@cello-protocol/daemon 0.0.230 → 0.0.231

package/dist/channel-admin-lookup.d.ts

@@ -0,0 +1,54 @@
+/**
+ * M16 020-CHANADMIN — asking a directory who administers a channel.
+ *
+ * A subscriber that has been handed a group key must check the agent that handed it over against
+ * what the directory says about the channel. The session proves who the counterparty IS; it says
+ * nothing about whether they have any authority over this channel. Without the check, any agent that
+ * can open a session with you becomes your channel.
+ *
+ * 019 built the check and it could not run: the answer lives in the directory's profile and no
+ * client-facing frame carried it. `channel_admin_query` (020, directory side) does, on the
+ * authenticated signaling stream. This is the client half.
+ *
+ * ⚠️ **"NOT A CHANNEL" AND "I COULD NOT FIND OUT" ARE DIFFERENT ANSWERS, and the whole value of this
+ * module is keeping them apart.** A negative is authoritative — the subscriber acts on it. A
+ * timeout, a down stream, a malformed reply or a directory-side `lookup_failed` are all the absence
+ * of an answer, and they leave the join refused. Collapsed into the negative, a directory outage
+ * would read as a verdict about the channel, and the step after that is accepting a key from
+ * whoever happened to answer.
+ */
+import type { Logger } from "./types.js";
+/**
+ * The part of a `SignalingManager` this needs. Structural rather than the class, so the lookup can
+ * be exercised without standing up a directory connection.
+ */
+export interface SignalingLike {
+    registerInboundHandler(handler: (frame: Record<string, unknown>) => void): () => void;
+    sendRaw(frame: unknown): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+}
+export type ChannelAdminOutcome = 
+/** A registered channel, and the agent the directory says administers it. */
+{
+    kind: "admin";
+    adminPubkeyHex: string;
+}
+/** The directory answered, and this pubkey is not a channel — unregistered, or an ordinary agent. */
+ | {
+    kind: "not_a_channel";
+}
+/** No answer. NOT a verdict about the channel. */
+ | {
+    kind: "unavailable";
+    reason: string;
+};
+export interface ChannelAdminLookupDeps {
+    /** The asking agent's directory connection, or null when it has none. */
+    signalingFor: (agentId: string) => SignalingLike | null;
+    logger: Logger;
+    timeoutMs?: number;
+}
+export declare function createChannelAdminLookup(deps: ChannelAdminLookupDeps): (agentId: string, channelHex: string) => Promise<ChannelAdminOutcome>;
+//# sourceMappingURL=channel-admin-lookup.d.ts.map

package/dist/channel-admin-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-admin-lookup.d.ts","sourceRoot":"","sources":["../src/channel-admin-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,sBAAsB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACtF,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,MAAM,MAAM,mBAAmB;AAC7B,6EAA6E;AAC3E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE;AAC3C,qGAAqG;GACnG;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE;AAC3B,kDAAkD;GAChD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,GAAG,IAAI,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmBD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,sBAAsB,GAC3B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CA0GvE"}

