toolroll 0.9.103 → 0.9.105

package/dist/local-owner.d.ts

@@ -1,124 +0,0 @@
-import type { LeadProposalKind, Store } from "./store.js";
-import type { ChatAction } from "./chat-actions.js";
-import type { ChatTaskAction } from "./chat-task-actions.js";
-/** Who a browser session or a terminal command speaks as. Saved sessions from before local mode read "full". */
-export type Authority = "full" | "local-owner";
-export declare const AUTHORITIES: readonly Authority[];
-/** A runtime string as an authority; anything else is null (never "full" by default). */
-export declare function authorityOf(value: unknown): Authority | null;
-/**
- * The acts a local owner may do (plan C1). Ids only: each surface (a route row, a chat action, a CLI command) names
- * the act it is, and an act not in this list is refused to a local owner.
- */
-export declare const LOCAL_OWNER_ACTS: readonly ["file-task", "lead-send", "approve-plan", "build-now", "answer-question", "stop-run", "pause-run", "resume-run", "complete-task", "request-revision", "archive-task", "add-project", "choose-default-agent", "mark-seen", "watch-agent", "read", "routing-turn-off", "dismiss-suggestion", "trial-stop", "code-map-switch", "memory-review"];
-export type LocalOwnerAct = (typeof LOCAL_OWNER_ACTS)[number];
-/** Whether a runtime string names an act a local owner may do. */
-export declare function localOwnerAct(value: unknown): value is LocalOwnerAct;
-/**
- * Every lead proposal kind, decided for the local owner. A new kind fails to compile here until someone decides it
- * (like METHOD_IS_PERSON in person-proof.ts). `action` and `task_action` are allowed only for an operation that is a
- * LOCAL_OWNER_ACTS act; the confirm gate checks that operation too.
- */
-export declare const LOCAL_OWNER_PROPOSALS: Readonly<Record<LeadProposalKind, "allow" | "refuse">>;
-/** Kinds whose allow also needs the operation itself to be a local-owner act. */
-export declare const OPERATION_KINDS: ReadonlySet<LeadProposalKind>;
-/**
- * Whether a local owner may confirm a proposal of this kind. A runtime string: an unknown kind is refused. For
- * `action`/`task_action`, `act` must be the local-owner act the operation is (null or unknown refuses).
- */
-export declare function localOwnerMayConfirm(kind: unknown, act?: unknown): boolean;
-/** Local mode as saved (store.ts `local_mode`, one row): who the owner is, its generation, and whether it is on. */
-export type LocalMode = {
-    owner: string;
-    generation: number;
-    enabled: boolean;
-    initializedAt: string;
-    changedAt: string;
-};
-/**
- * Whether a local-owner session or link still stands against local mode as read now: on, at the generation it was
- * bound to, for the same owner. Pure: the caller reads `mode` in the same transaction as the act.
- */
-export declare function localBindingStands(mode: LocalMode | null, binding: {
-    account: string;
-    localGeneration: number | null;
-}): boolean;
-/** Where a local owner's act came from, for the ledger: the console in a browser, or the terminal UI in-process. */
-export type LocalTransport = "browser" | "terminal";
-/**
- * A local owner acting now: who, the local-mode and account generations its session (or terminal start) was bound to,
- * the transport, and the act the surface it came through is (a route row, a CLI row, a chat card). Only the console's
- * admission and the CLI's dispatch create one; a request's input never names it.
- */
-export type LocalPrincipal = {
-    readonly account: string;
-    readonly localGeneration: number;
-    readonly accountGeneration: number;
-    readonly transport: LocalTransport;
-    readonly act: LocalOwnerAct;
-    /** The browser session's saved hash (web_session.id_hash): a write re-reads that it is still saved. Null in the terminal. */
-    readonly sessionHash: string | null;
-    /**
-     * The browser request it was admitted for, marked ended when its answer is sent. Work that outlives the request (a
-     * timer or a turn started in its async chain) is never the local owner proving anything: the prover refuses it, and
-     * the write-time re-check no longer applies to it. Null in the terminal (a command runs to its end).
-     */
