@llblab/pi-kit 0.19.1 → 0.20.0

package/node_modules/@llblab/pi-telegram/dist/lib/workspace-retirement.js

@@ -1,11 +1,12 @@
 /**
- * Workspace retirement preparation
+ * Workspace slot rotation
  * Zones: telegram, workspace identity, lifecycle
- * Owns fail-closed protection composition, pressure selection, exact-intent admission,
- * successor adoption, and gated mocked deletion with durable retirement commit.
+ * Owns fail-closed protection, demand-driven pressure retirement, exact-intent admission,
+ * successor recovery, and fenced one-shot deletion before durable slot reuse.
  */
 import { isDeepStrictEqual } from "node:util";
-import { planTelegramWorkspaceSlotAllocation, } from "./workspace-slots.js";
+import { getTelegramApiErrorRequestTarget, isTelegramApiRequestRejected, } from "./telegram-api.js";
+import { planTelegramWorkspaceSlotAllocation, TelegramWorkspaceSlotUnavailableError, } from "./workspace-slots.js";
 import { createTelegramWorkspaceAdmissionOperationId, isTelegramWorkspaceRetirementFence, runWithTelegramWorkspaceAdmissionsAsync, } from "./workspace-admission.js";
 export function createTelegramWorkspaceOperationGate() {
     let tail = Promise.resolve();
@@ -50,9 +51,10 @@ export function captureTelegramWorkspaceJournalProtectionSources(input) {
                 sources.push({ kind: "unknown", scope });
                 return;
             }
+            const read = binding.readForProtection ?? binding.journal.read;
             const snapshot = input.withJournalReference
-                ? input.withJournalReference(binding, binding.journal.read)
-                : binding.journal.read();
+                ? input.withJournalReference(binding, read)
+                : read();
             sources.push({ kind: "available", scope, entries: snapshot.entries });
         }
         catch {
@@ -279,6 +281,185 @@ export function createTelegramWorkspaceExternalProtectionCapture(deps) {
         });
     };
 }
+export function isCurrentTelegramWorkspaceBinding(store, expected) {
+    return store.listWorkspaceBindings().some((binding) => isDeepStrictEqual(binding, expected));
+}
+/**
+ * Demand-only preparation for pressure retirement. Every removed group is still
+ * owned by the journal's exact dead-owner CAS; this function never clears local
+ * queue memory or turns unknown evidence into deletion authority.
+ */
+export function createTelegramWorkspaceDeadOwnerQueueReclaimer(deps) {
+    const localProtection = (binding) => {
+        const active = deps.getActiveTurnTarget();
+        if (active && sameTarget(active, binding.target))
+            return "protected";
+        let unknown = false;
+        for (const item of deps.getQueuedItems()) {
+            if (item.target && sameTarget(item.target, binding.target))
+                return "protected";
+            if (!item.target && item.chatId === binding.target.chatId)
+                unknown = true;
+        }
+        return unknown ? "unknown" : "clear";
+    };
+    return async (binding, isCurrent) => {
+        if (!isCurrent() || !deps.isBindingCurrent(binding)) {
+            return { kind: "blocked", reason: "authority-changed" };
+        }
+        const initial = deps.getExternalProtection(binding);
+        if (initial.liveOwner !== "clear" || initial.deliveryAuthority !== "clear") {
+            return { kind: "blocked", reason: "live-owner" };
+        }
+        if (localProtection(binding) !== "clear") {
+            return { kind: "blocked", reason: "local-work" };
+        }
+        if (initial.acceptedWork === "clear")
+            return { kind: "not-needed" };
+        const discovery = binding.journalBindingsComplete === true
+            ? undefined
+            : deps.discoverFollowerJournals?.();
+        let complete = binding.journalBindingsComplete === true || discovery?.complete === true;
+        const sources = [];
+        const recoveryKeys = new Set();
+        const capture = (scope, resolve) => {
+            try {
+                const source = resolve();
+                if (!source?.recoveryKey || !source.readForProtection) {
+                    complete = false;
+                    return;
+                }
+                if (recoveryKeys.has(source.recoveryKey))
+                    return;
+                const snapshot = deps.withJournalReference
