@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/agent-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-handlers.js","sourceRoot":"","sources":["../src/agent-handlers.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAIpF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA4CzD,MAAM,UAAU,qBAAqB,CAAC,IAAsB;IAC1D,MAAM,EACJ,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAC9G,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAC5E,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAC7F,yBAAyB,EAAE,iBAAiB,GAC7C,GAAG,IAAI,CAAC;IAET,6CAA6C;IAC7C,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,EAAE,IAA0B,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,wDAAwD,EAAE,CAAC;QACrH,CAAC;QACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,kGAAkG;IAClG,kGAAkG;IAClG,qGAAqG;IACrG,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,oEAAoE,UAAU,CAAC,MAAM,sBAAsB,EAAE,CAAC;QAC5K,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,IAAI,iEAAiE,EAAE,CAAC;QAClJ,CAAC;QACD,IAAI,SAAiB,CAAC;QACtB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAClD,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1E,+FAA+F;YAC/F,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACnD,4FAA4F;YAC5F,+FAA+F;YAC/F,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACpC,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,gFAAgF;YAChF,+FAA+F;YAC/F,2FAA2F;YAC3F,yFAAyF;YACzF,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3D,+FAA+F;YAC/F,6FAA6F;YAC7F,2FAA2F;YAC3F,2FAA2F;YAC3F,kGAAkG;YAClG,8CAA8C;YAC9C,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YAChD,+FAA+F;YAC/F,yFAAyF;YACzF,wEAAwE;YACxE,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,wGAAwG,EAAE,CAAC;QAC1K,CAAC;QACD,8FAA8F;QAC9F,sDAAsD;QACtD,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,iGAAiG;IACjG,qGAAqG;IACrG,qGAAqG;IACrG,oGAAoG;IACpG,6DAA6D;IAC7D,iGAAiG;IACjG,mGAAmG;IACnG,uGAAuG;IACvG,kGAAkG;IAClG,oEAAoE;IACpE,KAAK,UAAU,qBAAqB,CAAC,IAKpC;QACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAChE,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,WAAW,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,uBAAuB,CAAC,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEnE,qGAAqG;QACrG,mGAAmG;QACnG,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QAC5E,oGAAoG;QACpG,uGAAuG;QACvG,MAAM,gBAAgB,GAAG,CAAC,YAAY,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrE,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC5E,IAAI,YAAmD,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,iGAAiG;YACjG,MAAM,UAAU,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxB,IAAI,CAAC,CAAC,KAAK,sBAAsB,IAAI,CAAC,KAAK,wBAAwB,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,UAAU;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAChI,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1J,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;gBACzF,IAAI,KAAqC,CAAC;gBAC1C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChI,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACtD,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,aAAa;oBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACnF,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,wBAAwB;oBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC;gBAC1H,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC9E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,UAAU,EAAE,CAAC;YACf,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAChD,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5G,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,6FAA6F,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;QACnL,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACtE,sGAAsG;QACtG,wFAAwF;QACxF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;QAC7G,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;QAEpC,mGAAmG;QACnG,kGAAkG;QAClG,kGAAkG;QAClG,iBAAiB;QACjB,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,0BAA0B,IAAI,2BAA2B,IAAI,uBAAuB,EAAE,CAAC;QAClJ,CAAC;QAED,oGAAoG;QACpG,mGAAmG;QACnG,kGAAkG;QAClG,0EAA0E;QAC1E,IAAI,mBAAmB,GAAwC,SAAS,CAAC;QACzE,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjF,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACrH,mBAAmB,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;YAC7D,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC,CAAC;YAC1G,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACzC,sFAAsF;YACtF,0FAA0F;YAC1F,oFAAoF;YACpF,gBAAgB,GAAG,iCAAiC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,qGAAqG;QACrG,mDAAmD;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACxB,gGAAgG;YAChG,+FAA+F;YAC/F,0BAA0B;YAC1B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM,kBAAkB,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC1E,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvH,CAAC,CAAC,CAAC;YACL,CAAC;YACD,yFAAyF;YACzF,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3C,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxH,CAAC,CAAC,CAAC;YACH,+FAA+F;YAC/F,gFAAgF;YAChF,aAAa,CAAC,IAAI,CAAC,CAAC;YACpB,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC1D,IAAI,EAAE,IAAI,CAAC;gBAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACpD,IAAI,EAAE,IAAI,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClC,6FAA6F;YAC7F,gGAAgG;YAChG,kGAAkG;YAClG,wFAAwF;YACxF,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YACzG,4DAA4D;YAC5D,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC;gBACjD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBAChC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,4DAA4D;oBACvF,yBAAyB,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAC1D,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YACD,4FAA4F;YAC5F,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACnE,yBAAyB,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS;YACxB,CAAC,CAAC,4KAA4K;YAC9K,CAAC,CAAC,oCAAoC,CAAC;QACzC,MAAM,OAAO,GACX,mBAAmB,KAAK,UAAU;YAChC,CAAC,CAAC,oFAAoF;YACtF,CAAC,CAAC,mBAAmB,KAAK,UAAU;gBAClC,CAAC,CAAC,iEAAiE,gBAAgB,IAAI,uBAAuB,sEAAsE,IAAI,+CAA+C;gBACvO,CAAC,CAAC,gBAAgB,KAAK,iCAAiC;oBACtD,CAAC,CAAC,8MAA8M;oBAChN,CAAC,CAAC,2FAA2F,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,EAAE,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,EAAE;IACF,6FAA6F;IAC7F,8FAA8F;IAC9F,8FAA8F;IAC9F,4FAA4F;IAC5F,yFAAyF;IACzF,WAAW;IACX,EAAE;IACF,+EAA+E;IAC/E,kGAAkG;IAClG,wFAAwF;IACxF,EAAE;IACF,8FAA8F;IAC9F,iEAAiE;IACjE,EAAE;IACF,oFAAoF;IACpF,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,qEAAqE;IACrE,EAAE;IACF,gGAAgG;IAChG,iGAAiG;IACjG,oEAAoE;IACpE,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,EAAE,IAA0B,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