charness 0.0.0-stage → 3.1.0

package/dist/botFileStorage.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @description Disk layout + lifecycle for bot-owned per-thread file intake.
+ *
+ * Files sent to a topic are downloaded into `DATA_DIR/files/<chatId>_<threadId>/`
+ * — bot-owned, deliberately OUTSIDE the bound project folder so user code dirs
+ * stay clean. Two cleanup mechanisms keep the tree bounded:
+ *
+ *   1. {@link purgeThreadFiles} — called when a bare `/clear` is forwarded to
+ *      the agent (its context is wiped, so referenced files are useless).
+ *   2. {@link sweepExpiredThreadFiles} — a logrotate-style age sweep run at
+ *      boot and once a day: files older than the retention window are removed
+ *      and now-empty dirs pruned — a connector's own folders inside a thread
+ *      dir (the Jira connector's `jira/`) are swept the same way.
+ *
+ * The path helpers and the sweep are pure / injectable (`now` is a parameter)
+ * so they can be unit-tested against a temp dir without a clock or a bot.
+ */
+import { type SessionKey } from './sessionKey';
+/** Subdirectory of `DATA_DIR` that holds every thread's intake folder. */
+export declare const filesRootDirName = "files";
+/** Retention window for the age sweep: files older than this are deleted. */
+export declare const fileRetentionDays = 30;
+/** Same window in ms — the injectable sweep takes a `retentionMs`. */
+export declare const fileRetentionMs: number;
+/** How often the boot-armed sweep timer fires (once a day). */
+export declare const fileSweepIntervalMs: number;
+/** Absolute path of the `files/` root under a given data dir. */
+export declare function resolveFilesRoot(dataDir: string): string;
+/** Absolute path of one thread's intake dir under a given data dir. */
+export declare function resolveThreadFilesDir(dataDir: string, key: SessionKey): string;
+/**
+ * @description Ensure a thread's intake dir exists and return its path.
+ * Created `0700` — these files can carry private user content and the dir is
+ * bot-owned, so it should not be world-readable on a shared host.
+ */
+export declare function ensureThreadFilesDir(dataDir: string, key: SessionKey): Promise<string>;
+/**
+ * @description Delete a thread's intake dir and everything in it. Used by the
+ * forwarded `/clear` path. No-op (and no throw) when the dir doesn't exist —
+ * a thread that never received a file has nothing to purge.
+ */
+export declare function purgeThreadFiles(dataDir: string, key: SessionKey): Promise<void>;
+/** Outcome of one sweep pass — handy for logging and assertions. */
+export interface SweepResult {
+    /** Number of files unlinked because they were older than the retention window, in any nested folder. */
+    removedFiles: number;
+    /** Number of dirs removed because they ended up empty: thread dirs and the folders nested in them. */
+    removedDirs: number;
+}
+/**
+ * @description Age-sweep the `files/` tree under `filesRoot`. Walks every
+ * thread dir and the folders nested in it, unlinks files whose mtime is older
+ * than `retentionMs` relative to `now`, then removes any dir left empty. `now`
+ * is injected so the sweep is deterministic in tests.
+ *
+ * Robust to a missing root (returns zeroes) and to per-entry errors (logged,
+ * skipped) so one unreadable file can't abort the whole sweep.
+ */
+export declare function sweepExpiredThreadFiles(filesRoot: string, retentionMs: number, now: number): Promise<SweepResult>;
+//# sourceMappingURL=botFileStorage.d.ts.map

package/dist/botFileStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"botFileStorage.d.ts","sourceRoot":"","sources":["../src/botFileStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1D,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,sEAAsE;AACtE,eAAO,MAAM,eAAe,QAA0C,CAAC;AAEvE,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB,QAAsB,CAAC;AAiBvD,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAI5F;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtF;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,wGAAwG;IACxG,YAAY,EAAE,MAAM,CAAC;IACrB,sGAAsG;IACtG,WAAW,EAAE,MAAM,CAAC;CACrB;AAqDD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,WAAW,CAAC,CA8BtB"}

