@cello-protocol/daemon 0.0.43 → 0.0.45

package/dist/agent-id-migration.d.ts

@@ -0,0 +1,61 @@
+/**
+ * DOD-AGENT-ID-JOINKEY-1 — finish the migration REMOVE-001 started.
+ *
+ * `agent_name` was the original PRIMARY KEY of `agents`. REMOVE-001 added the stable surrogate
+ * `agent_id` **specifically to make names reusable** (retire keeps the rows and FREES the name), and
+ * migrated only the parent table. SEVEN child tables were left joining on the column that had just
+ * become a mutable, reusable attribute:
+ *
+ *   sessions · seal_interrupted_artifacts · session_tree_leaves · transcript · message_watermarks ·
+ *   contacts · retry_queue
+ *
+ * (`retry_queue` is the seventh — it predates REMOVE-001, so REMOVE-001 skipped seven, not six.)
+ *
+ * The hazard is not stale data. Retire an agent, create a new one with the freed name — a different
+ * agent_id and a different K_local keypair — and every `WHERE agent_name = ?` hands the new identity
+ * the dead one's transcript, its contact whitelist (an ACCESS-CONTROL list), and its interrupted
+ * sessions. Resuming one would seal with the wrong keypair.
+ *
+ * This module carries `agent_id` into all seven and demotes `agent_name` to what it always was after
+ * REMOVE-001: a display label on the parent table, with exactly one source of truth.
+ *
+ * ── Why this is safe, and why it deletes nothing ────────────────────────────────────────────────
+ * Purely client-side. The directory has no `agent_name` column and never sees one (AC1's wire proof:
+ * parties are identified by pubkey + session_id; a name reaches the wire only as the self-declared
+ * `offered_moniker` display label, which this migration does not touch). No row content is destroyed:
+ * every row is COPIED into the new table before the old one is dropped. Retire-reuse orphans need no
+ * purge either — once joined on `agent_id`, a new same-named agent simply never matches them.
+ *
+ * ── Why one transaction ─────────────────────────────────────────────────────────────────────────
+ * SQLite cannot alter a PRIMARY KEY, so each table must be REBUILT (create, copy, drop, rename).
+ * SQLite DDL is transactional, so all seven rebuilds run inside ONE `BEGIN…COMMIT`: a crash rolls the
+ * entire migration back atomically and the daemon reopens on the untouched original schema. There is
+ * no half-migrated state to recover from, and therefore no recovery code to get wrong.
+ *
+ * ── Why the target schema is pinned literally here ──────────────────────────────────────────────
+ * The DDL below duplicates what `session-node-manager` / `retry-queue` create on a fresh database.
+ * That duplication is DELIBERATE. A migration must migrate to a FIXED target: if it read its target
+ * from the live schema, a future column added upstream would silently change what this migration
+ * produces on an old database, and the two shapes would drift apart unnoticed. The drift is instead
+ * caught by a test that asserts a MIGRATED database's schema is byte-identical to a FRESH one.
+ */
+import type { Logger } from "./types.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+export interface AgentIdMigrationResult {
+    readonly migrated: boolean;
+    /** Rows copied, per rebuilt table. Absent tables are omitted. */
+    readonly rowCounts: Readonly<Record<string, number>>;
+}
+/**
+ * Re-key the seven child tables from `agent_name` to `agent_id`. Idempotent: a table that already has
+ * an `agent_id` column is skipped, so a second call is a no-op. All rebuilds share ONE transaction.
+ *
+ * Throws (leaving the database untouched) on:
+ *   - an ambiguous `agent_name → agent_id` map (a reused retired name),
+ *   - any row whose non-null `agent_name` does not resolve to an agent,
+ *   - any row count that does not match pre-migration.
+ *
+ * Never half-commits, never silently drops a row, never invents an agent_id.
+ */
+export declare function migrateSessionTablesToAgentId(db: DaemonDatabase, logger: Logger): AgentIdMigrationResult;
+//# sourceMappingURL=agent-id-migration.d.ts.map

package/dist/agent-id-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-id-migration.d.ts","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAoJxD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAyDD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,CA0HxG"}

package/dist/agent-id-migration.js

@@ -0,0 +1,331 @@
+/**
+ * DOD-AGENT-ID-JOINKEY-1 — finish the migration REMOVE-001 started.
