@cello-protocol/daemon 0.0.53 → 0.0.54

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,MAAM,EACN,eAAe,EACf,UAAU,EACV,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACpI,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGpE,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kCAAkC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAK7G,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,aAAa,EACb,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,MAAM,EACN,eAAe,EACf,UAAU,EACV,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACpI,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGpE,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kCAAkC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAK7G,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,aAAa,EACb,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -8,22 +8,20 @@ export { connectToDaemon, IpcError } from "./ipc-client.js";
 export { connectOrStart } from "./connect-or-start.js";
 export { RetryQueue, RETRY_QUEUE_CAP } from "./retry-queue.js";
 export { NonceDedupStore, NONCE_DEDUP_CAP } from "./nonce-dedup.js";
-// CELLO-M7-TRANSPORT-001: direct-P2P transport selection with relay fallback + dcutr
+// Direct-P2P transport selection with relay fallback + dcutr
 export { TransportSelector, LocalTransportSelectorStub, TRANSPORT_ERROR, DEFAULT_DIRECT_DIAL_TIMEOUT_MS, selectAdvertisedAddress, } from "./transport-selector.js";
-// M7-MANIFEST-002: manifest loading, verification, and polling
+// Manifest loading, verification, and polling
 export { FileManifestProvider } from "./manifest-loader.js";
 export { RandomizedPollScheduler, ImmediatePollScheduler } from "./manifest-poll-scheduler.js";
 export { InMemoryManifestVersionStore } from "./manifest-version-store.js";
 export { DbManifestVersionStore } from "./manifest-version-store-db.js";
 export { ManifestDirectoryChallengeVerifier, TestDirectoryChallengeVerifier } from "./challenge-verifier.js";
-// DOD-ONBOARD-HELP-1 §2b — the ONE vocabulary (capability → {cli, mcp}). Exported so the CLI
-// registry and the connect shim's audit test derive their names from the SAME table the daemon
-// renders its guidance from, instead of three lists of literals that drift.
+// The ONE vocabulary (capability → {cli, mcp}). Exported so the CLI registry and the connect shim's
+// audit test derive their names from the SAME table the daemon renders its guidance from, instead of
+// three lists of literals that drift.
 export { DUAL_SURFACE_VERBS, MCP_ONLY_TOOLS, NON_TOOL_IDENTIFIERS, DEAD_CLI_VERBS, deadCliVerbPattern, RENAMED_AWAY_TOOLS, knownToolNames, toCliGuidance, renderForSurface, } from "./vocabulary.js";
-// The FROST/DKG directory-node client. This lives in the daemon because the daemon is the only
-// process that runs a ceremony — it reimplements natively what the retired @cello-protocol/client
-// used to own (daemon.ts: "the daemon never imports @cello-protocol/client"). Exported so
-// trustless-cello's directory tests can drive a real DKG against a real directory without
-// resurrecting the dead client package they used to import this from.
+// The FROST/DKG directory-node client. It lives in the daemon because the daemon is the only process
+// that runs a ceremony, and the daemon never imports @cello-protocol/client. Exported so
+// trustless-cello's directory tests can drive a real DKG against a real directory.
 export { NetworkDirectoryNode, bootstrapNetworkKeyShares, runNetworkDkg, runNetworkRefresh, } from "./network-directory-node.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,WAAW,EAAqB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA4D,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,eAAe,EAAoF,MAAM,iBAAiB,CAAC;AACpI,OAAO,EAAE,eAAe,EAAkB,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAsB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAA0D,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEpE,qFAAqF;AACrF,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AASjC,+DAA+D;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kCAAkC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAE7G,6FAA6F;AAC7F,+FAA+F;AAC/F,4EAA4E;AAC5E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAEzB,+FAA+F;AAC/F,kGAAkG;AAClG,0FAA0F;AAC1F,0FAA0F;AAC1F,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,aAAa,EACb,iBAAiB,GAClB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,WAAW,EAAqB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAA4D,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,eAAe,EAAoF,MAAM,iBAAiB,CAAC;AACpI,OAAO,EAAE,eAAe,EAAkB,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAsB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAA0D,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEpE,6DAA6D;AAC7D,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AASjC,8CAA8C;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kCAAkC,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAE7G,oGAAoG;AACpG,qGAAqG;AACrG,sCAAsC;AACtC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAEzB,qGAAqG;AACrG,yFAAyF;AACzF,mFAAmF;AACnF,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,aAAa,EACb,iBAAiB,GAClB,MAAM,6BAA6B,CAAC"}

