@celestea/studio 2.7.1

package/dist/server.js

@@ -0,0 +1,119 @@
+/**
+ * `startStudioServer` (H): the ONE reusable server bootstrap.
+ *
+ * `apps/studio/src/main.ts` (source checkout) and the `celestea` CLI
+ * (`packages/cli`) both call this, so the startup log lines and the W742
+ * graceful-teardown order exist in exactly one place. `main.ts` stays a thin
+ * wrapper that pins the historical source defaults; the CLI passes its own
+ * flags.
+ *
+ * Teardown order is the W742 contract (do not reorder):
+ *   signal -> stop accepting traffic (bounded grace) -> flush grants audit ->
+ *   engine down (workers settled, logs closed) -> let the loop drain.
+ */
+import { serve } from "@hono/node-server";
+import { createStudioApp } from "./app.js";
+import { loadStudioConfig } from "./config.js";
+import { assertBindIsSafe } from "./auth/api-token.js";
+import { engineLlmView } from "./runtime/llm-assembly.js";
+import { autowakeEnabled, ENV_AUTOWAKE } from "@celestea/runtime";
+/** Env knob: drain window before leftover sockets are cut. */
+export const ENV_DRAIN_MS = "CELESTEA_SHUTDOWN_DRAIN_MS";
+/** Env knob: ceiling for the whole teardown. */
+export const ENV_TEARDOWN_MS = "CELESTEA_SHUTDOWN_TIMEOUT_MS";
+/** The one startup banner (kept out of `startStudioServer` for the size rule). */
+function logListeningBanner(info) {
+    console.log(`[celestea-studio-ts] listening on http://${info.hostname}:${info.port} (${info.endpointCount} contract endpoints)`);
+    const v = info.view;
+    console.log(`[celestea-studio-ts] llm: mode=${v.mode} model=${v.model} base_url=${v.baseUrl} ` +
+        `key=${v.hasApiKey ? "set" : "missing"} context_window=${v.contextWindow ?? "n/a"} ` +
+        `timeouts(c/r/i)=${v.timeouts.connectMs ?? "off"}/${v.timeouts.responseMs ?? "off"}/${v.timeouts.idleMs ?? "off"}ms`);
+    console.log(`[celestea-studio-ts] reasoning_effort=${v.reasoningEffort ?? "off"} max_output_tokens=${v.maxOutputTokens ?? "off"}`);
+    console.log(`[celestea-studio-ts] api_key_env=${info.apiKeyEnv} (key read from the environment only)`);
+    console.log(autowakeEnabled(info.env)
+        ? `[celestea-studio-ts] autowake: enabled (a worker receipt wakes its host session; ${ENV_AUTOWAKE}=0 disables)`
+        : `[celestea-studio-ts] autowake: disabled by ${ENV_AUTOWAKE}`);
+}
+/** Boot the studio HTTP server; returns a handle whose `stop` is the teardown. */
+export function startStudioServer(options) {
+    const env = options.env ?? process.env;
+    // H: resolve the config HERE so the listening callback can write the ACTUAL
+    // address back into it. `services.config` is the same object, so
+    // `GET /api/health.bind` can never disagree with the socket the process is on
+    // (the "never lie to the operator" rule); `--port 0` reports the real port.
+    const config = options.config ?? loadStudioConfig({ cwd: options.cwd, env });
+    // H-security: a non-loopback listener with no token is a remote-shell hole
+    // (POST /api/exec). Refuse BEFORE composing or binding; never degrade silently.
