@cello-protocol/daemon 0.0.79 → 0.0.81

package/dist/consent-migration.d.ts

@@ -18,15 +18,21 @@
  *     column present and the rows un-backfilled, which would skip the one-time step FOREVER;
  *   - a RETHROW, because a migration that fails silently is a schema nobody can trust.
  *
- * DIRECTION OF THE BACKFILL. Existing rows become `accepted`, and that is correct rather than
- * lenient: every row that predates this column is portal-issued, minted about the operator, for the
- * operator, at their own action — there was never a third party whose decision was pending. Making
- * them `pending` would silently render every phone/email signal already in every wallet
- * unpresentable, which is a data-loss-shaped bug that raises no error.
+ * DIRECTION OF THE BACKFILL — ENFORCED BY THE SQL, NOT BY AN ARGUMENT ABOUT THE PAST.
+ * Portal-issued rows become `accepted`: they were minted about the operator, for the operator, at
+ * their own action, so there was never a third party whose decision was pending, and making them
+ * `pending` would silently render every phone/email signal already in every wallet unpresentable —
+ * a data-loss-shaped bug that raises no error. Agent-issued rows become `pending`, because somebody
+ * else authored them.
  *
- * NEW rows are a different question and are handled at the write path: an `issuer_kind: agent`
- * signal is inserted `pending`, because it is exactly the case where somebody else authored an
- * object about you.
+ * An earlier version backfilled everything to `accepted` on the reasoning that nothing agent-issued
+ * could exist yet. That was true only by RELEASE TIMING — the daemon has accepted
+ * `issuer_kind: agent` since M10 — so a dev or staging wallet that picked one up during M10B
+ * integration testing would have had it backfilled to presentable at boot, which is exactly the
+ * D-23 violation this file exists to prevent. Two WHERE clauses make it a property of the code.
+ *
+ * NEW rows are handled at the write path on the same axis: `putWalletSignal` inserts `pending` for
+ * `issuer_kind: agent` and `accepted` otherwise.
  */
 import type { DaemonDatabase } from "./sqlcipher-db.js";
 import type { Logger } from "./types.js";

package/dist/consent-migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent-migration.d.ts","sourceRoot":"","sources":["../src/consent-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA+BrF"}
+{"version":3,"file":"consent-migration.d.ts","sourceRoot":"","sources":["../src/consent-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAqFrF"}

package/dist/consent-migration.js

@@ -18,15 +18,21 @@
  *     column present and the rows un-backfilled, which would skip the one-time step FOREVER;
  *   - a RETHROW, because a migration that fails silently is a schema nobody can trust.
  *
- * DIRECTION OF THE BACKFILL. Existing rows become `accepted`, and that is correct rather than
- * lenient: every row that predates this column is portal-issued, minted about the operator, for the
- * operator, at their own action — there was never a third party whose decision was pending. Making
- * them `pending` would silently render every phone/email signal already in every wallet
- * unpresentable, which is a data-loss-shaped bug that raises no error.
+ * DIRECTION OF THE BACKFILL — ENFORCED BY THE SQL, NOT BY AN ARGUMENT ABOUT THE PAST.
+ * Portal-issued rows become `accepted`: they were minted about the operator, for the operator, at
+ * their own action, so there was never a third party whose decision was pending, and making them
+ * `pending` would silently render every phone/email signal already in every wallet unpresentable —
+ * a data-loss-shaped bug that raises no error. Agent-issued rows become `pending`, because somebody
+ * else authored them.
  *
- * NEW rows are a different question and are handled at the write path: an `issuer_kind: agent`
- * signal is inserted `pending`, because it is exactly the case where somebody else authored an
- * object about you.
+ * An earlier version backfilled everything to `accepted` on the reasoning that nothing agent-issued
+ * could exist yet. That was true only by RELEASE TIMING — the daemon has accepted
+ * `issuer_kind: agent` since M10 — so a dev or staging wallet that picked one up during M10B
+ * integration testing would have had it backfilled to presentable at boot, which is exactly the
+ * D-23 violation this file exists to prevent. Two WHERE clauses make it a property of the code.
