@cello-protocol/daemon 0.0.228 → 0.0.230

package/dist/channel-collect-tick.d.ts

@@ -0,0 +1,36 @@
+import type { Logger } from "./types.js";
+import type { ChannelCollector } from "./channel-collector.js";
+import type { ChannelSubscriptionStore } from "./channel-subscription-store.js";
+/** See the header: bounded by the shortest retention any channel may configure. */
+export declare const COLLECT_TICK_INTERVAL_MS: number;
+/** The widest the pubkey-derived offset can push a channel's tick. */
+export declare const COLLECT_JITTER_MS = 60000;
+/** A failing channel is backed off to at most this, then stays there until it succeeds. */
+export declare const COLLECT_MAX_BACKOFF_MS: number;
+export interface ChannelCollectTickDeps {
+    logger: Logger;
+    collector: ChannelCollector;
+    subscriptions: ChannelSubscriptionStore;
+    /**
+     * Whether this agent is ONLINE. Collecting for an agent the operator switched off is the kill
+     * switch failing to switch something off — the same rule the trust-signal tick follows.
+     */
+    isAgentOnline: (agentId: string) => boolean;
+    intervalMs?: number;
+    jitterMs?: number;
+    maxBackoffMs?: number;
+}
+export interface ChannelCollectTicker {
+    /** Begin collecting. Idempotent: a second call does not stack a second timer. */
+    start: () => void;
+    /** One pass over every active subscription. Exposed so a test drives it without a clock. */
+    collectAllDue: (now: number) => Promise<void>;
+    stop: () => void;
+}
+/**
+ * A stable offset in [0, jitterMs) for a channel, from its public key. Same channel, same
+ * subscriber, same offset every time — see the header for why that beats a fresh random each tick.
+ */
+export declare function jitterForChannel(channelHex: string, agentId: string, jitterMs: number): number;
+export declare function createChannelCollectTicker(deps: ChannelCollectTickDeps): ChannelCollectTicker;
+//# sourceMappingURL=channel-collect-tick.d.ts.map

package/dist/channel-collect-tick.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-collect-tick.d.ts","sourceRoot":"","sources":["../src/channel-collect-tick.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGhF,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,QAAa,CAAC;AACnD,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAElD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,gBAAgB,CAAC;IAC5B,aAAa,EAAE,wBAAwB,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,4FAA4F;IAC5F,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI9F;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,sBAAsB,GAAG,oBAAoB,CAgF7F"}

package/dist/channel-collect-tick.js

@@ -0,0 +1,133 @@
+/**
+ * M16 018-PUBCOLLECT — what actually RUNS the collector.
+ *
+ * ⚠️ **WITHOUT THIS, SUBSCRIBING DOES NOTHING.** `ChannelCollector` fetches when it is called, and
+ * a subscriber has nobody to call it: there is no inbound event for a channel post — the relay holds
+ * a queue and waits to be asked. A collector nobody schedules is a subscriber who never receives
+ * anything, with every component reporting healthy. The publishing half shipped wired and this half
+ * did not, which is the same hole twice in one milestone.
+ *
+ * ─── The interval, and why it is bounded by retention ────────────────────────────────────────
+ *
+ * A relay drops posts on its own schedule. If the gap between collections is longer than a channel's
+ * retention, a subscriber can miss a post that was delivered, held for its full life and swept —
+ * never seeing it, and never recording a gap either, because the number is below the floor by the
+ * time anyone looks. The interval therefore has to stay well under the shortest retention any
+ * channel uses, and the default retention is seven days. Five minutes is three orders of magnitude
+ * inside that, which is the margin this needs to be safe against a channel configured far shorter.
+ *
+ * ─── Jitter is derived from the channel key, not random ──────────────────────────────────────
+ *
+ * Every subscriber to a popular channel would otherwise poll its two relays at the same moment —
+ * the relays see the entire audience arrive at once, every interval, for ever. The offset is
+ * derived from the channel's public key so it is STABLE for a given subscriber: a random offset
+ * re-rolled each tick spreads the load just as well but makes the cadence unpredictable to the
+ * operator watching it, and makes a slow channel impossible to distinguish from a jittery one.
