@cello-protocol/daemon 0.0.229 → 0.0.231

package/dist/channel-collector.js

@@ -0,0 +1,249 @@
+import { broadcastPostHash, decodeBroadcastArtifact, validateBroadcastTitle, verifyBroadcastArtifact, } from "@cello-protocol/protocol-types";
+/** At most this many agent keys ride a fetch, per the relay's own cap (017). */
+const MAX_AGENT_KEYS_PER_FETCH = 32;
+export class ChannelCollector {
+    #opts;
+    #now;
+    /** Relay-reported `first_held_seq` per channel — the floor below which absence is not a gap. */
+    #firstHeld = new Map();
+    /**
+     * Gaps already reported to the publisher, so a survivor is not re-requested every tick.
+     *
+     * ⚠️ KEYED ON `agentId:channel`, NOT on the channel. Two agents on this daemon can subscribe to
+     * the same channel, and one key per channel means the second agent's genuine gap is silently never
+     * requested once the first has asked — its posts simply never arrive, with nothing logged.
+     */
+    #repairRequested = new Map();
+    /** The one place the repair key is built, so the two halves cannot drift apart. */
+    static #repairKey(agentId, channelHex) {
+        return `${agentId}:${channelHex}`;
+    }
+    constructor(opts) {
+        this.#opts = opts;
+        this.#now = opts.now ?? (() => Date.now());
+    }
+    /** One pass over one channel: fetch both relays, verify, store, advance. */
+    async collectOnce(agentId, channelHex, correlationId) {
+        const { logger, subscriptions, inbox } = this.#opts;
+        const sub = subscriptions.get(agentId, channelHex);
+        if (!sub || sub.status !== "active")
+            return;
+        const since = sub.delivered_through + 1;
+        const auth = await this.#opts.fetchAuth(sub.access, channelHex, since);
+        const agentKeys = this.#opts.localAgentKeys(channelHex).slice(0, MAX_AGENT_KEYS_PER_FETCH);
+        const channelPubkey = new Uint8Array(Buffer.from(channelHex, "hex"));
+        let lowestFirstHeld = null;
+        for (const relay of sub.relays) {
+            let answer;
+            try {
+                answer = await this.#opts.fetch(relay, {
+                    channel_pubkey: channelPubkey,
+                    since_seq: since,
+                    max_bytes: this.#opts.maxBytesPerFetch ?? 4 * 1024 * 1024,
+                    ...(auth ? { auth } : {}),
+                    ...(agentKeys.length > 0 ? { agent_pubkeys: agentKeys } : {}),
+                });
+            }
+            catch (err) {
+                // ⚠️ ONE RELAY DOWN IS NOT A FAILED COLLECTION. The other still has the posts, which is the
+                // entire reason a channel publishes to two.
+                logger.warn("channel.fetch.failed", {
+                    ...(correlationId !== undefined ? { correlationId } : {}),
+                    channel_pubkey: channelHex, relay, reason: extract(err),
+                });
+                continue;
+            }
+            if (!answer.ok) {
+                logger.warn("channel.fetch.failed", {
+                    ...(correlationId !== undefined ? { correlationId } : {}),
+                    channel_pubkey: channelHex, relay, reason: answer.reason,
+                });
+                continue;
+            }
+            if (answer.first_held_seq !== null) {
+                lowestFirstHeld = lowestFirstHeld === null ? answer.first_held_seq : Math.min(lowestFirstHeld, answer.first_held_seq);
+            }
+            let stored = 0;
+            for (const entry of answer.posts) {
+                const post = this.#verify(agentId, channelHex, sub.admin_pubkey, entry.post_cbor, relay, correlationId);
+                if (!post)
+                    continue;
+                const result = inbox.store(agentId, channelHex, post, {
+                    ...(entry.receipt_cbor ? { receiptCbor: entry.receipt_cbor } : {}),
+                    fromRelay: relay,
+                    collectedAt: this.#now(),
+                });
+                if (result.stored)
+                    stored += 1;
+            }
+            logger.info("channel.fetch.completed", {
+                ...(correlationId !== undefined ? { correlationId } : {}),
+                // `sub` was read BEFORE the fetch, so its position is the one we started from. Naming it
+                // `delivered_through` made the log say the position had not moved on every successful
+                // collection — the advance happens below, after every relay has been read.
+                channel_pubkey: channelHex, relay, count: stored, delivered_through_before: sub.delivered_through,
+            });
+        }
+        if (lowestFirstHeld !== null)
+            this.#firstHeld.set(channelHex, lowestFirstHeld);
+        this.#advance(agentId, channelHex, correlationId);
+        this.#reportGaps(agentId, channelHex, correlationId);
+    }
+    /**
+     * Verify a post before it is stored, and name the check that failed.
+     *
+     * The admin check is against the admin THIS SUBSCRIBER knows from its subscription — not against
+     * anything the relay said. A relay that swapped a post for one signed by another agent is exactly
+     * what this refuses.
+     */
+    #verify(agentId, channelHex, adminPubkeyHex, cbor, relay, correlationId) {
+        const drop = (check, detail) => {
+            this.#opts.logger.warn("channel.post.invalid", {
+                ...(correlationId !== undefined ? { correlationId } : {}),
+                channel_pubkey: channelHex, relay, check, detail,
+            });
+            return null;
+        };
+        const decoded = decodeBroadcastArtifact(cbor);
+        if (!decoded.ok)
+            return drop("decode", decoded.reason);
+        const post = decoded.artifact;
+        if (Buffer.from(post.channel_pubkey).toString("hex") !== channelHex.toLowerCase()) {
+            return drop("channel_pubkey", "the post belongs to a different channel");
+        }
+        const verdict = verifyBroadcastArtifact(post);
+        if (!verdict.ok)
+            return drop("signature", verdict.reason);
+        const title = validateBroadcastTitle(post.title);
+        if (!title.ok)
+            return drop("title", title.detail);
+        if (Buffer.from(post.agent_pubkey).toString("hex") !== adminPubkeyHex.toLowerCase()) {
