@uniquedivine/tg-sai 0.0.3 → 0.0.5

package/adminAudit.ts

@@ -1,54 +1,54 @@
 export interface TestData<T> {
-  goldReq: string;
-  notes?: string;
-  data: T;
+  goldReq: string
+  notes?: string
+  data: T
 }
 
 export interface UserData {
-  id: number;
-  username: string | null;
-  displayName: string;
-  isBot: boolean;
-  rawType: string;
+  id: number
+  username: string | null
+  displayName: string
+  isBot: boolean
+  rawType: string
 }
 
 export interface ChatMemberData {
-  user: UserData;
-  status: string;
-  title: string | null;
-  invitedBy: UserData | null;
-  promotedBy: UserData | null;
-  restrictedBy: UserData | null;
-  restrictions: unknown | null;
-  isMember: boolean;
-  permissions: AdminPermissionsData | null;
-  rawType: string;
+  user: UserData
+  status: string
+  title: string | null
+  invitedBy: UserData | null
+  promotedBy: UserData | null
+  restrictedBy: UserData | null
+  restrictions: unknown | null
+  isMember: boolean
+  permissions: AdminPermissionsData | null
+  rawType: string
 }
 
 export interface AdminPermissionsData {
-  addAdmins?: boolean;
-  add_admins?: boolean;
-  [key: string]: unknown;
+  addAdmins?: boolean
+  add_admins?: boolean
+  [key: string]: unknown
 }
 
 export interface ChatAuditInput {
-  chatId: number | string;
-  targetUserId: number | string;
-  self: UserData;
-  actor: ChatMemberData | null;
-  target: ChatMemberData | null;
+  chatId: number | string
+  targetUserId: number | string
+  self: UserData
+  actor: ChatMemberData | null
+  target: ChatMemberData | null
 }
 
 export interface ChatAuditResult {
-  chatId: number | string;
-  targetUserId: number | string;
-  actorRole: MemberRole;
-  targetRole: MemberRole;
-  actorCanApply: boolean;
-  actorCanTransferOwnership: boolean;
-  targetCanReceiveOwnership: boolean;
-  targetIsAdmin: boolean;
-  proposedActions: ProposedAction[];
+  chatId: number | string
+  targetUserId: number | string
+  actorRole: MemberRole
+  targetRole: MemberRole
+  actorCanApply: boolean
+  actorCanTransferOwnership: boolean
+  targetCanReceiveOwnership: boolean
+  targetIsAdmin: boolean
+  proposedActions: ProposedAction[]
 }
 
 export type MemberRole =
@@ -59,17 +59,17 @@ export type MemberRole =
   | "banned"
   | "left"
   | "not_present"
-  | "unknown";
+  | "unknown"
 
 export type ProposedAction =
   | "skip: actor lacks owner/admin rights"
   | "add target user"
   | "promote target user admin"
-  | "noop: target user already admin";
+  | "noop: target user already admin"
 
 export function deriveMemberRole(member: ChatMemberData | null): MemberRole {
   if (!member) {
-    return "not_present";
+    return "not_present"
   }
   switch (member.status) {
     case "creator":
@@ -78,9 +78,9 @@ export function deriveMemberRole(member: ChatMemberData | null): MemberRole {
     case "restricted":
     case "banned":
     case "left":
-      return member.status;
+      return member.status
     default:
-      return "unknown";
+      return "unknown"
   }
 }
 
@@ -88,49 +88,49 @@ export function hasAddAdminsRight(
   permissions: AdminPermissionsData | null,
 ): boolean {
   if (!permissions) {
-    return false;
+    return false
   }
-  return Boolean(permissions.addAdmins || permissions.add_admins);
+  return Boolean(permissions.addAdmins || permissions.add_admins)
 }
 
 export function canActorPromoteAdmins(input: ChatAuditInput): boolean {
-  const actorRole = deriveMemberRole(input.actor);
+  const actorRole = deriveMemberRole(input.actor)
   if (actorRole === "creator") {
-    return true;
+    return true
   }
   if (actorRole !== "admin") {
-    return false;
+    return false
   }
-  return hasAddAdminsRight(input.actor?.permissions ?? null);
+  return hasAddAdminsRight(input.actor?.permissions ?? null)
 }
 
 export function canActorTransferOwnership(input: ChatAuditInput): boolean {
-  return deriveMemberRole(input.actor) === "creator";
+  return deriveMemberRole(input.actor) === "creator"
 }
 