package/dist/botFileStorage.js

@@ -0,0 +1,205 @@
+"use strict";
+/**
+ * @description Disk layout + lifecycle for bot-owned per-thread file intake.
+ *
+ * Files sent to a topic are downloaded into `DATA_DIR/files/<chatId>_<threadId>/`
+ * — bot-owned, deliberately OUTSIDE the bound project folder so user code dirs
+ * stay clean. Two cleanup mechanisms keep the tree bounded:
+ *
+ *   1. {@link purgeThreadFiles} — called when a bare `/clear` is forwarded to
+ *      the agent (its context is wiped, so referenced files are useless).
+ *   2. {@link sweepExpiredThreadFiles} — a logrotate-style age sweep run at
+ *      boot and once a day: files older than the retention window are removed
+ *      and now-empty dirs pruned — a connector's own folders inside a thread
+ *      dir (the Jira connector's `jira/`) are swept the same way.
+ *
+ * The path helpers and the sweep are pure / injectable (`now` is a parameter)
+ * so they can be unit-tested against a temp dir without a clock or a bot.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileSweepIntervalMs = exports.fileRetentionMs = exports.fileRetentionDays = exports.filesRootDirName = void 0;
+exports.resolveFilesRoot = resolveFilesRoot;
+exports.resolveThreadFilesDir = resolveThreadFilesDir;
+exports.ensureThreadFilesDir = ensureThreadFilesDir;
+exports.purgeThreadFiles = purgeThreadFiles;
+exports.sweepExpiredThreadFiles = sweepExpiredThreadFiles;
+const fs_1 = require("fs");
+const path = __importStar(require("path"));
+const sessionKey_1 = require("./sessionKey");
+/** Subdirectory of `DATA_DIR` that holds every thread's intake folder. */
+exports.filesRootDirName = 'files';
+/** Retention window for the age sweep: files older than this are deleted. */
+exports.fileRetentionDays = 30;
+/** Same window in ms — the injectable sweep takes a `retentionMs`. */
+exports.fileRetentionMs = exports.fileRetentionDays * 24 * 60 * 60 * 1000;
+/** How often the boot-armed sweep timer fires (once a day). */
+exports.fileSweepIntervalMs = 24 * 60 * 60 * 1000;
+/**
+ * @description Separator standing in for the serialized key's `:` inside a
+ * directory name — `:` is illegal on some filesystems.
+ */
+const threadDirSeparator = '_';
+/**
+ * @description The per-thread intake dir name — `<chatId>_<threadId>`. The
+ * components are internal ids (not user input), but we still join via
+ * `path.join` so the result can never escape `filesRoot`.
+ */
+function threadDirName(key) {
+    return (0, sessionKey_1.keyToSlug)(key, threadDirSeparator);
+}
+/** Absolute path of the `files/` root under a given data dir. */
+function resolveFilesRoot(dataDir) {
+    return path.join(dataDir, exports.filesRootDirName);
+}
+/** Absolute path of one thread's intake dir under a given data dir. */
+function resolveThreadFilesDir(dataDir, key) {
+    return path.join(resolveFilesRoot(dataDir), threadDirName(key));
+}
+/**
+ * @description Ensure a thread's intake dir exists and return its path.
+ * Created `0700` — these files can carry private user content and the dir is
+ * bot-owned, so it should not be world-readable on a shared host.
+ */
+async function ensureThreadFilesDir(dataDir, key) {
+    const dir = resolveThreadFilesDir(dataDir, key);
+    await fs_1.promises.mkdir(dir, { recursive: true, mode: 0o700 });
+    return dir;
+}
+/**
+ * @description Delete a thread's intake dir and everything in it. Used by the
+ * forwarded `/clear` path. No-op (and no throw) when the dir doesn't exist —
+ * a thread that never received a file has nothing to purge.
+ */
+async function purgeThreadFiles(dataDir, key) {
+    const dir = resolveThreadFilesDir(dataDir, key);
+    await fs_1.promises.rm(dir, { recursive: true, force: true });
+}
+/**
+ * Sweep one dir and the folders nested in it (a connector keeps its own files in a subfolder of the thread
+ * dir): unlink what is older than `cutoff`, remove each dir left empty. Resolves how many entries remain —
+ * a fresh file, a folder that still holds something, a symlink (never followed) or an entry that could not be
+ * processed — so the caller knows whether its own dir may go.
+ */
+async function sweepDirectory(dir, cutoff, result) {
+    let entries;
+    try {
+        entries = await fs_1.promises.readdir(dir, { withFileTypes: true });
+    }
+    catch (e) {
+        console.warn(`[fileSweep] cannot read dir ${dir}:`, e);
+        return 1;
+    }
+    let remaining = 0;
+    for (const entry of entries) {
+        const entryPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (await sweepDirectory(entryPath, cutoff, result) === 0) {
+                try {
+                    await fs_1.promises.rmdir(entryPath);
+                    result.removedDirs += 1;
+                }
+                catch (e) {
+                    console.warn(`[fileSweep] cannot remove empty dir ${entryPath}:`, e);
+                    remaining += 1;
+                }
+            }
+            else {
+                remaining += 1;
+            }
+        }
+        else if (entry.isFile()) {
+            try {
+                const stat = await fs_1.promises.stat(entryPath);
+                if (stat.mtimeMs < cutoff) {
+                    await fs_1.promises.unlink(entryPath);
+                    result.removedFiles += 1;
+                }
+                else {
+                    remaining += 1;
+                }
+            }
+            catch (e) {
+                // Couldn't stat/unlink — leave it and treat as remaining so the dir
+                // isn't pruned out from under a file we failed to remove.
+                console.warn(`[fileSweep] cannot process ${entryPath}:`, e);
+                remaining += 1;
+            }
+        }
+        else {
+            remaining += 1;
+        }
+    }
+    return remaining;
+}
+/**
+ * @description Age-sweep the `files/` tree under `filesRoot`. Walks every
+ * thread dir and the folders nested in it, unlinks files whose mtime is older
+ * than `retentionMs` relative to `now`, then removes any dir left empty. `now`
+ * is injected so the sweep is deterministic in tests.
+ *
+ * Robust to a missing root (returns zeroes) and to per-entry errors (logged,
+ * skipped) so one unreadable file can't abort the whole sweep.
+ */
+async function sweepExpiredThreadFiles(filesRoot, retentionMs, now) {
+    const result = { removedFiles: 0, removedDirs: 0 };
+    let threadDirs;
+    try {
+        const entries = await fs_1.promises.readdir(filesRoot, { withFileTypes: true });
+        threadDirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
+    }
+    catch (e) {
+        // Missing root (no files ever received) is the common case — not an error.
+        if (e.code !== 'ENOENT') {
+            console.warn(`[fileSweep] cannot read files root ${filesRoot}:`, e);
+        }
+        return result;
+    }
+    const cutoff = now - retentionMs;
+    for (const dirName of threadDirs) {
+        const dir = path.join(filesRoot, dirName);
+        if (await sweepDirectory(dir, cutoff, result) === 0) {
+            try {
+                await fs_1.promises.rmdir(dir);
+                result.removedDirs += 1;
+            }
+            catch (e) {
+                console.warn(`[fileSweep] cannot remove empty dir ${dir}:`, e);
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=botFileStorage.js.map