-    readonly request: {
-        ended: boolean;
-    } | null;
-};
-/** The local owner this async chain acts as, or null (full authority, or nobody). Work that outlived its request still
- * reads it (so it is never mistaken for full authority); `localOwnerInFlight` says whether it may still prove anything. */
-export declare function currentLocalOwner(): LocalPrincipal | null;
-/** Whether a local owner's act is still in its request (or its terminal command): only then may it prove or write. */
-export declare function localOwnerInFlight(principal: LocalPrincipal): boolean;
-/** Run `body` as a local owner (the console's admission and the CLI's dispatch only). */
-export declare function asLocalOwner<T>(principal: LocalPrincipal, body: () => T): T;
-/**
- * Narrow the current local owner to one act for `body` (a chat card's own act inside the confirm route). Outside a
- * local owner's chain it changes nothing. It can only ever name an allowlisted act: a caller passing null refuses.
- */
-export declare function withLocalAct<T>(act: LocalOwnerAct, body: () => T): T;
-/**
- * The terminal UI's door (plan C3): run CLI commands (`runOperate`) inside `fn` as the local owner. runOperate binds the
- * owner from local mode as it reads it when its database opens, and refuses every command not marked for the local owner
- * (surface.ts LOCAL_ALLOW). Never read from argv or the environment.
- */
-export declare function runAsLocalOwner<T>(fn: () => T): T;
-/** Whether this chain asked to run commands as the local owner (runOperate reads it; nothing else should). */
-export declare function localOwnerRequested(): boolean;
-/**
- * The act each lead proposal kind is when a local owner confirms it (null: refused, as LOCAL_OWNER_PROPOSALS says).
- * `action` and `task_action` take their operation's act instead (CHAT_ACTION_LOCAL_ACTS, CHAT_TASK_ACTION_LOCAL_ACTS).
- */
-export declare const PROPOSAL_LOCAL_ACTS: Readonly<Record<LeadProposalKind, LocalOwnerAct | null>>;
-/** Every chat action (chat-actions.ts CHAT_ACTIONS), decided for the local owner: its act, or null (refused). A new
- * action fails to compile here until someone decides it. */
-export declare const CHAT_ACTION_LOCAL_ACTS: Readonly<Record<ChatAction, LocalOwnerAct | null>>;
-/** Every task card operation (chat-task-actions.ts), decided for the local owner. */
-export declare const CHAT_TASK_ACTION_LOCAL_ACTS: Readonly<Record<ChatTaskAction, LocalOwnerAct | null>>;
-/**
- * The act a saved proposal is for the local owner, read from its kind and (for operation kinds) its saved operation;
- * null refuses. A runtime read of saved JSON: anything unknown is null.
- */
-export declare function proposalLocalAct(kind: unknown, operation: unknown): LocalOwnerAct | null;
-/** The words every local-owner refusal says, and where it leads: set a first password, or sign in with the one set. */
-export declare function localOwnerRefusal(passwordSet: boolean, returnTo: string): {
-    message: string;
-    action: string;
-    href: string;
-};
-/** Whether local mode is on now (absent is off). Read straight from its one row, so the store's own checks can use it. */
-export declare function localModeOn(store: Pick<Store, "handle">): boolean;
-/**
- * The write-time re-check (plan C1): a local owner acting now still stands — local mode on, at the generation it was
- * bound to, for the same owner; the owner an active approver at the account generation it was bound to; and (a browser)
- * its session still saved. Read in the caller's transaction: Store.transact runs it inside every write a local owner's
- * chain makes, and the prover runs it inside the approval's own transaction.
- */
-export declare function localOwnerStandsNow(store: Pick<Store, "handle" | "accountOf" | "webSession">, principal: LocalPrincipal): boolean;
-/** What a local owner's write hears when it no longer stands (local mode turned off or moved, the owner changed, the
- * session ended). */
-export declare const LOCAL_OWNER_LAPSED = "This local sign-in no longer stands. Run `toolroll open` to sign in again.";
-/** What widening a launch's confinement hears while local mode is on (plan C5). */
-export declare const LOCAL_MODE_CONFINES = "Turn off local mode first.";

