@mulmoclaude/core 1.10.0 → 1.12.0

package/dist/feeds/server/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("../../rolldown-runtime-D6vf50IK.cjs");
 const require_calendarGrid = require("../../calendarGrid-CaS9er8i.cjs");
-const require_discovery = require("../../discovery-DYcR83qx.cjs");
-const require_server = require("../../server-l4TZ5Lbf.cjs");
+const require_discovery = require("../../discovery-NRy3tyUA.cjs");
+const require_server = require("../../server-7U-3DE2e.cjs");
 const require_feeds_paths = require("../paths.cjs");
 const require_ingestTypes = require("../../ingestTypes-D1GQdG8e.cjs");
 const require_notifier = require("../../notifier-tMsAXyXp.cjs");

package/dist/feeds/server/index.js

@@ -1,6 +1,6 @@
 import { C as FEED_SCHEDULES, w as INGEST_KINDS } from "../../calendarGrid-CrGxeCOG.js";
-import { N as listItems, V as resolveDataDir, W as safeSlugName, d as storeFor, et as createForwardingLogger, n as discoverCollections, tt as createHostSlot } from "../../discovery-_fjsluLx.js";
-import { A as buildCollectionActionSeedPrompt, P as readSkillTemplate, j as promptPathsFor } from "../../server-BlIrtGKl.js";
+import { N as listItems, V as resolveDataDir, W as safeSlugName, d as storeFor, et as createForwardingLogger, n as discoverCollections, tt as createHostSlot } from "../../discovery-B4CZvrXR.js";
+import { A as buildCollectionActionSeedPrompt, P as readSkillTemplate, j as promptPathsFor } from "../../server-DdyIvFhz.js";
 import { FEEDS_DIR, feedDir, feedStatePath, feedsRoot, ingestStateDir, ingestStatePath } from "../paths.js";
 import { n as DEFAULT_FEED_MAX_ITEMS, r as isFeedSchedule, t as AGENT_INGEST_KIND } from "../../ingestTypes-XReG-li7.js";
 import { d as publish, n as clear } from "../../notifier-BdA5qzhe.js";

package/dist/google/calendar.d.ts

@@ -40,6 +40,7 @@ export type CalendarEventSpan = {
 export type CalendarEventInput = {
     summary: string;
     description?: string;
+    location?: string;
     /** Calendar to create the event on; defaults to the user's primary. */
     calendarId?: string;
     /** Event colour (Google event palette id "1".."11"); omit to inherit the calendar's colour. */
@@ -61,6 +62,8 @@ export interface UpdateCalendarEventInput {
     end?: CalendarEventTime;
     /** `""` clears the description; omit to leave it untouched. */
     description?: string;
+    /** `""` clears the location; omit to leave it untouched. */
+    location?: string;
     calendarId?: string;
     colorId?: string;
     /** Etag of the version this edit was computed against. Sent as `If-Match`, so
@@ -87,6 +90,12 @@ export interface CalendarEventSummary {
     status: string;
     /** Google event palette id ("1".."11"), or "" when the event inherits the calendar's colour. */
     colorId: string;
+    /** The event body, RAW. Google stores limited HTML here, and normalising it on
+     *  the way in would silently strip the user's formatting on the way back out —
+     *  a mirrored calendar has to survive the round trip, so any prettifying
+     *  belongs to whatever displays it. */
+    description: string;
+    location: string;
 }
 export interface CalendarSummary {
     id: string;

package/dist/google/calendarLock.d.ts

@@ -0,0 +1,16 @@
+/** Serialise `run` against whatever is already running for `key`.
+ *
+ *  `locks` is passed in so the queuing rule is testable without module state;
+ *  the key is dropped once nothing is queued behind it, so the map cannot grow
+ *  an entry per calendar forever. A failed predecessor still releases the
+ *  queue — `then(run, run)`. */
+export declare function withKeyedLock<T>(locks: Map<string, Promise<unknown>>, key: string, run: () => Promise<T>): Promise<T>;
+/** Serialise anything that touches ONE calendar's sync state.
+ *
+ *  Shared with the push path (#2598), not only the pull doors: a push that
+ *  overtakes an in-flight pull would record a baseline for events the pull is
+ *  still writing, so the next push would diff against a future it never saw.
+ *
+ *  NOT reentrant — a holder must call the lock-free form of whatever it drives,
+ *  or it waits on itself forever. */
+export declare function withCalendarLock<T>(calendarId: string | undefined, run: () => Promise<T>): Promise<T>;

