@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/session-views.js

@@ -0,0 +1,278 @@
+import { countAttendance } from "./co-attendance.js";
+import { renderFrontierMismatch } from "./frontier-mismatch.js";
+import { resolveAgentState } from "./agent-state.js";
+import { extractErrorMessage } from "./error-message.js";
+export function createSessionViews(deps) {
+    const { logger, sessionNodeManager, perConnectionState, onlineAgents, explicitlyOfflineAgents, perAgentSignaling, sharedSignaling, frontierMismatches, sealKey, sealInterruptedInProgress, pendingSealWaiters, } = deps;
+    // M7-SESSION-001 AC-006/AC-007 (and M-1 PULL): build the interrupted_sessions
+    // array from SQLite. Shared by both getStatus() (daemon-wide) and the
+    // cello_status MCP handler (per-connection) so live MCP clients see the same
+    // interrupted sessions a CLI `cello status` would.
+    // `cello status` is a health snapshot, not a session archive. It surfaces ONLY genuinely
+    // RESUMABLE sessions (interrupted with messages exchanged) — never failed inits (interrupted,
+    // 0 messages — a dead handshake), which classify as "failed" and would otherwise accumulate
+    // unbounded and confuse. The list is also capped; the full, queryable history is `cello sessions`
+    // / cello_list_sessions (with filter + limit flags).
+    const STATUS_RESUMABLE_CAP = 10;
+    /**
+     * DOD-M12B-SEAL-STUCK-1 — ask the seal gate for ONE session, and never let the answer take the
+     * status response with it.
+     *
+     * This runs per session on every `cello status` and every `cello_status`, and it touches the
+     * database. An unguarded throw here rejects the whole response, after which the CLI finds the
+     * singleton lock still held and prints `daemon: "broken_shutdown"` — telling the operator their
+     * healthy daemon has failed to stop, over one session row it could not read. There is a
+     * documented precedent in this codebase for exactly that shape.
+     *
+     * A failure yields `unknown`, never `ready`: "we could not check" must not read as "safe to
+     * close", because a close on a short chain is terminal.
+     */
+    function probeSealReadiness(agentName, sessionId) {
+        try {
+            return sessionNodeManager.sealReadinessView(agentName, sessionId);
+        }
+        catch (err) {
+            const message = extractErrorMessage(err);
+            logger.warn("session.seal.readiness.probe.failed", { agentName, sessionId, error: message });
+            return { state: "unknown", reason: `probe_failed: ${message}` };
+        }
+    }
+    function buildInterruptedSessions() {
+        return sessionNodeManager
+            .getSessionsByStatus("interrupted")
+            .filter((row) => (row.message_count ?? 0) > 0) // resumable only — drop failed 0-message inits
+            .slice(0, STATUS_RESUMABLE_CAP)
+            .map((row) => ({
+            sessionId: row.session_id,
+            agentName: row.agent_name,
+            counterpartyPubkey: row.counterparty_pubkey,
+            messageCount: row.message_count ?? 0,
+            interruptedAt: row.interrupted_at ?? new Date(row.updated_at).toISOString(),
+            // DOD-SESSION-NAME-1 (AC-A11): an interrupted session is one you may want to resume or seal
+            // — the name is how you tell which one it was.
+            sessionName: row.session_name ?? null,
+            // DOD-M12B-SEAL-STUCK-1: the same answer the active list carries, for the same reason —
+            // an interrupted session can seal, so it can also be blocked from sealing by a gap, and
+            // that is knowable here instead of only after a failed close. A plain property, never a
+            // spread: a spread bypasses excess-property checking, which is how `frontierMismatch`
+            // below came to typecheck while no renderer could read it.
+            sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
+            // DOD-FRONTIER-STRAND-1 AC3: if a seal exchange has already proved the two sides disagree on
+            // how many messages this session holds, SAY SO HERE. Otherwise a stranded session is listed
+            // exactly like a healthy paused one, and the only way to learn it can never seal is to
+            // attempt another close and read the error — which is how dbb93dfc… sat unnoticed a week.
