instar 1.3.18 → 1.3.20

package/dist/core/wireRegistrySync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireRegistrySync.js","sourceRoot":"","sources":["../../src/core/wireRegistrySync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmC,EACnC,IAAuB;IAEvB,MAAM,MAAM,GAAG,CAAC,IAAa,EAAE,EAAW,EAAE,EAAE,CAC5C,IAAI,CAAC,iBAAiB,CAAC,cAAc,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAE1F,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAE5C,OAAO;QACL,WAAW,EAAE,CAAC,YAAY,EAAE,kBAAkB,CAAC;QAC/C,MAAM;YACJ,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACtC,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/feedback-factory/dispatch/dispatch.d.ts

@@ -0,0 +1,47 @@
+/**
+ * dispatch.ts — framework-agnostic port of the dispatch (guidance-out) logic.
+ *
+ * Ports the pure logic of `the-portal/pages/api/instar/dispatches/index.ts` out of
+ * the Next.js handler: the dispatch type/priority vocab, the semver comparison used
+ * for version-compat filtering (an agent only receives a dispatch whose
+ * [minVersion, maxVersion] window includes the agent's version), the list query
+ * filter (since/type/version), and the create-dedup title normalization. The HTTP
+ * wiring + storage are excluded (the app-placement decision); this is the reusable
+ * core. Reference is TypeScript, so equivalence is by faithful transcription +
+ * exhaustive both-sides-of-boundary tests (not a cross-runtime parity harness).
+ */
+export declare const DISPATCH_TYPES: readonly ["strategy", "behavioral", "lesson", "configuration", "security", "action"];
+export type DispatchType = typeof DISPATCH_TYPES[number];
+export declare const DISPATCH_PRIORITIES: readonly ["low", "normal", "high", "critical"];
+export type DispatchPriority = typeof DISPATCH_PRIORITIES[number];
+export declare const SEMVER_RE: RegExp;
+export declare function isValidDispatchType(type: unknown): type is DispatchType;
+export declare function isValidDispatchPriority(p: unknown): p is DispatchPriority;
+/** Port of parseVersion: leading major.minor.patch → [n,n,n]; [0,0,0] if unparseable. */
+export declare function parseVersion(v: string): [number, number, number];
+/** Port of isVersionGte: version >= min (major.minor.patch, equal counts as gte). */
+export declare function isVersionGte(version: string, min: string): boolean;
+/** Port of isVersionLte: version <= max (equal counts as lte). */
+export declare function isVersionLte(version: string, max: string): boolean;
+export interface DispatchRecord {
+    dispatchId: string;
+    type: string;
+    title: string;
+    content?: string;
+    priority?: string;
+    minVersion?: string | null;
+    maxVersion?: string | null;
+    active?: boolean;
+    createdAt?: string;
+    [k: string]: unknown;
+}
+/**
+ * Port of handleList's version-compat filter: a dispatch is included only if the
+ * agent's version is within its [minVersion, maxVersion] window. Mirrors the
+ * reference — applied only when the agent sent a valid-semver version; otherwise
+ * all candidates pass (the caller gates on SEMVER_RE before calling).
+ */
+export declare function filterDispatchesForVersion(dispatches: DispatchRecord[], version: string): DispatchRecord[];
+/** Port of the create-path title normalization used for dedup: trim + cap at 500 chars. */
+export declare function normalizeDispatchTitle(title: string): string;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/feedback-factory/dispatch/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/feedback-factory/dispatch/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,cAAc,sFAAuF,CAAC;AACnH,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AACzD,eAAO,MAAM,mBAAmB,gDAAiD,CAAC;AAClF,MAAM,MAAM,gBAAgB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,SAAS,QAA8B,CAAC;AAErD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,YAAY,CAEvE;AACD,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAEzE;AAED,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAIhE;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQlE;AAED,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQlE;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAM1G;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D"}

