@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/signal-submission.js

@@ -0,0 +1,368 @@
+/**
+ * M10B / DOD-END-SUBMIT-1 — the daemon side of the sealed submission queue (M10B-D2).
+ *
+ * Bob's daemon composes a submission, signs it with his agent's K_local, and seals it to the
+ * portal's intake key. A directory node then carries a blob it cannot read until the portal drains
+ * it. **The daemon never talks to the portal** — that is the decision this whole path exists to
+ * honour, and it is what keeps a later move to per-node intake a routing change rather than a
+ * migration of every installed client.
+ *
+ * WHAT THIS MODULE IS RESPONSIBLE FOR, and why it is separable from the send: everything here is
+ * pure given its inputs, and it is where the invariants live. The transport can retry, fail over, or
+ * be replaced; none of that can make an unsealed blob safe or a forged attribution valid.
+ *
+ *   INV-ATTRIBUTION — `submitter_pubkey` is read from the SIGNING key provider, and there is no
+ *                     parameter to override it. A caller cannot name someone else, because the field
+ *                     is not an input. Precedent: `accepting_node` in DOD-DIR-WRITE-1, "written by
+ *                     the node itself, never accepted from the request".
+ *   INV-CONSENT     — the plaintext is sealed to the intake key before it ever reaches the
+ *                     directory, so a node operator learns nothing about who endorsed whom.
+ *   §5a ABSENT      — a missing OR malformed intake key REFUSES, with the reason named. There is no
+ *                     code path here that emits an unsealed submission; that is a structural
+ *                     property of this file, not a policy someone remembered to apply.
+ *
+ * Crypto: Ed25519 → RFC 8032, CBOR → RFC 8949, SHA-256 → FIPS 180-4.
+ */
+import { sealToRecipient } from "@cello-protocol/crypto";
+import { buildSubmissionTbs, encodeSubmission, submissionId, } from "@cello-protocol/protocol-types";
+/** The wire version this daemon emits. Signed, so it cannot be downgraded in flight. */
+const SUBMISSION_VERSION = 1;
+/** Ed25519 public keys are 32 bytes — 64 lowercase hex characters. */
+const INTAKE_PUBKEY_RE = /^[0-9a-f]{64}$/;
+const INV_ATTRIBUTION_NO_OVERRIDE = true;
+void INV_ATTRIBUTION_NO_OVERRIDE;
+/**
+ * Compose → sign → seal. Returns the exact three values a queue row needs, or a named refusal.
+ *
+ * Note what this function does NOT do: it does not send, and it does not scan. Sending is the
+ * caller's, so a failed node is a retry rather than a re-sign. Scanning is the PORTAL's (spec §7,
+ * `DOD-END-SCAN-1`) — scanning here would be theatre, because the operator's own daemon is the
+ * party whose content is in question.
+ */
+export async function composeSealedSubmission(opts) {
+    const { manifest, keyProvider, logger } = opts;
+    if (!manifest) {
+        logger.warn("signal.submission.refused", {
+            reason: "manifest_unavailable",
+            op: opts.op,
+            subjectKind: opts.subjectKind,
+        });
+        return {
+            ok: false,
+            reason: "manifest_unavailable",
+            guidance: "No verified consortium manifest is loaded, so the portal's intake key is unknown. " +
+                "A submission is never sent unsealed. Check the daemon's manifest configuration and retry.",
+        };
+    }
+    // THE MANIFEST IS A STARTUP SNAPSHOT, AND ITS VALIDITY IS TIME-LIMITED.
+    //
+    // `verifyStartupManifest` checked the signatures, the window and the anti-rollback ONCE, at daemon
+    // start, and the daemon then holds that object for its whole lifetime — nothing refreshes it. So
+    // the startup gate's guarantee decays: three weeks later the window may have closed and the portal
+    // may have rotated the intake key, while this code would still happily seal to the retired one.
