toolroll 0.9.50 → 0.9.52

package/dist/server/people-tokens.js

@@ -19,7 +19,6 @@ import { accessFromGroups, accountNameFor, exchangeOidcCode, newOidcVisit, oidcA
 import { personAuditHtml, personHref } from "../people-audit-ui.js";
 import { cursorOf as auditCursorOf, remoteAudit } from "../remote-audit.js";
 import { hashPassword } from "../scope.js";
-import { passwordGuardOf } from "../sign-in-guard.js";
 import { form, HANDOFF_STYLE, joinDeadPage, joinFormPage, loginHref, loginPage, loginReturn, page, SESSION_COOKIE, SIGN_IN_COOKIE, SIGN_IN_LINK_PATH, signInSpent, signupPage, startedHere } from "./shared.js";
 export function createPeopleHandlers(runtime) {
     const { settingsUpdates, joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
@@ -474,7 +473,7 @@ export function createPeopleHandlers(runtime) {
             const authenticated = name !== null && token !== null ? authenticateAccount(store, name, token) : null;
             if (authenticated === null || !authenticated.ok) {
                 if (authenticated?.reason === "locked") {
-                    const locked = passwordGuardOf(store).lockedFor(name ?? "", at);
+                    const locked = authenticated.retryAfterMs;
                     recordSignIn(signInActor(name), "sign-in refused", "locked");
                     response.setHeader("Retry-After", String(Math.ceil(locked / 1000)));
                     return page(response, 429, loginPage(`Too many wrong passwords. Try again in ${minutesWords(locked)}.`, returnTo));

package/dist/server/remote.js

@@ -10,7 +10,7 @@ import { RequestBudget, SourceAdmission } from "../request-budget.js";
 import { authenticateAccount } from "../scope.js";
 import { createSessionEndpoint } from '../session-server.js';
 import {} from "../store.js";
-import { handleTeamHttp } from '../team-http.js';
+import { handleTeamHttp, TEAM_PASSWORD_REVERIFY_MS } from '../team-http.js';
 import { handleTeamsHttp } from "../teams.js";
 import { flowHook, telegramHook } from "./remote-hooks.js";
 import { respond } from "./shared.js";
@@ -26,6 +26,8 @@ export function createRemoteHandlers(runtime) {
         return who?.via === "bearer" ? who.principal ?? null : null;
     };
     const presentsToken = (request) => /^Bearer so_\S+$/.test(request.headers.authorization ?? "");
+    /** When each live request's password bearer last proved its password: kept only while the request is. */
+    const passwordProvedAt = new WeakMap();
     const teamEndpoint = (request, response) => handleTeamHttp(request, response, {
         authenticate: request => {
             if (presentsToken(request)) {
@@ -34,7 +36,11 @@ export function createRemoteHandlers(runtime) {
             }
             const who = identify(request, request.method === 'POST');
             const account = who === null ? null : store.accountOf(who.name);
-            return who && account && account.revokedAt === null ? { name: who.name, generation: account.generation, role: account.role } : null;
+            if (!who || !account || account.revokedAt !== null)
+                return null;
+            if (who.via === 'bearer')
+                passwordProvedAt.set(request, clock().getTime());
+            return { name: who.name, generation: account.generation, role: account.role };
         },
         admit: admitPasswordSource,
         admitAuthenticated: admitBearer,
@@ -51,10 +57,19 @@ export function createRemoteHandlers(runtime) {
                 actor.principal = { ...actor.principal, scope: live.scope };
                 return true;
             }
-            // A password bearer was proved when this connection opened. Cookie expiry/revocation
+            // A password bearer was proved when this connection opened, and is proved again (the password checked, through
+            // the same per-source tries and locks) once TEAM_PASSWORD_REVERIFY_MS has passed since. Cookie expiry/revocation
             // is rechecked without allowing a passive stream to extend its lifetime.
-            if (request.headers.authorization)
+            if (request.headers.authorization) {
+                const now = clock().getTime(), provedAt = passwordProvedAt.get(request);
+                if (provedAt !== undefined && now - provedAt < TEAM_PASSWORD_REVERIFY_MS)
+                    return true;
+                const who = identify(request, false);
+                if (who?.via !== 'bearer' || who.name !== actor.name || who.generation !== actor.generation)
+                    return false;
+                passwordProvedAt.set(request, now);
                 return true;
+            }
             const who = identify(request, false);
             return who?.name === actor.name && who.via === 'cookie' && who.session.generation === actor.generation;
         },

