@groundnuty/macf-channel-server 0.2.10 → 0.2.12

package/dist/checkpoint.d.ts

@@ -0,0 +1,76 @@
+import type { Logger } from '@groundnuty/macf-core';
+import { z } from 'zod';
+export declare const CheckpointToMemoryInputSchema: {
+    readonly session_id: z.ZodString;
+    readonly transcript_path: z.ZodOptional<z.ZodString>;
+    readonly cwd: z.ZodString;
+    readonly trigger: z.ZodOptional<z.ZodEnum<{
+        manual: "manual";
+        auto: "auto";
+    }>>;
+    readonly summary: z.ZodOptional<z.ZodString>;
+};
+export declare const CheckpointToMemoryOutputSchema: {
+    readonly written: z.ZodBoolean;
+    readonly path: z.ZodOptional<z.ZodString>;
+    readonly deduplicated: z.ZodBoolean;
+    readonly reason: z.ZodOptional<z.ZodString>;
+};
+export interface CheckpointToMemoryDeps {
+    readonly selfAgentName: string;
+    readonly logger: Logger;
+    /**
+     * Override for `~/.claude/projects` location. Production code uses
+     * `os.homedir()`; tests inject a temp dir. Optional — when absent,
+     * defaults to `${HOME}/.claude/projects`.
+     */
+    readonly projectsRootOverride?: string;
+    /**
+     * Override for `new Date()` so dedup-naming is testable against
+     * fixed dates. Production: undefined (uses real clock). Test: returns
+     * a fixed Date.
+     */
+    readonly nowOverride?: () => Date;
+}
+export interface CheckpointToMemoryInput {
+    readonly session_id: string;
+    readonly transcript_path?: string;
+    readonly cwd: string;
+    readonly trigger?: 'manual' | 'auto';
+    readonly summary?: string;
+}
+export interface CheckpointToMemoryResult {
+    readonly written: boolean;
+    readonly path?: string;
+    readonly deduplicated: boolean;
+    readonly reason?: string;
+}
+/**
+ * Encode an absolute filesystem path into Claude Code's per-project
+ * directory naming scheme used under `~/.claude/projects/`.
+ *
+ * Empirical scheme (verified by listing existing project dirs in the
+ * env): every `/` is replaced with `-`. The resulting string is the
+ * directory name; no other normalization is applied (case + spaces
+ * preserved).
+ */
+export declare function encodeProjectDir(cwd: string): string;
+/**
+ * Resolve the canonical memory directory for a given project cwd.
+ * Pure function — does not touch the filesystem.
+ */
+export declare function resolveMemoryDir(cwd: string, projectsRoot: string): string;
+/**
+ * Tool body — resolves memory dir, dedups by session-id, writes file.
+ *
+ * Wrapped in OTel span `macf.tool.checkpoint_to_memory` (SpanKind.INTERNAL —
+ * pure local filesystem op, no outbound network) per DR-023 telemetry
+ * pattern. Span attributes mirror the input shape so checkpoint cadence
+ * + outcome are visible in Tempo: trigger, deduplicated, written.
+ *
+ * Non-blocking: any error path resolves with `written: false` + a
+ * `reason` string. Never throws to the caller. The caller (server.ts
+ * tool wrapper) returns `isError: false` so PreCompact proceeds.
+ */
+export declare function checkpointToMemory(deps: CheckpointToMemoryDeps, input: CheckpointToMemoryInput): Promise<CheckpointToMemoryResult>;
+//# sourceMappingURL=checkpoint.d.ts.map

package/dist/checkpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.d.ts","sourceRoot":"","sources":["../src/checkpoint.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,6BAA6B;;;;;;;;;CAWhC,CAAC;AAEX,eAAO,MAAM,8BAA8B;;;;;CASjC,CAAC;AAEX,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE1E;AAwGD;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAmInC"}

