@jsm-mit/tigi-sharded-package 0.1.0 → 0.3.0

package/README.md

@@ -6,7 +6,9 @@ carries the rider's few driver-canister endpoints (U-14: `getRide`, `cancelRide`
 `getLicence`), built from `protocol/tigi-driver.did`, so the consumer never sees a driver
 canister's id.
 
-Status: the rider's side (night 1, U-42). Version 0.1.0 is the first to publish.
+Status: the rider's side (night 1, U-42); 0.2.0 (stage 2a, U-43) adds the rider's own
+rating and WHERE the chat with a driver is; 0.3.0 (U-45) adds `DriverCanistersActor` — the
+demo lease and the one-time claim code. Version 0.1.0 was the first to publish.
 
 ## The rider
 
@@ -39,6 +41,7 @@ await request.getLicenceAsyncUnsafe();                      // from accepted to
 await request.rateDriverAsyncUnsafe(5);                     // after completed, once
 
 const page = await profiles.getMyRidesAsyncUnsafe();        // the history in the core, 20 a page
+const mine = await profiles.getMyRatingAsyncUnsafe();       // PF-4: { average: 4.87, count, sum } | undefined ("Brak ocen")
 await rides.getPastRideAsyncUnsafe(page.rides[0].rideRef);  // its details from the driver canister
 ```
 
@@ -56,6 +59,82 @@ Errors: `CanisterError` (with `errorKey`; `refusalKeyOf(err)` gives the worker's
 `NOT_COMPLETED`, `EXPIRED`, `BLOCKED`), `CallRefusedAtInspectionStage`,
 `CriticalCanisterError`.
 
+## For the fronts: the chat (U-43)
+
+One chat room per DRIVER in `chat-sharded` (not per ride): its recipient is the owner of
+the driver canister, and every Tigi account may open a chat there (the chat asks the Tigi
+coordinator WHERE the accounts are and the core `isUser`). The core makes the rooms through
+the coordinator; this package only says WHERE — the fronts send and read messages with
+`@jsm-mit/chat-sharded-package` themselves (this package does not wrap the chat).
+
+```ts
+import { ChatPlacesActor, driverRoomId } from "@jsm-mit/tigi-sharded-package";
+import { ChatsActor, MessagesActor } from "@jsm-mit/chat-sharded-package";
+
+// The rider (PR-25): from `accepted` to the end of the ride.
+const place = await request.getChatPlaceAsyncUnsafe();      // { chatCoordinatorId, projectId, roomId } | undefined
+if (place) {
+    const chats = new ChatsActor(place.chatCoordinatorId, identity, { host });
+    const chat = await chats.openChatAsyncUnsafe({ projectId: place.projectId, roomId: place.roomId, customerName: profile.name });
+    // … MessagesActor(place.chatCoordinatorId, identity).postAsyncUnsafe / pollNewMessagesAsyncUnsafe
+}
+
+// The driver (FK-20): the room of their own canister; they are its recipient.
+const driverPlace = await new ChatPlacesActor(coordinatorId, identity, { host }).getDriverChatPlaceAsyncUnsafe(myDriverCanisterId);
+// list the chats of driverPlace.roomId (ChatsActor.getMyChatsAsyncUnsafe({ projectId, roomId }))
+// and show only the current rider's chat
+```
+
+- `undefined` = no chat in this environment yet (no chat config in the core) or a
+  simulated driver (no chat in MVP).
+- The room id is deterministic: `driverRoomId(canister)` = `drv-<canister id>` (the
+  core's `ChatRoomFunctions.driverRoomId`).
+- The rider needs a Tigi profile (`setMyProfileAsyncUnsafe`) — without one the chat
+  refuses to open it (`CanisterError`, `NotAuthorized`).
+- One chat per (room, rider, recipients): the rider has one chat with a driver over all
+  their rides. A demo pool canister taken over by another tester gets that tester as
+  the recipient; the chats with the previous tester stay with them.
+- The room may appear a few seconds after the driver's canister (the core's outbox);
+  `openChatAsyncUnsafe` answers `NotFound` until then — try again.