package/dist/google/calendarPushState.d.ts

@@ -1,7 +1,7 @@
 import { CalendarEventSummary } from './calendar.js';
 /** The pushable subset of an event. `htmlLink` and `status` are read-only on
  *  Google's side, so a baseline for them could never be acted on. */
-export type ShadowEvent = Pick<CalendarEventSummary, "summary" | "start" | "end" | "colorId">;
+export type ShadowEvent = Pick<CalendarEventSummary, "summary" | "start" | "end" | "colorId" | "description" | "location">;
 /** `<workspace>/data/calendar/.push-state.json` */
 export declare function calendarPushStatePath(workspaceRoot?: string): string;
 export declare const toShadowEvent: (event: CalendarEventSummary) => ShadowEvent;

package/dist/google/calendarSyncDue.d.ts

@@ -0,0 +1,10 @@
+/** How long a fresh marker suppresses a sync: one interval, less the slack.
+ *  The slack is halved rather than subtracted flat for a very short configured
+ *  interval, where a fixed five minutes would swallow the window whole. */
+export declare function calendarSyncDueWindowMs(intervalMs: number): number;
+/** True iff no recent enough run stands in for this one.
+ *
+ *  A marker that cannot be read as a time is treated as due: a stuck calendar is
+ *  worse than a duplicate run, which the sync is built to tolerate anyway
+ *  (writes are upserts by event id). */
+export declare function isCalendarSyncDue(lastSyncedAt: string | null, windowMs: number, now?: number): boolean;

package/dist/google/calendarSyncStore.d.ts

@@ -3,5 +3,24 @@ export declare function calendarSyncStatePath(workspaceRoot?: string): string;
 export declare function loadCalendarSyncToken(calendarId?: string, workspaceRoot?: string): Promise<string | null>;
 export declare function saveCalendarSyncToken(calendarId: string | undefined, syncToken: string, workspaceRoot?: string): Promise<void>;
 /** Drop one calendar's token — used when Google answers 410, so the next run
- *  starts a clean full sync. */
+ *  starts a clean full sync. Leaves the sync marker alone: "restart the walk"
+ *  says nothing about "nobody is running". */
 export declare function clearCalendarSyncToken(calendarId?: string, workspaceRoot?: string): Promise<void>;
+export declare function loadCalendarLastSyncedAt(calendarId?: string, workspaceRoot?: string): Promise<string | null>;
+/** Stamp when a sync of this calendar started, but only if `mayClaim` accepts
+ *  what the marker currently says. Answers whether THIS call is the one that
+ *  claimed it.
+ *
+ *  The decision and the stamp share one pass through the queue on purpose.
+ *  Deciding from a snapshot read earlier — as a caller filtering a whole map of
+ *  calendars up front must — leaves both hosts believing the calendar is free,
+ *  which is the race this exists to close (Codex review #2680). What remains is
+ *  the read→write gap BETWEEN processes; closing that needs a real file lock
+ *  (#2679), and this stays a soft dedup until then.
+ *
+ *  The time is passed in rather than read here so the rule stays testable
+ *  without freezing the clock. */
+export declare function claimCalendarSyncIfDue(calendarId: string | undefined, startedAt: string, mayClaim: (lastSyncedAt: string | null) => boolean, workspaceRoot?: string): Promise<boolean>;
+/** Drop one calendar's marker, so the next tick — on either host — may sync it
+ *  immediately instead of waiting the window out. */
+export declare function clearCalendarLastSyncedAt(calendarId?: string, workspaceRoot?: string): Promise<void>;

