constructor-research-mcp 0.0.0-stage → 0.3.0

package/dist/session.js

@@ -0,0 +1,108 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+/** The cookies the MCP keeps: the access token for requests, the refresh token to renew it. */
+export const SESSION_COOKIES = [
+    "ap_access_token",
+    "ap_id_token",
+    "ap_refresh_token",
+];
+/** Claims of a JWT, or undefined when it is not one. */
+export function claims(jwt) {
+    try {
+        return JSON.parse(Buffer.from(jwt.split(".")[1], "base64url").toString());
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Session cookies found in a Cookie header, a cURL, a Set-Cookie list or a bare JWT. */
+export function sessionCookies(text) {
+    const found = new Map();
+    for (const name of SESSION_COOKIES) {
+        const value = [
+            ...text.matchAll(new RegExp(`(?:^|[\\s;'"])${name}=([\\w.~+/=-]+)`, "g")),
+        ].at(-1)?.[1];
+        if (value)
+            found.set(name, value);
+    }
+    const bare = /^\s*(ey[\w-]+\.[\w-]+\.[\w-]+)\s*$/.exec(text)?.[1];
+    if (bare && !found.size)
+        found.set("ap_access_token", bare);
+    return found;
+}
+/** Index of the line holding the tokens in a cookie file, or -1. */
+const cookieLine = (lines) => lines.findIndex((l) => /^\s*(Cookie:\s*)?(ey[\w-]+\.|.*\bap_(access|refresh)_token=)/.test(l));
+/** The session saved in a cookie file; only its cookie line is read. */
+export async function readSession(file) {
+    const lines = (await readFile(file, "utf8")).split(/\r?\n/);
+    const line = lines[cookieLine(lines)] ?? "";
+    if (/[\x00-\x1f]/.test(line))
+        return new Map();
+    return sessionCookies(line.trim().replace(/^Cookie:\s*/i, ""));
+}
+/** The line naming the Constructor the session belongs to. */
+const HOST = /^host=(\S+)\s*$/;
+/**
+ * The Constructor (an origin) a saved session belongs to: its host line, written at sign-in,
+ * or else the issuer of its access token. Undefined when nothing is saved.
+ */
+export async function sessionHost(file) {
+    let lines;
+    try {
+        lines = (await readFile(file, "utf8")).split(/\r?\n/);
+    }
+    catch {
+        return undefined;
+    }
+    const named = lines.map((l) => HOST.exec(l)?.[1]).find(Boolean);
+    const line = lines[cookieLine(lines)] ?? "";
+    const issuer = claims(sessionCookies(line.replace(/^\s*Cookie:\s*/i, "")).get("ap_access_token"))?.iss;
+    try {
+        return new URL(named ?? issuer).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Replaces the cookie line of a file with these cookies, keeping its other lines, and with
+ * `host` its host line. Written to a temporary file and renamed, mode 600, so a reader never
+ * sees half a token and a crash never loses the session.
+ */
+export async function saveSession(file, cookies, host) {
+    let lines = [];
+    try {
+        lines = (await readFile(file, "utf8")).split(/\r?\n/);
+    }
+    catch (e) {
+        if (e.code !== "ENOENT")
+            throw e;
+    }
+    const line = SESSION_COOKIES.filter((n) => cookies.get(n))
+        .map((n) => `${n}=${cookies.get(n)}`)
+        .join("; ");
+    const i = cookieLine(lines);
+    if (i >= 0)
+        lines[i] = line;
+    else
+        lines.unshift(line);
+    if (host) {
+        lines = lines.filter((l) => !HOST.test(l));
+        lines.splice(lines.indexOf(line) + 1, 0, `host=${host}`);
+    }
+    await mkdir(dirname(file), { recursive: true });
+    const tmp = `${file}.${randomUUID()}.tmp`;
+    await writeFile(tmp, lines.join("\n").replace(/\n*$/, "\n"), {
+        mode: 0o600,
+        flag: "wx",
+    });
+    await rename(tmp, file);
+}
+/** New session cookies from a response's Set-Cookie headers. */
+export function setCookies(response) {
+    return sessionCookies(response.headers
+        .getSetCookie()
+        .map((c) => c.split(";")[0])
+        .join("; "));
+}

