@geminixiang/mikan 1.0.0-beta.7 → 1.0.0-beta.71

package/dist/office/index.js

@@ -0,0 +1,1084 @@
+/**
+ * The Conversation office module: canonical identity, the Workspace/Office
+ * layout values, the durable registry journal, and the boot-time legacy
+ * migration. Everything outside `src/office/` imports from this module;
+ * exported types live in `types.ts` per module convention.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import * as log from "../log.js";
+import { parseGithubConversationId } from "../adapters/github/ids.js";
+import { legacyConversationCredentialKey } from "../sandbox/identity.js";
+import { migrateConversationVaultKeys } from "../vault/index.js";
+import { atomicWritePrivateFile, isRecord, readTextFileIfExists } from "../file-guards.js";
+// ── Office identity (address & keys) ──────────────────────────────────────────
+const OFFICE_KEY_VERSION = "v1";
+const OFFICE_KEY_DOMAIN = "office-address-v1";
+const OFFICE_KEY_DIGEST_LENGTH = 16;
+const READABLE_ID_LENGTH = 32;
+const PLATFORM_NAMES = new Set(["slack", "discord", "telegram", "github"]);
+const OFFICE_KEY_PATTERN = /^v1-(slack|discord|telegram|github)-[a-z0-9]+(?:-[a-z0-9]+)*-[a-f0-9]{16}$/;
+/** Construct the canonical identity used by future office consumers. */
+export function createOfficeAddress(platform, conversationId) {
+    assertPlatformName(platform);
+    assertConversationId(conversationId);
+    return Object.freeze({ platform, conversationId });
+}
+/** Validate an untrusted runtime value as a canonical office address. */
+export function validateOfficeAddress(value) {
+    if (!isRecord(value))
+        throw new Error("Office address must be an object");
+    if (typeof value.platform !== "string") {
+        throw new Error("Office address platform must be a string");
+    }
+    if (typeof value.conversationId !== "string") {
+        throw new Error("Office address conversation id must be a string");
+    }
+    return createOfficeAddress(assertPlatformName(value.platform), value.conversationId);
+}
+/** Return true only for a supported platform name. */
+function isPlatformName(value) {
+    return typeof value === "string" && PLATFORM_NAMES.has(value);
+}
+/** Validate a platform name and return it for typed callers. */
+export function assertPlatformName(value) {
+    if (!isPlatformName(value))
+        throw new Error(`Unsupported platform: ${JSON.stringify(value)}`);
+    return value;
+}
+/** Path separators and the C0/C1 control ranges are never allowed in an id. */
+function isUnsafeConversationIdChar(character) {
+    const code = character.codePointAt(0) ?? 0;
+    return character === "/" || character === "\\" || code <= 0x1f || (code >= 0x7f && code <= 0x9f);
+}
+/** Validate a raw platform conversation identifier before it enters storage. */
+export function assertConversationId(value) {
+    if (value.length === 0 || value === "." || value === "..") {
+        throw new Error("Conversation id must be non-empty and not a path marker");
+    }
+    if ([...value].some(isUnsafeConversationIdChar)) {
+        throw new Error("Conversation id must not contain path separators or control characters");
+    }
+    return value;
+}
+/** Derive a readable diagnostic key whose digest remains the identity authority. */
+export function officeKey(address) {
+    const normalized = validateOfficeAddress(address);
+    const readable = readableConversationId(normalized.conversationId);
+    const digest = createHash("sha256")
+        .update(`${OFFICE_KEY_DOMAIN}\0${normalized.platform}\0${normalized.conversationId}`)
+        .digest("hex")
+        .slice(0, OFFICE_KEY_DIGEST_LENGTH);
+    return `${OFFICE_KEY_VERSION}-${normalized.platform}-${readable}-${digest}`;
+}
+/**
+ * Resolve the persistent workspace directory for an office.
+ * Module-internal: registry/migration record target paths with it. Callers
+ * outside `src/office/` use the `Office` value's `dir` field instead.
+ */
+export function officeDir(workspaceRoot, address) {
+    return join(workspaceRoot, officeKey(address));
+}
+/**
+ * Resolve the host-only state directory for an office.
+ *
+ * Settings and migration callers that only hold a `stateDir` string use this
+ * when no materialized `Office` value is available.
+ */
+export function officeStateDir(stateDir, address) {
+    return join(stateDir, "conversations", officeKey(address));
+}
+/** Compare canonical office identities without relying on their readable key. */
+export function sameOffice(left, right) {
+    const leftAddress = validateOfficeAddress(left);
+    const rightAddress = validateOfficeAddress(right);
+    return (leftAddress.platform === rightAddress.platform &&
+        leftAddress.conversationId === rightAddress.conversationId);
+}
+/** Validate a persisted or externally supplied office key. */
+export function assertOfficeKey(value) {
+    if (!OFFICE_KEY_PATTERN.test(value)) {
+        throw new Error(`Invalid office key: ${JSON.stringify(value)}`);
+    }
+    return value;
+}
+export function isOfficeKey(value) {
+    return typeof value === "string" && OFFICE_KEY_PATTERN.test(value);
+}
+function readableConversationId(conversationId) {
+    const readable = conversationId
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, READABLE_ID_LENGTH)
+        .replace(/-+$/g, "");
+    return readable || "conversation";
+}
+// ── Workspace/Office layout ───────────────────────────────────────────────────
+/**
+ * Workspace-root entries that are shared infrastructure, never office dirs.
