toolroll 0.5.0

package/dist/exhaustion.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The terminal exhaustion taxonomy (fallback chains, R1/C5/C8 of the
+ * approved design). A finished attempt is classified into ONE of these,
+ * where the evidence still exists — the provider adapter's structural
+ * record plus the gateway's authoritative CLI version and auth mode —
+ * NEVER in disposal, by which time the structural signal is gone.
+ *
+ * The whole feature is FAIL CLOSED by construction: a recognizer's
+ * eligible-signal set is EMPTY until a versioned fixture, captured from a
+ * GENUINELY EXHAUSTED subscription, proves the exact bytes. A build with
+ * no fixture for a (provider, version) can therefore NEVER return an
+ * eligible class — so it can never authorize a paid fallback. A
+ * successful run cannot establish the exhausted shape; only real
+ * exhaustion can, and the plane cannot manufacture it.
+ *
+ * Precedence (C5), applied by the classifier:
+ * - A present STRUCTURAL FAILURE terminal blocks success ingestion even
+ *   on exit 0 (that is the parser's job; this module reads the record).
+ * - Only an ALLOWLISTED, version+auth-specific pattern yields an ELIGIBLE
+ *   class. Exit code, bare rate-limit prose, timeout, notFound, stderr,
+ *   and zero tokens NEVER independently establish exhaustion.
+ * - Everything unmatched is `unknown` — the ordinary failure road.
+ */
+import type { ProviderId } from "./provider.js";
+export type TerminalClass = 
+/** The subscription/plan usage cap is spent — FALLBACK-ELIGIBLE. */
+"usage-exhausted"
+/** An API-key account's paid credits/quota are gone — FALLBACK-ELIGIBLE. */
+ | "credits-depleted"
+/** Temporary throttling NOT tied to the usage cap — backoff, NEVER paid fallback. */
+ | "transient-throttle"
+/** A definite non-exhaustion terminal (ordinary failure). */
+ | "not-exhausted"
+/** No structural signal matched — the ordinary failure/strike road. */
+ | "unknown";
+/** The two classes that may authorize a fallback advance. */
+export declare const FALLBACK_ELIGIBLE: ReadonlySet<TerminalClass>;
+export declare function isFallbackEligible(cls: TerminalClass): boolean;
+/**
+ * The structural terminal a provider's parser retained — the honest input
+ * to classification. `failed` marks a structural FAILURE terminal (codex
+ * turn.failed, a gemini error terminal): its presence blocks success
+ * ingestion regardless of exit code. `text` is the bounded terminal
+ * message; `code` its machine code if the harness typed one.
+ */
+export type StructuralTerminal = {
+    failed: boolean;
+    text: string | null;
+    code: string | null;
+};
+/** Whether THIS build carries a fixture-backed recognizer for a
+ * (provider, version). The C8 gate consults this at every authority
+ * point — not only at classification — so a downgrade to an unfixtured
+ * build severs any in-flight fallback authority. */
+export declare function hasRecognizer(provider: ProviderId, version: string | null): boolean;
+/**
+ * The EXACT C8 capability check (Codex E2/E3 review, finding 8): whether
+ * this build can recognize the specific eligible class an AUTH MODE would
+ * produce — a subscription's `usage-exhausted` needs a nonempty
+ * eligibleUsage set; an api-key account's `credits-depleted` needs a
+ * nonempty eligibleCredits set. `hasRecognizer` (any-eligible) is too coarse
+ * at the authority point: a version fixtured for usage only must NOT
+ * authorize a credits-depleted advance.
+ */
+export declare function recognizesEligible(provider: ProviderId, version: string | null, authMode: "subscription" | "api-key"): boolean;
+/** The eligible class an auth mode can legitimately carry — the C8
+ * consistency invariant: `usage-exhausted` iff subscription,
+ * `credits-depleted` iff api-key. A stamp that violates this pairing is a
+ * bad/overwritten record and must never advance. */
+export declare function classMatchesAuthMode(cls: TerminalClass, authMode: "subscription" | "api-key"): boolean;
+/**
+ * Classify a finished attempt. Fail closed: no recognizer for this exact
+ * (provider, version) => never an eligible class. `authMode` decides which
+ * eligible class a match yields — a subscription that hits its cap is
+ * `usage-exhausted`; an api-key account out of credits is
+ * `credits-depleted`. A structural failure with no eligible/transient
+ * match is `not-exhausted`; no structural failure and no match is
+ * `unknown`.