+    //
+    // The operator would be told the message was sent. The portal could not open it. By this module's
+    // own definition that arrives as unattributable POISON with no reply possible — the message simply
+    // vanishes, with no error anywhere. An EXPIRED input is an UNVERIFIED input (§5a), so it refuses
+    // and names the cause rather than trusting a check whose expiry has passed.
+    const now = (opts.nowMs ?? Date.now)();
+    const expiresAt = Date.parse(manifest.expires);
+    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
+        logger.warn("signal.submission.refused", {
+            reason: "manifest_expired",
+            manifestVersion: manifest.version,
+            expiresAt: manifest.expires,
+            op: opts.op,
+        });
+        return {
+            ok: false,
+            reason: "manifest_expired",
+            guidance: `The consortium manifest verified at daemon start (v${manifest.version}) expired at ` +
+                `${manifest.expires}, so its portal intake key can no longer be trusted — sealing to a ` +
+                "retired key produces a message the portal cannot open and cannot even attribute. " +
+                // DOD-M15-MANIFEST-EXPIRY-LIVE-1 review F4: this used to say "Restart the daemon to load and
+                // verify a current manifest, then retry." That is the one move that must NOT be made here.
+                // Startup fails closed on an expired manifest (ADV-002), so a restart without a REPLACEMENT
+                // does not reload anything — the daemon refuses to come back and every agent goes offline.
+                // The instruction turned a refused submission into a dead daemon, and it contradicted the
+                // guidance `cello_status` gives for the identical condition.
+                "Replace the manifest first — a new file at CELLO_CONSORTIUM_MANIFEST, or an " +
+                "@cello-protocol/connect upgrade if this daemon uses the compiled-in one — and then restart. " +
+                "Do NOT restart without one: startup refuses an expired manifest, so the daemon will not " +
+                "come back up. Run cello_status for the full picture.",
+        };
+    }
+    const intakeKey = manifest.intake_key;
+    if (!intakeKey) {
+        logger.warn("signal.submission.refused", {
+            reason: "intake_key_absent",
+            manifestVersion: manifest.version,
+            op: opts.op,
+        });
+        return {
+            ok: false,
+            reason: "intake_key_absent",
+            guidance: `Consortium manifest v${manifest.version} publishes no portal intake key, so this submission ` +
+                "cannot be sealed. It is NOT sent unsealed — the directory must not be able to read it. " +
+                "This needs a manifest that carries `intake_key`.",
+        };
+    }
+    // Malformed is refused for the same reason absent is. Sealing to a non-key produces a blob nobody
+    // can open, which reaches the portal as unattributable POISON with no reply possible (M10B-D22b) —
+    // so the operator would watch the submission vanish with no error anywhere. Uppercase hex is
+    // refused rather than lowercased: the key_id/pubkey pair comes from a SIGNED document, and quietly
+    // repairing a signed value hides a manifest-generation bug instead of surfacing it.
+    if (!intakeKey.key_id || !INTAKE_PUBKEY_RE.test(intakeKey.pubkey ?? "")) {
+        logger.warn("signal.submission.refused", {
+            reason: "intake_key_malformed",
+            manifestVersion: manifest.version,
+            keyId: intakeKey.key_id,
+            op: opts.op,
+        });
+        return {
+            ok: false,
+            reason: "intake_key_malformed",
+            guidance: `Consortium manifest v${manifest.version} carries an unusable intake key ` +
+                `(key_id: ${JSON.stringify(intakeKey.key_id)}) — the pubkey must be a 32-byte Ed25519 key as ` +
+                "64 lowercase hex characters. Refusing rather than sealing to an unopenable value.",
+        };
+    }
+    // INV-ATTRIBUTION: taken from the signer, never from a parameter.
+    const submitterPubkey = Buffer.from(await keyProvider.getPublicKey()).toString("hex");
+    const body = {
+        v: SUBMISSION_VERSION,
+        op: opts.op,
+        subject_kind: opts.subjectKind,
+        subject: opts.subject,
+        submitter_pubkey: submitterPubkey,
+        body: opts.body,
+        issued_at: opts.issuedAt,
+    };
+    const signature = await keyProvider.sign(buildSubmissionTbs(body));
+    const encoded = encodeSubmission(body, signature);
+    // Derived from the PLAINTEXT submission, not the ciphertext. Sealing is randomised, so a
+    // ciphertext-derived id would change on every re-seal and a failover retry would look like a
+    // second submission — two mints, double quota consumption.