+ *
+ * NEW rows are handled at the write path on the same axis: `putWalletSignal` inserts `pending` for
+ * `issuer_kind: agent` and `accepted` otherwise.
  */
 /** Present-tense truth for the reader: this is what gates presentation. */
 export const CONSENT_ACCEPTED = "accepted";
@@ -34,24 +40,82 @@ export function migrateWalletAddConsentState(db, logger) {
     const columns = new Set(db.prepare("PRAGMA table_info(wallet_trust_signals)").all().map((c) => c.name));
     // BIRTH GATE. Idempotent, and deliberately NOT "backfill wherever the value is NULL": a NULL that
     // appears later is not a legacy row, and promoting it would be the clobber this file prevents.
-    if (columns.has("consent_state"))
+    //
+    // IT GATES ON BOTH COLUMNS, and gating on only `consent_state` was a real bug that shipped: every
+    // database that ran the previous release already had `consent_state`, so this returned here and
+    // `consent_notified_at` was NEVER ADDED on upgrade. Fresh installs got it, upgrades did not —
+    // exactly the fresh-vs-migrated divergence the suite has a test for, on a column that test did not
+    // cover. It stayed green because the partial-migration test asserted only NEGATIVES, which are
+    // satisfied by returning before any of the code under test runs.
+    if (columns.has("consent_state") && columns.has("consent_notified_at"))
         return;
-    db.exec("BEGIN");
+    // BEGIN IMMEDIATE, not DEFERRED: a deferred transaction takes no write lock, so two daemons on one
+    // DB — a named real condition in this project — can both pass the gate above and the loser dies at
+    // boot on `duplicate column name`. It does not clobber, but it is a baffling crash. The lock also
+    // makes the re-read below meaningful.
+    db.exec("BEGIN IMMEDIATE");
     try {
+        // Re-read the gate under the lock: the PRAGMA above is a check-then-act outside any transaction.
+        const underLock = new Set(db.prepare("PRAGMA table_info(wallet_trust_signals)").all().map((c) => c.name));
+        // EACH COLUMN IS GATED INDEPENDENTLY. An earlier version added both under one gate keyed on
+        // `consent_state`, so a database holding one but not the other hit `duplicate column name`, the
+        // migration rethrew, and the daemon refused to start — a self-inflicted boot failure on a
+        // recoverable state. Caught by the legacy-backfill test, which constructs exactly that shape.
+        const needsConsent = !underLock.has("consent_state");
+        const needsNotified = !underLock.has("consent_notified_at");
+        if (!needsConsent && !needsNotified) {
+            db.exec("COMMIT");
+            return;
+        }
         // No DEFAULT — see the header. The rows are given their value by the explicit backfill below.
-        db.exec("ALTER TABLE wallet_trust_signals ADD COLUMN consent_state TEXT");
-        const res = db
-            .prepare(`UPDATE wallet_trust_signals SET consent_state = '${CONSENT_ACCEPTED}'`)
+        if (needsConsent)
+            db.exec("ALTER TABLE wallet_trust_signals ADD COLUMN consent_state TEXT");
+        // DOD-END-PENDING-1 / M10B-D5 — the NOTIFICATION's lifetime, which is NOT the item's. The item
+        // persists until accepted or refused; the notification is raised once and stops once seen. One
+        // flag cannot carry both: a single seen-bit would either dismiss the pending decision (losing it)
+        // or re-fire on every agent selection (nagging). Two facts, two columns.
+        if (needsNotified)
+            db.exec("ALTER TABLE wallet_trust_signals ADD COLUMN consent_notified_at INTEGER");
+        if (!needsConsent) {
+            // The backfill belongs to consent_state's BIRTH. If only the notification column was missing,
+            // the rows already carry their consent and must not be re-judged — that is the clobber this
+            // file exists to prevent, and it would arrive by the back door of a partially-migrated schema.
