@llblab/pi-kit 0.19.2 → 0.21.0

package/node_modules/@llblab/pi-telegram/dist/lib/workspace-admission.js

@@ -195,6 +195,12 @@ function normalizeFence(value, profileKey) {
             deletionIssuedAtMs: value.deletionIssuedAtMs,
         };
     }
+    if (value.phase === "deletion-rejected" &&
+        (value.destructiveKind === undefined || value.destructiveKind === "pressure-retirement") &&
+        isSafeTimestamp(value.deletionIssuedAtMs) && isSafeTimestamp(value.rejectionConfirmedAtMs)) {
+        return { ...base, destructiveKind: value.destructiveKind, phase: "deletion-rejected",
+            deletionIssuedAtMs: value.deletionIssuedAtMs, rejectionConfirmedAtMs: value.rejectionConfirmedAtMs };
+    }
     if (value.phase === "commit-ready" &&
         isSafeTimestamp(value.absenceConfirmedAtMs) &&
         (value.deletionIssuedAtMs === undefined ||
@@ -395,6 +401,10 @@ function areFencesEqual(left, right) {
         right.phase === "deletion-issued") {
         return left.deletionIssuedAtMs === right.deletionIssuedAtMs;
     }
+    if (left.phase === "deletion-rejected" && right.phase === "deletion-rejected") {
+        return left.deletionIssuedAtMs === right.deletionIssuedAtMs &&
+            left.rejectionConfirmedAtMs === right.rejectionConfirmedAtMs;
+    }
     return (left.phase === "commit-ready" &&
         right.phase === "commit-ready" &&
         left.absenceConfirmedAtMs === right.absenceConfirmedAtMs &&
@@ -1023,6 +1033,9 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
         if (!areOwnersEqual(expected.owner, options.owner)) {
             authorityChanged("Telegram Workspace absence confirmation requires fence owner authority.");
         }
+        if (expected.phase === "deletion-rejected") {
+            authorityChanged("Rejected Telegram Workspace deletion cannot confirm absence.");
+        }
         return transact((state) => {
             if (!state.fence || !isTelegramWorkspaceRetirementFence(state.fence)) {
                 authorityChanged("Telegram Workspace retirement fence is absent or has another kind.");
@@ -1069,7 +1082,7 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
             return { result: true, changed: true };
         });
     }
-    function completeRetirementFence(expected, expectedKind = "pressure-retirement") {
+    function completeDestructiveFence(expected, expectedKind, requiredPhase) {
         validateExpectedFence(expected, options.profileKey);
         if (resolveTelegramWorkspaceDestructiveFenceKind(expected) !== expectedKind)
             authorityChanged("Telegram Workspace destructive fence kind changed.");
@@ -1084,13 +1097,44 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
             if (!areFencesEqual(state.fence, expected)) {
                 authorityChanged("Telegram Workspace retirement fence authority changed.");
             }
-            if (state.fence.phase !== "commit-ready") {
-                authorityChanged("Telegram Workspace retirement commit is not ready.");
+            if (state.fence.phase !== requiredPhase) {
+                authorityChanged(requiredPhase === "commit-ready"
+                    ? "Telegram Workspace retirement commit is not ready."
+                    : "Telegram Workspace retirement rejection is not confirmed.");
             }
             delete state.fence;
             return { result: true, changed: true };
         });
     }
+    function confirmRetirementRejection(expected) {
+        validateExpectedFence(expected, options.profileKey);
+        if (resolveTelegramWorkspaceDestructiveFenceKind(expected) !== "pressure-retirement" ||
+            !areOwnersEqual(expected.owner, options.owner) ||
+            (expected.phase !== "deletion-issued" && expected.phase !== "deletion-rejected")) {
+            authorityChanged("Telegram Workspace rejection requires exact issued retirement authority.");
+        }
+        return transact((state) => {
+            const current = state.fence;
+            if (!current || !isTelegramWorkspaceRetirementFence(current) || !areFenceBasesEqual(current, expected) ||
+                (current.phase !== "deletion-issued" && current.phase !== "deletion-rejected") ||
+                current.deletionIssuedAtMs !== expected.deletionIssuedAtMs ||
+                (expected.phase === "deletion-rejected" && !areFencesEqual(current, expected))) {
+                authorityChanged("Telegram Workspace retirement fence authority changed.");
+            }
+            if (current.phase === "deletion-rejected")
+                return { result: cloneFence(current), changed: false };
+            const rejected = { ...current,
+                destructiveKind: "pressure-retirement", phase: "deletion-rejected", rejectionConfirmedAtMs: getNowMs() };
+            state.fence = rejected;
+            return { result: cloneFence(rejected), changed: true };
+        });
+    }
+    function completeRetirementFence(expected, expectedKind = "pressure-retirement") {
+        return completeDestructiveFence(expected, expectedKind, "commit-ready");
+    }
+    function completeRejectedRetirementFence(expected) {
+        return completeDestructiveFence(expected, "pressure-retirement", "deletion-rejected");
+    }
     function adoptThreadCleanupFence(expected, replacement) {
         return adoptRetirementFence(expected, replacement, "manual-thread-cleanup");
     }
@@ -1128,6 +1172,8 @@ export function createTelegramWorkspaceAdmissionLedger(options) {
         issueThreadCleanupDeletionPermit,
         confirmRetirementAbsence,
         confirmThreadCleanupAbsence,
+        confirmRetirementRejection,
+        completeRejectedRetirementFence,
         releaseUnissuedRetirementFence,
         releaseUnissuedThreadCleanupFence,
         completeRetirementFence,

package/node_modules/@llblab/pi-telegram/dist/lib/workspace-retirement.d.ts

@@ -1,10 +1,12 @@
 /**
- * Workspace retirement preparation
+ * Workspace slot rotation
  * Zones: telegram, workspace identity, lifecycle
- * Owns fail-closed protection composition, pressure selection, exact-intent admission,
- * successor adoption, and gated mocked deletion with durable retirement commit.
