@cello-protocol/daemon 0.0.3 → 0.0.4

package/dist/agent-loader.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Agent identity loader for the CELLO daemon.
+ *
+ * Pseudocode:
+ * 1. loadAgents(celloDir, logger):
+ *    a. Check if ~/.cello/agents/ exists
+ *    b. If not, check if ~/.cello/key exists (legacy single-agent mode)
+ *       - If legacy key exists, load it as agent 'default'
+ *    c. If agents/ exists, enumerate subdirectories
+ *       - For each subdir, check if a 'key' file exists
+ *       - If yes, attempt to load it via FileKeyProvider.load()
+ *       - If load fails (corrupt), log agent.load.failed and skip
+ *       - Subdirectories without a 'key' file are silently skipped
+ *    d. Return array of {name, pubkey} for successfully loaded agents
+ *
+ * Key file format: CELLO binary format (magic bytes + version + 32-byte Ed25519 seed)
+ * See core/crypto/src/ed25519.ts FileKeyProvider.load() for the canonical parser.
+ */
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { Logger } from "./types.js";
+export interface LoadedAgent {
+    name: string;
+    pubkey: string;
+    /**
+     * The agent's K_local signing key, retained so the daemon can produce
+     * K_local-signed control leaves (e.g. the SEAL-INTERRUPTED leaf in the
+     * seal-interrupted bilateral flow). The private scalar never leaves this
+     * provider — only signatures are emitted.
+     */
+    keyProvider: KeyProvider;
+}
+export interface FailedAgent {
+    name: string;
+    error: string;
+}
+export interface AgentLoadResult {
+    loaded: LoadedAgent[];
+    failed: FailedAgent[];
+}
+export declare function loadAgents(celloDir: string, logger: Logger): Promise<AgentLoadResult>;
+//# sourceMappingURL=agent-loader.d.ts.map

package/dist/agent-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loader.d.ts","sourceRoot":"","sources":["../src/agent-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAwC3F"}

package/dist/agent-loader.js

@@ -0,0 +1,94 @@
+/**
+ * Agent identity loader for the CELLO daemon.
+ *
+ * Pseudocode:
+ * 1. loadAgents(celloDir, logger):
+ *    a. Check if ~/.cello/agents/ exists
+ *    b. If not, check if ~/.cello/key exists (legacy single-agent mode)
+ *       - If legacy key exists, load it as agent 'default'
+ *    c. If agents/ exists, enumerate subdirectories
+ *       - For each subdir, check if a 'key' file exists
+ *       - If yes, attempt to load it via FileKeyProvider.load()
+ *       - If load fails (corrupt), log agent.load.failed and skip
+ *       - Subdirectories without a 'key' file are silently skipped
+ *    d. Return array of {name, pubkey} for successfully loaded agents
+ *
+ * Key file format: CELLO binary format (magic bytes + version + 32-byte Ed25519 seed)
+ * See core/crypto/src/ed25519.ts FileKeyProvider.load() for the canonical parser.
+ */
+import { readdir, stat, access } from "node:fs/promises";
+import { join } from "node:path";
+import { FileKeyProvider } from "@cello-protocol/crypto";
+export async function loadAgents(celloDir, logger) {
+    const agentsDir = join(celloDir, "agents");
+    const loaded = [];
+    const failed = [];
+    const agentsDirExists = await directoryExists(agentsDir);
+    if (!agentsDirExists) {
+        // Legacy backwards compat: if ~/.cello/key exists and ~/.cello/agents/ doesn't
+        const legacyKeyPath = join(celloDir, "key");
+        if (await fileExists(legacyKeyPath)) {
+            const result = await loadSingleAgent("default", legacyKeyPath, logger);
+            if (result.ok) {
+                loaded.push(result.agent);
+            }
+            else {
+                failed.push({ name: "default", error: result.error });
+            }
+        }
+        return { loaded, failed };
+    }
+    // Enumerate subdirectories of agents/
+    const entries = await readdir(agentsDir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const keyPath = join(agentsDir, entry.name, "key");
+        if (!(await fileExists(keyPath))) {
+            continue;
+        }
+        const result = await loadSingleAgent(entry.name, keyPath, logger);
+        if (result.ok) {
+            loaded.push(result.agent);
+        }
+        else {
+            failed.push({ name: entry.name, error: result.error });
+        }
+    }
+    return { loaded, failed };
+}
+async function loadSingleAgent(name, keyPath, logger) {
+    try {
+        const keyProvider = await FileKeyProvider.load(keyPath);
+        const pubkeyBytes = await keyProvider.getPublicKey();
+        const pubkey = Buffer.from(pubkeyBytes).toString("hex");
+        return { ok: true, agent: { name, pubkey, keyProvider } };
+    }
+    catch (err) {
+        const errorMsg = err instanceof Error ? err.message : String(err);
+        logger.error("agent.load.failed", {
+            agentName: name,
+            error: errorMsg,
+        });
+        return { ok: false, error: errorMsg };
+    }
+}
+async function directoryExists(path) {
+    try {
+        const s = await stat(path);
+        return s.isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function fileExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=agent-loader.js.map

