instar 1.3.1649 → 1.3.1650

package/dist/providers/adapters/anthropic-headless/transport/oneShotCompletion.js

@@ -7,6 +7,7 @@
  * collapse the two paths once the adapter is wired into the rest of
  * Instar's source.
  */
+import { applyClaudeChildAuth, configuredClaudeOauthKey } from '../../../../core/claudeChildAuth.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { CapabilityFlag } from '../../../capabilities.js';
@@ -45,8 +46,10 @@ class AnthropicHeadlessOneShotCompletion {
         const childEnv = { ...process.env };
         delete childEnv['CLAUDECODE'];
         delete childEnv['CLAUDE_SESSION_ID'];
-        // Inject auth credential if configured
-        if (this.config.credential) {
+        // Inject auth credential if configured. The agent's configured key wins over one read from the
+        // server's env, matching session launch (spec cloud-key-internal-calls).
+        applyClaudeChildAuth(childEnv);
+        if (this.config.credential && !configuredClaudeOauthKey()) {
             if (this.config.credential.startsWith('sk-ant-oat')) {
                 childEnv['CLAUDE_CODE_OAUTH_TOKEN'] = this.config.credential;
                 delete childEnv['ANTHROPIC_API_KEY'];

package/dist/providers/adapters/anthropic-headless/transport/oneShotCompletion.js.map

@@ -1 +1 @@
-{"version":3,"file":"oneShotCompletion.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/anthropic-headless/transport/oneShotCompletion.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAA0B,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAMtC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,kCAAkC;IAGT,MAAM;IAF1B,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEvD,YAA6B,MAA+B;sBAA/B,MAAM;IAA4B,CAAC;IAEhE,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,OAAkC;QAElC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC;QAEtF,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,MAAM;YACN,SAAS;YACT,KAAK;YACL,aAAa;YACb,GAAG;YACH,iBAAiB;YACjB,MAAM;YACN,gEAAgE;YAChE,mBAAmB;YACnB,MAAM;SACP,CAAC;QAEF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,gEAAgE;YAChE,qDAAqD;QACvD,CAAC;QAED,oEAAoE;QACpE,yBAAyB;QACzB,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAErC,uCAAuC;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,yBAAyB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC7D,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvD,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,EAAE,MAAM,CAAC;QACpC,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE;gBACnE,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO;gBAC/B,GAAG,EAAE,QAAQ;gBACb,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;gBACnB,KAAK,EAAE,IAAI;gBACX,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;aACzD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAwB,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACxD,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,YAAY,CAAC,KAAwG,EAAE,MAAM,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA+B;IAE/B,OAAO,IAAI,kCAAkC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"oneShotCompletion.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/anthropic-headless/transport/oneShotCompletion.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACrG,OAAO,EAAE,QAAQ,EAA0B,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAMtC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,kCAAkC;IAGT,MAAM;IAF1B,UAAU,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEvD,YAA6B,MAA+B;sBAA/B,MAAM;IAA4B,CAAC;IAEhE,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,OAAkC;QAElC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC;QAEtF,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,MAAM;YACN,SAAS;YACT,KAAK;YACL,aAAa;YACb,GAAG;YACH,iBAAiB;YACjB,MAAM;YACN,gEAAgE;YAChE,mBAAmB;YACnB,MAAM;SACP,CAAC;QAEF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACrC,gEAAgE;YAChE,qDAAqD;QACvD,CAAC;QAED,oEAAoE;QACpE,yBAAyB;QACzB,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAErC,+FAA+F;QAC/F,yEAAyE;QACzE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,yBAAyB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC7D,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBACvD,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,QAAQ,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACxD,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,EAAE,MAAM,CAAC;QACpC,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE;gBACnE,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO;gBAC/B,GAAG,EAAE,QAAQ;gBACb,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;gBACnB,KAAK,EAAE,IAAI;gBACX,gBAAgB,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;aACzD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAwB,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACxD,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACpE,MAAM,YAAY,CAAC,KAAwG,EAAE,MAAM,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA+B;IAE/B,OAAO,IAAI,kCAAkC,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC"}

package/dist/recommended/RecommendedServicesLedger.d.ts

@@ -0,0 +1,91 @@
+import { type MachineKeyLookup, type MachineSigner } from '../core/AppRecordSignatures.js';
+export declare const NO_REASONS: readonly ['cost', 'privacy', 'not-needed', 'have-another', 'other', 'none'];
+export type NoReason = (typeof NO_REASONS)[number];
+export declare const CHOICE_ORIGINS: readonly ['first-offer', 'change', 'cool-off', 'person-asked', 'owner-surface'];
+export type ChoiceOrigin = (typeof CHOICE_ORIGINS)[number] | `event:${string}`;
+interface RowSignature {
+    machineId: string;
+    signerKeyHash: string;
+    sig: string;
+}
+export interface ChoiceRow extends RowSignature {
+    type: 'choice';
+    eventId: string;
+    service: string;
+    choice: 'yes' | 'no';
+    shutdown: 'none' | 'authorized';
+    reason: NoReason;
+    origin: ChoiceOrigin;
+    offerTextHash: string;
+    supersedes: string[];
+    at: string;
+}
+export interface LegacyImportRow extends RowSignature {
+    type: 'legacy-import';
+    eventId: string;
+    service: string;
+    at: string;
+}
+export type LedgerRow = ChoiceRow | LegacyImportRow;
+export interface EffectiveChoice {
+    service: string;
+    choice: 'unset' | 'yes' | 'no';
+    origin: ChoiceOrigin | null;
+    /** A no refuses offers. Only an authorized shutdown stops a running service. */
+    shutdown: 'none' | 'authorized';
+    reason: NoReason | null;
+    /** An imported legacy decline: suppresses offers, grants and stops nothing. */
+    legacyDeclined: boolean;
+    at: string | null;
+}
+/** Validate a row's shape, not its signature. Exact fields only. */
+export declare function validateRow(raw: unknown): LedgerRow | null;
+/** One effective choice per service. A pure fold, so every machine reaches the same answer. */
+export declare function foldChoice(service: string, rows: readonly LedgerRow[]): EffectiveChoice;
+export declare function recommendedServicesDir(stateDir: string): string;
+export type IngestResult = 'added' | 'duplicate' | 'invalid' | 'bad-signature' | 'unverifiable' | 'full';
+export interface RecommendedServicesLedgerOptions {
+    stateDir: string;
+    signer: MachineSigner;
+    keyLookup: MachineKeyLookup;
+    now?: () => Date;
+}
+export declare class RecommendedServicesLedger {
+    private readonly opts;
+    private readonly file;
+    private readonly rows;
+    private hook;
+    private replicating;
+    constructor(opts: RecommendedServicesLedgerOptions);
+    setReplicationHook(hook: (row: LedgerRow) => void): void;
+    /** Set by the server from the store's real state: its emission is on, and peers pull. */
+    setReplicating(on: boolean): void;
+    /** False when choices stay on this machine. */
+    isReplicating(): boolean;
+    all(): LedgerRow[];
+    effective(service: string): EffectiveChoice;
+    /** The person's no. Sticky until a confirmed yes names it. */
+    recordNo(input: {
+        service: string;
+        shutdown: 'none' | 'authorized';
+        reason: NoReason;
+        origin: ChoiceOrigin;
+        offerTextHash?: string;
+    }): ChoiceRow;
+    /** A confirmed yes replaces every no standing at this moment, and only those. */
+    recordYes(input: {
+        service: string;
+        origin: ChoiceOrigin;
+        offerTextHash: string;
+    }): ChoiceRow;
+    /** Idempotent per service: one import row is enough, whichever machine wrote it. */
+    recordLegacyImport(service: string): LegacyImportRow | null;
+    /** A peer's row lands only when it verifies under the pinned key of the machine it names. */
+    ingestReplicated(raw: unknown): IngestResult;
+    private appendChoice;
+    private signAndStore;
+    private store;
+    private at;
+}
+export {};
+//# sourceMappingURL=RecommendedServicesLedger.d.ts.map

