toolroll 0.9.53 → 0.9.54

package/dist/contracts/teams-callback.js

@@ -5,8 +5,9 @@
  * is answered with why (`value.so: must be a Toolroll button token`), and nothing is done.
  */
 import { z } from "zod";
+import { CHAT_BUTTON_TOKEN } from "./chat-content.js";
 import { parseContract } from "./contract.js";
-export const teamsSubmitSchema = z.object({ so: z.string().regex(/^[a-f0-9]{32}$/, { error: "must be a Toolroll button token" }) });
+export const teamsSubmitSchema = z.object({ so: z.string().regex(CHAT_BUTTON_TOKEN, { error: "must be a Toolroll button token" }) });
 /** A submit's one-time token. */
 export function readTeamsSubmit(value) {
     const read = parseContract(z.object({ value: teamsSubmitSchema }), { value });

package/dist/discord-chat.js

@@ -190,17 +190,13 @@ export async function deliverDiscordPart(options) {
     if (!options.current() ||
         !state.owns(identity.installation, options.owner, now))
         return false;
-    const row = state
-        .prepare("SELECT p.* FROM chat_part p JOIN chat_event e ON e.id=p.event WHERE e.installation=? AND p.state='pending' AND (e.kind!='notice' OR ?=1) AND (p.next_at IS NULL OR p.next_at<=?) ORDER BY p.id LIMIT 1")
-        .get(identity.installation, options.canNotify?.() === false ? 0 : 1, now.toISOString());
+    const row = state.nextPart(identity.installation, options.canNotify?.() !== false, now);
     if (!row)
         return false;
     const event = state.event(row.event), binding = event.binding === null ? null : state.bindingById(event.binding);
     if (!binding ||
         new Date(row.created).getTime() + 86_400_000 < now.getTime()) {
-        state
-            .prepare("UPDATE chat_part SET state='dropped',problem='Delivery expired or access changed; open the saved chat' WHERE id=?")
-            .run(row.id);
+        state.dropPart(row.id, "Delivery expired or access changed; open the saved chat");
         return true;
     }
     try {
@@ -214,16 +210,16 @@ export async function deliverDiscordPart(options) {
             throw new DiscordError("Connected projects changed");
         let text = content.text, buttons = [], file;
         if (content.image && content.shot && resultShotsPruned(options.evidenceRoot, content.image.run)) {
-            state.prepare("UPDATE chat_part SET state='dropped',problem='Removed by retention' WHERE id=?").run(row.id);
+            state.dropPart(row.id, "Removed by retention");
             return true;
         }
         // A screenshot sent with a result replies to that result's message once it is placed, and waits until then.
-        const result = content.shot?.follows == null ? undefined : state.prepare("SELECT message,state,next_at FROM chat_part WHERE id=?").get(content.shot.follows);
-        if (result !== undefined && !discordId(result["message"]) && result["state"] === "pending") {
-            state.prepare("UPDATE chat_part SET next_at=? WHERE id=?").run(shotWaitsUntil(result["next_at"], now), row.id);
+        const result = content.shot?.follows == null ? null : state.part(content.shot.follows);
+        if (result !== null && !discordId(result.message) && result.state === "pending") {
+            state.holdPart(row.id, shotWaitsUntil(result.next_at, now));
             return true;
         }
-        const follows = result?.["message"];
+        const follows = result?.message;
         const thread = discordId(follows) ? String(follows) : event.thread;
         if (content.image) {
             const image = verifyResultImage(store, options.evidenceRoot, repos, content.image);
@@ -260,8 +256,7 @@ export async function deliverDiscordPart(options) {
                     preview.text.length <= 3400 &&
                     discordPlain(text).length <= 3900) {
                     buttons = state
-                        .prepare("SELECT token,phase FROM chat_action WHERE part=? AND consumed IS NULL AND expires>? ORDER BY rowid")
-                        .all(row.id, now.toISOString())
+                        .partTokens(row.id, now)
                         .map((action) => ({
                         type: 2,
                         style: action.phase === "yes" ? 4 : action.phase === "confirm" ? 1 : 2,
@@ -317,6 +312,10 @@ export async function deliverDiscordPart(options) {
                         custom_id: `so_${one.token}`,
                     }))
                     : []),
+                // A result's, plan's, failure's or pull request's own buttons (chat-decide.ts): its acts, then its links.
+                ...(content.decide?.rows.flat() ?? []).flatMap((one, index) => "token" in one
+                    ? [{ type: 2, style: index === 0 ? 1 : 2, label: one.label.slice(0, 80), custom_id: `so_${one.token}` }]
+                    : link(options.origin(), one.link)),
                 ...link(options.origin(), content.link),
                 ...(content.also ?? []).flatMap(one => link(options.origin(), one)),
             ];
@@ -355,13 +354,7 @@ export async function deliverDiscordPart(options) {
                     // Preserve the original remote attachment; never upload it again on an edit.
                     file = undefined;
                 }
-                state
-                    .prepare("UPDATE chat_part SET message=?,uploaded=? WHERE id=?")
-                    .run(target, content.image &&
-                    Array.isArray(found.attachments) &&
-                    found.attachments.length
-                    ? 1
-                    : 0, row.id);
+                state.setPartFile(row.id, null, Boolean(content.image && Array.isArray(found.attachments) && found.attachments.length), target);
             }
         }
         await channelAccess(shared, binding, session?.ceilingDigest);
@@ -396,17 +389,13 @@ export async function deliverDiscordPart(options) {
                     !answer.attachments.some((v) => object(v).filename === file.name &&
                         Number(object(v).size) === file.bytes.length))))
             throw new DiscordError("Discord did not confirm the message and file identity", 15_000, true);
-        state
-            .prepare("UPDATE chat_part SET state='sent',message=?,attempts=attempts+1,problem=NULL,next_at=NULL WHERE id=?")
-            .run(answer.id, row.id);
-        state
-            .prepare("UPDATE chat_runtime SET problem=NULL WHERE installation=? AND owner=?")
-            .run(identity.installation, options.owner);
+        state.partSent(row.id, String(answer.id), options.clock?.() ?? new Date());
+        state.setProblem(identity.installation, options.owner, null);
         return true;
     }
     catch (error) {
         if (error instanceof ChatDeliveryError && error.permanent) {
-            state.prepare("UPDATE chat_part SET state='dropped',next_at=NULL,problem=? WHERE id=?").run(error.message, row.id);
+            state.dropPart(row.id, error.message);
             return true;
         }
         // No permission to attach files here: one plain line instead of the result's screenshots.
@@ -420,18 +409,10 @@ export async function deliverDiscordPart(options) {
             : new DiscordError("Discord delivery is waiting to retry", 15_000, true);
         const until = new Date((options.clock?.() ?? new Date()).getTime() +
             Math.max(problem.retryMs, [5000, 15000, 60000, 300000][Math.min(row.attempts, 3)])).toISOString();
-        state
-            .prepare("UPDATE chat_part SET attempts=attempts+1,uncertain=uncertain+?,next_at=?,problem=? WHERE id=?")
-            .run(problem.uncertain ? 1 : 0, until, problem.message, row.id);
-        state
-            .prepare("UPDATE chat_runtime SET problem=? WHERE installation=? AND owner=?")
-            .run(problem.code === "ratelimited"
-            ? "Discord asked us to wait. Saved replies will retry."
-            : problem.message, identity.installation, options.owner);
+        state.partFailed(row.id, { problem: problem.message, until, uncertain: problem.uncertain });
+        state.setProblem(identity.installation, options.owner, problem.code === "ratelimited" ? "Discord asked us to wait. Saved replies will retry." : problem.message);
         if (problem.code === "ratelimited")
-            state
-                .prepare("UPDATE chat_runtime SET retry_at=? WHERE installation=?")
-                .run(until, identity.installation);
+            state.deferUntil(identity.installation, until);
         return true;
     }
 }