+ *
+ * `agent_name` was the original PRIMARY KEY of `agents`. REMOVE-001 added the stable surrogate
+ * `agent_id` **specifically to make names reusable** (retire keeps the rows and FREES the name), and
+ * migrated only the parent table. SEVEN child tables were left joining on the column that had just
+ * become a mutable, reusable attribute:
+ *
+ *   sessions · seal_interrupted_artifacts · session_tree_leaves · transcript · message_watermarks ·
+ *   contacts · retry_queue
+ *
+ * (`retry_queue` is the seventh — it predates REMOVE-001, so REMOVE-001 skipped seven, not six.)
+ *
+ * The hazard is not stale data. Retire an agent, create a new one with the freed name — a different
+ * agent_id and a different K_local keypair — and every `WHERE agent_name = ?` hands the new identity
+ * the dead one's transcript, its contact whitelist (an ACCESS-CONTROL list), and its interrupted
+ * sessions. Resuming one would seal with the wrong keypair.
+ *
+ * This module carries `agent_id` into all seven and demotes `agent_name` to what it always was after
+ * REMOVE-001: a display label on the parent table, with exactly one source of truth.
+ *
+ * ── Why this is safe, and why it deletes nothing ────────────────────────────────────────────────
+ * Purely client-side. The directory has no `agent_name` column and never sees one (AC1's wire proof:
+ * parties are identified by pubkey + session_id; a name reaches the wire only as the self-declared
+ * `offered_moniker` display label, which this migration does not touch). No row content is destroyed:
+ * every row is COPIED into the new table before the old one is dropped. Retire-reuse orphans need no
+ * purge either — once joined on `agent_id`, a new same-named agent simply never matches them.
+ *
+ * ── Why one transaction ─────────────────────────────────────────────────────────────────────────
+ * SQLite cannot alter a PRIMARY KEY, so each table must be REBUILT (create, copy, drop, rename).
+ * SQLite DDL is transactional, so all seven rebuilds run inside ONE `BEGIN…COMMIT`: a crash rolls the
+ * entire migration back atomically and the daemon reopens on the untouched original schema. There is
+ * no half-migrated state to recover from, and therefore no recovery code to get wrong.
+ *
+ * ── Why the target schema is pinned literally here ──────────────────────────────────────────────
+ * The DDL below duplicates what `session-node-manager` / `retry-queue` create on a fresh database.
+ * That duplication is DELIBERATE. A migration must migrate to a FIXED target: if it read its target
+ * from the live schema, a future column added upstream would silently change what this migration
+ * produces on an old database, and the two shapes would drift apart unnoticed. The drift is instead
+ * caught by a test that asserts a MIGRATED database's schema is byte-identical to a FRESH one.
+ */
+const REKEY_TARGETS = [
+    {
+        table: "sessions",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        session_id TEXT NOT NULL,
+        agent_id TEXT NOT NULL,
+        counterparty_pubkey TEXT NOT NULL,
+        status TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        message_count INTEGER NOT NULL DEFAULT 0,
+        interrupted_at TEXT,
+        relay_peer_id TEXT,
+        relay_addrs TEXT,
+        seal_legibility TEXT,
+        sealed_root_hex TEXT,
+        counterparty_primary_pubkey TEXT,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "seal_interrupted_artifacts",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        own_leaf TEXT NOT NULL,
+        counterparty_leaf TEXT NOT NULL,
+        merkle_root TEXT NOT NULL,
+        nonce TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "session_tree_leaves",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        leaf_index INTEGER NOT NULL,
+        leaf_kind TEXT NOT NULL,
+        leaf_hash_hex TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, leaf_index)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "transcript",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        sequence INTEGER NOT NULL,
+        direction TEXT NOT NULL,
+        blob BLOB NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, sequence, direction)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "message_watermarks",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        last_delivered_seq INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "contacts",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        pubkey TEXT NOT NULL,
+        added_at INTEGER NOT NULL,
+        moniker TEXT,
+        PRIMARY KEY (agent_id, pubkey)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        // The SEVENTH. DOD-LOOP-1 added `agent_name` here so two of the operator's agents could hold
+        // awaiting content for the SAME session_id without colliding — then left the agent OUT of the
+        // uniqueness constraint, which stayed `UNIQUE(session_id, nonce_hex)`. For an awaiting row,
+        // nonce_hex IS the content hash, so two local agents parking identical content in one session
+        // collided, and the collision was swallowed into memory and lost on the next restart.