+    const id = submissionId(encoded);
+    const ciphertext = sealToRecipient(Buffer.from(intakeKey.pubkey, "hex"), encoded);
+    logger.info("signal.submission.sealed", {
+        submissionId: id,
+        intakeKeyId: intakeKey.key_id,
+        op: opts.op,
+        subjectKind: opts.subjectKind,
+        manifestVersion: manifest.version,
+        // The body is NEVER logged — it is the operator's own words about a third party, and this log
+        // line would be the one place it existed in the clear on disk.
+        bodyBytes: Buffer.byteLength(opts.body, "utf8"),
+    });
+    return { ok: true, submissionId: id, intakeKeyId: intakeKey.key_id, ciphertext };
+}
+const DEFAULT_ACK_TIMEOUT_MS = 15_000;
+/**
+ * Hand a sealed submission to the directory node this agent is connected to, and await its ack.
+ *
+ * ONE node, deliberately. The daemon holds a single signaling stream, and registration already works
+ * this way — it sends `register_request` to the connected node and the DIRECTORY fans out to the
+ * quorum. There is no client-side multi-node write path, and inventing one here would duplicate the
+ * SignalingManager's reconnect. So "failover" for a submission is that existing reconnect, and a
+ * retry afterwards is safe because `submission_id` is content-derived: the same body produces the
+ * same id, so a second node stores it once and the portal mints once (M10B-D20, M10B-D21).
+ */
+export async function sendSealedSubmission(deps) {
+    const { signaling, submissionId: id, intakeKeyId, ciphertext, logger } = deps;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_ACK_TIMEOUT_MS;
+    // Advisory only — see the handler. Never resolves the send; it sharpens the TIMEOUT's diagnosis.
+    let sawNotAuthenticated = false;
+    let resolveFrame;
+    const pending = new Promise((r) => { resolveFrame = r; });
+    const unregister = signaling.registerInboundHandler((frame) => {
+        const t = frame["type"];
+        // A result for a DIFFERENT submission must be ignored: the handler sees every frame on a shared
+        // stream, and accepting someone else's ack would report success for a write that never happened.
+        // EVERY resolve path is id-gated. The handler sees every frame on a SHARED stream, so an
+        // ungated one resolves this submission with someone else's outcome — and two concurrent
+        // submissions is not an exotic case, it is the second endorsement.
+        if (t === "submission_write_result" && frame["submission_id"] === id)
+            resolveFrame(frame);
+        else if (t === "submission_write_error" && frame["submission_id"] === id)
+            resolveFrame(frame);
+        // `not_authenticated` is DELIBERATELY NOT a resolve path. An older node replies it when its
+        // decoder returns null (M10B-D25r), so it is the version-skew symptom — but it is also what the
+        // node sends for a frame that arrives before auth completes, and for ANY other component's
+        // undecodable frame on this same stream. Resolving on it would let an unrelated
+        // `manifest_poll_request` to an older node report THIS submission as unsupported, while the real
+        // result arrives afterwards and is dropped on the floor. It is recorded as advisory context and
+        // the timeout decides.
+        else if (t === "not_authenticated")
+            sawNotAuthenticated = true;
+    });
+    try {
+        const sent = await signaling.sendRaw({
+            type: "submission_write",
+            submission_id: id,
+            intake_key_id: intakeKeyId,
+            ciphertext,
+        });
+        if (!sent.ok) {
+            // The reason CODE carries the transport's own cause when it has one. `directory_unreachable`
+            // is an exit-point label — a machine consumer branching on it cannot tell "reconnecting" from
+            // "lost", and those want different operator actions.
