@aitne/daemon 0.1.8 → 0.1.9

package/dist/adapters/notification-manager.js

@@ -1,8 +1,28 @@
-import { isMessageEvent, getAgentDayBoundsUtc, nowInTimezone } from "@aitne/shared";
+import { isMessageEvent, getAgentDayBoundsUtc } from "@aitne/shared";
 import { randomUUID } from "node:crypto";
+import { isInQuietHoursAt, nextQuietHoursEndMs as computeNextQuietHoursEndMs, } from "../core/quiet-hours.js";
+import { MessageDeliveryError } from "./message-hub.js";
 import { recordProactiveForwardDeliveries } from "../core/channel-timeline.js";
 import { createLogger } from "../logging.js";
 const logger = createLogger("notification-manager");
+/**
+ * Log a delivery failure at the severity it deserves. A
+ * `MessageDeliveryError` means the message could not reach the user for an
+ * environmental reason — no proactive destination configured, or the
+ * configured one is momentarily unavailable (e.g. WhatsApp relay flap). That
+ * is a WARN-class condition, not a code fault: the failed `notification_log`
+ * row already records the miss for the dashboard, so emitting it at ERROR just
+ * floods the error stream (it was the single largest error category in the
+ * daemon log) and buries genuine faults. Anything else is unexpected — keep it
+ * at ERROR.
+ */
+function logDeliveryFailure(err, msg) {
+    if (err instanceof MessageDeliveryError) {
+        logger.warn({ err }, msg);
+        return;
+    }
+    logger.error({ err }, msg);
+}
 const NOOP_REPLY_ACTIVITY = {
     stop: async () => { },
 };
@@ -17,13 +37,12 @@ const SAFETY_CATEGORIES = [
  * Default bounded-retry shape for `deliverReply`. Sized so the operator's
  * worst-case wait for an acknowledged DM is small (~600 ms across two
  * backoffs at 200 ms + 400 ms) while still smoothing over the transient
- * 5xx / socket-reset class of platform failures that the pre-M4 code path
- * silently swallowed.
+ * 5xx / socket-reset class of platform failures.
  */
 const DEFAULT_REPLY_RETRY_ATTEMPTS = 3;
 const DEFAULT_REPLY_RETRY_BACKOFF_BASE_MS = 200;
 /**
- * P2-15 per-type rate limit. Sized to allow legitimate bursts of the same
+ * Per-type rate limit. Sized to allow legitimate bursts of the same
  * notification type (e.g. three rapid-fire calendar updates) but stop a
  * stuck-loop emitter from monopolising the global budget. 3 deliveries
  * per 5 minutes per `event.type` matches the upper bound observed in
@@ -55,15 +74,14 @@ export class NotificationManager {
     /** Per-`event.type` timestamp of the last actual delivery (ms since epoch). */
     lastDeliveryAtMs = new Map();
     /**
-     * P2-15 — per-event-type rate limiter. A misbehaving emitter for one
-     * event type used to consume the global `maxNotificationsPerHour`
-     * budget and silently starve unrelated notifications. We now also
-     * track a smaller per-type ring buffer of recent delivery timestamps;
-     * if a type exceeds {@link PER_TYPE_RATE_LIMIT} within
-     * {@link PER_TYPE_RATE_WINDOW_MS}, further sends of THAT type are
-     * dropped (logged) without consuming the global budget. Safety
-     * categories (`security`/`deadline`/`error`/`critical`) bypass this
-     * gate as they do the global one.
+     * Per-event-type rate limiter. Tracks a per-type ring buffer of recent
+     * delivery timestamps; if a type exceeds {@link PER_TYPE_RATE_LIMIT}
+     * within {@link PER_TYPE_RATE_WINDOW_MS}, further sends of THAT type are
+     * dropped (logged) without consuming the global budget. Without this
+     * gate, a misbehaving emitter for one event type can monopolise the
+     * global `maxNotificationsPerHour` budget and silently starve unrelated
+     * notifications. Safety categories (`security`/`deadline`/`error`/
+     * `critical`) bypass this gate as they do the global one.
      */
     perTypeDeliveryWindow = new Map();
     /**
@@ -85,8 +103,8 @@ export class NotificationManager {
         // Defensive clamp: a misconfigured `replyRetryAttempts <= 0` would
         // turn `deliverReply` into a no-op (the for-loop body never runs)
         // and silently break every DM reply. Clamp to a minimum of 1 so the
-        // worst legitimate misconfiguration is "no retries, same as the
-        // pre-M4 contract" rather than "no delivery at all".
+        // worst legitimate misconfiguration is "no retries" rather than "no
+        // delivery at all".
         this.replyRetryAttempts = Math.max(1, options.replyRetryAttempts ?? DEFAULT_REPLY_RETRY_ATTEMPTS);
         this.replyRetryBackoffBaseMs = Math.max(0, options.replyRetryBackoffBaseMs ?? DEFAULT_REPLY_RETRY_BACKOFF_BASE_MS);
         this.sleep = options.sleep ?? defaultSleep;
@@ -171,13 +189,12 @@ export class NotificationManager {
      * Direct reply to a MessageEvent — bypasses quiet-hours, rate-limits,
      * and batching.
      *
-     * M4 (release-prep): bounded retry with exponential backoff to absorb
-     * the transient platform-failure class (Slack 5xx, socket reset, WA
-     * relay flap). The previous one-shot path silently swallowed those
-     * errors, leaving the user with no acknowledgement of their DM while
-     * `agent_actions` showed the turn as completed — the most common
-     * user-visible symptom was "agent feels stuck; user resends; agent
-     * double-runs the same turn".
+     * Bounded retry with exponential backoff absorbs the transient
+     * platform-failure class (Slack 5xx, socket reset, WhatsApp relay flap).
+     * Without it, a one-shot path silently swallows those errors and leaves
+     * the user with no acknowledgement of their DM while `agent_actions`
+     * shows the turn as completed — the symptom is "agent feels stuck;
+     * user resends; agent double-runs the same turn".
