@ouro.bot/cli 0.1.0-alpha.732 → 0.1.0-alpha.734

package/dist/mailroom/hosted-cache-sync.js

@@ -30,6 +30,9 @@ function sameOptionalText(left, right) {
     return (left ?? "").toLowerCase() === (right ?? "").toLowerCase();
 }
 function mailSearchCacheDocumentMatchesRecord(document, record, requireKeyProvenance) {
+    const bodyProvenanceMatches = !requireKeyProvenance ||
+        (document.bodyForm === "plaintext" && document.decryptionKeyId === undefined) ||
+        (document.bodyForm === "encrypted" && typeof document.decryptionKeyId === "string");
     return document.schemaVersion === 1
         && document.agentId === record.agentId
         && document.messageId === record.id
@@ -38,7 +41,7 @@ function mailSearchCacheDocumentMatchesRecord(document, record, requireKeyProven
         && document.compartmentKind === record.compartmentKind
         && sameOptionalText(document.source, record.source)
         && document.textProjectionVersion === search_cache_1.MAIL_SEARCH_TEXT_PROJECTION_VERSION
-        && (!requireKeyProvenance || typeof document.decryptionKeyId === "string");
+        && bodyProvenanceMatches;
 }
 function messageMatchesRecord(message, record) {
     return message.id === record.id
@@ -63,37 +66,31 @@ async function fetchIndexedMessage(store, id) {
 function removeCanonicalIfPresent(agentId, messageId, options) {
     return (0, search_cache_1.removeMailSearchCacheDocument)(agentId, messageId, options) ? 1 : 0;
 }
-function missingPrivateKeyId(error) {
-    if (!(error instanceof Error))
-        return null;
-    const keyId = error.keyId;
-    return typeof keyId === "string" && keyId.length > 0 ? keyId : null;
+function recordFingerprint(record) {
+    return (0, blob_store_1.canonicalMailIndexRecordSnapshot)([record]).messageIndexFingerprint;
 }
-/**
- * Converge a local decrypted cache against hosted index authority, or perform
- * the legacy bounded upsert used by the in-agent refresh tool. This core never
- * writes remote mail state and never records access; adapters own audit policy.
- */
-async function performHostedMailSearchCacheSync(input) {
-    let authority = null;
-    let records;
-    if (input.mode === "full-convergence") {
-        const observer = input.authority ?? input.store;
-        if (!observer.observeMessageIndexAuthority) {
-            throw new Error("hosted mail authority observer is unavailable");
-        }
-        authority = await observer.observeMessageIndexAuthority(input.agentId);
-        if (authority.parseFailureCount > 0 || authority.duplicateIds.length > 0) {
-            throw new Error(`hosted mail authority is ambiguous: ${authority.parseFailureCount} malformed index name(s), ${authority.duplicateIds.length} duplicate message id(s)`);
-        }
-        if (authority.records.length === 0) {
-            throw new Error("hosted mail authority is empty and cannot safely drive full convergence");
-        }
-        records = authority.records;
+const FULL_CONVERGENCE_MAX_PASSES = 3;
+const FULL_CONVERGENCE_CONCURRENCY = 20;
+const PROGRESS_SETTLEMENT_INTERVAL = 250;
+const PROGRESS_HEARTBEAT_MS = 30_000;
+function safeProgress(input, progress) {
+    try {
+        input.onProgress?.(progress);
     }
-    else {
-        records = await scopedRecords(input);
+    catch {
+        // Progress is advisory terminal UX. A broken sink must not alter convergence.
