@ouro.bot/cli 0.1.0-alpha.9 → 0.1.0-alpha.900

package/dist/nerves/coverage/audit-rules.js

@@ -2,16 +2,25 @@
 /**
  * Per-test audit rules for nerves event coverage.
  *
- * Rule 1: every-test-emits -- every test must emit at least one event
- * Rule 2: start/end pairing -- _start events must have matching _end or _error
+ * Rule 1: every-test-emits -- every captured test must emit at least one event
+ * Rule 2: lifecycle start/end pairing -- process-scoped _start events must have matching _end or _error
  * Rule 3: error context -- error-level events must have non-empty meta
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.LIFECYCLE_PAIRED_STARTS = void 0;
 exports.checkEveryTestEmits = checkEveryTestEmits;
 exports.checkStartEndPairing = checkStartEndPairing;
 exports.checkErrorContext = checkErrorContext;
+// Only these starts represent process-scoped lifecycle contracts. Most nerves
+// `_start` events are local operation markers that can be legitimately observed
+// by a narrow unit test without driving the whole operation to completion.
+exports.LIFECYCLE_PAIRED_STARTS = new Set([
+    "daemon.server_start",
+    "daemon.update_checker_start",
+    "daemon.apply_pending_updates_start",
+]);
 /**
- * Rule 1: Every test must emit at least one nerves event.
+ * Rule 1: Every captured test must emit at least one nerves event.
  */
 function checkEveryTestEmits(data) {
     if (!data || typeof data !== "object") {
@@ -22,13 +31,13 @@ function checkEveryTestEmits(data) {
         .filter(([, events]) => !Array.isArray(events) || events.length === 0)
         .map(([name]) => name);
     return {
-        status: silent.length === 0 ? "pass" : "fail",
+        status: entries.length > 0 && silent.length === 0 ? "pass" : "fail",
         total_tests: entries.length,
         silent_tests: silent,
     };
 }
 /**
- * Rule 2: _start events must have matching _end or _error within the same test.
+ * Rule 2: Process-scoped lifecycle _start events must have matching _end or _error within the same test.
  */
 function checkStartEndPairing(data) {
     if (!data || typeof data !== "object") {
@@ -39,7 +48,7 @@ function checkStartEndPairing(data) {
         if (!Array.isArray(events))
             continue;
         const eventNames = events.map((e) => e.event);
-        const startEvents = eventNames.filter((name) => name.endsWith("_start"));
+        const startEvents = eventNames.filter((name) => exports.LIFECYCLE_PAIRED_STARTS.has(name));
         for (const startEvent of startEvents) {
             const prefix = startEvent.slice(0, -"_start".length);
             const hasEnd = eventNames.some((name) => name === `${prefix}_end`);

package/dist/nerves/coverage/audit.js

@@ -69,12 +69,38 @@ function readPerTestData(perTestPath) {
     if (!perTestPath || !(0, fs_1.existsSync)(perTestPath))
         return null;
     try {
-        return JSON.parse((0, fs_1.readFileSync)(perTestPath, "utf8"));
+        const raw = (0, fs_1.readFileSync)(perTestPath, "utf8").trim();
+        if (!raw)
+            return null;
+        try {
+            const parsed = JSON.parse(raw);
+            if (isPerTestRecord(parsed)) {
+                return { [parsed.testName]: parsed.events };
+            }
+            return parsed;
+        }
+        catch {
+            const perTestData = {};
+            for (const line of raw.split("\n").map((entry) => entry.trim()).filter(Boolean)) {
+                const parsed = JSON.parse(line);
+                if (!isPerTestRecord(parsed))
+                    return null;
+                const existing = perTestData[parsed.testName] ?? [];
+                perTestData[parsed.testName] = existing.concat(parsed.events);
+            }
+            return perTestData;
+        }
     }
     catch {
         return null;
     }
 }
+function isPerTestRecord(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    return typeof record.testName === "string" && Array.isArray(record.events);
+}
 function scanSourceFiles(sourceRoot) {
     const filesWithKeys = new Map();
     const fileContents = new Map();
@@ -92,7 +118,7 @@ function scanSourceFiles(sourceRoot) {
                     continue;
                 walkDir(full);
             }
-            else if (entry.name.endsWith(".ts")) {
+            else if (entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts")) {
                 const content = (0, fs_1.readFileSync)(full, "utf8");
                 const relPath = full.slice(root.length - "src".length);
                 fileContents.set(relPath, content);