 export function isAdminRole(role: MemberRole): boolean {
-  return role === "admin" || role === "creator";
+  return role === "admin" || role === "creator"
 }
 
 export function planAdminBootstrap(input: ChatAuditInput): ChatAuditResult {
-  const actorRole = deriveMemberRole(input.actor);
-  const targetRole = deriveMemberRole(input.target);
-  const actorCanApply = canActorPromoteAdmins(input);
-  const actorCanTransferOwnership = canActorTransferOwnership(input);
-  const targetIsAdmin = isAdminRole(targetRole);
+  const actorRole = deriveMemberRole(input.actor)
+  const targetRole = deriveMemberRole(input.target)
+  const actorCanApply = canActorPromoteAdmins(input)
+  const actorCanTransferOwnership = canActorTransferOwnership(input)
+  const targetIsAdmin = isAdminRole(targetRole)
   const targetCanReceiveOwnership =
-    targetRole === "admin" && input.target?.user.isBot !== true;
+    targetRole === "admin" && input.target?.user.isBot !== true
 
-  const proposedActions: ProposedAction[] = [];
+  const proposedActions: ProposedAction[] = []
   if (!actorCanApply) {
-    proposedActions.push("skip: actor lacks owner/admin rights");
+    proposedActions.push("skip: actor lacks owner/admin rights")
   } else if (targetIsAdmin) {
-    proposedActions.push("noop: target user already admin");
+    proposedActions.push("noop: target user already admin")
   } else {
     if (targetRole === "not_present" || targetRole === "left") {
-      proposedActions.push("add target user");
+      proposedActions.push("add target user")
     }
-    proposedActions.push("promote target user admin");
+    proposedActions.push("promote target user admin")
   }
 
   return {
@@ -143,5 +143,5 @@ export function planAdminBootstrap(input: ChatAuditInput): ChatAuditResult {
     targetCanReceiveOwnership,
     targetIsAdmin,
     proposedActions,
-  };
+  }
 }