package/dist/server/settings.js

@@ -1111,6 +1111,8 @@ export function createSettingsHandlers(runtime) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator looks after backups.", "/settings");
             const made = await backupNow(store, databaseFile, "manual", clock);
+            if (made.ok && made.checkpoint !== null && "problem" in made.checkpoint)
+                return redirect(response, `/settings/backups?problem=${encodeURIComponent(`Backed up. The activity log failed its tamper check, so it was not anchored: ${made.checkpoint.problem}`)}`);
             return redirect(response, made.ok ? `/settings/backups?said=${encodeURIComponent("Backed up.")}` : `/settings/backups?problem=${encodeURIComponent(`The backup failed: ${made.error}`)}`);
         }
         // Sprint 8: change the backup schedule. A step-up; the ledger keeps before → after.
@@ -1978,7 +1980,7 @@ export function createSettingsHandlers(runtime) {
                 const existing = loadBotToken({}, options.telegramTokenFile);
                 const hasEnv = (envValue(process.env, "TELEGRAM_TOKEN") ?? "") !== "";
                 const csrf = who.via === "cookie" ? who.session.csrf : "";
-                return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, null, null, null, null, {
+                return sendScreen(response, 400, settingsPage(chromeFor(who.via === "cookie" ? who.session.project : defaultProject, "settings"), existing, hasEnv, csrf, saved.message, options.configDir === undefined ? null : effectivePrimary(process.env, options.configDir, loadBotToken(process.env, options.telegramTokenFile) !== null), null, null, null, {
                     ...store.permissionDefault(),
                     canManage: who.role === "approver",
                 }));

package/dist/server/shared.d.ts

@@ -3138,6 +3138,7 @@ export declare function settingsPage(chrome: Chrome, existing: TokenSource | nul
     channel: string | null;
     implicit: boolean;
     configured: string[];
+    legacyWarning?: string;
 } | null, push?: {
     available: boolean;
     devices: PushSubscription[];

package/dist/server/shared.js

@@ -12313,6 +12313,7 @@ export function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging
         kind: "settings",
         said: problem,
         groups: settingsGroups(messaging, telegramFailing),
+        ...(messaging?.legacyWarning ? { legacyWebhookWarning: messaging.legacyWarning } : {}),
         theme,
         accent: requestContext.getStore()?.accent ?? DEFAULT_ACCENT,
         accentPresets: ACCENT_PRESETS,
@@ -12346,6 +12347,7 @@ export function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging
     };
     return screen("Settings", [
         "<h1>Settings</h1>",
+        messaging?.legacyWarning ? `<p data-legacy-webhooks>Legacy webhooks are deprecated. Connect <a href="/settings/slack" style="display:inline-flex;min-height:44px;align-items:center">Slack</a> or <a href="/settings/discord" style="display:inline-flex;min-height:44px;align-items:center">Discord</a> in Chat settings.</p>` : "",
         settingsTiles(view.groups),
         phone === null ? "" : phoneSetupHtml(phone),
         appearanceCard(csrf),

