@claude-flow/cli 3.32.1 → 3.32.3

package/dist/src/funnel/events.js

@@ -1,150 +0,0 @@
-/**
- * Funnel events — ADR-305 attribution / ADR-309 constrained schema.
- *
- * LOCAL-ONLY by design: this module performs no network I/O. Events are
- * appended to a bounded local queue only when the telemetry consent domain
- * is granted (ADR-302). Server-side ingestion (POST /v1/events, ADR-308)
- * is a separate opt-in transport that does not exist in this build — until
- * it does, the queue is simply a bounded local record the user can inspect
- * and delete.
- *
- * Constraints enforced here, permanently (ADR-309): closed event set, daily
- * timestamp buckets (never full timestamps), no raw prompts/commands/paths/
- * repo names — the schema has no field that could carry them.
- */
-import * as fs from 'fs';
-import { randomUUID } from 'crypto';
-import { hasConsent } from './consent.js';
-import { deleteStateFile, funnelStateDir, readStateJson, statePath, writeStateJson } from './state.js';
-const EVENTS_FILE = 'funnel-events.jsonl';
-const FUNNEL_ID_FILE = 'funnel-id.json';
-/** Bounded queue: ≤ 1000 events / ≤ 256 KiB — telemetry never grows unbounded. */
-const MAX_QUEUE_BYTES = 256 * 1024;
-const MAX_QUEUE_EVENTS = 1000;
-const EVENT_NAMES = [
-    'disclosure_shown',
-    'funnel_disabled',
-    'signup_opened',
-    'account_created',
-    'proxy_activated',
-    'promo_impression',
-    'promo_open',
-    'sponsor_mode_enabled',
-    'sponsor_mode_disabled',
-    'sponsor_capacity_exhausted',
-    'power_saver_enabled',
-    'power_saver_disabled',
-    'toggle_cooldown_blocked',
-    'training_share_enabled',
-    'training_share_disabled',
-    'advisor_tip_enabled',
-    'advisor_tip_disabled',
-];
-const SURFACES = ['statusline', 'init', 'credit_exhaustion'];
-/** Rotate the pseudonymous ID every 90 days (ADR-305). */
-const FUNNEL_ID_TTL_MS = 90 * 24 * 60 * 60 * 1000;
-/**
- * Lazily created pseudonymous funnel ID — random UUID, derived from nothing
- * (no hardware, account, email, or path). Exists only when attribution
- * consent (telemetry domain) is granted; deleted on opt-out.
- */
-export function getFunnelId(now = new Date()) {
-    if (!hasConsent('telemetry'))
-        return null;
-    const existing = readStateJson(FUNNEL_ID_FILE);
-    if (existing?.id) {
-        const created = Date.parse(existing.createdAt);
-        if (!Number.isNaN(created) && now.getTime() - created < FUNNEL_ID_TTL_MS)
-            return existing.id;
-    }
-    const record = { id: randomUUID(), createdAt: now.toISOString() };
-    writeStateJson(FUNNEL_ID_FILE, record);
-    return record.id;
-}
-/** Opt-out: stop emission, delete the ID and the local queue (ADR-305). */
-export function deleteFunnelData() {
-    deleteStateFile(FUNNEL_ID_FILE);
-    deleteStateFile(EVENTS_FILE);
-}
-/**
- * Most recent local record of `event`, as a daily bucket (`YYYY-MM-DD`) —
- * events never carry a full timestamp (ADR-309). Returns null when nothing
- * is recorded, which is also what you get with telemetry consent off (the
- * queue is never written at all in that case) — this can't distinguish
- * "never happened" from "not being recorded," by design.
- */
-export function lastRecordedEvent(event) {
-    try {
-        const raw = fs.readFileSync(statePath(EVENTS_FILE), 'utf-8');
-        const lines = raw.split('\n').filter(Boolean);
-        for (let i = lines.length - 1; i >= 0; i--) {
-            const parsed = JSON.parse(lines[i]);
-            if (parsed.event === event)
-                return parsed.timestampBucket;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-function dailyBucket(now) {
-    return now.toISOString().slice(0, 10);
-}
-/**
- * Record a funnel event to the local queue. No-op (returns false) when
- * telemetry consent is absent — consent-off means zero funnel records.
- * `messageId` is only carried for promo_impression / promo_open events; on
- * every other event it is dropped so the schema stays clean.
- */
-export function recordFunnelEvent(event, surface, release, optsOrNow = new Date()) {
-    if (!EVENT_NAMES.includes(event) || !SURFACES.includes(surface))
-        return false;
-    if (!hasConsent('telemetry'))
-        return false;
-    const now = optsOrNow instanceof Date ? optsOrNow : (optsOrNow.now ?? new Date());
-    const messageId = optsOrNow instanceof Date ? undefined : optsOrNow.messageId;
-    const payload = {
-        schemaVersion: 1,
-        event,
-        surface,
-        release,
-        timestampBucket: dailyBucket(now),
-    };
-    const id = getFunnelId(now);
-    if (id)
-        payload.pseudonymousId = id;
-    // messageId is only carried on promo events; validated + length-capped so
-    // the schema stays predictable.
-    if (messageId && (event === 'promo_impression' || event === 'promo_open')) {
-        if (typeof messageId === 'string' && messageId.length > 0 && messageId.length <= 64) {
-            payload.messageId = messageId;
-        }
-    }
-    try {
-        fs.mkdirSync(funnelStateDir(), { recursive: true, mode: 0o700 });
-        const file = statePath(EVENTS_FILE);
-        let existing = '';
-        try {
-            existing = fs.readFileSync(file, 'utf-8');
-        }
-        catch {
-            // first event
-        }
-        const lines = existing ? existing.split('\n').filter(Boolean) : [];
-        lines.push(JSON.stringify(payload));
-        let out = lines.slice(-MAX_QUEUE_EVENTS).join('\n') + '\n';
-        while (Buffer.byteLength(out, 'utf-8') > MAX_QUEUE_BYTES) {
-            const trimmed = out.split('\n').filter(Boolean);
-            trimmed.shift();
-            out = trimmed.join('\n') + '\n';
-        }
-        fs.writeFileSync(file, out, { encoding: 'utf-8', mode: 0o600 });
-        return true;
-    }
-    catch {
-        // Telemetry must never block or break the CLI (ADR-308 failure policy).
-        return false;
-    }
-}
-//# sourceMappingURL=events.js.map