package/captureProvisioningGolden.ts

@@ -0,0 +1,98 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { Command } from "commander"
+import { getChatMember, iterDialogs } from "@mtcute/bun/methods.js"
+import { createMtcuteClient } from "./mtcuteAdapter"
+import { strictProfileCredentials } from "./profiles"
+import { creationMarker, PROVISIONING_BOT_ID } from "./provisioning"
+import { setupFromCloud } from "./provisioningCloud"
+import { requireExactCaptureDialog, sanitizedProvisioningGolden } from "./provisioningGoldens"
+import { resolveProvisioningPeer } from "./provisioningRuntime"
+
+// Only read methods are used. An explicit persisted setup binds the target chat
+// and identities; a fresh temporary store avoids touching worker session files.
+export async function captureProvisioningGolden(options: {
+  profile: string; chat: string; setup: string; out: string
+}) {
+  const chatId = Number(options.chat)
+  const setup = setupFromCloud(JSON.parse(await readFile(options.setup, "utf8")))
+  if (!Number.isSafeInteger(chatId) || chatId >= 0 || setup.chatId !== chatId ||
+      setup.expectedUserId !== 8274304175 || !setup.binding ||
+      setup.custodyProfile !== options.profile)
+    throw new Error("Capture requires the exact custody setup and group")
+  const credentials = await strictProfileCredentials(options.profile, setup.expectedUserId)
+  const directory = await mkdtemp(join(tmpdir(), "tg-sai-golden-"))
+  let client: Awaited<ReturnType<typeof createMtcuteClient>> | undefined
+  let stage = "connect"
+  try {
+    client = await createMtcuteClient({ apiId: credentials.apiId,
+      apiHash: credentials.apiHash, session: credentials.sessionString,
+      storage: join(directory, "session") })
+    stage = "self"
+    const me = await client.getMe()
+    if (me.id !== setup.expectedUserId || me.isBot)
+      throw new Error("Custody identity mismatch")
+    stage = "dialogs"
+    await requireExactCaptureDialog(iterDialogs(client, {
+      limit: 1000, archived: "keep",
+    }), chatId)
+    stage = "fullchat"
+    const chat = await client.getFullChat(chatId)
+    const marker = creationMarker(setup)
+    console.log(JSON.stringify({ stage: "group_verified_readback", exactId: chat.id === chatId,
+      chatType: chat.chatType, isForum: chat.isForum, isCreator: chat.isCreator,
+      markerMatches: chat.bio === marker }))
+    if (chat.id !== chatId || chat.chatType !== "supergroup" || chat.isForum ||
+        !chat.isCreator || chat.bio !== marker)
+      throw new Error("Capture group ownership or marker mismatch")
+    const subjects = new Map<number, string>([
+      [setup.expectedUserId, "custody"], [PROVISIONING_BOT_ID, "bot"],
+    ])
+    setup.binding.admins.forEach((id, i) => {
+      if (!subjects.has(id)) subjects.set(id, `required_admin_${i}`)
+    })
+    setup.binding.participants.forEach((id, i) => {
+      if (!subjects.has(id)) subjects.set(id, `ordinary_${i}`)
+    })
+    const members = []
+    for (const [userId, subject] of subjects) {
+      stage = `member_${subject}`
+      if (subject.startsWith("ordinary_"))
+        await resolveProvisioningPeer(peer => client!.getUser(peer), userId)
+      const value = await getChatMember(client, { chatId, userId })
+      members.push({ subject, value })
+      console.log(JSON.stringify({ subject, status: value?.status ?? "absent" }))
+    }
+    stage = "invitations"
+    const invites = await client.getInviteLinks(chatId, { limit: 100 })
+    const golden = sanitizedProvisioningGolden({ capturedAt: new Date().toISOString(),
+      chat, expectedMarker: marker, members, invites })
+    await writeFile(options.out, `${JSON.stringify(golden, null, 2)}\n`, { flag: "wx", mode: 0o600 })
+    return { members: members.length, invitations: invites.length }
+  } catch (error) {
+    const record = error && typeof error === "object" ? error as Record<string, unknown> : {}
+    const code = typeof record.text === "string" && /^[A-Z0-9_]{1,100}$/.test(record.text)
+      ? record.text : "unclassified"
+    console.error(JSON.stringify({ stage, code }))
+    throw new Error("Sanitized capture failure")
+  } finally {
+    try { await client?.disconnect() } finally { await rm(directory, { recursive: true, force: true }) }
+  }
+}
+
+if (import.meta.main) {
+  const command = new Command().description("Capture sanitized read-only evidence from one authorized custody group")
+    .requiredOption("--profile <name>", "Exact configured custody profile")
+    .requiredOption("--chat <id>", "Exact negative Telegram group ID")
+    .requiredOption("--setup <path>", "Deal Desk setup readback JSON with resolved bindings")
+    .requiredOption("--out <path>", "New sanitized fixture file; existing files are refused")
+  command.parse()
+  try {
+    const counts = await captureProvisioningGolden(command.opts())
+    console.log(`Saved sanitized readback: ${counts.members} members, ${counts.invitations} invitations`)
+  } catch {
+    console.error("Capture failed. Check the exact setup, custody identity, permissions, and destination. Raw Telegram errors are suppressed.")
+    process.exitCode = 1
+  }
+}

package/cfg.ts

@@ -59,6 +59,18 @@ export const USERS = {
     displayName: "Corinne Antonia",
     kind: "user",
   },
+
+  /**
+   * Sai custody account: the intended owner of every Sai deal chat. Same
+   * numeric ID as `corinneAlt`, renamed and verified through `getMe` on
+   * 2026-11-05. Default ownership target for `ops sai-bootstrap`.
+   */
+  saiCustody: {
+    id: 8274304175,
+    handle: "SaiTeam_AI",
+    displayName: "Sai AI Automation",
+    kind: "user",
+  },
 } satisfies Record<string, TelegramIdentity>
 
 /**
@@ -70,4 +82,3 @@ export const nibiruInternal = {
   title: "Nibiru | Internal",
   kind: "channel",
 } satisfies TelegramChatIdentity
-