+        //
+        // The correct constraint falls out of the re-key. It is expressed as a UNIQUE INDEX over
+        // COALESCE(agent_id, '') rather than a table constraint, because SQLite treats NULLs as DISTINCT
+        // in a UNIQUE constraint: with a bare UNIQUE(agent_id, session_id, nonce_hex), the legacy
+        // agent-less direct-retry rows (agent_id NULL) would lose the (session_id, nonce_hex) dedup they
+        // have always had. COALESCE folds every agent-less row into one bucket, preserving exactly the
+        // old semantics for them while giving each agent its own namespace.
+        table: "retry_queue",
+        backfill: "nullable",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        id              INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id      TEXT    NOT NULL,
+        agent_id        TEXT,
+        nonce_hex       TEXT    NOT NULL,
+        content_blob    BLOB    NOT NULL,
+        queued_at       INTEGER NOT NULL,
+        attempts        INTEGER NOT NULL DEFAULT 1,
+        position        INTEGER NOT NULL,
+        awaiting_ack    INTEGER NOT NULL DEFAULT 0,
+        content_hash_hex TEXT
+      )`,
+        indexSql: (t) => [
+            `CREATE INDEX IF NOT EXISTS retry_queue_by_session_position ON ${t}(session_id, position ASC)`,
+            `CREATE UNIQUE INDEX IF NOT EXISTS retry_queue_agent_session_nonce ON ${t}(COALESCE(agent_id, ''), session_id, nonce_hex)`,
+        ],
+    },
+];
+function columnsOf(db, table) {
+    return db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
+}
+function tableExists(db, table) {
+    return (db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== undefined);
+}
+/**
+ * The `agent_name → agent_id` map, over ALL agent rows INCLUDING retired ones (a retired agent's rows
+ * must backfill to its OWN id and then sit inert — never be re-attributed to the live agent that
+ * reused its name).
+ *
+ * If any name resolves to more than one agent_id the map is AMBIGUOUS and the migration ABORTS. It
+ * does not guess, does not prefer the newest, does not prefer the oldest. A wrong attribution here
+ * would silently bind one identity's transcript, contacts and interrupted sessions to a DIFFERENT
+ * keypair — which is precisely the defect this migration exists to remove, except made permanent,
+ * unauditable, and blessed by a migration. A loud abort costs a wipe on a single-operator machine; a
+ * silent guess costs correctness forever.
+ *
+ * (A timestamp-based disambiguation is available in principle — rows written after the new agent's
+ * creation must belong to it, since a retired agent cannot write. It is deliberately NOT used: it
+ * depends on all seven tables carrying a trustworthy timestamp, and cleverness buys nothing on a
+ * database we would happily wipe.)
+ */
+function buildNameToAgentId(db) {
+    const rows = db
+        .prepare("SELECT agent_name, agent_id FROM agents")
+        .all();
+    const map = new Map();
+    const ambiguous = new Set();
+    for (const r of rows) {
+        if (map.has(r.agent_name))
+            ambiguous.add(r.agent_name);
+        map.set(r.agent_name, r.agent_id);
+    }
+    if (ambiguous.size > 0) {
+        throw new Error(`agent_id_backfill_ambiguous: agent name(s) [${[...ambiguous].sort().join(", ")}] resolve to more ` +
+            `than one agent_id (a retired agent's name was reused). The migration cannot know which identity ` +
+            `owns the existing session rows and refuses to guess — attributing them to the wrong keypair is ` +
+            `the very defect it exists to remove. Resolve by hand or start from a fresh database.`);
+    }
+    return map;
+}
+/** Does this table still need re-keying? True iff it exists and has no `agent_id` column. */
+function needsRekey(db, table) {
+    if (!tableExists(db, table))
+        return false;
+    return !columnsOf(db, table).includes("agent_id");
+}
+/**
+ * Re-key the seven child tables from `agent_name` to `agent_id`. Idempotent: a table that already has
+ * an `agent_id` column is skipped, so a second call is a no-op. All rebuilds share ONE transaction.
