@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/directory-bootstrap.js

@@ -0,0 +1,557 @@
+/**
+ * Directory endpoint bootstrap for the daemon.
+ *
+ * The logic lives here, not in the adapter: the daemon must not depend on the
+ * adapter, which sits ABOVE it as a thin IPC proxy.
+ *
+ * Mechanism:
+ *   1. resolveDirectoryUrl(env): CELLO_DIRECTORY_URL or a random bundled endpoint.
+ *   2. GET ${url}/bootstrap → { multiaddr } containing "/p2p/<peerId>".
+ *   3. The peer ID is the segment after the final "/p2p/" in the multiaddr.
+ *
+ * The resolver caches the first successful resolution and re-attempts on each
+ * connect until it succeeds, so a daemon that starts before the directory is
+ * reachable will connect once the bootstrap endpoint comes up (the transport
+ * SignalingManager retries connect()).
+ */
+import { BUNDLED_CONSORTIUM_MANIFEST } from "./bundled-consortium-manifest.js";
+import { extractErrorMessage } from "./error-message.js";
+/**
+ * Production directory HTTP endpoint — the cold-boot fallback when CELLO_DIRECTORY_URL is unset.
+ *
+ * THIS MUST BE ONE OF THE `endpoint` VALUES IN THE BUNDLED MANIFEST, byte for byte. `buildManifestDeps`
+ * loads the bundled roster only when the resolved directory URL matches a node in it, and otherwise
+ * falls through to the pre-roster path with NO step-6 directory authentication — so a value that
+ * merely reaches the same machine, such as a DNS name for the same host, silently disables the
+ * defense against a MITM redirecting /bootstrap to a rogue directory. It fails open and quietly,
+ * which is why the requirement is stated here rather than left to be rediscovered. That the match
+ * is byte-exact and the miss is silent is `DOD-M15-STEP6-REPLAY-1` — tracked, not overlooked; the
+ * TLS half that made a single bundled name possible at all is `DOD-M15-BOOTSTRAP-TLS-1`.
+ *
+ * A NAME as of 2026-09-10, and the condition the previous comment set is exactly what changed: it
+ * said this "cannot be this constant until the manifest carries names", and the manifest now carries
+ * names. Every node sits behind its own regional load balancer terminating TLS, and the bundled
+ * roster moved to `https://directory-<region>.cello.mygentic.ai` in the same change. The two are
+ * only ever correct together.
+ *
+ * No port: 443, and the balancer's URL map routes /bootstrap, /manifest, /health, /agent-lookup and
+ * /registry to the node's HTTP listener while everything else — the libp2p WebSocket upgrade — goes
+ * to the protocol listener. One port now serves what needed two.
+ */
+export const PRODUCTION_DIRECTORY_URL = "https://directory-use1.cello.mygentic.ai";
+/**
+ * The bundled manifest's endpoint list, used by resolveDirectoryUrl to distribute cold-boot
+ * clients across the consortium instead of always landing on the same node.
+ *
+ * Import is lazy (inside the function) to avoid a circular dependency with bundled-consortium-manifest.
+ * Extracted as a separate export for testing.
+ */
+export function pickRandomBundledEndpoint(nodes) {
+    const endpoint = nodes[Math.floor(Math.random() * nodes.length)]["endpoint"];
+    return typeof endpoint === "string" ? endpoint : PRODUCTION_DIRECTORY_URL;
+}
+/**
+ * Resolve the directory URL from the environment, falling back to a RANDOMLY SELECTED
+ * bundled manifest endpoint when CELLO_DIRECTORY_URL is not set.
+ *
+ * Random, not fixed: every fresh daemon picks a different consortium node. Without this
+ * all clients land on the same node (whichever `PRODUCTION_DIRECTORY_URL` names), and the
+ * other nodes only ever appear as failover. That was fine with one user; it does not scale.
+ *
+ * The random pick changes on every process start. Daemons that are already running and have
+ * established a directory connection are unaffected — they stay connected to their current node
+ * and only re-pick on the next login/restart.
+ */
+export function resolveDirectoryUrl(env = process.env) {
+    if (env["CELLO_DIRECTORY_URL"])
+        return env["CELLO_DIRECTORY_URL"];
+    return pickRandomBundledEndpoint(BUNDLED_CONSORTIUM_MANIFEST.nodes);
+}
+/**
+ * DOD-M15-BOOTSTRAP-1 — retry budget for the bootstrap probe.