package/dist/recommended/RecommendedServicesLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesLedger.d.ts","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesLedger.ts"],"names":[],"mappings":"AAaA,OAAO,EAEL,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAC1C,MAAM,gCAAgC,CAAC;AAExC,eAAO,MAAM,UAAU,YAAI,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AACtG,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,eAAO,MAAM,cAAc,YAAI,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAC9G,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;AAE/E,UAAU,YAAY;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAEhF,MAAM,WAAW,SAAU,SAAQ,YAAY;IAC7C,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;IAChC,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;IAChC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAeD,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAwB1D;AAED,+FAA+F;AAC/F,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,eAAe,CAgBvF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,MAAM,CAAC;AAEzG,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,yBAAyB;IAMxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,IAAI,CAA2C;IACvD,OAAO,CAAC,WAAW,CAAS;IAE5B,YAA6B,IAAI,EAAE,gCAAgC,EAQlE;IAED,kBAAkB,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,CAEvD;IAED,yFAAyF;IACzF,cAAc,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAEhC;IAED,+CAA+C;IAC/C,aAAa,IAAI,OAAO,CAEvB;IAED,GAAG,IAAI,SAAS,EAAE,CAEjB;IAED,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAE1C;IAED,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC;QAAC,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAE/I;IAED,iFAAiF;IACjF,SAAS,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAM5F;IAED,oFAAoF;IACpF,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAG1D;IAED,6FAA6F;IAC7F,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAgB3C;IAED,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,EAAE;CAGX"}

