@wenathlan/devthink 2.0.13 → 2.0.15

package/dist/flow.d.ts

@@ -0,0 +1,300 @@
+/**
+ * The flow module of the 1.1.90 consolidation: every correlated variation of the flow logic interned in this one file, so the module family carries one surface without duplicate variations.
+ * The correlation is the flow a reviewed plan travels: flowlibrary holds the template store the flow starts from (schemastrict manifest validation, publisher signature verification with quarantine, grant diffs mapped onto originprofiles, fresh consent for sensitive entries, install and fork resolution into native workflow records); flowrun executes a plan file through the same pipeline the extension runs (the grants gate, the parseworkflowproposal validation, the per step consent gates routed to the consent provider, the driver execution and the sealed immutable log chain the run writes); and syncbridge moves the same manifests between machines behind an explicit opt in with digest conflict detection, so the template a flow starts from stays the template the bridge carries.
+ * Nothing is hardcoded: the registry origin and the endpoint of every provider stay user configured values, and no library, run or bridge path ever bypasses the human review.
+ */
+import type { flowlibraryentry, flowlibrarymanifest, publishdescriptor, workflowrecord, schemaerror } from "./types.js";
+/** Computes the manifest digest every store deduplicates by and every sync conflict detects with. */
+export declare function manifestdigest(manifest: flowlibrarymanifest): Promise<string>;
+/** Validates one raw manifest under schemastrict: the shape errors name their path and expected shape, and the capability gate refuses kinds the installed capability set lacks. */
+export declare function validatemanifest(input: {
+    manifest: unknown;
+    capabilities: string[];
+}): Promise<{
+    ok: boolean;
+    errors: schemaerror[];
+    reason: string;
+    manifest?: flowlibrarymanifest;
+}>;
+/** Verifies the publisher signature of one manifest when present: the descriptor digest must match the recomputed manifest digest and the signature must seal the publisher, the digest and the provenance, so a signature over any other body refuses in full. */
+export declare function verifypublishersignature(manifest: flowlibrarymanifest): Promise<{
+    verified: boolean;
+    reason: string;
+}>;
+/** Signs one manifest with the publisher seal so tests and publishers produce verifiable descriptors; the seal covers the digest and the provenance exactly as the verification reads them. */
+export declare function signmanifest(manifest: flowlibrarymanifest, provenance: string, publishedat: number): Promise<publishdescriptor>;
+/** Builds one flowlibrary entry with its provenance attached: an unverified publisher quarantines the entry while a verified signature installs it as available. */
+export declare function libraryentryof(input: {
+    manifest: flowlibrarymanifest;
+    provenance: string;
+    now: number;
+}): Promise<flowlibraryentry>;
+/** Reads the grant diff of one manifest against the grants the profile holds: the added grants map onto originprofiles at import time so the import dialog shows exactly what the entry would newly hold. */
+export declare function grantdiffof(input: {
+    manifest: flowlibrarymanifest;
+    heldgrants: string[];
+}): {
+    added: string[];
+    kept: string[];
+    originmappings: Array<{
+        origin: string;
+        kinds: string[];
+    }>;
+};
+/** Reads the fresh consent descriptor a sensitive manifest needs before any import completes; a non sensitive manifest needs none. */
+export declare function sensitiveconsentfor(manifest: flowlibrarymanifest, freshconsent: boolean): {
+    required: boolean;
+    reason: string;
+};
+/** Builds the proposal objective one library import lands as: the import never executes directly, it routes through the same proposal flow and plan review as every task. */
+export declare function libraryproposalof(entry: flowlibraryentry): {
+    objective: string;
+    reviewed: boolean;
+    reason: string;
+};
+/** Resolves one manifest into a native workflow record: the steps keep their reviewed kinds while the selector namespaces rewrite for the local profile, and the record lands pending its review approval exactly like any import. */
+export declare function installlibrary(input: {
+    entry: flowlibraryentry;
+    selectornamespace?: string;
+    now: number;
+}): workflowrecord;