+ *
+ * Three attempts at 8 s, capped at 20 s in total. The numbers come from a measurement, not a guess:
+ * over a mobile link one probe returned at **16.2 s** and another returned nothing in 30 s, while
+ * the old code gave each node ONE attempt with a 5-second deadline. A packet lost during the TCP
+ * handshake is abandoned inside the retransmit backoff, and the node is dropped from the roster —
+ * for a normal user, on a normal lossy link, with nothing wrong anywhere in the system.
+ *
+ * A LONGER DEADLINE ALONE DOES NOT FIX IT, which is the counter-intuitive part and the reason this
+ * is a retry rather than a bigger number: the win comes from a FRESH CONNECTION. Waiting 20 s on
+ * the original socket keeps waiting on the same lost handshake; a new `fetch` starts a new one.
+ *
+ * The total cap exists so a genuinely dead node cannot hold startup for a minute — the roster has
+ * other nodes to try, and spending 3 × 8 s on the first one delays reaching them.
+ */
+const PROBE_ATTEMPTS = 3;
+const PROBE_TIMEOUT_MS = 8_000;
+const PROBE_TOTAL_BUDGET_MS = 20_000;
+/**
+ * Failure classes worth a second look. A lost packet, a DNS server that blinked, a connection
+ * refused during a node restart — all of these can succeed on a fresh connection moments later.
+ *
+ * `http_error` and `bad_response` are NOT here, deliberately: a 404, a 500, or a payload without a
+ * `/p2p/` is a deterministic answer from a server that IS reachable. Retrying it spends the whole
+ * budget to receive the same reply three times and delays every other node in the roster.
+ */
+const RETRYABLE = new Set(["timeout", "connect_error", "dns_error"]);
+/** DNS-level getaddrinfo failures vs transport-level connection failures. */
+const DNS_CODES = new Set(["ENOTFOUND", "EAI_AGAIN"]);
+/** Walk an error's `cause` chain for the first Node `code` (undici nests the coded error). */
+function findErrorCode(err) {
+    let cur = err;
+    for (let depth = 0; depth < 5 && cur instanceof Error; depth++) {
+        const code = cur.code;
+        if (typeof code === "string")
+            return code;
+        cur = cur.cause;
+    }
+    return null;
+}
+function classifyFetchError(err) {
+    if (err instanceof Error && err.name === "AbortError")
+        return { reason: "timeout", detail: "AbortError" };
+    const code = findErrorCode(err);
+    if (code !== null) {
+        if (DNS_CODES.has(code))
+            return { reason: "dns_error", detail: code };
+        return { reason: "connect_error", detail: code };
+    }
+    return { reason: "connect_error", detail: extractErrorMessage(err) };
+}
+/**
+ * The default: persistent. Used where nothing is waiting on the answer — the roster sweep, which
+ * runs its nodes in parallel and would rather spend 16 s than drop a healthy node.
+ */
+export const PERSISTENT_PROBE = {
+    attempts: PROBE_ATTEMPTS,
+    timeoutMs: PROBE_TIMEOUT_MS,
+    totalMs: PROBE_TOTAL_BUDGET_MS,
+};
+/**
+ * FAIL-FAST, for the reconnect path — review F1, a regression the retry introduced.
+ *
+ * `createDirectoryEndpointResolver` runs on EVERY connect attempt, and the signaling stream turns
+ * over roughly every 70 seconds. Giving that path the persistent budget meant a lossy link could
+ * spend 16 s resolving before falling back to the last-known-good endpoint it already had — and
+ * `outbound-sessions` waits only 10 s for signaling before giving up, so `cello_initiate_session`
+ * would start returning `directory_signaling_timeout` where it used to get a usable endpoint in
+ * time. A resilience fix that breaks the thing it was protecting.
+ *
+ * TWO PROBES AT 2 s, AND THE ARITHMETIC IS THE POINT. The blocked resolver has TWO legs inside that
+ * one 10 s wait — the primary, and then the roster sweep, whose `Promise.all` waits for the slowest
+ * node. So the budget has to fit TWICE: 2 × 2 s × 2 legs = 8 s, with headroom. A first attempt at
+ * 4 s looked generous and was wrong for exactly this reason, and the test that now asserts it
+ * against `SIGNALING_CONNECT_WAIT_MS` is what caught it.
+ *
+ * ISN'T 2 s TOO SHORT for a link where a probe was measured at 16.2 s? Yes — and that is the honest
+ * answer rather than a problem. Inside a 10 s deadline you cannot afford a 16 s probe from either
+ * leg, so pretending to try is how the deadline gets blown and the caller gets NOTHING. Failing fast
+ * here preserves the thing that actually helps on a bad link: the last-known-good endpoint, and a
+ * background sweep on the persistent budget that keeps the roster current without anyone waiting.