,uDAAuD,EAAE,CAAC;QACpH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,IAAI,wDAAwD,EAAE,CAAC;QACpI,CAAC;QACD,+FAA+F;QAC/F,kGAAkG;QAClG,4FAA4F;QAC5F,4FAA4F;QAC5F,iGAAiG;QACjG,+CAA+C;QAC/C,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,oDAAoD;YACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B;;;;;;;;;;;;;WAaG;QACH,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,qFAAqF;QACrF,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,MAAM,kBAAkB,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1E,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,EAAE;QACF,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,iGAAiG;QACjG,oBAAoB;QACpB,EAAE;QACF,4FAA4F;QAC5F,+FAA+F;QAC/F,6FAA6F;QAC7F,4FAA4F;QAC5F,2CAA2C;QAC3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QAC1G,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,0FAA0F;gBAC1F,2FAA2F;gBAC3F,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBACjD,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU;oBACxC,MAAM,EAAE,6FAA6F;oBACrG,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,4DAA4D;QAC5D,yBAAyB,EAAE,CAAC,yBAAyB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAElF,yEAAyE;QACzE,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACjD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBAChC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC1B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,4DAA4D;gBACvF,yBAAyB,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC1D,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC5E,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,uFAAuF;IACvF,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,6FAA6F;IAC7F,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,wFAAwF;IACxF,QAAQ,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;QACrE,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,oDAAoD,EAAE,CAAC;QAC5H,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC;QAEzC,gGAAgG;QAChG,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,2FAA2F;QAC3F,qBAAqB;QACrB,OAAO,SAAS,CAAC,YAAY,CAAC;QAE9B,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,2FAA2F;YAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,kEAAkE,EAAE,CAAC;QACpH,CAAC;QACD,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC;QAC9B;;;;;;;;;;;;WAYG;QACH,IAAI,eAAe,CAAC,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,kBAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,yBAAyB,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,SAAS;YACnB,4FAA4F;YAC5F,8FAA8F;YAC9F,+FAA+F;YAC/F,uFAAuF;YACvF,QAAQ,EACN,wBAAwB,SAAS,8DAA8D;gBAC/F,+FAA+F;gBAC/F,6FAA6F;gBAC7F,yEAAyE;SAC5E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,2CAA2C;IAC3C,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,IAA0B,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,sDAAsD,EAAE,CAAC;QACnH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,IAAI,wDAAwD,IAAI,gEAAgE,EAAE,CAAC;QACxM,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,oDAAoD,EAAE,CAAC;QAC5H,CAAC;QACD,+FAA+F;QAC/F,uFAAuF;QACvF,6FAA6F;QAC7F,mFAAmF;QACnF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,2FAA2F;gBAC3F,0FAA0F;gBAC1F,0FAA0F;gBAC1F,kFAAkF;gBAClF,0FAA0F;gBAC1F,wFAAwF;gBACxF,iDAAiD;gBACjD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClG,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,oBAAoB;oBAC5B,YAAY,EAAE,QAAQ,CAAC,MAAM;oBAC7B,QAAQ,EAAE,0BAA0B,IAAI,mBAAmB,QAAQ,CAAC,QAAQ,mCAAmC;iBAChH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,IAAI,iHAAiH,EAAE,CAAC;QACnM,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC;QACzC,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC;QAC9B,gGAAgG;QAChG,6FAA6F;QAC7F,qCAAqC;QACrC,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,6FAA6F;QAC7F,6FAA6F;QAC7F,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;gBAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD;;;;;;;;;;;WAWG;QACH,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxD,2FAA2F;QAC3F,yBAAyB,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACvF,+FAA+F;QAC/F,uFAAuF;QACvF,+FAA+F;QAC/F,oFAAoF;QACpF,EAAE;QACF,+FAA+F;QAC/F,gEAAgE;QAChE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC;QACtG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,yFAAyF;QACzF,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,8FAA8F;QAC9F,0FAA0F;QAC1F,gEAAgE;QAChE,MAAM,UAAU,GAAG,eAAe,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,8FAA8F;QAC9F,+FAA+F;QAC/F,oFAAoF;QACpF,MAAM,MAAM,GAA4B,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACjE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,4FAA4F;YAC5F,4FAA4F;YAC5F,qFAAqF;YACrF,2FAA2F;YAC3F,yFAAyF;YACzF,MAAM,CAAC,wBAAwB,CAAC;gBAC9B,GAAG,UAAU,4BAA4B,IAAI,mDAAmD;oBAChG,+FAA+F;oBAC/F,gGAAgG;oBAChG,gGAAgG,CAAC;QACrG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,yBAAyB,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,qBAAqB,EAAE,CAAC;YACrI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,CAAC,SAAS,CAAC,GAAG,gBAAgB,CAAC;gBACrC,MAAM,CAAC,kBAAkB,CAAC,GAAG,UAAU,IAAI,0FAA0F,IAAI,qFAAqF,CAAC;YACjO,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,4FAA4F;YAC5F,+FAA+F;YAC/F,4FAA4F;YAC5F,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrG,MAAM,CAAC,SAAS,CAAC,GAAG,sBAAsB,CAAC;YAC3C,MAAM,CAAC,kBAAkB,CAAC,GAAG,UAAU,IAAI,yIAAyI,CAAC;QACvL,CAAC;QACD,8FAA8F;QAC9F,iGAAiG;QACjG,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,yGAAyG;QACzG,qFAAqF;QACrF,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,8FAA8F;QAC9F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACtD,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC5G,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBAChB,MAAM,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC;oBACpC,MAAM,CAAC,0BAA0B,CAAC;wBAChC,GAAG,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,gCAAgC,IAAI,KAAK;4BACnF,8CAA8C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC;gBACxG,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACzC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAClD,CAAC,CAAC;YACH,MAAM,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC;YACtC,MAAM,CAAC,0BAA0B,CAAC;gBAChC,6CAA6C,IAAI,2DAA2D,CAAC;QACjH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACpD,uFAAuF;QACvF,mFAAmF;QACnF,yFAAyF;QACzF,2FAA2F;QAC3F,qEAAqE;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,oFAAoF;IACpF,uFAAuF;IACvF,uFAAuF;IACvF,kFAAkF;IAClF,sEAAsE;IACtE,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,uEAAuE;IACvE,8EAA8E;IAC9E,+BAA+B;AACjC,CAAC"}

package/dist/agent-id-migration.d.ts

@@ -0,0 +1,70 @@
+/**
+ * DOD-AGENT-ID-JOINKEY-1 — finish the migration REMOVE-001 started.
