opencode-swarm 7.177.1 → 7.178.0

package/dist/cli/{skill-generator-gn1k4yxj.js → skill-generator-fhj13jmq.js}

@@ -33,33 +33,33 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-qgf5xexz.js";
+} from "./index-zsm8h8y1.js";
 import"./index-q7sjgr1y.js";
-import"./index-cv191ybt.js";
-import"./index-exhm2ztr.js";
+import"./index-29begjkp.js";
+import"./index-zmb8fjp5.js";
 import"./index-2s7dvzff.js";
-import"./index-yrs4wwfq.js";
-import"./index-wemtrnch.js";
+import"./index-d5dexrv1.js";
+import"./index-ffqy30e5.js";
 import"./index-rtry5xyf.js";
-import"./index-67amf4my.js";
+import"./index-2vhkwy6v.js";
 import"./index-frcemc0b.js";
 import"./index-wrt875kh.js";
-import"./index-tbswvz8s.js";
-import"./index-634pjhe4.js";
+import"./index-yeh78c1g.js";
+import"./index-2mdk6nt9.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-en0p0hqp.js";
-import"./index-tj0sdxg9.js";
+import"./index-yj1kr0ft.js";
+import"./index-j3rkh9mp.js";
 import"./index-7g4c7s5r.js";
-import"./index-2jtmevrr.js";
-import"./index-yhaxn5r7.js";
+import"./index-wfbh1bx8.js";
+import"./index-zsp9de3k.js";
 import"./index-1xnse449.js";
 import"./index-c1ggtmpm.js";
-import"./index-m0cdjvtv.js";
+import"./index-18hjycr1.js";
 import"./index-zz7gzw57.js";
 import"./index-4ddpvd5c.js";
-import"./index-e48h8m73.js";
-import"./index-n7nzwz0q.js";
+import"./index-wbkxbgk8.js";
+import"./index-m2n1rhgv.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";
 import"./index-zpsr8rpc.js";

package/dist/cli/{snapshot-coordination-init-6ztt4v99.js → snapshot-coordination-init-5fawrj35.js}