package/custodyWorker.ts

@@ -0,0 +1,259 @@
+import { randomUUID } from "node:crypto"
+import { mkdir, open, readFile } from "node:fs/promises"
+import { dirname, join } from "node:path"
+import { configDir } from "./profiles"
+import { provisionSetup, safeProvisionError } from "./provisioning"
+import type {
+  ProvisionCloud,
+  ProvisionJournal,
+  Setup,
+  TelegramProvisioner,
+} from "./provisioning"
+import { CliProvisionCloud } from "./provisioningCloud"
+import {
+  FileProvisionJournal,
+  withAccountLock,
+  withProvisionTelegram,
+} from "./provisioningRuntime"
+
+export const CUSTODY_USER_ID = 8274304175
+export const REQUIRED_UNIQUE_ADMIN_ID = 1912700300
+export interface PendingQueue {
+  pending(input: {
+    expectedUserId: number
+    workerId: string
+    limit: number
+    after?: string
+  }): Promise<{
+    requests: Setup[]
+    nextAfter: string | null
+    blocked?: { requestId: string; state: string; reason: string }[]
+  }>
+}
+export interface WorkerResult {
+  requestId: string
+  state: string
+  chatId?: number
+  retryAt?: string | null
+  error?: string
+}
+export interface WorkerOptions {
+  custodyProfile: string
+  workerId: string
+  limit?: number
+  run?: boolean
+  now?: number
+  after?: string
+}
+/** Persistent random identity retains ownership of sticky cloud claims after restart. */
+export async function stableWorkerId(root = configDir()): Promise<string> {
+  const path = join(root, "provisioning", "worker-id")
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 })
+  try {
+    const file = await open(path, "wx", 0o600)
+    try {
+      await file.writeFile(`custody:${CUSTODY_USER_ID}:${randomUUID()}`)
+      await file.sync()
+    } finally {
+      await file.close()
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error
+  }
+  const id = (await readFile(path, "utf8")).trim()
+  if (!new RegExp(`^custody:${CUSTODY_USER_ID}:[a-f0-9-]{36}$`).test(id))
+    throw new Error(
+      "Invalid saved worker identity; inspect private worker state",
+    )
+  return id
+}
+
+/** One bounded page per tick; authoritative queue and local checks both scope jobs. */
+export async function runWorkerOnce(
+  options: WorkerOptions,
+  deps: {
+    cloud: ProvisionCloud & PendingQueue
+    journal: ProvisionJournal
+    telegram: <T>(
+      setup: Setup,
+      operation: (adapter: TelegramProvisioner) => Promise<T>,
+    ) => Promise<T>
+  },
+): Promise<{
+  dryRun: boolean
+  results: WorkerResult[]
+  nextAfter: string | null
+}> {
+  if (!options.custodyProfile.trim() || !options.workerId.trim())
+    throw new Error("Explicit custody profile and stable worker ID required")
+  const limit = options.limit ?? 10
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 50)
+    throw new Error("Worker limit must be 1 through 50")
+  const page = await deps.cloud.pending({
+    expectedUserId: CUSTODY_USER_ID,
+    workerId: options.workerId,
+    limit,
+    ...(options.after ? { after: options.after } : {}),
+  })
+  if (page.requests.length > limit)
+    throw new Error("Pending queue exceeded requested bound")
+  if (
+    !Array.isArray(page.blocked ?? []) ||
+    (page.blocked?.length ?? 0) + page.requests.length > limit
+  )
+    throw new Error("Pending queue blocked results exceeded requested bound")
+  const results: WorkerResult[] = (page.blocked ?? []).map((row) => ({
+    requestId: row.requestId,
+    state: "blocked",
+    error: row.reason,
+  }))
+  for (const selected of page.requests) {
+    const setup = await deps.cloud.view(selected.requestId)
+    if (
+      setup.expectedUserId !== CUSTODY_USER_ID ||
+      setup.custodyProfile !== options.custodyProfile
+    )
+      throw new Error("Pending job does not match configured custody identity")
+    if (
+      !setup.admins.some(
+        (admin) => String(admin.userId) === String(REQUIRED_UNIQUE_ADMIN_ID),
+      )
+    ) {
+      results.push({
+        requestId: setup.requestId,
+        state: "blocked",
+        error: "required_unique_admin_missing",
+      })
+      continue
+    }
+    if (
+      !["prepared", "creating", "configuring", "incomplete"].includes(
+        setup.state,
+      )
+    ) {
+      results.push({ requestId: setup.requestId, state: setup.state })
+      continue
+    }
+    // A permanent/unknown configuration failure needs explicit operator recovery.
+    // Only a persisted transient retry time authorizes unattended retry.
+    if (setup.state === "incomplete" && !setup.retryAt) {
+      results.push({
+        requestId: setup.requestId,
+        state: "blocked",
+        error: "operator_recovery_required",
+      })
+      continue
+    }
+    if (
+      setup.retryAt &&
+      Date.parse(setup.retryAt) > (options.now ?? Date.now())
+    ) {
+      results.push({
+        requestId: setup.requestId,
+        state: "waiting",
+        retryAt: setup.retryAt,
+      })
+      continue
+    }
+    if (!options.run) {
+      results.push({
+        requestId: setup.requestId,
+        state: setup.state,
+        ...(setup.chatId ? { chatId: setup.chatId } : {}),
+      })
+      continue
+    }
+    try {
+      const result = await deps.telegram(setup, (telegram) =>
+        provisionSetup({
+          setup,
+          telegram,
+          cloud: deps.cloud,
+          journal: deps.journal,
+          workerId: options.workerId,
+        }),
+      )
+      results.push({
+        requestId: setup.requestId,
+        state: result.state,
+        ...("chatId" in result && result.chatId
+          ? { chatId: result.chatId }
+          : {}),
+      })
+    } catch (error) {
+      // Get the actual state after an ambiguous response; never retry a creation in this tick.
+      const current = await deps.cloud.view(setup.requestId)
+      results.push({
+        requestId: setup.requestId,
+        state: current.state,
+        ...(current.chatId ? { chatId: current.chatId } : {}),
+        retryAt: current.retryAt,
+        error: safeProvisionError(error),
+      })
+    }
+  }
+  return { dryRun: !options.run, results, nextAfter: page.nextAfter }
+}
+
+export async function runCustodyWorker(options: {
+  custodyProfile: string
+  once?: boolean
+  run?: boolean
+  limit?: number
+  intervalMs?: number
+  signal?: AbortSignal
+}): Promise<void> {
+  const interval = options.intervalMs ?? 5000
+  if (!Number.isSafeInteger(interval) || interval < 1000 || interval > 60000)
+    throw new Error("Worker interval must be 1000 through 60000ms")
+  if (!options.once && !options.run)
+    throw new Error(
+      "Daemon mode requires --run; use --once for read-only preview",
+    )
+  const root = configDir()
+  const workerId = await stableWorkerId(root)
+  const execute = async () => {
+    const cloud = new CliProvisionCloud()
+    let after: string | undefined
+    do {
+      try {
+        const result = await runWorkerOnce(
+          { ...options, workerId, after },
+          {
+            cloud,
+            journal: new FileProvisionJournal(root),
+            telegram: withProvisionTelegram,
+          },
+        )
+        after = result.nextAfter ?? undefined
+        console.log(
+          JSON.stringify({ ...result, observedAt: new Date().toISOString() }),
+        )
+      } catch (error) {
+        if (options.once) throw error
+        console.error(
+          JSON.stringify({
+            state: "worker_tick_failed",
+            observedAt: new Date().toISOString(),
+            retryInMs: interval,
+          }),
+        )
+      }
+      if (options.once || options.signal?.aborted) break
+      await new Promise<void>((resolve) => {
+        const done = () => {
+          clearTimeout(timer)
+          options.signal?.removeEventListener("abort", done)
+          resolve()
+        }
+        const timer = setTimeout(done, interval)
+        options.signal?.addEventListener("abort", done, { once: true })
+      })
+    } while (!options.signal?.aborted)
+  }
+  if (!options.run) return execute()
+  await withAccountLock(
+    join(root, "provisioning", "worker-service.lock"),
+    execute,
+  )
+}

