instar 1.3.42 → 1.3.44

package/dist/core/HandoffReceiver.d.ts

@@ -0,0 +1,56 @@
+/**
+ * HandoffReceiver — the INCOMING-machine side of the planned handoff (spec §8
+ * G3d/G3e), the counterpart to the outgoing-only HandoffSentinel.
+ *
+ * The incoming machine is already receiving the live tail (via /api/live-tail).
+ * When the outgoing machine signals a handoff is beginning, this receiver:
+ *   1. builds its "caught up" ack — echoing the live-tail sequence it holds, the
+ *      ingress position it will resume from, and a hash of the thread history it
+ *      loaded (the outgoing verifies this echo before yielding);
+ *   2. sends the ack to the outgoing machine;
+ *   3. on the explicit `yield` signal (the ONLY trigger), acquires the lease via
+ *      the consented path.
+ *
+ * State machine: idle → catching_up → ack_sent → acquired | failed.
+ *
+ * The yield is acted on ONLY while a handoff is in progress (ack_sent) — a stray
+ * yield with no handoff underway is ignored (and the lease's own consent guard
+ * refuses a yield from a non-holder regardless). All I/O is injected, so the
+ * sequencing is unit-testable without a network.
+ */
+import type { HandoffAck } from './HandoffSentinel.js';
+export type HandoffReceiverState = 'idle' | 'catching_up' | 'ack_sent' | 'acquired' | 'failed';
+export interface HandoffReceiverOps {
+    /** Build the "caught up" ack from the live-tail buffer + adapter ingress + thread hash. */
+    buildAck: () => Promise<HandoffAck>;
+    /** Send the ack to the outgoing machine (HandoffWireTransport.sendAck). */
+    sendAck: (ack: HandoffAck) => Promise<boolean>;
+    /** Acquire the lease on the verified yield (coordinator.acquireLeaseOnConsent). */
+    acquireOnYield: () => Promise<boolean>;
+}
+export interface HandoffReceiverConfig {
+    logger?: (msg: string) => void;
+    onTerminal?: (state: 'acquired' | 'failed', detail: string) => void;
+}
+export declare class HandoffReceiver {
+    private readonly ops;
+    private readonly cfg;
+    private _state;
+    constructor(ops: HandoffReceiverOps, cfg?: HandoffReceiverConfig);
+    get state(): HandoffReceiverState;
+    private log;
+    /**
+     * The outgoing machine has begun a handoff to us. Build + send our caught-up
+     * ack. Returns true if the ack was sent (the outgoing will verify the echo and,
+     * if it matches + validation passes, send a yield).
+     */
+    onBeginHandoff(): Promise<boolean>;
+    /**
+     * The outgoing machine sent the explicit yield. Acquire the lease — but ONLY if
+     * a handoff is genuinely in progress (we sent an ack). A stray yield is ignored.
+     */
+    onYield(): Promise<boolean>;
+    /** Reset to idle (e.g. a handoff was aborted or completed). */
+    reset(): void;
+}
+//# sourceMappingURL=HandoffReceiver.d.ts.map

package/dist/core/HandoffReceiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandoffReceiver.d.ts","sourceRoot":"","sources":["../../src/core/HandoffReceiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE/F,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,mFAAmF;IACnF,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACrE;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,MAAM,CAAgC;gBAElC,GAAG,EAAE,kBAAkB,EAAE,GAAG,GAAE,qBAA0B;IAKpE,IAAI,KAAK,IAAI,oBAAoB,CAEhC;IAED,OAAO,CAAC,GAAG;IAIX;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IA2BxC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAuBjC,+DAA+D;IAC/D,KAAK,IAAI,IAAI;CAGd"}