package/dist/botFileStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"botFileStorage.js","sourceRoot":"","sources":["../src/botFileStorage.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCH,4CAEC;AAGD,sDAEC;AAOD,oDAIC;AAOD,4CAGC;AAsED,0DAkCC;AApKD,2BAAkD;AAClD,2CAA6B;AAC7B,6CAA0D;AAE1D,0EAA0E;AAC7D,QAAA,gBAAgB,GAAG,OAAO,CAAC;AAExC,6EAA6E;AAChE,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEpC,sEAAsE;AACzD,QAAA,eAAe,GAAG,yBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvE,+DAA+D;AAClD,QAAA,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD;;;GAGG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAe;IACpC,OAAO,IAAA,sBAAS,EAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED,iEAAiE;AACjE,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAgB,CAAC,CAAC;AAC9C,CAAC;AAED,uEAAuE;AACvE,SAAgB,qBAAqB,CAAC,OAAe,EAAE,GAAe;IACpE,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAAe;IACzE,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,aAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,GAAe;IACrE,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,aAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAUD;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,MAAc,EAAE,MAAmB;IAC5E,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,aAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,+BAA+B,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC;oBACH,MAAM,aAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC3B,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC,uCAAuC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;oBACrE,SAAS,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvC,IAAI,IAAI,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;oBAC1B,MAAM,aAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC5B,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,SAAS,IAAI,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,oEAAoE;gBACpE,0DAA0D;gBAC1D,OAAO,CAAC,IAAI,CAAC,8BAA8B,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC5D,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,WAAmB,EACnB,GAAW;IAEX,MAAM,MAAM,GAAgB,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAEhE,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,2EAA2E;QAC3E,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,sCAAsC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,aAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACrB,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,uCAAuC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/applyDnsFix.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @description Prefer IPv4 when DNS returns both address families. Hosts that
+ * advertise but cannot route IPv6 otherwise wait for a long timeout before
+ * falling back to IPv4 for Telegram, provider, and MCP requests.
+ */
+export declare function applyDnsFix(): void;
+//# sourceMappingURL=applyDnsFix.d.ts.map