package/dist/feedback-factory/dispatch/dispatch.js

@@ -0,0 +1,72 @@
+/**
+ * dispatch.ts — framework-agnostic port of the dispatch (guidance-out) logic.
+ *
+ * Ports the pure logic of `the-portal/pages/api/instar/dispatches/index.ts` out of
+ * the Next.js handler: the dispatch type/priority vocab, the semver comparison used
+ * for version-compat filtering (an agent only receives a dispatch whose
+ * [minVersion, maxVersion] window includes the agent's version), the list query
+ * filter (since/type/version), and the create-dedup title normalization. The HTTP
+ * wiring + storage are excluded (the app-placement decision); this is the reusable
+ * core. Reference is TypeScript, so equivalence is by faithful transcription +
+ * exhaustive both-sides-of-boundary tests (not a cross-runtime parity harness).
+ */
+export const DISPATCH_TYPES = ['strategy', 'behavioral', 'lesson', 'configuration', 'security', 'action'];
+export const DISPATCH_PRIORITIES = ['low', 'normal', 'high', 'critical'];
+export const SEMVER_RE = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
+export function isValidDispatchType(type) {
+    return typeof type === 'string' && DISPATCH_TYPES.includes(type);
+}
+export function isValidDispatchPriority(p) {
+    return typeof p === 'string' && DISPATCH_PRIORITIES.includes(p);
+}
+/** Port of parseVersion: leading major.minor.patch → [n,n,n]; [0,0,0] if unparseable. */
+export function parseVersion(v) {
+    const match = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
+    if (!match)
+        return [0, 0, 0];
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+/** Port of isVersionGte: version >= min (major.minor.patch, equal counts as gte). */
+export function isVersionGte(version, min) {
+    const v = parseVersion(version);
+    const m = parseVersion(min);
+    for (let i = 0; i < 3; i++) {
+        if (v[i] > m[i])
+            return true;
+        if (v[i] < m[i])
+            return false;
+    }
+    return true; // equal
+}
+/** Port of isVersionLte: version <= max (equal counts as lte). */
+export function isVersionLte(version, max) {
+    const v = parseVersion(version);
+    const m = parseVersion(max);
+    for (let i = 0; i < 3; i++) {
+        if (v[i] < m[i])
+            return true;
+        if (v[i] > m[i])
+            return false;
+    }
+    return true; // equal
+}
+/**
+ * Port of handleList's version-compat filter: a dispatch is included only if the
+ * agent's version is within its [minVersion, maxVersion] window. Mirrors the
+ * reference — applied only when the agent sent a valid-semver version; otherwise
+ * all candidates pass (the caller gates on SEMVER_RE before calling).
+ */
+export function filterDispatchesForVersion(dispatches, version) {
+    return dispatches.filter((d) => {
+        if (d.minVersion && !isVersionGte(version, d.minVersion))
+            return false;
+        if (d.maxVersion && !isVersionLte(version, d.maxVersion))
+            return false;
+        return true;
+    });
+}
+/** Port of the create-path title normalization used for dedup: trim + cap at 500 chars. */
+export function normalizeDispatchTitle(title) {
+    return title.trim().slice(0, 500);
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/feedback-factory/dispatch/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/feedback-factory/dispatch/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAEnH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAGlF,MAAM,CAAC,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAErD,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,QAAQ;AACvB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,QAAQ;AACvB,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAA4B,EAAE,OAAe;IACtF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACvE,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/dist/feedback-factory/processor/reopen.d.ts

@@ -0,0 +1,39 @@
+/**
+ * reopen.ts — TS port of the auto-reopen-on-regression decision.
+ *
+ * Ports the decision embedded in cmd_apply_clusters (the-portal/.claude/scripts/
+ * feedback-processor.py, the regression branch ~:1543) out of the DB-write code
+ * into a pure function. When the clustering driver (cluster.ts) merges a new
+ * report into a cluster that was already fixed/resolved/deferred (a "possible
+ * regression" note), the cluster is auto-reopened. This computes the reopen
+ * outcome from the cluster's prior status:
+ *
+ *   - deferred  → AGED-REOPEN  → status 'new',          annotate actionTaken,   no recurrence bump
+ *   - otherwise → REGRESSION   → status 'investigating', annotate researchNotes, bump recurrenceCount
+ *
+ * The DB writes (the prisma update with `{ increment: 1 }` etc.) stay in the
+ * adapter; this is the pure decision + the audit-note text. `now` is injected.
+ * Reference is interleaved with DB I/O, so equivalence is by faithful
+ * transcription + exhaustive unit tests (no clean isolated reference function to
+ * run a cross-runtime harness against).
+ */
+import type { Cluster } from './types.js';
+export interface ReopenDecision {
+    /** New lifecycle status to set on the reopened cluster. */
+    newStatus: 'new' | 'investigating';
+    /** Whether to bump recurrenceCount (chronic-regression accounting; NOT for aged-reopen). */
+    bumpRecurrence: boolean;
+    /** Which cluster field the audit note is appended to. */
+    annotateField: 'actionTaken' | 'researchNotes';
+    /** The note tag. */
+    noteTag: 'AGED-REOPEN' | 'REGRESSION';
+    /** The audit note appended to the chosen field. */
+    note: string;
+}
+/**
+ * Compute the auto-reopen outcome for a cluster being merged into on a regression.
+ * `wasStatus` is the cluster's status before reopen; `feedbackId` is the incoming
+ * report; `now` is the injected ISO timestamp (reference uses new Date().toISOString()).
+ */
+export declare function computeReopen(cluster: Cluster, feedbackId: string, now: string): ReopenDecision;
+//# sourceMappingURL=reopen.d.ts.map