+ *
+ * ─── Backoff is per channel, and only on FAILURE ─────────────────────────────────────────────
+ *
+ * A channel whose relays are both down is asked less and less often, up to a ceiling, so a dead
+ * channel costs little. Any success resets it immediately: the point is to stop hammering something
+ * broken, not to punish a channel for a bad afternoon.
+ */
+import { createHash } from "node:crypto";
+import { extractErrorMessage } from "./error-message.js";
+/** See the header: bounded by the shortest retention any channel may configure. */
+export const COLLECT_TICK_INTERVAL_MS = 5 * 60_000;
+/** The widest the pubkey-derived offset can push a channel's tick. */
+export const COLLECT_JITTER_MS = 60_000;
+/** A failing channel is backed off to at most this, then stays there until it succeeds. */
+export const COLLECT_MAX_BACKOFF_MS = 30 * 60_000;
+/**
+ * A stable offset in [0, jitterMs) for a channel, from its public key. Same channel, same
+ * subscriber, same offset every time — see the header for why that beats a fresh random each tick.
+ */
+export function jitterForChannel(channelHex, agentId, jitterMs) {
+    if (jitterMs <= 0)
+        return 0;
+    const digest = createHash("sha256").update(`${agentId}:${channelHex}`, "utf8").digest();
+    return digest.readUInt32BE(0) % jitterMs;
+}
+export function createChannelCollectTicker(deps) {
+    const { logger, collector, subscriptions, isAgentOnline } = deps;
+    const intervalMs = deps.intervalMs ?? COLLECT_TICK_INTERVAL_MS;
+    const jitterMs = deps.jitterMs ?? COLLECT_JITTER_MS;
+    const maxBackoffMs = deps.maxBackoffMs ?? COLLECT_MAX_BACKOFF_MS;
+    /** When each subscription is next due, and how far it has been backed off. */
+    const nextDue = new Map();
+    const backoff = new Map();
+    /**
+     * Subscriptions with a pass still running. A tick that lands on one is SKIPPED rather than
+     * queued: a slow relay would otherwise stack passes that all fetch the same posts, and each one
+     * holds a database write.
+     */
+    const inFlight = new Set();
+    let timer = null;
+    const keyOf = (agentId, channelHex) => `${agentId}:${channelHex}`;
+    async function collectAllDue(now) {
+        for (const sub of subscriptions.active()) {
+            const key = keyOf(sub.agent_id, sub.channel_pubkey);
+            if (inFlight.has(key))
+                continue;
+            // Checked PER SUBSCRIPTION, not once for the pass: one agent being offline must not stop
+            // another agent's channels from collecting.
+            if (!isAgentOnline(sub.agent_id))
+                continue;
+            const due = nextDue.get(key);
+            if (due === undefined) {
+                // First sight of this subscription: collect now, then settle into the jittered cadence. A
+                // new subscriber waiting a full interval for its first post looks broken and is.
+                nextDue.set(key, now);
+            }
+            else if (now < due) {
+                continue;
+            }
+            inFlight.add(key);
+            try {
+                await collector.collectOnce(sub.agent_id, sub.channel_pubkey);
+                await collector.repairGaps(sub.agent_id, sub.channel_pubkey);
+                backoff.delete(key);
+                nextDue.set(key, now + intervalMs + jitterForChannel(sub.channel_pubkey, sub.agent_id, jitterMs));
+            }
+            catch (err) {
+                // ⚠️ LOGGED, never swallowed and never fatal to the loop. A background collection that fails
+                // in silence is a subscriber who simply stops receiving, with nothing anywhere saying why —
+                // and one channel's bad relay must not stop every other channel on this daemon.