package/dist/checkpoint.js

@@ -0,0 +1,322 @@
+/**
+ * `checkpoint_to_memory` MCP tool implementation per macf#271 / DR-023 UC-3.
+ *
+ * Registered on the channel-server's MCP surface; called by Claude Code's
+ * plugin loader when the `PreCompact` hook fires (per
+ * `packages/macf/plugin/hooks/hooks.json`). The tool writes a structured
+ * session-handoff entry to the agent's per-project memory directory
+ * (`~/.claude/projects/<encoded-cwd>/memory/`) so the next session can
+ * read the entry via the standard MEMORY.md index lookup pattern.
+ *
+ * Hook event: `PreCompact` (NOT `Stop`).
+ *
+ * The original macf#271 issue body framed UC-3 as a `Stop` hook. That
+ * was wrong-cadence: per `feedback_stop_hook_fires_on_turn_end_not_session_exit.md`
+ * + Claude Code 2.1.118+ behaviour, `Stop` fires after every LLM turn
+ * completes, not at session exit / before compaction. `/exit` is a TUI-
+ * local command and bypasses Stop hooks entirely. The natural trigger
+ * for "synthesize before context loss" is `PreCompact` — fires before
+ * BOTH `/compact` (manual) and auto-compaction. Confirmed in macf#271
+ * comment exchange between code-agent + science-agent (2026-05-01);
+ * DR-023 §UC-3 amendment in this PR codifies the resolution.
+ *
+ * Failure semantics (per DR-023 §UC-3 + §"Failure-mode contract"):
+ *
+ *   The hook layer is observational + non-blocking by default. Memory
+ *   directory missing, file write failure, malformed input — all log a
+ *   diagnostic event and return `{written: false, reason}` to the hook
+ *   without raising. The caller (server.ts tool wrapper) returns
+ *   `isError: false` regardless so the PreCompact event always proceeds.
+ *   A failed checkpoint is recoverable: the operator can manually
+ *   author a handoff entry post-compaction (the existing
+ *   `synthesize-before-compaction` discipline).
+ *
+ *   Critically: the hook MUST NOT block compaction even on failure.
+ *   PreCompact CAN block (`{decision: "block", reason}`) but the design
+ *   choice here is observational — checkpoint is best-effort, missing
+ *   one is a lost paragraph, not a safety violation.
+ */
+import { writeFile, mkdir, readdir, readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { context, SpanKind, SpanStatusCode, trace } from '@opentelemetry/api';
+import { SpanNames, Attr, GenAiAttr } from './tracing.js';
+export const CheckpointToMemoryInputSchema = {
+    session_id: z.string().min(1)
+        .describe('Claude Code session identifier (UUID). Substituted from PreCompact hook input ${session_id}.'),
+    transcript_path: z.string().optional()
+        .describe('Absolute path to session transcript (jsonl). Substituted from ${transcript_path}.'),
+    cwd: z.string().min(1)
+        .describe('Workspace directory the session is operating in. Substituted from ${cwd}. Used to resolve the per-project memory directory.'),
+    trigger: z.enum(['manual', 'auto']).optional()
+        .describe('What triggered compaction — "manual" (`/compact` invocation) or "auto" (token threshold). Substituted from PreCompact matcher.'),
+    summary: z.string().optional()
+        .describe('Optional human-authored synthesis text to embed in the checkpoint body. When omitted, a stub body is written with metadata only — the LLM can populate it post-compaction or operator can author manually.'),
+};
+export const CheckpointToMemoryOutputSchema = {
+    written: z.boolean()
+        .describe('True if the checkpoint file was successfully written to disk.'),
+    path: z.string().optional()
+        .describe('Absolute path of the written or updated checkpoint file. Present when `written=true`.'),
+    deduplicated: z.boolean()
+        .describe('True if a pre-existing checkpoint for this session_id was updated (rather than a new file created).'),
+    reason: z.string().optional()
+        .describe('Diagnostic reason when `written=false`. Present on failure paths only.'),
+};
+/**
+ * Encode an absolute filesystem path into Claude Code's per-project
+ * directory naming scheme used under `~/.claude/projects/`.
+ *
+ * Empirical scheme (verified by listing existing project dirs in the
+ * env): every `/` is replaced with `-`. The resulting string is the
+ * directory name; no other normalization is applied (case + spaces
+ * preserved).
+ */
+export function encodeProjectDir(cwd) {
+    return cwd.replace(/\//g, '-');
+}
+/**
+ * Resolve the canonical memory directory for a given project cwd.
+ * Pure function — does not touch the filesystem.
+ */
+export function resolveMemoryDir(cwd, projectsRoot) {
+    return join(projectsRoot, encodeProjectDir(cwd), 'memory');
+}
+/** Format YYYY_MM_DD per `project_session_handoff_<date>.md` convention. */
+function formatDate(d) {
+    const yyyy = d.getUTCFullYear().toString().padStart(4, '0');
+    const mm = (d.getUTCMonth() + 1).toString().padStart(2, '0');
+    const dd = d.getUTCDate().toString().padStart(2, '0');
+    return `${yyyy}_${mm}_${dd}`;
+}
+/**
+ * Look for a pre-existing checkpoint with the same `originSessionId`
+ * in this memory directory. If found, return its absolute path so the
+ * caller can OVERWRITE it (deduplication: PreCompact may fire multiple
+ * times in a single session for sequential auto-compactions). If
+ * not found, return undefined.
+ *
+ * Scans only files matching the `project_session_handoff_*.md` glob
+ * to keep cost bounded (memory dirs accumulate ~50-100 entries; reading
+ * all of them on every PreCompact would be wasteful).
+ */
+async function findExistingCheckpoint(memoryDir, sessionId) {
+    let entries;
+    try {
+        entries = await readdir(memoryDir);
+    }
+    catch {
+        return undefined;
+    }
+    for (const entry of entries) {
+        if (!entry.startsWith('project_session_handoff_') || !entry.endsWith('.md')) {
+            continue;
+        }
+        const fullPath = join(memoryDir, entry);
+        let body;
+        try {
+            body = await readFile(fullPath, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        // Frontmatter is YAML at top of file: ---\n...\n---
+        // Look for `originSessionId: <sessionId>` line within first ~20
+        // lines (frontmatter is short by convention).
+        const head = body.split('\n', 25).join('\n');
+        if (head.includes(`originSessionId: ${sessionId}`)) {
+            return fullPath;
+        }
+    }
+    return undefined;
+}
+/**
+ * Build the checkpoint markdown body. Frontmatter follows the existing
+ * `project_session_handoff_*.md` convention (verified against actual
+ * memory entries: name, description, type=project, originSessionId).
+ *
+ * Body shape: when `summary` provided, embeds it directly. Without
+ * summary, writes a minimal-stub body so the file is well-formed +
+ * findable; future tools can append.
+ *
+ * Why ISO-8601 date in the description: matches the existing entries'
+ * pattern (e.g., "2026-04-30 session handoff — three release cycles
+ * (v0.2.5 → v0.2.7) ...") so the MEMORY.md index renders consistently
+ * if/when an entry for this checkpoint is added.
+ */
+function buildCheckpointBody(input, agentName, date) {
+    const isoDate = date.toISOString();
+    const dateOnly = formatDate(date).replace(/_/g, '-');
+    const trigger = input.trigger ?? 'unknown';
+    const transcriptLine = input.transcript_path !== undefined
+        ? `\n- transcript: \`${input.transcript_path}\``
+        : '';
+    const description = `Auto-checkpoint written by ${agentName} on ${dateOnly} via PreCompact hook (trigger=${trigger}).`;
+    const bodyContent = input.summary !== undefined && input.summary.length > 0
+        ? input.summary
+        : '_Auto-checkpoint stub — body not populated by hook input. The next session reads this frontmatter for session-id correlation; populate the body manually if a synthesis paragraph is needed._';
+    return `---
+name: ${dateOnly} session checkpoint (PreCompact auto-write)
+description: ${description}
+type: project
+originSessionId: ${input.session_id}
+---
+**Auto-checkpoint** written by \`${agentName}\` at \`${isoDate}\` via PreCompact hook (DR-023 UC-3).
+
+## Session metadata
+
+- agent: \`${agentName}\`
+- session_id: \`${input.session_id}\`
+- cwd: \`${input.cwd}\`
+- trigger: \`${trigger}\`${transcriptLine}
+
+## Body
+
+${bodyContent}
+`;
+}
+/**
+ * Tool body — resolves memory dir, dedups by session-id, writes file.
+ *
+ * Wrapped in OTel span `macf.tool.checkpoint_to_memory` (SpanKind.INTERNAL —
+ * pure local filesystem op, no outbound network) per DR-023 telemetry
+ * pattern. Span attributes mirror the input shape so checkpoint cadence
+ * + outcome are visible in Tempo: trigger, deduplicated, written.
+ *
+ * Non-blocking: any error path resolves with `written: false` + a
+ * `reason` string. Never throws to the caller. The caller (server.ts
+ * tool wrapper) returns `isError: false` so PreCompact proceeds.
+ */
+export async function checkpointToMemory(deps, input) {
+    const tracer = trace.getTracer('macf');
+    return tracer.startActiveSpan(SpanNames.ToolCheckpointToMemory, {
+        kind: SpanKind.INTERNAL,
+        attributes: {
+            [GenAiAttr.System]: 'macf',
+            [GenAiAttr.OperationName]: 'checkpoint_to_memory',
+            [Attr.CheckpointTrigger]: input.trigger ?? 'unknown',
+        },
+    }, async (span) => {
+        try {
+            const projectsRoot = deps.projectsRootOverride
+                ?? join(homedir(), '.claude', 'projects');
+            const memoryDir = resolveMemoryDir(input.cwd, projectsRoot);
+            // Ensure dir exists. mkdir recursive is idempotent.
+            try {
+                await mkdir(memoryDir, { recursive: true });
+            }
+            catch (err) {
+                const reason = `mkdir_failed: ${err instanceof Error ? err.message : String(err)}`;
+                deps.logger.warn('checkpoint_mkdir_failed', {
+                    memory_dir: memoryDir,
+                    error: reason,
+                });
+                span.setAttribute(Attr.CheckpointWritten, false);
+                span.setStatus({ code: SpanStatusCode.OK });
+                return { written: false, deduplicated: false, reason };
+            }
+            // Dedup: if an existing entry has originSessionId === input.session_id,
+            // overwrite it. Otherwise allocate a fresh path. Naming pattern matches
+            // existing convention `project_session_handoff_<YYYY_MM_DD>.md`; if
+            // multiple session-ids hit the same date, the second (and later) get
+            // a short-session-id suffix to avoid collision.
+            const existing = await findExistingCheckpoint(memoryDir, input.session_id);
+            const now = (deps.nowOverride ?? (() => new Date()))();
+            let targetPath;
+            let deduplicated;
+            if (existing !== undefined) {
+                targetPath = existing;
+                deduplicated = true;
+            }
+            else {
+                deduplicated = false;
+                const baseName = `project_session_handoff_${formatDate(now)}.md`;
+                const base = join(memoryDir, baseName);
+                // If `base` exists and belongs to a DIFFERENT session, suffix
+                // with the first 8 chars of the session-id so two sessions in
+                // a single calendar-date both land cleanly.
+                let collides = false;
+                try {
+                    const existingBody = await readFile(base, 'utf8');
+                    const head = existingBody.split('\n', 25).join('\n');
+                    // Different session-id already at the canonical path
+                    if (!head.includes(`originSessionId: ${input.session_id}`)) {
+                        collides = true;
+                    }
+                    else {
+                        // Same session-id; the readdir scan above should have caught
+                        // this — fallthrough to overwrite (defensive: still a write).
+                        targetPath = base;
+                        const body = buildCheckpointBody(input, deps.selfAgentName, now);
+                        await writeFile(targetPath, body, 'utf8');
+                        span.setAttribute(Attr.CheckpointWritten, true);
+                        span.setAttribute(Attr.CheckpointDeduplicated, true);
+                        span.setStatus({ code: SpanStatusCode.OK });
+                        deps.logger.info('checkpoint_written', {
+                            path: targetPath,
+                            session_id: input.session_id,
+                            deduplicated: 'true',
+                        });
+                        return { written: true, path: targetPath, deduplicated: true };
+                    }
+                }
+                catch {
+                    // ENOENT or read error → no collision; use base.
+                    collides = false;
+                }
+                if (collides) {
+                    const shortSid = input.session_id.slice(0, 8);
+                    targetPath = join(memoryDir, `project_session_handoff_${formatDate(now)}_${shortSid}.md`);
+                }
+                else {
+                    targetPath = base;
+                }
+            }
+            const body = buildCheckpointBody(input, deps.selfAgentName, now);
+            try {
+                await writeFile(targetPath, body, 'utf8');
+            }
+            catch (err) {
+                const reason = `write_failed: ${err instanceof Error ? err.message : String(err)}`;
+                deps.logger.warn('checkpoint_write_failed', {
+                    path: targetPath,
+                    error: reason,
+                });
+                span.setAttribute(Attr.CheckpointWritten, false);
+                span.setStatus({ code: SpanStatusCode.OK });
+                return { written: false, deduplicated, reason };
+            }
+            span.setAttribute(Attr.CheckpointWritten, true);
+            span.setAttribute(Attr.CheckpointDeduplicated, deduplicated);
+            span.setStatus({ code: SpanStatusCode.OK });
+            deps.logger.info('checkpoint_written', {
+                path: targetPath,
+                session_id: input.session_id,
+                deduplicated: deduplicated ? 'true' : 'false',
+            });
+            return { written: true, path: targetPath, deduplicated };
+        }
+        catch (err) {
+            // Defense-in-depth: any unexpected throw inside the body still
+            // surfaces as a non-blocking outcome to the caller.
+            span.recordException(err);
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: err instanceof Error ? err.message : String(err),
+            });
+            const reason = `unexpected_error: ${err instanceof Error ? err.message : String(err)}`;
+            deps.logger.error('checkpoint_unexpected_error', {
+                error: reason,
+            });
+            return { written: false, deduplicated: false, reason };
+        }
+        finally {
+            span.end();
+        }
+    });
+}
+// Suppress unused-import lint for `context` — kept for future
+// trace-correlation use (parent-span handoff) symmetric with notify-peer.ts.
+void context;
+//# sourceMappingURL=checkpoint.js.map