package/dist/feedback-factory/processor/reopen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reopen.d.ts","sourceRoot":"","sources":["../../../src/feedback-factory/processor/reopen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,SAAS,EAAE,KAAK,GAAG,eAAe,CAAC;IACnC,4FAA4F;IAC5F,cAAc,EAAE,OAAO,CAAC;IACxB,yDAAyD;IACzD,aAAa,EAAE,aAAa,GAAG,eAAe,CAAC;IAC/C,oBAAoB;IACpB,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC;IACtC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAiB/F"}

package/dist/feedback-factory/processor/reopen.js

@@ -0,0 +1,41 @@
+/**
+ * reopen.ts — TS port of the auto-reopen-on-regression decision.
+ *
+ * Ports the decision embedded in cmd_apply_clusters (the-portal/.claude/scripts/
+ * feedback-processor.py, the regression branch ~:1543) out of the DB-write code
+ * into a pure function. When the clustering driver (cluster.ts) merges a new
+ * report into a cluster that was already fixed/resolved/deferred (a "possible
+ * regression" note), the cluster is auto-reopened. This computes the reopen
+ * outcome from the cluster's prior status:
+ *
+ *   - deferred  → AGED-REOPEN  → status 'new',          annotate actionTaken,   no recurrence bump
+ *   - otherwise → REGRESSION   → status 'investigating', annotate researchNotes, bump recurrenceCount
+ *
+ * The DB writes (the prisma update with `{ increment: 1 }` etc.) stay in the
+ * adapter; this is the pure decision + the audit-note text. `now` is injected.
+ * Reference is interleaved with DB I/O, so equivalence is by faithful
+ * transcription + exhaustive unit tests (no clean isolated reference function to
+ * run a cross-runtime harness against).
+ */
+/**
+ * Compute the auto-reopen outcome for a cluster being merged into on a regression.
+ * `wasStatus` is the cluster's status before reopen; `feedbackId` is the incoming
+ * report; `now` is the injected ISO timestamp (reference uses new Date().toISOString()).
+ */
+export function computeReopen(cluster, feedbackId, now) {
+    const wasStatus = cluster.status ?? null;
+    const isAged = wasStatus === 'deferred';
+    const newStatus = isAged ? 'new' : 'investigating';
+    const noteTag = isAged ? 'AGED-REOPEN' : 'REGRESSION';
+    const fixedInVersion = cluster.fixedInVersion || 'n/a';
+    // Verbatim from the reference's regressionNote template.
+    const note = `[${noteTag} ${now}] New report matched cluster previously marked '${wasStatus}' (fixedInVersion=${fixedInVersion}). Auto-reopened to '${newStatus}' for review. Report: ${feedbackId}`;
+    return {
+        newStatus,
+        bumpRecurrence: !isAged,
+        annotateField: isAged ? 'actionTaken' : 'researchNotes',
+        noteTag,
+        note,
+    };
+}
+//# sourceMappingURL=reopen.js.map

package/dist/feedback-factory/processor/reopen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reopen.js","sourceRoot":"","sources":["../../../src/feedback-factory/processor/reopen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,UAAkB,EAAE,GAAW;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC;IACxC,MAAM,SAAS,GAA4B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;IAC5E,MAAM,OAAO,GAAiC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IACpF,MAAM,cAAc,GAAI,OAAO,CAAC,cAAyB,IAAI,KAAK,CAAC;IAEnE,yDAAyD;IACzD,MAAM,IAAI,GAAG,IAAI,OAAO,IAAI,GAAG,mDAAmD,SAAS,qBAAqB,cAAc,wBAAwB,SAAS,yBAAyB,UAAU,EAAE,CAAC;IAErM,OAAO;QACL,SAAS;QACT,cAAc,EAAE,CAAC,MAAM;QACvB,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe;QACvD,OAAO;QACP,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/messaging/FencedOutbox.d.ts