package/dist/recommended/RecommendedServicesLedger.js

@@ -0,0 +1,193 @@
+/**
+ * The record of a person's choices about recommended outside services
+ * (docs/specs/recommended-services.md).
+ *
+ * Append-only and signed per row by the writing machine's identity key, because auth tokens
+ * differ between machines. Rows replicate as the `recommendedServices` store and fold into one
+ * effective choice: a no stands until a yes names it in `supersedes`, so delayed replication
+ * and clock skew cannot undo a refusal. Imported legacy declines only suppress offers. They
+ * never count in the merge and never stop a running service.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { ledgerRowPayload, readJsonlLines, verifyMachineSignature, } from '../core/AppRecordSignatures.js';
+export const NO_REASONS = ['cost', 'privacy', 'not-needed', 'have-another', 'other', 'none'];
+export const CHOICE_ORIGINS = ['first-offer', 'change', 'cool-off', 'person-asked', 'owner-surface'];
+const SERVICE_RE = /^[a-z][a-z0-9-]{0,63}$/;
+const ID_RE = /^[0-9a-f]{32}$/;
+const ORIGIN_RE = /^event:[a-z][a-z0-9-]{0,63}$/;
+const MAX_ROWS = 10_000;
+function signature(r) {
+    const { machineId, signerKeyHash, sig } = r;
+    if (typeof machineId !== 'string' || !machineId || machineId.length > 128)
+        return null;
+    if (typeof signerKeyHash !== 'string' || !signerKeyHash || signerKeyHash.length > 128)
+        return null;
+    if (typeof sig !== 'string' || !sig || sig.length > 512)
+        return null;
+    return { machineId, signerKeyHash, sig };
+}
+/** Validate a row's shape, not its signature. Exact fields only. */
+export function validateRow(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    const s = signature(r);
+    if (!s)
+        return null;
+    const { eventId, service, at } = r;
+    if (typeof eventId !== 'string' || !ID_RE.test(eventId))
+        return null;
+    if (typeof service !== 'string' || !SERVICE_RE.test(service))
+        return null;
+    if (typeof at !== 'string' || !Number.isFinite(Date.parse(at)))
+        return null;
+    if (r.type === 'legacy-import')
+        return { type: 'legacy-import', eventId, service, at, ...s };
+    if (r.type !== 'choice')
+        return null;
+    const { choice, shutdown, reason, origin, offerTextHash, supersedes } = r;
+    if (choice !== 'yes' && choice !== 'no')
+        return null;
+    if (shutdown !== 'none' && shutdown !== 'authorized')
+        return null;
+    if (!NO_REASONS.includes(reason))
+        return null;
+    if (typeof origin !== 'string')
+        return null;
+    if (!CHOICE_ORIGINS.includes(origin) && !ORIGIN_RE.test(origin))
+        return null;
+    if (typeof offerTextHash !== 'string' || offerTextHash.length > 128)
+        return null;
+    if (!Array.isArray(supersedes) || supersedes.length > 256)
+        return null;
+    if (!supersedes.every((id) => typeof id === 'string' && ID_RE.test(id)))
+        return null;
+    return {
+        type: 'choice', eventId, service, choice, shutdown, reason: reason,
+        origin: origin, offerTextHash, supersedes: supersedes, at, ...s,
+    };
+}
+/** One effective choice per service. A pure fold, so every machine reaches the same answer. */
+export function foldChoice(service, rows) {
+    const own = rows.filter((r) => r.service === service);
+    const choices = own.filter((r) => r.type === 'choice');
+    const replaced = new Set(choices.filter((c) => c.choice === 'yes').flatMap((c) => c.supersedes));
+    const byNewest = (a, b) => (a.at === b.at ? (a.eventId < b.eventId ? 1 : -1) : a.at < b.at ? 1 : -1);
+    const liveNos = choices.filter((c) => c.choice === 'no' && !replaced.has(c.eventId)).sort(byNewest);
+    const yeses = choices.filter((c) => c.choice === 'yes').sort(byNewest);
+    const legacyDeclined = own.some((r) => r.type === 'legacy-import');
+    const winner = liveNos[0] ?? yeses[0];
+    if (!winner)
+        return { service, choice: 'unset', origin: null, shutdown: 'none', reason: null, legacyDeclined, at: null };
+    const shutdown = liveNos.some((n) => n.shutdown === 'authorized') ? 'authorized' : 'none';
+    return {
+        service, choice: winner.choice, origin: winner.origin,
+        shutdown: winner.choice === 'no' ? shutdown : 'none',
+        reason: winner.choice === 'no' ? winner.reason : null, legacyDeclined, at: winner.at,
+    };
+}
+export function recommendedServicesDir(stateDir) {
+    return path.join(stateDir, 'state', 'recommended-services');
+}
+export class RecommendedServicesLedger {
+    opts;
+    file;
+    rows = new Map();
+    hook = null;
+    replicating = false;
+    constructor(opts) {
+        this.opts = opts;
+        this.file = path.join(recommendedServicesDir(opts.stateDir), 'ledger.jsonl');
+        for (const line of readJsonlLines(this.file)) {
+            try {
+                const row = validateRow(JSON.parse(line));
+                if (row)
+                    this.rows.set(row.eventId, row);
+            }
+            catch { /* @silent-fallback-ok — one torn line; the row is re-read from peer streams at boot */ }
+        }
+    }
+    setReplicationHook(hook) {
+        this.hook = hook;
+    }
+    /** Set by the server from the store's real state: its emission is on, and peers pull. */
+    setReplicating(on) {
+        this.replicating = on;
+    }
+    /** False when choices stay on this machine. */
+    isReplicating() {
+        return this.replicating;
+    }
+    all() {
+        return [...this.rows.values()];
+    }
+    effective(service) {
+        return foldChoice(service, this.all());
+    }
+    /** The person's no. Sticky until a confirmed yes names it. */
+    recordNo(input) {
+        return this.appendChoice({ ...input, choice: 'no', supersedes: [] });
+    }
+    /** A confirmed yes replaces every no standing at this moment, and only those. */
+    recordYes(input) {
+        const replaced = new Set(this.all().flatMap((r) => (r.type === 'choice' && r.choice === 'yes' ? r.supersedes : [])));
+        const supersedes = this.all()
+            .filter((r) => r.type === 'choice' && r.service === input.service && r.choice === 'no' && !replaced.has(r.eventId))
+            .map((r) => r.eventId);
+        return this.appendChoice({ ...input, choice: 'yes', shutdown: 'none', reason: 'none', supersedes });
+    }
+    /** Idempotent per service: one import row is enough, whichever machine wrote it. */
+    recordLegacyImport(service) {
+        if (this.all().some((r) => r.type === 'legacy-import' && r.service === service))
+            return null;
+        return this.signAndStore({ type: 'legacy-import', eventId: newId(), service, at: this.at() });
+    }
+    /** A peer's row lands only when it verifies under the pinned key of the machine it names. */
+    ingestReplicated(raw) {
+        const row = validateRow(raw);
+        if (!row)
+            return 'invalid';
+        if (this.rows.has(row.eventId))
+            return 'duplicate';
+        if (this.rows.size >= MAX_ROWS)
+            return 'full';
+        const { sig, ...unsigned } = row;
+        const verdict = verifyMachineSignature(this.opts.keyLookup, { machineId: row.machineId, signerKeyHash: row.signerKeyHash, sig }, ledgerRowPayload(unsigned), Date.parse(row.at));
+        if (verdict === 'bad')
+            return 'bad-signature';
+        if (verdict !== 'ok')
+            return 'unverifiable';
+        this.store(row);
+        return 'added';
+    }
+    appendChoice(input) {
+        return this.signAndStore({
+            type: 'choice', eventId: newId(), service: input.service, choice: input.choice, shutdown: input.shutdown,
+            reason: input.reason, origin: input.origin, offerTextHash: input.offerTextHash ?? '', supersedes: input.supersedes, at: this.at(),
+        });
+    }
+    signAndStore(fields) {
+        const unsigned = { ...fields, machineId: this.opts.signer.machineId(), signerKeyHash: this.opts.signer.signerKeyHash() };
+        const { sig } = this.opts.signer.sign(ledgerRowPayload(unsigned));
+        const row = validateRow({ ...unsigned, sig });
+        if (!row)
+            throw new Error('recommended-services: refused to write a malformed row');
+        this.store(row);
+        this.hook?.(row);
+        return row;
+    }
+    store(row) {
+        fs.mkdirSync(path.dirname(this.file), { recursive: true });
+        fs.appendFileSync(this.file, `${JSON.stringify(row)}\n`);
+        this.rows.set(row.eventId, row);
+    }
+    at() {
+        return (this.opts.now?.() ?? new Date()).toISOString();
+    }
+}
+function newId() {
+    return crypto.randomBytes(16).toString('hex');
+}
+//# sourceMappingURL=RecommendedServicesLedger.js.map

package/dist/recommended/RecommendedServicesLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesLedger.js","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,GAEzD,MAAM,gCAAgC,CAAC;AAExC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAEtG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAuC9G,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,SAAS,SAAS,CAAC,CAA0B;IAC3C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACvF,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACnG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7F,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpG,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAkB;QAC9E,MAAM,EAAE,MAAsB,EAAE,aAAa,EAAE,UAAU,EAAE,UAAsB,EAAE,EAAE,EAAE,GAAG,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAA0B;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAE,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,OAAO;QACL,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QACpD,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;AAC9D,CAAC;AAWD,MAAM,OAAO,yBAAyB;IAMP,IAAI;IALhB,IAAI,CAAS;IACb,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,IAAI,GAAsC,IAAI,CAAC;IAC/C,WAAW,GAAG,KAAK,CAAC;IAE5B,YAA6B,IAAsC;oBAAtC,IAAI;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,IAAI,GAAG;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC,CAAC,uFAAuF,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,IAA8B;QAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,yFAAyF;IACzF,cAAc,CAAC,EAAW;QACxB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,+CAA+C;IAC/C,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,OAAe;QACvB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,8DAA8D;IAC9D,QAAQ,CAAC,KAA2H;QAClI,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,SAAS,CAAC,KAAuE;QAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;aAClI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,oFAAoF;IACpF,kBAAkB,CAAC,OAAe;QAChC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAoB,CAAC;IACnH,CAAC;IAED,6FAA6F;IAC7F,gBAAgB,CAAC,GAAY;QAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,WAAW,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ;YAAE,OAAO,MAAM,CAAC;QAC9C,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC;QACjC,MAAM,OAAO,GAAG,sBAAsB,CACpC,IAAI,CAAC,IAAI,CAAC,SAAS,EACnB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,EACnE,gBAAgB,CAAC,QAAQ,CAAC,EAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CACnB,CAAC;QACF,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,eAAe,CAAC;QAC9C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,cAAc,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY,CAAC,KAAqH;QACxI,OAAO,IAAI,CAAC,YAAY,CAAC;YACvB,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxG,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;SAClI,CAAc,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,MAA+B;QAClD,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;QACzH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,GAAc;QAC1B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IAEO,EAAE;QACR,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,CAAC;CACF;AAED,SAAS,KAAK;IACZ,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/recommended/RecommendedServicesReplicatedStore.d.ts