package/dist/agent-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loader.js","sourceRoot":"","sources":["../src/agent-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA0BzD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAc;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,+EAA+E;QAC/E,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAMD,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,OAAe,EACf,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YAChC,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/bin/cello-daemon.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * cello-daemon — the long-running CELLO daemon process.
+ *
+ * This binary is spawned by `cello login` as a detached background process.
+ * It manages agent identities, IPC connections, and (future) directory signaling.
+ *
+ * Environment variables:
+ *   CELLO_DIR       Override ~/.cello directory (default: ~/.cello)
+ *   CELLO_VERSION   Version string for lock file (default: from package.json)
+ */
+export {};
+//# sourceMappingURL=cello-daemon.d.ts.map

package/dist/bin/cello-daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cello-daemon.d.ts","sourceRoot":"","sources":["../../src/bin/cello-daemon.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG"}

package/dist/bin/cello-daemon.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+/**
+ * cello-daemon — the long-running CELLO daemon process.
+ *
+ * This binary is spawned by `cello login` as a detached background process.
+ * It manages agent identities, IPC connections, and (future) directory signaling.
+ *
+ * Environment variables:
+ *   CELLO_DIR       Override ~/.cello directory (default: ~/.cello)
+ *   CELLO_VERSION   Version string for lock file (default: from package.json)
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { startDaemon } from "../daemon.js";
+import { createDirectoryEndpointResolver } from "../directory-bootstrap.js";
+import { FileManifestProvider } from "../file-manifest-provider.js";
+import { FileManifestVersionStore } from "../manifest-version-store-file.js";
+import { RandomizedPollScheduler } from "../manifest-poll-scheduler.js";
+import { ManifestDirectoryChallengeVerifier } from "@cello-protocol/transport";
+const MAX_CONNECTIONS = 16;
+// Composition root: stdout JSON logger
+const logger = {
+    debug(event, context) {
+        const line = JSON.stringify({ level: "debug", event, ...context, ts: new Date().toISOString() });
+        process.stdout.write(line + "\n");
+    },
+    info(event, context) {
+        const line = JSON.stringify({ level: "info", event, ...context, ts: new Date().toISOString() });
+        process.stdout.write(line + "\n");
+    },
+    warn(event, context) {
+        const line = JSON.stringify({ level: "warn", event, ...context, ts: new Date().toISOString() });
+        process.stdout.write(line + "\n");
+    },
+    error(event, context) {
+        const line = JSON.stringify({ level: "error", event, ...context, ts: new Date().toISOString() });
+        process.stdout.write(line + "\n");
+    },
+};
+const celloDir = process.env.CELLO_DIR || join(homedir(), ".cello");
+const socketPath = join(celloDir, "daemon.sock");
+const lockFilePath = join(celloDir, "daemon.lock");
+const version = process.env.CELLO_VERSION || "0.0.1";
+/**
+ * Build the optional consortium-manifest deps from the environment (M7 J-AUTH).
+ *
+ *   CELLO_CONSORTIUM_MANIFEST    absolute path to the manifest JSON
+ *   CELLO_CONSORTIUM_ROOT_KEYS   comma-separated officer root pubkeys (hex)
+ *   CELLO_CONSORTIUM_THRESHOLD   minimum officer signatures (integer)
+ *
+ * When the manifest path is unset, returns {} — step-6 stays off (M6 compat).
+ * One FileManifestProvider instance is shared between startDaemon's loadAndVerify
+ * call and the ManifestDirectoryChallengeVerifier, so step-6 reads the same cached,
+ * verified manifest.
+ */
+function buildManifestDeps(logger) {
+    const manifestPath = process.env.CELLO_CONSORTIUM_MANIFEST;
+    if (!manifestPath)
+        return {};
+    const rootKeysRaw = process.env.CELLO_CONSORTIUM_ROOT_KEYS ?? "";
+    const manifestRootKeys = rootKeysRaw.split(",").map((k) => k.trim()).filter((k) => k.length > 0);
+    const manifestThreshold = Number.parseInt(process.env.CELLO_CONSORTIUM_THRESHOLD ?? "", 10);
+    if (manifestRootKeys.length === 0 || Number.isNaN(manifestThreshold)) {
+        throw new Error("CELLO_CONSORTIUM_MANIFEST is set but CELLO_CONSORTIUM_ROOT_KEYS / CELLO_CONSORTIUM_THRESHOLD are missing or invalid");
+    }
+    const manifestProvider = new FileManifestProvider({ path: manifestPath });
+    const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider);