package/dist/checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../src/checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAC1B,QAAQ,CAAC,8FAA8F,CAAC;IAC3G,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACnC,QAAQ,CAAC,mFAAmF,CAAC;IAChG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SACnB,QAAQ,CAAC,6HAA6H,CAAC;IAC1I,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC3C,QAAQ,CAAC,gIAAgI,CAAC;IAC7I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC3B,QAAQ,CAAC,4MAA4M,CAAC;CACjN,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;SACjB,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACxB,QAAQ,CAAC,uFAAuF,CAAC;IACpG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;SACtB,QAAQ,CAAC,qGAAqG,CAAC;IAClH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC1B,QAAQ,CAAC,wEAAwE,CAAC;CAC7E,CAAC;AAkCX;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,YAAoB;IAChE,OAAO,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,SAAS,UAAU,CAAC,CAAO;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,GAAG,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,SAAiB;IAEjB,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,oDAAoD;QACpD,gEAAgE;QAChE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,SAAS,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,mBAAmB,CAC1B,KAA8B,EAC9B,SAAiB,EACjB,IAAU;IAEV,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC;IAC3C,MAAM,cAAc,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS;QACxD,CAAC,CAAC,qBAAqB,KAAK,CAAC,eAAe,IAAI;QAChD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GAAG,8BAA8B,SAAS,OAAO,QAAQ,iCAAiC,OAAO,IAAI,CAAC;IACvH,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACzE,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,+LAA+L,CAAC;IAEpM,OAAO;QACD,QAAQ;eACD,WAAW;;mBAEP,KAAK,CAAC,UAAU;;mCAEA,SAAS,WAAW,OAAO;;;;aAIjD,SAAS;kBACJ,KAAK,CAAC,UAAU;WACvB,KAAK,CAAC,GAAG;eACL,OAAO,KAAK,cAAc;;;;EAIvC,WAAW;CACZ,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B,EAC5B,KAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,eAAe,CAC3B,SAAS,CAAC,sBAAsB,EAChC;QACE,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,UAAU,EAAE;YACV,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM;YAC1B,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,sBAAsB;YACjD,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;SACrD;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB;mBACzC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAE5D,oDAAoD;YACpD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;oBAC1C,UAAU,EAAE,SAAS;oBACrB,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzD,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,oEAAoE;YACpE,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAE3E,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACvD,IAAI,UAAkB,CAAC;YACvB,IAAI,YAAqB,CAAC;YAC1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,UAAU,GAAG,QAAQ,CAAC;gBACtB,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,KAAK,CAAC;gBACrB,MAAM,QAAQ,GAAG,2BAA2B,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;gBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACvC,8DAA8D;gBAC9D,8DAA8D;gBAC9D,4CAA4C;gBAC5C,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAClD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACrD,qDAAqD;oBACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;wBAC3D,QAAQ,GAAG,IAAI,CAAC;oBAClB,CAAC;yBAAM,CAAC;wBACN,6DAA6D;wBAC7D,8DAA8D;wBAC9D,UAAU,GAAG,IAAI,CAAC;wBAClB,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;wBACjE,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;wBAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;wBAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;wBACrD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;4BACrC,IAAI,EAAE,UAAU;4BAChB,UAAU,EAAE,KAAK,CAAC,UAAU;4BAC5B,YAAY,EAAE,MAAM;yBACrB,CAAC,CAAC;wBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;oBACjE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iDAAiD;oBACjD,QAAQ,GAAG,KAAK,CAAC;gBACnB,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC9C,UAAU,GAAG,IAAI,CACf,SAAS,EACT,2BAA2B,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAC5D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,IAAI,CAAC;gBACpB,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;oBAC1C,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YAClD,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;gBACrC,IAAI,EAAE,UAAU;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;aAC9C,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,oDAAoD;YACpD,IAAI,CAAC,eAAe,CAAC,GAAY,CAAC,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,cAAc,CAAC,KAAK;gBAC1B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC/C,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACzD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,6EAA6E;AAC7E,KAAK,OAAO,CAAC"}

package/dist/refresh-aware-client.d.ts

@@ -0,0 +1,15 @@
+import type { GitHubVariablesClient, Logger } from '@groundnuty/macf-core';
+import type { TokenRefresher } from './token-refresh.js';
+export interface RefreshAwareClientDeps {
+    readonly pathPrefix: string;
+    readonly tokenRefresher: TokenRefresher;
+    readonly logger: Logger;
+}
+/**
+ * Wrap a path-prefix + token-refresher into a `GitHubVariablesClient`
+ * that auto-refreshes on 401. Drop-in replacement for the bare
+ * `createGitHubClient(pathPrefix, token)` call in `server.ts` —
+ * passes through the existing Registry.create chain unchanged.
+ */
+export declare function createRefreshAwareClient(deps: RefreshAwareClientDeps): GitHubVariablesClient;
+//# sourceMappingURL=refresh-aware-client.d.ts.map

package/dist/refresh-aware-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-aware-client.d.ts","sourceRoot":"","sources":["../src/refresh-aware-client.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,sBAAsB,GAC3B,qBAAqB,CA+CvB"}

package/dist/refresh-aware-client.js

@@ -0,0 +1,82 @@
+/**
+ * Refresh-aware wrapper around `GitHubVariablesClient` (macf#317).
+ *
+ * Decorates a base client with two behaviors:
+ *
+ *  1. **Pre-call refresh** — every method invocation calls
+ *     `tokenRefresher.getRefreshedToken()` to get a current token + builds
+ *     a fresh inner client. The cache inside `tokenRefresher` keeps this
+ *     cheap (no fresh mint within ~50 min of last refresh).
+ *
+ *  2. **401 retry with force-refresh** — if the inner call throws
+ *     `GitHubApiError` with `status === 401`, the wrapper invokes
+ *     `getRefreshedToken({ forceRefresh: true })` (bypasses cache),
+ *     rebuilds the inner client, and retries the call once. A second 401
+ *     bubbles up — the issue isn't expiry but a different auth problem
+ *     (revoked App, deleted installation, etc).
+ *
+ * Why decorate at the GitHubVariablesClient layer (not the Registry layer):
+ * the Registry interface is project-business-logic (register/get/list/
+ * remove for agents). The token-stale failure surfaces at the lower
+ * (HTTP/auth) layer. Decorating at the lower layer keeps the failure-
+ * recovery surface small + uniform across all 4 Registry methods, plus
+ * the `/sign` flow's `varsClient`. One wrapper, all callers benefit.
+ *
+ * Note on closure-capture: the inner client built by `createGitHubClient`
+ * captures the token in its closure — there's no mutable token slot. So
+ * "rebuild the inner client when the token changes" is the cheapest +
+ * cleanest change. Builds are pure-function pricing (~microseconds);
+ * negligible vs the network round-trip.
+ */
+import { createGitHubClient, GitHubApiError } from '@groundnuty/macf-core';
+/**
+ * Wrap a path-prefix + token-refresher into a `GitHubVariablesClient`
+ * that auto-refreshes on 401. Drop-in replacement for the bare
+ * `createGitHubClient(pathPrefix, token)` call in `server.ts` —
+ * passes through the existing Registry.create chain unchanged.
+ */
+export function createRefreshAwareClient(deps) {
+    const { pathPrefix, tokenRefresher, logger } = deps;
+    /**
+     * Per-call: get token (cached or fresh), build inner client, invoke fn.
+     * On 401, force-refresh + rebuild + retry once. Anything else propagates.
+     */
+    async function withRefresh(label, fn) {
+        const initialToken = await tokenRefresher.getRefreshedToken();
+        const inner = createGitHubClient(pathPrefix, initialToken);
+        try {
+            return await fn(inner);
+        }
+        catch (err) {
+            // GitHubApiError carries status; 401 means token-related auth
+            // failure (expired, revoked, missing perm). Other GitHubApiError
+            // statuses (404, 422, 5xx) aren't auth-related; let them through.
+            if (err instanceof GitHubApiError && err.status === 401) {
+                logger.warn('github_api_401_refreshing_and_retrying', {
+                    method: label,
+                });
+                const freshToken = await tokenRefresher.getRefreshedToken({
+                    forceRefresh: true,
+                });
+                const fresh = createGitHubClient(pathPrefix, freshToken);
+                return await fn(fresh);
+            }
+            throw err;
+        }
+    }
+    return {
+        async writeVariable(name, value) {
+            await withRefresh('writeVariable', (c) => c.writeVariable(name, value));
+        },
+        async readVariable(name) {
+            return withRefresh('readVariable', (c) => c.readVariable(name));
+        },
+        async listVariables() {
+            return withRefresh('listVariables', (c) => c.listVariables());
+        },
+        async deleteVariable(name) {
+            await withRefresh('deleteVariable', (c) => c.deleteVariable(name));
+        },
+    };
+}
+//# sourceMappingURL=refresh-aware-client.js.map

package/dist/refresh-aware-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-aware-client.js","sourceRoot":"","sources":["../src/refresh-aware-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAU3E;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAA4B;IAE5B,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEpD;;;OAGG;IACH,KAAK,UAAU,WAAW,CACxB,KAAa,EACb,EAAgD;QAEhD,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,iEAAiE;YACjE,kEAAkE;YAClE,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBACpD,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,iBAAiB,CAAC;oBACxD,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBACzD,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,KAAa;YAC7C,MAAM,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,IAAY;YAC7B,OAAO,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,aAAa;YACjB,OAAO,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAY;YAC/B,MAAM,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server.js