+                    ? deps.withJournalReference(source, source.readForProtection)
+                    : source.readForProtection();
+                recoveryKeys.add(source.recoveryKey);
+                sources.push({ scope, binding: source, entries: snapshot.entries });
+            }
+            catch {
+                complete = false;
+            }
+        };
+        capture("shared", deps.resolveLeaderJournal);
+        for (const key of binding.journalBindingKeys ?? []) {
+            capture("binding", deps.createFollowerJournalResolver(key));
+        }
+        for (const path of discovery?.paths ?? []) {
+            if (!deps.createJournalPathResolver) {
+                complete = false;
+                break;
+            }
+            capture("discovered", deps.createJournalPathResolver(path));
+        }
+        if (!complete)
+            return { kind: "blocked", reason: "incomplete-source" };
+        const plans = [];
+        for (const source of sources) {
+            const relevant = source.scope === "binding"
+                ? [...source.entries]
+                : source.entries.filter((entry) => {
+                    const target = getJournalUpdateTarget(entry.update);
+                    return !!target && sameTarget(target, binding.target);
+                });
+            if (source.scope === "binding" && relevant.some((entry) => {
+                const target = getJournalUpdateTarget(entry.update);
+                return !target || !sameTarget(target, binding.target);
+            }))
+                return { kind: "blocked", reason: "unsupported-custody" };
+            const seen = new Set();
+            for (const entry of relevant) {
+                if (entry.state !== "queued" ||
+                    (entry.queueKind !== "prompt" && entry.queueKind !== "control") ||
+                    !entry.queueReceiptId || !entry.queueOwner || entry.queueHandoff) {
+                    return { kind: "blocked", reason: "unsupported-custody" };
+                }
+                if (seen.has(entry.queueReceiptId))
+                    continue;
+                const receiptEntries = source.entries.filter((candidate) => candidate.queueReceiptId === entry.queueReceiptId);
+                if (!receiptEntries.length || receiptEntries.some((candidate) => {
+                    const target = getJournalUpdateTarget(candidate.update);
+                    return candidate.state !== "queued" ||
+                        candidate.queueKind !== entry.queueKind ||
+                        !candidate.queueOwner || candidate.queueHandoff !== undefined ||
+                        !isDeepStrictEqual(candidate.queueOwner, entry.queueOwner) ||
+                        !target || !sameTarget(target, binding.target);
+                }))
+                    return { kind: "blocked", reason: "unsupported-custody" };
+                seen.add(entry.queueReceiptId);
+                plans.push({
+                    source: source.binding,
+                    recovery: {
+                        queueKind: entry.queueKind,
+                        receiptId: entry.queueReceiptId,
+                        sourceUpdateIds: receiptEntries.map((candidate) => candidate.updateId).sort((a, b) => a - b),
+                        deadOwner: entry.queueOwner,
+                        recoveryOwner: deps.getRecoveryOwner(),
+                    },
+                });
+            }
+        }
+        if (!plans.length)
+            return { kind: "blocked", reason: "protection-retained" };
+        for (const plan of plans) {
+            let liveness = "unverifiable";
+            try {
+                liveness = deps.getQueueOwnerLiveness(plan.recovery.deadOwner);
+            }
+            catch { /* Unknown process evidence is never destructive authority. */ }
+            if (liveness === "alive")
+                return { kind: "blocked", reason: "owner-alive" };
+            if (liveness !== "dead")
+                return { kind: "blocked", reason: "owner-unverifiable" };
+        }
+        const recoveredIds = [];
+        for (const plan of plans) {
+            if (!isCurrent() || !deps.isBindingCurrent(binding)) {
+                return { kind: "blocked", reason: "authority-changed" };
+            }
+            const current = deps.getExternalProtection(binding);
