seq, [r.entry_hash]);
+        }
+        const out = new Map();
+        for (const [author, seqs] of byAuthor) {
+            let seq = 0;
+            while (seqs.has(seq + 1))
+                seq++;
+            if (seq === 0)
+                continue;
+            out.set(author, { seq, headHashes: seqs.get(seq) });
+        }
+        return out;
+    }
+    #hasEntry(ownerAgentId, documentId, hash) {
+        return (this.#db
+            .prepare(`SELECT 1 FROM document_entries
+            WHERE owner_agent_id = ? AND document_id = ? AND entry_hash = ?`)
+            .get(ownerAgentId, documentId, hash) !== undefined);
+    }
+    #hasPending(ownerAgentId, documentId, hash) {
+        return (this.#db
+            .prepare(`SELECT 1 FROM document_entries_pending
+            WHERE owner_agent_id = ? AND document_id = ? AND entry_hash = ?`)
+            .get(ownerAgentId, documentId, hash) !== undefined);
+    }
+    #insertEntry(ownerAgentId, documentId, hash, env, bytes, nowMs) {
+        this.#db
+            .prepare(`INSERT INTO document_entries
+           (owner_agent_id, document_id, entry_hash, author_agent_id, author_seq,
+            received_bytes, recorded_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(ownerAgentId, documentId, hash, env.body.author_agent_id, env.body.author_seq, 
+        // Copied — the caller may reuse or zero its buffer after we return.
+        Buffer.from(bytes), nowMs);
+        this.#logger.info("document.entry.recorded", {
+            documentId,
+            entryHash: hash,
+            author: env.body.author_agent_id,
+            authorSeq: env.body.author_seq,
+            kind: env.body.kind,
+        });
+    }
+    /** Move every pending entry whose ancestry is now complete — repeated until a pass moves none. */
+    #promoteReady(ownerAgentId, documentId, nowMs) {
+        const promoted = [];
+        for (;;) {
+            const rows = this.#db
+                .prepare(`SELECT entry_hash, received_bytes FROM document_entries_pending
+            WHERE owner_agent_id = ? AND document_id = ?`)
+                .all(ownerAgentId, documentId);
+            let movedThisPass = false;
+            for (const row of rows) {
+                const env = decodeDocumentAmendment(new Uint8Array(row.received_bytes));
+                const ready = env.body.parents.every((p) => this.#hasEntry(ownerAgentId, documentId, p));
+                if (!ready)
+                    continue;
+                this.#insertEntry(ownerAgentId, documentId, row.entry_hash, env, new Uint8Array(row.received_bytes), nowMs);
+                this.#db
+                    .prepare(`DELETE FROM document_entries_pending
+              WHERE owner_agent_id = ? AND document_id = ? AND entry_hash = ?`)
+                    .run(ownerAgentId, documentId, row.entry_hash);
+                this.#logger.info("document.entry.promoted", {
+                    documentId,
+                    entryHash: row.entry_hash,
+                });
+                promoted.push({ entryHash: row.entry_hash, envelope: env });
+                movedThisPass = true;
+            }
+            if (!movedThisPass)
+                return promoted;
+        }
+    }
+}
+//# sourceMappingURL=document-amendment-store.js.map