toolroll 0.9.34 → 0.9.37

package/dist/chat-actions.js

@@ -35,6 +35,8 @@ import { starterFlowOf, starterOf, startersFor, starterTerms, STARTER_FLOWS, swi
 import { answerTeammateQuestion } from "./teammate-work.js";
 import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleWords, setToolRules } from "./teammate-tools.js";
 import { aboutYouOf, checkAboutYouLine, saveAboutYou, withAboutYouLine } from "./lead-about.js";
+import { CHAT_ACTION_FIELDS, readChatActionRequest, readSharedAction, SHARED_ACTION_VERSION } from "./contracts/chat-actions.js";
+export { CHAT_ACTION_FIELDS };
 /** A tool from the lead's card: a common tool by its id, or the operator's own program or address. */
 function toolSpecFromRequest(input) {
     if (input["catalog"] !== undefined) {
@@ -118,6 +120,9 @@ export const CHAT_ACTIONS = {
     task_cancel: { label: "Cancel task", protected: true, password: false },
     task_resume: { label: "Resume task", protected: true, password: true },
 };
+// Every action has a schema (contracts/chat-actions.ts) and every schema an action: a mismatch fails to compile.
+const SAME_ACTIONS = true;
+void SAME_ACTIONS;
 /** Protected actions a paired phone may confirm behind its own explicit
  * yes/cancel challenge instead of the console's secure screen. Password
  * actions and long or redacted terms never qualify. */
@@ -128,53 +133,6 @@ export function isChatAction(value) {
     return typeof value === "string" && Object.hasOwn(CHAT_ACTIONS, value);
 }
 const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
-export const CHAT_ACTION_FIELDS = {
-    skill_import: ["repo", "content", "files"],
-    skill_enable: ["repo", "version"],
-    skill_disable: ["repo", "version"],
-    skill_restore: ["repo", "restore"],
-    skill_test: ["repo", "version", "sample", "nonce"],
-    knowledge_instructions: ["repo", "instructions"],
-    knowledge_save: ["repo", "title", "content", "id"],
-    knowledge_remove: ["repo", "id"],
-    knowledge_restore: ["repo", "restore"],
-    tool_add: ["repo", "catalog", "name", "command", "args", "url", "secrets", "about"],
-    tool_remove: ["repo", "name"],
-    flow_create: ["repo", "name", "definition", "trigger"],
-    flow_starter: ["repo", "starter"],
-    flow_edit: ["flow", "name", "definition"],
-    flow_card_add: ["flow", "title", "description", "zone"],
-    flow_card_move: ["card", "zone"],
-    flow_card_approve: ["card", "note"],
-    flow_card_send_back: ["card", "note"],
-    flow_card_choose: ["card", "choice", "note"],
-    flow_card_cancel: ["card"],
-    flow_card_comment: ["card", "note"],
-    flow_card_assign: ["card", "owner"],
-    flow_card_watch: ["card", "watching"],
-    flow_script_save: ["repo", "script"],
-    flow_trigger_add: ["flow", "trigger"],
-    flow_trigger_pause: ["trigger"],
-    flow_trigger_resume: ["trigger"],
-    flow_trigger_remove: ["trigger"],
-    teammate_create: ["repo", "template", "name", "soul"],
-    teammate_soul: ["teammate", "soul"],
-    teammate_state: ["teammate", "state"],
-    teammate_note: ["teammate", "note"],
-    teammate_answer: ["question", "choice", "text"],
-    teammate_tools: ["teammate", "tool", "change", "action", "use", "limitField", "limitOver", "undoWith"],
-    teammate_memory: ["teammate", "memory", "change", "text"],
-    teammate_routine: ["teammate", "change", "routine", "schedule", "text"],
-    teammate_undo: ["teammate", "call"],
-    kit_setup: ["repo", "kit"],
-    decision_record: ["repo", "claim", "why", "supersedes", "source"],
-    decision_retire: ["repo", "decision", "reason"],
-    lead_about_you: ["line", "replaces"],
-    scope_approve: ["task"],
-    result_accept: ["task", "run"],
-    task_cancel: ["task"],
-    task_resume: ["task", "run"],
-};
 const nonceHash = (value) => createHash("sha256").update(value).digest("hex");
 function requireActor(store, who, repo, operation) {
     if (!store.schemaCurrent())
@@ -277,9 +235,11 @@ const quoted = (value) => `“${value}”`;
 export function prepareSharedAction(store, who, operation, input, root, now = new Date()) {
     if (!isChatAction(operation))
         throw Error("Choose an available action.");
-    const allowed = CHAT_ACTION_FIELDS[operation];
-    if (Object.keys(input).some((key) => !allowed.includes(key)))
-        throw Error("This action contains an unsupported field.");
+    // The action's own schema: its fields and their kinds, refused by path. The request itself is used as given, so a
+    // confirmation rebuilds the same stamp from the same bytes.