+    assertBindIsSafe(options.hostname, config.authToken);
+    const { app, routes, services } = createStudioApp({ ...options, config });
+    const profile = services.runtime.profile();
+    const view = engineLlmView(profile, env);
+    const loud = options.log ?? true;
+    const drainMs = Number.parseInt(env[ENV_DRAIN_MS] ?? "2000", 10);
+    const teardownMs = Number.parseInt(env[ENV_TEARDOWN_MS] ?? "5000", 10);
+    let boundPort = options.port;
+    let announceListening = () => { };
+    const listening = new Promise((resolve) => {
+        announceListening = resolve;
+    });
+    const server = serve({ fetch: app.fetch, port: options.port, hostname: options.hostname }, (info) => {
+        boundPort = info.port;
+        config.bind = `${options.hostname}:${info.port}`;
+        announceListening({ port: info.port, hostname: options.hostname });
+        if (loud) {
+            logListeningBanner({ hostname: options.hostname, port: info.port, endpointCount: routes.length, view, apiKeyEnv: profile.api_key_env, env });
+        }
+        options.onListening?.({ port: info.port, hostname: options.hostname, endpointCount: routes.length });
+    });
+    const engine = services.runtime;
+    let stopping = false;
+    const log = (line) => {
+        if (loud)
+            console.log(`[celestea-studio-ts] ${line}`);
+    };
+    async function within(work, ms) {
+        let timer = null;
+        const deadline = new Promise((resolve) => {
+            timer = setTimeout(resolve, ms);
+        });
+        try {
+            await Promise.race([Promise.resolve(work), deadline]);
+        }
+        catch (e) {
+            log(`teardown step failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        finally {
+            if (timer !== null)
+                clearTimeout(timer);
+        }
+    }
+    async function stopTraffic() {
+        await within(new Promise((resolve) => {
+            server.close(() => resolve());
+        }), drainMs);
+        server.closeAllConnections?.();
+    }
+    async function stop(signal) {
+        if (stopping) {
+            log(`${signal} again — exiting now (in-flight work is dropped)`);
+            return;
+        }
+        stopping = true;
+        log(`${signal} received — draining (grace ${drainMs}ms)`);
+        await stopTraffic();
+        log("traffic stopped (listener closed, leftover sockets cut)");
+        await within(services.grants.audit.flush(), drainMs);
+        log("audit flushed");
+        await within(engine.shutdown?.(), teardownMs);
+        log("engine stopped (workers settled, session logs closed) — loop may drain");
+    }
+    return {
+        get port() {
+            return boundPort;
+        },
+        hostname: options.hostname,
+        endpointCount: routes.length,
+        listening,
+        stop,
+    };
+}

package/dist/settings.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Host-side mutable settings (the `USER_OVERRIDE` slot + the base-url override).
+ *
+ * Two things are NOT engine state but must survive between requests:
+ *   - `system_prompt` (POST /api/config): a non-empty value bypasses the whole
+ *     prompt registry assembly; an empty value clears the override and falls
+ *     back to `build_gen` (`src/prompts.rs` memoryOverride);
+ *   - `base_url` (POST /api/config): an empty value clears the override so the
+ *     env / provider default chain applies again.
+ *
+ * The api_key is deliberately NOT here: it goes straight into the process env
+ * and is never held in a field that could be serialized by accident.
+ */
+export declare class StudioSettings {
+    private systemPrompt;
+    private baseUrl;
+    systemPromptOverride(): string | null;
+    /** "" clears the override (fall back to the registry assembly). */
+    setSystemPromptOverride(value: string): void;
+    baseUrlOverride(): string | null;
+    /** "" clears the override (fall back to env / provider chain). */
+    setBaseUrlOverride(value: string): void;
+}

package/dist/settings.js

@@ -0,0 +1,31 @@
+/**
+ * Host-side mutable settings (the `USER_OVERRIDE` slot + the base-url override).
+ *
+ * Two things are NOT engine state but must survive between requests:
+ *   - `system_prompt` (POST /api/config): a non-empty value bypasses the whole
+ *     prompt registry assembly; an empty value clears the override and falls
+ *     back to `build_gen` (`src/prompts.rs` memoryOverride);
+ *   - `base_url` (POST /api/config): an empty value clears the override so the
+ *     env / provider default chain applies again.