@@ -8,70 +8,70 @@ import {
   markSnapshotCoordinationClosing,
   retrySnapshotCoordinationInitialization,
   startSnapshotCoordinationInitialization
-} from "./index-yepxmq4f.js";
+} from "./index-heg4em8j.js";
 import"./index-hnvmj9wx.js";
-import"./index-vfp9hjgv.js";
-import"./index-fgv6qp10.js";
-import"./index-eefz8ghz.js";
-import"./index-1042jnb9.js";
-import"./index-4ygb35m1.js";
-import"./index-k6bjkqw8.js";
+import"./index-q9vb5e7n.js";
+import"./index-qs8eth8h.js";
+import"./index-bfz1jvcn.js";
+import"./index-vfc7d22n.js";
+import"./index-jzxeymr0.js";
+import"./index-mpcp6rmj.js";
 import"./index-txdagbh7.js";
 import"./index-n1tcj1q7.js";
-import"./index-fpbcxykc.js";
-import"./index-qgf5xexz.js";
-import"./index-k330631a.js";
-import"./index-7c24bb1r.js";
+import"./index-6b295cas.js";
+import"./index-zsm8h8y1.js";
+import"./index-at0ygwwp.js";
+import"./index-zex7644g.js";
 import"./index-fyfbpz4f.js";
-import"./index-eya03h5m.js";
+import"./index-y74n1sy8.js";
 import"./index-549wxbe1.js";
 import"./index-zsrtt42s.js";
-import"./index-822hhbkc.js";
-import"./index-5d2avnj9.js";
-import"./index-7nsvszwn.js";
+import"./index-wkde35ej.js";
+import"./index-pm7c6f66.js";
+import"./index-2b1whj28.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-fnq5ac3f.js";
-import"./index-j82xdrqp.js";
-import"./index-bqmxxbrw.js";
-import"./index-cv191ybt.js";
-import"./index-exhm2ztr.js";
+import"./index-kfk403mc.js";
+import"./index-p27az2hc.js";
+import"./index-rp0jk48x.js";
+import"./index-29begjkp.js";
+import"./index-zmb8fjp5.js";
 import"./index-2s7dvzff.js";
-import"./index-yrs4wwfq.js";
-import"./index-wemtrnch.js";
+import"./index-d5dexrv1.js";
+import"./index-ffqy30e5.js";
 import"./index-rtry5xyf.js";
-import"./index-67amf4my.js";
+import"./index-2vhkwy6v.js";
 import"./index-frcemc0b.js";
 import"./index-wrt875kh.js";
-import"./index-7ntcak58.js";
-import"./index-drgt81xf.js";
-import"./index-t2nf57mv.js";
-import"./index-v2he8xfj.js";
-import"./index-1bq6hkw5.js";
-import"./index-xnednxvm.js";
+import"./index-gg44hytk.js";
+import"./index-ke3m026z.js";
+import"./index-j1v54ahd.js";
+import"./index-y6a2bkp1.js";
+import"./index-w4yjy3vp.js";
+import"./index-tnjmn0dn.js";
 import"./index-rdm3px0g.js";
 import"./index-ry16d01s.js";
-import"./index-tbswvz8s.js";
-import"./index-634pjhe4.js";
+import"./index-yeh78c1g.js";
+import"./index-2mdk6nt9.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-en0p0hqp.js";
-import"./index-tj0sdxg9.js";
+import"./index-yj1kr0ft.js";
+import"./index-j3rkh9mp.js";
 import"./index-7g4c7s5r.js";
-import"./index-2jtmevrr.js";
-import"./index-yhaxn5r7.js";
+import"./index-wfbh1bx8.js";
+import"./index-zsp9de3k.js";
 import"./index-1xnse449.js";
 import"./index-c1ggtmpm.js";
-import"./index-m0cdjvtv.js";
+import"./index-18hjycr1.js";
 import"./index-zz7gzw57.js";
 import"./index-4ddpvd5c.js";
-import"./index-e48h8m73.js";
-import"./index-n7nzwz0q.js";
+import"./index-wbkxbgk8.js";
+import"./index-m2n1rhgv.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";
 import"./index-zpsr8rpc.js";
-import"./index-76qm2c2y.js";
-import"./index-yzjaj53h.js";
+import"./index-wvghb3x6.js";
+import"./index-9rwhas09.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/{telemetry-w774xb8g.js → telemetry-ca8dmn26.js}

@@ -14,7 +14,7 @@ import {
   startHeartbeatTracking,
   stopHeartbeatTracking,
   telemetry
-} from "./index-2jtmevrr.js";
+} from "./index-wfbh1bx8.js";
 import"./index-1xnse449.js";
 import"./index-c1ggtmpm.js";
 import"./index-gknz3bv1.js";

package/dist/cli/{workspace-snapshot-9gqna7gq.js → workspace-snapshot-v5qyjxg0.js}

@@ -45,10 +45,10 @@ import {
   shouldSkipSnapshot,
   switchPrFeedbackTrackingCandidateAsync,
   workspaceSnapshotMatches
-} from "./index-5d2avnj9.js";
-import"./index-exhm2ztr.js";
+} from "./index-pm7c6f66.js";
+import"./index-zmb8fjp5.js";
 import"./index-2s7dvzff.js";
-import"./index-yhaxn5r7.js";
+import"./index-zsp9de3k.js";
 import"./index-1xnse449.js";
 import"./index-c1ggtmpm.js";
 import"./index-zz7gzw57.js";

package/dist/cli/{worktree-collision-ownership-q2ydb0ph.js → worktree-collision-ownership-hjk0jx19.js}

@@ -9,27 +9,27 @@ import {
   WORKTREE_PROVISIONING_OWNER_LEASE_MS,
   removeWorktreeProvisioningOwner,
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-7nsvszwn.js";
+} from "./index-2b1whj28.js";
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-bqmxxbrw.js";
-import"./index-exhm2ztr.js";
+} from "./index-rp0jk48x.js";
+import"./index-zmb8fjp5.js";
 import"./index-2s7dvzff.js";
-import"./index-v2he8xfj.js";
-import"./index-1bq6hkw5.js";
-import"./index-xnednxvm.js";
+import"./index-y6a2bkp1.js";
+import"./index-w4yjy3vp.js";
+import"./index-tnjmn0dn.js";
 import"./index-rdm3px0g.js";
 import"./index-ry16d01s.js";
-import"./index-tbswvz8s.js";
-import"./index-634pjhe4.js";
+import"./index-yeh78c1g.js";
+import"./index-2mdk6nt9.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-en0p0hqp.js";
-import"./index-tj0sdxg9.js";
+import"./index-yj1kr0ft.js";
+import"./index-j3rkh9mp.js";
 import"./index-7g4c7s5r.js";
-import"./index-2jtmevrr.js";
-import"./index-yhaxn5r7.js";
+import"./index-wfbh1bx8.js";
+import"./index-zsp9de3k.js";
 import {
   canonicalRootKeyFresh
 } from "./index-1xnse449.js";