@@ -0,0 +1,14 @@
+import type { StoreFieldSchema } from '../core/ReplicatedRecordEnvelope.js';
+import type { HlcTimestamp } from '../core/HybridLogicalClock.js';
+import { type LedgerRow } from './RecommendedServicesLedger.js';
+export declare const RECOMMENDED_SERVICE_RECORD_KIND = "recommended-service-record";
+export declare const RECOMMENDED_SERVICES_STORE_KEY = "recommendedServices";
+export declare function deriveRecommendedServiceRecordKey(eventId: string): string;
+export declare const recommendedServiceStoreSchema: StoreFieldSchema;
+export declare function buildRecommendedServiceRecordData(row: LedgerRow): (hlc: HlcTimestamp, origin: string, observed?: HlcTimestamp) => Record<string, unknown> | null;
+export declare const RECOMMENDED_SERVICES_KIND_REGISTRATION: {
+    readonly kind: "recommended-service-record";
+    readonly store: "recommendedServices";
+    readonly schema: StoreFieldSchema;
+};
+//# sourceMappingURL=RecommendedServicesReplicatedStore.d.ts.map

package/dist/recommended/RecommendedServicesReplicatedStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesReplicatedStore.d.ts","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesReplicatedStore.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,qCAAqC,CAAC;AAChH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE7E,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAC5E,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAIpE,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,eAAO,MAAM,6BAA6B,EAAE,gBAM3C,CAAC;AAEF,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,SAAS,SACjD,YAAY,UAAU,MAAM,aAAa,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMpG;AAED,eAAO,MAAM,sCAAsC;aACjD,IAAI;aACJ,KAAK;aACL,MAAM;CACE,CAAC"}

package/dist/recommended/RecommendedServicesReplicatedStore.js

@@ -0,0 +1,34 @@
+/**
+ * The `recommendedServices` replicated-store kind (docs/specs/recommended-services.md,
+ * Multi-machine posture). Rows are immutable and keyed by eventId, so the union has no
+ * conflicts. The ledger verifies each row's signature before it lands.
+ */
+import crypto from 'node:crypto';
+import { validateRow } from './RecommendedServicesLedger.js';
+export const RECOMMENDED_SERVICE_RECORD_KIND = 'recommended-service-record';
+export const RECOMMENDED_SERVICES_STORE_KEY = 'recommendedServices';
+const KNOWN = ['row'];
+export function deriveRecommendedServiceRecordKey(eventId) {
+    return crypto.createHash('sha256').update(`recommended-services\u0000${eventId}`).digest('hex');
+}
+export const recommendedServiceStoreSchema = {
+    knownFields: KNOWN,
+    validate(raw, _ctx) {
+        const row = validateRow(raw.row);
+        return row ? { row } : null;
+    },
+};
+export function buildRecommendedServiceRecordData(row) {
+    return (hlc, origin, observed) => ({
+        row,
+        recordKey: deriveRecommendedServiceRecordKey(row.eventId),
+        hlc, op: 'put', origin,
+        ...(observed !== undefined ? { observed } : {}),
+    });
+}
+export const RECOMMENDED_SERVICES_KIND_REGISTRATION = {
+    kind: RECOMMENDED_SERVICE_RECORD_KIND,
+    store: RECOMMENDED_SERVICES_STORE_KEY,
+    schema: recommendedServiceStoreSchema,
+};
+//# sourceMappingURL=RecommendedServicesReplicatedStore.js.map

package/dist/recommended/RecommendedServicesReplicatedStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecommendedServicesReplicatedStore.js","sourceRoot":"","sources":["../../src/recommended/RecommendedServicesReplicatedStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAkB,MAAM,gCAAgC,CAAC;AAE7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,qBAAqB,CAAC;AAEpE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAU,CAAC;AAE/B,MAAM,UAAU,iCAAiC,CAAC,OAAe;IAC/D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAqB;IAC7D,WAAW,EAAE,KAAyC;IACtD,QAAQ,CAAC,GAAsC,EAAE,IAA0B;QACzE,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,iCAAiC,CAAC,GAAc;IAC9D,OAAO,CAAC,GAAiB,EAAE,MAAc,EAAE,QAAuB,EAAkC,EAAE,CAAC,CAAC;QACtG,GAAG;QACH,SAAS,EAAE,iCAAiC,CAAC,GAAG,CAAC,OAAO,CAAC;QACzD,GAAG,EAAE,EAAE,EAAE,KAAqB,EAAE,MAAM;QACtC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,8BAA8B;IACrC,MAAM,EAAE,6BAA6B;CAC7B,CAAC"}

package/dist/recommended/legacyDeclines.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Maps the two old features whose offers these services replace
+ * (docs/specs/recommended-services.md, Store and Offers). The old offer paths refuse these ids
+ * in every state, and a person's old decline carries over as an import.
+ */
+import type { RecommendedServicesLedger } from './RecommendedServicesLedger.js';
+export declare const LEGACY_FEATURE_TO_SERVICE: Readonly<Record<string, string>>;
+export declare function isRetiredLegacyOffer(featureId: string): boolean;
+/** Import old declines before any list is built. Safe to run at every boot. */
+export declare function importLegacyDeclines(ledger: RecommendedServicesLedger, stateOf: (featureId: string) => string | null): number;
+//# sourceMappingURL=legacyDeclines.d.ts.map

package/dist/recommended/legacyDeclines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyDeclines.d.ts","sourceRoot":"","sources":["../../src/recommended/legacyDeclines.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEhF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrE,CAAC;AAEH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,yBAAyB,EACjC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAC5C,MAAM,CAMR"}

package/dist/recommended/legacyDeclines.js

@@ -0,0 +1,17 @@
+export const LEGACY_FEATURE_TO_SERVICE = Object.freeze({
+    'cloudflare-tunnel': 'cloudflare-domain',
+    'git-backup': 'github-state-backup',
+});
+export function isRetiredLegacyOffer(featureId) {
+    return Object.prototype.hasOwnProperty.call(LEGACY_FEATURE_TO_SERVICE, featureId);
+}
+/** Import old declines before any list is built. Safe to run at every boot. */
+export function importLegacyDeclines(ledger, stateOf) {
+    let imported = 0;
+    for (const [featureId, service] of Object.entries(LEGACY_FEATURE_TO_SERVICE)) {
+        if (stateOf(featureId) === 'declined' && ledger.recordLegacyImport(service))
+            imported += 1;
+    }
+    return imported;
+}
+//# sourceMappingURL=legacyDeclines.js.map

package/dist/recommended/legacyDeclines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacyDeclines.js","sourceRoot":"","sources":["../../src/recommended/legacyDeclines.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,yBAAyB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACvF,mBAAmB,EAAE,mBAAmB;IACxC,YAAY,EAAE,qBAAqB;CACpC,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAClC,MAAiC,EACjC,OAA6C;IAE7C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,UAAU,IAAI,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAAE,QAAQ,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/recommended/serviceIds.d.ts

