@sigrun/sigrun 0.7.0 → 0.9.0

package/dist/server/routes/extensions.js

@@ -88,6 +88,11 @@ export function registerExtensionRoutes(app, ctx) {
                             ...(def.sharedData === true
                                 ? { sharedData: true }
                                 : {}),
+                            // The per-conversation opt-in (sparse: present only
+                            // when the panel opted in).
+                            ...(def.perConversation === true
+                                ? { perConversation: true }
+                                : {}),
                         })),
                     }),
             };

package/dist/server/routes/interactions.js

@@ -34,7 +34,7 @@
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { AmbientDoc, AmbientOwnersDoc, asAmbientRecord, } from "../../harness/ambient.js";
-import { InteractionDoc, InteractionsIndexDoc, answerFromBody, applyAnswer, asInteractionRecord, indexSettled, maskedAnswerValues, } from "../../harness/interactions.js";
+import { InteractionDoc, InteractionsIndexDoc, answerFromBody, applyAnswer, applyDecline, asInteractionRecord, indexSettled, maskedAnswerValues, sweepSecretDelivery, } from "../../harness/interactions.js";
 import { loadConversation } from "../conversation-handler.js";
 import { ID_PARAMS_SCHEMA, conversationId } from "../helpers.js";
 import { accessOf } from "@sigrun/shared/access";
@@ -221,6 +221,53 @@ export function registerInteractionRoutes(app, ctx) {
             answer: committed.answer,
         };
     });
+    // The decline route (ask-user Task 1): the answer route's peer — a
+    // human declines a DECLINABLE record (status "skipped", declinedVia
+    // "button"). Same access (write), same commit structure, same
+    // indexSettled + reply-after-commit; every successful decline sweeps
+    // the record's unread secret delivery inside the commit (the
+    // settleInteraction pattern). 404 unknown / 404 not-pending /
+    // 409 not-declinable.
+    app.post("/v1/conversations/:id/interactions/:callId/decline", {
+        schema: { params: ANSWER_PARAMS_SCHEMA },
+        preHandler: loadConversation(ctx, "write"),
+    }, async (request, reply) => {
+        const { callId } = request.params;
+        const conversation = request.conversation;
+        const committed = await conversation.commit(async (tx) => {
+            const draft = await tx.doc(InteractionDoc, conversation.id, callId, callId);
+            // Unknown callId: the doc materializes empty — kind "" never
+            // seeded (the answer route's detection).
+            if (draft.kind === "") {
+                return { found: false };
+            }
+            const outcome = applyDecline(draft, "button", Date.now(), request.principal.user);
+            if (outcome !== "declined") {
+                // A loser of the first-wins race never sweeps: the delivery
+                // (when there is one) belongs to the winner (the answer
+                // route's rule).
+                return { found: true, outcome };
+            }
+            const index = await tx.doc(InteractionsIndexDoc);
+            indexSettled(index, conversation.id, callId);
+            sweepSecretDelivery(conversation.id, callId);
+            return { found: true, outcome };
+        }, BACKGROUND_CONTEXT);
+        if (!committed.found) {
+            return await reply.code(404).send({ error: "no_such_interaction" });
+        }
+        if (committed.outcome === "not_pending") {
+            return await reply.code(404).send({ error: "not_pending" });
+        }
+        if (committed.outcome === "not_declinable") {
+            return await reply.code(409).send({ error: "not_declinable" });
+        }
+        return {
+            callId,
+            status: "skipped",
+            declinedVia: "button",
+        };
+    });
     // ─── Ambient seam ────────────────────────────────────────────────────
     // The conversation's ambient surfaces, replacement-state reads.
     app.get("/v1/conversations/:id/ambient", { schema: { params: ID_PARAMS_SCHEMA } }, async (request, reply) => {

