@cats-inc/cats-platform 0.1.21 → 0.2.8

package/build/server/platform/transports/work-delivery/actionTokens.js

@@ -0,0 +1,145 @@
+/**
+ * Opaque action tokens for transport inline controls (SPEC-114 FR-13).
+ *
+ * Telegram `callback_data` is capped at 64 bytes and is fully attacker-editable,
+ * so it must never carry entity ids, an actor, or a revision. It carries one
+ * random opaque token; every authority decision is made here against
+ * server-owned state.
+ */
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+/** Telegram's hard `callback_data` limit. */
+const TELEGRAM_CALLBACK_DATA_MAX_BYTES = 64;
+/** Prefix that routes a callback to the golden path, plus the token itself. */
+const ACTION_TOKEN_PREFIX = 'gp:';
+/** 18 random bytes -> 24 base64url chars; with the prefix that is 27 bytes. */
+const ACTION_TOKEN_RANDOM_BYTES = 18;
+const DEFAULT_TOKEN_TTL_MS = 24 * 60 * 60 * 1000;
+export function encodeTransportWorkCallbackData(token) {
+    return `${ACTION_TOKEN_PREFIX}${token}`;
+}
+export function decodeTransportWorkCallbackData(callbackData) {
+    if (!callbackData.startsWith(ACTION_TOKEN_PREFIX)) {
+        return null;
+    }
+    const token = callbackData.slice(ACTION_TOKEN_PREFIX.length);
+    return token.length > 0 ? token : null;
+}
+/**
+ * Guards the Telegram limit at the point of construction rather than at send
+ * time, where a silently-dropped keyboard looks like a product bug.
+ */
+export function isTransportWorkCallbackDataWithinLimit(callbackData) {
+    return Buffer.byteLength(callbackData, 'utf8') <= TELEGRAM_CALLBACK_DATA_MAX_BYTES;
+}
+function defaultRandomToken() {
+    return randomBytes(ACTION_TOKEN_RANDOM_BYTES).toString('base64url');
+}
+/** Constant-time compare so token lookup cannot be probed by timing. */
+function safeEquals(left, right) {
+    const leftBuffer = Buffer.from(left, 'utf8');
+    const rightBuffer = Buffer.from(right, 'utf8');
+    if (leftBuffer.length !== rightBuffer.length) {
+        return false;
+    }
+    return timingSafeEqual(leftBuffer, rightBuffer);
+}
+export function createTransportWorkActionTokenStore(options = {}) {
+    const now = options.now ?? (() => new Date());
+    const ttlMs = options.ttlMs ?? DEFAULT_TOKEN_TTL_MS;
+    const randomToken = options.randomToken ?? defaultRandomToken;
+    const tokens = new Map((options.store?.listActionTokens() ?? []).map((token) => [token.token, token]));
+    function removeExpired() {
+        const timestamp = now().getTime();
+        for (const [key, token] of tokens) {
+            if (timestamp >= Date.parse(token.expiresAt)) {
+                tokens.delete(key);
+                options.store?.deleteActionToken(key);
+            }
+        }
+    }
+    function findToken(candidate) {
+        const direct = tokens.get(candidate);
+        if (direct && safeEquals(direct.token, candidate)) {
+            return direct;
+        }
+        return null;
+    }
+    return {
+        issue(input) {
+            removeExpired();
+            const issuedAt = now();
+            const token = {
+                version: 1,
+                token: randomToken(),
+                bindingId: input.bindingId,
+                ownerActorId: input.ownerActorId,
+                externalUserRef: input.externalUserRef,
+                workItemId: input.workItemId,
+                proposalRevision: input.proposalRevision,
+                proposalDigest: input.proposalDigest,
+                action: input.action,
+                issuedAt: issuedAt.toISOString(),
+                expiresAt: new Date(issuedAt.getTime() + ttlMs).toISOString(),
+            };
+            tokens.set(token.token, token);
+            options.store?.putActionToken(token);
+            return token;
+        },
+        resolve(input) {
+            const candidate = decodeTransportWorkCallbackData(input.callbackData);
+            if (candidate === null) {
+                return { status: 'rejected', reason: 'unknown_token' };
+            }
+            const token = findToken(candidate);
+            if (token === null) {
+                return { status: 'rejected', reason: 'unknown_token' };
+            }
+            // Binding and owner are checked before anything else so a cross-binding
+            // replay never reveals whether the referenced scope still exists.
+            if (token.bindingId !== input.bindingId) {
+                return { status: 'rejected', reason: 'cross_binding' };
+            }
+            if (token.externalUserRef !== input.externalUserRef) {
+                return { status: 'rejected', reason: 'unauthorized_owner' };
+            }
+            if (now().getTime() >= Date.parse(token.expiresAt)) {
+                tokens.delete(token.token);
+                options.store?.deleteActionToken(token.token);
+                return { status: 'rejected', reason: 'expired' };
+            }
+            // Scope is resolved for the work item the token names, never for whatever
+            // the transport guessed.
+            const scope = input.resolveScope(token.workItemId);
+            if (scope === null) {
+                return { status: 'rejected', reason: 'unknown_token' };
+            }
+            if (scope.proposalRevision !== null
+                && token.proposalRevision !== scope.proposalRevision) {
+                return { status: 'rejected', reason: 'stale_revision' };
+            }
+            if (scope.proposalDigest !== null
+                && token.proposalDigest !== scope.proposalDigest) {
+                return { status: 'rejected', reason: 'digest_mismatch' };
+            }
+            if (!scope.allowedActions.includes(token.action)) {
+                return { status: 'rejected', reason: 'action_not_allowed' };
+            }
+            return { status: 'resolved', token };
+        },
+        invalidateWorkItem(workItemId) {
+            let removed = 0;
+            for (const [key, token] of tokens) {
+                if (token.workItemId === workItemId) {
+                    tokens.delete(key);
+                    removed += 1;
+                }
+            }
+            options.store?.deleteActionTokensForWorkItem(workItemId);
+            return removed;
+        },
+        size() {
+            return tokens.size;
+        },
+    };
+}
+//# sourceMappingURL=actionTokens.js.map

