@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/held-content.js

@@ -0,0 +1,389 @@
+import { extractErrorMessage } from "./error-message.js";
+export class HeldContent {
+    #ctx;
+    constructor(ctx) {
+        this.#ctx = ctx;
+    }
+    /** A getter so the moved queries still read `this.#db` and narrow exactly as they did. */
+    get #db() {
+        return this.#ctx.db();
+    }
+    #heldRestored = new Set();
+    #heldReleased = new Set();
+    /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
+     *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
+     *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
+     *  exceeding it once #releaseHeld drains them. */
+    getHeldBytesTotal(agentName, sessionId) {
+        // DOD-M12B-STRAND-1: hydrate first. Reading the Map before the durable holds are back
+        // under-counts, and this gate exists to stop several held chunks each passing the size cap
+        // individually while cumulatively exceeding it — an under-count is the bypass.
+        this.ensureHeldRestored(agentName, sessionId);
+        const held = this.#ctx.heldContent.get(this.#ctx.sessionKey(agentName, sessionId));
+        if (!held)
+            return 0;
+        let total = 0;
+        for (const entry of held.values())
+            total += entry.content.length;
+        return total;
+    }
+    /**
+     * DOD-M12B-STRAND-1 — restore this session's held frames into memory.
+     *
+     * Called when a session node is (re)created, which is the moment the session becomes able to
+     * append again. Loading at daemon boot instead would be wrong for the same reason the old code
+     * was wrong: a frame is only releasable against a tree, and the tree is loaded per session.
+     *
+     * A frame whose content the tree ALREADY HOLDS at that position is dropped — re-appending it
+     * would change the root a seal signs over. That test is `hashAt`, not `canonical_seq < frontier`:
+     * the two counters are different spaces and this file documents them drifting, so the index
+     * comparison alone would destroy a frame the tree never held. See the drift branch below.
+     */
+    ensureHeldRestored(agentName, sessionId, opts) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        if (!this.#heldRestored.has(key)) {
+            // Set BEFORE restoring, so the #ensureHeldRestored inside #releaseHeld below returns straight
+            // away instead of recursing.
+            this.#heldRestored.add(key);
+            this.restoreHeldContent(agentName, sessionId);
+        }
+        // A RESTORED FRAME MAY ALREADY BE IN ORDER, and nothing else would ever notice.
+        //
+        // #releaseHeld has one caller: the tail of a successful inbound ingest. Every other way the tree
+        // grows — an outbound send leaf, a queued or rejected leaf — advances the frontier without
+        // draining. While holds died with the session node that cost seconds; now the hold is durable,
+        // so the stall is durable too: the counterparty's message sits on disk at exactly the next slot,
+        // is never delivered, and `sealReadiness` counts it, so the session cannot close either.
+        // Undeliverable AND unsealable, forever, from one restart.
+        //
+        // TRACKED SEPARATELY FROM THE HYDRATION. A read-only caller (the status surface) hydrates and
+        // must NOT release — otherwise `cello status` appends leaves, advances the session root, writes
+        // transcript rows and rings the doorbell, which makes a diagnostic command the thing that
+        // delivers messages. One shared flag would also let that read CONSUME the release the next real
+        // ingest was going to perform, which is the stall above, reintroduced.
+        if (opts?.release === false)
+            return;
+        if (this.#heldReleased.has(key))
+            return;
+        this.#heldReleased.add(key);
+        if (this.#ctx.heldContent.get(key)?.size) {
+            const counterparty = this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
+            if (counterparty)
+                this.releaseHeld(agentName, sessionId, counterparty);
+        }
+    }
+    restoreHeldContent(agentName, sessionId) {
+        if (!this.#db)
+            return;
+        let rows;
+        try {
+            rows = this.#db.prepare(`SELECT canonical_seq, content_blob, original_blob, content_hash_hex, screened_out, correlation_id, origin, leaf_kind
+           FROM held_content WHERE agent_id = ? AND session_id = ? ORDER BY canonical_seq ASC`).all(this.#ctx.requireAgentId(agentName), sessionId);
+        }
+        catch (err) {
+            this.#ctx.logger.error("session.content.held.restore.failed", {
+                agentName, sessionId,
+                impact: "verified content held before the restart is not in memory and cannot be released",
+                error: extractErrorMessage(err),
+            });
+            return;
+        }
+        if (rows.length === 0)
+            return;
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        let held = this.#ctx.heldContent.get(key);
+        if (!held) {
+            held = new Map();
+            this.#ctx.heldContent.set(key, held);
+        }
+        const tree = this.#ctx.getSessionTree(agentName, sessionId);
+        const frontier = tree.size();
+        let restored = 0;
+        let superseded = 0;
+        let drifted = 0;
+        for (const row of rows) {
+            // ASK THE TREE WHAT IS AT THAT POSITION — do not infer it from the index.
