browxai 0.7.0

package/dist/tools/storage-web-auth-tools.js

@@ -0,0 +1,230 @@
+import { withDeadline } from "../util/deadline.js";
+import { confirmByobAction } from "../policy/confirm.js";
+import { injectStorageState, authSave, authLoad, authList, authDelete, } from "../session/storage.js";
+import { SESSION_ARG } from "./schemas.js";
+/**
+ * Web-storage + named-auth-state tools: the localStorage / sessionStorage CRUD
+ * family (registered via a `for` loop over both kinds) plus auth_save / auth_load /
+ * auth_list / auth_delete. Split out of `storage-tools` by cohesive family (RFC
+ * 0004 P3 / D3 SRP); registered through the shared `ToolHost` seam in the same
+ * source order — the web-storage loop is kept verbatim so the 10 registered names
+ * land in the same order.
+ */
+export function registerStorageWebAuthTools(host) {
+    const { z, register, gateCheck, entryFor, okText, errText, confirmCtxFor, denyContent, storageFor, workspace, cfgActionTimeout, } = host;
+    // ---- layer 2: localStorage / sessionStorage --------------------------------
+    // Origin-scoped, page-bound: the session must be navigated to the target
+    // origin before any of these tools work. Driven via `page.evaluate(...)`
+    // on `window.localStorage` / `window.sessionStorage` — the JS surface is
+    // identical, so the implementation factors over a single helper family.
+    for (const kind of ["localStorage", "sessionStorage"]) {
+        const prefix = kind === "localStorage" ? "localstorage" : "sessionstorage";
+        const human = kind === "localStorage" ? "localStorage" : "sessionStorage";
+        const lifetimeNote = kind === "localStorage"
+            ? 'Persists across reloads + browser restarts (within the origin\'s persistent storage; cleared by `inject_storage_state({mode:"replace"})` or a profile wipe).'
+            : "Session-scoped: cleared automatically when the top-level browsing context ends (tab close). NOT included in `dump_storage_state`/`storageState()` — capture is intentionally a cookies+localStorage blob.";
+        const originScope = `${human} is ORIGIN-SCOPED and tied to the current page — the session MUST be navigated to the target origin before this tool works. On about:blank / a different origin the call rejects with a navigation hint.`;
+        register(`${prefix}_get`, {
+            capability: "read",
+            description: `Read one key from ${human} of the current page's origin. Returns \`{value: string|null, origin}\`. ${originScope} Read-only.`,
+            inputSchema: { key: z.string().describe(`${human} key.`), ...SESSION_ARG },
+        }, async ({ key, session }) => {
+            const g = gateCheck(`${prefix}_get`);
+            if (g)
+                return g;
+            try {
+                const e = await entryFor(session);
+                const r = await withDeadline(storageFor(e).webStorageGet(kind, { key }, `${prefix}_get`), cfgActionTimeout(), `${prefix}_get`);
+                return okText({ ok: true, key, ...r });
+            }
+            catch (err) {
+                return errText(`${prefix}_get`, err);
+            }
+        });
+        register(`${prefix}_list`, {
+            capability: "read",
+            description: `List every key/value pair in ${human} of the current page's origin. Returns \`{entries:[{key,value}...], origin}\`. ${originScope} Read-only.`,
+            inputSchema: { ...SESSION_ARG },
+        }, async ({ session }) => {
+            const g = gateCheck(`${prefix}_list`);
+            if (g)
+                return g;
+            try {
+                const e = await entryFor(session);
+                const r = await withDeadline(storageFor(e).webStorageList(kind, `${prefix}_list`), cfgActionTimeout(), `${prefix}_list`);
+                return okText({ ok: true, count: r.entries.length, ...r });
+            }
+            catch (err) {
+                return errText(`${prefix}_list`, err);
+            }
+        });
+        register(`${prefix}_set`, {
+            capability: "action",
+            description: `Set a key/value in ${human} of the current page's origin. ${lifetimeNote} ${originScope}`,
+            inputSchema: {
+                key: z.string().describe(`${human} key.`),
+                value: z
+                    .string()
+                    .describe(`${human} value (string — same as the DOM API, non-strings must be JSON-stringified by the caller).`),
+                ...SESSION_ARG,
+            },
+        }, async ({ key, value, session }) => {