+ * The single definition behind boot-time directory setup, the workspace
+ * projection, and the migration's legacy-dir scan. `events` stays reserved
+ * for the legacy scheduling bus that `mikan office migrate-events` drains.
+ */
+export const RESERVED_WORKSPACE_NAMES = Object.freeze(new Set(["skills", "events", "agents", "MEMORY.md"]));
+/**
+ * Construct the Workspace value for a deployment. One construction site per
+ * process (main.ts for the daemon; CLI subcommands and tests build their
+ * own). The value owns the registry instance and the recorded-office cache
+ * that office materialization uses on hot paths, so there is no process-wide
+ * registry state.
+ */
+/**
+ * An office's session files live in `<office dir>/sessions` — the one home of
+ * that rule. String-based for surfaces that hold a conversation dir rather
+ * than an `Office` value (mirrors `officeStateDir`); `Office.sessionsDir` is
+ * derived from it. Pointer/thread-file semantics live in `sessions/store`.
+ */
+export function officeSessionsDir(dir) {
+    return join(dir, "sessions");
+}
+export function createWorkspace(options) {
+    // Paths are joined as given (no resolve) so values match what callers
+    // passing the same root/stateDir strings computed before this module.
+    const { root, stateDir } = options;
+    // Lazy: CLI surfaces construct a Workspace for path math without paying
+    // for (or being allowed to create) the registry journal.
+    let registry;
+    const recorded = new Set();
+    const offices = new Map();
+    const workspace = Object.freeze({
+        root,
+        stateDir,
+        memoryPath: join(root, "MEMORY.md"),
+        skillsDir: join(root, "skills"),
+        agentsDir: join(root, "agents"),
+        reservedNames: RESERVED_WORKSPACE_NAMES,
+        office(address) {
+            const normalized = validateOfficeAddress(address);
+            const key = officeKey(normalized);
+            const existing = offices.get(key);
+            if (existing)
+                return existing;
+            const dir = join(root, key);
+            const office = Object.freeze({
+                address: normalized,
+                key,
+                dir,
+                memoryPath: join(dir, "MEMORY.md"),
+                skillsDir: join(dir, "skills"),
+                sessionsDir: officeSessionsDir(dir),
+                attachmentsDir: join(dir, "attachments"),
+                logPath: join(dir, "log.jsonl"),
+                stateDir: join(stateDir, "conversations", key),
+                workspace,
+                ensure() {
+                    // Record-first ordering: a crash can leave a record without a
+                    // directory (harmless; recreated on the next message) but never an
+                    // anonymous office directory the registry cannot enumerate.
+                    if (!recorded.has(key)) {
+                        registry ??= new OfficeRegistry(stateDir);
+                        registry.recordOffice(normalized);
+                        recorded.add(key);
+                    }
+                    ensureRegularOfficeDirectory(dir);
+                    return dir;
+                },
+            });
+            offices.set(key, office);
+            return office;
+        },
+    });
+    return workspace;
+}
+/** mkdir-if-missing with the same fail-closed type guard as projection roots. */
+function ensureRegularOfficeDirectory(dir) {
+    let stats;
+    try {
+        stats = lstatSync(dir);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        return;
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        throw new Error(`Office directory must be a regular non-symlink directory: ${dir}`);
+    }
+}
+// ── Office registry journal ───────────────────────────────────────────────────
+const REGISTRY_VERSION = 1;
+const REGISTRY_FILENAME = "office-registry.json";
+const MIGRATION_STATUSES = new Set([
+    "needs-owner",
+    "prepared",
+    "moving",
+    "committed",
+    "failed",
+]);
+const REGISTRY_LOCK_FILENAME = ".office-registry.lock";
+const REGISTRY_LOCK_RETRY_MS = 25;
+const REGISTRY_LOCK_TIMEOUT_MS = 5_000;
+const REGISTRY_LOCK_STALE_MS = 60_000;
+export class OfficeRegistry {
+    constructor(stateDir, options = {}) {
+        this.stateDir = resolve(stateDir);
+        mkdirSync(this.stateDir, { recursive: true, mode: 0o700 });
+        assertRegularDirectory(this.stateDir, "State directory");
+        this.registryPath = resolve(this.stateDir, REGISTRY_FILENAME);
+        this.lockPath = join(this.stateDir, REGISTRY_LOCK_FILENAME);
+        this.writeState = options.writeState ?? atomicWritePrivateFile;
+        this.lockTimeoutMs = options.lockTimeoutMs ?? REGISTRY_LOCK_TIMEOUT_MS;
+        this.state = this.readState();
+    }
+    /** Reload the atomic registry file after another host process changed it. */
+    reload() {
+        this.state = this.readState();
+        return this.state;
+    }
+    getState() {
+        return this.state;
+    }
+    getMigration(rawConversationId) {
+        assertConversationId(rawConversationId);
+        return this.state.migrations.find((record) => record.rawConversationId === rawConversationId);
+    }
+    enablePlatform(platform) {
+        const validPlatform = assertPlatformName(platform);
+        return this.withExclusiveLease(() => {
+            if (this.state.enabledPlatforms.includes(validPlatform))
+                return this.state;
+            const enabledPlatforms = [...this.state.enabledPlatforms, validPlatform].toSorted();
+            this.replaceState(enabledPlatforms, this.state.offices, this.state.migrations);
+            return this.state;
+        });
+    }
+    /**
+     * Record that an office exists. Idempotent: re-recording a known office is
+     * a lock-free cache hit for callers that materialize directories per
+     * message, so this sits safely on hot write paths.