+ */
+export declare function classifyTerminal(args: {
+    provider: ProviderId;
+    version: string | null;
+    authMode: "subscription" | "api-key";
+    terminal: StructuralTerminal | null;
+}): TerminalClass;

package/dist/exhaustion.js

@@ -0,0 +1,141 @@
+/**
+ * The terminal exhaustion taxonomy (fallback chains, R1/C5/C8 of the
+ * approved design). A finished attempt is classified into ONE of these,
+ * where the evidence still exists — the provider adapter's structural
+ * record plus the gateway's authoritative CLI version and auth mode —
+ * NEVER in disposal, by which time the structural signal is gone.
+ *
+ * The whole feature is FAIL CLOSED by construction: a recognizer's
+ * eligible-signal set is EMPTY until a versioned fixture, captured from a
+ * GENUINELY EXHAUSTED subscription, proves the exact bytes. A build with
+ * no fixture for a (provider, version) can therefore NEVER return an
+ * eligible class — so it can never authorize a paid fallback. A
+ * successful run cannot establish the exhausted shape; only real
+ * exhaustion can, and the plane cannot manufacture it.
+ *
+ * Precedence (C5), applied by the classifier:
+ * - A present STRUCTURAL FAILURE terminal blocks success ingestion even
+ *   on exit 0 (that is the parser's job; this module reads the record).
+ * - Only an ALLOWLISTED, version+auth-specific pattern yields an ELIGIBLE
+ *   class. Exit code, bare rate-limit prose, timeout, notFound, stderr,
+ *   and zero tokens NEVER independently establish exhaustion.
+ * - Everything unmatched is `unknown` — the ordinary failure road.
+ */
+/** The two classes that may authorize a fallback advance. */
+export const FALLBACK_ELIGIBLE = new Set([
+    "usage-exhausted",
+    "credits-depleted",
+]);
+export function isFallbackEligible(cls) {
+    return FALLBACK_ELIGIBLE.has(cls);
+}
+/**
+ * The registry. EVERY entry ships empty (fail closed). A real fixture,
+ * once captured from a genuinely exhausted subscription and reviewed,
+ * adds the exact patterns under that provider+version — and ONLY then can
+ * that (provider, version) ever return an eligible class.
+ *
+ * The outer key is the provider; the inner key is the exact CLI version
+ * string the gateway proved at spawn (never a range — a version this
+ * build has no fixture for is unrecognized, so fail closed).
+ */
+const RECOGNIZERS = {
+    claude: {},
+    codex: {},
+    openrouter: {},
+    gemini: {},
+};
+/**
+ * The recognizer lookup. Reads ONLY the module-level RECOGNIZERS registry —
+ * there is NO mutation surface, so no build (production or otherwise) can
+ * install a recognizer at runtime; a real fixture arrives as a source edit,
+ * reviewed in a text diff (Codex E2/E3 review, finding 1). The suite proves
+ * the eligible path by MOCKING this module, never by a shipped seam.
+ * Object.hasOwn keeps the lookup TOTAL for adversarial version strings
+ * (foundation review, finding 3): "__proto__" / "constructor" / "toString"
+ * resolve to "no recognizer", never an inherited property.