+ *
+ * Throws (leaving the database untouched) on:
+ *   - an ambiguous `agent_name → agent_id` map (a reused retired name),
+ *   - any row whose non-null `agent_name` does not resolve to an agent,
+ *   - any row count that does not match pre-migration.
+ *
+ * Never half-commits, never silently drops a row, never invents an agent_id.
+ */
+export function migrateSessionTablesToAgentId(db, logger) {
+    const pending = REKEY_TARGETS.filter((t) => needsRekey(db, t.table));
+    if (pending.length === 0)
+        return { migrated: false, rowCounts: {} };
+    // Ambiguity is checked BEFORE the transaction opens: nothing has been touched when it throws. It
+    // is logged with the same failure event as an in-transaction abort — a refusal to migrate is a
+    // loud event regardless of WHERE in the process it was detected.
+    let nameToId;
+    try {
+        nameToId = buildNameToAgentId(db);
+    }
+    catch (err) {
+        logger.error("daemon.migration.agent_id_backfill.failed", {
+            tables: pending.map((t) => t.table),
+            reason: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    const before = new Map();
+    for (const t of pending) {
+        before.set(t.table, db.prepare(`SELECT COUNT(*) AS n FROM ${t.table}`).get().n);
+    }
+    const rowCounts = {};
+    db.exec("BEGIN");
+    try {
+        for (const target of pending) {
+            const oldCols = columnsOf(db, target.table);
+            const tmp = `${target.table}_rekey_new`;
+            db.exec(target.createSql(tmp));
+            // Copy every column the OLD table has that the NEW table also has (minus agent_name, which is
+            // replaced by agent_id). A pre-DOD-LOOP-1 retry_queue lacks agent_name/awaiting_ack entirely;
+            // taking the intersection handles every historical shape without a per-version special case.
+            const newCols = columnsOf(db, tmp);
+            const carried = oldCols.filter((c) => c !== "agent_name" && c !== "id" && newCols.includes(c));
+            const hasName = oldCols.includes("agent_name");
+            if (hasName) {
+                // Resolve through a JOIN on the parent so the mapping is the database's, not this process's.
+                // An unresolvable row is DROPPED by the inner join and caught by the count check below —
+                // for `strict` tables. For `nullable` (retry_queue), a NULL name must survive, so LEFT JOIN.
+                const join = target.backfill === "strict" ? "JOIN" : "LEFT JOIN";
+                db.exec(`INSERT INTO ${tmp} (agent_id${carried.length ? ", " + carried.join(", ") : ""})
+           SELECT a.agent_id${carried.length ? ", " + carried.map((c) => `t.${c}`).join(", ") : ""}
+           FROM ${target.table} t ${join} agents a ON a.agent_name = t.agent_name`);
+            }
+            else {
+                // No name to resolve (pre-DOD-LOOP-1 retry_queue): agent_id stays NULL — "not agent-scoped".
+                if (target.backfill === "strict") {
+                    throw new Error(`agent_id_backfill_impossible: table '${target.table}' has neither agent_name nor agent_id`);
+                }
+                db.exec(`INSERT INTO ${tmp} (${carried.join(", ")}) SELECT ${carried.map((c) => `t.${c}`).join(", ")} FROM ${target.table} t`);
+            }
+            const after = db.prepare(`SELECT COUNT(*) AS n FROM ${tmp}`).get().n;
+            const expected = before.get(target.table);
+            if (after !== expected) {
+                throw new Error(`agent_id_backfill_row_count_mismatch: table '${target.table}' had ${expected} row(s) before and ` +
+                    `${after} after the copy. A row failed to resolve to an agent_id (orphaned ${target.table}.agent_name ` +
+                    `with no matching agents row), or a name matched more than one agent. Refusing to commit.`);
+            }
+            // Completeness. `strict` → every row must carry an agent_id. `nullable` → only rows that HAD a
+            // name must; a row that was always agent-less legitimately stays NULL.