+            const cause = sent.reason ?? "directory_unreachable";
+            logger.warn("signal.submission.refused", { submissionId: id, reason: cause });
+            return {
+                ok: false,
+                reason: cause,
+                // STATED AS IT IS: this submission was NOT delivered and NOTHING here retries it. An earlier
+                // draft said "it was not lost", which asserted a retry no code performs — the caller would
+                // have to re-invoke, and until DOD-END-SURFACE-1 there is no caller at all. What IS true is
+                // that re-submitting is SAFE, which is a different claim.
+                guidance: `The submission was NOT handed to a directory node (${cause}) and nothing has retried it. ` +
+                    "Re-submitting is safe: it produces the SAME submission_id, so the retry is stored once, " +
+                    "not twice.",
+            };
+        }
+        let timer;
+        const timeout = new Promise((r) => {
+            timer = setTimeout(() => r({ type: "__timeout__" }), timeoutMs);
+        });
+        const frame = await Promise.race([pending, timeout]);
+        clearTimeout(timer);
+        if (frame["type"] === "__timeout__") {
+            // F2: NAME THE AMBIGUITY RATHER THAN RESOLVING IT. `not_authenticated` has THREE producers on
+            // the directory side — an undecodable frame from a node that has not deployed this frame kind
+            // (the version-skew case), an undecodable frame from a node that HAS (i.e. our own bug: a
+            // malformed id or an empty ciphertext), and a frame that genuinely arrived before auth
+            // completed. An earlier draft asserted the first with certainty and told the operator it was
+            // "NOT an authentication problem" — which, in the third case, sends them away from the actual
+            // cause and towards a deploy that will never fix it.
+            const reason = sawNotAuthenticated ? "submission_unsupported_by_node" : "submission_write_timeout";
+            logger.warn("signal.submission.refused", { submissionId: id, reason, timeoutMs, sawNotAuthenticated });
+            return {
+                ok: false,
+                reason,
+                guidance: sawNotAuthenticated
+                    ? "The directory node did not recognise the frame and never acknowledged the submission. " +
+                        "MOST LIKELY it has not deployed submission support yet — nodes deploy independently per " +
+                        "region, so check this node's version first. Two other conditions produce the same reply: " +
+                        "a malformed submission from this client, and a frame rejected because authentication had " +
+                        "not completed (if the signaling stream also dropped, look there). Re-submitting is safe."
+                    : `The directory node accepted the frame but did not acknowledge the submission within ${timeoutMs}ms. ` +
+                        "Whether it was stored is unknown; re-submitting is safe (same submission_id, stored once).",
+            };
+        }
+        if (frame["type"] === "submission_write_error") {
+            const reason = typeof frame["reason"] === "string" ? frame["reason"] : "unspecified";
+            logger.warn("signal.submission.refused", { submissionId: id, reason: "submission_refused_by_node", nodeReason: reason });
+            return {
+                ok: false,
+                reason: "submission_refused_by_node",
+                // The upstream reason SURVIVES into the payload rather than being flattened into this
+                // function's own exit label (§5b).
+                guidance: `The directory node refused the submission: ${reason}.`,
+            };
+        }
+        const stored = frame["stored"] === true;
+        logger.info(stored ? "signal.submission.queued" : "signal.submission.duplicate", {
+            submissionId: id,
+            intakeKeyId,
+            stored,
+        });
+        return { ok: true, submissionId: id, stored };
+    }
+    finally {
+        unregister();
+    }
+}
+/**
+ * M10B / `M10B-D25r2` — ask the directory what happened to what this agent submitted.
+ *
+ * THE REQUEST CARRIES NO IDENTITY, and that absence is the point: the directory scopes the answer to
+ * the key that authenticated the stream. A pubkey parameter would be a parameter to forge, and would
+ * let any agent that can dial a node collect another's outcomes — including refusal ciphertexts
+ * sealed to somebody else, unopenable by them but never theirs to hold.
+ *
+ * ONE TIMEOUT, NO RETRY. An outcome is durable at the directory until acked, so a caller that missed
+ * it simply asks again — a retry loop here would only add load to a node that is already slow.