package/dist/src/funnel/index.d.ts

@@ -1,21 +0,0 @@
-/**
- * Funnel module — ruflo → Cognitum lifecycle system (ADR-301..310).
- * Local-only: nothing in this module performs network I/O.
- */
-export * from './types.js';
-export { funnelStateDir } from './state.js';
-export { isCI, isInteractive, reducedMotion } from './environment.js';
-export { resolveFunnelEnabled } from './precedence.js';
-export { CONSENT_DOMAINS, getConsent, hasConsent, readConsents, recordConsent, revokeConsent, } from './consent.js';
-export { DISCLOSURE_GRACE_MS, DISCLOSURE_ROTATION_SLOT_MS, getDisclosure, promoEligible, recordDisclosureAccepted, recordDisclosureDeclined, recordDisclosureReenabled, recordDisclosureShown, selectDisclosureMessage, } from './disclosure.js';
-export { MAX_MESSAGE_COLUMNS, MESSAGES, containsForbiddenSequences, displayWidth, eligibleMessages, eligibleMessagesFromPools, isAllowedUrl, isValidMessage, } from './messages.js';
-export { DEFAULT_MESSAGES_ENDPOINT, getRemoteMessages, refreshRemoteMessages, } from './message-transport.js';
-export { PROMO_REPEAT_CAP_MS, PROMO_SLOT_MODULO, ROTATION_SLOT_MS, selectMessage, } from './rotation.js';
-export { CREDIT_RECOVERY_HINT, classifyCreditError, renderCreditRecovery, shouldShowCreditRecovery, type CreditPromptSession, type ProviderErrorLike, } from './credit-errors.js';
-export { deleteFunnelData, getFunnelId, lastRecordedEvent, recordFunnelEvent } from './events.js';
-export { getFunnelPromo, type PromoContext } from './promo.js';
-export { PAYOUT_POLICY_VERSION, deleteEnrollment, getAttributionToken, getEnrollment, isEarningEligible, recordEnrollment, } from './payout.js';
-export { RATE_LIMIT_TTL_MS, clearRateLimitStatus, markRateLimited, rateLimitNotice, readRateLimitStatus, type RateLimitStatus, } from './rate-limit-notifier.js';
-export { QUOTA_LOW_TTL_MS, clearQuotaLowStatus, markQuotaLow, quotaLowNotice, readQuotaLowStatus, type QuotaLowStatus, } from './power-saver-notifier.js';
-export { TOGGLE_COOLDOWN_MS, cooldownActive, cooldownRemainingMin } from './toggle-cooldown.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/src/funnel/index.js