package/dist/initiate-session-handler.d.ts

@@ -0,0 +1,22 @@
+import type { IpcHandler } from "./ipc-server.js";
+import type { SessionNodeManager, RelayConnectParams } from "./session-node-manager.js";
+import type { Logger } from "./types.js";
+import type { ConnState } from "./contact-handlers.js";
+import { type ITransportSelector, type SessionNegotiator } from "./transport-selector.js";
+import type { SessionAssignment } from "@cello-protocol/protocol-types";
+import type { IAutoNatService } from "@cello-protocol/transport";
+export interface InitiateSessionDeps {
+    handlers: Map<string, IpcHandler>;
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    getConnState: (connectionId: string) => ConnState | undefined;
+    resolveCurrentAgent: (connState: ConnState | undefined, explicitAgent?: string) => string | null;
+    NO_CURRENT_AGENT_RESPONSE: unknown;
+    resolvedSessionNegotiator: SessionNegotiator;
+    transportSelector: ITransportSelector;
+    autoNatService: IAutoNatService;
+    buildRelayConnectParams: (agentName: string, assignment: SessionAssignment) => Promise<RelayConnectParams | undefined>;
+    getRelayCircuitAddress?: () => string;
+}
+export declare function registerInitiateSessionHandler(deps: InitiateSessionDeps): void;
+//# sourceMappingURL=initiate-session-handler.d.ts.map

package/dist/initiate-session-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiate-session-handler.d.ts","sourceRoot":"","sources":["../src/initiate-session-handler.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACxF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA2B,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEnH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,yBAAyB,EAAE,OAAO,CAAC;IACnC,yBAAyB,EAAE,iBAAiB,CAAC;IAC7C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,cAAc,EAAE,eAAe,CAAC;IAChC,uBAAuB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IACvH,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;CACvC;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA8J9E"}

package/dist/initiate-session-handler.js

@@ -0,0 +1,150 @@
+/**
+ * cello_initiate_session — the initiator's entry point.
+ *
+ * Asks the negotiator to find the counterparty and broker a session (cross-node if they live on a
+ * different directory node), then stands up the local session node and the relay witness.
+ *
+ * The relay witness is BEST-EFFORT by design: a session with no relay still runs on the direct
+ * content path. Degraded, never blocked — refusing to open a session because the witness is
+ * unavailable would hand any relay outage a veto over the whole protocol.
+ */
+import { randomUUID } from "node:crypto";
+import { selectAdvertisedAddress } from "./transport-selector.js";
+import { TIER } from "./contacts-tier-migration.js";
+export function registerInitiateSessionHandler(deps) {
+    const { handlers, logger, sessionNodeManager, getConnState, resolveCurrentAgent, NO_CURRENT_AGENT_RESPONSE, resolvedSessionNegotiator, transportSelector, autoNatService, buildRelayConnectParams, getRelayCircuitAddress, } = deps;
+    // ─── CELLO-M7-TRANSPORT-001: cello_initiate_session ─────────────────────────
+    // Direct-P2P-by-default transport selection (AC-005/AC-006/AC-008/AC-010c).
+    // Flow:
+    //   1. Require a current agent.
+    //   2. Mint a correlationId for the whole session-establishment flow.
+    //   3. Read the standing receiver's AutoNAT dialability → choose the advertised
+    //      address (direct when dialable, relay circuit otherwise — AC-004/AC-019).
+    //   4. Negotiate the FROST-signed SessionAssignment via the directory
+    //      (sessionNegotiator — WIRE-001/SIGNAL-001). When no negotiator is wired,
+    //      return directory_signaling_not_configured (graceful — the transport
+    //      adapters ARE wired; this proves it does not crash with "adapter not wired").
+    //   5. Drive the transport selector to dial the counterparty using the
+    //      assignment's authoritative transport_mode (SI-001). Map the TransportResult
+    //      to the MCP response.
+    handlers.set("cello_initiate_session", async (params, connectionId) => {
+        const connState = getConnState(connectionId);
+        // CC-3 / M8C-AUTOSTART-1 F18: resolve the target agent — explicit { agent } wins, else this
+        // connection's current agent, else the sole online agent (removes the no_current_agent papercut
+        // after a /mcp reconnect when exactly one agent is online). 2+ online with none selected → null.
+        const agentName = resolveCurrentAgent(connState, params?.agent);
+        if (!agentName) {
+            return NO_CURRENT_AGENT_RESPONSE;
+        }
+        const correlationId = randomUUID();
+        // AC-004/AC-019: the advertised address is chosen from the standing receiver's
+        // current dialability. Not dialable (or AutoNAT unavailable) → relay circuit.