+/** Diffs the versions of one library update before it replaces the local entry: the changed steps, the added grants and the version movement all surface so the update never overwrites silently. */
+export declare function updatelibrary(input: {
+    incoming: flowlibraryentry;
+    existing: flowlibraryentry;
+}): {
+    changedsteps: string[];
+    addedgrants: string[];
+    versionfrom: string;
+    versionto: string;
+    replace: boolean;
+    reason: string;
+};
+/** Reads the removal outcome of one library entry: the local forks stay untouched because a fork is an independent local workflow the store owns apart from its template. */
+export declare function removelibrary(input: {
+    entry: flowlibraryentry;
+    forks: workflowrecord[];
+}): {
+    removed: string;
+    keptforks: string[];
+    reason: string;
+};
+/** Forks one library entry into an independent local workflow: the fork copies the steps with their rewritten selectors and owns its own name from its creation on. */
+export declare function forklibrary(input: {
+    entry: flowlibraryentry;
+    now: number;
+}): workflowrecord;
+/** Searches the flowlibrary entries for the dashboardpage browser: the query matches the title, the description and the publisher while the filter narrows the publisher, the sensitive mark or the state. */
+export declare function librarysearch(input: {
+    entries: flowlibraryentry[];
+    query?: string;
+    filter?: {
+        publisher?: string;
+        sensitive?: boolean;
+        state?: string;
+    };
+}): flowlibraryentry[];
+/** Reads one browser row of a library entry: the publisher, the version and the required grants per entry the browser lists before any install. */
+export declare function librarybrowserow(entry: flowlibraryentry): {
+    id: string;
+    title: string;
+    publisher: string;
+    version: string;
+    grants: string[];
+    sensitive: boolean;
+    state: string;
+    registry?: string;
+};
+/** Reads the full step list of one library entry the entry view shows before install: every step with its kind, label, target and namespace beside the data expectations with their minimization hints. */
+export declare function librarystepsview(entry: flowlibraryentry): Array<{
+    id: string;
+    kind: string;
+    label: string;
+    target?: string;
+    namespace?: string;
+    families: string[];
+    fields: string[];
+}>;
+/** Reads the minimization summary of one manifest: the data families its steps expect and the fields each family limits itself to. */
+export declare function dataexpectationssummary(manifest: flowlibrarymanifest): Array<{
+    family: string;
+    fields: string[];
+    steps: string[];
+}>;
+/** Builds one library lifecycle event for the immutable log and the store: every install, update and removal records with its entry provenance. */
+export declare function libraryeventof(input: {
+    kind: "install" | "update" | "remove";
+    entryid: string;
+    title: string;
+    version: string;
+    detail: string;
+    now: number;
+}): {
+    id: string;
+    kind: "install" | "update" | "remove";
+    entryid: string;
+    title: string;
+    version: string;
+    detail: string;
+    at: number;
+};
+/** Exports the manifest list of the flowlibrary for audit: one entry per manifest with its digest, publisher, version, state and provenance and no step payload. */
+export declare function exportlibrarymanifests(entries: flowlibraryentry[]): Array<{
+    id: string;
+    title: string;
+    publisher: string;
+    version: string;
+    digest: string;
+    state: string;
+    provenance: string;
+    addedat: number;
+}>;
+import type { consentprovider, flowrunevent, flowrunoutcome, flowrunrequest, flowrungate, planfile, planfilestep, storedrunlog } from "./types.js";
+/**
+ * Flowrun logic of the 1.1.67 family.
+ * The terminal executes a plan file through the same pipeline the extension runs: the request parses into its options, the plan file becomes a workflow proposal that passes the same parseworkflowproposal validation, the run never starts without an origin grant file or an interactive prompt, every sensitive step waits at its consent gate routed to the consent provider (the terminal prompt in the cli, a host callback in the headless library), every outcome lands in the sealed immutable log chain the run writes to its output directory, and the logstream events and the stepstimeline render for the terminal.
+ * The run never skips a gate: a refused gate revokes the run, a failed step fails it, and both exit non zero.
