@jungjaehoon/mama-os 0.32.3 → 0.34.0

package/dist/gateways/telegram-report-context-store.js

@@ -0,0 +1,612 @@
+"use strict";
+/**
+ * TG-05/TG-06: Telegram owner-report context inbox store.
+ *
+ * The messenger SQLite database is the single report-context authority for
+ * owner-report delivery events and turn-consumption receipts
+ * (docs/development/telegram-outbound-context-inbox-design.md, Decision 4).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TelegramReportContextStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const untrusted_content_js_1 = require("../utils/untrusted-content.js");
+/**
+ * TG-05 Slice K (design Decision 8): the EXACT legacy V2 prefix algorithm,
+ * including the UTF-16 `slice(0, 700)` truncation (a surrogate split at the
+ * boundary is preserved, not repaired). report-carry.ts deliberately does NOT
+ * export its builder (legacy-export cull, pinned by report-carry.test.ts), so
+ * this replica is pinned byte-for-byte against the public peek() surface by a
+ * differential test instead.
+ */
+const LEGACY_CARRY_SUMMARY_MAX_CHARS = 700;
+function legacyReportCarryPrefix(record) {
+    const summary = record.text.length > LEGACY_CARRY_SUMMARY_MAX_CHARS
+        ? `${record.text.slice(0, LEGACY_CARRY_SUMMARY_MAX_CHARS)}\n[... truncated - full text was delivered to the owner channel]`
+        : record.text;
+    return (`[Operator context] The last FULL situation report was delivered at ${record.deliveredAt}.\n` +
+        'If the owner asks for a report or current status, reference/refresh THIS instead of ' +
+        `reconstructing state from memory. Content:\n${(0, untrusted_content_js_1.wrapUntrustedContent)('operator-report-carry', summary)}\n---\n`);
+}
+/** Design Decision 5 initial limits. */
+const DEFAULT_LIVE_ROW_CAP = 2_048;
+const DEFAULT_LIVE_BYTE_CAP = 64 * 1024 * 1024;
+const DEFAULT_RETAINED_ROW_CAP = 8_192;
+const DEFAULT_RETAINED_BYTE_CAP = 256 * 1024 * 1024;
+const TOMBSTONE_REPLAY_FLOOR_MS = 7 * 24 * 60 * 60 * 1000;
+const TOMBSTONE_MAX_AGE_MS = 365 * 24 * 60 * 60 * 1000;
+const DEFAULT_TOMBSTONE_CAP = 100_000;
+/** Live = prepared or delivered-but-unconsumed (design Decision 5). */
+const LIVE_ROW_CONDITION = `(
+  state IN ('prepared_retryable', 'prepared_definite_rejection')
+  OR (state = 'delivered' AND disposition = 'pending')
+)`;
+function targetIdentity(target) {
+    return JSON.stringify([target.source, target.channelId]);
+}
+function isLegacyCarryV2(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const record = value;
+    const target = record.target;
+    const provenance = record.provenance;
+    return (record.version === 2 &&
+        typeof record.deliveryId === 'string' &&
+        record.deliveryId.length > 0 &&
+        typeof target === 'object' &&
+        target !== null &&
+        target.source === 'telegram' &&
+        typeof target.channelId === 'string' &&
+        typeof record.deliveredAt === 'string' &&
+        typeof record.text === 'string' &&
+        typeof provenance === 'object' &&
+        provenance !== null &&
+        (record.consumedAt === undefined || typeof record.consumedAt === 'string'));
+}
+class TelegramReportContextStore {
+    db;
+    nowIso;
+    liveRowCap;
+    liveByteCap;
+    retainedRowCap;
+    retainedByteCap;
+    constructor(db, options = {}) {
+        this.db = db;
+        this.nowIso = options.nowIso ?? (() => new Date().toISOString());
+        this.liveRowCap = options.liveRowCapPerTarget ?? DEFAULT_LIVE_ROW_CAP;
+        this.liveByteCap = options.liveByteCapPerTarget ?? DEFAULT_LIVE_BYTE_CAP;
+        this.retainedRowCap = options.retainedRowCapPerTarget ?? DEFAULT_RETAINED_ROW_CAP;
+        this.retainedByteCap = options.retainedByteCapPerTarget ?? DEFAULT_RETAINED_BYTE_CAP;
+        this.runMigration();
+        if (options.legacyCarryPath) {
+            this.migrateLegacyCarry(options.legacyCarryPath);
+        }
+    }
+    /**
+     * TG-05 Slice K: migrate the legacy V2 carry file. Unconsumed -> a
+     * delivered-pending event (even past the old 24h TTL); consumed -> a
+     * target-scoped legacy restoration record carrying the EXACT old prefix
+     * bytes. Transactionally insert/verify, commit, then atomically rename the
+     * source `.migrated`. Invalid files are quarantined and never injected.
