toolroll 0.5.0

package/dist/tree-proof.js

@@ -0,0 +1,58 @@
+/**
+ * The read-only roles' clean-tree proof (planner, scout — mate arc §10,
+ * v4 review finding 4). `git status --porcelain` alone is not a proof: it
+ * omits IGNORED paths, so an agent could leave a generated file behind
+ * and pass; and a pathname filter that exempts the protocol files
+ * regardless of index status would let an agent `git add` its own
+ * handoff and pass with a dirty index. So: ignored paths are snapshotted
+ * BEFORE the agent runs and any new one afterwards is foreign; and a
+ * protocol file is admitted only as plain untracked (`??`) — staged is
+ * foreign. Ignored directories are collapsed by git (`!! build/`), so a
+ * write INTO a directory that was already ignored before the agent ran
+ * (a dependency tree the setup command produced) is not detected — that
+ * residual is stated here rather than wished away.
+ */
+const GIT = "git";
+const STATUS_ARGS = ["--no-optional-locks", "-c", "core.quotePath=false", "status", "--porcelain", "--ignored"];
+/** The ignored paths git reports right now — the "before" of a proof. */
+export async function snapshotIgnored(git, cwd) {
+    const status = await git(GIT, [...STATUS_ARGS], { cwd });
+    if (status.code !== 0)
+        return null;
+    const ignored = new Set();
+    for (const line of status.stdout.split("\n")) {
+        if (line.startsWith("!! "))
+            ignored.add(line.slice(3));
+    }
+    return ignored;
+}
+/**
+ * Everything in the tree that is not (a) an ignored path that was already
+ * ignored before, (b) one of this attempt's own protocol files as PLAIN
+ * untracked, or (c) the pool's untracked lease marker.
+ */
+export async function proveTreeUntouched(git, cwd, args) {
+    const status = await git(GIT, [...STATUS_ARGS], { cwd });
+    if (status.code !== 0)
+        return { ok: false, reason: "git", foreign: [] };
+    const foreign = [];
+    for (const line of status.stdout.split("\n")) {
+        if (line.trim() === "")
+            continue;
+        const code = line.slice(0, 2);
+        const path = line.slice(3);
+        if (code === "!!") {
+            if (!args.ignoredBefore.has(path))
+                foreign.push(path);
+            continue;
+        }
+        const own = args.protocolFiles.includes(path) || path === args.marker;
+        // Untracked is the only admissible state for a protocol file: a staged
+        // one would survive cleanup in the index and ride into somebody's
+        // commit.
+        if (own && code === "??")
+            continue;
+        foreign.push(own ? `${path} (staged)` : path);
+    }
+    return foreign.length === 0 ? { ok: true } : { ok: false, reason: "dirty-tree", foreign };
+}

package/dist/verification-evidence.d.ts

@@ -0,0 +1,44 @@
+import type { Artifact, Store, VerifyCommand } from "./store.js";
+import type { VerifyCommandFacts } from "./proof.js";
+import { type AdjudicateResult } from "./proof.js";
+export declare const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
+export declare const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
+export declare const isVerificationReceipt: (a: Artifact) => boolean;
+export declare function sealVerificationReceipt(store: Store, root: string, runId: number, head: string, command: VerifyCommand, result: VerifyCommandFacts, now: Date, reusedFrom?: {
+    run: number;
+    digest: string;
+}): void;
+/** Read and bind existing evidence, never backfill historical receipts. A legacy
+ * single-attempt machine header is sufficient only with its exact approved grant
+ * and sealed candidate endpoints. Recovery logs without a receipt stay explicit. */
+export declare function verificationEvidence(store: Store, root: string, runId: number): {
+    ok: true;
+    bytes: string | null;
+    digest: string;
+} | {
+    ok: false;
+    problem: string;
+};
+/** Only a sealed failed check can start unattended diagnosis. Lost custody,
+ * changed approvals/trees and incomplete evidence still need attention; they
+ * must not become another code-writing attempt. Keep the log out of the small
+ * revision artifact and re-read it when the repair builder starts. */
+export declare function failedVerificationEvidence(store: Store, root: string, runId: number): {
+    kind: "none";
+} | {
+    kind: "unavailable";
+    problem: string;
+} | {
+    kind: "failed";
+    digest: string;
+    receipt: string;
+    log: string;
+};
+/** A fresh review may assess a pre-upgrade result which stopped solely because
+ * no builder proof was written. Read original sealed facts; never run checks,
+ * backfill receipts, rewrite artifacts, or reuse a different candidate's gate.