+    const read = readChatActionRequest(operation, input);
+    if (!read.ok)
+        throw Error(`This action can't be read — ${read.issues.map(issue => issue.line).join("; ")}.`);
     if (operation === "lead_about_you") {
         // The owner's own note: the card shows the line, and the line it replaces beside it.
         const checked = checkAboutYouLine(input["line"]);
@@ -300,7 +260,7 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
         const state = replaces === 0 ? {} : { was: lines[replaces - 1] };
         const title = replaces === 0 ? "Remember about you" : "Update what your lead knows about you";
         const stamp = hash({ operation, request, repo: "", state, terms, actor: who.name, generation: who.generation, ceiling: who.ceilingDigest });
-        return { operation, request, repo: "", title, terms, stamp, state };
+        return { version: SHARED_ACTION_VERSION, operation, request, repo: "", title, terms, stamp, state };
     }
     const task = operation.startsWith("skill_") || operation.startsWith("knowledge_") || operation.startsWith("decision_") || operation.startsWith("tool_") || operation.startsWith("flow_") || operation.startsWith("teammate_") || operation.startsWith("kit_")
         ? null
@@ -965,22 +925,12 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
         generation: who.generation,
         ceiling: who.ceilingDigest,
     });
-    return { operation, request, repo, title, terms, stamp, state };
+    return { version: SHARED_ACTION_VERSION, operation, request, repo, title, terms, stamp, state };
 }
+/** A saved proposal's action, read by its schema (contracts/chat-actions.ts); null when it can't be read. */
 export function sharedActionPayload(value) {
-    return isChatAction(value["operation"]) &&
-        typeof value["stamp"] === "string" &&
-        typeof value["repo"] === "string" &&
-        typeof value["title"] === "string" &&
-        Array.isArray(value["terms"]) &&
-        value["terms"].every((t) => typeof t === "string") &&
-        value["request"] !== null &&
-        typeof value["request"] === "object" &&
-        !Array.isArray(value["request"]) &&
-        value["state"] !== null &&
-        typeof value["state"] === "object"
-        ? value
-        : null;
+    const read = readSharedAction(value);
+    return read.ok ? read.value : null;
 }
 /** A shortened or redacted preview is not complete consent. This rule lives
  * in the shared door, so a forged transport callback cannot bypass it. */

package/dist/chat-ask.js

@@ -1,4 +1,4 @@
-import { chatHash } from "./chat-delivery-state.js";
+import { chatHash, partContent, savedChatPart } from "./chat-delivery-state.js";
 import { MATE_ASK_OTHER } from "./store.js";
 /** The question as text with its options, where no buttons are drawn. */
 export function chatAskText(ask) {
@@ -10,7 +10,7 @@ export function chatAskButtons(state, part, now) {
     const row = state.prepare("SELECT p.payload,e.channel,b.channel AS own FROM chat_part p JOIN chat_event e ON e.id=p.event JOIN chat_binding b ON b.id=e.binding WHERE p.id=?").get(part);
     if (row === undefined)
         return [];
-    const content = JSON.parse(String(row["payload"]));
+    const content = partContent(String(row["payload"]));
     if ((content.channel ?? row["channel"]) !== row["own"])
         return [];
     const options = content.ask?.options ?? [];
@@ -32,9 +32,9 @@ function repaint(state, part, event, line, now) {
         state.plan(event.id, [{ text: line }], now);
         return;
     }
-    const before = JSON.parse(String(row["payload"]));
+    const before = partContent(String(row["payload"]));
     const content = { text: `${before.text}\n\n${line}`.slice(0, 3400), edit: event.ts, ...(before.channel === undefined ? {} : { channel: before.channel }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL WHERE id=?").run(JSON.stringify(content), part);
+    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL WHERE id=?").run(savedChatPart(content), part);
     state.finish(event.id);
 }
 /** A tapped ask button, inside the action's transaction; false when the token isn't one. */
@@ -84,7 +84,7 @@ export function applyChatAskTap(options, event, binding, token, now) {
     state.enqueue({
