toolroll 0.9.53 → 0.9.55

package/dist/chat-migration.d.ts

@@ -0,0 +1,30 @@
+import type { Database } from "./store.js";
+export type LegacyChatApp = "slack" | "discord" | "teams";
+export declare const LEGACY_CHAT_APPS: readonly LegacyChatApp[];
+/** One app's old tables, as an older database has (or should have had) them. */
+export declare const legacyAppSchema: (app: LegacyChatApp) => string;
+/** One app's 16 old tables, parents first. */
+export declare const legacyAppTables: (app: LegacyChatApp) => string[];
+/** Telegram's own tables (v1-v114) and the bridge's lease, kept verbatim. */
+export declare const LEGACY_TELEGRAM_SCHEMA = "\nCREATE TABLE IF NOT EXISTS telegram_flow_choice (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  choice      INTEGER NOT NULL,\n  label       TEXT NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_choice_visit ON telegram_flow_choice (card, entry);\n\n-- v79: a Telegram message that showed one task (a /task status, a task\n-- picked from /tasks): a reply to it is about that task. Like chat_focus,\n-- a pointer and never an authority \u2014 the turn re-proves the task.\nCREATE TABLE IF NOT EXISTS telegram_task_message (\n  binding    INTEGER NOT NULL,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  task_id    TEXT NOT NULL,\n  source_run INTEGER,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\n\n\n-- Away mode (v34, mate arc \u00A710): the Telegram bridge's digest cadence.\n-- One row. every_ms NULL = off (every fact pages as it lands); set, the\n-- bridge holds ROUTINE rows unclaimed until the window elapses and sends\n-- them as one message \u2014 decisions and attention-class facts still page\n-- singly. last_sent_at anchors the window; it never deletes a row.\nCREATE TABLE IF NOT EXISTS telegram_digest (\n  id           INTEGER PRIMARY KEY CHECK (id = 1),\n  every_ms     INTEGER,\n  set_by       TEXT,\n  set_at       TEXT,\n  last_sent_at TEXT\n);\nINSERT OR IGNORE INTO telegram_digest (id, every_ms) VALUES (1, NULL);\n\n\n-- One Telegram chat speaking as one approver. Bindings are never deleted:\n-- revocation is a stamp, because \"who could answer as whom, when\" is an\n-- audit question a DELETE cannot answer. The partial unique index (v72) is\n-- the rule that one Telegram user has one live binding per bot: several\n-- teammates pair their own private chats with the same bot.\nCREATE TABLE IF NOT EXISTS telegram_binding (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  paired_at           TEXT NOT NULL,\n  paired_by           TEXT NOT NULL,\n  pair_update_id      INTEGER,\n  revoked_at          TEXT,\n  revoked_by          TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_binding_live_user\n  ON telegram_binding (bot_id, user_id) WHERE revoked_at IS NULL;\n\n-- v72: a Telegram chat's place in the shared team conversations. A group\n-- follows exactly one team conversation (and a conversation has at most one\n-- group); a private chat may select one conversation to talk in instead of\n-- its personal assistant. The cursor is the last conversation message this\n-- chat received. Rows are revoked, never deleted.\nCREATE TABLE IF NOT EXISTS telegram_team_chat (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  bot_id       TEXT NOT NULL,\n  chat_id      TEXT NOT NULL,\n  binding      INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  kind         TEXT NOT NULL CHECK (kind IN ('group','private')),\n  conversation TEXT NOT NULL REFERENCES team_conversation(id) ON DELETE RESTRICT,\n  bound_by     TEXT NOT NULL,\n  bound_at     TEXT NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  revoked_at   TEXT,\n  revoked_by   TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_team_chat_live\n  ON telegram_team_chat (bot_id, chat_id) WHERE revoked_at IS NULL;\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_team_chat_group\n  ON telegram_team_chat (conversation) WHERE revoked_at IS NULL AND kind = 'group';\n\n\nCREATE TABLE IF NOT EXISTS telegram_outbound_message (\n  binding INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id TEXT NOT NULL,\n  chat_id TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  notification INTEGER NOT NULL REFERENCES notification(id) ON DELETE RESTRICT,\n  destination TEXT NOT NULL,\n  project TEXT,\n  task_ref INTEGER REFERENCES task_ref(id),\n  task_id TEXT,\n  source_run INTEGER REFERENCES run(id),\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id, notification)\n);\nCREATE TABLE IF NOT EXISTS telegram_retry (\n  bot_id TEXT PRIMARY KEY,\n  next_attempt_at TEXT NOT NULL\n);\n\n-- One-time pairing codes, hashed like every other credential, consumed in\n-- one transaction with the binding they create.