package/build/server/platform/transports/work-delivery/actionTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionTokens.js","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/actionTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAS3D,6CAA6C;AAC7C,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAE5C,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAsDjD,MAAM,UAAU,+BAA+B,CAAC,KAAa;IAC3D,OAAO,GAAG,mBAAmB,GAAG,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,YAAoB;IAClE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CAAC,YAAoB;IACzE,OAAO,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,gCAAgC,CAAC;AACrF,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,WAAW,CAAC,yBAAyB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtE,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,UAAgD,EAAE;IAElD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAC;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAC/E,CAAC;IAEF,SAAS,aAAa;QACpB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YAClC,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK;YACT,aAAa,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAA+B;gBACxC,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,WAAW,EAAE;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;gBAChC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aAC9D,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,KAAK;YACX,MAAM,SAAS,GAAG,+BAA+B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACzD,CAAC;YACD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACzD,CAAC;YACD,wEAAwE;YACxE,kEAAkE;YAClE,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;gBACxC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACzD,CAAC;YACD,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;gBACpD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3B,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACnD,CAAC;YAED,0EAA0E;YAC1E,yBAAyB;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACzD,CAAC;YACD,IACE,KAAK,CAAC,gBAAgB,KAAK,IAAI;mBAC5B,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EACpD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAC1D,CAAC;YACD,IACE,KAAK,CAAC,cAAc,KAAK,IAAI;mBAC1B,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAChD,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACvC,CAAC;QAED,kBAAkB,CAAC,UAAU;YAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACpC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACnB,OAAO,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,6BAA6B,CAAC,UAAU,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI;YACF,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/build/server/platform/transports/work-delivery/contracts.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Transport work-delivery golden-path contracts (SPEC-114 / ADR-112).
+ *
+ * These shapes are deliberately transport-neutral and deliberately *not* Cats
+ * Core record families. ADR-112 section 1 keeps Work Items, Tasks, Runs,
+ * Approvals, Outcomes, Artifacts, and Activities as the only authoritative work
+ * ledger; everything here is either additive provenance that rides on existing
+ * Core metadata, or transport-owned outbox/receipt state that Core Activities
+ * may reference by opaque key.
+ */
+import type { CoreDeliveryGate, CoreDeliveryMode } from '../../../core/types.js';
+/** Transports that can originate golden-path work. Telegram is the first. */
+export type TransportWorkChannel = 'telegram';
+/**
+ * Durable source provenance for one transport-originated work request.
+ *
+ * External references are opaque transport-store keys: SPEC-114 FR-6 and FR-9
+ * forbid copying bot tokens or raw credentials into Core, and Core only ever
+ * needs to be able to point back at the transport store.
+ */
+export interface TransportWorkOriginV1 {
+    version: 1;
+    transport: TransportWorkChannel;
+    bindingId: string;
+    externalConversationRef: string;
+    externalUpdateRef: string;
+    externalMessageRef: string | null;
+    conversationId: string;
+    workItemId: string;
+    proposalRevision: number;
+    proposalDigest: string;
+}
+/** Why a transport message is being sent. Drives ordering and coalescing. */
+export type TransportWorkDeliveryPurpose = 'ack' | 'proposal' | 'progress' | 'decision' | 'result' | 'publish_result';
+/** Lifecycle of one outbox row. `ambiguous` requires explicit owner retry. */
+export type TransportWorkDeliveryState = 'pending' | 'sending' | 'sent' | 'failed' | 'ambiguous';
+/**
+ * One durable outbound intent plus its receipt.
+ *
+ * `idempotencyKey` is the whole point: a duplicate callback, a retry, or a
+ * process restart must resolve to this same row rather than send a second
+ * Telegram message (SPEC-114 FR-42, FR-45, FR-47).
+ */
+export interface TransportWorkDeliveryV1 {
+    version: 1;
+    idempotencyKey: string;
+    bindingId: string;
+    /**
+     * Where this message goes, captured at intake.
+     *
+     * FR-43: the destination is the binding that *originated* the request, not