@@ -0,0 +1,42 @@
+/**
+ * FencedOutbox — fencing-token-gated outbound reply path (spec §8 G3a).
+ *
+ * "No duplicate replies" is enforced here STRUCTURALLY, not by assuming a single
+ * consumer. A reply is sent only while this machine holds the lease at the epoch
+ * the reply was stamped under; a fenced (stale-epoch) machine's in-flight reply
+ * is SUPPRESSED at the send path. The reply is committed to the message ledger
+ * with a deterministic idempotency key (hash(dedupeKey + replyIndex)) so any
+ * machine re-running the same event reproduces it identically — and the ledger
+ * recognizes an already-committed reply and refuses to re-send.
+ *
+ * On a channel with native outbound dedup the idempotency key makes a re-send a
+ * no-op; on a channel without it (Telegram), the dual-medium reply_committed
+ * marker (propagated by the sync layer) is what prevents a failover re-send.
+ */
+import { MessageProcessingLedger } from './MessageProcessingLedger.js';
+export interface FencedOutboxDeps {
+    ledger: MessageProcessingLedger;
+    /** The current effective fencing epoch. */
+    currentEpoch: () => number;
+    /** Whether this machine structurally holds the lease right now. */
+    holdsLease: () => boolean;
+    logger?: (msg: string) => void;
+}
+export interface SendOutcome {
+    sent: boolean;
+    suppressed: boolean;
+    reason: 'sent' | 'already-replied' | 'fenced-no-lease' | 'fenced-stale-epoch' | 'send-failed';
+    idempotencyKey: string;
+}
+export declare class FencedOutbox {
+    private readonly d;
+    constructor(deps: FencedOutboxDeps);
+    private log;
+    /**
+     * Send a reply for `dedupeKey`, stamped under `stampedEpoch` (the epoch the
+     * turn began processing under). Returns the outcome. The actual platform send
+     * is `sendFn`; it is invoked ONLY after the fencing checks pass.
+     */
+    send(dedupeKey: string, replyIndex: number, stampedEpoch: number, sendFn: () => Promise<void>): Promise<SendOutcome>;
+}
+//# sourceMappingURL=FencedOutbox.d.ts.map

package/dist/messaging/FencedOutbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FencedOutbox.d.ts","sourceRoot":"","sources":["../../src/messaging/FencedOutbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAC;AAEnG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,uBAAuB,CAAC;IAChC,2CAA2C;IAC3C,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,mEAAmE;IACnE,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,aAAa,CAAC;IAC9F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAmB;gBAEzB,IAAI,EAAE,gBAAgB;IAIlC,OAAO,CAAC,GAAG;IAIX;;;;OAIG;IACG,IAAI,CACR,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAC1B,OAAO,CAAC,WAAW,CAAC;CAgCxB"}