package/dist/set-token.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/set-token.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// Save the session from a copied cURL (or a bare token) for the MCP without printing it.
+// Usage: npx -y -p constructor-research-mcp constructor-research-set-token <file with a copied cURL, or a token> --for claude-code|codex|opencode
+//        (or --to <session file>); the session belongs to the Constructor the cURL was sent to.
+import { readFileSync } from "node:fs";
+import { configFromEnv, HARNESSES, originOf, sessionArgs } from "./config.js";
+import { claims, saveSession, sessionCookies } from "./session.js";
+const { file: target, rest } = sessionArgs(process.argv.slice(2), configFromEnv());
+const source = rest[0];
+if (!source || !target) {
+    console.error(`Usage: npx -y -p constructor-research-mcp constructor-research-set-token <file with a copied cURL> --for ${HARNESSES.join("|")}   (or --to <session file>)`);
+    process.exit(2);
+}
+const text = readFileSync(source, "utf8");
+const found = sessionCookies(text);
+const token = found.get("ap_access_token");
+if (!token) {
+    console.error("No ap_access_token found in " + source + ".");
+    process.exit(1);
+}
+const { exp, max_slt } = claims(token) ?? {};
+if (exp && exp * 1000 <= Date.now() && !found.has("ap_refresh_token")) {
+    console.error("That token already expired at " +
+        new Date(exp * 1000).toISOString() +
+        "; copy a fresh one.");
+    process.exit(1);
+}
+// The Constructor the cURL was sent to; a bare token names its own issuer.
+const sent = /\bcurl\s+(?:-\S+\s+)*['"]?(https?:\/\/[^\s'"]+)/.exec(text)?.[1];
+let host;
+try {
+    host = sent ? originOf(sent) : undefined;
+}
+catch { }
+await saveSession(target, found, host);
+const time = (s) => new Date(s * 1000).toISOString().slice(0, 16).replace("T", " ") + " UTC";
+console.log("Saved to " +
+    target +
+    (host ? ` (for ${host})` : "") +
+    (found.has("ap_refresh_token")
+        ? `, with the refresh token: the MCP renews the session itself${max_slt ? " until " + time(max_slt) : ""}. The browser this cURL came from holds the same session, and a refresh token works once: whichever renews first logs the other out. The sign_in tool (or constructor-research-login) gives the MCP a session of its own.`
+        : exp
+            ? "; expires " +
+                time(exp) +
+                " (in " +
+                Math.round((exp * 1000 - Date.now()) / 60000) +
+                " min). Copy the cURL with the ap_refresh_token cookie, or use the sign_in tool, and the MCP renews it itself."
+            : "."));

package/dist/signin.d.ts

@@ -0,0 +1,19 @@
+import type { Config } from "./config.js";
+export type SignInResult = {
+    status: "signed_in";
+    message: string;
+    session_file: string;
+    host: string;
+    until?: string;
+} | {
+    status: "sign_in_failed";
+    message: string;
+};
+/** A Chromium-based browser on macOS, Windows or Linux; CONSTRUCTOR_BROWSER overrides. */
+export declare function findBrowser(): string | undefined;
+/**
+ * Opens the sign-in window, waits for the user to sign in (up to 15 min), saves the
+ * session cookies to `file`, and closes the window at once. Never returns a token.
+ * `opened` runs once the window is up.
+ */
+export declare function signIn(config: Pick<Config, "baseUrl" | "apiPath" | "requestTimeoutMs">, file: string, opened?: () => void): Promise<SignInResult>;