@@ -13,10 +13,11 @@ import { createLogger } from '@groundnuty/macf-core';
 import { createMcpChannel } from './mcp.js';
 import { createHealthState } from './health.js';
 import { createHttpsServer } from './https.js';
-import { createRegistryFromConfig } from '@groundnuty/macf-core';
+import { createRegistry, createRegistryFromConfig } from '@groundnuty/macf-core';
 import { checkCollision, CollisionError } from './collision.js';
 import { registerShutdownHandler } from './shutdown.js';
-import { generateToken } from '@groundnuty/macf-core';
+import { createTokenRefresher } from './token-refresh.js';
+import { createRefreshAwareClient } from './refresh-aware-client.js';
 import { createChallenge, verifyAndConsumeChallenge } from '@groundnuty/macf-core';
 import { createChallengeStore } from '@groundnuty/macf-core';
 import { signCSR } from '@groundnuty/macf-core';
@@ -138,24 +139,83 @@ async function main() {
                 });
             }
         };
-        // P2: Generate token early — needed for /sign endpoint and registry
-        const token = await generateToken();
-        const registry = createRegistryFromConfig(config.registry, config.project, token);
-        const { createGitHubClient } = await import('@groundnuty/macf-core');
-        // Build the variables client for the /sign challenge flow
-        let signPathPrefix;
-        switch (config.registry.type) {
-            case 'org':
-                signPathPrefix = `/orgs/${config.registry.org}`;
-                break;
-            case 'profile':
-                signPathPrefix = `/repos/${config.registry.user}/${config.registry.user}`;
-                break;
-            case 'repo':
-                signPathPrefix = `/repos/${config.registry.owner}/${config.registry.repo}`;
-                break;
+        // P2: Build the project registry + (GitHub-mode only) /sign varsClient.
+        //
+        // Pre-macf#317 this section also called `await generateToken()` to
+        // mint a static token + pass it into `createRegistryFromConfig` +
+        // `createGitHubClient`. The token-refresh wrapper now handles minting
+        // lazily (first call to `tokenRefresher.getRefreshedToken()`) — we
+        // don't pre-mint here because the refresh-aware client mints on first
+        // use anyway, and pre-minting wouldn't improve startup signal.
+        //
+        // DR-024 / macf#322: local-registry mode dispatches via
+        // `createRegistryFromConfig` (which routes 'local' to LocalRegistryClient)
+        // instead of building a refresh-aware GitHub Variables client. The
+        // `/sign` challenge-response endpoint is structurally inactive in
+        // local mode — operators pre-share the CA via filesystem perms, so
+        // there is no challenge to verify. `onSign` returns a 503 with a
+        // diagnostic body pointing at the local-mode trust model (DR-024
+        // §"/sign endpoint disabled in local mode" — Return 404 with diagnostic
+        // body strategy chosen so peers that mistakenly try challenge-response
+        // get a clear error rather than a connection-refused).
+        const isLocalRegistry = config.registry.type === 'local';
+        // macf#317: in-runner token refresh. The refresher caches the current
+        // token in-process; on each call it returns cached if age < 50min,
+        // else mints fresh via macf-gh-token.sh. On 401 from a downstream API
+        // call, the refresh-aware client retries once with forceRefresh: true.
+        // This closes the >1hr-session expiry gap (silent-fallback Instance 1
+        // expiry sub-case) — the cv-architect 401 at 67min uptime witnessed
+        // 2026-05-01 was the motivating incident.
+        // No-op in local mode (no token to mint) — but constructed unconditionally
+        // because subsequent code paths take the refresher reference; the
+        // refresher itself only fires on first `getRefreshedToken()` call.
+        const tokenRefresher = createTokenRefresher({ logger });
+        let registry;
+        let varsClient;
+        if (isLocalRegistry) {
+            // DR-024 §"Decision rule for future PRs" 2: factory dispatch on
+            // `registry.type`. The empty token argument is unused for local
+            // (LocalRegistryClient ignores it) — kept positional for call-surface
+            // symmetry across all four variants.
+            registry = createRegistryFromConfig(config.registry, config.project, '');
+            // varsClient stays undefined; /sign is structurally inactive.
+        }
+        else {
+            // TypeScript narrowed `config.registry.type` to `repo|org|profile`
+            // by virtue of the `isLocalRegistry` check above. The exhaustive
+            // switch over the narrowed union still fails the build if a fifth
+            // GitHub-backed variant is ever added — same coverage as the
+            // pre-DR-024 form.
+            let signPathPrefix;
+            switch (config.registry.type) {
+                case 'org':
+                    signPathPrefix = `/orgs/${config.registry.org}`;
+                    break;
+                case 'profile':
+                    signPathPrefix = `/repos/${config.registry.user}/${config.registry.user}`;
+                    break;
+                case 'repo':
+                    signPathPrefix = `/repos/${config.registry.owner}/${config.registry.repo}`;
+                    break;
+            }
+            // Project-registry path prefix differs from /sign prefix only in the
+            // org case (registry uses /orgs/<org> too — same shape). Re-derive
+            // here for clarity even though it's identical to signPathPrefix.
+            const registryClient = createRefreshAwareClient({
+                pathPrefix: signPathPrefix,
+                tokenRefresher,
+                logger,
+            });
+            registry = createRegistry(registryClient, config.project);
+            // Build the variables client for the /sign challenge flow with the
+            // same refresh-aware wrapping. Stop hook + /sign both 401 after the
+            // 1-hour token TTL absent this fix.
+            varsClient = createRefreshAwareClient({
+                pathPrefix: signPathPrefix,
+                tokenRefresher,
+                logger,
+            });
         }
-        const varsClient = createGitHubClient(signPathPrefix, token);
         // In-memory challenge store (DR-010, #80). Process-local; server restart
         // between step 1 and step 2 of a flow invalidates outstanding challenges.
         const challengeStore = createChallengeStore();
@@ -163,6 +223,16 @@ async function main() {
         // Step 1: allocate challenge, return id + instruction (no registry write).
         // Step 2: verify challenge_id + registry-observed value, sign CSR.
         const onSign = async (request) => {
+            // DR-024 §"/sign endpoint disabled in local mode": local-registry
+            // mode has no GitHub-mediated identity proof. Reject with a clear
+            // 404 + diagnostic body so peers that mistakenly hit /sign see why
+            // it's not part of the trust path here.
+            if (varsClient === undefined) {
+                throw new HttpError(404, '/sign is disabled in local-registry mode (DR-024). ' +
+                    'Local mode uses pre-shared CA via filesystem permissions; ' +
+                    'there is no challenge-response trust path.');
+            }
+            const sharedVarsClient = varsClient;
             // Try to load CA key — if not available, this agent can't sign.
             let ca;
             try {
@@ -194,7 +264,7 @@ async function main() {
                 agentName: request.agent_name,
                 challengeId: request.challenge_id,
                 store: challengeStore,
-                client: varsClient,
+                client: sharedVarsClient,
             });
             if (result === 'mismatch') {
                 // Generic error — do not leak which check failed (no oracle for
@@ -259,6 +329,42 @@ async function main() {
                 isError: result.peers_attempted > 0 && result.peers_delivered === 0,
             };
         });
+        // macf#271 / DR-023 UC-3: register checkpoint_to_memory MCP tool on
+        // the same MCP channel. Hook event is PreCompact (NOT Stop, despite
+        // the issue's original framing — see DR-023 §UC-3 amendment + the
+        // checkpoint.ts file-header for the reframe rationale). Tool writes
+        // a session-handoff file to the agent's per-project memory directory
+        // under `~/.claude/projects/<encoded-cwd>/memory/`. Failure-mode is
+        // observational + non-blocking: any error path returns
+        // `{written: false, reason}` and `isError: false` so PreCompact
+        // proceeds (a missed checkpoint is recoverable; blocking compaction
+        // is not).
+        const { checkpointToMemory, CheckpointToMemoryInputSchema, CheckpointToMemoryOutputSchema, } = await import('./checkpoint.js');
+        const checkpointDeps = {
+            selfAgentName: config.agentName,
+            logger,
+        };
+        mcp.mcp.registerTool('checkpoint_to_memory', {
+            description: 'Write a session-handoff checkpoint to the agent\'s per-project ' +
+                'memory directory. Invoked by the PreCompact hook (DR-023 UC-3) before context ' +
+                'compaction so the next session can read structured handoff state via the ' +
+                'MEMORY.md index pattern. Failure-mode is observational + non-blocking — write ' +
+                'failures log + return `{written: false, reason}` to the hook without raising; ' +
+                'compaction always proceeds.',
+            inputSchema: CheckpointToMemoryInputSchema,
+            outputSchema: CheckpointToMemoryOutputSchema,
+        }, async (input) => {
+            const result = await checkpointToMemory(checkpointDeps, input);
+            return {
+                content: [{ type: 'text', text: JSON.stringify(result) }],
+                structuredContent: { ...result },
+                // Per DR-023 §UC-3: PreCompact is best-effort. Even on
+                // write-failure, surface isError:false so compaction proceeds.
+                // The `reason` field in structured output is sufficient signal
+                // for LLM self-correction in subsequent turns.
+                isError: false,
+            };
+        });
         // P1: Connect MCP channel
         await mcp.connect();
         // P1: Bind port