+     */
+    migrateLegacyCarry(path) {
+        if (!(0, node_fs_1.existsSync)(path)) {
+            return;
+        }
+        let record;
+        try {
+            const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+            if (!isLegacyCarryV2(parsed)) {
+                throw new Error('not a V2 report carry record');
+            }
+            record = parsed;
+        }
+        catch {
+            (0, node_fs_1.renameSync)(path, `${path}.quarantined-${Date.now()}`);
+            return;
+        }
+        const provenanceTuple = record.provenance.status === 'available'
+            ? ['available', record.provenance.modelRunId]
+            : ['unavailable', record.provenance.reason];
+        const payloadIdentity = (0, node_crypto_1.createHash)('sha256')
+            .update(JSON.stringify([
+            'legacy-report-carry-v2',
+            record.deliveryId,
+            record.target.source,
+            record.target.channelId,
+            record.deliveredAt,
+            record.text,
+            provenanceTuple,
+        ]), 'utf8')
+            .digest('hex');
+        this.db.transaction(() => {
+            if (record.consumedAt) {
+                const existing = this.db
+                    .prepare('SELECT payload_identity FROM telegram_report_legacy_restorations WHERE delivery_id = ?')
+                    .get(record.deliveryId);
+                if (existing) {
+                    if (existing.payload_identity !== payloadIdentity) {
+                        throw new Error(`Legacy carry ${record.deliveryId} identity conflict during migration replay`);
+                    }
+                    return;
+                }
+                const restorationText = legacyReportCarryPrefix(record);
+                this.db
+                    .prepare(`INSERT INTO telegram_report_legacy_restorations
+               (delivery_id, target, channel_key, delivered_at, consumed_at,
+                restoration_text, legacy_projection_hash, payload_identity)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .run(record.deliveryId, targetIdentity(record.target), record.consumingChannelKey ?? null, record.deliveredAt, record.consumedAt, 
+                // JSON-encoded: the legacy UTF-16 slice(0,700) can split a
+                // surrogate pair, and a lone surrogate does not survive SQLite's
+                // UTF-8 TEXT round-trip. JSON escapes it losslessly.
+                JSON.stringify(restorationText), (0, node_crypto_1.createHash)('sha256').update(restorationText, 'utf8').digest('hex'), payloadIdentity);
+                return;
+            }
+            const existing = this.db
+                .prepare('SELECT payload_identity FROM telegram_report_context_events WHERE delivery_id = ?')
+                .get(record.deliveryId);
+            if (existing) {
+                if (existing.payload_identity !== payloadIdentity) {
+                    throw new Error(`Legacy carry ${record.deliveryId} identity conflict during migration replay`);
+                }
+                return;
+            }
+            this.db
+                .prepare(`INSERT INTO telegram_report_context_events
+             (delivery_id, target, mode, occurrence, provenance, text, payload_identity,
+              state, disposition, created_at, delivered_at)
+           VALUES (?, ?, 'full', ?, ?, ?, ?, 'delivered', 'pending', ?, ?)`)
+                .run(record.deliveryId, targetIdentity(record.target), JSON.stringify({ kind: 'legacy_v2' }), JSON.stringify(record.provenance), record.text, payloadIdentity, this.nowIso(), record.deliveredAt);
+        })();
+        (0, node_fs_1.renameSync)(path, `${path}.migrated`);
+    }
+    /**
+     * Idempotently insert the exact prepared report before any external send.
+     * A replay of the same delivery ID must carry the identical payload; any
+     * divergence is an identity conflict and never silently overwrites.
+     */
+    reserve(input) {
+        const existing = this.db
+            .prepare(`SELECT seq, delivery_id, target, mode, occurrence, provenance, text, payload_identity, state
+         FROM telegram_report_context_events WHERE delivery_id = ?`)
+            .get(input.deliveryId);
+        if (existing) {
+            const semanticsMatch = existing.target === targetIdentity(input.target) &&
+                existing.mode === input.mode &&
+                existing.text === input.text;
+            if (semanticsMatch && existing.payload_identity !== input.payloadIdentity) {
+                // Design Decision 8: a richer pending artifact may replay a MIGRATED
+                // delivery ID; the current identity is recorded as an alias only when
+                // target, mode, exact text, and provenance all match.
+                const isMigratedRow = existing.occurrence === JSON.stringify({ kind: 'legacy_v2' });
+                const provenanceMatches = existing.provenance ===
+                    (input.provenance === undefined ? null : JSON.stringify(input.provenance));
+                if (isMigratedRow && provenanceMatches) {
+                    this.db
+                        .prepare('UPDATE telegram_report_context_events SET payload_identity_alias = ? WHERE delivery_id = ?')
+                        .run(input.payloadIdentity, input.deliveryId);
+                    return { seq: existing.seq, deliveryId: existing.delivery_id, state: existing.state };
+                }
+            }
+            if (!semanticsMatch || existing.payload_identity !== input.payloadIdentity) {
+                throw new Error(`Owner report delivery ${input.deliveryId} identity conflict: replay does not match the reserved report`);
+            }
+            return { seq: existing.seq, deliveryId: existing.delivery_id, state: existing.state };
+        }
+        // Design Decision 5: compact consumed exact records under retained
+        // pressure, then refuse the reservation outright when live data alone is
+        // full. The failure happens BEFORE any Telegram send.