+ *
+ * The retry is still the mechanism — two probes means a second, FRESH connection, which is what
+ * recovers a lost handshake. One would be the original defect.
+ */
+export const FAST_PROBE = { attempts: 2, timeoutMs: 2_000, totalMs: 5_000 };
+export async function fetchBootstrapResult(directoryUrl, fetchFn = fetch, nowMs = Date.now, budget = PERSISTENT_PROBE) {
+    const started = nowMs();
+    let last = { ok: false, reason: "connect_error", detail: "no attempt was made" };
+    for (let attempt = 1; attempt <= budget.attempts; attempt++) {
+        last = await probeOnce(directoryUrl, fetchFn, budget.timeoutMs);
+        if (last.ok)
+            return { ...last, attempts: attempt };
+        if (!RETRYABLE.has(last.reason))
+            return { ...last, attempts: attempt };
+        // Stop if another full attempt cannot finish inside the budget — better to let the caller move
+        // on to the next node than to spend the remainder proving this one is still unreachable.
+        const spent = nowMs() - started;
+        if (attempt === budget.attempts || spent + budget.timeoutMs > budget.totalMs) {
+            return { ...last, attempts: attempt };
+        }
+    }
+    return { ...last, attempts: budget.attempts };
+}
+/**
+ * ONE probe, on its OWN connection. Separated from the retry loop above precisely because the fresh
+ * connection is the mechanism — each call is a new `fetch`, so a handshake lost in TCP backoff is
+ * abandoned rather than waited out.
+ */
+async function probeOnce(directoryUrl, fetchFn, timeoutMs) {
+    const bootstrapUrl = `${directoryUrl.replace(/\/$/, "")}/bootstrap`;
+    const ac = new AbortController();
+    const timeout = setTimeout(() => ac.abort(), timeoutMs);
+    try {
+        let resp;
+        try {
+            resp = await fetchFn(bootstrapUrl, { signal: ac.signal });
+        }
+        catch (err) {
+            return { ok: false, ...classifyFetchError(err) };
+        }
+        if (!resp.ok)
+            return { ok: false, reason: "http_error", detail: String(resp.status) };
+        let json;
+        try {
+            json = (await resp.json());
+        }
+        catch (err) {
+            /**
+             * AN ABORTED BODY READ IS A TIMEOUT, NOT A MALFORMED PAYLOAD — review F3.
+             *
+             * The deadline covers the body as well as the request, so a server that sends headers and
+             * then stalls — the ordinary shape of a lossy mobile link, which is this unit's entire
+             * subject — aborts inside `resp.json()`. Reporting that as `bad_response` was wrong twice:
+             * it sent the operator to inspect a payload that was never received, and `bad_response` is
+             * deliberately NOT retryable, so the node got one probe and was dropped. Precisely the
+             * outcome the retry exists to prevent, reached through the retry's own policy.
+             */
+            const classified = classifyFetchError(err);
+            if (classified.reason === "timeout" || ac.signal.aborted) {
+                // Both conditions, deliberately. The signal alone is what production sees when the deadline
+                // fires, but keying ONLY on it makes the behaviour depend on controller state rather than on
+                // what was actually thrown — untestable, and wrong the moment a body read aborts for any
+                // other reason. `classifyFetchError` already knows an AbortError is a timeout; reuse it
+                // rather than growing a second opinion about the same error.
+                return { ok: false, reason: "timeout", detail: classified.detail ?? "aborted reading the response body" };
+            }
+            return { ok: false, reason: "bad_response", detail: extractErrorMessage(err) };
+        }
+        if (typeof json.multiaddr === "string" && json.multiaddr.includes("/p2p/")) {
+            return { ok: true, multiaddr: json.multiaddr };
+        }
+        return { ok: false, reason: "bad_response", detail: "multiaddr missing or lacks /p2p/" };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Auto-discover the directory multiaddr via GET /bootstrap on the directory HTTP
+ * endpoint. Returns the multiaddr (which embeds the peer ID after "/p2p/"), or null.
+ * Thin compatibility wrapper over fetchBootstrapResult (which carries the failure class).
+ */
+export async function fetchBootstrapMultiaddr(directoryUrl, fetchFn = fetch) {
+    const result = await fetchBootstrapResult(directoryUrl, fetchFn);
+    return result.ok ? result.multiaddr : null;
+}
+/**
+ * Extract the libp2p peer ID from a multiaddr — the segment after the final
+ * "/p2p/". Returns null if absent.