package/dist/server/routes/meta.js

@@ -73,6 +73,12 @@ export function registerMetaRoutes(app, ctx) {
                                 // The §7.3 shared-data flag: channels refetch
                                 // fully when a since fetch answers ops-only.
                                 ...(def.sharedData === true ? { sharedData: true } : {}),
+                                // The per-conversation opt-in: channels attach the
+                                // panel with the open conversation's id (sparse —
+                                // present only when the panel opted in).
+                                ...(def.perConversation === true
+                                    ? { perConversation: true }
+                                    : {}),
                             })),
                         }),
                 };
@@ -174,6 +180,17 @@ export function registerMetaRoutes(app, ctx) {
                 providers: opened.providerCollisions,
                 commands: commandCatalog.collisions,
             },
+            // Knowledge C7: the published-hook registry — one row per OWNED
+            // hook name (`provider` is the owner slug; `shadowed` lists the
+            // losing providers). Empty when nothing published.
+            publishedHooks: opened.publishedHooks(),
+            // Warden Task 7: the decision-provider seam projection (the same
+            // pure-derivation discipline — the registry's boot-built rows).
+            decisions: {
+                providers: opened.decisions.providers(),
+                default: opened.decisions.resolvedDefault(),
+                collisions: opened.decisions.collisions(),
+            },
         };
     });
     // The slash-command catalog: the thin metadata list the composer's `/`

package/dist/server/routes/notices.js

@@ -0,0 +1,94 @@
+/**
+ * The `/v1/notices` routes (notices Task 4, spec §3/§4): the user's
+ * notice pile and its one action dispatch, over the shared
+ * `NoticesService` (the store files' one mediation point).
+ *
+ * Access: every notice id is per-user — a notice only ever exists on
+ * its recipient's pile. A foreign / unknown / user-less id is therefore
+ * indistinguishable from an absent one: 404 `notice_not_found` on
+ * every `:id` route (never a 403 tell), and the user-less principal's
+ * GET is the empty list. There is no cross-user selector: an admin
+ * asking with another user's id still 404s — the id is only ever
+ * addressed through the CALLER's pile.
+ *
+ * Route params: notice ids are UUID strings (store-assigned), so the
+ * schemas declare a string param — never the conversations'
+ * `ID_PARAMS_SCHEMA` (integer).
+ */
+/**
+ * The one notice-id param: a UUID string (the store mints random ids).
+ * Declared as a string so Fastify's param validation cannot mask the
+ * lookup with an integer-coercion 400.
+ */
+const NOTICE_ID_PARAMS_SCHEMA = {
+    type: "object",
+    properties: { id: { type: "string" } },
+    required: ["id"],
+    additionalProperties: false,
+};
+/** The action route's params: the notice id plus the action id. */
+const NOTICE_ACTION_PARAMS_SCHEMA = {
+    type: "object",
+    properties: { id: { type: "string" }, actionId: { type: "string" } },
+    required: ["id", "actionId"],
+    additionalProperties: false,
+};
+/** The action route's body: the optional client request id (dedup). */
+const NOTICE_ACTION_BODY_SCHEMA = {
+    type: "object",
+    properties: { requestId: { type: "string" } },
+    additionalProperties: false,
+};
+/** The not-found body — shared by every notice route's lookup. */
+const NOT_FOUND = { error: "notice_not_found" };
+/** Register the `/v1/notices` routes. */
+export function registerNoticeRoutes(app, ctx) {
+    const { notices } = ctx;
+    // The user's own pile (spec §3): newest first, minus any
+    // conversation notice whose share was revoked (the service prunes
+    // them off disk on the same read). A user-less principal has no
+    // pile — the empty list, never an error.
+    app.get("/v1/notices", async (request) => {
+        const user = request.principal.user;
+        if (user === undefined)
+            return { notices: [] };
+        return { notices: await notices.listForUser(user) };
+    });
+    // Dismiss one of the caller's notices: 204 when it existed, 404
+    // when it did not (foreign / unknown / already dismissed — all the
+    // same answer).
+    app.post("/v1/notices/:id/dismiss", { schema: { params: NOTICE_ID_PARAMS_SCHEMA } }, async (request, reply) => {
+        const user = request.principal.user;
+        if (user === undefined) {
+            return await reply.code(404).send(NOT_FOUND);
+        }
+        const { id } = request.params;
+        if (!(await notices.dismiss(user, id))) {
+            return await reply.code(404).send(NOT_FOUND);
+        }
+        return await reply.code(204).send();
+    });
+    // Dismiss everything of the caller's. Idempotent: always 204.
+    app.post("/v1/notices/dismiss-all", async (request, reply) => {
+        const user = request.principal.user;
+        if (user !== undefined) {
+            await notices.dismissAll(user);
+        }
+        return await reply.code(204).send();
+    });
+    // The one action dispatch (spec §4): the service's dispatch order
+    // (rate-limit → dedup → lookup → action find → binding find →
+    // handler call) answers the 200/400/404/409/429 union; the route
+    // only maps it onto the wire.
+    app.post("/v1/notices/:id/actions/:actionId", {
+        schema: {
+            params: NOTICE_ACTION_PARAMS_SCHEMA,
+            body: NOTICE_ACTION_BODY_SCHEMA,
+        },
+    }, async (request, reply) => {
+        const { id, actionId } = request.params;
+        const body = (request.body ?? {});
+        const answer = await notices.runAction(request.principal, id, actionId, body.requestId);
+        return await reply.code(answer.status).send(answer.body);
+    });
+}