package/dist/messaging/FencedOutbox.js

@@ -0,0 +1,60 @@
+/**
+ * FencedOutbox — fencing-token-gated outbound reply path (spec §8 G3a).
+ *
+ * "No duplicate replies" is enforced here STRUCTURALLY, not by assuming a single
+ * consumer. A reply is sent only while this machine holds the lease at the epoch
+ * the reply was stamped under; a fenced (stale-epoch) machine's in-flight reply
+ * is SUPPRESSED at the send path. The reply is committed to the message ledger
+ * with a deterministic idempotency key (hash(dedupeKey + replyIndex)) so any
+ * machine re-running the same event reproduces it identically — and the ledger
+ * recognizes an already-committed reply and refuses to re-send.
+ *
+ * On a channel with native outbound dedup the idempotency key makes a re-send a
+ * no-op; on a channel without it (Telegram), the dual-medium reply_committed
+ * marker (propagated by the sync layer) is what prevents a failover re-send.
+ */
+import { computeReplyIdempotencyKey } from './MessageProcessingLedger.js';
+export class FencedOutbox {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    log(m) {
+        this.d.logger?.(`[outbox] ${m}`);
+    }
+    /**
+     * Send a reply for `dedupeKey`, stamped under `stampedEpoch` (the epoch the
+     * turn began processing under). Returns the outcome. The actual platform send
+     * is `sendFn`; it is invoked ONLY after the fencing checks pass.
+     */
+    async send(dedupeKey, replyIndex, stampedEpoch, sendFn) {
+        const idempotencyKey = computeReplyIdempotencyKey(dedupeKey, replyIndex);
+        // Idempotency: if a reply was already committed (locally or via a remote
+        // dual-medium marker), do not send again.
+        if (this.d.ledger.isActedOn(dedupeKey)) {
+            this.log(`already replied to ${dedupeKey} — suppressing`);
+            return { sent: false, suppressed: true, reason: 'already-replied', idempotencyKey };
+        }
+        // Fencing: only the current lease holder, at the stamped epoch, may send.
+        if (!this.d.holdsLease()) {
+            this.log(`fenced (no lease) — suppressing reply to ${dedupeKey}`);
+            return { sent: false, suppressed: true, reason: 'fenced-no-lease', idempotencyKey };
+        }
+        const epoch = this.d.currentEpoch();
+        if (epoch !== stampedEpoch) {
+            this.log(`fenced (stale epoch ${stampedEpoch} != current ${epoch}) — suppressing reply to ${dedupeKey}`);
+            return { sent: false, suppressed: true, reason: 'fenced-stale-epoch', idempotencyKey };
+        }
+        try {
+            await sendFn();
+        }
+        catch (err) {
+            this.log(`send failed for ${dedupeKey}: ${err instanceof Error ? err.message : String(err)}`);
+            return { sent: false, suppressed: false, reason: 'send-failed', idempotencyKey };
+        }
+        // Commit the reply marker (durable, synchronous) BEFORE advancing the cursor.
+        this.d.ledger.commitReply(dedupeKey, idempotencyKey, stampedEpoch);
+        return { sent: true, suppressed: false, reason: 'sent', idempotencyKey };
+    }
+}
+//# sourceMappingURL=FencedOutbox.js.map

package/dist/messaging/FencedOutbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FencedOutbox.js","sourceRoot":"","sources":["../../src/messaging/FencedOutbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAA2B,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAkBnG,MAAM,OAAO,YAAY;IACN,CAAC,CAAmB;IAErC,YAAY,IAAsB;QAChC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,CAAS;QACnB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,SAAiB,EACjB,UAAkB,EAClB,YAAoB,EACpB,MAA2B;QAE3B,MAAM,cAAc,GAAG,0BAA0B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEzE,yEAAyE;QACzE,0CAA0C;QAC1C,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,sBAAsB,SAAS,gBAAgB,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;QACtF,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,uBAAuB,YAAY,eAAe,KAAK,4BAA4B,SAAS,EAAE,CAAC,CAAC;YACzG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC;QACzF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,mBAAmB,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;QACnF,CAAC;QAED,8EAA8E;QAC9E,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/messaging/MessageProcessingLedger.d.ts