@@ -0,0 +1,3 @@
+/** The services a person can choose about (docs/specs/recommended-services.md, The catalog). */
+export declare const RECOMMENDED_SERVICE_IDS: readonly string[];
+//# sourceMappingURL=serviceIds.d.ts.map

package/dist/recommended/serviceIds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceIds.d.ts","sourceRoot":"","sources":["../../src/recommended/serviceIds.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGnD,CAAC"}

package/dist/recommended/serviceIds.js

@@ -0,0 +1,6 @@
+/** The services a person can choose about (docs/specs/recommended-services.md, The catalog). */
+export const RECOMMENDED_SERVICE_IDS = Object.freeze([
+    'tailscale', 'cloudflare-domain', 'telegram', 'jev', 'bitwarden',
+    'github-state-backup', 'second-ai-door', 'voice-transcription', 'email',
+]);
+//# sourceMappingURL=serviceIds.js.map

package/dist/recommended/serviceIds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceIds.js","sourceRoot":"","sources":["../../src/recommended/serviceIds.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,CAAC,MAAM,uBAAuB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACtE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW;IAChE,qBAAqB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,OAAO;CACxE,CAAC,CAAC"}

package/dist/scaffold/templates.d.ts

@@ -118,6 +118,8 @@ export declare const REROUTED_LOGIN_EXPIRED_MARKER = "A job session stuck at an
 /** Rerouted-job expired-login awareness bullet. Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export declare const REROUTED_LOGIN_EXPIRED_BULLET = "- **A job session stuck at an expired login is ended in minutes**: a scheduled job (or other one-shot) that runs as an interactive Claude session and lands under a login whose sign-in has expired shows `Login expired \u00B7 Please run /login` and can do nothing. The monitor now ends it about a minute after it first sees that screen (reason `rerouted-login-expired`, a `SessionManager.monitorTick.reroutedLoginExpired` degradation naming the login folder) instead of letting it hold a job slot for the full 8-hour lifetime; the job runs again on its next trigger. It also reports the sighting to the quota poller, which alone decides pool status: when that screen is Claude Code's own message line and the login's saved credential still reads, the account turns needs-reauth at once (cause `cli-login-expired-observed`) and the automatic sign-in repair starts; when the saved credential cannot be read, it takes two different sessions under that login showing the screen within an hour. If a user asks \"why did my scheduled jobs stop running?\" or \"why did a job end straight away?\" \u2014 check `GET /jobs` for a stale `nextScheduled`, then the server log for `stuck at an expired login`; the fix is signing that login in again.";
 /** Content-sniff marker for the interactive expired-login bullet (CMT-1008, Migration Parity). */
+export declare const CLAUDE_KEY_HEALTH_MARKER = "A rejected sign-in key is told and recovers";
+export declare const CLAUDE_KEY_HEALTH_BULLET = "- **A rejected sign-in key is told and recovers**: an agent signed in with one key (`sessions.credentials.anthropic`, the usual cloud install) passes that key to every Claude process on the server, including internal model calls. If Anthropic refuses the key twice, the operator gets one plain notice, each waiting person is told once, and `GET /health` (with the auth header) shows `claudeKey.status: dead`. The fix is a new key from `claude setup-token`, put in place with `instar set-claude-key` on the server (reads stdin or a hidden prompt, never an argument; never ask for the key in chat). Within a minute Instar checks it, and conversations stuck at the login screen restart by themselves and answer what they missed. A conversation that ended during the outage is not replayed. **When to use** (PROACTIVE): the user asks \"why did you stop replying?\" or \"why does health say the model is failing?\" \u2192 read `claudeKey` in `GET /health`. Off switches: `sessions.claudeKeyHealth.enabled: false` and `sessions.claudeChildAuth.enabled: false`.";
 export declare const INTERACTIVE_LOGIN_EXPIRED_MARKER = "A conversation stuck at an expired login moves to a signed-in account";
 /** Interactive expired-login awareness bullet (CMT-1008). Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export declare const INTERACTIVE_LOGIN_EXPIRED_BULLET = "- **A conversation stuck at an expired login moves to a signed-in account**: a Telegram/topic session placed on a pool login whose Claude sign-in has expired shows `Login expired \u00B7 Please run /login` (newer Claude Code: `Not logged in \u00B7 Run /login`) on every turn. About a minute after the monitor first sees that screen in the session's live tail it (1) marks that account needs-reauth (cause `cli-login-expired-observed`, so new sessions avoid it and the automatic sign-in repair can start) \u2014 even when the saved token still reads quota, because the CLI's own screen is the stronger evidence, and a later quota poll does not flip it back while the saved credential is unchanged (a sign-in repair, or you setting it active again, always wins); and (2) resumes the session on a signed-in account through the same swap as `POST /subscription-pool/swap` (conversation preserved; one attempt per session per 10 minutes, at most three; protected sessions are never moved). Only Claude Code's own message line counts: a stale mention scrolled up the screen, a message quoting the text, or a tool result such as `claude auth status` printing it never triggers it. If the login's saved credential cannot be read at all (e.g. a locked keychain), one screen is not enough and the session is not moved until the account is confirmed dead. Off switch for the swap only: `subscriptionPool.loginExpiredSwap.enabled: false` (read live). If a user asks \"why did my conversation suddenly switch accounts?\" or \"why is this account showing needs sign-in when its quota looks fine?\" \u2014 check the server log for `stuck at an expired login` and `[LoginExpiredRecovery]`; a failed swap also reports a `SessionManager.monitorTick.interactiveLoginExpired` degradation. The fix for the account itself is signing that login in again.";