package/dist/nerves/coverage/cli.js

@@ -35,7 +35,7 @@ function runAuditCli(argv) {
         return 2;
     }
     const eventsPath = args.eventsPath ?? (0, path_1.join)(runDir, "vitest-events.ndjson");
-    const perTestPath = args.perTestPath ?? (0, path_1.join)(runDir, "vitest-events-per-test.json");
+    const perTestPath = args.perTestPath ?? (0, path_1.join)(runDir, "vitest-events-per-test.ndjson");
     const sourceRoot = args.sourceRoot ?? (0, path_1.resolve)("src");
     const outputPath = args.output ?? (0, path_1.join)(runDir, "nerves-coverage.json");
     const report = (0, audit_1.auditNervesCoverage)({

package/dist/nerves/coverage/contract.js

@@ -12,11 +12,11 @@ exports.REQUIRED_ENVELOPE_FIELDS = [
     "meta",
 ];
 exports.SENSITIVE_PATTERNS = [
-    /\btoken\s*[:=]/i,
-    /\bapi[_-]?key\b/i,
-    /\bpassword\b/i,
-    /\bsecret\b/i,
-    /\bauthorization\b/i,
+    /\btoken\b["']?\s*[:=]/i,
+    /\bapi[_-]?key\b["']?\s*[:=]/i,
+    /\bpassword\b["']?\s*[:=]/i,
+    /\bsecret\b["']?\s*[:=]/i,
+    /\bauthorization\b["']?\s*[:=]/i,
 ];
 function eventKey(component, event) {
     return `${component}:${event}`;