+     * whichever binding a UI happens to have selected when the send fires.
+     */
+    externalConversationRef: string;
+    workItemId: string;
+    taskId: string | null;
+    runId: string | null;
+    purpose: TransportWorkDeliveryPurpose;
+    payload: TransportWorkDeliveryPayload;
+    state: TransportWorkDeliveryState;
+    externalMessageRef: string | null;
+    attemptCount: number;
+    lastErrorCode: string | null;
+    /** Monotonic per work item; lets a late routine progress send be dropped. */
+    sequence: number;
+    createdAt: string;
+    updatedAt: string;
+    sentAt: string | null;
+}
+/**
+ * The owner-visible golden-path stage.
+ *
+ * ADR-112 section 2: this is a *projection* with explicit derivation rules, not
+ * a second state machine. It is always recomputed from authoritative Core
+ * records plus transport receipts, so it can never drift on its own.
+ */
+export type TransportWorkStage = 'received' | 'scope_proposed' | 'execution_authorized' | 'admitted' | 'running' | 'decision_needed' | 'result_ready' | 'publish_authorized' | 'delivered' | 'failed' | 'cancelled';
+/**
+ * Bounded owner actions a stage may expose. Labels are localized elsewhere.
+ *
+ * There is deliberately no `adjust`: it was offered on every proposal while
+ * `authorize` refused it. Removing it from the union makes that class of
+ * mistake a type error rather than a discipline problem. It returns with the
+ * FR-16 clarification loop, together with a handler.
+ */
+export type TransportWorkAction = 'start_work' | 'cancel' | 'approve' | 'deny' | 'retry' | 'resume' | 'publish' | 'view';
+/**
+ * The owner-visible content of one outbound message.
+ *
+ * Deliberately narrow: text plus an optional authenticated Desktop link. FR-44
+ * forbids sending local filesystem paths or credentials as though Telegram
+ * could reach them, so the renderer never puts a path in here.
+ */
+export interface TransportWorkDeliveryPayload {
+    /** Already localized. The transport renders it verbatim. */
+    text: string;
+    deepLink: string | null;
+    /**
+     * Inline actions to attach. `label` is localized; `callbackData` is the
+     * bounded opaque token and is the only part the external user can echo back.
+     */
+    actions: TransportWorkPayloadAction[];
+}
+export interface TransportWorkPayloadAction {
+    action: TransportWorkAction;
+    callbackData: string;
+    label: string;
+}
+/**
+ * The execution-relevant scope shown to the owner before anything runs.
+ *
+ * `revision` and `digest` exist so that a confirmation can be bound to exactly
+ * the text the owner saw (FR-17, FR-21). Changing any field below must produce
+ * a new digest and invalidate outstanding action tokens.
+ */
+export interface TransportWorkProposalV1 {
+    version: 1;
+    revision: number;
+    digest: string;
+    goal: string;
+    targetLabel: string;
+    projectId: string | null;
+    workspacePath: string | null;
+    acceptanceCriteria: string[];
+    deliveryMode: CoreDeliveryMode;
+    deliveryGates: CoreDeliveryGate[];
+    sideEffects: string[];
+    openQuestion: string | null;
+    createdAt: string;
+}
+/** Reason codes shared by Telegram and Desktop readiness surfaces (FR-3). */
+export declare const TRANSPORT_WORK_READINESS_REASONS: readonly ["binding_disabled", "binding_unhealthy", "owner_not_authorized", "cat_not_bound", "execution_target_missing", "capability_profile_missing", "workspace_missing", "workspace_unreachable", "workspace_not_a_repository", "workspace_not_clean", "delivery_policy_unresolved", "background_service_unavailable"];
+export type TransportWorkReadinessReason = (typeof TRANSPORT_WORK_READINESS_REASONS)[number];
+export interface TransportWorkReadinessBlocker {
+    reason: TransportWorkReadinessReason;
+    /** Stable remediation key resolved through product i18n, never raw copy. */
+    remediationKey: string;
+    /** Deep link path for Desktop remediation. Never carries a secret. */
+    remediationPath: string | null;
+}
+export interface TransportWorkReadiness {
+    ready: boolean;
+    blockers: TransportWorkReadinessBlocker[];
+}
+/**
+ * A bounded opaque action token (FR-13).
+ *
+ * Only `token` ever reaches `callback_data`; every field below is resolved
+ * server-side so a forged or replayed button cannot widen its own authority.
+ */
+export interface TransportWorkActionTokenV1 {
+    version: 1;
+    token: string;
+    bindingId: string;
+    ownerActorId: string;
+    externalUserRef: string;
+    workItemId: string;
+    proposalRevision: number;
+    proposalDigest: string;
+    action: TransportWorkAction;
+    issuedAt: string;
+    expiresAt: string;
+}
+export type TransportWorkActionTokenRejection = 'unknown_token' | 'expired' | 'stale_revision' | 'digest_mismatch' | 'cross_binding' | 'unauthorized_owner' | 'action_not_allowed';
+export type TransportWorkActionTokenResolution = {
+    status: 'resolved';
+    token: TransportWorkActionTokenV1;
+} | {
+    status: 'rejected';
+    reason: TransportWorkActionTokenRejection;
+};
+//# sourceMappingURL=contracts.d.ts.map