+        const dialability = autoNatService.getDialability();
+        const relayCircuitAddr = getRelayCircuitAddress ? getRelayCircuitAddress() : "";
+        const advertisedAddress = selectAdvertisedAddress(dialability, relayCircuitAddr);
+        // resolvedSessionNegotiator is always defined (the daemon builds a real internal
+        // negotiator when none is injected), so directory_signaling_not_configured no longer
+        // fires on the live binary — session_request is actually negotiated with the directory.
+        const negotiation = await resolvedSessionNegotiator.negotiate({
+            agentName,
+            correlationId,
+            advertisedAddress,
+            params: params ?? {},
+        });
+        if (!negotiation.ok) {
+            return { ok: false, reason: negotiation.reason, guidance: negotiation.guidance };
+        }
+        // SI-001: the selector consumes the assignment's signed transport_mode as the
+        // sole dial authority — never inferred from address format.
+        const assignment = negotiation.assignment;
+        // M8B F13: validate-what-you-receive at the trust boundary. When the responder cannot
+        // proceed it aborts SILENTLY (session-ceremony.ts wireSessionOfferHandler sends nothing)
+        // and the directory folds an EMPTY counterparty endpoint into the FROST-signed
+        // assignment. Accepting that assignment produced a false ok:true + a phantom session
+        // whose failure only surfaced on the first cello_send. Reject it HERE — before any
+        // local session state exists — covering every cause of a missing accept (abort,
+        // offline, crash, timeout) without needing a directory change.
+        if (!assignment.counterparty_session_peer_id) {
+            logger.warn("session.initiate.counterparty_unavailable", {
+                sessionId: Buffer.from(assignment.session_id).toString("hex"),
+                agentName,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "counterparty_unavailable",
+                guidance: "The counterparty did not accept the session offer (it may be offline or unable to receive). No session was established. Verify the counterparty agent is online (its operator can check cello_status), then retry cello_initiate_session.",
+            };
+        }
+        const result = await transportSelector.dial(assignment, { correlationId });
+        const sessionId = Buffer.from(assignment.session_id).toString("hex");
+        if (!result.ok) {
+            // Terminal: both direct and relay failed (AC-008). Pass the error through.
+            return { ok: false, reason: result.reason, guidance: result.guidance };
+        }
+        // SEAM (initiate → DAEMON-004 session-core): transport is now established, but the
+        // session does not yet exist in the daemon's session-core. Without this, initiate
+        // would set up a connection no session can use and a subsequent cello_send would
+        // report session_not_found. Create the DAEMON-004 session node + DB row, bound (via
+        // its connection gater) to the counterparty's negotiated session peer id, so the
+        // session is queryable and usable (cello_send / cello_receive / cello_close_session).
+        //
+        // NOTE (seam 1b, next): the session node N_A created here does NOT yet share the
+        // connection that transportSelector.dial established on the separate transportDialer
+        // node — so its content newStream cannot ride that link until the dial is routed
+        // THROUGH N_A. Tracked as the dialer/session-node reconciliation; this seam only
+        // establishes that initiate creates the session-core session.
+        // The initiator's session row must record WHO this session is with, so an interrupted
+        // initiator session surfaces its counterparty at next login (DOD-INT-1). The public
+        // tool param is `target_pubkey` (the counterparty's K_local) — the same field the
+        // negotiator reads above; `counterparty_pubkey` is the legacy fallback. Reading only
+        // the legacy field stored an EMPTY counterparty on every initiator session.
+        const counterpartyPubkey = typeof params?.target_pubkey === "string"
+            ? params.target_pubkey
+            : typeof params?.counterparty_pubkey === "string"
+                ? params.counterparty_pubkey
+                : "";
+        const counterpartyPeerId = assignment.counterparty_session_peer_id ?? "";
+        // M7 DOD-SPINE-6 / MSG-001-3b: relay witness params from the FROST-signed assignment
+        // + this agent's K_local. N_A connects to the relay and submits message-leaf hashes.
+        const relayParams = await buildRelayConnectParams(agentName, assignment);
+        const created = await sessionNodeManager.createSessionNode(sessionId, agentName, counterpartyPubkey, counterpartyPeerId, correlationId, 
+        // Reuse the standing receiver as N_A so its peer id matches the session endpoint the
+        // negotiator advertised — the counterparty's gater admits the dial (WIRE-002).