package/dist/channel-admin-lookup.js

@@ -0,0 +1,122 @@
+import { extractErrorMessage } from "./error-message.js";
+const DEFAULT_TIMEOUT_MS = 10_000;
+/** 64 lowercase hex characters, or nothing. A partial admin key must not reach a comparison. */
+function adminPubkeyOf(frame) {
+    const raw = frame["admin_pubkey"];
+    if (typeof raw !== "string" || !/^[0-9a-fA-F]{64}$/.test(raw))
+        return null;
+    return raw.toLowerCase();
+}
+function echoedChannelHex(frame) {
+    const raw = frame["channel_pubkey"];
+    if (raw instanceof Uint8Array)
+        return Buffer.from(raw).toString("hex");
+    if (Buffer.isBuffer(raw))
+        return raw.toString("hex");
+    if (typeof raw === "string" && /^[0-9a-fA-F]{64}$/.test(raw))
+        return raw.toLowerCase();
+    return null;
+}
+export function createChannelAdminLookup(deps) {
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return async function lookup(agentId, channelHexRaw) {
+        const channelHex = channelHexRaw.toLowerCase();
+        const signaling = deps.signalingFor(agentId);
+        if (!signaling) {
+            // Answer now rather than waiting out the timeout for a reply that was never coming — this runs
+            // on the inbound join path, once per frame.
+            return { kind: "unavailable", reason: "signaling_unavailable" };
+        }
+        let resolveFrame;
+        const pending = new Promise((r) => { resolveFrame = r; });
+        /**
+         * ⚠️ **MATCHED ON THE ECHOED PUBKEY, not on the frame type alone.** The signaling stream is one
+         * multiplexed stream shared by every lookup this agent has in flight. Taking the first
+         * `channel_admin_result` that arrives would let two concurrent joins each accept the other's
+         * answer — and then the admin check runs against a different channel's administrator, where a
+         * match proves nothing.
+         */
+        const unregister = signaling.registerInboundHandler((frame) => {
+            const t = frame["type"];
+            if (t !== "channel_admin_result" && t !== "channel_admin_error")
+                return;
+            /**
+             * ⚠️ **THE ERROR IS MATCHED THE SAME WAY, and it was not at first.** An unmatched error
+             * resolved whichever lookup happened to be waiting: two joins in flight, a database fault on
+             * the first channel, and the second was refused although the directory had answered it
+             * perfectly. It fails closed, so nothing unsafe — it just turns one channel's outage into
+             * every concurrent join's refusal, which is a bad trade for a field.
+             */
+            if (echoedChannelHex(frame) !== channelHex)
+                return;
+            resolveFrame(frame);
+        });
+        let timer;
+        try {
+            const sent = await signaling.sendRaw({
+                type: "channel_admin_query",
+                channel_pubkey: new Uint8Array(Buffer.from(channelHex, "hex")),
+            });
+            if (!sent.ok) {
+                // The transport's own reason, never a guess about the directory or the channel.
+                return { kind: "unavailable", reason: sent.reason ?? "signaling_unavailable" };
+            }
+            const timeoutP = new Promise((r) => {
+                timer = setTimeout(() => r({ type: "__timeout__" }), timeoutMs);
+            });
+            const frame = await Promise.race([pending, timeoutP]);
+            if (frame["type"] === "__timeout__") {
+                deps.logger.warn("directory.channel.admin.lookup.failed", { channel: channelHex.slice(0, 16), reason: "timeout" });
+                return { kind: "unavailable", reason: "timeout" };
+            }
+            if (frame["type"] === "channel_admin_error") {
+                const reason = typeof frame["reason"] === "string" ? frame["reason"] : "lookup_failed";
+                deps.logger.warn("directory.channel.admin.lookup.failed", { channel: channelHex.slice(0, 16), reason });
+                return { kind: "unavailable", reason };
+            }
+            /**
+             * ⚠️ **SHAPE FIRST, AND THIS WAS A DEFECT THE TEST CAUGHT.** `registered !== true` is true for
+             * a field that is ABSENT as well as one that is `false` — so a reply missing the field
+             * entirely read as an authoritative "not a channel", which is precisely the collapse this
+             * module exists to prevent. A frame that does not carry both booleans is a directory that
+             * replied with something we cannot read, and that is not knowing.
+             */
+            if (typeof frame["registered"] !== "boolean" || typeof frame["channel"] !== "boolean") {
+                deps.logger.warn("directory.channel.admin.lookup.failed", { channel: channelHex.slice(0, 16), reason: "malformed_reply" });
+                return { kind: "unavailable", reason: "malformed_reply" };
+            }
+            if (frame["registered"] !== true || frame["channel"] !== true) {
+                // An answer, and a settled one: the subscriber is looking at something that is not a channel.
+                deps.logger.info("directory.channel.admin.lookup", { channel: channelHex.slice(0, 16), answered: "not_a_channel" });
+                return { kind: "not_a_channel" };
+            }
+            const adminPubkeyHex = adminPubkeyOf(frame);
+            if (adminPubkeyHex === null) {
+                /**
+                 * A registered channel whose answer carries no usable admin key. Reading a missing or
+                 * malformed field as `""` would put an empty key into the comparison against whoever
+                 * answered — which either matches nothing for ever or, worse, matches an empty counterparty.
+                 * So it is `unavailable`: there is no admin to check against, and that is not knowing.
+                 *
+                 * ⚠️ **NAMED FOR THE REGISTRATION, NOT THE WIRE.** Calling this `malformed_reply` sent the
+                 * operator to debug the protocol, when the directory answered exactly as designed about a
+                 * channel that was registered without an administrator. The reason has to point at the
+                 * thing that is actually wrong.
+                 */
+                deps.logger.warn("directory.channel.admin.lookup.failed", { channel: channelHex.slice(0, 16), reason: "channel_without_admin" });
+                return { kind: "unavailable", reason: "channel_without_admin" };
+            }
+            deps.logger.info("directory.channel.admin.lookup", { channel: channelHex.slice(0, 16), answered: "admin" });
+            return { kind: "admin", adminPubkeyHex };
+        }
+        catch (err) {
+            return { kind: "unavailable", reason: extractErrorMessage(err) };
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            unregister();
+        }
+    };
+}
+//# sourceMappingURL=channel-admin-lookup.js.map

