@autumnsgrove/groveengine 0.9.97 → 0.9.98

package/dist/auth/session.js

@@ -5,6 +5,7 @@
  * Session management is now handled by Heartwood SessionDO.
  * This file only contains tenant verification functions.
  */
+import { emailsMatch } from "../utils/user.js";
 /**
  * Verify that a user owns/has access to a tenant
  */
@@ -21,7 +22,7 @@ export async function verifyTenantOwnership(db, tenantId, userEmail) {
             return false;
         }
         // Check if user email matches tenant owner email
-        return tenant.email.toLowerCase() === userEmail.toLowerCase();
+        return emailsMatch(tenant.email, userEmail);
     }
     catch (error) {
         console.error("Error verifying tenant ownership:", error);

package/dist/components/admin/FloatingToolbar.svelte

@@ -219,8 +219,50 @@
     }
   }
 
-  // Set up selection monitoring and keyboard shortcuts
+  // Track if the textarea is focused to avoid global listener interference
+  let isTextareaFocused = $state(false);
+
+  // Handle focus/blur on textarea to manage global listeners lifecycle
+  function handleTextareaFocus() {
+    isTextareaFocused = true;
+  }
+
+  /** @param {FocusEvent} e */
+  function handleTextareaBlur(e) {
+    // If focus moved to toolbar, keep it open
+    if (e.relatedTarget && toolbarRef?.contains(/** @type {Node} */ (e.relatedTarget))) {
+      return;
+    }
+    isTextareaFocused = false;
+    isVisible = false;
+  }
+
+  // Set up focus tracking on the textarea
   $effect(() => {
+    if (!textareaRef) return;
+
+    textareaRef.addEventListener("focus", handleTextareaFocus);
+    textareaRef.addEventListener("blur", handleTextareaBlur);
+
+    // Check if already focused
+    if (document.activeElement === textareaRef) {
+      isTextareaFocused = true;
+    }
+
+    return () => {
+      textareaRef?.removeEventListener("focus", handleTextareaFocus);
+      textareaRef?.removeEventListener("blur", handleTextareaBlur);
+    };
+  });
+
+  // Only add global listeners when textarea is focused
+  // This prevents interference with other form elements in the admin panel
+  $effect(() => {
+    if (!isTextareaFocused) {
+      isVisible = false;
+      return;
+    }
+
     // Use selectionchange for more reliable selection tracking (catches programmatic changes)
     document.addEventListener("selectionchange", handleSelectionChange);
     document.addEventListener("mousedown", handleClickOutside);

package/dist/components/admin/GutterManager.svelte

@@ -567,7 +567,7 @@
           variant="outline"
           onclick={() => openImagePicker((url) => (itemUrl = url))}
         >
-          Browse CDN
+          Browse Images
         </Button>
       </div>
     </div>
@@ -636,7 +636,7 @@
 </Dialog>
 
 <!-- Image Picker Modal -->
-<Dialog bind:open={showImagePicker} title="Select Image from CDN">
+<Dialog bind:open={showImagePicker} title="Select Image">
   {#snippet children()}
     <div class="picker-controls">
     <Input

package/dist/components/admin/MarkdownEditor.svelte

@@ -41,6 +41,12 @@
    * @property {Array<{url: string, alt?: string, caption?: string}>} [images]
    */
 
+  /**
+   * @typedef {Object.<string, boolean>} GraftsRecord
+   * Graft flags for this tenant - component reads what it needs.
+   * Known flags: fireside_mode (AI-assisted prompts), scribe_mode (voice-to-text)
+   */
+
   // Props
   let {
     content = $bindable(""),
@@ -54,8 +60,14 @@
     previewTags = /** @type {string[]} */ ([]),
     gutterItems = /** @type {GutterItemProp[]} */ ([]),
     firesideAssisted = $bindable(false),
+    /** All grafts for this tenant - component reads what it needs */
+    grafts = /** @type {GraftsRecord} */ ({}),
   } = $props();
 
+  // Derived graft flags - add new ones here as they're created
+  const firesideEnabled = $derived(grafts?.fireside_mode ?? false);
+  const scribeEnabled = $derived(grafts?.scribe_mode ?? false);
+
   // Core refs and state
   /** @type {HTMLTextAreaElement | null} */
   let textareaRef = $state(null);
@@ -125,12 +137,43 @@
 