+    }
+}
+function validateAuthorityObservation(authority) {
+    if (authority.parseFailureCount > 0 || authority.duplicateIds.length > 0) {
+        throw new Error(`hosted mail authority is ambiguous: ${authority.parseFailureCount} malformed index name(s), ${authority.duplicateIds.length} duplicate message id(s)`);
+    }
+    if (authority.records.length === 0) {
+        throw new Error("hosted mail authority is empty and cannot safely drive full convergence");
     }
+    return authority;
+}
+async function reconcileRecords(input, records, pass, progressCursor) {
     const recordsById = new Map(records.map((record) => [record.id, record]));
     const canonicalDocuments = new Map();
     let removed = 0;
@@ -108,6 +105,12 @@ async function performHostedMailSearchCacheSync(input) {
             }
             canonicalDocuments.set(document.messageId, document);
         }
+        for (const inspected of (0, search_cache_1.inspectMailSearchSkipReceipts)(input.agentId, input.cacheOptions)) {
+            const receipt = inspected.receipt;
+            if (!receipt || !inspected.canonical || !recordsById.has(receipt.messageId)) {
+                (0, search_cache_1.removeMailSearchSkipReceiptFile)(input.agentId, inspected.fileName, input.cacheOptions);
+            }
+        }
     }
     else {
         for (const document of (0, search_cache_1.searchMailSearchCache)({
@@ -122,17 +125,39 @@ async function performHostedMailSearchCacheSync(input) {
     let fetched = 0;
     let alreadyCached = 0;
     let skipped = 0;
+    let settled = 0;
+    let nextRecord = 0;
     const failures = [];
-    for (const record of records) {
+    progressCursor.pass = pass;
+    progressCursor.settled = settled;
+    progressCursor.total = records.length;
+    safeProgress(input, { phase: "pass-start", pass, settled, total: records.length });
+    async function processRecord(record) {
         const cached = canonicalDocuments.get(record.id);
-        if (cached && input.mode === "full-convergence" && cached.decryptionKeyId && !input.privateKeys[cached.decryptionKeyId]) {
-            removed += removeCanonicalIfPresent(input.agentId, record.id, input.cacheOptions);
-            skipped += 1;
-            continue;
-        }
-        if (cached && mailSearchCacheDocumentMatchesRecord(cached, record, input.mode === "full-convergence")) {
+        const cachedEncryptedKeyMissing = input.mode === "full-convergence" &&
+            cached?.bodyForm === "encrypted" &&
+            typeof cached.decryptionKeyId === "string" &&
+            !input.privateKeys[cached.decryptionKeyId];
+        if (cached &&
+            !cachedEncryptedKeyMissing &&
+            mailSearchCacheDocumentMatchesRecord(cached, record, input.mode === "full-convergence")) {
+            if (input.mode === "full-convergence") {
+                (0, search_cache_1.removeMailSearchSkipReceipt)(input.agentId, record.id, input.cacheOptions);
+            }
             alreadyCached += 1;
-            continue;
+            return;
+        }
+        if (input.mode === "full-convergence") {
+            const receipt = (0, search_cache_1.readMailSearchSkipReceipt)(input.agentId, record.id, input.cacheOptions);
+            if (receipt &&
+                receipt.recordFingerprint === recordFingerprint(record) &&
+                !input.privateKeys[receipt.missingKeyId]) {
+                removed += removeCanonicalIfPresent(input.agentId, record.id, input.cacheOptions);
+                skipped += 1;
+                return;
+            }
+            if (receipt)
+                (0, search_cache_1.removeMailSearchSkipReceipt)(input.agentId, record.id, input.cacheOptions);
         }
         try {
             const message = await fetchIndexedMessage(input.store, record.id);
@@ -146,29 +171,79 @@ async function performHostedMailSearchCacheSync(input) {
             (0, search_cache_1.upsertMailSearchCacheDocument)(message, decrypted.private, input.cacheOptions, {
                 ...(message.bodyForm === "encrypted" ? { decryptionKeyId: message.privateEnvelope.keyId } : {}),
             });
+            if (input.mode === "full-convergence") {
+                (0, search_cache_1.removeMailSearchSkipReceipt)(input.agentId, record.id, input.cacheOptions);
+            }
         }
         catch (error) {
-            if (input.mode === "full-convergence" || missingPrivateKeyId(error)) {