package/dist/google/collectionProjection.d.ts

@@ -0,0 +1,18 @@
+import { CollectionFieldSpec, CollectionItem } from '../collection/core/schema.js';
+import { GOOGLE_CALENDAR_SOURCE_FIELDS } from '../collection/core/schemaZ.js';
+import { CalendarEventSummary } from './calendar.js';
+/** The event fields a schema may map from — narrowed to real keys of
+ *  `CalendarEventSummary` so the projection below needs no cast. */
+export type GoogleCalendarSourceField = (typeof GOOGLE_CALENDAR_SOURCE_FIELDS)[number];
+/** Project one Google event onto the collection's own field names. The
+ *  primary field always takes the event id — upsert-by-id is what keeps the
+ *  sync idempotent, so it is deliberately not remappable. */
+export declare function toCollectionRecord(event: CalendarEventSummary, map: Record<string, GoogleCalendarSourceField>, primaryKey: string, fields: Record<string, CollectionFieldSpec>): CollectionItem;
+/** Google's mapped values laid over whatever the record already holds.
+ *
+ *  A record file is written whole (`writeItem`), so projecting alone would drop
+ *  every column the map does not name — a collection cannot then carry a local
+ *  note next to a mirrored event, because the next pull that touches that event
+ *  silently deletes it. The projection still wins on the fields it covers: those
+ *  are Google's to own. */
+export declare function mergeIntoExisting(existing: CollectionItem | null, projected: CollectionItem): CollectionItem;

package/dist/google/collectionPush.d.ts

@@ -1,4 +1,8 @@
 import { LoadedCollection } from '../collection/server/discoveredCollection.js';
+import { CollectionFieldSpec, CollectionItem } from '../collection/core/schema.js';
+import { CalendarEventSummary } from './calendar.js';
+import { ShadowEvent } from './calendarPushState.js';
+import { PushableSourceField } from './pushPlan.js';
 /** What the up-front writability gate knows about the target calendar. */
 export interface CalendarWriteTarget {
     /** The role from the user's calendar LIST, or null when the calendar is not in
@@ -27,6 +31,15 @@ export interface CalendarCollectionPushResult {
     /** Records that cannot be pushed as they stand, each with the reason. */
     skipped: string[];
     errors: string[];
+    /** Records whose local edit did NOT reach Google and would be destroyed by
+     *  the pull that follows an automatic push (#2620).
+     *
+     *  Only the two states where overwriting loses work with nowhere to recover
+     *  it from: a both-sides conflict, and an unexpected failure. A `skipped`
+     *  record is deliberately absent — several of its reasons (an id already
+     *  taken in Google, an unmappable span) are recovered BY letting the pull
+     *  write, so protecting them would stall the collection instead. */
+    unpushedIds: string[];
 }
 export type CalendarPushOutcome = {
     kind: "pushed";
@@ -55,6 +68,54 @@ export interface CalendarPushDeps {
     accessToken: () => Promise<string>;
     calendarMeta: (accessToken: string, calendarId: string | undefined) => Promise<CalendarWriteTarget>;
 }
+type PushOutcome = {
+    kind: "created";
+    event: CalendarEventSummary;
+} | {
+    kind: "updated";
+    event: CalendarEventSummary;
+} | {
+    kind: "conflict";
+}
+/** `event` present only when this record's baseline had to be repaired (an
+ *  event that already existed in Google), so the write path can persist it. */
+ | {
+    kind: "unchanged";
+    event?: CalendarEventSummary;
+} | {
+    kind: "skipped";
+    message: string;
+} | {
+    kind: "error";
+    message: string;
+};
+export type PushOutcomeKind = PushOutcome["kind"];
+/** Whether this outcome leaves a local edit that only exists locally, so the
+ *  pull must not overwrite the record and the baseline must not advance. */
+export declare const isUnpushed: (kind: PushOutcomeKind) => boolean;
+/** Record ids whose local value no longer matches the baseline — edits that have
+ *  not reached Google.
+ *
+ *  Pure, and deliberately built from `planRecord`, so it answers with exactly the
+ *  records a push WOULD have acted on. A private re-implementation would drift
+ *  from the push and protect the wrong set. */
+export declare function locallyEditedIds(records: readonly CollectionItem[], shadow: Record<string, ShadowEvent>, map: Record<string, PushableSourceField>, primaryKey: string, fields: Record<string, CollectionFieldSpec>): string[];
+/** The same set, read from the workspace.
+ *
+ *  Needed when a push cannot run AT ALL — a calendar whose role degraded to
+ *  reader, a revoked grant, an IO failure. The pull still runs, since reading
+ *  needs no write access, and would overwrite exactly these records while
+ *  advancing their baseline past the edit (CodeRabbit review #2666). Computed
+ *  from the stored baseline alone, so it works precisely when Google is the
+ *  thing that is unreachable. */
+export declare function unsentLocalEdits(collection: LoadedCollection, workspaceRoot: string): Promise<string[]>;
+/** Push one collection WITHOUT taking the calendar lock.
+ *
+ *  The caller must already hold it. The scheduled push→pull cycle
+ *  (`collectionSync.ts`) runs inside the lock it took for the pull, and the lock
+ *  is not reentrant — going through `pushCalendarForCollection` there would make
+ *  the sync wait on itself forever. */
+export declare function pushCollectionNow(collection: LoadedCollection, workspaceRoot: string, deps?: CalendarPushDeps): Promise<CalendarPushOutcome>;
 /** Push ONE collection's records to the calendar it declares.
  *
  *  "Does this collection sync at all" is answered before "is Google linked", for
@@ -62,3 +123,4 @@ export interface CalendarPushDeps {
  *  account for a collection that never declared a calendar sends them fixing the
  *  wrong thing. */
 export declare function pushCalendarForCollection(slug: string, workspaceRoot: string, deps?: CalendarPushDeps): Promise<CalendarPushOutcome>;
+export {};