   // Note: Slash commands and command palette removed for simplified Medium-style UX
 
+  // Debounced preview HTML - avoid expensive markdown rendering on every keystroke
+  // Cache the last rendered HTML to prevent jank during typing
+  let debouncedContent = $state(content);
+  // NOT $state - these are cleanup handles, not reactive state
+  // Using $state here causes infinite loops (effect writes to state it reads)
+  /** @type {ReturnType<typeof setTimeout> | null} */
+  let debounceTimer = null;
+  let isMounted = true;
+
+  // Update debounced content after 150ms of no typing
+  $effect(() => {
+    // Clear any existing timer
+    if (debounceTimer) clearTimeout(debounceTimer);
+
+    // Capture current content for the closure
+    const currentContent = content;
+
+    debounceTimer = setTimeout(() => {
+      // Only update if component is still mounted (prevents race condition)
+      if (isMounted) {
+        debouncedContent = currentContent;
+      }
+    }, 150);
+
+    return () => {
+      if (debounceTimer) clearTimeout(debounceTimer);
+      isMounted = false;  // Mark as unmounted on cleanup
+    };
+  });
+
   // Computed values
   let wordCount = $derived(content.trim() ? content.trim().split(/\s+/).length : 0);
   let charCount = $derived(content.length);
   let lineCount = $derived(content.split("\n").length);
-  let previewHtml = $derived(content ? sanitizeMarkdown(editorMd.render(content)) : "");
-  let previewHeaders = $derived(content ? extractHeaders(content) : []);
+  // Use debounced content for expensive operations (markdown rendering)
+  let previewHtml = $derived(debouncedContent ? sanitizeMarkdown(editorMd.render(debouncedContent)) : "");
+  let previewHeaders = $derived(debouncedContent ? extractHeaders(debouncedContent) : []);
 
   let readingTime = $derived.by(() => {
     const minutes = Math.ceil(wordCount / 200);
@@ -254,8 +297,8 @@
       cycleEditorMode();
     }
 
-    // Cmd/Ctrl + Shift + F for Fireside mode
-    if (e.key === "f" && (e.metaKey || e.ctrlKey) && e.shiftKey) {
+    // Cmd/Ctrl + Shift + F for Fireside mode (only if graft enabled)
+    if (e.key === "f" && (e.metaKey || e.ctrlKey) && e.shiftKey && firesideEnabled) {
       e.preventDefault();
       toggleFiresideMode();
     }
@@ -541,6 +584,30 @@
     }
   });
 
+  // Full preview modal focus management
+  /** @type {HTMLElement | null} */
+  let previouslyFocusedBeforePreview = null;
+  /** @type {HTMLDivElement | null} */
+  let fullPreviewModalRef = $state(null);
+
+  $effect(() => {
+    if (showFullPreview) {
+      // Store the currently focused element to restore on close
+      const activeEl = document.activeElement;
+      if (activeEl instanceof HTMLElement) {
+        previouslyFocusedBeforePreview = activeEl;
+      }
+      // Focus the modal for keyboard accessibility
+      setTimeout(() => {
+        fullPreviewModalRef?.focus();
+      }, 50);
+    } else if (previouslyFocusedBeforePreview) {
+      // Restore focus when modal closes
+      previouslyFocusedBeforePreview.focus();
+      previouslyFocusedBeforePreview = null;
+    }
+  });
+
   // Drag and drop handlers
   /** @param {DragEvent} e */
   function handleDragEnter(e) {
@@ -724,7 +791,7 @@
   {#if !isFiresideMode}
   <div class="toolbar">
     <div class="toolbar-left">
-      {#if !content.trim()}
+      {#if firesideEnabled && !content.trim()}
         <button
           type="button"
           class="fireside-btn"
@@ -737,8 +804,8 @@
         </button>
         <span class="toolbar-divider">|</span>
       {/if}
-      <!-- Voice Input (Scribe) -->
-      {#if editorMode !== "preview"}
+      <!-- Voice Input (Scribe) - gated by scribe_mode graft -->
+      {#if scribeEnabled && editorMode !== "preview"}
         <div class="voice-wrapper" title="Voice Input (⌘⇧U) - Hold to record, release to transcribe">
           <VoiceInput
             mode={voiceMode}
@@ -850,7 +917,7 @@
               onkeydown={handleKeydown}
               onscroll={handleScroll}
               onpaste={handlePaste}
-              placeholder="Start writing your post... (Drag & drop or paste images)"
+              placeholder="Start writing your bloom... (Drag & drop or paste images)"
               spellcheck="true"
               disabled={readonly}
               class="editor-textarea"
@@ -929,7 +996,7 @@
 