+ */
+function recognizersFromRegistry(provider, version) {
+    if (!Object.hasOwn(RECOGNIZERS[provider], version))
+        return undefined;
+    return RECOGNIZERS[provider][version];
+}
+/** Whether THIS build carries a fixture-backed recognizer for a
+ * (provider, version). The C8 gate consults this at every authority
+ * point — not only at classification — so a downgrade to an unfixtured
+ * build severs any in-flight fallback authority. */
+export function hasRecognizer(provider, version) {
+    if (version === null)
+        return false;
+    const perVersion = recognizersFromRegistry(provider, version);
+    if (perVersion === undefined)
+        return false;
+    return perVersion.eligibleUsage.length > 0 || perVersion.eligibleCredits.length > 0;
+}
+/**
+ * The EXACT C8 capability check (Codex E2/E3 review, finding 8): whether
+ * this build can recognize the specific eligible class an AUTH MODE would
+ * produce — a subscription's `usage-exhausted` needs a nonempty
+ * eligibleUsage set; an api-key account's `credits-depleted` needs a
+ * nonempty eligibleCredits set. `hasRecognizer` (any-eligible) is too coarse
+ * at the authority point: a version fixtured for usage only must NOT
+ * authorize a credits-depleted advance.
+ */
+export function recognizesEligible(provider, version, authMode) {
+    if (version === null)
+        return false;
+    const perVersion = recognizersFromRegistry(provider, version);
+    if (perVersion === undefined)
+        return false;
+    return authMode === "subscription" ? perVersion.eligibleUsage.length > 0 : perVersion.eligibleCredits.length > 0;
+}
+/** The eligible class an auth mode can legitimately carry — the C8
+ * consistency invariant: `usage-exhausted` iff subscription,
+ * `credits-depleted` iff api-key. A stamp that violates this pairing is a
+ * bad/overwritten record and must never advance. */
+export function classMatchesAuthMode(cls, authMode) {
+    if (cls === "usage-exhausted")
+        return authMode === "subscription";
+    if (cls === "credits-depleted")
+        return authMode === "api-key";
+    return false;
+}
+/**
+ * Classify a finished attempt. Fail closed: no recognizer for this exact
+ * (provider, version) => never an eligible class. `authMode` decides which
+ * eligible class a match yields — a subscription that hits its cap is
+ * `usage-exhausted`; an api-key account out of credits is
+ * `credits-depleted`. A structural failure with no eligible/transient
+ * match is `not-exhausted`; no structural failure and no match is
+ * `unknown`.
+ */
+export function classifyTerminal(args) {
+    const { provider, version, authMode, terminal } = args;
+    if (terminal === null)
+        return "unknown";
+    // The classifier's contract permits failed:false, but a non-failure
+    // terminal is never exhaustion (Codex foundation review, finding 4):
+    // only a structural FAILURE terminal is even eligible for matching.
+    if (terminal.failed !== true)
+        return "unknown";
+    const perVersion = version === null ? undefined : recognizersFromRegistry(provider, version);
+    const haystack = `${terminal.code ?? ""}\n${terminal.text ?? ""}`;
+    if (perVersion !== undefined) {
+        // Transient throttle is checked FIRST so a throttle can never be read
+        // as exhaustion (Claude's "temporarily limiting requests — not your
+        // usage limit" family).
+        if (perVersion.transient.some(re => re.test(haystack)))
+            return "transient-throttle";
+        // Then the eligible sets, gated by auth mode.
+        if (authMode === "subscription" && perVersion.eligibleUsage.some(re => re.test(haystack))) {
+            return "usage-exhausted";
+        }
+        if (authMode === "api-key" && perVersion.eligibleCredits.some(re => re.test(haystack))) {
+            return "credits-depleted";
+        }
+    }
+    // A structural FAILURE terminal that matched nothing is a definite
+    // non-exhaustion terminal (a non-failure terminal already returned
+    // unknown above).
+    return "not-exhausted";
+}

package/dist/export-ui.d.ts

@@ -0,0 +1,4 @@
+export declare const EXPORT_CSS: string;
+export declare function dataExportHtml(csrf: string, notice: {
+    problem?: string | null;
+}): string;

package/dist/export-ui.js

@@ -0,0 +1,17 @@
+/**
+ * Settings → Data (v105): an instance operator downloads everything Standing
+ * Orders knows as one .zip. One form: the password, typed again, and a button.