+            const g = gateCheck(`${prefix}_set`);
+            if (g)
+                return g;
+            try {
+                const e = await entryFor(session);
+                const c = await confirmByobAction(`${prefix}_set`, confirmCtxFor(e));
+                if (!c.ok)
+                    return denyContent(`${prefix}_set`, c);
+                const r = await withDeadline(storageFor(e).webStorageSet(kind, { key, value }, `${prefix}_set`), cfgActionTimeout(), `${prefix}_set`);
+                return okText({ ok: r.ok, key, origin: r.origin });
+            }
+            catch (err) {
+                return errText(`${prefix}_set`, err);
+            }
+        });
+        register(`${prefix}_delete`, {
+            capability: "action",
+            description: `Remove a key from ${human} of the current page's origin. Idempotent. ${originScope}`,
+            inputSchema: { key: z.string().describe(`${human} key.`), ...SESSION_ARG },
+        }, async ({ key, session }) => {
+            const g = gateCheck(`${prefix}_delete`);
+            if (g)
+                return g;
+            try {
+                const e = await entryFor(session);
+                const c = await confirmByobAction(`${prefix}_delete`, confirmCtxFor(e));
+                if (!c.ok)
+                    return denyContent(`${prefix}_delete`, c);
+                const r = await withDeadline(storageFor(e).webStorageDelete(kind, { key }, `${prefix}_delete`), cfgActionTimeout(), `${prefix}_delete`);
+                return okText({ ok: r.ok, key, origin: r.origin });
+            }
+            catch (err) {
+                return errText(`${prefix}_delete`, err);
+            }
+        });
+        register(`${prefix}_clear`, {
+            capability: "action",
+            description: `Wipe ALL keys in ${human} of the current page's origin. ${originScope}`,
+            inputSchema: { ...SESSION_ARG },
+        }, async ({ session }) => {
+            const g = gateCheck(`${prefix}_clear`);
+            if (g)
+                return g;
+            try {
+                const e = await entryFor(session);
+                const c = await confirmByobAction(`${prefix}_clear`, confirmCtxFor(e));
+                if (!c.ok)
+                    return denyContent(`${prefix}_clear`, c);
+                const r = await withDeadline(storageFor(e).webStorageClear(kind, `${prefix}_clear`), cfgActionTimeout(), `${prefix}_clear`);
+                return okText({ ok: r.ok, origin: r.origin });
+            }
+            catch (err) {
+                return errText(`${prefix}_clear`, err);
+            }
+        });
+    }
+    // ---- layer 3: named auth-states --------------------------------------------
+    // Wraps layer 1: auth_save writes a workspace-rooted JSON of the bulk
+    // storageState; auth_load reads it back. open_session({authState}) is the
+    // canonical seeding path; inject_storage_state({state: <path or blob>})
+    // is the in-flight reseat. NO parallel implementation.
+    register("auth_save", {
+        capability: "action",
+        description: "Capture the session's current storage state into a named slot at `$BROWX_WORKSPACE/.auth-states/<name>.json`. Names are letters/digits/`._-` only (no separators, no `..`). Overwrites an existing slot of the same name. Pair with `open_session({authState})` to spin up a session pre-logged-in, or with `auth_load` + `inject_storage_state` for in-flight reseating. SECURITY NOTE: cookie *values* may carry credentials — these files are sensitive (a future secrets-masking pass lands separately).",
+        inputSchema: {
+            name: z.string().describe("Slot name (letters/digits/`._-` only)."),
+            ...SESSION_ARG,
+        },
+    }, async ({ name, session }) => {
+        const g = gateCheck("auth_save");
+        if (g)
+            return g;
+        try {
+            const e = await entryFor(session);
+            const c = await confirmByobAction("auth_save", confirmCtxFor(e));
+            if (!c.ok)
+                return denyContent("auth_save", c);
+            const r = await withDeadline(authSave(e.session.page().context(), workspace.root, name), cfgActionTimeout(), "auth_save");
+            return okText({ ...r });
+        }
+        catch (err) {
+            return errText("auth_save", err);
+        }
+    });
+    register("auth_load", {
+        capability: "action",
