@slaw-ai/server 2026.611.0

package/dist/services/botfather/authoring-lock.js

@@ -0,0 +1,23 @@
+import { readBotfatherConfigSection } from "../../config-file.js";
+import { readBotfatherCredentials } from "./credentials.js";
+/**
+ * Tower-only authoring lock predicate. An instance is "tower-governed" — and so
+ * local skill authoring/import is disabled — when a control-tower URL is
+ * configured AND the instance is enrolled (active credentials with an apiKey
+ * exist). Standalone or not-yet-enrolled instances are NOT governed, so their
+ * local skill authoring keeps working exactly as before.
+ *
+ * See DESIGN-skill-registry.md §8.1. Kept tiny + dependency-injectable so the
+ * decision is unit-testable without touching disk.
+ */
+export function isTowerGoverned(deps = {}) {
+    const readConfig = deps.readConfigSection ?? readBotfatherConfigSection;
+    const readCreds = deps.readCredentials ?? readBotfatherCredentials;
+    const section = readConfig();
+    const hasTowerUrl = typeof section?.url === "string" && section.url.length > 0;
+    if (!hasTowerUrl)
+        return false;
+    const creds = readCreds();
+    return Boolean(creds?.apiKey);
+}
+//# sourceMappingURL=authoring-lock.js.map

package/dist/services/botfather/authoring-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring-lock.js","sourceRoot":"","sources":["../../../src/services/botfather/authoring-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,OAGI,EAAE;IAEN,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,IAAI,0BAA0B,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,wBAAwB,CAAC;IACnE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/services/botfather/authoring-lock.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authoring-lock.test.d.ts.map

package/dist/services/botfather/authoring-lock.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring-lock.test.d.ts","sourceRoot":"","sources":["../../../src/services/botfather/authoring-lock.test.ts"],"names":[],"mappings":""}

package/dist/services/botfather/authoring-lock.test.js

@@ -0,0 +1,25 @@
+import { describe, it, expect } from "vitest";
+import { isTowerGoverned } from "./authoring-lock.js";
+/**
+ * P5 — tower-only authoring lock predicate. Local skill authoring is blocked
+ * ONLY when an instance is both connected to a tower (url configured) AND
+ * enrolled (active credentials). Standalone or pre-enrollment instances keep
+ * local authoring.
+ */
+const cfg = (url) => () => (url ? { url } : undefined);
+const creds = (apiKey) => () => (apiKey ? { apiKey, enrollmentId: "e" } : null);
+describe("isTowerGoverned", () => {
+    it("is GOVERNED when a tower url is configured and credentials are active", () => {
+        expect(isTowerGoverned({ readConfigSection: cfg("http://tower:8400"), readCredentials: creds("key123") })).toBe(true);
+    });
+    it("is NOT governed standalone (no tower url)", () => {
+        expect(isTowerGoverned({ readConfigSection: cfg(undefined), readCredentials: creds("key123") })).toBe(false);
+    });
+    it("is NOT governed when connected but not yet enrolled (no apiKey)", () => {
+        expect(isTowerGoverned({ readConfigSection: cfg("http://tower:8400"), readCredentials: creds(undefined) })).toBe(false);
+    });
+    it("is NOT governed with an empty url string", () => {
+        expect(isTowerGoverned({ readConfigSection: cfg(""), readCredentials: creds("key123") })).toBe(false);
+    });
+});
+//# sourceMappingURL=authoring-lock.test.js.map

package/dist/services/botfather/authoring-lock.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring-lock.test.js","sourceRoot":"","sources":["../../../src/services/botfather/authoring-lock.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,GAAG,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,EAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACzE,MAAM,KAAK,GAAG,CAAC,MAAe,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAElG,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CACJ,eAAe,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,eAAe,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,eAAe,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9G,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,eAAe,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/botfather/client.d.ts