package/dist/sign-in-guard.d.ts

@@ -1,31 +1,56 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 /**
- * Password guessing (v99). Five wrong passwords in a row lock that account
- * for 15 minutes, doubling with each further lock up to a day; a right one
- * clears the count. Every password check counts: signing in, a request that
- * carries a password, and each step-up inside the console. Unknown names
- * count too, so guessing names gains nothing.
- *
- * Kept in memory, per database: a restart forgives, which someone locked out
- * by another's guessing may need. The console reports each lock to the
- * action ledger through onLock.
+ * Five failures lock a source/account pair, with exponential backoff. Across sources, failures slow an account and
+ * admit only a few unproven checks per minute before password derivation. A validated same-account browser session
+ * bypasses that shared admission budget, never a source's own lock. Fabricated names follow the same admission path.
+ * Source and name records expire by time. Both use bounded, non-evicting keyed storage, regardless of whether the
+ * account exists. Saturation shares overflow buckets without displacing or changing individually tracked state.
  */
 export type GuardPolicy = {
     failuresBeforeLock: number;
     firstLockMs: number;
     maxLockMs: number;
+    firstSlowMs: number;
 };
 export declare const DEFAULT_GUARD_POLICY: GuardPolicy;
+/** Default/loopback source for callers without an explicit native CLI context. */
+export declare const LOCAL_SOURCE = "local";
+/** Native CLI only: no HTTP peer or forwarded header can select this source. */
+export declare const CLI_PASSWORD_SOURCE = "local-cli";
+export declare const ACCOUNT_PASSWORD_TRIES = 3;
+export declare const ACCOUNT_PASSWORD_WINDOW_MS = 60000;
+/** Run `work` with every password check inside it counted against `source`. */
+export declare const withPasswordSource: <T>(source: string, work: () => T) => T;
+/** Where the password being checked now came from (LOCAL_SOURCE outside a request). */
+export declare const currentPasswordSource: () => string;
+/** Set only after the server validates a browser session, never from submitted form fields. */
+export declare const provenPasswordAccount: AsyncLocalStorage<{
+    name: string;
+    generation: number;
+} | null>;
 export declare class PasswordGuard {
     readonly policy: GuardPolicy;
-    private readonly accounts;
+    private readonly secret;
+    private readonly sources;
+    private readonly slowdowns;
+    private nextPruneAt;
     /** Told once per lock: the account (as typed), and for how long. */
     onLock: ((account: string, lockMs: number) => void) | null;
     constructor(policy?: GuardPolicy);
     private static key;
-    /** Milliseconds this account stays locked (0: it may try). */
-    lockedFor(account: string, now: number): number;
-    failed(account: string, now: number): void;
-    succeeded(account: string): void;
+    private static pair;
+    /** Prune by the supplied time, even below capacity; retain a lock's escalation history for a day. */
+    private prune;
+    /** Source-local snapshot for existing callers. Authentication must use preflight to spend the shared budget. */
+    lockedFor(account: string, now: number, source?: string): number;
+    /** Reserve one password check, or return its wait. No password derivation may precede this call. */
+    preflight(account: string, now: number, source?: string, proven?: boolean): number;
+    /** A wrong password; only a database lookup may establish `exists`. */
+    failed(account: string, now: number, source?: string, exists?: boolean): void;
+    /** The right password clears individually tracked state; shared overflow buckets must expire by time. */
+    succeeded(account: string, source?: string): void;
+    /** Individually tracked source-and-name entries (at most TRACKED), excluding fixed shared overflow buckets. */
+    get size(): number;
 }
 /** The guard for one database (a store): every password check against it counts. */
 export declare function passwordGuardOf(owner: object): PasswordGuard;
@@ -40,6 +65,6 @@ export declare class SourceBudget {
     private readonly sources;
     constructor(tries?: number, windowMs?: number);
     /** Milliseconds until this address may try again (0: it may). */
-    waitFor(source: string, now: number): number;
-    failed(source: string, now: number): void;
+    waitFor(address: string, now: number): number;
+    failed(address: string, now: number): void;
 }