@@ -1,21 +0,0 @@
-/**
- * Funnel module — ruflo → Cognitum lifecycle system (ADR-301..310).
- * Local-only: nothing in this module performs network I/O.
- */
-export * from './types.js';
-export { funnelStateDir } from './state.js';
-export { isCI, isInteractive, reducedMotion } from './environment.js';
-export { resolveFunnelEnabled } from './precedence.js';
-export { CONSENT_DOMAINS, getConsent, hasConsent, readConsents, recordConsent, revokeConsent, } from './consent.js';
-export { DISCLOSURE_GRACE_MS, DISCLOSURE_ROTATION_SLOT_MS, getDisclosure, promoEligible, recordDisclosureAccepted, recordDisclosureDeclined, recordDisclosureReenabled, recordDisclosureShown, selectDisclosureMessage, } from './disclosure.js';
-export { MAX_MESSAGE_COLUMNS, MESSAGES, containsForbiddenSequences, displayWidth, eligibleMessages, eligibleMessagesFromPools, isAllowedUrl, isValidMessage, } from './messages.js';
-export { DEFAULT_MESSAGES_ENDPOINT, getRemoteMessages, refreshRemoteMessages, } from './message-transport.js';
-export { PROMO_REPEAT_CAP_MS, PROMO_SLOT_MODULO, ROTATION_SLOT_MS, selectMessage, } from './rotation.js';
-export { CREDIT_RECOVERY_HINT, classifyCreditError, renderCreditRecovery, shouldShowCreditRecovery, } from './credit-errors.js';
-export { deleteFunnelData, getFunnelId, lastRecordedEvent, recordFunnelEvent } from './events.js';
-export { getFunnelPromo } from './promo.js';
-export { PAYOUT_POLICY_VERSION, deleteEnrollment, getAttributionToken, getEnrollment, isEarningEligible, recordEnrollment, } from './payout.js';
-export { RATE_LIMIT_TTL_MS, clearRateLimitStatus, markRateLimited, rateLimitNotice, readRateLimitStatus, } from './rate-limit-notifier.js';
-export { QUOTA_LOW_TTL_MS, clearQuotaLowStatus, markQuotaLow, quotaLowNotice, readQuotaLowStatus, } from './power-saver-notifier.js';
-export { TOGGLE_COOLDOWN_MS, cooldownActive, cooldownRemainingMin } from './toggle-cooldown.js';
-//# sourceMappingURL=index.js.map