@@ -0,0 +1,26 @@
+import { type InstanceIdentity, type EnrollResponse, type EnrollPollResponse, type HeartbeatRequest, type HeartbeatResponse, type SyncRequest, type SyncResponse, type SkillCatalogResponse, type SkillContentResponse } from "@slaw-ai/shared/botfather/protocol";
+/**
+ * HTTP client for the botfather tower. The tower's ingest endpoints accept
+ * plain JSON (its Zod schemas parse the request body directly), so we send
+ * plain JSON with a Bearer token — no gzip envelope. Errors are surfaced as
+ * thrown BotfatherHttpError; callers decide whether to spool/back off.
+ */
+export declare class BotfatherHttpError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+export declare function createBotfatherClient(baseUrl: string): {
+    /** token-less self-enrollment → pending (or active if an auto-approve rule matches) */
+    enroll(instance: InstanceIdentity, reportIssueTitles: boolean): Promise<EnrollResponse>;
+    /** poll until approved; returns the per-instance apiKey once active */
+    pollEnrollment(enrollmentId: string): Promise<EnrollPollResponse>;
+    heartbeat(apiKey: string, body: HeartbeatRequest): Promise<HeartbeatResponse>;
+    sync(apiKey: string, body: SyncRequest): Promise<SyncResponse>;
+    /** pull the tower's published skill catalog (descriptors only) */
+    skillCatalog(apiKey: string): Promise<SkillCatalogResponse>;
+    /** pull full content (markdown + files) for one published skill */
+    skillContent(apiKey: string, key: string): Promise<SkillContentResponse>;
+};
+export type BotfatherClient = ReturnType<typeof createBotfatherClient>;
+//# sourceMappingURL=client.d.ts.map

package/dist/services/botfather/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/services/botfather/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,oCAAoC,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAFtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAsED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM;IAGjD,uFAAuF;qBAChE,gBAAgB,qBAAqB,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAO7F,uEAAuE;iCACpC,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;sBAM/C,MAAM,QAAQ,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;iBAGhE,MAAM,QAAQ,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAGpE,kEAAkE;yBACvC,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAGjE,mEAAmE;yBACxC,MAAM,OAAO,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;EAIjF;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/services/botfather/client.js