+            if (current.liveOwner !== "clear" || current.deliveryAuthority !== "clear") {
+                return { kind: "blocked", reason: "live-owner" };
+            }
+            if (localProtection(binding) !== "clear") {
+                return { kind: "blocked", reason: "local-work" };
+            }
+            let result;
+            try {
+                result = deps.withJournalReference
+                    ? deps.withJournalReference(plan.source, () => plan.source.journal.recoverDeadQueueOwner(plan.recovery))
+                    : plan.source.journal.recoverDeadQueueOwner(plan.recovery);
+            }
+            catch (error) {
+                try {
+                    deps.onMutationError?.(error);
+                }
+                catch { /* Diagnostics are fail-open. */ }
+                return { kind: "blocked", reason: "mutation-refused" };
+            }
+            if (result.status === "owner-alive") {
+                return { kind: "blocked", reason: "owner-alive" };
+            }
+            if (result.status === "owner-unverifiable") {
+                return { kind: "blocked", reason: "owner-unverifiable" };
+            }
+            recoveredIds.push(...result.recoveredUpdateIds);
+        }
+        if (!isCurrent() || !deps.isBindingCurrent(binding)) {
+            return { kind: "blocked", reason: "authority-changed" };
+        }
+        const after = deps.getExternalProtection(binding);
+        if (after.liveOwner !== "clear" || after.acceptedWork !== "clear" ||
+            after.deliveryAuthority !== "clear") {
+            return { kind: "blocked", reason: "protection-retained" };
+        }
+        return {
+            kind: "recovered",
+            receipts: plans.length,
+            updateIds: recoveredIds.sort((a, b) => a - b),
+        };
+    };
+}
 export async function adoptTelegramWorkspaceRetirementIntent(input) {
     return input.runExclusive(async () => {
         const leaderEpoch = input.getLeaderEpoch();
@@ -314,7 +495,7 @@ function isTelegramWorkspaceDeletionConfirmedAbsent(error) {
         return false;
     const status = "status" in error && typeof error.status === "number"
         ? error.status : undefined;
-    if (status !== undefined && status !== 400)
+    if (status !== 400)
         return false;
     const message = error.message.toLowerCase();
     return message.includes("topic_id_invalid") ||
@@ -332,6 +513,47 @@ function matchesTelegramWorkspaceRetirementFence(fence, intent) {
         fence.target.threadId === intent.binding.target.threadId &&
         fence.retirementRequestedAtMs === intent.requestedAtMs);
 }
+async function cancelRejectedTelegramWorkspaceRetirement(input, retained) {
+    const epoch = input.getLeaderEpoch();
+    const isCurrent = () => epoch !== undefined && input.getLeaderEpoch() === epoch &&
+        input.getProfileKey() === retained.profileKey && input.isCurrent?.() !== false;
+    if (!isCurrent())
+        return { kind: "retained", reason: "authority-changed" };
+    if (retained.phase !== "deletion-rejected" ||
+        (retained.destructiveKind ?? "pressure-retirement") !== "pressure-retirement") {
+        return { kind: "retained", reason: "fence-conflict" };
+    }
+    const owner = input.admission.getOwner();
+    const fence = retained.leaderEpoch === epoch && isDeepStrictEqual(retained.owner, owner)
+        ? retained : input.admission.adoptRetirementFence(retained, { owner, leaderEpoch: epoch });
+    if (fence.phase !== "deletion-rejected")
+        return { kind: "retained", reason: "fence-conflict" };
+    const bindingRetained = () => input.store.listWorkspaceBindings().some(binding => binding.bindingKey === fence.bindingKey && binding.slot === fence.slot && sameTarget(binding.target, fence.target));
+    const intents = input.store.listWorkspaceRetirementIntents();
+    if (!bindingRetained() || intents.length > 1 ||
+        (intents[0] && !matchesTelegramWorkspaceRetirementFence(fence, intents[0]))) {
+        return { kind: "retained", reason: "stale-intent" };
+    }
+    if (intents[0] && !input.store.removeWorkspaceRetirementIntent(intents[0])) {
+        return { kind: "retained", reason: "commit-rejected" };
+    }
+    // Publish even after a same-store retry whose failed write left only a dirty
+    // in-memory withdrawal. The rejection fence protects both commit prefixes.