package/dist/core/HandoffReceiver.js

@@ -0,0 +1,103 @@
+/**
+ * HandoffReceiver — the INCOMING-machine side of the planned handoff (spec §8
+ * G3d/G3e), the counterpart to the outgoing-only HandoffSentinel.
+ *
+ * The incoming machine is already receiving the live tail (via /api/live-tail).
+ * When the outgoing machine signals a handoff is beginning, this receiver:
+ *   1. builds its "caught up" ack — echoing the live-tail sequence it holds, the
+ *      ingress position it will resume from, and a hash of the thread history it
+ *      loaded (the outgoing verifies this echo before yielding);
+ *   2. sends the ack to the outgoing machine;
+ *   3. on the explicit `yield` signal (the ONLY trigger), acquires the lease via
+ *      the consented path.
+ *
+ * State machine: idle → catching_up → ack_sent → acquired | failed.
+ *
+ * The yield is acted on ONLY while a handoff is in progress (ack_sent) — a stray
+ * yield with no handoff underway is ignored (and the lease's own consent guard
+ * refuses a yield from a non-holder regardless). All I/O is injected, so the
+ * sequencing is unit-testable without a network.
+ */
+export class HandoffReceiver {
+    ops;
+    cfg;
+    _state = 'idle';
+    constructor(ops, cfg = {}) {
+        this.ops = ops;
+        this.cfg = cfg;
+    }
+    get state() {
+        return this._state;
+    }
+    log(m) {
+        this.cfg.logger?.(`[handoff-recv] ${m}`);
+    }
+    /**
+     * The outgoing machine has begun a handoff to us. Build + send our caught-up
+     * ack. Returns true if the ack was sent (the outgoing will verify the echo and,
+     * if it matches + validation passes, send a yield).
+     */
+    async onBeginHandoff() {
+        this._state = 'catching_up';
+        let ack;
+        try {
+            ack = await this.ops.buildAck();
+        }
+        catch (err) {
+            this._state = 'failed';
+            this.log(`buildAck failed: ${msg(err)}`);
+            return false;
+        }
+        let sent;
+        try {
+            sent = await this.ops.sendAck(ack);
+        }
+        catch (err) {
+            this._state = 'failed';
+            this.log(`sendAck failed: ${msg(err)}`);
+            return false;
+        }
+        if (!sent) {
+            this._state = 'failed';
+            this.log('ack not accepted by the outgoing machine');
+            return false;
+        }
+        this._state = 'ack_sent';
+        return true;
+    }
+    /**
+     * The outgoing machine sent the explicit yield. Acquire the lease — but ONLY if
+     * a handoff is genuinely in progress (we sent an ack). A stray yield is ignored.
+     */
+    async onYield() {
+        if (this._state !== 'ack_sent') {
+            this.log(`ignoring yield in state '${this._state}' — no handoff in progress`);
+            return false;
+        }
+        let acquired;
+        try {
+            acquired = await this.ops.acquireOnYield();
+        }
+        catch (err) {
+            this._state = 'failed';
+            this.cfg.onTerminal?.('failed', `acquire threw: ${msg(err)}`);
+            return false;
+        }
+        if (acquired) {
+            this._state = 'acquired';
+            this.cfg.onTerminal?.('acquired', 'lease acquired on yield — now awake');
+            return true;
+        }
+        this._state = 'failed';
+        this.cfg.onTerminal?.('failed', 'consent acquire did not take the lease — staying standby');
+        return false;
+    }
+    /** Reset to idle (e.g. a handoff was aborted or completed). */
+    reset() {
+        this._state = 'idle';
+    }
+}
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=HandoffReceiver.js.map

package/dist/core/HandoffReceiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandoffReceiver.js","sourceRoot":"","sources":["../../src/core/HandoffReceiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAyBH,MAAM,OAAO,eAAe;IACT,GAAG,CAAqB;IACxB,GAAG,CAAwB;IACpC,MAAM,GAAyB,MAAM,CAAC;IAE9C,YAAY,GAAuB,EAAE,MAA6B,EAAE;QAClE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;QAC5B,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,oBAAoB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,MAAM,4BAA4B,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,kBAAkB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,0DAA0D,CAAC,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+DAA+D;IAC/D,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/core/HandoffWireTransport.d.ts