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA,mEAAmE;AACnE,kEAAkE;AAClE,2DAA2D;AAC3D,uEAAuE;AACvE,qEAAqE;AACrE,8CAA8C;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAiB7C,KAAK,UAAU,IAAI;IACjB,gEAAgE;IAChE,2CAA2C;IAC3C,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,aAAa,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;IAEH,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,0BAA0B;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,IAAI,EAAG,GAAyB,CAAC,IAAI,IAAI,SAAS;SACnD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,UAAU;QACzB,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAErE,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAsB,EAAiB,EAAE;YAC/D,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,YAAY;aAC5B,CAAC,CAAC;YAEH,kEAAkE;YAClE,+DAA+D;YAC/D,kCAAkC;YAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,eAAe,CAC1B,SAAS,CAAC,OAAO,EACjB,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAC3B,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC1C,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,eAAe,CAAC,GAAY,CAAC,CAAC;oBACnC,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,cAAc,CAAC,KAAK;wBAC1B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBAC1D,CAAC,CAAC;oBACH,MAAM,GAAG,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,CAAC;YACH,CAAC,CACF,CAAC;YACF,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAE5B,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,YAAY;aAC5B,CAAC,CAAC;YAEH,kEAAkE;YAClE,0DAA0D;YAC1D,+DAA+D;YAC/D,6DAA6D;YAC7D,8DAA8D;YAC9D,+DAA+D;YAC/D,6DAA6D;YAC7D,iDAAiD;YACjD,EAAE;YACF,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,kEAAkE;YAClE,+DAA+D;YAC/D,6DAA6D;YAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;oBAC/B,MAAM,EAAE,iCAAiC;oBACzC,MAAM,EAAE,6FAA6F;iBACtG,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7C,2DAA2D;gBAC3D,uDAAuD;gBACvD,8DAA8D;gBAC9D,WAAW,CAAC,OAAO,EAAE;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,MAAM,EAAE,MAAM,CAAC,UAAU;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;oBAC/B,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,0BAA0B;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,oEAAoE;QACpE,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAErE,0DAA0D;QAC1D,IAAI,cAAsB,CAAC;QAC3B,QAAQ,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7B,KAAK,KAAK;gBAAE,cAAc,GAAG,SAAS,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAAC,MAAM;YACnE,KAAK,SAAS;gBAAE,cAAc,GAAG,UAAU,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM;YACjG,KAAK,MAAM;gBAAE,cAAc,GAAG,UAAU,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAAC,MAAM;QACjG,CAAC;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAE7D,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;QAE9C,iEAAiE;QACjE,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,EAAE,OAAoB,EAAoC,EAAE;YAC9E,gEAAgE;YAChE,IAAI,EAAuC,CAAC;YAC5C,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;YACjE,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC5B,iEAAiE;gBACjE,MAAM,SAAS,GAAG,eAAe,CAAC;oBAChC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,KAAK,EAAE,cAAc;iBACtB,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,YAAY,EAAE,SAAS,CAAC,WAAW;iBACpC,CAAC,CAAC;gBACH,OAAO;oBACL,YAAY,EAAE,SAAS,CAAC,WAAW;oBACnC,WAAW,EAAE,SAAS,CAAC,WAAW;iBACnC,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;gBAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,WAAW,EAAE,OAAO,CAAC,YAAa;gBAClC,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YAEH,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,gEAAgE;gBAChE,gEAAgE;gBAChE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;gBACzE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YAE3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,SAAS,EAAE,EAAE,CAAC,OAAO;gBACrB,QAAQ,EAAE,EAAE,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC;QAEF,MAAM,WAAW,GAAG,iBAAiB,CAAC;YACpC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ;YACR,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;YAClC,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEH,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,gEAAgE;QAChE,kEAAkE;QAClE,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACvG,MAAM,cAAc,GAAG;YACrB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,SAAS;YAC/B,iBAAiB,EAAE,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;YAC7D,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;YAC3D,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;YAClD,MAAM;SACP,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,YAAY,CAClB,aAAa,EACb;YACE,WAAW,EAAE,kEAAkE;gBAC7E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,qFAAqF;gBACrF,+EAA+E;gBAC/E,gDAAgD;YAClD,WAAW,EAAE,qBAAqB;YAClC,YAAY,EAAE,sBAAsB;SACrC,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClE,+CAA+C;gBAC/C,8DAA8D;gBAC9D,gEAAgE;gBAChE,6BAA6B;gBAC7B,iBAAiB,EAAE,EAAE,GAAG,MAAM,EAAE;gBAChC,OAAO,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC;aACpE,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,0BAA0B;QAC1B,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QAEpB,gBAAgB;QAChB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEzE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,MAAM,cAAc,CAC1C,MAAM,CAAC,SAAS,EAChB,QAAQ,EACR;YACE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,EACD,MAAM,CACP,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACvC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CACtB,MAAM,CAAC,SAAS,EAChB,eAAe,CAAC,QAAQ,CAAC,IAAI,EAC7B,eAAe,CAAC,QAAQ,CAAC,IAAI,CAC9B,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAc;YAC3B,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,MAAM,CAAC,SAAmC;YAChD,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC;QAEF,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE;YACxB,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,MAAM,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,gCAAgC;QAChC,uBAAuB,CAAC;YACtB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAC5B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,WAAW,EAAE,MAAM,CAAC,UAAU;SAC/B,CAAC,CAAC;IACH,CAAC,CAAE,iBAAiB;AACtB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/D,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA,mEAAmE;AACnE,kEAAkE;AAClE,2DAA2D;AAC3D,uEAAuE;AACvE,qEAAqE;AACrE,8CAA8C;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAiB7C,KAAK,UAAU,IAAI;IACjB,gEAAgE;IAChE,2CAA2C;IAC3C,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,aAAa,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;IAEH,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,iEAAiE;IACjE,0BAA0B;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,IAAI,EAAG,GAAyB,CAAC,IAAI,IAAI,SAAS;SACnD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,UAAU,UAAU;QACzB,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAErE,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAsB,EAAiB,EAAE;YAC/D,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,YAAY;aAC5B,CAAC,CAAC;YAEH,kEAAkE;YAClE,+DAA+D;YAC/D,kCAAkC;YAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,eAAe,CAC1B,SAAS,CAAC,OAAO,EACjB,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAC3B,KAAK,EAAE,IAAI,EAAE,EAAE;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC1C,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,eAAe,CAAC,GAAY,CAAC,CAAC;oBACnC,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,cAAc,CAAC,KAAK;wBAC1B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBAC1D,CAAC,CAAC;oBACH,MAAM,GAAG,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,CAAC;YACH,CAAC,CACF,CAAC;YACF,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAE5B,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,YAAY;aAC5B,CAAC,CAAC;YAEH,kEAAkE;YAClE,0DAA0D;YAC1D,+DAA+D;YAC/D,6DAA6D;YAC7D,8DAA8D;YAC9D,+DAA+D;YAC/D,6DAA6D;YAC7D,iDAAiD;YACjD,EAAE;YACF,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,kEAAkE;YAClE,+DAA+D;YAC/D,6DAA6D;YAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;oBAC/B,MAAM,EAAE,iCAAiC;oBACzC,MAAM,EAAE,6FAA6F;iBACtG,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7C,2DAA2D;gBAC3D,uDAAuD;gBACvD,8DAA8D;gBAC9D,WAAW,CAAC,OAAO,EAAE;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,MAAM,EAAE,MAAM,CAAC,UAAU;oBACzB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;oBAC/B,MAAM,EAAE,kBAAkB;oBAC1B,MAAM,EAAE,0BAA0B;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,wEAAwE;QACxE,EAAE;QACF,mEAAmE;QACnE,kEAAkE;QAClE,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,+DAA+D;QAC/D,EAAE;QACF,wDAAwD;QACxD,2EAA2E;QAC3E,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,iEAAiE;QACjE,wEAAwE;QACxE,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC;QAEzD,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,0CAA0C;QAC1C,2EAA2E;QAC3E,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,cAAc,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,IAAI,QAAQ,CAAC;QACb,IAAI,UAAmE,CAAC;QAExE,IAAI,eAAe,EAAE,CAAC;YACpB,gEAAgE;YAChE,gEAAgE;YAChE,sEAAsE;YACtE,qCAAqC;YACrC,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzE,8DAA8D;QAChE,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,6DAA6D;YAC7D,mBAAmB;YACnB,IAAI,cAAsB,CAAC;YAC3B,QAAQ,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC7B,KAAK,KAAK;oBACR,cAAc,GAAG,SAAS,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAChD,MAAM;gBACR,KAAK,SAAS;oBACZ,cAAc,GAAG,UAAU,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAC1E,MAAM;gBACR,KAAK,MAAM;oBACT,cAAc,GAAG,UAAU,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAC3E,MAAM;YACV,CAAC;YAED,qEAAqE;YACrE,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,cAAc,GAAG,wBAAwB,CAAC;gBAC9C,UAAU,EAAE,cAAc;gBAC1B,cAAc;gBACd,MAAM;aACP,CAAC,CAAC;YACH,QAAQ,GAAG,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE1D,mEAAmE;YACnE,oEAAoE;YACpE,oCAAoC;YACpC,UAAU,GAAG,wBAAwB,CAAC;gBACpC,UAAU,EAAE,cAAc;gBAC1B,cAAc;gBACd,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;QAE9C,iEAAiE;QACjE,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,MAAM,GAAG,KAAK,EAAE,OAAoB,EAAoC,EAAE;YAC9E,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,wCAAwC;YACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,qDAAqD;oBACnD,4DAA4D;oBAC5D,4CAA4C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,gBAAgB,GAAG,UAAU,CAAC;YACpC,gEAAgE;YAChE,IAAI,EAAuC,CAAC;YAC5C,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;YACjE,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC5B,iEAAiE;gBACjE,MAAM,SAAS,GAAG,eAAe,CAAC;oBAChC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,KAAK,EAAE,cAAc;iBACtB,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,YAAY,EAAE,SAAS,CAAC,WAAW;iBACpC,CAAC,CAAC;gBACH,OAAO;oBACL,YAAY,EAAE,SAAS,CAAC,WAAW;oBACnC,WAAW,EAAE,SAAS,CAAC,WAAW;iBACnC,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;gBAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,WAAW,EAAE,OAAO,CAAC,YAAa;gBAClC,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YAEH,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,gEAAgE;gBAChE,gEAAgE;gBAChE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;gBACzE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YAE3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,SAAS,EAAE,EAAE,CAAC,OAAO;gBACrB,QAAQ,EAAE,EAAE,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC;QAEF,MAAM,WAAW,GAAG,iBAAiB,CAAC;YACpC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ;YACR,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;YAClC,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEH,mEAAmE;QACnE,mEAAmE;QACnE,sEAAsE;QACtE,gEAAgE;QAChE,kEAAkE;QAClE,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACvG,MAAM,cAAc,GAAG;YACrB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,SAAS;YAC/B,iBAAiB,EAAE,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;YAC7D,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;YAC3D,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;YAClD,MAAM;SACP,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,YAAY,CAClB,aAAa,EACb;YACE,WAAW,EAAE,kEAAkE;gBAC7E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,qFAAqF;gBACrF,+EAA+E;gBAC/E,gDAAgD;YAClD,WAAW,EAAE,qBAAqB;YAClC,YAAY,EAAE,sBAAsB;SACrC,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClE,+CAA+C;gBAC/C,8DAA8D;gBAC9D,gEAAgE;gBAChE,6BAA6B;gBAC7B,iBAAiB,EAAE,EAAE,GAAG,MAAM,EAAE;gBAChC,OAAO,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC;aACpE,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,uDAAuD;QACvD,gEAAgE;QAChE,oEAAoE;QACpE,WAAW;QACX,MAAM,EACJ,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,GAC/B,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACpC,MAAM,cAAc,GAAG;YACrB,aAAa,EAAE,MAAM,CAAC,SAAS;YAC/B,MAAM;SACP,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,YAAY,CAClB,sBAAsB,EACtB;YACE,WAAW,EAAE,iEAAiE;gBAC5E,gFAAgF;gBAChF,2EAA2E;gBAC3E,gFAAgF;gBAChF,gFAAgF;gBAChF,6BAA6B;YAC/B,WAAW,EAAE,6BAA6B;YAC1C,YAAY,EAAE,8BAA8B;SAC7C,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClE,iBAAiB,EAAE,EAAE,GAAG,MAAM,EAAE;gBAChC,uDAAuD;gBACvD,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+CAA+C;gBAC/C,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,0BAA0B;QAC1B,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QAEpB,gBAAgB;QAChB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAEzE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,MAAM,cAAc,CAC1C,MAAM,CAAC,SAAS,EAChB,QAAQ,EACR;YACE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,EACD,MAAM,CACP,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACvC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CACtB,MAAM,CAAC,SAAS,EAChB,eAAe,CAAC,QAAQ,CAAC,IAAI,EAC7B,eAAe,CAAC,QAAQ,CAAC,IAAI,CAC9B,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAc;YAC3B,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,MAAM,CAAC,SAAmC;YAChD,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC;QAEF,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE;YACxB,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,MAAM,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,gCAAgC;QAChC,uBAAuB,CAAC;YACtB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;YAC5B,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,WAAW,EAAE,MAAM,CAAC,UAAU;SAC/B,CAAC,CAAC;IACH,CAAC,CAAE,iBAAiB;AACtB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC/D,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/token-refresh.d.ts