package/dist/channel-admin-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-admin-lookup.js","sourceRoot":"","sources":["../src/channel-admin-lookup.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA0BzD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,gGAAgG;AAChG,SAAS,aAAa,CAAC,KAA8B;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA8B;IACtD,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAQ,GAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAA4B;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,OAAO,KAAK,UAAU,MAAM,CAAC,OAAe,EAAE,aAAqB;QACjE,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,+FAA+F;YAC/F,4CAA4C;YAC5C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,YAAmD,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnF;;;;;;WAMG;QACH,MAAM,UAAU,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,sBAAsB,IAAI,CAAC,KAAK,qBAAqB;gBAAE,OAAO;YACxE;;;;;;eAMG;YACH,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,UAAU;gBAAE,OAAO;YACnD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;gBACnC,IAAI,EAAE,qBAAqB;gBAC3B,cAAc,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,gFAAgF;gBAChF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACjF,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE;gBAC1D,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEtD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACnH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,qBAAqB,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;gBACvF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxG,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;YAED;;;;;;eAMG;YACH,IAAI,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;gBACtF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAC3H,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YAC5D,CAAC;YAED,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9D,8FAA8F;gBAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;gBACpH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;YACnC,CAAC;YAED,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gBAC5B;;;;;;;;;;mBAUG;gBACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACjI,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAClE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5G,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/channel-config-store.d.ts

@@ -23,6 +23,9 @@ export interface ChannelConfig {
     relays: string[];
     guidance: string;
     retention_seconds: number;
+    members_visible?: boolean;
+    /** The agent that answers join requests. NOT the channel key — see the column comment. */
+    admin_pubkey?: string;
 }
 export declare class ChannelConfigStore {
     #private;

package/dist/channel-config-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel-config-store.d.ts","sourceRoot":"","sources":["../src/channel-config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAE1D,eAAO,MAAM,yBAAyB,QAWrC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,kBAAkB;;gBAIjB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAM9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IA0B7C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;CAiBlE"}
+{"version":3,"file":"channel-config-store.d.ts","sourceRoot":"","sources":["../src/channel-config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAE1D,eAAO,MAAM,yBAAyB,QA0BrC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,kBAAkB;;gBAIjB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAM9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAkC7C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;CAsBlE"}