+                const next = Math.min(maxBackoffMs, (backoff.get(key) ?? intervalMs) * 2);
+                backoff.set(key, next);
+                nextDue.set(key, now + next + jitterForChannel(sub.channel_pubkey, sub.agent_id, jitterMs));
+                logger.warn("channel.collect.tick_failed", {
+                    channel_pubkey: sub.channel_pubkey,
+                    reason: extractErrorMessage(err),
+                    next_attempt_in_ms: next,
+                });
+            }
+            finally {
+                inFlight.delete(key);
+            }
+        }
+    }
+    return {
+        start() {
+            if (timer !== null)
+                return;
+            // The pass runs every interval and decides per subscription what is due; the jitter lives in
+            // the due times rather than in the timer, so one slow channel cannot drag the others.
+            timer = setInterval(() => {
+                void collectAllDue(Date.now()).catch((err) => {
+                    logger.warn("channel.collect.pass_failed", { reason: extractErrorMessage(err) });
+                });
+            }, intervalMs);
+            // Never hold the process open for a background poll.
+            timer.unref?.();
+            logger.info("channel.collect.started", { interval_ms: intervalMs, jitter_ms: jitterMs });
+        },
+        collectAllDue,
+        stop() {
+            if (timer !== null)
+                clearInterval(timer);
+            timer = null;
+        },
+    };
+}
+//# sourceMappingURL=channel-collect-tick.js.map

package/dist/channel-collect-tick.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-collect-tick.js","sourceRoot":"","sources":["../src/channel-collect-tick.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAC;AACnD,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,MAAM,CAAC;AAwBlD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAAe,EAAE,QAAgB;IACpF,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACxF,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAA4B;IACrE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,wBAAwB,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAEjE,8EAA8E;IAC9E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C;;;;OAIG;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,KAAK,GAA0B,IAAI,CAAC;IAExC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAU,EAAE,CAAC,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;IAE1F,KAAK,UAAU,aAAa,CAAC,GAAW;QACtC,KAAK,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YACpD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChC,yFAAyF;YACzF,4CAA4C;YAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAE3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,0FAA0F;gBAC1F,iFAAiF;gBACjF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxB,CAAC;iBAAM,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC9D,MAAM,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7D,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpG,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,6FAA6F;gBAC7F,4FAA4F;gBAC5F,gFAAgF;gBAChF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1E,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC5F,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACzC,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;oBAChC,kBAAkB,EAAE,IAAI;iBACzB,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;YACH,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO;YAC3B,6FAA6F;YAC7F,sFAAsF;YACtF,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,KAAK,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACpD,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnF,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,UAAU,CAAC,CAAC;YACf,qDAAqD;YACrD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,aAAa;QACb,IAAI;YACF,IAAI,KAAK,KAAK,IAAI;gBAAE,aAAa,CAAC,KAAK,CAAC,CAAC;YACzC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/channel-collector.d.ts

@@ -0,0 +1,99 @@
+/**
+ * ChannelCollector — M16 018-PUBCOLLECT, the subscriber half.
+ *
+ * A channel's two relays are **not coordinated**. Each holds its own queue, they disagree by design
+ * — different `first_held_seq`, different `last_seq`, different subsets — and none of that is an
+ * error. The subscriber fetches from both and takes the union.
+ *
+ * ⚠️ **EVERYTHING IS VERIFIED HERE.** Both signatures, the title rules, the size, and that the
+ * publishing agent is the admin THIS SUBSCRIBER knows for the channel. A relay's word that a post is
+ * good is worth nothing: the relay is a witness, not an authority, and the whole design assumes it
+ * may be hostile.
+ *
+ * ─── Two positions, and why a fetch may only move one ────────────────────────────────────────
+ *
+ *   delivered_through  how far the daemon has fetched and verified — moved here
+ *   processed_through  how far the AGENT has read — never touched here
+ *
+ * ─── The contiguous run ──────────────────────────────────────────────────────────────────────
+ *
+ * `delivered_through` advances only across an unbroken run. Holding 1, 2 and 4 leaves it at 2 —
+ * because advancing to 4 would mean post 3 is never delivered when it finally arrives, the position
+ * having already passed it. The gap is reported instead.