package/dist/nerves/coverage/file-completeness.js

@@ -10,24 +10,158 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isTypeOnlyFile = isTypeOnlyFile;
 exports.checkFileCompleteness = checkFileCompleteness;
 /**
- * Determines if a source file is type-only (no executable code).
- * A file is type-only if it contains no function, class, or mutable declarations.
- * `const ... as const` declarations are treated as type-equivalent (frozen
- * compile-time values with no side effects).
+ * Determines if a source file is type-only or a pure assembly/re-export file.
+ * Exempt files contain no runtime behavior requiring independent observability.
+ *
+ * Exempt patterns:
+ * - Files with only type/interface/enum declarations
+ * - `const ... as const` declarations (frozen compile-time values)
+ * - Files whose only executable code is const array spreads (assembly/composition)
+ * - Files whose only executable code is re-exports
  */
 function isTypeOnlyFile(source) {
     const lines = source.split("\n");
     for (const line of lines) {
         const trimmed = line.trim();
+        /* v8 ignore start -- regex branches: functionally tested in file-completeness.test.ts @preserve */
         // Skip lines that are const+as-const (type-equivalent frozen values)
         if (/\bconst\s/.test(trimmed) && /\bas\s+const\b/.test(trimmed))
             continue;
+        // Skip const declarations that are pure data (arrays, objects, maps, sets)
+        if (/\bconst\s+\w+[\s:][^=]*=\s*[\[{]/.test(trimmed))
+            continue;
+        if (/\bconst\s+\w+[\s:][^=]*=\s*\w+\.map\(/.test(trimmed))
+            continue;
+        if (/^export\s+const\s+\w+[\s:][^=]*=\s*[\[{]/.test(trimmed))
+            continue;
+        if (/^export\s+const\s+\w+[\s:][^=]*=\s*\w+\.map\(/.test(trimmed))
+            continue;
+        if (/\bconst\s+\w+[\s:][^=]*=\s*new\s+(Set|Map)\b/.test(trimmed))
+            continue;
         // Check for executable code markers
         if (/\b(function|class|const|let|var)\s/.test(trimmed))
             return false;
+        /* v8 ignore stop */
     }
     return true;
 }
+// Sub-modules dispatched through a centralized pattern where the router
+// handles all observability events. These files don't need independent
+// emitNervesEvent calls.
+const DISPATCH_EXEMPT_PATTERNS = [
+    "repertoire/tools-files",
+    "repertoire/tools-shell",
+    "repertoire/tools-notes",
+    "repertoire/tools-bridge",
+    "repertoire/tools-session",
+    "repertoire/tools-continuity",
+    "repertoire/tools-surface",
+    "repertoire/tools-config",
+    "repertoire/tools-base",
+    // CLI sub-modules: cli-exec.ts is the router with emitNervesEvent calls;
+    // cli-parse, cli-render, cli-help, and their small helpers are pure functions/data with no side effects.
+    "daemon/cli-parse",
+    "daemon/cli-render",
+    "daemon/cli-help",
+    "daemon/vault-items",
+    // Shared utility modules: pure helpers consumed by modules that own observability.
+    "arc/json-store",
+    "heart/mail-import-discovery",
+    "repertoire/api-client",
+    "repertoire/github-client",
+    "mind/embedding-provider",
+    // Commerce utility module: error classes and pure helpers (no independent side effects).
+    "repertoire/commerce-errors",
+    // Diary integrity: pure detection utility (pattern matching only). The caller
+    // (diary.ts saveDiaryEntry) owns observability via mind.diary_integrity_warning.
+    "mind/diary-integrity",
+    // Provenance trust: pure classification function (no side effects). Callers
+    // (note-search.ts, tools-notes.ts) own observability for note search results.
+    "mind/provenance-trust",
+    // Log redaction: pure utility consumed by the NDJSON sink (no independent side effects).
+    "nerves/redact",
+    // Bundle templates: pure constants (gitignore template string, PII
+    // directory list). No runtime behavior — consumed by tools-bundle.ts
+    // which owns the observability for bundle operations.
+    "repertoire/bundle-templates",
+    // HTTP health probe: pure HTTP utility factory. The HealthMonitor caller
+    // owns observability via daemon.health_result events.
+    "daemon/http-health-probe",
+    // Rollup decision function: pure decision tree mapping per-agent
+    // snapshots + bootstrap-degraded entries + safe-mode flag to a
+    // RollupStatus. No side effects. The caller (daemon-entry.ts
+    // buildDaemonHealthState → DaemonHealthWriter) owns observability via