+        description: 'Load a named storage-state slot AND apply it to an existing session (replaces the context\'s cookies/localStorage/IndexedDB — same semantics as `inject_storage_state({mode:"replace"})`). For SEEDING a new session at creation time, prefer `open_session({authState:"<name>"})` — that\'s cheaper (no clear-then-replace cycle on a fresh context) and lets incognito mode use the Playwright-native primitive.',
+        inputSchema: {
+            name: z.string().describe("Slot name (must exist; auth_save it first)."),
+            ...SESSION_ARG,
+        },
+    }, async ({ name, session }) => {
+        const g = gateCheck("auth_load");
+        if (g)
+            return g;
+        try {
+            const e = await entryFor(session);
+            const c = await confirmByobAction("auth_load", confirmCtxFor(e));
+            if (!c.ok)
+                return denyContent("auth_load", c);
+            const blob = authLoad(workspace.root, name);
+            const r = await withDeadline(injectStorageState(e.session.page().context(), e.session.page(), blob, {
+                mode: "replace",
+            }), cfgActionTimeout(), "auth_load");
+            return okText({ ok: true, name, applied: r });
+        }
+        catch (err) {
+            return errText("auth_load", err);
+        }
+    });
+    register("auth_list", {
+        capability: "read",
+        description: "Enumerate every named auth-state slot in the workspace. Returns `{name, path, bytes, modifiedAt}` per slot, sorted by name. Read-only.",
+        inputSchema: {},
+    }, async () => {
+        const g = gateCheck("auth_list");
+        if (g)
+            return g;
+        try {
+            const slots = authList(workspace.root);
+            return okText({ ok: true, count: slots.length, slots });
+        }
+        catch (err) {
+            return errText("auth_list", err);
+        }
+    });
+    register("auth_delete", {
+        capability: "action",
+        description: "Remove a named auth-state slot from the workspace. Idempotent (`existed:false` if it wasn't there).",
+        inputSchema: { name: z.string().describe("Slot name.") },
+    }, async ({ name }) => {
+        const g = gateCheck("auth_delete");
+        if (g)
+            return g;
+        try {
+            const r = authDelete(workspace.root, name);
+            return okText({ ...r, name });
+        }
+        catch (err) {
+            return errText("auth_delete", err);
+        }
+    });
+    // ===========================================================================
+    // Cache API + IndexedDB CRUD.
+    //
+    // Sibling families of the cookie / web-storage CRUD above. Both APIs are
+    // ORIGIN-SCOPED — the page MUST be navigated to the target origin first
+    // (same posture as localStorage / sessionStorage). On about:blank or a
+    // different origin the call rejects with a navigation hint.
+    //
+    // Capability split:
+    //   reads  (`caches_list_storages`, `caches_list`, `caches_get`,
+    //           `idb_list_databases`, `idb_list_stores`, `idb_get`)  → `read`
+    //   writes (`caches_put`, `caches_delete`, `caches_clear`,
+    //           `caches_delete_storage`, `idb_put`, `idb_delete`,
+    //           `idb_clear`)                                          → `action`
+    // No new capability gate — same posture as web-storage CRUD.
+    // ===========================================================================
+}

package/dist/tools/tool-metadata.d.ts

@@ -0,0 +1,8 @@
+import type { ToolRegistration } from "./host.js";
+/** Run every core tool registration once against a browser-free host and return
+ *  the accumulated metadata table (name → `ToolMeta` + zod schema). The two
+ *  plugin-info tools (`plugins_list` / `plugins_info`) are registered inside the
+ *  async `wirePluginRuntime` (which loads plugins from disk); their capability is
+ *  declared from the shared `PLUGIN_INFO_TOOL_CAPABILITY` source so collection
+ *  stays synchronous and IO-free. Cached after the first run. */
+export declare function collectToolMetadata(): ReadonlyMap<string, ToolRegistration>;

package/dist/tools/tool-metadata.js

@@ -0,0 +1,185 @@
+// Tool-metadata bootstrap (RFC 0004 P2 / D2 + D7).
+//
+// The per-tool gating facts (`capability` / `batchable` / `deep`) and the zod
+// input schema are declared inline at each `host.register` call — the single
+// source of truth. The three central maps (`TOOL_CAPABILITY`,
+// `BATCH_ALLOWED_TOOLS`, `DEEP_TOOLS`) and the SDK tool-types codegen are DERIVED
+// from those registrations.