+ */
+/** The driver a flowrun executes its steps through: the extension driver rides the reviewed executor, the headless driver rides a remote browser session and the dry run driver validates without page effects. */
+export interface flowdriver {
+    execute(step: planfilestep, at: number): Promise<{
+        state: "done" | "failed";
+        summary: string;
+        duration: number;
+    }>;
+}
+/** Parses one flowrun request from terminal arguments: the plan path is mandatory, the format defaults to human, the output directory defaults to the plan directory and the flags stay user choices. */
+export declare function parseflowrunrequest(args: string[]): flowrunrequest;
+/** Parses one origin grants file: a list of granted HTTPS origins the run holds for its whole duration. */
+export declare function parsegrantsfile(value: unknown): string[];
+/** Builds the workflow proposal value of one plan file so the same parseworkflowproposal validation the extension runs decides whether the run starts. */
+export declare function flowproposalvalue(file: planfile): Record<string, unknown>;
+/** Reads whether one plan file step is sensitive: the same risk and sensitive class derivation the extension runs decides which steps wait at a gate. */
+export declare function flowstepsensitive(step: planfilestep): boolean;
+/** Builds one flowrun gate wait: the gate the run holds at while the consent provider resolves it. */
+export declare function flowgateof(step: planfilestep, origin: string, reason: string): flowrungate;
+/** The dry run driver: it validates each step without page effects, so a flowrun with the dry run flag walks the plan and writes its chain without touching any browser. */
+export declare function dryflowdriver(): flowdriver;
+/** Reads the exit code of one flowrun state: a done run exits zero, a failed run exits one and a revoked run exits two. */
+export declare function flowrunexitcodeof(state: flowrunoutcome["state"]): number;
+/** Renders one flowrun event stream for the terminal: the human format prints one line per event and the json format prints one json object per line. */
+export declare function renderflowevents(events: flowrunevent[], format: "human" | "json"): string;
+/** Derives the stepstimeline rows of one flowrun from its events: one row per step with its status, summary and the gate wait it stood at. */
+export declare function flowtimelinerowsof(events: flowrunevent[]): Array<{
+    stepid: string;
+    status: "waiting" | "done" | "failed" | "revoked";
+    summary: string;
+    at: number;
+}>;
+/** Renders the stepstimeline of one flowrun for the terminal: one line per step row with its status marker. */
+export declare function renderflowtimeline(events: flowrunevent[]): string;
+/** Runs one plan file through the same pipeline the extension runs: the grants gate, the workflow proposal validation, the per step consent gates routed to the provider, the driver execution and the sealed immutable log chain the run writes. */
+export declare function runflow(input: {
+    request: flowrunrequest;
+    file: planfile;
+    grants: string[];
+    provider?: consentprovider;
+    driver?: flowdriver;
+    now: number;
+    clock?: () => number;
+    emit?: (event: flowrunevent) => void;
+}): Promise<{
+    outcome: flowrunoutcome;
+    events: flowrunevent[];
+    log: storedrunlog;
+}>;
+/** Reads the flowrun report of one finished run: the outcome beside the rendered event stream and the terminal timeline, one json document the output directory keeps. */
+export declare function flowrunreport(input: {
+    outcome: flowrunoutcome;
+    events: flowrunevent[];
+}): {
+    version: string;
+    outcome: flowrunoutcome;
+    events: flowrunevent[];
+    timeline: string;
+};
+import type { syncbridgeconflict, syncbridgehook } from "./types.js";
+/**
+ * Syncbridge logic of the 1.1.66 family.
+ * The manifest sync between machines lives here: every hook declares its provider, direction and state behind an explicit opt in with no default on, the file provider moves manifests through manual import and export while the web provider stays a stub behind the opt in gate, the digest of every manifest detects conflicts and both versions surface instead of a silent overwrite, and the scope gate refuses any payload that carries a secret or a log entry because the bridge moves manifests only.
+ * Nothing is hardcoded: the endpoint of every provider stays the user's configured value, and no hook ever turns itself on.