+    // Anti-rollback (DOD-AUTH-2 / TUF): persist the last-verified manifest version under
+    // ~/.cello so the daemon refuses a manifest whose version regressed across restarts.
+    // The daemon (startDaemon) reads getLastSeenVersion() before accepting a manifest and
+    // persistVersion() on success; a version < trusted → directory.auth.manifest.version.rollback.
+    const manifestVersionStore = new FileManifestVersionStore(join(celloDir, "manifest-version.json"));
+    // DOD-AUTH-2: background manifest poll. The directory is re-polled on a randomized
+    // 6–12h interval (thundering-herd avoidance) and a newer signed manifest is adopted.
+    // The interval is env-injectable so the live binary test can poll sub-second instead
+    // of waiting hours; production leaves these unset → the 6–12h default window.
+    // Both-or-neither, positive, min <= max — a partial/invalid override fails LOUDLY
+    // rather than silently reverting to 6–12h or producing a negative (tight-loop) delay.
+    const rawPollMin = process.env.CELLO_MANIFEST_POLL_MIN_MS;
+    const rawPollMax = process.env.CELLO_MANIFEST_POLL_MAX_MS;
+    let pollOpts;
+    if (rawPollMin !== undefined || rawPollMax !== undefined) {
+        const minMs = Number.parseInt(rawPollMin ?? "", 10);
+        const maxMs = Number.parseInt(rawPollMax ?? "", 10);
+        if (Number.isNaN(minMs) || Number.isNaN(maxMs) || minMs <= 0 || maxMs < minMs) {
+            throw new Error("CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS must BOTH be set to positive integers with min <= max");
+        }
+        pollOpts = { minMs, maxMs };
+    }
+    const manifestPollScheduler = new RandomizedPollScheduler(pollOpts);
+    logger.info("daemon.manifest.configured", {
+        manifestPath,
+        rootKeyCount: manifestRootKeys.length,
+        threshold: manifestThreshold,
+        pollMinMs: pollOpts?.minMs ?? null,
+        pollMaxMs: pollOpts?.maxMs ?? null,
+    });
+    return { manifestProvider, manifestRootKeys, manifestThreshold, challengeVerifier, manifestVersionStore, manifestPollScheduler };
+}
+async function main() {
+    // M7 Keystone (Part 1): give the daemon its door to the directory. The resolver
+    // discovers the directory endpoint via GET ${CELLO_DIRECTORY_URL}/bootstrap (the
+    // proven M6 path); startDaemon builds the real signalingConnect from it + the
+    // primary agent identity.
+    const directoryEndpointResolver = createDirectoryEndpointResolver({ logger });
+    // M7 J-AUTH (DOD-AUTH-1/2): the consortium-manifest hardening is OPT-IN. When the
+    // operator (or the live harness) configures a manifest, the daemon loads + verifies
+    // it (threshold officer signatures + validity window) and verifies the directory's
+    // step-6 identity proof against the node pubkeys in that manifest. When unset, the
+    // daemon runs the M6 backward-compat path: no challengeVerifier → step-6 skipped.
+    // Both dialers (keystone + per-agent) receive the verifier via startDaemon.
+    const manifest = buildManifestDeps(logger);
+    const handle = await startDaemon({
+        celloDir,
+        socketPath,
+        lockFilePath,
+        maxConnections: MAX_CONNECTIONS,
+        version,
+        logger,
+        directoryEndpointResolver,
+        ...manifest,
+    });
+    const shutdown = async (signal) => {
+        await handle.stop(signal);
+        process.exit(0);
+    };
+    process.on("SIGTERM", () => {
+        try {
+            shutdown("SIGTERM").catch((err) => {
+                logger.error("daemon.shutdown.failed", {
+                    signal: "SIGTERM",
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                process.exit(1);
+            });
+        }
+        catch (err) {
+            logger.error("daemon.shutdown.failed", {
+                signal: "SIGTERM",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            process.exit(1);
+        }
+    });
+    process.on("SIGINT", () => {
+        try {
+            shutdown("SIGINT").catch((err) => {
+                logger.error("daemon.shutdown.failed", {
+                    signal: "SIGINT",
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                process.exit(1);
+            });
+        }
+        catch (err) {
+            logger.error("daemon.shutdown.failed", {
+                signal: "SIGINT",
+                error: err instanceof Error ? err.message : String(err),
+            });
+            process.exit(1);
+        }
+    });
+}
+main().catch((err) => {
+    logger.error("daemon.startup.failed", {
+        error: err instanceof Error ? err.message : String(err),
+    });
+    process.exit(1);
+});
+//# sourceMappingURL=cello-daemon.js.map