package/dist/sign-in-guard.js

@@ -1,39 +1,161 @@
-export const DEFAULT_GUARD_POLICY = { failuresBeforeLock: 5, firstLockMs: 15 * 60_000, maxLockMs: 24 * 60 * 60_000 };
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHmac, randomBytes } from "node:crypto";
+import { sourceKey } from "./source-key.js";
+export const DEFAULT_GUARD_POLICY = { failuresBeforeLock: 5, firstLockMs: 15 * 60_000, maxLockMs: 24 * 60 * 60_000, firstSlowMs: 60_000 };
 const TRACKED = 10_000;
+/** Default/loopback source for callers without an explicit native CLI context. */
+export const LOCAL_SOURCE = "local";
+/** Native CLI only: no HTTP peer or forwarded header can select this source. */
+export const CLI_PASSWORD_SOURCE = "local-cli";
+export const ACCOUNT_PASSWORD_TRIES = 3;
+export const ACCOUNT_PASSWORD_WINDOW_MS = 60_000;
+const LOCAL_PEERS = new Set(["127.0.0.1", "::1"]);
+const passwordSource = new AsyncLocalStorage();
+/** Run `work` with every password check inside it counted against `source`. */
+export const withPasswordSource = (source, work) => passwordSource.run(source, work);
+/** Where the password being checked now came from (LOCAL_SOURCE outside a request). */
+export const currentPasswordSource = () => passwordSource.getStore() ?? LOCAL_SOURCE;
+/** Set only after the server validates a browser session, never from submitted form fields. */
+export const provenPasswordAccount = new AsyncLocalStorage();
+/**
+ * Keep the first TRACKED live keys exactly; further keys share TRACKED overflow buckets. Hashes use the guard's
+ * private secret, so callers cannot choose collisions. Neither tier evicts live state. Overflow never mutates the
+ * exact tier, and cannot move into a freed exact slot until all overflow state expires: moving would reset budgets.
+ * A success may clear its exact record, but never a shared bucket (which could also hold another name's failures).
+ */
+class KeyedGuardState {
+    secret;
+    domain;
+    entries = new Map();
+    overflow = new Map();
+    constructor(secret, domain) {
+        this.secret = secret;
+        this.domain = domain;
+    }
+    hash(key) { return createHmac("sha256", this.secret).update(this.domain).update("\0").update(key).digest("hex"); }
+    bucket(hash) { return parseInt(hash.slice(0, 8), 16) % TRACKED; }
+    get(key) {
+        const hash = this.hash(key);
+        return this.entries.get(hash) ?? this.overflow.get(this.bucket(hash));
+    }
+    retain(key, create) {
+        const hash = this.hash(key), kept = this.entries.get(hash);
+        if (kept !== undefined)
+            return kept;
+        if (this.overflow.size === 0 && this.entries.size < TRACKED) {
+            const entry = create();
+            this.entries.set(hash, entry);
+            return entry;
+        }
+        const bucket = this.bucket(hash), shared = this.overflow.get(bucket);
+        if (shared !== undefined)
+            return shared;
+        const entry = create();
+        this.overflow.set(bucket, entry);
+        return entry;
+    }
+    clear(key) { this.entries.delete(this.hash(key)); }
+    prune(now, lifetime) {
+        let next = Infinity;
+        const pruneEntries = (entries) => {
+            for (const [key, entry] of entries) {
+                const expires = entry.lastAt + lifetime;
+                if (expires <= now)
+                    entries.delete(key);
+                else
+                    next = Math.min(next, expires);
+            }
+        };
+        pruneEntries(this.entries);
+        pruneEntries(this.overflow);
+        return next;
+    }
+    /** Individual source/name records; shared overflow storage has its own fixed TRACKED-bucket bound. */
+    get size() { return this.entries.size; }
+}
 export class PasswordGuard {
     policy;
-    accounts = new Map();
+    secret = randomBytes(32);
+    sources = new KeyedGuardState(this.secret, "source/name");
+    slowdowns = new KeyedGuardState(this.secret, "name");
+    nextPruneAt = Infinity;
     /** Told once per lock: the account (as typed), and for how long. */
     onLock = null;
     constructor(policy = DEFAULT_GUARD_POLICY) {
         this.policy = policy;
     }
     static key(account) { return account.trim().toLowerCase().slice(0, 64); }
-    /** Milliseconds this account stays locked (0: it may try). */
-    lockedFor(account, now) {
-        const state = this.accounts.get(PasswordGuard.key(account));
-        return state === undefined ? 0 : Math.max(0, state.lockedUntil - now);
+    static pair(account, source) {
+        const key = sourceKey(source);
+        return `${LOCAL_PEERS.has(key) ? LOCAL_SOURCE : key}\u0000${PasswordGuard.key(account)}`;
+    }
+    /** Prune by the supplied time, even below capacity; retain a lock's escalation history for a day. */
+    prune(now) {
+        if (now < this.nextPruneAt)
+            return;
+        this.nextPruneAt = Math.min(this.sources.prune(now, this.policy.maxLockMs), this.slowdowns.prune(now, this.policy.maxLockMs));
     }
-    failed(account, now) {
+    /** Source-local snapshot for existing callers. Authentication must use preflight to spend the shared budget. */