+//
+// Most consumers read a derived map only AFTER `createServer` has run every
+// `registerXxxTools(host)` module, so the maps are already populated. But a few
+// read them standalone — `resolveCapabilities` (a unit test, `browxai doctor`),
+// the SDK registry's `capabilityFor`, and the SDK tool-types generator. For those
+// callers this module exposes `collectToolMetadata()`: it builds a browser-free
+// host, runs every registration once, and returns the accumulated table. It also
+// installs that collection as the lazy populator behind `TOOL_CAPABILITY` /
+// `DEEP_TOOLS` (the inverted dependency the leaf modules `capabilities.ts` /
+// `tool-gate.ts` cannot express directly — they can't import the tools layer).
+//
+// The collection is browser-free and idempotent: the host's session factory is
+// lazy (no browser opens), the handlers are never invoked (only their `def`
+// metadata is read), and `declareToolCapability` / `declareDeepTool` are no-ops
+// on a repeat of the same value.
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { installToolMetadataCollector, resolveCapabilities, resolveConfirmHooks, } from "../util/capabilities.js";
+import { installDeepToolsCollector } from "../engine/tool-gate.js";
+import { resolveConfig } from "../util/config.js";
+import { resolveWorkspace } from "../util/workspace.js";
+import { ConfigStore, resolvedToEnv } from "../util/config-store.js";
+import { resolveOriginPolicy } from "../policy/origin.js";
+import { ApprovalStore } from "../policy/confirm.js";
+import { resolveCredentialsProvider } from "../util/credentials.js";
+import { DiagnosticsRecorder } from "../util/diagnostics.js";
+import { PACKAGE_VERSION } from "../util/version.js";
+import { buildHost } from "./host-build.js";
+import { buildSessionRegistry } from "./session-registry.js";
+import { registerActionTools } from "./action-tools.js";
+import { registerReadObserveDomTools } from "./read-observe-dom-tools.js";
+import { registerReadObserveExtractTools } from "./read-observe-extract-tools.js";
+import { registerReadObserveVerifyTools } from "./read-observe-verify-tools.js";
+import { registerReadObserveCaptureTools } from "./read-observe-capture-tools.js";
+import { registerReadObserveBufferTools } from "./read-observe-buffer-tools.js";
+import { registerGestureNetworkTools } from "./gesture-network-tools.js";
+import { registerDeepPerfTools } from "./deep-perf-tools.js";
+import { registerDeepCoverageTools } from "./deep-coverage-tools.js";
+import { registerDeepDeterminismTools } from "./deep-determinism-tools.js";
+import { registerCaptureReportMarksTools } from "./capture-report-marks-tools.js";
+import { registerCaptureReportDiagnosticsTools } from "./capture-report-diagnostics-tools.js";
+import { registerCaptureReportUploadTools } from "./capture-report-upload-tools.js";
+import { registerCaptureReportExportTools } from "./capture-report-export-tools.js";
+import { registerCaptureReportElementExportTools } from "./capture-report-element-export-tools.js";
+import { registerCanvasTools } from "./canvas-tools.js";
+import { registerStorageTools } from "./storage-tools.js";
+import { registerFormsRecordingTools } from "./forms-recording-tools.js";
+import { registerSessionPolicyTools } from "./session-policy-tools.js";
+import { registerDeviceEmulationTools } from "./device-emulation-tools.js";
+import { registerLiveEmulationTools } from "./live-emulation-tools.js";
+import { registerConfigApprovalTools } from "./config-approval-tools.js";
+import { registerSecretsCaptchaTools } from "./secrets-captcha-tools.js";
+import { registerInputTools } from "./input-tools.js";
+import { registerExtensionsBatchTools } from "./extensions-batch-tools.js";
+import { PLUGIN_INFO_TOOL_CAPABILITY } from "./plugin-runtime.js";
+/** Build a browser-free `HostDeps` so `buildHost` runs without opening a browser.