+ * Owns fail-closed protection, demand-driven pressure retirement, exact-intent admission,
+ * successor recovery, and fenced one-shot deletion before durable slot reuse.
  */
+import type { TelegramUpdateJournalDeadQueueOwnerRecoveryInput, TelegramUpdateJournalDeadQueueOwnerRecoveryResult, TelegramUpdateJournalEntry, TelegramUpdateJournalQueueOwnerIdentity } from "./journal.ts";
 import type { TelegramTarget } from "./target.ts";
+import { type TelegramWorkspaceThreadDeletionTransport } from "./telegram-api.ts";
 import type { TelegramTopicTargetStore, TelegramWorkspaceExternalProtectionEvidence, TelegramWorkspaceRetirementIntent, TelegramWorkspaceProtectionState, TelegramWorkspaceThreadBinding } from "./threads.ts";
 import { type TelegramWorkspaceAdmissionLedger, type TelegramWorkspaceAdmissionScope, type TelegramWorkspaceDeletionPermit } from "./workspace-admission.ts";
 export interface TelegramWorkspaceOperationGate {
@@ -36,6 +38,11 @@ interface TelegramWorkspaceJournalReader {
             }[];
         };
     };
+    readForProtection?: () => {
+        entries: readonly {
+            update: unknown;
+        }[];
+    };
 }
 export declare function captureTelegramWorkspaceJournalProtectionSources(input: {
     binding: TelegramWorkspaceThreadBinding;
@@ -134,6 +141,54 @@ export declare function createTelegramWorkspaceExternalProtectionCapture(deps: {
     getJournalWriterProtection?: (journalBindingKey: string) => TelegramWorkspaceProtectionState;
     getDeliveryAuthorityProtection?: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceProtectionState;
 }): (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceExternalProtectionEvidence;
+export declare function isCurrentTelegramWorkspaceBinding(store: Pick<TelegramTopicTargetStore, "listWorkspaceBindings">, expected: TelegramWorkspaceThreadBinding): boolean;
+export interface TelegramWorkspaceDeadQueueJournalBinding {
+    recoveryKey?: string;
+    readForProtection?: () => {
+        entries: readonly TelegramUpdateJournalEntry[];
+    };
+    journal: {
+        recoverDeadQueueOwner: (input: TelegramUpdateJournalDeadQueueOwnerRecoveryInput) => TelegramUpdateJournalDeadQueueOwnerRecoveryResult;
+    };
+}
+export type TelegramWorkspaceDeadQueueReclamation = {
+    kind: "not-needed";
+} | {
+    kind: "recovered";
+    receipts: number;
+    updateIds: number[];
+} | {
+    kind: "blocked";
+    reason: "authority-changed" | "live-owner" | "local-work" | "incomplete-source" | "unsupported-custody" | "owner-alive" | "owner-unverifiable" | "mutation-refused" | "protection-retained";
+};
+/**
+ * Demand-only preparation for pressure retirement. Every removed group is still
+ * owned by the journal's exact dead-owner CAS; this function never clears local
+ * queue memory or turns unknown evidence into deletion authority.