+ *
+ * `agent_name` was the original PRIMARY KEY of `agents`. REMOVE-001 added the stable surrogate
+ * `agent_id` **specifically to make names reusable** (retire keeps the rows and FREES the name), and
+ * migrated only the parent table. SEVEN child tables were left joining on the column that had just
+ * become a mutable, reusable attribute:
+ *
+ *   sessions · seal_interrupted_artifacts · session_tree_leaves · transcript · message_watermarks ·
+ *   contacts · retry_queue
+ *
+ * (`retry_queue` is the seventh — it predates REMOVE-001, so REMOVE-001 skipped seven, not six.)
+ *
+ * The hazard is not stale data. Retire an agent, create a new one with the freed name — a different
+ * agent_id and a different K_local keypair — and every `WHERE agent_name = ?` hands the new identity
+ * the dead one's transcript, its contact whitelist (an ACCESS-CONTROL list), and its interrupted
+ * sessions. Resuming one would seal with the wrong keypair.
+ *
+ * This module carries `agent_id` into all seven and demotes `agent_name` to what it always was after
+ * REMOVE-001: a display label on the parent table, with exactly one source of truth.
+ *
+ * ── Why this is safe, and why it deletes nothing ────────────────────────────────────────────────
+ * Purely client-side. The directory has no `agent_name` column and never sees one (AC1's wire proof:
+ * parties are identified by pubkey + session_id; a name reaches the wire only as the self-declared
+ * `offered_moniker` display label, which this migration does not touch). No row content is destroyed:
+ * every row is COPIED into the new table before the old one is dropped. Retire-reuse orphans need no
+ * purge either — once joined on `agent_id`, a new same-named agent simply never matches them.
+ *
+ * ── Why one transaction ─────────────────────────────────────────────────────────────────────────
+ * SQLite cannot alter a PRIMARY KEY, so each table must be REBUILT (create, copy, drop, rename).
+ * SQLite DDL is transactional, so all seven rebuilds run inside ONE `BEGIN…COMMIT`: a crash rolls the
+ * entire migration back atomically and the daemon reopens on the untouched original schema. There is
+ * no half-migrated state to recover from, and therefore no recovery code to get wrong.
+ *
+ * ── Why the target schema is pinned literally here ──────────────────────────────────────────────
+ * The DDL below duplicates what `session-node-manager` / `retry-queue` create on a fresh database.
+ * That duplication is DELIBERATE. A migration must migrate to a FIXED target: if it read its target
+ * from the live schema, a future column added upstream would silently change what this migration
+ * produces on an old database, and the two shapes would drift apart unnoticed. The drift is instead
+ * caught by a test that asserts a MIGRATED database's schema is byte-identical to a FRESH one.
+ */
+import type { Logger } from "./types.js";
+import { type DaemonDatabase } from "./sqlcipher-db.js";
+/**
+ * The tables this migration rebuilds, derived from `REKEY_TARGETS` rather than written out again.
+ *
+ * Exported for the guards (`dod-m15-migration-guard-1`), which must cover exactly what the
+ * migration touches. A hand-typed copy over there would silently get SHORTER than this list the day
+ * an eighth table is added — so the one table nobody remembered to guard would be the one table
+ * nobody checks, which is the shape of every escape this migration has already had.
+ */
+export declare const REKEYED_TABLES: readonly string[];
+export interface AgentIdMigrationResult {
+    readonly migrated: boolean;
+    /** Rows copied, per rebuilt table. Absent tables are omitted. */
+    readonly rowCounts: Readonly<Record<string, number>>;
+}
+/**
+ * Re-key the seven child tables from `agent_name` to `agent_id`. Idempotent: a table that already has
+ * an `agent_id` column is skipped, so a second call is a no-op. All rebuilds share ONE transaction.
+ *
+ * Throws (leaving the database untouched) on:
+ *   - an ambiguous `agent_name → agent_id` map (a reused retired name),
+ *   - any row whose non-null `agent_name` does not resolve to an agent,
+ *   - any row count that does not match pre-migration.
+ *
+ * Never half-commits, never silently drops a row, never invents an agent_id.
+ */
+export declare function migrateSessionTablesToAgentId(db: DaemonDatabase, logger: Logger): AgentIdMigrationResult;
+//# sourceMappingURL=agent-id-migration.d.ts.map

package/dist/agent-id-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-id-migration.d.ts","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAoQ5E;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAsC,CAAC;AAEnF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAyDD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAyIxG"}

package/dist/agent-id-migration.js

@@ -0,0 +1,468 @@
+/**
+ * DOD-AGENT-ID-JOINKEY-1 — finish the migration REMOVE-001 started.