package/build/server/platform/transports/work-delivery/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,6EAA6E;AAC7E,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,UAAU,GACV,UAAU,GACV,UAAU,GACV,QAAQ,GACR,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,MAAM,0BAA0B,GAClC,SAAS,GACT,SAAS,GACT,MAAM,GACN,QAAQ,GACR,WAAW,CAAC;AAEhB;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,4BAA4B,CAAC;IACtC,OAAO,EAAE,4BAA4B,CAAC;IACtC,KAAK,EAAE,0BAA0B,CAAC;IAClC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,gBAAgB,GAChB,sBAAsB,GACtB,UAAU,GACV,SAAS,GACT,iBAAiB,GACjB,cAAc,GACd,oBAAoB,GACpB,WAAW,GACX,QAAQ,GACR,WAAW,CAAC;AAEhB;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,QAAQ,GACR,SAAS,GACT,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,MAAM,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;OAGG;IACH,OAAO,EAAE,0BAA0B,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,gBAAgB,CAAC;IAC/B,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,0TAanC,CAAC;AAEX,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,4BAA4B,CAAC;IACrC,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,6BAA6B,EAAE,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iCAAiC,GACzC,eAAe,GACf,SAAS,GACT,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,oBAAoB,GACpB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,kCAAkC,GAC1C;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,0BAA0B,CAAA;CAAE,GACzD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,iCAAiC,CAAA;CAAE,CAAC"}