+        true, relayParams);
+        if (!created.ok) {
+            return { ok: false, reason: created.reason, guidance: created.guidance };
+        }
+        // SEAM 1b: the session node N_A must hold the connection its content stream rides — so
+        // dial the counterparty THROUGH N_A. The counterparty's advertised SESSION addresses are
+        // the source of truth for dialability (a NATed node advertises a relay-circuit address; a
+        // directly-reachable one — localhost or a public addr — advertises a direct multiaddr), so
+        // attempt the dial whenever the assignment carries counterparty session addrs, regardless
+        // of the transport_mode LABEL (the local selector stub labels everything "relay" even when
+        // the addrs are directly dialable). A failure is NOT fatal: per the dead-channel contract,
+        // the session stays active and a later cello_send queues the content in the durable retry
+        // queue until a route exists (the relay-park path is MSG-001-3b).
+        const counterpartyAddrs = assignment.counterparty_session_addrs ?? [];
+        if (counterpartyAddrs.length > 0) {
+            const connected = await sessionNodeManager.connectToCounterparty(agentName, sessionId, counterpartyAddrs);
+            if (!connected.ok) {
+                logger.warn("session.initiate.connect.failed", {
+                    sessionId,
+                    reason: connected.reason,
+                    error: connected.error,
+                    transportMode: assignment.transport_mode,
+                    correlationId,
+                });
+            }
+        }
+        // M8C-CONTACT-1 (D6): "initiating a session to X adds X" — pin at the pubkey the negotiator
+        // actually used (not re-resolved later). DOD-TIER-4 AC3: a deliberate outbound initiate makes the
+        // counterparty KNOWN, provenance 'initiated'. (Not WHITELISTED — auto-accept stays an explicit
+        // cello_contact_set_tier act, design §1.)
+        sessionNodeManager.addContact(agentName, counterpartyPubkey, undefined, "initiated", TIER.KNOWN);
+        // AC-007: the session is usable immediately upon (relay) connection — the dcutr
+        // upgrade runs in the background and is intentionally NOT awaited here.
+        return { ok: true, sessionId, transportMode: result.mode, correlationId };
+    });
+}
+//# sourceMappingURL=initiate-session-handler.js.map

package/dist/initiate-session-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiate-session-handler.js","sourceRoot":"","sources":["../src/initiate-session-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,OAAO,EAAE,uBAAuB,EAAmD,MAAM,yBAAyB,CAAC;AACnH,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AAkBpD,MAAM,UAAU,8BAA8B,CAAC,IAAyB;IACtE,MAAM,EACJ,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,mBAAmB,EACvE,yBAAyB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,cAAc,EACvF,uBAAuB,EAAE,sBAAsB,GAChD,GAAG,IAAI,CAAC;IAET,+EAA+E;IAC/E,4EAA4E;IAC5E,QAAQ;IACR,gCAAgC;IAChC,sEAAsE;IACtE,gFAAgF;IAChF,gFAAgF;IAChF,sEAAsE;IACtE,+EAA+E;IAC/E,2EAA2E;IAC3E,oFAAoF;IACpF,uEAAuE;IACvE,mFAAmF;IACnF,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QACpE,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,4FAA4F;QAC5F,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QAEnC,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,CAAC;QACpD,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAEjF,iFAAiF;QACjF,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,SAAS,CAAC;YAC5D,SAAS;YACT,aAAa;YACb,iBAAiB;YACjB,MAAM,EAAE,MAAM,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;QACnF,CAAC;QAED,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;QAE1C,sFAAsF;QACtF,yFAAyF;QACzF,+EAA+E;QAC/E,qFAAqF;QACrF,mFAAmF;QACnF,gFAAgF;QAChF,+DAA+D;QAC/D,IAAI,CAAC,UAAU,CAAC,4BAA4B,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACvD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC7D,SAAS;gBACT,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0BAA0B;gBAClC,QAAQ,EAAE,2OAA2O;aACtP,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,2EAA2E;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzE,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,iFAAiF;QACjF,oFAAoF;QACpF,iFAAiF;QACjF,sFAAsF;QACtF,EAAE;QACF,iFAAiF;QACjF,qFAAqF;QACrF,iFAAiF;QACjF,iFAAiF;QACjF,8DAA8D;QAC9D,sFAAsF;QACtF,oFAAoF;QACpF,kFAAkF;QAClF,qFAAqF;QACrF,4EAA4E;QAC5E,MAAM,kBAAkB,GACtB,OAAO,MAAM,EAAE,aAAa,KAAK,QAAQ;YACvC,CAAC,CAAC,MAAM,CAAC,aAAa;YACtB,CAAC,CAAC,OAAO,MAAM,EAAE,mBAAmB,KAAK,QAAQ;gBAC/C,CAAC,CAAC,MAAM,CAAC,mBAAmB;gBAC5B,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,kBAAkB,GAAG,UAAU,CAAC,4BAA4B,IAAI,EAAE,CAAC;QACzE,qFAAqF;QACrF,qFAAqF;QACrF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CACxD,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,aAAa;QACb,qFAAqF;QACrF,+EAA+E;QAC/E,IAAI,EACJ,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3E,CAAC;QAED,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,2FAA2F;QAC3F,0FAA0F;QAC1F,2FAA2F;QAC3F,2FAA2F;QAC3F,0FAA0F;QAC1F,kEAAkE;QAClE,MAAM,iBAAiB,GAAG,UAAU,CAAC,0BAA0B,IAAI,EAAE,CAAC;QACtE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAC1G,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBAC7C,SAAS;oBACT,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,aAAa,EAAE,UAAU,CAAC,cAAc;oBACxC,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4FAA4F;QAC5F,kGAAkG;QAClG,+FAA+F;QAC/F,0CAA0C;QAC1C,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEjG,gFAAgF;QAChF,wEAAwE;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/network-directory-node.d.ts

@@ -41,8 +41,8 @@ export declare class NetworkDirectoryNode implements DirectoryNodeStub {
  * /cello/frost/1.0.0 network protocol. Returns a FrostThresholdSigner configured
  * to use NetworkDirectoryNodes, plus the primaryPubkey.
  *
- * NODE_ENV=test guard is kept because this still uses the trustedDealer shortcut.
- * Real DKG (M3) will replace this entirely.
+ * TEST-ONLY: this uses the trustedDealer shortcut, so it is guarded by NODE_ENV=test. The production
+ * path is runNetworkDkg.
  */
 export declare function bootstrapNetworkKeyShares(agentPubkey: Uint8Array, opts: {
     threshold: number;
@@ -79,14 +79,14 @@ export declare function runNetworkDkg(agentPubkey: Uint8Array, opts: {
     threshold: number;
     participants: number;
     directoryNodes: NetworkDirectoryNode[];
-    /** OPS-AGENT-001: Pre-authorization token to present in Round 1 frame. */
+    /** Pre-authorization token to present in the Round 1 frame. */
     preAuthToken?: string;
-    /** SEC-2: K_local signer for the DKG-time commit/sign requests' auth. */
+    /** K_local signer for the DKG-time commit/sign requests' auth. */
     signAuth?: FrostAuthSigner;
 }): Promise<{
     signer: FrostThresholdSigner;
     primaryPubkey: Uint8Array;
-    /** PERSIST-024: serializable FROST share data for DB persistence. SI-001: never log signingShare. */
+    /** Serializable FROST share data for DB persistence. NEVER log signingShare. */
     signingShare: Uint8Array;
     identifier: string;
     commitments: Uint8Array[];
@@ -104,7 +104,7 @@ export declare function runNetworkRefresh(agentPubkey: Uint8Array, opts: {
     participants: number;
     directoryNodes: NetworkDirectoryNode[];
     fromEpochN: number;
-    /** SEC-2: K_local signer for any commit/sign auth during the refresh. */
+    /** K_local signer for any commit/sign auth during the refresh. */
     signAuth?: FrostAuthSigner;
 }): Promise<{
     toEpochN: number;

package/dist/network-directory-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-directory-node.d.ts","sourceRoot":"","sources":["../src/network-directory-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAiB,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EAEf,MAAM,uCAAuC,CAAC;AA4B/C,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAQxE,qBAAa,oBAAqB,YAAW,iBAAiB;;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAgBR,IAAI,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,SAAS,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAQD,WAAW,IAAI,OAAO;IAMtB,2GAA2G;IAC3G,UAAU,IAAI,UAAU,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAI/D,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA+C5F,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC;IAkD7C,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAsDnE,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI;IA8B9F,wFAAwF;IAClF,UAAU,IAAI,OAAO,CAAC,OAAO,mBAAmB,EAAE,MAAM,CAAC;CA0BhE;AAoOD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;CACxC,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,CAAC,CAgCtE;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,UAAU,EACvB,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GACA,OAAO,CAAC;IACT,MAAM,EAAE,oBAAoB,CAAC;IAC7B,aAAa,EAAE,UAAU,CAAC;IAC1B,qGAAqG;IACrG,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAsKD;AA0ED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,UAAU,EACvB,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GACA,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,UAAU,CAAC;IAC1B,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC7C,CAAC,CA2DD"}