package/dist/server/routes/providers.js

@@ -87,8 +87,30 @@ function providerReadinessReport(opened) {
     for (const { id: providerId } of opened.models.getProviders()) {
         providers.push(readinessEntry(opened, providerId, producersByName));
     }
+    // Warden Task 7: decision providers append as their own entries
+    // (`kind: "decision"`, the model ids listed) — a decision provider
+    // whose id collides with a chat provider stays SEPARATE (distinct
+    // kinds, never merged).
+    for (const decision of opened.decisions.providers()) {
+        providers.push(decisionEntry(decision));
+    }
     return { providers };
 }
+/**
+ * One decision provider's report entry (warden Task 7): the registry
+ * row projected onto the shared entry shape — `models` the count,
+ * `modelIds` the bare ids, `owner` the contributing extension.
+ */
+function decisionEntry(decision) {
+    return {
+        provider: decision.id,
+        kind: "decision",
+        status: decision.status,
+        models: decision.models.length,
+        modelIds: decision.models,
+        owner: decision.extension,
+    };
+}
 /** Register the model-catalog and provider-readiness routes. */
 export function registerProviderRoutes(app, ctx) {
     const { opened } = ctx;
@@ -109,6 +131,35 @@ export function registerProviderRoutes(app, ctx) {
     // serves, so the 404 vocabulary matches it). Key material never
     // appears in any of these routes — statuses and counts only.
     const isKnownProvider = (providerId) => opened.models.getProvider(providerId) !== undefined;
+    // Warden Task 7: a DECISION-only provider id is equally routable (the
+    // registry enumerates its ids). The mutation bodies branch on the
+    // kind: chat ids refresh, decision ids re-read — the registry
+    // derives readiness per call, so a credential write is visible
+    // without a refresh (and the decision seam has no catalog leg to
+    // refresh).
+    const isDecisionProvider = (providerId) => opened.decisions.providers().some((row) => row.id === providerId);
+    const isRoutableProvider = (providerId) => isKnownProvider(providerId) || isDecisionProvider(providerId);
+    // The entry back from a mutation: the chat derivation for catalog
+    // providers, the decision entry for decision-only ids (a chat AND
+    // decision provider sharing an id answer the CHAT entry — the
+    // mutation there targets the catalog provider's refresh leg).
+    const routableEntry = (providerId) => {
+        if (isKnownProvider(providerId)) {
+            return readinessEntry(opened, providerId, producersIndex(opened));
+        }
+        const decision = opened.decisions
+            .providers()
+            .find((row) => row.id === providerId);
+        if (decision === undefined) {
+            throw new Error(`provider "${providerId}" is not routable`);
+        }
+        return decisionEntry(decision);
+    };
+    // The post-write refresh: chat ids only.
+    const refreshAfterWrite = async (providerId) => {
+        if (isKnownProvider(providerId))
+            await opened.refreshProvider(providerId);
+    };
     // One bounded refresh of the named provider (W3 Task 6, spec §7.6):
     // the SAME policy the boot/interval/refresh-on-miss paths run — bounded
     // by the deadline, failures warned (never the route's error), a
@@ -138,7 +189,7 @@ export function registerProviderRoutes(app, ctx) {
             return await reply.code(403).send({ error: "forbidden" });
         }
         const { id } = request.params;
-        if (!isKnownProvider(id)) {
+        if (!isRoutableProvider(id)) {
             return await reply.code(404).send({ error: "provider_not_found" });
         }
         const body = request.body;
@@ -153,9 +204,14 @@ export function registerProviderRoutes(app, ctx) {
                 .code(400)
                 .send({ error: "invalid_field", field: "apiKey" });
         }
-        await opened.auth.setApiKey(credentialKey(id), apiKey);
-        await opened.refreshProvider(id);
-        return readinessEntry(opened, id, producersIndex(opened));
+        // The credential key: chat ids redirect the DEFAULT provider's id
+        // to the magic "default" key; decision-only ids use the id
+        // verbatim (the magic key names the default CHAT provider, never a
+        // decision credential).
+        const key = isKnownProvider(id) ? credentialKey(id) : id;
+        await opened.auth.setApiKey(key, apiKey);
+        await refreshAfterWrite(id);
+        return routableEntry(id);
     });
     // Remove the provider's credential (admin): store delete of that SAME
     // key → one refresh → the entry. Restart-free the same way — the
@@ -165,12 +221,13 @@ export function registerProviderRoutes(app, ctx) {
             return await reply.code(403).send({ error: "forbidden" });
         }
         const { id } = request.params;
-        if (!isKnownProvider(id)) {
+        if (!isRoutableProvider(id)) {
             return await reply.code(404).send({ error: "provider_not_found" });
         }
-        await opened.auth.deleteApiKey(credentialKey(id));
-        await opened.refreshProvider(id);
-        return readinessEntry(opened, id, producersIndex(opened));
+        const key = isKnownProvider(id) ? credentialKey(id) : id;
+        await opened.auth.deleteApiKey(key);
+        await refreshAfterWrite(id);
+        return routableEntry(id);
     });
     // Models: the merged chat-model catalog as picker entries (no provider
     // internals — baseUrl/headers/auth stay server-side). The shared

