@quantiya/codevibe-core 2.0.0 → 2.0.2

package/dist/orchestration-shell/gate-prompts.d.ts

@@ -0,0 +1,481 @@
+import { Event } from '../types/events';
+/**
+ * `metadata.prompt_kind` value for the 5-option Path B (Halted-resolution)
+ * gate prompt. Mirrors `METADATA_PROMPT_KIND` at `appsync_emit.rs:68`.
+ *
+ * Cross-impl literal parity is a load-bearing invariant — see Test 23
+ * (`hostile-grep.test.ts`).
+ */
+export declare const ORCHESTRATION_ESCALATED_GATE_PROMPT_KIND: "orchestration_escalated_gate";
+/**
+ * `metadata.prompt_kind` value for the 2-option Path A (FinalApproval)
+ * gate prompt. Mirrors `METADATA_PROMPT_KIND_FINAL_APPROVAL` at
+ * `appsync_emit.rs:297`.
+ */
+export declare const ORCHESTRATION_FINAL_APPROVAL_PROMPT_KIND: "orchestration_final_approval";
+/**
+ * `metadata.prompt_kind` value for the 4-option continuation-handoff gate
+ * prompt (3 target agents + CANCEL). Mirrors the Rust emitter const
+ * `METADATA_PROMPT_KIND_CONTINUATION_HANDOFF = "continuation_offer_handoff"`
+ * (`appsync_emit.rs`, P1). PHASE-CP-10-MIN (#585) LOCK #C10M-1/2.
+ *
+ * Cross-impl literal parity is a load-bearing invariant — see Test 23
+ * (`hostile-grep.test.ts`).
+ */
+export declare const CONTINUATION_OFFER_HANDOFF_PROMPT_KIND: "continuation_offer_handoff";
+/**
+ * Source-of-truth string literals for the hostile-grep cross-impl parity
+ * test (`__tests__/hostile-grep.test.ts`, Test 23). Mirrors the Rust
+ * emitter at
+ * `codevibe-core-rs/crates/codevibe-orchestration-lambda/src/appsync_emit.rs`
+ * lines 63 / 68 / 297 / 312-340 / 351-364.
+ *
+ * Do NOT remove or reorder — Test 23 greps this module for each literal
+ * verbatim. Drift here = silent cross-platform breakage:
+ *   - tool_name discriminator        → `metadata.tool_name`
+ *   - prompt_kind discriminators     → `metadata.prompt_kind`
+ *   - 5-tuple escalation option ids  → `metadata.payload.options[*].id`
+ *     (position-ordered: ACCEPT, ACCEPT_WITH_NOTES, REJECT_WITH_NOTES,
+ *      REJECT_RESTART, ABORT_TASK)
+ *   - 2-tuple final-approval ids     → `metadata.payload.options[*].id`
+ *     (position-ordered: APPROVE, CANCEL)
+ *
+ * NB: the option ids themselves are NEVER referenced as TS string
+ * constants at runtime — the renderer + mapper read them from the wire
+ * per #C8M-1. This block exists purely as a hostile-grep anchor so any
+ * Rust-side reordering or rename trips the parity test on the TS side
+ * as well.
+ */
+export declare const SOURCE_OF_TRUTH_LITERALS: {
+    readonly toolName: "OrchestrationGate";
+    readonly escalatedPromptKind: "orchestration_escalated_gate";
+    readonly finalApprovalPromptKind: "orchestration_final_approval";
+    readonly escalationOptionIds: readonly ["ACCEPT", "ACCEPT_WITH_NOTES", "REJECT_WITH_NOTES", "REJECT_RESTART", "ABORT_TASK"];
+    readonly finalApprovalOptionIds: readonly ["APPROVE", "CANCEL"];
+    readonly continuationHandoffPromptKind: "continuation_offer_handoff";
+    readonly continuationHandoffOptionIds: readonly ["CONTINUE_WITH", "CANCEL"];
+};
+/**
+ * Discriminated union over the two prompt kinds CP-8 min routes through
+ * the gate-prompt path. Anything outside this union flows to the
+ * existing `subagent-event` / `mobile-event-replay` path per #C8M-3.