+            //
+            // `canonical_seq` is the RELAY's sequence space; `frontier` is this tree's msg-leaf count.
+            // The two drift, on purpose and by documented cases: the relay counts CTRL leaves the tree
+            // never appends, and a first message whose relay submit failed leaves the tree one ahead.
+            // Under drift `canonical_seq < frontier` is TRUE for a frame the tree has never held, and
+            // deleting on that comparison destroys verified content while reporting it as tidy-up —
+            // the exact failure this unit exists to end, reintroduced on the recovery path.
+            const occupant = tree.hashAt(row.canonical_seq);
+            if (occupant === row.content_hash_hex) {
+                this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
+                superseded++;
+                continue;
+            }
+            if (row.canonical_seq < frontier) {
+                // The position is taken by DIFFERENT content. The frame cannot be appended (that would
+                // rewrite a committed leaf) and must not be deleted (it is verified content nobody else
+                // holds), so it goes to the annex that exists for exactly this — content that arrived for
+                // a chain that can no longer carry it — and only then does the row go.
+                const annexed = this.#ctx.queries.recordSealedAnnex(agentName, sessionId, row.content_hash_hex, new Uint8Array(row.content_blob), 
+                // DOD-M12B-INDEX-1: our own held send is attributed to US, never to the counterparty.
+                row.origin === "sent"
+                    ? this.#ctx.queries.ownPubkeyHex(agentName)
+                    : this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey ?? null);
+                this.#ctx.logger.error("session.content.held.position_drifted", {
+                    agentName, sessionId, canonicalSeq: row.canonical_seq, frontier,
+                    contentHash: row.content_hash_hex, occupant, annexed,
+                    correlationId: row.correlation_id ?? undefined,
+                    impact: annexed
+                        ? "the relay's position for this frame is occupied by different content — it cannot join the chain and is readable only from the annex"
+                        : "the relay's position for this frame is occupied by different content AND the annex write failed — the durable row is kept rather than destroyed",
+                });
+                if (annexed)
+                    this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
+                drifted++;
+                continue;
+            }
+            held.set(row.canonical_seq, {
+                content: new Uint8Array(row.content_blob),
+                ...(row.original_blob ? { originalContent: new Uint8Array(row.original_blob) } : {}),
+                contentHashHex: row.content_hash_hex,
+                ...(row.correlation_id ? { correlationId: row.correlation_id } : {}),
+                ...(row.screened_out ? { screenedOut: true } : {}),
+                ...(row.origin === "sent" ? { origin: "sent" } : {}),
+                ...(row.leaf_kind === "doc" ? { kind: "doc" } : {}),
+                /**
+                 * ⚠️ `restoredAcrossRestart` EXISTS TO NAME A LOSS, NOT TO CHANGE BEHAVIOUR — review pass 2, H1.
+                 *
+                 * `held_content` has no authorship columns, so a SENT message held behind a gap and released
+                 * after a daemon restart comes back with **no signature** — its transcript row records
+                 * `self_authored` with no proof, indistinguishable from an unwitnessed send. That is the
+                 * defect bullet 5 exists to end, reappearing on the recovery path, and it was silent.
+                 *
+                 * The proof cannot be reconstructed here: it was made over Structure-1 bytes this process no
+                 * longer holds. **So the honest move is to say so, not to fabricate one** — a proof that
+                 * cannot be checked, presented as one that can, is worse than the absence.
+                 *
+                 * Two BLOB columns would close it properly (this table already carries two `ALTER TABLE …
+                 * ADD COLUMN` migrations, so the pattern exists). Under a frozen gate a log is additive and
+                 * tightenable where a schema change is neither, so this announces the loss now and
+                 * `DOD-M15-HELD-AUTHORSHIP-1` carries the column.
+                 */
+                restoredAcrossRestart: true,
+            });
+            restored++;
+        }
+        if (held.size === 0)
+            this.#ctx.heldContent.delete(key);
+        this.#ctx.logger.info("session.content.held.restored", {
+            agentName, sessionId, restored, superseded, drifted, frontier,
+            canonicalSeqs: [...held.keys()].sort((a, b) => a - b),
+            // The flow ids of the frames that came back, so a restored message ties to the
+            // `session.content.held` that opened its flow before the restart.
+            correlationIds: rows.map((r) => r.correlation_id).filter((c) => c !== null),
+        });
+    }
+    /**
+     * DOD-MSG-4: drain held out-of-order content in canonical order. After a leaf is appended, any
+     * held entry whose canonical sequence equals the new next-expected index is now in order — append
+     * it, then check again (a single fill can release a run of consecutive held messages).
+     */
+    releaseHeld(agentName, sessionId, senderPubkey) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        // DOD-M12B-STRAND-1: hydrate before scanning. Restoring eagerly at session-node creation put
+        // it behind writes that can fail — one failed `sessions` row upsert and the frames stayed on
+        // disk, invisible, which is the same outcome as losing them.