+        this.compactRetained(input.target);
+        this.enforceLiveCapacity(input.target);
+        const inserted = this.db
+            .prepare(`INSERT INTO telegram_report_context_events
+           (delivery_id, target, mode, occurrence, provenance, text, payload_identity, state, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, 'prepared_retryable', ?)
+         RETURNING seq`)
+            .get(input.deliveryId, targetIdentity(input.target), input.mode, JSON.stringify(input.occurrence), input.provenance === undefined ? null : JSON.stringify(input.provenance), input.text, input.payloadIdentity, this.nowIso());
+        return { seq: inserted.seq, deliveryId: input.deliveryId, state: 'prepared_retryable' };
+    }
+    /**
+     * Atomically transition a confirmed send to `delivered`. Idempotent: an
+     * already-delivered row keeps its original delivery time so crash-recovery
+     * replays converge instead of rewriting history.
+     */
+    markDelivered(deliveryId, deliveredAtIso) {
+        const updated = this.db
+            .prepare(`UPDATE telegram_report_context_events
+         SET state = 'delivered', disposition = 'pending', delivered_at = ?
+         WHERE delivery_id = ? AND state = 'prepared_retryable'`)
+            .run(deliveredAtIso, deliveryId);
+        if (updated.changes > 0) {
+            return;
+        }
+        const existing = this.db
+            .prepare('SELECT state FROM telegram_report_context_events WHERE delivery_id = ?')
+            .get(deliveryId);
+        if (!existing) {
+            throw new Error(`Unknown owner report delivery ${deliveryId}`);
+        }
+        if (existing.state !== 'delivered') {
+            throw new Error(`Owner report delivery ${deliveryId} cannot be marked delivered from state ${existing.state}`);
+        }
+    }
+    /**
+     * Compare-and-swap attempt lease: exactly one holder may execute a Telegram
+     * send at a time. A live lease excludes every new claim - another worker,
+     * another tick, or the same owner - and an expired lease is recoverable
+     * after restart. Returns null when no claim is possible.
+     */
+    claimAttempt(deliveryId, owner, nowIso, leaseUntilIso) {
+        const updated = this.db
+            .prepare(`UPDATE telegram_report_context_events
+         SET attempt_owner = ?, lease_until = ?, attempt_count = attempt_count + 1
+         WHERE delivery_id = ?
+           AND state = 'prepared_retryable'
+           AND (lease_until IS NULL OR lease_until < ?)
+           AND (next_attempt_at IS NULL OR next_attempt_at <= ?)`)
+            .run(owner, leaseUntilIso, deliveryId, nowIso, nowIso);
+        if (updated.changes === 0) {
+            return null;
+        }
+        return { deliveryId, owner, leaseUntilIso };
+    }
+    /**
+     * Safe cancellation (design Decision 3): permitted only from
+     * prepared_definite_rejection - the one state where the Telegram ledger
+     * proves definite non-acceptance and no attempt lease is live. Ambiguous or
+     * confirmed acceptance can never be cancelled. Replay on an already
+     * cancelled row is a converging no-op that keeps the first audit record.
+     */
+    cancel(deliveryId, reason, operatorTimeIso) {
+        const updated = this.db
+            .prepare(`UPDATE telegram_report_context_events
+         SET state = 'cancelled', cancel_reason = ?, cancelled_at = ?,
+             attempt_owner = NULL, lease_until = NULL, next_attempt_at = NULL
+         WHERE delivery_id = ? AND state = 'prepared_definite_rejection'
+           AND attempt_owner IS NULL`)
+            .run(reason, operatorTimeIso, deliveryId);
+        if (updated.changes > 0) {
+            return;
+        }
+        const existing = this.getEvent(deliveryId);
+        if (existing?.state === 'cancelled') {
+            return;
+        }
+        throw new Error(`Owner report delivery ${deliveryId} cannot be cancelled: only a definite rejection with no live attempt may be cancelled (state: ${existing?.state ?? 'unknown'})`);
+    }
+    /**
+     * Explicit operator reactivation of a definite rejection after conditions
+     * are corrected (for example the bot was unblocked). Same delivery ID, same
+     * immutable target; the row becomes immediately recoverable.
+     */
+    reactivate(deliveryId) {
+        const updated = this.db
+            .prepare(`UPDATE telegram_report_context_events
+         SET state = 'prepared_retryable', next_attempt_at = NULL
+         WHERE delivery_id = ? AND state = 'prepared_definite_rejection'`)
+            .run(deliveryId);
+        if (updated.changes === 0) {
+            const existing = this.getEvent(deliveryId);
+            throw new Error(`Owner report delivery ${deliveryId} cannot be reactivated: only a definite rejection may be reactivated (state: ${existing?.state ?? 'unknown'})`);
+        }
+    }
+    /**
+     * Delivered reports not yet consumed by an owner turn, for one exact
+     * target, oldest first. This is the pending-projection source; one chat can
+     * never read another target's reports.