+ * Called inside review ingestion, after its exact bindings have been proved. */
+export declare function assessmentFromSavedEvidence(store: Store, root: string, runId: number): AdjudicateResult | null;
+/** Reuse is exclusive to a machine-authored observation revision, with its
+ * own current approval and complete new observations. Never synthesize a pass. */
+export declare function reuseObservationVerification(store: Store, root: string, runId: number, now: Date): VerifyCommandFacts | null;

package/dist/verification-evidence.js

@@ -0,0 +1,238 @@
+// Verified-build assignment completion reuses these gate checks.
+import { observationBrief, readObservationEvidence } from "./observations.js";
+/** Machine verification receipts use the existing sealed artifact store (schema
+ * 60). Verbose output is independently bounded; no agent-authored check claim
+ * can create or replace this receipt. */
+import { createHash } from "node:crypto";
+import { adjudicate } from "./proof.js";
+import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
+import { readVerifiedArtifact, storeEvidence, scanForSecrets, redactSecretLines } from "./evidence.js";
+export const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
+export const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
+const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const binding = (a) => ({ artifactId: a.id, sha256: a.sha256, bytesStored: a.bytesStored, bytesOriginal: a.bytesOriginal, truncated: a.truncated, redacted: a.redacted, captureStatus: a.captureStatus });
+export const isVerificationReceipt = (a) => a.kind === "structured-output" && (a.capture === VERIFICATION_RECEIPT_CAPTURE || a.capture === "machine verification reuse v1");
+export function sealVerificationReceipt(store, root, runId, head, command, result, now, reusedFrom) {
+    const source = store.getRun(runId);
+    const log = store.artifactsFor(runId).find(a => a.kind === "check-log");
+    if (!log)
+        throw new Error("Verification receipt requires its retained log");
+    const raw = JSON.stringify({
+        version: reusedFrom === undefined ? 1 : 2, run: runId, head, base: source.baseRevision, scopeDigest: source.scopeDigest,
+        ...(reusedFrom === undefined ? {} : { reusedFrom, executedHere: false }),
+        command, result, log: binding(log),
+    }, null, 1);
+    const hits = scanForSecrets(raw);
+    storeEvidence(store, root, runId, "structured-output", "verification-receipt.json", Buffer.from(hits.length ? redactSecretLines(raw, hits) : raw), reusedFrom === undefined ? VERIFICATION_RECEIPT_CAPTURE : "machine verification reuse v1", now, { captureStatus: "ok", redacted: hits.length > 0 });
+}
+/** Read and bind existing evidence, never backfill historical receipts. A legacy
+ * single-attempt machine header is sufficient only with its exact approved grant
+ * and sealed candidate endpoints. Recovery logs without a receipt stay explicit. */
+// Recovery reads this existing receipt binding, then requires an actually executed
+// v1 passing gate. This reader does not rerun checks or transfer a prior approval.