package/dist/channel-config-store.js

@@ -9,6 +9,21 @@ export const CHANNEL_CONFIG_CREATE_SQL = `
     relays             TEXT    NOT NULL,
     guidance           TEXT    NOT NULL DEFAULT '',
     retention_seconds  INTEGER NOT NULL DEFAULT ${String(DEFAULT_RETENTION_SECONDS)},
+    -- ─── M16 019-MEMBERSHIP: one table, not two ───────────────────────────────────────────────
+    -- 019 first added a channel_settings table duplicating four of these columns, and wired NO
+    -- writer to it — so every membership read came back empty and every join was refused on a
+    -- channel the daemon genuinely administered. Two tables for one fact, with the live path
+    -- reading the empty one. Collapsed here while the database is still empty, which makes it a
+    -- schema edit rather than a migration.
+    --
+    -- Whether members can see each other. A publisher's decision about its own channel.
+    members_visible    INTEGER NOT NULL DEFAULT 0,
+    -- 0 means NO KEY HAS EVER BEEN ISSUED. The first join mints generation 1; each ejection
+    -- advances it, and that number is what every body and every fetch key is bound to.
+    key_generation     INTEGER NOT NULL DEFAULT 0,
+    -- The AGENT that admits members and answers join requests. Distinct from the channel key: the
+    -- channel signs posts and never converses, the admin holds the sessions. Empty until set.
+    admin_pubkey       TEXT    NOT NULL DEFAULT '',
     updated_at         INTEGER NOT NULL
   );
 `;
@@ -22,7 +37,8 @@ export class ChannelConfigStore {
     }
     get(channelHex) {
         const row = this.#db
-            .prepare(`SELECT access, relays, guidance, retention_seconds FROM channel_config WHERE channel_pubkey = ?`)
+            .prepare(`SELECT access, relays, guidance, retention_seconds, members_visible, admin_pubkey
+           FROM channel_config WHERE channel_pubkey = ?`)
             .get(channelHex.toLowerCase());
         if (!row)
             return null;
@@ -43,16 +59,23 @@ export class ChannelConfigStore {
             relays,
             guidance: row.guidance,
             retention_seconds: Number(row.retention_seconds),
+            members_visible: Number(row.members_visible) === 1,
+            admin_pubkey: row.admin_pubkey,
         };
     }
     set(channelHex, config, now) {
         this.#db
-            .prepare(`INSERT INTO channel_config (channel_pubkey, access, relays, guidance, retention_seconds, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+            .prepare(
+        // ⚠️ `key_generation` is NOT in the update list, and must never be: it is advanced only by an
+        // ejection, and letting a settings edit touch it would silently re-key or un-re-key a channel.
+        `INSERT INTO channel_config
+           (channel_pubkey, access, relays, guidance, retention_seconds, members_visible, admin_pubkey, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (channel_pubkey) DO UPDATE SET
            access = excluded.access, relays = excluded.relays, guidance = excluded.guidance,
-           retention_seconds = excluded.retention_seconds, updated_at = excluded.updated_at`)
-            .run(channelHex.toLowerCase(), config.access, JSON.stringify(config.relays), config.guidance, config.retention_seconds, now);
+           retention_seconds = excluded.retention_seconds, members_visible = excluded.members_visible,
+           admin_pubkey = excluded.admin_pubkey, updated_at = excluded.updated_at`)
+            .run(channelHex.toLowerCase(), config.access, JSON.stringify(config.relays), config.guidance, config.retention_seconds, config.members_visible === true ? 1 : 0, config.admin_pubkey ?? "", now);
         this.#logger.info("channel.config.set", {
             channel_pubkey: channelHex, access: config.access, relays: config.relays.length,
         });

package/dist/channel-config-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"channel-config-store.js","sourceRoot":"","sources":["../src/channel-config-store.ts"],"names":[],"mappings":"AAkBA,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1D,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;kDAQS,MAAM,CAAC,yBAAyB,CAAC;;;CAGlF,CAAC;AASF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,UAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,iGAAiG,CAAC;aAC1G,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAElB,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAY,CAAC;YACjD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;YAC9F,sCAAsC;YACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAuB;YACnC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;SACjD,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,UAAkB,EAAE,MAAqB,EAAE,GAAW;QACxD,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;4FAIoF,CACrF;aACA,GAAG,CACF,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAC/C,CAAC;QACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACtC,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;SAChF,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"channel-config-store.js","sourceRoot":"","sources":["../src/channel-config-store.ts"],"names":[],"mappings":"AAkBA,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1D,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;kDAQS,MAAM,CAAC,yBAAyB,CAAC;;;;;;;;;;;;;;;;;;CAkBlF,CAAC;AAYF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,UAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN;wDACgD,CACjD;aACA,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAKlB,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAY,CAAC;YACjD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;YAC9F,sCAAsC;YACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAuB;YACnC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAChD,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;YAClD,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,UAAkB,EAAE,MAAqB,EAAE,GAAW;QACxD,IAAI,CAAC,GAAG;aACL,OAAO;QACN,8FAA8F;QAC9F,+FAA+F;QAC/F;;;;;;kFAM0E,CAC3E;aACA,GAAG,CACF,UAAU,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EACtE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EACzC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CACxE,CAAC;QACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACtC,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;SAChF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/channel-join-exchange.d.ts