package/dist/cli/applyDnsFix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyDnsFix.d.ts","sourceRoot":"","sources":["../../src/cli/applyDnsFix.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC"}

package/dist/cli/applyDnsFix.js

@@ -0,0 +1,46 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyDnsFix = applyDnsFix;
+const dns = __importStar(require("dns"));
+/**
+ * @description Prefer IPv4 when DNS returns both address families. Hosts that
+ * advertise but cannot route IPv6 otherwise wait for a long timeout before
+ * falling back to IPv4 for Telegram, provider, and MCP requests.
+ */
+function applyDnsFix() {
+    dns.setDefaultResultOrder('ipv4first');
+}
+//# sourceMappingURL=applyDnsFix.js.map

package/dist/cli/applyDnsFix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyDnsFix.js","sourceRoot":"","sources":["../../src/cli/applyDnsFix.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,kCAEC;AATD,yCAA2B;AAE3B;;;;GAIG;AACH,SAAgB,WAAW;IACzB,GAAG,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC"}

package/dist/cli/bot.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @description Shared bot startup used by the public no-arg CLI and the
+ * internal hot-worker entry.
+ *
+ * Responsibilities executed in order:
+ *
+ *   1. Load `.env` files (global, then local override — or ONLY `ENV_FILE`)
+ *      between the connector guards, which exit on a breach. Must happen BEFORE
+ *      the bot module is imported, because `src/bot.ts` reads many
+ *      `process.env.*` values at top-level (TELEGRAM_BOT_TOKEN, WORK_ROOT,
+ *      ALLOWED_GROUP_ID, etc.).
+ *   2. Default `WORK_ROOT` to `process.cwd()` if still unset. This is the
+ *      normal path: start `telegramcode` from the parent folder containing
+ *      the projects/topics you want to bind.
+ *   3. Validate `WORK_ROOT` resolves to an existing directory — fail fast
+ *      with a clear message if not.
+ *   4. Acquire the single-instance lock and wire cleanup handlers.
+ *   5. Dynamically import `../bot` (which reads env at module scope) and
+ *      call `startBot()`.
+ *
+ * The dynamic import in step 5 is deliberate: a static `import` at the top
+ * of this file would resolve `process.env` at module-load time, before
+ * the env load ran, and we'd see undefined tokens. `await import(...)`
+ * defers binding until after env is populated.
+ */
+export declare function runBot(): Promise<void>;
+//# sourceMappingURL=bot.d.ts.map

package/dist/cli/bot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bot.d.ts","sourceRoot":"","sources":["../../src/cli/bot.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAyC5C"}