+export function verificationEvidence(store, root, runId) {
+    const fail = (problem) => ({ ok: false, problem });
+    const source = store.getRun(runId);
+    if (!source)
+        return fail("The verification source run is missing.");
+    const repo = store.refById(source.taskRef)?.repo;
+    const command = repo ? store.liveVerifyCommand(repo) : null;
+    const artifacts = store.artifactsFor(runId);
+    const receipts = artifacts.filter(isVerificationReceipt);
+    const machine = store.proofVerdictFor(runId);
+    const verified = (machine?.machineVerdict ?? machine?.verdict) === "verified";
+    if (!command && !receipts.length && !verified)
+        return { ok: true, bytes: null, digest: hash(null) };
+    if (!command || command.approvedAt > source.startedAt)
+        return fail("The original approved verification command is missing or changed.");
+    if (receipts.length > 1)
+        return fail("The verification receipt is ambiguous.");
+    const logs = artifacts.filter(a => a.kind === "check-log");
+    if (logs.length !== 1 || logs[0].captureStatus === "failed")
+        return fail("One readable machine verification log is required.");
+    const log = logs[0];
+    const read = readVerifiedArtifact(root, log);
+    if (!read.ok)
+        return fail("The retained verification log no longer verifies.");
+    let receipt;
+    if (receipts.length) {
+        const artifact = receipts[0];
+        if (artifact.truncated || artifact.redacted || artifact.captureStatus === "failed")
+            return fail("The verification receipt is incomplete.");
+        const sealed = readVerifiedArtifact(root, artifact);
+        if (!sealed.ok)
+            return fail("The verification receipt no longer verifies.");
+        try {
+            receipt = JSON.parse(sealed.content.toString("utf8"));
+        }
+        catch {
+            return fail("The verification receipt cannot be read.");
+        }
+        if ((receipt?.version !== 1 && receipt?.version !== 2) || receipt.run !== runId || receipt.head !== source.headRevision || receipt.base !== source.baseRevision || receipt.scopeDigest !== source.scopeDigest || JSON.stringify(receipt.command) !== JSON.stringify(command) || JSON.stringify(receipt.log) !== JSON.stringify(binding(log)))
+            return fail("The candidate, approved command or retained log changed since verification.");
+        if (receipt.version === 2) {
+            try {
+                const brief = observationBrief(store, root, source.taskRef);
+                const reused = receipt.reusedFrom;
+                if (!brief || !readObservationEvidence(store, root, runId) || !reused || reused.run !== brief.sourceRun || reused.run >= runId || reused.digest !== brief.gateDigest ||
+                    source.baseRevision !== brief.head || source.headRevision !== brief.head || receipt.executedHere !== false)
+                    return fail("The reused gate is not bound to an unchanged observation follow-up.");
+                const original = verificationEvidence(store, root, reused.run);
+                if (!original.ok || !original.bytes || original.digest !== reused.digest)
+                    return fail("The original passing gate no longer verifies.");
+                const previous = JSON.parse(original.bytes);
+                const originalLog = store.getArtifact(previous.log.artifactId);
+                if (previous.head !== source.headRevision || previous.result.exitCode !== 0 || JSON.stringify(previous.command) !== JSON.stringify(command) ||
+                    JSON.stringify(previous.result) !== JSON.stringify(receipt.result) || originalLog?.sha256 !== log.sha256 ||
+                    originalLog.bytesOriginal !== log.bytesOriginal || originalLog.redacted !== log.redacted || originalLog.truncated !== log.truncated)
+                    return fail("The reused gate's candidate, command, result or copied log changed.");
+            }
+            catch {
+                return fail("The reused gate or its observations no longer verify.");
+            }
+        }
+        else if (receipt.reusedFrom !== undefined)
+            return fail("The gate reuse receipt has an unsupported version.");
+        const result = receipt.result;
+        if (result?.configured !== true || typeof result.ran !== "boolean" || (result.ran ? !Number.isInteger(result.exitCode) || result.exitCode < 0 || result.exitCode > 255 : result.attemptFailed !== true))
+            return fail("The machine verification result is malformed.");
+        if (verified && (!result.ran || result.exitCode !== 0))
+            return fail("The passing machine verdict disagrees with its verification receipt.");
+    }
+    else {
+        const stat = artifacts.filter(a => a.kind === "diff-stat");
+        if (stat.length !== 1 || stat[0].truncated || stat[0].captureStatus === "failed")
+            return fail("Legacy verification has no exact candidate inventory.");
+        const readStat = readVerifiedArtifact(root, stat[0]);
+        if (!readStat.ok)
+            return fail("Legacy candidate inventory no longer verifies.");
+        let endpoints;
+        try {
+            endpoints = JSON.parse(readStat.content.toString("utf8"));
+        }
+        catch {
+            return fail("Legacy candidate inventory is unreadable.");
+        }
+        if (!source.headRevision || endpoints.head !== source.headRevision || endpoints.base !== source.baseRevision || endpoints.filesTruncated !== false)
+            return fail("Legacy verification candidate endpoints do not match.");
+        const text = read.content.toString("utf8");
+        const header = /^=== Attempt summary ===\n- Project check · attempt 1: \(exit (\d+)\)\n\n=== Project check · attempt 1 ===\n/.exec(text);
+        const exitCode = header ? Number(header[1]) : -1;
+        if (!header || exitCode > 255 || !text.startsWith(`${header[0]}$ ${command.command}\n(exit ${exitCode})\n\n--- stdout ---\n`))
+            return fail("The original log lacks an unambiguous machine gate receipt; historical output was not reconstructed.");
+        if (verified && exitCode !== 0)
+            return fail("The passing machine verdict disagrees with the original failed check.");
+        receipt = { version: 1, source: "legacy machine log header", run: runId, head: source.headRevision, base: source.baseRevision, scopeDigest: source.scopeDigest, command, result: { configured: true, ran: true, exitCode }, log: binding(log), candidate: binding(stat[0]) };
+    }
+    // The view preserves shortened/redacted status and does not claim the omitted
+    // output exists. Its fingerprint is re-proved before every turn and ingestion.