\nCREATE TABLE IF NOT EXISTS telegram_pairing (\n  code_hash       TEXT PRIMARY KEY,\n  approver        TEXT NOT NULL REFERENCES approver(name) ON DELETE RESTRICT,\n  approver_generation INTEGER NOT NULL,\n  created_at      TEXT NOT NULL,\n  created_by      TEXT NOT NULL,\n  expires_at      TEXT NOT NULL,\n  consumed_at     TEXT,\n  consumed_chat   TEXT,\n  consumed_user   TEXT,\n  consumed_update INTEGER\n);\n\n-- Every Telegram update this installation has applied, exactly once. The\n-- PRIMARY KEY is the idempotency: a replayed batch re-applies nothing.\nCREATE TABLE IF NOT EXISTS telegram_update (\n  update_id  INTEGER PRIMARY KEY,\n  applied_at TEXT NOT NULL,\n  result     TEXT NOT NULL\n);\n\n-- Opaque one-tap actions. callback_data carries only the random token; what\n-- the tap MEANS \u2014 which binding, decision, option, and phase \u2014 lives here,\n-- where a stolen bot token cannot read or forge it. Confirm challenges are\n-- short-lived rows in the same table, consumed exactly once.\nCREATE TABLE IF NOT EXISTS telegram_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  decision    INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  option_id   TEXT NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('choose','confirm','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_action_by_decision ON telegram_action (decision);\n\n-- v86: a flow card waiting at a \"Person decides\" zone reaches the decider on\n-- Telegram with Approve / Edit / Send back. Each button is one opaque token\n-- for one visit of one card (card, entry), placed on the message it rides so\n-- a tap on any other message proves itself stale. Edit and Send back ask\n-- for a reply to a prompt: telegram_flow_prompt names which prompt means\n-- what, so the reply becomes the new draft or the note.\nCREATE TABLE IF NOT EXISTS telegram_flow_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  action      TEXT NOT NULL CHECK (action IN ('approve','edit','send-back')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_action_visit ON telegram_flow_action (card, entry);\n-- v93: a teammate's question on Telegram. One button per option (choice)\n-- and one to reply in words (choice NULL), placed on the message it rides;\n-- a reply to the prompt the Reply button sends is the answer.\nCREATE TABLE IF NOT EXISTS telegram_question_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES teammate_question(id),\n  choice      TEXT,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE TABLE IF NOT EXISTS telegram_question_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  question    INTEGER NOT NULL REFERENCES teammate_question(id),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\nCREATE TABLE IF NOT EXISTS telegram_flow_prompt (\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  mode        TEXT NOT NULL CHECK (mode IN ('edit','send-back')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT,\n  PRIMARY KEY (chat_id, message_id)\n);\n\n-- Which outbound Telegram message carries which decision (v10). A free-text\n-- reply is routed through the EXACT message it replies to \u2014 never \"the\n-- latest decision\", never \"the only open one\" (Codex free-text review,\n-- finding 1). Losing the send/record race fails closed: an unrecorded\n-- message routes nothing.\nCREATE TABLE IF NOT EXISTS telegram_decision_message (\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  chat_id    TEXT NOT NULL,\n  message_id TEXT NOT NULL,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (binding, chat_id, message_id)\n);\n\n-- The free-text draft (v10): an operator's note, held immutable and\n-- expiring until a TAP commits it with the choice. One live draft per\n-- (binding, decision); a newer valid reply SUPERSEDES, never edits.