+            return drop("admin", "the publishing agent is not the admin this subscriber knows for the channel");
+        }
+        return post;
+    }
+    /** Advance over the contiguous run, stopping below any gap and below any fork. */
+    #advance(agentId, channelHex, correlationId) {
+        const { subscriptions, inbox, logger } = this.#opts;
+        const sub = subscriptions.get(agentId, channelHex);
+        if (!sub)
+            return;
+        const held = new Set(inbox.heldSeqs(agentId, channelHex));
+        const forked = new Set(inbox.forkedSeqs(agentId, channelHex));
+        for (const seq of forked) {
+            const versions = inbox.forksFor(agentId, channelHex, seq);
+            logger.warn("channel.fork.detected", {
+                ...(correlationId !== undefined ? { correlationId } : {}),
+                channel_pubkey: channelHex,
+                seq,
+                // Both hashes, so the publisher can be confronted with exactly what it signed.
+                hashes: versions.map((v) => Buffer.from(broadcastPostHash(v)).toString("hex")),
+            });
+        }
+        // Start from the first post this subscriber could possibly hold: either the next one it expects,
+        // or the relay's floor when everything below has been pruned away.
+        const floor = this.#firstHeld.get(channelHex);
+        let next = sub.delivered_through + 1;
+        if (floor !== undefined && floor > next && !held.has(next))
+            next = floor;
+        let advanced = sub.delivered_through;
+        while (held.has(next) && !forked.has(next)) {
+            advanced = next;
+            next += 1;
+        }
+        if (advanced > sub.delivered_through) {
+            subscriptions.setDeliveredThrough(agentId, channelHex, advanced);
+        }
+    }
+    /**
+     * What is missing between the relays' floor and the highest post seen.
+     *
+     * ⚠️ **BELOW `first_held_seq` IS NEVER A GAP.** Those posts were pruned or aged out on purpose.
+     * Reporting them would have every subscriber demand content that no longer exists, for ever.
+     */
+    gapsFor(agentId, channelHex) {
+        const { subscriptions, inbox } = this.#opts;
+        const sub = subscriptions.get(agentId, channelHex);
+        const held = inbox.heldSeqs(agentId, channelHex);
+        /**
+         * ⚠️ **THE RELAY'S REPORTED FLOOR WINS OUTRIGHT, and is never lowered by anything local.**
+         *
+         * The floor used to be the minimum of the relay's floor, the lowest post held, and
+         * `delivered_through + 1`. Take a relay that pruned 1–4 and serves 5, 6, 7, where post 5 fails
+         * verification: nothing is held below 6, `delivered_through` stays 0, and the minimum is 1 — so
+         * the subscriber demands posts 1 to 5 from a publisher that pruned four of them months ago, and
+         * keeps demanding them for ever. That is precisely what "below the floor is never a gap" forbids.
+         *
+         * Only when NO relay has reported a floor do the local positions stand in for one.
+         */
+        const reported = this.#firstHeld.get(channelHex);
+        const localCandidates = [held[0], (sub?.delivered_through ?? 0) + 1]
+            .filter((n) => typeof n === "number" && n > 0);
+        const first_held_seq = reported !== undefined && reported > 0
+            ? reported
+            : (localCandidates.length > 0 ? Math.min(...localCandidates) : 1);
+        if (held.length === 0)
+            return { missing: [], first_held_seq };
+        const highest = held[held.length - 1];
+        const have = new Set(held);
+        const missing = [];
+        for (let seq = first_held_seq; seq < highest; seq++) {
+            if (!have.has(seq))
+                missing.push(seq);
+        }
+        return { missing, first_held_seq };
+    }
+    #reportGaps(agentId, channelHex, correlationId) {
+        const { missing, first_held_seq } = this.gapsFor(agentId, channelHex);
+        if (missing.length === 0)
+            return;
+        this.#opts.logger.warn("channel.gap.detected", {
+            ...(correlationId !== undefined ? { correlationId } : {}),
+            channel_pubkey: channelHex, missing, first_held_seq,
+        });
+    }
+    /**
+     * Repair what is still missing: the OTHER relay first, then the publisher.
+     *
+     * The other relay is asked first because it costs nothing and usually has it — the two queues
+     * disagree by design. The publisher is a last resort and is asked ONCE per gap: a gap that
+     * survives both is reported, not re-requested every tick, or a permanently pruned post becomes a
+     * permanent request loop.
+     */
+    async repairGaps(agentId, channelHex, correlationId) {
+        const sub = this.#opts.subscriptions.get(agentId, channelHex);
+        if (!sub || sub.status !== "active")
+            return;
+        // A fresh pass over both relays is the "ask the other relay" step: whatever either holds now is
+        // collected and the gap closes without troubling the publisher.
+        await this.collectOnce(agentId, channelHex, correlationId);
+        const { missing } = this.gapsFor(agentId, channelHex);
+        if (missing.length === 0)
+            return;
+        const repairKey = ChannelCollector.#repairKey(agentId, channelHex);
+        let asked = this.#repairRequested.get(repairKey);
+        if (!asked) {
+            asked = new Set();
+            this.#repairRequested.set(repairKey, asked);
+        }
+        const fresh = missing.filter((seq) => !asked.has(seq));
+        if (fresh.length === 0)
+            return;
+        for (const seq of fresh)
+            asked.add(seq);
+        const from = Math.min(...fresh);
+        const to = Math.max(...fresh);
+        this.#opts.logger.info("channel.repair.requested", {
+            ...(correlationId !== undefined ? { correlationId } : {}),
+            channel_pubkey: channelHex, from, to,
+        });
+        await this.#opts.requestRepair(agentId, channelHex, from, to);
+    }
+}
+function extract(err) {
+    if (err instanceof Error)
+        return err.message;
+    const m = err?.message;
+    return typeof m === "string" ? m : JSON.stringify(err);
+}
+//# sourceMappingURL=channel-collector.js.map