+    const bytes = JSON.stringify(receipt);
+    return { ok: true, bytes, digest: hash({ receipt, receipts }) };
+}
+/** Only a sealed failed check can start unattended diagnosis. Lost custody,
+ * changed approvals/trees and incomplete evidence still need attention; they
+ * must not become another code-writing attempt. Keep the log out of the small
+ * revision artifact and re-read it when the repair builder starts. */
+export function failedVerificationEvidence(store, root, runId) {
+    if (!store.artifactsFor(runId).some(isVerificationReceipt))
+        return { kind: "none" };
+    const verified = verificationEvidence(store, root, runId);
+    if (!verified.ok)
+        return { kind: "unavailable", problem: verified.problem };
+    if (verified.bytes === null)
+        return { kind: "none" };
+    const receipt = JSON.parse(verified.bytes);
+    const result = receipt.result;
+    if (!result.configured || (result.ran ? result.exitCode === 0 :
+        result.failure !== "timed-out" && result.failure !== "retry-timed-out"))
+        return { kind: "none" };
+    const artifact = store.getArtifact(receipt.log.artifactId);
+    if (!artifact || artifact.truncated || artifact.redacted || artifact.captureStatus !== "ok") {
+        return { kind: "unavailable", problem: "Automatic repair needs the complete, unredacted failed-check log." };
+    }
+    const read = readVerifiedArtifact(root, artifact);
+    if (!read.ok)
+        return { kind: "unavailable", problem: "The failed-check log no longer verifies." };
+    return { kind: "failed", digest: verified.digest, receipt: verified.bytes, log: read.content.toString("utf8") };
+}
+/** A fresh review may assess a pre-upgrade result which stopped solely because
+ * no builder proof was written. Read original sealed facts; never run checks,
+ * backfill receipts, rewrite artifacts, or reuse a different candidate's gate.
+ * Called inside review ingestion, after its exact bindings have been proved. */
+export function assessmentFromSavedEvidence(store, root, runId) {
+    const previous = store.proofVerdictFor(runId);
+    if (previous?.verdict !== "short" || previous.reasons.length !== 1 || previous.reasons[0] !== "no proof was written" ||
+        previous.matrix.some(row => row.review !== null || row.assessment !== undefined))
+        return null;
+    const source = store.getRun(runId);
+    if (!source?.headRevision || !source.baseRevision)
+        return null;
+    const task = store.externalIdFor(source.taskRef);
+    const scope = task === null ? null : store.getScope(task);
+    if (!scope || scope.digest !== source.scopeDigest || scope.acceptance.length === 0)
+        return null;
+    const artifacts = store.artifactsFor(runId);
+    if (artifacts.some(one => one.kind === "proof"))
+        return null;
+    const readOne = (kind) => {
+        const found = artifacts.filter(one => one.kind === kind);
+        if (found.length !== 1 || found[0].truncated || found[0].redacted || found[0].captureStatus === "failed")
+            return null;
+        const read = readVerifiedArtifact(root, found[0]);
+        return read.ok ? read.content.toString("utf8") : null;
+    };
+    const diff = readOne("terminal-diff"), stat = readOne("diff-stat"), handoff = readOne("handoff"), context = readOne("review-context");
+    if (diff === null || stat === null || handoff === null || context === null)
+        return null;
+    const parsedContext = parseReviewContext(context);
+    if (!parsedContext.ok || parsedContext.inventory.run !== runId || reviewContextCustodyProblem(store, root, parsedContext.inventory) !== null)
+        return null;
+    const gate = verificationEvidence(store, root, runId);
+    if (!gate.ok || gate.bytes === null)
+        return null;
+    try {
+        const inventory = JSON.parse(stat), receipt = JSON.parse(gate.bytes);
+        const base = source.branch ? store.firstBuilderBase(source.taskRef, source.branch) ?? source.baseRevision : source.baseRevision;
+        if (inventory.schema !== 1 || inventory.head !== source.headRevision || inventory.base !== base || inventory.filesTruncated !== false ||