+ *
+ * `agent_name` was the original PRIMARY KEY of `agents`. REMOVE-001 added the stable surrogate
+ * `agent_id` **specifically to make names reusable** (retire keeps the rows and FREES the name), and
+ * migrated only the parent table. SEVEN child tables were left joining on the column that had just
+ * become a mutable, reusable attribute:
+ *
+ *   sessions · seal_interrupted_artifacts · session_tree_leaves · transcript · message_watermarks ·
+ *   contacts · retry_queue
+ *
+ * (`retry_queue` is the seventh — it predates REMOVE-001, so REMOVE-001 skipped seven, not six.)
+ *
+ * The hazard is not stale data. Retire an agent, create a new one with the freed name — a different
+ * agent_id and a different K_local keypair — and every `WHERE agent_name = ?` hands the new identity
+ * the dead one's transcript, its contact whitelist (an ACCESS-CONTROL list), and its interrupted
+ * sessions. Resuming one would seal with the wrong keypair.
+ *
+ * This module carries `agent_id` into all seven and demotes `agent_name` to what it always was after
+ * REMOVE-001: a display label on the parent table, with exactly one source of truth.
+ *
+ * ── Why this is safe, and why it deletes nothing ────────────────────────────────────────────────
+ * Purely client-side. The directory has no `agent_name` column and never sees one (AC1's wire proof:
+ * parties are identified by pubkey + session_id; a name reaches the wire only as the self-declared
+ * `offered_moniker` display label, which this migration does not touch). No row content is destroyed:
+ * every row is COPIED into the new table before the old one is dropped. Retire-reuse orphans need no
+ * purge either — once joined on `agent_id`, a new same-named agent simply never matches them.
+ *
+ * ── Why one transaction ─────────────────────────────────────────────────────────────────────────
+ * SQLite cannot alter a PRIMARY KEY, so each table must be REBUILT (create, copy, drop, rename).
+ * SQLite DDL is transactional, so all seven rebuilds run inside ONE `BEGIN…COMMIT`: a crash rolls the
+ * entire migration back atomically and the daemon reopens on the untouched original schema. There is
+ * no half-migrated state to recover from, and therefore no recovery code to get wrong.
+ *
+ * ── Why the target schema is pinned literally here ──────────────────────────────────────────────
+ * The DDL below duplicates what `session-node-manager` / `retry-queue` create on a fresh database.
+ * That duplication is DELIBERATE. A migration must migrate to a FIXED target: if it read its target
+ * from the live schema, a future column added upstream would silently change what this migration
+ * produces on an old database, and the two shapes would drift apart unnoticed. The drift is instead
+ * caught by a test that asserts a MIGRATED database's schema is byte-identical to a FRESH one.
+ */
+import { withForeignKeysOff } from "./sqlcipher-db.js";
+import { extractErrorMessage } from "./error-message.js";
+/**
+ * EVERY COLUMN THE INLINE ALTERs ADD MUST APPEAR IN THE createSql BELOW.
+ *
+ * `initialize()` runs the ALTERs first and this rebuild second, and the rebuild carries only the
+ * INTERSECTION of the old and new column sets. A column the ALTERs add and a createSql omits is
+ * therefore DELETED on the one boot where a legacy database upgrades — silently, unrecoverably,
+ * on an operator's machine. `sessions.read_at` was missing for exactly that reason: every dismissal
+ * flag would have been dropped, after which `getEndedUnread` (which filters on `read_at IS NULL`)
+ * throws `no such column` for the rest of that process.
+ *
+ * The parity test guards this, but only because it replays the ALTERs BEFORE the re-key, in the
+ * order `initialize()` uses. Replaying them afterwards puts the column back and the comparison
+ * passes over the top of the loss — which is how this survived.
+ */
+const REKEY_TARGETS = [
+    {
+        table: "sessions",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        session_id TEXT NOT NULL,
+        agent_id TEXT NOT NULL,
+        counterparty_pubkey TEXT NOT NULL,
+        status TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        message_count INTEGER NOT NULL DEFAULT 0,
+        interrupted_at TEXT,
+        relay_peer_id TEXT,
+        relay_addrs TEXT,
+        seal_legibility TEXT,
+        sealed_root_hex TEXT,
+        counterparty_primary_pubkey TEXT,
+        session_name TEXT,
+        read_at INTEGER,
+        counterparty_abandoned_at INTEGER,
+        interrupted_by TEXT,
+        restart_seal_gave_up_at INTEGER,
+        restart_seal_gave_up_reason TEXT,
+        -- DOD-M15-DIVERGE-DURABLE-1. Omitting it here would delete the flag on the one boot a
+        -- legacy database upgrades, and a dropped divergence reads as HEALTHY — exactly the
+        -- failure the column was added to prevent, reintroduced by the migration that carries it.
+        diverged_at INTEGER,
+        -- Decisions Carried #8 — the session salt. Omitting it here drops the salt on the one boot
+        -- a legacy database upgrades, and a dropped salt is WORSE than no salt: every leaf hashed
+        -- under it becomes unverifiable, and the "does this session already have one?" lookup then
+        -- mints a fresh salt and splits the transcript silently. Same trap as diverged_at above.
+        content_salt BLOB,
+        -- 033-ACKEMIT — the session's genesis prev_root: what its FIRST message acknowledges.
+        -- Same trap as the two above, and the consequence is specific: this column exists ONLY to
+        -- survive a restart, because the session timestamp it is derived from arrives on the relay
+        -- assignment and is gone from memory once the process ends. Dropping it on the one boot a
+        -- legacy database upgrades is therefore indistinguishable from never having written it —
+        -- and that session then acknowledges nothing until the counterparty speaks, so its own
+        -- messages carry no content binding for as long as it stays one-sided.