+            ...(() => {
+                const m = frontierMismatches.get(row.agent_name, row.session_id);
+                return m ? { frontierMismatch: renderFrontierMismatch(m, row.session_id) } : {};
+            })(),
+        }));
+    }
+    // CC-5/F21: reap dead half-open sessions on READ (compute-on-read, like reapExpiredInboundSessions —
+    // no background timer). A session the standing receiver opened from an inbound offer the initiator
+    // ABANDONED stays "active" forever (the counterparty never joins), clutters the open/active lists, and
+    // its normal close fires an unsealable bilateral seal. Mark such a session terminal ("abandoned") once
+    // it is PROVABLY dead: counterparty never established (liveness != "alive" AND 0 RECEIVED messages —
+    // message_count alone counts our own auto-"Dispatched." ack, so it is NOT the signal) + age past the
+    // grace TTL (a genuinely fresh session still setting up must survive).
+    // CC-10 (live 2026-07-08 Phase-2 block): scan 'interrupted' too, not just 'active'. A daemon restart
+    // flips dead half-opens to 'interrupted'; those classify as "failed" (invisible in every list) yet
+    // still count toward the unknown-sender acceptance bound (D18 deliberately counts 'interrupted') — so
+    // a stranger whose first handshakes died was silently locked out FOREVER. Reaping only 0-RECEIVED
+    // ghosts keeps D18 intact: the disconnect-evasion attacker's sessions always carry received content.
+    const HALF_OPEN_TTL_MS = Number(process.env["CELLO_HALF_OPEN_TTL_MS"]) || 5 * 60 * 1000;
+    function reapDeadHalfOpenSessions(agentName) {
+        const now = Date.now();
+        const candidates = [...sessionNodeManager.getSessionsByStatus("active"), ...sessionNodeManager.getSessionsByStatus("interrupted")];
+        for (const row of candidates) {
+            if (agentName !== undefined && row.agent_name !== agentName)
+                continue;
+            if (now - row.created_at <= HALF_OPEN_TTL_MS)
+                continue; // too young — may just be setting up
+            // DOD-M12B-ACK-1: 'impaired' counts as live HERE. This reaper's question is "did the
+            // counterparty ever establish?", and impaired means it did — the connection is up, only
+            // delivery on it is failing. Reaping on impaired would abandon exactly the sessions this
+            // milestone exists to repair.
+            const liveness = sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id);
+            if (liveness === "alive" || liveness === "impaired")
+                continue; // live
+            /**
+             * DOD-M12B-REAP-HELD-1 — count HELD frames too, or an interrupted conversation reads as a
+             * dead handshake.
+             *
+             * OBSERVED LIVE 2026-08-18: this line abandoned session `d28db475…` — twenty leaves in the
+             * chain plus sixteen verified frames still held, ten of them from the counterparty — while the
+             * restart-seal resolver was actively trying to notarize it. The receipt was forfeited and the
+             * held content annexed.
+             *
+             * `countReceivedMessages` asks the TRANSCRIPT, and held content never reaches the transcript;
+             * it waits in `held_content` until it can join the chain. So the very condition that holds
+             * content — an interrupted session — is the condition that hides the counterparty's messages
+             * from this test, and a real conversation becomes indistinguishable from an offer nobody
+             * answered. `countEstablishedReceived` asks both places.
+             */
+            if (sessionNodeManager.countEstablishedReceived(row.agent_name, row.session_id) > 0)
+                continue; // counterparty spoke
+            // Non-awaited: abandonSession flips the DB status synchronously (before its first await), so THIS
+            // read reflects it; the async node teardown finishes in the background. CC-10 reviewer LOW: only
+            // log "reaped" if the status flip actually wrote — a swallowed write failure already logs
+            // session.status.write.failed, and reporting success over it would hide a still-counting ghost.
+            void sessionNodeManager.abandonSession(row.agent_name, row.session_id)
+                .then((flipped) => {
+                if (flipped) {
+                    logger.info("session.half_open.reaped", { agentName: row.agent_name, sessionId: row.session_id, priorStatus: row.status, ageMs: now - row.created_at });
+                }
+            })
+                .catch((err) => {
+                logger.warn("session.half_open.reap.failed", { agentName: row.agent_name, sessionId: row.session_id, reason: extractErrorMessage(err) });
+            });
+        }
+    }
+    // DOD-M15-AWAYSCOPE-1: one budget for ALL the attendance probes a status read fires, not one
+    // each. An operator with a dozen sessions must not wait a dozen timeouts, and the number is set by
+    // what a person will sit through at a terminal rather than by what a slow relay might need.
+    const ATTENDANCE_PROBE_BUDGET_MS = 1_500;
+    // M8B F16: per-session liveness for ACTIVE sessions, shared by both status surfaces
+    // ("status" for the CLI, "cello_status" for MCP). The signal (session.liveness.changed,
+    // tracked in the node manager) existed but nothing consumed it — a dead counterparty
+    // was invisible to the operator.