+ */
+export async function fetchSubmissionResults(opts) {
+    const { signaling, keyProvider, logger } = opts;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_ACK_TIMEOUT_MS;
+    let resolveFrame;
+    const pending = new Promise((r) => { resolveFrame = r; });
+    const unregister = signaling.registerInboundHandler((frame) => {
+        const t = frame["type"];
+        if (t === "submission_results" || t === "submission_results_error")
+            resolveFrame(frame);
+    });
+    try {
+        const sent = await signaling.sendRaw({ type: "submission_results_request" });
+        if (!sent.ok) {
+            const cause = sent.reason ?? "directory_unreachable";
+            return {
+                ok: false,
+                reason: cause,
+                guidance: `The request was not handed to a directory node (${cause}). Outcomes are held until you ` +
+                    "collect them, so nothing is lost — try again once the stream is back.",
+            };
+        }
+        let timer;
+        const timeoutP = new Promise((r) => { timer = setTimeout(() => r({ type: "__timeout__" }), timeoutMs); });
+        const frame = await Promise.race([pending, timeoutP]);
+        clearTimeout(timer);
+        if (frame["type"] === "__timeout__") {
+            return {
+                ok: false,
+                reason: "submission_results_timeout",
+                guidance: `The node did not answer within ${timeoutMs}ms. Your outcomes are still held — this is a ` +
+                    "slow or old node, not a lost result. An older node that does not know the frame answers " +
+                    "nothing at all, which looks the same from here.",
+            };
+        }
+        if (frame["type"] === "submission_results_error") {
+            const reason = typeof frame["reason"] === "string" ? frame["reason"] : "unspecified";
+            return { ok: false, reason, guidance: `The directory could not serve your results: ${reason}.` };
+        }
+        const raw = Array.isArray(frame["results"]) ? frame["results"] : [];
+        const results = [];
+        for (const r of raw) {
+            const submissionId = typeof r["submission_id"] === "string" ? r["submission_id"] : null;
+            const outcome = typeof r["outcome"] === "string" ? r["outcome"] : null;
+            // A row missing its id or outcome is unusable — there is nothing to correlate it against and
+            // nothing to report. Dropped LOUDLY rather than surfaced as a result with empty fields.
+            if (!submissionId || !outcome) {
+                logger.warn("signal.results.malformed_row", {});
+                continue;
+            }
+            // THE MESSAGE IS OPENED HERE, by k_local, and a failure to open is NOT a failure of the
+            // result: the outcome and reason are still true and still worth reporting. Swallowing the
+            // whole row because its message would not decrypt would hide a refusal behind a key problem.
+            let message = null;
+            const ct = r["ciphertext"];
+            if (ct instanceof Uint8Array && ct.length > 0 && keyProvider.openContentSeal) {
+                try {
+                    const opened = await keyProvider.openContentSeal(ct);
+                    message = opened ? new TextDecoder().decode(opened) : null;
+                    if (!opened)
+                        logger.warn("signal.results.seal_unopenable", { submissionId });
+                }
+                catch {
+                    logger.warn("signal.results.seal_unopenable", { submissionId });
+                }
+            }
+            results.push({
+                submissionId,
+                outcome,
+                reason: typeof r["reason"] === "string" ? r["reason"] : null,
+                signalHash: typeof r["signal_hash"] === "string" ? r["signal_hash"] : null,
+                message,
+                createdAt: typeof r["created_at"] === "string" ? r["created_at"] : "",
+            });
+        }
+        logger.info("signal.results.fetched", { count: results.length });
+        return { ok: true, results };
+    }
+    finally {
+        unregister();
+    }
+}
+//# sourceMappingURL=signal-submission.js.map