package/dist/channel-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-collector.js","sourceRoot":"","sources":["../src/channel-collector.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,gCAAgC,CAAC;AAIxC,gFAAgF;AAChF,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAoCpC,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAA0B;IAC/B,IAAI,CAAe;IAC5B,gGAAgG;IACvF,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD;;;;;;OAMG;IACM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3D,mFAAmF;IACnF,MAAM,CAAC,UAAU,CAAC,OAAe,EAAE,UAAkB;QACnD,OAAO,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;IACpC,CAAC;IAED,YAAY,IAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QAC3E,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAE5C,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3F,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;QAErE,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,IAAI,MAA2C,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;oBACrC,cAAc,EAAE,aAAa;oBAC7B,SAAS,EAAE,KAAK;oBAChB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;oBACzD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,4FAA4F;gBAC5F,4CAA4C;gBAC5C,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBAClC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;oBAClC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;iBACzD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBACnC,eAAe,GAAG,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YACxH,CAAC;YAED,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxG,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;oBACpD,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBACrC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,yFAAyF;gBACzF,sFAAsF;gBACtF,2EAA2E;gBAC3E,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,CAAC,iBAAiB;aAClG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,eAAe,KAAK,IAAI;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,OAAe,EAAE,UAAkB,EAAE,cAAsB,EAAE,IAAgB,EAAE,KAAa,EAAE,aAAsB;QAEpH,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,MAAc,EAAQ,EAAE;YACnD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAC7C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;aACjD,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;QAE9B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,OAAO,EAAE,6EAA6E,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,QAAQ,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QAClE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,cAAc,EAAE,UAAU;gBAC1B,GAAG;gBACH,+EAA+E;gBAC/E,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,iGAAiG;QACjG,mEAAmE;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,IAAI,GAAG,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;QAEzE,IAAI,QAAQ,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,QAAQ,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACrC,aAAa,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAe,EAAE,UAAkB;QACzC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACjD;;;;;;;;;;WAUG;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;aACjE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,cAAc,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,CAAC;YAC3D,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;QAE9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,GAAG,GAAG,cAAc,EAAE,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QACrE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAC7C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,UAAkB,EAAE,aAAsB;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAE5C,gGAAgG;QAChG,gEAAgE;QAChE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QAE3D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACjD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;CACF;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,MAAM,CAAC,GAAI,GAAoC,EAAE,OAAO,CAAC;IACzD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/dist/channel-config-store.d.ts