+    function buildActiveSessions() {
+        reapDeadHalfOpenSessions(); // CC-5/F21: drop provably-dead half-open sessions before surfacing active ones
+        return sessionNodeManager.getSessionsByStatus("active").map((row) => {
+            // DOD-M12B-SEAL-STUCK-1: ask the SAME gate the close path asks, so the surface and the
+            // refusal can never disagree. Computed here rather than cached because the answer changes
+            // the moment a gap fills, and a stale "stuck" is its own lie.
+            return {
+                sessionId: row.session_id,
+                agentName: row.agent_name,
+                counterpartyPubkey: row.counterparty_pubkey,
+                liveness: sessionNodeManager.getSessionLiveness(row.agent_name, row.session_id),
+                sessionName: row.session_name ?? null, // DOD-SESSION-NAME-1 (AC-A11)
+                sealReadiness: probeSealReadiness(row.agent_name, row.session_id),
+                // DOD-M12B-CLOSE-SILENT-WAIT-1: both flows, because either can be the one blocking the
+                // operator's command — `pendingSealWaiters` is the active close, `sealInterruptedInProgress`
+                // the interrupted one.
+                sealing: pendingSealWaiters.has(sealKey(row.agent_name, row.session_id)) ||
+                    sealInterruptedInProgress.has(sealKey(row.agent_name, row.session_id)),
+            };
+        });
+    }
+    /**
+     * The state an operator sees, for one agent — used by BOTH status surfaces.
+     *
+     * Deliberately one function. The daemon-wide status and the per-connection `cello_status` used to
+     * compute this separately, and separate copies of a truth claim are how the directory-health block
+     * came to exist on one surface and not the other earlier today.
+     */
+    function agentStateFor(a) {
+        return resolveAgentState({
+            loadFailed: a.state === "load_failed",
+            // `unregistered` is BUILT and tested (agent-state.ts) and deliberately NOT EMITTED yet.
+            //
+            // The truthful signal is whether the DKG left a FROST share — registration's durable product,
+            // rather than a flag anyone could forget to set. But every test fixture creates an agent
+            // WITHOUT one, so switching this on relabels the agents in 29 tests across 8 files, and the
+            // alternative — fabricating share material in fixtures — plants fake crypto material that a
+            // later reader takes for real. Neither is worth it for a state that lasts the few seconds
+            // between `cello create-agent` and `cello register-agent`.
+            //
+            // So the daemon asserts exactly what it asserted before this change: a loaded agent is treated
+            // as registered. That is not a regression, and it is not silent — it is this comment. The VALUE
+            // stays in AgentState, so turning it on once fixtures can register for real is a one-line
+            // change here and NOT a second wire change for every consumer.
+            hasFrostShare: true,
+            deliberatelyOffline: explicitlyOfflineAgents.has(a.name),
+            started: onlineAgents.has(a.name),
+            // This agent's OWN stream where it has one — an agent whose connection is severed while its
+            // siblings are fine must not read as healthy.
+            //
+            // Falls back to the shared manager, mirroring directorySignalingStatus(): production gives
+            // every agent its own connection, but the IN-PROCESS TEST path has ONE shared manager (NOT back-compat: Rule F deletes
+            // back-compat on sight, and deleting this would break every in-process test in the package) and
+            // no per-agent entry at all. Reading only the per-agent map there returns undefined for every
+            // agent, so all of them reported `connecting` — which then made isAgentReady false and refused
+            // real commands with `selected_agent_offline`. Absent is not the same as disconnected.
+            signalingConnected: (perAgentSignaling.get(a.name)?.signaling.status ?? sharedSignaling?.status) === "connected",
+            attendance: countAttendance(perConnectionState, a.name),
+        });
+    }
+    // `probeSealReadiness` is NOT returned: its only caller is `buildInterruptedSessions`, which
+    // moved with it. Returning it would make a private helper reachable for no consumer.
+    /**
+     * DOD-M15-AWAYSCOPE-1 unit 3 — the same active sessions, plus what the RELAY knows about the far
+     * side: is it reachable, and is anyone attending it.
+     *
+     * ── WHY THIS IS A SEPARATE, ASYNC BUILD ─────────────────────────────────────────────────────────
+     *
+     * `buildActiveSessions` answers from local state and must stay synchronous — it is called from the
+     * half-open reaper's own path and from surfaces that cannot await. Attendance is not local: it is
+     * the far daemon's assertion, held by the relay, and the only way to have it is to ask. So the
+     * round trip lives here, on top, and every caller that can afford it uses this one.
