@rubytech/create-sitedesk-code 0.1.522 → 0.1.524

package/payload/platform/plugins/scheduling/mcp/dist/lib/agent-dispatch.js

@@ -1,128 +1,48 @@
 /**
+ * Destination validation for agent-bearing scheduled dispatch.
  * Task 1378 — agent-bearing scheduled dispatch: destination validation.
  * Task 1439 — house single-authority + creating-account match.
  *
- * The scheduling MCP cannot import `platform/ui` (plugin boundary), so this
- * module replicates the minimal E.164 matching from
- * `platform/ui/app/lib/whatsapp/normalize.ts`. For WhatsApp the authoritative
- * `adminPhones` + `accountManagers` lists live ONLY on the socket-owning house
- * account (Tasks 1377/1382), so the validator resolves the house via
- * `resolveHouseOrSoleAccountId` — the same authority the inbound gate uses — and
- * reads its config, NOT the event's own account. It then requires the
- * destination's registered account to match the account that created the
- * schedule (the house/owner account excepted), so a schedule created in account
- * X cannot message another account's people. One `validateAgentDestination` is
- * shared by `schedule-event`, `schedule-update`, and the dispatcher's standing
- * audit so create-time and fire-time cannot diverge on rule or reason codes.
+ * The rule itself now lives in `platform/lib/agent-dispatch-rule`, because the
+ * admin UI needs the same rule and `platform/ui` must never import from
+ * `platform/plugins`. This module is the plugin's face onto it: it resolves the
+ * socket-owning house (the one thing the lib deliberately refuses to do) and
+ * delegates. Every exported signature here is unchanged, so `schedule-event`,
+ * `schedule-update`, the dispatcher's standing audit and the connector-sync
+ * provisioner are untouched by the move.
+ *
+ * For WhatsApp the authoritative `adminPhones` + `accountManagers` lists live
+ * ONLY on the socket-owning house account (Tasks 1377/1382), so the house is
+ * resolved via `resolveHouseOrSoleAccountId` — the same authority the inbound
+ * gate uses — and its config is read, NOT the event's own account.
+ *
+ * The provenance marker below is NOT part of the destination rule and stays
+ * here: it is stamped by this plugin's own dispatcher and travels outward on
+ * the inject POST, so it is this plugin's contract to keep, not shared logic
+ * two packages need to agree on.
  */
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { resolveHouseOrSoleAccountId } from "../../../../../lib/account-enumeration/dist/index.js";
-/**
- * Replica of `normalize.ts:normalizeE164` — strip whitespace/dashes/parens, a
- * `whatsapp:` prefix, and a leading `+` or `00`; return digits-only or `''`.
- */
-export function normalizeE164(value) {
-    let candidate = value.trim().replace(/[\s\-().]/g, "");
-    candidate = candidate.replace(/^whatsapp:/i, "");
-    if (candidate.startsWith("+"))
-        candidate = candidate.slice(1);
-    else if (candidate.startsWith("00"))
-        candidate = candidate.slice(2);
-    if (!/^\d+$/.test(candidate))
-        return "";
-    return candidate;
-}
-/** Replica of `normalize.ts:phonesMatch` — normalized equality, non-empty. */
-export function phonesMatch(a, b) {
-    const na = normalizeE164(a);
-    const nb = normalizeE164(b);
-    return na.length > 0 && na === nb;
-}
-export function readChannelAdmins(accountDir, channel) {
-    let config = {};
-    try {
-        config = JSON.parse(readFileSync(resolve(accountDir, "account.json"), "utf-8"));
-    }
-    catch {
-        config = {};
-    }
-    if (channel === "whatsapp") {
-        const wa = config.whatsapp ?? {};
-        const adminPhones = Array.isArray(wa.adminPhones)
-            ? wa.adminPhones.filter((p) => typeof p === "string")
-            : [];
-        const managersRaw = wa.accountManagers ?? {};
-        const accountManagers = {};
-        for (const [k, v] of Object.entries(managersRaw)) {
-            if (typeof v === "string")
-                accountManagers[k] = v;
-        }
-        return { adminPhones, accountManagers };
-    }
-    const tg = config.telegram ?? {};
-    const adminUsers = Array.isArray(tg.adminUsers)
-        ? tg.adminUsers.filter((u) => typeof u === "number")
-        : [];
-    return { adminUsers };
-}
-/**
- * The account a WhatsApp `destination` is registered to on the HOUSE's lists,
- * or null if it is in neither list. A manager binding wins over an admin match:
- * if the number is an `accountManagers` key its registered account is the bound
- * sub-account (the isolation-relevant fact); otherwise if it is an `adminPhones`
- * entry its registered account is the house. `houseDir` is the house account's
- * directory; `houseAccountId` its id.
