instar 1.2.67 → 1.2.68

package/dist/threadline/ConversationStore.d.ts

@@ -0,0 +1,158 @@
+/**
+ * ConversationStore — the single source of truth for a Threadline conversation.
+ *
+ * Phase 1 of the Threadline re-assessment (THREADLINE-CONVERSATION-KEYSTONE-SPEC.md).
+ * Collapses the state previously smeared across `ThreadResumeMap`,
+ * `ContextThreadMap`, the in-memory peer-affinity map and `inbox.jsonl` into one
+ * durable record keyed by `threadId`. It is the ONLY place conversation turn
+ * state lives — the one-shot reply worker provably cannot self-police a loop, so
+ * the turn count + novelty hashes must live here, on the conversation.
+ *
+ * Concurrency: every write goes through `mutate(threadId, fn)`, a single-writer
+ * surface modeled on `CommitmentTracker.mutate()` — a per-threadId FIFO queue
+ * plus optimistic CAS on the record's `version`. This is the fix for the
+ * convergence-flagged race where two near-simultaneous inbound messages (or a
+ * live-inject racing a resume) would clobber `turnCount`/`lastOutboundHash` under
+ * the legacy last-writer-wins `load→mutate→persist`.
+ *
+ * Storage: {stateDir}/threadline/conversations.json (server-write-only, atomic
+ * tmp+rename). NOT relay-hosted — authoritative state stays local. The
+ * append-only SharedStateLedger remains the audit trail; this is the live
+ * mutable state it logs transitions from.
+ */
+/**
+ * Conversation lifecycle state. Superset of the legacy `ThreadState`
+ * (`active|idle|resolved|failed|archived`) plus `open` (created, not yet
+ * worked) and `awaiting-reply` (we replied, waiting on the peer). `idle` is
+ * also the warrants-a-reply gate's "suppressed, do not spawn" terminal-ish
+ * state.
+ */
+export type ConversationState = 'open' | 'active' | 'idle' | 'awaiting-reply' | 'resolved' | 'failed' | 'archived';
+/**
+ * The durable conversation record. EXHAUSTIVE against the legacy stores — an
+ * incomplete field list silently drops live data on migration (convergence
+ * finding). Every field the four legacy stores held is preserved here.
+ */
+export interface Conversation {
+    /** Primary key — the Threadline thread id. */
+    threadId: string;
+    /** Monotonic version for optimistic CAS in mutate(). */
+    version: number;
+    /** Conversation participants — self + peer fingerprint(s). */
+    participants: {
+        /** This agent's name/fingerprint (best-effort). */
+        self?: string;
+        /** Remote peer fingerprint(s). */
+        peers: string[];
+    };
+    /** Convenience display handle for the primary remote peer. */
+    remoteAgent?: string;
+    /** Lifecycle state. */
+    state: ConversationState;
+    /** When state became 'resolved' (grace-period clock). */
+    resolvedAt?: string;
+    /** The Claude/Codex session UUID the resume primitive depends on. */
+    sessionUuid?: string;
+    /** The live (or last-known) tmux session bound to this conversation. */
+    boundSessionName?: string;
+    /** Owning Telegram topic (formerly originTopicId). */
+    boundTopicId?: number;
+    /** Originating topic-session name at send time (fast-path resume cache). */
+    originSessionName?: string;
+    /** Spawn mode of the worker handling this conversation. */
+    spawnMode?: 'interactive' | 'pipe';
+    /** Thread subject. */
+    subject?: string;
+    /** A2A contextId mapped to this thread, if any. */
+    contextId?: string;
+    /**
+     * The authenticated agent identity that owns the contextId binding. Dropping
+     * this reopens the session-smuggling vector ContextThreadMap defends.