@@ -0,0 +1,36 @@
+/**
+ * ChannelConfigStore — what a PUBLISHER has decided about its own channel (M16 018-PUBCOLLECT).
+ *
+ * The mirror image of `channel-subscription-store.ts`: that one is what a subscriber knows about
+ * somebody else's channel, this is what a publisher has chosen for its own — which two relays it
+ * publishes to, whether the channel is public, what it is for, how long posts are kept.
+ *
+ * ⚠️ **THE RELAY PAIR LIVES HERE, NOT IN THE INFO RECORD.** The record is the SIGNED STATEMENT of
+ * these facts, deposited for subscribers to read; this is the source it is signed from. Deriving the
+ * pair from the last record instead would mean a publisher that lost its record could no longer
+ * publish, and a relay serving a stale record could quietly redirect one.
+ *
+ * Keyed on the channel's own pubkey.
+ */
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+import type { ChannelAccess } from "@cello-protocol/protocol-types";
+/** Seven days, matching the relay's own default retention. */
+export declare const DEFAULT_RETENTION_SECONDS: number;
+export declare const CHANNEL_CONFIG_CREATE_SQL: string;
+export interface ChannelConfig {
+    access: ChannelAccess;
+    relays: string[];
+    guidance: string;
+    retention_seconds: number;
+    members_visible?: boolean;
+    /** The agent that answers join requests. NOT the channel key — see the column comment. */
+    admin_pubkey?: string;
+}
+export declare class ChannelConfigStore {
+    #private;
+    constructor(db: DaemonDatabase, logger: Logger);
+    get(channelHex: string): ChannelConfig | null;
+    set(channelHex: string, config: ChannelConfig, now: number): void;
+}
+//# sourceMappingURL=channel-config-store.d.ts.map

package/dist/channel-config-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-config-store.d.ts","sourceRoot":"","sources":["../src/channel-config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAE1D,eAAO,MAAM,yBAAyB,QA0BrC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,kBAAkB;;gBAIjB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAM9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAkC7C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;CAsBlE"}