      *
      * Final-fallback contract: when the originating platform refuses
      * every attempt, we route the same payload through the proactive
@@ -266,7 +283,7 @@ export class NotificationManager {
                     status: "failed",
                 });
             }
-            logger.error({ err }, "Failed to send notification");
+            logDeliveryFailure(err, "Failed to send notification");
             return false;
         }
     }
@@ -306,8 +323,8 @@ export class NotificationManager {
             logger.info({ fromBatch: fromBatch ?? false, eventType: event.type }, "Notification suppressed (rate limit)");
             return;
         }
-        // P2-15: per-event-type secondary gate. Runs AFTER the global limiter
-        // so suppression order is consistent (global → per-type). A burst of
+        // Per-event-type secondary gate. Runs AFTER the global limiter so
+        // suppression order is consistent (global → per-type). A burst of
         // the same type cannot starve unrelated notifications by exhausting
         // the global budget alone — both gates have to allow the send.
         if (!isSafety && this.isTypeRateLimited(event.type)) {
@@ -385,7 +402,7 @@ export class NotificationManager {
                     status: "failed",
                 });
             }
-            logger.error({ err }, "Failed to send notification");
+            logDeliveryFailure(err, "Failed to send notification");
         }
     }
     /**
@@ -505,7 +522,7 @@ export class NotificationManager {
             if (dueAt < earliest)
                 earliest = dueAt;
         }
-        // P2-17: if quiet hours are currently active, push the next flush
+        // If quiet hours are currently active, push the next flush
         // attempt to the wall-clock moment they end. Without this guard,
         // `flushBatches` would fire on the cooldown timer, hit `isQuietHours()`
         // inside `deliverProactive`, and log the queued batch as `suppressed`
@@ -569,47 +586,32 @@ export class NotificationManager {
         }
     }
     /**
-     * P2-17 helper. Returns ms-since-epoch when the current quiet-hours
-     * window ends, or null when quiet hours are not active. Used by
+     * Returns ms-since-epoch when the current quiet-hours window ends, or
+     * null when quiet hours are not active. Used by
      * {@link scheduleBatchFlush} to defer pending batches past the
      * quiet-hours boundary so they actually deliver instead of being
-     * suppressed at flush time. Walks forward minute-by-minute (capped at
-     * 24 h) so configured timezone + overnight windows stay correct
-     * without re-deriving the boundary math here.
+     * suppressed at flush time.
+     *
+     * Thin wrapper around the shared `core/quiet-hours.ts` helper —
+     * NotificationManager and `ScheduleWatcher` (BROWSER_TASK_REDESIGN_PLAN
+     * §12 Q#5) share the same overnight-window math.
      */
     nextQuietHoursEndMs() {
-        if (!this.isQuietHoursAt(new Date()))
-            return null;
-        const startMs = Date.now();
-        for (let minutes = 1; minutes <= 24 * 60; minutes++) {
-            const probeAt = new Date(startMs + minutes * 60_000);
-            if (!this.isQuietHoursAt(probeAt))
-                return probeAt.getTime();
-        }
-        return null;
+        return computeNextQuietHoursEndMs(new Date(), this.quietHoursWindow());
     }
     /** Check if current time is within quiet hours (uses configured timezone) */
     isQuietHours() {
-        return this.isQuietHoursAt(new Date());
+        return isInQuietHoursAt(new Date(), this.quietHoursWindow());
     }
-    /**
-     * Quiet-hours predicate evaluated against an arbitrary wall-clock
-     * instant. Extracted from {@link isQuietHours} so {@link nextQuietHoursEndMs}
-     * can probe future times without mutating globals.
-     */
-    isQuietHoursAt(at) {
-        const local = nowInTimezone(this.config.timezone || undefined, at);
-        const currentMinutes = local.hours * 60 + local.minutes;
-        const [startH, startM] = this.config.quietHoursStart.split(":").map(Number);
-        const [endH, endM] = this.config.quietHoursEnd.split(":").map(Number);
-        const startMinutes = startH * 60 + startM;
-        const endMinutes = endH * 60 + endM;
-        if (startMinutes <= endMinutes) {
-            // Same day range (e.g., 09:00-17:00)
-            return currentMinutes >= startMinutes && currentMinutes < endMinutes;
-        }
-        // Overnight range (e.g., 23:00-07:00)
-        return currentMinutes >= startMinutes || currentMinutes < endMinutes;
+    /** Frozen snapshot of the configured window — kept inline so the
+     *  cache invalidates naturally on every call (config can hot-reload
+     *  via PATCH /api/config). */
+    quietHoursWindow() {
+        return {
+            start: this.config.quietHoursStart,
+            end: this.config.quietHoursEnd,
+            timezone: this.config.timezone || undefined,
+        };
     }
     /** Check if hourly or daily notification limits have been reached */
     isRateLimited() {
@@ -642,7 +644,7 @@ export class NotificationManager {
         return dailyCount.cnt >= this.config.maxNotificationsPerDay;
     }
     /**
-     * P2-15 per-type gate. True when this event type has hit
+     * Per-type gate. True when this event type has hit
      * {@link PER_TYPE_RATE_LIMIT} deliveries in the trailing
      * {@link PER_TYPE_RATE_WINDOW_MS}. Trims expired timestamps inline so
      * the ring buffer stays bounded.
@@ -753,4 +755,3 @@ export class NotificationManager {
         }
     }
 }
-//# sourceMappingURL=notification-manager.js.map