package/dist/src/funnel/insights.d.ts

@@ -1,49 +0,0 @@
-/**
- * Local insight ticker — environment/task-aware suggestions sharing the
- * promo row's screen real estate, but a deliberately SEPARATE data path
- * from it.
- *
- * Why separate: the promo row is "zero local content, fully remote-served,
- * fail-closed" (an explicit earlier design call — nothing about WHAT shows
- * ships in the package). Insights are the opposite by nature — CVE counts,
- * uncommitted changes, sponsored-mode state — none of that is knowable
- * server-side. Conflating the two would mean either routing local logic
- * through the remote-content validation pipeline (messages.ts's
- * isValidMessage(), built for untrusted REMOTE content) or quietly giving
- * the promo row a second, unrelated job. So: same rendered slot, same
- * PromoRow shape, but a totally separate module, never touching
- * message-transport.ts or the remote message cache.
- *
- * Cheapness discipline (learned the hard way — see the funnel-cache fix):
- * every insight source here MUST be either (a) synchronous local file/state
- * reads, already-computed data the caller passes in, or (b) a read of a
- * cache some OTHER, separately-scheduled process populates. NEVER a network
- * call from here — that would reintroduce the exact bug where a statusline
- * render silently ate a multi-second fetch it could never actually finish.
- */
-export interface LocalInsight {
-    id: string;
-    text: string;
-    /** Higher = shown first when multiple insights are candidates this slot. */
-    priority: number;
-}
-export interface LocalInsightContext {
-    security?: {
-        status: string;
-        cvesFixed: number;
-        totalCves: number;
-    };
-    swarm?: {
-        activeAgents: number;
-        maxAgents: number;
-        coordinationActive: boolean;
-    };
-    /** Count of uncommitted-changed files (git status --short line count). */
-    gitUncommittedCount?: number;
-    now?: Date;
-}
-/** All candidate insights for this render, unsorted. */
-export declare function computeLocalInsights(ctx: LocalInsightContext): LocalInsight[];
-/** Highest-priority insight this render, or null if nothing is actionable. */
-export declare function selectLocalInsight(ctx: LocalInsightContext): LocalInsight | null;
-//# sourceMappingURL=insights.d.ts.map