package/dist/cli/{worktree-isolation-fsqe1qdv.js → worktree-isolation-aj20bs6q.js}

@@ -21,72 +21,72 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-yepxmq4f.js";
+} from "./index-heg4em8j.js";
 import"./index-hnvmj9wx.js";
-import"./index-vfp9hjgv.js";
-import"./index-fgv6qp10.js";
-import"./index-eefz8ghz.js";
-import"./index-1042jnb9.js";
-import"./index-4ygb35m1.js";
-import"./index-k6bjkqw8.js";
+import"./index-q9vb5e7n.js";
+import"./index-qs8eth8h.js";
+import"./index-bfz1jvcn.js";
+import"./index-vfc7d22n.js";
+import"./index-jzxeymr0.js";
+import"./index-mpcp6rmj.js";
 import"./index-txdagbh7.js";
 import"./index-n1tcj1q7.js";
-import"./index-fpbcxykc.js";
-import"./index-qgf5xexz.js";
-import"./index-k330631a.js";
-import"./index-7c24bb1r.js";
+import"./index-6b295cas.js";
+import"./index-zsm8h8y1.js";
+import"./index-at0ygwwp.js";
+import"./index-zex7644g.js";
 import"./index-fyfbpz4f.js";
-import"./index-eya03h5m.js";
+import"./index-y74n1sy8.js";
 import"./index-549wxbe1.js";
 import"./index-zsrtt42s.js";
-import"./index-822hhbkc.js";
-import"./index-5d2avnj9.js";
-import"./index-7nsvszwn.js";
+import"./index-wkde35ej.js";
+import"./index-pm7c6f66.js";
+import"./index-2b1whj28.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-fnq5ac3f.js";
-import"./index-j82xdrqp.js";
-import"./index-bqmxxbrw.js";
-import"./index-cv191ybt.js";
-import"./index-exhm2ztr.js";
+import"./index-kfk403mc.js";
+import"./index-p27az2hc.js";
+import"./index-rp0jk48x.js";
+import"./index-29begjkp.js";
+import"./index-zmb8fjp5.js";
 import"./index-2s7dvzff.js";
-import"./index-yrs4wwfq.js";
-import"./index-wemtrnch.js";
+import"./index-d5dexrv1.js";
+import"./index-ffqy30e5.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-67amf4my.js";
+} from "./index-2vhkwy6v.js";
 import"./index-frcemc0b.js";
 import"./index-wrt875kh.js";
-import"./index-7ntcak58.js";
-import"./index-drgt81xf.js";
-import"./index-t2nf57mv.js";
-import"./index-v2he8xfj.js";
-import"./index-1bq6hkw5.js";
-import"./index-xnednxvm.js";
+import"./index-gg44hytk.js";
+import"./index-ke3m026z.js";
+import"./index-j1v54ahd.js";
+import"./index-y6a2bkp1.js";
+import"./index-w4yjy3vp.js";
+import"./index-tnjmn0dn.js";
 import"./index-rdm3px0g.js";
 import"./index-ry16d01s.js";
-import"./index-tbswvz8s.js";
-import"./index-634pjhe4.js";
+import"./index-yeh78c1g.js";
+import"./index-2mdk6nt9.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-en0p0hqp.js";
-import"./index-tj0sdxg9.js";
+import"./index-yj1kr0ft.js";
+import"./index-j3rkh9mp.js";
 import"./index-7g4c7s5r.js";
-import"./index-2jtmevrr.js";
-import"./index-yhaxn5r7.js";
+import"./index-wfbh1bx8.js";
+import"./index-zsp9de3k.js";
 import"./index-1xnse449.js";
 import"./index-c1ggtmpm.js";
-import"./index-m0cdjvtv.js";
+import"./index-18hjycr1.js";
 import"./index-zz7gzw57.js";
 import"./index-4ddpvd5c.js";
-import"./index-e48h8m73.js";
-import"./index-n7nzwz0q.js";
+import"./index-wbkxbgk8.js";
+import"./index-m2n1rhgv.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";
 import"./index-zpsr8rpc.js";
-import"./index-76qm2c2y.js";
-import"./index-yzjaj53h.js";
+import"./index-wvghb3x6.js";
+import"./index-9rwhas09.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/commands/dashboard.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `/swarm dashboard` — report the opt-in local mission-control dashboard's
+ * state (issue #2509, Workstream G5).
+ *
+ * Read-only. Three outcomes:
+ * - LISTENING: prints the tokened browsing URL (token from the in-process
+ *   registry only — it is never persisted).
+ * - DISABLED (port conflict / bind failure): explains why and how to fix.
+ * - OFF (default): explains the `dashboard.port` opt-in.
+ *
+ * The command never starts or stops the listener; lifecycle belongs to the
+ * post-resolution init task in `src/index.ts`.
+ */
+import type { CommandResult } from './registry';
+export declare function handleDashboardCommand(directory: string, _args: string[] | string): CommandResult;