+     */
+    agentIdentity?: string;
+    pinned: boolean;
+    messageCount: number;
+    machineOrigin?: string;
+    migratedTo?: string;
+    migrateFrom?: string;
+    turnCount: number;
+    lastInboundHash?: string;
+    lastOutboundHash?: string;
+    createdAt: string;
+    savedAt: string;
+    lastActivityAt: string;
+    /** Snapshot of the unified-trust level at last contact. */
+    trustLevel?: string;
+    /** Snapshot of the MoltBridge IQS band at last contact. */
+    iqsBand?: string;
+}
+/** Mutation function: receives a draft clone, returns the next record. */
+export type ConversationMutateFn = (draft: Conversation) => Conversation | Promise<Conversation>;
+export declare class ConversationStore {
+    private filePath;
+    private store;
+    /** Per-threadId FIFO mutate queues — serialize concurrent writers. */
+    private mutateQueues;
+    private mutateRunning;
+    /** Ephemeral verified-only peer-affinity hints (peerFingerprint → hint). */
+    private affinity;
+    constructor(stateDir: string);
+    /** Get a conversation by threadId. Returns null if missing or TTL-expired. */
+    get(threadId: string): Conversation | null;
+    /** True if a (non-expired) conversation exists for the threadId. */
+    has(threadId: string): boolean;
+    /** Find conversations whose peer set includes the given fingerprint/name. */
+    getByParticipant(participant: string): Conversation[];
+    /** Find the conversation bound to a Telegram topic, if any. */
+    getByTopicId(topicId: number): Conversation | null;
+    /** Reverse lookup: conversation owning an A2A contextId (identity-bound). */
+    getByContextId(contextId: string, agentIdentity: string): Conversation | null;
+    /** List active/idle conversations (not resolved/failed/archived). */
+    listActive(): Conversation[];
+    /** Total stored conversations (for monitoring). */
+    size(): number;
+    /**
+     * Single-writer mutate surface. Every write path routes through here so
+     * concurrent writers (the inbound funnel gate, the router resume/spawn, the
+     * relay-send binding stamp) can't clobber each other.
+     *
+     * Contract (mirrors CommitmentTracker.mutate):
+     *  - FIFO queue per threadId, max depth 256.
+     *  - Optimistic CAS on `version`: read → fn(clone) → write iff version
+     *    unchanged, else retry (max 5). On success version is incremented and
+     *    the store is persisted atomically.
+     *  - If the conversation does not exist yet, the fn receives a fresh skeleton
+     *    (state 'open', version 0) so callers can upsert in one call.
+     */
+    mutate(threadId: string, fn: ConversationMutateFn): Promise<Conversation>;
+    private drainMutateQueue;
+    private applyMutationWithCAS;
+    /**
+     * Direct upsert of a full record WITHOUT going through the CAS queue. ONLY
+     * for migration / bulk import where there are no concurrent writers. Runtime
+     * writers MUST use mutate().
+     */
+    importDirect(conversation: Conversation): void;
+    /** Persist after a batch of importDirect calls. */
+    flush(): void;
+    /** Remove a conversation. */
+    remove(threadId: string): void;
+    /**
+     * Record a short-lived, verified-only affinity hint (peer → most-recent
+     * thread). Deliberately NOT persisted (accepted loss on restart). Callers
+     * MUST only call this for VERIFIED peers — an unverified affinity would be a
+     * hijack vector.