+            if (error instanceof core_1.MissingPrivateMailKeyError) {
                 removed += removeCanonicalIfPresent(input.agentId, record.id, input.cacheOptions);
                 skipped += 1;
+                if (input.mode === "full-convergence") {
+                    (0, search_cache_1.writeMailSearchSkipReceipt)({
+                        schemaVersion: 1,
+                        agentId: input.agentId,
+                        messageId: record.id,
+                        recordFingerprint: recordFingerprint(record),
+                        missingKeyId: error.keyId,
+                        reason: "missing-private-key",
+                        observedAt: new Date().toISOString(),
+                    }, input.cacheOptions);
+                }
             }
             else {
-                failures.push({ id: record.id, error: error instanceof Error ? error.message : String(error) });
+                throw error;
             }
         }
     }
+    async function worker() {
+        while (true) {
+            const recordIndex = nextRecord;
+            nextRecord += 1;
+            if (recordIndex >= records.length)
+                return;
+            try {
+                await processRecord(records[recordIndex]);
+            }
+            catch (error) {
+                failures.push({
+                    index: recordIndex,
+                    id: records[recordIndex].id,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+            finally {
+                settled += 1;
+                progressCursor.settled = settled;
+                if (settled % PROGRESS_SETTLEMENT_INTERVAL === 0) {
+                    safeProgress(input, { phase: "settled", pass, settled, total: records.length });
+                }
+            }
+        }
+    }
+    try {
+        const workerCount = Math.min(FULL_CONVERGENCE_CONCURRENCY, records.length);
+        await Promise.allSettled(Array.from({ length: workerCount }, () => worker()));
+    }
+    finally {
+        safeProgress(input, { phase: "pass-complete", pass, settled, total: records.length });
+    }
     if (failures.length > 0) {
+        failures.sort((left, right) => left.index - right.index);
         const sample = failures.slice(0, 3).map((entry) => `${entry.id}: ${entry.error}`).join("; ");
-        throw new Error(`mail search index refresh incomplete; ${failures.length} fetch failed. first failure(s): ${sample}`);
+        throw new Error(`mail search index refresh incomplete; ${failures.length} record operation(s) failed. first failure(s): ${sample}`);
     }
+    return { fetched, alreadyCached, removed, skipped };
+}
+function writeCoverage(input, records, snapshot) {
+    const recordsById = new Map(records.map((record) => [record.id, record]));
     const cachedIds = new Set((0, search_cache_1.searchMailSearchCache)({
         agentId: input.agentId,
         placement: input.placement,
         compartmentKind: input.scope,
         source: input.source,
     }, input.cacheOptions).filter((document) => recordsById.has(document.messageId)).map((document) => document.messageId));
-    const snapshot = authority?.snapshot ?? (0, blob_store_1.canonicalMailIndexRecordSnapshot)(records);
-    const coverage = (0, search_cache_1.writeMailSearchCoverageRecord)({
+    return (0, search_cache_1.writeMailSearchCoverageRecord)({
         schemaVersion: 1,
         agentId: input.agentId,
         storeKind: input.storeKind,
@@ -179,12 +254,60 @@ async function performHostedMailSearchCacheSync(input) {
         visibleMessageCount: records.length,
         cachedMessageCount: cachedIds.size,
         decryptableMessageCount: cachedIds.size,
-        skippedMessageCount: skipped,
+        skippedMessageCount: records.length - cachedIds.size,
         messageIndexFingerprint: snapshot.messageIndexFingerprint,
         textProjectionVersion: search_cache_1.MAIL_SEARCH_TEXT_PROJECTION_VERSION,
         ...(snapshot.oldestReceivedAt ? { oldestReceivedAt: snapshot.oldestReceivedAt } : {}),
         ...(snapshot.newestReceivedAt ? { newestReceivedAt: snapshot.newestReceivedAt } : {}),
     }, input.cacheOptions);
+}
+/**
+ * Converge a local decrypted cache against hosted index authority, or perform
+ * the legacy bounded upsert used by the in-agent refresh tool. This core never
+ * writes remote mail state and never records access; adapters own audit policy.