@@ -0,0 +1,113 @@
+import { PROTOCOL_VERSION, } from "@slaw-ai/shared/botfather/protocol";
+/**
+ * HTTP client for the botfather tower. The tower's ingest endpoints accept
+ * plain JSON (its Zod schemas parse the request body directly), so we send
+ * plain JSON with a Bearer token — no gzip envelope. Errors are surfaced as
+ * thrown BotfatherHttpError; callers decide whether to spool/back off.
+ */
+export class BotfatherHttpError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "BotfatherHttpError";
+    }
+}
+function joinUrl(base, p) {
+    return new URL(p, base.endsWith("/") ? base : base + "/").toString();
+}
+async function postJson(url, body, apiKey, timeoutMs = 15_000) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),
+            },
+            body: JSON.stringify(body),
+            signal: ctrl.signal,
+        });
+        const text = await res.text();
+        let parsed = undefined;
+        try {
+            parsed = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            /* non-JSON body */
+        }
+        if (!res.ok) {
+            const code = parsed?.code;
+            throw new BotfatherHttpError(parsed?.error ?? `HTTP ${res.status}`, res.status, code);
+        }
+        return parsed;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function getJson(url, apiKey, timeoutMs = 15_000) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, {
+            method: "GET",
+            headers: { authorization: `Bearer ${apiKey}` },
+            signal: ctrl.signal,
+        });
+        const text = await res.text();
+        let parsed = undefined;
+        try {
+            parsed = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            /* non-JSON body */
+        }
+        if (!res.ok) {
+            const code = parsed?.code;
+            throw new BotfatherHttpError(parsed?.error ?? `HTTP ${res.status}`, res.status, code);
+        }
+        return parsed;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function createBotfatherClient(baseUrl) {
+    const ingest = (p) => joinUrl(baseUrl, `api/ingest/v1/${p}`);
+    return {
+        /** token-less self-enrollment → pending (or active if an auto-approve rule matches) */
+        async enroll(instance, reportIssueTitles) {
+            return postJson(ingest("enroll"), {
+                protocolVersion: PROTOCOL_VERSION,
+                instance,
+                capabilities: { reportIssueTitles, liveStream: false },
+            });
+        },
+        /** poll until approved; returns the per-instance apiKey once active */
+        async pollEnrollment(enrollmentId) {
+            return postJson(ingest("enroll/poll"), {
+                protocolVersion: PROTOCOL_VERSION,
+                enrollmentId,
+            });
+        },
+        async heartbeat(apiKey, body) {
+            return postJson(ingest("heartbeat"), body, apiKey);
+        },
+        async sync(apiKey, body) {
+            return postJson(ingest("sync"), body, apiKey);
+        },
+        /** pull the tower's published skill catalog (descriptors only) */
+        async skillCatalog(apiKey) {
+            return getJson(ingest("skills"), apiKey);
+        },
+        /** pull full content (markdown + files) for one published skill */
+        async skillContent(apiKey, key) {
+            return getJson(ingest(`skills/${encodeURIComponent(key)}`), apiKey);
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/services/botfather/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/services/botfather/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAUjB,MAAM,oCAAoC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGhC;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,IAAa;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;QAGtB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,CAAS;IACtC,OAAO,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAAa,EAAE,MAAe,EAAE,SAAS,GAAG,MAAM;IACxF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,GAAY,SAAS,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAI,MAAwC,EAAE,IAAI,CAAC;YAC7D,MAAM,IAAI,kBAAkB,CACzB,MAAyC,EAAE,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EACzE,GAAG,CAAC,MAAM,EACV,IAAI,CACL,CAAC;QACJ,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,GAAW,EAAE,MAAc,EAAE,SAAS,GAAG,MAAM;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;YAC9C,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,GAAY,SAAS,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAI,MAAwC,EAAE,IAAI,CAAC;YAC7D,MAAM,IAAI,kBAAkB,CACzB,MAAyC,EAAE,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EACzE,GAAG,CAAC,MAAM,EACV,IAAI,CACL,CAAC;QACJ,CAAC;QACD,OAAO,MAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO;QACL,uFAAuF;QACvF,KAAK,CAAC,MAAM,CAAC,QAA0B,EAAE,iBAA0B;YACjE,OAAO,QAAQ,CAAiB,MAAM,CAAC,QAAQ,CAAC,EAAE;gBAChD,eAAe,EAAE,gBAAgB;gBACjC,QAAQ;gBACR,YAAY,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,KAAK,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QACD,uEAAuE;QACvE,KAAK,CAAC,cAAc,CAAC,YAAoB;YACvC,OAAO,QAAQ,CAAqB,MAAM,CAAC,aAAa,CAAC,EAAE;gBACzD,eAAe,EAAE,gBAAgB;gBACjC,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,IAAsB;YACpD,OAAO,QAAQ,CAAoB,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAiB;YAC1C,OAAO,QAAQ,CAAe,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,kEAAkE;QAClE,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,OAAO,OAAO,CAAuB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,mEAAmE;QACnE,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAW;YAC5C,OAAO,OAAO,CAAuB,MAAM,CAAC,UAAU,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/botfather/credentials.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Per-instance botfather credentials, stored outside the squad-scoped secrets
+ * vault because this key is instance-level, not squad-level. File mode 0600 at
+ * ~/.slaw/instances/<id>/botfather/credentials.json (ARCHITECTURE §6.2).
+ */
+export interface BotfatherCredentials {
+    apiKey: string;
+    enrollmentId: string;
+    enrolledAt: string;
+    url: string;
+}
+export declare function readBotfatherCredentials(instanceId?: string): BotfatherCredentials | null;
+export declare function writeBotfatherCredentials(creds: BotfatherCredentials, instanceId?: string): void;
+export declare function clearBotfatherCredentials(instanceId?: string): void;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/services/botfather/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/services/botfather/credentials.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,wBAAwB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAiBzF;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,oBAAoB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAIhG;AAED,wBAAgB,yBAAyB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAOnE"}