 <!-- Full Preview Modal -->
 {#if showFullPreview}
-  <div class="full-preview-modal" role="dialog" aria-modal="true" aria-label="Full article preview" tabindex="-1" onkeydown={(e) => e.key === 'Escape' && (showFullPreview = false)}>
+  <div bind:this={fullPreviewModalRef} class="full-preview-modal" role="dialog" aria-modal="true" aria-label="Full article preview" tabindex="-1" onkeydown={(e) => e.key === 'Escape' && (showFullPreview = false)}>
     <button type="button" class="full-preview-backdrop" onclick={() => (showFullPreview = false)} aria-label="Close preview"></button>
     <div class="full-preview-container" class:has-vines={gutterItems.length > 0}>
       <header class="full-preview-header">

package/dist/components/admin/MarkdownEditor.svelte.d.ts

@@ -23,6 +23,7 @@ declare const MarkdownEditor: import("svelte").Component<{
     previewTags?: any;
     gutterItems?: any;
     firesideAssisted?: boolean;
+    grafts?: any;
 }, {
     getAvailableAnchors: () => string[];
     insertAnchor: (name: string) => void;
@@ -44,4 +45,5 @@ type $$ComponentProps = {
     previewTags?: any;
     gutterItems?: any;
     firesideAssisted?: boolean;
+    grafts?: any;
 };

package/dist/components/admin/VoiceInput.svelte

@@ -16,6 +16,7 @@
     type ScribeRecorderState,
   } from "../../scribe/recorder.js";
   import type { GutterItem, ScribeMode } from "../../lumen/types.js";
+  import { getCSRFToken } from "../../utils/api.js";
 
   // ============================================================================
   // Props & Events
@@ -163,10 +164,16 @@
       formData.append("audio", audioBlob);
       formData.append("mode", mode);
 
+      // Get CSRF token for state-changing request
+      const csrfToken = getCSRFToken();
+
       const response = await fetch("/api/lumen/transcribe", {
         method: "POST",
         body: formData,
         credentials: "include",
+        headers: csrfToken
+          ? { "X-CSRF-Token": csrfToken, "csrf-token": csrfToken }
+          : {},
       });
 
       if (!response.ok) {

package/dist/components/custom/GutterItem.svelte

@@ -53,7 +53,7 @@
 		{@const imageSrc = item.src || item.url || item.file}
 		<figure class="gutter-photo">
 			<button class="image-button" onclick={() => openLightbox(imageSrc, item.caption || 'Gutter image', item.caption || '')}>
-				<img src={imageSrc} alt={item.caption || 'Gutter image'} />
+				<img src={imageSrc} alt={item.caption || 'Gutter image'} loading="lazy" decoding="async" />
 			</button>
 			{#if item.caption}
 				<figcaption>{item.caption}</figcaption>
@@ -76,7 +76,7 @@
 		{/if}
 	{:else if item.type === 'emoji'}
 		<div class="gutter-emoji">
-			<img src={item.src} alt={item.alt || 'Emoji'} title={item.alt || ''} />
+			<img src={item.src} alt={item.alt || 'Emoji'} title={item.alt || ''} loading="lazy" decoding="async" />
 		</div>
 	{/if}
 </div>

package/dist/components/custom/InternalsPostViewer.svelte

@@ -1,6 +1,6 @@
 <script>
 	/**
-	 * Simple component to display a featured blog post
+	 * Simple component to display a featured garden post
 	 * @prop {{ title: string; description?: string; slug: string; date?: string }} post - Post data
 	 * @prop {string} [caption] - Optional caption text
 	 */
@@ -17,7 +17,7 @@
 	{#if caption}
 		<span class="caption">{caption}</span>
 	{/if}
-	<a href="/blog/{post.slug}" class="post-link">
+	<a href="/garden/{post.slug}" class="post-link">
 		<h3 class="title">{post.title}</h3>
 		{#if post.description}
 			<p class="description">{post.description}</p>

package/dist/components/custom/MobileTOC.svelte

@@ -19,6 +19,7 @@
 	let menuRef = $state<HTMLDivElement>();
 	let buttonRef = $state<HTMLButtonElement>();
 	let activeId = $state('');
+	let previouslyFocusedElement: HTMLElement | null = null;
 
 	function toggleMenu() {
 		isOpen = !isOpen;
@@ -28,6 +29,29 @@
 		isOpen = false;
 	}
 