@@ -0,0 +1,105 @@
+/**
+ * MessageProcessingLedger — the no-loss / no-duplicate-reply guarantee (spec §8 G3a).
+ *
+ * A durable, SQLite-backed record of each inbound message's lifecycle:
+ *   received → processing → reply_committed → cursor_advanced
+ * keyed by the adapter's `dedupeKey(rawEvent)` (Telegram update_id, Slack
+ * event_id/client_msg_id). Rules:
+ *
+ *  - An event whose dedupeKey is already reply_committed/cursor_advanced is
+ *    NEVER acted on again — a redelivery (Telegram retry, Slack reconnect, or a
+ *    transfer-window overlap during a handoff) is recognized and dropped. This
+ *    is what makes "no duplicate replies" structural, not merely "only one
+ *    consumer".
+ *  - The ingress cursor advances ONLY on durable completion (cursor_advanced),
+ *    so a crash before completion replays the event (at-least-once) and the
+ *    ledger makes the replay a no-op-or-resume (exactly-once effect).
+ *  - Each transition is flushed to local SQLite synchronously on commit (WAL +
+ *    NORMAL), so a same-machine crash-restart never double-acts.
+ *  - A stuck `processing` entry past maxProcessingMs (old holder fenced
+ *    mid-turn) is re-runnable by the current holder from its stored input.
+ *
+ * Substrate is SQLite (the proven PendingRelayStore/CommitmentTracker path) —
+ * NOT a new ad-hoc JSON file and NOT a git-synced blob. Schema self-initializes
+ * on first access (no PostUpdateMigrator step needed). Per-agent-id isolation.
+ */
+export type LedgerState = 'received' | 'processing' | 'reply_committed' | 'cursor_advanced';
+export interface LedgerEntry {
+    dedupeKey: string;
+    platform: string;
+    topic: string | null;
+    state: LedgerState;
+    receivedAt: string;
+    processingStartedAt: string | null;
+    replyCommittedAt: string | null;
+    cursorAdvancedAt: string | null;
+    replyIdempotencyKey: string | null;
+    replyEpoch: number | null;
+    inputSnapshot: string | null;
+    attempts: number;
+}
+export declare function resolveMessageLedgerPath(stateDir: string, agentId: string): string;
+/**
+ * Deterministic outbound idempotency key — any machine re-running the same
+ * inbound event reproduces it identically (spec §8 G3a). Used so a failover
+ * re-send is recognized as the same reply.
+ */
+export declare function computeReplyIdempotencyKey(dedupeKey: string, replyIndex: number): string;
+export declare class MessageProcessingLedger {
+    private readonly db;
+    readonly path: string;
+    private constructor();
+    static open(agentId: string, stateDir: string): MessageProcessingLedger;
+    /** Open an in-memory ledger (tests). */
+    static openMemory(): MessageProcessingLedger;
+    /**
+     * Record an inbound event. Idempotent on dedupeKey (INSERT OR IGNORE).
+     * Returns whether this is the first time we've seen it + the current state.
+     * A caller seeing firstSeen:false with an acted-on state must DROP the event.
+     */
+    record(dedupeKey: string, opts: {
+        platform: string;
+        topic?: string | null;
+        input?: string;
+    }): {
+        firstSeen: boolean;
+        state: LedgerState;
+    };
+    /** Has this event already been acted on (reply committed or cursor advanced)? */
+    isActedOn(dedupeKey: string): boolean;
+    /**
+     * Claim an event for processing under the given fencing epoch. Returns false
+     * if it has already been acted on (drop). A stuck 'processing' entry can be
+     * re-claimed (the old holder was fenced); attempts is incremented.
+     */
+    beginProcessing(dedupeKey: string, epoch: number): boolean;
+    /**
+     * Commit that a reply was sent. Records the deterministic idempotency key and
+     * the fencing epoch it was committed under. Idempotent — committing twice is
+     * a no-op (the marker already exists).
+     */
+    commitReply(dedupeKey: string, replyIdempotencyKey: string, epoch: number): void;
+    /** Advance the ingress cursor — only call after durable reply commit. */
+    advanceCursor(dedupeKey: string): void;
+    /**
+     * Apply a reply_committed marker propagated from another machine (dual-medium
+     * marker, spec §8 G3a): if we have the entry and it's not yet acted on, mark
+     * it committed so a failover does not re-send. Creates the entry if unknown
+     * (the other machine saw it first).
+     */
+    applyRemoteReplyMarker(dedupeKey: string, opts: {
+        platform: string;
+        replyIdempotencyKey: string;
+        epoch: number;
+        topic?: string | null;
+    }): void;
+    /**
+     * Entries stuck in 'processing' past maxProcessingMs — eligible for re-run by
+     * the current lease holder from their stored input (spec §8 G3a). The old
+     * holder's abandoned output is discarded (the new holder re-executes).
+     */
+    reclaimStuck(maxProcessingMs: number, nowMs?: number): LedgerEntry[];
+    get(dedupeKey: string): LedgerEntry | null;
+    close(): void;
+}
+//# sourceMappingURL=MessageProcessingLedger.d.ts.map

package/dist/messaging/MessageProcessingLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageProcessingLedger.d.ts","sourceRoot":"","sources":["../../src/messaging/MessageProcessingLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAQH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoBD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGlF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAuB;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,OAAO;IAKP,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,uBAAuB;IAYvE,wCAAwC;IACxC,MAAM,CAAC,UAAU,IAAI,uBAAuB;IAO5C;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAC5F,SAAS,EAAE,OAAO,CAAC;QACnB,KAAK,EAAE,WAAW,CAAC;KACpB;IAYD,iFAAiF;IACjF,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAKrC;;;;OAIG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAc1D;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAUhF,yEAAyE;IACzE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAStC;;;;;OAKG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAe9I;;;;OAIG;IACH,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,GAAE,MAAmB,GAAG,WAAW,EAAE;IAahF,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAK1C,KAAK,IAAI,IAAI;CAGd"}