+     */
+    listDeliveredPending(target) {
+        const rows = this.db
+            .prepare(`SELECT seq, delivery_id, mode, delivered_at, text
+         FROM telegram_report_context_events
+         WHERE target = ? AND state = 'delivered' AND disposition = 'pending'
+         ORDER BY seq ASC`)
+            .all(targetIdentity(target));
+        return rows.map((row) => ({
+            seq: row.seq,
+            deliveryId: row.delivery_id,
+            mode: row.mode,
+            deliveredAtIso: row.delivered_at,
+            text: row.text,
+        }));
+    }
+    /**
+     * Committed receipts for the given source-message references, in the input
+     * order. Only text-bearing receipts are returned; a compacted receipt no
+     * longer restores.
+     */
+    listReceiptsByRefs(refs) {
+        const lookup = this.db.prepare(`SELECT source_message_ref, delivery_ids, projection_text, committed_at
+       FROM telegram_report_context_receipts WHERE source_message_ref = ?`);
+        const results = [];
+        for (const ref of refs) {
+            const row = lookup.get(ref);
+            if (!row || row.projection_text === null) {
+                continue;
+            }
+            results.push({
+                sourceMessageRef: row.source_message_ref,
+                deliveryIds: JSON.parse(row.delivery_ids),
+                projectionText: row.projection_text,
+                committedAtIso: row.committed_at,
+            });
+        }
+        return results;
+    }
+    /**
+     * Legacy V2 restorations for one target, eligible for fresh-session history
+     * (30 days after consumption, design Decision 8). Restoration text is
+     * JSON-decoded back to the exact legacy prefix string.
+     */
+    listLegacyRestorations(target, nowIso) {
+        const cutoff = new Date(new Date(nowIso).getTime() - 30 * 24 * 60 * 60 * 1000).toISOString();
+        const rows = this.db
+            .prepare(`SELECT delivery_id, consumed_at, delivered_at, restoration_text
+         FROM telegram_report_legacy_restorations
+         WHERE target = ? AND consumed_at >= ? AND restoration_text IS NOT NULL
+         ORDER BY consumed_at ASC, delivery_id ASC`)
+            .all(targetIdentity(target), cutoff);
+        return rows.map((row) => ({
+            deliveryId: row.delivery_id,
+            consumedAtIso: row.consumed_at,
+            deliveredAtIso: row.delivered_at,
+            restorationText: JSON.parse(row.restoration_text),
+        }));
+    }
+    compactRetained(target) {
+        const compactOldestConsumed = this.db.prepare(`UPDATE telegram_report_context_events
+       SET text = '', tombstone = 1
+       WHERE seq = (
+         SELECT seq FROM telegram_report_context_events
+         WHERE target = ? AND tombstone = 0
+           AND disposition IN ('consumed_turn', 'operator_archived')
+         ORDER BY seq ASC LIMIT 1
+       )`);
+        // Retained = rows still carrying exact text.
+        for (;;) {
+            const retained = this.db
+                .prepare(`SELECT COUNT(*) AS rows, COALESCE(SUM(LENGTH(CAST(text AS BLOB))), 0) AS bytes
+           FROM telegram_report_context_events WHERE target = ? AND tombstone = 0`)
+                .get(targetIdentity(target));
+            if (retained.rows < this.retainedRowCap && retained.bytes < this.retainedByteCap) {
+                return;
+            }
+            const changed = compactOldestConsumed.run(targetIdentity(target)).changes;
+            if (changed === 0) {
+                // Nothing consumed left to compact; live pressure is handled by the
+                // live-capacity check.
+                return;
+            }
+        }
+    }
+    enforceLiveCapacity(target) {
+        const live = this.db
+            .prepare(`SELECT COUNT(*) AS rows, COALESCE(SUM(LENGTH(CAST(text AS BLOB))), 0) AS bytes
+         FROM telegram_report_context_events
+         WHERE target = ? AND ${LIVE_ROW_CONDITION}`)
+            .get(targetIdentity(target));
+        if (live.rows >= this.liveRowCap || live.bytes >= this.liveByteCap) {
+            throw new Error(`capacity_full: owner-report live capacity reached for target (${live.rows} rows, ${live.bytes} bytes); ` +
+                'unseen reports must be consumed or explicitly archived before new ones are accepted');
+        }
+    }
+    /**
+     * Design Decision 5: explicit two-step operator action (token flow lives at
+     * the API layer). Archives ONLY already-delivered pending rows up to and
+     * including `throughSeq`, records the audit fields, and removes them from
+     * pending projection and live capacity. Never Telegram cancellation.
+     */
+    archiveDelivered(target, throughSeq, actor, reason, nowIso) {
+        const rows = this.db
+            .prepare(`UPDATE telegram_report_context_events
+         SET disposition = 'operator_archived', archived_by = ?, archived_reason = ?, archived_at = ?
+         WHERE target = ? AND state = 'delivered' AND disposition = 'pending' AND seq <= ?