+ */
+const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+export const EXPORT_CSS = `.data-export{max-width:720px;min-width:0}.data-export label{display:grid;gap:4px;margin:14px 0 0;font-size:.875rem}` +
+    `.data-export input[type=password]{width:100%;max-width:360px;box-sizing:border-box}.data-export button[type=submit]{margin-top:14px;min-height:44px;white-space:nowrap}`;
+export function dataExportHtml(csrf, notice) {
+    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : "";
+    return `<section class="data-export">${note}` +
+        `<p>Everything Toolroll knows, as one .zip: projects, tasks, runs and cost, the action ledger, evidence packs, chats, flows, teammates and settings. ` +
+        `Passwords, keys and tokens are never included.</p>` +
+        `<form method="post" action="/settings/data"><input type="hidden" name="csrf" value="${e(csrf)}">` +
+        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
+        `<button type="submit">Download export</button></form>` +
+        `<p class="meta">The same export from the command line: <code>toolroll export --out &lt;path&gt; [--zip]</code></p></section>`;
+}

package/dist/export.d.ts

@@ -0,0 +1,48 @@
+import type { Store } from "./store.js";
+export declare const EXPORT_FORMAT = "standing-orders/export/v1";
+export type ExportFile = {
+    path: string;
+    data: Buffer;
+};
+export type ManifestEntry = {
+    path: string;
+    sha256: string;
+    bytes: number;
+    rows?: number;
+};
+export type ExportManifest = {
+    format: typeof EXPORT_FORMAT;
+    generatedAt: string;
+    generatedBy: string;
+    schemaVersion: number;
+    files: ManifestEntry[];
+    /** What was left out on purpose, so a reader knows it wasn't lost. */
+    excluded: {
+        tables: string[];
+        columns: string[];
+    };
+};
+export type FullExport = {
+    root: string;
+    files: ExportFile[];
+    manifest: ExportManifest;
+    tables: number;
+    packs: number;
+};
+/** Where a table's file goes: by what it's about. Anything new lands in "other", never nowhere. */
+export declare function categoryOf(table: string): string;
+/** Every key- or token-shaped run in `text` replaced by "[redacted]". */
+export declare function redactKeyShapes(text: string): string;
+/** The whole export, in memory: the files, the manifest and README among them. */
+export declare function buildExport(store: Store, options: {
+    who: string;
+    now: Date;
+    evidenceRoot: string;
+    configDir: string | null;
+}): FullExport;
+/** Write the export as a new folder at `out` (its parent must exist; it must not). Files are readable by their owner only. */
+export declare function writeExportFolder(out: string, exported: FullExport): void;
+/** The same files as one .zip (deflated, inside a folder named for the export). */
+export declare function exportZip(exported: FullExport): Buffer;
+/** One line for the ledger and the person who asked. */
+export declare function exportSummary(exported: FullExport): string;

package/dist/export.js

@@ -0,0 +1,305 @@
+/**
+ * Full export (v105): everything Toolroll knows, for an instance
+ * operator to take away — every table of the database as JSON Lines, grouped
+ * by what it's about (projects, tasks, runs, the ledger, chats, flows,
+ * teammates, people, settings), an evidence pack per task, the settings kept
+ * in files beside the database, a README explaining the layout, and a
+ * manifest with each file's SHA-256. One folder, or the same files in a .zip.
+ *
+ * Secrets never leave: tables that are nothing but secrets (sessions,
+ * pairing codes, nonces) are skipped, columns that hold one (password and
+ * token hashes, button tokens, push keys, webhook secrets) are dropped, a
+ * column whose name looks like a secret and that nobody has reviewed is
+ * dropped too, and any value shaped like a key or token is replaced by
+ * "[redacted]". Provider keys and file-kept secrets are never read.
+ *
+ * Not included: artifact bodies (logs, diffs, screenshots), which stay in
+ * the evidence folder; their records (size, SHA-256) are in runs/artifact.