+
+## For the fronts: the driver's own canister (U-45)
+
+Internet Identity gives one person a different principal on every origin. The demo lease is
+taken on the rider's site; the driver signs in on the canister's own front
+(`https://<canister>.icp0.io`) with another principal. A fresh lease answers a one-time
+claim code (15 min, single use; the core keeps only its sha256) that hands the canister to
+whoever claims it there (`fabryka.md` F-20).
+
+```ts
+import { DriverCanistersActor, claimLinkOf, claimCodeOfHash } from "@jsm-mit/tigi-sharded-package";
+
+// The rider's site (the lease holder).
+const canisters = new DriverCanistersActor(coordinatorId, identity, { host });
+const lease = await canisters.leaseDemoAsyncUnsafe();       // { kind: "leased", canister, claim? } | { kind: "busy", untilMs }
+if (lease.kind === "leased" && lease.claim) {
+    link = claimLinkOf(lease.canister.canisterId, lease.claim.code);   // "Otwórz swój kanister"
+}
+const fresh = await canisters.newClaimCodeAsyncUnsafe();    // "Nowy link": the old code stops working
+await canisters.extendDemoAsyncUnsafe();                    // F-8: 15 min more
+await canisters.getMineAsyncUnsafe();                       // the held demo canister (or the own one) | undefined
+
+// The driver's front, signed in as a non-owner, with #claim=<code> in the address.
+const code = claimCodeOfHash(window.location.hash);
+if (code) {
+    await new DriverCanistersActor(coordinatorId, identity, { host }).claimAsyncUnsafe(canisterId, code);
+    // clear the fragment, reload: the driver is the owner now
+}
+```
+
+- A refused claim is always `CanisterError` `NotAuthorized` — wrong, expired, used or not
+  this canister's code alike.
+- The lease stays with its holder: `getMineAsyncUnsafe`, `extendDemoAsyncUnsafe` and
+  `newClaimCodeAsyncUnsafe` keep working from the rider's site; `ownerPrincipal` names
+  the driver after the claim. The chat room of the canister gets the driver as its
+  recipient.
+- The same holder leasing again (no reinstall) gets no code: `newClaimCodeAsyncUnsafe`.
+- These views carry the driver canister's id: it is the driver's own address.
+
 The Test Manager (stage and the test modes): `TestManagerActor.hasSimulatedDriversAsyncUnsafe`,
 `spawnDriversAsyncUnsafe` (12 drivers), `setSpeedUpAsyncUnsafe(request, 10)` before choosing.
 Offers of the simulator have `simulated: true`.
@@ -68,7 +147,9 @@ npm run test-unit          # no replica needed
 npm run test-drivers       # (a) 5 real driver canisters, driver-bots, route-stub
 npm run test-simulator     # (b) the simulator, 20 requests, 20 rides
 npm run test-split         # (c) an area split during traffic
+npm run test-claim         # (d) the demo lease and the claim code (U-45)
 npm run test-smoke         # one whole ride with the simulator (run by publish-public)
+npm run load-local         # the load test: 200 simulated drivers, 100 riders (docs/load-test-2026-10-24.md)
 npm run publish-public     # human-run: publish from master (see below)
 npm run sync-declarations  # after a change of a .did (`… protocol` for the protocol and the simulator only)
 ```
@@ -76,7 +157,9 @@ npm run sync-declarations  # after a change of a .did (`… protocol` for the pr
 The end-to-end suites run on the LOCAL replica only (`scripts/run-tests-local.sh`): a fresh
 group, local cycles, the driver and simulator wasms of `../../tigi-driver-rust` (built
 there, never changed). Logs and measurements go to `/tmp/claude-1000/tigi/`
-(`TEST_LOG_DIR`).
+(`TEST_LOG_DIR`). The load test builds its group with its own coordinator
+(`tigi-sharded-coordinator-load`), so the shared local group stays; its settings are
+environment variables (`scripts/load-local.ts`, `scripts/run-load-local.sh`).
 
 ## Publishing
 

package/declarations/coordinator/coordinator.did

@@ -1,5 +1,19 @@
+// WHERE the accounts of a principal are (rule `sharding.md`, "A WHERE answer is a place"):
+// a canister to ask, or a referral to another coordinator to ask the same question (after
+// the core budded into a peer group). The client follows at most 2 referrals.
+type AccountsPlace = variant {
+  // Ask this canister `isUser` (today: the core of the group).
+  canister : principal;
+  // Ask this coordinator `accountsCanisterFor` again.