+            db.exec("COMMIT");
+            logger.info("signal.consent.migrated", { backfilled: 0, added: "consent_notified_at" });
+            return;
+        }
+        // THE DIRECTION IS ENFORCED, NOT ARGUED (review F5). The header's reasoning — "everything
+        // predating this column is portal-issued" — is true TODAY only by release timing: the daemon has
+        // accepted `issuer_kind: agent` since M10, and a dev or staging wallet that picked one up during
+        // M10B integration testing would be backfilled straight to `accepted` and presentable, which is
+        // the D-23 violation this unit exists to prevent, silently, at boot. Two WHERE clauses make the
+        // claim a property of the code instead of a property of the calendar.
+        const acceptedRes = db
+            .prepare(`UPDATE wallet_trust_signals SET consent_state = '${CONSENT_ACCEPTED}' WHERE issuer_kind <> 'agent'`)
+            .run();
+        const pendingRes = db
+            .prepare("UPDATE wallet_trust_signals SET consent_state = 'pending' WHERE issuer_kind = 'agent'")
             .run();
+        const res = { changes: Number(acceptedRes.changes) + Number(pendingRes.changes) };
         db.exec("COMMIT");
         logger.info("signal.consent.migrated", {
-            backfilled: Number(res.changes),
-            to: CONSENT_ACCEPTED,
-            reason: "rows predating consent are portal-issued — minted for the operator, at their own action",
+            backfilled: res.changes,
+            accepted: Number(acceptedRes.changes),
+            pending: Number(pendingRes.changes),
+            reason: "portal-issued rows were minted for the operator at their own action; agent-issued rows need consent",
         });
     }
     catch (err) {
-        db.exec("ROLLBACK");
+        // A FAILING ROLLBACK MUST NOT MASK THE REAL ERROR (review F6, and the pattern this file claims to
+        // follow guards it — `contacts-tier-migration.ts` — I copied the shape minus its most important
+        // two lines). SQLite auto-aborts the transaction on SQLITE_FULL/SQLITE_IOERR, so a bare ROLLBACK
+        // then throws "cannot rollback - no transaction is active" — BEFORE the log and BEFORE the
+        // rethrow. The operator gets a transaction-layer message for a full disk, and
+        // `signal.consent.migration_failed` never fires at all.
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch { /* the failing statement may already have aborted the txn */ }
         // RETHROW. A swallowed failure here leaves the daemon running against a schema it believes has
         // consent and does not — which presents unconsented endorsements while every test passes.
         logger.error("signal.consent.migration_failed", {

package/dist/consent-migration.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent-migration.js","sourceRoot":"","sources":["../src/consent-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAaH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C,MAAM,UAAU,4BAA4B,CAAC,EAAkB,EAAE,MAAc;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5G,CAAC;IAEF,kGAAkG;IAClG,+FAA+F;IAC/F,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO;IAEzC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,8FAA8F;QAC9F,EAAE,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CAAC,oDAAoD,gBAAgB,GAAG,CAAC;aAChF,GAAG,EAAE,CAAC;QACT,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC/B,EAAE,EAAE,gBAAgB;YACpB,MAAM,EAAE,yFAAyF;SAClG,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,+FAA+F;QAC/F,0FAA0F;QAC1F,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"consent-migration.js","sourceRoot":"","sources":["../src/consent-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAaH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C,MAAM,UAAU,4BAA4B,CAAC,EAAkB,EAAE,MAAc;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5G,CAAC;IAEF,kGAAkG;IAClG,+FAA+F;IAC/F,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,8FAA8F;IAC9F,mGAAmG;IACnG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO;IAE/E,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,sCAAsC;IACtC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,iGAAiG;QACjG,MAAM,SAAS,GAAG,IAAI,GAAG,CACtB,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5G,CAAC;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,0FAA0F;QAC1F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAEnE,8FAA8F;QAC9F,IAAI,YAAY;YAAE,EAAE,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,kGAAkG;QAClG,yEAAyE;QACzE,IAAI,aAAa;YAAE,EAAE,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAEtG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,8FAA8F;YAC9F,4FAA4F;YAC5F,+FAA+F;YAC/F,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,0FAA0F;QAC1F,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,gGAAgG;QAChG,sEAAsE;QACtE,MAAM,WAAW,GAAG,EAAE;aACnB,OAAO,CAAC,oDAAoD,gBAAgB,gCAAgC,CAAC;aAC7G,GAAG,EAAE,CAAC;QACT,MAAM,UAAU,GAAG,EAAE;aAClB,OAAO,CAAC,uFAAuF,CAAC;aAChG,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,UAAU,EAAE,GAAG,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;YACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YACnC,MAAM,EAAE,qGAAqG;SAC9G,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,2FAA2F;QAC3F,8EAA8E;QAC9E,wDAAwD;QACxD,IAAI,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QACnG,+FAA+F;QAC/F,0FAA0F;QAC1F,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/consortium-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consortium-bootstrap.d.ts","sourceRoot":"","sources":["../src/consortium-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,uBAAuB,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkF/F;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,wBAAwB,EAAE,CAAC,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAChF,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC7D,qFAAqF;IACrF,oBAAoB,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAyCtF"}
+{"version":3,"file":"consortium-bootstrap.d.ts","sourceRoot":"","sources":["../src/consortium-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,uBAAuB,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkF/F;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,wBAAwB,EAAE,CAAC,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAChF,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC7D,qFAAqF;IACrF,oBAAoB,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAoDtF"}

package/dist/consortium-bootstrap.js

@@ -90,10 +90,21 @@ export function createConsortiumRouting(deps) {
         const m = manifestProvider?.getCurrentManifest();
         return m ? await manifestNodesToEndpoints(m.nodes, { logger, fetchFn }) : null;
     };
+    // DECLARED membership, straight off the verified manifest — no probe. Lets the resolver reject a
+    // primary that resolves but belongs to a different consortium (the compiled-in default URL after
+    // a consortium move) without mistaking a momentarily-down member for a non-member.
+    const getManifestPeerIds = () => {
+        const m = manifestProvider?.getCurrentManifest();
+        if (!m)
+            return null;
+        const ids = m.nodes.map((n) => n.peerId).filter((p) => typeof p === "string" && p.length > 0);
+        return ids.length > 0 ? new Set(ids) : null;
+    };
     const failoverEndpointResolver = directoryEndpointResolver
         ? createRosterAwareEndpointResolver({
             primaryResolver: directoryEndpointResolver,
             getConsortiumRoster: resolveConsortiumRoster,
+            getManifestPeerIds,
             logger,
         })
         : undefined;

package/dist/consortium-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"consortium-bootstrap.js","sourceRoot":"","sources":["../src/consortium-bootstrap.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,iCAAiC,GAElC,MAAM,0BAA0B,CAAC;AAyBlC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAsB;IAChE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE9G,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,IAAI,mBAAmB,GAAyB,EAAE,CAAC;IAEnD,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAE3F,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACpD,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,QAAQ,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC9C,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,QAAQ,CAAC,OAAO;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QAED,+FAA+F;QAC/F,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,CAAC;QACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,eAAe,EAAE,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QAED,MAAM,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,gBAAgB,GAAG,IAAI,CAAC;QACxB,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC9C,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,yFAAyF;QACzF,mBAAmB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC;QACjD,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,aAAa,GAAG;YACpB,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,aAAa;YACb,aAAa;YACb,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChF,CAAC;QACF,qFAAqF;QACrF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAClD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;AAC5E,CAAC;AAmCD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,EACJ,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAC3E,qBAAqB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,EAAE,OAAO,GACpF,GAAG,IAAI,CAAC;IAET,MAAM,uBAAuB,GAAG,KAAK,IAA0C,EAAE;QAC/E,MAAM,CAAC,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;QACjD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,yBAAyB;QACxD,CAAC,CAAC,iCAAiC,CAAC;YAChC,eAAe,EAAE,yBAAyB;YAC1C,mBAAmB,EAAE,uBAAuB;YAC5C,MAAM;SACP,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,mBAAmB,GAAG,KAAK,IAAuC,EAAE,CACxE,wBAAwB,CAAC,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErE,8FAA8F;IAC9F,iGAAiG;IACjG,+FAA+F;IAC/F,wEAAwE;IACxE,IAAI,oBAA8C,CAAC;IACnD,IAAI,qBAAqB,IAAI,gBAAgB,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;QAChJ,oBAAoB,GAAG,qBAAqB,CAAC;YAC3C,SAAS,EAAE,qBAAqB;YAChC,YAAY,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,gBAAgB;YAChB,oBAAoB;YACpB,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,iBAAiB;YAC5B,MAAM;YACN,iBAAiB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;AAC1G,CAAC"}