package/dist/bin/cello-daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cello-daemon.js","sourceRoot":"","sources":["../../src/bin/cello-daemon.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,EAAE,kCAAkC,EAAqH,MAAM,2BAA2B,CAAC;AAElM,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,uCAAuC;AACvC,MAAM,MAAM,GAAW;IACrB,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,MAAc;IAQvC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;IACjE,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;IACnF,qFAAqF;IACrF,qFAAqF;IACrF,sFAAsF;IACtF,+FAA+F;IAC/F,MAAM,oBAAoB,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACnG,mFAAmF;IACnF,qFAAqF;IACrF,qFAAqF;IACrF,8EAA8E;IAC9E,kFAAkF;IAClF,sFAAsF;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,IAAI,QAAsD,CAAC;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,YAAY;QACZ,YAAY,EAAE,gBAAgB,CAAC,MAAM;QACrC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;QAClC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC;AACnI,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,0BAA0B;IAC1B,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAE9E,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,mFAAmF;IACnF,kFAAkF;IAClF,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,QAAQ;QACR,UAAU;QACV,YAAY;QACZ,cAAc,EAAE,eAAe;QAC/B,OAAO;QACP,MAAM;QACN,yBAAyB;QACzB,GAAG,QAAQ;KACZ,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACzC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;QACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cello-node-transport-dialer.d.ts