+	// Focus trap: Tab key cycles within menu
+	function handleFocusTrap(event: KeyboardEvent) {
+		if (event.key === 'Tab' && isOpen && menuRef) {
+			const focusableElements = menuRef.querySelectorAll<HTMLElement>(
+				'button, a, [tabindex]:not([tabindex="-1"])'
+			);
+			if (focusableElements.length === 0) return;
+
+			const firstElement = focusableElements[0];
+			const lastElement = focusableElements[focusableElements.length - 1];
+
+			if (event.shiftKey && document.activeElement === firstElement) {
+				// Shift+Tab on first element: wrap to last
+				event.preventDefault();
+				lastElement?.focus();
+			} else if (!event.shiftKey && document.activeElement === lastElement) {
+				// Tab on last element: wrap to first
+				event.preventDefault();
+				firstElement?.focus();
+			}
+		}
+	}
+
 	function scrollToHeader(id: string) {
 		const element = document.getElementById(id);
 		if (element) {
@@ -55,11 +79,14 @@
 		}
 	}
 
-	// Handle escape key
+	// Handle escape key and focus trap
 	function handleKeydown(event: KeyboardEvent) {
 		if (event.key === 'Escape' && isOpen) {
 			closeMenu();
+			// Restore focus to button when closing
+			buttonRef?.focus();
 		}
+		handleFocusTrap(event);
 	}
 
 	// Set up intersection observer to track active section
@@ -90,6 +117,25 @@
 		return () => observer.disconnect();
 	}
 
+	// Handle focus management when menu opens/closes
+	$effect(() => {
+		if (isOpen) {
+			// Store the previously focused element to restore later
+			previouslyFocusedElement = document.activeElement as HTMLElement;
+			// Focus the first TOC item when menu opens
+			requestAnimationFrame(() => {
+				const firstLink = menuRef?.querySelector<HTMLButtonElement>('.toc-link');
+				firstLink?.focus();
+			});
+		} else {
+			if (previouslyFocusedElement && previouslyFocusedElement !== buttonRef) {
+				// Restore focus when menu closes (unless already on button)
+				previouslyFocusedElement.focus();
+			}
+			previouslyFocusedElement = null;
+		}
+	});
+
 	$effect(() => {
 		const cleanup = setupScrollTracking();
 
@@ -124,7 +170,13 @@
 
 		<!-- Floating Menu -->
 		{#if isOpen}
-			<div class="toc-menu" bind:this={menuRef}>
+			<div
+				class="toc-menu"
+				bind:this={menuRef}
+				role="dialog"
+				aria-modal="true"
+				aria-label="Table of contents"
+			>
 				<h3 class="toc-title">{title}</h3>
 				<ul class="toc-list">
 					{#each headers as header (header.id)}

package/dist/components/custom/TableOfContents.svelte

@@ -73,7 +73,7 @@
 </script>
 
 {#if headers.length > 0}
-	<nav class="toc">
+	<nav class="toc" aria-label="Table of contents">
 		<h3 class="toc-title">{title}</h3>
 		<ul class="toc-list">
 			{#each headers as header (header.id)}

package/dist/components/quota/UpgradePrompt.svelte

@@ -261,7 +261,7 @@
 
         <div class="flex gap-3">
           <a
-            href="/admin/posts"
+            href="/arbor/posts"
             class="flex-1 px-4 py-2 bg-gray-100 hover:bg-gray-200 dark:bg-gray-700 dark:hover:bg-gray-600 text-gray-900 dark:text-gray-100 text-center font-medium rounded-lg transition-colors focus:outline-none focus:ring-2 focus:ring-gray-500 focus:ring-offset-2 dark:focus:ring-offset-gray-800"
           >
             Manage Posts