+ *
+ * The api_key is deliberately NOT here: it goes straight into the process env
+ * and is never held in a field that could be serialized by accident.
+ */
+export class StudioSettings {
+    systemPrompt = null;
+    baseUrl = null;
+    systemPromptOverride() {
+        return this.systemPrompt;
+    }
+    /** "" clears the override (fall back to the registry assembly). */
+    setSystemPromptOverride(value) {
+        this.systemPrompt = value.trim() === "" ? null : value;
+    }
+    baseUrlOverride() {
+        return this.baseUrl;
+    }
+    /** "" clears the override (fall back to env / provider chain). */
+    setBaseUrlOverride(value) {
+        this.baseUrl = value === "" ? null : value;
+    }
+}

package/dist/sse.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Studio SSE bus — the host side of `GET /api/events` (W513).
+ *
+ * Contract points implemented here:
+ *   - envelope `{v:2, session, turn, seq, payload}`: `session` is the session the
+ *     frame belongs to (`null` = process-level), `turn` is the SESSION-local turn
+ *     number, `seq` stays a monotonic process-global counter and `payload` is
+ *     byte-identical to the frozen 8-event contract;
+ *   - exactly 8 event names (`SSE_EVENT_NAMES` lives in `@celestea/core`);
+ *   - default = one connection receives EVERY session (the client routes
+ *     locally); `subscribe({session})` = server-side split for narrow clients;
+ *   - back-pressure is PER SESSION BUCKET: a background session's text flood can
+ *     no longer evict the focused session's frames. Only the overflowing bucket
+ *     is dropped, and the marker carries `{session, dropped, hint}`.
+ *
+ * NOTE (W513): the design sketch also proposed coalescing `status` frames per
+ * session. That is NOT done here: the P5 replay harness compares the frame
+ * stream byte-for-byte against the derived transcript, and dropping a status
+ * frame silently is indistinguishable from losing a real frame. Per-session
+ * bucketing alone provides the isolation the feature needs.
+ *
+ * The bus is push-based (each subscriber owns a bounded queue plus a waiter) so
+ * a Hono `streamSSE` handler awaits frames instead of polling. Delivery is
+ * deliberately lossy under back-pressure: that IS the contract.
+ */
+import { LAGGED_HINT, type SseEnvelope, type SseEventName, type Statusline } from "@celestea/core";
+export { LAGGED_HINT };
+/** Core keeps the canonical bus capacity; the host re-exports it under its own name. */
+export declare const SSE_BUS_CAPACITY = 512;
+/** Envelope version this bus writes (`2` = per-session envelope). */
+export declare const SSE_ENVELOPE_VERSION = 2;
+/** Smallest per-session bucket (never starve one session in a busy process). */
+export declare const MIN_BUCKET_CAPACITY = 64;
+export interface BusFrame {
+    event: SseEventName;
+    envelope: SseEnvelope;
+}
+export interface BusSubscription {
+    /** Await the next frame; resolves to null once the subscription is closed. */
+    next(): Promise<BusFrame | null>;
+    close(): void;
+    /** Number of times this subscriber fell behind (one lagged frame each). */
+    dropped(): number;
+}
+/** Server-side split: keep only these sessions (plus process-level frames). */
+export interface SubscribeOptions {
+    /** One session id (`null` keeps only process-level frames). */
+    session?: string | null;
+    /** Several session ids (repeatable `?session=`). */
+    sessions?: readonly string[];
+}
+export interface StudioBus {
+    emit(event: SseEventName, turn: number, payload: Record<string, unknown>, session?: string | null): BusFrame;
+    subscribe(opts?: SubscribeOptions): BusSubscription;
+    /** Current global sequence counter (next value to be handed out). */
+    seq(): number;
+    subscriberCount(): number;
+}
+export interface StudioBusOptions {
+    capacity?: number;
+    /** Per-session bucket floor (default [MIN_BUCKET_CAPACITY], clamped to capacity). */
+    minBucket?: number;
+    /** Statusline snapshot embedded in the `lagged` marker. */
+    statusline?: () => Statusline | Record<string, unknown>;
+}
+/** One bus per Studio app; adapters and handlers share it. */
+export declare function createStudioBus(opts?: StudioBusOptions): StudioBus;

package/dist/sse.js

@@ -0,0 +1,186 @@
+/**
+ * Studio SSE bus — the host side of `GET /api/events` (W513).