+         RETURNING delivery_id`)
+            .all(actor, reason, nowIso, targetIdentity(target), throughSeq);
+        return rows.map((row) => row.delivery_id);
+    }
+    /** Live usage for the status surface; warn at 80% of either bound. */
+    liveUsage(target) {
+        const live = this.db
+            .prepare(`SELECT COUNT(*) AS rows, COALESCE(SUM(LENGTH(CAST(text AS BLOB))), 0) AS bytes
+         FROM telegram_report_context_events
+         WHERE target = ? AND ${LIVE_ROW_CONDITION}`)
+            .get(targetIdentity(target));
+        return {
+            rows: live.rows,
+            bytes: live.bytes,
+            rowCap: this.liveRowCap,
+            byteCap: this.liveByteCap,
+            warn: live.rows >= this.liveRowCap * 0.8 || live.bytes >= this.liveByteCap * 0.8,
+        };
+    }
+    /**
+     * Tombstone GC (design Decision 4): identity tombstones are retained up to
+     * 365 days with a global count cap. No tombstone younger than Telegram's
+     * seven-day replay window is ever pruned; beyond that floor the oldest
+     * terminal tombstones go first. Returns the number of removed rows.
+     */
+    pruneTombstones(nowIso, options = {}) {
+        const cap = options.maxTombstones ?? DEFAULT_TOMBSTONE_CAP;
+        const nowMs = new Date(nowIso).getTime();
+        const floorIso = new Date(nowMs - TOMBSTONE_REPLAY_FLOOR_MS).toISOString();
+        const maxAgeIso = new Date(nowMs - TOMBSTONE_MAX_AGE_MS).toISOString();
+        let removed = this.db
+            .prepare(`DELETE FROM telegram_report_context_events
+         WHERE tombstone = 1 AND COALESCE(delivered_at, created_at) < ?`)
+            .run(maxAgeIso).changes;
+        for (;;) {
+            const count = this.db
+                .prepare('SELECT COUNT(*) AS n FROM telegram_report_context_events WHERE tombstone = 1')
+                .get();
+            if (count.n <= cap) {
+                break;
+            }
+            const deleted = this.db
+                .prepare(`DELETE FROM telegram_report_context_events
+           WHERE seq = (
+             SELECT seq FROM telegram_report_context_events
+             WHERE tombstone = 1 AND COALESCE(delivered_at, created_at) < ?
+             ORDER BY seq ASC LIMIT 1
+           )`)
+                .run(floorIso).changes;
+            if (deleted === 0) {
+                break;
+            }
+            removed += deleted;
+        }
+        return removed;
+    }
+    /** Read one event's attempt/terminal detail; null when unknown. */
+    getEvent(deliveryId) {
+        const row = this.db
+            .prepare(`SELECT seq, delivery_id, state, attempt_count, next_attempt_at, lease_until,
+                rejection_reason, cancel_reason
+         FROM telegram_report_context_events WHERE delivery_id = ?`)
+            .get(deliveryId);
+        if (!row) {
+            return null;
+        }
+        return {
+            seq: row.seq,
+            deliveryId: row.delivery_id,
+            state: row.state,
+            attemptCount: row.attempt_count,
+            nextAttemptAt: row.next_attempt_at,
+            leaseUntil: row.lease_until,
+            rejectionReason: row.rejection_reason,
+            cancelReason: row.cancel_reason,
+        };
+    }
+    /**
+     * Record a retryable send failure: keep the row nonterminal, stamp the next
+     * attempt time, and release the lease. Only the current lease holder may
+     * reshape backoff - a stale worker's outcome must not race a live one.
+     */
+    scheduleRetry(deliveryId, owner, nextAttemptAtIso) {
+        const updated = this.db
+            .prepare(`UPDATE telegram_report_context_events
+         SET next_attempt_at = ?, attempt_owner = NULL, lease_until = NULL
+         WHERE delivery_id = ? AND state = 'prepared_retryable' AND attempt_owner = ?`)
+            .run(nextAttemptAtIso, deliveryId, owner);
+        if (updated.changes === 0) {
+            throw new Error(`Worker ${owner} does not hold the attempt lease for owner report delivery ${deliveryId}`);
+        }
+    }
+    /**
+     * Record a definite Telegram non-acceptance. The row stays pinned in the
+     * ledger (nonterminal) and is never automatically retried; only an explicit
+     * operator action may reactivate it (design Decision 3).
+     */
+    markDefiniteRejection(deliveryId, owner, reason) {
+        const updated = this.db
+            .prepare(`UPDATE telegram_report_context_events
+         SET state = 'prepared_definite_rejection', rejection_reason = ?,
+             attempt_owner = NULL, lease_until = NULL, next_attempt_at = NULL
+         WHERE delivery_id = ? AND state = 'prepared_retryable' AND attempt_owner = ?`)
+            .run(reason, deliveryId, owner);
+        if (updated.changes === 0) {
+            throw new Error(`Worker ${owner} does not hold the attempt lease for owner report delivery ${deliveryId}`);
+        }
+    }
+    /**
+     * Startup/tick recovery: prepared_retryable rows that are due (no future
+     * retry scheduled) and not held by a live attempt lease, oldest first.
+     */
+    listRecoverable(nowIso) {
+        const rows = this.db
+            .prepare(`SELECT seq, delivery_id, state FROM telegram_report_context_events
+         WHERE state = 'prepared_retryable'
+           AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+           AND (lease_until IS NULL OR lease_until < ?)