+            !Array.isArray(inventory.files) || inventory.fileCount !== inventory.files.length || !inventory.files.every((one) => typeof one?.path === "string") ||
+            new Set(inventory.files.map((one) => one.path)).size !== inventory.files.length)
+            return null;
+        return adjudicate({ directAssessment: true, proofArtifactPresent: false, proofParse: null,
+            handoffPresent: true, terminalDiffPresent: true, terminalDiffCaptureStatus: "ok",
+            diffStat: { captured: true, truncated: false, paths: new Set(inventory.files.map((one) => one.path)) },
+            verifyCommand: receipt.result, verificationCommand: receipt.command.command, screenshots: [],
+            approvedCriteria: scope.acceptance, reviewContext: parsedContext.inventory.coverage });
+    }
+    catch {
+        return null;
+    }
+}
+/** Reuse is exclusive to a machine-authored observation revision, with its
+ * own current approval and complete new observations. Never synthesize a pass. */
+export function reuseObservationVerification(store, root, runId, now) {
+    const run = store.getRun(runId);
+    if (!run)
+        throw Error("The observation run is missing.");
+    const brief = observationBrief(store, root, run.taskRef);
+    if (!brief)
+        return null;
+    const scope = store.getScope(store.externalIdFor(run.taskRef));
+    if (!scope || scope.digest !== run.scopeDigest || scope.approvedDigest !== scope.digest || run.baseRevision !== brief.head || run.headRevision !== brief.head ||
+        !readObservationEvidence(store, root, runId))
+        throw Error("Only complete observations for the unchanged approved candidate can reuse its gate.");
+    const original = verificationEvidence(store, root, brief.sourceRun);
+    if (!original.ok || !original.bytes || original.digest !== brief.gateDigest)
+        throw Error("The original passing gate is unavailable or changed.");
+    const receipt = JSON.parse(original.bytes), log = store.getArtifact(receipt.log.artifactId);
+    if (!log || receipt.head !== brief.head || receipt.result?.ran !== true || receipt.result.exitCode !== 0)
+        throw Error("The source gate did not pass this candidate.");
+    const read = readVerifiedArtifact(root, log);
+    if (!read.ok)
+        throw Error("The original check log no longer verifies.");
+    if (store.artifactsFor(runId).some(a => a.kind === "check-log" || isVerificationReceipt(a)))
+        throw Error("This attempt already has a gate; it cannot be replaced.");
+    storeEvidence(store, root, runId, "check-log", "check-log.txt", read.content, `Reused unchanged passing checks from run #${brief.sourceRun}; no full command executed in this attempt`, now, { captureStatus: "ok", redacted: log.redacted, sourceBytesOriginal: log.bytesOriginal });
+    sealVerificationReceipt(store, root, runId, brief.head, receipt.command, receipt.result, now, { run: brief.sourceRun, digest: brief.gateDigest });
+    store.addRunNote(runId, "Toolroll", `Reused the passing project checks from run #${brief.sourceRun} for the unchanged candidate. This attempt collected only the missing focused observations.`, now);
+    return receipt.result;
+}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+/** The package's own version, read from package.json beside dist/ or src/ — one source, never a literal. */
+export declare const PACKAGE_VERSION: string;

package/dist/version.js

@@ -0,0 +1,10 @@
+import { readFileSync } from "node:fs";
+/** The package's own version, read from package.json beside dist/ or src/ — one source, never a literal. */
+export const PACKAGE_VERSION = (() => {
+    try {
+        return String(JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ?? "0.0.0");
+    }
+    catch {
+        return "0.0.0";
+    }
+})();

package/dist/webhooks.d.ts

@@ -0,0 +1,91 @@
+import type { Notification, Store } from "./store.js";
+export declare const SLACK_ENV = "TOOLROLL_SLACK_WEBHOOK";
+export declare const DISCORD_ENV = "TOOLROLL_DISCORD_WEBHOOK";
+export declare const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