+     *
+     * ── WHAT THE OPERATOR GETS, AND WHY IT IS NOT A MESSAGE ─────────────────────────────────────────
+     *
+     * This is the whole replacement for the away reply. An unattended agent used to announce itself by
+     * sending its greeting INTO the conversation, which took a hash-chain leaf and cost session
+     * `e7dd3f43…` its receipt on both machines. The same fact now arrives here, as session STATUS: the
+     * operator reads it, their agent never has to answer it, and it never enters a transcript or a
+     * sealed receipt.
+     *
+     * ── THE TWO LIVENESSES ARE BOTH REPORTED, AND THEY ARE NOT THE SAME QUESTION ────────────────────
+     *
+     * `liveness` is daemon-local — does THIS process hold a libp2p connection for the session. It has a
+     * fourth value, `impaired`, meaning the connection is up and writes on it are failing.
+     * `relayLiveness` is the RELAY's observation of the counterparty's standing connection, which is
+     * visible even when this daemon has no direct link at all. They disagree routinely and legitimately
+     * — a relay-mediated session is the normal case — so collapsing them into one word would make the
+     * commoner state look like a fault.
+     *
+     * ── BOUNDED, BECAUSE A STATUS COMMAND MUST ANSWER ───────────────────────────────────────────────
+     *
+     * Every session is asked in parallel under ONE budget. A relay that does not answer costs the
+     * operator a wait, not a hang, and the sessions that did answer are still reported — a status read
+     * that blocks on the slowest relay is a status read nobody runs when it matters.
+     */
+    async function buildActiveSessionsWithAttendance() {
+        const sessions = buildActiveSessions();
+        if (sessions.length === 0)
+            return sessions;
+        const deadline = new Promise((r) => setTimeout(() => r("timeout"), ATTENDANCE_PROBE_BUDGET_MS));
+        const answered = await Promise.race([
+            Promise.all(sessions.map(async (s) => {
+                try {
+                    return await sessionNodeManager.queryRelayLiveness(s.agentName, s.sessionId);
+                }
+                catch {
+                    // A probe that throws tells the operator nothing, and must not take the status read with
+                    // it. Null here reads the same as "this session has no relay to ask", which is honest.
+                    return null;
+                }
+            })),
+            deadline,
+        ]);
+        if (answered === "timeout") {
+            // The local picture, unenriched. NOT an error and not a partial merge: pairing answers to
+            // sessions after a race would report some rows enriched and others not, with nothing saying
+            // which — and an operator cannot tell a missing field from a field that means "unknown".
+            logger.debug("session.attendance.probe.timeout", { sessions: sessions.length, budgetMs: ATTENDANCE_PROBE_BUDGET_MS });
+            return sessions;
+        }
+        return sessions.map((s, i) => {
+            const a = answered[i];
+            if (!a)
+                return s;
+            return {
+                ...s,
+                relayLiveness: a.liveness,
+                ...(a.observedAt > 0 ? { relayObservedAt: a.observedAt } : {}),
+                // BOTH, and they are different facts. `relayObservedAt` is when the relay last saw the
+                // connection change; `attendanceObservedAt` is when the agent last said something about
+                // itself. Labelling the attendance with the first dates an absence to a time before it was
+                // true, and the number then never moves when the operator steps away again.