package/dist/channel-config-store.js

@@ -0,0 +1,84 @@
+/** Seven days, matching the relay's own default retention. */
+export const DEFAULT_RETENTION_SECONDS = 7 * 24 * 60 * 60;
+export const CHANNEL_CONFIG_CREATE_SQL = `
+  CREATE TABLE IF NOT EXISTS channel_config (
+    channel_pubkey     TEXT    NOT NULL PRIMARY KEY,
+    access             TEXT    NOT NULL,
+    -- JSON array of multiaddrs, in the order the publisher chose them. Two is the design; the column
+    -- is a list because the count is the publisher's decision, not the schema's.
+    relays             TEXT    NOT NULL,
+    guidance           TEXT    NOT NULL DEFAULT '',
+    retention_seconds  INTEGER NOT NULL DEFAULT ${String(DEFAULT_RETENTION_SECONDS)},
+    -- ─── M16 019-MEMBERSHIP: one table, not two ───────────────────────────────────────────────
+    -- 019 first added a channel_settings table duplicating four of these columns, and wired NO
+    -- writer to it — so every membership read came back empty and every join was refused on a
+    -- channel the daemon genuinely administered. Two tables for one fact, with the live path
+    -- reading the empty one. Collapsed here while the database is still empty, which makes it a
+    -- schema edit rather than a migration.
+    --
+    -- Whether members can see each other. A publisher's decision about its own channel.
+    members_visible    INTEGER NOT NULL DEFAULT 0,
+    -- 0 means NO KEY HAS EVER BEEN ISSUED. The first join mints generation 1; each ejection
+    -- advances it, and that number is what every body and every fetch key is bound to.
+    key_generation     INTEGER NOT NULL DEFAULT 0,
+    -- The AGENT that admits members and answers join requests. Distinct from the channel key: the
+    -- channel signs posts and never converses, the admin holds the sessions. Empty until set.
+    admin_pubkey       TEXT    NOT NULL DEFAULT '',
+    updated_at         INTEGER NOT NULL
+  );
+`;
+export class ChannelConfigStore {
+    #db;
+    #logger;
+    constructor(db, logger) {
+        this.#db = db;
+        this.#logger = logger;
+        this.#db.exec(CHANNEL_CONFIG_CREATE_SQL);
+    }
+    get(channelHex) {
+        const row = this.#db
+            .prepare(`SELECT access, relays, guidance, retention_seconds, members_visible, admin_pubkey
+           FROM channel_config WHERE channel_pubkey = ?`)
+            .get(channelHex.toLowerCase());
+        if (!row)
+            return null;
+        let relays = [];
+        try {
+            const parsed = JSON.parse(row.relays);
+            if (Array.isArray(parsed))
+                relays = parsed.filter((r) => typeof r === "string");
+        }
+        catch {
+            // A corrupt relay list makes the channel unpublishable and says so, rather than publishing to
+            // an empty set and reporting success.
+            this.#logger.error("channel.config.relays_corrupt", { channel_pubkey: channelHex });
+            return null;
+        }
+        return {
+            access: row.access,
+            relays,
+            guidance: row.guidance,
+            retention_seconds: Number(row.retention_seconds),
+            members_visible: Number(row.members_visible) === 1,
+            admin_pubkey: row.admin_pubkey,
+        };
+    }
+    set(channelHex, config, now) {
+        this.#db
+            .prepare(
+        // ⚠️ `key_generation` is NOT in the update list, and must never be: it is advanced only by an
+        // ejection, and letting a settings edit touch it would silently re-key or un-re-key a channel.
+        `INSERT INTO channel_config
+           (channel_pubkey, access, relays, guidance, retention_seconds, members_visible, admin_pubkey, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (channel_pubkey) DO UPDATE SET
+           access = excluded.access, relays = excluded.relays, guidance = excluded.guidance,
+           retention_seconds = excluded.retention_seconds, members_visible = excluded.members_visible,
+           admin_pubkey = excluded.admin_pubkey, updated_at = excluded.updated_at`)
+            .run(channelHex.toLowerCase(), config.access, JSON.stringify(config.relays), config.guidance, config.retention_seconds, config.members_visible === true ? 1 : 0, config.admin_pubkey ?? "", now);
+        this.#logger.info("channel.config.set", {
+            channel_pubkey: channelHex, access: config.access, relays: config.relays.length,
+        });
+    }
+}
+//# sourceMappingURL=channel-config-store.js.map

package/dist/channel-config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-config-store.js","sourceRoot":"","sources":["../src/channel-config-store.ts"],"names":[],"mappings":"AAkBA,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1D,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;kDAQS,MAAM,CAAC,yBAAyB,CAAC;;;;;;;;;;;;;;;;;;CAkBlF,CAAC;AAYF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,UAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN;wDACgD,CACjD;aACA,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAKlB,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAY,CAAC;YACjD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;YAC9F,sCAAsC;YACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAuB;YACnC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAChD,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;YAClD,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,UAAkB,EAAE,MAAqB,EAAE,GAAW;QACxD,IAAI,CAAC,GAAG;aACL,OAAO;QACN,8FAA8F;QAC9F,+FAA+F;QAC/F;;;;;;kFAM0E,CAC3E;aACA,GAAG,CACF,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EACzC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CACxE,CAAC;QACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACtC,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;SAChF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/channel-inbox-store.d.ts