+ */
+/** Computes the sync digest of one manifest: the canonical body the conflict detection compares across machines. */
+export declare function syncdigestof(manifest: flowlibrarymanifest): Promise<string>;
+/** Builds one syncbridge hook with its opt in off: no hook ever defaults on, the user flips the opt in from the optionspage. */
+export declare function syncbridgehookof(input: {
+    provider: "file" | "web";
+    direction: "pull" | "push" | "both";
+    endpoint: string;
+    now: number;
+}): syncbridgehook;
+/** Flips the explicit opt in of one hook: only the user turns a hook on or off and the state resets to idle. */
+export declare function syncbridgeoptinflip(hook: syncbridgehook, optin: boolean): syncbridgehook;
+/** Reads the provider registry the optionspage lists: the file provider with its manual import and export and the web provider stub behind the opt in gate. */
+export declare function syncbridgeproviders(): Array<{
+    provider: "file" | "web";
+    label: string;
+    operations: string[];
+    note: string;
+}>;
+/** Exports one manifest list as the syncbridge file payload: the manifests travel with their digests while secrets and logs never enter the payload under any flag. */
+export declare function syncbridgeexportpayload(manifests: flowlibrarymanifest[]): Promise<{
+    version: 1;
+    kind: "syncbridge";
+    manifests: flowlibrarymanifest[];
+    digests: string[];
+    exclusions: string[];
+}>;
+/** Validates one syncbridge payload for import: the scope gate refuses a payload that carries secrets or log entries in full while a manifest only payload validates with its digest list. */
+export declare function syncbridgevalidate(payload: {
+    kind?: string;
+    manifests?: unknown;
+    digests?: unknown;
+    exclusions?: unknown;
+    secrets?: unknown;
+    logs?: unknown;
+}): {
+    ok: boolean;
+    reason: string;
+};
+/** Runs one pull or push scan of a hook and returns its conflict records instead of a silent overwrite: the digest comparison of every manifest id surfaces both versions whenever the digests differ. */
+export declare function syncbridgescan(input: {
+    hook: syncbridgehook;
+    local: Array<{
+        manifestid: string;
+        version: string;
+        digest: string;
+    }>;
+    remote: Array<{
+        manifestid: string;
+        version: string;
+        digest: string;
+    }>;
+    now: number;
+}): Promise<{
+    conflicts: syncbridgeconflict[];
+    synced: string[];
+    reason: string;
+}>;
+/** Resolves one syncbridge conflict with a distinct user action: local keeps the local manifest, remote takes the remote one and merge defers the union to the user editor. */
+export declare function resolveconflict(conflict: syncbridgeconflict, resolution: "local" | "remote" | "merge", now: number): syncbridgeconflict;
+/** Lists the conflicts of one hook the optionspage shows with their resolve actions. */
+export declare function conflictsfor(conflicts: syncbridgeconflict[], hookid?: string): syncbridgeconflict[];
+/** Reads the web provider stub descriptor: the stub names its operations and stays honest that no network call ships before its backend exists. */
+export declare function webproviderstub(hook: syncbridgehook): {
+    hookid: string;
+    endpoint: string;
+    optin: boolean;
+    operations: string[];
+    stub: true;
+    reason: string;
+};
+/** Reads the file provider adapter of one hook: pull parses a dropped sync payload, push serializes the manifest list and list reads the local manifests; every operation moves manifests only. */
+export declare function fileproviderof(hook: syncbridgehook): {
+    hookid: string;
+    operations: Array<{
+        kind: "pull" | "push" | "list";
+        label: string;
+    }>;
+};
+//# sourceMappingURL=flow.d.ts.map

package/dist/gates.d.ts

@@ -0,0 +1,103 @@
+/**
+ * The gates module of the 1.1.90 consolidation: every correlated variation of the human confirmation gate logic interned in this one file, so the module family carries one surface without duplicate variations.
+ * The correlation is the human gate itself: confirmgates holds the sensitive class gates of the run steps (confirmpay for money, confirmdelete for destruction and confirmcreds for credentials, each resolved only through one distinct human action with no timeout path and no batch approval) and approvalgate holds the remote client gates of the agent protocol (the approval raise with the full call arguments, the client identity and the called tool in every prompt, the secret redaction of the marked fields, the approve and refuse resolution with its actor and latency record and the timeout that refuses an unanswered gate by default).
+ * No gate window, class list or batch rule is ever hardcoded anywhere in the family: every timeout stays the user's choice beside the documented default, the gate payloads show exactly what the human reviews, and no gate ever resolves without its distinct human action.