+ *  Mirrors the deps `createServer` assembles (server.ts) via the same public
+ *  resolvers; the session-registry factory is lazy (no session opens), and the
+ *  two per-handler closures (`describeTarget` / `asTarget`) are stubs `buildHost`
+ *  only stores and never invokes at construction. */
+function makeMetadataHostDeps() {
+    const workspace = resolveWorkspace();
+    const configStore = new ConfigStore(workspace.root);
+    const resolvedConfig = configStore.resolve();
+    const cfgEnv = resolvedToEnv(resolvedConfig);
+    const config = resolveConfig(cfgEnv);
+    const caps = resolveCapabilities(cfgEnv);
+    const confirmHooks = resolveConfirmHooks(cfgEnv);
+    const originPolicy = resolveOriginPolicy(cfgEnv);
+    const approvals = new ApprovalStore();
+    const credentialsResolved = resolveCredentialsProvider(cfgEnv);
+    const diagnostics = new DiagnosticsRecorder({ enabled: false, workspaceRoot: workspace.root });
+    const registry = buildSessionRegistry({
+        opts: { headless: true },
+        resolvedConfig,
+        configStore,
+        caps,
+        workspace,
+        serverEngine: "chromium",
+        serverDefaultMode: "persistent",
+    });
+    // The collection server is throwaway (never served) — name/version are cosmetic.
+    const server = new McpServer({ name: "browxai", version: PACKAGE_VERSION }, { capabilities: { tools: {} } });
+    const toolHandlers = {};
+    return {
+        server,
+        toolHandlers,
+        registry,
+        config,
+        configStore,
+        resolvedConfig,
+        caps,
+        confirmHooks,
+        originPolicy,
+        approvals,
+        isByob: false,
+        workspace,
+        diagnostics,
+        credentialsResolved,
+        pluginRecords: () => [],
+        startOptions: { headless: true },
+        describeTarget: async () => "",
+        asTarget: () => {
+            throw new Error("asTarget is a metadata-collection stub — no handler runs here");
+        },
+    };
+}
+let cached;
+/** Run every core tool registration once against a browser-free host and return
+ *  the accumulated metadata table (name → `ToolMeta` + zod schema). The two
+ *  plugin-info tools (`plugins_list` / `plugins_info`) are registered inside the
+ *  async `wirePluginRuntime` (which loads plugins from disk); their capability is
+ *  declared from the shared `PLUGIN_INFO_TOOL_CAPABILITY` source so collection
+ *  stays synchronous and IO-free. Cached after the first run. */
+export function collectToolMetadata() {
+    if (cached)
+        return cached;
+    const host = buildHost(makeMetadataHostDeps());
+    registerReadObserveDomTools(host);
+    registerReadObserveExtractTools(host);
+    registerReadObserveVerifyTools(host);
+    registerReadObserveCaptureTools(host);
+    registerReadObserveBufferTools(host);
+    registerActionTools(host);
+    registerGestureNetworkTools(host);
+    registerDeepPerfTools(host);
+    registerDeepCoverageTools(host);
+    registerDeepDeterminismTools(host);
+    registerCaptureReportMarksTools(host);
+    registerCaptureReportDiagnosticsTools(host);
+    registerCaptureReportUploadTools(host);
+    registerCaptureReportExportTools(host);
+    registerCaptureReportElementExportTools(host);
+    registerCanvasTools(host);
+    registerStorageTools(host);
+    registerFormsRecordingTools(host);
+    registerSessionPolicyTools(host);
+    registerDeviceEmulationTools(host);
+    registerLiveEmulationTools(host);
+    registerConfigApprovalTools(host);
+    registerSecretsCaptchaTools(host);
+    registerInputTools(host);
+    registerExtensionsBatchTools(host);
+    // The two plugin-info MCP tools register inside the async plugin runtime; their
+    // capability (the only metadata that matters for the derived maps) is declared
+    // from the shared single source so we don't run the plugin loader to collect it.
+    const table = new Map(host.registrations);
+    for (const [name, capability] of Object.entries(PLUGIN_INFO_TOOL_CAPABILITY)) {
+        host.register(name, { description: `${name} (plugin runtime)`, capability }, async () => ({
+            content: [],
+        }));
+    }
+    for (const [name, reg] of host.registrations)
+        table.set(name, reg);
+    cached = table;
+    return cached;
+}
+// Install the collection as the lazy populator behind the derived maps. A read of
+// `TOOL_CAPABILITY` / `DEEP_TOOLS` (or a `resolveCapabilities` call) that happens
+// before `createServer` ran will now trigger `collectToolMetadata()` once and see
+// the full derived rows — without the standalone caller having to build a server.