package/dist/config/tiers.d.ts

@@ -18,9 +18,11 @@ export type TierIcon = "user" | "sprout" | "tree-deciduous" | "trees" | "crown";
 export interface TierLimits {
     posts: number;
     storage: number;
+    storageDisplay: string;
     themes: number;
     navPages: number;
     commentsPerWeek: number;
+    aiWordsPerMonth: number;
 }
 export interface TierFeatures {
     blog: boolean;
@@ -121,7 +123,7 @@ export declare function tierHasFeature(tier: TierKey, feature: keyof TierFeature
 /**
  * Get a specific limit for a tier.
  */
-export declare function getTierLimit(tier: TierKey, limit: keyof TierLimits): number;
+export declare function getTierLimit(tier: TierKey, limit: keyof TierLimits): number | string;
 /**
  * Get rate limits for a tier.
  */

package/dist/config/tiers.js

@@ -22,9 +22,11 @@ export const TIERS = {
         limits: {
             posts: 0,
             storage: 0,
+            storageDisplay: "0 MB",
             themes: 0,
             navPages: 0,
             commentsPerWeek: 20,
+            aiWordsPerMonth: 0,
         },
         features: {
             blog: false,
@@ -55,14 +57,14 @@ export const TIERS = {
         display: {
             name: "Free",
             tagline: "Just visiting",
-            description: "Hang out in Meadow, follow blogs, react and comment.",
+            description: "Hang out in Meadow, follow gardens, react and comment.",
             icon: "user",
             bestFor: "Readers",
             featureStrings: [
                 "Meadow access",
                 "20 comments/week",
-                "Follow blogs",
-                "React to posts",
+                "Follow gardens",
+                "React to blooms",
             ],
         },
         support: { level: "help_center", displayString: "Help Center" },
@@ -74,9 +76,11 @@ export const TIERS = {
         limits: {
             posts: 50,
             storage: 1 * 1024 * 1024 * 1024, // 1 GB
+            storageDisplay: "1 GB",
             themes: 3,
             navPages: 0,
             commentsPerWeek: Infinity,
+            aiWordsPerMonth: 750, // ~25/day * 30 days
         },
         features: {
             blog: true,
@@ -111,7 +115,7 @@ export const TIERS = {
             icon: "sprout",
             bestFor: "Curious",
             featureStrings: [
-                "50 posts",
+                "50 blooms",
                 "1 GB storage",
                 "3 curated themes",
                 "Meadow access",
@@ -128,9 +132,11 @@ export const TIERS = {
         limits: {
             posts: 250,
             storage: 5 * 1024 * 1024 * 1024, // 5 GB
+            storageDisplay: "5 GB",
             themes: 10,
             navPages: 3,
             commentsPerWeek: Infinity,
+            aiWordsPerMonth: 3000, // ~100/day * 30 days
         },
         features: {
             blog: true,
@@ -165,7 +171,7 @@ export const TIERS = {
             icon: "tree-deciduous",
             bestFor: "Hobbyists",
             featureStrings: [
-                "250 posts",
+                "250 blooms",
                 "5 GB storage",
                 "10 themes",
                 "3 nav pages",
@@ -183,9 +189,11 @@ export const TIERS = {
         limits: {
             posts: Infinity,
             storage: 20 * 1024 * 1024 * 1024, // 20 GB
+            storageDisplay: "20 GB",
             themes: Infinity,
             navPages: 5,
             commentsPerWeek: Infinity,
+            aiWordsPerMonth: 15000, // ~500/day * 30 days
         },
         features: {
             blog: true,
@@ -220,7 +228,7 @@ export const TIERS = {
             icon: "trees",
             bestFor: "Serious Bloggers",
             featureStrings: [
-                "Unlimited posts",
+                "Unlimited blooms",
                 "20 GB storage",
                 "Theme customizer",
                 "5 nav pages",
@@ -238,9 +246,11 @@ export const TIERS = {
         limits: {
             posts: Infinity,
             storage: 100 * 1024 * 1024 * 1024, // 100 GB
+            storageDisplay: "100 GB",
             themes: Infinity,
             navPages: 8,
             commentsPerWeek: Infinity,
+            aiWordsPerMonth: 75000, // ~2500/day * 30 days
         },
         features: {
             blog: true,

package/dist/curios/timeline/Timeline.svelte

@@ -79,6 +79,19 @@
 	let loadingMore = $state(false);
 	let expandedCards = $state(new Set<string>());
 