- */
-export function registeredAccountForDestination(houseDir, houseAccountId, destination) {
-    const { adminPhones, accountManagers } = readChannelAdmins(houseDir, "whatsapp");
-    for (const [managerPhone, subAccountId] of Object.entries(accountManagers)) {
-        if (subAccountId && phonesMatch(managerPhone, destination))
-            return subAccountId;
-    }
-    if (adminPhones.some((p) => phonesMatch(p, destination)))
-        return houseAccountId;
-    return null;
-}
+import { validateAgentDestination as validateAgainstHouse, } from "../../../../../lib/agent-dispatch-rule/dist/index.js";
+export { normalizeE164, phonesMatch, readChannelAdmins, registeredAccountForDestination, boundSubAccountFor, } from "../../../../../lib/agent-dispatch-rule/dist/index.js";
 /**
  * Validate a dispatch destination under the Task 1439 two-part rule.
  * `accountsDir` is the PARENT accounts directory
  * (`$PLATFORM_ROOT/../data/accounts`); `creatingAccountId` is the account that
  * created (or owns) the schedule.
  *
- *  - whatsapp: resolve the socket-owning house, read ITS authoritative lists,
- *    and compute the destination's registered account. `not-registered` if it
- *    is in no house list. Otherwise valid iff the creator IS the house (owner
- *    exception: it owns the single line and may target any registered
- *    admin/manager) OR the registered account equals the creating account.
- *    Any other case is `cross-account`.
- *  - telegram: house-only (Task 1378; 1380 deferred). Reads the creating
- *    account's own `telegram.adminUsers`; there is no manager surface and thus
- *    no cross-account concept — an integer chat id present in the list is valid,
- *    anything else is `not-registered`.
+ * The house is resolved here rather than in the rule module.
+ * `resolveHouseOrSoleAccountId` throws when the install has no `role:'house'`
+ * account and does not have exactly one valid account; that throw is the
+ * caller's to handle and is deliberately not swallowed here —
+ * `connector-sync-provision.ts` already documents catching it.
+ *
+ * Telegram never consults the house, so the resolver is not called for it.
  */
 export function validateAgentDestination(accountsDir, creatingAccountId, channel, destination) {
-    if (channel === "whatsapp") {
-        const houseAccountId = resolveHouseOrSoleAccountId(accountsDir);
-        const houseDir = resolve(accountsDir, houseAccountId);
-        const registered = registeredAccountForDestination(houseDir, houseAccountId, destination);
-        if (registered === null)
-            return { valid: false, reason: "not-registered" };
-        if (creatingAccountId === houseAccountId)
-            return { valid: true };
-        if (registered === creatingAccountId)
-            return { valid: true };
-        return {
-            valid: false,
-            reason: "cross-account",
-            destinationAccount: registered,
-            scheduleAccount: creatingAccountId,
-        };
-    }
-    const { adminUsers } = readChannelAdmins(resolve(accountsDir, creatingAccountId), "telegram");
-    const asNumber = Number(destination);
-    const ok = Number.isInteger(asNumber) && adminUsers.includes(asNumber);
-    return ok ? { valid: true } : { valid: false, reason: "not-registered" };
+    const houseAccountId = channel === "whatsapp" ? resolveHouseOrSoleAccountId(accountsDir) : creatingAccountId;
+    return validateAgainstHouse(accountsDir, houseAccountId, creatingAccountId, channel, destination);
 }
 /**
  * Validate an `agentDispatch` at write time (shared by `schedule-event` and
@@ -188,17 +108,4 @@ export function buildScheduleProvenance(input) {
         dispatchedAt: input.dispatchedAt,
     };
 }
-/**
- * The sub-account a WhatsApp manager destination is bound to, or null. Telegram
- * has no account-manager surface (house-only, Task 1378 scope), so it always
- * returns null. Used by the standing audit to detect a deleted sub-account.