+{"version":3,"file":"consortium-bootstrap.js","sourceRoot":"","sources":["../src/consortium-bootstrap.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,iCAAiC,GAElC,MAAM,0BAA0B,CAAC;AAyBlC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAsB;IAChE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE9G,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,IAAI,mBAAmB,GAAyB,EAAE,CAAC;IAEnD,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAE3F,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACpD,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,QAAQ,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC9C,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,QAAQ,CAAC,OAAO;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QAED,+FAA+F;QAC/F,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,CAAC;QACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,eAAe,EAAE,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;QAC5E,CAAC;QAED,MAAM,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,gBAAgB,GAAG,IAAI,CAAC;QACxB,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC9C,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,yFAAyF;QACzF,mBAAmB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC;QACjD,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,aAAa,GAAG;YACpB,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,aAAa;YACb,aAAa;YACb,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChF,CAAC;QACF,qFAAqF;QACrF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAClD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,CAAC;AAC5E,CAAC;AAmCD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,EACJ,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAC3E,qBAAqB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,EAAE,OAAO,GACpF,GAAG,IAAI,CAAC;IAET,MAAM,uBAAuB,GAAG,KAAK,IAA0C,EAAE;QAC/E,MAAM,CAAC,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;QACjD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,CAAC,CAAC;IAEF,iGAAiG;IACjG,iGAAiG;IACjG,mFAAmF;IACnF,MAAM,kBAAkB,GAAG,GAAuB,EAAE;QAClD,MAAM,CAAC,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3G,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,yBAAyB;QACxD,CAAC,CAAC,iCAAiC,CAAC;YAChC,eAAe,EAAE,yBAAyB;YAC1C,mBAAmB,EAAE,uBAAuB;YAC5C,kBAAkB;YAClB,MAAM;SACP,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,mBAAmB,GAAG,KAAK,IAAuC,EAAE,CACxE,wBAAwB,CAAC,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErE,8FAA8F;IAC9F,iGAAiG;IACjG,+FAA+F;IAC/F,wEAAwE;IACxE,IAAI,oBAA8C,CAAC;IACnD,IAAI,qBAAqB,IAAI,gBAAgB,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;QAChJ,oBAAoB,GAAG,qBAAqB,CAAC;YAC3C,SAAS,EAAE,qBAAqB;YAChC,YAAY,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,gBAAgB;YAChB,oBAAoB;YACpB,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,iBAAiB;YAC5B,MAAM;YACN,iBAAiB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,CAAC;AAC1G,CAAC"}

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAKrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAQ7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAO5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAkBnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;CACjC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CA8B3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAKrB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAQ7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAsB,MAAM,2BAA2B,CAAC;AAO5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAkBnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;IACrC;;OAEG;IACH,eAAe,IAAI,YAAY,CAAC;CACjC;AAYD,qBAAa,4BAA6B,YAAW,mBAAmB;IAChE,UAAU,CAAC,MAAM,EAAE,iBAAiB;CA8B3C;AAID,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAS7E"}

package/dist/daemon.js

@@ -70,6 +70,7 @@ import { registerNotificationHandlers } from "./notification-handlers.js";
 import { TypeRegistry } from "./type-registry.js";
 import { DbRegistryVersionStore } from "./registry-version-store-db.js";
 import { startRegistryPoll } from "./registry-poll.js";
+import { CONSENT_ACCEPTED } from "./consent-migration.js";
 import { TrustSignalStore } from "./trust-signal-store.js";
 import { encodeCbor, decodeCbor } from "@cello-protocol/protocol-types";
 // Minimal no-op KeyProvider stub for session nodes.