\nCREATE TABLE IF NOT EXISTS telegram_note_draft (\n  id         INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding    INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE CASCADE,\n  decision   INTEGER NOT NULL REFERENCES decision(id) ON DELETE CASCADE,\n  update_id  INTEGER NOT NULL,\n  message_id TEXT NOT NULL,\n  reply_to   TEXT NOT NULL,\n  note       TEXT NOT NULL,\n  state      TEXT NOT NULL DEFAULT 'pending' CHECK (state IN ('pending','armed','superseded','consumed','discarded')),\n  created_at TEXT NOT NULL,\n  expires_at TEXT NOT NULL\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS telegram_note_draft_live\n  ON telegram_note_draft (binding, decision) WHERE state IN ('pending','armed');\n\n-- v62: the durable inbound conversation queue. An ordinary paired message\n-- becomes a row in the SAME transaction that marks its update applied, so\n-- the poll cursor never moves past text nobody holds. The row carries the\n-- exact binding, sender, update, message and the request identity the\n-- shared mate engine receipts it under; the async model turn runs OUTSIDE\n-- any transaction under a short claim, and a replay or restart finds the\n-- receipt instead of dispatching the provider again.\nCREATE TABLE IF NOT EXISTS telegram_conversation (\n  id                  INTEGER PRIMARY KEY AUTOINCREMENT,\n  binding             INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  bot_id              TEXT NOT NULL,\n  chat_id             TEXT NOT NULL,\n  user_id             TEXT NOT NULL,\n  approver            TEXT NOT NULL,\n  approver_generation INTEGER NOT NULL,\n  update_id           INTEGER NOT NULL UNIQUE,\n  message_id          TEXT NOT NULL,\n  reply_to            TEXT,\n  request             TEXT NOT NULL UNIQUE,\n  text                TEXT NOT NULL,\n  context             TEXT,\n  task_id             TEXT,\n  source_run          INTEGER,\n  state               TEXT NOT NULL CHECK (state IN ('queued','running','done','failed')),\n  claim_owner         TEXT,\n  claim_expires_at    TEXT,\n  attempts            INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at     TEXT,\n  session             INTEGER,\n  turn                INTEGER,\n  outcome             TEXT,\n  reply_message_id    TEXT,\n  created_at          TEXT NOT NULL,\n  started_at          TEXT,\n  finished_at         TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_conversation_queue ON telegram_conversation (bot_id, state, id);\n\n-- v62: opaque one-tap tokens for the mate's proposal cards, the same shape\n-- as telegram_action for decisions: callback_data carries only the token,\n-- and what a tap MEANS (which binding, which proposal, which phase) lives\n-- here. Consumed exactly once; an irreversible answer arms a yes/cancel\n-- pair first, exactly as a decision button does.\nCREATE TABLE IF NOT EXISTS telegram_proposal_action (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  proposal    INTEGER NOT NULL REFERENCES mate_proposal(id) ON DELETE CASCADE,\n  phase       TEXT NOT NULL CHECK (phase IN ('confirm','dismiss','yes','cancel')),\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_proposal_action_by_proposal ON telegram_proposal_action (proposal);\n\n-- v63: the outbound half of a conversation, durable BEFORE any send. Once\n-- the engine's turn is answered (or recovered from its receipt), the exact\n-- reply text, split into Telegram-sized parts, and one card per pending\n-- proposal are written here in one transaction; the bridge then sends\n-- them in order under the row's claim, marking a part sent only when\n-- Telegram confirmed a message id. A crash, an outage, a rate limit or a\n-- restart resumes from the first unsent part \u2014 never another model call,\n-- proposal, task or revision. A card's buttons are minted with the part,\n-- so a resend carries the same tokens. A part whose network answer was\n-- lost is counted as uncertain: a resend may duplicate it, and the row\n-- says so instead of claiming an exactly-once Telegram cannot provide.\n-- v64: an 'image' part is one verified screenshot of one exact result,\n-- named by typed columns \u2014 task, run, artifact and the hash its record\n-- carried when the part was planned \u2014 never by JSON inside text or a\n-- keyboard, and never by bytes: every send re-reads the artifact from the\n-- evidence root and re-verifies it against these columns first. Its text\n-- is the short caption. A confirmed image message binds replies to that\n-- exact task and run, exactly as an outbox fact's message does.