@@ -0,0 +1,61 @@
+/**
+ * HandoffWireTransport — the point-to-point ack/yield channel for the planned
+ * handoff protocol (spec §8 G3d/G3e). Symmetric: both machines run it, using the
+ * half that matches their role in a given handoff.
+ *
+ *   OUTGOING machine (HandoffSentinel.initiate):
+ *     - awaitAck(timeoutMs): resolves when the incoming POSTs its verified-ack to
+ *       /api/handoff/ack (recordAck fires the pending promise); null on timeout.
+ *     - sendYield(): POSTs the explicit yield signal to the incoming's
+ *       /api/handoff/yield — the ONLY trigger for the incoming's lease CAS. Sent
+ *       ONLY after a verified ack + passing validation (HandoffSentinel enforces).
+ *
+ *   INCOMING machine:
+ *     - sendAck(ack): POSTs its "caught up" echo (tailSeq + ingressPosition +
+ *       threadHistoryHash) to the outgoing's /api/handoff/ack.
+ *     - onYield(cb): the /api/handoff/yield route invokes the registered handler,
+ *       which triggers the incoming's lease-CAS acquisition.
+ *
+ * All POSTs ride the authenticated machine channel (signRequest +
+ * machineAuthMiddleware on the receiver). Injected fetch/clock for testability.
+ * A handoff is strictly 1:1 with the single peer, resolved by the caller.
+ */
+import type { HandoffAck } from './HandoffSentinel.js';
+export interface HandoffWirePeer {
+    machineId: string;
+    url: string;
+}
+export interface HandoffWireTransportDeps {
+    selfMachineId: string;
+    signingKeyPem: string;
+    /** Resolve the single counterpart machine for a handoff (excludes self). */
+    peer: () => HandoffWirePeer | null;
+    nextSequence: () => number;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    logger?: (msg: string) => void;
+}
+export declare class HandoffWireTransport {
+    private readonly d;
+    private pendingAck;
+    private yieldHandler;
+    constructor(deps: HandoffWireTransportDeps);
+    private log;
+    private fetchImpl;
+    private post;
+    /** Wait for the incoming machine's ack (resolved by recordAck), or null on timeout. */
+    awaitAck(timeoutMs: number): Promise<HandoffAck | null>;
+    /** Called by POST /api/handoff/ack — delivers the incoming machine's ack. */
+    recordAck(ack: HandoffAck): void;
+    /** Send the yield signal to the incoming machine. */
+    sendYield(): Promise<boolean>;
+    /** Open a planned handoff: POST the flush manifest to the incoming's begin route. */
+    sendBegin(manifest: unknown): Promise<boolean>;
+    /** Send this machine's "caught up" ack to the outgoing machine. */
+    sendAck(ack: HandoffAck): Promise<boolean>;
+    /** Register the handler the /api/handoff/yield route invokes (incoming side). */
+    onYield(cb: () => void): void;
+    /** Called by POST /api/handoff/yield — triggers the incoming's lease CAS. */
+    recordYield(): void;
+}
+//# sourceMappingURL=HandoffWireTransport.d.ts.map

package/dist/core/HandoffWireTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandoffWireTransport.d.ts","sourceRoot":"","sources":["../../src/core/HandoffWireTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA2B;IAC7C,OAAO,CAAC,UAAU,CAAoG;IACtH,OAAO,CAAC,YAAY,CAA6B;gBAErC,IAAI,EAAE,wBAAwB;IAI1C,OAAO,CAAC,GAAG;IAGX,OAAO,CAAC,SAAS;YAGH,IAAI;IAsBlB,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAmBvD,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAWhC,qDAAqD;IAC/C,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAInC,qFAAqF;IAC/E,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMpD,mEAAmE;IAC7D,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD,iFAAiF;IACjF,OAAO,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAI7B,6EAA6E;IAC7E,WAAW,IAAI,IAAI;CAOpB"}