@@ -0,0 +1,59 @@
+/**
+ * CELLO Daemon — cello-node-transport-dialer.ts (CELLO-M7-TRANSPORT-001)
+ *
+ * CelloNodeTransportDialer — the REAL TransportDialer (CELLO_ENV dev/staging/
+ * production). It performs the low-level dial operations the TransportSelector
+ * composes, over a live session CelloNode plus the daemon's relay registry.
+ *
+ * Review finding C1(b): no real TransportDialer existed — only the
+ * LocalTransportSelectorStub returned canned results. This is the production
+ * implementation the composition root wires when CELLO_ENV is a production
+ * variant.
+ *
+ * ─── Operations ──────────────────────────────────────────────────────────────
+ *   dialDirect(peerId, addrs, timeoutMs) — dial the counterparty's direct
+ *     multiaddrs (TCP/QUIC). Each addr is raced against timeoutMs. Throws if every
+ *     address fails (the selector catches and falls back to relay — AC-006).
+ *   dialRelay(relayCircuitAddr, peerId)  — dial via the relay circuit address.
+ *   relayCircuitAddr(assignment)         — build the circuit address from the
+ *     daemon's relay registry (NOT the assignment's address fields — AC-006), so
+ *     the fallback works regardless of transport_mode.
+ *   attemptDcutr(peerId)                 — observe whether libp2p's automatic
+ *     dcutr hole-punch upgraded the relayed connection to direct within a window.
+ *     Throws if no direct connection appears (non-fatal — selector logs DEBUG).
+ *
+ * SI-001: this dialer NEVER inspects transport_mode or infers strategy from
+ * address format — it only performs the operation the selector asks for. The
+ * authoritative transport_mode decision lives entirely in the TransportSelector.
+ */
+import type { SessionAssignment } from "@cello-protocol/protocol-types";
+import type { CelloNode } from "@cello-protocol/transport";
+import type { TransportDialer } from "./transport-selector.js";
+/** A relay endpoint from the daemon's relay registry (populated at directory connect). */
+export interface RelayEndpoint {
+    peerId: string;
+    multiaddrs: string[];
+}
+export interface CelloNodeTransportDialerOptions {
+    /** The session node used to dial the counterparty. */
+    node: CelloNode;
+    /**
+     * The daemon's relay registry — returns the known relay endpoint, or null when
+     * no relay is registered. AC-006: the relay address is sourced here, never
+     * parsed from the assignment's address fields.
+     */
+    relayRegistry: () => RelayEndpoint | null;
+    /** How long to wait for the dcutr upgrade to surface a direct connection (ms). */
+    dcutrObserveTimeoutMs?: number;
+    /** Poll interval while observing for the dcutr upgrade (ms). */
+    dcutrPollIntervalMs?: number;
+}
+export declare class CelloNodeTransportDialer implements TransportDialer {
+    #private;
+    constructor(opts: CelloNodeTransportDialerOptions);
+    dialDirect(peerId: string | undefined, addrs: string[], timeoutMs: number): Promise<void>;
+    dialRelay(relayCircuitAddr: string, _peerId: string | undefined): Promise<void>;
+    relayCircuitAddr(assignment: SessionAssignment): string;
+    attemptDcutr(peerId: string | undefined): Promise<void>;
+}
+//# sourceMappingURL=cello-node-transport-dialer.d.ts.map

package/dist/cello-node-transport-dialer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cello-node-transport-dialer.d.ts","sourceRoot":"","sources":["../src/cello-node-transport-dialer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC9C,sDAAsD;IACtD,IAAI,EAAE,SAAS,CAAC;IAChB;;;;OAIG;IACH,aAAa,EAAE,MAAM,aAAa,GAAG,IAAI,CAAC;IAC1C,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAKD,qBAAa,wBAAyB,YAAW,eAAe;;gBAMlD,IAAI,EAAE,+BAA+B;IAO3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzF,SAAS,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,GAAG,MAAM;IAajD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CA8B9D"}