+     */
+    recordAffinity(peerFingerprint: string, threadId: string): void;
+    /** Look up a fresh affinity hint, honoring the sliding + absolute windows. */
+    getAffinity(peerFingerprint: string): string | null;
+    /** Prune expired + resolved-past-grace + LRU-overflow (non-pinned). */
+    prune(): void;
+    private skeleton;
+    private isExpired;
+    private pruneIfNeeded;
+    private pruneMap;
+    private loadStore;
+    private saveStore;
+}
+//# sourceMappingURL=ConversationStore.d.ts.map

package/dist/threadline/ConversationStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConversationStore.d.ts","sourceRoot":"","sources":["../../src/threadline/ConversationStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,QAAQ,GACR,MAAM,GACN,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,UAAU,CAAC;AAEf;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAEhB,8DAA8D;IAC9D,YAAY,EAAE;QACZ,mDAAmD;QACnD,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,kCAAkC;QAClC,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,uBAAuB;IACvB,KAAK,EAAE,iBAAiB,CAAC;IACzB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACnC,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAGvB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IAGrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AA+CjG,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAwB;IAErC,sEAAsE;IACtE,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,aAAa,CAA0B;IAE/C,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAwC;gBAE5C,QAAQ,EAAE,MAAM;IAS5B,8EAA8E;IAC9E,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAO1C,oEAAoE;IACpE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B,6EAA6E;IAC7E,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,EAAE;IAYrD,+DAA+D;IAC/D,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAOlD,6EAA6E;IAC7E,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAW7E,qEAAqE;IACrE,UAAU,IAAI,YAAY,EAAE;IAW5B,mDAAmD;IACnD,IAAI,IAAI,MAAM;IAMd;;;;;;;;;;;;OAYG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;YAkBjE,gBAAgB;YAoBhB,oBAAoB;IAiClC;;;;OAIG;IACH,YAAY,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI;IAS9C,mDAAmD;IACnD,KAAK,IAAI,IAAI;IAIb,6BAA6B;IAC7B,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAS9B;;;;;OAKG;IACH,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAU/D,8EAA8E;IAC9E,WAAW,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAanD,uEAAuE;IACvE,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,QAAQ;IAwBhB,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,SAAS;CAYlB"}

package/dist/threadline/ConversationStore.js

@@ -0,0 +1,341 @@
+/**
+ * ConversationStore — the single source of truth for a Threadline conversation.
+ *
+ * Phase 1 of the Threadline re-assessment (THREADLINE-CONVERSATION-KEYSTONE-SPEC.md).
+ * Collapses the state previously smeared across `ThreadResumeMap`,
+ * `ContextThreadMap`, the in-memory peer-affinity map and `inbox.jsonl` into one
+ * durable record keyed by `threadId`. It is the ONLY place conversation turn
+ * state lives — the one-shot reply worker provably cannot self-police a loop, so
+ * the turn count + novelty hashes must live here, on the conversation.
+ *
+ * Concurrency: every write goes through `mutate(threadId, fn)`, a single-writer
+ * surface modeled on `CommitmentTracker.mutate()` — a per-threadId FIFO queue
+ * plus optimistic CAS on the record's `version`. This is the fix for the
+ * convergence-flagged race where two near-simultaneous inbound messages (or a
+ * live-inject racing a resume) would clobber `turnCount`/`lastOutboundHash` under
+ * the legacy last-writer-wins `load→mutate→persist`.
+ *
+ * Storage: {stateDir}/threadline/conversations.json (server-write-only, atomic
+ * tmp+rename). NOT relay-hosted — authoritative state stays local. The
+ * append-only SharedStateLedger remains the audit trail; this is the live
+ * mutable state it logs transitions from.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+// ── Constants ───────────────────────────────────────────────────
+/** Entries older than 7 days are pruned (non-pinned only) — matches legacy TTL. */
+const MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/** Resolved conversations get a 7-day grace before removal — matches legacy. */
+const RESOLVED_GRACE_MS = 7 * 24 * 60 * 60 * 1000;
+/** Cap before LRU eviction of non-pinned entries — matches ThreadResumeMap. */
+const MAX_ENTRIES = 1000;
+/** Max depth of the per-id mutate queue. Enqueue beyond this rejects. */
+const MUTATE_QUEUE_MAX_DEPTH = 256;
+/** Max CAS retries when the version drifts under an apply. */
+const MUTATE_CAS_MAX_RETRIES = 5;
+// ── Ephemeral verified-only peer-affinity (NOT persisted) ────────
+//
+// The legacy peer-affinity map is a SHORT (10-min sliding / 2-hr absolute),
+// verified-only, deliberately ephemeral hint — promoting it to a durable,
+// unverified binding would reopen a hijack vector (spec §1). We keep it in
+// memory on the store so it is lost on restart by design (accepted loss).