package/build/server/platform/transports/work-delivery/contracts.js

@@ -0,0 +1,26 @@
+/**
+ * Transport work-delivery golden-path contracts (SPEC-114 / ADR-112).
+ *
+ * These shapes are deliberately transport-neutral and deliberately *not* Cats
+ * Core record families. ADR-112 section 1 keeps Work Items, Tasks, Runs,
+ * Approvals, Outcomes, Artifacts, and Activities as the only authoritative work
+ * ledger; everything here is either additive provenance that rides on existing
+ * Core metadata, or transport-owned outbox/receipt state that Core Activities
+ * may reference by opaque key.
+ */
+/** Reason codes shared by Telegram and Desktop readiness surfaces (FR-3). */
+export const TRANSPORT_WORK_READINESS_REASONS = [
+    'binding_disabled',
+    'binding_unhealthy',
+    'owner_not_authorized',
+    'cat_not_bound',
+    'execution_target_missing',
+    'capability_profile_missing',
+    'workspace_missing',
+    'workspace_unreachable',
+    'workspace_not_a_repository',
+    'workspace_not_clean',
+    'delivery_policy_unresolved',
+    'background_service_unavailable',
+];
+//# sourceMappingURL=contracts.js.map

package/build/server/platform/transports/work-delivery/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmKH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,eAAe;IACf,0BAA0B;IAC1B,4BAA4B;IAC5B,mBAAmB;IACnB,uBAAuB;IACvB,4BAA4B;IAC5B,qBAAqB;IACrB,4BAA4B;IAC5B,gCAAgC;CACxB,CAAC"}

package/build/server/platform/transports/work-delivery/deliveryGates.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Publish-gate resolution for the golden path (SPEC-114 FR-40..FR-41).
+ *
+ * Execution authorization and publication authorization are separate risk
+ * boundaries (ADR-112 section 3). Confirming "Start work" says the owner
+ * accepted the scope; it never says they accepted a side effect that only
+ * became visible while the work ran.
+ */
+import type { CoreDeliveryGate, CoreDeliveryMode } from '../../../core/types.js';
+export interface ResolveOutstandingDeliveryGatesInput {
+    deliveryMode: CoreDeliveryMode;
+    /** Gates from the effective Core delivery policy. */
+    effectiveGates: readonly CoreDeliveryGate[];
+    /** Gates an owner has already decided for this exact proposal revision. */
+    satisfiedGates: readonly CoreDeliveryGate[];
+    /** True when the result would publish an Artifact beyond the local host. */
+    publishesPublicArtifact: boolean;
+}
+/**
+ * Returns the gates that still block publication.
+ *
+ * An empty result means the golden path may proceed to delivery; it does not
+ * mean governance was skipped, only that every applicable gate is satisfied.
+ */
+export declare function resolveOutstandingDeliveryGates(input: ResolveOutstandingDeliveryGatesInput): CoreDeliveryGate[];
+/**
+ * True when the mode may deliver without a second owner event, given no
+ * outstanding gates. `artifact_only` and `commit_only` are local-only, which is
+ * exactly why they are the two proof modes for the first slice.
+ */
+export declare function isFirstSliceDeliveryMode(mode: CoreDeliveryMode): boolean;
+//# sourceMappingURL=deliveryGates.d.ts.map

package/build/server/platform/transports/work-delivery/deliveryGates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveryGates.d.ts","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/deliveryGates.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAYjF,MAAM,WAAW,oCAAoC;IACnD,YAAY,EAAE,gBAAgB,CAAC;IAC/B,qDAAqD;IACrD,cAAc,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,2EAA2E;IAC3E,cAAc,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,4EAA4E;IAC5E,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oCAAoC,GAC1C,gBAAgB,EAAE,CAepB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAExE"}