package/dist/signin.js

@@ -0,0 +1,209 @@
+// Sign in to Constructor in a separate Chrome window and save the session.
+// The window uses a fresh temporary profile: a session nothing else holds, so the MCP can
+// renew it without logging out the user's own browser (a refresh token works only once).
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { delimiter, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { claims, saveSession, setCookies, SESSION_COOKIES } from "./session.js";
+const SIGN_IN_MINUTES = 15;
+/** A Chromium-based browser on macOS, Windows or Linux; CONSTRUCTOR_BROWSER overrides. */
+export function findBrowser() {
+    if (process.env.CONSTRUCTOR_BROWSER)
+        return existsSync(process.env.CONSTRUCTOR_BROWSER)
+            ? process.env.CONSTRUCTOR_BROWSER
+            : undefined;
+    const env = process.env;
+    const installed = process.platform === "win32"
+        ? [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA]
+            .filter((d) => !!d)
+            .flatMap((d) => [
+            join(d, "Google", "Chrome", "Application", "chrome.exe"),
+            join(d, "Microsoft", "Edge", "Application", "msedge.exe"),
+            join(d, "Chromium", "Application", "chrome.exe"),
+            join(d, "BraveSoftware", "Brave-Browser", "Application", "brave.exe"),
+        ])
+        : process.platform === "darwin"
+            ? [
+                "Google Chrome.app/Contents/MacOS/Google Chrome",
+                "Chromium.app/Contents/MacOS/Chromium",
+                "Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+                "Brave Browser.app/Contents/MacOS/Brave Browser",
+            ].flatMap((app) => [
+                join("/Applications", app),
+                join(homedir(), "Applications", app),
+            ])
+            : [];
+    // Then the PATH, as Linux installs them (and any OS where the user put one there).
+    const names = [
+        "google-chrome",
+        "google-chrome-stable",
+        "chromium",
+        "chromium-browser",
+        "microsoft-edge",
+        "brave-browser",
+        "chrome",
+        "msedge",
+    ];
+    const exts = process.platform === "win32"
+        ? (env.PATHEXT ?? ".EXE").split(";").filter(Boolean)
+        : [""];
+    const onPath = (env.PATH ?? "")
+        .split(delimiter)
+        .filter(Boolean)
+        .flatMap((dir) => names.flatMap((n) => exts.map((e) => join(dir, n + e.toLowerCase()))));
+    return [...installed, ...onPath].find((c) => existsSync(c));
+}
+/** Minimal Chrome DevTools Protocol client over the browser's WebSocket. */
+async function devtools(url) {
+    const ws = new WebSocket(url);
+    await new Promise((ok, fail) => {
+        ws.onopen = ok;
+        ws.onerror = () => fail(new Error("Could not connect to the browser."));
+    });
+    let id = 0;
+    const waiting = new Map();
+    ws.onmessage = (e) => {
+        const m = JSON.parse(String(e.data));
+        waiting.get(m.id)?.(m);
+        waiting.delete(m.id);
+    };
+    return {
+        send(method, params = {}) {
+            return new Promise((ok, fail) => {
+                const n = ++id;
+                waiting.set(n, (m) => m.error ? fail(new Error(m.error.message)) : ok(m.result));
+                ws.send(JSON.stringify({ id: n, method, params }));
+            });
+        },
+        close: () => ws.close(),
+    };
+}
+/**
+ * Opens the sign-in window, waits for the user to sign in (up to 15 min), saves the
+ * session cookies to `file`, and closes the window at once. Never returns a token.
+ * `opened` runs once the window is up.
+ */
+export async function signIn(config, file, opened = () => { }) {
+    const fallback = `save a session from a copied cURL instead: npx -y -p constructor-research-mcp constructor-research-set-token <file with the cURL> --to ${file}`;
+    const headless = !!process.env.CONSTRUCTOR_LOGIN_HEADLESS;
+    if (process.platform === "linux" &&
+        !headless &&
+        !process.env.DISPLAY &&
+        !process.env.WAYLAND_DISPLAY)
+        return {
+            status: "sign_in_failed",
+            message: `This machine has no screen to open a sign-in window on (no DISPLAY or WAYLAND_DISPLAY). Sign in where the MCP has a desktop, or ${fallback}.`,
+        };
+    const exe = findBrowser();
+    if (!exe)
+        return {
+            status: "sign_in_failed",
+            message: `No Chrome, Edge, Chromium or Brave found. Set CONSTRUCTOR_BROWSER in the MCP settings to the browser's executable, or ${fallback}.`,