- */
-export function boundSubAccountFor(accountDir, destination) {
-    const { accountManagers } = readChannelAdmins(accountDir, "whatsapp");
-    for (const [managerPhone, subAccountId] of Object.entries(accountManagers)) {
-        if (subAccountId && phonesMatch(managerPhone, destination))
-            return subAccountId;
-    }
-    return null;
-}
 //# sourceMappingURL=agent-dispatch.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/agent-dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-dispatch.js","sourceRoot":"","sources":["../../src/lib/agent-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAkBnG;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACvD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACzD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAkBD,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAAqB;IAErB,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAI,MAAM,CAAC,QAAgD,IAAI,EAAE,CAAC;QAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC;YAC/C,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAI,EAAE,CAAC,eAAuD,IAAI,EAAE,CAAC;QACtF,MAAM,eAAe,GAA2B,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,EAAE,GAAI,MAAM,CAAC,QAAgD,IAAI,EAAE,CAAC;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC;QAC7C,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,cAAsB,EACtB,WAAmB;IAEnB,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3E,IAAI,YAAY,IAAI,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC;YAAE,OAAO,YAAY,CAAC;IAClF,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,iBAAyB,EACzB,OAAqB,EACrB,WAAmB;IAEnB,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,+BAA+B,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3E,IAAI,iBAAiB,KAAK,cAAc;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACjE,IAAI,UAAU,KAAK,iBAAiB;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,eAAe;YACvB,kBAAkB,EAAE,UAAU;YAC9B,eAAe,EAAE,iBAAiB;SACnC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,aAA6E;IAE7E,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,8BAA8B,WAAW,uCAAuC,OAAO,KAAK;gBAC1F,2CAA2C,KAAK,CAAC,kBAAkB,oBAAoB,KAAK,CAAC,eAAe,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,WAAW,kDAAkD,OAAO,0BAA0B,CAC7H,CAAC;IACJ,CAAC;AACH,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB,EAAE,SAAiB;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAE5F,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,MAAM;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACzF,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;YACzC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACpF,CAAC,CAAC,EAAE;QACN,aAAa,EACX,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QACxG,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;IACxE,MAAM,EAAE,eAAe,EAAE,GAAG,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACtE,KAAK,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3E,IAAI,YAAY,IAAI,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC;YAAE,OAAO,YAAY,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"agent-dispatch.js","sourceRoot":"","sources":["../../src/lib/agent-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACnG,OAAO,EACL,wBAAwB,IAAI,oBAAoB,GAGjD,MAAM,sDAAsD,CAAC;AAE9D,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,sDAAsD,CAAC;AAG9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,iBAAyB,EACzB,OAAqB,EACrB,WAAmB;IAEnB,MAAM,cAAc,GAClB,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACxF,OAAO,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,aAA6E;IAE7E,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,8BAA8B,WAAW,uCAAuC,OAAO,KAAK;gBAC1F,2CAA2C,KAAK,CAAC,kBAAkB,oBAAoB,KAAK,CAAC,eAAe,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,WAAW,kDAAkD,OAAO,0BAA0B,CAC7H,CAAC;IACJ,CAAC;AACH,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB,EAAE,SAAiB;IAC/E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAE5F,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,MAAM;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACzF,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;YACzC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACpF,CAAC,CAAC,EAAE;QACN,aAAa,EACX,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QACxG,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/notes-cap.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Task 2136 — the notes blob, bounded.
+ *
+ * `e.notes` was an uncapped free-text string with nine appenders, all in the
+ * same `\n[<iso>] <prose>` shape, interleaving fires with cancellations and
+ * lifecycle notes. Five of those appenders were fire lines and are gone: those
+ * facts now live on `:RoutineRun`, where they are readable without parsing
+ * prose. The four that remain are operator-facing prose, not run history, and
+ * stay.
+ *
+ * Those four trim at write time rather than through a sweep, so the blob is
+ * bounded by construction and an already-oversized blob shrinks the next time
+ * anything writes to it. No migration is needed and none ships.
+ */
+/** How many trailing lines survive an append. */
+export declare const NOTES_MAX_LINES = 50;
+/**
+ * The Cypher fragment for "append this note and keep only the last
+ * NOTES_MAX_LINES lines", for use inside a SET clause. `nodeVar` is the bound
+ * node, `paramName` the query parameter holding the new note (which already
+ * carries its own leading newline, as every appender writes it).