+        this.ensureHeldRestored(agentName, sessionId);
+        const held = this.#ctx.heldContent.get(key);
+        if (!held)
+            return 0;
+        let released = 0;
+        for (;;) {
+            const nextExpected = this.#ctx.getSessionTree(agentName, sessionId).size();
+            const entry = held.get(nextExpected);
+            if (!entry)
+                break;
+            held.delete(nextExpected);
+            // DOD-M12B-STRAND-1: released content leaves the durable store in the same breath. A row
+            // that outlives its release would re-append the same content on the next boot — growing the
+            // tree and changing a root that has already been signed.
+            this.#ctx.queries.deleteHeldContent(agentName, sessionId, nextExpected);
+            // DOD-M12B-INDEX-1: OUR OWN held message. It leafs at its canonical index and is transcribed
+            // as SENT — never routed down the received path, which would attribute our words to the
+            // counterparty in the sealed record and hand them back to our own agent as inbound.
+            if (entry.origin === "sent") {
+                // The KIND the leaf was placed with, not a hardcoded "msg" — a document leaf that had to
+                // wait for its position must come back as a document leaf, or the two sides disagree about
+                // what the chain contains.
+                this.#ctx.appendSessionLeaf(agentName, sessionId, entry.kind ?? "msg", entry.contentHashHex, entry.correlationId);
+                // A DOCUMENT frame takes a leaf and NO transcript row — matching what the immediate-append
+                // path does for one. Writing one would put raw CBOR into the operator's transcript as
+                // something they said, which is the same attribution failure as releasing it inbound.
+                if (entry.kind === "doc") {
+                    released++;
+                    this.#ctx.logger.info("session.content.released", {
+                        sessionId, sequenceNumber: nextExpected, leafKind: "doc", correlationId: entry.correlationId,
+                    });
+                    if (held.size === 0) {
+                        this.#ctx.heldContent.delete(key);
+                        break;
+                    }
+                    continue;
+                }
+                // OBSERVED, not assumed — the received path already does this. The leaf commits either way,
+                // so a dropped transcript write means the operator's OWN message is missing from their own
+                // transcript with the chain saying it is there, and nothing anywhere said so.
+                // bullet 5: the proof was captured at submit time and rides the held entry — see #heldContent.
+                /**
+                 * THE RESTART LOSS, ANNOUNCED — review pass 2, H1. Only for an entry that actually crossed a
+                 * restart: an in-memory held entry carries its proof, and an unwitnessed send legitimately
+                 * has none, so warning on every absent proof would fire on a designed benign state and bury
+                 * the one occurrence that means something.
+                 */
+                if (entry.restoredAcrossRestart === true && entry.authorship === undefined) {
+                    this.#ctx.logger.warn("session.content.released.authorship.lost", {
+                        agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
+                        impact: "this message was held behind a gap, survived a daemon restart, and is now committed with " +
+                            "attribution 'self_authored' and NO signature. Its transcript row asserts its author rather " +
+                            "than proving one, and is indistinguishable from a send the relay never witnessed.",
+                        guidance: "Not recoverable after the fact — the signature covered Structure-1 bytes this process no longer " +
+                            "holds, and fabricating one would be worse than the absence. Tracked as DOD-M15-HELD-AUTHORSHIP-1: " +
+                            "held_content needs the two proof columns so a restart carries them.",
+                    });
+                }
+                if (!this.#ctx.records.recordTranscriptMessage(agentName, sessionId, nextExpected, "sent", entry.content, entry.correlationId, entry.authorship)) {
+                    this.#ctx.logger.error("session.content.released.transcript.failed", {
+                        agentName, sessionId, sequenceNumber: nextExpected, correlationId: entry.correlationId,
+                        impact: "this side's own message is committed to the chain but missing from its transcript",
+                    });
+                }
+            }
+            else if (entry.screenedOut) {
+                this.#ctx.appendSessionLeaf(agentName, sessionId, "msg", entry.contentHashHex, entry.correlationId);
+                // The SAME witness leak as the immediate-append terminal-block branch (see the block comment
+                // at the `if (terminalBlock)` append in `ingestReceivedContent`), on the held path. This
+                // branch also bypasses `#appendVerifiedContent`, where the drop lives — so a blocked message
+                // that arrived out of order left `missingLeaves` stuck at 1 and the session unsealable.