package/dist/cli/bot.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBot = runBot;
+const fs = __importStar(require("fs"));
+const connectorGuards_1 = require("./connectorGuards");
+const instanceLock_1 = require("../instanceLock");
+const state_1 = require("../state");
+const consoleFileTap_1 = require("../utils/consoleFileTap");
+/**
+ * @description Shared bot startup used by the public no-arg CLI and the
+ * internal hot-worker entry.
+ *
+ * Responsibilities executed in order:
+ *
+ *   1. Load `.env` files (global, then local override — or ONLY `ENV_FILE`)
+ *      between the connector guards, which exit on a breach. Must happen BEFORE
+ *      the bot module is imported, because `src/bot.ts` reads many
+ *      `process.env.*` values at top-level (TELEGRAM_BOT_TOKEN, WORK_ROOT,
+ *      ALLOWED_GROUP_ID, etc.).
+ *   2. Default `WORK_ROOT` to `process.cwd()` if still unset. This is the
+ *      normal path: start `telegramcode` from the parent folder containing
+ *      the projects/topics you want to bind.
+ *   3. Validate `WORK_ROOT` resolves to an existing directory — fail fast
+ *      with a clear message if not.
+ *   4. Acquire the single-instance lock and wire cleanup handlers.
+ *   5. Dynamically import `../bot` (which reads env at module scope) and
+ *      call `startBot()`.
+ *
+ * The dynamic import in step 5 is deliberate: a static `import` at the top
+ * of this file would resolve `process.env` at module-load time, before
+ * the env load ran, and we'd see undefined tokens. `await import(...)`
+ * defers binding until after env is populated.
+ */
+async function runBot() {
+    // The connector guards wrap the env load: a breach exits here, before the
+    // console tee, the lock or the bot module can do anything (Jira plan J3).
+    const { loaded } = (0, connectorGuards_1.loadEnvWithConnectorGuards)();
+    // Tee stdout/stderr to an hourly bucket file under DATA_DIR as EARLY as
+    // possible (right after env load, so DATA_DIR from .env is honoured) — boot
+    // logs below this line are captured for post-incident reading, terminal view
+    // preserved. Best-effort; never throws into a write.
+    (0, consoleFileTap_1.installConsoleFileTap)((0, state_1.resolveDataDir)());
+    if (loaded.length === 0) {
+        process.stderr.write(`Warning: no .env file found in $PWD or ~/.config/telegramcode/. ` +
+            `Required env (TELEGRAM_BOT_TOKEN) ` +
+            `must come from the shell instead. ALLOWED_GROUP_ID is optional ` +
+            `(auto-pairs on first contact if unset; access = the group's admins).\n`);
+    }
+    if (!process.env.WORK_ROOT) {
+        process.env.WORK_ROOT = process.cwd();
+        process.stderr.write(`Using $PWD as WORK_ROOT: ${process.env.WORK_ROOT}\n`);
+    }
+    const wr = process.env.WORK_ROOT;
+    if (!fs.existsSync(wr) || !fs.statSync(wr).isDirectory()) {
+        process.stderr.write(`WORK_ROOT does not exist or is not a directory: ${wr}\n`);
+        process.exit(1);
+    }
+    await (0, instanceLock_1.acquireLock)();
+    (0, instanceLock_1.installLockCleanupHandlers)();
+    // Lazy import so env is fully populated before the bot module's top-level
+    // `process.env.*` reads run. See file-level docstring for rationale.
+    const { startBot } = await Promise.resolve().then(() => __importStar(require('../bot')));
+    await startBot();
+}
+//# sourceMappingURL=bot.js.map

package/dist/cli/bot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bot.js","sourceRoot":"","sources":["../../src/cli/bot.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,wBAyCC;AAxED,uCAAyB;AACzB,uDAA+D;AAC/D,kDAA0E;AAC1E,oCAA0C;AAC1C,4DAAgE;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACI,KAAK,UAAU,MAAM;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,4CAA0B,GAAE,CAAC;IAEhD,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrD,IAAA,sCAAqB,EAAC,IAAA,sBAAc,GAAE,CAAC,CAAC;IAExC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE;YAChE,oCAAoC;YACpC,iEAAiE;YACjE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mDAAmD,EAAE,IAAI,CAC1D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAA,0BAAW,GAAE,CAAC;IACpB,IAAA,yCAA0B,GAAE,CAAC;IAE7B,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,EAAE,QAAQ,EAAE,GAAG,wDAAa,QAAQ,GAAC,CAAC;IAC5C,MAAM,QAAQ,EAAE,CAAC;AACnB,CAAC"}