package/dist/adapters/outbound-text.d.ts

@@ -4,9 +4,7 @@
  * Each platform caps outbound message length differently (Discord 2000,
  * Telegram 4096, WhatsApp ~4000) and several need to mint inbound
  * filenames from a MIME type when the platform omits a `file_name` field.
- * Pre-Phase-7 each adapter carried its own copy of these helpers, which
- * drifted in comments and tiny edge-case behaviour over time. Phase 7.8
- * consolidates them here so a future fix lands in exactly one place.
+ * Consolidated here so a future fix lands in exactly one place.
  */
 /**
  * Split `text` into chunks no longer than `maxLen` characters, preferring
@@ -21,8 +19,8 @@
  * Slack/Telegram/Discord render as U+FFFD or reject outright. Emoji-heavy
  * agent replies (common in JP/zh interfaces) are the typical trigger.
  *
- * Code-fence safety (P2-07): if the chosen split point lands inside an
- * open ```fenced code block``` we back off to a newline OUTSIDE the
+ * Code-fence safety: if the chosen split point lands inside an open
+ * ```fenced code block``` we back off to a newline OUTSIDE the
  * fence so the first chunk is self-contained and the second chunk
  * doesn't start mid-language. Without this, Slack/Discord renders the
  * second chunk's text as a single broken syntax-highlight block until
@@ -41,4 +39,3 @@ export declare function splitOutboundText(text: string, maxLen: number): string[
 export declare function extensionFromMime(mimeType: string | null | undefined, fallback: string): string;
 /** `<base>.<ext>` where `<ext>` is derived via {@link extensionFromMime}. */
 export declare function filenameForMime(base: string, mimeType: string | null | undefined, fallbackExt: string): string;
-//# sourceMappingURL=outbound-text.d.ts.map