         id: chatHash(`${state.channel}:ask:${event.id}`).slice(0, 32), installation: event.installation, binding: binding.id, kind: "message",
         channel: event.channel, member: event.member, ts: event.ts, thread: event.thread,
-        payload: JSON.stringify({ text: option, originalLength: option.length }), created: now.toISOString(),
+        payload: { text: option, originalLength: option.length }, created: now.toISOString(),
     });
     repaint(state, part, event, `You chose: ${option}`, now);
     return true;

package/dist/chat-decide.d.ts

@@ -1,9 +1,22 @@
+/** Decisions finish in the chat app. A pushed card about a result, a failed task, a plan waiting for approval or a
+ * pull request ready to merge carries buttons that act in place: Accept and finish, Request changes, Retry,
+ * Approve & start, Merge. Every act that changes something asks twice ("Accept and finish 'X'? [Yes] [Cancel]"),
+ * and each button is one opaque token bound to the exact result, receipt, plan or commit the card showed: a card a
+ * newer result, a finished task or a changed plan has overtaken says so and acts on nothing.
+ *
+ * Approving a plan or merging needs the password, which never goes in chat, so they act in chat only under a
+ * repository's signed mode that carries the chatApprove term, for the signer's own chat; otherwise, and for a plan
+ * that widens permissions, exceeds the mode's budget or touches protected paths, the card keeps its link.
+ *
+ * Channel-agnostic: Telegram renders these today, and Slack, Discord and Teams reach the same acts through the same
+ * tokens (the `channel` column). Every act runs through the door the console uses. */
+import { DECIDE_ACTS } from "./contracts/chat-callback-rows.js";
 import { type ModeTerms } from "./modes.js";
 import { type VerifiedApprover } from "./principal.js";
 import type { Scope } from "./scope.js";
 import type { Store } from "./store.js";
 /** The tokens live in chat_decide_action and the open "What should change?" in chat_decide_prompt (store.ts). */
-export type DecideAct = "accept" | "changes" | "retry" | "approve" | "not-now" | "merge";
+export type DecideAct = (typeof DECIDE_ACTS)[number];
 export type DecideTarget = {
     kind: "result";
     taskId: string;

package/dist/chat-decide.js

@@ -10,6 +10,7 @@
  *
  * Channel-agnostic: Telegram renders these today, and Slack, Discord and Teams reach the same acts through the same
  * tokens (the `channel` column). Every act runs through the door the console uses. */
+import { DECIDE_ACTS, readDecideActionRow } from "./contracts/chat-callback-rows.js";
 import { createHash, randomBytes } from "node:crypto";
 import { acceptAndCompleteAsOperator, assignmentOf, owedAcceptance } from "./assignment.js";
 import { chatControlHref, chatResultHref } from "./chat-controls.js";
@@ -258,11 +259,12 @@ function retryStamp(store, taskId, who) {
 export function offerFingerprint(offer) {
     return sha(JSON.stringify(offer));
 }
-function readAction(row) {
-    return { token: String(row["token"]), channel: String(row["channel"]), binding: Number(row["binding"]), chat: String(row["chat"]),
-        message: row["message"] == null ? null : String(row["message"]), act: String(row["act"]), phase: String(row["phase"]),
-        taskId: String(row["task_id"]), run: row["run"] == null ? null : Number(row["run"]), digest: String(row["digest"]),
-        expiresAt: String(row["expires_at"]), consumedAt: row["consumed_at"] == null ? null : String(row["consumed_at"]) };
+function readAction(raw) {
+    const read = readDecideActionRow(raw);
+    if (!read.ok)
+        return read;
+    const { task_id: taskId, expires_at: expiresAt, consumed_at: consumedAt, created_at: _created, ...row } = read.value;
+    return { ok: true, value: { ...row, taskId, expiresAt, consumedAt } };
 }
 function mint(store, seat, message, spec, taskId, phase, now) {
     const token = `d:${randomBytes(12).toString("hex")}`;
@@ -378,7 +380,11 @@ export function applyDecideTap(store, seat, input) {
     const raw = input.token.startsWith("d:") ? store.handle.prepare("SELECT * FROM chat_decide_action WHERE token = ?").get(input.token) : undefined;
     if (raw === undefined)
         return null;
-    const row = readAction(raw);
+    const read = readAction(raw);
+    // A saved button that can't be read acts on nothing, and says why.