+ */
+export function parsePeerIdFromMultiaddr(multiaddr) {
+    const idx = multiaddr.lastIndexOf("/p2p/");
+    if (idx === -1)
+        return null;
+    const peerId = multiaddr.slice(idx + "/p2p/".length).split("/")[0];
+    return peerId && peerId.length > 0 ? peerId : null;
+}
+/**
+ * Validate + normalise a manifest node `endpoint` to the HTTP(S) base used for its
+ * `/bootstrap` probe, or return `null` if it is not a usable bootstrap base.
+ *
+ * CONTRACT: a manifest `endpoint` is the node's HTTP(S) `/bootstrap` base — production
+ * directories serve `/bootstrap` over plaintext HTTP on port 9090, directly (there is no load
+ * balancer in front of them), matching PRODUCTION_DIRECTORY_URL. 8080 on the same host speaks the
+ * libp2p WebSocket upgrade and answers plain HTTP with 400, so pointing this at 8080 resolves as
+ * zero reachable nodes from a perfectly valid manifest. The wss libp2p DIAL address is
+ * returned BY `/bootstrap`; it is NOT the endpoint. Do NOT accept (or port-guess) a
+ * `wss://host:443` value — mapping that to `http://host:443` speaks plaintext to the
+ * TLS port and silently fails. Anything
+ * that is not `http(s)://` (a bare multiaddr, a wss dial address, a typo) is a config
+ * error in officer-SIGNED data: return null so the caller logs it DISTINCTLY from a
+ * transient outage and never dials a wrong port. A single trailing slash is stripped
+ * (fetchBootstrapMultiaddr appends `/bootstrap`).
+ */
+export function mapEndpointToBootstrapBase(endpoint) {
+    const noSlash = endpoint.replace(/\/$/, "");
+    if (noSlash.startsWith("http://") || noSlash.startsWith("https://"))
+        return noSlash;
+    return null;
+}
+/**
+ * Resolve every consortium node in the manifest's node set to a live directory
+ * endpoint by probing each node's `/bootstrap` (in parallel, order preserved).
+ *
+ * AVAILABILITY-AWARE (the sovereign-node redundancy invariant): a node whose bootstrap is
+ * unreachable is SKIPPED with a warning — one node down must never strand the others,
+ * because a T-of-N ceremony only needs T of the N. Returns the resolved subset
+ * (possibly empty). The CALLER decides whether the resolved count meets the threshold;
+ * this function NEVER silently substitutes the single hardcoded endpoint for a missing
+ * node — that would defeat sovereignty by masking a down/forged node as healthy.
+ */
+export async function manifestNodesToEndpoints(nodes, opts) {
+    const fetchFn = opts.fetchFn ?? fetch;
+    const resolved = await Promise.all(nodes.map(async (node) => {
+        const base = mapEndpointToBootstrapBase(node.endpoint);
+        if (base === null) {
+            // PERMANENT config error in SIGNED manifest data — logged distinctly from a
+            // transient `unresolved` so a bad endpoint is never mistaken for a node that's
+            // merely down (fail loud, don't silently skip-as-if-outage).
+            opts.logger.error("directory.consortium.node.endpoint_invalid", {
+                nodeId: node.nodeId,
+                endpoint: node.endpoint,
+            });
+            return null;
+        }
+        const probe = await fetchBootstrapResult(base, fetchFn, Date.now, opts.probeBudget ?? PERSISTENT_PROBE);
+        if (!probe.ok) {
+            opts.logger.warn("directory.consortium.node.unresolved", {
+                nodeId: node.nodeId,
+                endpoint: node.endpoint,
+                reason: probe.reason,
+                detail: probe.detail,
+                // DOD-M15-BOOTSTRAP-1: how many probes were spent before giving up. Without it, a node
+                // dropped after one deterministic 404 and a node dropped after three timed-out probes on
+                // a lossy link read identically — and they call for opposite responses.
+                attempts: probe.attempts,
+            });
+            opts.onNodeUnresolved?.({
+                nodeId: node.nodeId,
+                endpoint: node.endpoint,
+                reason: probe.reason,
+                detail: probe.detail,
+                // Review F2: this is the OPERATOR SURFACE (it feeds cello_status), and it was left
+                // without the count while the log got it. This file's own comment says it: "a `warn` in
+                // the log is not a surface." One 404 and three timed-out probes are different problems.