+     */
+    recordOffice(address) {
+        const normalized = validateOfficeAddress(address);
+        const existing = this.findOffice(normalized);
+        if (existing)
+            return existing;
+        return this.withExclusiveLease(() => {
+            const found = this.findOffice(normalized);
+            if (found)
+                return found;
+            const record = Object.freeze({
+                platform: normalized.platform,
+                conversationId: normalized.conversationId,
+                recordedAt: new Date().toISOString(),
+            });
+            this.replaceState(this.state.enabledPlatforms, [...this.state.offices, record], this.state.migrations);
+            return record;
+        });
+    }
+    getOffices() {
+        return this.state.offices;
+    }
+    findOffice(address) {
+        return this.state.offices.find((record) => record.platform === address.platform && record.conversationId === address.conversationId);
+    }
+    /**
+     * Validate and record a legacy directory. With exactly one enabled platform,
+     * ownership is safe to infer. With zero or multiple platforms, the record
+     * remains explicit `needs-owner` unless the caller supplies an owner.
+     */
+    prepareLegacyMigration(options) {
+        const rawConversationId = assertConversationId(options.rawConversationId);
+        const sourceDir = resolve(options.sourceDir);
+        const workspaceRoot = resolve(options.workspaceRoot);
+        return this.withExclusiveLease(() => {
+            const existing = this.getMigration(rawConversationId);
+            assertCanonicalSource(sourceDir, workspaceRoot, rawConversationId);
+            if (existing) {
+                assertSameMigrationInputs(existing, sourceDir, workspaceRoot);
+                if (existing.status !== "needs-owner")
+                    return existing;
+            }
+            assertRegularDirectory(sourceDir, "Legacy office source");
+            const ownerPlatform = this.resolveOwner(options.ownerPlatform, rawConversationId);
+            if (!ownerPlatform) {
+                const record = makeRecord({
+                    rawConversationId,
+                    sourceDir,
+                    workspaceRoot,
+                    status: "needs-owner",
+                });
+                this.replaceMigration(existing, record);
+                return record;
+            }
+            const targetDir = officeDir(workspaceRoot, {
+                platform: ownerPlatform,
+                conversationId: rawConversationId,
+            });
+            if (pathExists(targetDir)) {
+                const failed = makeRecord({
+                    rawConversationId,
+                    sourceDir,
+                    workspaceRoot,
+                    ownerPlatform,
+                    targetDir,
+                    status: "failed",
+                    error: "Target office directory already exists",
+                });
+                this.replaceMigration(existing, failed);
+                throw new Error(`${failed.error}: ${targetDir}`);
+            }
+            const prepared = makeRecord({
+                rawConversationId,
+                sourceDir,
+                workspaceRoot,
+                ownerPlatform,
+                targetDir,
+                status: "prepared",
+            });
+            this.replaceMigration(existing, prepared);
+            return prepared;
+        });
+    }
+    markMoving(rawConversationId) {
+        return this.withExclusiveLease(() => {
+            const record = this.requireMigration(rawConversationId);
+            if (record.status === "moving" ||
+                record.status === "committed" ||
+                record.status === "failed") {
+                return record;
+            }
+            if (record.status === "needs-owner") {
+                throw new Error(`Legacy office ${JSON.stringify(rawConversationId)} still needs an owner`);
+            }
+            assertRegularDirectory(record.sourceDir, "Legacy office source");
+            const targetDir = migrationTarget(record);
+            if (!targetDir)
+                throw new Error("Prepared office migration has no target directory");
+            if (pathExists(targetDir)) {
+                const failed = this.failRecord(record, "Target office directory appeared before moving");
+                throw new Error(`${failed.error}: ${targetDir}`);
+            }
+            const moving = transitionRecord(record, "moving");
+            this.replaceMigration(record, moving);
+            return moving;
+        });
+    }
+    markCommitted(rawConversationId) {
+        return this.withExclusiveLease(() => {
+            const record = this.requireMigration(rawConversationId);
+            if (record.status === "committed" || record.status === "failed")
+                return record;
+            if (record.status !== "moving") {
+                throw new Error(`Cannot commit office migration from ${record.status}`);
+            }
+            const targetDir = migrationTarget(record);
+            if (!targetDir)
+                throw new Error("Moving office migration has no target directory");
+            assertRegularDirectory(targetDir, "Migrated office target");
+            assertPathAbsent(record.sourceDir, "Legacy office source");
+            const committed = transitionRecord(record, "committed");
+            this.replaceMigration(record, committed);
+            return committed;
+        });
+    }
+    markFailed(rawConversationId, error) {
+        return this.withExclusiveLease(() => {
+            const record = this.requireMigration(rawConversationId);
+            if (record.status === "committed") {
+                throw new Error("A committed office migration cannot be marked failed");
+            }
+            if (record.status === "failed")
+                return record;
+            return this.failRecord(record, error);
+        });
+    }
+    resolveOwner(ownerPlatform, rawConversationId) {
+        if (ownerPlatform !== undefined) {
+            const validPlatform = assertPlatformName(ownerPlatform);
+            if (!this.state.enabledPlatforms.includes(validPlatform)) {
+                throw new Error(`Owner platform ${validPlatform} is not enabled`);
+            }
+            return validPlatform;
+        }
+        const candidates = platformsMatchingConversationIdFormat(rawConversationId, this.state.enabledPlatforms);
+        return candidates.length === 1 ? candidates[0] : undefined;
+    }
+    requireMigration(rawConversationId) {
+        assertConversationId(rawConversationId);
+        const record = this.getMigration(rawConversationId);
+        if (!record)
+            throw new Error(`No office migration registered for ${rawConversationId}`);
+        return record;
+    }
+    failRecord(record, error) {
+        const message = error.trim();
+        if (!message)
+            throw new Error("Office migration failure reason must not be empty");
+        const failed = transitionRecord(record, "failed", message);
+        this.replaceMigration(record, failed);
+        return failed;
+    }
+    replaceMigration(previous, next) {
+        const migrations = [...this.state.migrations];
+        const index = previous
+            ? migrations.findIndex((record) => record.rawConversationId === previous.rawConversationId)
+            : -1;
+        if (index === -1)
+            migrations.push(next);
+        else
+            migrations[index] = next;
+        this.replaceState(this.state.enabledPlatforms, this.state.offices, migrations);
+    }
+    replaceState(enabledPlatforms, offices, migrations) {
+        const candidate = freezeState({ enabledPlatforms, offices, migrations });
+        this.writeState(this.registryPath, `${JSON.stringify(candidate, null, 2)}\n`);
+        this.state = candidate;
+    }
+    /**
+     * Acquire the domain lease, reload while holding it, then perform one
+     * read-modify-write. A future move transaction can retain the same lease
+     * across its filesystem operation instead of splitting the transition.