+    // daemon.health_written when the rolled-up state is persisted.
+    "daemon/daemon-rollup",
+    // Attachment helper modules: generic file-path/extension utilities and the
+    // source registry are pure support seams. The orchestrator/adapters that
+    // call them own the observability.
+    "heart/attachments/originals",
+    "heart/attachments/sources/index",
+    "heart/attachments/sources/cli-local-file",
+    // Browser-safe Mailbox contract helpers: shared types/formatting helpers
+    // consumed by server readers and the UI. Mailbox read/render modules own
+    // the observability for these projections.
+    "heart/mailbox/mailbox-types",
+    // Mail search relevance scorer: pure heuristic function (regex + counter
+    // arithmetic). The caller (search-cache.ts searchMailSearchCache) owns
+    // observability via senses.mail_search_cache_upserted and friends.
+    "mailroom/search-relevance",
+    // Mail thread reconstruction: pure graph-walk over decrypted message
+    // metadata. Consumers (tools-mail.ts mail_thread handler) own observability.
+    "mailroom/thread",
+    // Trip ledger crypto helpers: pure RSA/AES envelope construction + slug
+    // hashing. The caller (trips/store.ts) owns observability via
+    // trips.ledger_created and trips.evidence_attached.
+    "trips/core",
+    // Mailbox HTTP helper modules: route/static/transport/hook seams are
+    // dispatched by mailbox-http.ts, whose server lifecycle owns observability.
+    "heart/mailbox/mailbox-http-transport",
+    "heart/mailbox/mailbox-http-static",
+    "heart/mailbox/mailbox-http-hooks",
+    "heart/mailbox/mailbox-http-routes",
+    "heart/mailbox/mailbox-http-response",
+    // Session playback: read-only debugging CLI for sanitize-pipeline replay.
+    // No side effects on the runtime; output is human-readable diagnostics only.
+    "heart/session-playback-cli-main",
+    "heart/session-playback-cli",
+    "heart/session-playback",
+    // Nerves review: read-only NDJSON tail/filter CLI for debugging.
+    // Diagnostics-only utility; the running daemon owns observability.
+    "nerves/review/cli-main",
+    "nerves/review/cli",
+    "nerves/review/core",
+    // Mail body cache: in-process LRU helper. Cache hit/miss observability
+    // lives at the caller (tools-mail.ts mail_body handler) which fires
+    // repertoire.mail_body_cache_hit on cache reuse.
+    "mailroom/body-cache",
+    // Session stats: read-only session.json analyzer CLI for debugging.
+    // Diagnostics-only utility; output is human-readable summary.
+    "heart/session-stats-cli-main",
+    "heart/session-stats",
+    // Layer 2 sync classifier: pure pattern-matcher mapping (error, context)
+    // to a SyncClassification. The orchestrator (boot-sync-probe.ts) owns
+    // observability via daemon.boot_sync_probe_start/end events; the
+    // post-turn push path (sync.ts) emits its own classification events.
+    "heart/sync-classification",
+    // Layer 2 timeout wrapper: pure soft/hard timeout abstraction over
+    // AbortController + setTimeout. Callers (boot-sync-probe.ts and any
+    // future consumer) own observability; the wrapper itself is mechanical.
+    "heart/timeouts",
+    // Shared frontmatter parser: pure YAML-ish parser used by habit-parser,
+    // habit-migration, await-parser, and any other small markdown reader.
+    // No side effects of its own; callers emit nerves events around their
+    // parse calls (e.g. daemon.habit_parse, daemon.await_parse).
+    "util/frontmatter",
+    // Legacy-tasks-to-desk migration classifier: pure-data per-file bucketing function.
+    // The caller (migrate-to-desk.ts) owns observability via
+    // daemon.migrate_to_desk_* events around the runMigrateToDesk() entry
+    // points.
+    "repertoire/desk/classifier",
+];
+function isDispatchExempt(filePath) {
+    return DISPATCH_EXEMPT_PATTERNS.some((pattern) => filePath.includes(pattern));
+}
 /**
  * Check that all production files have at least one emitNervesEvent call.
  *
@@ -41,7 +175,7 @@ function checkFileCompleteness(filesWithKeys, fileContents) {
         const hasKeys = filesWithKeys.has(filePath) && filesWithKeys.get(filePath).length > 0;
         if (hasKeys)
             continue;
-        if (isTypeOnlyFile(source)) {
+        if (isTypeOnlyFile(source) || isDispatchExempt(filePath)) {
             exempt.push(filePath);
         }
         else {