+            const unresolved = target.backfill === "strict"
+                ? db.prepare(`SELECT COUNT(*) AS n FROM ${tmp} WHERE agent_id IS NULL`).get().n
+                : hasName
+                    ? db
+                        .prepare(`SELECT COUNT(*) AS n FROM ${target.table} t WHERE t.agent_name IS NOT NULL
+                     AND NOT EXISTS (SELECT 1 FROM agents a WHERE a.agent_name = t.agent_name)`)
+                        .get().n
+                    : 0;
+            if (unresolved > 0) {
+                throw new Error(`agent_id_backfill_incomplete: table '${target.table}' has ${unresolved} row(s) whose agent could not ` +
+                    `be resolved to a stable agent_id. Refusing to commit a table with an unattributable row.`);
+            }
+            db.exec(`DROP TABLE ${target.table}`);
+            db.exec(`ALTER TABLE ${tmp} RENAME TO ${target.table}`);
+            for (const sql of target.indexSql(target.table))
+                db.exec(sql);
+            rowCounts[target.table] = after;
+        }
+        db.exec("COMMIT");
+    }
+    catch (err) {
+        // SQLite may have already aborted the transaction; a failing ROLLBACK must not mask the real error.
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch {
+            /* the failing statement may have already aborted the txn */
+        }
+        logger.error("daemon.migration.agent_id_backfill.failed", {
+            tables: pending.map((t) => t.table),
+            reason: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    logger.info("daemon.migration.agent_id_backfill", {
+        tables: Object.keys(rowCounts),
+        rowCounts,
+        agentsMapped: nameToId.size,
+    });
+    return { migrated: true, rowCounts };
+}
+//# sourceMappingURL=agent-id-migration.js.map

package/dist/agent-id-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-id-migration.js","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAqBH,MAAM,aAAa,GAA2B;IAC5C;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;QAed;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;QAUd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;QAKd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;QAMd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,EAAE;QACF,yFAAyF;QACzF,iGAAiG;QACjG,0FAA0F;QAC1F,iGAAiG;QACjG,+FAA+F;QAC/F,oEAAoE;QACpE,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;QAWd;QACJ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACf,iEAAiE,CAAC,4BAA4B;YAC9F,wEAAwE,CAAC,iDAAiD;SAC3H;KACF;CACO,CAAC;AAQX,SAAS,SAAS,CAAC,EAAkB,EAAE,KAAa;IAClD,OAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,WAAW,CAAC,EAAkB,EAAE,KAAa;IACpD,OAAO,CACL,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,CACrG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB,CAAC,EAAkB;IAC5C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,yCAAyC,CAAC;SAClD,GAAG,EAAgE,CAAC;IAEvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACjG,kGAAkG;YAClG,iGAAiG;YACjG,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,EAAkB,EAAE,KAAa;IACnD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAkB,EAAE,MAAc;IAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEpE,iGAAiG;IACjG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAG,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,YAAY,CAAC;YAExC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAE/B,8FAA8F;YAC9F,8FAA8F;YAC9F,6FAA6F;YAC7F,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE/F,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,6FAA6F;gBAC7F,yFAAyF;gBACzF,6FAA6F;gBAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;gBACjE,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,aAAa,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;8BAC1D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;kBAChF,MAAM,CAAC,KAAK,MAAM,IAAI,0CAA0C,CACzE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,uCAAuC,CAC5F,CAAC;gBACJ,CAAC;gBACD,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,IAAI,CACtH,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;YAC3C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,KAAK,SAAS,QAAQ,qBAAqB;oBAChG,GAAG,KAAK,qEAAqE,MAAM,CAAC,KAAK,cAAc;oBACvG,0FAA0F,CAC7F,CAAC;YACJ,CAAC;YAED,+FAA+F;YAC/F,uEAAuE;YACvE,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAE,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC;gBAClG,CAAC,CAAC,OAAO;oBACP,CAAC,CACG,EAAE;yBACC,OAAO,CACN,6BAA6B,MAAM,CAAC,KAAK;+FACkC,CAC5E;yBACA,GAAG,EACP,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC,CAAC;YACV,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,SAAS,UAAU,gCAAgC;oBACrG,0FAA0F,CAC7F,CAAC;YACJ,CAAC;YAED,EAAE,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACtC,EAAE,CAAC,IAAI,CAAC,eAAe,GAAG,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE9D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAClC,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oGAAoG;QACpG,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;QAChD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9B,SAAS;QACT,YAAY,EAAE,QAAQ,CAAC,IAAI;KAC5B,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC"}

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA6tL7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAmvL7E"}

package/dist/daemon.js

@@ -1450,12 +1450,14 @@ export async function startDaemon(config) {
     // entry; a TTF expiry records the un-acked content for the crash backstop (the relay
     // park deposit itself is added in 3b). Both side effects are best-effort and never
     // throw into the content stream handler.