+ *
+ * Split-and-rejoin rather than a byte slice: a byte cap can cut mid-line and
+ * leave a fragment that reads as a corrupted entry rather than a truncated
+ * history.
+ *
+ * Empty elements are dropped before the rejoin. Every appender writes a LEADING
+ * `\n`, so `split` yields an empty first element on every call; a naive
+ * `reduce(acc + '\n' + line)` would re-emit those empties and add one more each
+ * time, so the blob grew a blank line per append and the 50-line cap retained
+ * only ~25 real entries. Filtering them means the cap means what it says, and
+ * the single leading newline is restored once by the reduce itself.
+ */
+export declare function appendNotesCapped(nodeVar: string, paramName: string): string;
+//# sourceMappingURL=notes-cap.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/notes-cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notes-cap.d.ts","sourceRoot":"","sources":["../../src/lib/notes-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iDAAiD;AACjD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5E"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/notes-cap.js

@@ -0,0 +1,39 @@
+/**
+ * Task 2136 — the notes blob, bounded.
+ *
+ * `e.notes` was an uncapped free-text string with nine appenders, all in the
+ * same `\n[<iso>] <prose>` shape, interleaving fires with cancellations and
+ * lifecycle notes. Five of those appenders were fire lines and are gone: those
+ * facts now live on `:RoutineRun`, where they are readable without parsing
+ * prose. The four that remain are operator-facing prose, not run history, and
+ * stay.
+ *
+ * Those four trim at write time rather than through a sweep, so the blob is
+ * bounded by construction and an already-oversized blob shrinks the next time
+ * anything writes to it. No migration is needed and none ships.
+ */
+/** How many trailing lines survive an append. */
+export const NOTES_MAX_LINES = 50;
+/**
+ * The Cypher fragment for "append this note and keep only the last
+ * NOTES_MAX_LINES lines", for use inside a SET clause. `nodeVar` is the bound
+ * node, `paramName` the query parameter holding the new note (which already
+ * carries its own leading newline, as every appender writes it).
+ *
+ * Split-and-rejoin rather than a byte slice: a byte cap can cut mid-line and
+ * leave a fragment that reads as a corrupted entry rather than a truncated
+ * history.
+ *
+ * Empty elements are dropped before the rejoin. Every appender writes a LEADING
+ * `\n`, so `split` yields an empty first element on every call; a naive
+ * `reduce(acc + '\n' + line)` would re-emit those empties and add one more each
+ * time, so the blob grew a blank line per append and the 50-line cap retained
+ * only ~25 real entries. Filtering them means the cap means what it says, and
+ * the single leading newline is restored once by the reduce itself.
+ */
+export function appendNotesCapped(nodeVar, paramName) {
+    return (`${nodeVar}.notes = reduce(acc = '', line IN ` +
+        `[l IN split(COALESCE(${nodeVar}.notes, '') + $${paramName}, '\\n') WHERE l <> ''][-${NOTES_MAX_LINES}..]` +
+        ` | acc + '\\n' + line)`);
+}
+//# sourceMappingURL=notes-cap.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/notes-cap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notes-cap.js","sourceRoot":"","sources":["../../src/lib/notes-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,SAAiB;IAClE,OAAO,CACL,GAAG,OAAO,oCAAoC;QAC9C,wBAAwB,OAAO,kBAAkB,SAAS,4BAA4B,eAAe,KAAK;QAC1G,wBAAwB,CACzB,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/routine-run.d.ts

@@ -0,0 +1,175 @@
+import type { Driver } from "neo4j-driver";
+/** Which dispatch loop opened the record. */
+export type RunKind = "recurring" | "one-time";
+/** The `chooseDispatchMode` result the record was opened for. */
+export type RunMode = "agent" | "action" | "none";
+/**
+ * What the dispatcher can honestly say at close time.
+ *
+ * `accepted` means the POST returned 200 or the MCP tool returned without
+ * error — nothing about the work is known. `handleInbound` is fire-and-forget
+ * and `ensureChannelSession` returns rather than throwing on a spawn failure
+ * (ui/server/routes/channel/schedule-inject.ts), so `finished` can never be
+ * established here. It is reached only by `promoteRoutineRuns` on the reconcile
+ * tick, from evidence in the transcript.