package/dist/scaffold/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkBH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CAq8DR;AAED,uDAAuD;AACvD,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2UR;AAED;;oDAEoD;AACpD,eAAO,MAAM,0BAA0B,8EAAwE,CAAC;AAChH,eAAO,MAAM,0BAA0B,8KAA2H,CAAC;AAEnK;gEACgE;AAChE,eAAO,MAAM,2BAA2B,gCAA2B,CAAC;AACpE,eAAO,MAAM,2BAA2B,iKAAkK,CAAC;AAE3M;;8DAE8D;AAC9D,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;mFACmF;AACnF,eAAO,MAAM,sCAAsC,qEAAqE,CAAC;AAEzH;;;;;;;;GAQG;AACH,yGAAyG;AACzG,eAAO,MAAM,wBAAwB,gXAAoX,CAAC;AAE1Z,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAexD;AAED,4FAA4F;AAC5F,eAAO,MAAM,6BAA6B,mDAAmD,CAAC;AAE9F,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,kDAAkD,CAAC;AAE7F,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B,qqCAAkpC,CAAC;AAE7rC,eAAO,MAAM,4BAA4B,sCAAsC,CAAC;AAEhF,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,0rBAAmrB,CAAC;AAE7tB,sEAAsE;AACtE,eAAO,MAAM,cAAc,8CAA+C,CAAC;AAC3E,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,8CAA8C,CAAC;AAE7E,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AACxE,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,8tBAAkuB,CAAC;AAExwB;sDACsD;AACtD,eAAO,MAAM,cAAc,wvBAA0tB,CAAC;AAEtvB,eAAO,MAAM,qBAAqB,wDAAwD,CAAC;AAC3F,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAwkL,CAAC;AAE5nL,eAAO,MAAM,wBAAwB,kDAAkD,CAAC;AAExF;sDACsD;AACtD,eAAO,MAAM,wBAAwB,yhCAAshC,CAAC;AAE5jC,6FAA6F;AAC7F,eAAO,MAAM,sCAAsC,mFAAmF,CAAC;AACvI,oHAAoH;AACpH,eAAO,MAAM,uCAAuC,kUAAkU,CAAC;AACvX,eAAO,MAAM,oCAAoC,2aAA2a,CAAC;AAC7d,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,gEAAgE,CAAC;AAE3G,6GAA6G;AAC7G,eAAO,MAAM,6BAA6B,stCAA0zB,CAAC;AAEr2B,kGAAkG;AAClG,eAAO,MAAM,gCAAgC,0EAA0E,CAAC;AAExH,uHAAuH;AACvH,eAAO,MAAM,gCAAgC,2yDAAmwD,CAAC;AAEjzD;+EAC+E;AAC/E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,o4CAA+3C,CAAC;AAEn6C,eAAO,MAAM,6BAA6B,qvBAAquB,CAAC;AAEhxB;;+DAE+D;AAC/D,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,+EAA+E;AAC/E,eAAO,MAAM,gCAAgC,wFAAwF,CAAC;AAEtI;;+DAE+D;AAC/D,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,8FAA8F;AAC9F,eAAO,MAAM,2BAA2B,6HAA6H,CAAC;AACtK,uGAAuG;AACvG,eAAO,MAAM,6BAA6B,+DAA+D,CAAC;AAE1G;;;wBAGwB;AACxB,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAGD;;+DAE+D;AAC/D,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;2DAE2D;AAC3D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;+DAE+D;AAC/D,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoBH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CAy8DR;AAED,uDAAuD;AACvD,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2UR;AAED;;oDAEoD;AACpD,eAAO,MAAM,0BAA0B,8EAAwE,CAAC;AAChH,eAAO,MAAM,0BAA0B,8KAA2H,CAAC;AAEnK;gEACgE;AAChE,eAAO,MAAM,2BAA2B,gCAA2B,CAAC;AACpE,eAAO,MAAM,2BAA2B,iKAAkK,CAAC;AAE3M;;8DAE8D;AAC9D,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,mGAAmG;AACnG,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;mFACmF;AACnF,eAAO,MAAM,sCAAsC,qEAAqE,CAAC;AAEzH;;;;;;;;GAQG;AACH,yGAAyG;AACzG,eAAO,MAAM,wBAAwB,gXAAoX,CAAC;AAE1Z,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAexD;AAED,4FAA4F;AAC5F,eAAO,MAAM,6BAA6B,mDAAmD,CAAC;AAE9F,oFAAoF;AACpF,eAAO,MAAM,6BAA6B,kDAAkD,CAAC;AAE7F,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B,qqCAAkpC,CAAC;AAE7rC,eAAO,MAAM,4BAA4B,sCAAsC,CAAC;AAEhF,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,0rBAAmrB,CAAC;AAE7tB,sEAAsE;AACtE,eAAO,MAAM,cAAc,8CAA+C,CAAC;AAC3E,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,8CAA8C,CAAC;AAE7E,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AACxE,0FAA0F;AAC1F,eAAO,MAAM,wBAAwB,8tBAAkuB,CAAC;AAExwB;sDACsD;AACtD,eAAO,MAAM,cAAc,wvBAA0tB,CAAC;AAEtvB,eAAO,MAAM,qBAAqB,wDAAwD,CAAC;AAC3F,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,MAAwkL,CAAC;AAE5nL,eAAO,MAAM,wBAAwB,kDAAkD,CAAC;AAExF;sDACsD;AACtD,eAAO,MAAM,wBAAwB,yhCAAshC,CAAC;AAE5jC,6FAA6F;AAC7F,eAAO,MAAM,sCAAsC,mFAAmF,CAAC;AACvI,oHAAoH;AACpH,eAAO,MAAM,uCAAuC,kUAAkU,CAAC;AACvX,eAAO,MAAM,oCAAoC,2aAA2a,CAAC;AAC7d,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,gEAAgE,CAAC;AAE3G,6GAA6G;AAC7G,eAAO,MAAM,6BAA6B,stCAA0zB,CAAC;AAEr2B,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,gDAAgD,CAAC;AACtF,eAAO,MAAM,wBAAwB,miCAA4hC,CAAC;AAElkC,eAAO,MAAM,gCAAgC,0EAA0E,CAAC;AAExH,uHAAuH;AACvH,eAAO,MAAM,gCAAgC,2yDAAmwD,CAAC;AAEjzD;+EAC+E;AAC/E;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,o4CAA+3C,CAAC;AAEn6C,eAAO,MAAM,6BAA6B,qvBAAquB,CAAC;AAEhxB;;+DAE+D;AAC/D,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,+EAA+E;AAC/E,eAAO,MAAM,gCAAgC,wFAAwF,CAAC;AAEtI;;+DAE+D;AAC/D,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,8FAA8F;AAC9F,eAAO,MAAM,2BAA2B,6HAA6H,CAAC;AACtK,uGAAuG;AACvG,eAAO,MAAM,6BAA6B,+DAA+D,CAAC;AAE1G;;;wBAGwB;AACxB,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAGD;;+DAE+D;AAC/D,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;2DAE2D;AAC3D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;+DAE+D;AAC/D,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD"}