package/dist/adapters/outbound-text.js

@@ -4,9 +4,7 @@
  * Each platform caps outbound message length differently (Discord 2000,
  * Telegram 4096, WhatsApp ~4000) and several need to mint inbound
  * filenames from a MIME type when the platform omits a `file_name` field.
- * Pre-Phase-7 each adapter carried its own copy of these helpers, which
- * drifted in comments and tiny edge-case behaviour over time. Phase 7.8
- * consolidates them here so a future fix lands in exactly one place.
+ * Consolidated here so a future fix lands in exactly one place.
  */
 /**
  * Split `text` into chunks no longer than `maxLen` characters, preferring
@@ -21,8 +19,8 @@
  * Slack/Telegram/Discord render as U+FFFD or reject outright. Emoji-heavy
  * agent replies (common in JP/zh interfaces) are the typical trigger.
  *
- * Code-fence safety (P2-07): if the chosen split point lands inside an
- * open ```fenced code block``` we back off to a newline OUTSIDE the
+ * Code-fence safety: if the chosen split point lands inside an open
+ * ```fenced code block``` we back off to a newline OUTSIDE the
  * fence so the first chunk is self-contained and the second chunk
  * doesn't start mid-language. Without this, Slack/Discord renders the
  * second chunk's text as a single broken syntax-highlight block until
@@ -172,4 +170,3 @@ export function extensionFromMime(mimeType, fallback) {
 export function filenameForMime(base, mimeType, fallbackExt) {
     return `${base}.${extensionFromMime(mimeType, fallbackExt)}`;
 }
-//# sourceMappingURL=outbound-text.js.map

package/dist/adapters/primary-platform-resolver.d.ts

@@ -66,4 +66,3 @@ export type PrimaryPlatformResolverAction = {
     readonly kind: "no-fallback";
 };
 export declare function resolvePrimaryPlatform(input: PrimaryPlatformResolverInput): PrimaryPlatformResolverAction;
-//# sourceMappingURL=primary-platform-resolver.d.ts.map

package/dist/adapters/primary-platform-resolver.js

@@ -52,4 +52,3 @@ export function resolvePrimaryPlatform(input) {
         reason: "auto-resolve",
     };
 }
-//# sourceMappingURL=primary-platform-resolver.js.map

package/dist/adapters/slack-adapter.d.ts

@@ -13,8 +13,8 @@ export interface SlackAdapterOptions {
     onMessage: OnMessageCallback;
     /** Called when a matching pairing challenge captures a new owner user ID. */
     onOwnerDetected?: (userId: string) => void | Promise<void>;
-    /** Phase 2: canonical attachment store for inbound media download/ingest
-     *  and outbound file delivery. When absent, media is silently skipped. */
+    /** Canonical attachment store for inbound media download/ingest and
+     *  outbound file delivery. When absent, media is silently skipped. */
     attachmentStore?: AttachmentStore;
 }
 /**
@@ -27,8 +27,8 @@ export interface SlackPairingChallenge {
     match: (text: string) => boolean;
     expiresAt: number;
     /**
-     * P2-23 — optional reply hint for the case where the inbound DM did NOT
-     * match the matcher but is recoverable with a small operator nudge
+     * Optional reply hint for the case where the inbound DM did NOT match
+     * the matcher but is recoverable with a small operator nudge
      * (e.g. the magic-phrase substring is present but wrapped in extra
      * prose). The adapter calls this AFTER the match check fails; a
      * non-null return becomes a DM reply on the sender's channel so the
@@ -43,8 +43,8 @@ export interface SlackPairingChallenge {
  * Listens for DMs and @mentions via Slack's Socket Mode (WebSocket).
  * Converts Slack events to MessageEvents and pushes them into the EventBus.
  *
- * Phase 3 — challenge-based pairing: an inbound DM only promotes its
- * sender to owner if the daemon has registered a {@link SlackPairingChallenge}
+ * Pairing is challenge-based: an inbound DM only promotes its sender to
+ * owner if the daemon has registered a {@link SlackPairingChallenge}
  * AND the message text satisfies the matcher. Otherwise the strict
  * owner-id filter applies and the message is dropped.
  */
@@ -103,8 +103,7 @@ export declare class SlackAdapter implements MessageAdapter {
      * restart would lose the binding and the user would think the pair
      * succeeded. Returns `true` on success so the caller can decide
      * whether to `cancelPairing()` (success) or keep the matcher armed
-     * for retry (failure). See B-1 in the pre-release audit.
+     * for retry (failure).
      */
     private captureOwner;
 }
-//# sourceMappingURL=slack-adapter.d.ts.map