+                ...(a.attendance ? { counterpartyAttendance: a.attendance } : {}),
+                ...(a.attendanceObservedAt !== undefined ? { attendanceObservedAt: a.attendanceObservedAt } : {}),
+            };
+        });
+    }
+    return { buildInterruptedSessions, reapDeadHalfOpenSessions, buildActiveSessions, buildActiveSessionsWithAttendance, agentStateFor };
+}
+//# sourceMappingURL=session-views.js.map

package/dist/session-views.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-views.js","sourceRoot":"","sources":["../src/session-views.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkBzD,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,EACJ,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EACrF,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,OAAO,EAAE,yBAAyB,EAC1F,kBAAkB,GACnB,GAAG,IAAI,CAAC;IAET,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,mDAAmD;IACnD,yFAAyF;IACzF,8FAA8F;IAC9F,4FAA4F;IAC5F,kGAAkG;IAClG,qDAAqD;IACrD,MAAM,oBAAoB,GAAG,EAAE,CAAC;IAChC;;;;;;;;;;;;OAYG;IACH,SAAS,kBAAkB,CAAC,SAAiB,EAAE,SAAiB;QAC9D,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,SAAS,wBAAwB;QAC/B,OAAO,kBAAkB;aACtB,mBAAmB,CAAC,aAAa,CAAC;aAClC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,+CAA+C;aAC7F,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC;aAC9B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;YAC3C,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;YACpC,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YAC3E,4FAA4F;YAC5F,+CAA+C;YAC/C,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,wFAAwF;YACxF,wFAAwF;YACxF,wFAAwF;YACxF,sFAAsF;YACtF,2DAA2D;YAC3D,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;YACjE,6FAA6F;YAC7F,4FAA4F;YAC5F,uFAAuF;YACvF,0FAA0F;YAC1F,GAAG,CAAC,GAAG,EAAE;gBACP,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,CAAC,CAAC,EAAE;SACL,CAAC,CAAC,CAAC;IACR,CAAC;IAED,qGAAqG;IACrG,mGAAmG;IACnG,uGAAuG;IACvG,uGAAuG;IACvG,qGAAqG;IACrG,qGAAqG;IACrG,uEAAuE;IACvE,qGAAqG;IACrG,mGAAmG;IACnG,sGAAsG;IACtG,kGAAkG;IAClG,qGAAqG;IACrG,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACxF,SAAS,wBAAwB,CAAC,SAAkB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,CAAC,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC;QACnI,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,SAAS;YACtE,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,gBAAgB;gBAAE,SAAS,CAAC,qCAAqC;YAC7F,qFAAqF;YACrF,wFAAwF;YACxF,yFAAyF;YACzF,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YACvF,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,UAAU;gBAAE,SAAS,CAAC,OAAO;YACtE;;;;;;;;;;;;;;eAcG;YACH,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,qBAAqB;YACpH,kGAAkG;YAClG,iGAAiG;YACjG,0FAA0F;YAC1F,gGAAgG;YAChG,KAAK,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;iBACnE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC1J,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3I,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,mGAAmG;IACnG,4FAA4F;IAC5F,MAAM,0BAA0B,GAAG,KAAK,CAAC;IAEzC,oFAAoF;IACpF,wFAAwF;IACxF,qFAAqF;IACrF,iCAAiC;IACjC,SAAS,mBAAmB;QAC1B,wBAAwB,EAAE,CAAC,CAAC,+EAA+E;QAC3G,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClE,uFAAuF;YACvF,0FAA0F;YAC1F,8DAA8D;YAC9D,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;gBAC3C,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;gBAC/E,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,8BAA8B;gBACrE,aAAa,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;gBACjE,uFAAuF;gBACvF,6FAA6F;gBAC7F,uBAAuB;gBACvB,OAAO,EACL,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC/D,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;aACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,SAAS,aAAa,CAAC,CAAY;QACjC,OAAO,iBAAiB,CAAC;YACvB,UAAU,EAAE,CAAC,CAAC,KAAK,KAAK,aAAa;YACrC,wFAAwF;YACxF,EAAE;YACF,8FAA8F;YAC9F,yFAAyF;YACzF,4FAA4F;YAC5F,4FAA4F;YAC5F,0FAA0F;YAC1F,2DAA2D;YAC3D,EAAE;YACF,+FAA+F;YAC/F,gGAAgG;YAChG,0FAA0F;YAC1F,+DAA+D;YAC/D,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjC,4FAA4F;YAC5F,8CAA8C;YAC9C,EAAE;YACF,2FAA2F;YAC3F,uHAAuH;YACzH,gGAAgG;YAC9F,8FAA8F;YAC9F,+FAA+F;YAC/F,uFAAuF;YACvF,kBAAkB,EAChB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,IAAI,eAAe,EAAE,MAAM,CAAC,KAAK,WAAW;YAC9F,UAAU,EAAE,eAAe,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,6FAA6F;IAC7F,qFAAqF;IACrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,UAAU,iCAAiC;QAC9C,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAY,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC;oBACH,OAAO,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,yFAAyF;oBACzF,uFAAuF;oBACvF,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YACH,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,0FAA0F;YAC1F,4FAA4F;YAC5F,yFAAyF;YACzF,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACtH,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;YACjB,OAAO;gBACL,GAAG,CAAC;gBACJ,aAAa,EAAE,CAAC,CAAC,QAAQ;gBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,uFAAuF;gBACvF,wFAAwF;gBACxF,2FAA2F;gBAC3F,4EAA4E;gBAC5E,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClG,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,iCAAiC,EAAE,aAAa,EAAE,CAAC;AACvI,CAAC"}