package/dist/log.d.ts

@@ -1,7 +0,0 @@
-export type LogLevel = "info" | "warn" | "error";
-export type LogFields = Record<string, string | number | boolean | null | undefined>;
-export declare function formatLogLine(level: LogLevel, event: string, fields: LogFields, now: Date, json: boolean): string;
-export declare function logEvent(level: LogLevel, event: string, fields?: LogFields, options?: {
-    now?: Date;
-    write?: (line: string) => void;
-}): void;

package/dist/login-secrets.d.ts

@@ -1,60 +0,0 @@
-/** The reserved folder's name, beside the database. Toolroll's own; nothing else belongs there. */
-export declare const SECRETS_DIR = ".toolroll-secrets";
-/** The saved login's file name, inside the folder (and, from older versions, directly beside the database). */
-export declare const LOGIN_FILE_NAME = "up-login.txt";
-export declare class UntrustedSecretsFolder extends Error {
-}
-/** The reserved folder for a state folder (the database's folder), by name. */
-export declare const secretsDirOf: (stateDir: string) => string;
-/** Where the saved login lives now. */
-export declare const loginFileOf: (stateDir: string) => string;
-/** Where older versions saved it: directly beside the database. */
-export declare const legacyLoginFileOf: (stateDir: string) => string;
-/**
- * Make the reserved folder if it isn't there (owner-only), and prove it is a real folder of this user's, owner-only,
- * reached by no link. Returns its path. Throws UntrustedSecretsFolder when something else holds the name: nothing is
- * written there then, and the fence still denies the name.
- */
-export declare function ensureSecretsDir(stateDir: string): string;
-/** The saved-login file to write: inside the reserved folder, made and proven first. Throws when it can't be. */
-export declare function writableLoginFile(stateDir: string): string;
-/** The saved-login file to read: the reserved folder's when anything is there, else the old place's when anything is
- * there, else the reserved folder's (nothing saved yet). */
-export declare function savedLoginFile(stateDir: string): string;
-export type LoginMigration = {
-    kind: "none";
-} | {
-    kind: "moved";
-    from: string;
-    to: string;
-}
-/** Both existed with the same contents: the old copy was removed. */
- | {
-    kind: "deduplicated";
-    from: string;
-    to: string;
-}
-/** Both exist and differ: the reserved folder's wins for reads, the old one is left for the person. */
- | {
-    kind: "both";
-    from: string;
-    to: string;
-}
-/** The old file is a link, not a regular file of this user's, or too large: left exactly where it is. */
- | {
-    kind: "refused";
-    from: string;
-    reason: string;
-} | {
-    kind: "failed";
-    from: string;
-    reason: string;
-};
-/**
- * Move a saved login from directly beside the database into the reserved folder. The new file is a fresh one (never
- * the old file's inode, so no other name for that file — a hard link — reaches it), created owner-only (0600) inside
- * the owner-only folder and published whole under its name (written to a private temporary name, synced, then
- * hard-linked in, which fails rather than replace anything), and the old one is removed only after. A link or
- * anything other than this user's own regular file at the old name is never followed or moved. Never throws.
- */
-export declare function migrateLegacyLogin(stateDir: string): LoginMigration;

package/dist/machine-check.d.ts

@@ -1,16 +0,0 @@
-/** A check the machine runs, said as what it is (docs/plans/plain-toolroll.md, Phase 1 follow-up from a release's own
- * page): a task with a prepared candidate is checked out by the machine and no agent runs, so its status says the check
- * that is running, its step and its progress, from the check's own records, never "an agent", and it has no notes to
- * read and no word to send. Presentation only: it reads the run, its check progress and the release's steps. */
-import type { Store } from "./store.js";
-/** The words for a machine-run check now running on `runId`, or null when an agent builds this task (or nothing runs). */
-export declare function machineCheckWords(store: Store, taskId: string, runId: number | null, release: {
-    at?: {
-        step: string;
-        name: string;
-        index: number;
-        of: number;
-    } | null;
-} | null, now: Date): string | null;
-/** Whether this task's builds are the machine's own checks (a prepared candidate), where no agent runs. */
-export declare function machineChecked(store: Store, taskId: string): boolean;