+         ORDER BY seq ASC`)
+            .all(nowIso, nowIso);
+        return rows.map((row) => ({ seq: row.seq, deliveryId: row.delivery_id, state: row.state }));
+    }
+    /**
+     * Startup ledger reconciliation input: every nonterminal row must hold a
+     * Telegram-ledger pin, every terminal row must not (design Decision 2).
+     */
+    listPinReconciliation() {
+        const rows = this.db
+            .prepare(`SELECT delivery_id, state FROM telegram_report_context_events ORDER BY seq ASC`)
+            .all();
+        const nonterminal = [];
+        const terminal = [];
+        for (const row of rows) {
+            if (row.state === 'prepared_retryable' || row.state === 'prepared_definite_rejection') {
+                nonterminal.push(row.delivery_id);
+            }
+            else {
+                terminal.push(row.delivery_id);
+            }
+        }
+        return { nonterminal, terminal };
+    }
+    runMigration() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS telegram_report_context_events (
+        seq INTEGER PRIMARY KEY AUTOINCREMENT,
+        delivery_id TEXT NOT NULL UNIQUE,
+        target TEXT NOT NULL,
+        mode TEXT NOT NULL CHECK (mode IN ('digest', 'full')),
+        occurrence TEXT NOT NULL,
+        provenance TEXT,
+        text TEXT NOT NULL,
+        payload_identity TEXT NOT NULL,
+        state TEXT NOT NULL CHECK (
+          state IN ('prepared_retryable', 'prepared_definite_rejection', 'delivered', 'cancelled')
+        ),
+        disposition TEXT CHECK (
+          disposition IN ('pending', 'consumed_turn', 'operator_archived')
+        ),
+        archived_by TEXT,
+        archived_reason TEXT,
+        archived_at TEXT,
+        created_at TEXT NOT NULL,
+        delivered_at TEXT,
+        attempt_count INTEGER NOT NULL DEFAULT 0,
+        next_attempt_at TEXT,
+        attempt_owner TEXT,
+        lease_until TEXT,
+        rejection_reason TEXT,
+        cancelled_at TEXT,
+        cancel_reason TEXT,
+        consumed_by_ref TEXT,
+        consumed_at TEXT,
+        payload_identity_alias TEXT,
+        tombstone INTEGER NOT NULL DEFAULT 0
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_report_context_events_target_state
+        ON telegram_report_context_events(target, state);
+
+      CREATE TABLE IF NOT EXISTS telegram_report_legacy_restorations (
+        delivery_id TEXT PRIMARY KEY,
+        target TEXT NOT NULL,
+        channel_key TEXT,
+        delivered_at TEXT NOT NULL,
+        consumed_at TEXT NOT NULL,
+        restoration_text TEXT,
+        legacy_projection_hash TEXT NOT NULL,
+        payload_identity TEXT NOT NULL,
+        source_message_ref TEXT,
+        session_id TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS telegram_report_context_receipts (
+        source_message_ref TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        delivery_ids TEXT NOT NULL,
+        projection_version TEXT NOT NULL,
+        projection_text TEXT,
+        projection_hash TEXT NOT NULL,
+        final_response_sha256 TEXT NOT NULL,
+        committed_at TEXT NOT NULL
+      );
+    `);
+    }
+}
+exports.TelegramReportContextStore = TelegramReportContextStore;
+//# sourceMappingURL=telegram-report-context-store.js.map

package/dist/gateways/telegram-report-context-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-report-context-store.js","sourceRoot":"","sources":["../../src/gateways/telegram-report-context-store.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,6CAAyC;AACzC,qCAA+D;AAG/D,wEAAqE;AAErE;;;;;;;GAOG;AACH,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAE3C,SAAS,uBAAuB,CAAC,MAAqB;IACpD,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,8BAA8B;QACjD,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,8BAA8B,CAAC,kEAAkE;QAC3H,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAClB,OAAO,CACL,sEAAsE,MAAM,CAAC,WAAW,KAAK;QAC7F,sFAAsF;QACtF,+CAA+C,IAAA,2CAAoB,EACjE,uBAAuB,EACvB,OAAO,CACR,SAAS,CACX,CAAC;AACJ,CAAC;AAsDD,wCAAwC;AACxC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1D,MAAM,oBAAoB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC,uEAAuE;AACvE,MAAM,kBAAkB,GAAG;;;EAGzB,CAAC;AAEH,SAAS,cAAc,CAAC,MAA2B;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAA6C,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAiD,CAAC;IAC5E,OAAO,CACL,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC5B,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,MAAM,CAAC,MAAM,KAAK,UAAU;QAC5B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,OAAO,UAAU,KAAK,QAAQ;QAC9B,UAAU,KAAK,IAAI;QACnB,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,MAAa,0BAA0B;IAQlB;IAPF,MAAM,CAAe;IACrB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,cAAc,CAAS;IACvB,eAAe,CAAS;IAEzC,YACmB,EAAkB,EACnC,UAA6C,EAAE;QAD9B,OAAE,GAAF,EAAE,CAAgB;QAGnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,mBAAmB,IAAI,oBAAoB,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,oBAAoB,IAAI,qBAAqB,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,uBAAuB,IAAI,wBAAwB,CAAC;QAClF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,wBAAwB,IAAI,yBAAyB,CAAC;QACrF,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,IAAY;QACrC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,IAAA,oBAAU