@@ -0,0 +1,46 @@
+/**
+ * ChannelInboxStore — the posts a SUBSCRIBER has collected and verified (M16 018-PUBCOLLECT).
+ *
+ * Distinct from `channel-log-store.ts`, which is the PUBLISHER's copy of what it sent. This is the
+ * reader's side: what arrived, from which relay, and — when two relays disagree — both versions.
+ *
+ * ⚠️ **A FORK IS STORED, NOT RESOLVED.** Two different posts at one number means the channel signed
+ * both, which is the one thing a channel key cannot take back. Keeping only the first seen would
+ * make whichever relay answered first the arbiter of what the channel said, and would destroy the
+ * evidence that it said two things. So both rows survive, and the position stops below them.
+ *
+ * Keyed on `agent_id`, never `agent_name`.
+ */
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+import { type BroadcastArtifact } from "@cello-protocol/protocol-types";
+export declare const CHANNEL_INBOX_CREATE_SQL = "\n  CREATE TABLE IF NOT EXISTS channel_inbox (\n    agent_id        TEXT    NOT NULL,\n    channel_pubkey  TEXT    NOT NULL,\n    seq             INTEGER NOT NULL,\n    -- The post's own hash is part of the key, which is what lets a FORK keep both rows rather than\n    -- one overwriting the other. A (agent, channel, seq) key would silently drop the evidence.\n    post_hash       TEXT    NOT NULL,\n    post_cbor       BLOB    NOT NULL,\n    receipt_cbor    BLOB,\n    from_relay      TEXT    NOT NULL,\n    collected_at    INTEGER NOT NULL,\n    PRIMARY KEY (agent_id, channel_pubkey, seq, post_hash)\n  );\n";
+export type ChannelInboxErrorCode = "post_invalid" | "inbox_row_corrupt";
+export declare class ChannelInboxError extends Error {
+    readonly code: ChannelInboxErrorCode;
+    constructor(code: ChannelInboxErrorCode, message: string);
+}
+export declare class ChannelInboxStore {
+    #private;
+    constructor(db: DaemonDatabase, logger: Logger);
+    /**
+     * Store one verified post. Idempotent on (agent, channel, seq, hash): the same post arriving from
+     * the second relay is the ordinary case, not a conflict.
+     */
+    store(agentId: string, channelHex: string, post: BroadcastArtifact, opts: {
+        receiptCbor?: Uint8Array;
+        fromRelay: string;
+        collectedAt: number;
+    }): {
+        stored: boolean;
+    };
+    /** Posts in [fromSeq, toSeq], seq order. A forked number contributes every version it holds. */
+    range(agentId: string, channelHex: string, fromSeq: number, toSeq: number): BroadcastArtifact[];
+    /** Every version held at one number. Length > 1 is a fork. */
+    forksFor(agentId: string, channelHex: string, seq: number): BroadcastArtifact[];
+    /** The post numbers this subscriber holds, ascending and deduplicated. */
+    heldSeqs(agentId: string, channelHex: string): number[];
+    /** The numbers at which this subscriber holds more than one distinct post. */
+    forkedSeqs(agentId: string, channelHex: string): number[];
+}
+//# sourceMappingURL=channel-inbox-store.d.ts.map

package/dist/channel-inbox-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-inbox-store.d.ts","sourceRoot":"","sources":["../src/channel-inbox-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,wBAAwB,ymBAcpC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,mBAAmB,CAAC;AAEzE,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;gBACzB,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM;CAKzD;AAED,qBAAa,iBAAiB;;gBAIhB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAM9C;;;OAGG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;QACxE,WAAW,CAAC,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;KAClE,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE;IAgBvB,gGAAgG;IAChG,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAW/F,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,EAAE;IAI/E,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;IAUvD,8EAA8E;IAC9E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE;CAqB1D"}