package/dist/core/HandoffWireTransport.js

@@ -0,0 +1,114 @@
+/**
+ * HandoffWireTransport — the point-to-point ack/yield channel for the planned
+ * handoff protocol (spec §8 G3d/G3e). Symmetric: both machines run it, using the
+ * half that matches their role in a given handoff.
+ *
+ *   OUTGOING machine (HandoffSentinel.initiate):
+ *     - awaitAck(timeoutMs): resolves when the incoming POSTs its verified-ack to
+ *       /api/handoff/ack (recordAck fires the pending promise); null on timeout.
+ *     - sendYield(): POSTs the explicit yield signal to the incoming's
+ *       /api/handoff/yield — the ONLY trigger for the incoming's lease CAS. Sent
+ *       ONLY after a verified ack + passing validation (HandoffSentinel enforces).
+ *
+ *   INCOMING machine:
+ *     - sendAck(ack): POSTs its "caught up" echo (tailSeq + ingressPosition +
+ *       threadHistoryHash) to the outgoing's /api/handoff/ack.
+ *     - onYield(cb): the /api/handoff/yield route invokes the registered handler,
+ *       which triggers the incoming's lease-CAS acquisition.
+ *
+ * All POSTs ride the authenticated machine channel (signRequest +
+ * machineAuthMiddleware on the receiver). Injected fetch/clock for testability.
+ * A handoff is strictly 1:1 with the single peer, resolved by the caller.
+ */
+import { signRequest } from '../server/machineAuth.js';
+export class HandoffWireTransport {
+    d;
+    pendingAck = null;
+    yieldHandler = null;
+    constructor(deps) {
+        this.d = deps;
+    }
+    log(m) {
+        this.d.logger?.(`[handoff-wire] ${m}`);
+    }
+    fetchImpl() {
+        return this.d.fetchImpl ?? fetch;
+    }
+    async post(path, body) {
+        const peer = this.d.peer();
+        if (!peer) {
+            this.log(`no peer for ${path}`);
+            return false;
+        }
+        try {
+            const headers = signRequest(this.d.selfMachineId, this.d.signingKeyPem, body, this.d.nextSequence());
+            const res = await this.fetchImpl()(`${peer.url.replace(/\/$/, '')}${path}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', ...headers },
+                body: JSON.stringify(body),
+            });
+            return !!(res && res.ok);
+        }
+        catch (err) {
+            this.log(`POST ${path} to ${peer.machineId} failed: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
+    // ── OUTGOING side ──────────────────────────────────────────────
+    /** Wait for the incoming machine's ack (resolved by recordAck), or null on timeout. */
+    awaitAck(timeoutMs) {
+        // Only one handoff at a time; a new wait supersedes any stale pending one.
+        if (this.pendingAck) {
+            clearTimeout(this.pendingAck.timer);
+            this.pendingAck.resolve(null);
+            this.pendingAck = null;
+        }
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                this.pendingAck = null;
+                this.log(`ack timed out after ${timeoutMs}ms`);
+                resolve(null);
+            }, timeoutMs);
+            // Don't let a pending handoff ack keep the process alive.
+            timer.unref?.();
+            this.pendingAck = { resolve, timer };
+        });
+    }
+    /** Called by POST /api/handoff/ack — delivers the incoming machine's ack. */
+    recordAck(ack) {
+        if (!this.pendingAck) {
+            this.log('received an ack with no pending awaitAck — dropping');
+            return;
+        }
+        clearTimeout(this.pendingAck.timer);
+        const { resolve } = this.pendingAck;
+        this.pendingAck = null;
+        resolve(ack);
+    }
+    /** Send the yield signal to the incoming machine. */
+    async sendYield() {
+        return this.post('/api/handoff/yield', { yield: true, from: this.d.selfMachineId });
+    }
+    /** Open a planned handoff: POST the flush manifest to the incoming's begin route. */
+    async sendBegin(manifest) {
+        return this.post('/api/handoff/begin', { manifest });
+    }
+    // ── INCOMING side ──────────────────────────────────────────────
+    /** Send this machine's "caught up" ack to the outgoing machine. */
+    async sendAck(ack) {
+        return this.post('/api/handoff/ack', { ack });
+    }
+    /** Register the handler the /api/handoff/yield route invokes (incoming side). */
+    onYield(cb) {
+        this.yieldHandler = cb;
+    }
+    /** Called by POST /api/handoff/yield — triggers the incoming's lease CAS. */
+    recordYield() {
+        if (!this.yieldHandler) {
+            this.log('received a yield with no handler registered — dropping');
+            return;
+        }
+        this.yieldHandler();
+    }
+}
+//# sourceMappingURL=HandoffWireTransport.js.map