+        genesis_prev_root BLOB,
+        -- 069-ORDERPROOF: the assigned relay's ack-signing pubkey. Pinned here as well as in the
+        -- inline ALTER, or the rebuild drops it and the ALTER re-adds it EMPTY — every revived
+        -- session then loses the key its ordering attestations are checked against, silently.
+        relay_anchor_hex TEXT,
+        -- DOD-M15-FREEZE-STATUS-1, carried for CELLO_Support's lane. Dropping these on upgrade would
+        -- un-freeze a session frozen because a party signed with a key that was not the
+        -- counterparty's — the failure that column exists to survive, reintroduced by the migration
+        -- that carries it.
+        frozen_at INTEGER,
+        frozen_reason TEXT,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "seal_interrupted_artifacts",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        own_leaf TEXT NOT NULL,
+        counterparty_leaf TEXT NOT NULL,
+        merkle_root TEXT NOT NULL,
+        nonce TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "session_tree_leaves",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        leaf_index INTEGER NOT NULL,
+        leaf_kind TEXT NOT NULL,
+        leaf_hash_hex TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, leaf_index)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "transcript",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        sequence INTEGER NOT NULL,
+        direction TEXT NOT NULL,
+        blob BLOB NOT NULL,
+        created_at INTEGER NOT NULL,
+        -- DOD-M15-SEALWIRE-1 bullet 5. THE SECOND ENTRY. session-node-manager adds these by
+        -- inline ALTER before this rebuild runs, and the rebuild copies only the INTERSECTION --
+        -- so omitting them here DELETES a message's authorship proof on the one boot a legacy
+        -- database upgrades, then re-adds the columns empty. A transcript that silently stops
+        -- proving who wrote what is worse than one that never claimed to.
+        sender_pubkey TEXT,
+        sender_sig BLOB,
+        attribution TEXT NOT NULL DEFAULT 'local_session_state',
+        -- DOD-M15-REFUSEDEVIDENCE-1. THE THIRD ENTRY, and the note above is why it is here: the
+        -- rebuild copies only the INTERSECTION of columns, so leaving this out would silently drop
+        -- every retained refusal's REASON on the one boot a legacy database upgrades — turning
+        -- kept evidence into an unexplained blob. Same trap, third column.
+        quarantine_reason TEXT,
+        PRIMARY KEY (agent_id, session_id, sequence, direction)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "message_watermarks",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        last_delivered_seq INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "contacts",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        pubkey TEXT NOT NULL,
+        added_at INTEGER NOT NULL,
+        moniker TEXT,
+        PRIMARY KEY (agent_id, pubkey)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        // The SEVENTH. DOD-LOOP-1 added `agent_name` here so two of the operator's agents could hold
+        // awaiting content for the SAME session_id without colliding — then left the agent OUT of the
+        // uniqueness constraint, which stayed `UNIQUE(session_id, nonce_hex)`. For an awaiting row,
+        // nonce_hex IS the content hash, so two local agents parking identical content in one session
+        // collided, and the collision was swallowed into memory and lost on the next restart.
+        //
+        // The correct constraint falls out of the re-key. It is expressed as a UNIQUE INDEX over
+        // COALESCE(agent_id, '') rather than a table constraint, because SQLite treats NULLs as DISTINCT
+        // in a UNIQUE constraint: with a bare UNIQUE(agent_id, session_id, nonce_hex), the legacy
+        // agent-less direct-retry rows (agent_id NULL) would lose the (session_id, nonce_hex) dedup they
+        // have always had. COALESCE folds every agent-less row into one bucket, preserving exactly the
+        // old semantics for them while giving each agent its own namespace.
+        table: "retry_queue",
+        backfill: "nullable",
+        /**
+         * ⚠️ THREE COLUMNS WERE MISSING FROM THE DDL BELOW. NOTHING WAS EVER LOST — AND WHAT KEPT IT
+         * THAT WAY IS THE ORDER OF TWO CALLS, NOT A CHECK.
+         *
+         * ⚠️ THIS COMMENT PREVIOUSLY CALLED IT *"a live data-loss bug"*, and that was WRONG. The other
+         * lane disproved it against git history and I verified it independently rather than take it:
+         * this re-key shipped 2026-07-10, `structure1_cbor` / `structure2_cbor` arrived in
+         * `retry-queue.ts` on 2026-08-05, and the re-key is one-shot. Every database that has ever run
+         * it did so a month before the columns existed, so there was never an ordering record present to
+         * drop. Recording the correction here because a comment stating a live bug that is not live is
+         * exactly the artifact this milestone keeps finding — one with the FORM of a verified finding
+         * and no verification behind it.
+         *
+         * **The real property, which is narrower and more fragile than the claim it replaces.** The
+         * rebuild copies the INTERSECTION of the two column lists, so omitting a column here does drop
+         * it — that mechanism is real and is what the header at the top of this file warns about. It is
+         * unreachable for this table only because `RetryQueue`'s constructor, which owns those
+         * `ALTER TABLE`s, runs AFTER `initialize()` — so at the moment this DDL executes, the columns do
+         * not exist to be copied. `daemon.ts` builds the queue long after it calls `initialize()`, and
+         * the source of that ordering is a convention (`retry-queue.ts`, "Do not reorder"), not a
+         * runtime check. `DOD-M15-MIGRATION-GUARD-1` is what stops the convention failing silently: it
+         * replays each ALTER-carrying table's inline ALTERs in the real boot order and asserts seeded
+         * VALUES survive across all seven rebuilt tables, so a column this DDL omits shows up as a
+         * failing test rather than as an empty column on an operator's machine after an upgrade. Keep
+         * the two together — the list below and that replay are one guard in two halves.