+     */
+    withExclusiveLease(operation) {
+        const release = acquireRegistryLease(this.lockPath, this.lockTimeoutMs);
+        try {
+            this.state = this.readState();
+            return operation();
+        }
+        finally {
+            release();
+        }
+    }
+    readState() {
+        assertRegistryFileSafe(this.registryPath);
+        const raw = readTextFileIfExists(this.registryPath);
+        if (raw === undefined) {
+            return freezeState({ enabledPlatforms: [], offices: [], migrations: [] });
+        }
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch (error) {
+            throw new Error(`Invalid office registry JSON at ${this.registryPath}`, { cause: error });
+        }
+        return parseState(value, this.registryPath);
+    }
+}
+function makeRecord(fields) {
+    const record = {
+        rawConversationId: fields.rawConversationId,
+        sourceDir: fields.sourceDir,
+        workspaceRoot: fields.workspaceRoot,
+        ...(fields.ownerPlatform ? { ownerPlatform: fields.ownerPlatform } : {}),
+        ...(fields.targetDir ? { targetDir: fields.targetDir } : {}),
+        status: fields.status,
+        ...(fields.error ? { error: fields.error } : {}),
+        updatedAt: fields.updatedAt ?? new Date().toISOString(),
+    };
+    return Object.freeze(record);
+}
+function transitionRecord(record, status, error) {
+    const targetDir = migrationTarget(record);
+    return makeRecord({
+        rawConversationId: record.rawConversationId,
+        sourceDir: record.sourceDir,
+        workspaceRoot: record.workspaceRoot,
+        ...(record.ownerPlatform ? { ownerPlatform: record.ownerPlatform } : {}),
+        ...(targetDir ? { targetDir } : {}),
+        status,
+        ...(error ? { error } : {}),
+    });
+}
+function migrationTarget(record) {
+    return record.ownerPlatform
+        ? officeDir(record.workspaceRoot, {
+            platform: record.ownerPlatform,
+            conversationId: record.rawConversationId,
+        })
+        : undefined;
+}
+function freezeState(input) {
+    return Object.freeze({
+        version: REGISTRY_VERSION,
+        enabledPlatforms: Object.freeze([...input.enabledPlatforms]),
+        offices: Object.freeze(input.offices.map((record) => Object.freeze({ ...record }))),
+        migrations: Object.freeze(input.migrations.map((record) => Object.freeze({ ...record }))),
+    });
+}
+function parseState(value, path) {
+    if (!isRecord(value) || value.version !== REGISTRY_VERSION) {
+        throw new Error(`Invalid office registry version at ${path}`);
+    }
+    if (!Array.isArray(value.enabledPlatforms) || !Array.isArray(value.migrations)) {
+        throw new Error(`Invalid office registry shape at ${path}`);
+    }
+    const enabledPlatforms = value.enabledPlatforms.map((platform) => {
+        if (typeof platform !== "string")
+            throw new Error(`Invalid enabled platform in ${path}`);
+        return assertPlatformName(platform);
+    });
+    if (new Set(enabledPlatforms).size !== enabledPlatforms.length) {
+        throw new Error(`Duplicate enabled platform in ${path}`);
+    }
+    // Files written before office records existed simply have no offices yet.