+ *
+ * Contract points implemented here:
+ *   - envelope `{v:2, session, turn, seq, payload}`: `session` is the session the
+ *     frame belongs to (`null` = process-level), `turn` is the SESSION-local turn
+ *     number, `seq` stays a monotonic process-global counter and `payload` is
+ *     byte-identical to the frozen 8-event contract;
+ *   - exactly 8 event names (`SSE_EVENT_NAMES` lives in `@celestea/core`);
+ *   - default = one connection receives EVERY session (the client routes
+ *     locally); `subscribe({session})` = server-side split for narrow clients;
+ *   - back-pressure is PER SESSION BUCKET: a background session's text flood can
+ *     no longer evict the focused session's frames. Only the overflowing bucket
+ *     is dropped, and the marker carries `{session, dropped, hint}`.
+ *
+ * NOTE (W513): the design sketch also proposed coalescing `status` frames per
+ * session. That is NOT done here: the P5 replay harness compares the frame
+ * stream byte-for-byte against the derived transcript, and dropping a status
+ * frame silently is indistinguishable from losing a real frame. Per-session
+ * bucketing alone provides the isolation the feature needs.
+ *
+ * The bus is push-based (each subscriber owns a bounded queue plus a waiter) so
+ * a Hono `streamSSE` handler awaits frames instead of polling. Delivery is
+ * deliberately lossy under back-pressure: that IS the contract.
+ */
+import { BUS_CAPACITY as CORE_CAPACITY, LAGGED_HINT, SSE_EVENT_NAMES, } from "@celestea/core";
+export { LAGGED_HINT };
+/** Core keeps the canonical bus capacity; the host re-exports it under its own name. */
+export const SSE_BUS_CAPACITY = CORE_CAPACITY;
+/** Envelope version this bus writes (`2` = per-session envelope). */
+export const SSE_ENVELOPE_VERSION = 2;
+/** Smallest per-session bucket (never starve one session in a busy process). */
+export const MIN_BUCKET_CAPACITY = 64;
+function bucketKey(session) {
+    return session ?? "";
+}
+/** One subscriber: an ordered frame list plus per-session occupancy counts. */
+class SessionBuckets {
+    capacity;
+    minBucket;
+    accept;
+    lagged;
+    frames = [];
+    counts = new Map();
+    waiter = null;
+    closed = false;
+    dropCount = 0;
+    constructor(capacity, minBucket, accept, lagged) {
+        this.capacity = capacity;
+        this.minBucket = minBucket;
+        this.accept = accept;
+        this.lagged = lagged;
+    }
+    push(frame) {
+        if (this.closed || !this.accept(frame))
+            return;
+        const key = bucketKey(frame.envelope.session);
+        if ((this.counts.get(key) ?? 0) >= this.bucketCap()) {
+            this.dropCount += 1;
+            this.append(this.lagged(frame.envelope.session, this.dropBucket(key) + 1));
+            return;
+        }
+        this.append(frame);
+    }
+    next() {
+        const frame = this.shift();
+        if (frame !== undefined)
+            return Promise.resolve(frame);
+        if (this.closed)
+            return Promise.resolve(null);
+        return new Promise((resolve) => {
+            this.waiter = { resolve };
+        });
+    }
+    close() {
+        this.closed = true;
+        this.frames.length = 0;
+        const waiter = this.waiter;
+        this.waiter = null;
+        waiter?.resolve(null);
+    }
+    dropped() {
+        return this.dropCount;
+    }
+    /** Per-session bucket cap: the fair share, never below `minBucket`. */
+    bucketCap() {
+        const buckets = Math.max(1, this.counts.size);
+        return Math.max(Math.min(this.minBucket, this.capacity), Math.floor(this.capacity / buckets));