package/dist/google/collectionSync.d.ts

@@ -1,8 +1,6 @@
 import { SystemTaskDef } from '../scheduler/adapter.js';
 import { LoadedCollection } from '../collection/server/discoveredCollection.js';
 import { DeleteItemResult, WriteItemResult } from '../collection/server/io.js';
-import { CollectionFieldSpec, CollectionItem } from '../collection/core/schema.js';
-import { GOOGLE_CALENDAR_SOURCE_FIELDS } from '../collection/core/schemaZ.js';
 import { CalendarEventSummary } from './calendar.js';
 import { ShadowEvent } from './calendarPushState.js';
 export declare const GOOGLE_CALENDAR_SYNC_TASK_ID = "system:google-calendar-sync";
@@ -16,13 +14,6 @@ export interface CalendarCollectionSyncResult {
     /** Retryable failures. Any of these hold the sync token back. */
     errors: string[];
 }
-/** The event fields a schema may map from — narrowed to real keys of
- *  `CalendarEventSummary` so the projection below needs no cast. */
-type GoogleCalendarSourceField = (typeof GOOGLE_CALENDAR_SOURCE_FIELDS)[number];
-/** Project one Google event onto the collection's own field names. The
- *  primary field always takes the event id — upsert-by-id is what keeps the
- *  sync idempotent, so it is deliberately not remappable. */
-export declare function toCollectionRecord(event: CalendarEventSummary, map: Record<string, GoogleCalendarSourceField>, primaryKey: string, fields: Record<string, CollectionFieldSpec>): CollectionItem;
 /** `skipped` is a benign no-op; `unwritable` can never succeed so it must NOT
  *  hold the token; `error` is retryable and does hold it. */
 type ApplyOutcome = {
@@ -40,13 +31,55 @@ type ApplyOutcome = {
 };
 export declare function classifyWrite(eventId: string, kind: WriteItemResult["kind"]): ApplyOutcome;
 export declare function classifyDelete(eventId: string, kind: DeleteItemResult["kind"]): ApplyOutcome;
-/** Serialise `run` against whatever is already running for `key`.
+/** The events of a window a pull may act on.
  *
- *  `locks` is passed in so the queuing rule is testable without module state;
- *  the key is dropped once nothing is queued behind it, so the map cannot grow
- *  an entry per calendar forever. A failed predecessor still releases the
- *  queue — `then(run, run)`. */
-export declare function withKeyedLock<T>(locks: Map<string, Promise<unknown>>, key: string, run: () => Promise<T>): Promise<T>;
+ *  A record the push just refused to send is edited on BOTH sides. Writing
+ *  Google's value over it destroys the local edit the push declined to resolve,
+ *  so the local one stands. Single-sourced because the record write and the
+ *  baseline write must agree exactly on which events they skip — disagreeing is
+ *  what would silently overwrite Google on the next push (#2620). */
+export declare function pullableEvents(events: readonly CalendarEventSummary[], unpushed: ReadonlySet<string>): CalendarEventSummary[];
+/** What an automatic push protected, per collection slug. `null` means it could
+ *  not be worked out at all — see `PROTECTION_UNKNOWN`. */
+export type UnpushedBySlug = ReadonlyMap<string, ReadonlySet<string> | null>;
+/** A collection whose protection is unknown must not be pulled this run.
+ *
+ *  Reported through the retryable `errors` channel rather than as a special case:
+ *  that already holds the sync token AND skips the baseline save, so the window
+ *  simply replays next run with nothing lost. Failing OPEN here — pulling with no
+ *  protection — would overwrite the very edits this exists to protect; the read