+const AFFINITY_SLIDING_MS = 10 * 60 * 1000;
+const AFFINITY_ABSOLUTE_MS = 2 * 60 * 60 * 1000;
+// ── Implementation ──────────────────────────────────────────────
+export class ConversationStore {
+    filePath;
+    store;
+    /** Per-threadId FIFO mutate queues — serialize concurrent writers. */
+    mutateQueues = new Map();
+    mutateRunning = new Set();
+    /** Ephemeral verified-only peer-affinity hints (peerFingerprint → hint). */
+    affinity = new Map();
+    constructor(stateDir) {
+        const threadlineDir = path.join(stateDir, 'threadline');
+        fs.mkdirSync(threadlineDir, { recursive: true });
+        this.filePath = path.join(threadlineDir, 'conversations.json');
+        this.store = this.loadStore();
+    }
+    // ── Reads (synchronous, from in-memory store) ──────────────────
+    /** Get a conversation by threadId. Returns null if missing or TTL-expired. */
+    get(threadId) {
+        const c = this.store.conversations[threadId];
+        if (!c)
+            return null;
+        if (!c.pinned && this.isExpired(c))
+            return null;
+        return c;
+    }
+    /** True if a (non-expired) conversation exists for the threadId. */
+    has(threadId) {
+        return this.get(threadId) !== null;
+    }
+    /** Find conversations whose peer set includes the given fingerprint/name. */
+    getByParticipant(participant) {
+        const out = [];
+        for (const c of Object.values(this.store.conversations)) {
+            if (c.pinned || !this.isExpired(c)) {
+                if (c.participants.peers.includes(participant) || c.remoteAgent === participant) {
+                    out.push(c);
+                }
+            }
+        }
+        return out;
+    }
+    /** Find the conversation bound to a Telegram topic, if any. */
+    getByTopicId(topicId) {
+        for (const c of Object.values(this.store.conversations)) {
+            if (c.boundTopicId === topicId && (c.pinned || !this.isExpired(c)))
+                return c;
+        }
+        return null;
+    }
+    /** Reverse lookup: conversation owning an A2A contextId (identity-bound). */
+    getByContextId(contextId, agentIdentity) {
+        for (const c of Object.values(this.store.conversations)) {
+            if (c.contextId === contextId && (c.pinned || !this.isExpired(c))) {
+                // Identity binding — prevents session smuggling (ContextThreadMap parity).
+                if (c.agentIdentity && c.agentIdentity !== agentIdentity)
+                    return null;
+                return c;
+            }
+        }
+        return null;
+    }
+    /** List active/idle conversations (not resolved/failed/archived). */
+    listActive() {
+        const out = [];
+        for (const c of Object.values(this.store.conversations)) {
+            if ((c.state === 'active' || c.state === 'idle' || c.state === 'open' || c.state === 'awaiting-reply') &&
+                (c.pinned || !this.isExpired(c))) {
+                out.push(c);
+            }
+        }
+        return out;
+    }
+    /** Total stored conversations (for monitoring). */
+    size() {
+        return Object.keys(this.store.conversations).length;
+    }
+    // ── Writes (single-writer CAS) ─────────────────────────────────
+    /**
+     * Single-writer mutate surface. Every write path routes through here so
+     * concurrent writers (the inbound funnel gate, the router resume/spawn, the
+     * relay-send binding stamp) can't clobber each other.
+     *
+     * Contract (mirrors CommitmentTracker.mutate):
+     *  - FIFO queue per threadId, max depth 256.
+     *  - Optimistic CAS on `version`: read → fn(clone) → write iff version
+     *    unchanged, else retry (max 5). On success version is incremented and
+     *    the store is persisted atomically.
+     *  - If the conversation does not exist yet, the fn receives a fresh skeleton
+     *    (state 'open', version 0) so callers can upsert in one call.