,EAAC,IAAI,EAAE,GAAG,IAAI,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,WAAW;YACtC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YAC7C,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACzC,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;YACb,wBAAwB;YACxB,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,MAAM,CAAC,MAAM;YACpB,MAAM,CAAC,MAAM,CAAC,SAAS;YACvB,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,IAAI;YACX,eAAe;SAChB,CAAC,EACF,MAAM,CACP;aACA,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACvB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;qBACrB,OAAO,CACN,wFAAwF,CACzF;qBACA,GAAG,CAAC,MAAM,CAAC,UAAU,CAA6C,CAAC;gBACtE,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,QAAQ,CAAC,gBAAgB,KAAK,eAAe,EAAE,CAAC;wBAClD,MAAM,IAAI,KAAK,CACb,gBAAgB,MAAM,CAAC,UAAU,4CAA4C,CAC9E,CAAC;oBACJ,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBACxD,IAAI,CAAC,EAAE;qBACJ,OAAO,CACN;;;6CAGiC,CAClC;qBACA,GAAG,CACF,MAAM,CAAC,UAAU,EACjB,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7B,MAAM,CAAC,mBAAmB,IAAI,IAAI,EAClC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,UAAU;gBACjB,2DAA2D;gBAC3D,iEAAiE;gBACjE,qDAAqD;gBACrD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAC/B,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAClE,eAAe,CAChB,CAAC;gBACJ,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;iBACrB,OAAO,CACN,mFAAmF,CACpF;iBACA,GAAG,CAAC,MAAM,CAAC,UAAU,CAA6C,CAAC;YACtE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,gBAAgB,KAAK,eAAe,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CACb,gBAAgB,MAAM,CAAC,UAAU,4CAA4C,CAC9E,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;2EAGiE,CAClE;iBACA,GAAG,CACF,MAAM,CAAC,UAAU,EACjB,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EACjC,MAAM,CAAC,IAAI,EACX,eAAe,EACf,IAAI,CAAC,MAAM,EAAE,EACb,MAAM,CAAC,WAAW,CACnB,CAAC;QACN,CAAC,CAAC,EAAE,CAAC;QAEL,IAAA,oBAAU,EAAC,IAAI,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAoC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,OAAO,CACN;mEAC2D,CAC5D;aACA,GAAG,CAAC,KAAK,CAAC,UAAU,CAYV,CAAC;QAEd,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,cAAc,GAClB,QAAQ,CAAC,MAAM,KAAK,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChD,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;gBAC5B,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC;YAC/B,IAAI,cAAc,IAAI,QAAQ,CAAC,gBAAgB,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC1E,qEAAqE;gBACrE,sEAAsE;gBACtE,sDAAsD;gBACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpF,MAAM,iBAAiB,GACrB,QAAQ,CAAC,UAAU;oBACnB,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC7E,IAAI,aAAa,IAAI,iBAAiB,EAAE,CAAC;oBACvC,IAAI,CAAC,EAAE;yBACJ,OAAO,CACN,4FAA4F,CAC7F;yBACA,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;oBAChD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACxF,CAAC;YACH,CAAC;YACD,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,gBAAgB,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,+DAA+D,CACzG,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxF,CAAC;QAED,mEAAmE;QACnE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,OAAO,CACN;;;uBAGe,CAChB;aACA,GAAG,CACF,KAAK,CAAC,UAAU,EAChB,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,KAAK,CAAC,IAAI,EACV,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAChC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EACxE,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,eAAe,EACrB,IAAI,CAAC,MAAM,EAAE,CACK,CAAC;QAEvB,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAkB,EAAE,cAAsB;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CACN;;gEAEwD,CACzD;aACA,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,OAAO,CAAC,wEAAwE,CAAC;aACjF,GAAG,CAAC,UAAU,CAAmD,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,0CAA0C,QAAQ,CAAC,KAAK,EAAE,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,YAAY,CACV,UAAkB,EAClB,KAAa,EACb,MAAc,EACd,aAAqB;QAErB,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CACN;;;;;iEAKyD,CAC1D;aACA,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,UAAkB,EAAE,MAAc,EAAE,eAAuB;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CACN;;;;qCAI6B,CAC9B;aACA,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,iGAAiG,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,CACpK,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,UAAkB;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CACN;;yEAEiE,CAClE;aACA,GAAG,CAAC,UAAU,CAAC,CAAC;QACnB,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,gFAAgF,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,CACnJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,MAA2B;QAO9C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;;0BAGkB,CACnB;aACA,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAM3B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,cAAc,EAAE,GAAG,CAAC,YAAY;YAChC,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,IAAc;QAM/B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B;0EACoE,CACrE,CAAC;QACF,MAAM,OAAO,GAKR,EAAE,CAAC;QACR,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAOb,CAAC;YACd,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;gBACxC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAa;gBACrD,cAAc,EAAE,GAAG,CAAC,eAAe;gBACnC,cAAc,EAAE,GAAG,CAAC,YAAY;aACjC