+ */
+export type GatePromptKind = typeof ORCHESTRATION_ESCALATED_GATE_PROMPT_KIND | typeof ORCHESTRATION_FINAL_APPROVAL_PROMPT_KIND | typeof CONTINUATION_OFFER_HANDOFF_PROMPT_KIND;
+/**
+ * One option entry on the wire — matches the Rust struct projected by
+ * `build_escalation_options()` / `build_final_approval_options()`.
+ */
+export interface GatePromptOption {
+    readonly id: string;
+    readonly label: string;
+    readonly description: string;
+    /**
+     * PHASE-CP-10-MIN (#585) — the per-option target agent for the
+     * `continuation_offer_handoff` prompt (CLAUDE/CODEX/GEMINI/ANTIGRAVITY).
+     * On the wire the 3-4 agent options all carry `id: "CONTINUE_WITH"` (a valid
+     * `UserDecisionKind`); the agent rides this NEW per-option `targetAgent`
+     * field (Rust `OptionPayload.target_agent` with
+     * `#[serde(rename="targetAgent", skip_serializing_if="Option::is_none")]`,
+     * P2/M-A/M3). Absent on every pre-CP-10 array (escalation / final-approval)
+     * because the Rust field is skipped when `None`. LOCK #C10M-1.
+     */
+    readonly targetAgent?: string;
+}
+/**
+ * Locked design §4 #C8M-9. The plaintext-parsed envelope the
+ * dispatcher hands to the reducer via `GATE_PROMPT_RECEIVED`. Captures
+ * everything the renderer + submit path need; no other field is read
+ * from `event.metadata` after extraction.
+ *
+ * Field provenance (Rust `appsync_emit.rs::build_metadata_json` lines
+ * 1459-1493):
+ *   - `promptKind`         from `metadata.prompt_kind`
+ *   - `taskId` / `gateId`  from `metadata.payload.{taskId,gateId}` (ROOT, #572)
+ *   - `currentRound`       from `metadata.payload.outcome.round`
+ *   - `options`            from `metadata.payload.options` (5 or 2 entries)
+ *   - `reason`             from `metadata.payload.outcome.reason` (Path B only)
+ *   - `summary`            from `metadata.summary`
+ *   - `receivedAt`         from `event.timestamp` (server-set; ISO 8601)
+ */
+export interface GatePromptEnvelope {
+    readonly promptKind: GatePromptKind;
+    readonly taskId: string;
+    readonly gateId: string;
+    readonly currentRound: number;
+    readonly options: ReadonlyArray<GatePromptOption>;
+    readonly reason?: string;
+    readonly summary?: string;
+    readonly receivedAt: string;
+    /** Plaintext 3-entry timeline strip (gate_opened → verdicts_collected → gate_resolved). */
+    readonly timeline?: ReadonlyArray<GateTimelineEntry>;
+    /** Plaintext per-round cascade rows; #574 emits a single entry today (renders no cascade). */
+    readonly roundHistory?: ReadonlyArray<GateRoundHistoryEntry>;
+    /** Decrypted reviewer-disagreement panel (or an unavailable marker); set by the dispatcher. */
+    readonly verdictDetails?: GateVerdictDetails;
+    /** The continuation offer's desktop-minted ULID (`metadata.offerId`). */
+    readonly offerId?: string;
+    /** The agent that halted (closed enum CLAUDE/CODEX/GEMINI/ANTIGRAVITY; `metadata.sourceAgent`). */
+    readonly sourceAgent?: string;
+    /** The authoritative 64-hex SHA-256 packet hash (`metadata.packetHash`). */
+    readonly packetHash?: string;
+    readonly groupEscalation?: {
+        readonly taskGroupId: string;
+    };
+}
+/**
+ * One `metadata.timeline` entry [SRC `appsync_emit.rs:1623-1625`]:
+ * `{ at: <rfc3339>, kind: "gate_opened"|"verdicts_collected"|"gate_resolved" }`.