+export declare const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
+export type WebhookKind = "slack" | "discord";
+export type WebhookTarget = {
+    kind: WebhookKind;
+    url: string;
+};
+export type MessagingChannel = "telegram" | "slack" | "discord" | "teams";
+export declare const MESSAGING_CHANNELS: readonly MessagingChannel[];
+export declare function isMessagingChannel(value: string): value is MessagingChannel;
+export declare function saveWebhook(dir: string, kind: WebhookKind, url: string): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function clearWebhook(dir: string, kind: WebhookKind): void;
+export declare function saveConsoleUrl(dir: string, url: string): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+/** Every configured mirror. Environment wins over files, like the bot token. */
+export declare function loadWebhookTargets(env: Record<string, string | undefined>, dir: string): WebhookTarget[];
+/** The operator's explicit choice of which service carries the pages. */
+export declare function savePrimary(dir: string, channel: MessagingChannel): void;
+export declare function loadPrimary(env: Record<string, string | undefined>, dir: string): MessagingChannel | null;
+/**
+ * Which service actually carries the pages, and whether that was chosen or
+ * merely fell out of what happens to be configured. Explicit choice wins
+ * WHEN its channel is actually configured (a primary pointing at nothing
+ * falls through rather than silencing every page); otherwise Telegram if
+ * present (it can hold buttons), else the mirrors. `implicit` is the flag
+ * every status surface uses to say "you have several — pick one".
+ */
+export declare function effectivePrimary(env: Record<string, string | undefined>, dir: string, telegramConfigured: boolean): {
+    channel: MessagingChannel | null;
+    implicit: boolean;
+    configured: MessagingChannel[];
+};
+export declare function loadConsoleUrl(env: Record<string, string | undefined>, dir: string): string | null;
+/**
+ * The origin a phone link may open, or null. The SAME console-url setting
+ * the mirrors use — read again on every call, never cached, so a changed or
+ * removed setting stops the next link — held to a stricter shape than a
+ * mirror link: exactly an https origin (no credentials, path, query,
+ * fragment), not loopback, and, when the console this process co-hosts
+ * states its own `--public-url`, exactly that origin. A model, a Host
+ * header or a proposal field never supplies it, and nothing here probes
+ * the address: a valid shape is a place to send a person, not a promise
+ * that it answers.
+ */
+export declare function phoneOrigin(env: Record<string, string | undefined>, dir: string, options?: {
+    serverOrigin?: string | null;
+}): string | null;
+/** Where in the console this notification wants a person. */
+export declare function linkFor(consoleUrl: string | null, notification: Notification): string | null;
+/**
+ * One notification, one platform. The payloads are the simplest thing each
+ * platform documents; the console link is the call to action, because the
+ * message is a mirror and the UI is the instrument.
+ */
+export declare function postWebhook(target: WebhookTarget, notification: Notification, link: string | null, fetcher?: typeof fetch): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+export type WebhookReport = {
+    sent: number;
+    problems: string[];
+};
+/**
+ * Deliver every pending notification to every configured mirror, through
+ * the SAME claim/finalize discipline as every other deliverer — so a
+ * webhook pass and a Telegram bridge can never both own one row. This
+ * pass runs when Telegram is NOT configured; with a paired Telegram chat,
+ * Telegram remains the delivery channel (it can carry buttons) and these
+ * mirrors stay silent rather than double-paging every phone.
+ */
+export declare function webhookPass(store: Store, options: {
+    targets: WebhookTarget[];
+    consoleUrl: string | null;
+    owner?: string;
+    clock?: () => Date;
+    fetcher?: typeof fetch;
+}): Promise<WebhookReport>;