+        };
+    const host = new URL(config.baseUrl).hostname;
+    const profile = await mkdtemp(join(tmpdir(), "constructor-login-"));
+    const chrome = spawn(exe, [
+        `--user-data-dir=${profile}`,
+        "--remote-debugging-port=0",
+        "--remote-allow-origins=http://127.0.0.1",
+        "--no-first-run",
+        "--no-default-browser-check",
+        "--disable-sync",
+        // Tests run the browser without a window.
+        ...(headless ? ["--headless=new"] : []),
+        "--new-window",
+        `${config.baseUrl}/research/`,
+    ], { stdio: "ignore" });
+    let exited = false;
+    chrome.on("exit", () => (exited = true));
+    chrome.on("error", () => (exited = true));
+    const failed = (message) => ({
+        status: "sign_in_failed",
+        message,
+    });
+    try {
+        let port, path;
+        for (let i = 0; i < 300 && !port && !exited; i++) {
+            try {
+                [port, path] = (await readFile(join(profile, "DevToolsActivePort"), "utf8")).split("\n");
+            }
+            catch {
+                await delay(100);
+            }
+        }
+        if (!port)
+            return failed(`The browser did not start (${exe}); ${fallback}.`);
+        const cdp = await devtools(`ws://127.0.0.1:${port}${path}`);
+        opened();
+        const session = async () => {
+            const { cookies } = await cdp.send("Storage.getCookies");
+            return new Map(cookies
+                .filter((c) => SESSION_COOKIES.includes(c.name) &&
+                (c.domain.replace(/^\./, "") === host ||
+                    host.endsWith(c.domain.startsWith(".") ? c.domain : "." + c.domain)))
+                .map((c) => [c.name, c.value]));
+        };
+        const deadline = Date.now() + SIGN_IN_MINUTES * 60000;
+        let found;
+        while (!exited && Date.now() < deadline) {
+            const s = await session().catch(() => undefined);
+            const exp = claims(s?.get("ap_access_token"))?.exp;
+            if (s?.has("ap_refresh_token") && exp && exp * 1000 > Date.now()) {
+                // The page may still be loading; read again once it settles, then close at once so
+                // the window never renews this session itself.
+                await delay(3000);
+                found = (await session().catch(() => undefined)) ?? s;
+                break;
+            }
+            await delay(1000);
+        }
+        await cdp.send("Browser.close").catch(() => { });
+        cdp.close();
+        if (!found)
+            return failed(exited
+                ? "The window was closed before sign-in finished; nothing was saved."
+                : `No sign-in within ${SIGN_IN_MINUTES} min; nothing was saved.`);
+        // Check the access token without sending the refresh token, so nothing is renewed.
+        const response = await fetch(config.baseUrl + config.apiPath + "/auth/session", {
+            headers: {
+                Cookie: `ap_access_token=${found.get("ap_access_token")}`,
+                Accept: "application/json",
+            },
+            redirect: "manual",
+            signal: AbortSignal.timeout(config.requestTimeoutMs),
+        }).catch(() => undefined);
+        await response?.body?.cancel();
+        if (response?.status === 401)
+            return failed("Constructor rejected the new session; nothing was saved.");
+        await saveSession(file, new Map([...found, ...(response ? setCookies(response) : [])]), config.baseUrl);
+        const end = claims(found.get("ap_access_token"))?.max_slt;
+        const until = end
+            ? new Date(end * 1000).toISOString().slice(0, 16).replace("T", " ") +
+                " UTC"
+            : undefined;
+        return {
+            status: "signed_in",
+            message: `Signed in to ${config.baseUrl}. Session saved to ${file}` +
+                (until ? `; the MCP renews it automatically until ${until}.` : "."),
+            session_file: file,
+            host: config.baseUrl,
+            until,
+        };
+    }
+    catch (e) {
+        return failed(`Sign-in failed: ${e?.message ?? e}. Nothing was saved.`);
+    }
+    finally {
+        if (!exited) {
+            chrome.kill();
+            for (let i = 0; i < 50 && !exited; i++)
+                await delay(100);
+            if (!exited)
+                chrome.kill("SIGKILL"); // TerminateProcess on Windows
+        }
+        await rm(profile, { recursive: true, force: true }).catch(() => { });
+    }
+}