package/dist/discord-settings.js

@@ -9,14 +9,10 @@ const escape = (text) => text
     .replaceAll("'", "'");
 export function discordSettingsHtml(store, dir, csrf, options = {}) {
     const credentials = loadDiscordCredentials(dir), state = new ChatState(store, "discord"), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
-    const runtime = credentials
-        ? state.db
-            .prepare("SELECT connected,problem,lease_until FROM discord_runtime WHERE installation=?")
-            .get(credentials.installation)
-        : null;
+    const runtime = credentials ? state.runtime(credentials.installation) : null;
     const now = options.now ?? new Date(), live = runtime &&
-        typeof runtime.lease_until === "string" &&
-        runtime.lease_until > now.toISOString() &&
+        runtime.leaseUntil !== null &&
+        runtime.leaseUntil > now.toISOString() &&
         runtime.connected;
     const hidden = `<input type="hidden" name="csrf" value="${escape(csrf)}">`;
     const password = '<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>';
@@ -44,12 +40,7 @@ export function discordSettingsHtml(store, dir, csrf, options = {}) {
                     '<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/discord">Check connection</a>';
         }
         else if (binding && state.live(binding)) {
-            const pending = Number(state.db
-                .prepare("SELECT count(*) n FROM discord_part p JOIN discord_event e ON e.id=p.event WHERE e.binding=? AND p.state='pending'")
-                .get(binding.id)?.n ?? 0);
-            const failed = Number(state.db
-                .prepare("SELECT count(*) n FROM discord_part p JOIN discord_event e ON e.id=p.event WHERE e.binding=? AND p.state='dropped'")
-                .get(binding.id)?.n ?? 0);
+            const { pending, dropped: failed } = state.partCounts(binding.id);
             content +=
                 `<p>Your Discord account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>` +
                     "<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>" +