\nCREATE TABLE IF NOT EXISTS telegram_conversation_part (\n  conversation    INTEGER NOT NULL REFERENCES telegram_conversation(id) ON DELETE CASCADE,\n  ordinal         INTEGER NOT NULL,\n  kind            TEXT NOT NULL CHECK (kind IN ('reply','card','image')),\n  text            TEXT NOT NULL,\n  reply_to        TEXT,\n  proposal        INTEGER REFERENCES mate_proposal(id) ON DELETE SET NULL,\n  keyboard_json   TEXT,\n  state           TEXT NOT NULL CHECK (state IN ('pending','sent','dropped')),\n  message_id      TEXT,\n  attempts        INTEGER NOT NULL DEFAULT 0,\n  uncertain       INTEGER NOT NULL DEFAULT 0,\n  next_attempt_at TEXT,\n  last_error      TEXT,\n  created_at      TEXT NOT NULL,\n  sent_at         TEXT,\n  task_id         TEXT,\n  source_run      INTEGER REFERENCES run(id),\n  artifact        INTEGER,\n  sha256          TEXT,\n  PRIMARY KEY (conversation, ordinal),\n  CHECK ((state = 'sent') = (message_id IS NOT NULL)),\n  CHECK ((state = 'sent') = (sent_at IS NOT NULL)),\n  CHECK ((kind = 'image') = (task_id IS NOT NULL AND source_run IS NOT NULL AND artifact IS NOT NULL AND sha256 IS NOT NULL))\n);\n\n\n-- The bridge's poll lease and cursor, per bot. One live poller at a time;\n-- the cursor only ever moves forward, and only under a live generation.\nCREATE TABLE IF NOT EXISTS bridge_lease (\n  bot_id       TEXT PRIMARY KEY,\n  owner        TEXT NOT NULL,\n  generation   INTEGER NOT NULL,\n  cursor       INTEGER NOT NULL DEFAULT 0,\n  expires_at   TEXT NOT NULL,\n  heartbeat_at TEXT NOT NULL,\n  push_url     TEXT,\n  push_at      TEXT,\n  push_problem TEXT\n);\n-- v98: updates Telegram pushed to /hooks/telegram, kept until the bridge\n-- applies them (in update order, through the same door as polled ones).\nCREATE TABLE IF NOT EXISTS telegram_inbox (\n  update_id    INTEGER PRIMARY KEY,\n  bot_id       TEXT NOT NULL,\n  payload      TEXT NOT NULL,\n  received_at  TEXT NOT NULL\n);\n\n\nCREATE TABLE IF NOT EXISTS telegram_flow_confirm (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  card        INTEGER NOT NULL,\n  entry       INTEGER NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('yes','cancel')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_confirm_visit ON telegram_flow_confirm (card, entry);\n";
+/** Telegram's 21 old tables and the bridge's lease, children first. */
+export declare const LEGACY_TELEGRAM_TABLES: readonly ["telegram_note_draft", "telegram_decision_message", "telegram_task_message", "telegram_outbound_message", "telegram_action", "telegram_proposal_action", "telegram_flow_action", "telegram_flow_confirm", "telegram_flow_choice", "telegram_flow_prompt", "telegram_question_action", "telegram_question_prompt", "telegram_conversation_part", "telegram_conversation", "telegram_team_chat", "telegram_pairing", "telegram_update", "telegram_inbox", "telegram_retry", "telegram_digest", "telegram_binding", "bridge_lease"];
+/** Whether this database already keeps its chats in the shared tables (v116 ran, or it was made at v116 or later). */
+export declare function chatTablesShared(db: Database): boolean;
+/** Whether any of the old per-app tables is still here. */
+export declare function legacyChatTablesPresent(db: Database): boolean;
+/**
+ * What is wrong with the old chat tables this database still has, before anything is changed: one that lacks a column
+ * its every shape has had is not a table this build knows how to carry. Null when they are fine (or already gone).
+ */
+export declare function legacyChatProblem(db: Database): string | null;
+/**
+ * v116: every old chat table's rows into the shared ones, in one transaction. Each copy is one INSERT ... SELECT (no
+ * row passes through this process), then every count is checked against its source, every Telegram message's words
+ * against the person its binding names, and every foreign key; only then are the old tables dropped. Anything that
+ * doesn't add up rolls the whole move back and the open fails, with the old tables as they were. Run again (a resumed
+ * upgrade) it finds no old tables and does nothing.
+ */
+export declare function convertChatTables(db: Database): {
+    copied: number;
+};