+     */
+    async mutate(threadId, fn) {
+        return new Promise((resolve, reject) => {
+            let queue = this.mutateQueues.get(threadId);
+            if (!queue) {
+                queue = [];
+                this.mutateQueues.set(threadId, queue);
+            }
+            if (queue.length >= MUTATE_QUEUE_MAX_DEPTH) {
+                reject(new Error(`ConversationStore.mutate: queue full for ${threadId} (depth ${queue.length} >= ${MUTATE_QUEUE_MAX_DEPTH})`));
+                return;
+            }
+            queue.push({ fn, resolve, reject });
+            void this.drainMutateQueue(threadId);
+        });
+    }
+    async drainMutateQueue(threadId) {
+        if (this.mutateRunning.has(threadId))
+            return;
+        this.mutateRunning.add(threadId);
+        try {
+            const queue = this.mutateQueues.get(threadId);
+            while (queue && queue.length > 0) {
+                const entry = queue.shift();
+                try {
+                    const result = await this.applyMutationWithCAS(threadId, entry.fn);
+                    entry.resolve(result);
+                }
+                catch (err) {
+                    entry.reject(err instanceof Error ? err : new Error(String(err)));
+                }
+            }
+            if (queue && queue.length === 0)
+                this.mutateQueues.delete(threadId);
+        }
+        finally {
+            this.mutateRunning.delete(threadId);
+        }
+    }
+    async applyMutationWithCAS(threadId, fn) {
+        let attempt = 0;
+        while (attempt <= MUTATE_CAS_MAX_RETRIES) {
+            const current = this.store.conversations[threadId] ?? this.skeleton(threadId);
+            const observedVersion = current.version ?? 0;
+            const draft = { ...current, participants: { ...current.participants, peers: [...current.participants.peers] } };
+            const next = await fn(draft);
+            // CAS: the record's version must not have drifted underneath us.
+            const latest = this.store.conversations[threadId];
+            const latestVersion = latest?.version ?? (latest ? 0 : observedVersion);
+            if (latest && latestVersion !== observedVersion) {
+                attempt++;
+                continue;
+            }
+            const committed = {
+                ...next,
+                threadId,
+                version: observedVersion + 1,
+                savedAt: new Date().toISOString(),
+            };
+            this.store.conversations[threadId] = committed;
+            this.pruneIfNeeded();
+            this.saveStore();
+            return committed;
+        }
+        throw new Error(`ConversationStore.mutate: CAS retry budget exhausted for ${threadId} after ${MUTATE_CAS_MAX_RETRIES} retries`);
+    }
+    /**
+     * Direct upsert of a full record WITHOUT going through the CAS queue. ONLY
+     * for migration / bulk import where there are no concurrent writers. Runtime
+     * writers MUST use mutate().
+     */
+    importDirect(conversation) {
+        const existing = this.store.conversations[conversation.threadId];
+        this.store.conversations[conversation.threadId] = {
+            ...conversation,
+            version: existing ? Math.max(existing.version ?? 0, conversation.version ?? 0) : (conversation.version ?? 0),
+            savedAt: new Date().toISOString(),
+        };
+    }
+    /** Persist after a batch of importDirect calls. */
+    flush() {
+        this.saveStore();
+    }
+    /** Remove a conversation. */
+    remove(threadId) {
+        if (this.store.conversations[threadId]) {
+            delete this.store.conversations[threadId];
+            this.saveStore();
+        }
+    }
+    // ── Ephemeral verified-only peer affinity (in-memory, non-durable) ──
+    /**
+     * Record a short-lived, verified-only affinity hint (peer → most-recent
+     * thread). Deliberately NOT persisted (accepted loss on restart). Callers
+     * MUST only call this for VERIFIED peers — an unverified affinity would be a
+     * hijack vector.