+    }
+    append(frame) {
+        this.frames.push(frame);
+        const key = bucketKey(frame.envelope.session);
+        this.counts.set(key, (this.counts.get(key) ?? 0) + 1);
+        this.wake();
+    }
+    /** Drop ONE session's backlog; returns how many frames were discarded. */
+    dropBucket(key) {
+        const kept = [];
+        let removed = 0;
+        for (const frame of this.frames) {
+            if (bucketKey(frame.envelope.session) === key)
+                removed += 1;
+            else
+                kept.push(frame);
+        }
+        this.frames.length = 0;
+        this.frames.push(...kept);
+        this.counts.set(key, 0);
+        return removed;
+    }
+    /** Dequeue one frame and release its bucket slot. */
+    shift() {
+        const frame = this.frames.shift();
+        if (frame === undefined)
+            return undefined;
+        const key = bucketKey(frame.envelope.session);
+        this.counts.set(key, Math.max(0, (this.counts.get(key) ?? 1) - 1));
+        return frame;
+    }
+    wake() {
+        const waiter = this.waiter;
+        if (waiter === null)
+            return;
+        this.waiter = null;
+        waiter.resolve(this.shift() ?? null);
+    }
+}
+function assertEventName(event) {
+    if (!SSE_EVENT_NAMES.includes(event)) {
+        throw new Error(`unknown SSE event '${event}': the contract freezes ${SSE_EVENT_NAMES.length} names`);
+    }
+}
+/** The `?session=` filter: matching sessions plus process-level frames. */
+function sessionFilter(opts) {
+    const one = opts.session;
+    const many = opts.sessions;
+    if (one === undefined && many === undefined)
+        return () => true;
+    const wanted = new Set(many ?? []);
+    if (one !== undefined && one !== null)
+        wanted.add(one);
+    return (frame) => frame.envelope.session === null || wanted.has(frame.envelope.session);
+}
+/** One bus per Studio app; adapters and handlers share it. */
+export function createStudioBus(opts = {}) {
+    const capacity = opts.capacity ?? SSE_BUS_CAPACITY;
+    const minBucket = Math.min(opts.minBucket ?? MIN_BUCKET_CAPACITY, capacity);
+    const queues = new Set();
+    let seq = 0;
+    const laggedFrame = (session, dropped) => ({
+        event: "status",
+        envelope: {
+            v: SSE_ENVELOPE_VERSION,
+            session,
+            turn: 0,
+            seq: seq++,
+            payload: {
+                phase: "lagged",
+                hint: LAGGED_HINT,
+                session,
+                dropped,
+                statusline: opts.statusline ? opts.statusline() : {},
+            },
+        },
+    });
+    function emit(event, turn, payload, session = null) {
+        assertEventName(event);
+        const frame = { event, envelope: { v: SSE_ENVELOPE_VERSION, session, turn, seq: seq++, payload } };
+        for (const q of queues)
+            q.push(frame);
+        return frame;
+    }
+    function subscribe(sub) {
+        const q = new SessionBuckets(capacity, minBucket, sessionFilter(sub ?? {}), laggedFrame);
+        queues.add(q);
+        return {
+            next: () => q.next(),
+            close: () => {
+                q.close();
+                queues.delete(q);
+            },
+            dropped: () => q.dropped(),
+        };
+    }
+    return { emit, subscribe, seq: () => seq, subscriberCount: () => queues.size };
+}

package/dist/static.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Static file serving + SPA fallback (`src/main.rs:735-847`).