package/dist/channel-inbox-store.js

@@ -0,0 +1,88 @@
+import { broadcastPostHash, decodeBroadcastArtifact, encodeBroadcastArtifact, } from "@cello-protocol/protocol-types";
+export const CHANNEL_INBOX_CREATE_SQL = `
+  CREATE TABLE IF NOT EXISTS channel_inbox (
+    agent_id        TEXT    NOT NULL,
+    channel_pubkey  TEXT    NOT NULL,
+    seq             INTEGER NOT NULL,
+    -- The post's own hash is part of the key, which is what lets a FORK keep both rows rather than
+    -- one overwriting the other. A (agent, channel, seq) key would silently drop the evidence.
+    post_hash       TEXT    NOT NULL,
+    post_cbor       BLOB    NOT NULL,
+    receipt_cbor    BLOB,
+    from_relay      TEXT    NOT NULL,
+    collected_at    INTEGER NOT NULL,
+    PRIMARY KEY (agent_id, channel_pubkey, seq, post_hash)
+  );
+`;
+export class ChannelInboxError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.name = "ChannelInboxError";
+        this.code = code;
+    }
+}
+export class ChannelInboxStore {
+    #db;
+    #logger;
+    constructor(db, logger) {
+        this.#db = db;
+        this.#logger = logger;
+        this.#db.exec(CHANNEL_INBOX_CREATE_SQL);
+    }
+    /**
+     * Store one verified post. Idempotent on (agent, channel, seq, hash): the same post arriving from
+     * the second relay is the ordinary case, not a conflict.
+     */
+    store(agentId, channelHex, post, opts) {
+        const cbor = encodeBroadcastArtifact(post);
+        const hashHex = Buffer.from(broadcastPostHash(post)).toString("hex");
+        const inserted = this.#db
+            .prepare(`INSERT OR IGNORE INTO channel_inbox
+           (agent_id, channel_pubkey, seq, post_hash, post_cbor, receipt_cbor, from_relay, collected_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(agentId, channelHex.toLowerCase(), post.seq, hashHex, Buffer.from(cbor), opts.receiptCbor ? Buffer.from(opts.receiptCbor) : null, opts.fromRelay, opts.collectedAt);
+        return { stored: Number(inserted.changes) > 0 };
+    }
+    /** Posts in [fromSeq, toSeq], seq order. A forked number contributes every version it holds. */
+    range(agentId, channelHex, fromSeq, toSeq) {
+        const rows = this.#db
+            .prepare(`SELECT seq, post_cbor FROM channel_inbox
+          WHERE agent_id = ? AND channel_pubkey = ? AND seq BETWEEN ? AND ?
+          ORDER BY seq ASC, post_hash ASC`)
+            .all(agentId, channelHex.toLowerCase(), fromSeq, toSeq);
+        return rows.map((r) => this.#decode(Number(r.seq), new Uint8Array(r.post_cbor)));
+    }
+    /** Every version held at one number. Length > 1 is a fork. */
+    forksFor(agentId, channelHex, seq) {
+        return this.range(agentId, channelHex, seq, seq);
+    }
+    /** The post numbers this subscriber holds, ascending and deduplicated. */
+    heldSeqs(agentId, channelHex) {
+        const rows = this.#db
+            .prepare(`SELECT DISTINCT seq FROM channel_inbox
+          WHERE agent_id = ? AND channel_pubkey = ? ORDER BY seq ASC`)
+            .all(agentId, channelHex.toLowerCase());
+        return rows.map((r) => Number(r.seq));
+    }
+    /** The numbers at which this subscriber holds more than one distinct post. */
+    forkedSeqs(agentId, channelHex) {
+        const rows = this.#db
+            .prepare(`SELECT seq FROM channel_inbox
+          WHERE agent_id = ? AND channel_pubkey = ?
+          GROUP BY seq HAVING COUNT(DISTINCT post_hash) > 1 ORDER BY seq ASC`)
+            .all(agentId, channelHex.toLowerCase());
+        return rows.map((r) => Number(r.seq));
+    }
+    #decode(seq, cbor) {
+        const decoded = decodeBroadcastArtifact(cbor);
+        if (!decoded.ok) {
+            // A stored row that no longer decodes is corruption, never something to skip past: the caller
+            // is about to show these to an agent.
+            this.#logger.error("channel.inbox.row_corrupt", { seq, reason: decoded.reason });
+            throw new ChannelInboxError("inbox_row_corrupt", `stored seq ${String(seq)} does not decode: ${decoded.reason}`);
+        }
+        return decoded.artifact;
+    }
+}
+//# sourceMappingURL=channel-inbox-store.js.map

package/dist/channel-inbox-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-inbox-store.js","sourceRoot":"","sources":["../src/channel-inbox-store.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,GAExB,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;CAcvC,CAAC;AAIF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IACrC,YAAY,IAA2B,EAAE,OAAe;QACtD,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,iBAAiB;IACnB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAuB,EAAE,IAEnE;QACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG;aACtB,OAAO,CACN;;yCAEiC,CAClC;aACA,GAAG,CACF,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACvE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAC1F,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAe,EAAE,KAAa;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;;0CAEkC,CACnC;aACA,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,CAA2D,CAAC;QACpH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,8DAA8D;IAC9D,QAAQ,CAAC,OAAe,EAAE,UAAkB,EAAE,GAAW;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,0EAA0E;IAC1E,QAAQ,CAAC,OAAe,EAAE,UAAkB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;qEAC6D,CAC9D;aACA,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,CAAoC,CAAC;QAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,8EAA8E;IAC9E,UAAU,CAAC,OAAe,EAAE,UAAkB;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;;6EAEqE,CACtE;aACA,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,CAAoC,CAAC;QAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,IAAgB;QACnC,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,8FAA8F;YAC9F,sCAAsC;YACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACjF,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,cAAc,MAAM,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC1B,CAAC;CACF"}