+ */
+async function performHostedMailSearchCacheSyncWithProgress(input, progressCursor) {
+    let finalRecords;
+    let finalSnapshot;
+    let fetched = 0;
+    let removed = 0;
+    let alreadyCached = 0;
+    if (input.mode === "full-convergence") {
+        const observer = input.authority ?? input.store;
+        if (!observer.observeMessageIndexAuthority) {
+            throw new Error("hosted mail authority observer is unavailable");
+        }
+        let authority = validateAuthorityObservation(await observer.observeMessageIndexAuthority(input.agentId));
+        let stable = false;
+        for (let pass = 1; pass <= FULL_CONVERGENCE_MAX_PASSES; pass += 1) {
+            const reconciliation = await reconcileRecords(input, authority.records, pass, progressCursor);
+            fetched += reconciliation.fetched;
+            removed += reconciliation.removed;
+            alreadyCached = reconciliation.alreadyCached;
+            const followup = validateAuthorityObservation(await observer.observeMessageIndexAuthority(input.agentId));
+            if (followup.snapshot.messageIndexFingerprint === authority.snapshot.messageIndexFingerprint) {
+                authority = followup;
+                stable = true;
+                break;
+            }
+            authority = followup;
+        }
+        if (!stable) {
+            throw new Error(`hosted mail authority did not stabilize after ${FULL_CONVERGENCE_MAX_PASSES} passes`);
+        }
+        finalRecords = authority.records;
+        finalSnapshot = authority.snapshot;
+    }
+    else {
+        finalRecords = await scopedRecords(input);
+        const reconciliation = await reconcileRecords(input, finalRecords, 1, progressCursor);
+        fetched = reconciliation.fetched;
+        removed = reconciliation.removed;
+        alreadyCached = reconciliation.alreadyCached;
+        finalSnapshot = (0, blob_store_1.canonicalMailIndexRecordSnapshot)(finalRecords);
+    }
+    const coverage = writeCoverage(input, finalRecords, finalSnapshot);
+    const skipped = coverage.skippedMessageCount;
     (0, runtime_1.emitNervesEvent)({
         component: "senses",
         event: "senses.mail_search_cache_synced",
@@ -192,7 +315,7 @@ async function performHostedMailSearchCacheSync(input) {
         meta: {
             agentId: input.agentId,
             mode: input.mode,
-            visible: records.length,
+            visible: finalRecords.length,
             fetched,
             alreadyCached,
             removed,
@@ -201,6 +324,18 @@ async function performHostedMailSearchCacheSync(input) {
     });
     return { coverage, fetched, alreadyCached, removed, skipped };
 }
+async function performHostedMailSearchCacheSync(input) {
+    const progressCursor = { pass: 1, settled: 0, total: 0 };
+    const heartbeat = setInterval(() => {
+        safeProgress(input, { phase: "heartbeat", ...progressCursor });
+    }, PROGRESS_HEARTBEAT_MS);
+    try {
+        return await performHostedMailSearchCacheSyncWithProgress(input, progressCursor);
+    }
+    finally {
+        clearInterval(heartbeat);
+    }
+}
 async function syncHostedMailSearchCache(input) {
     const traceId = (0, node_crypto_1.randomUUID)();
     (0, runtime_1.emitNervesEvent)({

package/dist/mailroom/search-cache.js

@@ -35,6 +35,11 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAIL_SEARCH_TEXT_PROJECTION_VERSION = void 0;
 exports.buildMailSearchCacheDocument = buildMailSearchCacheDocument;
+exports.writeMailSearchSkipReceipt = writeMailSearchSkipReceipt;
+exports.readMailSearchSkipReceipt = readMailSearchSkipReceipt;
+exports.inspectMailSearchSkipReceipts = inspectMailSearchSkipReceipts;
+exports.removeMailSearchSkipReceipt = removeMailSearchSkipReceipt;
+exports.removeMailSearchSkipReceiptFile = removeMailSearchSkipReceiptFile;
 exports.upsertMailSearchCacheDocument = upsertMailSearchCacheDocument;
 exports.inspectMailSearchCacheFiles = inspectMailSearchCacheFiles;
 exports.reloadMailSearchCache = reloadMailSearchCache;
@@ -69,6 +74,13 @@ function cachePath(agentId, messageId, options) {
 function coverageDir(agentId, options) {
     return path.join(cacheDir(agentId, options), "coverage");
 }
+function skippedDir(agentId, options) {
+    return path.join(cacheDir(agentId, options), "skipped");
+}
+function skipReceiptPath(agentId, messageId, options) {
+    const encoded = Buffer.from(messageId).toString("base64url");