+ * `kind` is kept as the raw string (forward-compatible; unknown kinds
+ * still render their timestamp).
+ */
+export interface GateTimelineEntry {
+    readonly at: string;
+    readonly kind: string;
+}
+/**
+ * One `metadata.roundHistory` entry [SRC `appsync_emit.rs` ENG.5 emit]:
+ * `{ round: <int>, kind: <str>, reason: <str> }`. Plaintext closed-enum
+ * strings. The cascade renders ONLY when `roundHistory.length > 1`.
+ */
+export interface GateRoundHistoryEntry {
+    readonly round: number;
+    readonly kind: string;
+    readonly reason: string;
+}
+/**
+ * One decrypted reviewer seat (per shared-contract §2 / `verdict_details.rs`
+ * `build_panel`): `{ seatId, role, reviewerAgent, decision, findings,
+ * findingsTruncated, truncatedFindingCount }`. `decision` is the 4-value
+ * UPPERCASE `VerdictKind`; map via `decisionCopy` (unknown → raw string).
+ */
+export interface GateReviewerSeat {
+    readonly seatId: number;
+    readonly role: string;
+    readonly reviewerAgent: string;
+    readonly decision: string;
+    readonly findings: ReadonlyArray<string>;
+    readonly findingsTruncated: boolean;
+    readonly truncatedFindingCount: number;
+}
+/**
+ * The decrypted reviewer-disagreement panel attached to the envelope by the
+ * dispatcher. Either `available` (the decrypted `{ reviewers, ... }` object)
+ * OR `unavailable` (fail-closed: decrypt error, size cap, or encryption
+ * error). NEVER carries ciphertext.
+ */
+export type GateVerdictDetails = {
+    readonly status: 'available';
+    readonly reviewers: ReadonlyArray<GateReviewerSeat>;
+    /** Root marker (#574 size-degrade): findings dropped → "audit browser" hint. */
+    readonly findingsOmittedForSize: boolean;
+} | {
+    readonly status: 'unavailable';
+    /**
+     * Why the panel can't be shown:
+     *   - 'size'              → `verdictDetailsUnavailable: "size"` (adds the audit-browser hint)
+     *   - 'encryption_error'  → `verdictDetailsUnavailable: "encryption_error"`
+     *   - 'unavailable_other' → ANY other present non-empty `verdictDetailsUnavailable`
+     *                           marker (unknown / future; neutral line only, no hint)
+     *   - 'decrypt_failed'    → client-side decrypt/parse failure (fail-closed)
+     */
+    readonly reason: 'size' | 'encryption_error' | 'unavailable_other' | 'decrypt_failed';
+};
+/**
+ * Defensive validator (per #C8M-1 + #C8M-2). Returns `null` on ANY of:
+ *   - event is not an INTERACTIVE_PROMPT
+ *   - metadata absent / un-parseable
+ *   - `prompt_kind` not one of the two orchestration discriminators
+ *   - `payload.options` not an array, OR wrong length
+ *     (5 for escalation, 2 for final-approval)
+ *   - any entry missing `id` / `label` / `description` or with non-string
+ *     `id`
+ *   - `payload.{taskId,gateId}` (ROOT) or `payload.outcome.round` missing
+ *     or wrong type
+ *
+ * Wire-shape note (#572): `taskId`/`gateId`/`sessionId` live at the
+ * `payload` ROOT; `outcome` carries only `{kind, reason, round}` — per the
+ * authoritative engine emit (`codevibe-orchestration-lambda/src/appsync_emit.rs:1514-1523`).
+ * The mobile V1 bridge already reads them at root; this extractor matches.