+	// Cache rendered markdown by summary ID (prevents re-rendering on every reactive update)
+	const renderedHtmlCache = new Map<string, string>();
+
+	function getRenderedHtml(summary: Summary): string {
+		const cacheKey = summary.id;
+		if (renderedHtmlCache.has(cacheKey)) {
+			return renderedHtmlCache.get(cacheKey)!;
+		}
+		const gutterItems = summary.gutter_content ?? [];
+		const html = renderMarkdownWithGutter(summary.detailed_timeline ?? '', gutterItems);
+		renderedHtmlCache.set(cacheKey, html);
+		return html;
+	}
 
 	// Fun rest day messages
 	const REST_DAY_MESSAGES = [
@@ -320,7 +333,7 @@
 							{#if summary.detailed_timeline && isExpanded}
 								<div class="detailed-section">
 									<div class="detailed-timeline markdown-content">
-										{@html renderMarkdownWithGutter(summary.detailed_timeline, gutterItems)}
+										{@html getRenderedHtml(summary)}
 									</div>
 								</div>
 							{/if}

package/dist/curios/timeline/secrets.server.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Timeline Curio Secrets Helper
+ *
+ * Provides token retrieval with graceful migration from legacy encryption
+ * (TOKEN_ENCRYPTION_KEY) to envelope encryption (SecretsManager).
+ *
+ * Migration strategy:
+ * 1. Try SecretsManager first (new system, per-tenant isolation)
+ * 2. Fall back to legacy column + TOKEN_ENCRYPTION_KEY
+ * 3. Auto-migrate legacy tokens to SecretsManager on successful read
+ */
+import { type SecretsManager } from "../../server/secrets";
+/** Secret key names for Timeline tokens in SecretsManager */
+export declare const TIMELINE_SECRET_KEYS: {
+    readonly GITHUB_TOKEN: "timeline_github_token";
+    readonly OPENROUTER_KEY: "timeline_openrouter_key";
+};
+export type TimelineSecretKey = (typeof TIMELINE_SECRET_KEYS)[keyof typeof TIMELINE_SECRET_KEYS];
+/**
+ * Environment bindings needed for token operations
+ */
+interface TokenEnv {
+    DB: D1Database;
+    GROVE_KEK?: {
+        get(): Promise<string>;
+    };
+    TOKEN_ENCRYPTION_KEY?: string;
+}
+/**
+ * Result of a token retrieval operation
+ */
+export interface TokenResult {
+    token: string | null;
+    source: "secrets_manager" | "legacy" | "none";
+    migrated: boolean;
+}
+/**
+ * Get a Timeline token with graceful migration from legacy encryption.
+ *
+ * Priority:
+ * 1. SecretsManager (envelope encryption) - preferred, per-tenant isolation
+ * 2. Legacy column + TOKEN_ENCRYPTION_KEY - fallback with auto-migrate
+ *
+ * @param env - Platform environment with DB and encryption bindings
+ * @param tenantId - The tenant ID
+ * @param keyName - Which secret to retrieve
+ * @param legacyColumnValue - Value from the legacy encrypted column (may be null)
+ * @returns TokenResult with the decrypted token and metadata
+ */
+export declare function getTimelineToken(env: TokenEnv, tenantId: string, keyName: TimelineSecretKey, legacyColumnValue: string | null): Promise<TokenResult>;
+/**
+ * Save a Timeline token using SecretsManager (preferred) or legacy encryption.
+ *
+ * @param env - Platform environment with DB and encryption bindings
+ * @param tenantId - The tenant ID
+ * @param keyName - Which secret to store
+ * @param plainToken - The plaintext token value
+ * @returns Object indicating which system was used
+ */
+export declare function setTimelineToken(env: TokenEnv, tenantId: string, keyName: TimelineSecretKey, plainToken: string): Promise<{
+    system: "secrets_manager" | "legacy";
+    legacyValue: string | null;
+}>;
+/**
+ * Delete a Timeline token from SecretsManager.
+ * Legacy column should be cleared separately via SQL.
+ */
+export declare function deleteTimelineToken(env: TokenEnv, tenantId: string, keyName: TimelineSecretKey): Promise<boolean>;
+/**
+ * Check if a Timeline token exists in either system.
+ */
+export declare function hasTimelineToken(env: TokenEnv, tenantId: string, keyName: TimelineSecretKey, legacyColumnValue: string | null): Promise<boolean>;
+/**
+ * Create a SecretsManager instance, handling missing GROVE_KEK gracefully.
+ * Returns null if GROVE_KEK is not configured.
+ */
+export declare function maybeCreateSecretsManager(env: TokenEnv): Promise<SecretsManager | null>;
+export {};