+    await input.store.persist();
+    if (!isCurrent())
+        return { kind: "retained", reason: "authority-changed" };
+    if (input.store.listWorkspaceRetirementIntents().length || !bindingRetained()) {
+        return { kind: "retained", reason: "commit-rejected" };
+    }
+    try {
+        input.admission.completeRejectedRetirementFence(fence);
+    }
+    catch {
+        if (input.admission.read().fence)
+            return { kind: "retained", reason: "fence-release-unconfirmed" };
+    }
+    return { kind: "cancelled", reason: "delete-rejected" };
+}
 export async function executeTelegramWorkspaceRetirement(input) {
     return input.runExclusive(async () => {
         const isCurrent = () => input.getLeaderEpoch() === input.intent.leaderEpoch &&
@@ -360,6 +582,9 @@ export async function executeTelegramWorkspaceRetirement(input) {
                 leaderEpoch: input.intent.leaderEpoch,
             });
         }
+        if (fence?.phase === "deletion-rejected") {
+            return cancelRejectedTelegramWorkspaceRetirement({ ...input, isCurrent }, fence);
+        }
         const intent = input.store.listWorkspaceRetirementIntents().find((candidate) => isDeepStrictEqual(candidate, input.intent));
         const binding = input.store.listWorkspaceBindings().find((candidate) => candidate.bindingKey === input.intent.binding.bindingKey);
         if (!intent || !binding || !isDeepStrictEqual(binding, input.intent.binding)) {
@@ -385,7 +610,8 @@ export async function executeTelegramWorkspaceRetirement(input) {
             return { kind: "retained", reason: "protection-changed" };
         if (!fence) {
             const acquired = input.admission.acquireRetirementFence({
-                operationId: `workspace-retirement:${input.intent.id}`,
+                // A fresh attempt after proven rejection must not revive an old permit.
+                operationId: createTelegramWorkspaceAdmissionOperationId(),
                 retirementIntentId: input.intent.id,
                 bindingKey: binding.bindingKey,
                 slot: binding.slot,
@@ -423,6 +649,12 @@ export async function executeTelegramWorkspaceRetirement(input) {
             }
             catch (error) {
                 if (!isTelegramWorkspaceDeletionConfirmedAbsent(error)) {
+                    const target = getTelegramApiErrorRequestTarget(error);
+                    if (target && sameTarget(target, binding.target) && isTelegramApiRequestRejected(error, "deleteForumTopic")) {
+                        fence = input.admission.confirmRetirementRejection(fence);
+                        const cancellation = await cancelRejectedTelegramWorkspaceRetirement({ ...input, isCurrent }, fence);
+                        return cancellation.kind === "cancelled" ? { kind: "retained", reason: "delete-rejected" } : cancellation;
+                    }
                     return { kind: "retained", reason: "delete-unconfirmed" };
                 }
             }
@@ -541,6 +773,31 @@ export async function prepareTelegramWorkspaceRetirement(deps) {
 }
 export async function runTelegramWorkspaceRetirementLifecycle(input) {
     let intent = input.store.listWorkspaceRetirementIntents()[0];
+    const retainedFence = input.admission.read().fence;
+    if (retainedFence && isTelegramWorkspaceRetirementFence(retainedFence) &&
+        retainedFence.phase === "deletion-rejected") {
+        return input.runExclusive(() => cancelRejectedTelegramWorkspaceRetirement(input, retainedFence));
+    }
+    if (!intent && retainedFence && isTelegramWorkspaceRetirementFence(retainedFence) &&
+        (retainedFence.destructiveKind ?? "pressure-retirement") === "pressure-retirement" &&
+        retainedFence.phase === "commit-ready") {
+        return input.runExclusive(async () => {
+            const epoch = input.getLeaderEpoch();
+            if (epoch === undefined || input.getProfileKey() !== retainedFence.profileKey ||
+                input.isCurrent?.() === false)
+                return { kind: "retained", reason: "authority-changed" };
+            if (input.store.listWorkspaceRetirementIntents().length ||
+                input.store.listWorkspaceBindings().some((binding) => binding.bindingKey === retainedFence.bindingKey)) {
+                return { kind: "retained", reason: "stale-intent" };
+            }
+            const owner = input.admission.getOwner();
+            const fence = retainedFence.leaderEpoch === epoch &&
+                isDeepStrictEqual(retainedFence.owner, owner) ? retainedFence :