+ */
+import type { confirmgate, gatekind, gateresolution, sensitiveclass, toolstep } from "./types.js";
+/** Maps the sensitive classes of one step to its gated family: payment classes gate through confirmpay, delete classes through confirmdelete and credential classes through confirmcreds, while publish grades and plain sensitive by default steps ride their consent window prompt alone. */
+export declare function gatekindfor(classes: sensitiveclass[]): gatekind | undefined;
+/** Builds the payload of one confirmpay gate: the amount, the payee origin and the target element of the step the human reviews. */
+export declare function paypayload(input: {
+    amount?: string;
+    payeeorigin: string;
+    target?: string;
+}): Record<string, string>;
+/** Builds the payload of one confirmdelete gate: the target, the scope and the irreversibility of the destructive step the human reviews. */
+export declare function deletepayload(input: {
+    target?: string;
+    scope: string;
+    irreversibility: string;
+}): Record<string, string>;
+/** Builds the payload of one confirmcreds gate: the credential label only, because the value stays behind the vault and no gate ever reveals it. */
+export declare function credspayload(label: string): Record<string, string>;
+/** Opens one confirm gate for a gated step: the payload the human reviews, the origin provenance and the open state that only an explicit user action resolves. */
+export declare function opengate(input: {
+    kind: gatekind;
+    stepid: string;
+    runid: string;
+    origin: string;
+    payload: Record<string, string>;
+    now: number;
+    gateid?: string;
+}): confirmgate;
+/** Reads the state of the gate one step waits at: no gate, an open gate the step pauses at, a resolved gate the step passes and a refused gate the step never dispatches through. */
+export declare function gatestateof(gates: confirmgate[], stepid: string): {
+    state: "none" | "open" | "resolved" | "refused";
+    gate?: confirmgate;
+};
+/** Resolves exactly one gate through one explicit human action: the decision names its acting user, an already resolved or refused gate stays terminal, and no timeout path exists because only a human resolves a gate. */
+export declare function resolvegate(input: {
+    gates: confirmgate[];
+    gateid: string;
+    decision: "resolved" | "refused";
+    actor: string;
+    now: number;
+}): {
+    gates: confirmgate[];
+    resolution?: gateresolution;
+};
+/** Refuses batch approvals: one human action resolves exactly one gate, so a resolution request that names several gates refuses in full. */
+export declare function nobatchresolution(gateids: string[]): {
+    allowed: boolean;
+    reason: string;
+};
+/** Builds the plain language prompt of one gate: confirmpay names the amount, the payee origin and the target element, confirmdelete names the target, the scope and the irreversibility, and confirmcreds names the credential label only. */
+export declare function gateprompttext(gate: confirmgate): string;
+/** Builds the gate descriptor of one gated step from its reviewed shape: the payload fields the human reviews read from the step options, the plan origin and the vault label of a credential step. */
+export declare function gateforstep(input: {
+    step: Pick<toolstep, "id" | "kind" | "target" | "options">;
+    classes: sensitiveclass[];
+    runid: string;
+    origin: string;
+    credentiallabel?: string;
+    now: number;
+}): confirmgate | undefined;
+import type { approvalrequest, approvalexec, clientidentity } from "./types.js";
+/**
+ * Approval gates of the 1.1.55 agent protocol part two.
+ * Every sensitive tool call a remote client raises lands behind a human approval gate in this file: the gate raise with the full call arguments, the client identity and the called tool in every prompt, the secret redaction of the fields the user marked secret, the approve and refuse resolution with its actor and latency record, and the timeout that refuses an unanswered gate by default.
+ * The gates never bypass review: an approved gate executes exactly the call it holds while refused and expired gates never execute anything.