+     */
+    recordAffinity(peerFingerprint, threadId) {
+        const now = Date.now();
+        const existing = this.affinity.get(peerFingerprint);
+        if (existing && existing.threadId === threadId) {
+            existing.lastSeen = now;
+        }
+        else {
+            this.affinity.set(peerFingerprint, { threadId, firstSeen: now, lastSeen: now });
+        }
+    }
+    /** Look up a fresh affinity hint, honoring the sliding + absolute windows. */
+    getAffinity(peerFingerprint) {
+        const hint = this.affinity.get(peerFingerprint);
+        if (!hint)
+            return null;
+        const now = Date.now();
+        if (now - hint.lastSeen > AFFINITY_SLIDING_MS || now - hint.firstSeen > AFFINITY_ABSOLUTE_MS) {
+            this.affinity.delete(peerFingerprint);
+            return null;
+        }
+        return hint.threadId;
+    }
+    // ── Maintenance ────────────────────────────────────────────────
+    /** Prune expired + resolved-past-grace + LRU-overflow (non-pinned). */
+    prune() {
+        this.pruneMap();
+        this.saveStore();
+    }
+    // ── Private helpers ────────────────────────────────────────────
+    skeleton(threadId) {
+        const now = new Date().toISOString();
+        return {
+            threadId,
+            version: 0,
+            participants: { peers: [] },
+            state: 'open',
+            pinned: false,
+            messageCount: 0,
+            turnCount: 0,
+            createdAt: now,
+            savedAt: now,
+            lastActivityAt: now,
+        };
+    }
+    isExpired(c) {
+        const now = Date.now();
+        if (c.state === 'resolved' && c.resolvedAt) {
+            return now - new Date(c.resolvedAt).getTime() > RESOLVED_GRACE_MS;
+        }
+        const ref = c.lastActivityAt || c.savedAt;
+        return now - new Date(ref).getTime() > MAX_AGE_MS;
+    }
+    pruneIfNeeded() {
+        if (Object.keys(this.store.conversations).length > MAX_ENTRIES)
+            this.pruneMap();
+    }
+    pruneMap() {
+        const map = this.store.conversations;
+        // Phase 1: drop expired / resolved-past-grace (non-pinned).
+        for (const key of Object.keys(map)) {
+            const c = map[key];
+            if (c.pinned)
+                continue;
+            if (this.isExpired(c))
+                delete map[key];
+        }
+        // Phase 2: LRU eviction if still over cap.
+        const keys = Object.keys(map);
+        if (keys.length <= MAX_ENTRIES)
+            return;
+        const unpinned = [];
+        for (const key of keys) {
+            const c = map[key];
+            if (c.pinned)
+                continue;
+            unpinned.push({ key, t: new Date(c.lastActivityAt || c.savedAt).getTime() });
+        }
+        unpinned.sort((a, b) => a.t - b.t);
+        const toEvict = keys.length - MAX_ENTRIES;
+        for (let i = 0; i < toEvict && i < unpinned.length; i++) {
+            delete map[unpinned[i].key];
+        }
+    }
+    loadStore() {
+        try {
+            if (fs.existsSync(this.filePath)) {
+                const data = JSON.parse(fs.readFileSync(this.filePath, 'utf-8'));
+                if (data && data.version === 1 && data.conversations && typeof data.conversations === 'object') {
+                    return data;
+                }
+            }
+        }
+        catch {
+            // Corrupted — start fresh.
+        }
+        return { version: 1, conversations: {}, lastModified: new Date().toISOString() };
+    }
+    saveStore() {
+        this.store.lastModified = new Date().toISOString();
+        try {
+            const dir = path.dirname(this.filePath);
+            fs.mkdirSync(dir, { recursive: true });
+            const tmpPath = `${this.filePath}.${process.pid}.tmp`;
+            fs.writeFileSync(tmpPath, JSON.stringify(this.store, null, 2) + '\n');
+            fs.renameSync(tmpPath, this.filePath);
+        }
+        catch {
+            // @silent-fallback-ok — state persistence failure, retried on next write.