+ */
+export declare function createTelegramWorkspaceDeadOwnerQueueReclaimer(deps: {
+    getExternalProtection: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceExternalProtectionEvidence;
+    getActiveTurnTarget: () => TelegramTarget | undefined;
+    getQueuedItems: () => readonly {
+        chatId: number;
+        target?: TelegramTarget;
+    }[];
+    resolveLeaderJournal: () => TelegramWorkspaceDeadQueueJournalBinding | undefined;
+    createFollowerJournalResolver: (journalBindingKey: string) => () => TelegramWorkspaceDeadQueueJournalBinding | undefined;
+    discoverFollowerJournals?: () => {
+        paths: readonly string[];
+        complete: boolean;
+    };
+    createJournalPathResolver?: (path: string) => () => TelegramWorkspaceDeadQueueJournalBinding | undefined;
+    withJournalReference?: <T>(binding: TelegramWorkspaceDeadQueueJournalBinding, operation: () => T) => T;
+    getRecoveryOwner: () => TelegramUpdateJournalQueueOwnerIdentity;
+    getQueueOwnerLiveness: (owner: {
+        processId: number;
+        processBirthId: string;
+    }) => "alive" | "dead" | "unverifiable";
+    isBindingCurrent: (binding: TelegramWorkspaceThreadBinding) => boolean;
+    onMutationError?: (error: unknown) => void;
+}): (binding: TelegramWorkspaceThreadBinding, isCurrent: () => boolean) => Promise<TelegramWorkspaceDeadQueueReclamation>;
 export type TelegramWorkspaceRetirementAdoption = {
     kind: "adopted";
     intent: TelegramWorkspaceRetirementIntent;
@@ -154,14 +209,17 @@ export type TelegramWorkspaceRetirementExecution = {
     kind: "retired";
     bindingKey: string;
     slot: string;
+} | {
+    kind: "cancelled";
+    reason: "delete-rejected";
 } | {
     kind: "retained";
-    reason: "stale-intent" | "protection-changed" | "admission-active" | "fence-conflict" | "delete-unconfirmed" | "authority-changed" | "commit-rejected" | "fence-release-unconfirmed";
+    reason: "stale-intent" | "protection-changed" | "admission-active" | "fence-conflict" | "delete-unconfirmed" | "delete-rejected" | "authority-changed" | "commit-rejected" | "fence-release-unconfirmed";
 };
 export type TelegramWorkspaceRetirementAbsence = "absent" | "present" | "unknown";
 export declare function executeTelegramWorkspaceRetirement(input: {
-    store: Pick<TelegramTopicTargetStore, "captureWorkspaceSlotOccupancy" | "listWorkspaceBindings" | "listWorkspaceRetirementIntents" | "commitWorkspaceRetirement">;
-    admission: Pick<TelegramWorkspaceAdmissionLedger, "getOwner" | "read" | "acquireRetirementFence" | "adoptRetirementFence" | "issueDeletionPermit" | "confirmRetirementAbsence" | "releaseUnissuedRetirementFence" | "completeRetirementFence">;
+    store: Pick<TelegramTopicTargetStore, "captureWorkspaceSlotOccupancy" | "listWorkspaceBindings" | "listWorkspaceRetirementIntents" | "commitWorkspaceRetirement" | "removeWorkspaceRetirementIntent" | "persist">;
+    admission: Pick<TelegramWorkspaceAdmissionLedger, "getOwner" | "read" | "acquireRetirementFence" | "adoptRetirementFence" | "issueDeletionPermit" | "confirmRetirementAbsence" | "confirmRetirementRejection" | "completeRejectedRetirementFence" | "releaseUnissuedRetirementFence" | "completeRetirementFence">;
     intent: TelegramWorkspaceRetirementIntent;
     getExternalProtection: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceExternalProtectionEvidence;
     getLeaderEpoch: () => number | string | undefined;
@@ -216,4 +274,17 @@ export declare function runTelegramWorkspaceRetirementLifecycle(input: {
     deleteForumTopic: Parameters<typeof executeTelegramWorkspaceRetirement>[0]["deleteForumTopic"];
     confirmTargetAbsent?: Parameters<typeof executeTelegramWorkspaceRetirement>[0]["confirmTargetAbsent"];
 }): Promise<TelegramWorkspaceRetirementLifecycleResult>;
+export type TelegramWorkspaceCapacityRunner = <T>(operation: () => Promise<T>) => Promise<T>;
+export interface TelegramWorkspaceSlotRotationPorts extends TelegramWorkspaceOperationGate {
+    getAdmission: () => TelegramWorkspaceAdmissionLedger | undefined;
+    deleteThread: TelegramWorkspaceThreadDeletionTransport;
+    reclaimDeadOwnerQueuedWork?: (binding: TelegramWorkspaceThreadBinding, isCurrent: () => boolean) => Promise<TelegramWorkspaceDeadQueueReclamation>;
+}
+/** Retry allocation once, only after the failed operation released all ordinary leases. */
+export declare function createTelegramWorkspaceSlotRotation(input: TelegramWorkspaceSlotRotationPorts & {
+    store: TelegramTopicTargetStore;
+    getLeaderEpoch: () => number | string | undefined;
+    getExternalProtection: (binding: TelegramWorkspaceThreadBinding) => TelegramWorkspaceExternalProtectionEvidence;
+    recordEvent: (message: string, details: Record<string, unknown>) => void;
+}): TelegramWorkspaceCapacityRunner;
 export {};