+    if (!read.ok)
+        return { ack: `That button can't be read (${read.issues.map(issue => issue.line).join("; ")}). Nothing was done.`, ignored: true };
+    const row = read.value;
     const { now } = input;
     if (row.channel !== seat.channel || row.binding !== seat.binding || row.chat !== seat.chat || (row.message !== null && row.message !== input.message))
         return { ack: "That button isn't for this chat.", ignored: true };

package/dist/chat-delivery-state.d.ts

@@ -1,4 +1,8 @@
 import { type Store } from "./store.js";
+import { chatSchema, chatTables } from "./contracts/chat-tables.js";
+import { savedChatPart, type ChatContent, type ChatEventBody } from "./contracts/chat-content.js";
+export { savedChatPart, type ChatContent, type ChatEventBody };
+export { chatSchema, chatTables };
 export type ChatIdentity = {
     installation: string;
     team?: string;
@@ -57,72 +61,6 @@ export type ChatRoom = {
     binding: number;
     cursor: number;
 };
-export type ChatContent = {
-    text: string;
-    /** Where the part is sent when not the binding's own DM: a room's channel. */
-    channel?: string;
-    proposal?: number;
-    image?: {
-        taskId: string;
-        run: number;
-        artifact: number;
-        sha256: string;
-    };
-    /** A screenshot sent with a result (result-shots.ts): it follows that result's message part, in its thread when
-     * the app allows; a refused upload becomes one plain line, and one removed by retention goes quietly. */
-    shot?: {
-        follows: number | null;
-    };
-    task?: string;
-    run?: number;
-    edit?: string;
-    phase?: "armed";
-    link?: {
-        label: string;
-        path: string;
-    };
-    /** More link buttons after `link`: [Look first] beside [Merge] or [Accept and finish]. */
-    also?: Array<{
-        label: string;
-        path: string;
-    }>;
-    /** A flow decision's buttons ride this part (v88): minted when it is planned. */
-    flow?: {
-        card: number;
-        entry: number;
-        actions: Array<"approve" | "edit" | "send-back">;
-    };
-    /** A flow's "Person chooses" buttons ride this part: minted when it is planned. */
-    choose?: {
-        card: number;
-        entry: number;
-        options: Array<{
-            choice: number;
-            label: string;
-        }>;
-    };
-    /** "Use this as your note?" Yes / No about the person's message `held` (an event id), for one choice's visit. */
-    note?: {
-        card: number;
-        entry: number;
-        held: string;
-    };
-    /** A teammate's question's buttons ride this part (v93): each option, then one to answer in words (choice null). */
-    question?: {
-        id: number;
-        choices: Array<{
-            choice: string | null;
-            label: string;
-        }>;
-    };
-    /** The lead's question to its owner rides this part: its options, then "Something else". */
-    ask?: {
-        turn: number;
-        options: string[];
-    };
-    /** The lead's own reply, already shaped (reply-shape.ts): the channel renders its bold anchors and labelled links in its own format. */
-    voice?: true;
-};
 export declare const chatHash: (text: string) => string;
 export declare class ChatState {
     readonly store: Store;
@@ -170,7 +108,10 @@ export declare class ChatState {
     revoke(installation: string, now?: Date): void;
     pairing(installation: string, approver: string, generation: number, now?: Date): string;
     pair(identity: ChatIdentity, hash: string, member: string, channel: string, now: Date): ChatBinding | null;
-    enqueue(event: Omit<ChatEvent, "session" | "state" | "next_at">): boolean;
+    /** Save a received event with its body (contracts/chat-content.ts), versioned. */
+    enqueue(event: Omit<ChatEvent, "session" | "state" | "next_at" | "payload"> & {
+        payload: ChatEventBody;
+    }): boolean;
     event(id: string): ChatEvent | null;
     next(installation: string, now: Date): ChatEvent | null;
     defer(event: string, problem: string, until: Date): void;
@@ -181,11 +122,12 @@ export declare class ChatState {
     lease(installation: string, owner: string, now: Date): boolean;
     owns(installation: string, owner: string, now?: Date): boolean;
 }
-export declare const chatSchema: (channel: "slack" | "discord" | "teams") => string;