+ *
+ * The caller (dispatcher in `index.ts`) is responsible for emitting the
+ * `kind: 'advisory'` ConversationEntry on null-return per #C8M-1.
+ */
+export declare function extractGatePromptEnvelope(event: Event): GatePromptEnvelope | null;
+/**
+ * The canonical 5-option group-decision escalation set, position-bound to the
+ * `submitGroupDecision` / `claimGroupDecision` `GroupDecisionLabel` union AND
+ * verbatim with the engine's `escalationOptionIds` (so the rendered numbered
+ * list, the `_with_notes` notes-phase trigger, and the `mapTypedNumberToDecisionKind`
+ * uppercasing all behave EXACTLY like a per-track engine escalation). The labels
+ * + descriptions are desktop-authored (the group halt rides Class B, not the
+ * engine INTERACTIVE_PROMPT path, so there is no server-supplied copy) but the
+ * IDS are the load-bearing contract — they map 1:1 onto the two-phase submit.
+ */
+export declare const GROUP_ESCALATION_OPTIONS: ReadonlyArray<GatePromptOption>;
+/**
+ * PHASE-589/469 W3.2 — synthesize the desktop-side 5-option group escalation
+ * `GatePromptEnvelope` from a team `task_group_halted` payload. This is the
+ * ONLY envelope NOT extracted from an engine INTERACTIVE_PROMPT: it carries the
+ * `groupEscalation` marker so `routeGatePromptInput` routes resolution through
+ * the two-phase `submitGroupDecision` instead of the per-track `applyUserDecision`.
+ *
+ * `taskId`/`gateId` are synthetic sentinels derived from the group id (the group
+ * has no per-track gate). `gateId` MUST be STABLE per group so the reducer's
+ * gateId-keyed dedup collapses a duplicate halt packet onto the same prompt
+ * entry (a re-emitted halt must not stack two prompts). `currentRound` is 0
+ * (the group decision is round-agnostic).
+ *
+ * `haltReason` (a content-free engine reason label) becomes the `reason` the
+ * renderer surfaces via `formatHaltReason`; never any file content (#589-G).
+ */
+export declare function buildGroupEscalationEnvelope(input: {
+    taskGroupId: string;
+    haltReason?: string;
+    receivedAt?: string;
+}): GatePromptEnvelope;
+/**
+ * Per #C8M-1: typed_number N (1-based) → `lowercase(envelope.options[N-1].id)`.
+ * Result is the `decision` value the caller passes to
+ * `sdk.applyUserDecision({ decision, ... })`. The SDK uppercases via
+ * `toWireEnum` before AppSync wire-send (see `client.ts:244-246`).
+ *
+ * Returns `null` for ANY of:
+ *   - `n` is not an integer (NaN, fractional, non-number)
+ *   - `n < 1` or `n > envelope.options.length`
+ *
+ * `needsNotes` is `true` iff the resolved kind ends with `_with_notes`,
+ * driving the InputBar transition to the notes-entry sub-prompt per
+ * #C8M-5. For Path A's APPROVE / CANCEL, `needsNotes` is always false.
+ *
+ * The caller MUST treat `null` as a typo / out-of-range and reject the
+ * submit — silent fallback to a default kind would destroy or accept
+ * the user's work without consent (matches the v1-options rule).
+ *
+ * PHASE-CP-10-MIN (#585) — for a `CONTINUE_WITH` option the resolved `kind`
+ * is `"continue_with"` and the result ALSO carries `targetAgent` (the
+ * per-option agent), so the submit handler can encrypt it as `notes`. The
+ * continuation accept is typed-digit-only — NO `_with_notes` editor phase
+ * (the agent name IS the payload), so `needsNotes` stays false (#C10M-5).
+ */
+export declare function mapTypedNumberToDecisionKind(envelope: GatePromptEnvelope, n: number): {
+    kind: string;
+    needsNotes: boolean;
+    targetAgent?: string;
+} | null;
+/**
+ * `haltReasonCopy` — `payload.outcome.reason` → `{ label, explanation }`.