package/dist/services/botfather/credentials.js

@@ -0,0 +1,39 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveBotfatherCredentialsPath } from "@slaw-ai/shared";
+export function readBotfatherCredentials(instanceId) {
+    const file = resolveBotfatherCredentialsPath({ instanceId });
+    try {
+        if (!fs.existsSync(file))
+            return null;
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (typeof parsed.apiKey === "string" && parsed.apiKey.length > 0) {
+            return {
+                apiKey: parsed.apiKey,
+                enrollmentId: parsed.enrollmentId ?? "",
+                enrolledAt: parsed.enrolledAt ?? "",
+                url: parsed.url ?? "",
+            };
+        }
+    }
+    catch {
+        /* corrupt → treat as not enrolled */
+    }
+    return null;
+}
+export function writeBotfatherCredentials(creds, instanceId) {
+    const file = resolveBotfatherCredentialsPath({ instanceId });
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(creds, null, 2), { encoding: "utf8", mode: 0o600 });
+}
+export function clearBotfatherCredentials(instanceId) {
+    const file = resolveBotfatherCredentialsPath({ instanceId });
+    try {
+        if (fs.existsSync(file))
+            fs.rmSync(file);
+    }
+    catch {
+        /* best effort */
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/services/botfather/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/services/botfather/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAclE,MAAM,UAAU,wBAAwB,CAAC,UAAmB;IAC1D,MAAM,IAAI,GAAG,+BAA+B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkC,CAAC;QAC1F,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;gBACvC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBACnC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA2B,EAAE,UAAmB;IACxF,MAAM,IAAI,GAAG,+BAA+B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAmB;IAC3D,MAAM,IAAI,GAAG,+BAA+B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}

package/dist/services/botfather/enrollment.d.ts

@@ -0,0 +1,49 @@
+import type { InstanceIdentity } from "@slaw-ai/shared/botfather/protocol";
+/** Gate-facing enrollment state (ARCHITECTURE §6.3). */
+export type EnrollmentState = "connecting" | "pending" | "rejected" | "active" | "unreachable" | "revoked" | "standalone";
+export interface EnrollmentStatus {
+    state: EnrollmentState;
+    url: string | null;
+    enforcement: "enforce" | "advisory";
+    machineId: string;
+    instanceId: string;
+    hostname: string;
+    /** true once we hold a valid API key (enrolled at least once) */
+    enrolled: boolean;
+    detail?: string;
+}
+export declare function buildIdentity(): InstanceIdentity;
+export interface BotfatherSettings {
+    url: string | undefined;
+    enforcement: "enforce" | "advisory";
+    reportIssueTitles: boolean;
+}
+/**
+ * Drives the enrollment lifecycle. Holds the current state in memory so the
+ * gate API can report it without re-hitting the network on every poll.
+ */
+export declare class BotfatherEnrollment {
+    private readonly settings;
+    private state;
+    private enrollmentId;
+    private detail;
+    private readonly client;
+    readonly identity: InstanceIdentity;
+    constructor(settings: BotfatherSettings);
+    get apiKey(): string | null;
+    status(): EnrollmentStatus;
+    /** Should the SLAW UI be blocked behind the gate right now? */
+    isGated(): boolean;
+    /**
+     * One enrollment step. Idempotent + safe to call on an interval until active.
+     * Returns the current state after the step.
+     */
+    tick(): Promise<EnrollmentState>;
+    /** Called by the reporter when a heartbeat/sync returns 401 (revoked). */
+    onRevoked(): void;
+    /** Force a fresh enrollment (CLI `reenroll`). */
+    reenroll(): Promise<EnrollmentState>;
+    private persistKey;
+    static isRevokedError(err: unknown): boolean;
+}
+//# sourceMappingURL=enrollment.d.ts.map