+    // DOD-AGENT-ID-JOINKEY-1: RetryQueue owns an agent-scoped table, so it is handed the STABLE
+    // agent_id. The daemon resolves the operator-facing name ONCE, here at its own boundary.
     sessionNodeManager.setAwaitingAckHooks({
         onPersisted: (agentName, sessionId, contentHashHex) => {
-            retryQueue.markContentAcked(agentName, sessionId, Buffer.from(contentHashHex, "hex"));
+            retryQueue.markContentAcked(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"));
         },
         onTtf: (agentName, sessionId, contentHashHex, content) => {
-            retryQueue.enqueueAwaitingContent(agentName, sessionId, Buffer.from(contentHashHex, "hex"), content);
+            retryQueue.enqueueAwaitingContent(sessionNodeManager.resolveAgentId(agentName), sessionId, Buffer.from(contentHashHex, "hex"), content);
         },
     });
     // MSG-001-3b (2b): the LIVE content-park deposit. On a not-confirmed send (direct delivery
@@ -1508,8 +1510,14 @@ export async function startDaemon(config) {
     // PERSISTED session state (the in-memory entry is gone after a restart). Same seal + deposit
     // as the live hook above; the endpoint + recipient come from the sessions row.
     const startupParkFn = async (entry) => {
-        const ep = sessionNodeManager.getPersistedRelayEndpoint(entry.agentName, entry.sessionId);
-        const record = sessionNodeManager.getSessionRecord(entry.agentName, entry.sessionId);
+        // The durable row carries the OWNING agent's stable id. Resolve it back to a name for the
+        // name-addressed session/standing-receiver lookups. A retired owner resolves fine and then has no
+        // standing receiver, so the park fails loudly below rather than silently re-parking as someone else.
+        const ownerName = sessionNodeManager.agentNameForId(entry.agentId);
+        if (ownerName === null)
+            return { parked: false, error: "owning_agent_not_found" };
+        const ep = sessionNodeManager.getPersistedRelayEndpoint(ownerName, entry.sessionId);
+        const record = sessionNodeManager.getSessionRecord(ownerName, entry.sessionId);
         if (!ep)
             return { parked: false, error: "no_persisted_relay_endpoint" };
         if (!record?.counterparty_pubkey)
@@ -1543,18 +1551,23 @@ export async function startDaemon(config) {
     // Re-park un-acked awaiting content to the relay store-and-forward queue. Runs once pre-IPC
     // (the crash backstop) and again per-agent when an agent comes online — because post-DOD-LOOP-1
     // the native `startupParkFn` needs the OWNING agent's standing receiver, which exists only once
-    // that agent is online. `filterAgent` scopes the drain to one agent's sessions on the agent-
+    // that agent is online. `filterAgentName` scopes the drain to one agent's sessions on the agent-
     // online re-run; with no filter it attempts all (the pre-IPC pass / injected-target test path).
-    async function flushAwaitingContent(filterAgent) {
+    async function flushAwaitingContent(filterAgentName) {
+        // DOD-AGENT-ID-JOINKEY-1: the queue is keyed by the STABLE agent_id, but the caller (and the
+        // human-readable log) speak the NAME. Resolve once here; log the name, filter by the id.