package/dist/machine-identity.d.ts

@@ -1,75 +0,0 @@
-/**
- * Which computer is "this one" for process custody (process witnesses, workspace notes, quarantine journals, a coding
- * agent's custody, runner records, eval campaigns).
- *
- * The network hostname is not an identity: on a Mac with no HostName set, os.hostname() follows the network
- * ("Studio-A.local" on one network, "studio-a.localdomain" on another). A witness recorded under the
- * old name then read as another computer's forever, and a finished build waited on that computer to confirm it
- * stopped (runs 3312 and 3313).
- *
- * So each witness carries this machine's stable id, read from the OS and hashed with a Toolroll-only prefix (the raw
- * id is never stored):
- *
- *   darwin  IOPlatformUUID (ioreg -rd1 -c IOPlatformExpertDevice): fixed per machine
- *   linux   /etc/machine-id (or /var/lib/dbus/machine-id): fixed per installation; a container reads as unknown, since
- *           containers made from one image can share it
- *   win32   HKLM\SOFTWARE\Microsoft\Cryptography MachineGuid
- *
- * THE RULE (isThisMachine): a witness with an id is this machine's exactly when the id equals ours, and never when ours
- * is unknown. A witness without one (written before v150, or by a process that couldn't read its id) is this
- * machine's when its host string is one of this machine's own names: os.hostname() as it reads now, the names macOS
- * configures for it (scutil HostName, LocalHostName + ".local"), and the hostnames recorded beside this machine's own
- * id (machine_host_alias, written only by a process that read that id here, with the hostname it read here at the
- * same moment). No name ever enters the set from a witness, a note, a runner record or anything another computer
- * wrote, so another computer can only match by holding one of this machine's own names: the same coincidence the
- * plain hostname comparison always accepted, and never for a witness that carries a different id.
- */
-export type MachineIdentity = {
-    ok: true;
-    id: string;
-    source: "darwin-platform-uuid" | "linux-machine-id" | "win32-machine-guid" | "injected";
-} | {
-    ok: false;
-    reason: "unsupported-platform" | "unreadable" | "malformed" | "container";
-    detail: string;
-};
-export type MachineIdentityReaders = {
-    platform?: NodeJS.Platform;
-    readFile?: (path: string) => string;
-    exists?: (path: string) => boolean;
-    run?: (file: string, args: string[]) => string;
-};
-/** The stored form of a raw OS id: hashed under a Toolroll-only prefix, so the record never holds the raw id. */
-export declare function hashMachineId(source: string, raw: string): string;
-/** Read this machine's id from the OS, never cached here (machineIdentity() caches it). */
-export declare function readMachineIdentity(readers?: MachineIdentityReaders): MachineIdentity;
-/** The names macOS configures for this machine (not the network's): HostName when set, and LocalHostName.local
- * (Bonjour keeps it unique on its network). Empty elsewhere or when scutil can't answer. */
-export declare function readConfiguredHostNames(readers?: MachineIdentityReaders): string[];
-/** This machine's identity, read once per process. */
-export declare function machineIdentity(): MachineIdentity;
-/** The id to stamp on a new witness, or null when this machine's id is unknown. */
-export declare function currentMachineId(): string | null;
-/** Tests only: pin (or clear, with null) this process's machine id and configured names, and forget remembered names. */
-export declare function injectMachineIdentity(identity: MachineIdentity | null, configured?: string[] | null): void;
-/** Note hostnames recorded beside `id` in this machine's own records. Names for another id are kept apart and never
- * read as this machine's. */
-export declare function rememberHostAliases(id: string, hosts: Iterable<string>): void;
-/** The names this machine is known by right now, from this machine alone: its hostname as it reads now and the
- * names macOS configures for it. What a new witness records beside its id. */
-export declare function liveHostAliases(): string[];
-export type ThisMachine = {
-    id: string | null;
-    hosts: string[];
-};
-/** This machine: its id (null when unknown) and every name it is known by: its live names, plus the names recorded
- * beside its id when the id is known. */
-export declare function thisMachine(extra?: Iterable<string>): ThisMachine;
-/** THE RULE (module comment): whether a witness names this machine. */
-export declare function isThisMachine(witness: {
-    host: string;
-    machineId?: string | null;
-}, here?: ThisMachine): boolean;
-/** Whether a recorded host is the machine a caller named by `here`: exact, or, when `here` is this machine's hostname
- * as it reads now, any of this machine's names (a caller that passes another host, as a test does, compares exactly). */
-export declare function sameMachineHost(seen: string, here?: string, machineId?: string | null): boolean;