package/dist/src/funnel/insights.js

@@ -1,120 +0,0 @@
-/**
- * Local insight ticker — environment/task-aware suggestions sharing the
- * promo row's screen real estate, but a deliberately SEPARATE data path
- * from it.
- *
- * Why separate: the promo row is "zero local content, fully remote-served,
- * fail-closed" (an explicit earlier design call — nothing about WHAT shows
- * ships in the package). Insights are the opposite by nature — CVE counts,
- * uncommitted changes, sponsored-mode state — none of that is knowable
- * server-side. Conflating the two would mean either routing local logic
- * through the remote-content validation pipeline (messages.ts's
- * isValidMessage(), built for untrusted REMOTE content) or quietly giving
- * the promo row a second, unrelated job. So: same rendered slot, same
- * PromoRow shape, but a totally separate module, never touching
- * message-transport.ts or the remote message cache.
- *
- * Cheapness discipline (learned the hard way — see the funnel-cache fix):
- * every insight source here MUST be either (a) synchronous local file/state
- * reads, already-computed data the caller passes in, or (b) a read of a
- * cache some OTHER, separately-scheduled process populates. NEVER a network
- * call from here — that would reintroduce the exact bug where a statusline
- * render silently ate a multi-second fetch it could never actually finish.
- */
-import { hasConsent } from './consent.js';
-import { readQuotaLowStatus } from './power-saver-notifier.js';
-import { readStateJson } from './state.js';
-import { readAdvisorTip } from './advisor-tip.js';
-const GIT_UNCOMMITTED_THRESHOLD = 20;
-const FLYWHEEL_STATUS_TTL_MS = 24 * 60 * 60 * 1000;
-function flywheelInsight(now) {
-    const cache = readStateJson('flywheel-status.json');
-    // `!cache._ts` would wrongly treat a legitimate epoch-zero timestamp as
-    // absent (0 is falsy) — check the type explicitly instead (ADR-316 found
-    // this exact defect pattern live via a test using new Date(0)).
-    if (!cache || !cache.headline || typeof cache._ts !== 'number')
-        return null;
-    if (now.getTime() - cache._ts >= FLYWHEEL_STATUS_TTL_MS)
-        return null;
-    return { id: 'insight-flywheel-status', text: `🧬 ${cache.headline}`, priority: 40 };
-}
-function securityInsight(ctx) {
-    const s = ctx.security;
-    if (!s)
-        return null;
-    const pending = s.totalCves - s.cvesFixed;
-    if (pending > 0) {
-        return {
-            id: 'insight-cves-pending',
-            text: `⚠ ${pending} CVE${pending === 1 ? '' : 's'} pending — Run ruflo security scan --depth full`,
-            priority: 90,
-        };
-    }
-    if (s.status === 'PENDING') {
-        return { id: 'insight-scan-pending', text: '🛡 Security scan pending — Run ruflo security scan --depth full', priority: 70 };
-    }
-    return null;
-}
-function gitInsight(ctx) {
-    const n = ctx.gitUncommittedCount;
-    if (n === undefined || n <= GIT_UNCOMMITTED_THRESHOLD)
-        return null;
-    return {
-        id: 'insight-uncommitted',
-        text: `📝 ${n} uncommitted changes — commit or stash before continuing`,
-        priority: 50,
-    };
-}
-/**
- * Power-saver mode state — genuinely local (consent + a self-reported flag
- * file, same pattern the rest of this module uses). Sponsored/rate-limited
- * state is deliberately NOT duplicated here — promo.ts's own
- * getSponsoredDowntimeOverride() already preempts rotation entirely for
- * that case (ADR-313), with higher precedence than this slot-based ticker.
- * Two insight sources for the same fact would mean picking which one wins;
- * simpler to just not have two.
- */
-function proxyModeInsight(now) {
-    if (hasConsent('power-saver') && readQuotaLowStatus(now).low) {
-        return { id: 'insight-power-saver-active', text: '🔋 Power saver mode active — routing via cognitum-auto', priority: 55 };
-    }
-    return null;
-}
-/**
- * ADR-316 — a co-pilot tip from ruflo's Fable Advisor Harness
- * (services/fable-harness.ts, ADR-172). Consent-gated (never surfaces a
- * stale cached tip after the user disables it, even though the cache file
- * itself isn't deleted on disable — this check is what actually enforces
- * "off means off"). Purely a cache read here — no network call, no spend;
- * the real `claude -p` call happens in advisor-tip.ts's
- * refreshAdvisorTipIfStale(), invoked from a detached background process,
- * never from this hot path.
- */
-function advisorTipInsight(now) {
-    if (!hasConsent('advisor-tips'))
-        return null;
-    const tip = readAdvisorTip(now);
-    if (!tip)
-        return null;
-    return { id: 'insight-advisor-tip', text: `🧭 ${tip.headline}`, priority: 45 };
-}
-/** All candidate insights for this render, unsorted. */
-export function computeLocalInsights(ctx) {
-    const now = ctx.now ?? new Date();
-    const candidates = [
-        securityInsight(ctx),
-        gitInsight(ctx),
-        proxyModeInsight(now),
-        advisorTipInsight(now),
-        flywheelInsight(now),
-    ];
-    return candidates.filter((i) => i !== null);
-}
-/** Highest-priority insight this render, or null if nothing is actionable. */
-export function selectLocalInsight(ctx) {
-    const candidates = computeLocalInsights(ctx);
-    if (candidates.length === 0)
-        return null;
-    return candidates.reduce((best, c) => (c.priority > best.priority ? c : best));
-}
-//# sourceMappingURL=insights.js.map

package/dist/src/funnel/local-signals.d.ts

@@ -1,15 +0,0 @@
-export interface SecurityStatus {
-    status: 'CLEAN' | 'IN_PROGRESS' | 'PENDING';
-    cvesFixed: number;
-    totalCves: number;
-}
-export declare function getSecurityStatus(cwd?: string): SecurityStatus;
-export interface SwarmStatus {
-    activeAgents: number;
-    maxAgents: number;
-    coordinationActive: boolean;
-}
-export declare function getSwarmStatus(): SwarmStatus;
-/** Count of uncommitted-changed files (git status --short line count). */
-export declare function getGitUncommittedCount(): number | undefined;
-//# sourceMappingURL=local-signals.d.ts.map