+  coordinator : principal;
+};
 type AssignPrefixArgs = record { prefix : text; worker : principal };
 type CanisterArgs = record { canister : principal };
+// The chat group's admin methods this coordinator calls for its core (rule `sharding.md`,
+// "Between two groups": the coordinator calls for its group). A fixed list: the core
+// composes the arguments and keeps the logic, the coordinator only forwards. A new
+// method of the chat group is a new case here, never a free method name.
+type ChatAdminMethod = variant { updateRoom; createRoom; deleteRoom };
 type CommitWasmArgs = record {
   // Of the whole module. The coordinator refuses a module that does not match.
   sha256 : blob;
@@ -121,6 +135,16 @@ type Event = record {
   kind : text;
   "text" : text;
 };
+// The arguments of the method are the core's, Candid-encoded (`to_candid` in Motoko) —
+// the coordinator does not read them and keeps no copy of the chat group's types.
+type ForwardChatAdminArgs = record {
+  method : ChatAdminMethod;
+  // The one argument of the method, Candid-encoded.
+  args : blob;
+  // The chat group's COORDINATOR (the core's chat config) — the group's address. The
+  // coordinator asks it where the chat core is.
+  chatCoordinator : principal;
+};
 type GeohashesArgs = record { geohashes : vec text };
 // DEPLOYED: fresh from the deploy, the deploy admins rule, no worker exists or is created.
 // LIVE: a person claimed the superadmin role; the group works.
@@ -320,25 +344,26 @@ type ReportOutboxStuckArgs = record {
 };
 type Result = variant { Ok : vec principal; Err : CoordinatorError };
 type Result_1 = variant { Ok : Roles; Err : CoordinatorError };
-type Result_10 = variant { Ok : bool; Err : CoordinatorError };
-type Result_11 = variant { Ok : vec WorkerRecord; Err : CoordinatorError };
-type Result_12 = variant { Ok : CoreRecord; Err : CoordinatorError };
-type Result_13 = variant { Ok : WorkerStatus; Err : CoordinatorError };
-type Result_14 = variant { Ok : Dependents; Err : CoordinatorError };
-type Result_15 = variant { Ok : Config; Err : CoordinatorError };
-type Result_16 = variant { Ok : SetWorkerConfigResult; Err : CoordinatorError };
-type Result_17 = variant { Ok : WorkerView; Err : CoordinatorError };
-type Result_18 = variant { Ok : SplitResult; Err : CoordinatorError };
-type Result_19 = variant { Ok : nat; Err : CoordinatorError };
+type Result_10 = variant { Ok : vec WorkerLive; Err : CoordinatorError };
+type Result_11 = variant { Ok : bool; Err : CoordinatorError };
+type Result_12 = variant { Ok : vec WorkerRecord; Err : CoordinatorError };
+type Result_13 = variant { Ok : CoreRecord; Err : CoordinatorError };
+type Result_14 = variant { Ok : WorkerStatus; Err : CoordinatorError };
+type Result_15 = variant { Ok : Dependents; Err : CoordinatorError };
+type Result_16 = variant { Ok : Config; Err : CoordinatorError };
+type Result_17 = variant { Ok : SetWorkerConfigResult; Err : CoordinatorError };
+type Result_18 = variant { Ok : WorkerView; Err : CoordinatorError };
+type Result_19 = variant { Ok : SplitResult; Err : CoordinatorError };
 type Result_2 = variant { Ok : vec PrefixEntry; Err : CoordinatorError };
-type Result_20 = variant { Ok : nat64; Err : CoordinatorError };
+type Result_20 = variant { Ok : nat; Err : CoordinatorError };
+type Result_21 = variant { Ok : nat64; Err : CoordinatorError };
 type Result_3 = variant { Ok : WasmInfo; Err : CoordinatorError };
 type Result_4 = variant { Ok : principal; Err : CoordinatorError };
 type Result_5 = variant { Ok : DeletedWorker; Err : CoordinatorError };
 type Result_6 = variant { Ok : vec text; Err : CoordinatorError };
-type Result_7 = variant { Ok : CoreLive; Err : CoordinatorError };
-type Result_8 = variant { Ok : Status; Err : CoordinatorError };
-type Result_9 = variant { Ok : vec WorkerLive; Err : CoordinatorError };
+type Result_7 = variant { Ok : blob; Err : CoordinatorError };
+type Result_8 = variant { Ok : CoreLive; Err : CoordinatorError };
+type Result_9 = variant { Ok : Status; Err : CoordinatorError };
 // Somebody asked for the superadmin role.
 type RoleRequest = record { "principal" : principal; atNs : nat64 };
 // Who rules the group — for the front.