package/dist/core/HandoffWireTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandoffWireTransport.js","sourceRoot":"","sources":["../../src/core/HandoffWireTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAmBvD,MAAM,OAAO,oBAAoB;IACd,CAAC,CAA2B;IACrC,UAAU,GAA+F,IAAI,CAAC;IAC9G,YAAY,GAAwB,IAAI,CAAC;IAEjD,YAAY,IAA8B;QACxC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACO,SAAS;QACf,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;IACnC,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;YACrG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;gBAC1E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,CAAC,GAAG,IAAK,GAAgB,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kEAAkE;IAElE,uFAAuF;IACvF,QAAQ,CAAC,SAAiB;QACxB,2EAA2E;QAC3E,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,uBAAuB,SAAS,IAAI,CAAC,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,0DAA0D;YACzD,KAAa,CAAC,KAAK,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,SAAS,CAAC,GAAe;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,SAAS,CAAC,QAAiB;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,kEAAkE;IAElE,mEAAmE;IACnE,KAAK,CAAC,OAAO,CAAC,GAAe;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,iFAAiF;IACjF,OAAO,CAAC,EAAc;QACpB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,6EAA6E;IAC7E,WAAW;QACT,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/core/HttpLeaseTransport.d.ts

@@ -0,0 +1,68 @@
+/**
+ * HttpLeaseTransport — the low-latency wire path for the fenced lease (spec §6:
+ * "the low-latency authoritative copy of the lease travels over the tunnel").
+ *
+ * Implements LeaseTransport over the existing authenticated machine-to-machine
+ * HTTP channel (signRequest + machineAuthMiddleware, the same path /api/heartbeat
+ * uses). The git copy remains the durable audit/CAS substrate; this transport
+ * ACCELERATES acquisition + carries renewals, and a holder that cannot reach
+ * peers for > leaseTtlMs self-suspends (the renewal-requires-medium rule).
+ *
+ * observed() returns the freshest lease this machine has RECEIVED from a peer
+ * (fed by the /api/lease endpoint via recordObserved) plus the per-holder nonce
+ * map for replay detection. isReachable() reflects whether a recent broadcast
+ * reached at least one peer.
+ *
+ * The HTTP layer is injected (fetchImpl) so the broadcast/observe/reachability
+ * logic is unit-testable without a network.
+ */
+import type { LeaseTransport } from './LeaseCoordinator.js';
+import type { LeaseRecord } from './types.js';
+export interface LeasePeer {
+    machineId: string;
+    /** Base URL of the peer (its lastKnownUrl / tunnel URL). */
+    url: string;
+}
+export interface HttpLeaseTransportDeps {
+    selfMachineId: string;
+    signingKeyPem: string;
+    /** Resolve the current set of reachable peers (excludes self). */
+    peers: () => LeasePeer[];
+    /** Monotonic per-request sequence (reuse the machine's nonce/sequence source). */
+    nextSequence: () => number;
+    /** Injected fetch (defaults to global fetch). */
+    fetchImpl?: typeof fetch;
+    /** How recent a successful broadcast counts as "reachable". Default = leaseTtlMs. */
+    reachabilityWindowMs?: number;
+    now?: () => number;
+    logger?: (msg: string) => void;
+}
+export declare class HttpLeaseTransport implements LeaseTransport {
+    private readonly d;
+    private lastObserved;
+    private lastNonceByHolder;
+    private lastBroadcastOkAt;
+    private readonly windowMs;
+    constructor(deps: HttpLeaseTransportDeps);
+    private now;
+    private log;
+    /**
+     * Broadcast our lease to every peer over the authenticated channel. Resolves
+     * true if at least one peer accepted (we have a live medium); false if none
+     * were reachable.
+     */
+    broadcast(lease: LeaseRecord): Promise<boolean>;
+    observed(): {
+        lease: LeaseRecord | null;
+        lastNonceByHolder: Record<string, number>;
+    };
+    isReachable(): boolean;
+    /**
+     * Record a lease received from a peer (called by the /api/lease endpoint after
+     * machine-auth verification). Keeps only the highest-epoch observed lease and
+     * advances the per-holder nonce watermark (replay detection happens in
+     * FencedLease.acceptTunnelLease which reads this map).
+     */
+    recordObserved(lease: LeaseRecord): void;
+}
+//# sourceMappingURL=HttpLeaseTransport.d.ts.map