+ */
+export type RunOutcome = "accepted" | "failed" | "no-destination";
+/** Records are kept for 30 days. A quarter-hourly routine settles at ~2,900 per account. */
+export declare const RETENTION_DAYS = 30;
+/**
+ * How long an `open` record may live before it counts as an orphan. This is
+ * `DISPATCH_TIMEOUT_MS` from check-due-events, the hard ceiling on the dispatch
+ * leg, so a genuinely in-flight run can never be miscounted.
+ */
+export declare const ORPHAN_AFTER_MS = 600000;
+/** Neo4j integers arrive as `{low, high}` objects; normalise to a JS number. */
+export declare function toNumber(v: unknown): number | null;
+export interface OpenRunInput {
+    eventId: string;
+    accountId: string;
+    kind: RunKind;
+    mode: RunMode;
+    /** `<channel>:<destination>` for an agent turn, `<plugin>.<tool>` for an action, `-` for none. */
+    target: string;
+    /**
+     * The instant the run was due. On the recurring path this is byte-identical
+     * to the `lastTriggered` the same tick writes, which is what the
+     * `fires-without-records` audit reconciles against.
+     */
+    scheduledFor: string;
+}
+/**
+ * Open the record BEFORE the dispatch, so a run that dies mid-flight still has a
+ * record and a line. Returns the runId, or null when the write failed.
+ */
+export declare function openRoutineRun(driver: Driver, input: OpenRunInput): Promise<string | null>;
+/**
+ * The transport result, emitted separately from the work result so the two can
+ * never be conflated. Log-only: the httpStatus lands on the node at close.
+ */
+export declare function logRunDispatch(runId: string | null, target: string, httpStatus: number | null): void;
+export interface CloseRunInput {
+    outcome: RunOutcome;
+    /** The verbatim `accepted` / `error:<n>` / `error:<msg>` string, kept unparsed. */
+    dispatchResult?: string | null;
+    httpStatus?: number | null;
+    error?: string | null;
+}
+/**
+ * Close the record. `ranMs` is computed in Cypher from the stored `startedAt`
+ * so it is measured against the record's own clock rather than assumed from a
+ * value the caller carried. `startedAt` is an ISO string, so it is parsed with
+ * `datetime()` before the subtraction — a bare string compare against a
+ * temporal would silently yield null.
+ */
+export declare function closeRoutineRun(driver: Driver, runId: string | null, input: CloseRunInput): Promise<void>;
+export interface RunSessionInput {
+    /** The `adminSessionIdFor` hash this firing lands in. */
+    sessionKey: string | null;
+    /** JSONL byte size at inject time — where in the shared transcript this run starts. */
+    transcriptOffset: number | null;
+    /**
+     * False when the offset could not be resolved. Because `adminSessionIdFor`
+     * hashes `${accountId}:admin:${subject}`, every run for one destination shares
+     * one transcript; `bounded=false` surfaces that collision rather than hiding
+     * it, and makes the record unpromotable by design.
+     */
+    bounded: boolean;
+}
+export declare function recordRunSession(driver: Driver, runId: string | null, input: RunSessionInput): Promise<void>;
+/**
+ * Read a transcript from `from` BYTES to the end. Null when unreadable.
+ *
+ * The offset is a byte count — `schedule-inject` records `statSync().size`. It is
+ * therefore read with a positional `readSync`, not by decoding the file and
+ * slicing the string: `String.prototype.slice` indexes UTF-16 code units, so one
+ * multi-byte character anywhere before the boundary (an emoji, an accented name,
+ * a curly quote — all routine in a transcript) would shift the cut and silently
+ * drop the head of this run's output, leaving a finished run recorded as merely
+ * started. Reading positionally also means only the tail is loaded, not the whole
+ * transcript, on every record on every 120-second tick.
+ */
+export declare function readTranscriptTail(path: string, from: number, to?: number | null): string | null;
+/**
+ * Decide a run's status from the slice of transcript that belongs to it.
+ *
+ * Pure, so the rule is testable without a filesystem or a graph.
+ *
+ * The window alone is not enough to attribute output. `adminSessionIdFor` puts
+ * every run for one destination in ONE transcript together with the operator's
+ * own messages, so "an assistant row appeared after this run's offset" is true
+ * whenever the operator simply had a conversation — which would report a routine
+ * that has been dead for a week as having produced output on every fire. The
+ * dispatcher prefixes each injected turn with a schedule marker naming the
+ * routine (`… event <first 8 of eventId> …`, composeScheduleMarker on both the
+ * WhatsApp and Telegram notification paths), so the run's own inbound is
+ * identifiable inside the window:
+ *
+ *   - no marker              → nothing of this run's landed. Do not promote.