+         *
+         * So the columns are listed here anyway. They cost nothing while the order holds, and they are
+         * the difference between a silent loss and no loss on the day someone moves the construction up.
+         *
+         * What that loss WOULD cost, if it ever became reachable: those two columns are the relay's
+         * signed ordering record, carried so a parked entry is self-ordering on recovery. Without it the
+         * recipient places the content at its ARRIVAL index rather than its witnessed sequence, the two
+         * trees part, and the session can no longer seal bilaterally.
+         *
+         * `content_hash_alg` is `DOD-M15-SEALWIRE-1` part B2b's own column, added here in the same edit
+         * as the two it would otherwise have joined. It is why the omission was found at all.
+         *
+         * The existing guard could not see any of it: `dod-agent-id-joinkey-migration` replays the inline
+         * ALTERs in the real boot order, but only the `sessions` ones — `retry_queue`'s live in a
+         * different file and run from a different constructor. `DOD-M15-MIGRATION-GUARD-1` is what now
+         * covers the cross-file case.
+         */
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        id              INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id      TEXT    NOT NULL,
+        agent_id        TEXT,
+        nonce_hex       TEXT    NOT NULL,
+        content_blob    BLOB    NOT NULL,
+        queued_at       INTEGER NOT NULL,
+        attempts        INTEGER NOT NULL DEFAULT 1,
+        position        INTEGER NOT NULL,
+        awaiting_ack    INTEGER NOT NULL DEFAULT 0,
+        content_hash_hex TEXT,
+        structure1_cbor BLOB,
+        structure2_cbor BLOB,
+        -- 034-CARRYLEAF. Same trap as every column above, and the consequence here is the
+        -- withholding hole re-opening on the one boot a legacy database upgrades: a re-parked
+        -- message would reach its recipient with no signature over its ordering claim and no leaf
+        -- domain, so they could read it and never witness it, and it could never enter a receipt.
+        structure1_sig BLOB,
+        leaf_kind INTEGER,
+        content_hash_alg TEXT
+      )`,
+        indexSql: (t) => [
+            `CREATE INDEX IF NOT EXISTS retry_queue_by_session_position ON ${t}(session_id, position ASC)`,
+            `CREATE UNIQUE INDEX IF NOT EXISTS retry_queue_agent_session_nonce ON ${t}(COALESCE(agent_id, ''), session_id, nonce_hex)`,
+        ],
+    },
+];
+/**
+ * The tables this migration rebuilds, derived from `REKEY_TARGETS` rather than written out again.
+ *
+ * Exported for the guards (`dod-m15-migration-guard-1`), which must cover exactly what the
+ * migration touches. A hand-typed copy over there would silently get SHORTER than this list the day
+ * an eighth table is added — so the one table nobody remembered to guard would be the one table
+ * nobody checks, which is the shape of every escape this migration has already had.
+ */
+export const REKEYED_TABLES = REKEY_TARGETS.map((t) => t.table);
+function columnsOf(db, table) {
+    return db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
+}
+function tableExists(db, table) {
+    return (db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== undefined);
+}
+/**
+ * The `agent_name → agent_id` map, over ALL agent rows INCLUDING retired ones (a retired agent's rows
+ * must backfill to its OWN id and then sit inert — never be re-attributed to the live agent that
+ * reused its name).
+ *
+ * If any name resolves to more than one agent_id the map is AMBIGUOUS and the migration ABORTS. It
+ * does not guess, does not prefer the newest, does not prefer the oldest. A wrong attribution here
+ * would silently bind one identity's transcript, contacts and interrupted sessions to a DIFFERENT
+ * keypair — which is precisely the defect this migration exists to remove, except made permanent,
+ * unauditable, and blessed by a migration. A loud abort costs a wipe on a single-operator machine; a
+ * silent guess costs correctness forever.
+ *
+ * (A timestamp-based disambiguation is available in principle — rows written after the new agent's
+ * creation must belong to it, since a retired agent cannot write. It is deliberately NOT used: it
+ * depends on all seven tables carrying a trustworthy timestamp, and cleverness buys nothing on a
+ * database we would happily wipe.)
+ */
+function buildNameToAgentId(db) {
+    const rows = db
+        .prepare("SELECT agent_name, agent_id FROM agents")
+        .all();
+    const map = new Map();
+    const ambiguous = new Set();
+    for (const r of rows) {
+        if (map.has(r.agent_name))
+            ambiguous.add(r.agent_name);
+        map.set(r.agent_name, r.agent_id);
+    }
+    if (ambiguous.size > 0) {
+        throw new Error(`agent_id_backfill_ambiguous: agent name(s) [${[...ambiguous].sort().join(", ")}] resolve to more ` +
+            `than one agent_id (a retired agent's name was reused). The migration cannot know which identity ` +
+            `owns the existing session rows and refuses to guess — attributing them to the wrong keypair is ` +
+            `the very defect it exists to remove. Resolve by hand or start from a fresh database.`);
+    }
+    return map;
+}
+/** Does this table still need re-keying? True iff it exists and has no `agent_id` column. */
+function needsRekey(db, table) {
+    if (!tableExists(db, table))
+        return false;
+    return !columnsOf(db, table).includes("agent_id");
+}
+/**
+ * Re-key the seven child tables from `agent_name` to `agent_id`. Idempotent: a table that already has
+ * an `agent_id` column is skipped, so a second call is a no-op. All rebuilds share ONE transaction.
+ *
+ * Throws (leaving the database untouched) on:
+ *   - an ambiguous `agent_name → agent_id` map (a reused retired name),
+ *   - any row whose non-null `agent_name` does not resolve to an agent,
+ *   - any row count that does not match pre-migration.
+ *
+ * Never half-commits, never silently drops a row, never invents an agent_id.