package/dist/services/botfather/enrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../../src/services/botfather/enrollment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAS3E,wDAAwD;AACxD,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,aAAa,GACb,SAAS,GACT,YAAY,CAAC;AAEjB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,UAAU,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD,wBAAgB,aAAa,IAAI,gBAAgB,CAShD;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,WAAW,EAAE,SAAS,GAAG,UAAU,CAAC;IACpC,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IANrC,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;gBAEP,QAAQ,EAAE,iBAAiB;IAYxD,IAAI,MAAM,IAAI,MAAM,GAAG,IAAI,CAE1B;IAED,MAAM,IAAI,gBAAgB;IAa1B,+DAA+D;IAC/D,OAAO,IAAI,OAAO;IASlB;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC;IA2CtC,0EAA0E;IAC1E,SAAS,IAAI,IAAI;IAMjB,iDAAiD;IAC3C,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC;IAO1C,OAAO,CAAC,UAAU;IAUlB,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO;CAM7C"}

package/dist/services/botfather/enrollment.js

@@ -0,0 +1,145 @@
+import os from "node:os";
+import { loadOrCreateMachineIdentity, resolveSlawInstanceId } from "@slaw-ai/shared";
+import { serverVersion } from "../../version.js";
+import { createBotfatherClient, BotfatherHttpError } from "./client.js";
+import { readBotfatherCredentials, writeBotfatherCredentials, clearBotfatherCredentials, } from "./credentials.js";
+function osTag() {
+    const p = process.platform;
+    return p === "darwin" || p === "win32" ? p : "linux";
+}
+export function buildIdentity() {
+    const machine = loadOrCreateMachineIdentity();
+    return {
+        machineId: machine.machineId,
+        instanceId: resolveSlawInstanceId(),
+        hostname: os.hostname(),
+        os: osTag(),
+        slawVersion: serverVersion,
+    };
+}
+/**
+ * Drives the enrollment lifecycle. Holds the current state in memory so the
+ * gate API can report it without re-hitting the network on every poll.
+ */
+export class BotfatherEnrollment {
+    settings;
+    state;
+    enrollmentId = null;
+    detail;
+    client;
+    identity;
+    constructor(settings) {
+        this.settings = settings;
+        this.identity = buildIdentity();
+        if (!settings.url) {
+            this.state = "standalone";
+            this.client = null;
+            return;
+        }
+        this.client = createBotfatherClient(settings.url);
+        const creds = readBotfatherCredentials();
+        this.state = creds ? "active" : "connecting";
+    }
+    get apiKey() {
+        return readBotfatherCredentials()?.apiKey ?? null;
+    }
+    status() {
+        return {
+            state: this.state,
+            url: this.settings.url ?? null,
+            enforcement: this.settings.enforcement,
+            machineId: this.identity.machineId,
+            instanceId: this.identity.instanceId,
+            hostname: this.identity.hostname,
+            enrolled: this.apiKey !== null,
+            detail: this.detail,
+        };
+    }
+    /** Should the SLAW UI be blocked behind the gate right now? */
+    isGated() {
+        if (this.state === "standalone" || this.state === "active")
+            return false;
+        if (this.settings.enforcement === "advisory")
+            return false;
+        // enforce: an already-enrolled instance is allowed to run even if the tower
+        // is momentarily unreachable (fail-open for the enrolled, §6.4).
+        if (this.state === "unreachable" && this.apiKey)
+            return false;
+        return true;
+    }
+    /**
+     * One enrollment step. Idempotent + safe to call on an interval until active.
+     * Returns the current state after the step.
+     */
+    async tick() {
+        if (!this.client || this.state === "standalone")
+            return this.state;
+        // already have a key → consider ourselves active (heartbeat will detect revocation)
+        if (this.apiKey && this.state !== "revoked") {
+            this.state = "active";
+            return this.state;
+        }
+        try {
+            if (!this.enrollmentId) {
+                const res = await this.client.enroll(this.identity, this.settings.reportIssueTitles);
+                this.enrollmentId = res.enrollmentId;
+                if (res.state === "active" && res.apiKey) {
+                    this.persistKey(res.apiKey, res.enrollmentId);
+                    this.state = "active";
+                    return this.state;
+                }
+                this.state = res.state === "rejected" ? "rejected" : "pending";
+                return this.state;
+            }
+            const poll = await this.client.pollEnrollment(this.enrollmentId);
+            if (poll.state === "active" && poll.apiKey) {
+                this.persistKey(poll.apiKey, this.enrollmentId);
+                this.state = "active";
+            }
+            else if (poll.state === "rejected") {
+                this.state = "rejected";
+            }
+            else if (poll.state === "revoked") {
+                // revoked mid-flight → restart enrollment
+                this.enrollmentId = null;
+                this.state = "revoked";
+            }
+            else {
+                this.state = "pending";
+            }
+            return this.state;
+        }
+        catch (err) {
+            this.detail = err instanceof Error ? err.message : String(err);
+            this.state = "unreachable";
+            return this.state;
+        }
+    }
+    /** Called by the reporter when a heartbeat/sync returns 401 (revoked). */
+    onRevoked() {
+        clearBotfatherCredentials();
+        this.enrollmentId = null;
+        this.state = "revoked";
+    }
+    /** Force a fresh enrollment (CLI `reenroll`). */
+    async reenroll() {
+        clearBotfatherCredentials();
+        this.enrollmentId = null;
+        this.state = "connecting";
+        return this.tick();
+    }
+    persistKey(apiKey, enrollmentId) {
+        writeBotfatherCredentials({
+            apiKey,
+            enrollmentId,
+            enrolledAt: new Date().toISOString(),
+            url: this.settings.url ?? "",
+        });
+        this.detail = undefined;
+    }
+    static isRevokedError(err) {
+        return (err instanceof BotfatherHttpError &&
+            (err.status === 401 || err.code === "enrollment_revoked"));
+    }
+}
+//# sourceMappingURL=enrollment.js.map