+    lockedFor(account, now, source = currentPasswordSource()) {
+        this.prune(now);
+        const pair = PasswordGuard.pair(account, source);
+        const tries = this.sources.get(pair);
+        if (tries === undefined)
+            return 0;
+        const slowdown = this.slowdowns.get(PasswordGuard.key(account));
+        // Legacy observation only: account existence never affects authentication or state retention.
+        return Math.max(0, tries.lockedUntil - now, slowdown?.observedAccount === true ? slowdown.until - now : 0);
+    }
+    /** Reserve one password check, or return its wait. No password derivation may precede this call. */
+    preflight(account, now, source = currentPasswordSource(), proven = false) {
+        this.prune(now);
+        const tries = this.sources.get(PasswordGuard.pair(account, source));
         const key = PasswordGuard.key(account);
-        const state = this.accounts.get(key) ?? { failures: 0, lockedUntil: 0, locks: 0 };
-        this.accounts.delete(key);
-        state.failures += 1;
-        if (state.failures >= this.policy.failuresBeforeLock) {
-            const lockMs = Math.min(this.policy.maxLockMs, this.policy.firstLockMs * 2 ** state.locks);
-            state.lockedUntil = now + lockMs;
-            state.locks += 1;
-            state.failures = 0;
+        const slowdown = this.slowdowns.get(key);
+        const sourceWait = Math.max(0, (tries?.lockedUntil ?? 0) - now, tries === undefined ? 0 : (slowdown?.until ?? 0) - now);
+        if (sourceWait > 0)
+            return sourceWait;
+        if (proven || slowdown === undefined || slowdown.until <= now)
+            return 0;
+        slowdown.admissions = slowdown.admissions.filter(at => at > now - ACCOUNT_PASSWORD_WINDOW_MS);
+        if (slowdown.admissions.length >= ACCOUNT_PASSWORD_TRIES) {
+            return slowdown.admissions[0] + ACCOUNT_PASSWORD_WINDOW_MS - now;
+        }
+        slowdown.admissions.push(now);
+        return 0;
+    }
+    /** A wrong password; only a database lookup may establish `exists`. */
+    failed(account, now, source = currentPasswordSource(), exists = false) {
+        this.prune(now);
+        const pair = PasswordGuard.pair(account, source);
+        const tries = this.sources.retain(pair, () => ({ failures: 0, lockedUntil: 0, locks: 0, lastAt: now }));
+        tries.failures += 1;
+        tries.lastAt = now;
+        this.nextPruneAt = Math.min(this.nextPruneAt, now + this.policy.maxLockMs);
+        if (tries.failures >= this.policy.failuresBeforeLock) {
+            const lockMs = Math.min(this.policy.maxLockMs, this.policy.firstLockMs * 2 ** tries.locks);
+            tries.lockedUntil = now + lockMs;
+            tries.locks += 1;
+            tries.failures = 0;
             this.onLock?.(account.trim().slice(0, 64), lockMs);
         }
-        this.accounts.set(key, state);
-        // Bounded: the oldest tracked names go first.
-        while (this.accounts.size > TRACKED)
-            this.accounts.delete(this.accounts.keys().next().value);
+        const key = PasswordGuard.key(account);
+        const slowdown = this.slowdowns.retain(key, () => ({ failures: 0, until: 0, lastAt: now, admissions: [], observedAccount: false }));
+        slowdown.observedAccount = exists;
+        slowdown.failures += 1;
+        slowdown.lastAt = now;
+        const over = slowdown.failures - this.policy.failuresBeforeLock;
+        if (over >= 0)
+            slowdown.until = now + Math.min(this.policy.maxLockMs, this.policy.firstSlowMs * 2 ** Math.min(over, 32));
     }
-    succeeded(account) {
-        this.accounts.delete(PasswordGuard.key(account));
+    /** The right password clears individually tracked state; shared overflow buckets must expire by time. */
+    succeeded(account, source = currentPasswordSource()) {
+        const pair = PasswordGuard.pair(account, source);
+        this.sources.clear(pair);
+        this.slowdowns.clear(PasswordGuard.key(account));
     }
+    /** Individually tracked source-and-name entries (at most TRACKED), excluding fixed shared overflow buckets. */
+    get size() { return this.sources.size; }
 }
 const guards = new WeakMap();
 /** The guard for one database (a store): every password check against it counts. */
@@ -59,11 +181,12 @@ export class SourceBudget {
         this.windowMs = windowMs;
     }
     /** Milliseconds until this address may try again (0: it may). */
-    waitFor(source, now) {
-        const recent = (this.sources.get(source) ?? []).filter(at => now - at < this.windowMs);
+    waitFor(address, now) {
+        const recent = (this.sources.get(sourceKey(address)) ?? []).filter(at => now - at < this.windowMs);
         return recent.length < this.tries ? 0 : this.windowMs - (now - recent[0]);
     }
-    failed(source, now) {
+    failed(address, now) {
+        const source = sourceKey(address);
         const recent = (this.sources.get(source) ?? []).filter(at => now - at < this.windowMs);
         recent.push(now);
         this.sources.delete(source);