package/dist/adapters/slack-adapter.js

@@ -21,8 +21,8 @@ const logger = createLogger("slack-adapter");
  * Listens for DMs and @mentions via Slack's Socket Mode (WebSocket).
  * Converts Slack events to MessageEvents and pushes them into the EventBus.
  *
- * Phase 3 — challenge-based pairing: an inbound DM only promotes its
- * sender to owner if the daemon has registered a {@link SlackPairingChallenge}
+ * Pairing is challenge-based: an inbound DM only promotes its sender to
+ * owner if the daemon has registered a {@link SlackPairingChallenge}
  * AND the message text satisfies the matcher. Otherwise the strict
  * owner-id filter applies and the message is dropped.
  */
@@ -33,7 +33,6 @@ export class SlackAdapter {
     mutableOwnerId;
     onMessage;
     onOwnerDetected;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app = null;
     botUserId = null;
     botInfo = null;
@@ -57,7 +56,7 @@ export class SlackAdapter {
     startPairing(challenge) {
         this.pairingChallenge = challenge;
         logger.info({ ttlMs: challenge.expiresAt - Date.now() }, "slack pairing challenge registered");
-        // P2-20: schedule the matcher closure for active cleanup at TTL. The
+        // Schedule the matcher closure for active cleanup at TTL. The
         // matcher itself short-circuits past the TTL via `isPairingActive`
         // (security intact), but without this timer the closure (and any
         // captured magic-phrase normalization buffer) sticks around in memory
@@ -116,10 +115,9 @@ export class SlackAdapter {
     }
     async start() {
         // Dynamic import — @slack/bolt is an optional dependency
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         let bolt;
         try {
-            bolt = await import("@slack/bolt");
+            bolt = (await import("@slack/bolt"));
         }
         catch {
             throw new Error("@slack/bolt not installed. Run: pnpm --filter @aitne/daemon add @slack/bolt");
@@ -145,9 +143,7 @@ export class SlackAdapter {
         // captureOwner. Bolt's `app.message` handler accepts async callbacks
         // and surfaces unhandled rejections; awaiting here also lets Bolt's
         // own error middleware see exceptions thrown downstream.
-        this.app.message(
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        async ({ message, say: _say }) => {
+        this.app.message(async ({ message }) => {
             await this.handleMessage(message);
         });
         await this.app.start();
@@ -243,7 +239,6 @@ export class SlackAdapter {
         }
         return { messageId: lastTs };
     }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     async handleMessage(message) {
         // Ignore bot messages and message_changed/deleted subtypes
         if (message.bot_id || message.subtype)
@@ -257,7 +252,7 @@ export class SlackAdapter {
         // channels are "group"; public channels are "channel" — none of
         // which are a single-owner DM. Only "im" is.
         if (message.channel_type === "mpim") {
-            logger.debug({ channel: message.channel }, "slack message dropped: multi-person IM rejected (B-4)");
+            logger.debug({ channel: message.channel }, "slack message dropped: multi-person IM rejected");
             return;
         }
         const isDm = message.channel_type === "im";
@@ -281,7 +276,7 @@ export class SlackAdapter {
                 // `onOwnerDetected` completes before we acknowledge pairing.
                 // `cancelPairing()` only fires on success — if the callback
                 // throws (e.g. .env unwritable), the matcher stays armed so the
-                // user can retry by resending the phrase. See B-1.
+                // user can retry by resending the phrase.
                 const ok = await this.captureOwner(senderId);
                 if (ok) {
                     this.cancelPairing();
@@ -292,16 +287,20 @@ export class SlackAdapter {
                 // on the phrase itself.
                 return;
             }
-            // P2-23: matcher rejected but the input may be a wrapped magic
+            // Matcher rejected but the input may be a wrapped magic
             // phrase. Send a hint so the legitimate user can correct rather
             // than getting silence indistinguishable from an attacker's wrong
             // guess. Best-effort: a send failure is logged but never bubbles.
             const hint = challenge.hintReply?.(text);
             if (hint) {
                 try {
+                    // `this.app` is guaranteed non-null here: Bolt only fires the
+                    // message handler after `await this.app.start()` returns. The `!`
+                    // preserves the original throw-and-log behaviour if invariants
+                    // ever change, rather than silently dropping the hint reply.
                     await this.app.client.chat.postMessage({
                         token: this.botToken,
-                        channel: message.channel,
+                        channel: message.channel ?? "",
                         text: hint,
                     });
                 }
@@ -320,18 +319,12 @@ export class SlackAdapter {
         // is synchronous and returns immediately.
         const files = Array.isArray(message.files) ? message.files : [];
         if (files.length > 0 && this.attachmentStore) {
-            void this.downloadAndEmitSlackMessage(message, senderId, text, isDm, isMention, 
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            files).catch((err) => logger.error({ err }, "slack attachment handler threw"));
+            void this.downloadAndEmitSlackMessage(message, senderId, text, isDm, isMention, files).catch((err) => logger.error({ err }, "slack attachment handler threw"));
             return;
         }
         this.emitSlackEvent(message, senderId, text, isDm, isMention, []);
     }
-    async downloadAndEmitSlackMessage(
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    message, senderId, text, isDm, isMention, 
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    files) {
+    async downloadAndEmitSlackMessage(message, senderId, text, isDm, isMention, files) {
         const attachmentRefs = [];
         for (const file of files) {
             if (!file || typeof file !== "object")
@@ -360,8 +353,7 @@ export class SlackAdapter {
                 continue;
             }
             // Prefer url_private_download (includes Content-Disposition header)
-            const downloadUrl = resolvedFile.url_private_download
-                ?? resolvedFile.url_private;
+            const downloadUrl = resolvedFile.url_private_download ?? resolvedFile.url_private;
             if (!downloadUrl)
                 continue;
             try {
@@ -396,9 +388,7 @@ export class SlackAdapter {
         }
         this.emitSlackEvent(message, senderId, text, isDm, isMention, attachmentRefs);
     }
-    emitSlackEvent(
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    message, senderId, text, isDm, isMention, attachments) {
+    emitSlackEvent(message, senderId, text, isDm, isMention, attachments) {
         const event = createEvent({
             type: "message.received",
             source: "slack",
@@ -437,7 +427,7 @@ export class SlackAdapter {
      * restart would lose the binding and the user would think the pair
      * succeeded. Returns `true` on success so the caller can decide
      * whether to `cancelPairing()` (success) or keep the matcher armed
-     * for retry (failure). See B-1 in the pre-release audit.
+     * for retry (failure).
      */
     async captureOwner(userId) {
         const previousOwnerId = this.mutableOwnerId;
@@ -455,4 +445,3 @@ export class SlackAdapter {
         }
     }
 }
-//# sourceMappingURL=slack-adapter.js.map