@@ -0,0 +1,46 @@
+import type { Logger } from '@groundnuty/macf-core';
+/**
+ * Token cache TTL — 50 minutes. 10-minute safety margin under the 1-hour
+ * installation-token TTL (GitHub App contract). Calls within this window
+ * return the cached token; calls past this window mint fresh.
+ *
+ * Exposed as a const so tests can assert the value without re-deriving.
+ */
+export declare const REFRESH_AGE_MS: number;
+export interface TokenRefresherDeps {
+    /** Optional override for the canonical helper-script path; tests inject. */
+    readonly tokenScriptPath?: string;
+    /** Optional clock injection for tests. */
+    readonly clock?: {
+        readonly now: () => number;
+    };
+    /** Optional execFile injection for tests (avoids spawning real shell). */
+    readonly exec?: (cmd: string, args: readonly string[], opts?: {
+        readonly encoding?: 'utf-8';
+    }) => Promise<{
+        readonly stdout: string;
+        readonly stderr: string;
+    }>;
+    /** Logger for diagnostic output. */
+    readonly logger: Logger;
+}
+export interface GetRefreshedTokenOptions {
+    /** Force a fresh mint regardless of cache age (used on 401 retry). */
+    readonly forceRefresh?: boolean;
+}
+export interface TokenRefresher {
+    /**
+     * Returns a current token, minting fresh if the cache is older than
+     * `REFRESH_AGE_MS` or `forceRefresh: true`. Throws on mint failure;
+     * never returns a stale token silently.
+     */
+    readonly getRefreshedToken: (opts?: GetRefreshedTokenOptions) => Promise<string>;
+}
+/**
+ * Create a token refresher with an in-process cache. Caller invokes
+ * `getRefreshedToken()` per-API-call; the cache returns the same token
+ * for ~50 min then mints fresh. On 401, caller invokes with
+ * `forceRefresh: true` to bypass cache.
+ */
+export declare function createTokenRefresher(deps: TokenRefresherDeps): TokenRefresher;
+//# sourceMappingURL=token-refresh.d.ts.map

package/dist/token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../src/token-refresh.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAIpD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,QAAiB,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;IAChD,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,CACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,KACnC,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,IAAI,CAAC,EAAE,wBAAwB,KAC5B,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAsHD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CAyC7E"}