package/dist/nerves/coverage/run-artifacts.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REPO_SLUG = void 0;
 exports.getTestRunsRoot = getTestRunsRoot;
+exports.coverageRunOwner = coverageRunOwner;
+exports.getOwnedTestRunsRoot = getOwnedTestRunsRoot;
 exports.createRunId = createRunId;
 exports.getRunDir = getRunDir;
 exports.writeActiveRun = writeActiveRun;
@@ -10,68 +12,86 @@ exports.clearActiveRun = clearActiveRun;
 exports.writeLatestRun = writeLatestRun;
 exports.readLatestRun = readLatestRun;
 const fs_1 = require("fs");
-const path_1 = require("path");
+const crypto_1 = require("crypto");
 const os_1 = require("os");
+const path_1 = require("path");
 exports.REPO_SLUG = "ouroboros-agent-harness";
 function getTestRunsRoot(repoSlug = exports.REPO_SLUG) {
-    return (0, path_1.join)((0, os_1.homedir)(), ".agentstate", "test-runs", repoSlug);
+    return (0, path_1.join)((0, os_1.tmpdir)(), "ouroboros-test-runs", repoSlug);
+}
+function coverageRunOwner(cwd = process.cwd()) {
+    const hash = (0, crypto_1.createHash)("sha256").update((0, path_1.resolve)(cwd)).digest("hex").slice(0, 12);
+    return `cwd-${hash}`;
+}
+function getOwnedTestRunsRoot(repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    return (0, path_1.join)(getTestRunsRoot(repoSlug), coverageRunOwner(cwd));
 }
 function createRunId(now = new Date()) {
     return now.toISOString().replace(/[:.]/g, "-");
 }
-function getRunDir(runId, repoSlug = exports.REPO_SLUG) {
-    return (0, path_1.join)(getTestRunsRoot(repoSlug), runId);
+function getRunDir(runId, repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    return (0, path_1.join)(getOwnedTestRunsRoot(repoSlug, cwd), runId);
 }
-function getActiveRunPath(repoSlug = exports.REPO_SLUG) {
-    return (0, path_1.join)(getTestRunsRoot(repoSlug), ".active-run.json");
+function getActiveRunPath(repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    return (0, path_1.join)(getOwnedTestRunsRoot(repoSlug, cwd), ".active-run.json");
 }
-function getLatestRunPath(repoSlug = exports.REPO_SLUG) {
-    return (0, path_1.join)(getTestRunsRoot(repoSlug), "latest-run.json");
+function getLatestRunPath(repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    return (0, path_1.join)(getOwnedTestRunsRoot(repoSlug, cwd), "latest-run.json");
 }
-function ensureRoot(repoSlug = exports.REPO_SLUG) {
-    const root = getTestRunsRoot(repoSlug);
+function ensureRoot(repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    const root = getOwnedTestRunsRoot(repoSlug, cwd);
     (0, fs_1.mkdirSync)(root, { recursive: true });
     return root;
 }
-function writeActiveRun(info) {
-    ensureRoot(info.repo_slug);
-    (0, fs_1.writeFileSync)(getActiveRunPath(info.repo_slug), JSON.stringify(info, null, 2), "utf8");
+function isValidRunInfo(value, repoSlug, cwd) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const parsed = value;
+    const owner = coverageRunOwner(cwd);
+    if (parsed.repo_slug !== repoSlug ||
+        parsed.run_owner !== owner ||
+        typeof parsed.run_id !== "string" ||
+        parsed.run_id.length === 0 ||
+        typeof parsed.run_dir !== "string" ||
+        parsed.run_dir.length === 0 ||
+        typeof parsed.created_at !== "string" ||
+        parsed.created_at.length === 0) {
+        return false;
+    }
+    const ownerRoot = (0, path_1.resolve)(getOwnedTestRunsRoot(repoSlug, cwd));
+    const runDir = (0, path_1.resolve)(parsed.run_dir);
+    const relativeRunDir = (0, path_1.relative)(ownerRoot, runDir);
+    const isContained = relativeRunDir !== "" && relativeRunDir !== ".." && !relativeRunDir.startsWith(`..${path_1.sep}`) && !(0, path_1.isAbsolute)(relativeRunDir);
+    return isContained && runDir === (0, path_1.resolve)(ownerRoot, parsed.run_id);
 }
-function readActiveRun(repoSlug = exports.REPO_SLUG) {
-    const filePath = getActiveRunPath(repoSlug);
+function readRunInfo(filePath, repoSlug, cwd) {
     if (!(0, fs_1.existsSync)(filePath))
         return null;
     try {
         const parsed = JSON.parse((0, fs_1.readFileSync)(filePath, "utf8"));
-        if (!parsed.run_id || !parsed.run_dir)
-            return null;
-        return parsed;
+        return isValidRunInfo(parsed, repoSlug, cwd) ? parsed : null;
     }
     catch {
         return null;
     }
 }
-function clearActiveRun(repoSlug = exports.REPO_SLUG) {
-    const filePath = getActiveRunPath(repoSlug);
+function writeActiveRun(info, cwd = process.cwd()) {
+    ensureRoot(info.repo_slug, cwd);
+    (0, fs_1.writeFileSync)(getActiveRunPath(info.repo_slug, cwd), JSON.stringify(info, null, 2), "utf8");
+}
+function readActiveRun(repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    return readRunInfo(getActiveRunPath(repoSlug, cwd), repoSlug, cwd);
+}
+function clearActiveRun(repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    const filePath = getActiveRunPath(repoSlug, cwd);
     if ((0, fs_1.existsSync)(filePath)) {
         (0, fs_1.unlinkSync)(filePath);
     }
 }
-function writeLatestRun(info) {
-    ensureRoot(info.repo_slug);
-    (0, fs_1.writeFileSync)(getLatestRunPath(info.repo_slug), JSON.stringify(info, null, 2), "utf8");
+function writeLatestRun(info, cwd = process.cwd()) {
+    ensureRoot(info.repo_slug, cwd);
+    (0, fs_1.writeFileSync)(getLatestRunPath(info.repo_slug, cwd), JSON.stringify(info, null, 2), "utf8");
 }
-function readLatestRun(repoSlug = exports.REPO_SLUG) {
-    const filePath = getLatestRunPath(repoSlug);
-    if (!(0, fs_1.existsSync)(filePath))
-        return null;
-    try {
-        const parsed = JSON.parse((0, fs_1.readFileSync)(filePath, "utf8"));
-        if (!parsed.run_id || !parsed.run_dir)
-            return null;
-        return parsed;
-    }
-    catch {
-        return null;
-    }
+function readLatestRun(repoSlug = exports.REPO_SLUG, cwd = process.cwd()) {
+    return readRunInfo(getLatestRunPath(repoSlug, cwd), repoSlug, cwd);
 }