package/build/server/platform/transports/work-delivery/deliveryGates.js

@@ -0,0 +1,45 @@
+/**
+ * Publish-gate resolution for the golden path (SPEC-114 FR-40..FR-41).
+ *
+ * Execution authorization and publication authorization are separate risk
+ * boundaries (ADR-112 section 3). Confirming "Start work" says the owner
+ * accepted the scope; it never says they accepted a side effect that only
+ * became visible while the work ran.
+ */
+/**
+ * Modes whose external side effects always need a separate result-preview
+ * authorization in the first slice, whatever the configured gates say.
+ */
+const HIGH_SIDE_EFFECT_MODES = new Set([
+    'push_branch',
+    'pr_with_checks',
+    'deploy_preview',
+]);
+/**
+ * Returns the gates that still block publication.
+ *
+ * An empty result means the golden path may proceed to delivery; it does not
+ * mean governance was skipped, only that every applicable gate is satisfied.
+ */
+export function resolveOutstandingDeliveryGates(input) {
+    const required = new Set(input.effectiveGates);
+    if (HIGH_SIDE_EFFECT_MODES.has(input.deliveryMode)) {
+        required.add('owner_approval_required');
+    }
+    if (input.publishesPublicArtifact) {
+        required.add('publish_artifact_required');
+    }
+    for (const satisfied of input.satisfiedGates) {
+        required.delete(satisfied);
+    }
+    return [...required];
+}
+/**
+ * True when the mode may deliver without a second owner event, given no
+ * outstanding gates. `artifact_only` and `commit_only` are local-only, which is
+ * exactly why they are the two proof modes for the first slice.
+ */
+export function isFirstSliceDeliveryMode(mode) {
+    return mode === 'artifact_only' || mode === 'commit_only';
+}
+//# sourceMappingURL=deliveryGates.js.map

package/build/server/platform/transports/work-delivery/deliveryGates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveryGates.js","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/deliveryGates.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;GAGG;AACH,MAAM,sBAAsB,GAAkC,IAAI,GAAG,CAAC;IACpE,aAAa;IACb,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC;AAYH;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAA2C;IAE3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAmB,KAAK,CAAC,cAAc,CAAC,CAAC;IAEjE,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAClC,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC7C,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,OAAO,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,aAAa,CAAC;AAC5D,CAAC"}

package/build/server/platform/transports/work-delivery/inboundClassification.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Inbound request classification (SPEC-114 FR-48).
+ *
+ * Attachment ingestion is out of scope for the first slice. The failure mode
+ * this guards against is subtle and worse than an outright error: handing the
+ * agent a *filename* as though it were the file's content, which produces
+ * confident work about a document nobody read.
+ */
+export type TransportWorkInboundKind = 'work_command' | 'attachment_unsupported' | 'empty' | 'not_work_request';
+export interface TransportWorkInboundClassification {
+    kind: TransportWorkInboundKind;
+    /** Present only for `work_command`: the goal text after `/work`. */
+    goal: string | null;
+    /** Stable message key for the owner-facing explanation, when refused. */
+    refusalKey: string | null;
+}
+/**
+ * True when the owner is addressing the golden path at all.
+ *
+ * The bridge gates on this before acting on a classification, so an ordinary
+ * chat message that happens to carry a photo keeps its existing behaviour
+ * instead of being refused by a feature it never invoked.
+ */
+export declare function isTransportWorkRequestText(text: string | null): boolean;
+export interface ClassifyTransportWorkInboundInput {
+    text: string | null;
+    /** Attachment kinds present on the update, if any. */
+    attachmentKinds: readonly string[];
+}
+export declare function classifyTransportWorkInbound(input: ClassifyTransportWorkInboundInput): TransportWorkInboundClassification;
+//# sourceMappingURL=inboundClassification.d.ts.map

package/build/server/platform/transports/work-delivery/inboundClassification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inboundClassification.d.ts","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/inboundClassification.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,wBAAwB,GAChC,cAAc,GACd,wBAAwB,GACxB,OAAO,GACP,kBAAkB,CAAC;AAEvB,MAAM,WAAW,kCAAkC;IACjD,IAAI,EAAE,wBAAwB,CAAC;IAC/B,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yEAAyE;IACzE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAID;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEvE;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,kCAAkC,CAoCpC"}