+ *
+ * ─── Forks ───────────────────────────────────────────────────────────────────────────────────
+ *
+ * Two different posts at one number means the channel signed both. Both are kept, the fork is
+ * reported with both hashes, and the position stops below it. Nothing is resolved automatically:
+ * picking one would make whichever relay answered first the arbiter of what the channel said.
+ */
+import type { Logger } from "./types.js";
+import { type ChannelAccess } from "@cello-protocol/protocol-types";
+import { ChannelInboxStore } from "./channel-inbox-store.js";
+import { ChannelSubscriptionStore } from "./channel-subscription-store.js";
+export type RelayFetchSeam = (relay: string, req: {
+    channel_pubkey: Uint8Array;
+    since_seq: number;
+    max_bytes: number;
+    auth?: {
+        signature: Uint8Array;
+        time_ms: number;
+    };
+    agent_pubkeys?: Uint8Array[];
+}) => Promise<{
+    ok: true;
+    posts: Array<{
+        seq: number;
+        post_cbor: Uint8Array;
+        receipt_cbor?: Uint8Array;
+    }>;
+    first_held_seq: number | null;
+    last_seq: number | null;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export interface ChannelCollectorOptions {
+    logger: Logger;
+    subscriptions: ChannelSubscriptionStore;
+    inbox: ChannelInboxStore;
+    fetch: RelayFetchSeam;
+    /** The fetch-key signature for a non-public channel. 019 owns the key; `undefined` means public. */
+    fetchAuth: (access: ChannelAccess, channelHex: string, sinceSeq: number) => Promise<{
+        signature: Uint8Array;
+        time_ms: number;
+    } | undefined>;
+    /** Local agent keys to declare for the reader count. Best-effort, and never affects delivery. */
+    localAgentKeys: (channelHex: string) => Uint8Array[];
+    /** Ask the PUBLISHER to re-deposit a range. It answers by re-depositing, never by sending posts. */
+    requestRepair: (agentId: string, channelHex: string, from: number, to: number) => Promise<void>;
+    now?: () => number;
+    maxBytesPerFetch?: number;
+}
+export interface GapReport {
+    missing: number[];
+    first_held_seq: number;
+}
+export declare class ChannelCollector {
+    #private;
+    constructor(opts: ChannelCollectorOptions);
+    /** One pass over one channel: fetch both relays, verify, store, advance. */
+    collectOnce(agentId: string, channelHex: string, correlationId?: string): Promise<void>;
+    /**
+     * What is missing between the relays' floor and the highest post seen.
+     *
+     * ⚠️ **BELOW `first_held_seq` IS NEVER A GAP.** Those posts were pruned or aged out on purpose.
+     * Reporting them would have every subscriber demand content that no longer exists, for ever.
+     */
+    gapsFor(agentId: string, channelHex: string): GapReport;
+    /**
+     * Repair what is still missing: the OTHER relay first, then the publisher.
+     *
+     * The other relay is asked first because it costs nothing and usually has it — the two queues
+     * disagree by design. The publisher is a last resort and is asked ONCE per gap: a gap that
+     * survives both is reported, not re-requested every tick, or a permanently pruned post becomes a
+     * permanent request loop.
+     */
+    repairGaps(agentId: string, channelHex: string, correlationId?: string): Promise<void>;
+}
+//# sourceMappingURL=channel-collector.d.ts.map

package/dist/channel-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-collector.d.ts","sourceRoot":"","sources":["../src/channel-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAK3E,MAAM,MAAM,cAAc,GAAG,CAC3B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IACH,cAAc,EAAE,UAAU,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;CAC9B,KACE,OAAO,CACR;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrJ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,wBAAwB,CAAC;IACxC,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,oGAAoG;IACpG,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAC5I,iGAAiG;IACjG,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;IACrD,oGAAoG;IACpG,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,gBAAgB;;gBAmBf,IAAI,EAAE,uBAAuB;IAKzC,4EAA4E;IACtE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyI7F;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS;IAyCvD;;;;;;;OAOG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA6B7F"}

package/dist/channel-collector.js

@@ -0,0 +1,249 @@
+import { broadcastPostHash, decodeBroadcastArtifact, validateBroadcastTitle, verifyBroadcastArtifact, } from "@cello-protocol/protocol-types";
+/** At most this many agent keys ride a fetch, per the relay's own cap (017). */
+const MAX_AGENT_KEYS_PER_FETCH = 32;
+export class ChannelCollector {
+    #opts;
+    #now;
+    /** Relay-reported `first_held_seq` per channel — the floor below which absence is not a gap. */
+    #firstHeld = new Map();
+    /**
+     * Gaps already reported to the publisher, so a survivor is not re-requested every tick.