+ */
+import { createHash } from "node:crypto";
+import { closeSync, constants, fsyncSync, mkdirSync, openSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { crc32, deflateRawSync } from "node:zlib";
+import { SCHEMA_VERSION } from "./store.js";
+import { evidencePack } from "./evidence-pack.js";
+import { SECRET_PATTERNS } from "./evidence.js";
+import { origin, readMonitoring } from "./monitoring-settings.js";
+import { readSsoSettings } from "./sso-settings.js";
+import { readEmailSettings } from "./email-settings.js";
+import { SUBSCRIPTION_CAPABLE, readAuthMode } from "./keys.js";
+export const EXPORT_FORMAT = "standing-orders/export/v1";
+/** Tables that hold nothing but secrets or short-lived sign-in material, and derived search indexes. */
+const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "telegram_pairing", "slack_pair", "discord_pair", "teams_pair"]);
+const DERIVED_TABLE = /^(sqlite_|memory_search)/;
+/** Columns that hold a secret (or what stands in for one): never exported. */
+const SECRET_COLUMNS = new Set([
+    "api_token.secret_hash", "approver.credential_hash", "coordinator_credential.credential_hash", "runner.credential_hash", "invite.token_hash",
+    "flow_trigger.hook_hash", "held_session.cookie", "push_subscription.endpoint", "push_subscription.p256dh", "push_subscription.auth",
+    "chat_turn.credential_key", "mate_session.credential_key", "mate_turn.credential_key", "bridge_lease.push_url", "workflow_preview.token",
+    "quota.credential_fp",
+]);
+/** A column named like this holds a secret unless it is reviewed below; an unreviewed one is dropped. */
+const SECRET_NAME = /hash|secret|token|passw|cookie|csrf|credential|p256dh|^auth$|key|nonce|endpoint|url/i;
+/** Reviewed: named like a secret, but it isn't one (a seal, a digest, a lookup name, an address with no key). */
+const REVIEWED_COLUMNS = new Set([
+    "artifact.key", "budget.scope_key", "mate_thread.scope_key", "diff_comment.source_key", "discord_meta.key", "slack_meta.key", "teams_meta.key",
+    "flow_trigger_event.key", "installation_fact.key", "mcp_idempotency.key", "memory_gap.key", "mutation.idempotency_key", "notification.dedupe_key",
+    "service_cursor.key", "ledger_checkpoint.hash", "ledger_seal.hash", "merge_intent.grant_terms_hash", "plan_revision.parent_hash",
+    "publication.body_hash", "publication.pr_url", "team_message.payload_hash", "team_request.payload_hash", "backend_grant.credential_scope",
+]);
+/** Token counts are usage, not tokens. */
+const USAGE_COLUMN = /(^|_)tokens(_|$)|output_tokens/;
+/** Where a table's file goes: by what it's about. Anything new lands in "other", never nowhere. */
+export function categoryOf(table) {
+    const rules = [
+        [/^(action_ledger|ledger_seal|ledger_checkpoint|sync_ledger)$/, "ledger"],
+        [/^teammate/, "teammates"],
+        [/^(flow|routine|workflow_)/, "flows"],
+        [/^(chat_|mate_|team_|telegram_|slack_|discord_|teams_|notification|push_|bridge_lease)/, "chats"],
+        [/^(approver|api_token|invite|sso_identity|coordinator_)/, "people"],
+        [/^(run|artifact|claim|worktree$|execution_slot|contest|tournament_terms|fallback_cycle|fallback_transition|held_session|session_turn|attended_authorization|criterion_review|diff_comment|proof_|review_request|repair_chain|incident|publication$|merge_|side_spend|knowledge_snapshot|learning_snapshot|skill_snapshot)/, "runs"],
+        [/^(task|hold$|plan_|scope_|tool_seal|decision|external_|skill_test)/, "tasks"],
+        [/^(project|approval_policy|capability|verify_command|worktree_setup|backend_grant|intake_grant|publication_grant|operating_mode|knowledge_|learning_|memory_|skill_)/, "projects"],
+        [/(_config|_default|_defaults)$|^(budget|model_|provider_|installation_fact|runtime_check|monitoring_status|quota|mode_rail|schema_version)/, "settings"],
+    ];
+    return rules.find(([pattern]) => pattern.test(table))?.[1] ?? "other";
+}