+ *
+ * The Vite build under `STUDIO_STATIC_ROOT` is served READ-ONLY and hardened
+ * twice: `sanitizeRel` refuses `..`, absolute and prefix components on the
+ * request path, and the resolved path is then re-checked to sit inside the
+ * root (so a symlink cannot escape either). Unknown `/api/*` paths never reach
+ * this handler — they are 404 JSON, which is why the API 404 is registered
+ * before the fallback. A missing build serves the "build the frontend first"
+ * hint page instead.
+ */
+import type { Hono } from "hono";
+export declare function contentTypeFor(rel: string): string;
+/** Allow normal components only: reject `..`, absolute and prefix components. */
+export declare function sanitizeRel(rel: string): string | null;
+/** Resolve inside the root or refuse (catches symlink escapes too). */
+export declare function resolveWithinRoot(root: string, rel: string): string | null;
+/** The static/SPA handler; `/api/*` is answered by the caller's 404 route. */
+export declare function serveStaticPath(root: string, rawPath: string): Response;
+export declare function registerStatic(app: Hono, root: string): void;

package/dist/static.js

@@ -0,0 +1,120 @@
+/**
+ * Static file serving + SPA fallback (`src/main.rs:735-847`).
+ *
+ * The Vite build under `STUDIO_STATIC_ROOT` is served READ-ONLY and hardened
+ * twice: `sanitizeRel` refuses `..`, absolute and prefix components on the
+ * request path, and the resolved path is then re-checked to sit inside the
+ * root (so a symlink cannot escape either). Unknown `/api/*` paths never reach
+ * this handler — they are 404 JSON, which is why the API 404 is registered
+ * before the fallback. A missing build serves the "build the frontend first"
+ * hint page instead.
+ */
+import { readFileSync, statSync, realpathSync } from "node:fs";
+import { extname, resolve, sep } from "node:path";
+const MIME = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".map": "application/json",
+    ".txt": "text/plain; charset=utf-8",
+    ".webmanifest": "application/manifest+json",
+};
+const HINT_PAGE = `<!doctype html><meta charset="utf-8"><title>celestea-studio</title>
+<body style="font-family:system-ui;padding:2rem">
+<h1>celestea-studio TS</h1>
+<p>frontend/dist is missing — build the frontend first (<code>pnpm build</code> in frontend/).</p>
+<p>The HTTP API is available at <code>/api/*</code>.</p>
+</body>`;
+export function contentTypeFor(rel) {
+    return MIME[extname(rel).toLowerCase()] ?? "application/octet-stream";
+}
+/** Allow normal components only: reject `..`, absolute and prefix components. */
+export function sanitizeRel(rel) {
+    const parts = [];
+    for (const raw of rel.split("/")) {
+        if (raw === "" || raw === ".")
+            continue;
+        if (raw === ".." || raw.includes("\\") || raw.includes("\0"))
+            return null;
+        parts.push(raw);
+    }
+    if (parts.length === 0)
+        return null;
+    return parts.join("/");
+}
+/** Resolve inside the root or refuse (catches symlink escapes too). */
+export function resolveWithinRoot(root, rel) {
+    const target = resolve(root, rel);
+    const realRoot = (() => {
+        try {
+            return realpathSync(root);
+        }
+        catch {
+            return resolve(root);
+        }
+    })();
+    const real = (() => {
+        try {
+            return realpathSync(target);
+        }
+        catch {
+            return target;
+        }
+    })();
+    if (real !== realRoot && !real.startsWith(realRoot.endsWith(sep) ? realRoot : `${realRoot}${sep}`))
+        return null;
+    return target;
+}
+function readIfFile(path) {
+    try {
+        if (!statSync(path).isFile())
+            return null;
+        return path;
+    }
+    catch {
+        return null;
+    }
+}
+function readStatic(root, rel) {
+    const file = readIfFile(resolveWithinRoot(root, rel) ?? "");
+    if (file === null)
+        return null;
+    return { body: readFileSync(file), contentType: contentTypeFor(rel) };