+ *  that failed is no evidence that the pull's own writes would fail too, so they
+ *  would land (CodeRabbit review #2666). */
+export declare const PROTECTION_UNKNOWN = "could not work out which records to protect after a failed push";
+/** What ONE collection's pull must leave alone: only what ITS OWN push failed to
+ *  send.
+ *
+ *  Scoped per collection because a calendar can back several of them, and a
+ *  conflict in one says nothing about the others. Sharing one set across the
+ *  group starved a collection that never even declares `autoPush`: it cannot
+ *  conflict, yet a neighbour's conflict froze its records — and the sync token
+ *  still advanced, so Google never resent them (Codex review #2666). */
+export declare const unpushedFor: (unpushed: UnpushedBySlug, slug: string) => ReadonlySet<string> | null;
+/** What the calendar's BASELINE must leave alone: the union over every
+ *  collection.
+ *
+ *  Deliberately not per collection, unlike the records above. `.push-state.json`
+ *  holds ONE baseline per calendar, shared by every collection on it, so there is
+ *  no per-collection baseline to hold back. Advancing it while any collection
+ *  still has an unresolved conflict is the failure that silently overwrites
+ *  Google on the next push, and holding it back only ever means "keep reporting
+ *  the conflict" — so the union is the safe side of an asymmetry the shared
+ *  storage forces.
+ *
+ *  A `null` (unknown) entry contributes nothing, because that collection reports
+ *  a retryable error instead — which stops the baseline being saved at all. */
+export declare const allUnpushed: (unpushed: UnpushedBySlug) => ReadonlySet<string>;
+/** Whether a run may take the calendar, given what the shared marker says.
+ *
+ *  The scheduled door defers to it; every user-facing door claims regardless,
+ *  because a Refresh click that silently returns nothing reads as an empty
+ *  calendar, not as "another host has this". */
+export type ClaimGuard = (lastSyncedAt: string | null) => boolean;
 /** Sync ONE calendar and fan its events out to every collection bound to it.
  *
  *  The fan-out is not an optimisation, it is correctness: the sync token is
@@ -61,17 +94,19 @@ export declare function withKeyedLock<T>(locks: Map<string, Promise<unknown>>, k
  *  load the SAME stored token and walk the same window. That is idempotent —
  *  writes are upserts by event id — but it is a wasted full walk. Queued, the
  *  second pass resumes from the token the first just stored and fetches only
- *  what is genuinely new. */
-/** Serialise anything that touches ONE calendar's sync state.
- *
- *  Shared with the push path (#2598), not only the pull doors: a push that
- *  overtakes an in-flight pull would record a baseline for events the pull is
- *  still writing, so the next push would diff against a future it never saw. */
-export declare function withCalendarLock<T>(calendarId: string | undefined, run: () => Promise<T>): Promise<T>;
-export declare function syncCalendarGroup(calendarId: string | undefined, collections: readonly LoadedCollection[], workspaceRoot: string): Promise<CalendarCollectionSyncResult[]>;
+ *  what is genuinely new. That queue is module state, so it orders the doors
+ *  into THIS process only; `claimThenSync` is what other hosts can see. */
+export declare function syncCalendarGroup(calendarId: string | undefined, collections: readonly LoadedCollection[], workspaceRoot: string, mayClaim?: ClaimGuard): Promise<CalendarCollectionSyncResult[]>;