+/** Extra shapes beside the evidence scanner's: this installation's own tokens and password hashes, and bearer headers. */
+const EXTRA_SHAPES = [
+    /\bso_[a-f0-9]{12}_[A-Za-z0-9_-]{43}/g,
+    /\bscrypt\$[^\s"',;]+/g,
+    /\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*/gi,
+    /\bsk-[A-Za-z0-9_-]{20,}/g,
+    /\bxapp-[A-Za-z0-9-]{10,}/g,
+    /\blin_(?:api|wh)_[A-Za-z0-9]{20,}/g,
+];
+/** A whole private key, header to footer (or to the end of the text): it goes first, before the scanner's header-only
+ * shape can take the header and leave the key's body behind. */
+const PRIVATE_KEY_BLOCK = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g;
+const SHAPES = [PRIVATE_KEY_BLOCK, ...SECRET_PATTERNS.map(({ pattern }) => new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`)), ...EXTRA_SHAPES];
+/** Every key- or token-shaped run in `text` replaced by "[redacted]". */
+export function redactKeyShapes(text) {
+    let out = text;
+    for (const shape of SHAPES)
+        out = out.replace(shape, "[redacted]");
+    return out;
+}
+function cleanValue(value) {
+    if (typeof value === "string")
+        return redactKeyShapes(value);
+    if (value instanceof Uint8Array)
+        return { base64: Buffer.from(value).toString("base64") };
+    if (typeof value === "bigint")
+        return value.toString();
+    return value;
+}
+const fileName = (value) => value.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+/, "_").slice(0, 120) || "_";
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+/** The whole export, in memory: the files, the manifest and README among them. */
+export function buildExport(store, options) {
+    const db = store.handle;
+    const stamp = options.now.toISOString().replace(/[:.]/g, "-");
+    const root = `standing-orders-export-${stamp}`;
+    const files = [];
+    const entries = [];
+    const add = (path, data, rows) => { files.push({ path, data }); entries.push({ path, sha256: sha256(data), bytes: data.length, ...(rows === undefined ? {} : { rows }) }); };
+    const excludedTables = [], excludedColumns = [];
+    const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all().map(one => one.name);
+    let written = 0;
+    for (const table of tables) {
+        if (DERIVED_TABLE.test(table))
+            continue;
+        if (SECRET_TABLES.has(table)) {
+            excludedTables.push(table);
+            continue;
+        }
+        const columns = db.prepare(`PRAGMA table_info("${table.replace(/"/g, '""')}")`).all().map(one => one.name);
+        const kept = columns.filter(column => {
+            const name = `${table}.${column}`;
+            const secret = SECRET_COLUMNS.has(name) || (SECRET_NAME.test(column) && !USAGE_COLUMN.test(column) && !REVIEWED_COLUMNS.has(name));
+            if (secret)
+                excludedColumns.push(name);
+            return !secret;
+        });
+        if (kept.length === 0) {
+            excludedTables.push(table);
+            continue;
+        }
+        const lines = [];
+        const select = `SELECT ${kept.map(column => `"${column.replace(/"/g, '""')}"`).join(", ")} FROM "${table.replace(/"/g, '""')}" ORDER BY rowid`;
+        let rows;
+        // A table without rowids keeps its own order.
+        try {
+            rows = db.prepare(select).all();
+        }
+        catch {
+            rows = db.prepare(select.replace(/ ORDER BY rowid$/, "")).all();
+        }
+        for (const row of rows) {
+            const clean = {};
+            for (const column of kept)
+                clean[column] = cleanValue(row[column]);
+            lines.push(JSON.stringify(clean));
+        }
+        add(`${categoryOf(table)}/${table}.jsonl`, Buffer.from(lines.length === 0 ? "" : `${lines.join("\n")}\n`, "utf8"), lines.length);
+        written++;
+    }
+    // An evidence pack per task: the task and each revision of it, their terms, approvals, runs, cost and ledger entries.