+                attempts: probe.attempts,
+            });
+            return null;
+        }
+        /**
+         * DOD-M15-BOOTSTRAP-1 — a node that only answered on a RETRY is not the same as one that
+         * answered first time, and a silent success hides that difference.
+         *
+         * This is the operator's early warning: the link to that node is losing packets. Before the
+         * retry existed, the same conditions dropped it from the roster outright, and the log said
+         * only "unresolved". Reported at INFO, not WARN — nothing is wrong yet, and a warning that
+         * fires on a recovered probe would be noise.
+         */
+        if ((probe.attempts ?? 1) > 1) {
+            opts.logger.info("directory.consortium.node.resolved_after_retry", {
+                nodeId: node.nodeId,
+                endpoint: node.endpoint,
+                attempts: probe.attempts,
+                impact: "this node answered only after a repeated probe, which means the path to it is dropping packets; before the retry existed this node would have been skipped entirely",
+            });
+        }
+        const multiaddr = probe.multiaddr;
+        const peerId = parsePeerIdFromMultiaddr(multiaddr);
+        if (!peerId) {
+            opts.logger.error("directory.consortium.node.no_peer_id", { nodeId: node.nodeId, multiaddr });
+            return null;
+        }
+        // The manifest DECLARES this node's peer id, and it is inside the signed body — so when the
+        // plaintext /bootstrap probe answers with a different one, the signed roster and the live
+        // response disagree about who this node is. Refuse rather than dial.
+        //
+        // Without this the declared value was decorative: the client dialled whatever the probe
+        // returned and the signature covered a field nobody read. Step-6 still authenticates the
+        // directory by challenge, so this is defence in depth at the DIAL layer — it declines to open a
+        // connection to the wrong peer at all, instead of opening one and rejecting it a round later.
+        //
+        // Absent `peerId` is tolerated: manifests written before the field existed carry none, and
+        // treating "not declared" as "mismatch" would strand every node in them.
+        const declaredPeerId = node.peerId;
+        if (declaredPeerId && declaredPeerId !== peerId) {
+            opts.logger.error("directory.consortium.node.peer_id_mismatch", {
+                nodeId: node.nodeId,
+                declaredPeerId,
+                probePeerId: peerId,
+            });
+            return null;
+        }
+        return { nodeId: node.nodeId, pubkey: node.pubkey, peerId, multiaddr };
+    }));
+    return resolved.filter((e) => e !== null);
+}
+/**
+ * Build an async `getDirectoryEndpoint` for createSignalingConnect.
+ *
+ * Re-resolves the bootstrap on EVERY call (i.e. every connect attempt) so a
+ * directory address change — failover, DNS/port change, or peer-ID rotation — is
+ * picked up on the next reconnect. The last successfully-resolved endpoint is kept
+ * only as a fallback: if a fresh fetch fails, the resolver returns the last
+ * known-good endpoint so a transient /bootstrap blip doesn't strand a working daemon.
+ */
+export function createDirectoryEndpointResolver(opts) {
+    const directoryUrl = opts.directoryUrl ?? resolveDirectoryUrl();
+    const fetchFn = opts.fetchFn ?? fetch;
+    const staleFallback = opts.staleFallback ?? true;
+    let lastGood = null;
+    return async function getDirectoryEndpoint() {
+        // FAST_PROBE, not the persistent one: a caller is blocked on this. See its definition.
+        const probe = await fetchBootstrapResult(directoryUrl, fetchFn, Date.now, FAST_PROBE);
+        if (probe.ok) {
+            const multiaddr = probe.multiaddr;
+            const peerId = parsePeerIdFromMultiaddr(multiaddr);
+            if (peerId) {
+                // Log only when the resolved endpoint actually changes (avoids per-connect noise).
+                if (!lastGood || lastGood.multiaddr !== multiaddr) {
+                    opts.logger.info("directory.bootstrap.resolved", { directoryUrl, peerId });
+                }
+                lastGood = { peerId, multiaddr };
+                return lastGood;
+            }
+            opts.logger.error("directory.bootstrap.no_peer_id", { directoryUrl, multiaddr });
+        }
+        else {
+            opts.logger.warn("directory.bootstrap.unavailable", {
+                directoryUrl,
+                reason: probe.reason,
+                detail: probe.detail,
+            });
+        }
+        // Fresh resolution failed — reuse the last known-good endpoint if we have one AND stale fallback
+        // is enabled. When disabled (the failover-wrapper's primary probe), a fresh failure is reported
+        // as null so the roster can take over instead of the caller looping on a dead endpoint.