package/dist/commands/registry.d.ts

@@ -497,6 +497,13 @@ export declare const COMMAND_REGISTRY: {
         readonly category: "diagnostics";
         readonly toolPolicy: "agent";
     };
+    readonly dashboard: {
+        readonly handler: (ctx: CommandContext) => CommandResult;
+        readonly description: "Show the opt-in local mission-control dashboard URL and status (issue #2509)";
+        readonly details: "Read-only status for the opt-in loopback dashboard over durable swarm state (gates & circuits, delegation age bands, lane liveness, task board, activity timeline). Disabled by default; enable with dashboard.port > 0 in opencode-swarm.json. Never starts or stops the listener — lifecycle belongs to plugin init; the dashboard itself performs no mutations.";
+        readonly category: "diagnostics";
+        readonly toolPolicy: "agent";
+    };
     readonly learning: {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Show learning metrics and violation trends";

package/dist/config/schema.d.ts

@@ -1977,6 +1977,19 @@ export declare const DispatchProtectionConfigSchema: z.ZodObject<{
     burst_capacity: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>;
 export type DispatchProtectionConfig = z.infer<typeof DispatchProtectionConfigSchema>;
+/**
+ * Local mission-control dashboard (issue #2509, Workstream G5). The port IS
+ * the opt-in: absent config or `port: 0` leaves the dashboard fully disabled
+ * with zero footprint (no listener, no post-resolution task, no `.swarm`
+ * artifact). When `port > 0`, a loopback-only, capability-token HTTP server
+ * starts from the post-resolution init queue and renders read-only views over
+ * the project's durable swarm state. Inline-asset architecture per ADR 0002
+ * (REIMPLEMENT — no upstream code ported).
+ */
+export declare const DashboardConfigSchema: z.ZodObject<{
+    port: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type DashboardConfig = z.infer<typeof DashboardConfigSchema>;
 /**
  * Issue #2384: deprecated transcript-row settlement for Profile A PR-review
  * base/micro discovery lanes is an explicit compatibility opt-in. Omitted
@@ -3160,6 +3173,9 @@ export declare const PluginConfigSchema: z.ZodObject<{
         deadband: z.ZodDefault<z.ZodNumber>;
         retirement_min_age_days: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
+    dashboard: z.ZodOptional<z.ZodObject<{
+        port: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
 }, z.core.$strip>;
 export type PluginConfig = z.infer<typeof PluginConfigSchema>;
 export type { AgentName, PipelineAgentName, QAAgentName, } from './constants';