package/dist/cello-node-transport-dialer.js

@@ -0,0 +1,108 @@
+/**
+ * CELLO Daemon — cello-node-transport-dialer.ts (CELLO-M7-TRANSPORT-001)
+ *
+ * CelloNodeTransportDialer — the REAL TransportDialer (CELLO_ENV dev/staging/
+ * production). It performs the low-level dial operations the TransportSelector
+ * composes, over a live session CelloNode plus the daemon's relay registry.
+ *
+ * Review finding C1(b): no real TransportDialer existed — only the
+ * LocalTransportSelectorStub returned canned results. This is the production
+ * implementation the composition root wires when CELLO_ENV is a production
+ * variant.
+ *
+ * ─── Operations ──────────────────────────────────────────────────────────────
+ *   dialDirect(peerId, addrs, timeoutMs) — dial the counterparty's direct
+ *     multiaddrs (TCP/QUIC). Each addr is raced against timeoutMs. Throws if every
+ *     address fails (the selector catches and falls back to relay — AC-006).
+ *   dialRelay(relayCircuitAddr, peerId)  — dial via the relay circuit address.
+ *   relayCircuitAddr(assignment)         — build the circuit address from the
+ *     daemon's relay registry (NOT the assignment's address fields — AC-006), so
+ *     the fallback works regardless of transport_mode.
+ *   attemptDcutr(peerId)                 — observe whether libp2p's automatic
+ *     dcutr hole-punch upgraded the relayed connection to direct within a window.
+ *     Throws if no direct connection appears (non-fatal — selector logs DEBUG).
+ *
+ * SI-001: this dialer NEVER inspects transport_mode or infers strategy from
+ * address format — it only performs the operation the selector asks for. The
+ * authoritative transport_mode decision lives entirely in the TransportSelector.
+ */
+const DEFAULT_DCUTR_OBSERVE_TIMEOUT_MS = 10_000;
+const DEFAULT_DCUTR_POLL_INTERVAL_MS = 250;
+export class CelloNodeTransportDialer {
+    #node;
+    #relayRegistry;
+    #dcutrTimeoutMs;
+    #dcutrPollMs;
+    constructor(opts) {
+        this.#node = opts.node;
+        this.#relayRegistry = opts.relayRegistry;
+        this.#dcutrTimeoutMs = opts.dcutrObserveTimeoutMs ?? DEFAULT_DCUTR_OBSERVE_TIMEOUT_MS;
+        this.#dcutrPollMs = opts.dcutrPollIntervalMs ?? DEFAULT_DCUTR_POLL_INTERVAL_MS;
+    }
+    async dialDirect(peerId, addrs, timeoutMs) {
+        if (addrs.length === 0) {
+            throw new Error("no direct addresses to dial");
+        }
+        let lastError;
+        for (const addr of addrs) {
+            try {
+                await this.#withTimeout(this.#node.dial(addr), timeoutMs, `direct dial to ${addr}`);
+                return; // first successful dial wins
+            }
+            catch (err) {
+                lastError = err;
+            }
+        }
+        throw lastError instanceof Error
+            ? lastError
+            : new Error(`direct dial failed for all ${addrs.length} address(es): ${String(lastError)}`);
+    }
+    async dialRelay(relayCircuitAddr, _peerId) {
+        await this.#node.dial(relayCircuitAddr);
+    }
+    relayCircuitAddr(assignment) {
+        const relay = this.#relayRegistry();
+        if (!relay || relay.multiaddrs.length === 0) {
+            throw new Error("no relay endpoint registered — cannot build relay circuit address");
+        }
+        const counterparty = assignment.counterparty_session_peer_id;
+        if (!counterparty) {
+            throw new Error("assignment has no counterparty_session_peer_id for the relay circuit");
+        }
+        // /<relay-multiaddr>/p2p/<relay-peer-id>/p2p-circuit/p2p/<counterparty-session-peer-id>
+        return `${relay.multiaddrs[0]}/p2p/${relay.peerId}/p2p-circuit/p2p/${counterparty}`;
+    }
+    async attemptDcutr(peerId) {
+        if (!peerId) {
+            throw new Error("no counterparty peer id to observe dcutr upgrade for");
+        }
+        // libp2p's dcutr service runs automatically once a relayed connection exists.
+        // We observe whether it produced a direct (non-circuit) connection within the
+        // window. This is best-effort — failure is non-fatal (SI-003).
+        const deadline = Date.now() + this.#dcutrTimeoutMs;
+        for (;;) {
+            if (this.#node.hasDirectConnectionTo(peerId))
+                return;
+            if (Date.now() >= deadline) {
+                throw new Error(`dcutr did not establish a direct connection to ${peerId} within ${this.#dcutrTimeoutMs}ms`);
+            }
+            await new Promise((r) => setTimeout(r, this.#dcutrPollMs));
+        }
+    }
+    async #withTimeout(p, timeoutMs, label) {
+        let timer;
+        try {
+            return await Promise.race([
+                p,
+                new Promise((_resolve, reject) => {
+                    timer = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=cello-node-transport-dialer.js.map