+        }
+    }
+}
+//# sourceMappingURL=ConversationStore.js.map

package/dist/threadline/ConversationStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConversationStore.js","sourceRoot":"","sources":["../../src/threadline/ConversationStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAsG7B,mEAAmE;AAEnE,mFAAmF;AACnF,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,+EAA+E;AAC/E,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB,yEAAyE;AACzE,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,8DAA8D;AAC9D,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBhD,mEAAmE;AAEnE,MAAM,OAAO,iBAAiB;IACpB,QAAQ,CAAS;IACjB,KAAK,CAAwB;IAErC,sEAAsE;IAC9D,YAAY,GAAoC,IAAI,GAAG,EAAE,CAAC;IAC1D,aAAa,GAAgB,IAAI,GAAG,EAAE,CAAC;IAE/C,4EAA4E;IACpE,QAAQ,GAA8B,IAAI,GAAG,EAAE,CAAC;IAExD,YAAY,QAAgB;QAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxD,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,kEAAkE;IAElE,8EAA8E;IAC9E,GAAG,CAAC,QAAgB;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,oEAAoE;IACpE,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;IACrC,CAAC;IAED,6EAA6E;IAC7E,gBAAgB,CAAC,WAAmB;QAClC,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+DAA+D;IAC/D,YAAY,CAAC,OAAe;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,cAAc,CAAC,SAAiB,EAAE,aAAqB;QACrD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,2EAA2E;gBAC3E,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBACtE,OAAO,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,UAAU;QACR,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC;gBAClG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mDAAmD;IACnD,IAAI;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;IAED,kEAAkE;IAElE;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,EAAwB;QACrD,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,KAAK,CACd,4CAA4C,QAAQ,WAAW,KAAK,CAAC,MAAM,OAAO,sBAAsB,GAAG,CAC5G,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACpC,KAAK,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;oBACnE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACxB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,KAAK,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YACD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,EAAwB;QAC3E,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,IAAI,sBAAsB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9E,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YAE7C,MAAM,KAAK,GAAiB,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YAC9H,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YAE7B,iEAAiE;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,MAAM,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;gBAChD,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAiB;gBAC9B,GAAG,IAAI;gBACP,QAAQ;gBACR,OAAO,EAAE,eAAe,GAAG,CAAC;gBAC5B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;YAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4DAA4D,QAAQ,UAAU,sBAAsB,UAAU,CAC/G,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,YAA0B;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG;YAChD,GAAG,YAAY;YACf,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;YAC5G,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,KAAK;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED,6BAA6B;IAC7B,MAAM,CAAC,QAAgB;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,uEAAuE;IAEvE;;;;;OAKG;IACH,cAAc,CAAC,eAAuB,EAAE,QAAgB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/C,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,WAAW,CAAC,eAAuB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,mBAAmB,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,oBAAoB,EAAE,CAAC;YAC7F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,kEAAkE;IAElE,uEAAuE;IACvE,KAAK;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED,kEAAkE;IAE1D,QAAQ,CAAC,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC3B,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,KAAK;YACb,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,GAAG;YACZ,cAAc,EAAE,GAAG;SACpB,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,CAAe;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC;QACpE,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC;QAC1C,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC;IACpD,CAAC;IAEO,aAAa;QACnB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,WAAW;YAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClF,CAAC;IAEO,QAAQ;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;QACrC,4DAA4D;QAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC,CAAC,MAAM;gBAAE,SAAS;YACvB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,2CAA2C;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO;QACvC,MAAM,QAAQ,GAAsC,EAAE,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC,CAAC,MAAM;gBAAE,SAAS;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;QAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACjE,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;oBAC/F,OAAO,IAA6B,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACnF,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACtD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;CACF"}