package/dist/core/HttpLeaseTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpLeaseTransport.d.ts","sourceRoot":"","sources":["../../src/core/HttpLeaseTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,KAAK,EAAE,MAAM,SAAS,EAAE,CAAC;IACzB,kFAAkF;IAClF,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAyB;IAC3C,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,iBAAiB,CAA8B;IACvD,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,IAAI,EAAE,sBAAsB;IAKxC,OAAO,CAAC,GAAG;IAGX,OAAO,CAAC,GAAG;IAIX;;;;OAIG;IACG,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BrD,QAAQ,IAAI;QAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAIpF,WAAW,IAAI,OAAO;IAItB;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;CAYzC"}

package/dist/core/HttpLeaseTransport.js

@@ -0,0 +1,97 @@
+/**
+ * HttpLeaseTransport — the low-latency wire path for the fenced lease (spec §6:
+ * "the low-latency authoritative copy of the lease travels over the tunnel").
+ *
+ * Implements LeaseTransport over the existing authenticated machine-to-machine
+ * HTTP channel (signRequest + machineAuthMiddleware, the same path /api/heartbeat
+ * uses). The git copy remains the durable audit/CAS substrate; this transport
+ * ACCELERATES acquisition + carries renewals, and a holder that cannot reach
+ * peers for > leaseTtlMs self-suspends (the renewal-requires-medium rule).
+ *
+ * observed() returns the freshest lease this machine has RECEIVED from a peer
+ * (fed by the /api/lease endpoint via recordObserved) plus the per-holder nonce
+ * map for replay detection. isReachable() reflects whether a recent broadcast
+ * reached at least one peer.
+ *
+ * The HTTP layer is injected (fetchImpl) so the broadcast/observe/reachability
+ * logic is unit-testable without a network.
+ */
+import { signRequest } from '../server/machineAuth.js';
+export class HttpLeaseTransport {
+    d;
+    lastObserved = null;
+    lastNonceByHolder = {};
+    lastBroadcastOkAt = 0;
+    windowMs;
+    constructor(deps) {
+        this.d = deps;
+        this.windowMs = deps.reachabilityWindowMs ?? 60_000;
+    }
+    now() {
+        return (this.d.now ?? Date.now)();
+    }
+    log(m) {
+        this.d.logger?.(`[lease-wire] ${m}`);
+    }
+    /**
+     * Broadcast our lease to every peer over the authenticated channel. Resolves
+     * true if at least one peer accepted (we have a live medium); false if none
+     * were reachable.
+     */
+    async broadcast(lease) {
+        const peers = this.d.peers();
+        if (peers.length === 0) {
+            // No peers → a single-machine mesh; treat as "reachable" (nothing to fail).
+            this.lastBroadcastOkAt = this.now();
+            return true;
+        }
+        const fetchImpl = this.d.fetchImpl ?? fetch;
+        let anyOk = false;
+        await Promise.all(peers.map(async (peer) => {
+            try {
+                const body = { lease };
+                const headers = signRequest(this.d.selfMachineId, this.d.signingKeyPem, body, this.d.nextSequence());
+                const res = await fetchImpl(`${peer.url.replace(/\/$/, '')}/api/lease`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json', ...headers },
+                    body: JSON.stringify(body),
+                });
+                if (res && res.ok)
+                    anyOk = true;
+            }
+            catch (err) {
+                this.log(`broadcast to ${peer.machineId} failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }));
+        if (anyOk)
+            this.lastBroadcastOkAt = this.now();
+        return anyOk;
+    }
+    observed() {
+        return { lease: this.lastObserved, lastNonceByHolder: { ...this.lastNonceByHolder } };
+    }
+    isReachable() {
+        return this.now() - this.lastBroadcastOkAt <= this.windowMs;
+    }
+    /**
+     * Record a lease received from a peer (called by the /api/lease endpoint after
+     * machine-auth verification). Keeps only the highest-epoch observed lease and
+     * advances the per-holder nonce watermark (replay detection happens in
+     * FencedLease.acceptTunnelLease which reads this map).
+     */
+    recordObserved(lease) {
+        if (!lease || typeof lease.epoch !== 'number')
+            return;
+        const prevNonce = this.lastNonceByHolder[lease.holder] ?? -1;
+        // Only accept a strictly-newer nonce for this holder (drop replays here too).
+        if (lease.nonce <= prevNonce && this.lastObserved && this.lastObserved.epoch >= lease.epoch) {
+            return;
+        }
+        if (lease.nonce > prevNonce)
+            this.lastNonceByHolder[lease.holder] = lease.nonce;
+        if (!this.lastObserved || lease.epoch >= this.lastObserved.epoch) {
+            this.lastObserved = lease;
+        }
+    }
+}
+//# sourceMappingURL=HttpLeaseTransport.js.map