package/dist/signal-submission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-submission.js","sourceRoot":"","sources":["../src/signal-submission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,GAKb,MAAM,gCAAgC,CAAC;AAGxC,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AA2E1C,MAAM,2BAA2B,GAAgC,IAAI,CAAC;AACtE,KAAK,2BAA2B,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,sBAAsB;YAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EACN,oFAAoF;gBACpF,2FAA2F;SAC9F,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,gGAAgG;IAChG,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,4EAA4E;IAC5E,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,kBAAkB;YAC1B,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,SAAS,EAAE,QAAQ,CAAC,OAAO;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kBAAkB;YAC1B,QAAQ,EACN,sDAAsD,QAAQ,CAAC,OAAO,eAAe;gBACrF,GAAG,QAAQ,CAAC,OAAO,qEAAqE;gBACxF,mFAAmF;gBACnF,6FAA6F;gBAC7F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,0FAA0F;gBAC1F,6DAA6D;gBAC7D,8EAA8E;gBAC9E,8FAA8F;gBAC9F,0FAA0F;gBAC1F,sDAAsD;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,mBAAmB;YAC3B,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EACN,wBAAwB,QAAQ,CAAC,OAAO,sDAAsD;gBAC9F,yFAAyF;gBACzF,kDAAkD;SACrD,CAAC;IACJ,CAAC;IAED,kGAAkG;IAClG,mGAAmG;IACnG,6FAA6F;IAC7F,mGAAmG;IACnG,oFAAoF;IACpF,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,sBAAsB;YAC9B,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EACN,wBAAwB,QAAQ,CAAC,OAAO,kCAAkC;gBAC1E,YAAY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,kDAAkD;gBAC9F,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEtF,MAAM,IAAI,GAAmB;QAC3B,CAAC,EAAE,kBAAkB;QACrB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,eAAe;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,QAAQ;KACzB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAClD,yFAAyF;IACzF,6FAA6F;IAC7F,2DAA2D;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAElF,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;QACtC,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,SAAS,CAAC,MAAM;QAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,QAAQ,CAAC,OAAO;QACjC,8FAA8F;QAC9F,+DAA+D;QAC/D,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;AACnF,CAAC;AAqDD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAO1C;IACC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAE3D,iGAAiG;IACjG,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,YAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,gGAAgG;QAChG,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,mEAAmE;QACnE,IAAI,CAAC,KAAK,yBAAyB,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;aACrF,IAAI,CAAC,KAAK,wBAAwB,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9F,4FAA4F;QAC5F,gGAAgG;QAChG,2FAA2F;QAC3F,gFAAgF;QAChF,iGAAiG;QACjG,gGAAgG;QAChG,uBAAuB;aAClB,IAAI,CAAC,KAAK,mBAAmB;YAAE,mBAAmB,GAAG,IAAI,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;YACnC,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,WAAW;YAC1B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,6FAA6F;YAC7F,8FAA8F;YAC9F,qDAAqD;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAA8B;gBACtC,6FAA6F;gBAC7F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,0DAA0D;gBAC1D,QAAQ,EACN,sDAAsD,KAAK,gCAAgC;oBAC3F,0FAA0F;oBAC1F,YAAY;aACf,CAAC;QACJ,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE;YACzD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;YACpC,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,uFAAuF;YACvF,6FAA6F;YAC7F,8FAA8F;YAC9F,qDAAqD;YACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,0BAA0B,CAAC;YACnG,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACvG,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM;gBACN,QAAQ,EAAE,mBAAmB;oBAC3B,CAAC,CAAC,wFAAwF;wBACxF,0FAA0F;wBAC1F,2FAA2F;wBAC3F,2FAA2F;wBAC3F,0FAA0F;oBAC5F,CAAC,CAAC,uFAAuF,SAAS,MAAM;wBACtG,4FAA4F;aACjG,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,wBAAwB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACzH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,sFAAsF;gBACtF,mCAAmC;gBACnC,QAAQ,EAAE,8CAA8C,MAAM,GAAG;aAClE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,6BAA6B,EAAE;YAC/E,YAAY,EAAE,EAAE;YAChB,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAE3D,IAAI,YAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,0BAA0B;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC;YACrD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK;gBACb,QAAQ,EACN,mDAAmD,KAAK,iCAAiC;oBACzF,uEAAuE;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtD,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,QAAQ,EACN,kCAAkC,SAAS,+CAA+C;oBAC1F,0FAA0F;oBAC1F,iDAAiD;aACpD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,0BAA0B,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,+CAA+C,MAAM,GAAG,EAAE,CAAC;QACnG,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,SAAS,CAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,6FAA6F;YAC7F,wFAAwF;YACxF,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,wFAAwF;YACxF,0FAA0F;YAC1F,6FAA6F;YAC7F,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3B,IAAI,EAAE,YAAY,UAAU,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;gBAC7E,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;oBACrD,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC3D,IAAI,CAAC,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY;gBACZ,OAAO;gBACP,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC5D,UAAU,EAAE,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC1E,OAAO;gBACP,SAAS,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/signaling-connect.d.ts

@@ -0,0 +1,118 @@
+/**
+ * M7 Keystone (Part 2) — production `signalingConnect` for the daemon.