package/dist/scaffold/templates.js

@@ -19,6 +19,8 @@ import { JOB_DECLARED_FAILURE_AWARENESS } from "../scheduler/jobDeclaredFailure.
 // function call inside generateClaudeMd — no module-init cycle (PostUpdateMigrator
 // never imports templates).
 import { APPRENTICESHIP_STALL_GATE_CLAUDEMD_SECTION, SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION, PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION, MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION, CODEX_CONNECT_CLAUDEMD_SECTION, FEATURE_SWITCH_CLAUDEMD_SECTION, NORMAL_CHROME_BROWSER_CLAUDEMD_SECTION, SINGLE_MACHINE_FAILOVER_GAP_CLAUDEMD_SECTION, MISSING_LOGIN_SESSION_CLAUDEMD_SECTION, DYNAMIC_MCP_CLAUDEMD_SECTION, ULTRACODE_SPAWN_CLAUDEMD_SECTION, AGENT_SIGNATURE_PROVENANCE_CLAUDEMD_SECTION, SENDER_REJECTION_CLAUDEMD_SECTION, SCOPE_ACCRETION_CLAUDEMD_SECTION, MESH_SELF_HEALING_CLAUDEMD_SECTION, LEASE_MEDIUM_CLAUDEMD_SECTION, WRITE_ADMISSION_CLAUDEMD_SECTION, DOORWAY_REGISTRY_CLAUDEMD_SECTION, EXTERNAL_HOG_CLAUDEMD_SECTION, ROUTING_SPEND_CLAUDEMD_SECTION, MATURATION_BOARD_CLAUDEMD_SECTION, MATURATION_LADDER_CLAUDEMD_SECTION, QUEUE_PACE_CLAUDEMD_SECTION, ECOSYSTEM_IDEAS_CLAUDEMD_SECTION, MOBILE_PAIRING_CLAUDEMD_SECTION, MOBILE_CHAT_CLAUDEMD_SECTION, APP_CONVERSATIONS_CLAUDEMD_SECTION, MOBILE_ROUTES_CLAUDEMD_SECTION, MOBILE_PUSH_CLAUDEMD_SECTION, MOBILE_PEOPLE_CLAUDEMD_SECTION, DECISION_QUALITY_CLAUDEMD_SECTION, BENCHMARK_DIVERGENCE_CLAUDEMD_SECTION, DUPLICATE_RECONCILER_CLAUDEMD_SECTION, AUDIT_CONVERGENCE_CLAUDEMD_SECTION, TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION, DECISION_JOURNAL_CONFIDENCE_CLAUDEMD_GUIDANCE, WINDOW_RUN_LIVENESS_CLAUDEMD_SECTION, SCRIPT_JOBS_CLAUDEMD_SECTION, SESSION_HANDOFF_CLAUDEMD_SECTION, JOB_RESULT_SUPERVISION_CLAUDEMD_SECTION, DEDICATED_PROFILE_REGISTRY_ROW_ANSWER, CODEX_ARM_SWEEPER_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_CLAUDEMD_SECTION, APP_MEDIA_CLAUDEMD_SECTION, MACHINE_BROWSER_CARE_CLAUDEMD_SECTION, PAIRING_WITHOUT_TELEGRAM_CLAUDEMD_SECTION, SLACK_FROM_APP_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_POOL_CLAUDEMD_SECTION, MACHINE_WEDGE_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { SURFACE_REFERRAL_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { RECOMMENDED_SERVICES_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { MINIMUM_OPERATOR_EFFORT_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { CODEX_DEVICE_LIMIT_CLAUDEMD_BULLET } from '../core/PostUpdateMigrator.js';
 import { UPDATE_APPLY_VERIFY_HOLD_CLAUDEMD_LINE } from '../core/PostUpdateMigrator.js';
@@ -417,6 +419,7 @@ ${REAPER_BACKGROUND_WORK_BULLET}
 ${STANDING_SESSIONS_BULLET}
 ${REROUTED_LOGIN_EXPIRED_BULLET}
 ${INTERACTIVE_LOGIN_EXPIRED_BULLET}
+${CLAUDE_KEY_HEALTH_BULLET}
 - **Busy-orphan detection** (\`busyOrphanDetection\`, OBSERVE-ONLY, dark by default; dev agents on): the inverse blind spot. CPU-progress is a proxy for "useful" — but a *useless* process that SPINS (a hot-loop, a wedged job burning CPU) looks "active" and would keep a session pinned. When an idle session (idle prompt + flat transcript) is held only by a child that's *burning* CPU across an extended dwell, the reaper records a \`busy-orphan-suspected\` audit row (and \`busy-orphan-cleared\` on recovery). It NEVER changes the keep/kill decision — it just makes the "useless-but-busy child pins an idle session" case measurable, so safe auto-reclaim can graduate later with data. Read \`logs/reaper-audit.jsonl\` (filter \`busy-orphan-suspected\`).
 - Why it matters: idle sessions pile up across agents until the machine starves (CPU *or* memory) and new sessions get "spawn denied" — silently breaking cross-agent messaging. This sweeps them, but only under real pressure.
 - See current state / why each session is kept or flagged: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/sessions/reaper\` (the \`pressure.inputs\` shows freePct, loadPerCore, \`cpuBusyPct\` — real sampled CPU busy %, the signal that decides \`cpuTier\` since reaper-pressure-signals; the 1-min load average is reported but no longer decisive, because it read 9.4/core at 36-44% idle (its macOS computation is poorly documented; the measured disagreement is the evidence) — plus the compressor OBSERVABLES \`compressorPct\`, \`decompressionsPerSec\` and \`kernelMemoryPressureLevel\` (reported, grading nothing: none of them separated that laptop from a healthy machine when measured) — plus \`cpuSignal\`, \`sampledAt\`, \`windowMs\` and the memTier/cpuTier breakdown. A CPU figure appears only once a full 30 s window has elapsed; shorter is \`null\` (unknown ⇒ memory-only), never a startup spike. Rollback lever: \`monitoring.sessionReaper.cpuSignal: 'load'\` restores the legacy grading exactly; the busy thresholds are \`cpuModerateBusyPct\`/\`cpuCriticalBusyPct\` (75/90), and there are no compressor thresholds because no compressor grade ships). On a machine pool, add \`?scope=pool\` to get every machine's snapshot; the local snapshot stays at the top level and \`pool.machines\` carries peers. A dark, old, unreachable, or malformed peer is a classified \`pool.failed\` row — never a 500 or a silently local-looking answer.
@@ -1021,6 +1024,7 @@ ${ROUTING_SPEND_CLAUDEMD_SECTION(port)}
 ${MATURATION_BOARD_CLAUDEMD_SECTION(port)}
 ${MATURATION_LADDER_CLAUDEMD_SECTION(port)}
 ${QUEUE_PACE_CLAUDEMD_SECTION(port)}
+${RECOMMENDED_SERVICES_CLAUDEMD_SECTION(port)}
 ${ECOSYSTEM_IDEAS_CLAUDEMD_SECTION(port)}
 ${MOBILE_PAIRING_CLAUDEMD_SECTION(port)}
 ${MOBILE_CHAT_CLAUDEMD_SECTION(port)}
@@ -1822,6 +1826,8 @@ Record what I learn. Build infrastructure, not one-offs. Grow to meet the user's
 Your messages to the user pass an always-on LLM gate (the tone gate) before they send. It reviews high-stakes leaks (CLI commands, file paths, config keys, endpoints) AND the self-stop anti-patterns (B15–B19: quitting on yourself for a context/fatigue reason, calling a doable thing impossible, parking your own work on the user). The two families are treated DIFFERENTLY — the leak/representation rules are overridable nudges (see below); the self-stop family stays a hard block, because there the check exists to constrain YOU and your reason for overriding would come from the very reasoning it distrusts. It judges the behavioral rules **by MEANING, not by literal phrases — a paraphrase of the anti-pattern is caught exactly the same as the canonical wording**, so do not assume rewording evades it. The gate FAILS CLOSED (holds the message, queued for retry — never silently delivers) if it can't produce a verdict (provider down, unparseable output, or a slow-review timeout); the operator kill-switch is \`toneGate.failClosedOnExhaustion\`. Constitution: "Intelligent Prompts — An LLM Gate Must Not String-Match".
 