-export declare const chatTables: (channel: "slack" | "discord" | "teams") => string[];
+/** A saved part's content. One that can't be read is a delivery problem that names the field, never a guess. */
+export declare function partContent(payload: string): ChatContent;
 export declare class ChatDeliveryError extends Error {
     readonly code: string;
     readonly retryMs: number;
     readonly uncertain: boolean;
-    constructor(code: string, retryMs?: number, uncertain?: boolean);
+    readonly permanent: boolean;
+    constructor(code: string, retryMs?: number, uncertain?: boolean, permanent?: boolean);
 }

package/dist/chat-delivery-state.js

@@ -1,136 +1,10 @@
 /** Durable private-chat receipts. Each transport has its own tables and lease. */
 import { createHash, randomBytes } from "node:crypto";
 import { MATE_ASK_TTL_MS } from "./store.js";
-const CHAT_SCHEMA = `
-CREATE TABLE IF NOT EXISTS chat_binding (
- id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL,
- team TEXT NOT NULL, app TEXT NOT NULL, member TEXT NOT NULL, channel TEXT NOT NULL,
- approver TEXT NOT NULL, generation INTEGER NOT NULL, created TEXT NOT NULL, revoked TEXT
-);
-CREATE UNIQUE INDEX IF NOT EXISTS chat_one_binding_member ON chat_binding(installation, member) WHERE revoked IS NULL;
-CREATE TABLE IF NOT EXISTS chat_pair (
- hash TEXT PRIMARY KEY, installation TEXT NOT NULL, approver TEXT NOT NULL,
- generation INTEGER NOT NULL, expires TEXT NOT NULL, consumed TEXT
-);
-CREATE TABLE IF NOT EXISTS chat_event (
- id TEXT PRIMARY KEY, installation TEXT NOT NULL, binding INTEGER REFERENCES chat_binding(id),
- kind TEXT NOT NULL CHECK(kind IN ('message','action','pair','notice')),
- channel TEXT NOT NULL, member TEXT NOT NULL, ts TEXT NOT NULL, thread TEXT NOT NULL,
- payload TEXT NOT NULL, created TEXT NOT NULL,
- session INTEGER REFERENCES mate_session(id), state TEXT NOT NULL DEFAULT 'queued' CHECK(state IN ('queued','done','dropped')),
- next_at TEXT, problem TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_pending_event ON chat_event(installation,state,next_at);
-CREATE TABLE IF NOT EXISTS chat_part (
- id INTEGER PRIMARY KEY AUTOINCREMENT, event TEXT NOT NULL REFERENCES chat_event(id), ordinal INTEGER NOT NULL,
- payload TEXT NOT NULL, state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending','sent','dropped')),
- message TEXT, file TEXT, uploaded INTEGER NOT NULL DEFAULT 0, attempts INTEGER NOT NULL DEFAULT 0,
- uncertain INTEGER NOT NULL DEFAULT 0, next_at TEXT, problem TEXT, created TEXT NOT NULL,
- UNIQUE(event,ordinal)
-);
-CREATE TABLE IF NOT EXISTS chat_action (
- token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
- proposal INTEGER NOT NULL REFERENCES mate_proposal(id), phase TEXT NOT NULL CHECK(phase IN ('confirm','dismiss','yes','cancel')),
- expires TEXT NOT NULL, consumed TEXT
-);
-CREATE TABLE IF NOT EXISTS chat_progress (
- binding INTEGER NOT NULL REFERENCES chat_binding(id), run INTEGER NOT NULL REFERENCES run(id),
- part INTEGER NOT NULL REFERENCES chat_part(id), digest TEXT NOT NULL,
- PRIMARY KEY(binding,run)
-);
-CREATE TABLE IF NOT EXISTS chat_runtime (
- installation TEXT PRIMARY KEY, owner TEXT, lease_until TEXT, connected TEXT,
- problem TEXT, retry_at TEXT, notification INTEGER NOT NULL DEFAULT 0
-);
-`;
-/** v73: a chat's place in the shared team conversations — a channel follows one
- * conversation, a DM may select one. Rows are revoked, never deleted. */
-const CHAT_ROOM_SCHEMA = `
-CREATE TABLE IF NOT EXISTS chat_room (
- id INTEGER PRIMARY KEY AUTOINCREMENT, installation TEXT NOT NULL, chat TEXT NOT NULL,
- kind TEXT NOT NULL CHECK(kind IN ('group','private')), conversation TEXT NOT NULL,
- binding INTEGER NOT NULL REFERENCES chat_binding(id),
- bound_by TEXT NOT NULL, bound TEXT NOT NULL, cursor INTEGER NOT NULL DEFAULT 0,
- revoked TEXT, revoked_by TEXT
-);
-CREATE UNIQUE INDEX IF NOT EXISTS chat_room_live ON chat_room(installation, chat) WHERE revoked IS NULL;
-CREATE UNIQUE INDEX IF NOT EXISTS chat_room_group ON chat_room(conversation) WHERE revoked IS NULL AND kind='group';
-CREATE TABLE IF NOT EXISTS chat_meta (
- installation TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, updated TEXT NOT NULL,
- PRIMARY KEY(installation, key)
-);
-`;
-/** v88: flow decisions in the chat app, as on Telegram (telegram-flow.ts).