+ *
+ * This is the daemon's directory-facing dialer. It establishes ONE authenticated
+ * signaling stream to a directory node and returns it as a transport
+ * `ConnectResult`. The transport `SignalingManager` owns everything after connect:
+ * heartbeat, reconnect (it calls connect() again on a fresh attempt), the outbound
+ * queue, and optional manifest polling.
+ *
+ * The 7-step handshake below is the wire protocol the directory speaks. It is not negotiable from
+ * this side: change a step and registration, the DKG ceremony, and session sealing all break.
+ *
+ * Architecture note (2026-06-11 daemon-transport doc): this is the *directory-facing
+ * node* — one per daemon, signaling only. A FRESH libp2p node (and therefore a fresh
+ * transport key / Peer ID) is created on every connect, which is exactly the
+ * reconnect-rotation behavior the architecture calls for. Per-session data exchange
+ * uses separate ephemeral session nodes, not this node.
+ *
+ * Step-5/6 directory identity verification (the consortium-manifest "directory proves
+ * itself back" hardening) is OPTIONAL here: it runs only when a `challengeVerifier`
+ * is supplied. M6 ran with it off (challengeVerifier = null) and connected fine; the
+ * hardening layers on later without changing this path.
+ *
+ * Crypto reference: agent→directory auth signs SHA-256(domain ‖ nonce ‖ pubkey) with
+ * the agent's K_local Ed25519 key (RFC 8032). K_local never leaves the KeyProvider.
+ */
+import { type CelloNode, type ConnectResult, type IDirectoryChallengeVerifier } from "@cello-protocol/transport";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { Logger } from "./types.js";
+/** A directory node the daemon can dial, resolved from bootstrap config or a manifest. */
+export interface DirectoryEndpoint {
+    peerId: string;
+    /** A dialable multiaddr (e.g. /dns4/host/tcp/443/wss/p2p/<peerId>). Optional if already connected. */
+    multiaddr?: string;
+}
+/** The agent identity that authenticates this signaling stream (steps 3-4). */
+export interface SignalingAuthIdentity {
+    keyProvider: KeyProvider;
+    pubkeyHex: string;
+}
+export interface SignalingConnectDeps {
+    /**
+     * Resolve the directory node to dial. Returns null when no endpoint is known yet.
+     * May be async — production re-resolves the bootstrap (GET /bootstrap) per connect
+     * so a directory address change is picked up on the next reconnect.
+     */
+    getDirectoryEndpoint: () => DirectoryEndpoint | null | Promise<DirectoryEndpoint | null>;
+    /** Resolve the agent identity to authenticate as. Returns null when no agent exists yet. */
+    getAuthIdentity: () => SignalingAuthIdentity | null;
+    logger: Logger;
+    /**
+     * Optional directory identity verifier (consortium-manifest step-6 hardening).
+     * When absent, directory verification is skipped — the M6 backward-compat path.