+     *
+     * ⚠️ KEYED ON `agentId:channel`, NOT on the channel. Two agents on this daemon can subscribe to
+     * the same channel, and one key per channel means the second agent's genuine gap is silently never
+     * requested once the first has asked — its posts simply never arrive, with nothing logged.
+     */
+    #repairRequested = new Map();
+    /** The one place the repair key is built, so the two halves cannot drift apart. */
+    static #repairKey(agentId, channelHex) {
+        return `${agentId}:${channelHex}`;
+    }
+    constructor(opts) {
+        this.#opts = opts;
+        this.#now = opts.now ?? (() => Date.now());
+    }
+    /** One pass over one channel: fetch both relays, verify, store, advance. */
+    async collectOnce(agentId, channelHex, correlationId) {
+        const { logger, subscriptions, inbox } = this.#opts;
+        const sub = subscriptions.get(agentId, channelHex);
+        if (!sub || sub.status !== "active")
+            return;
+        const since = sub.delivered_through + 1;
+        const auth = await this.#opts.fetchAuth(sub.access, channelHex, since);
+        const agentKeys = this.#opts.localAgentKeys(channelHex).slice(0, MAX_AGENT_KEYS_PER_FETCH);
+        const channelPubkey = new Uint8Array(Buffer.from(channelHex, "hex"));
+        let lowestFirstHeld = null;
+        for (const relay of sub.relays) {
+            let answer;
+            try {
+                answer = await this.#opts.fetch(relay, {
+                    channel_pubkey: channelPubkey,
+                    since_seq: since,
+                    max_bytes: this.#opts.maxBytesPerFetch ?? 4 * 1024 * 1024,
+                    ...(auth ? { auth } : {}),
+                    ...(agentKeys.length > 0 ? { agent_pubkeys: agentKeys } : {}),
+                });
+            }
+            catch (err) {
+                // ⚠️ ONE RELAY DOWN IS NOT A FAILED COLLECTION. The other still has the posts, which is the
+                // entire reason a channel publishes to two.
+                logger.warn("channel.fetch.failed", {
+                    ...(correlationId !== undefined ? { correlationId } : {}),
+                    channel_pubkey: channelHex, relay, reason: extract(err),
+                });
+                continue;
+            }
+            if (!answer.ok) {
+                logger.warn("channel.fetch.failed", {
+                    ...(correlationId !== undefined ? { correlationId } : {}),
+                    channel_pubkey: channelHex, relay, reason: answer.reason,
+                });
+                continue;
+            }
+            if (answer.first_held_seq !== null) {
+                lowestFirstHeld = lowestFirstHeld === null ? answer.first_held_seq : Math.min(lowestFirstHeld, answer.first_held_seq);
+            }
+            let stored = 0;
+            for (const entry of answer.posts) {
+                const post = this.#verify(agentId, channelHex, sub.admin_pubkey, entry.post_cbor, relay, correlationId);
+                if (!post)
+                    continue;
+                const result = inbox.store(agentId, channelHex, post, {
+                    ...(entry.receipt_cbor ? { receiptCbor: entry.receipt_cbor } : {}),
+                    fromRelay: relay,
+                    collectedAt: this.#now(),
+                });
+                if (result.stored)
+                    stored += 1;
+            }
+            logger.info("channel.fetch.completed", {
+                ...(correlationId !== undefined ? { correlationId } : {}),
+                // `sub` was read BEFORE the fetch, so its position is the one we started from. Naming it
+                // `delivered_through` made the log say the position had not moved on every successful
+                // collection — the advance happens below, after every relay has been read.