+    return path.join(skippedDir(agentId, options), `${encoded}.json`);
+}
 function normalizedCoverageKey(key) {
     return {
         agentId: key.agentId,
@@ -100,6 +112,39 @@ function readJsonDocument(filePath) {
         return null;
     }
 }
+function readSkipReceipt(filePath) {
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+    if (typeof value !== "object" || value === null)
+        return null;
+    const receipt = value;
+    if (receipt.schemaVersion !== 1 ||
+        typeof receipt.agentId !== "string" || receipt.agentId.length === 0 ||
+        typeof receipt.messageId !== "string" || receipt.messageId.length === 0 ||
+        typeof receipt.recordFingerprint !== "string" || !/^[a-f0-9]{64}$/.test(receipt.recordFingerprint) ||
+        typeof receipt.missingKeyId !== "string" || receipt.missingKeyId.length === 0 ||
+        receipt.reason !== "missing-private-key" ||
+        typeof receipt.observedAt !== "string" || !Number.isFinite(Date.parse(receipt.observedAt))) {
+        return null;
+    }
+    return receipt;
+}
+function isRegularFileNoFollow(filePath) {
+    try {
+        return fs.lstatSync(filePath).isFile();
+    }
+    catch (error) {
+        if (typeof error === "object" && error !== null && "code" in error &&
+            (error.code === "ENOENT" || error.code === "ENOTDIR"))
+            return false;
+        throw error;
+    }
+}
 function writeJsonAtomically(filePath, value) {
     const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
     try {
@@ -158,10 +203,74 @@ function buildMailSearchCacheDocument(message, privateEnvelope, provenance = {})
         untrustedContentWarning: privateEnvelope.untrustedContentWarning,
         searchText: normalizeSearchText(privateEnvelope),
         textProjectionVersion: exports.MAIL_SEARCH_TEXT_PROJECTION_VERSION,
+        bodyForm: message.bodyForm ?? (decryptionKeyId ? "encrypted" : "plaintext"),
         attachmentCount: privateEnvelope.attachments.length,
         ...(decryptionKeyId ? { decryptionKeyId } : {}),
     };
 }
+function writeMailSearchSkipReceipt(receipt, options) {
+    const dir = skippedDir(receipt.agentId, options);
+    fs.mkdirSync(dir, { recursive: true });
+    writeJsonAtomically(skipReceiptPath(receipt.agentId, receipt.messageId, options), receipt);
+    return receipt;
+}
+function readMailSearchSkipReceipt(agentId, messageId, options) {
+    const filePath = skipReceiptPath(agentId, messageId, options);
+    if (!isRegularFileNoFollow(filePath))
+        return null;
+    const receipt = readSkipReceipt(filePath);
+    return receipt?.agentId === agentId && receipt.messageId === messageId ? receipt : null;
+}
+function inspectMailSearchSkipReceipts(agentId, options) {
+    const dir = skippedDir(agentId, options);
+    if (!fs.existsSync(dir))
+        return [];
+    return fs.readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => (entry.isFile() || entry.isSymbolicLink()) && entry.name.endsWith(".json"))
+        .map((entry) => {
+        const filePath = path.join(dir, entry.name);
+        const receipt = entry.isFile() ? readSkipReceipt(filePath) : null;
+        return {
+            fileName: entry.name,
+            filePath,
+            receipt: receipt?.agentId === agentId ? receipt : null,
+            canonical: receipt?.agentId === agentId && entry.name === path.basename(skipReceiptPath(agentId, receipt.messageId, options)),
+        };
+    })
+        .sort((left, right) => left.fileName.localeCompare(right.fileName));
+}
+function removeMailSearchSkipReceipt(agentId, messageId, options) {
+    const filePath = skipReceiptPath(agentId, messageId, options);
+    try {
+        const entry = fs.lstatSync(filePath);
+        if (!entry.isFile() && !entry.isSymbolicLink())
+            return false;
+        fs.unlinkSync(filePath);
+        return true;
+    }
+    catch (error) {
+        if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT"))
+            throw error;
+        return false;
+    }
+}
+function removeMailSearchSkipReceiptFile(agentId, fileName, options) {
+    if (path.basename(fileName) !== fileName || !fileName.endsWith(".json"))
+        return false;
+    const filePath = path.join(skippedDir(agentId, options), fileName);
+    try {
+        const entry = fs.lstatSync(filePath);
+        if (!entry.isFile() && !entry.isSymbolicLink())
+            return false;
+        fs.unlinkSync(filePath);