+                this.#ctx.witnessedSeq.get(key)?.delete(entry.contentHashHex);
+            }
+            else {
+                this.#ctx.appendVerifiedContent(agentName, sessionId, entry.content, entry.contentHashHex, senderPubkey, entry.correlationId, entry.originalContent);
+            }
+            released++;
+            this.#ctx.logger.info("session.content.released", {
+                sessionId,
+                sequenceNumber: nextExpected,
+                screenedOut: entry.screenedOut === true,
+                correlationId: entry.correlationId,
+            });
+            if (held.size === 0) {
+                this.#ctx.heldContent.delete(key);
+                break;
+            }
+        }
+        return released;
+    }
+    /**
+     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
+     *
+     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
+     * exists on this side and is not in the tree, while the counterparty already has it from the relay
+     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
+     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
+     * it.
+     */
+    holdOwnLeafForTest(agentName, sessionId, canonicalSeq, contentHashHex) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        let held = this.#ctx.heldContent.get(key);
+        if (!held) {
+            held = new Map();
+            this.#ctx.heldContent.set(key, held);
+        }
+        held.set(canonicalSeq, { content: new Uint8Array(), contentHashHex, origin: "sent", kind: "msg" });
+    }
+    /**
+     * ⚠️ **ORPHANED COMMENT, OWNER UNKNOWN — do not attach it to the method below.** It reads
+     * *"@returns true iff the UPDATE was executed without error (a failed write is logged, never
+     * thrown)"*, and `annexHeldContentOnTerminal` returns `void` and runs no such UPDATE. It was
+     * already stranded in `session-node-manager.ts` before 037 moved this code, and Rule C carried it
+     * verbatim rather than dropping a sentence that is true of SOMETHING.
+     *
+     * Kept, marked, and NOT reattached: the nearest candidate by behaviour is
+     * `SessionQueries.markCounterpartyAbandoned`, which already has its own doc — so attaching it
+     * there on a guess is the same defect this marker exists to stop. Delete it only once its owner is
+     * identified, or reattach it then.
+     */
+    /**
+     * DOD-M12B-STRAND-1 — move a terminal session's held frames to the annex.
+     *
+     * A held frame is content this agent RECEIVED and VERIFIED. When its session ends it can never
+     * join that chain (appending behind a committed root is not an option, and ingest refuses a
+     * terminal session outright), but it is still the operator's mail and no other copy exists —
+     * the sender was never acknowledged for it. `sealed_session_annex` is where M12-P17 already puts
+     * content that arrives for an ended session; this is the same content arriving slightly earlier.
+     *
+     * ANNEX FIRST, DELETE SECOND, per row. A crash between them costs a duplicate the annex's
+     * INSERT OR IGNORE absorbs; the other order costs the message. A row whose annex write fails is
+     * KEPT — the retention sweep will find it again, and a leftover row is cheaper than a lost one.
+     */
+    annexHeldContentOnTerminal(agentName, sessionId, status) {
+        if (!this.#db)
+            return;
+        let rows;
+        try {
+            rows = this.#db.prepare(`SELECT canonical_seq, content_blob, content_hash_hex, held_at, origin
+           FROM held_content WHERE agent_id = ? AND session_id = ? ORDER BY canonical_seq ASC`).all(this.#ctx.requireAgentId(agentName), sessionId);
+        }
+        catch (err) {
+            this.#ctx.logger.error("session.content.held.annex.scan.failed", {
+                agentName, sessionId, status,
+                impact: "held frames for a terminal session were not moved to the annex and remain unreadable",
+                error: extractErrorMessage(err),
+            });
+            return;
+        }
+        if (rows.length === 0)
+            return;
+        const counterparty = this.#ctx.queries.getSessionRecord(agentName, sessionId)?.counterparty_pubkey ?? null;
+        let annexed = 0;
+        let kept = 0;
+        for (const row of rows) {
+            // DOD-M12B-INDEX-1: ATTRIBUTION. A `sent` row is our own message. Stamping the counterparty's
+            // pubkey on it would put our words in their mouth in the one record that survives the
+            // session — the same failure the release path was changed to avoid, on the drain it did not
+            // touch. `#ownPubkeyHex` is null only when the identity cannot be resolved, and a null sender
+            // reads as "unattributed", which is true, rather than as a false attribution.
+            const sender = row.origin === "sent" ? this.#ctx.queries.ownPubkeyHex(agentName) : counterparty;
+            if (this.#ctx.queries.recordSealedAnnex(agentName, sessionId, row.content_hash_hex, new Uint8Array(row.content_blob), sender)) {
+                this.#ctx.queries.deleteHeldContent(agentName, sessionId, row.canonical_seq);
+                // AND OUT OF THE IN-MEMORY MAP. Measured live 2026-08-17 on daemon 0.0.170: this frame is
+                // now safe in the annex and its durable row is gone — but teardown still found it in the
+                // map, counted `held_content` for the session, got 0, and fired
+                // `session.content.held.lost`: "verified content was destroyed". Ten frames were annexed
+                // and the same ten were reported destroyed, in the same second. A false alarm on the most
+                // serious event in the system is worse than no alarm, because the next investigation goes
+                // looking for content that was never lost.