+                input.admission.adoptRetirementFence(retainedFence, { owner, leaderEpoch: epoch });
+            input.admission.completeRetirementFence(fence);
+            return { kind: "retired", bindingKey: fence.bindingKey, slot: fence.slot };
+        });
+    }
     if (intent) {
         const adoption = await adoptTelegramWorkspaceRetirementIntent({
             store: input.store,
@@ -585,3 +842,122 @@ export async function runTelegramWorkspaceRetirementLifecycle(input) {
         confirmTargetAbsent: input.confirmTargetAbsent,
     });
 }
+/** Retry allocation once, only after the failed operation released all ordinary leases. */
+export function createTelegramWorkspaceSlotRotation(input) {
+    const requests = createTelegramWorkspaceOperationGate();
+    return async (operation) => {
+        const admission = input.getAdmission();
+        const epoch = input.getLeaderEpoch();
+        if (!admission || epoch === undefined)
+            return operation();
+        const profileKey = admission.getProfileKey();
+        const isCurrent = () => input.getLeaderEpoch() === epoch &&
+            input.getAdmission()?.getProfileKey() === profileKey;
+        return requests.runExclusive(async () => {
+            if (!isCurrent())
+                throw new Error("Telegram Workspace allocation lost leader authority.");
+            const rotate = async () => {
+                const result = await input.runExclusive(async () => {
+                    if (!isCurrent())
+                        throw new Error("Telegram Workspace rotation lost leader authority.");
+                    await input.store.load();
+                    if (!isCurrent())
+                        throw new Error("Telegram Workspace rotation lost leader authority.");
+                    return runTelegramWorkspaceRetirementLifecycle({
+                        store: input.store, admission, getExternalProtection: input.getExternalProtection,
+                        getLeaderEpoch: input.getLeaderEpoch, getProfileKey: () => profileKey, isCurrent,
+                        // This entire lifecycle already owns the shared gate, without an admission lease.
+                        runExclusive: async (action) => action(),
+                        deleteForumTopic(permit, body) {
+                            return input.deleteThread(() => {
+                                const fence = admission.read().fence;
+                                if (!isCurrent() || !fence || !isTelegramWorkspaceRetirementFence(fence) ||
+                                    (fence.destructiveKind ?? "pressure-retirement") !== "pressure-retirement" ||
+                                    (permit.destructiveKind ?? "pressure-retirement") !== "pressure-retirement" ||
+                                    fence.phase !== "deletion-issued" ||
+                                    !isDeepStrictEqual(fence.owner, admission.getOwner()) ||
+                                    fence.profileKey !== permit.profileKey || fence.leaderEpoch !== permit.leaderEpoch ||
+                                    fence.operationId !== permit.operationId || fence.retirementIntentId !== permit.retirementIntentId ||
+                                    fence.bindingKey !== permit.bindingKey || fence.slot !== permit.slot ||
+                                    fence.deletionIssuedAtMs !== permit.issuedAtMs ||
+                                    !sameTarget(fence.target, permit.target) ||
+                                    body.chat_id !== permit.target.chatId || body.message_thread_id !== permit.target.threadId) {
+                                    throw new Error("Telegram Workspace deletion permit is stale.");
+                                }
+                                return { ...permit.target };
+                            });
+                        },
+                    });
+                });
+                if (result.kind !== "retired" && result.kind !== "not-needed" && result.kind !== "cancelled") {
+                    throw new Error(`Telegram Workspace slots A-Z are unavailable; rotation blocked (${result.reason}).`);
+                }
+                if (result.kind === "retired") {
+                    try {
+                        input.recordEvent("Telegram Workspace slot rotated.", { slot: result.slot });
+                    }
+                    catch { /* Diagnostics cannot turn completed retirement into another attempt. */ }
+                }
+                if (!isCurrent())
+                    throw new Error("Telegram Workspace rotation lost leader authority.");