package/dist/source-key.d.ts

@@ -0,0 +1,2 @@
+/** The budget key for one address, as described above. */
+export declare function sourceKey(source: string): string;

package/dist/source-key.js

@@ -0,0 +1,49 @@
+/**
+ * The key a per-source budget counts under. One IPv6 subscriber is usually handed a whole /64, so keying by the full
+ * address would give one caller 2^64 fresh budgets: a native IPv6 address counts as its /64 (`2001:db8:1:2::/64`),
+ * however it is spelled. IPv4 stays exact, and an IPv4-mapped IPv6 address (`::ffff:203.0.113.5`) is that IPv4 address.
+ * `::1` stays itself, so this computer is never pooled with anything else. The trusted proxy's `fwd:` marker is kept,
+ * and anything that isn't an address ("unknown", a tenant id) is returned unchanged.
+ */
+const IPV4 = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/** The eight 16-bit groups of an IPv6 address (brackets and a zone ignored), or null when it isn't one. */
+function ipv6Groups(text) {
+    let bare = text.trim().replace(/^\[(.*)\]$/, "$1").replace(/%.*$/, "").toLowerCase();
+    if (!bare.includes(":") || !/^[0-9a-f:.]+$/.test(bare))
+        return null;
+    // An embedded IPv4 tail is two groups.
+    const tail = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(bare);
+    if (tail !== null) {
+        if (!IPV4.test(tail[2]))
+            return null;
+        const [a, b, c, d] = tail[2].split(".").map(Number);
+        bare = `${tail[1]}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
+    }
+    const halves = bare.split("::");
+    if (halves.length > 2)
+        return null;
+    const part = (one) => one === "" ? [] : one.split(":").every(group => /^[0-9a-f]{1,4}$/.test(group)) ? one.split(":") : null;
+    const head = part(halves[0]), rest = halves.length === 2 ? part(halves[1]) : [];
+    if (head === null || rest === null)
+        return null;
+    const missing = 8 - head.length - rest.length;
+    if (halves.length === 2 ? missing < 1 : missing !== 0)
+        return null;
+    return [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...rest].map(group => parseInt(group, 16));
+}
+/** The budget key for one address, as described above. */
+export function sourceKey(source) {
+    if (source.startsWith("fwd:"))
+        return `fwd:${sourceKey(source.slice(4))}`;
+    if (IPV4.test(source))
+        return source;
+    const groups = ipv6Groups(source);
+    if (groups === null)
+        return source;
+    if (groups.slice(0, 5).every(group => group === 0) && groups[5] === 0xffff) {
+        return `${groups[6] >> 8}.${groups[6] & 0xff}.${groups[7] >> 8}.${groups[7] & 0xff}`;
+    }
+    if (groups.slice(0, 7).every(group => group === 0) && groups[7] === 1)
+        return "::1";
+    return `${groups.slice(0, 4).map(group => group.toString(16)).join(":")}::/64`;
+}