package/dist/store.d.ts

@@ -0,0 +1,85 @@
+import type { Config } from "./config.js";
+export interface Operation {
+    id: string;
+    kind: "deploy" | "update" | "build" | "start" | "stop";
+    endpoint: string;
+    input: any;
+    status: string;
+    volumes_to_wipe?: string[];
+    project_id?: string;
+    application_id?: string;
+    desks: Record<string, string>;
+    images: Record<string, string>;
+    services: Record<string, string>;
+    applied: string[];
+    stopped: string[];
+    started: string[];
+    pending?: {
+        method: string;
+        path: string;
+    };
+    message?: string;
+    created_at: string;
+    updated_at: string;
+    result?: any;
+    action?: {
+        stage: string;
+        service?: string;
+        dockerfile?: string;
+    };
+    revision?: number;
+    /** Image ID seen with build_status error once; a failure counts on the second sighting. */
+    errorSeen?: Record<string, string>;
+    /** Name of the failed image per build that was already rebuilt once. */
+    retried?: Record<string, string>;
+    /** Public-URL checks after start. */
+    readiness?: {
+        since: number;
+        checks: Record<string, {
+            url: string;
+            status: number | null;
+            ok: boolean;
+        }>;
+        /** Services that printed nothing since they started, once the window ran out. */
+        silent?: string[];
+    };
+    /** Earlier deployments of the same application this one replaced. */
+    replaced?: {
+        deployment_id: string;
+        services_not_included: string[];
+    }[];
+    submission_key?: string;
+    failure?: {
+        stage: string;
+        service?: string;
+        dockerfile?: string;
+        image_id?: string;
+        image_name?: string;
+        first_image_name?: string;
+        desk_link?: string;
+        /** Last build log lines, when the MCP followed the build. */
+        log_tail?: string[];
+    };
+}
+export declare class StateStore {
+    readonly config: Config;
+    constructor(config: Config);
+    /** The Constructor API saved operations belong to; follows a sign-in to another host. */
+    get endpoint(): string;
+    private init;
+    load(id: string): Promise<Operation | undefined>;
+    ids(): Promise<string[]>;
+    /** Marks that a process is executing this deployment right now. */
+    beat(id: string): Promise<void>;
+    /** Epoch ms of the last beat; 0 when none. */
+    lastBeat(id: string): Promise<number>;
+    private alive;
+    save(op: Operation): Promise<void>;
+    exclusive<T>(fn: () => Promise<T>): Promise<T>;
+}
+/**
+ * Runs `fn` while holding `lock`, a file created exclusively and shared by every process.
+ * Waits up to `waitMs` for another holder, then throws `busy()`. A lock left by a process
+ * that no longer exists is removed.
+ */
+export declare function withLock<T>(lock: string, fn: () => Promise<T>, waitMs: number, busy: () => Error): Promise<T>;