- * A button is one opaque token for one visit (card, entry) of one card, on
- * the part it rides; Edit and Send back open a prompt the person's next
- * message in their DM answers. */
-const CHAT_FLOW_SCHEMA = `
-CREATE TABLE IF NOT EXISTS chat_flow_action (
- token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
- card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
- action TEXT NOT NULL CHECK(action IN ('approve','edit','send-back')), expires TEXT NOT NULL, consumed TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_flow_action_visit ON chat_flow_action(card, entry);
-CREATE TABLE IF NOT EXISTS chat_flow_prompt (
- id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES chat_binding(id),
- card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
- mode TEXT NOT NULL CHECK(mode IN ('edit','send-back')), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_flow_prompt_open ON chat_flow_prompt(binding, consumed);
-`;
-/** A flow's "Person chooses" zone in the chat app (flow-send.ts): one button per option (choice is its index, label its words
- * when sent) for one visit of one card, on the part it rides. A reply in that notice's thread is the note; chat_flow_note
- * is "Use this as your note?" Yes / No about one other message (held: its event; words: what it said, kept only until
- * answered, as an event's own payload is cleared once it is handled), asked once per visit.
- * Never in CHAT_TABLES: an older database has no such table until this schema creates it. */
-const CHAT_FLOW_CHOICE_SCHEMA = `
-CREATE TABLE IF NOT EXISTS chat_flow_choice (
- token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
- card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
- choice INTEGER NOT NULL, label TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_flow_choice_visit ON chat_flow_choice(card, entry);
-CREATE TABLE IF NOT EXISTS chat_flow_note (
- token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
- card INTEGER NOT NULL REFERENCES flow_card(id), entry INTEGER NOT NULL,
- held TEXT NOT NULL, words TEXT, answer TEXT NOT NULL CHECK(answer IN ('yes','no')), expires TEXT NOT NULL, consumed TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_flow_note_visit ON chat_flow_note(card, entry);
-`;
-/** v93: a teammate's question in the chat app. One button per option (choice)
- * and one to answer in words (choice NULL); that one opens a prompt the
- * person's next message in their DM answers. Never in CHAT_TABLES: an older
- * database has no such tables until this schema creates them. */
-const CHAT_QUESTION_SCHEMA = `
-CREATE TABLE IF NOT EXISTS chat_question_action (
- token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id),
- question INTEGER NOT NULL REFERENCES teammate_question(id), choice TEXT, expires TEXT NOT NULL, consumed TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_question_action_question ON chat_question_action(question);
-CREATE TABLE IF NOT EXISTS chat_question_prompt (
- id INTEGER PRIMARY KEY AUTOINCREMENT, binding INTEGER NOT NULL REFERENCES chat_binding(id),
- question INTEGER NOT NULL REFERENCES teammate_question(id), created TEXT NOT NULL, expires TEXT NOT NULL, consumed TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_question_prompt_open ON chat_question_prompt(binding, consumed);
-`;
-/** The lead's question to its owner (ask_owner) in the chat app: one button per option (choice is its index) and one for
- * "Something else" (choice NULL). A tap sends the option as the owner's next message. Never in CHAT_TABLES. */
-const CHAT_ASK_SCHEMA = `
-CREATE TABLE IF NOT EXISTS chat_ask_action (
- token TEXT PRIMARY KEY, part INTEGER NOT NULL REFERENCES chat_part(id) ON DELETE CASCADE,
- turn INTEGER NOT NULL, choice INTEGER, expires TEXT NOT NULL, consumed TEXT