@@ -0,0 +1,87 @@
+/**
+ * ChannelJoinExchange — M16 019-MEMBERSHIP Part B, both sides of joining a channel.
+ *
+ * A channel never converses. Its ADMIN is an ordinary agent, so a join is a typed exchange inside a
+ * normal sealed session with that admin — no new transport, no relay frames, no special case in the
+ * session layer.
+ *
+ * ─── The two identity checks, and why each is load-bearing ───────────────────────────────────
+ *
+ * **ADMIN side: the session counterparty must BE the subscriber the frame names.** The frame says
+ * who is joining and the session says who is talking; if they may differ, anyone can enrol a third
+ * party — and, worse, receive that third party's key bundle themselves, because the bundle is
+ * wrapped for the pubkey in the frame and sent down the session they are holding.
+ *
+ * **SUBSCRIBER side: the answering agent must be the admin in the channel's DIRECTORY PROFILE.**
+ * The session proves who the counterparty is. It does not prove they are this channel's admin. Drop
+ * this check and any agent that can open a session with you hands you a key bundle and a relay pair
+ * and becomes your channel: you read their posts believing them to be somebody else's, and the
+ * immutable `admin_pubkey` the design rests on protects nobody.
+ *
+ * ─── What is NOT decided here ────────────────────────────────────────────────────────────────
+ *
+ * Invite-only admission is the admin AGENT's decision. A request lands as `pending` and raises a
+ * notice; nothing in this file approves one. There is no heuristic, no allowlist, no auto-approve.
+ */
+import { encodeChannelRekey } from "@cello-protocol/protocol-types";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { Logger } from "./types.js";
+import type { ChannelMembershipStore } from "./channel-membership-store.js";
+import type { ChannelSubscriptionStore } from "./channel-subscription-store.js";
+/** What this daemon knows about a channel it administers. `null` means it does not administer one. */
+export interface LocalChannelAdmin {
+    agentId: string;
+    adminPubkeyHex: string;
+    channelKeyProvider: KeyProvider;
+    adminKeyProvider: KeyProvider;
+}
+export interface ChannelJoinExchangeDeps {
+    logger: Logger;
+    members: ChannelMembershipStore;
+    subscriptions: ChannelSubscriptionStore;
+    /** Put a frame on an open session. The session layer owns delivery; this owns the decisions. */
+    sendInSession: (sessionId: string, content: Uint8Array) => Promise<void>;
+    localChannelAdmin: (channelHex: string) => LocalChannelAdmin | null;
+    /**
+     * The channel's admin AS THE DIRECTORY REPORTS IT. `null` means the lookup could not be resolved,
+     * which FAILS CLOSED — an unreachable directory must not become "whoever answered is the admin".
+     */
+    profileAdminPubkey: (channelHex: string, agentId: string) => Promise<string | null>;
+    keyProviderFor: (agentId: string) => KeyProvider | null;
+    raiseNotice: (event: string, channelHex: string, subscriberHex: string) => void;
+    now?: () => number;
+}
+export type SubscriberJoinResult = {
+    ok: true;
+    channelHex: string;
+    generation: number;
+} | {
+    ok: false;
+    reason: "not_a_join_frame" | "malformed" | "not_admin_of_channel" | "admin_unresolved" | "key_unwrap_failed" | "no_key_provider";
+};
+export interface ChannelJoinExchange {
+    /** An inbound frame on the ADMIN's daemon. `consumed: false` means it was not a join frame. */
+    onAdminFrame: (sessionId: string, counterpartyHex: string, content: Uint8Array) => Promise<{
+        consumed: boolean;
+    }>;
+    /** An inbound acceptance or re-key on the SUBSCRIBER's daemon. */
+    onSubscriberFrame: (agentId: string, sessionId: string, counterpartyHex: string, content: Uint8Array) => Promise<SubscriberJoinResult>;
+    /** The admin agent's explicit decision on a pending invite-only request. */
+    approve: (channelHex: string, subscriberHex: string, sessionId: string) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Refuse a pending request by name. */
+    refuse: (channelHex: string, subscriberHex: string, sessionId: string) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+}
+export declare function createChannelJoinExchange(deps: ChannelJoinExchangeDeps): ChannelJoinExchange;
+/** Re-exported so the caller does not need a second import to build a re-key frame. */
+export { encodeChannelRekey };
+//# sourceMappingURL=channel-join-exchange.d.ts.map

package/dist/channel-join-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-join-exchange.d.ts","sourceRoot":"","sources":["../src/channel-join-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAEgD,kBAAkB,EAGxE,MAAM,gCAAgC,CAAC;AAIxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGhF,sGAAsG;AACtG,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,WAAW,CAAC;IAChC,gBAAgB,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,sBAAsB,CAAC;IAChC,aAAa,EAAE,wBAAwB,CAAC;IACxC,gGAAgG;IAChG,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,iBAAiB,GAAG,IAAI,CAAC;IACpE;;;OAGG;IACH,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,WAAW,GAAG,IAAI,CAAC;IACxD,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;IAChF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,GAAG,WAAW,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAEpJ,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClH,kEAAkE;IAClE,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvI,4EAA4E;IAC5E,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjI,wCAAwC;IACxC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjI;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB,CAgR5F;AAED,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,CAAC"}