+        return true;
+    }
+    catch (error) {
+        if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT"))
+            throw error;
+        return false;
+    }
+}
 function upsertMailSearchCacheDocument(message, privateEnvelope, options, provenance) {
     const document = buildMailSearchCacheDocument(message, privateEnvelope, provenance);
     const dir = cacheDir(message.agentId, options);

package/dist/mind/prompt.js

@@ -348,6 +348,7 @@ const PROCESS_TYPE_LABELS = {
     voice: "voice handler",
     a2a: "a2a handler",
     mcp: "mcp bridge",
+    telegram: "telegram handler",
 };
 function processTypeLabel(channel) {
     return PROCESS_TYPE_LABELS[channel];
@@ -468,6 +469,7 @@ function localSenseStatusLines() {
         mail: configuredSenses.mail ?? { enabled: false },
         voice: configuredSenses.voice ?? { enabled: false },
         a2a: configuredSenses.a2a ?? { enabled: false },
+        telegram: configuredSenses.telegram ?? { enabled: false },
         workbench: configuredSenses.workbench ?? { enabled: false },
     };
     const payload = (0, config_1.loadConfig)();
@@ -493,6 +495,9 @@ function localSenseStatusLines() {
             && hasTextField(voice, "whisperCliPath")
             && hasTextField(voice, "whisperModelPath"),
         a2a: true,
+        telegram: hasTextField(runtimePayload, "telegramBotToken")
+            && hasTextField(runtimePayload, "telegramAuthorizedUserId")
+            && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
         workbench: false,
     };
     const rows = [
@@ -517,6 +522,10 @@ function localSenseStatusLines() {
             label: "A2A",
             status: senses.a2a.enabled ? "ready" : "disabled",
         },
+        {
+            label: "Telegram",
+            status: !senses.telegram.enabled ? "disabled" : configured.telegram ? "ready" : "needs_config",
+        },
         {
             label: "Workbench",
             // Workbench can be injected at runtime (the Workbench app spawns

package/dist/nerves/coverage/source-scanner.js

@@ -1,22 +1,22 @@
 "use strict";
 /**
- * Static source scanner for emitNervesEvent calls.
+ * Static source scanner for emitNervesEvent and emitNervesEventDurable calls.
  *
  * Extracts component:event keys from production source files by
- * regex-matching emitNervesEvent({ component: "...", event: "..." })
+ * regex-matching either static emitter with literal component/event fields.
  * calls. Only accepts static string literals (single or double quotes).
  * Template literals and variable references are rejected.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanSourceForNervesKeys = scanSourceForNervesKeys;
-const EMIT_CALL_RE = /emitNervesEvent\s*\(\s*\{([\s\S]*?)\}\s*\)/g;
+const EMIT_CALL_RE = /emitNervesEvent(?:Durable)?\s*\(\s*\{([\s\S]*?)\}\s*\)/g;
 function extractStringLiteral(block, field) {
     const re = new RegExp(`${field}\\s*:\\s*(['"])((?:(?!\\1).)+)\\1`);
     const match = re.exec(block);
     return match ? match[2] : null;
 }
 /**
- * Scan a source file's content for emitNervesEvent calls and extract
+ * Scan a source file's content for synchronous or durable Nerves calls and extract
  * component:event keys. Only static string literals are accepted.
  */
 function scanSourceForNervesKeys(source) {

package/dist/nerves/index.js

@@ -61,6 +61,24 @@ const LEVEL_PRIORITY = {
     warn: 30,
     error: 40,
 };
+function fsyncFileAndDirectory(filePath) {
+    if ((0, fs_1.existsSync)(filePath)) {
+        const fileDescriptor = (0, fs_1.openSync)(filePath, "r");
+        try {
+            (0, fs_1.fsyncSync)(fileDescriptor);
+        }
+        finally {
+            (0, fs_1.closeSync)(fileDescriptor);
+        }
+    }
+    const directoryDescriptor = (0, fs_1.openSync)((0, path_1.dirname)(filePath), "r");
+    try {
+        (0, fs_1.fsyncSync)(directoryDescriptor);
+    }
+    finally {
+        (0, fs_1.closeSync)(directoryDescriptor);
+    }
+}
 const GLOBAL_SINKS_KEY = Symbol.for("ouroboros.nerves.global-sinks");
 function resolveGlobalSinks() {
     const scope = globalThis;
@@ -248,6 +266,7 @@ function rotateIfNeeded(filePath, optionsOrMaxSize) {
         if ((0, fs_1.existsSync)(plain1)) {
             (0, fs_1.unlinkSync)(plain1);
         }
+        fsyncFileAndDirectory(filePath);
         (0, fs_1.renameSync)(filePath, plain1);
         // Step 3: gzip (or keep plain) the renamed file into the .1 generation.