+    const chain = store.ledgerChain({ full: true });
+    const access = { principal: "operator", repos: null, includeUnplaced: true };
+    const packed = new Set(), roots = new Set(), names = new Set();
+    let packs = 0;
+    for (const { id } of db.prepare("SELECT id FROM task ORDER BY created_at, id").all()) {
+        if (packed.has(id))
+            continue;
+        packed.add(id);
+        const family = store.taskFamilyOf(id, null, true);
+        if (family === null || roots.has(family.root.id))
+            continue;
+        roots.add(family.root.id);
+        for (const version of family.versions)
+            packed.add(version.id);
+        const pack = evidencePack(store, family.root.id, access, options.who, options.now, options.evidenceRoot, chain);
+        if (pack === null)
+            continue;
+        let name = fileName(family.root.id);
+        for (let n = 2; names.has(name); n++)
+            name = `${fileName(family.root.id)}-${n}`;
+        names.add(name);
+        add(`evidence-packs/${name}.json`, Buffer.from(`${redactKeyShapes(JSON.stringify(pack, null, 2))}\n`, "utf8"));
+        packs++;
+    }
+    // Settings kept in files beside the database: what they are set to, never their secrets.
+    add("settings/files.json", Buffer.from(`${JSON.stringify(fileSettings(options.configDir), null, 2)}\n`, "utf8"));
+    add("README.md", Buffer.from(readme(options.now, options.who), "utf8"));
+    const manifest = {
+        format: EXPORT_FORMAT, generatedAt: options.now.toISOString(), generatedBy: options.who, schemaVersion: SCHEMA_VERSION,
+        files: entries, excluded: { tables: excludedTables, columns: excludedColumns },
+    };
+    files.push({ path: "manifest.json", data: Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`, "utf8") });
+    return { root, files, manifest, tables: written, packs };
+}
+/** The settings kept in files (monitoring, sign-in, email, how each provider bills), secrets left out. */
+function fileSettings(dir) {
+    const monitoring = readMonitoring(dir);
+    const sso = readSsoSettings(dir);
+    const email = readEmailSettings(dir);
+    const billing = {};
+    for (const provider of Object.keys(SUBSCRIPTION_CAPABLE))
+        billing[provider] = readAuthMode(provider);
+    return {
+        monitoring: {
+            // A webhook or collector address may carry a key in its path or query: only where it points.
+            webhook: monitoring.webhook === null ? null : { origin: origin(monitoring.webhook.url) },
+            folder: monitoring.folder,
+            traces: monitoring.traces === null ? null : { origin: origin(monitoring.traces.endpoint), header: monitoring.traces.header?.name ?? null },
+        },
+        signIn: sso === null ? null : { issuer: sso.issuer, clientId: sso.clientId, label: sso.label, scopes: sso.scopes, groupsClaim: sso.groupsClaim, rules: sso.rules, passwords: sso.passwords },
+        email: email === null ? null : { host: email.host, port: email.port, secure: email.secure, user: email.user, from: email.from, imap: email.imap },
+        providerBilling: billing,
+    };
+}
+function readme(now, who) {
+    return `# Toolroll export
+
+Everything this installation knew on ${now.toISOString().slice(0, 16).replace("T", " ")} UTC, exported by ${who}.
+
+## Layout
+
+- \`manifest.json\`: every other file, with its size and SHA-256. Check a file with \`shasum -a 256 <file>\`.
+- \`projects/\`: projects, their approval rules, checks, grants, knowledge, lessons and skills.
+- \`tasks/\`: tasks and their versions (\`task_ref.revision_of\`), scopes and approvals (\`task_scope\`, \`scope_approval_vote\`), plans, holds and decisions.
+- \`runs/\`: agent runs with usage and cost (\`run\`, \`run_spend\`), their records of artifacts, proofs, reviews and publications.
+- \`ledger/\`: the action ledger (\`action_ledger\`), each entry's seal (\`ledger_seal\`) and the checkpoints (\`ledger_checkpoint\`).
+- \`evidence-packs/\`: one JSON file per task: who asked, the exact terms and who approved them, runs and cost, checks, completion and its ledger entries.
+- \`chats/\`: conversations with the lead and teammates, and Telegram, Slack, Discord and Teams messages and notifications.
+- \`flows/\`: flows, their cards, scripts and triggers, routines and saved recipes.
+- \`teammates/\`: teammates, their versions, memory, tools and turns.
+- \`people/\`: accounts, API token names and invitations (no passwords or tokens).
+- \`settings/\`: models, budgets, spend and permission defaults, provider readings; \`files.json\` holds the settings kept in files.