+    const offices = (Array.isArray(value.offices) ? value.offices : []).map((entry) => parseOfficeRecord(entry, path));
+    if (new Set(offices.map((record) => officeKey(record))).size !== offices.length) {
+        throw new Error(`Duplicate office record in ${path}`);
+    }
+    const migrations = value.migrations.map((entry) => parseRecord(entry, path, enabledPlatforms));
+    if (new Set(migrations.map((record) => record.rawConversationId)).size !== migrations.length) {
+        throw new Error(`Duplicate office migration in ${path}`);
+    }
+    return freezeState({ enabledPlatforms, offices, migrations });
+}
+function parseOfficeRecord(value, path) {
+    if (!isRecord(value))
+        throw new Error(`Invalid office record in ${path}`);
+    if (typeof value.platform !== "string" ||
+        typeof value.conversationId !== "string" ||
+        typeof value.recordedAt !== "string") {
+        throw new Error(`Invalid office record fields in ${path}`);
+    }
+    return Object.freeze({
+        platform: assertPlatformName(value.platform),
+        conversationId: assertConversationId(value.conversationId),
+        recordedAt: value.recordedAt,
+    });
+}
+function hasMigrationStrings(value) {
+    return (typeof value.rawConversationId === "string" &&
+        typeof value.sourceDir === "string" &&
+        typeof value.workspaceRoot === "string" &&
+        typeof value.status === "string" &&
+        typeof value.updatedAt === "string");
+}
+/** Validate the fields every stored migration record must carry. */
+function parseMigrationFields(value, path) {
+    if (!hasMigrationStrings(value)) {
+        throw new Error(`Invalid office migration fields in ${path}`);
+    }
+    assertConversationId(value.rawConversationId);
+    if (!isAbsolute(value.sourceDir) || !isAbsolute(value.workspaceRoot)) {
+        throw new Error(`Office migration paths must be absolute in ${path}`);
+    }
+    assertCanonicalSource(value.sourceDir, value.workspaceRoot, value.rawConversationId);
+    if (!MIGRATION_STATUSES.has(value.status)) {
+        throw new Error(`Invalid office migration status in ${path}`);
+    }
+    return {
+        rawConversationId: value.rawConversationId,
+        sourceDir: value.sourceDir,
+        workspaceRoot: value.workspaceRoot,
+        status: value.status,
+        updatedAt: value.updatedAt,
+    };
+}
+/**
+ * Ownership rules by status: `needs-owner` must carry neither owner nor
+ * target, `failed` may carry either, every other status must carry both.
+ */
+function assertOwnershipMatchesStatus(status, ownerPlatform, targetDir, path) {
+    const owned = ownerPlatform !== undefined;
+    const targeted = targetDir !== undefined;
+    if (status === "needs-owner" && (owned || targeted)) {
+        throw new Error(`Needs-owner migration cannot have an owner or target in ${path}`);
+    }
+    if (status !== "needs-owner" && status !== "failed" && !(owned && targeted)) {
+        throw new Error(`Prepared office migration is missing ownership in ${path}`);
+    }
+    if (!owned && targeted) {
+        throw new Error(`Office migration target has no owner in ${path}`);
+    }
+}
+function parseRecord(value, path, enabledPlatforms) {
+    if (!isRecord(value))
+        throw new Error(`Invalid office migration record in ${path}`);
+    const fields = parseMigrationFields(value, path);
+    const ownerPlatform = optionalPlatform(value.ownerPlatform);
+    const targetDir = optionalString(value.targetDir);
+    const error = optionalString(value.error);
+    if (ownerPlatform !== undefined && !enabledPlatforms.includes(ownerPlatform)) {
+        throw new Error(`Office migration owner is not enabled in ${path}`);
+    }
+    assertOwnershipMatchesStatus(fields.status, ownerPlatform, targetDir, path);
+    const expectedTargetDir = ownerPlatform
+        ? officeDir(fields.workspaceRoot, {
+            platform: ownerPlatform,
+            conversationId: fields.rawConversationId,
+        })
+        : undefined;
+    if (targetDir !== expectedTargetDir) {
+        throw new Error(`Office migration target does not match its office address in ${path}`);
+    }
+    if (fields.status === "failed" && !error) {
+        throw new Error(`Failed office migration is missing an error in ${path}`);
+    }
+    return buildMigrationRecord(fields, ownerPlatform, expectedTargetDir, error);
+}
+function buildMigrationRecord(fields, ownerPlatform, targetDir, error) {
+    return makeRecord({
+        rawConversationId: fields.rawConversationId,
+        sourceDir: fields.sourceDir,
+        workspaceRoot: fields.workspaceRoot,
+        ...(ownerPlatform ? { ownerPlatform } : {}),
+        ...(targetDir ? { targetDir } : {}),
+        status: fields.status,
+        ...(error ? { error } : {}),
+        updatedAt: fields.updatedAt,
+    });
+}
+function optionalPlatform(value) {
+    return value === undefined
+        ? undefined
+        : typeof value === "string"
+            ? assertPlatformName(value)
+            : failOptional("platform");
+}
+function optionalString(value) {
+    return value === undefined
+        ? undefined
+        : typeof value === "string"
+            ? value
+            : failOptional("string");
+}
+function failOptional(label) {
+    throw new Error(`Invalid optional ${label} in office registry`);
+}
+function assertSameMigrationInputs(existing, sourceDir, workspaceRoot) {
+    if (existing.sourceDir !== sourceDir || existing.workspaceRoot !== workspaceRoot) {
+        throw new Error(`Legacy office migration inputs changed for ${existing.rawConversationId}`);
+    }
+}
+function assertCanonicalSource(sourceDir, workspaceRoot, rawConversationId) {
+    const expectedSourceDir = resolve(workspaceRoot, rawConversationId);
+    if (sourceDir !== expectedSourceDir) {
+        throw new Error(`Legacy office source must be ${expectedSourceDir}`);
+    }
+    assertRegularDirectory(workspaceRoot, "Workspace root");