package/dist/discord.js

@@ -37,9 +37,7 @@ export async function followDiscord(options) {
                 current.botToken === credentials.botToken &&
                 state.owns(credentials.installation, owner));
         };
-        const problem = (message) => state
-            .prepare("UPDATE chat_runtime SET problem=? WHERE installation=? AND owner=?")
-            .run(message, credentials.installation, owner);
+        const problem = (message) => state.setProblem(credentials.installation, owner, message);
         const api = discordApi(credentials.botToken);
         const client = new Client({
             // Guild messages and their content are needed for rooms; the Message
@@ -63,9 +61,7 @@ export async function followDiscord(options) {
             if (!same() || !validated)
                 return;
             connected = true;
-            state
-                .prepare("UPDATE chat_runtime SET connected=?,problem=NULL WHERE installation=? AND owner=?")
-                .run(new Date().toISOString(), credentials.installation, owner);
+            state.setConnected(credentials.installation, owner, new Date());
         };
         client.on("shardReady", online);
         client.on("shardResume", online);
@@ -133,11 +129,7 @@ export async function followDiscord(options) {
         try {
             await client.login(credentials.botToken);
             while (same()) {
-                const retry = state
-                    .prepare("SELECT retry_at FROM chat_runtime WHERE installation=?")
-                    .get(credentials.installation)?.retry_at;
-                if (!connected ||
-                    (typeof retry === "string" && retry > new Date().toISOString())) {
+                if (!connected || state.retryAt(credentials.installation) > new Date().toISOString()) {
                     await pause(1000);
                     continue;
                 }
@@ -160,9 +152,7 @@ export async function followDiscord(options) {
             alive = false;
             options.signal.removeEventListener("abort", stop);
             await client.destroy().catch(() => { });
-            state
-                .prepare("UPDATE chat_runtime SET owner=NULL,lease_until=NULL,connected=NULL WHERE installation=? AND owner=?")
-                .run(credentials.installation, owner);
+            state.stop(credentials.installation, owner);
         }
         await pause(5000);
     }

package/dist/export.js

@@ -29,20 +29,20 @@ import { readEmailSettings } from "./email-settings.js";
 import { SUBSCRIPTION_CAPABLE, readAuthMode } from "./keys.js";
 export const EXPORT_FORMAT = "standing-orders/export/v1";
 /** Tables that hold nothing but secrets or short-lived sign-in material, and derived search indexes. */
-const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "telegram_pairing", "slack_pair", "discord_pair", "teams_pair", "oauth_code", "oauth_refresh"]);
+const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "chat_pair", "oauth_code", "oauth_refresh"]);
 const DERIVED_TABLE = /^(sqlite_|memory_search)/;
 /** Columns that hold a secret (or what stands in for one): never exported. */
 const SECRET_COLUMNS = new Set([
     "api_token.secret_hash", "lead_credential.secret_hash", "approver.credential_hash", "coordinator_credential.credential_hash", "runner.credential_hash", "invite.token_hash",
     "flow_trigger.hook_hash", "push_subscription.endpoint", "push_subscription.p256dh", "push_subscription.auth",
-    "chat_turn.credential_key", "mate_session.credential_key", "mate_turn.credential_key", "bridge_lease.push_url", "workflow_preview.token",
+    "chat_turn.credential_key", "mate_session.credential_key", "mate_turn.credential_key", "chat_runtime.push_url", "workflow_preview.token",
     "quota.credential_fp", "oauth_grant.renew_hash", "oauth_client.source_hash",
 ]);
 /** A column named like this holds a secret unless it is reviewed below; an unreviewed one is dropped. */
 const SECRET_NAME = /hash|secret|token|passw|cookie|csrf|credential|p256dh|^auth$|key|nonce|endpoint|url/i;
 /** Reviewed: named like a secret, but it isn't one (a seal, a digest, a lookup name, an address with no key). */
 const REVIEWED_COLUMNS = new Set([
-    "artifact.key", "budget.scope_key", "mate_thread.scope_key", "diff_comment.source_key", "discord_meta.key", "slack_meta.key", "teams_meta.key",
+    "artifact.key", "budget.scope_key", "mate_thread.scope_key", "diff_comment.source_key", "chat_meta.key",
     "flow_trigger_event.key", "installation_fact.key", "mcp_idempotency.key", "memory_gap.key", "mutation.idempotency_key", "notification.dedupe_key",
     "service_cursor.key", "ledger_checkpoint.hash", "ledger_seal.hash", "merge_intent.grant_terms_hash", "plan_revision.parent_hash",
     "publication.body_hash", "publication.pr_url", "team_message.payload_hash", "team_request.payload_hash", "backend_grant.credential_scope",
@@ -55,7 +55,7 @@ export function categoryOf(table) {
         [/^(action_ledger|ledger_seal|ledger_checkpoint|sync_ledger)$/, "ledger"],
         [/^teammate/, "teammates"],
         [/^(flow|workflow_)/, "flows"],
-        [/^(chat_|mate_|team_|telegram_|slack_|discord_|teams_|notification|push_|bridge_lease)/, "chats"],
+        [/^(chat_|mate_|team_|notification|push_)/, "chats"],
         [/^(approver|api_token|lead_credential|invite|sso_identity|coordinator_|oauth_)/, "people"],
         [/^(run|artifact|claim|worktree$|execution_slot|criterion_review|diff_comment|proof_|review_request|repair_chain|incident|publication$|merge_|side_spend|knowledge_snapshot|learning_snapshot|skill_snapshot)/, "runs"],
         [/^(task|hold$|plan_|scope_|tool_seal|decision|external_|skill_test)/, "tasks"],