package/dist/dashboard/assets.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Inline dashboard assets (issue #2509).
+ *
+ * The HTML/JS below is served verbatim from this TS string module — the
+ * inline-asset architecture credited to opencode-ensemble by ADR 0002
+ * (REIMPLEMENT decision: ideas adopted, no upstream code/strings/UI assets
+ * ported). No frontend build step, no framework dependency, no external
+ * requests: the page is a static shell that fetches the read-only JSON API
+ * on the same token-scoped origin path it was served from.
+ */
+/** Static HTML shell for the mission-control view. */
+export declare function renderDashboardHtml(): string;

package/dist/dashboard/index.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Dashboard lifecycle entry (issue #2509).
+ *
+ * `startDashboardServer` is the single production start surface, called from
+ * the post-resolution init task in `src/index.ts` (never from the awaited
+ * `server()` path — AGENTS invariant 1) and directly by tests. The handle it
+ * returns satisfies the frozen driver contract: `port`/`url`/`token` plus an
+ * idempotent `close()`.
+ *
+ * Runtime state posture:
+ * - The only durable artifact is `.swarm/dashboard-status.json` — a
+ *   one-record notice file (status/port/url-without-token/startedAt). The
+ *   capability token is NEVER persisted; the `/swarm dashboard` command reads
+ *   it from the in-process registry below.
+ * - The registry is keyed by canonical project key with FIFO eviction
+ *   (session-state boundedness, AGENTS invariant 8); one listener per project
+ *   root per process, closed on plugin dispose / process exit by
+ *   `closeDashboardServerForRoot`.
+ */
+export interface DashboardStartOptions {
+    /** TCP port; the opt-in knob itself (0/absent never reaches this module). */
+    port: number;
+    /** Bind host — always loopback; defaults to 127.0.0.1. */
+    host?: string;
+    /** Project root (any of the accepted aliases; `directory` wins). */
+    directory?: string;
+    projectRoot?: string;
+    root?: string;
+}
+export interface DashboardHandle {
+    /** Bound port; undefined when the server did not come up. */
+    readonly port: number | undefined;
+    /** Tokened browsing URL; undefined when the server did not come up. */
+    readonly url: string | undefined;
+    /** Per-boot capability token; undefined when the server did not come up. */
+    readonly token: string | undefined;
+    readonly listening: boolean;
+    readonly enabled: boolean;
+    /** Machine-readable state, e.g. 'listening' | 'disabled_port_conflict'. */
+    readonly status: string;
+    close(): Promise<void>;
+}
+/**
+ * Start the opt-in dashboard for one project root.
+ *
+ * Never throws: a bind conflict (or any listen error) resolves to a disabled
+ * handle carrying a positive notice signal (`enabled:false`, `listening:false`
+ * plus a `disabled_port_conflict` status) and the `.swarm/dashboard-status.json`
+ * notice file — the disable-with-notice contract in issue #2509 AC3/AC7.
+ */
+export declare function startDashboardServer(options: DashboardStartOptions): Promise<DashboardHandle>;
+/**
+ * Conventional module entry point: the frozen #2509 driver contract resolves
+ * the module's start surface by function name, preferring exactly
+ * `startDashboard`. Same function as `startDashboardServer` — an alias, not a
+ * second implementation.
+ */
+export declare const startDashboard: typeof startDashboardServer;
+/** Live handle for a project root (for the `/swarm dashboard` command). */
+export declare function getDashboardHandle(directory: string): DashboardHandle | null;
+/**
+ * Sync best-effort close used by the plugin dispose/exit cleanup path
+ * (cannot await there). Safe when nothing is running.
+ */
+export declare function closeDashboardServerForRoot(directory: string): void;
+/**
+ * Owner-guarded close for multi-instance hosts (review round 2, finding F-A —
+ * the PRR-011 pattern from src/background/pr-subscriptions.ts): closes the
+ * root's listener ONLY when the registered handle is the caller's own. A
+ * stale dispose from instance A (whose start was overwritten by instance B's
+ * later start on the same root) becomes a no-op instead of tearing down B's
+ * live listener. Returns true when this call performed the close.
+ */
+export declare function closeDashboardServerForRootIfOwner(directory: string, expectedHandle: DashboardHandle | null): boolean;