@@ -477,6 +502,11 @@ type WorkerView = record {
   "record" : WorkerRecord;
 };
 service : (InitArgs) -> {
+  // KO-16: WHERE the accounts of a principal are — a place: `canister` (ask it `isUser`) or
+  // `coordinator` (a referral: ask that coordinator again). Asked by the chat core for a
+  // customer of the project whose accounts field names this coordinator. Today `canister` =
+  // the core of the group for every principal (null = no core yet). Never the answer itself.
+  accountsCanisterFor : (principal) -> (opt AccountsPlace) query;
   // An admin of the core, added by a superadmin through the coordinator.
   addCoreAdmin : (PrincipalArgs) -> (Result);
   // A deploy admin more — a machine that runs seeds or tests. Not in a live prod group.
@@ -506,8 +536,15 @@ service : (InitArgs) -> {
   // KO-9: every prefix of the worker goes to `target`, and the worker is closed. The
   // emptied worker stays until a superadmin deletes it or opens it again.
   drainWorker : (DrainWorkerArgs) -> (Result_6);
+  // KO-16: the core only — one admin call on the chat group, made by this coordinator, the
+  // admin of the project there. The core composes the argument (`to_candid`) and reads the
+  // answer (`from_candid`); the coordinator checks the method against its fixed list, finds
+  // the chat core through the chat coordinator, and answers with the chat core's reply as it
+  // came (`Ok`), whatever it says. `Err` = the chat group could not be reached: a rejected
+  // call forgets the chat core, asks the chat coordinator again and tries once more.
+  forwardChatAdmin : (ForwardChatAdminArgs) -> (Result_7);
   // What the core says of itself right now — one composite query for the front.
-  getCoreStatus : () -> (Result_7) composite_query;
+  getCoreStatus : () -> (Result_8) composite_query;
   // The core of the group.
   getHomeCanister : () -> (opt principal) query;
   // The whole prefix map: which worker serves which area.
@@ -516,10 +553,10 @@ service : (InitArgs) -> {
   // ask. The principal who asked is for the superadmin only.
   getRoles : () -> (Roles) query;
   // Everything the superadmin front shows.
-  getStatus : () -> (Result_8) query;
+  getStatus : () -> (Result_9) query;
   // What every worker says of itself right now — one composite query, the workers' own
   // `getStatus` queries inside it. A worker that cannot be asked carries the reason instead.
-  getWorkersStatus : () -> (Result_9) composite_query;
+  getWorkersStatus : () -> (Result_10) composite_query;
   // The superadmin hands the role over to the one who asked.
   handOverSuperadmin : () -> (Result_1);
   // Whether this coordinator still has dependents — the core it owns, or workers, code or
@@ -532,7 +569,7 @@ service : (InitArgs) -> {
   // A test mode only (`prod` and `stage` refuse, and so does the worker): a load put on
   // ONE worker — its per-prefix counters grow, and it reports the level given to the
   // coordinator as a real minute would. What a local script uses to force a split.
-  injectWorkerTestLoad : (InjectTestLoadArgs) -> (Result_10);
+  injectWorkerTestLoad : (InjectTestLoadArgs) -> (Result_11);
   // Installs the core wasm on the core: a core without code, or — outside prod — a core
   // that has code (handed over at the install, or a reset). A fresh state, the same canister.
   installCore : () -> (Result_3);
@@ -550,11 +587,11 @@ service : (InitArgs) -> {
   // reaches the areas of several workers (WO-12).
   locateGeohashes : (GeohashesArgs) -> (vec opt principal) query;
   // A superadmin reads the query load of every installed worker now.
-  readQueryLoads : () -> (Result_11);
+  readQueryLoads : () -> (Result_12);
   // What the management canister says of the core: its balance and its module.
-  refreshCore : () -> (Result_12);
+  refreshCore : () -> (Result_13);
   // What a worker says of itself now. The coordinator keeps the memory and the cycles.