package/dist/mate-tools.js

@@ -494,7 +494,7 @@ const MATE_TOOL_HANDLERS = {
         description: "When the owner asks to approve one thing (a plan waiting on them, or a flow card waiting at a Person decides step), send that item's own Approve and Send back buttons to their paired chat right away. Their tap there is the approval (two taps, as on any decision card); you never approve. Give task for a plan, or card for a flow card (its number from get_flows). When it can't be approved in chat, the answer says why: say that in one line and open show_control approval (a plan) or the flow, never that you can't approve.",
         handle: (ctx, args) => {
             const pairedHere = ctx.channel === "telegram";
-            const paired = ctx.store.handle.prepare("SELECT 1 FROM telegram_binding WHERE approver = ? AND approver_generation = ? AND revoked_at IS NULL LIMIT 1")
+            const paired = ctx.store.handle.prepare("SELECT 1 FROM chat_binding WHERE provider = 'telegram' AND approver = ? AND generation = ? AND revoked IS NULL LIMIT 1")
                 .get(ctx.who.name, ctx.store.accountOf(ctx.who.name)?.generation ?? -1) !== undefined;
             const stamp = ctx.now.getTime();
             if (args["card"] !== undefined) {
@@ -520,7 +520,8 @@ const MATE_TOOL_HANDLERS = {
             if (task === null || admittedRef(ctx, task) === null)
                 return notFound();
             const current = ctx.store.taskFamilyOf(task, ctx.who.repos, false)?.current.id ?? task;
-            const plan = planInChat(ctx.store, current, ctx.who.name, ctx.now, ctx.evidenceRoot);
+            // Its buttons go to the paired Telegram chat (pairedHere), so it is that chat's authority that counts.
+            const plan = planInChat(ctx.store, current, ctx.who.name, ctx.now, "telegram", ctx.evidenceRoot);
             if (!plan.ok)
                 return { ok: true, body: { offered: false, task: current, why: plan.why, control: "approval" } };
             if (!pairedHere || !paired)

package/dist/modes.d.ts

@@ -13,6 +13,7 @@
  * owns the transactions; the tick owns the rails; serve owns the
  * ceremony screens.
  */
+import { type ChatProvider } from "./contracts/chat-tables.js";
 export type ModeName = "standard" | "hands-off";
 export type ModeTerms = {
     name: ModeName;
@@ -64,12 +65,16 @@ export type ModeTerms = {
      * `repairAuto` is also true — a mode may sign a cap without signing the
      * authority, but never the reverse. */
     repairMaxAttempts: number;
-    /** Explicit opt-in: the signer's paired Telegram chat may approve this
+    /** Explicit opt-in: the signer's paired chat may approve this
      * repository's plans and merge its ready pull requests with two taps,
      * for the mode's lifetime. A plan that widens permissions, exceeds the
      * per-attempt budget or touches protected paths still opens Toolroll.
      * Legacy modes read FALSE — never inherited, only freshly signed. */
     chatApprove: boolean;
+    /** The chat apps `chatApprove` names, signed with it. Absent on a mode signed before chat apps other than Telegram
+     * could approve: its words said "your paired Telegram chat", so it stays Telegram only (chatApproveChatsOf). A wider
+     * grant is only ever a fresh signature naming the apps. */
+    chatApproveChats?: readonly ChatProvider[];
     absoluteExpiry: string;
 };
 export declare const MODE_MAX_DAYS = 7;
@@ -82,6 +87,13 @@ export declare function modeTermsJson(terms: ModeTerms): string;
 export declare function modeDigestOf(terms: ModeTerms): string;
 /** Strict rehydration — anything unexpected is null, never a guess. */
 export declare function modeTermsFromJson(json: string | null): ModeTerms | null;
+/** The chat apps a mode lets its signer approve from: none without chatApprove; Telegram alone for a grant signed
+ * before it named its apps (that is what its words said); otherwise exactly the apps it names. */
+export declare function chatApproveChatsOf(terms: Pick<ModeTerms, "chatApprove" | "chatApproveChats">): readonly ChatProvider[];
+/** What a new chatApprove signature names: every chat app, said in its words. */
+export declare const CHAT_APPROVE_ALL: readonly ChatProvider[];
+/** "Telegram", "Telegram or Slack", "Telegram, Slack, Discord or Teams". */
+export declare const chatNames: (chats: readonly ChatProvider[]) => string;
 /** Every term in words — what the ceremony renders and the password
  * signs. The reversal sentence is verbatim from the chain (C1). */
 export declare function modeWords(terms: ModeTerms): string[];