-);
-CREATE INDEX IF NOT EXISTS chat_ask_action_turn ON chat_ask_action(turn);
-`;
-const CHAT_TABLES = [
-    "chat_binding",
-    "chat_pair",
-    "chat_event",
-    "chat_part",
-    "chat_action",
-    "chat_progress",
-    "chat_runtime",
-];
+import { chatSchema, chatTables } from "./contracts/chat-tables.js";
+import { readChatPart, savedChatEventBody, savedChatPart } from "./contracts/chat-content.js";
+export { savedChatPart };
+export { chatSchema, chatTables };
 export const chatHash = (text) => createHash("sha256").update(text).digest("hex");
 export class ChatState {
     store;
@@ -275,8 +149,9 @@ export class ChatState {
             return this.bindingFor(identity.installation, member);
         });
     }
+    /** Save a received event with its body (contracts/chat-content.ts), versioned. */
     enqueue(event) {
-        return (Number(this.prepare("INSERT OR IGNORE INTO chat_event(id,installation,binding,kind,channel,member,ts,thread,payload,created) VALUES(?,?,?,?,?,?,?,?,?,?)").run(event.id, event.installation, event.binding, event.kind, event.channel, event.member, event.ts, event.thread, event.payload, event.created).changes) === 1);
+        return (Number(this.prepare("INSERT OR IGNORE INTO chat_event(id,installation,binding,kind,channel,member,ts,thread,payload,created) VALUES(?,?,?,?,?,?,?,?,?,?)").run(event.id, event.installation, event.binding, event.kind, event.channel, event.member, event.ts, event.thread, savedChatEventBody(event.payload), event.created).changes) === 1);
     }
     event(id) {
         return (this.prepare("SELECT * FROM chat_event WHERE id=?").get(id) ?? null);
@@ -296,7 +171,7 @@ export class ChatState {
     plan(event, parts, now) {
         this.store.transact(() => {
             for (const [ordinal, part] of parts.entries()) {
-                const inserted = this.prepare("INSERT OR IGNORE INTO chat_part(event,ordinal,payload,created) VALUES(?,?,?,?)").run(event, ordinal, JSON.stringify(part), now.toISOString());
+                const inserted = this.prepare("INSERT OR IGNORE INTO chat_part(event,ordinal,payload,created) VALUES(?,?,?,?)").run(event, ordinal, savedChatPart(part), now.toISOString());
                 if (Number(inserted.changes) && part.proposal)
                     this.tokens(Number(inserted.lastInsertRowid), part.proposal, ["confirm", "dismiss"], now);
                 if (Number(inserted.changes) && part.question)
@@ -332,16 +207,23 @@ export class ChatState {
         return !!this.prepare("SELECT 1 FROM chat_runtime WHERE installation=? AND owner=? AND lease_until>?").get(installation, owner, now.toISOString());
     }
 }
-export const chatSchema = (channel) => (CHAT_SCHEMA + CHAT_ROOM_SCHEMA + CHAT_FLOW_SCHEMA + CHAT_FLOW_CHOICE_SCHEMA + CHAT_QUESTION_SCHEMA + CHAT_ASK_SCHEMA).replaceAll("chat_", `${channel}_`);
-export const chatTables = (channel) => CHAT_TABLES.map((name) => name.replace("chat_", `${channel}_`));
+/** A saved part's content. One that can't be read is a delivery problem that names the field, never a guess. */
+export function partContent(payload) {
+    const read = readChatPart(payload);
+    if (!read.ok)
+        throw new ChatDeliveryError(`This saved message can't be read: ${read.issues.map(issue => issue.line).join("; ")}`, 0, false, true);
+    return read.value;
+}
 export class ChatDeliveryError extends Error {
     code;
     retryMs;
     uncertain;
-    constructor(code, retryMs = 5000, uncertain = false) {
+    permanent;
+    constructor(code, retryMs = 5000, uncertain = false, permanent = false) {
         super(code);
         this.code = code;
         this.retryMs = retryMs;
         this.uncertain = uncertain;
+        this.permanent = permanent;
     }
 }