+    assertPathIfPresent(sourceDir, "Legacy office source");
+}
+function assertRegularDirectory(path, label) {
+    let stat;
+    try {
+        stat = lstatSync(path);
+    }
+    catch (error) {
+        throw new Error(`${label} does not exist: ${path}`, { cause: error });
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new Error(`${label} must be a regular directory: ${path}`);
+    }
+}
+/** `lstat` that reports a missing path as undefined; other errors still throw. */
+function lstatIfExists(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT"))
+            return undefined;
+        throw error;
+    }
+}
+function assertRegistryFileSafe(path) {
+    const stat = lstatIfExists(path);
+    if (stat && (stat.isSymbolicLink() || !stat.isFile())) {
+        throw new Error(`Office registry must be a regular file: ${path}`);
+    }
+}
+function assertPathIfPresent(path, label) {
+    const stat = lstatIfExists(path);
+    if (stat && (stat.isSymbolicLink() || !stat.isDirectory())) {
+        throw new Error(`${label} must be a regular directory: ${path}`);
+    }
+}
+function assertPathAbsent(path, label) {
+    if (lstatIfExists(path))
+        throw new Error(`${label} must be absent: ${path}`);
+}
+function pathExists(path) {
+    return lstatIfExists(path) !== undefined;
+}
+/** Create the lock directory and stamp it with our token, unwinding on failure. */
+function claimRegistryLock(lockPath, token) {
+    mkdirSync(lockPath, { mode: 0o700 });
+    try {
+        writeFileSync(join(lockPath, "owner"), `${token}\n`, { mode: 0o600 });
+    }
+    catch (error) {
+        rmSync(lockPath, { recursive: true, force: true });
+        throw error;
+    }
+}
+function acquireRegistryLease(lockPath, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    const token = `${process.pid}:${randomBytes(8).toString("hex")}`;
+    for (;;) {
+        try {
+            claimRegistryLock(lockPath, token);
+            return () => releaseRegistryLease(lockPath, token);
+        }
+        catch (error) {
+            awaitFreeRegistryLock(lockPath, deadline, error);
+        }
+    }
+}
+/**
+ * Handle one failed lock attempt: rethrow anything but a held lock, clear a
+ * stale lock so the next attempt wins, else wait until the deadline passes.
+ */
+function awaitFreeRegistryLock(lockPath, deadline, error) {
+    if (!isErrno(error, "EEXIST"))
+        throw error;
+    if (registryLockIsStale(lockPath)) {
+        rmSync(lockPath, { recursive: true, force: true });
+        return;
+    }
+    if (Date.now() >= deadline) {
+        throw new Error(`Timed out acquiring office registry lock: ${lockPath}`, { cause: error });
+    }
+    sleepSync(REGISTRY_LOCK_RETRY_MS);
+}
+function releaseRegistryLease(lockPath, token) {
+    try {
+        if (readFileSync(join(lockPath, "owner"), "utf8").trim() === token) {
+            rmSync(lockPath, { recursive: true, force: true });
+        }
+    }
+    catch (error) {
+        if (!isErrno(error, "ENOENT"))
+            throw error;
+    }
+}
+function registryLockIsStale(lockPath) {
+    let ownerKnown = false;
+    let ownerAlive = false;
+    try {
+        const owner = readFileSync(join(lockPath, "owner"), "utf8").trim();
+        const pid = Number(owner.split(":", 1)[0]);
+        if (Number.isInteger(pid) && pid > 0) {
+            ownerKnown = true;
+            try {
+                process.kill(pid, 0);
+                ownerAlive = true;
+            }
+            catch (error) {
+                if (isErrno(error, "EPERM"))
+                    ownerAlive = true;
+            }
+        }
+    }
+    catch {
+        // The owner file may not have been written before its process died.
+    }
+    try {
+        const oldEnough = Date.now() - statSync(lockPath).mtimeMs >= REGISTRY_LOCK_STALE_MS;
+        return ownerKnown ? !ownerAlive : oldEnough;
+    }
+    catch {
+        return false;
+    }
+}
+function sleepSync(milliseconds) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+// ── raw-id lookups (cold paths: CLI, Admin enumeration) ──────────────────────
+/** Current office inventory, read fresh from disk for cross-process freshness. */
+export function listRegisteredOffices(stateDir) {
+    return new OfficeRegistry(stateDir).getOffices();
+}
+/**
+ * Enabled platforms whose id format could have produced this raw
+ * conversation id. Auto-claiming uses this as verification, not guessing:
+ * every format below is one mikan itself writes (GitHub ids are mikan-derived
+ * slugs; Slack/Telegram/Discord ids are the platforms' own grammars), and a
+ * directory is only claimed when exactly one enabled platform's format
+ * matches. Bare digits stay ambiguous while both Telegram and Discord are
+ * enabled (negative ids are Telegram-only); anything matching no enabled
+ * format fails closed to needs-owner.
+ */
+function platformsMatchingConversationIdFormat(rawConversationId, enabledPlatforms) {
+    return enabledPlatforms.filter((platform) => {
+        switch (platform) {
+            case "github":
+                return isGithubConversationId(rawConversationId);
+            case "telegram":
+                return /^-?\d+$/.test(rawConversationId);
+            case "discord":
+                return /^\d+$/.test(rawConversationId);
+            case "slack":
+                return /^[A-Z][A-Z0-9]*$/.test(rawConversationId);
+        }
+    });
+}
+function isGithubConversationId(rawConversationId) {
+    try {
+        parseGithubConversationId(rawConversationId);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isErrno(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+// ── Boot-time legacy migration ────────────────────────────────────────────────
+/**
+ * Move every legacy raw-id office directory under the workspace root to the
+ * canonical office-key layout, journaling each move through the office
+ * registry so an interrupted run resumes instead of losing offices.