 ${TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION}
+
+${SURFACE_REFERRAL_CLAUDEMD_SECTION}
 ### Context-Aware Outbound Review (why was my message flagged / would my reply have been blocked?)
 
 Beyond the tone gate, a response-review pipeline (nine specialist reviewers driven by a Stop hook) evaluates each finished conversational turn. On most installs it is OFF BY CONFIG — \`GET /review/history\` returns 501 there; say so honestly rather than guessing. Where it runs, it is usually in WATCH MODE (\`responseReview.observeOnly: true\`): verdicts are recorded, nothing is blocked. The context-aware layer (⚗️ experimental, dev-gated dark: \`responseReview.conversationalContext\`) feeds the opted-in reviewer a bounded, untrusted-data-enveloped slice of recent conversation so "the operator asked for this technical detail" is an input it can actually judge — a one-way carve-out (it can only move a would-block toward PASS, never license credentials/PII, never touch the deterministic policy layer).
@@ -2671,6 +2677,8 @@ export const REROUTED_LOGIN_EXPIRED_MARKER = 'A job session stuck at an expired
 /** Rerouted-job expired-login awareness bullet. Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export const REROUTED_LOGIN_EXPIRED_BULLET = `- **${REROUTED_LOGIN_EXPIRED_MARKER}**: a scheduled job (or other one-shot) that runs as an interactive Claude session and lands under a login whose sign-in has expired shows \`Login expired · Please run /login\` and can do nothing. The monitor now ends it about a minute after it first sees that screen (reason \`rerouted-login-expired\`, a \`SessionManager.monitorTick.reroutedLoginExpired\` degradation naming the login folder) instead of letting it hold a job slot for the full 8-hour lifetime; the job runs again on its next trigger. ${REROUTED_LOGIN_EXPIRED_POOL_SENTENCE} If a user asks "why did my scheduled jobs stop running?" or "why did a job end straight away?" — check \`GET /jobs\` for a stale \`nextScheduled\`, then the server log for \`stuck at an expired login\`; the fix is signing that login in again.`;
 /** Content-sniff marker for the interactive expired-login bullet (CMT-1008, Migration Parity). */
+export const CLAUDE_KEY_HEALTH_MARKER = 'A rejected sign-in key is told and recovers';
+export const CLAUDE_KEY_HEALTH_BULLET = `- **${CLAUDE_KEY_HEALTH_MARKER}**: an agent signed in with one key (\`sessions.credentials.anthropic\`, the usual cloud install) passes that key to every Claude process on the server, including internal model calls. If Anthropic refuses the key twice, the operator gets one plain notice, each waiting person is told once, and \`GET /health\` (with the auth header) shows \`claudeKey.status: dead\`. The fix is a new key from \`claude setup-token\`, put in place with \`instar set-claude-key\` on the server (reads stdin or a hidden prompt, never an argument; never ask for the key in chat). Within a minute Instar checks it, and conversations stuck at the login screen restart by themselves and answer what they missed. A conversation that ended during the outage is not replayed. **When to use** (PROACTIVE): the user asks "why did you stop replying?" or "why does health say the model is failing?" → read \`claudeKey\` in \`GET /health\`. Off switches: \`sessions.claudeKeyHealth.enabled: false\` and \`sessions.claudeChildAuth.enabled: false\`.`;
 export const INTERACTIVE_LOGIN_EXPIRED_MARKER = 'A conversation stuck at an expired login moves to a signed-in account';
 /** Interactive expired-login awareness bullet (CMT-1008). Shared by the generated CLAUDE.md and PostUpdateMigrator. */
 export const INTERACTIVE_LOGIN_EXPIRED_BULLET = `- **${INTERACTIVE_LOGIN_EXPIRED_MARKER}**: a Telegram/topic session placed on a pool login whose Claude sign-in has expired shows \`Login expired · Please run /login\` (newer Claude Code: \`Not logged in · Run /login\`) on every turn. About a minute after the monitor first sees that screen in the session's live tail it (1) marks that account needs-reauth (cause \`cli-login-expired-observed\`, so new sessions avoid it and the automatic sign-in repair can start) — even when the saved token still reads quota, because the CLI's own screen is the stronger evidence, and a later quota poll does not flip it back while the saved credential is unchanged (a sign-in repair, or you setting it active again, always wins); and (2) resumes the session on a signed-in account through the same swap as \`POST /subscription-pool/swap\` (conversation preserved; one attempt per session per 10 minutes, at most three; protected sessions are never moved). Only Claude Code's own message line counts: a stale mention scrolled up the screen, a message quoting the text, or a tool result such as \`claude auth status\` printing it never triggers it. If the login's saved credential cannot be read at all (e.g. a locked keychain), one screen is not enough and the session is not moved until the account is confirmed dead. Off switch for the swap only: \`subscriptionPool.loginExpiredSwap.enabled: false\` (read live). If a user asks "why did my conversation suddenly switch accounts?" or "why is this account showing needs sign-in when its quota looks fine?" — check the server log for \`stuck at an expired login\` and \`[LoginExpiredRecovery]\`; a failed swap also reports a \`SessionManager.monitorTick.interactiveLoginExpired\` degradation. The fix for the account itself is signing that login in again.`;