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,sBAAsB,CACpB,MAA2B,EAC3B,MAAc;QAOd,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;;mDAG2C,CAC5C;aACA,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAKnC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,WAAW;YAC9B,cAAc,EAAE,GAAG,CAAC,YAAY;YAChC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAW;SAC5D,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,MAA2B;QACjD,MAAM,qBAAqB,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC3C;;;;;;;SAOG,CACJ,CAAC;QACF,6CAA6C;QAC7C,SAAS,CAAC;YACR,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;iBACrB,OAAO,CACN;kFACwE,CACzE;iBACA,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAoC,CAAC;YAClE,IAAI,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1E,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,oEAAoE;gBACpE,uBAAuB;gBACvB,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,MAA2B;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;gCAEwB,kBAAkB,EAAE,CAC7C;aACA,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAoC,CAAC;QAClE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,iEAAiE,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,KAAK,WAAW;gBACvG,qFAAqF,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CACd,MAA2B,EAC3B,UAAkB,EAClB,KAAa,EACb,MAAc,EACd,MAAc;QAEd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;;+BAGuB,CACxB;aACA,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,CAE9D,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,sEAAsE;IACtE,SAAS,CAAC,MAA2B;QAOnC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;gCAEwB,kBAAkB,EAAE,CAC7C;aACA,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAoC,CAAC;QAClE,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,GAAG,GAAG;SACjF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,MAAc,EAAE,UAAsC,EAAE;QACtE,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,qBAAqB,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC;QAEvE,IAAI,OAAO,GAAG,IAAI,CAAC,EAAE;aAClB,OAAO,CACN;wEACgE,CACjE;aACA,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;QAE1B,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE;iBAClB,OAAO,CAAC,8EAA8E,CAAC;iBACvF,GAAG,EAAmB,CAAC;YAC1B,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBACnB,MAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;iBACpB,OAAO,CACN;;;;;aAKG,CACJ;iBACA,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACzB,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,MAAM;YACR,CAAC;YACD,OAAO,IAAI,OAAO,CAAC;QACrB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mEAAmE;IACnE,QAAQ,CAAC,UAAkB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN;;mEAE2D,CAC5D;aACA,GAAG,CAAC,UAAU,CAWJ,CAAC;QACd,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,eAAe,EAAE,GAAG,CAAC,gBAAgB;YACrC,YAAY,EAAE,GAAG,CAAC,aAAa;SAChC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAkB,EAAE,KAAa,EAAE,gBAAwB;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CACN;;sFAE8E,CAC/E;aACA,GAAG,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,8DAA8D,UAAU,EAAE,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,qBAAqB,CAAC,UAAkB,EAAE,KAAa,EAAE,MAAc;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CACN;;;sFAG8E,CAC/E;aACA,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,8DAA8D,UAAU,EAAE,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,MAAc;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;;;;0BAIkB,CACnB;aACA,GAAG,CAAC,MAAM,EAAE,MAAM,CAInB,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED;;;OAGG;IACH,qBAAqB;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,gFAAgF,CAAC;aACzF,GAAG,EAAoE,CAAC;QAC3E,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,KAAK,KAAK,oBAAoB,IAAI,GAAG,CAAC,KAAK,KAAK,6BAA6B,EAAE,CAAC;gBACtF,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACnC,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4DZ,CAAC,CAAC;IACL,CAAC;CACF;AA3vBD,gEA2vBC"}

package/dist/gateways/telegram.d.ts

@@ -12,6 +12,7 @@
 import { BaseGateway } from './base-gateway.js';
 import type { TurnProcessor } from './turn-contract.js';
 import { type TelegramMediaDownloadRequest } from './telegram-media.js';
+import type { TelegramReportDeliveryControl } from '../operator/report-delivery-coordinator.js';
 /**
  * Telegram Gateway configuration
  */
@@ -74,6 +75,14 @@ export declare class TelegramGateway extends BaseGateway {
     sendMessage(chatId: string, text: string, idempotencyKey?: string): Promise<void>;
     /** Detached system work must wait behind the normal per-chat delivery queue. */
     sendSystemMessage(chatId: string, text: string, deliveryId?: string): Promise<void>;
+    /**
+     * TG-05/TG-06: narrow owner-report delivery surface for the report
+     * coordinator. Pins the delivery-ID-bound ledger entry before the first
+     * send so a confirmed-send proof cannot be pruned while the report-context
+     * SQLite row remains nonterminal, and classifies send failures with the
+     * gateway's own definite-rejection test.
+     */
+    createReportDeliveryControl(): TelegramReportDeliveryControl;
     sendMessageFromActiveTurn(chatId: string, text: string, idempotencyKey?: string): Promise<void>;
     private sendMessageNow;
     sendFile(chatId: string, filePath: string, caption?: string, idempotencyKey?: string): Promise<void>;