package/dist/signal-handlers.d.ts

@@ -0,0 +1,63 @@
+import type { SubmissionOp, ConsortiumManifest } from "@cello-protocol/protocol-types";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { SignalingManager } from "@cello-protocol/transport";
+import type { SubmissionRetryQueue } from "./submission-retry.js";
+import type { IpcHandler } from "./ipc-server.js";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { Logger } from "./types.js";
+import type { LoadedAgent } from "./agent-loader.js";
+/** The per-connection agent selection, as this surface needs to read it. */
+export interface SignalConnState {
+    currentAgent: string | null;
+}
+export interface SignalHandlerDeps {
+    handlers: Map<string, IpcHandler>;
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    /** Signing keys by agent name. A missing entry is a refusal, never a silent skip. */
+    keyProviders: Map<string, KeyProvider>;
+    /** Read-only: a submission needs its agent ONLINE, and this surface must not change that. */
+    onlineAgents: ReadonlySet<string>;
+    /** Resolves the selected agent's name to its pubkey. It no longer gates attestations: a CO-OWNED
+     * subject is annotated by the portal, not refused here. */
+    loadedAgents: ReadonlyArray<LoadedAgent>;
+    /** Read this connection's agent selection. The READ, not the container. */
+    getConnState: (connectionId: string) => SignalConnState | undefined;
+    /**
+     * ⚠️ NOT a getter — for an agent with no manager this CONSTRUCTS one. The comment at its use
+     * site says so and moved with the code; it is repeated here because the name reads like a lookup.
+     */
+    getAgentSignaling: (agentName: string, agentKeyProvider: KeyProvider, agentPubkeyHex: string) => {
+        signaling: SignalingManager;
+    };
+    /** A transient connection to a directory that is not this agent's home node. */
+    openVisitingConnection: (agentName: string, agentKeyProvider: KeyProvider, agentPubkeyHex: string, endpoint: {
+        peerId: string;
+        multiaddr: string;
+    }, correlationId: string, nodeId: string) => {
+        mgr: SignalingManager;
+        stop: (reason: string) => Promise<void>;
+    };
+    /** It returns synchronously and dials in the background; this is what makes it usable. */
+    waitForSignalingConnected: (mgr: SignalingManager, timeoutMs: number) => Promise<boolean>;
+    /** Every directory in the verified consortium. Null when there is no roster at all. */
+    resolveConsortiumRoster: () => Promise<Array<{
+        peerId: string;
+        multiaddr: string;
+        nodeId: string;
+    }> | null>;
+    /** The verified manifest, for its intake key. Null on every path that verified nothing. */
+    verifiedManifest: ConsortiumManifest | null;
+    /** Held submissions that could not be sent, retried on a window. */
+    submissionRetries: SubmissionRetryQueue;
+    /** Record an issued submission against the agent's STABLE id, never its display name. */
+    recordIssuedSubmission: (agentName: string, agentId: string, s: {
+        submissionId: string;
+        subject: string;
+        op: SubmissionOp;
+        intakeKeyId: string;
+        stored: boolean;
+    }) => void;
+}
+export declare function registerSignalHandlers(deps: SignalHandlerDeps): void;
+//# sourceMappingURL=signal-handlers.d.ts.map

package/dist/signal-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-handlers.d.ts","sourceRoot":"","sources":["../src/signal-handlers.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAqB,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC1G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAKlE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAUrD,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAAG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AAEjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,qFAAqF;IACrF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,6FAA6F;IAC7F,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC;+DAC2D;IAC3D,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACzC,2EAA2E;IAC3E,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;IACpE;;;OAGG;IACH,iBAAiB,EAAE,CACjB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,WAAW,EAC7B,cAAc,EAAE,MAAM,KACnB;QAAE,SAAS,EAAE,gBAAgB,CAAA;KAAE,CAAC;IACrC,gFAAgF;IAChF,sBAAsB,EAAE,CACtB,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,WAAW,EAC7B,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAC/C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,KACX;QAAE,GAAG,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACxE,0FAA0F;IAC1F,yBAAyB,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,uFAAuF;IACvF,uBAAuB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5G,2FAA2F;IAC3F,gBAAgB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C,oEAAoE;IACpE,iBAAiB,EAAE,oBAAoB,CAAC;IACxC,yFAAyF;IACzF,sBAAsB,EAAE,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KACjG,IAAI,CAAC;CACX;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA89BpE"}