+ *
+ * The engine never guesses: with several enabled platforms an unowned raw
+ * directory stays in place and is reported for `mikan office claim`. Callers
+ * must treat a non-empty `unowned`/`failed` as fatal for daemon boot — after
+ * the layout flip, an unmigrated legacy directory is invisible to the
+ * runtime, which would silently present the conversation as empty.
+ */
+export function migrateLegacyOffices(options) {
+    const registry = new OfficeRegistry(options.stateDir);
+    for (const platform of options.enabledPlatforms)
+        registry.enablePlatform(platform);
+    const summary = {
+        migrated: [],
+        recovered: [],
+        unowned: [],
+        failed: [],
+        vaultKeysMigrated: [],
+        vaultConflicts: [],
+        stateDirsMigrated: [],
+        stateDirConflicts: [],
+    };
+    recoverInterruptedMoves(registry, summary);
+    claimAndMoveLegacyDirs(registry, options.workspaceRoot, summary);
+    // Credential vaults are keyed by office too; the registry inventory (which
+    // the directory moves above just extended) drives the same rename.
+    const vaults = migrateConversationVaultKeys({
+        stateDir: options.stateDir,
+        offices: registry.getOffices(),
+    });
+    summary.vaultKeysMigrated = vaults.migrated;
+    summary.vaultConflicts = vaults.conflicts;
+    for (const rawConversationId of vaults.migrated) {
+        log.logInfo(`[office] Migrated vault key to office key: ${rawConversationId}`);
+    }
+    migrateConversationStateDirs(registry, options.stateDir, summary);
+    for (const record of registry.getState().migrations) {
+        if (record.status === "needs-owner")
+            summary.unowned.push(record.rawConversationId);
+        else if (record.status === "failed")
+            summary.failed.push(record.rawConversationId);
+    }
+    return summary;
+}
+/** Complete or fail every move the journal says was interrupted mid-rename. */
+function recoverInterruptedMoves(registry, summary) {
+    for (const record of registry.getState().migrations) {
+        if (record.status !== "moving")
+            continue;
+        const failure = finishInterruptedMove(record);
+        if (failure) {
+            registry.markFailed(record.rawConversationId, failure);
+            continue;
+        }
+        registry.markCommitted(record.rawConversationId);
+        recordMigratedOffice(registry, record);
+        summary.recovered.push(record.rawConversationId);
+        log.logInfo(`[office] Recovered interrupted migration: ${record.rawConversationId}`);
+    }
+}
+/** Complete one interrupted rename; returns the failure reason when it cannot. */
+function finishInterruptedMove(record) {
+    const targetDir = record.targetDir;
+    if (!targetDir)
+        return "Moving record has no target directory";
+    const sourceExists = pathExists(record.sourceDir);
+    const targetExists = pathExists(targetDir);
+    if (sourceExists && targetExists) {
+        return "Both legacy source and office target exist; merge them manually";
+    }
+    if (!sourceExists && !targetExists)
+        return "Neither legacy source nor office target exists";
+    if (sourceExists)
+        renameSync(record.sourceDir, targetDir);
+    return undefined;
+}
+/**
+ * A legacy directory is claimable unless it already failed (reported via
+ * summary.failed). One that reappears after a committed move is a different
+ * (or resurrected) office the runtime can no longer see, so refusing to boot
+ * beats silently ignoring its data.
+ */
+function isClaimableLegacyDir(registry, workspaceRoot, rawConversationId) {
+    const existing = registry.getMigration(rawConversationId);
+    if (existing?.status === "committed") {
+        throw new Error(`Legacy office directory reappeared after migration: ${join(workspaceRoot, rawConversationId)}`);
+    }
+    return existing?.status !== "failed";
+}
+/** Scan the workspace root and move every claimable legacy office directory. */
+function claimAndMoveLegacyDirs(registry, workspaceRoot, summary) {
+    for (const rawConversationId of listLegacyOfficeDirs(workspaceRoot)) {
+        if (!isClaimableLegacyDir(registry, workspaceRoot, rawConversationId))
+            continue;
+        const record = registry.prepareLegacyMigration({
+            rawConversationId,
+            sourceDir: join(workspaceRoot, rawConversationId),
+            workspaceRoot,
+        });
+        if (record.status === "needs-owner")
+            continue; // reported via summary.unowned
+        const moving = registry.markMoving(rawConversationId);
+        const targetDir = moving.targetDir;
+        if (!targetDir)
+            throw new Error("Moving office migration has no target directory");
+        renameSync(moving.sourceDir, targetDir);
+        registry.markCommitted(rawConversationId);
+        recordMigratedOffice(registry, moving);
+        summary.migrated.push(rawConversationId);
+        log.logInfo(`[office] Migrated office directory: ${rawConversationId} -> ${targetDir}`);
+    }
+}
+/**
+ * Move each registered office's host state tree from
+ * `conversations/<rawId>` to
+ * `conversations/<officeKey>` in one rename. Conflicts are reported for
+ * manual merge, never clobbered.
+ */
+function migrateConversationStateDirs(registry, stateDir, summary) {
+    for (const office of registry.getOffices()) {
+        const legacyDir = join(stateDir, "conversations", office.conversationId);
+        if (!existsSync(legacyDir))
+            continue;
+        const targetDir = officeStateDir(stateDir, office);
+        if (existsSync(targetDir)) {
+            summary.stateDirConflicts.push(office.conversationId);
+            continue;
+        }
+        renameSync(legacyDir, targetDir);
+        summary.stateDirsMigrated.push(office.conversationId);
+        log.logInfo(`[office] Migrated host state dir to office key: ${office.conversationId}`);
+    }
+}
+/** A migrated office is an existing office; keep the directory enumerable. */
+function recordMigratedOffice(registry, record) {
+    if (!record.ownerPlatform)
+        return;
+    registry.recordOffice({
+        platform: record.ownerPlatform,
+        conversationId: record.rawConversationId,
+    });
+}
+/**
+ * Legacy office candidates: regular directories that are not reserved
+ * infrastructure, not hidden, and not already office-key named. A symlink in
+ * office position is refused outright — following it could move data from
+ * outside the workspace root.