package/dist/adapters/telegram-adapter.d.ts

@@ -15,8 +15,8 @@ export interface TelegramAdapterOptions {
      * applyConfigUpdates so the next restart still has the right owner.
      */
     onOwnerDetected?: (chatId: string) => void | Promise<void>;
-    /** Phase 2: canonical attachment store for inbound media download/ingest
-     *  and outbound file delivery. When absent, media is silently skipped. */
+    /** Canonical attachment store for inbound media download/ingest and
+     *  outbound file delivery. When absent, media is silently skipped. */
     attachmentStore?: AttachmentStore;
 }
 /**
@@ -43,10 +43,8 @@ export interface PairingChallenge {
  * Group / supergroup traffic is intentionally ignored. This adapter is for
  * owner DMs only; Telegram group mentions are out of scope.
  *
- * Phase 3 — challenge-based pairing only.
- *
- * The adapter no longer has a "first DM wins" discovery mode. Pairing now
- * requires that the daemon register a {@link PairingChallenge} via
+ * Pairing is challenge-based: the daemon must register a
+ * {@link PairingChallenge} via
  * `startPairing()`; only inbound messages whose text passes the matcher
  * (e.g. `/start <random-token>` for QR pairing) capture the owner. This
  * closes the race where any unrelated DM during a 5-minute window could
@@ -103,11 +101,10 @@ export declare class TelegramAdapter implements MessageAdapter {
     private photoSizeBytes;
     /**
      * Atomically promote a chat ID to "owner" and notify the daemon. See
-     * slack-adapter.captureOwner for the full B-1 design rationale — the
-     * env/DB write must complete before we acknowledge pairing, and
+     * slack-adapter.captureOwner for the full rationale — the env/DB
+     * write must complete before we acknowledge pairing, and
      * mutableOwnerId rolls back if the callback throws so a daemon restart
      * doesn't silently lose the binding.
      */
     private captureOwner;
 }
-//# sourceMappingURL=telegram-adapter.d.ts.map