+- \`other/\`: everything else the database keeps (workers, leases, queues).
+
+Each \`.jsonl\` file is one database table: one JSON object per line, one row each. A binary value is \`{"base64": "..."}\`.
+
+## What is left out
+
+No password, password hash, API key, token or webhook secret is included. \`manifest.json\` lists the tables and columns
+left out for that reason. Any value shaped like a key or token is replaced by \`[redacted]\`; a ledger entry changed that
+way no longer matches its seal. Artifact contents (logs, diffs, screenshots) stay in the evidence folder; their records,
+with sizes and SHA-256, are in \`runs/artifact.jsonl\`.
+`;
+}
+/** Write the export as a new folder at `out` (its parent must exist; it must not). Files are readable by their owner only. */
+export function writeExportFolder(out, exported) {
+    mkdirSync(out, { mode: 0o700 });
+    for (const file of exported.files) {
+        const target = join(out, file.path);
+        mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+        const handle = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeSync(handle, file.data);
+            fsyncSync(handle);
+        }
+        finally {
+            closeSync(handle);
+        }
+    }
+}
+/** The same files as one .zip (deflated, inside a folder named for the export). */
+export function exportZip(exported) {
+    const local = [], central = [];
+    let offset = 0;
+    const at = new Date(exported.manifest.generatedAt);
+    const time = (at.getUTCHours() << 11) | (at.getUTCMinutes() << 5) | Math.floor(at.getUTCSeconds() / 2);
+    const date = ((Math.max(1980, at.getUTCFullYear()) - 1980) << 9) | ((at.getUTCMonth() + 1) << 5) | at.getUTCDate();
+    if (exported.files.length > 0xffff)
+        throw new Error("Too many files for one .zip; export to a folder instead.");
+    for (const file of exported.files) {
+        const name = Buffer.from(`${exported.root}/${file.path}`, "utf8");
+        const packed = deflateRawSync(file.data);
+        const crc = crc32(file.data);
+        if (offset + packed.length + 30 + name.length > 0xffffffff || file.data.length > 0xffffffff)
+            throw new Error("The export is too large for one .zip; export to a folder instead.");
+        const head = Buffer.alloc(30);
+        head.writeUInt32LE(0x04034b50, 0);
+        head.writeUInt16LE(20, 4);
+        head.writeUInt16LE(0x0800, 6);
+        head.writeUInt16LE(8, 8);
+        head.writeUInt16LE(time, 10);
+        head.writeUInt16LE(date, 12);
+        head.writeUInt32LE(crc, 14);
+        head.writeUInt32LE(packed.length, 18);
+        head.writeUInt32LE(file.data.length, 22);
+        head.writeUInt16LE(name.length, 26);
+        head.writeUInt16LE(0, 28);
+        const entry = Buffer.alloc(46);
+        entry.writeUInt32LE(0x02014b50, 0);
+        entry.writeUInt16LE(0x031e, 4);
+        entry.writeUInt16LE(20, 6);
+        entry.writeUInt16LE(0x0800, 8);
+        entry.writeUInt16LE(8, 10);
+        entry.writeUInt16LE(time, 12);
+        entry.writeUInt16LE(date, 14);
+        entry.writeUInt32LE(crc, 16);
+        entry.writeUInt32LE(packed.length, 20);
+        entry.writeUInt32LE(file.data.length, 24);
+        entry.writeUInt16LE(name.length, 28);
+        entry.writeUInt32LE((0o100600 << 16) >>> 0, 38);
+        entry.writeUInt32LE(offset, 42);
+        local.push(head, name, packed);
+        central.push(entry, name);
+        offset += head.length + name.length + packed.length;
+    }
+    const directory = Buffer.concat(central);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(exported.files.length, 8);
+    end.writeUInt16LE(exported.files.length, 10);
+    end.writeUInt32LE(directory.length, 12);
+    end.writeUInt32LE(offset, 16);
+    return Buffer.concat([...local, directory, end]);
+}
+/** One line for the ledger and the person who asked. */
+export function exportSummary(exported) {
+    return `${exported.files.length} files · ${exported.tables} tables · ${exported.packs} evidence packs`;
+}