package/dist/nerves/coverage/source-scanner.js

@@ -1,22 +1,22 @@
 "use strict";
 /**
- * Static source scanner for emitNervesEvent calls.
+ * Static source scanner for emitNervesEvent and emitNervesEventDurable calls.
  *
  * Extracts component:event keys from production source files by
- * regex-matching emitNervesEvent({ component: "...", event: "..." })
+ * regex-matching either static emitter with literal component/event fields.
  * calls. Only accepts static string literals (single or double quotes).
  * Template literals and variable references are rejected.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scanSourceForNervesKeys = scanSourceForNervesKeys;
-const EMIT_CALL_RE = /emitNervesEvent\s*\(\s*\{([\s\S]*?)\}\s*\)/g;
+const EMIT_CALL_RE = /emitNervesEvent(?:Durable)?\s*\(\s*\{([\s\S]*?)\}\s*\)/g;
 function extractStringLiteral(block, field) {
     const re = new RegExp(`${field}\\s*:\\s*(['"])((?:(?!\\1).)+)\\1`);
     const match = re.exec(block);
     return match ? match[2] : null;
 }
 /**
- * Scan a source file's content for emitNervesEvent calls and extract
+ * Scan a source file's content for synchronous or durable Nerves calls and extract
  * component:event keys. Only static string literals are accepted.
  */
 function scanSourceForNervesKeys(source) {

package/dist/nerves/event-buffer.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBufferedSink = createBufferedSink;
+const runtime_1 = require("./runtime");
+const DEFAULT_MAX_SIZE = 1000;
+const DEFAULT_TTL_MS = 5 * 60 * 1000; // 5 minutes
+function createBufferedSink(inner, options = {}) {
+    const maxSize = options.maxSize ?? DEFAULT_MAX_SIZE;
+    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    const nowMs = options.nowMs ?? (() => Date.now());
+    const buffer = [];
+    let dropped = 0;
+    let sinkHealthy = true;
+    let unhealthySince = null;
+    function tryInner(event) {
+        try {
+            inner(event);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    function markUnhealthy() {
+        sinkHealthy = false;
+        unhealthySince = unhealthySince ?? nowMs();
+    }
+    function markHealthy() {
+        sinkHealthy = true;
+        unhealthySince = null;
+    }
+    function discardBuffer() {
+        const count = buffer.length;
+        dropped += count;
+        buffer.length = 0;
+        (0, runtime_1.emitNervesEvent)({
+            component: "nerves",
+            event: "nerves.buffer_ttl_discard",
+            message: `discarded ${count} buffered events after TTL`,
+            meta: { discarded: count, ttlMs },
+        });
+    }
+    function checkTtl() {
+        if (unhealthySince !== null && nowMs() - unhealthySince > ttlMs) {
+            discardBuffer();
+            // Reset unhealthySince to now so TTL starts fresh for newly buffered events
+            unhealthySince = nowMs();
+            return true;
+        }
+        return false;
+    }
+    function addToBuffer(event) {
+        if (buffer.length >= maxSize) {
+            buffer.shift();
+            dropped++;
+        }
+        buffer.push(event);
+    }
+    function flushBuffer() {
+        while (buffer.length > 0) {
+            const event = buffer[0];
+            if (tryInner(event)) {
+                buffer.shift();
+            }
+            else {
+                markUnhealthy();
+                return;
+            }
+        }
+    }
+    function sink(event) {
+        if (!sinkHealthy) {
+            checkTtl();
+            // Try sending the new event to see if inner has recovered
+            if (tryInner(event)) {
+                markHealthy();
+                flushBuffer();
+            }
+            else {
+                addToBuffer(event);
+            }
+            return;
+        }
+        if (tryInner(event)) {
+            return;
+        }
+        // Inner failed
+        markUnhealthy();
+        addToBuffer(event);
+    }
+    function flush() {
+        if (buffer.length === 0)
+            return;
+        // Test if inner is recovered by trying the first buffered event
+        const first = buffer[0];
+        if (tryInner(first)) {
+            buffer.shift();
+            markHealthy();
+            flushBuffer();
+        }
+        // If still broken, leave buffer intact
+    }
+    function state() {
+        return {
+            buffered: buffer.length,
+            dropped,
+            sinkHealthy,
+        };
+    }
+    return { sink, flush, state };
+}