package/dist/modes.js

@@ -14,6 +14,7 @@
  * ceremony screens.
  */
 import { createHash } from "node:crypto";
+import { CHAT_PROVIDERS, isChatProvider } from "./contracts/chat-tables.js";
 export const MODE_MAX_DAYS = 7;
 /** The presets are STARTING POINTS the ceremony renders in full — the
  * signature always covers the resolved terms, never a label. */
@@ -120,6 +121,10 @@ export function modeTermsFromJson(json) {
         (t["repairMaxAttempts"] === undefined ||
             (typeof t["repairMaxAttempts"] === "number" && Number.isInteger(t["repairMaxAttempts"]) && t["repairMaxAttempts"] >= 0 && t["repairMaxAttempts"] <= 3)) &&
         (t["chatApprove"] === undefined || typeof t["chatApprove"] === "boolean") &&
+        // chatApproveChats: absent (a Telegram-only grant, or none), or the apps a chatApprove term names, each once.
+        (t["chatApproveChats"] === undefined ||
+            (t["chatApprove"] === true && Array.isArray(t["chatApproveChats"]) && t["chatApproveChats"].length > 0 &&
+                t["chatApproveChats"].every(isChatProvider) && new Set(t["chatApproveChats"]).size === t["chatApproveChats"].length)) &&
         typeof t["absoluteExpiry"] === "string" &&
         !Number.isNaN(Date.parse(t["absoluteExpiry"]))) {
         return {
@@ -138,11 +143,22 @@ export function modeTermsFromJson(json) {
             repairAuto: t["repairAuto"] === true,
             repairMaxAttempts: typeof t["repairMaxAttempts"] === "number" ? t["repairMaxAttempts"] : 0,
             chatApprove: t["chatApprove"] === true,
+            ...(Array.isArray(t["chatApproveChats"]) ? { chatApproveChats: [...t["chatApproveChats"]] } : {}),
             absoluteExpiry: t["absoluteExpiry"],
         };
     }
     return null;
 }
+/** The chat apps a mode lets its signer approve from: none without chatApprove; Telegram alone for a grant signed
+ * before it named its apps (that is what its words said); otherwise exactly the apps it names. */
+export function chatApproveChatsOf(terms) {
+    return !terms.chatApprove ? [] : terms.chatApproveChats ?? ["telegram"];
+}
+/** What a new chatApprove signature names: every chat app, said in its words. */
+export const CHAT_APPROVE_ALL = CHAT_PROVIDERS;
+const CHAT_NAMES = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
+/** "Telegram", "Telegram or Slack", "Telegram, Slack, Discord or Teams". */
+export const chatNames = (chats) => chats.length <= 1 ? chats.map(one => CHAT_NAMES[one]).join("") : `${chats.slice(0, -1).map(one => CHAT_NAMES[one]).join(", ")} or ${CHAT_NAMES[chats[chats.length - 1]]}`;
 /** Every term in words — what the ceremony renders and the password
  * signs. The reversal sentence is verbatim from the chain (C1). */
 export function modeWords(terms) {
@@ -178,7 +194,7 @@ export function modeWords(terms) {
         ...(terms.repairAuto
             ? ["historical automatic repair grants are retained on record but no longer schedule work"] : []),
         ...(terms.chatApprove
-            ? ["your paired Telegram chat may approve this repository's plans and merge its ready pull requests, two taps each, without your password; a plan that widens permissions, exceeds the per-attempt cap above or touches protected paths still opens Toolroll"] : []),
+            ? [`your paired ${chatNames(chatApproveChatsOf(terms))} chat may approve this repository's plans and merge its ready pull requests, two taps each, without your password; a plan that widens permissions, exceeds the per-attempt cap above or touches protected paths still opens Toolroll`] : []),
         `everything above ends at ${terms.absoluteExpiry.slice(0, 16).replace("T", " ")} — revoking it earlier is one click, and every act it covered falls back to its own ceremony`,
     ];
 }

package/dist/notification-rows.d.ts

@@ -0,0 +1,30 @@
+/** Saved notifications, read and told apart without a store: the row readers, the lifecycle key and the predicates
+ * the store and the chat core (chat-messages.ts) share. A leaf: it imports types only. */
+import type { MateProposal, Notification, NotificationReceipt } from "./store.js";
+/** The one task a card is about: a task its confirmation created (a new
+ * task, a revision), else the task it names (and, for feedback on a result,
+ * that result). Null for a card about no single task. A pointer for
+ * replies, never an authority. */
+export declare function proposalTaskOf(proposal: MateProposal | null): {
+    task: string;
+    run: number | null;
+} | null;
+/** Every lifecycle dedupe key starts here: `life:<kind>:<identity>:<ordinal>`. */
+export declare const LIFECYCLE_KEY_PREFIX = "life:";
+/**
+ * Task lifecycle updates (Telegram task updates, 2026-09-16): the CLOSED
+ * vocabulary of routine progress facts the shared mutations record beside
+ * the change that made them true. None carries a push class — they are
+ * digest-eligible progress, never a page — and every one is project-bound
+ * through the task it names. A decision, incident, gap, stall, publication
+ * or merge page keeps its own producer; nothing here repeats one.
+ */
+export declare const LIFECYCLE_KINDS: readonly ["task-filed", "scope-approved", "approval-withdrawn", "task-held", "task-released", "task-queued", "task-requeued", "task-cancelled", "run-started", "run-phase", "check-progress", "run-finished", "run-stopping", "run-stopped", "run-resumed", "review-requested", "review-finished", "acceptance-evidence", "acceptance-ready"];
+export type LifecycleKind = (typeof LIFECYCLE_KINDS)[number];
+/** A progress fact, told apart by its durable key — never by display text. */
+export declare function isLifecycleNotification(row: Pick<Notification, "dedupeKey">): boolean;
+/** Only known progress producers can repaint a card. Decisions and urgent
+ * incidents keep their own alerts; a routine retry updates its saved attempt. */
+export declare function isTelegramProgressNotification(row: Pick<Notification, "dedupeKey" | "kind" | "pushClass" | "run">): boolean;
+export declare function readNotification(row: Record<string, unknown>): Notification;
+export declare function readNotificationReceipt(row: Record<string, unknown>): NotificationReceipt;