package/dist/token-refresh.js

@@ -0,0 +1,202 @@
+/**
+ * In-runner GH_TOKEN refresh helper (macf#317).
+ *
+ * Bot installation tokens have a **1-hour TTL by design** (GitHub App contract).
+ * `claude.sh` mints a fresh token at session start + exports `GH_TOKEN`; the
+ * channel-server inherits that token via `process.env`. Without an in-runner
+ * refresh, every gh-API-using handler 401s after ~60 minutes of session
+ * uptime. Witnessed 2026-05-01 ~14:30Z on cv-architect's Stop hook at
+ * ~67min uptime — the operator-witnessed incident motivating this module.
+ *
+ * Architecture: an in-process token cache. Holds {token, mintedAt}; on
+ * every `getRefreshedToken()` call, returns cached if `age < REFRESH_AGE_MS`
+ * (50min — 10min safety margin under 1hr TTL); otherwise mints fresh via
+ * the canonical `macf-gh-token.sh` helper. On a 401 from a downstream API
+ * call, the caller re-invokes with `forceRefresh: true` to bypass cache.
+ *
+ * Critical: refreshed tokens stay **in-process**. We never `process.env.GH_TOKEN
+ * = ...` or pass tokens to child processes via env mutation — a stale
+ * `GH_TOKEN` env var elsewhere is a separate hazard surface. The wrapper-
+ * around-GitHub-client pattern (refresh-aware-client.ts) holds the fresh
+ * token in closure, never leaks it.
+ *
+ * Failure semantics: refresh failures (clock drift, missing key, rotated
+ * key, deleted App) throw with diagnostic. We do NOT silently fall back
+ * to the stale env-var token — that would extend the silent-fallback class
+ * (Instance 1, gh-token attribution traps) by re-introducing a quiet path
+ * where ops continue under wrong identity. Loud failure preserves the
+ * fail-loud invariant.
+ *
+ * Sister-shape reference: macf-testbed#135 (closed/deferred — sweep-
+ * harness-side refresh between iterations). Same hazard class, different
+ * surface; this module is the channel-server-side response.
+ *
+ * Helper-script discoverability: in-runner refresh requires the canonical
+ * `macf-gh-token.sh` to be invokable. Resolution order:
+ *   1. Caller-injected `tokenScriptPath` (testing override)
+ *   2. `$MACF_WORKSPACE_DIR/.claude/scripts/macf-gh-token.sh` (canonical
+ *      consumer-fleet path; set by claude.sh per macf#161)
+ *
+ * Falls back to `generateToken()` from macf-core if the helper script isn't
+ * resolvable (substrate / non-init'd workspaces). The core helper handles
+ * the same APP_ID/INSTALL_ID/KEY_PATH env path; only difference is fail-
+ * loud diagnostics live in the shell wrapper.
+ *
+ * SAFETY NOTE: this module uses `execFile` (NOT `exec`), so arguments are
+ * passed as an argv array — no shell interpretation, no injection surface
+ * for the operator-controlled APP_ID/INSTALL_ID/KEY_PATH values.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { generateToken } from '@groundnuty/macf-core';
+const execFileAsync = promisify(execFile);
+/**
+ * Token cache TTL — 50 minutes. 10-minute safety margin under the 1-hour
+ * installation-token TTL (GitHub App contract). Calls within this window
+ * return the cached token; calls past this window mint fresh.
+ *
+ * Exposed as a const so tests can assert the value without re-deriving.
+ */
+export const REFRESH_AGE_MS = 50 * 60 * 1000;
+/**
+ * Locate the canonical token helper script. Returns the resolved path or
+ * `null` if not findable; caller falls back to `generateToken()`.
+ */
+function resolveScriptPath(override) {
+    if (override !== undefined)
+        return override;
+    const workspaceDir = process.env['MACF_WORKSPACE_DIR'];
+    if (workspaceDir === undefined || workspaceDir === '')
+        return null;
+    const candidate = join(workspaceDir, '.claude', 'scripts', 'macf-gh-token.sh');
+    return existsSync(candidate) ? candidate : null;
+}
+/**
+ * Validate token shape — must be a non-empty `ghs_*` installation token.
+ * Mirrors the canonical fail-loud prefix check from `macf-gh-token.sh`.
+ * Defensive against scenarios where the helper exits 0 but produces empty
+ * stdout (shouldn't happen — the helper has its own check — but this is
+ * the result-invariant assertion at the channel-server boundary).
+ */
+function assertTokenShape(token) {
+    if (token === '') {
+        throw new Error('Token refresh failed: empty token returned');
+    }
+    if (!token.startsWith('ghs_')) {
+        const prefix = token.slice(0, 4);
+        throw new Error(`Token refresh failed: bad prefix '${prefix}' — expected 'ghs_' (installation token). ` +
+            'Refusing to use non-installation token to avoid mis-attribution.');
+    }
+}
+/**
+ * Mint a fresh token. Tries the canonical shell helper first (fail-loud
+ * with diagnostics) and falls back to `generateToken()` from core.
+ */
+async function mintToken(deps) {
+    const scriptPath = resolveScriptPath(deps.tokenScriptPath);
+    if (scriptPath !== null) {
+        const appId = process.env['APP_ID'];
+        const installId = process.env['INSTALL_ID'];
+        const keyPath = process.env['KEY_PATH'];
+        if (appId === undefined || appId === '' ||
+            installId === undefined || installId === '' ||
+            keyPath === undefined || keyPath === '') {
+            throw new Error('Token refresh failed: APP_ID/INSTALL_ID/KEY_PATH env vars required ' +
+                'for in-runner refresh; channel-server inherits these from claude.sh. ' +
+                'If unset, the claude.sh launcher did not set them — check workspace ' +
+                'config (.claude/settings.local.json) and macf doctor.');
+        }
+        const runExec = deps.exec ?? execFileAsync;
+        try {
+            const { stdout } = await runExec(scriptPath, ['--app-id', appId, '--install-id', installId, '--key', keyPath], { encoding: 'utf-8' });
+            const token = stdout.trim();
+            assertTokenShape(token);
+            return token;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new Error(`Token refresh failed via ${scriptPath}: ${msg}. ` +
+                'Common causes: clock drift (timedatectl status), wrong/rotated key, ' +
+                'or wrong APP_ID/INSTALL_ID. Channel-server WILL NOT silently fall ' +
+                'back to the stale inherited GH_TOKEN — fail loud per silent-fallback-' +
+                'hazards.md Instance 1 (expiry sub-case).', { cause: err });
+        }
+    }
+    // Fallback: core's generateToken (no helper-script available — substrate
+    // / non-init'd workspaces). Same APP_ID/INSTALL_ID/KEY_PATH env path,
+    // less verbose diagnostics.
+    try {
+        // generateToken's precedence is GH_TOKEN env > TokenSource > env vars.
+        // When GH_TOKEN is set (typical), generateToken returns it as-is —
+        // which is the very stale token we're trying to refresh. To force a
+        // fresh mint, we'd need to either (a) clear GH_TOKEN before the call
+        // or (b) call into the gh CLI directly. Operators in this fallback
+        // path (no MACF_WORKSPACE_DIR + no helper script) get the env-var
+        // token unchanged; expiry hazard remains. The forceRefresh-on-401
+        // retry path still attempts a fresh mint — but if the env var keeps
+        // winning, the retry returns the same stale token. Documented for
+        // operators: in-runner refresh requires either the helper script or
+        // unsetting GH_TOKEN at claude-sh level. Substrate / non-init'd
+        // workspaces should ensure GH_TOKEN is not set OR ship the helper
+        // script.
+        const token = await generateToken();
+        assertTokenShape(token);
+        return token;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Token refresh failed via generateToken fallback: ${msg}. ` +
+            'No MACF_WORKSPACE_DIR set + no APP_ID/INSTALL_ID/KEY_PATH env vars. ' +
+            'In-runner refresh is not viable in this configuration.', { cause: err });
+    }
+}
+/**
+ * Create a token refresher with an in-process cache. Caller invokes
+ * `getRefreshedToken()` per-API-call; the cache returns the same token
+ * for ~50 min then mints fresh. On 401, caller invokes with
+ * `forceRefresh: true` to bypass cache.
+ */
+export function createTokenRefresher(deps) {
+    const clock = deps.clock ?? { now: () => Date.now() };
+    let cachedToken = null;
+    let mintedAt = 0;
+    let inFlight = null;
+    async function mintAndCache() {
+        // De-duplicate concurrent refresh attempts: if one mint is already
+        // in-flight, return the same promise. Prevents N concurrent gh-token-
+        // generate spawns when N concurrent /notify handlers all hit the
+        // refresh boundary simultaneously.
+        if (inFlight !== null)
+            return inFlight;
+        inFlight = (async () => {
+            try {
+                const token = await mintToken(deps);
+                cachedToken = token;
+                mintedAt = clock.now();
+                deps.logger.info('token_refreshed', {
+                    age_ms: '0',
+                    source: deps.tokenScriptPath ?? 'workspace_helper',
+                });
+                return token;
+            }
+            finally {
+                inFlight = null;
+            }
+        })();
+        return inFlight;
+    }
+    return {
+        async getRefreshedToken(opts) {
+            const force = opts?.forceRefresh === true;
+            const now = clock.now();
+            const age = now - mintedAt;
+            if (!force && cachedToken !== null && age < REFRESH_AGE_MS) {
+                return cachedToken;
+            }
+            return mintAndCache();
+        },
+    };
+}
+//# sourceMappingURL=token-refresh.js.map