 /** The baseline this window establishes: what Google now says per event, and
- *  `null` for a cancelled one so a recreate cannot resume from a dead baseline. */
-export declare function shadowUpdates(events: readonly CalendarEventSummary[]): Record<string, ShadowEvent | null>;
+ *  `null` for a cancelled one so a recreate cannot resume from a dead baseline.
+ *
+ *  An event whose record the push could not send is left OUT, and that omission
+ *  is load-bearing. Advancing its baseline to Google's new value while the record
+ *  keeps the local one would make the next push read a plain one-sided edit —
+ *  no conflict to detect any more — and quietly overwrite Google. Held back, the
+ *  baseline stays older than both sides, so the conflict keeps being reported
+ *  until someone resolves it (#2620). */
+export declare function shadowUpdates(events: readonly CalendarEventSummary[], unpushed?: ReadonlySet<string>): Record<string, ShadowEvent | null>;
 /** Liveness of the collections a sync just wrote to, checked against the skill
  *  dir `deleteCollection` removes. `exists` is injected so the rule is testable
  *  without a filesystem. An empty group has no survivor by definition. */
@@ -111,8 +146,15 @@ export declare function orphanedCalendarId(deleted: CalendarDeclaring, remaining
  *  Returns the cleared calendar id, or null when nothing was cleared. Never
  *  throws: a failed cleanup must not fail the delete it follows. */
 export declare function releaseOrphanedCalendarToken(deleted: CalendarDeclaring, workspaceRoot: string): Promise<string | null>;
-/** Sync every collection that declares `googleCalendar`. */
-export declare function syncDueCalendarCollections(workspaceRoot: string): Promise<CalendarCollectionSyncResult[]>;
+/** Sync every collection whose calendar is due — no host in this workspace has
+ *  started one within `intervalMs` (#2678). Without that gate this walked every
+ *  declaring group on every tick, so a second host registering the same task
+ *  simply doubled the runs, concurrently.
+ *
+ *  Dueness is not decided here, only described: the guard is handed down and
+ *  evaluated where the marker is written, so the answer cannot go stale between
+ *  deciding and claiming (Codex review #2680). */
+export declare function syncDueCalendarCollections(workspaceRoot: string, intervalMs?: number): Promise<CalendarCollectionSyncResult[]>;
 /** The groups whose calendar has never synced. A missing token IS the "created
  *  since the last sync" signal — nothing else distinguishes a new collection
  *  from an edited one on the write path this feeds (#2427).
@@ -156,7 +198,12 @@ export interface ManualCalendarSyncDeps {
  *  calendar sends them fixing the wrong thing. */
 export declare function syncCalendarForCollection(slug: string, workspaceRoot: string, deps?: ManualCalendarSyncDeps): Promise<ManualCalendarSyncOutcome>;
 /** Scheduler registration, shaped like `feedRefreshTaskDef` so hosts wire it
- *  with a single line. */
+ *  with a single line.
+ *
+ *  `run` reads the interval back off the definition instead of closing over the
+ *  option: a host rewrites `schedule` from its own overrides file AFTER this
+ *  returns, and the due window has to follow it. Frozen at the default, a
+ *  shortened interval would tick often and skip nearly every tick. */
 export declare function googleCalendarSyncTaskDef(opts?: {
     workspaceRoot?: string;
     intervalMs?: number;