+}
+function bytesResponse(body, contentType, status = 200) {
+    return new Response(body, { status, headers: { "content-type": contentType, "cache-control": "no-cache" } });
+}
+function htmlResponse(body, status = 200) {
+    return new Response(body, { status, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
+}
+/** The static/SPA handler; `/api/*` is answered by the caller's 404 route. */
+export function serveStaticPath(root, rawPath) {
+    if (rawPath.startsWith("/api/"))
+        return Response.json({ error: "not found" }, { status: 404 });
+    const rel = sanitizeRel(rawPath.replace(/^\/+/, "") === "" ? "index.html" : rawPath.replace(/^\/+/, ""));
+    if (rel === null)
+        return Response.json({ error: "not found" }, { status: 404 });
+    const file = readStatic(root, rel);
+    if (file !== null)
+        return bytesResponse(file.body, file.contentType);
+    if (rel === "index.html" || !rel.includes(".")) {
+        const index = readStatic(root, "index.html");
+        return index === null ? htmlResponse(HINT_PAGE) : bytesResponse(index.body, "text/html; charset=utf-8");
+    }
+    return Response.json({ error: "not found" }, { status: 404 });
+}
+export function registerStatic(app, root) {
+    app.get("*", (c) => serveStaticPath(root, new URL(c.req.url).pathname));
+}

package/dist/store/builtin-sections.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Builtin prompt sections — the frozen 10-row registry (order 100..1000).
+ *
+ * Ported verbatim from `fixtures/live/prompts.json` (a read-only live capture
+ * of GET /api/prompts), which mirrors `src/prompts.rs:89-99` BUILTIN_SECTIONS.
+ * W782 is the one deliberate edit since: `environment` (order 200) no longer
+ * spells out this checkout's paths/port/unit name — it renders `{{studio_*}}`
+ * variables derived at runtime, and no template may carry an absolute path.
+ * These are DATA, not logic: the registry stores them as `source: "builtin"`
+ * and a global/workspace row with the same id only swaps the template.
+ *
+ * W729 (P0, K6/D6): the registry is still exactly 10 rows with the SAME order
+ * array; the session mode is expressed as a TEMPLATE VARIANT of `tool_access`
+ * (order 300), never as an 11th section. `BUILTIN_SECTIONS` carries variant A
+ * (the `standard` text) and [TOOL_ACCESS_VARIANTS] carries both, so the
+ * mode-aware assembly picks one and every other consumer still sees a
+ * 10-row table.
+ */
+import { type SessionMode } from "./mode.js";
+/**
+ * The `tool_access` (order 300) template variants — `docs/modes-standard-vs-execution.md`
+ * §1.3, verbatim. K3: the variant table is module-level data, never inlined at a
+ * call site; K6: it is the ONLY difference between the two mode assemblies.
+ *
+ *   A `standard`  — direct calls are the normal path; `run_code` is available.
+ *   B `execution` — one program per dependent sequence + the hard limits.
+ *
+ * Byte budget: A = 353 B, B = 1068 B (the frozen 10-section assembly is 3835 B
+ * before this change, PROMPT_MAX_LEN is 8192 B — both variants stay far below).
+ */
+export declare const TOOL_ACCESS_VARIANTS: Readonly<Record<SessionMode, string>>;
+export interface BuiltinSection {
+    id: string;
+    name: string;
+    order: number;
+    template: string;
+}
+export declare const BUILTIN_SECTIONS: readonly BuiltinSection[];
+/**
+ * Section id -> builtin template (the last-resort fallback) under one mode: the
+ * `tool_access` row is swapped for that mode's variant, every other row is the
+ * frozen template. A user override (global/workspace/bound) still wins,
+ * because the overlay replaces the template this function produced (R4).
+ */
+export declare function builtinTemplate(id: string, mode?: SessionMode): string | undefined;
+/** The builtin rows of one mode, copied (a caller can never mutate the table). */
+export declare function builtinRowsFor(mode: SessionMode): Array<{
+    id: string;
+    name: string;
+    template: string;
+    order: number;
+}>;