package/dist/threadline/ThreadlineRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThreadlineRouter.d.ts","sourceRoot":"","sources":["../../src/threadline/ThreadlineRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,qCAAqC,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAkC,MAAM,sBAAsB,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAM9D,6CAA6C;AAC7C,MAAM,WAAW,sBAAsB;IACrC,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,kBAAkB,CAAC;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhC,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,KAAK,EAAE,eAAe,CAAC;IACvB,qHAAqH;IACrH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,UAAU,EAAE,eAAe,CAAC;IAC5B,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;4CAEwC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAyBD,UAAU,qBAAqB;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAoBD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD;;sEAEkE;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAE1D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgD;IAE9E;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB,CAAuE;IAElG,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IAEnD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAC/E,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAGnC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,mBAAmB,EACjC,eAAe,EAAE,eAAe,EAChC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,cAAc,CAAC,EACrG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,EAClC,eAAe,CAAC,EAAE,gBAAgB,GAAG,IAAI,EACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,IAAI,EACpD,KAAK,CAAC,EAAE,MAAM,MAAM;IAgBtB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IA6BtB;;;OAGG;IACH,2BAA2B,IAAI,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAIzE;;;;OAIG;IACH,sBAAsB,CACpB,OAAO,EAAE,OAAO,0BAA0B,EAAE,mBAAmB,GAAG,IAAI,GACrE,IAAI;IAIP,kEAAkE;IAClE,OAAO,CAAC,UAAU;IAKlB;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,GAAE,MAA4B,GAAG,MAAM;IAyBlE;;;;;;;OAOG;IACG,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAmI1H;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAcvE;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAexC;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;YAaxB,YAAY;YAwEZ,cAAc;IAwF5B;;;;;OAKG;YACW,wBAAwB;YAsCxB,mBAAmB;IA6BjC,OAAO,CAAC,WAAW;CAwCpB"}
+{"version":3,"file":"ThreadlineRouter.d.ts","sourceRoot":"","sources":["../../src/threadline/ThreadlineRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,qCAAqC,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAkC,MAAM,sBAAsB,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAM9D,6CAA6C;AAC7C,MAAM,WAAW,sBAAsB;IACrC,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,kBAAkB,CAAC;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhC,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,KAAK,EAAE,eAAe,CAAC;IACvB,qHAAqH;IACrH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,UAAU,EAAE,eAAe,CAAC;IAC5B,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;4CAEwC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAyBD,UAAU,qBAAqB;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAoBD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD;;sEAEkE;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0B;IAE1D,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgD;IAE9E;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB,CAAuE;IAElG,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IAEnD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4C;IAC/E,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAGnC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,mBAAmB,EACjC,eAAe,EAAE,eAAe,EAChC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,cAAc,CAAC,EACrG,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,EAClC,eAAe,CAAC,EAAE,gBAAgB,GAAG,IAAI,EACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,IAAI,EACpD,KAAK,CAAC,EAAE,MAAM,MAAM;IAgBtB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IA6BtB;;;OAGG;IACH,2BAA2B,IAAI,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAIzE;;;;OAIG;IACH,sBAAsB,CACpB,OAAO,EAAE,OAAO,0BAA0B,EAAE,mBAAmB,GAAG,IAAI,GACrE,IAAI;IAIP,kEAAkE;IAClE,OAAO,CAAC,UAAU;IAKlB;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,GAAE,MAA4B,GAAG,MAAM;IAyBlE;;;;;;;OAOG;IACG,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA8J1H;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAcvE;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAexC;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;YAaxB,YAAY;YAwEZ,cAAc;IAwF5B;;;;;OAKG;YACW,wBAAwB;YAsCxB,mBAAmB;IA6BjC,OAAO,CAAC,WAAW;CAwCpB"}

package/dist/threadline/ThreadlineRouter.js

@@ -246,6 +246,30 @@ export class ThreadlineRouter {
                 message.threadId = mintedThreadId;
             }
         }
+        // SECURITY (KEYSTONE §2 / acceptance #8): a threadId is NOT a bearer token.
+        // If an UNVERIFIED peer presents a threadId that already resolves to a
+        // conversation owned by a DIFFERENT participant, it must NOT be resumed into
+        // / routed to that owner session — that is the hijack surface
+        // ContextThreadMap.agentIdentity defends. Crypto-verified peers are exempt
+        // (identity is already established); for unverified peers the inbound
+        // identity must match the thread's known participant, else we isolate the
+        // sender to a fresh first-contact thread and the victim's conversation is
+        // left untouched.
+        {
+            const presented = this.threadResumeMap.get(message.threadId);
+            if (presented) {
+                const cryptoVerified = relayContext?.trust.kind === 'verified';
+                const inboundFp = relayContext?.senderFingerprint || message.from.agent || '';
+                const inboundName = relayContext?.senderName || '';
+                const peer = presented.remoteAgent || '';
+                const identityMatches = !!peer && (peer === inboundFp || peer === inboundName);
+                if (!cryptoVerified && !identityMatches) {
+                    const freshId = crypto.randomUUID();
+                    console.warn(`[ThreadlineRouter] Anti-hijack: unverified sender ${inboundName || inboundFp || 'unknown'} presented threadId ${message.threadId.slice(0, 8)} owned by ${peer.slice(0, 16)}; isolating to fresh thread ${freshId.slice(0, 8)}`);
+                    message.threadId = freshId;
+                }
+            }
+        }
         const threadId = message.threadId;
         // Record affinity (no-op for non-verified trust kinds).
         this.recordAffinity(relayContext, threadId);