+                channel_pubkey: channelHex, relay, count: stored, delivered_through_before: sub.delivered_through,
+            });
+        }
+        if (lowestFirstHeld !== null)
+            this.#firstHeld.set(channelHex, lowestFirstHeld);
+        this.#advance(agentId, channelHex, correlationId);
+        this.#reportGaps(agentId, channelHex, correlationId);
+    }
+    /**
+     * Verify a post before it is stored, and name the check that failed.
+     *
+     * The admin check is against the admin THIS SUBSCRIBER knows from its subscription — not against
+     * anything the relay said. A relay that swapped a post for one signed by another agent is exactly
+     * what this refuses.
+     */
+    #verify(agentId, channelHex, adminPubkeyHex, cbor, relay, correlationId) {
+        const drop = (check, detail) => {
+            this.#opts.logger.warn("channel.post.invalid", {
+                ...(correlationId !== undefined ? { correlationId } : {}),
+                channel_pubkey: channelHex, relay, check, detail,
+            });
+            return null;
+        };
+        const decoded = decodeBroadcastArtifact(cbor);
+        if (!decoded.ok)
+            return drop("decode", decoded.reason);
+        const post = decoded.artifact;
+        if (Buffer.from(post.channel_pubkey).toString("hex") !== channelHex.toLowerCase()) {
+            return drop("channel_pubkey", "the post belongs to a different channel");
+        }
+        const verdict = verifyBroadcastArtifact(post);
+        if (!verdict.ok)
+            return drop("signature", verdict.reason);
+        const title = validateBroadcastTitle(post.title);
+        if (!title.ok)
+            return drop("title", title.detail);
+        if (Buffer.from(post.agent_pubkey).toString("hex") !== adminPubkeyHex.toLowerCase()) {
+            return drop("admin", "the publishing agent is not the admin this subscriber knows for the channel");
+        }
+        return post;
+    }
+    /** Advance over the contiguous run, stopping below any gap and below any fork. */
+    #advance(agentId, channelHex, correlationId) {
+        const { subscriptions, inbox, logger } = this.#opts;
+        const sub = subscriptions.get(agentId, channelHex);
+        if (!sub)
+            return;
+        const held = new Set(inbox.heldSeqs(agentId, channelHex));
+        const forked = new Set(inbox.forkedSeqs(agentId, channelHex));
+        for (const seq of forked) {
+            const versions = inbox.forksFor(agentId, channelHex, seq);
+            logger.warn("channel.fork.detected", {
+                ...(correlationId !== undefined ? { correlationId } : {}),
+                channel_pubkey: channelHex,
+                seq,
+                // Both hashes, so the publisher can be confronted with exactly what it signed.
+                hashes: versions.map((v) => Buffer.from(broadcastPostHash(v)).toString("hex")),
+            });
+        }
+        // Start from the first post this subscriber could possibly hold: either the next one it expects,
+        // or the relay's floor when everything below has been pruned away.
+        const floor = this.#firstHeld.get(channelHex);
+        let next = sub.delivered_through + 1;
+        if (floor !== undefined && floor > next && !held.has(next))
+            next = floor;
+        let advanced = sub.delivered_through;
+        while (held.has(next) && !forked.has(next)) {
+            advanced = next;
+            next += 1;
+        }
+        if (advanced > sub.delivered_through) {
+            subscriptions.setDeliveredThrough(agentId, channelHex, advanced);
+        }
+    }
+    /**
+     * What is missing between the relays' floor and the highest post seen.
+     *
+     * ⚠️ **BELOW `first_held_seq` IS NEVER A GAP.** Those posts were pruned or aged out on purpose.
+     * Reporting them would have every subscriber demand content that no longer exists, for ever.