package/dist/src/funnel/local-signals.js

@@ -1,68 +0,0 @@
-/**
- * Local, synchronous, $0 structural signals shared by the statusline
- * (commands/hooks.ts's statuslineCommand) and the advisor-tip refresh
- * (funnel/advisor-tip.ts, ADR-316) — a single source of truth so the two
- * call sites can never silently drift on what "security status" or "swarm
- * status" means. Every function here is cheap, bounded, and never throws —
- * matching the statusline's own "never allowed to break the render"
- * discipline.
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import { execSync } from 'child_process';
-export function getSecurityStatus(cwd = process.cwd()) {
-    const scanResultsPath = path.join(cwd, '.claude', 'security-scans');
-    let cvesFixed = 0;
-    const totalCves = 3;
-    if (fs.existsSync(scanResultsPath)) {
-        try {
-            const scans = fs.readdirSync(scanResultsPath).filter((f) => f.endsWith('.json'));
-            cvesFixed = Math.min(totalCves, scans.length);
-        }
-        catch {
-            // Ignore
-        }
-    }
-    const auditPath = path.join(cwd, '.swarm', 'security');
-    if (fs.existsSync(auditPath)) {
-        try {
-            const audits = fs.readdirSync(auditPath).filter((f) => f.includes('audit'));
-            cvesFixed = Math.min(totalCves, Math.max(cvesFixed, audits.length));
-        }
-        catch {
-            // Ignore
-        }
-    }
-    const status = cvesFixed >= totalCves ? 'CLEAN' : cvesFixed > 0 ? 'IN_PROGRESS' : 'PENDING';
-    return { status, cvesFixed, totalCves };
-}
-export function getSwarmStatus() {
-    let activeAgents = 0;
-    let coordinationActive = false;
-    const maxAgents = 15;
-    const isWindows = process.platform === 'win32';
-    try {
-        const psCmd = isWindows
-            ? 'tasklist /FI "IMAGENAME eq node.exe" /NH 2>NUL | find /c /v "" 2>NUL || echo 0'
-            : 'ps aux 2>/dev/null | grep -c agentic-flow || echo "0"';
-        const ps = execSync(psCmd, { encoding: 'utf-8', timeout: 3000 });
-        activeAgents = Math.max(0, parseInt(ps.trim()) - 1);
-        coordinationActive = activeAgents > 0;
-    }
-    catch {
-        // ps/tasklist unavailable or timed out — report zero
-    }
-    return { activeAgents, maxAgents, coordinationActive };
-}
-/** Count of uncommitted-changed files (git status --short line count). */
-export function getGitUncommittedCount() {
-    try {
-        const out = execSync('git status --porcelain 2>/dev/null', { encoding: 'utf-8', timeout: 3000 });
-        const lines = out.split('\n').filter((l) => l.trim().length > 0);
-        return lines.length;
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=local-signals.js.map