+ */
+export function migrateSessionTablesToAgentId(db, logger) {
+    const pending = REKEY_TARGETS.filter((t) => needsRekey(db, t.table));
+    if (pending.length === 0)
+        return { migrated: false, rowCounts: {} };
+    // Ambiguity is checked BEFORE the transaction opens: nothing has been touched when it throws. It
+    // is logged with the same failure event as an in-transaction abort — a refusal to migrate is a
+    // loud event regardless of WHERE in the process it was detected.
+    let nameToId;
+    try {
+        nameToId = buildNameToAgentId(db);
+    }
+    catch (err) {
+        logger.error("daemon.migration.agent_id_backfill.failed", {
+            tables: pending.map((t) => t.table),
+            reason: extractErrorMessage(err),
+        });
+        throw err;
+    }
+    const before = new Map();
+    for (const t of pending) {
+        before.set(t.table, db.prepare(`SELECT COUNT(*) AS n FROM ${t.table}`).get().n);
+    }
+    const rowCounts = {};
+    // FOREIGN KEYS OFF, OUTSIDE THE TRANSACTION — and it must be outside, or it does nothing.
+    //
+    // `contacts` is one of the tables rebuilt below, and it is the FK PARENT of
+    // `contact_trust_signals` (M10 / DOD-STORE-CLIENT-1). Since M10-D19 turned FK enforcement ON,
+    // `DROP TABLE contacts` is an implicit DELETE that fires ON DELETE CASCADE and silently empties
+    // every received trust signal on every agent. The row-count guards below would not notice: they
+    // count `contacts`, not its children.
+    //
+    // And `PRAGMA foreign_keys` is a NO-OP inside a transaction — SQLite ignores it without a word —
+    // so disabling FKs after `BEGIN` (the intuitive place) would look correct and cascade anyway.
+    // `withForeignKeysOff` toggles it here, VERIFIES it took effect, and runs `PRAGMA
+    // foreign_key_check` on the way out so a rebuild that leaves a dangling reference fails loudly
+    // instead of surfacing as a mystery insert failure days later.
+    return withForeignKeysOff(db, logger, () => {
+        db.exec("BEGIN");
+        try {
+            for (const target of pending) {
+                const oldCols = columnsOf(db, target.table);
+                const tmp = `${target.table}_rekey_new`;
+                db.exec(target.createSql(tmp));
+                // Copy every column the OLD table has that the NEW table also has (minus agent_name, which is
+                // replaced by agent_id). A pre-DOD-LOOP-1 retry_queue lacks agent_name/awaiting_ack entirely;
+                // taking the intersection handles every historical shape without a per-version special case.
+                const newCols = columnsOf(db, tmp);
+                const carried = oldCols.filter((c) => c !== "agent_name" && c !== "id" && newCols.includes(c));
+                const hasName = oldCols.includes("agent_name");
+                if (hasName) {
+                    // Resolve through a JOIN on the parent so the mapping is the database's, not this process's.
+                    // An unresolvable row is DROPPED by the inner join and caught by the count check below —
+                    // for `strict` tables. For `nullable` (retry_queue), a NULL name must survive, so LEFT JOIN.
+                    const join = target.backfill === "strict" ? "JOIN" : "LEFT JOIN";
+                    db.exec(`INSERT INTO ${tmp} (agent_id${carried.length ? ", " + carried.join(", ") : ""})
+             SELECT a.agent_id${carried.length ? ", " + carried.map((c) => `t.${c}`).join(", ") : ""}
+             FROM ${target.table} t ${join} agents a ON a.agent_name = t.agent_name`);
+                }
+                else {
+                    // No name to resolve (pre-DOD-LOOP-1 retry_queue): agent_id stays NULL — "not agent-scoped".
+                    if (target.backfill === "strict") {
+                        throw new Error(`agent_id_backfill_impossible: table '${target.table}' has neither agent_name nor agent_id`);
+                    }
+                    db.exec(`INSERT INTO ${tmp} (${carried.join(", ")}) SELECT ${carried.map((c) => `t.${c}`).join(", ")} FROM ${target.table} t`);
+                }
+                const after = db.prepare(`SELECT COUNT(*) AS n FROM ${tmp}`).get().n;
+                const expected = before.get(target.table);
+                if (after !== expected) {
+                    throw new Error(`agent_id_backfill_row_count_mismatch: table '${target.table}' had ${expected} row(s) before and ` +
+                        `${after} after the copy. A row failed to resolve to an agent_id (orphaned ${target.table}.agent_name ` +
+                        `with no matching agents row), or a name matched more than one agent. Refusing to commit.`);
+                }
+                // Completeness. `strict` → every row must carry an agent_id. `nullable` → only rows that HAD a
+                // name must; a row that was always agent-less legitimately stays NULL.
+                const unresolved = target.backfill === "strict"
+                    ? db.prepare(`SELECT COUNT(*) AS n FROM ${tmp} WHERE agent_id IS NULL`).get().n
+                    : hasName
+                        ? db
+                            .prepare(`SELECT COUNT(*) AS n FROM ${target.table} t WHERE t.agent_name IS NOT NULL
+                       AND NOT EXISTS (SELECT 1 FROM agents a WHERE a.agent_name = t.agent_name)`)
+                            .get().n
+                        : 0;
+                if (unresolved > 0) {
+                    throw new Error(`agent_id_backfill_incomplete: table '${target.table}' has ${unresolved} row(s) whose agent could not ` +
+                        `be resolved to a stable agent_id. Refusing to commit a table with an unattributable row.`);
+                }
+                db.exec(`DROP TABLE ${target.table}`);
+                db.exec(`ALTER TABLE ${tmp} RENAME TO ${target.table}`);
+                for (const sql of target.indexSql(target.table))
+                    db.exec(sql);
+                rowCounts[target.table] = after;
+            }
+            db.exec("COMMIT");
+        }
+        catch (err) {
+            // SQLite may have already aborted the transaction; a failing ROLLBACK must not mask the real error.