package/build/server/platform/transports/work-delivery/inboundClassification.js

@@ -0,0 +1,52 @@
+/**
+ * Inbound request classification (SPEC-114 FR-48).
+ *
+ * Attachment ingestion is out of scope for the first slice. The failure mode
+ * this guards against is subtle and worse than an outright error: handing the
+ * agent a *filename* as though it were the file's content, which produces
+ * confident work about a document nobody read.
+ */
+const WORK_COMMAND = '/work';
+/**
+ * True when the owner is addressing the golden path at all.
+ *
+ * The bridge gates on this before acting on a classification, so an ordinary
+ * chat message that happens to carry a photo keeps its existing behaviour
+ * instead of being refused by a feature it never invoked.
+ */
+export function isTransportWorkRequestText(text) {
+    return (text ?? '').trim().toLowerCase().startsWith(WORK_COMMAND);
+}
+export function classifyTransportWorkInbound(input) {
+    const text = (input.text ?? '').trim();
+    const hasAttachment = input.attachmentKinds.length > 0;
+    if (hasAttachment && text === '') {
+        return {
+            kind: 'attachment_unsupported',
+            goal: null,
+            refusalKey: 'workDelivery.inbound.attachmentNotIngested',
+        };
+    }
+    if (!text.toLowerCase().startsWith(WORK_COMMAND)) {
+        return {
+            kind: text === '' ? 'empty' : 'not_work_request',
+            goal: null,
+            refusalKey: null,
+        };
+    }
+    const goal = text.slice(WORK_COMMAND.length).trim();
+    if (goal === '') {
+        return { kind: 'empty', goal: null, refusalKey: 'workDelivery.inbound.goalRequired' };
+    }
+    // A `/work` caption on an attachment is still a text request; the caption is
+    // the goal and the attachment is explicitly not ingested.
+    if (hasAttachment) {
+        return {
+            kind: 'attachment_unsupported',
+            goal: null,
+            refusalKey: 'workDelivery.inbound.attachmentNotIngested',
+        };
+    }
+    return { kind: 'work_command', goal, refusalKey: null };
+}
+//# sourceMappingURL=inboundClassification.js.map

package/build/server/platform/transports/work-delivery/inboundClassification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inboundClassification.js","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/inboundClassification.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAmB;IAC5D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACpE,CAAC;AAQD,MAAM,UAAU,4BAA4B,CAC1C,KAAwC;IAExC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvD,IAAI,aAAa,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,4CAA4C;SACzD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;YAChD,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,mCAAmC,EAAE,CAAC;IACxF,CAAC;IAED,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,4CAA4C;SACzD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC"}