package/dist/src/funnel/message-transport.d.ts

@@ -1,51 +0,0 @@
-/**
- * Remote message transport — best-effort fetch of the ADR-311 message
- * feed, cached locally, validated through the ADR-301 content pipeline
- * BEFORE any message is displayed.
- *
- * Design discipline:
- *   1. **Never blocks the render.** The statusline reads only the local
- *      cache. This module refreshes the cache in the background; a fresh
- *      install shows the in-code fallback pool until the first refresh
- *      lands (usually seconds after CLI startup).
- *   2. **Content pipeline stays authoritative.** Every message the server
- *      returns is validated by `isValidMessage()` from `messages.ts` —
- *      same schema, same host allowlist, same control-char strip, same
- *      80-column cap. A tampered or accidentally-broken remote feed can
- *      pollute nothing.
- *   3. **Fail silent.** Any network/parse/validation failure leaves the
- *      previously-cached (or in-code) pool intact.
- *   4. **Bounded cache size.** ≤ 128 KiB and ≤ 200 messages — matches
- *      ADR-309's bounded-local-queue discipline.
- *   5. **Kill switch.** `RUFLO_FUNNEL_MESSAGES=0` (or `RUFLO_FUNNEL=0`)
- *      disables the fetcher entirely.
- *   6. **Signature-verification hook.** Reserved for a future ADR-311
- *      amendment; currently the transport-layer TLS + host allowlist is
- *      the trust boundary. All content is treated as untrusted regardless.
- */
-import type { FunnelMessage } from './types.js';
-/** Endpoint the client hits — overridable for staging / self-hosted. */
-export declare const DEFAULT_MESSAGES_ENDPOINT: string;
-/**
- * Best-effort refresh of the cache. Safe to call at any point in the
- * CLI lifecycle — returns a summary; never throws; never blocks longer
- * than FETCH_TIMEOUT_MS + write time.
- */
-export declare function refreshRemoteMessages(opts?: {
-    endpoint?: string;
-    force?: boolean;
-    env?: NodeJS.ProcessEnv;
-}): Promise<{
-    refreshed: boolean;
-    skipped?: string;
-    accepted?: number;
-    rejected?: number;
-    status?: number;
-}>;
-/**
- * Read the cached remote pool. Returns [] when the cache is empty or
- * stale enough to distrust — callers should merge with the in-code
- * fallback pool.
- */
-export declare function getRemoteMessages(): FunnelMessage[];
-//# sourceMappingURL=message-transport.d.ts.map