+                return result;
+            };
+            const pending = await input.runExclusive(async () => {
+                await input.store.load();
+                if (!isCurrent())
+                    throw new Error("Telegram Workspace allocation lost leader authority.");
+                return input.store.listWorkspaceRetirementIntents().length > 0;
+            });
+            const fence = admission.read().fence;
+            if (pending || (fence && isTelegramWorkspaceRetirementFence(fence) &&
+                (fence.destructiveKind ?? "pressure-retirement") === "pressure-retirement")) {
+                const recovered = await rotate();
+                if (recovered.kind !== "cancelled")
+                    return operation();
+            }
+            try {
+                return await operation();
+            }
+            catch (error) {
+                if (!(error instanceof TelegramWorkspaceSlotUnavailableError))
+                    throw error;
+                if (input.reclaimDeadOwnerQueuedWork) {
+                    const candidates = await input.runExclusive(async () => {
+                        await input.store.load();
+                        if (!isCurrent())
+                            throw new Error("Telegram Workspace reclamation lost leader authority.");
+                        const snapshot = input.store.captureWorkspaceSlotOccupancy(input.getExternalProtection);
+                        const allocation = planTelegramWorkspaceSlotAllocation({ ...snapshot, nowMs: Date.now() });
+                        if (allocation.kind !== "blocked" || allocation.reason !== "protected-capacity")
+                            return [];
+                        return input.store.listWorkspaceBindings().filter((binding) => typeof binding.inactiveSinceMs === "number" &&
+                            Number.isFinite(binding.inactiveSinceMs) &&
+                            binding.inactiveSinceMs >= 0).sort((left, right) => left.inactiveSinceMs - right.inactiveSinceMs ||
+                            (left.slot ?? "").localeCompare(right.slot ?? ""));
+                    });
+                    for (const binding of candidates) {
+                        const evidence = input.getExternalProtection(binding);
+                        if (evidence.liveOwner !== "clear" ||
+                            evidence.acceptedWork !== "protected" ||
+                            evidence.deliveryAuthority !== "clear")
+                            continue;
+                        const reclaimed = await input.reclaimDeadOwnerQueuedWork(binding, isCurrent);
+                        if (reclaimed.kind === "recovered") {
+                            try {
+                                input.recordEvent("Telegram Workspace dead-owner queue reclaimed.", {
+                                    slot: binding.slot,
+                                    receipts: reclaimed.receipts,
+                                    updateCount: reclaimed.updateIds.length,
+                                });
+                            }
+                            catch { /* Diagnostics cannot revoke journal-owned recovery. */ }
+                            break;
+                        }
+                    }
+                }
+                await rotate();
+                return operation();
+            }
+        });
+    };
+}

package/node_modules/@llblab/pi-telegram/dist/lib/workspace-slots.d.ts

@@ -6,6 +6,9 @@
  * a selection is a proposal, never authority to retire a binding.
  */
 export declare const TELEGRAM_WORKSPACE_SLOTS = "abcdefghijklmnopqrstuvwxyz";
+export declare class TelegramWorkspaceSlotUnavailableError extends Error {
+    constructor();
+}
 export interface TelegramWorkspaceSlotOccupancy {
     bindingKey: string;
     slot: string;

package/node_modules/@llblab/pi-telegram/dist/lib/workspace-slots.js

@@ -6,6 +6,12 @@
  * a selection is a proposal, never authority to retire a binding.
  */
 export const TELEGRAM_WORKSPACE_SLOTS = "abcdefghijklmnopqrstuvwxyz";
+export class TelegramWorkspaceSlotUnavailableError extends Error {
+    constructor() {
+        super("Telegram Workspace slot reservation is unavailable.");
+        this.name = "TelegramWorkspaceSlotUnavailableError";
+    }
+}
 function isSlot(slot) {
     return /^[a-z]$/u.test(slot);
 }

package/node_modules/@llblab/pi-telegram/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.50.1",
+  "version": "0.51.0",
   "private": false,
   "publishConfig": {
     "access": "public"