+        if (staleFallback && lastGood) {
+            opts.logger.warn("directory.bootstrap.using_last_known", { directoryUrl, peerId: lastGood.peerId });
+            return lastGood;
+        }
+        return null;
+    };
+}
+/** In-place-safe Fisher-Yates shuffle returning a NEW array (never mutates the input). */
+function fisherYatesShuffle(items) {
+    const out = items.slice();
+    for (let i = out.length - 1; i > 0; i--) {
+        const j = Math.floor(Math.random() * (i + 1));
+        [out[i], out[j]] = [out[j], out[i]];
+    }
+    return out;
+}
+/**
+ * Wrap a single-node primary resolver with the consortium roster so the signaling
+ * dialer (and the ceremony endpoint that shares this instance) route AROUND a down
+ * primary directory node instead of retrying the single primary URL forever — the
+ * sovereign-node REDUNDANCY invariant.
+ *
+ * Selection policy, per getDirectoryEndpoint() call:
+ *   1. Sticky-until-fail — while riding a non-primary fallback, KEEP it as long as it's
+ *      still in the reachable roster. Do NOT churn back to the primary when it recovers
+ *      (no flapping / reconnect storm). The fallback's multiaddr is refreshed from the
+ *      fresh roster match each call.
+ *   2. Primary-first — otherwise try the configured node. This is also the healthy
+ *      steady state: when the primary resolves, we return WITHOUT probing the roster
+ *      (no per-connect roster cost while everything is nominal).
+ *   3. Fallback — if the primary is down, fail over to a reachable roster member. The
+ *      order is randomized (across the members other than the dead primary) so clients
+ *      spread across the survivors. Emits directory.bootstrap.failover on a change so an
+ *      operator sees the client is now running on a non-home node.
+ *   4. Return null only when NOTHING resolves (primary down AND roster empty/absent) —
+ *      the unchanged all-nodes-down failure mode, no crash.
+ *
+ * ONE instance is shared across the daemon's signaling connect and its ceremony
+ * getDirectoryEndpoint so signaling + ceremonies stay on the SAME directory node and
+ * fail over together (a coherent per-daemon directory selection).
+ *
+ * Scope note: stickiness here is by ROSTER REACHABILITY, not by observed connect success
+ * — the resolver is not told whether a dial/auth against the returned endpoint actually
+ * succeeded. A node whose /bootstrap resolves is served by that same node, so resolvable ≈
+ * connectable in practice; only a live kill-primary failover test proves that presence
+ * resolution, relay assignment, and the FROST ceremony all work against a non-home directory.
+ */
+export function createRosterAwareEndpointResolver(opts) {
+    const shuffle = opts.shuffle ?? fisherYatesShuffle;
+    // The endpoint we last returned, and whether it is a non-primary fallback we're riding.
+    let current = null;
+    let stuckToFallback = false;
+    // The primary's own identity, learned whenever the primary last resolved. Used to EXCLUDE the
+    // primary from the fallback set even when `current` no longer points at it — a flapping primary
+    // whose independent roster probe still lists it must never be re-picked as its own fallback.
+    let primaryPeerId = null;
+    /** Pick a reachable roster member that is neither the current pointer nor the primary. */
+    function selectFallback(roster) {
+        const excluded = new Set([current?.peerId, primaryPeerId].filter((p) => !!p));
+        const others = roster.filter((e) => !excluded.has(e.peerId));
+        const ordered = shuffle(others.length > 0 ? others : roster);
+        const chosen = ordered[0];
+        const next = { peerId: chosen.peerId, multiaddr: chosen.multiaddr };
+        if (!current || current.peerId !== chosen.peerId) {
+            opts.logger.warn("directory.bootstrap.failover", {
+                from: current?.peerId ?? null,
+                to: chosen.peerId,
+                nodeId: chosen.nodeId,
+            });
+        }
+        current = next;
+        stuckToFallback = true;
+        return next;
+    }
+    return async function getDirectoryEndpoint() {
+        // 1. Sticky-until-fail: keep the current fallback while it is still reachable.
+        if (stuckToFallback && current) {
+            const roster = await opts.getConsortiumRoster();
+            const match = roster?.find((e) => e.peerId === current.peerId);
+            if (match) {
+                // Refresh the multiaddr from the fresh roster resolution; identity is unchanged.
+                current = { peerId: match.peerId, multiaddr: match.multiaddr };
+                return current;
+            }
+            // The fallback fell out of the reachable roster → re-select below.
+            opts.logger.warn("directory.bootstrap.failover.lost", { peerId: current.peerId });
+        }
+        // 2. Primary-first (and the healthy steady state — no roster probe once the primary is known
+        //    to be a consortium member).