+     */
+    gapsFor(agentId, channelHex) {
+        const { subscriptions, inbox } = this.#opts;
+        const sub = subscriptions.get(agentId, channelHex);
+        const held = inbox.heldSeqs(agentId, channelHex);
+        /**
+         * ⚠️ **THE RELAY'S REPORTED FLOOR WINS OUTRIGHT, and is never lowered by anything local.**
+         *
+         * The floor used to be the minimum of the relay's floor, the lowest post held, and
+         * `delivered_through + 1`. Take a relay that pruned 1–4 and serves 5, 6, 7, where post 5 fails
+         * verification: nothing is held below 6, `delivered_through` stays 0, and the minimum is 1 — so
+         * the subscriber demands posts 1 to 5 from a publisher that pruned four of them months ago, and
+         * keeps demanding them for ever. That is precisely what "below the floor is never a gap" forbids.
+         *
+         * Only when NO relay has reported a floor do the local positions stand in for one.
+         */
+        const reported = this.#firstHeld.get(channelHex);
+        const localCandidates = [held[0], (sub?.delivered_through ?? 0) + 1]
+            .filter((n) => typeof n === "number" && n > 0);
+        const first_held_seq = reported !== undefined && reported > 0
+            ? reported
+            : (localCandidates.length > 0 ? Math.min(...localCandidates) : 1);
+        if (held.length === 0)
+            return { missing: [], first_held_seq };
+        const highest = held[held.length - 1];
+        const have = new Set(held);
+        const missing = [];
+        for (let seq = first_held_seq; seq < highest; seq++) {
+            if (!have.has(seq))
+                missing.push(seq);
+        }
+        return { missing, first_held_seq };
+    }
+    #reportGaps(agentId, channelHex, correlationId) {
+        const { missing, first_held_seq } = this.gapsFor(agentId, channelHex);
+        if (missing.length === 0)
+            return;
+        this.#opts.logger.warn("channel.gap.detected", {
+            ...(correlationId !== undefined ? { correlationId } : {}),
+            channel_pubkey: channelHex, missing, first_held_seq,
+        });
+    }
+    /**
+     * Repair what is still missing: the OTHER relay first, then the publisher.
+     *
+     * The other relay is asked first because it costs nothing and usually has it — the two queues
+     * disagree by design. The publisher is a last resort and is asked ONCE per gap: a gap that
+     * survives both is reported, not re-requested every tick, or a permanently pruned post becomes a
+     * permanent request loop.
+     */
+    async repairGaps(agentId, channelHex, correlationId) {
+        const sub = this.#opts.subscriptions.get(agentId, channelHex);
+        if (!sub || sub.status !== "active")
+            return;
+        // A fresh pass over both relays is the "ask the other relay" step: whatever either holds now is
+        // collected and the gap closes without troubling the publisher.
+        await this.collectOnce(agentId, channelHex, correlationId);
+        const { missing } = this.gapsFor(agentId, channelHex);
+        if (missing.length === 0)
+            return;
+        const repairKey = ChannelCollector.#repairKey(agentId, channelHex);
+        let asked = this.#repairRequested.get(repairKey);
+        if (!asked) {
+            asked = new Set();
+            this.#repairRequested.set(repairKey, asked);
+        }
+        const fresh = missing.filter((seq) => !asked.has(seq));
+        if (fresh.length === 0)
+            return;
+        for (const seq of fresh)
+            asked.add(seq);
+        const from = Math.min(...fresh);
+        const to = Math.max(...fresh);
+        this.#opts.logger.info("channel.repair.requested", {
+            ...(correlationId !== undefined ? { correlationId } : {}),
+            channel_pubkey: channelHex, from, to,
+        });
+        await this.#opts.requestRepair(agentId, channelHex, from, to);
+    }
+}
+function extract(err) {
+    if (err instanceof Error)
+        return err.message;
+    const m = err?.message;
+    return typeof m === "string" ? m : JSON.stringify(err);
+}
+//# sourceMappingURL=channel-collector.js.map

package/dist/channel-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-collector.js","sourceRoot":"","sources":["../src/channel-collector.