package/build/server/platform/transports/work-delivery/outbox.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Durable transport delivery outbox (SPEC-114 FR-32..FR-33, FR-42..FR-47).
+ *
+ * This is a narrow, replaceable platform interface rather than a new Core
+ * record family (ADR-112 section 1). Production supplies a transport state
+ * store; isolated tests may keep using the in-memory form.
+ *
+ * Three invariants earn this module its existence:
+ *
+ *  1. one `idempotencyKey` sends at most one external message, across duplicate
+ *     callbacks, retries, and process restarts;
+ *  2. messages for one work item are sent in causal order;
+ *  3. a routine progress message that lost its race against a newer decision or
+ *     terminal message is dropped rather than delivered late.
+ */
+import type { TransportWorkDeliveryPayload, TransportWorkDeliveryPurpose, TransportWorkDeliveryV1 } from './contracts.js';
+import type { TransportWorkTelemetry } from './telemetry.js';
+import type { TransportWorkStateStore } from './stateStore.js';
+export interface TransportWorkOutboxEnqueueInput {
+    idempotencyKey: string;
+    bindingId: string;
+    externalConversationRef: string;
+    workItemId: string;
+    taskId?: string | null;
+    runId?: string | null;
+    purpose: TransportWorkDeliveryPurpose;
+    payload: TransportWorkDeliveryPayload;
+}
+export interface TransportWorkOutboxSendResult {
+    ok: boolean;
+    externalMessageRef: string | null;
+    errorCode?: string | null;
+    /**
+     * Set when the transport call failed in a way that cannot prove whether the
+     * message was delivered (timeout, aborted socket). FR-47 keeps such a row
+     * out of `failed` so recovery reconciles instead of double-sending.
+     */
+    ambiguous?: boolean;
+}
+export type TransportWorkOutboxSender = (row: TransportWorkDeliveryV1) => Promise<TransportWorkOutboxSendResult>;
+export type TransportWorkOutboxFlushOutcome = 'sent' | 'already_sent' | 'suppressed_stale' | 'failed' | 'ambiguous';
+export interface TransportWorkOutboxFlushResult {
+    outcome: TransportWorkOutboxFlushOutcome;
+    row: TransportWorkDeliveryV1;
+}
+export interface TransportWorkOutbox {
+    /** Idempotent: an existing key returns the stored row untouched. */
+    enqueue(input: TransportWorkOutboxEnqueueInput): TransportWorkDeliveryV1;
+    flush(idempotencyKey: string): Promise<TransportWorkOutboxFlushResult>;
+    /** Explicit owner retry; this is the only operation allowed to re-drive ambiguity. */
+    retry(idempotencyKey: string): Promise<TransportWorkOutboxFlushResult>;
+    /** Flushes every non-terminal row for a work item, in sequence order. */
+    flushWorkItem(workItemId: string): Promise<TransportWorkOutboxFlushResult[]>;
+    /** Startup recovery sends only rows that were safely pending before a crash. */
+    recoverPending(): Promise<TransportWorkOutboxFlushResult[]>;
+    get(idempotencyKey: string): TransportWorkDeliveryV1 | null;
+    list(workItemId: string): TransportWorkDeliveryV1[];
+    /** True once a `result` or `publish_result` row reached `sent`. */
+    hasDeliveredResult(workItemId: string): boolean;
+}
+export interface TransportWorkOutboxOptions {
+    send: TransportWorkOutboxSender;
+    now?: () => Date;
+    /** Seeds durable rows recovered from disk after a restart. */
+    initialRows?: readonly TransportWorkDeliveryV1[];
+    /** Optional counters. Absent means the path runs unmeasured, never broken. */
+    telemetry?: TransportWorkTelemetry;
+    /** Durable storage for intents, attempts, and receipts. */
+    store?: TransportWorkStateStore;
+}
+export declare function createTransportWorkOutbox(options: TransportWorkOutboxOptions): TransportWorkOutbox;
+/**
+ * Stable idempotency key for one outbound message.
+ *
+ * Every input is either an authoritative id or an owner-visible revision, so
+ * the same logical message recomputes the same key after a restart.
+ */
+export declare function buildTransportWorkDeliveryKey(input: {
+    bindingId: string;
+    workItemId: string;
+    purpose: TransportWorkDeliveryPurpose;
+    discriminator: string;
+}): string;
+//# sourceMappingURL=outbox.d.ts.map

package/build/server/platform/transports/work-delivery/outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../../../../src/platform/transports/work-delivery/outbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,4BAA4B,EAC5B,4BAA4B,EAE5B,uBAAuB,EACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAc/D,MAAM,WAAW,+BAA+B;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,4BAA4B,CAAC;IACtC,OAAO,EAAE,4BAA4B,CAAC;CACvC;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,OAAO,CAAC;IACZ,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,GAAG,EAAE,uBAAuB,KACzB,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAE5C,MAAM,MAAM,+BAA+B,GACvC,MAAM,GACN,cAAc,GACd,kBAAkB,GAClB,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,+BAA+B,CAAC;IACzC,GAAG,EAAE,uBAAuB,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,OAAO,CAAC,KAAK,EAAE,+BAA+B,GAAG,uBAAuB,CAAC;IACzE,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACvE,sFAAsF;IACtF,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACvE,yEAAyE;IACzE,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAC7E,gFAAgF;IAChF,cAAc,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAAC;IAC5D,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACpD,mEAAmE;IACnE,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,yBAAyB,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACjD,8EAA8E;IAC9E,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACjC;AAMD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CA0PrB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,4BAA4B,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,MAAM,CAQT"}