+     */
+    challengeVerifier?: IDirectoryChallengeVerifier;
+    /** Verified consortium manifest version, surfaced in ConnectResult. Defaults to 0 (no manifest). */
+    getManifestVersion?: () => number;
+    /**
+     * Test seam: inject a node factory. Production uses `createNode` to mint a fresh
+     * directory-facing node per connect.
+     */
+    createDirectoryNode?: (keyProvider: KeyProvider) => Promise<CelloNode>;
+    /**
+     * M7 Action 2: publish the live directory-facing node to the daemon so subsystems
+     * that must reach the directory on the SAME node — registration's FROST DKG
+     * (NetworkDirectoryNode), ceremonies, seal — can use it. Called with the node on a
+     * successful connect, and with `null` when the stream closes. The daemon keeps the
+     * latest reference and gates use on the signaling status being `connected`.
+     */
+    publishNode?: (node: CelloNode | null) => void;
+    /**
+     * Cross-node topology (item 3): mark this a VISITING connection. Set true ONLY for the transient
+     * connection a client opens into a node that is NOT its home, to broker a cross-node session. The
+     * flag rides in signaling_auth_response; the directory then gives this stream a #streams entry (so
+     * the same-node session flow sees the agent) but writes NO presence — so the transient connection
+     * never re-homes the agent or falsely marks it offline. Home connections omit it. Not signature-
+     * bound (the auth TBS is unchanged) — the flag rides the encrypted libp2p channel.
+     */
+    visiting?: boolean;
+    /**
+     * DOD-NAT-REACHABILITY-1 (Phase 2): receives the directory's healthy relay-pool
+     * endpoints when signaling_auth_ok carries `relay_endpoints`. Fires once per
+     * successful connect (so every reconnect refreshes the set). The endpoints ride
+     * the authenticated, directory-verified signaling channel — the same trust rail
+     * as session_assignment frames. Absent field (old directory) → never called.
+     */
+    onRelayEndpoints?: (endpoints: Array<{
+        peerId: string;
+        addrs: string[];
+    }>) => void;
+    /**
+     * DOD-M15-RELAYSLOTS-1: receives the directory's online token — the credential the relays above
+     * now require before they will let this agent hold a circuit reservation slot. Rides the same
+     * frame and the same cadence as `relay_endpoints`: every connect and every reconnect, which is
+     * what keeps a short-lived token current.
+     *
+     * Absent field → never called. That is the honest signal in two different situations, and the
+     * daemon cannot tell them apart from here: an older directory that does not issue tokens, or a
+     * key this directory does not know as a registered agent. Either way there is no slot.
+     */
+    onOnlineToken?: (token: Uint8Array) => void;
+    /**
+     * DOD-M15-RELAYSLOTS-1 review M1: fired instead of `onOnlineToken` when the directory issued
+     * none, carrying WHICH absence it was. `undefined` means the directory stated no reason, i.e. it
+     * predates the token — which is itself the third distinct answer and must not be folded into the
+     * other two.
+     */
+    onOnlineTokenAbsent?: (reason: "not_registered_here" | "issue_failed" | undefined) => void;
+}
+/**
+ * Build a production `signalingConnect` for `DaemonConfig.signalingConnect`.
+ *
+ * The returned function performs one full connect attempt. It throws on any failure
+ * (no endpoint, no identity, dial failure, auth rejection, challenge failure); the
+ * transport SignalingManager catches the throw and schedules a reconnect.
+ */
+export declare function createSignalingConnect(deps: SignalingConnectDeps): () => Promise<ConnectResult>;
+//# sourceMappingURL=signaling-connect.d.ts.map

package/dist/signaling-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signaling-connect.d.ts","sourceRoot":"","sources":["../src/signaling-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAOH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EAElB,KAAK,2BAA2B,EACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AA+CzC,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACzF,4FAA4F;IAC5F,eAAe,EAAE,MAAM,qBAAqB,GAAG,IAAI,CAAC;IACpD,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAClC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC;IACnF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,GAAG,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;CAC5F;AAuBD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CA0X/F"}