+{"version":3,"file":"network-directory-node.d.ts","sourceRoot":"","sources":["../src/network-directory-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAiB,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,cAAc,EAEf,MAAM,uCAAuC,CAAC;AA2B/C,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAQxE,qBAAa,oBAAqB,YAAW,iBAAiB;;IAC5D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAgBR,IAAI,EAAE;QAChB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,SAAS,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAQD,WAAW,IAAI,OAAO;IAMtB,2GAA2G;IAC3G,UAAU,IAAI,UAAU,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;IAI/D,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA+C5F,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC;IAkD7C,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAsDnE,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,IAAI;IA8B9F,wFAAwF;IAClF,UAAU,IAAI,OAAO,CAAC,OAAO,mBAAmB,EAAE,MAAM,CAAC;CA0BhE;AAqOD;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;CACxC,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,CAAC,CAgCtE;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,UAAU,EACvB,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GACA,OAAO,CAAC;IACT,MAAM,EAAE,oBAAoB,CAAC;IAC7B,aAAa,EAAE,UAAU,CAAC;IAC1B,gFAAgF;IAChF,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAsKD;AA0ED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,UAAU,EACvB,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,GACA,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,UAAU,CAAC;IAC1B,YAAY,EAAE,UAAU,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC7C,CAAC,CA2DD"}

package/dist/network-directory-node.js

@@ -10,7 +10,8 @@
  *   frost_sign_request:   ask directory to compute a partial signature
  */
 import { createHash } from "node:crypto";
-import { Encoder, decode as cborDecode } from "cbor-x";
+import { decode as cborDecode } from "cbor-x";
+import { encodeCbor } from "@cello-protocol/protocol-types";
 import * as lp from "it-length-prefixed";
 import { ed25519_FROST, FrostThresholdSigner } from "@cello-protocol/crypto";
 import { bootstrapKeyShares, storeDkgResult, getClientFrostIdentifier, getClientRefreshRoster, generateClientRefreshContribution, applyRefreshToLocalShare, } from "@cello-protocol/crypto/frost/frost-threshold-signer.js";
@@ -21,7 +22,6 @@ const NOOP_LOGGER = {
     debug: () => { },
 };
 const FROST_PROTOCOL_ID = "/cello/frost/1.0.0";
-const CBOR_ENC = new Encoder({ tagUint8Array: false });
 const FROST_AUTH_DOMAIN = "CELLO-FROST-AUTH-v1";
 // Domain separation (must match the directory's verifyFrostAuth): 0x00 = commit; 0x01 || framedMsg = sign.
 const FROST_AUTH_COMMIT_TAIL = new Uint8Array([0x00]);
@@ -36,7 +36,7 @@ export class NetworkDirectoryNode {
     // Set during bootstrapKeyShares — used to identify which agent's share to retrieve
     #agentPubkeyHex = null;
     #epochId = null;
-    // SEC-2: signs the K_local auth on commit/sign requests (set via setBootstrapContext).
+    // Signs the K_local auth on commit/sign requests (set via setBootstrapContext).
     #signAuth = null;
     // Stored during receiveShare — used by tests to get the FrostPublic for signRound calls
     #lastPub = null;
@@ -72,7 +72,7 @@ export class NetworkDirectoryNode {
             commitments: pub.commitments,
             verifyingShares: pub.verifyingShares,
         };
-        const frame = CBOR_ENC.encode({
+        const frame = encodeCbor({
             type: "frost_bootstrap",
             agentPubkey: this.#agentPubkeyHex,
             epochId: this.#epochId,
@@ -105,7 +105,7 @@ export class NetworkDirectoryNode {
             this.#logger.debug("frost.directory.commitment.abort", { reason: "missing_context", hasAgent: !!this.#agentPubkeyHex, hasEpochId: !!this.#epochId });
             throw new Error("NetworkDirectoryNode: setBootstrapContext must be called before generateCommitment");
         }
-        const frame = CBOR_ENC.encode({
+        const frame = encodeCbor({
             type: "frost_commit_request",
             agentPubkey: this.#agentPubkeyHex,
             epochId: this.#epochId,
@@ -143,7 +143,7 @@ export class NetworkDirectoryNode {
             this.#logger.debug("frost.directory.sign.abort", { reason: "missing_context" });
             throw new Error("NetworkDirectoryNode: setBootstrapContext must be called before signRound");
         }
-        const frame = CBOR_ENC.encode({
+        const frame = encodeCbor({
             type: "frost_sign_request",
             agentPubkey: this.#agentPubkeyHex,
             epochId: this.#epochId,
@@ -151,7 +151,7 @@ export class NetworkDirectoryNode {
             commitmentList: params.commitmentList,
             ceremonyId: params.ceremonyId,
             peerIdString: params.ceremonyId,
-            // SEC-2: bound to THIS framedMsg, with the 0x01 sign-frame domain-separation prefix.