+ * Shared-contract §3. Unknown reason → render the RAW snake_case string as
+ * the label with NO explanation (see `formatHaltReason` below).
+ */
+export declare const haltReasonCopy: Readonly<Record<string, {
+    readonly label: string;
+    readonly explanation: string;
+}>>;
+/**
+ * `decisionCopy` — `VerdictKind` (UPPERCASE) → display label.
+ * Shared-contract §4. Unknown → raw string (see `formatDecision`).
+ */
+export declare const decisionCopy: Readonly<Record<string, string>>;
+/**
+ * Halt-reason → `{ label, explanation }` via `haltReasonCopy`. Unknown
+ * reason → `{ label: <raw>, explanation: null }` (never blank). Absent
+ * reason → `null`.
+ */
+export declare function formatHaltReason(reason: string | undefined): {
+    label: string;
+    explanation: string | null;
+} | null;
+/** Decision → display label via `decisionCopy`. Unknown → raw string. */
+export declare function formatDecision(decision: string): string;
+/**
+ * The minimal decrypt primitive `decryptVerdictDetails` needs. Structurally
+ * compatible with `cryptoService.decryptMetadata(encryptedB64, sessionKeyB64)`
+ * — injected so the orchestration is unit-testable with a mock (NO live
+ * crypto in tests).
+ */
+export type DecryptMetadataFn = (encryptedB64: string, sessionKeyBase64: string) => Record<string, unknown>;
+/**
+ * Parse an ALREADY-DECRYPTED verdictDetails OBJECT (shared-contract §2 shape)
+ * into the structured `GateVerdictDetails`. PURE — no crypto, no I/O — so the
+ * parity test exercises it directly with the fixture's decrypted plaintext.
+ *
+ * Contract (shared-contract §2):
+ *   - The decrypted payload MUST be a JSON OBJECT `{ reviewers: [...] }`
+ *     (NOT a top-level array — iOS throws on an array; we treat a non-object
+ *     or a missing/invalid `reviewers` as a decrypt failure → fail-closed).
+ *   - Each reviewer: `{ seatId, role, reviewerAgent, decision, findings,
+ *     findingsTruncated, truncatedFindingCount }`. A seat MISSING any required
+ *     typed field (finite-integer `seatId`, non-empty string `role`, string
+ *     `reviewerAgent`, string `decision`) is DROPPED — fail closed, never a
+ *     synthesized `-1`/`''` junk row (parity with iOS/Android). `decision`
+ *     keeps its raw string (mapped at render time via `decisionCopy`).
+ *   - Root `findingsOmittedForSize: true` → panel rows present, findings
+ *     dropped → audit-browser hint at panel level.
+ *
+ * Returns the `available` panel on success, or `{ status:'unavailable',
+ * reason:'decrypt_failed' }` when the object is structurally unusable OR when
+ * no usable reviewer rows remain (empty array OR all seats malformed) — the
+ * renderer shows the neutral unavailable line, never an empty "available" panel.
+ */
+export declare function parseDecryptedVerdictDetails(decrypted: unknown): GateVerdictDetails;
+/**
+ * FIELD-LEVEL decrypt orchestration (shared-contract §2 / B.4) for the
+ * nested `metadata.verdictDetails = { encrypted: <b64> }` blob. The
+ * `{encrypted:…}` wrapper is NOT auto-unwrapped (that only happens for
+ * TOP-LEVEL event metadata), so this explicitly:
+ *   (1) reads `.encrypted` off `metadata.verdictDetails`;
+ *   (2) decrypts it with the session key via the injected
+ *       `decryptMetadata` primitive (the SAME AES-256-GCM inline-nonce
+ *       envelope image/metadata decryption uses — `cryptoService.decryptMetadata`);
+ *   (3) parses the result as an OBJECT and reads `reviewers`
+ *       (via `parseDecryptedVerdictDetails`).