+        const primary = await opts.primaryResolver();
+        if (primary) {
+            // A primary that RESOLVES but is not a MEMBER of this consortium is a black hole, and used to
+            // be a permanent one: failover triggered only on UNREACHABILITY, so the compiled-in default
+            // URL after a consortium move resolved forever while every connection died at step-6 identity
+            // auth with `key_not_in_manifest`. Reachability was never the right test.
+            //
+            // Checked against DECLARED manifest membership, never against the reachable roster. The
+            // roster is the set that answered /bootstrap just now; a genuine member that is momentarily
+            // down is absent from it, and disqualifying on that would route around a node that is merely
+            // restarting — turning a blip into a failover. Membership is also LOCAL, so this costs no
+            // probe at all and the healthy path is unchanged.
+            const members = opts.getManifestPeerIds?.() ?? null;
+            if (members && members.size > 0 && !members.has(primary.peerId)) {
+                opts.logger.warn("directory.bootstrap.primary.not_in_consortium", {
+                    peerId: primary.peerId,
+                    memberCount: members.size,
+                });
+                primaryPeerId = primary.peerId; // exclude it from the fallback pick below
+                const roster = await opts.getConsortiumRoster();
+                if (roster && roster.length > 0)
+                    return selectFallback(roster);
+                // No reachable member either — return null so the caller retries rather than hand back a
+                // directory we KNOW will reject us.
+                return null;
+            }
+            if (stuckToFallback) {
+                opts.logger.info("directory.bootstrap.failover", { to: primary.peerId, restored: true });
+            }
+            current = primary;
+            primaryPeerId = primary.peerId;
+            stuckToFallback = false;
+            return primary;
+        }
+        // 3. Primary is down → fail over to a reachable roster member (randomized order).
+        const roster = await opts.getConsortiumRoster();
+        if (roster && roster.length > 0) {
+            // Exclude the (now-dead/flapping) primary and the current pointer; any OTHER reachable member
+            // is valid. Falls back to the full roster only if excluding leaves nothing (all members are
+            // the excluded ones — e.g. the roster is just the primary itself).
+            const excluded = new Set([current?.peerId, primaryPeerId].filter((p) => !!p));
+            const others = roster.filter((e) => !excluded.has(e.peerId));
+            const ordered = shuffle(others.length > 0 ? others : roster);
+            const chosen = ordered[0];
+            const next = { peerId: chosen.peerId, multiaddr: chosen.multiaddr };
+            if (!current || current.peerId !== chosen.peerId) {
+                opts.logger.warn("directory.bootstrap.failover", {
+                    from: current?.peerId ?? null,
+                    to: chosen.peerId,
+                    nodeId: chosen.nodeId,
+                });
+            }
+            current = next;
+            stuckToFallback = true;
+            return next;
+        }
+        // 4. Nothing resolves.
+        return null;
+    };
+}
+//# sourceMappingURL=directory-bootstrap.js.map

package/dist/directory-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-bootstrap.js","sourceRoot":"","sources":["../src/directory-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAG/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,0CAA0C,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAA6C;IAE7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC7E,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,IAAI,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,OAAO,yBAAyB,CAAC,2BAA2B,CAAC,KAA+C,CAAC,CAAC;AAChH,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAwC,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1G,6EAA6E;AAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAEtD,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,YAAY,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAI,GAAkC,CAAC,IAAI,CAAC;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC1G,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAgB;IAC3C,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,gBAAgB;IAC3B,OAAO,EAAE,qBAAqB;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,UAAwB,KAAK,EAC7B,QAAsB,IAAI,CAAC,GAAG,EAC9B,SAAsB,gBAAgB;IAEtC,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;IACxB,IAAI,IAAI,GAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAElG,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAEvE,+FAA+F;QAC/F,yFAAyF;QACzF,MAAM,KAAK,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QAChC,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,YAAoB,EAAE,OAAqB,EAAE,SAAiB;IACrF,MAAM,YAAY,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC;IACpE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QACxD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB;;;;;;;;;eASG;YACH,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzD,4FAA4F;gBAC5F,6FAA6F;gBAC7F,yFAAyF;gBACzF,wFAAwF;gBACxF,6DAA6D;gBAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,mCAAmC,EAAE,CAAC;YAC5G,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,UAAwB,KAAK;IAE7B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAgBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AA+CD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAgC,EAChC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAsC,EAAE;QAC3D,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,4EAA4E;YAC5E,+EAA+E;YAC/E,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,uFAAuF;gBACvF,yFAAyF;gBACzF,wEAAwE;gBACxE,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,mFAAmF;gBACnF,wFAAwF;gBACxF,wFAAwF;gBACxF,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD;;;;;;;;WAQG;QACH,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBACjE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EACJ,qKAAqK;aACxK,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,4FAA4F;QAC5F,0FAA0F;QAC1F,qEAAqE;QACrE,EAAE;QACF,wFAAwF;QACxF,yFAAyF;QACzF,gGAAgG;QAChG,8FAA8F;QAC9F,EAAE;QACF,2FAA2F;QAC3F,yEAAyE;QACzE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,cAAc,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,cAAc;gBACd,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAoBD;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,IAAI,QAAQ,GAA6B,IAAI,CAAC;IAE9C,OAAO,KAAK,UAAU,oBAAoB;QACxC,uFAAuF;QACvF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAClC,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,mFAAmF;gBACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAClD,YAAY;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QACD,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAgCD,0FAA0F;AAC1F,SAAS,kBAAkB,CAAI,KAAU;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,wFAAwF;IACxF,IAAI,OAAO,GAA6B,IAAI,CAAC;IAC7C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,aAAa,GAAkB,IAAI,CAAC;IAExC,0FAA0F;IAC1F,SAAS,cAAc,CAAC,MAA4B;QAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAC/C,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;gBAC7B,EAAE,EAAE,MAAM,CAAC,MAAM;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,UAAU,oBAAoB;QAGxC,+EAA+E;QAC/E,IAAI,eAAe,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAQ,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iFAAiF;gBACjF,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,6FAA6F;QAC7F,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,8FAA8F;YAC9F,4FAA4F;YAC5F,8FAA8F;YAC9F,0EAA0E;YAC1E,EAAE;YACF,wFAAwF;YACxF,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,IAAI,CAAC;YACpD,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW,EAAE,OAAO,CAAC,IAAI;iBAC1B,CAAC,CAAC;gBACH,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,0CAA0C;gBAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAChD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC/D,yFAAyF;gBACzF,oCAAoC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,GAAG,OAAO,CAAC;YAClB,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,eAAe,GAAG,KAAK,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,8FAA8F;YAC9F,4FAA4F;YAC5F,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBAC/C,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;oBAC7B,EAAE,EAAE,MAAM,CAAC,MAAM;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,eAAe,GAAG,IAAI,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uBAAuB;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/directory-connect.d.ts

@@ -0,0 +1,27 @@
+/**
+ * How this daemon reaches a directory, and what it tells a relay about itself when it gets there.
+ *
+ * The relay-witness connect parameters — who is asking, over which circuit, with which online token
+ * — and the default signaling connect that carries them. Also the single shared signaling manager,
+ * which exists ONLY on the in-process test path: in production every agent dials its own, because
+ * the directory routes by the pubkey that authenticated the stream.
+ */
+import { SignalingManager, type CelloNode } from "@cello-protocol/transport";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { Logger } from "./types.js";
+import type { DirectoryEndpoint } from "./signaling-connect.js";
+import type { RelayConnectParams } from "./session-node-manager.js";
+import { parseSessionAssignment } from "./session-assignment-parser.js";
+export interface DirectoryConnectDeps {
+    logger: Logger;
+    keyProviders: Map<string, KeyProvider>;
+    /** Test seam. Its ABSENCE is what puts the daemon on the production per-agent path. */
+    signalingConnect: ConstructorParameters<typeof SignalingManager>[0]["connect"] | undefined;
+    directoryEndpointResolver: (() => Promise<DirectoryEndpoint | null>) | undefined;
+}
+export declare function createDirectoryConnect(deps: DirectoryConnectDeps): {
+    buildRelayConnectParams: (agentName: string, assignment: NonNullable<ReturnType<typeof parseSessionAssignment>>) => Promise<RelayConnectParams | undefined>;
+    noSharedDirectoryNode: () => CelloNode | null;
+    sharedSignaling: SignalingManager | undefined;
+};
+//# sourceMappingURL=directory-connect.d.ts.map

package/dist/directory-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-connect.d.ts","sourceRoot":"","sources":["../src/directory-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAsB,MAAM,2BAA2B,CAAC;AACjG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,uFAAuF;IACvF,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC3F,yBAAyB,EAAE,CAAC,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CAClF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB;yCASlD,MAAM,cACL,WAAW,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,KACjE,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;iCA6ER,SAAS,GAAG,IAAI;;EAgBnD"}