package/dist/cello-node-transport-dialer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cello-node-transport-dialer.js","sourceRoot":"","sources":["../src/cello-node-transport-dialer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA2BH,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAChD,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAE3C,MAAM,OAAO,wBAAwB;IAC1B,KAAK,CAAY;IACjB,cAAc,CAA6B;IAC3C,eAAe,CAAS;IACxB,YAAY,CAAS;IAE9B,YAAY,IAAqC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;QACtF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAA0B,EAAE,KAAe,EAAE,SAAiB;QAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,SAAkB,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;gBACpF,OAAO,CAAC,6BAA6B;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,MAAM,SAAS,YAAY,KAAK;YAC9B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,MAAM,iBAAiB,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,gBAAwB,EAAE,OAA2B;QACnE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC;IAED,gBAAgB,CAAC,UAA6B;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,YAAY,GAAG,UAAU,CAAC,4BAA4B,CAAC;QAC7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,wFAAwF;QACxF,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,MAAM,oBAAoB,YAAY,EAAE,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA0B;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QACnD,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC;gBAAE,OAAO;YACrD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,WAAW,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAI,CAAa,EAAE,SAAiB,EAAE,KAAa;QACnE,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxB,CAAC;gBACD,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;oBACtC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACpG,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}

package/dist/challenge-verifier.d.ts

@@ -0,0 +1,12 @@
+/**
+ * M7-MANIFEST-002 — Challenge verifier re-exports.
+ *
+ * The production verifier (ManifestDirectoryChallengeVerifier) and test stub
+ * (TestDirectoryChallengeVerifier) are both defined in @cello-protocol/transport
+ * to avoid creating a circular dependency between daemon and transport.
+ *
+ * This module re-exports them for consumers that import from the daemon package.
+ */
+export { ManifestDirectoryChallengeVerifier, TestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
+export type { IDirectoryChallengeVerifier } from "@cello-protocol/transport";
+//# sourceMappingURL=challenge-verifier.d.ts.map

package/dist/challenge-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-verifier.d.ts","sourceRoot":"","sources":["../src/challenge-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/challenge-verifier.js

@@ -0,0 +1,11 @@
+/**
+ * M7-MANIFEST-002 — Challenge verifier re-exports.
+ *
+ * The production verifier (ManifestDirectoryChallengeVerifier) and test stub
+ * (TestDirectoryChallengeVerifier) are both defined in @cello-protocol/transport
+ * to avoid creating a circular dependency between daemon and transport.
+ *
+ * This module re-exports them for consumers that import from the daemon package.
+ */
+export { ManifestDirectoryChallengeVerifier, TestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
+//# sourceMappingURL=challenge-verifier.js.map

package/dist/challenge-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-verifier.js","sourceRoot":"","sources":["../src/challenge-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC"}

package/dist/connect-or-start.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Connect-or-start logic for the CELLO daemon.
+ *
+ * Pseudocode:
+ * 1. connectOrStart(celloDir, logger):
+ *    a. Read lock file at ~/.cello/daemon.lock
+ *    b. If lock exists:
+ *       - Check if PID is alive (signal 0)
+ *       - If alive, attempt to connect to socket
+ *       - If connection succeeds, return existing daemon client
+ *       - If connection fails (socket gone), remove stale lock and start fresh
+ *    c. If lock doesn't exist or is stale:
+ *       - Remove stale lock (log daemon_lock_stale_removed)
+ *       - Spawn daemon as detached child process
+ *       - Wait for daemon.started event (read from child stdout)
+ *       - Return client connected to new daemon
+ */
+import { type IpcClient } from "./ipc-client.js";
+import type { Logger } from "./types.js";
+export interface ConnectResult {
+    client: IpcClient;
+    alreadyRunning: boolean;
+}
+export declare function connectOrStart(celloDir: string, logger: Logger, daemonBin: string): Promise<ConnectResult>;
+//# sourceMappingURL=connect-or-start.d.ts.map

package/dist/connect-or-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-or-start.d.ts","sourceRoot":"","sources":["../src/connect-or-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC,CAiCxB"}