-  refreshWorker : (CanisterArgs) -> (Result_13);
+  refreshWorker : (CanisterArgs) -> (Result_14);
   removeCoreAdmin : (PrincipalArgs) -> (Result);
   removeDeployAdmin : (PrincipalArgs) -> (Result_1);
   // KO-10, C-11: the core's balance is below `lowCyclesBelow`: it gets `cyclesPerWorker`,
@@ -582,28 +619,28 @@ service : (InitArgs) -> {
   // installed again from scratch — the same ids, the same cycles, no create fee — and the
   // map starts again: the first worker holds the world. One canister at a time; refused
   // while a split, a drain or an upgrade runs.
-  resetGroup : () -> (Result_14);
+  resetGroup : () -> (Result_15);
   // Changes what a superadmin may: `spread`, the cycles of a worker, the own reserve,
   // `maxWorkers`, the query thresholds. Only the fields given are changed.
-  setConfig : (SetConfigArgs) -> (Result_15);
-  setCoreLoggingEnabled : (CoreLoggingArgs) -> (Result_10);
+  setConfig : (SetConfigArgs) -> (Result_16);
+  setCoreLoggingEnabled : (CoreLoggingArgs) -> (Result_11);
   // The config of the workers of the group: the load thresholds, logging. Only the fields
   // given are changed. The result is stored, given to every worker that has its code, and
   // to every worker created later.
-  setWorkerConfig : (WorkerConfigArgs) -> (Result_16);
+  setWorkerConfig : (WorkerConfigArgs) -> (Result_17);
   // Opens a worker to the prefixes of a split again, or closes it without giving anything
   // away.
-  setWorkerOpen : (SetWorkerOpenArgs) -> (Result_17);
+  setWorkerOpen : (SetWorkerOpenArgs) -> (Result_18);
   // A superadmin splits a worker now, whatever its load and `spread` (KO-17): a fresh worker
   // takes about half of its prefixes. Answers with the new worker and the prefixes it got.
-  splitWorker : (CanisterArgs) -> (Result_18);
+  splitWorker : (CanisterArgs) -> (Result_19);
   // A worker of the group sends its cycles here before it is deleted (`giveBackCycles`).
   // The workers only: somebody else's cycles are refused (they go back to the sender).
   takeCycles : () -> (nat);
   // Cycles for the core, by hand: `cyclesPerWorker`, like a worker's top-up.
-  topUpCore : () -> (Result_19);
+  topUpCore : () -> (Result_20);
   // Cycles for a worker, by hand.
-  topUpWorker : (CanisterArgs) -> (Result_19);
+  topUpWorker : (CanisterArgs) -> (Result_20);
   // KO-11: a new build of the core: stop → upgrade → start; its state stays (C-12).
   upgradeCore : () -> (Result_3);
   // KO-11: a new worker build on a worker that runs: stop → upgrade → start. Its state
@@ -611,10 +648,10 @@ service : (InitArgs) -> {
   // a split or a drain holds the worker.
   upgradeWorker : (CanisterArgs) -> (Result_3);
   // The core wasm, in chunks like the worker's.
-  uploadCoreWasmChunk : (WasmChunkArgs) -> (Result_20);
+  uploadCoreWasmChunk : (WasmChunkArgs) -> (Result_21);
   // One chunk of a NEW worker wasm. The first chunk (index 0) drops what was uploaded
   // before; the module counts only after `commitWorkerWasm`.
-  uploadWorkerWasmChunk : (WasmChunkArgs) -> (Result_20);
+  uploadWorkerWasmChunk : (WasmChunkArgs) -> (Result_21);
   // KO-1, KO-2: the worker of the area a geohash lies in — the longest prefix of the map
   // wins. None = no installed worker serves the area (no worker yet, or its worker is being
   // installed). Uncertified: the package checks the answer against `listWorkers`, and a

package/declarations/coordinator/coordinator.did.d.ts

@@ -2,8 +2,34 @@ import type { Principal } from '@icp-sdk/core/principal';
 import type { ActorMethod } from '@icp-sdk/core/agent';
 import type { IDL } from '@icp-sdk/core/candid';
 
+/**
+ * WHERE the accounts of a principal are (rule `sharding.md`, "A WHERE answer is a place"):
+ * a canister to ask, or a referral to another coordinator to ask the same question (after
+ * the core budded into a peer group). The client follows at most 2 referrals.