package/dist/core/HttpLeaseTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpLeaseTransport.js","sourceRoot":"","sources":["../../src/core/HttpLeaseTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAyBvD,MAAM,OAAO,kBAAkB;IACZ,CAAC,CAAyB;IACnC,YAAY,GAAuB,IAAI,CAAC;IACxC,iBAAiB,GAA2B,EAAE,CAAC;IAC/C,iBAAiB,GAAG,CAAC,CAAC;IACb,QAAQ,CAAS;IAElC,YAAY,IAA4B;QACtC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,oBAAoB,IAAI,MAAM,CAAC;IACtD,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IACO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,4EAA4E;YAC5E,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBACrG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,EAAE;oBACtE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;oBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;gBACH,IAAI,GAAG,IAAK,GAAgB,CAAC,EAAE;oBAAE,KAAK,GAAG,IAAI,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,SAAS,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,IAAI,KAAK;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,iBAAiB,EAAE,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,KAAkB;QAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,8EAA8E;QAC9E,IAAI,KAAK,CAAC,KAAK,IAAI,SAAS,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS;YAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACjE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;CACF"}

package/dist/core/HttpLiveTailTransport.d.ts

@@ -0,0 +1,88 @@
+/**
+ * HttpLiveTailTransport — the encrypted server-to-server wire that streams the
+ * live conversation tail from the lease HOLDER to the standby (spec §8 G3b/c).
+ *
+ * This is the SENDER side. The holder calls broadcast() with a per-topic,
+ * monotonic-sequence flush of recent conversation content; the transport:
+ *   1. REDACTS the content (liveTailRedaction) BEFORE anything leaves the
+ *      machine — credential categories are scrubbed at the boundary, not trusted
+ *      to TLS or the receiver (spec §8 G3c: "redact/exclude secrets ... never
+ *      sent in the clear over the tail").
+ *   2. ENCRYPTS the redacted content for the peer using the v3 machine-to-machine
+ *      scheme (encryptForSync: ephemeral X25519 key agreement + AES-256-GCM,
+ *      forward-secret per flush — a fresh ephemeral key per call).
+ *   3. POSTs it to the peer's /api/live-tail over the existing AUTHENTICATED
+ *      machine channel (signRequest + machineAuthMiddleware on the receiver),
+ *      giving mutual authentication: the receiver verifies the sender's machine
+ *      identity, and only the intended receiver (holding the X25519 private key)
+ *      can decrypt.
+ *
+ * Single-machine safe: no peers → broadcast is a reachable no-op (identical to
+ * a git-only / disabled mesh, so a solo agent is unaffected).
+ *
+ * Only the designated next-in-line standby peer(s) receive a tail subscription
+ * (the cost ceiling that keeps "more machines = more reliable, not more chatter"
+ * — spec §8 G3b); peer selection is the caller's via the injected peers().
+ *
+ * The HTTP layer, the encryptor, and the clock are all injected so the
+ * redact→encrypt→post logic is unit-testable without a network or real keys.
+ */
+import type { EncryptedSecretPayload } from './SecretStore.js';