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,gCAAgC,CAAC;AAIxC,gFAAgF;AAChF,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAoCpC,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAA0B;IAC/B,IAAI,CAAe;IAC5B,gGAAgG;IACvF,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD;;;;;;OAMG;IACM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3D,mFAAmF;IACnF,MAAM,CAAC,UAAU,CAAC,OAAe,EAAE,UAAkB;QACnD,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;IACpC,CAAC;IAED,YAAY,IAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QAC3E,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAE5C,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3F,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QAErE,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,IAAI,MAA2C,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;oBACrC,cAAc,EAAE,aAAa;oBAC7B,SAAS,EAAE,KAAK;oBAChB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;oBACzD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,4FAA4F;gBAC5F,4CAA4C;gBAC5C,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBAClC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBAClC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;iBACzD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnC,eAAe,GAAG,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YACxH,CAAC;YAED,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxG,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;oBACpD,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBACrC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,yFAAyF;gBACzF,sFAAsF;gBACtF,2EAA2E;gBAC3E,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,CAAC,iBAAiB;aAClG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,eAAe,KAAK,IAAI;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAAe,EAAE,UAAkB,EAAE,cAAsB,EAAE,IAAgB,EAAE,KAAa,EAAE,aAAsB;QAEpH,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,MAAc,EAAQ,EAAE;YACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAC7C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;aACjD,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;QAE9B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,OAAO,EAAE,6EAA6E,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,QAAQ,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QAClE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,cAAc,EAAE,UAAU;gBAC1B,GAAG;gBACH,+EAA+E;gBAC/E,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,mEAAmE;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,IAAI,GAAG,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;QAEzE,IAAI,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,QAAQ,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACrC,aAAa,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAe,EAAE,UAAkB;QACzC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACjD;;;;;;;;;;WAUG;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;aACjE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,CAAC;YAC3D,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;QAE9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,GAAG,GAAG,cAAc,EAAE,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QACrE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAC7C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAE5C,gGAAgG;QAChG,gEAAgE;QAChE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QAE3D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACjD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;CACF;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,MAAM,CAAC,GAAI,GAAoC,EAAE,OAAO,CAAC;IACzD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/dist/channel-config-store.d.ts

@@ -0,0 +1,33 @@
+/**
+ * ChannelConfigStore — what a PUBLISHER has decided about its own channel (M16 018-PUBCOLLECT).
+ *
+ * The mirror image of `channel-subscription-store.ts`: that one is what a subscriber knows about
+ * somebody else's channel, this is what a publisher has chosen for its own — which two relays it
+ * publishes to, whether the channel is public, what it is for, how long posts are kept.
+ *
+ * ⚠️ **THE RELAY PAIR LIVES HERE, NOT IN THE INFO RECORD.** The record is the SIGNED STATEMENT of
+ * these facts, deposited for subscribers to read; this is the source it is signed from. Deriving the
+ * pair from the last record instead would mean a publisher that lost its record could no longer
+ * publish, and a relay serving a stale record could quietly redirect one.
+ *
+ * Keyed on the channel's own pubkey.
+ */
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+import type { ChannelAccess } from "@cello-protocol/protocol-types";
+/** Seven days, matching the relay's own default retention. */
+export declare const DEFAULT_RETENTION_SECONDS: number;
+export declare const CHANNEL_CONFIG_CREATE_SQL: string;
+export interface ChannelConfig {
+    access: ChannelAccess;
+    relays: string[];
+    guidance: string;
+    retention_seconds: number;
+}
+export declare class ChannelConfigStore {
+    #private;
+    constructor(db: DaemonDatabase, logger: Logger);
+    get(channelHex: string): ChannelConfig | null;
+    set(channelHex: string, config: ChannelConfig, now: number): void;
+}
+//# sourceMappingURL=channel-config-store.d.ts.map

package/dist/channel-config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-config-store.d.ts","sourceRoot":"","sources":["../src/channel-config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAE1D,eAAO,MAAM,yBAAyB,QAWrC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,kBAAkB;;gBAIjB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAM9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IA0B7C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;CAiBlE"}