+ */
+export type AccountsPlace = {
+    /**
+     * Ask this canister `isUser` (today: the core of the group).
+     */
+    'canister' : Principal
+  } |
+  {
+    /**
+     * Ask this coordinator `accountsCanisterFor` again.
+     */
+    'coordinator' : Principal
+  };
 export interface AssignPrefixArgs { 'prefix' : string, 'worker' : Principal }
 export interface CanisterArgs { 'canister' : Principal }
+/**
+ * The chat group's admin methods this coordinator calls for its core (rule `sharding.md`,
+ * "Between two groups": the coordinator calls for its group). A fixed list: the core
+ * composes the arguments and keeps the logic, the coordinator only forwards. A new
+ * method of the chat group is a new case here, never a free method name.
+ */
+export type ChatAdminMethod = { 'updateRoom' : null } |
+  { 'createRoom' : null } |
+  { 'deleteRoom' : null };
 export interface CommitWasmArgs {
   /**
    * Of the whole module. The coordinator refuses a module that does not match.
@@ -201,6 +227,22 @@ export interface Event {
   'kind' : string,
   'text' : string,
 }
+/**
+ * The arguments of the method are the core's, Candid-encoded (`to_candid` in Motoko) —
+ * the coordinator does not read them and keeps no copy of the chat group's types.
+ */
+export interface ForwardChatAdminArgs {
+  'method' : ChatAdminMethod,
+  /**
+   * The one argument of the method, Candid-encoded.
+   */
+  'args' : Uint8Array | number[],
+  /**
+   * The chat group's COORDINATOR (the core's chat config) — the group's address. The
+   * coordinator asks it where the chat core is.
+   */
+  'chatCoordinator' : Principal,
+}
 export interface GeohashesArgs { 'geohashes' : Array<string> }
 /**
  * DEPLOYED: fresh from the deploy, the deploy admins rule, no worker exists or is created.
@@ -464,30 +506,32 @@ export type Result = { 'Ok' : Array<Principal> } |
   { 'Err' : CoordinatorError };
 export type Result_1 = { 'Ok' : Roles } |
   { 'Err' : CoordinatorError };
-export type Result_10 = { 'Ok' : boolean } |
+export type Result_10 = { 'Ok' : Array<WorkerLive> } |
   { 'Err' : CoordinatorError };
-export type Result_11 = { 'Ok' : Array<WorkerRecord> } |
+export type Result_11 = { 'Ok' : boolean } |
   { 'Err' : CoordinatorError };
-export type Result_12 = { 'Ok' : CoreRecord } |
+export type Result_12 = { 'Ok' : Array<WorkerRecord> } |
   { 'Err' : CoordinatorError };
-export type Result_13 = { 'Ok' : WorkerStatus } |
+export type Result_13 = { 'Ok' : CoreRecord } |
   { 'Err' : CoordinatorError };
-export type Result_14 = { 'Ok' : Dependents } |
+export type Result_14 = { 'Ok' : WorkerStatus } |
   { 'Err' : CoordinatorError };
-export type Result_15 = { 'Ok' : Config } |
+export type Result_15 = { 'Ok' : Dependents } |
   { 'Err' : CoordinatorError };
-export type Result_16 = { 'Ok' : SetWorkerConfigResult } |
+export type Result_16 = { 'Ok' : Config } |
   { 'Err' : CoordinatorError };
-export type Result_17 = { 'Ok' : WorkerView } |
+export type Result_17 = { 'Ok' : SetWorkerConfigResult } |
   { 'Err' : CoordinatorError };
-export type Result_18 = { 'Ok' : SplitResult } |
+export type Result_18 = { 'Ok' : WorkerView } |
   { 'Err' : CoordinatorError };
-export type Result_19 = { 'Ok' : bigint } |
+export type Result_19 = { 'Ok' : SplitResult } |
   { 'Err' : CoordinatorError };
 export type Result_2 = { 'Ok' : Array<PrefixEntry> } |
   { 'Err' : CoordinatorError };
 export type Result_20 = { 'Ok' : bigint } |
   { 'Err' : CoordinatorError };
+export type Result_21 = { 'Ok' : bigint } |
+  { 'Err' : CoordinatorError };
 export type Result_3 = { 'Ok' : WasmInfo } |
   { 'Err' : CoordinatorError };
 export type Result_4 = { 'Ok' : Principal } |
@@ -496,11 +540,11 @@ export type Result_5 = { 'Ok' : DeletedWorker } |
   { 'Err' : CoordinatorError };
 export type Result_6 = { 'Ok' : Array<string> } |
   { 'Err' : CoordinatorError };
-export type Result_7 = { 'Ok' : CoreLive } |
+export type Result_7 = { 'Ok' : Uint8Array | number[] } |
   { 'Err' : CoordinatorError };
-export type Result_8 = { 'Ok' : Status } |
+export type Result_8 = { 'Ok' : CoreLive } |
   { 'Err' : CoordinatorError };
-export type Result_9 = { 'Ok' : Array<WorkerLive> } |
+export type Result_9 = { 'Ok' : Status } |
   { 'Err' : CoordinatorError };
 /**
  * Somebody asked for the superadmin role.