package/dist/mailbox.d.ts

@@ -1,57 +0,0 @@
-export type MailboxAccess = {
-    host: string;
-    port: number;
-    secure: boolean;
-    user: string;
-    password?: string;
-    accessToken?: string;
-};
-export type InboundMail = {
-    uid: number;
-    messageId: string | null;
-    inReplyTo: string | null;
-    references: string[];
-    from: string;
-    fromName: string | null;
-    subject: string;
-    text: string;
-    automatic: boolean;
-};
-/** Where a folder stands: its UIDVALIDITY and the last UID seen. */
-export type MailCursor = {
-    validity: string;
-    uid: number;
-};
-/** `at` is where the next read starts; `more` says mail is still waiting past it. */
-export type MailRead = {
-    ok: true;
-    at: MailCursor;
-    mails: InboundMail[];
-    renumbered: boolean;
-    more: boolean;
-} | {
-    ok: false;
-    said: string;
-    permanent: boolean;
-};
-export type MailReader = (access: MailboxAccess, folder: string, after: MailCursor | null, limit: number) => Promise<MailRead>;
-export declare function mailCursorOf(text: string | null): MailCursor | null;
-export declare const mailCursorText: (at: MailCursor) => string;
-/** Whether Inbox triggers can read mail: a connected Google account, or a mail server with its IMAP address. */
-export declare function mailboxReady(dir: string | null): boolean;
-/** The mailbox to read, signed in: Google when connected, else the mail server's IMAP. */
-export declare function mailboxAccess(dir: string | null, fetcher: typeof fetch): Promise<{
-    ok: true;
-    access: MailboxAccess;
-    address: string;
-} | {
-    ok: false;
-    said: string;
-    permanent: boolean;
-}>;
-/** The new part of a message: no quoted earlier messages, no signature, tidy lines. */
-export declare function freshText(text: string): string;
-/** One raw message as plain words, and whether a machine sent it. */
-export declare function readMail(uid: number, source: Buffer | string): Promise<InboundMail>;
-/** The production reader: one read-only IMAP visit. */
-export declare const readThroughImap: MailReader;

package/dist/maintenance.d.ts

@@ -1,13 +0,0 @@
-/** Serialized background maintenance. It schedules no agent work: callers
- * retain dispatch, ownership and recovery policy. Slow passes never overlap. */
-export declare function startMaintenance(args: {
-    intervalMs: number;
-    run: () => Promise<void>;
-    shouldStop: () => boolean;
-    onError: (error: unknown) => void;
-    /** Synchronously cancel owned background work before waiting for the current pass. */
-    onStop?: () => void;
-}): {
-    runNow: () => Promise<void>;
-    stop: () => Promise<void>;
-};