+ *
+ * Returns:
+ *   - `undefined` when there is NO encrypted blob to decrypt (absent
+ *     `verdictDetails`, or it isn't an `{encrypted:string}` wrapper) AND no
+ *     plaintext `verdictDetailsUnavailable` marker is in play — the caller
+ *     leaves the envelope's `verdictDetails` as whatever the extractor set
+ *     (which may itself be an `unavailable` marker from the plaintext sibling).
+ *   - `{ status:'available', ... }` on a successful decrypt+parse.
+ *   - `{ status:'unavailable', reason:'decrypt_failed' }` when the decrypt
+ *     throws OR the decrypted payload is structurally unusable. NEVER
+ *     ciphertext, NEVER throws.
+ */
+export declare function decryptVerdictDetails(metadata: Record<string, unknown>, sessionKeyBase64: string, decryptMetadata: DecryptMetadataFn): GateVerdictDetails | undefined;
+/**
+ * `true` iff `metadata.verdictDetails` carries an `{ encrypted: <string> }`
+ * blob the dispatcher should attempt to decrypt. Lets the dispatcher skip
+ * the session-key resolve entirely for gate events with no encrypted panel.
+ */
+export declare function hasEncryptedVerdictDetails(metadata: Record<string, unknown>): boolean;
+/** A timeline row the panel renders: kind label + the raw `at` timestamp. */
+export interface GatePanelTimelineRow {
+    readonly kind: string;
+    readonly at: string;
+}
+/** A reviewer row the panel renders: pre-formatted header + findings. */
+export interface GatePanelReviewerRow {
+    readonly seatId: number;
+    readonly role: string;
+    readonly reviewerAgent: string;
+    /** "Reviewer {seatId} ({role}, {reviewerAgent}): {decisionCopy}". */
+    readonly header: string;
+    readonly findings: ReadonlyArray<string>;
+    /** Per-seat "(N more — full review in the audit browser)" hint, or null. */
+    readonly truncationHint: string | null;
+}
+/**
+ * The fully-extracted, render-ready GateDetailsPanel model. PURE function of
+ * the envelope — the `GateDetailsPanel` component computes this and renders
+ * it; the parity test asserts these exact extracted values (shared-contract
+ * §5). `null` panel pieces render nothing (graceful empty).
+ */
+export interface GateDetailsPanelModel {
+    /** `summary` verbatim (headline), or null. */
+    readonly headline: string | null;
+    /** Halt-reason label + explanation (unknown → raw label, null explanation), or null. */
+    readonly reasonLabel: string | null;
+    readonly reasonExplanation: string | null;
+    /** "Round N". */
+    readonly roundLabel: string;
+    /** Timeline rows (empty → no strip). */
+    readonly timeline: ReadonlyArray<GatePanelTimelineRow>;
+    /** Elapsed seconds (gate_resolved − gate_opened), or null if not derivable. */
+    readonly elapsedSeconds: number | null;
+    /** Cascade rows — ONLY when roundHistory.length > 1; else empty (no cascade). */
+    readonly cascade: ReadonlyArray<{
+        readonly round: number;
+        readonly reasonLabel: string;
+    }>;
+    /** True when the prior-rounds cascade omitted earlier entries (`omittedEarlier`). */
+    readonly cascadeOmittedEarlier: boolean;
+    /** Reviewer rows (empty → no disagreement panel). */
+    readonly reviewers: ReadonlyArray<GatePanelReviewerRow>;
+    /** Panel-level "Full review in the audit browser" hint (size-degrade), or null. */
+    readonly panelTruncationHint: string | null;
+    /** Neutral "Reviewer details unavailable" line text when the panel can't render, or null. */
+    readonly reviewerUnavailableLine: string | null;
+}
+/**
+ * Build the render-ready `GateDetailsPanelModel` from an envelope. PURE — no
+ * crypto, no I/O (the `verdictDetails` decrypt already happened in the
+ * dispatcher and is attached to the envelope). The test exercises this with
+ * the shared parity fixture's envelope directly (shared-contract §5).