package/dist/notification-rows.js

@@ -0,0 +1,102 @@
+/** The one task a card is about: a task its confirmation created (a new
+ * task, a revision), else the task it names (and, for feedback on a result,
+ * that result). Null for a card about no single task. A pointer for
+ * replies, never an authority. */
+export function proposalTaskOf(proposal) {
+    if (proposal === null)
+        return null;
+    const named = typeof proposal.payload["task"] === "string" && proposal.payload["task"] !== "" ? proposal.payload["task"] : null;
+    const creates = proposal.kind === "task" || (proposal.kind === "review" && proposal.payload["operation"] === "revise");
+    const made = creates && proposal.state === "confirmed" ? proposal.outcome?.["taskId"] : undefined;
+    if (typeof made === "string" && made !== "" && made !== named)
+        return { task: made, run: null };
+    if (named === null)
+        return null;
+    const run = proposal.kind === "review" ? proposal.payload["run"] : null;
+    return { task: named, run: typeof run === "number" && Number.isSafeInteger(run) ? run : null };
+}
+/** Every lifecycle dedupe key starts here: `life:<kind>:<identity>:<ordinal>`. */
+export const LIFECYCLE_KEY_PREFIX = "life:";
+/**
+ * Task lifecycle updates (Telegram task updates, 2026-09-16): the CLOSED
+ * vocabulary of routine progress facts the shared mutations record beside
+ * the change that made them true. None carries a push class — they are
+ * digest-eligible progress, never a page — and every one is project-bound
+ * through the task it names. A decision, incident, gap, stall, publication
+ * or merge page keeps its own producer; nothing here repeats one.
+ */
+export const LIFECYCLE_KINDS = [
+    "task-filed",
+    "scope-approved",
+    "approval-withdrawn",
+    "task-held",
+    "task-released",
+    "task-queued",
+    "task-requeued",
+    "task-cancelled",
+    "run-started",
+    "run-phase",
+    "check-progress",
+    "run-finished",
+    "run-stopping",
+    "run-stopped",
+    "run-resumed",
+    "review-requested",
+    "review-finished",
+    "acceptance-evidence",
+    "acceptance-ready",
+];
+/** A progress fact, told apart by its durable key — never by display text. */
+export function isLifecycleNotification(row) {
+    return row.dedupeKey.startsWith(LIFECYCLE_KEY_PREFIX);
+}
+/** Only known progress producers can repaint a card. Decisions and urgent
+ * incidents keep their own alerts; a routine retry updates its saved attempt. */
+export function isTelegramProgressNotification(row) {
+    if (row.kind === "check-progress" && row.pushClass === "progress" && row.run !== null)
+        return isLifecycleNotification(row);
+    if (row.pushClass !== null)
+        return false;
+    if (row.kind === "build-failed" && row.run !== null && row.dedupeKey === `run:${row.run}:failed`)
+        return true;
+    // The owner's lead took the attempt on, or let it lapse (lead-voice.ts): its card repaints in place.
+    if ((row.kind === "lead-on-it" || row.kind === "lead-lapsed") && row.run !== null)
+        return true;
+    return isLifecycleNotification(row) &&
+        ["run-started", "run-phase", "run-finished", "review-requested", "review-finished", "run-stopping", "run-stopped", "run-resumed", "task-held", "task-released"].includes(row.kind);
+}
+export function readNotification(row) {
+    return {
+        id: Number(row["id"]),
+        recipient: row["recipient"] == null ? null : String(row["recipient"]),
+        dedupeKey: String(row["dedupe_key"]),
+        scope: row["provenance_scope"],
+        project: row["project"] == null ? null : String(row["project"]),
+        taskRef: row["task_ref"] == null ? null : Number(row["task_ref"]),
+        taskId: row["task_id"] == null ? null : String(row["task_id"]),
+        run: row["source_run"] == null ? null : Number(row["source_run"]),
+        kind: String(row["kind"]),
+        subject: String(row["subject"]),
+        body: String(row["body"]),
+        createdAt: String(row["created_at"]),
+        resolvedAt: row["resolved_at"] === null || row["resolved_at"] === undefined
+            ? null
+            : String(row["resolved_at"]),
+        pushClass: (row["push_class"] === null || row["push_class"] === undefined) && String(row["kind"]) === "check-progress"
+            ? "progress"
+            : row["push_class"] === null || row["push_class"] === undefined
+                ? null
+                : String(row["push_class"]),
+        link: row["link"] === null || row["link"] === undefined ? null : String(row["link"]),
+    };
+}
+export function readNotificationReceipt(row) {
+    return {
+        ...readNotification(row),
+        attempts: Number(row["attempts"]),
+        lastAttemptAt: row["last_attempt_at"] == null ? null : String(row["last_attempt_at"]),
+        lastError: row["last_error"] == null ? null : String(row["last_error"]),
+        deliveredAt: row["delivered_at"] == null ? null : String(row["delivered_at"]),
+        receipt: row["receipt"] == null ? null : String(row["receipt"]),
+    };
+}