package/dist/services/botfather/enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../../src/services/botfather/enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAwB,MAAM,aAAa,CAAC;AAC9F,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAwB1B,SAAS,KAAK;IACZ,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;IAC9C,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,qBAAqB,EAAE;QACnC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QACvB,EAAE,EAAE,KAAK,EAAE;QACX,WAAW,EAAE,aAAa;KAC3B,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAOD;IANrB,KAAK,CAAkB;IACvB,YAAY,GAAkB,IAAI,CAAC;IACnC,MAAM,CAAqB;IAClB,MAAM,CAAyB;IACvC,QAAQ,CAAmB;IAEpC,YAA6B,QAA2B;QAA3B,aAAQ,GAAR,QAAQ,CAAmB;QACtD,IAAI,CAAC,QAAQ,GAAG,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,wBAAwB,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,wBAAwB,EAAE,EAAE,MAAM,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,MAAM;QACJ,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI;YAC9B,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,OAAO;QACL,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QAC3D,4EAA4E;QAC5E,iEAAiE;QACjE,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAEnE,oFAAoF;QACpF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBACrF,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;gBACrC,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;oBAC9C,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;oBACtB,OAAO,IAAI,CAAC,KAAK,CAAC;gBACpB,CAAC;gBACD,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/D,OAAO,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBAChD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;YACxB,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACrC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YAC1B,CAAC;iBAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpC,0CAA0C;gBAC1C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACzB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,SAAS;QACP,yBAAyB,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ;QACZ,yBAAyB,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAEO,UAAU,CAAC,MAAc,EAAE,YAAoB;QACrD,yBAAyB,CAAC;YACxB,MAAM;YACN,YAAY;YACZ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,GAAY;QAChC,OAAO,CACL,GAAG,YAAY,kBAAkB;YACjC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/services/botfather/instance-limit-enforcement.d.ts