package/dist/server/routes/submissions.js

@@ -52,6 +52,9 @@ export function registerSubmissionRoutes(app, ctx) {
                     ? {}
                     : { user: request.principal.user }),
                 ...(body.whenBusy === undefined ? {} : { whenBusy: body.whenBusy }),
+                // Ask-user Task 2: a human's message through the HTTP submit
+                // route declines pending declinable questions (spec §5.3).
+                declinesQuestions: true,
                 ...(request.query?.waitMs ===
                     undefined
                     ? {}

package/dist/server/routes/users.js

@@ -272,6 +272,10 @@ export function registerUserRoutes(app, ctx) {
         // must not load for the recipient. In-flight curator runs fail
         // closed through the stores' user-exists gate (nothing recreated).
         await removeUserCuration(ctx.managedPaths.userAreas(user));
+        // Notices spec §3.2 rule 8: notices are personal and never
+        // transferred. The user area itself stays for the workspace's
+        // recipient, so the notices file is removed on its own.
+        await ctx.notices.removeUser(user);
         return await reply.code(204).send();
     });
 }

package/dist/server/surfaces/dedup.js

@@ -18,6 +18,12 @@ export const DEDUP_WINDOW_MS = 10 * 60 * 1000;
  * same-instance duplicate (and `null` when a different instance already
  * holds the actionId — the caller treats that as a fresh action);
  * `record` stores the first result.
+ *
+ * Generic over the stored result type (notices Task 4): the surface
+ * actions' default (`ActionResponse`) and the notices service's
+ * `NoticeActionResponse` share the `{ok, ...}` result shape but are
+ * different unions — the notice dispatch stores its own type through
+ * the same mechanics without a cast.
  */
 export class ActionDedup {
     entries = new Map();

package/dist/server/visibility.js

@@ -0,0 +1,30 @@
+/**
+ * Visibility for an ARBITRARY directory user (notices Task 3): the
+ * request-scoped `visibleTo` (routes/interactions.ts) answers for the
+ * REQUEST principal; the notices service needs the same answer for the
+ * notice's RECIPIENT — usually not the caller at all (a post targeting
+ * another user's conversation, or the list read pruning a revoked
+ * share).
+ *
+ * The rule is the same one `visibleTo` runs: `accessOf` over the
+ * conversation's SessionMetaDoc snapshot, with the principal projected
+ * from the DIRECTORY (stored groups only — never request-supplied
+ * claims), absent record → not visible. A userless conversation (no
+ * meta) reads as ownerless → visible, exactly like `visibleTo`.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { accessOf } from "@sigrun/shared/access";
+import { storedGroups } from "../harness/identity/groups.js";
+import { SessionMetaDoc } from "./session-meta.js";
+/**
+ * Whether `user` (a directory username) can SEE conversation `id`:
+ * `accessOf` over the session-meta snapshot with the user's stored
+ * groups. `false` when the directory has no record for the name.
+ */
+export async function visibleToUser(ctx, id, user) {
+    const record = ctx.opened.identity.users.get(user);
+    if (record === undefined)
+        return false;
+    const meta = await ctx.opened.harness.snapshot(SessionMetaDoc, id, BACKGROUND_CONTEXT);
+    return (accessOf({ user, superuser: false, groups: storedGroups(record) }, meta ?? {}) !== "none");
+}