@@ -1652,6 +1653,12 @@ async function startDaemonHoldingLock(config, singletonLock) {
             expires_at: r.expiresAt,
             supersedes_hash: r.supersedesHash,
             default_present: r.defaultPresent,
+            // M10B / DOD-END-ACCEPT-1 review F4. Without this the operator cannot distinguish a signal
+            // that will be presented from one awaiting their decision — or one they already refused —
+            // because `default_present: true` looks identical in all three cases. `default_present`
+            // answers "include it by default"; this answers the prior question, "may it be presented at
+            // all".
+            consent_state: r.consentState,
         }));
         return { ok: true, signals: rows };
     });
@@ -1689,6 +1696,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             schema_version: row.schemaVersion,
             status: row.status,
             default_present: row.defaultPresent,
+            consent_state: row.consentState, // review F4 — see wallet_list_signals
             issued_at: row.issuedAt,
             expires_at: row.expiresAt,
             supersedes_hash: row.supersedesHash,
@@ -1711,6 +1719,18 @@ async function startDaemonHoldingLock(config, singletonLock) {
         if (!row) {
             return { ok: false, reason: "signal_not_found", guidance: `No wallet signal with hash prefix '${prefix}'.` };
         }
+        // M10B / DOD-END-ACCEPT-1 review F4. Enabling a signal the subject has not accepted returned
+        // `{ok: true, default_present: true}` — the daemon affirming it will now be presented, when it
+        // never will. `default_present` selects from what is ELIGIBLE, and an unconsented signal is not
+        // eligible; saying yes here is a hollow success on the one verb that does respond.
+        if (row.consentState !== CONSENT_ACCEPTED) {
+            return {
+                ok: false,
+                reason: "consent_pending",
+                guidance: `This signal is '${row.consentState ?? "unset"}', not accepted, so it cannot be presented ` +
+                    "regardless of the default-present flag. Accept it first; enabling it changes nothing until then.",
+            };
+        }
         store.setDefaultPresent(row.signalHash, true);
         return { ok: true, signal_hash: row.signalHash, default_present: true };
     });
@@ -1733,6 +1753,92 @@ async function startDaemonHoldingLock(config, singletonLock) {
         store.setDefaultPresent(row.signalHash, false);
         return { ok: true, signal_hash: row.signalHash, default_present: false };
     });
+    // ── M10B / DOD-END-SURFACE-1 — the consent verbs (D-23, M10B-D5) ───────────────────────────────
+    //
+    // SCOPED TO THE SELECTED AGENT, not to "the first loaded agent" the way wallet_revoke_signal is.
+    // Consent is a decision the SUBJECT makes about an object a third party wrote concerning them, so
+    // answering it on the wrong agent's behalf is not a cosmetic error — it is one agent deciding for
+    // another. The presenting-agent pubkey is also what the store's queries scope on, and passing the
+    // device-local agent_id instead now REFUSES rather than silently returning an empty queue.