+installToolMetadataCollector(() => {
+    collectToolMetadata();
+});
+installDeepToolsCollector(() => {
+    collectToolMetadata();
+});
+// D1 (RFC 0004 P2, SECURITY-CRITICAL): EAGERLY populate the derived maps at import
+// time — do not wait for the first lazy read. Importing this bootstrap is the
+// composition-root install point reached by every real entry point (the package
+// entry `src/index.ts`, `createServer` in `src/server.ts`, the SDK client in
+// `src/sdk/index.ts`, and the CLI `src/cli.ts`). With the maps populated on import,
+// the gate's fail-safe (`assertGateBootstrapped` / `assertEngineGateBootstrapped`)
+// never fires on a production read — it stays a backstop against a NEW consumer
+// that forgets to reach this bootstrap. The collection is cached, so the eager run
+// is paid once. createServer calls `resolveCapabilities` BEFORE its own tool
+// registrations; because this eager run already populated the maps, that early
+// read sees the full rows rather than an empty (fail-open) map.
+collectToolMetadata();

package/dist/util/batch.d.ts

@@ -0,0 +1,83 @@
+import { type Predicate } from "./predicates.js";
+export interface BatchCall {
+    tool: string;
+    args?: Record<string, unknown>;
+    /** opaque label echoed verbatim in the result for cross-referencing in
+     *  long batches ("set type", "set initiative", "save row"). Free-form. */
+    label?: string;
+    /** optional post-call assertions. Failing any assertion marks the call
+     *  as `ok: false` with `error` set to the failed predicate, and respects
+     *  `stopOnError`. Minimal predicate set — not a full assertion DSL. */
+    expect?: BatchExpect;
+}
+export interface BatchExpect {
+    /** Inner result's `element.value === <string>`. */
+    valueEquals?: string;
+    /** Inner result's `element.displayText` includes the substring. */
+    displayTextIncludes?: string;
+    /** Inner result's `element.ownerControl.displayTextAfter` includes the substring. */
+    controlDisplayTextIncludes?: string;
+    /** Inner result's `element.container.rowText` includes the substring. */
+    containerTextIncludes?: string;
+    /** Inner result's `element.ownerControl.changed === true`. */
+    controlChanged?: boolean;
+}
+export interface BatchEntry {
+    tool: string;
+    /** Echo of the call's `label` when supplied. */
+    label?: string;
+    ok: boolean;
+    result?: unknown;
+    error?: string;
+}
+export interface BatchReport {
+    completed: number;
+    failedAt: number | null;
+    results: BatchEntry[];
+}
+export type ToolContent = {
+    type: "text";
+    text: string;
+} | {
+    type: string;
+    [k: string]: unknown;
+};
+export interface ToolResponse {
+    content: ToolContent[];
+}
+export type ToolHandler = (args: unknown) => Promise<ToolResponse>;
+export interface BatchOptions {
+    allowed: ReadonlySet<string>;
+    handlers: Record<string, ToolHandler>;
+    stopOnError?: boolean;
+}
+export declare function runBatch(calls: BatchCall[], opts: BatchOptions): Promise<BatchReport>;
+/**
+ * Evaluate a `BatchExpect` against the parsed inner-call result. Returns null
+ * when all predicates pass, or a string describing the first failed predicate.
+ *
+ * Implementation: each shorthand field lowers into a `Predicate` and runs
+ * through the shared `evaluatePredicate` engine — same vocabulary that backs
+ * `verify_predicate`. The shorthand INPUT shape stays frozen; the engine
+ * underneath is shared so semantic primitives (`contains`, `equals`) can
+ * never drift between the two surfaces. The data bag is the inner-call body
+ * itself (an ActionResult-shaped `{element: {...}}`); paths use the
+ * `element.*` root, which is on the predicate engine's accessor allow-list.
+ *
+ * Exported for unit tests.
+ */
+export declare function evaluateExpect(expect: BatchExpect, body: unknown): string | null;
+interface LoweredShorthand {
+    /** Source shorthand field name — used in the failure string so the
+     *  user-facing message still names the shorthand they supplied. */
+    field: keyof BatchExpect;
+    /** Path label for the failure message (e.g. "element.value"). */
+    path: string;
+    /** The value the shorthand expected (echoed in the failure message). */
+    expected: unknown;
+    predicate: Predicate;
+}
+/** Pure; exported for tests + the equivalence-pinning regression. Each
+ *  supplied shorthand field becomes one predicate over the inner body. */
+export declare function lowerExpect(expect: BatchExpect): LoweredShorthand[];
+export {};