+ *
+ * A candidate must also look like a conversation office: every office that
+ * ever saw a message has a `log.jsonl`, and every office that ran the agent
+ * has `sessions/`. Trusted workspace roots legitimately accumulate other
+ * directories — repos the agent cloned, build output — which are not offices
+ * and must be neither renamed nor reported as unowned; they stay where they
+ * are (an operator can still claim one explicitly via `mikan office claim`).
+ */
+function listLegacyOfficeDirs(workspaceRoot) {
+    return readdirSync(workspaceRoot, { withFileTypes: true })
+        .filter((entry) => isLegacyOfficeDir(workspaceRoot, entry))
+        .map((entry) => entry.name)
+        .toSorted();
+}
+function isLegacyOfficeDir(workspaceRoot, entry) {
+    if (entry.name.startsWith("."))
+        return false;
+    if (RESERVED_WORKSPACE_NAMES.has(entry.name))
+        return false;
+    if (isOfficeKey(entry.name))
+        return false;
+    if (entry.isSymbolicLink()) {
+        throw new Error(`Workspace entry must not be a symlink: ${join(workspaceRoot, entry.name)}`);
+    }
+    if (!entry.isDirectory())
+        return false;
+    if (looksLikeConversationOffice(join(workspaceRoot, entry.name)))
+        return true;
+    log.logInfo(`[office] Skipping non-office workspace directory (no log.jsonl or sessions/): ${entry.name}`);
+    return false;
+}
+function looksLikeConversationOffice(dir) {
+    return existsSync(join(dir, "log.jsonl")) || existsSync(join(dir, "sessions"));
+}
+/** Operator-facing boot failure for offices the engine may not move itself. */
+export function formatUnmigratedOfficesError(summary) {
+    const lines = ["Conversation office migration cannot complete:"];
+    if (summary.unowned.length > 0) {
+        lines.push("", "These legacy conversation directories have no owning platform (several", "platforms are enabled, so ownership cannot be inferred):", ...summary.unowned.map((id) => `  - ${id}`), "", "Assign each one with:", "  mikan office claim <conversationId> <platform>");
+    }
+    lines.push(...conflictSection(summary.failed, [
+        "These migrations previously failed and need manual repair (see",
+        "office-registry.json in the state dir for each error):",
+    ]), ...conflictSection(summary.vaultConflicts, [
+        "These conversations have credentials under both the legacy and the",
+        "office-key vault directory; merge them manually under <state-dir>/vaults:",
+    ]), ...conflictSection(summary.stateDirConflicts, [
+        "These conversations have host state under both the legacy and the",
+        "office-key directory; merge them manually under <state-dir>/conversations:",
+    ]));
+    return lines.join("\n");
+}
+/** One blank-separated "these need manual work" block, empty when nothing does. */
+function conflictSection(ids, explanation) {
+    if (ids.length === 0)
+        return [];
+    return ["", ...explanation, ...ids.map((id) => `  - ${id}`)];
+}
+/**
+ * Bind-spec translator for the container layout migration: rewrites every
+ * host path the office migration renamed — workspace dirs, per-conversation
+ * state trees, conversation vaults — and the guest workspace segment, using
+ * the registry's office inventory as the raw-id ↔ office mapping. Specs that
+ * reference none of the renamed paths come back unchanged, which is also how
+ * an already-migrated container is recognized.
+ */
+function replacePrefix(path, pairs) {
+    for (const [oldPrefix, newPrefix] of pairs) {
+        if (path === oldPrefix)
+            return newPrefix;
+        if (path.startsWith(`${oldPrefix}/`))
+            return newPrefix + path.slice(oldPrefix.length);
+    }
+    return path;
+}
+export function buildContainerBindTranslator(options) {
+    const hostPairs = [];
+    const guestPairs = [];
+    for (const office of options.offices) {
+        const key = officeKey(office);
+        const rawId = office.conversationId;
+        hostPairs.push([join(options.workspaceRoot, rawId), join(options.workspaceRoot, key)]);
+        hostPairs.push([
+            join(options.stateDir, "conversations", rawId),
+            officeStateDir(options.stateDir, office),
+        ]);
+        hostPairs.push([
+            join(options.stateDir, "vaults", legacyConversationCredentialKey(rawId)),
+            join(options.stateDir, "vaults", key),
+        ]);
+        guestPairs.push([`/workspace/${rawId}`, `/workspace/${key}`]);
+    }
+    return (bindSpec) => {
+        const readOnly = bindSpec.endsWith(":ro");
+        const spec = readOnly ? bindSpec.slice(0, -3) : bindSpec;
+        const separator = spec.indexOf(":");
+        if (separator === -1)
+            return bindSpec;
+        const source = replacePrefix(spec.slice(0, separator), hostPairs);
+        const target = replacePrefix(spec.slice(separator + 1), guestPairs);
+        return `${source}:${target}${readOnly ? ":ro" : ""}`;
+    };
+}
+//# sourceMappingURL=index.js.map