package/dist/cli/botEntry.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=botEntry.d.ts.map

package/dist/cli/botEntry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"botEntry.d.ts","sourceRoot":"","sources":["../../src/cli/botEntry.ts"],"names":[],"mappings":""}

package/dist/cli/botEntry.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const applyDnsFix_1 = require("./applyDnsFix");
+const bot_1 = require("./bot");
+(0, applyDnsFix_1.applyDnsFix)();
+(0, bot_1.runBot)().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
+//# sourceMappingURL=botEntry.js.map

package/dist/cli/botEntry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"botEntry.js","sourceRoot":"","sources":["../../src/cli/botEntry.ts"],"names":[],"mappings":";;;AAEA,+CAA4C;AAC5C,+BAA+B;AAE/B,IAAA,yBAAW,GAAE,CAAC;AAEd,IAAA,YAAM,GAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli/claudeProfiles.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @description `telegramcode claude-profiles [--best] [--model <name>] [--json]` — the command-line twin of the
+ * `claude_profiles` MCP tool, for a worker that has no MCP (a shell script, a child started by hand): which
+ * Claude account profile a new process should run on. It reads the bot's cache off `DATA_DIR/state.json`
+ * (`utils/claudeUsage.ts`; the bot polls every profile's usage on a timer, so the figures are at most a poll
+ * old) and never opens the `StateStore` (that would migrate and lock a live bot's file) nor the network.
+ *
+ *   --best         print ONLY the recommended profile's config directory — an EMPTY line for the default
+ *                  profile (set nothing) — so `CLAUDE_CONFIG_DIR="$(telegramcode claude-profiles --best)"`
+ *                  works as is; exit 1 when no profile is eligible
+ *   --model <name> the model the child will run (`fable` → the Fable weekly window counts)
+ *   --json         the full report as JSON (the MCP tool's shape)
+ *
+ * Without a flag: one human line per profile. `DATA_DIR` comes from the environment the bot itself reads
+ * (`~/.config/telegramcode/.env`, `$PWD/.env`, or `ENV_FILE`).
+ */
+import { type ClaudeProfileReportEntry } from '../utils/claudeUsage';
+export interface ClaudeProfilesCliArgs {
+    isBest: boolean;
+    isJson: boolean;
+    model: string | null;
+}
+/** Parse the subcommand's flags; `null` with a message for anything unknown. */
+export declare function parseClaudeProfilesCliArgs(argv: readonly string[]): {
+    ok: true;
+    args: ClaudeProfilesCliArgs;
+} | {
+    ok: false;
+    error: string;
+};
+/** One human line: `✓ work  /data/…/work  mail@example.com personal max  5h 12% 🔄 in 2h · week 40% 🔄 in 2d 1h · Fable 3% 🔄 in 2d 1h` (no Fable part for an account without that window). */
+export declare function formatClaudeProfileCliLine(entry: ClaudeProfileReportEntry, nowMs: number): string;
+/**
+ * @description Run the subcommand; returns the exit code. Output goes to stdout, a refusal to stderr.
+ * `readRecords` / `now` are injectable for the unit test; the CLI test drives the built binary instead.
+ */
+export declare function runClaudeProfilesCli(argv: readonly string[], io?: {
+    stdout?: (text: string) => void;
+    stderr?: (text: string) => void;
+    now?: () => number;
+}): Promise<number>;
+//# sourceMappingURL=claudeProfiles.d.ts.map

package/dist/cli/claudeProfiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeProfiles.d.ts","sourceRoot":"","sources":["../../src/cli/claudeProfiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAKL,KAAK,wBAAwB,EAE9B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,gFAAgF;AAChF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgB5I;AAED,+LAA+L;AAC/L,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmBjG;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE;IACF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACf,GACL,OAAO,CAAC,MAAM,CAAC,CA8BjB"}