package/dist/store.d.ts

@@ -152,7 +152,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 113;
+export declare const SCHEMA_VERSION = 114;
 /**
  * The migrations `toolroll update` may carry a database through in place: each
  * one only adds (a table, a column, an accepted value) and leaves every saved row
@@ -166,6 +166,11 @@ export declare const SCHEMA_VERSION = 113;
  * api_token columns (project limit, rotation); existing tokens read as before.
  * v112 only adds the two request-budget tables.
  * v113 adds MCP sign-in tables and API-token purpose metadata.
+ * v114 is the one declared exception to "only adds", and the rehearsal checks
+ * it as such: a settled run's exited process witnesses become one summary row
+ * (rows removed equal the witnesses summarized), and notification drops its
+ * delivery columns only after every value moves into one legacy receipt per row
+ * (rows and ids carried whole; legacy receipts added equal the rows carried).
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
@@ -1030,19 +1035,15 @@ export type Notification = {
     subject: string;
     body: string;
     createdAt: string;
-    attempts: number;
-    lastAttemptAt: string | null;
-    lastError: string | null;
-    deliveredAt: string | null;
-    receipt: string | null;
     /** The closed push attention class, or null = this fact never pushes. */
     pushClass: "decision" | "pick" | "merge" | "attention" | "progress" | null;
     /** The machine-minted console path a push may deep-link — never free text. */
     link: string | null;
     /**
      * When the fact stopped wanting a person — a decision answered, an incident
-     * resolved. Distinct from delivery, and it never deletes the row: receipts
-     * are the audit trail of what was actually sent.
+     * resolved. Distinct from delivery, and it never deletes the row: the
+     * per-destination receipts (notification_delivery) are the audit trail of
+     * what was actually sent.
      */
     resolvedAt: string | null;
     scope: "unknown" | "installation" | "project" | "task";
@@ -1051,6 +1052,14 @@ export type Notification = {
     taskId: string | null;
     run: number | null;
 };
+/** One notification's delivery state at one destination (notification_delivery). */
+export type NotificationReceipt = Notification & {
+    attempts: number;
+    lastAttemptAt: string | null;
+    lastError: string | null;
+    deliveredAt: string | null;
+    receipt: string | null;
+};
 export type TelegramDelivery = Notification & {
     destination: string;
     claimGeneration: number;
@@ -1868,6 +1877,9 @@ export declare function openStoreNoMigrate(file: string, options?: OpenOptions):
  * retries. Correction children (the same-session structured-output
  * repairs) are not attempts; they continue one. */
 export declare const REVIEW_ROOT_ATTEMPTS = 3;
+/** The receipt v114 keeps a notification's old single-destination delivery under. No sender claims it: every real
+ * destination is a kind and a 64-character hash, or a Telegram binding. */
+export declare const LEGACY_NOTIFICATION_DESTINATION = "legacy:single-destination";
 /** v34: artifact.kind admits 'report'. A table already rebuilt to the v38
  * shape (migrate() runs unconditionally on every open, including a fresh
  * database created straight at the current shape) is a DONE shape too —
@@ -2489,8 +2501,16 @@ export declare class Store {
         fresh?: number;
     }): LedgerChainReport;
     /** A checkpoint of the chain as it stands: its head, recorded here and handed back to be copied off the machine.
-     * Never over a chain that doesn't verify: that would vouch for what broke it. */
-    ledgerCheckpoint(by: string, now: Date): {
+     * Never over a chain that doesn't verify: that would vouch for what broke it. `automatic` (before a backup, after
+     * a monitoring delivery): at the verified head, or at `head` (one that was sent) once the walk reached it, only past
+     * the newest checkpoint (null otherwise), and with no ledger entry of its own, so a checkpoint never makes new