         if (compress) {
@@ -259,8 +278,10 @@ function rotateIfNeeded(filePath, optionsOrMaxSize) {
             const buf = (0, fs_1.readFileSync)(plain1);
             const compressed = zlib.gzipSync(buf);
             (0, fs_1.writeFileSync)(gz1, compressed);
+            fsyncFileAndDirectory(gz1);
             (0, fs_1.unlinkSync)(plain1);
         }
+        fsyncFileAndDirectory(compress ? generationGzPath(base, ext, 1) : plain1);
         completed = true;
         (0, runtime_1.emitNervesEvent)({
             component: "nerves",
@@ -298,6 +319,33 @@ function createNdjsonFileSink(filePath, optionsOrMaxSize) {
     const queue = [];
     let flushing = false;
     let bytesSinceCheck = 0;
+    let enqueued = 0;
+    let completed = 0;
+    let appendFailure = null;
+    const barriers = [];
+    function settleBarriers() {
+        const ready = barriers.filter((barrier) => barrier.target <= completed);
+        if (ready.length === 0)
+            return;
+        for (const barrier of ready)
+            barriers.splice(barriers.indexOf(barrier), 1);
+        if (appendFailure) {
+            for (const barrier of ready)
+                barrier.reject(appendFailure);
+            return;
+        }
+        try {
+            fsyncFileAndDirectory(filePath);
+            for (const barrier of ready)
+                barrier.resolve();
+        }
+        catch (error) {
+            const failure = error instanceof Error ? error : new Error(String(error));
+            appendFailure = failure;
+            for (const barrier of ready)
+                barrier.reject(failure);
+        }
+    }
     function flush() {
         if (flushing || queue.length === 0)
             return;
@@ -310,31 +358,42 @@ function createNdjsonFileSink(filePath, optionsOrMaxSize) {
             try {
                 rotateIfNeeded(filePath, options);
             }
-            catch {
-                // Rotation errors are surfaced via nerves events; never block writes.
+            catch (rotationError) {
+                appendFailure ??= rotationError instanceof Error ? rotationError : new Error(String(rotationError));
             }
         }
-        (0, fs_1.appendFile)(filePath, line, "utf8", () => {
+        (0, fs_1.appendFile)(filePath, line, "utf8", (error) => {
+            completed += 1;
+            if (error)
+                appendFailure ??= error;
             if (checkAfterAppend) {
                 try {
+                    fsyncFileAndDirectory(filePath);
                     rotateIfNeeded(filePath, options);
                 }
-                catch {
-                    // Rotation errors are surfaced via nerves events; never block writes.
+                catch (rotationError) {
+                    appendFailure ??= rotationError instanceof Error ? rotationError : new Error(String(rotationError));
                 }
             }
+            settleBarriers();
             flushing = false;
             flush();
         });
     }
-    return (entry) => {
+    const sink = ((entry) => {
         const line = verbose
             ? `${JSON.stringify(entry)}\n`
             : `${(0, redact_1.redactString)(JSON.stringify((0, redact_1.redactLogEntry)(entry)))}\n`;
         bytesSinceCheck += line.length;
+        enqueued += 1;
         queue.push(line);
         flush();
-    };
+    });
+    sink.barrier = () => new Promise((resolve, reject) => {
+        barriers.push({ target: enqueued, resolve, reject });
+        settleBarriers();
+    });
+    return sink;
 }
 function registerGlobalLogSink(sink) {
     globalSinks.add(sink);
@@ -356,9 +415,10 @@ function createLogger(options = {}) {
     const configuredLevel = options.level ?? "info";
     const sinks = options.sinks ?? [createStderrSink()];
     const sink = createFanoutSink(sinks);
+    const durableSinks = sinks.filter((candidate) => "barrier" in candidate && typeof candidate.barrier === "function");
     const now = options.now ?? (() => new Date());
-    function emit(level, entry) {
-        if (!shouldEmit(configuredLevel, level)) {
+    function emit(level, entry, force = false) {
+        if (!force && !shouldEmit(configuredLevel, level)) {
             return;
         }
         const payload = {
@@ -378,5 +438,11 @@ function createLogger(options = {}) {
         info: (entry) => emit("info", entry),
         warn: (entry) => emit("warn", entry),
         error: (entry) => emit("error", entry),
+        durabilityBarrier: async () => {
+            if (durableSinks.length === 0)
+                throw new Error("No durable Nerves sink is configured");
+            await Promise.all(durableSinks.map((durableSink) => durableSink.barrier()));
+        },
+        emitDurable: (level, entry) => emit(level, entry, true),
     };
 }