package/custodyWorkerCli.ts

@@ -0,0 +1,52 @@
+import type { Command } from "commander"
+import { runCustodyWorker } from "./custodyWorker"
+
+/** Root main.ts calls this once beside addProvisionCommands. No MCP is involved. */
+export function addCustodyWorkerCommands(
+  program: Command,
+  run: typeof runCustodyWorker = runCustodyWorker,
+): void {
+  program
+    .command("worker")
+    .description(
+      "Run the custody-account provisioning queue; defaults to a read-only one-page preview",
+    )
+    .requiredOption(
+      "--custody-profile <name>",
+      "Explicit saved custody profile for user 8274304175",
+    )
+    .option("--once", "Process one bounded page and exit")
+    .option("--run", "Execute approved queued Telegram setup jobs")
+    .option("--limit <count>", "Maximum jobs per tick, 1 through 50", "10")
+    .option(
+      "--interval-ms <ms>",
+      "Polling interval, 1000 through 60000",
+      "5000",
+    )
+    .action(
+      async (options: {
+        custodyProfile: string
+        once?: boolean
+        run?: boolean
+        limit: string
+        intervalMs: string
+      }) => {
+        const controller = new AbortController()
+        const stop = () => controller.abort()
+        process.once("SIGTERM", stop)
+        process.once("SIGINT", stop)
+        try {
+          await run({
+            ...options,
+            once: options.once || !options.run,
+            limit: Number(options.limit),
+            intervalMs: Number(options.intervalMs),
+            signal: controller.signal,
+          })
+        } finally {
+          process.removeListener("SIGTERM", stop)
+          process.removeListener("SIGINT", stop)
+        }
+      },
+    )
+}