+ *
+ * Never throws; every absent/malformed field degrades to a safe empty value.
+ */
+export declare function buildGateDetailsPanelModel(envelope: GatePromptEnvelope): GateDetailsPanelModel;
+/** One reviewer seat row the panel renders (a round's verdict). */
+export interface ReviewSummaryReviewerRow {
+    readonly seatId: number;
+    readonly role: string;
+    readonly agent: string;
+    /** "Reviewer {seatId} ({role}, {agent}): {decisionCopy}". */
+    readonly header: string;
+    /** Decision display label via `decisionCopy` (unknown → raw). */
+    readonly decisionLabel: string;
+    readonly reasoning: string;
+    readonly suggestedChanges: ReadonlyArray<string>;
+}
+/** One round the panel renders (proposal + per-seat verdicts + revise notes). */
+export interface ReviewSummaryRoundModel {
+    readonly round: number;
+    /** "Round N". */
+    readonly roundLabel: string;
+    readonly proposal: string;
+    readonly reviewers: ReadonlyArray<ReviewSummaryReviewerRow>;
+    /** GateDecision serde value (proceed | auto_revise | escalate). */
+    readonly outcome: string;
+    /** Aggregated REVISE seat findings (the auto-revision driver), or null. */
+    readonly reviseNotes: string | null;
+}
+/**
+ * The fully-extracted, render-ready per-round review summary model. PURE
+ * function of the decrypted summary. `null`-attached (entry has no
+ * `reviewSummary`) → the panel renders nothing extra (fail-open base prompt).
+ */
+export interface ReviewSummaryPanelModel {
+    readonly rounds: ReadonlyArray<ReviewSummaryRoundModel>;
+    /** finalOutcome display value (proceed | auto_revise | escalate). */
+    readonly finalOutcome: string;
+    /** Banner text when the size cap dropped/truncated content, or null. */
+    readonly truncationNotice: string | null;
+}
+/**
+ * The decrypted summary input shape `buildReviewSummaryPanelModel` accepts.
+ * Structurally identical to the SDK's `TaskReviewSummary` (kept local to avoid
+ * an import cycle). Every field is defensively read — a malformed/partial
+ * object degrades to an empty/safe model, never throws.
+ */
+export interface DecryptedReviewSummaryInput {
+    readonly rounds?: ReadonlyArray<{
+        readonly round?: number;
+        readonly proposal?: string;
+        readonly reviewers?: ReadonlyArray<{
+            readonly seatId?: number;
+            readonly role?: string;
+            readonly agent?: string;
+            readonly decision?: string;
+            readonly reasoning?: string;
+            readonly suggestedChanges?: ReadonlyArray<string>;
+        }>;
+        readonly outcome?: string;
+        readonly reviseNotes?: string;
+    }>;
+    readonly finalOutcome?: string;
+    readonly truncatedForSize?: boolean;
+    readonly omittedRounds?: number;
+}
+/**
+ * Build the render-ready `ReviewSummaryPanelModel` from a decrypted summary.
+ * PURE — no crypto, no I/O. Defensive: every absent/malformed field degrades
+ * to a safe empty value (the panel renders what it can; the decision never
+ * blocks on this — §2.5 fail-open). Returns `null` when there are no usable
+ * rounds (the renderer then shows no per-round panel).
+ *
+ * Truncation markers (the `"…[truncated]"` suffixes + `truncatedForSize` /
+ * `omittedRounds`) ride verbatim from the engine — the engine already
+ * truncated the strings; the builder only surfaces a panel-level NOTICE so the
+ * user knows content was dropped.
+ */
+export declare function buildReviewSummaryPanelModel(summary: DecryptedReviewSummaryInput | null | undefined): ReviewSummaryPanelModel | null;