@@ -0,0 +1,44 @@
+import type { Db } from "@slaw-ai/db";
+import { type StoredInstanceLimit } from "./limits-store.js";
+/**
+ * Enforcement for the tower-pushed INSTANCE-WIDE budget limit. This is an
+ * additive ceiling layered on top of the existing squad/agent budget policies
+ * ("tower caps, local can be stricter"). It is plan-aware: metered/API runs are
+ * measured in COST (cents); subscription runs are measured in TOKENS (cost ≈ $0
+ * there). An instance running a mix is governed on both axes at once.
+ */
+export interface InstanceUsageMtd {
+    /** sum of cost_cents for metered_api rows this calendar month (UTC) */
+    meteredCostCents: number;
+    /** sum of input+cached+output tokens for subscription rows this month */
+    subscriptionTokens: number;
+}
+/** Current month-to-date metered cost (cents) and subscription tokens, instance-wide. */
+export declare function computeInstanceUsageMtd(db: Db): Promise<InstanceUsageMtd>;
+export type LimitMetric = "cost" | "tokens";
+export interface LimitEvaluation {
+    /** is any ceiling hit at/over 100%? (block when mode === hard) */
+    exceeded: boolean;
+    /** is any ceiling at/over warnPercent? */
+    warned: boolean;
+    /** which metric drove the highest utilisation (for messaging) */
+    metric: LimitMetric | null;
+    /** observed / ceiling for the driving metric */
+    observed: number;
+    ceiling: number | null;
+    percent: number;
+    mode: StoredInstanceLimit["mode"];
+}
+/** Pure evaluation of usage against a stored limit — testable without a DB. */
+export declare function evaluateInstanceLimit(limit: StoredInstanceLimit, usage: InstanceUsageMtd): LimitEvaluation;
+export interface InstanceLimitBlock {
+    reason: string;
+    metric: LimitMetric;
+}
+/**
+ * Returns a block when the tower limit is in HARD mode and a ceiling is hit.
+ * Soft/off modes never block here (they warn at cost-event time instead).
+ * Used as an additive gate at the top of getInvocationBlock.
+ */
+export declare function getInstanceLimitBlock(db: Db): Promise<InstanceLimitBlock | null>;
+//# sourceMappingURL=instance-limit-enforcement.d.ts.map

package/dist/services/botfather/instance-limit-enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-limit-enforcement.d.ts","sourceRoot":"","sources":["../../../src/services/botfather/instance-limit-enforcement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEhF;;;;;;GAMG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAID,yFAAyF;AACzF,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiB/E;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,gBAAgB,GACtB,eAAe,CAqCjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CActF"}