+ *   - marker, no assistant   → started: the inbound journalled, no answer yet.
+ *   - marker then assistant  → finished: this run produced that output.
+ *
+ * The assistant row must come AFTER the marker, or a reply to the operator's
+ * earlier message would be credited to this run.
+ */
+export declare function classifyRunEvidence(window: string, eventId: string): "none" | "started" | "finished";
+/**
+ * Promote `accepted` and `started` records from evidence in the transcript.
+ *
+ * This is the honest half of the outcome vocabulary. The dispatcher can only
+ * ever say `accepted` — `handleInbound` is fire-and-forget and a spawn failure
+ * returns rather than throwing — so `started` and `finished` are established
+ * here, from evidence inside the slice of transcript that belongs to the run:
+ * bounded below by its own recorded offset and above by the next run's on the
+ * same transcript, and identified within that window by the run's own schedule
+ * marker (see `classifyRunEvidence`).
+ *
+ * A `bounded=false` record is never selected: without a lower boundary there is
+ * no way to attribute appended bytes to THIS run rather than to the operator's
+ * own traffic in the same shared transcript. Leaving it `accepted` is the
+ * correct reading, not a gap.
+ *
+ * Never throws (honours the sweep contract).
+ */
+export declare function promoteRoutineRuns(driver: Driver, accountId: string, deps?: {
+    readTail?: (path: string, from: number, to: number | null) => string | null;
+    projectDirFor?: (sessionKey: string) => string | null;
+}): Promise<{
+    started: number;
+    finished: number;
+}>;
+/**
+ * The retention control. Unbounded record growth is the same defect as the
+ * uncapped notes string this task removes, so the sweep ships with the record
+ * rather than after it. Never throws.
+ */
+export declare function sweepRoutineRuns(driver: Driver, accountId: string, nowMs: number, retentionDays?: number): Promise<number>;
+/**
+ * Records opened and never closed. A run dying between open and close emits
+ * nothing on its own; this is the only control that finds it. Emitted every
+ * tick including zero, because a check that is silent when healthy cannot be
+ * distinguished from a check that stopped running.
+ */
+export declare function auditRunOrphans(driver: Driver, accountId: string, nowMs: number): Promise<void>;
+/**
+ * Reconciles the OLD scalar against the NEW record: a routine whose
+ * `lastTriggered` moved past the previous audit with no `:RoutineRun` at that
+ * instant fired through a path that writes no record. Load-bearing — without it
+ * a missed dispatch path would be assumed absent rather than detected.
+ *
+ * Defined against `lastTriggered`, which only the RECURRING path writes (the
+ * one-time path sets `eventStatus` and `updatedAt` alone). It therefore covers
+ * the recurring path only, by construction. The one-time path is covered by its
+ * own test and by the census.
+ *
+ * Returns the new watermark: the newest `lastTriggered` seen, or the previous
+ * watermark when nothing fired. Never throws.
+ */
+export declare function auditFiresWithoutRecords(driver: Driver, accountId: string, watermark: string | null): Promise<string>;
+/**
+ * The retention control's own signal. A rising `total` with a fixed `oldest` is
+ * the unbounded-growth signature — the shape the notes blob had for years with
+ * nothing watching it. Emitted every tick including zero.
+ */
+export declare function auditRunCensus(driver: Driver, accountId: string): Promise<void>;
+//# sourceMappingURL=routine-run.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/routine-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine-run.d.ts","sourceRoot":"","sources":["../../src/lib/routine-run.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,6CAA6C;AAC7C,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,UAAU,CAAC;AAE/C,iEAAiE;AACjE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,gBAAgB,CAAC;AAElE,4FAA4F;AAC5F,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;GAIG;AACH,eAAO,MAAM,eAAe,SAAU,CAAC;AAEvC,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYlD;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoDhG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGpG;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,UAAU,CAAC;IACpB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,GAAG,IAAI,CAsBtG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAKpG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5E,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAClD,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqFhD;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,aAAa,GAAE,MAAuB,GACrC,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BrG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,MAAM,CAAC,CAwCjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BrF"}