@@ -711,6 +755,13 @@ export interface WorkerView {
   'record' : WorkerRecord,
 }
 export interface _SERVICE {
+  /**
+   * KO-16: WHERE the accounts of a principal are — a place: `canister` (ask it `isUser`) or
+   * `coordinator` (a referral: ask that coordinator again). Asked by the chat core for a
+   * customer of the project whose accounts field names this coordinator. Today `canister` =
+   * the core of the group for every principal (null = no core yet). Never the answer itself.
+   */
+  'accountsCanisterFor' : ActorMethod<[Principal], [] | [AccountsPlace]>,
   /**
    * An admin of the core, added by a superadmin through the coordinator.
    */
@@ -760,10 +811,19 @@ export interface _SERVICE {
    * emptied worker stays until a superadmin deletes it or opens it again.
    */
   'drainWorker' : ActorMethod<[DrainWorkerArgs], Result_6>,
+  /**
+   * KO-16: the core only — one admin call on the chat group, made by this coordinator, the
+   * admin of the project there. The core composes the argument (`to_candid`) and reads the
+   * answer (`from_candid`); the coordinator checks the method against its fixed list, finds
+   * the chat core through the chat coordinator, and answers with the chat core's reply as it
+   * came (`Ok`), whatever it says. `Err` = the chat group could not be reached: a rejected
+   * call forgets the chat core, asks the chat coordinator again and tries once more.
+   */
+  'forwardChatAdmin' : ActorMethod<[ForwardChatAdminArgs], Result_7>,
   /**
    * What the core says of itself right now — one composite query for the front.
    */
-  'getCoreStatus' : ActorMethod<[], Result_7>,
+  'getCoreStatus' : ActorMethod<[], Result_8>,
   /**
    * The core of the group.
    */
@@ -780,12 +840,12 @@ export interface _SERVICE {
   /**
    * Everything the superadmin front shows.
    */
-  'getStatus' : ActorMethod<[], Result_8>,
+  'getStatus' : ActorMethod<[], Result_9>,
   /**
    * What every worker says of itself right now — one composite query, the workers' own
    * `getStatus` queries inside it. A worker that cannot be asked carries the reason instead.
    */
-  'getWorkersStatus' : ActorMethod<[], Result_9>,
+  'getWorkersStatus' : ActorMethod<[], Result_10>,
   /**
    * The superadmin hands the role over to the one who asked.
    */
@@ -806,7 +866,7 @@ export interface _SERVICE {
    * ONE worker — its per-prefix counters grow, and it reports the level given to the
    * coordinator as a real minute would. What a local script uses to force a split.
    */
-  'injectWorkerTestLoad' : ActorMethod<[InjectTestLoadArgs], Result_10>,
+  'injectWorkerTestLoad' : ActorMethod<[InjectTestLoadArgs], Result_11>,
   /**
    * Installs the core wasm on the core: a core without code, or — outside prod — a core
    * that has code (handed over at the install, or a reset). A fresh state, the same canister.
@@ -838,15 +898,15 @@ export interface _SERVICE {
   /**
    * A superadmin reads the query load of every installed worker now.
    */
-  'readQueryLoads' : ActorMethod<[], Result_11>,
+  'readQueryLoads' : ActorMethod<[], Result_12>,
   /**
    * What the management canister says of the core: its balance and its module.