package/dist/channel-join-exchange.d.ts

@@ -0,0 +1,87 @@
+/**
+ * ChannelJoinExchange — M16 019-MEMBERSHIP Part B, both sides of joining a channel.
+ *
+ * A channel never converses. Its ADMIN is an ordinary agent, so a join is a typed exchange inside a
+ * normal sealed session with that admin — no new transport, no relay frames, no special case in the
+ * session layer.
+ *
+ * ─── The two identity checks, and why each is load-bearing ───────────────────────────────────
+ *
+ * **ADMIN side: the session counterparty must BE the subscriber the frame names.** The frame says
+ * who is joining and the session says who is talking; if they may differ, anyone can enrol a third
+ * party — and, worse, receive that third party's key bundle themselves, because the bundle is
+ * wrapped for the pubkey in the frame and sent down the session they are holding.
+ *
+ * **SUBSCRIBER side: the answering agent must be the admin in the channel's DIRECTORY PROFILE.**
+ * The session proves who the counterparty is. It does not prove they are this channel's admin. Drop
+ * this check and any agent that can open a session with you hands you a key bundle and a relay pair
+ * and becomes your channel: you read their posts believing them to be somebody else's, and the
+ * immutable `admin_pubkey` the design rests on protects nobody.
+ *
+ * ─── What is NOT decided here ────────────────────────────────────────────────────────────────
+ *
+ * Invite-only admission is the admin AGENT's decision. A request lands as `pending` and raises a
+ * notice; nothing in this file approves one. There is no heuristic, no allowlist, no auto-approve.
+ */
+import { encodeChannelRekey } from "@cello-protocol/protocol-types";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { Logger } from "./types.js";
+import type { ChannelMembershipStore } from "./channel-membership-store.js";
+import type { ChannelSubscriptionStore } from "./channel-subscription-store.js";
+/** What this daemon knows about a channel it administers. `null` means it does not administer one. */
+export interface LocalChannelAdmin {
+    agentId: string;
+    adminPubkeyHex: string;
+    channelKeyProvider: KeyProvider;
+    adminKeyProvider: KeyProvider;
+}
+export interface ChannelJoinExchangeDeps {
+    logger: Logger;
+    members: ChannelMembershipStore;
+    subscriptions: ChannelSubscriptionStore;
+    /** Put a frame on an open session. The session layer owns delivery; this owns the decisions. */
+    sendInSession: (sessionId: string, content: Uint8Array) => Promise<void>;
+    localChannelAdmin: (channelHex: string) => LocalChannelAdmin | null;
+    /**
+     * The channel's admin AS THE DIRECTORY REPORTS IT. `null` means the lookup could not be resolved,
+     * which FAILS CLOSED — an unreachable directory must not become "whoever answered is the admin".
+     */
+    profileAdminPubkey: (channelHex: string, agentId: string) => Promise<string | null>;
+    keyProviderFor: (agentId: string) => KeyProvider | null;
+    raiseNotice: (event: string, channelHex: string, subscriberHex: string) => void;
+    now?: () => number;
+}
+export type SubscriberJoinResult = {
+    ok: true;
+    channelHex: string;
+    generation: number;
+} | {
+    ok: false;
+    reason: "not_a_join_frame" | "malformed" | "not_admin_of_channel" | "admin_unresolved" | "key_unwrap_failed" | "no_key_provider";
+};
+export interface ChannelJoinExchange {
+    /** An inbound frame on the ADMIN's daemon. `consumed: false` means it was not a join frame. */
+    onAdminFrame: (sessionId: string, counterpartyHex: string, content: Uint8Array) => Promise<{
+        consumed: boolean;
+    }>;
+    /** An inbound acceptance or re-key on the SUBSCRIBER's daemon. */
+    onSubscriberFrame: (agentId: string, sessionId: string, counterpartyHex: string, content: Uint8Array) => Promise<SubscriberJoinResult>;
+    /** The admin agent's explicit decision on a pending invite-only request. */
+    approve: (channelHex: string, subscriberHex: string, sessionId: string) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Refuse a pending request by name. */
+    refuse: (channelHex: string, subscriberHex: string, sessionId: string) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+}
+export declare function createChannelJoinExchange(deps: ChannelJoinExchangeDeps): ChannelJoinExchange;
+/** Re-exported so the caller does not need a second import to build a re-key frame. */
+export { encodeChannelRekey };
+//# sourceMappingURL=channel-join-exchange.d.ts.map

package/dist/channel-join-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-join-exchange.d.ts","sourceRoot":"","sources":["../src/channel-join-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAEgD,kBAAkB,EAGxE,MAAM,gCAAgC,CAAC;AAIxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGhF,sGAAsG;AACtG,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,WAAW,CAAC;IAChC,gBAAgB,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,sBAAsB,CAAC;IAChC,aAAa,EAAE,wBAAwB,CAAC;IACxC,gGAAgG;IAChG,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,iBAAiB,GAAG,IAAI,CAAC;IACpE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,WAAW,GAAG,IAAI,CAAC;IACxD,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IAChF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAEpJ,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClH,kEAAkE;IAClE,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvI,4EAA4E;IAC5E,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjI,wCAAwC;IACxC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjI;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB,CAgR5F;AAED,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,CAAC"}