package/dist/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../src/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiC7C;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAiB;IAC1C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CACpB,YAAY,EACZ,SAAS,EACT,SAAS,EACT,kBAAkB,CACnB,CAAC;IACF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,4CAA4C;YACvF,kEAAkE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,IAAwB;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE3D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAExC,IACE,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YACnC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;YAC3C,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EACvC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACrE,uEAAuE;gBACvE,sEAAsE;gBACtE,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAC9B,UAAU,EACV,CAAC,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,EAChE,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,KAAK,GAAG,IAAI;gBAClD,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,0CAA0C,EAC1C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,4BAA4B;IAC5B,IAAI,CAAC;QACH,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,UAAU;QACV,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;QACpC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,IAAI;YAC3D,sEAAsE;YACtE,wDAAwD,EACxD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACtD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,QAAQ,GAAW,CAAC,CAAC;IACzB,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAE5C,KAAK,UAAU,YAAY;QACzB,mEAAmE;QACnE,sEAAsE;QACtE,iEAAiE;QACjE,mCAAmC;QACnC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QACvC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,WAAW,GAAG,KAAK,CAAC;gBACpB,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;oBAClC,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,IAAI,CAAC,eAAe,IAAI,kBAAkB;iBACnD,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,IAA+B;YACrD,MAAM,KAAK,GAAG,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC;YAE3B,IAAI,CAAC,KAAK,IAAI,WAAW,KAAK,IAAI,IAAI,GAAG,GAAG,cAAc,EAAE,CAAC;gBAC3D,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tracing.d.ts

@@ -13,6 +13,7 @@ export declare const SpanNames: {
     readonly CertsVerifyChallenge: "macf.certs.verify_challenge";
     readonly CertsSign: "macf.certs.sign";
     readonly ToolNotifyPeer: "macf.tool.notify_peer";
+    readonly ToolCheckpointToMemory: "macf.tool.checkpoint_to_memory";
 };
 /** MACF-specific attribute keys (not covered by OTEL semconv). */
 export declare const Attr: {
@@ -26,6 +27,9 @@ export declare const Attr: {
     readonly NotifyEvent: "macf.notify.event";
     readonly PeersAttempted: "macf.notify.peers_attempted";
     readonly PeersDelivered: "macf.notify.peers_delivered";
+    readonly CheckpointTrigger: "macf.checkpoint.trigger";
+    readonly CheckpointWritten: "macf.checkpoint.written";
+    readonly CheckpointDeduplicated: "macf.checkpoint.deduplicated";
 };
 /** GenAI semconv keys (experimental in v1.36+). */
 export declare const GenAiAttr: {

package/dist/tracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,gEAAgE;AAChE,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,uDAAuD;AACvD,eAAO,MAAM,SAAS;;;;;;;;;;CAeZ,CAAC;AAEX,kEAAkE;AAClE,eAAO,MAAM,IAAI;;;;;;;;;;;CAeP,CAAC;AAEX,mDAAmD;AACnD,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CA0B9E"}
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,gEAAgE;AAChE,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,uDAAuD;AACvD,eAAO,MAAM,SAAS;;;;;;;;;;;CAmBZ,CAAC;AAEX,kEAAkE;AAClE,eAAO,MAAM,IAAI;;;;;;;;;;;;;;CAqBP,CAAC;AAEX,mDAAmD;AACnD,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CA0B9E"}

package/dist/tracing.js

@@ -38,6 +38,10 @@ export const SpanNames = {
     // parent-child relationship to receiver's NotifyReceived span via
     // W3C traceparent propagation.
     ToolNotifyPeer: 'macf.tool.notify_peer',
+    // macf#271: PreCompact-driven checkpoint_to_memory span. INTERNAL-kind
+    // (purely local filesystem write). Attributes: trigger (manual|auto),
+    // written (bool), deduplicated (bool). DR-023 §UC-3 telemetry pattern.
+    ToolCheckpointToMemory: 'macf.tool.checkpoint_to_memory',
 };
 /** MACF-specific attribute keys (not covered by OTEL semconv). */
 export const Attr = {
@@ -55,6 +59,12 @@ export const Attr = {
     NotifyEvent: 'macf.notify.event',
     PeersAttempted: 'macf.notify.peers_attempted',
     PeersDelivered: 'macf.notify.peers_delivered',
+    // macf#271: checkpoint_to_memory span attributes. Surface PreCompact
+    // trigger source (manual / auto) + outcome (written, deduplicated)
+    // for DR-023 UC-3 telemetry.
+    CheckpointTrigger: 'macf.checkpoint.trigger',
+    CheckpointWritten: 'macf.checkpoint.written',
+    CheckpointDeduplicated: 'macf.checkpoint.deduplicated',
 };
 /** GenAI semconv keys (experimental in v1.36+). */
 export const GenAiAttr = {

package/dist/tracing.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAI3C,gEAAgE;AAChE,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,cAAc,EAAE,6BAA6B;IAC7C,OAAO,EAAE,sBAAsB;IAC/B,eAAe,EAAE,sBAAsB;IACvC,qBAAqB,EAAE,6BAA6B;IACpD,OAAO,EAAE,eAAe;IACxB,eAAe,EAAE,wBAAwB;IACzC,oBAAoB,EAAE,6BAA6B;IACnD,SAAS,EAAE,iBAAiB;IAC5B,kEAAkE;IAClE,+DAA+D;IAC/D,8DAA8D;IAC9D,kEAAkE;IAClE,+BAA+B;IAC/B,cAAc,EAAE,uBAAuB;CAC/B,CAAC;AAEX,kEAAkE;AAClE,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAChC,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,gCAAgC;IAChC,YAAY,EAAE,oBAAoB;IAClC,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,6BAA6B;IAC7C,cAAc,EAAE,6BAA6B;CACrC,CAAC;AAEX,mDAAmD;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,SAAS,EAAE,mBAAmB;IAC9B,OAAO,EAAE,iBAAiB;IAC1B,aAAa,EAAE,uBAAuB;IACtC,MAAM,EAAE,eAAe;CACf,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA2B;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,cAAc,CAAC;QACxB,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAClB,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,8DAA8D;QAC9D,KAAK,mBAAmB;YACtB,OAAO,aAAa,CAAC;QACvB,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,+CAA+C;QAC/C,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAI3C,gEAAgE;AAChE,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,cAAc,EAAE,6BAA6B;IAC7C,OAAO,EAAE,sBAAsB;IAC/B,eAAe,EAAE,sBAAsB;IACvC,qBAAqB,EAAE,6BAA6B;IACpD,OAAO,EAAE,eAAe;IACxB,eAAe,EAAE,wBAAwB;IACzC,oBAAoB,EAAE,6BAA6B;IACnD,SAAS,EAAE,iBAAiB;IAC5B,kEAAkE;IAClE,+DAA+D;IAC/D,8DAA8D;IAC9D,kEAAkE;IAClE,+BAA+B;IAC/B,cAAc,EAAE,uBAAuB;IACvC,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,sBAAsB,EAAE,gCAAgC;CAChD,CAAC;AAEX,kEAAkE;AAClE,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAChC,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;IAC9B,WAAW,EAAE,mBAAmB;IAChC,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,gCAAgC;IAChC,YAAY,EAAE,oBAAoB;IAClC,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,6BAA6B;IAC7C,cAAc,EAAE,6BAA6B;IAC7C,qEAAqE;IACrE,mEAAmE;IACnE,6BAA6B;IAC7B,iBAAiB,EAAE,yBAAyB;IAC5C,iBAAiB,EAAE,yBAAyB;IAC5C,sBAAsB,EAAE,8BAA8B;CAC9C,CAAC;AAEX,mDAAmD;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,SAAS,EAAE,mBAAmB;IAC9B,OAAO,EAAE,iBAAiB;IAC1B,aAAa,EAAE,uBAAuB;IACtC,MAAM,EAAE,eAAe;CACf,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA2B;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,cAAc,CAAC;QACxB,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC;QACnB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe;YAClB,OAAO,QAAQ,CAAC;QAClB,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,8DAA8D;QAC9D,KAAK,mBAAmB;YACtB,OAAO,aAAa,CAAC;QACvB,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,+CAA+C;QAC/C,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundnuty/macf-channel-server",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "MCP channel server for the Multi-Agent Coordination Framework. HTTPS + mTLS endpoint agents connect to for inter-agent messaging (notify), CI-completion routing, and /sign certificate issuance. Invoked by Claude Code's plugin via `npx -y @groundnuty/macf-channel-server` per DR-022.",
   "type": "module",
   "main": "dist/index.js",
@@ -32,7 +32,7 @@
     "test:e2e": "vitest run --config vitest.e2e.config.ts"
   },
   "dependencies": {
-    "@groundnuty/macf-core": "0.2.10",
+    "@groundnuty/macf-core": "0.2.12",
     "@modelcontextprotocol/sdk": "~1.29.0",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/exporter-metrics-otlp-proto": "0.215.0",