+            try {
+                db.exec("ROLLBACK");
+            }
+            catch {
+                /* the failing statement may have already aborted the txn */
+            }
+            logger.error("daemon.migration.agent_id_backfill.failed", {
+                tables: pending.map((t) => t.table),
+                reason: extractErrorMessage(err),
+            });
+            throw err;
+        }
+        logger.info("daemon.migration.agent_id_backfill", {
+            tables: Object.keys(rowCounts),
+            rowCounts,
+            agentsMapped: nameToId.size,
+        });
+        return { migrated: true, rowCounts };
+    });
+}
+//# sourceMappingURL=agent-id-migration.js.map

package/dist/agent-id-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-id-migration.js","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkBzD;;;;;;;;;;;;;GAaG;AACH,MAAM,aAAa,GAA2B;IAC5C;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAgDd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;QAUd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;;;;;;;QAqBd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;QAKd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;QAMd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,EAAE;QACF,yFAAyF;QACzF,iGAAiG;QACjG,0FAA0F;QAC1F,iGAAiG;QACjG,+FAA+F;QAC/F,oEAAoE;QACpE,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,UAAU;QACpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAyCG;QACH,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;;;;;;QAoBd;QACJ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACf,iEAAiE,CAAC,4BAA4B;YAC9F,wEAAwE,CAAC,iDAAiD;SAC3H;KACF;CACO,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAQnF,SAAS,SAAS,CAAC,EAAkB,EAAE,KAAa;IAClD,OAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,WAAW,CAAC,EAAkB,EAAE,KAAa;IACpD,OAAO,CACL,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,CACrG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB,CAAC,EAAkB;IAC5C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,yCAAyC,CAAC;SAClD,GAAG,EAAgE,CAAC;IAEvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACjG,kGAAkG;YAClG,iGAAiG;YACjG,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,EAAkB,EAAE,KAAa;IACnD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAkB,EAAE,MAAc;IAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEpE,iGAAiG;IACjG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAG,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,0FAA0F;IAC1F,EAAE;IACF,4EAA4E;IAC5E,8FAA8F;IAC9F,gGAAgG;IAChG,gGAAgG;IAChG,sCAAsC;IACtC,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,kFAAkF;IAClF,+FAA+F;IAC/F,+DAA+D;IAC/D,OAAO,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,YAAY,CAAC;gBAExC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE/B,8FAA8F;gBAC9F,8FAA8F;gBAC9F,6FAA6F;gBAC7F,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAE/F,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,OAAO,EAAE,CAAC;oBACZ,6FAA6F;oBAC7F,yFAAyF;oBACzF,6FAA6F;oBAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;oBACjE,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,aAAa,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gCAC1D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;oBAChF,MAAM,CAAC,KAAK,MAAM,IAAI,0CAA0C,CACzE,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,6FAA6F;oBAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,uCAAuC,CAC5F,CAAC;oBACJ,CAAC;oBACD,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,IAAI,CACtH,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;gBACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;gBAC3C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,KAAK,SAAS,QAAQ,qBAAqB;wBAChG,GAAG,KAAK,qEAAqE,MAAM,CAAC,KAAK,cAAc;wBACvG,0FAA0F,CAC7F,CAAC;gBACJ,CAAC;gBAED,+FAA+F;gBAC/F,uEAAuE;gBACvE,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAC1B,CAAC,CAAE,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC;oBAClG,CAAC,CAAC,OAAO;wBACP,CAAC,CACG,EAAE;6BACC,OAAO,CACN,6BAA6B,MAAM,CAAC,KAAK;iGACkC,CAC5E;6BACA,GAAG,EACP,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC,CAAC;gBACV,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,SAAS,UAAU,gCAAgC;wBACrG,0FAA0F,CAC7F,CAAC;gBACJ,CAAC;gBAED,EAAE,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtC,EAAE,CAAC,IAAI,CAAC,eAAe,GAAG,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAE9D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;YAClC,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oGAAoG;YACpG,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;YAChD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,SAAS;YACT,YAAY,EAAE,QAAQ,CAAC,IAAI;SAC5B,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agent-loader.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Agent identity loader for the CELLO daemon.
+ *
+ * Agents are enumerated from the encrypted `agents` table — ONE loading path. There is no flat-file
+ * fallback: on-disk key files are imported into the `agents` table by the one-time migration
+ * (identity-migration.ts) before this loader runs.
+ *
+ * Each agent's K_local Ed25519 seed is stored as a BLOB column; the loader builds a sign-only
+ * InMemoryKeyProvider from it (the private scalar never leaves the provider — only signatures and
+ * content-seal opens are emitted).
+ */
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+export interface LoadedAgent {
+    name: string;
+    pubkey: string;
+    /**
+     * The agent's K_local signing key, retained so the daemon can produce K_local-signed control
+     * leaves (e.g. the SEAL-INTERRUPTED leaf). The private scalar never leaves this provider.
+     */
+    keyProvider: KeyProvider;
+}
+export interface FailedAgent {
+    name: string;
+    error: string;
+}
+export interface AgentLoadResult {
+    loaded: LoadedAgent[];
+    failed: FailedAgent[];
+}
+/**
+ * Load every agent from the encrypted `agents` table. A row whose seed is unusable (corrupt/wrong
+ * length) is reported as a failed agent and skipped — never silently dropped.
+ */
+export declare function loadAgents(db: DaemonDatabase, logger: Logger): Promise<AgentLoadResult>;
+//# sourceMappingURL=agent-loader.d.ts.map

package/dist/agent-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loader.d.ts","sourceRoot":"","sources":["../src/agent-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB7F"}