package/dist/dashboard/server.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Loopback HTTP server for the opt-in dashboard (issue #2509).
+ *
+ * Portability: `node:http` ONLY — the bundle must stay Node-ESM-loadable
+ * (AGENTS invariant 2); no Bun-specific server API exists anywhere in the
+ * dashboard.
+ *
+ * Security boundary (AC3/AC6/AC7):
+ * - GET/HEAD only; every other method is 405 — the server has NO
+ *   state-changing verb, which is the CSRF policy (a cross-site request
+ *   can only ever re-read what its origin checks already block).
+ * - Host allowlist (DNS-rebinding defense): the Host header hostname must be
+ *   a loopback name (127.0.0.1 / localhost / ::1); the server itself only
+ *   ever binds 127.0.0.1. House standard: src/commands/_shared/url-security.ts
+ *   (named by issue #2509) governs the outbound-URL posture this surface
+ *   composes with — `isPrivateHost` there is the loopback BLOCKLIST for
+ *   outbound links; this listener needs the INVERSE (an inbound loopback
+ *   ALLOWLIST), so the posture is reused rather than the helpers imported.
+ * - Origin allowlist: a present Origin header must parse to a loopback host.
+ * - Capability token: every route requires the per-boot token via query
+ *   (`token`/`t`/`cap`/`capability`) or path (`/{token}/…`, `/t/{token}/…`);
+ *   comparison is constant-time over SHA-256 digests. Failure is a plain 404.
+ * - Responses are fully materialized, byte-capped, `no-store`, `nosniff`.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type Server } from 'node:http';
+export interface DashboardRouteContext {
+    directory: string;
+    token: string;
+}
+type JsonBody = Record<string, unknown>;
+export interface DashboardRequestOutcome {
+    status: number;
+    body: string;
+    contentType: string;
+}
+/** Host header → loopback hostname decision (port suffix tolerated). */
+export declare function hostHeaderAllowed(hostHeader: string | undefined): boolean;
+/** Origin header (when present) → loopback origin decision. */
+export declare function originHeaderAllowed(originHeader: string | undefined): boolean;
+/** Constant-time token comparison over fixed-length digests. */
+export declare function tokenMatches(expected: string, presented: string): boolean;
+/**
+ * Extract (token, route) from a request URL. Accepts the token as a query
+ * parameter (`token|t|cap|capability`) or as the first path segment
+ * (`/{token}/route`) or under the explicit prefix (`/t/{token}/route`).
+ */
+export declare function extractTokenAndRoute(rawUrl: string): {
+    token: string;
+    route: string;
+} | null;
+/**
+ * Bring an over-budget JSON payload back under MAX_RESPONSE_BYTES while
+ * keeping it VALID JSON: drop elements from the tail of the largest array
+ * (the volume driver in every view) and re-serialize, instead of splicing the
+ * serialized text (a splice lands mid-element and yields unparseable JSON —
+ * issue #2509 review round 2, finding F-B). Terminates: every iteration
+ * removes at least one array element. Marks the payload so clients can tell.
+ */
+export declare function shrinkJsonToBudget(root: JsonBody): string;
+/**
+ * Resolve one authorized route to its response. Read-only by construction:
+ * the handlers only call the view layer.
+ */
+export declare function resolveRoute(route: string, ctx: DashboardRouteContext): Promise<DashboardRequestOutcome>;
+export interface DashboardServerOptions {
+    port: number;
+    host?: string;
+    directory: string;
+    token: string;
+}
+export interface DashboardServerHandle {
+    server: Server;
+    port: number;
+}
+/**
+ * Create the dashboard request handler. Exported for direct testing; the
+ * security middleware order is part of the frozen contract (method → host →
+ * origin → token → route).
+ */
+export declare function createDashboardRequestHandler(ctx: DashboardRouteContext): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/**
+ * Bind the dashboard listener on the loopback interface. Resolves with the
+ * bound port; rejects on bind errors (EADDRINUSE surfaces here). The server
+ * is unref'd and every connection socket is unref'd + tracked so neither the
+ * listener nor an idle browser tab can keep the host process alive.
+ */
+export declare function listenDashboardServer(options: DashboardServerOptions): Promise<DashboardServerHandle>;
+/**
+ * Close a dashboard server: stop listening, destroy tracked sockets,
+ * resolve once closed. Idempotent and never throws.
+ */
+export declare function closeDashboardServer(server: Server): Promise<void>;
+export {};