+    const resolveSelectedAgent = (connectionId) => {
+        const name = perConnectionState.get(connectionId)?.currentAgent ?? null;
+        if (!name) {
+            return {
+                ok: false,
+                reason: "no_current_agent",
+                guidance: "Select an agent first (cello_use_agent) — a consent decision belongs to the agent it is about.",
+            };
+        }
+        const rec = loadedAgents.find((a) => a.name === name);
+        if (!rec) {
+            return { ok: false, reason: "agent_not_loaded", guidance: `Agent '${name}' is selected but not loaded on this daemon.` };
+        }
+        return { ok: true, name, pubkey: rec.pubkey };
+    };
+    handlers.set("consent_list_pending", async (_params, connectionId) => {
+        const sel = resolveSelectedAgent(connectionId);
+        if (!sel.ok)
+            return sel;
+        const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
+        const items = store.listPendingConsent(sel.pubkey).map((r) => ({
+            signal_hash: r.signalHash,
+            type: r.type,
+            issuer_pubkey: r.issuerPubkey,
+            issued_at: r.issuedAt,
+            // The payload is the ENDORSER'S OWN WORDS and is returned raw, unparsed, for the operator to
+            // read before deciding. It is not interpreted here and it is never presented to anyone until
+            // they accept — that is the entire point of the decision they are being asked to make.
+            payload_bytes: r.payload.length,
+        }));
+        // Seeing the list IS being told. Marking here rather than in cello_use_agent means the operator
+        // is never marked notified about something they were not actually shown.
+        store.markConsentNotified(sel.pubkey);
+        return { ok: true, agent: sel.name, pending: items };
+    });
+    handlers.set("consent_accept", async (params, connectionId) => {
+        const sel = resolveSelectedAgent(connectionId);
+        if (!sel.ok)
+            return sel;
+        const prefix = typeof params?.hash_prefix === "string" ? params.hash_prefix : null;
+        if (!prefix || prefix.length < 8) {
+            return { ok: false, reason: "invalid_prefix", guidance: "hash_prefix must be at least 8 hex characters." };
+        }
+        const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
+        const item = store.listPendingConsent(sel.pubkey).find((r) => r.signalHash.startsWith(prefix));
+        if (!item) {
+            // Deliberately does NOT fall back to a wallet-wide lookup: a hash this agent has no pending
+            // decision on is not this agent's to accept, and finding it anyway would be the cross-agent
+            // decision this scoping exists to prevent.
+            return { ok: false, reason: "not_pending_for_agent", guidance: `No pending consent item for '${sel.name}' with prefix '${prefix}'.` };
+        }
+        store.setConsentState(item.signalHash, "accepted");
+        return { ok: true, signal_hash: item.signalHash, consent_state: "accepted" };
+    });
+    handlers.set("consent_refuse", async (params, connectionId) => {
+        const sel = resolveSelectedAgent(connectionId);
+        if (!sel.ok)
+            return sel;
+        const prefix = typeof params?.hash_prefix === "string" ? params.hash_prefix : null;
+        if (!prefix || prefix.length < 8) {
+            return { ok: false, reason: "invalid_prefix", guidance: "hash_prefix must be at least 8 hex characters." };
+        }
+        const store = new TrustSignalStore(sessionNodeManager.getDb(), logger);
+        const item = store.listPendingConsent(sel.pubkey).find((r) => r.signalHash.startsWith(prefix));
+        if (!item) {
+            return { ok: false, reason: "not_pending_for_agent", guidance: `No pending consent item for '${sel.name}' with prefix '${prefix}'.` };
+        }
+        store.setConsentState(item.signalHash, "refused");
+        // M10B-D4: the refusal MESSAGE back to the issuer is the subject's CHOICE and rides the
+        // submission queue as an `op` — it is not sent here, and it is not sent automatically. Accepting
+        // the message parameter without a carrier would be a promise this verb cannot keep, so the
+        // parameter is deliberately not taken yet; the refusal itself is complete and durable.
+        return {
+            ok: true,
+            signal_hash: item.signalHash,
+            consent_state: "refused",
+            note: "The issuer is not notified. Sending a refusal message requires the submission carrier (DOD-END-SUBMIT-1 wiring).",
+        };
+    });
     handlers.set("wallet_revoke_signal", async (params, _connectionId) => {
         const hashPrefix = typeof params?.hash_prefix === "string" ? params.hash_prefix : null;
         if (!hashPrefix || hashPrefix.length < 8) {