+            // Bound to THIS framedMsg, with the 0x01 sign-frame domain-separation prefix.
             authSig: await this.#buildAuthSig(Buffer.concat([Buffer.from([FROST_AUTH_SIGN_PREFIX]), Buffer.from(params.msg)])),
         });
         this.#logger.debug("frost.directory.sign.stream.opening", {});
@@ -178,16 +178,16 @@ export class NetworkDirectoryNode {
         }
         return null;
     }
-    // Called by the network-aware bootstrapKeyShares before distributing shares. SEC-2: `signAuth`
-    // is the agent's K_local signer, used to authenticate every subsequent commit/sign request; every
-    // ceremony path (session/seal, DKG, refresh) passes it so the enforcing directory accepts the request.
+    // Called by the network-aware bootstrapKeyShares before distributing shares. `signAuth` is the
+    // agent's K_local signer, used to authenticate every subsequent commit/sign request; EVERY ceremony
+    // path (session/seal, DKG, refresh) must pass it or the enforcing directory refuses the request.
     setBootstrapContext(agentPubkeyHex, epochId, signAuth) {
         this.#agentPubkeyHex = agentPubkeyHex;
         this.#epochId = epochId;
         if (signAuth)
             this.#signAuth = signAuth;
     }
-    // SEC-2: hash bound by the directory's verifyFrostAuth. tail = utf8("commit") | framedMsg.
+    // Hash bound by the directory's verifyFrostAuth. tail = utf8("commit") | framedMsg.
     #frostAuthHash(tail) {
         return new Uint8Array(createHash("sha256")
             .update(Buffer.concat([
@@ -198,8 +198,8 @@ export class NetworkDirectoryNode {
         ]))
             .digest());
     }
-    // SEC-2: the K_local auth signature to attach, or undefined if no signer was threaded (which the
-    // enforcing directory then refuses AUTH_REQUIRED — surfacing an un-threaded path loudly, not silently).
+    // The K_local auth signature to attach, or undefined if no signer was threaded — which the enforcing
+    // directory then refuses with AUTH_REQUIRED, surfacing an un-threaded path loudly, not silently.
     async #buildAuthSig(tail) {
         if (!this.#signAuth) {
             this.#logger.warn("frost.directory.auth.no_signer", { agent: this.#agentPubkeyHex?.slice(0, 16), epochId: this.#epochId });
@@ -244,12 +244,12 @@ export class NetworkDirectoryNode {
  * Opens a new stream, sends frost_dkg_round1_request, returns the broadcast.
  */
 async function dkgRound1WithNode(node, agentPubkeyHex, epochId, signers, preAuthToken) {
-    const frame = CBOR_ENC.encode({
+    const frame = encodeCbor({
         type: "frost_dkg_round1_request",
         agentPubkey: agentPubkeyHex,
         epochId,
         signers,
-        // OPS-AGENT-001: include preAuthToken when present (mandatory in M6+)
+        // Include preAuthToken when present.
         ...(preAuthToken !== undefined ? { preAuthToken } : {}),
     });
     const stream = await node.openStream();
@@ -278,7 +278,7 @@ async function dkgRound1WithNode(node, agentPubkeyHex, epochId, signers, preAuth
  * Opens a new stream, sends frost_dkg_round2_request, returns sharesForOthers.
  */
 async function dkgRound2WithNode(node, agentPubkeyHex, epochId, othersRound1) {
-    const frame = CBOR_ENC.encode({
+    const frame = encodeCbor({
         type: "frost_dkg_round2_request",
         agentPubkey: agentPubkeyHex,
         epochId,
@@ -311,7 +311,7 @@ async function dkgRound2WithNode(node, agentPubkeyHex, epochId, othersRound1) {
  * Opens a new stream, sends frost_dkg_round3_request, returns shareCommitment.