package/dist/services/botfather/instance-limit-enforcement.js

@@ -0,0 +1,83 @@
+import { sql } from "drizzle-orm";
+import { readInstanceLimit } from "./limits-store.js";
+const SUBSCRIPTION_TYPES = ["subscription_included", "subscription_overage"];
+/** Current month-to-date metered cost (cents) and subscription tokens, instance-wide. */
+export async function computeInstanceUsageMtd(db) {
+    const res = await db.execute(sql `
+    SELECT
+      coalesce(sum(case when billing_type = 'metered_api' then cost_cents else 0 end), 0)::double precision
+        AS metered_cost_cents,
+      coalesce(sum(case when billing_type in ('subscription_included','subscription_overage')
+        then input_tokens + cached_input_tokens + output_tokens else 0 end), 0)::double precision
+        AS subscription_tokens
+    FROM cost_events
+    WHERE occurred_at >= date_trunc('month', now() at time zone 'utc')
+  `);
+    const rows = res.rows ?? res;
+    const r = Array.isArray(rows) ? rows[0] : undefined;
+    return {
+        meteredCostCents: Number(r?.metered_cost_cents ?? 0),
+        subscriptionTokens: Number(r?.subscription_tokens ?? 0),
+    };
+}
+/** Pure evaluation of usage against a stored limit — testable without a DB. */
+export function evaluateInstanceLimit(limit, usage) {
+    const base = {
+        exceeded: false,
+        warned: false,
+        metric: null,
+        observed: 0,
+        ceiling: null,
+        percent: 0,
+        mode: limit.mode,
+    };
+    if (limit.mode === "off")
+        return base;
+    const candidates = [
+        { metric: "cost", observed: usage.meteredCostCents, ceiling: limit.costLimitCents },
+        { metric: "tokens", observed: usage.subscriptionTokens, ceiling: limit.tokenLimit },
+    ];
+    let driver = base;
+    for (const c of candidates) {
+        if (c.ceiling == null || c.ceiling <= 0)
+            continue;
+        const percent = (c.observed / c.ceiling) * 100;
+        const exceeded = c.observed >= c.ceiling;
+        const warned = percent >= limit.warnPercent;
+        // keep the metric with the highest utilisation as the driver
+        if (percent >= driver.percent) {
+            driver = {
+                exceeded,
+                warned,
+                metric: c.metric,
+                observed: c.observed,
+                ceiling: c.ceiling,
+                percent: Math.round(percent),
+                mode: limit.mode,
+            };
+        }
+    }
+    return driver;
+}
+/**
+ * Returns a block when the tower limit is in HARD mode and a ceiling is hit.
+ * Soft/off modes never block here (they warn at cost-event time instead).
+ * Used as an additive gate at the top of getInvocationBlock.
+ */
+export async function getInstanceLimitBlock(db) {
+    const limit = await readInstanceLimit(db);
+    if (limit.mode !== "hard")
+        return null;
+    const usage = await computeInstanceUsageMtd(db);
+    const ev = evaluateInstanceLimit(limit, usage);
+    if (!ev.exceeded || !ev.metric)
+        return null;
+    const human = ev.metric === "cost"
+        ? `$${(ev.observed / 100).toFixed(2)} of $${((ev.ceiling ?? 0) / 100).toFixed(2)}`
+        : `${Math.round(ev.observed).toLocaleString()} of ${(ev.ceiling ?? 0).toLocaleString()} tokens`;
+    return {
+        metric: ev.metric,
+        reason: `Control-tower budget limit reached for this instance (${human}). New work is blocked until the limit resets or is raised.`,
+    };
+}
+//# sourceMappingURL=instance-limit-enforcement.js.map

package/dist/services/botfather/instance-limit-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-limit-enforcement.js","sourceRoot":"","sources":["../../../src/services/botfather/instance-limit-enforcement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAA4B,MAAM,mBAAmB,CAAC;AAiBhF,MAAM,kBAAkB,GAAG,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;AAE7E,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAM;IAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;;;;;;GAS/B,CAAC,CAAC;IACH,MAAM,IAAI,GAAI,GAA4C,CAAC,IAAI,IAAK,GAAiC,CAAC;IACtG,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,CAAC,EAAE,kBAAkB,IAAI,CAAC,CAAC;QACpD,kBAAkB,EAAE,MAAM,CAAC,CAAC,EAAE,mBAAmB,IAAI,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAkBD,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CACnC,KAA0B,EAC1B,KAAuB;IAEvB,MAAM,IAAI,GAAoB;QAC5B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,UAAU,GAA6E;QAC3F,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE;QACnF,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE;KACpF,CAAC;IAEF,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC;QAC5C,6DAA6D;QAC7D,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG;gBACP,QAAQ;gBACR,MAAM;gBACN,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAM;IAChD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GACT,EAAE,CAAC,MAAM,KAAK,MAAM;QAClB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAClF,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC;IACpG,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,MAAM,EAAE,yDAAyD,KAAK,6DAA6D;KACpI,CAAC;AACJ,CAAC"}

package/dist/services/botfather/instance-limit-enforcement.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=instance-limit-enforcement.test.d.ts.map

package/dist/services/botfather/instance-limit-enforcement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-limit-enforcement.test.d.ts","sourceRoot":"","sources":["../../../src/services/botfather/instance-limit-enforcement.test.ts"],"names":[],"mappings":""}