+                this.#ctx.heldContent.get(this.#ctx.sessionKey(agentName, sessionId))?.delete(row.canonical_seq);
+                annexed++;
+            }
+            else {
+                kept++;
+            }
+        }
+        this.#ctx.logger.warn("session.content.held.annexed", {
+            agentName, sessionId, status, annexed, kept,
+            // The consumer of `held_at`: how long the oldest frame waited before its session ended.
+            oldestHeldMs: Date.now() - Math.min(...rows.map((r) => r.held_at)),
+            impact: "these messages arrived and verified but never joined the chain — they are readable from the annex, not the transcript",
+        });
+    }
+    /**
+     * Forget the restore/release bookkeeping for a torn-down session.
+     *
+     * The held CONTENT itself is not dropped here — the map is shared and the manager's eviction still
+     * owns that line. What goes is this module's memory of whether a session was already hydrated from
+     * disk and already released, which must not survive a teardown: a revived session has to re-read
+     * from durable state rather than trust a flag about a process that is gone.
+     */
+    evictSession(agentName, sessionId) {
+        const key = this.#ctx.sessionKey(agentName, sessionId);
+        this.#heldRestored.delete(key);
+        this.#heldReleased.delete(key);
+    }
+}
+//# sourceMappingURL=held-content.js.map

package/dist/held-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"held-content.js","sourceRoot":"","sources":["../src/held-content.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAoDzD,MAAM,OAAO,WAAW;IACb,IAAI,CAAqB;IAElC,YAAY,GAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,0FAA0F;IAC1F,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC;;;sDAGkD;IAClD,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;QACpD,sFAAsF;QACtF,2FAA2F;QAC3F,+EAA+E;QAC/E,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB,EAAE,IAA4B;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,8FAA8F;YAC9F,6BAA6B;YAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,gFAAgF;QAChF,EAAE;QACF,iGAAiG;QACjG,2FAA2F;QAC3F,+FAA+F;QAC/F,iGAAiG;QACjG,yFAAyF;QACzF,2DAA2D;QAC3D,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,0FAA0F;QAC1F,gGAAgG;QAChG,uEAAuE;QACvE,IAAI,IAAI,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO;QACpC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QACxC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,CAAC;YACnG,IAAI,YAAY;gBAAE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,SAAiB,EAAE,SAAiB;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,IAA4M,CAAC;QACjN,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CACrB;8FACsF,CACvF,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAU,CAAC;QACjE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBAC5D,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,kFAAkF;gBAC1F,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAChC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,0EAA0E;YAC1E,EAAE;YACF,2FAA2F;YAC3F,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,wFAAwF;YACxF,gFAAgF;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAChD,IAAI,QAAQ,KAAK,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC7E,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;gBACjC,uFAAuF;gBACvF,wFAAwF;gBACxF,0FAA0F;gBAC1F,uEAAuE;gBACvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CACjD,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBAC5E,sFAAsF;gBACtF,GAAG,CAAC,MAAM,KAAK,MAAM;oBACnB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;oBAC3C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,IAAI,IAAI,CAC1F,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBAC9D,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,QAAQ;oBAC/D,WAAW,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,OAAO;oBACpD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;oBAC9C,MAAM,EAAE,OAAO;wBACb,CAAC,CAAC,qIAAqI;wBACvI,CAAC,CAAC,iJAAiJ;iBACtJ,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC1F,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC1B,OAAO,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpF,cAAc,EAAE,GAAG,CAAC,gBAAgB;gBACpC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D;;;;;;;;;;;;;;;;mBAgBG;gBACH,qBAAqB,EAAE,IAAI;aAC5B,CAAC,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACrD,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;YAC7D,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,+EAA+E;YAC/E,kEAAkE;YAClE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SACzF,CAAC,CAAC;IACL,CAAC;IACD;;;;OAIG;IACH,WAAW,CAAC,SAAiB,EAAE,SAAiB,EAAE,YAAoB;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,6FAA6F;QAC7F,6FAA6F;QAC7F,6DAA6D;QAC7D,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,SAAS,CAAC;YACR,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1B,yFAAyF;YACzF,4FAA4F;YAC5F,yDAAyD;YACzD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACxE,6FAA6F;YAC7F,wFAAwF;YACxF,oFAAoF;YACpF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,yFAAyF;gBACzF,2FAA2F;gBAC3F,2BAA2B;gBAC3B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAClH,2FAA2F;gBAC3F,sFAAsF;gBACtF,sFAAsF;gBACtF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACzB,QAAQ,EAAE,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;wBAChD,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;qBAC7F,CAAC,CAAC;oBACH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAClE,SAAS;gBACX,CAAC;gBACD,4FAA4F;gBAC5F,2FAA2F;gBAC3F,8EAA8E;gBAC9E,+FAA+F;gBAC/F;;;;;mBAKG;gBACH,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;wBAChE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;wBACtF,MAAM,EACJ,2FAA2F;4BAC3F,6FAA6F;4BAC7F,mFAAmF;wBACrF,QAAQ,EACN,kGAAkG;4BAClG,oGAAoG;4BACpG,qEAAqE;qBACxE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjJ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;wBACnE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;wBACtF,MAAM,EAAE,mFAAmF;qBAC5F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBACpG,6FAA6F;gBAC7F,yFAAyF;gBACzF,6FAA6F;gBAC7F,wFAAwF;gBACxF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;YACvJ,CAAC;YACD,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBAChD,SAAS;gBACT,cAAc,EAAE,YAAY;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI;gBACvC,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACpE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD;;;;;;;;OAQG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB,EAAE,YAAoB,EAAE,cAAsB;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD;;;;;;;;;;;OAWG;IACH;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAA8B;QAC7F,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,IAAuH,CAAC;QAC5H,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CACrB;8FACsF,CACvF,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAU,CAAC;QACjE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;gBAC/D,SAAS,EAAE,SAAS,EAAE,MAAM;gBAC5B,MAAM,EAAE,sFAAsF;gBAC9F,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAChC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB,IAAI,IAAI,CAAC;QAC3G,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,8FAA8F;YAC9F,sFAAsF;YACtF,4FAA4F;YAC5F,8FAA8F;YAC9F,8EAA8E;YAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAChG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC9H,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC7E,0FAA0F;gBAC1F,yFAAyF;gBACzF,gEAAgE;gBAChE,yFAAyF;gBACzF,0FAA0F;gBAC1F,0FAA0F;gBAC1F,2CAA2C;gBAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACjG,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YACpD,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI;YAC3C,wFAAwF;YACxF,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,EAAE,uHAAuH;SAChI,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,SAAiB,EAAE,SAAiB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/http-manifest-poll.d.ts

@@ -0,0 +1,67 @@
+/**
+ * CELLO-M7-CONN-001 (DOD-CONN-3) — HTTP consortium-manifest poll.
+ *
+ * The manifest poll is the ONE daemon-level directory operation. With the keystone
+ * deleted there is no shared authenticated signaling stream to carry it, so it moves
+ * to unauthenticated HTTP: GET ${directoryUrl}/manifest. The manifest is PUBLIC,
+ * self-authenticating data — threshold-signed by officer root keys that the daemon has
+ * pinned LOCALLY (CELLO_CONSORTIUM_ROOT_KEYS). The directory is ONLY a transport, never
+ * a trust anchor: a rogue/compromised directory cannot make us adopt a forged, expired,
+ * not-yet-valid, or rolled-back manifest. The verify-before-adopt policy here is the
+ * SAME TUF policy the deleted keystone signaling path enforced (SignalingManager
+ * .handleManifestPollResponse), preserved unchanged across the transport move.
+ *
+ * Runs daemon-level — even with ZERO agents (the property the keystone, which borrowed
+ * the primary agent's identity to authenticate, could never provide).
+ *
+ * Crypto reference: RFC 8032 (Ed25519 threshold verification via verifyManifest).
+ */
+import type { IManifestProvider, IManifestVersionStore, IManifestPollScheduler } from "@cello-protocol/transport";
+/** Minimal structural logger — events use the `domain.noun.verb` taxonomy. */
+export interface ManifestPollLogger {
+    info(event: string, ctx?: Record<string, unknown>): void;
+    warn(event: string, ctx?: Record<string, unknown>): void;
+    error(event: string, ctx?: Record<string, unknown>): void;
+}
+export interface ManifestAdoptDeps {
+    manifestProvider: IManifestProvider;
+    manifestVersionStore: IManifestVersionStore;
+    /** Locally-pinned officer root keys (CELLO_CONSORTIUM_ROOT_KEYS). */
+    rootKeys: readonly string[];
+    threshold: number;
+    logger: ManifestPollLogger;
+}
+export type ManifestPollFailureReason = "manifest_http_unreachable" | "manifest_malformed" | "manifest_threshold_invalid" | "manifest_signature_invalid" | "manifest_not_yet_valid" | "manifest_expired" | "manifest_version_rollback" | "manifest_store_error";
+export type ManifestPollOutcome = {
+    ok: true;
+    adopted: boolean;
+    oldVersion: number | null;
+    newVersion: number;
+} | {
+    ok: false;
+    reason: ManifestPollFailureReason;
+};
+/**
+ * Fetch the consortium manifest over HTTP, verify it (TUF), and adopt it if it is a
+ * newer, validly-signed, unexpired manifest. Never throws — a poll failure returns a
+ * distinct reason and leaves the cached manifest + trusted version untouched (DB-001).