package/dist/settings/registry.js

@@ -133,6 +133,18 @@ export const CORE_SETTING_KEYS = [
         section: "general",
         reason: "read per settled run by the auto-namer (src/harness/naming.ts)",
     },
+    {
+        key: "decisionModel",
+        apply: "live",
+        section: "general",
+        reason: "read per host.decisions.evaluate call by the decision registry (src/harness/decisions.ts)",
+    },
+    {
+        key: "decisions.tool",
+        apply: "live",
+        section: "tools",
+        reason: "read at each decision_evaluate tool call (default off)",
+    },
     {
         key: "defaultProvider.baseUrl",
         apply: "restart",
@@ -332,6 +344,12 @@ export const CORE_SETTING_KEYS = [
         section: "advanced",
         reason: "the event bus's queue bound is set at open (boot)",
     },
+    {
+        key: "server.decisions.timeoutMs",
+        apply: "live",
+        section: "providers",
+        reason: "the decision registry reads the settings' timeoutMs per evaluate call (src/harness/decisions.ts)",
+    },
     {
         key: "server.providers.refreshIntervalMinutes",
         apply: "live",

package/node_modules/@sigrun/shared/CHANGELOG.md

@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [0.9.0] - 2026-11-05
+
+- `InteractionRecord` gains optional `declinable: true` and settled `declinedVia:
+  "button" | "message"` (the ask-user decline wire surface — additive, optional).
+- `InteractionDeclined` wire type beside `InteractionAnswered` (the decline route's
+  200 body).
+
+## [0.8.0] - 2026-11-04
+
+- New `./notices` subpath: the `UserNotice*` wire types, `NOTICE_LIMITS`, and the
+  key/action-id regexes (the client-shared contract for the notices feature).
+
 ## [0.7.0] - 2026-11-04
 
 - New `./model-label` subpath: `modelBreadcrumb` collapses every non-leaf path segment of