+        const filterAgentId = filterAgentName !== undefined
+            ? sessionNodeManager.resolveAgentId(filterAgentName)
+            : undefined;
         const all = retryQueue.getAwaitingSessions();
-        const sessions = filterAgent === undefined
+        const sessions = filterAgentId === undefined
             ? all
-            : all.filter((s) => s.agentName === filterAgent);
+            : all.filter((s) => s.agentId === filterAgentId);
         if (sessions.length === 0)
             return;
         const parkFn = config.contentParkFn ?? startupParkFn;
         if (!parkFn) {
-            const pendingCount = sessions.reduce((n, s) => n + retryQueue.getAwaitingDepth(s.agentName, s.sessionId), 0);
+            const pendingCount = sessions.reduce((n, s) => n + retryQueue.getAwaitingDepth(s.agentId, s.sessionId), 0);
             logger.warn("content.park.flush.deferred", {
                 sessionCount: sessions.length,
                 pendingCount,
@@ -1565,7 +1578,7 @@ export async function startDaemon(config) {
         let parkedTotal = 0;
         for (const s of sessions) {
             try {
-                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentName, s.sessionId, parkFn);
+                parkedTotal += await retryQueue.drainAwaitingToPark(s.agentId, s.sessionId, parkFn);
             }
             catch (err) {
                 logger.error("content.park.flush.failed", {
@@ -1577,7 +1590,7 @@ export async function startDaemon(config) {
         logger.info("content.park.flush.completed", {
             sessionCount: sessions.length,
             parkedCount: parkedTotal,
-            ...(filterAgent !== undefined ? { agentName: filterAgent } : {}),
+            ...(filterAgentName !== undefined ? { agentName: filterAgentName } : {}),
         });
     }
     await flushAwaitingContent();
@@ -3507,10 +3520,16 @@ export async function startDaemon(config) {
         }
         // DOD-LOOP-1: awaiting content is keyed by the OWNING agent. Prefer an explicit agentName param;
         // fall back to the connection's current agent.
+        // DOD-AGENT-ID-JOINKEY-1: the old `?? ""` fell back to an EMPTY-STRING agent, silently merging
+        // every unaddressed caller's awaiting content into one nameless queue. There is no such agent.
         const agentName = params?.agentName
-            ?? perConnectionState.get(connectionId)?.currentAgent ?? "";
-        retryQueue.enqueueAwaitingContent(agentName, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"));
-        return { queued: true, awaitingDepth: retryQueue.getAwaitingDepth(agentName, sessionId) };
+            ?? perConnectionState.get(connectionId)?.currentAgent;
+        if (!agentName) {
+            return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
+        }
+        const agentId = sessionNodeManager.resolveAgentId(agentName);
+        retryQueue.enqueueAwaitingContent(agentId, sessionId, Buffer.from(contentHashHex, "hex"), Buffer.from(contentHex, "hex"));
+        return { queued: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
     });
     // CELLO-M7-MSG-001: a `persisted` delivery ACK (or a confirmed park) clears the durable
     // awaiting-ACK entry so the startup flush does not re-park already-delivered content.
@@ -3521,9 +3540,13 @@ export async function startDaemon(config) {
             return { error: "missing_params", guidance: "Provide sessionId and contentHash (hex)." };
         }
         const agentName = params?.agentName
-            ?? perConnectionState.get(connectionId)?.currentAgent ?? "";
-        retryQueue.markContentAcked(agentName, sessionId, Buffer.from(contentHashHex, "hex"));
-        return { acked: true, awaitingDepth: retryQueue.getAwaitingDepth(agentName, sessionId) };
+            ?? perConnectionState.get(connectionId)?.currentAgent;
+        if (!agentName) {
+            return { error: "no_current_agent", guidance: "Select an agent with cello_use_agent, or pass agentName." };
+        }
+        const agentId = sessionNodeManager.resolveAgentId(agentName);
+        retryQueue.markContentAcked(agentId, sessionId, Buffer.from(contentHashHex, "hex"));
+        return { acked: true, awaitingDepth: retryQueue.getAwaitingDepth(agentId, sessionId) };
     });
     handlers.set("check_nonce", async (params, _connectionId) => {
         const sessionId = params?.sessionId;