+ */
+export declare function pollManifestOverHttp(opts: {
+    directoryUrl: string;
+    fetchFn?: typeof fetch;
+    now?: Date;
+    correlationId?: string;
+} & ManifestAdoptDeps): Promise<ManifestPollOutcome>;
+/**
+ * Wire the daemon-level HTTP manifest poll onto a scheduler. Self-rearming: each tick
+ * polls then schedules the next. Returns a stop function. The poll runs regardless of
+ * how many agents exist (including zero) — it has no agent identity and opens no
+ * signaling connection.
+ */
+export declare function startHttpManifestPoll(opts: {
+    scheduler: IManifestPollScheduler;
+    directoryUrl: string;
+    fetchFn?: typeof fetch;
+    mintCorrelationId?: () => string;
+} & ManifestAdoptDeps): () => void;
+//# sourceMappingURL=http-manifest-poll.d.ts.map

package/dist/http-manifest-poll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-manifest-poll.d.ts","sourceRoot":"","sources":["../src/http-manifest-poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGlH,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,qEAAqE;IACrE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,MAAM,yBAAyB,GACjC,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,4BAA4B,GAC5B,wBAAwB,GACxB,kBAAkB,GAClB,2BAA2B,GAC3B,sBAAsB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAIrD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE;IACJ,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,iBAAiB,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAsG9B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IACJ,SAAS,EAAE,sBAAsB,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC,GAAG,iBAAiB,GACpB,MAAM,IAAI,CA6BZ"}

package/dist/http-manifest-poll.js

@@ -0,0 +1,150 @@
+/**
+ * CELLO-M7-CONN-001 (DOD-CONN-3) — HTTP consortium-manifest poll.
+ *
+ * The manifest poll is the ONE daemon-level directory operation. With the keystone
+ * deleted there is no shared authenticated signaling stream to carry it, so it moves
+ * to unauthenticated HTTP: GET ${directoryUrl}/manifest. The manifest is PUBLIC,
+ * self-authenticating data — threshold-signed by officer root keys that the daemon has
+ * pinned LOCALLY (CELLO_CONSORTIUM_ROOT_KEYS). The directory is ONLY a transport, never
+ * a trust anchor: a rogue/compromised directory cannot make us adopt a forged, expired,
+ * not-yet-valid, or rolled-back manifest. The verify-before-adopt policy here is the
+ * SAME TUF policy the deleted keystone signaling path enforced (SignalingManager
+ * .handleManifestPollResponse), preserved unchanged across the transport move.
+ *
+ * Runs daemon-level — even with ZERO agents (the property the keystone, which borrowed
+ * the primary agent's identity to authenticate, could never provide).
+ *
+ * Crypto reference: RFC 8032 (Ed25519 threshold verification via verifyManifest).
+ */
+import { verifyManifest } from "@cello-protocol/crypto";
+import { extractErrorMessage } from "./error-message.js";
+const FETCH_TIMEOUT_MS = 10_000;
+/**
+ * Fetch the consortium manifest over HTTP, verify it (TUF), and adopt it if it is a
+ * newer, validly-signed, unexpired manifest. Never throws — a poll failure returns a
+ * distinct reason and leaves the cached manifest + trusted version untouched (DB-001).
+ */
+export async function pollManifestOverHttp(opts) {
+    const { directoryUrl, fetchFn = fetch, now = new Date(), correlationId, manifestProvider, manifestVersionStore, rootKeys, threshold, logger, } = opts;
+    const manifestUrl = `${directoryUrl.replace(/\/$/, "")}/manifest`;
+    // DOD-AUTH-2 observability: announce each poll dispatch (domain.noun.verb taxonomy, matching the
+    // manifest LOAD events `directory.auth.manifest.*`). Lets an operator/alarm see the daemon is
+    // actively polling even when every poll is a no-op (already-current) or a transient failure.
+    logger.info("directory.auth.manifest.poll.dispatched", { directoryUrl, correlationId });
+    // 1. Fetch. Any network error / non-200 / timeout → unreachable. DB-001: the caller
+    //    keeps the cached manifest; a poll failure never disturbs agent connections.
+    let raw;
+    try {
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS);
+        let resp;
+        try {
+            resp = await fetchFn(manifestUrl, { signal: ac.signal });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!resp.ok) {
+            logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_http_unreachable", status: resp.status, directoryUrl, correlationId });
+            return { ok: false, reason: "manifest_http_unreachable" };
+        }
+        raw = await resp.json();
+    }
+    catch (err) {
+        logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_http_unreachable", directoryUrl, correlationId, error: extractErrorMessage(err) });
+        return { ok: false, reason: "manifest_http_unreachable" };
+    }
+    // 2. Structural check before verify — a junk body must fail loudly, not be cached.