package/dist/src/funnel/message-transport.js

@@ -1,149 +0,0 @@
-/**
- * Remote message transport — best-effort fetch of the ADR-311 message
- * feed, cached locally, validated through the ADR-301 content pipeline
- * BEFORE any message is displayed.
- *
- * Design discipline:
- *   1. **Never blocks the render.** The statusline reads only the local
- *      cache. This module refreshes the cache in the background; a fresh
- *      install shows the in-code fallback pool until the first refresh
- *      lands (usually seconds after CLI startup).
- *   2. **Content pipeline stays authoritative.** Every message the server
- *      returns is validated by `isValidMessage()` from `messages.ts` —
- *      same schema, same host allowlist, same control-char strip, same
- *      80-column cap. A tampered or accidentally-broken remote feed can
- *      pollute nothing.
- *   3. **Fail silent.** Any network/parse/validation failure leaves the
- *      previously-cached (or in-code) pool intact.
- *   4. **Bounded cache size.** ≤ 128 KiB and ≤ 200 messages — matches
- *      ADR-309's bounded-local-queue discipline.
- *   5. **Kill switch.** `RUFLO_FUNNEL_MESSAGES=0` (or `RUFLO_FUNNEL=0`)
- *      disables the fetcher entirely.
- *   6. **Signature-verification hook.** Reserved for a future ADR-311
- *      amendment; currently the transport-layer TLS + host allowlist is
- *      the trust boundary. All content is treated as untrusted regardless.
- */
-import * as https from 'https';
-import { URL as NodeUrl } from 'url';
-import { isValidMessage } from './messages.js';
-import { readStateJson, writeStateJson } from './state.js';
-const CACHE_FILE = 'funnel-messages-cache.json';
-const CACHE_TTL_MS = 6 * 60 * 60 * 1000; // 6h — matches server Cache-Control
-const CACHE_MAX_BYTES = 128 * 1024;
-const CACHE_MAX_MESSAGES = 200;
-const FETCH_TIMEOUT_MS = 4_000;
-/** Endpoint the client hits — overridable for staging / self-hosted. */
-export const DEFAULT_MESSAGES_ENDPOINT = process.env.RUFLO_FUNNEL_MESSAGES_ENDPOINT ?? 'https://funnel.ruv.io/v1/messages';
-function readCache() {
-    const raw = readStateJson(CACHE_FILE);
-    if (!raw || !Array.isArray(raw.messages))
-        return { fresh: false, messages: [] };
-    const age = Date.now() - (raw._ts ?? 0);
-    return { fresh: age < CACHE_TTL_MS, messages: raw.messages };
-}
-function writeCache(messages) {
-    // Bound the cache before persisting — messages come from an untrusted
-    // source, so we cap size regardless of server behavior.
-    let trimmed = messages.slice(0, CACHE_MAX_MESSAGES);
-    let body = JSON.stringify({ _ts: Date.now(), messages: trimmed });
-    while (Buffer.byteLength(body, 'utf-8') > CACHE_MAX_BYTES && trimmed.length > 0) {
-        trimmed = trimmed.slice(0, trimmed.length - 1);
-        body = JSON.stringify({ _ts: Date.now(), messages: trimmed });
-    }
-    writeStateJson(CACHE_FILE, { _ts: Date.now(), messages: trimmed });
-}
-function httpsGet(url) {
-    return new Promise((resolve) => {
-        let target;
-        try {
-            target = new NodeUrl(url);
-        }
-        catch {
-            resolve({ status: 0, body: 'bad-url' });
-            return;
-        }
-        if (target.protocol !== 'https:') {
-            resolve({ status: 0, body: 'non-https' });
-            return;
-        }
-        const req = https.request({
-            hostname: target.hostname,
-            port: target.port || 443,
-            path: target.pathname + target.search,
-            method: 'GET',
-            headers: {
-                'User-Agent': 'ruflo-funnel/messages',
-                'Accept': 'application/json',
-            },
-        }, (res) => {
-            let chunks = '';
-            res.setEncoding('utf-8');
-            res.on('data', (chunk) => { chunks += chunk; });
-            res.on('end', () => resolve({ status: res.statusCode ?? 0, body: chunks }));
-        });
-        req.setTimeout(FETCH_TIMEOUT_MS, () => {
-            req.destroy();
-            resolve({ status: 0, body: 'timeout' });
-        });
-        req.on('error', () => resolve({ status: 0, body: 'error' }));
-        req.end();
-    });
-}
-function killSwitched(env = process.env) {
-    const kill = (v) => v !== undefined && /^(0|false|off|no)$/i.test(v.trim());
-    return kill(env.RUFLO_FUNNEL_MESSAGES) || kill(env.RUFLO_FUNNEL);
-}
-/**
- * Best-effort refresh of the cache. Safe to call at any point in the
- * CLI lifecycle — returns a summary; never throws; never blocks longer
- * than FETCH_TIMEOUT_MS + write time.
- */
-export async function refreshRemoteMessages(opts) {
-    const env = opts?.env ?? process.env;
-    if (killSwitched(env))
-        return { refreshed: false, skipped: 'kill-switch' };
-    const cache = readCache();
-    if (!opts?.force && cache.fresh)
-        return { refreshed: false, skipped: 'fresh-cache' };
-    const endpoint = opts?.endpoint ?? DEFAULT_MESSAGES_ENDPOINT;
-    const res = await httpsGet(endpoint);
-    if (res.status !== 200)
-        return { refreshed: false, skipped: `http-${res.status}`, status: res.status };
-    let parsed;
-    try {
-        parsed = JSON.parse(res.body);
-    }
-    catch {
-        return { refreshed: false, skipped: 'json-parse-error' };
-    }
-    if (!parsed || typeof parsed !== 'object')
-        return { refreshed: false, skipped: 'not-object' };
-    const raw = parsed.messages;
-    if (!Array.isArray(raw))
-        return { refreshed: false, skipped: 'no-messages-field' };
-    // Every message goes through the SAME pipeline the in-code pool uses.
-    // This is where trust boundary enforcement actually lives.
-    const now = new Date();
-    const accepted = [];
-    let rejected = 0;
-    for (const candidate of raw) {
-        if (isValidMessage(candidate, now)) {
-            accepted.push(candidate);
-        }
-        else {
-            rejected += 1;
-        }
-    }
-    writeCache(accepted);
-    return { refreshed: true, accepted: accepted.length, rejected, status: res.status };
-}
-/**
- * Read the cached remote pool. Returns [] when the cache is empty or
- * stale enough to distrust — callers should merge with the in-code
- * fallback pool.
- */
-export function getRemoteMessages() {
-    const cache = readCache();
-    return cache.messages;
-}
-//# sourceMappingURL=message-transport.js.map