package/dist/operate.js

@@ -175,7 +175,7 @@ import { mintCoordinator, revokeCoordinator, listCoordinators } from "./coordina
 import { serveMcp } from "./mcp.js";
 import { createInterface } from "node:readline";
 import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, fileAndSealUnderMode, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha } from "./scope.js";
-import { presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
+import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
 import { requestTaskStop, resumeTaskStop, taskControlOf } from "./task-control.js";
 import { worktreeAdoptionNotice } from "./worktree-notices.js";
@@ -4659,8 +4659,11 @@ async function modeCommand(positional, flags, context) {
         return fail(write, json, "mode set", "invalid", "--plan-auto requires automatic filing approval", EXIT.refused);
     }
     // Approving plans and merges from the signer's paired chat: never a preset default, only this flag.
-    if (flag(flags, "chat-approve"))
+    // The signature names every chat app it covers: a grant signed before that named Telegram alone, and stays so.
+    if (flag(flags, "chat-approve")) {
         terms.chatApprove = true;
+        terms.chatApproveChats = CHAT_APPROVE_ALL;
+    }
     // Automerge requires a live merge-capable grant on the repo (D1).
     if (terms.publication === "automerge" && !store.hasMergeCapableGrant(repo, now)) {
         return fail(write, json, "mode set", "no-grant", "automerge needs a merge-capable publication grant on this repo — file one first", EXIT.refused);

package/dist/plane-review.js

@@ -175,17 +175,11 @@ export function reviewPlane(store, now, canSee = () => true) {
         }
     }
     // Chat replies that couldn't be delivered.
-    for (const app of ["slack", "discord", "teams"]) {
-        if (!tableExists(store, `${app}_part`))
-            continue;
-        const name = { slack: "Slack", discord: "Discord", teams: "Teams" }[app];
-        for (const row of store.handle.prepare(`SELECT id, problem, attempts FROM ${app}_part WHERE state = 'dropped' AND created >= ? ORDER BY id`).all(since)) {
-            add(`chat/${app}`, `${name} replies weren't delivered`, ["reply", "replies"], { evidence: `After ${plural(Number(row["attempts"] ?? 0), "try", "tries")}: ${excerpt(str(row["problem"])) || "dropped"}` });
-        }
-    }
-    if (tableExists(store, "telegram_conversation_part")) {
-        for (const row of store.handle.prepare("SELECT last_error, attempts FROM telegram_conversation_part WHERE state = 'dropped' AND created_at >= ?").all(since)) {
-            add("chat/telegram", "Telegram replies weren't delivered", ["reply", "replies"], { evidence: `After ${plural(Number(row["attempts"] ?? 0), "try", "tries")}: ${excerpt(str(row["last_error"])) || "dropped"}` });
+    if (tableExists(store, "chat_part")) {
+        const names = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
+        for (const row of store.handle.prepare("SELECT provider, problem, attempts FROM chat_part WHERE state = 'dropped' AND created >= ? ORDER BY provider = 'telegram' DESC, provider, id").all(since)) {
+            const app = String(row["provider"]);
+            add(`chat/${app}`, `${names[app] ?? app} replies weren't delivered`, ["reply", "replies"], { evidence: `After ${plural(Number(row["attempts"] ?? 0), "try", "tries")}: ${excerpt(str(row["problem"])) || "dropped"}` });
         }
     }
     if (tableExists(store, "notification_delivery")) {