+export interface LiveTailPeer {
+    machineId: string;
+    /** Base URL of the peer (its lastKnownUrl / tunnel URL). */
+    url: string;
+    /** Peer's X25519 encryption public key (base64) — from the mesh registry. */
+    encryptionPublicKey: string;
+}
+/** What actually travels on the wire — the content is encrypted, never plaintext. */
+export interface LiveTailFlushWire {
+    topic: string;
+    seq: number;
+    enc: EncryptedSecretPayload;
+    /** The redaction category-set version the sender applied (spec §8 G3c). */
+    redactionVersion: number;
+}
+export interface HttpLiveTailTransportDeps {
+    selfMachineId: string;
+    signingKeyPem: string;
+    /** Resolve the next-in-line standby peer(s) to push the live tail to (excludes self). */
+    peers: () => LiveTailPeer[];
+    /** Monotonic per-request sequence for machine-auth replay protection. */
+    nextSequence: () => number;
+    /**
+     * Encrypt already-redacted content for a recipient's X25519 public key (base64).
+     * Wired to SecretStore.encryptForSync in production; injected for tests.
+     */
+    encryptFor: (content: string, recipientEncPubB64: string) => EncryptedSecretPayload;
+    /** Injected fetch (defaults to global fetch). */
+    fetchImpl?: typeof fetch;
+    /** How recent a successful broadcast counts as "reachable". Default = 60s. */
+    reachabilityWindowMs?: number;
+    now?: () => number;
+    logger?: (msg: string) => void;
+}
+export interface LiveTailFlushInput {
+    topic: string;
+    /** Per-topic monotonic sequence (the standby applies only lastAppliedSeq+1). */
+    seq: number;
+    /** Raw (un-redacted) tail content for this flush. */
+    content: string;
+}
+export declare class HttpLiveTailTransport {
+    private readonly d;
+    private lastBroadcastOkAt;
+    private readonly windowMs;
+    constructor(deps: HttpLiveTailTransportDeps);
+    private now;
+    private log;
+    /**
+     * Redact → encrypt → POST a flush to every standby peer over the authenticated
+     * channel. Resolves true if at least one peer accepted (a live medium exists);
+     * false if no peer was reachable. No peers → a reachable no-op (true).
+     */
+    broadcast(flush: LiveTailFlushInput): Promise<boolean>;
+    /** Whether a recent broadcast reached at least one peer (the renewal-medium check). */
+    isReachable(): boolean;
+}
+//# sourceMappingURL=HttpLiveTailTransport.d.ts.map

package/dist/core/HttpLiveTailTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpLiveTailTransport.d.ts","sourceRoot":"","sources":["../../src/core/HttpLiveTailTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,sBAAsB,CAAC;IAC5B,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,KAAK,EAAE,MAAM,YAAY,EAAE,CAAC;IAC5B,yEAAyE;IACzE,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B;;;OAGG;IACH,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,KAAK,sBAAsB,CAAC;IACpF,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA4B;IAC9C,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,IAAI,EAAE,yBAAyB;IAK3C,OAAO,CAAC,GAAG;IAGX,OAAO,CAAC,GAAG;IAIX;;;;OAIG;IACG,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAsC5D,uFAAuF;IACvF,WAAW,IAAI,OAAO;CAGvB"}