  */
 async function dkgRound3WithNode(node, agentPubkeyHex, epochId, sharesForMe, allRound1) {
-    const frame = CBOR_ENC.encode({
+    const frame = encodeCbor({
         type: "frost_dkg_round3_request",
         agentPubkey: agentPubkeyHex,
         epochId,
@@ -355,7 +355,8 @@ function parseDkgRound1Response(bytes) {
     if (typeof obj !== "object" || obj === null)
         return { kind: "invalid" };
     const o = obj;
-    // Handle preauth_error frames from the directory (CRIT-1: previously silently dropped)
+    // preauth_error frames from the directory MUST be surfaced, never dropped as "invalid" — a silently
+    // discarded rejection reads to the caller as a malformed frame instead of a refused authorization.
     if (o["type"] === "preauth_error") {
         const reason = typeof o["reason"] === "string" ? o["reason"] : "PRE_AUTH_TOKEN_MISSING";
         return { kind: "preauth_error", reason };
@@ -474,12 +475,12 @@ function parseU8Array(v) {
  * /cello/frost/1.0.0 network protocol. Returns a FrostThresholdSigner configured
  * to use NetworkDirectoryNodes, plus the primaryPubkey.
  *
- * NODE_ENV=test guard is kept because this still uses the trustedDealer shortcut.
- * Real DKG (M3) will replace this entirely.
+ * TEST-ONLY: this uses the trustedDealer shortcut, so it is guarded by NODE_ENV=test. The production
+ * path is runNetworkDkg.
  */
 export async function bootstrapNetworkKeyShares(agentPubkey, opts) {
-    // bootstrapKeyShares uses trustedDealer — a test-harness shortcut, not real DKG (M3+).
-    // This function inherits that constraint. The caller (cello-mcp.ts) guards with NODE_ENV=test.
+    // bootstrapKeyShares uses trustedDealer — a test-harness shortcut, not a real DKG. This function
+    // inherits that constraint, so it must never run outside tests.
     if (process.env.NODE_ENV !== "test") {
         throw new Error("bootstrapNetworkKeyShares uses trustedDealer which is test-only. Real DKG (M3) required in production.");
     }
@@ -633,8 +634,8 @@ export async function runNetworkDkg(agentPubkey, opts) {
     }
     catch { /* ignore */ }
     // Set signing context on each directory node so generateCommitment/signRound can
-    // identify which agent's share to use in future FROST signing ceremonies. SEC-2: thread the
-    // K_local signer so the DKG-time and later signing requests carry a valid auth.
+    // identify which agent's share to use in future FROST signing ceremonies. The K_local signer MUST be
+    // threaded here so the DKG-time and later signing requests carry a valid auth.
     for (const node of opts.directoryNodes) {
         node.setBootstrapContext(agentPubkeyHex, epochId, opts.signAuth);
     }
@@ -644,7 +645,7 @@ export async function runNetworkDkg(agentPubkey, opts) {
         participants: opts.participants,
         directoryNodeStubs: opts.directoryNodes,
     }, agentPubkey);
-    // PERSIST-024: extract serializable FROST share data for DB persistence (SI-001: never log signingShare)
+    // Extract serializable FROST share data for DB persistence. NEVER log signingShare.
     const serializedSecret = clientKey.secret;
     const serializedPub = clientKey.public;
     return {
@@ -658,13 +659,13 @@ export async function runNetworkDkg(agentPubkey, opts) {
         participants: opts.participants,
     };
 }
-// ─── M8B DOD-REFRESH-1: proactive share resharing (PSS) orchestration ─────────
+// ─── Proactive share resharing (PSS) orchestration ─────────
 // A client-coordinated 2-round refresh that rotates every shareholder's share to a new epoch while keeping
 // the group public key unchanged (frost-resharing.ts). The client is the UNIFORM RELAY: it collects one
 // contribution per node (round 1) and distributes the agreed set — narrowed to each node's own sub-share
 // (round 2) — so a directory cannot equivocate and a node never sees another party's sub-shares.
 async function refreshRound1WithNode(node, agentPubkeyHex, fromEpochId, toEpochId, signers, participantIds) {
-    const frame = CBOR_ENC.encode({
+    const frame = encodeCbor({
         type: "frost_refresh_round1_request",
         agentPubkey: agentPubkeyHex,
         fromEpochId,
@@ -691,7 +692,7 @@ async function refreshRound1WithNode(node, agentPubkeyHex, fromEpochId, toEpochI
     throw new Error("refreshRound1: no response received");
 }
 async function refreshRound2WithNode(node, agentPubkeyHex, fromEpochId, toEpochId, signers, participantIds, contributions) {
-    const frame = CBOR_ENC.encode({
+    const frame = encodeCbor({
         type: "frost_refresh_round2_request",
         agentPubkey: agentPubkeyHex,
         fromEpochId,