package/dist/project-delete.js

@@ -207,35 +207,30 @@ function deleteRows(store, repo, d, now) {
     const notifications = json(ids(db, `SELECT id FROM notification WHERE project = ? OR ${IN("task_ref")} OR ${IN("source_run")}`, repo, T, R));
     const questions = json(ids(db, `SELECT id FROM teammate_question WHERE ${IN("teammate")} OR ${IN("card")}`, M, C));
     const proposals = json(ids(db, `SELECT id FROM mate_proposal WHERE ${IN("thread")}`, H));
-    const conversations = json(ids(db, `SELECT id FROM telegram_conversation WHERE ${IN("task_id")}`, K));
-    // Chats about the project's work, on every surface.
-    for (const surface of ["discord", "slack", "teams"]) {
-        del(`${surface}_progress`, IN("run"), R);
-        del(`${surface}_action`, IN("proposal"), proposals);
-        del(`${surface}_flow_action`, IN("card"), C);
-        del(`${surface}_flow_prompt`, IN("card"), C);
-        del(`${surface}_flow_choice`, IN("card"), C);
-        del(`${surface}_flow_note`, IN("card"), C);
-        del(`${surface}_question_action`, IN("question"), questions);
-        del(`${surface}_question_prompt`, IN("question"), questions);
-        del(`${surface}_ask_action`, IN("turn"), U);
-    }
-    del("telegram_action", IN("decision"), decisions);
-    del("telegram_decision_message", IN("decision"), decisions);
-    del("telegram_note_draft", IN("decision"), decisions);
-    del("telegram_proposal_action", IN("proposal"), proposals);
-    del("telegram_flow_action", IN("card"), C);
-    del("telegram_flow_prompt", IN("card"), C);
-    del("telegram_flow_choice", IN("card"), C);
+    // A chat message about one of the project's tasks (its turn named it), with its reply. Event ids are text ('m123'),
+    // and the same id can be another app's: each is kept whole, as provider:id.
+    const conversations = json(list(db, `SELECT provider || ':' || id FROM chat_event WHERE kind = 'message' AND json_extract(payload, '$.about.task') IN (SELECT value FROM json_each(?))`, K));
+    // Every app's planned parts about the project's work: a result screenshot, or a message naming one of its tasks or runs.
+    const parts = `SELECT provider || ':' || id FROM chat_part WHERE provider || ':' || event IN (SELECT value FROM json_each(?))
+    OR json_extract(payload, '$.image.taskId') IN (SELECT value FROM json_each(?)) OR json_extract(payload, '$.image.run') IN (SELECT value FROM json_each(?))`;
+    const doomedParts = `provider || ':' || part IN (${parts})`;
+    // Chats about the project's work, on every app.
+    del("chat_progress", IN("run"), R);
+    del("chat_action", `${IN("proposal")} OR ${IN("decision")} OR ${doomedParts}`, proposals, decisions, conversations, K, R);
+    del("chat_flow_action", `${IN("card")} OR ${doomedParts}`, C, conversations, K, R);
+    del("chat_flow_prompt", IN("card"), C);
+    del("chat_flow_choice", `${IN("card")} OR ${doomedParts}`, C, conversations, K, R);
+    del("chat_flow_note", IN("card"), C);
+    del("chat_question_action", `${IN("question")} OR ${doomedParts}`, questions, conversations, K, R);
+    del("chat_question_prompt", IN("question"), questions);
+    del("chat_ask_action", `${IN("turn")} OR ${doomedParts}`, U, conversations, K, R);
+    del("chat_note_draft", IN("decision"), decisions);
     del("flow_send", IN("card"), C);
-    del("telegram_question_action", IN("question"), questions);
-    del("telegram_question_prompt", IN("question"), questions);
     del("chat_decide_action", IN("task_id"), K);
     del("chat_decide_prompt", IN("task_id"), K);
-    del("telegram_task_message", `${IN("task_id")} OR ${IN("source_run")}`, K, R);
-    del("telegram_conversation_part", `${IN("conversation")} OR ${IN("source_run")} OR ${IN("task_id")}`, conversations, R, K);
-    del("telegram_conversation", IN("id"), conversations);
-    del("telegram_outbound_message", `project = ? OR ${IN("notification")} OR ${IN("task_ref")} OR ${IN("source_run")}`, repo, notifications, T, R);
+    del("chat_message_ref", `${IN("decision")} OR ${IN("task_id")} OR ${IN("run")} OR project = ? OR ${IN("notification")} OR ${IN("task_ref")}`, decisions, K, R, repo, notifications, T);
+    del("chat_part", `provider || ':' || id IN (${parts})`, conversations, K, R);
+    del("chat_event", `provider || ':' || id IN (SELECT value FROM json_each(?))`, conversations);
     del("chat_card_task", IN("task_ref"), T);
     del("chat_batch_item", IN("task_ref"), T);
     del("result_shot_sent", IN("run"), R);

package/dist/result-shots.js

@@ -169,6 +169,6 @@ export function refuseResultShots(state, store, part, content, app, now) {
     const title = chatTitle(store, content.image?.taskId ?? content.task ?? "");
     const line = { text: `Screenshots for ${title} weren't sent: the ${app} app isn't allowed to upload files here.`,
         ...(content.task === undefined ? {} : { task: content.task }), ...(content.run === undefined ? {} : { run: content.run }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE id=?").run(savedChatPart(line), now.toISOString(), part.id);
-    state.prepare("UPDATE chat_part SET state='dropped',problem='Uploads are not allowed here' WHERE event=? AND id<>? AND state='pending'").run(part.event, part.id);
+    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE provider=:provider AND id=?").run(savedChatPart(line), now.toISOString(), part.id);
+    state.prepare("UPDATE chat_part SET state='dropped',problem='Uploads are not allowed here' WHERE provider=:provider AND event=? AND id<>? AND state='pending'").run(part.event, part.id);
 }