+    const manifest = raw;
+    if (typeof manifest?.version !== "number" ||
+        !Array.isArray(manifest?.nodes) ||
+        !Array.isArray(manifest?.signatures)) {
+        logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_malformed", directoryUrl, correlationId });
+        return { ok: false, reason: "manifest_malformed" };
+    }
+    // 3. Defense-in-depth: never adopt against a 0/missing threshold (verifyManifest would
+    //    accept an unsigned manifest at threshold 0). The composition root rejects
+    //    threshold < 1 before wiring, but guard the policy directly too.
+    if (threshold < 1) {
+        logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_threshold_invalid", threshold, correlationId });
+        return { ok: false, reason: "manifest_threshold_invalid" };
+    }
+    // 4. Threshold signature (RFC 8032) against locally-pinned root keys.
+    const verifyResult = verifyManifest(manifest, rootKeys, threshold);
+    if (!verifyResult.ok) {
+        // Distinct security event (a rogue/compromised directory served a forged manifest) — kept as its
+        // own name so alarms can key on it separately from ordinary poll failures. DOD-AUTH-2.
+        logger.warn("directory.auth.manifest.signature.invalid", { reason: "manifest_signature_invalid", manifestVersion: manifest.version, detail: verifyResult.reason, correlationId });
+        return { ok: false, reason: "manifest_signature_invalid" };
+    }
+    // 5. Validity window.
+    if (now < new Date(manifest.not_before)) {
+        logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_not_yet_valid", manifestVersion: manifest.version, notBefore: manifest.not_before, correlationId });
+        return { ok: false, reason: "manifest_not_yet_valid" };
+    }
+    if (new Date(manifest.expires) <= now) {
+        logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_expired", manifestVersion: manifest.version, expiresAt: manifest.expires, correlationId });
+        return { ok: false, reason: "manifest_expired" };
+    }
+    // 6-7. Anti-rollback + adopt. The version store / provider are I/O (the version store is
+    // DB-backed in production), so they can THROW — wrap them so a store error becomes a distinct,
+    // LOGGED failure (manifest_store_error) instead of an invisible throw that silently disables
+    // manifest adoption forever (fallback-finder MED).
+    try {
+        const lastSeen = await manifestVersionStore.getLastSeenVersion();
+        if (lastSeen !== null && manifest.version < lastSeen) {
+            logger.warn("directory.auth.manifest.poll.failed", { reason: "manifest_version_rollback", manifestVersion: manifest.version, lastSeenVersion: lastSeen, correlationId });
+            return { ok: false, reason: "manifest_version_rollback" };
+        }
+        if (lastSeen !== null && manifest.version === lastSeen) {
+            // Already current — nothing to adopt.
+            return { ok: true, adopted: false, oldVersion: lastSeen, newVersion: manifest.version };
+        }
+        const oldVersion = manifestProvider.getCurrentManifest()?.version ?? null;
+        manifestProvider.updateManifest(manifest);
+        await manifestVersionStore.persistVersion(manifest.version);
+        logger.info("directory.auth.manifest.poll.success", { oldVersion, newVersion: manifest.version, directoryUrl, correlationId });
+        return { ok: true, adopted: true, oldVersion, newVersion: manifest.version };
+    }
+    catch (err) {
+        logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_store_error", manifestVersion: manifest.version, directoryUrl, correlationId, error: extractErrorMessage(err) });
+        return { ok: false, reason: "manifest_store_error" };
+    }
+}
+/**
+ * Wire the daemon-level HTTP manifest poll onto a scheduler. Self-rearming: each tick
+ * polls then schedules the next. Returns a stop function. The poll runs regardless of
+ * how many agents exist (including zero) — it has no agent identity and opens no
+ * signaling connection.
+ */
+export function startHttpManifestPoll(opts) {
+    const { scheduler, directoryUrl, fetchFn, mintCorrelationId, manifestProvider, manifestVersionStore, rootKeys, threshold, logger } = opts;
+    let stopped = false;
+    const tick = async () => {
+        if (stopped)
+            return;
+        await pollManifestOverHttp({
+            directoryUrl,
+            fetchFn,
+            correlationId: mintCorrelationId?.(),
+            manifestProvider,
+            manifestVersionStore,
+            rootKeys,
+            threshold,
+            logger,
+        }).catch((err) => {
+            // pollManifestOverHttp is designed never to throw (all failures return a reason). If it ever
+            // does, LOG it (never swallow silently — that would hide a permanently-disabled poll) and let
+            // the loop self-heal by re-arming below.
+            logger.error("directory.auth.manifest.poll.failed", { reason: "manifest_poll_unexpected_error", directoryUrl, error: extractErrorMessage(err) });
+        });
+        if (!stopped)
+            scheduler.scheduleNext(tick);
+    };
+    scheduler.scheduleNext(tick);
+    return () => {
+        stopped = true;
+        scheduler.cancel();
+    };
+}
+//# sourceMappingURL=http-manifest-poll.js.map