package/dist/store.js

@@ -0,0 +1,150 @@
+import { mkdir, readFile, writeFile, rename, unlink, chmod, readdir, stat, link, } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { ToolError } from "./api.js";
+export class StateStore {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /** The Constructor API saved operations belong to; follows a sign-in to another host. */
+    get endpoint() {
+        return this.config.baseUrl + this.config.apiPath;
+    }
+    async init() {
+        await mkdir(this.config.stateDir, { recursive: true, mode: 0o700 });
+        await chmod(this.config.stateDir, 0o700);
+    }
+    async load(id) {
+        if (!/^[0-9a-f-]{36}$/i.test(id))
+            throw new ToolError("invalid_input", "Invalid deployment ID.");
+        try {
+            const op = JSON.parse(await readFile(join(this.config.stateDir, `${id}.json`), "utf8"));
+            for (const field of ["desks", "images", "services"])
+                op[field] = Object.assign(Object.create(null), op[field]);
+            if (op.endpoint !== this.endpoint)
+                throw new ToolError("endpoint_mismatch", "This operation belongs to a different Constructor endpoint.");
+            return op;
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return undefined;
+            throw e;
+        }
+    }
+    async ids() {
+        await this.init();
+        return (await readdir(this.config.stateDir))
+            .filter((n) => /^[0-9a-f-]{36}\.json$/i.test(n))
+            .map((n) => n.slice(0, -5));
+    }
+    /** Marks that a process is executing this deployment right now. */
+    async beat(id) {
+        await this.init();
+        await writeFile(this.alive(id), "", { mode: 0o600 });
+    }
+    /** Epoch ms of the last beat; 0 when none. */
+    async lastBeat(id) {
+        try {
+            return (await stat(this.alive(id))).mtimeMs;
+        }
+        catch {
+            return 0;
+        }
+    }
+    alive(id) {
+        if (!/^[0-9a-f-]{36}$/i.test(id))
+            throw new ToolError("invalid_input", "Invalid deployment ID.");
+        return join(this.config.stateDir, `${id}.alive`);
+    }
+    async save(op) {
+        await this.init();
+        op.updated_at = new Date().toISOString();
+        const target = join(this.config.stateDir, `${op.id}.json`), tmp = target + "." + randomUUID() + ".tmp";
+        await writeFile(tmp, JSON.stringify(op, null, 2), {
+            mode: 0o600,
+            flag: "wx",
+        });
+        await rename(tmp, target);
+    }
+    async exclusive(fn) {
+        await this.init();
+        const lock = join(this.config.stateDir, ".lock");
+        return withLock(lock, fn, 0, () => new ToolError("busy", `Another operation holds ${lock}. Retry later.`));
+    }
+}
+/**
+ * Runs `fn` while holding `lock`, a file created exclusively and shared by every process.
+ * Waits up to `waitMs` for another holder, then throws `busy()`. A lock left by a process
+ * that no longer exists is removed.
+ */
+export async function withLock(lock, fn, waitMs, busy) {
+    const token = JSON.stringify({ pid: process.pid, token: randomUUID() });
+    const deadline = Date.now() + waitMs;
+    for (;;) {
+        try {
+            await writeFile(lock, token, { flag: "wx", mode: 0o600 });
+            break;
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                throw e;
+            if (await breakStale(lock))
+                continue;
+            if (Date.now() >= deadline)
+                throw busy();
+            await new Promise((r) => setTimeout(r, 100));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        if ((await readFile(lock, "utf8")) === token)
+            await unlink(lock);
+    }
+}
+/**
+ * Removes a lock whose process is gone (a server killed or restarted mid-step). The
+ * lock is moved aside first and only deleted if it is still the dead one, so two
+ * processes breaking it at once cannot delete a lock just taken by a live one.
+ */
+async function breakStale(lock) {
+    let held;
+    try {
+        held = await readFile(lock, "utf8");
+    }
+    catch (e) {
+        return e.code === "ENOENT";
+    }
+    let pid = NaN;
+    try {
+        pid = Number(JSON.parse(held).pid);
+    }
+    catch {
+        /* Not a lock this server wrote; leave it. */
+    }
+    if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid || running(pid))
+        return false;
+    const aside = `${lock}.${randomUUID()}.stale`;
+    try {
+        await rename(lock, aside);
+    }
+    catch (e) {
+        return e.code === "ENOENT";
+    }
+    if ((await readFile(aside, "utf8")) !== held)
+        // A live process took the lock in between: put it back unless another took it since.
+        await link(aside, lock).catch(() => { });
+    await unlink(aside);
+    return true;
+}
+function running(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === "EPERM";
+    }
+}

package/dist/wait.d.ts

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import { StateStore } from "./store.js";
+import { DeploymentRuntime } from "./runtime.js";
+export declare const EXIT: {
+    readonly done: 0;
+    readonly error: 1;
+    readonly attention: 2;
+    readonly running: 3;
+    readonly nothing: 4;
+};
+export interface WaitOptions {
+    maxMs: number;
+    /** A deployment nobody advanced for this long is continued here; Infinity only watches. */
+    staleMs?: number;
+    pollMs?: number;
+}
+export interface WaitResult {
+    results: any[];
+    running: string[];
+    code: number;
+}
+/** Deployments still in progress that were touched in the last two hours. */
+export declare function active(store: StateStore): Promise<string[]>;
+export declare function waitFor(runtime: DeploymentRuntime, ids: string[], { maxMs, staleMs, pollMs }: WaitOptions): Promise<WaitResult>;
+/** One line per deployment, for an agent to read. */
+export declare function summary({ results, running }: WaitResult): string;