    */
-  'refreshCore' : ActorMethod<[], Result_12>,
+  'refreshCore' : ActorMethod<[], Result_13>,
   /**
    * What a worker says of itself now. The coordinator keeps the memory and the cycles.
    */
-  'refreshWorker' : ActorMethod<[CanisterArgs], Result_13>,
+  'refreshWorker' : ActorMethod<[CanisterArgs], Result_14>,
   'removeCoreAdmin' : ActorMethod<[PrincipalArgs], Result>,
   'removeDeployAdmin' : ActorMethod<[PrincipalArgs], Result_1>,
   /**
@@ -888,29 +948,29 @@ export interface _SERVICE {
    * map starts again: the first worker holds the world. One canister at a time; refused
    * while a split, a drain or an upgrade runs.
    */
-  'resetGroup' : ActorMethod<[], Result_14>,
+  'resetGroup' : ActorMethod<[], Result_15>,
   /**
    * Changes what a superadmin may: `spread`, the cycles of a worker, the own reserve,
    * `maxWorkers`, the query thresholds. Only the fields given are changed.
    */
-  'setConfig' : ActorMethod<[SetConfigArgs], Result_15>,
-  'setCoreLoggingEnabled' : ActorMethod<[CoreLoggingArgs], Result_10>,
+  'setConfig' : ActorMethod<[SetConfigArgs], Result_16>,
+  'setCoreLoggingEnabled' : ActorMethod<[CoreLoggingArgs], Result_11>,
   /**
    * The config of the workers of the group: the load thresholds, logging. Only the fields
    * given are changed. The result is stored, given to every worker that has its code, and
    * to every worker created later.
    */
-  'setWorkerConfig' : ActorMethod<[WorkerConfigArgs], Result_16>,
+  'setWorkerConfig' : ActorMethod<[WorkerConfigArgs], Result_17>,
   /**
    * Opens a worker to the prefixes of a split again, or closes it without giving anything
    * away.
    */
-  'setWorkerOpen' : ActorMethod<[SetWorkerOpenArgs], Result_17>,
+  'setWorkerOpen' : ActorMethod<[SetWorkerOpenArgs], Result_18>,
   /**
    * A superadmin splits a worker now, whatever its load and `spread` (KO-17): a fresh worker
    * takes about half of its prefixes. Answers with the new worker and the prefixes it got.
    */
-  'splitWorker' : ActorMethod<[CanisterArgs], Result_18>,
+  'splitWorker' : ActorMethod<[CanisterArgs], Result_19>,
   /**
    * A worker of the group sends its cycles here before it is deleted (`giveBackCycles`).
    * The workers only: somebody else's cycles are refused (they go back to the sender).
@@ -919,11 +979,11 @@ export interface _SERVICE {
   /**
    * Cycles for the core, by hand: `cyclesPerWorker`, like a worker's top-up.
    */
-  'topUpCore' : ActorMethod<[], Result_19>,
+  'topUpCore' : ActorMethod<[], Result_20>,
   /**
    * Cycles for a worker, by hand.
    */
-  'topUpWorker' : ActorMethod<[CanisterArgs], Result_19>,
+  'topUpWorker' : ActorMethod<[CanisterArgs], Result_20>,
   /**
    * KO-11: a new build of the core: stop → upgrade → start; its state stays (C-12).
    */
@@ -937,12 +997,12 @@ export interface _SERVICE {
   /**
    * The core wasm, in chunks like the worker's.
    */
-  'uploadCoreWasmChunk' : ActorMethod<[WasmChunkArgs], Result_20>,
+  'uploadCoreWasmChunk' : ActorMethod<[WasmChunkArgs], Result_21>,
   /**
    * One chunk of a NEW worker wasm. The first chunk (index 0) drops what was uploaded
    * before; the module counts only after `commitWorkerWasm`.
    */
-  'uploadWorkerWasmChunk' : ActorMethod<[WasmChunkArgs], Result_20>,
+  'uploadWorkerWasmChunk' : ActorMethod<[WasmChunkArgs], Result_21>,
   /**
    * KO-1, KO-2: the worker of the area a geohash lies in — the longest prefix of the map
    * wins. None = no installed worker serves the area (no worker yet, or its worker is being