package/node_modules/@sigrun/shared/dist/decisions.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The decision-provider wire types (the decision-providers spec): a
+ * provider TYPE whose models answer typed questions (noul / choice /
+ * score) over a JSON state, for extensions that need small structured
+ * judgments rather than a chat completion.
+ *
+ * TYPE-ONLY module, with NO imports at all: `JsonValue`/`JsonObject` are
+ * declared locally exactly the way `shared/src/json.ts` mirrors them, so
+ * the shared leaf keeps its zero-import invariant (enforced by
+ * test/views-purity.test.ts). The two `DECISION_MAX_*` constants are
+ * pure VALUES — wire modules carry "types + pure constants".
+ */
+/** A strict-JSON value (local mirror — see shared/src/json.ts). */
+export type DecisionJsonValue = null | boolean | number | string | DecisionJsonValue[] | {
+    [key: string]: DecisionJsonValue;
+};
+/** A strict-JSON object (local mirror — see shared/src/json.ts). */
+export type DecisionJsonObject = {
+    [key: string]: DecisionJsonValue;
+};
+/** The state a decision question is asked over: a string or strict JSON. */
+export type DecisionState = string | DecisionJsonObject | DecisionJsonValue[];
+/** One typed question. Choice needs at least one label; score at least two levels. */
+export type DecisionQuestion = {
+    readonly type: "noul";
+    readonly instructions?: DecisionJsonValue;
+    readonly criteria?: {
+        readonly true?: DecisionJsonValue;
+        readonly false?: DecisionJsonValue;
+    } | null;
+} | {
+    readonly type: "choice";
+    readonly instructions?: DecisionJsonValue;
+    readonly criteria: Readonly<Record<string, DecisionJsonValue | null>>;
+} | {
+    readonly type: "score";
+    readonly instructions?: DecisionJsonValue;
+    readonly criteria: readonly DecisionJsonValue[];
+};
+/** One evaluation: a state plus 1..32 typed questions. */
+export interface DecisionRequest {
+    readonly state: DecisionState;
+    readonly questions: Readonly<Record<string, DecisionQuestion>>;
+}
+/** One answer, matching its question's type; probabilities are in [0, 1]. */
+export type DecisionAnswer = {
+    readonly type: "noul";
+    readonly noul: number;
+} | {
+    readonly type: "choice";
+    readonly choice: string;
+    readonly confidence: number;
+    readonly probabilities: Readonly<Record<string, number>>;
+} | {
+    readonly type: "score";
+    readonly score: number;
+    readonly confidence: number;
+    readonly probabilities: Readonly<Record<string, number>>;
+    readonly legend?: Readonly<Record<string, DecisionJsonValue>>;
+};
+/** The provider's answer set plus optional usage bookkeeping. */
+export interface DecisionAnswers {
+    readonly answers: Readonly<Record<string, DecisionAnswer>>;
+    readonly usage?: {
+        readonly input_tokens: number | null;
+        readonly output_tokens: number | null;
+    };
+    readonly model?: string;
+}
+/** The outcome of one `evaluate` call; NEVER a throw. */
+export type DecisionResult = {
+    readonly ok: true;
+    readonly model: string;
+    readonly answers: Readonly<Record<string, DecisionAnswer>>;
+    readonly usage: {
+        readonly input_tokens: number | null;
+        readonly output_tokens: number | null;
+    };
+    readonly elapsedMs: number;
+} | {
+    readonly ok: false;
+    readonly code: "no_model" | "unknown_model" | "invalid_request" | "over_limits" | "not_configured" | "timeout" | "aborted" | "failed" | "bad_answer";
+    readonly error: string;
+};
+/** A model's declared limits (narrower than the built-in caps win). */
+export interface DecisionLimits {
+    readonly maxQuestions?: number;
+    readonly maxInputBytes?: number;
+    readonly minChoiceOptions?: number;
+    readonly maxScoreLevels?: number;
+}
+/** Built-in cap: at most this many questions per request. */
+export declare const DECISION_MAX_QUESTIONS = 32;
+/** Built-in cap: the JSON state serialized size, in bytes. */
+export declare const DECISION_MAX_BYTES = 65536;

package/node_modules/@sigrun/shared/dist/decisions.js

@@ -0,0 +1,16 @@
+/**
+ * The decision-provider wire types (the decision-providers spec): a
+ * provider TYPE whose models answer typed questions (noul / choice /
+ * score) over a JSON state, for extensions that need small structured
+ * judgments rather than a chat completion.
+ *
+ * TYPE-ONLY module, with NO imports at all: `JsonValue`/`JsonObject` are
+ * declared locally exactly the way `shared/src/json.ts` mirrors them, so
+ * the shared leaf keeps its zero-import invariant (enforced by
+ * test/views-purity.test.ts). The two `DECISION_MAX_*` constants are
+ * pure VALUES — wire modules carry "types + pure constants".
+ */
+/** Built-in cap: at most this many questions per request. */
+export const DECISION_MAX_QUESTIONS = 32;
+/** Built-in cap: the JSON state serialized size, in bytes. */
+export const DECISION_MAX_BYTES = 65_536;

package/node_modules/@sigrun/shared/dist/interactions.d.ts

@@ -54,6 +54,20 @@ export type InteractionRecord = {
      * model-asserted. Absent on the naive single-operator path (no user).
      */
     readonly answeredByUser?: string;
+    /**
+     * Decline affordance (ask-user Task 1, spec §5.2): `true` marks the
+     * record declinable — a human may skip it without answering (the
+     * decline route / `host.declineInteraction`). Absent or omitted means
+     * NOT declinable; `false` fails validation (the flag is `true`-only).
+     */
+    readonly declinable?: true;
+    /**
+     * How the record was declined (ask-user Task 1/2): "button" via the
+     * decline route or host method, "message" via an admitted decline
+     * message. Set only on a `skipped` decline; absent on every other
+     * terminal status.
+     */
+    readonly declinedVia?: "button" | "message";
     /**
      * The interaction body: a block tree (placement `interaction` — a
      * root `form` whose `submit` is the answer). Legacy-shaped bodies