+     * activity for the next backup or delivery to checkpoint again. */
+    ledgerCheckpoint(by: string, now: Date, automatic?: {
+        head?: {
+            through: number;
+            hash: string;
+        };
+    }): {
         through: number;
         hash: string;
     } | {
@@ -4869,13 +4889,6 @@ export declare class Store {
     notificationById(id: number): Notification | null;
     notificationsAfter(id: number, limit?: number): Notification[];
     listNotifications(only?: "pending" | "all"): Notification[];
-    recordDelivery(id: number, outcome: {
-        ok: true;
-        receipt: string | null;
-    } | {
-        ok: false;
-        error: string;
-    }, now: Date): void;
     /**
      * Close a gap's notification episode. Called when its capability verifies:
      * the next failure is a *new* fact, and a dedupe key that suppressed it
@@ -7448,6 +7461,12 @@ export declare class Store {
      * every finished run is visited, a batch at a time. Never signals. */
     recordFinishedRunExits(now: Date, batch?: number): number;
     finishUnspawnedProcess(witness: number, now: Date): void;
+    /** Settled custody, compacted (v114; compactSettledRunProcesses): a finished run whose witnesses all exited keeps
+     * one summary row. A settled stop, an approver's settlement and a recovery compact their run at once; the worker's
+     * reconcile pass (recordFinishedRunExits) compacts every other settled run, including one that settled at run end. */
+    compactRunProcesses(now: Date, only?: number): number;
+    /** Whether a run's witnesses were compacted into its summary: they existed, and all exited. */
+    processesSummarized(runId: number): boolean;
     /** The reconcile road for a pid-less witness a crash or a thrown spawn
      * left behind: once its run has finished, no live child is tracked for it
      * here, every other witness of the run has exited and none of the run's
@@ -7739,24 +7758,8 @@ export declare class Store {
         error: string;
         retryAt?: string;
     }, now: Date): boolean;
-    /** Read receipts without changing the meaning of shell/webhook history. */
-    telegramDeliveries(binding: TelegramBinding): Notification[];
-    /**
-     * Claim pending notifications for one deliverer. Two deliverers — the
-     * bridge and `outbox deliver` — select-then-send-then-record, and without
-     * a claim both can send the same row in the gap. The claim is a short
-     * lease on the act of sending; a deliverer that dies mid-send leaves rows
-     * that unclaim themselves by expiry.
-     */
-    claimDeliveries(owner: string, ttlMs: number, now: Date, only?: "all" | "urgent"): Notification[];
-    /** Finalize only what this owner still holds. A lapsed claim writes nothing. */
-    finalizeDelivery(id: number, owner: string, outcome: {
-        ok: true;
-        receipt: string | null;
-    } | {
-        ok: false;
-        error: string;
-    }, now: Date): boolean;
+    /** The notifications this pairing holds, each with its delivery state there. */
+    telegramDeliveries(binding: TelegramBinding): NotificationReceipt[];
     /** The digest cadence: null everyMs = off. */
     telegramDigest(): TelegramDigest;
     /** Set (or clear, with null) the cadence. Turning it on starts the
@@ -7879,14 +7882,6 @@ export declare class Store {
     /** The message now showing this card, and what it shows. */
     setChatCardMessage(id: number, message: string, digest: string): void;
     markTelegramDigestSent(now: Date): void;
-    /** Every batched row finalized delivered AND the anchor moved, in ONE
-     * transaction (v4 review, finding 5): a digest is either recorded whole
-     * or not at all. Rows whose claim lapsed meanwhile are reported, not
-     * silently skipped. */
-    finalizeDigest(ids: readonly number[], owner: string, receipt: string | null, now: Date): {
-        finalized: number;
-        lapsed: number;
-    };
     /** Routine rows waiting for the next digest: pending, and not urgent.
      * A row the live pairing delivered, or skipped as pre-pairing history,
      * is settled and not waiting. */