+ */
+/** The documented default approval window of two minutes; any user configured window wins and an unanswered gate refuses by default. */
+export declare const defaultapprovalwindowms = 120000;
+/** Raises one approval gate for a sensitive tool call: the full call arguments, the reason in plain language, the fields the user marked secret and the timeout that refuses by default. */
+export declare function requireapproval(input: {
+    clientid: string;
+    tool: string;
+    reason: string;
+    params: Record<string, unknown>;
+    now: number;
+    timeout?: number;
+    secretfields?: string[];
+    id?: string;
+}): approvalrequest;
+/** Resolves one pending approval gate: the decision of the acting user closes the gate and returns the execution record with the latency from the raise; already closed gates stay untouched. */
+export declare function resolveapproval(input: {
+    requests: approvalrequest[];
+    id: string;
+    decision: "approved" | "refused";
+    actor: string;
+    now: number;
+}): {
+    requests: approvalrequest[];
+    exec?: approvalexec;
+};
+/** Expires every unanswered approval gate past its timeout window: the default disposition of an expired gate is refusal and the records stay for the audit trail. */
+export declare function expireapprovals(requests: approvalrequest[], now: number): approvalrequest[];
+/** Returns the pending and resolved gates of the approval view, newest raise first. */
+export declare function listapprovals(requests: approvalrequest[]): approvalrequest[];
+/** Redacts the call arguments of one approval prompt: every field the user marked secret carries its redaction marker while the rest of the arguments stay visible for review. */
+export declare function redactparams(params: Record<string, unknown>, secretfields: string[]): Record<string, unknown>;
+/** Builds the plain language approval prompt every gate surfaces: the client identity, the called tool, the reason and the full call arguments with the secret fields redacted. */
+export declare function approvalprompt(request: approvalrequest, identity?: clientidentity): string;
+//# sourceMappingURL=gates.d.ts.map

package/dist/identity.d.ts

@@ -0,0 +1,51 @@
+import { type DevThinkPaths } from "./config.js";
+export type DevThinkIdentity = {
+    version: 1;
+    userId: string;
+    deviceId: string;
+    createdAt: string;
+};
+export type PairingRecord = {
+    id: string;
+    userId: string;
+    deviceId: string;
+    codeHash?: string;
+    createdAt: string;
+    expiresAt: number;
+    usedAt?: string;
+    revokedAt?: string;
+};
+export type BrowserSession = {
+    id: string;
+    userId: string;
+    deviceId: string;
+    tokenHash: string;
+    createdAt: string;
+    expiresAt: number;
+    revokedAt?: string;
+};
+export declare function normalizePublicUserId(value: string): string;
+export declare function getIdentity(paths: DevThinkPaths): DevThinkIdentity;
+/** Updates the public local-person identifier and migrates active local pairing records. */
+export declare function setIdentityUserId(paths: DevThinkPaths, requestedUserId: string): DevThinkIdentity;
+export declare function createPairing(paths: DevThinkPaths, lifetimeMs?: number): {
+    identity: DevThinkIdentity;
+    pairingId: string;
+    code: string;
+    expiresAt: number;
+};
+/** Builds a one-time workbench invitation without embedding any provider credential. */
+export declare function createPairingLink(pagesUrl: string | undefined, gatewayUrl: string | undefined, pairingId: string, oneTimeCode: string): string | undefined;
+export declare function consumePairing(paths: DevThinkPaths, pairingId: string, oneTimeCode: string, sessionLifetimeMs?: number): {
+    token: string;
+    identity: DevThinkIdentity;
+    expiresAt: number;
+} | undefined;
+export declare function verifyBrowserSession(paths: DevThinkPaths, token: string | undefined): BrowserSession | undefined;
+export declare function revokeBrowserSessions(paths: DevThinkPaths): number;
+export declare function pairingStatus(paths: DevThinkPaths): {
+    identity: DevThinkIdentity;
+    activePairs: number;
+    activeSessions: number;
+};
+//# sourceMappingURL=identity.d.ts.map

package/dist/ids.d.ts

@@ -0,0 +1,7 @@
+/** Generates a 50-bit compact suffix that avoids ambiguous characters. */
+export declare function compactToken(): string;
+/** Creates a short identifier such as `s_1e9k2m7v3q`; existing longer IDs remain valid inputs. */
+export declare function createCompactId(prefix: string): string;
+/** Identifies the compact format without rejecting existing legacy identifiers. */
+export declare function isCompactId(value: string): boolean;
+//# sourceMappingURL=ids.d.ts.map