package/dist/mcp-connect.d.ts

@@ -1,181 +0,0 @@
-import { type ProjectTool, type ToolSpec } from "./project-tools.js";
-import type { Store } from "./store.js";
-import { readScope, scopeList } from "./oauth-run-token.js";
-export { readScope, scopeList };
-/**
- * A one-click service. `reads` names what a research step may read there:
- * an action is read-only only when it is named by a reading verb (READING)
- * and every other word in its name is one of these.
- */
-export type OneClick = {
-    id: string;
-    label: string;
-    url: string;
-    about: string;
-    reads?: readonly string[];
-    /** Send no scope: the server applies its own preset for this resource (PostHog's MCP preset). Naming scopes there
-     * shows a 75-group permission grid instead, and the person can stop on it without ever coming back. */
-    serverScopes?: true;
-    /** Actions a research step may use by exact name, checked before the name rule: only while the connection's saved
-     * grant is read-only (readOnlyGrant). PostHog's server lists one action, `exec`, that reads or writes as the grant allows. */
-    readActions?: readonly string[];
-};
-/**
- * Services that connect this way: their servers speak streamable HTTP and
- * advertise registering clients on the spot. Advertising isn't accepting:
- * Figma's server advertises it, but its registration answers 403 to any app
- * Figma hasn't approved, so Figma connects through its desktop app instead
- * (LOCAL_APPS). A service is listed only when its registration accepts
- * Toolroll; mcp-connect.test.ts replays each one's answer (no live calls).
- *
- * Signed in end to end, live: Mobbin. The rest register in replayed checks
- * only, until someone signs in to each for real.
- */
-export declare const ONE_CLICK: readonly OneClick[];
-/**
- * The list, with one service standing in on this computer when the person
- * running Toolroll says so ("stripe|Stripe|http://127.0.0.1:5123/mcp"
- * in TOOLROLL_TEST_CONNECT): how the end-to-end check signs in for
- * real without a real account. Only a loopback address is taken.
- */
-export declare function oneClickServices(environment?: NodeJS.ProcessEnv): typeof ONE_CLICK;
-export declare const oneClickOf: (id: string) => OneClick | null;
-/** An app on this computer that Connect adds without a sign-in (LOCAL_APPS): its tool, name and one line of how. */
-export declare const localConnectOf: (id: string) => {
-    id: string;
-    label: string;
-    about: string;
-} | null;
-/**
- * Where each service stands in a project: connected, open to connect, or its name taken by a tool set up another way.
- * `local` connects with no sign-in. `research` says, for a connected service research can't use because of the access
- * it was granted, why (shown on its Tools entry beside Reconnect read-only).
- */
-export declare function connectionsOf(store: Store, repo: string, home?: string): {
-    id: string;
-    label: string;
-    about: string;
-    state: "connected" | "open" | "taken";
-    local?: true;
-    research?: string;
-}[];
-/**
- * Whether an action only reads: its name has a reading verb, and every other
- * word is a reading verb, a qualifier or something this service lets
- * research read. An allow-list: a word nobody listed withholds the action.
- */
-export declare function readsOnly(action: string, subjects: readonly string[]): boolean;
-export declare const readOnlyGrant: (grant: readonly string[] | null) => boolean;
-/** The scope a connected service's sign-in was granted, as saved beside its token; null when it was never proved. */
-export declare function grantOf(repo: string, tool: string, home?: string): string[] | null;
-/**
- * What a research step may use of a project's connected services: each
- * signed-in service's read-only actions, as its last test listed them —
- * by server (`reads`, for Codex's `enabled_tools`) and named the way Claude
- * allows them (`mcp__<service>__<action>`). `local` is the loopback host of
- * each app on this computer it reads (its proxy lets only those through). A service not connected, without
- * read-only actions, or left out of this run (`launched`) gives nothing. `withheld` is why a service that can name
- * its research actions gave none (its grant, `granted`, writes or was never proved): the run says so.
- */
-export type ResearchTools = {
-    services: {
-        id: string;
-        label: string;
-    }[];
-    allowed: string[];
-    reads: Record<string, string[]>;
-    local: string[];
-    withheld?: Record<string, string>;
-};
-export declare function researchToolsOf(tools: readonly ProjectTool[], launched?: ReadonlySet<string> | null, granted?: (tool: string) => readonly string[] | null): ResearchTools;
-/** Where a service sends the person back after they sign in. */
-export declare const CONNECT_CALLBACK = "/settings/tools/connected";
-type Fetch = typeof fetch;
-type Server = {
-    authorize: string;
-    token: string;
-    register: string;
-    scopes: string[];
-    resource: string | null;
-    revoke: string | null;
-};
-/** A sign-in on its way: what the callback needs to finish it (kept in the console's memory, 15 minutes). `kit` or `template` is the page it returns to. */
-export type ConnectVisit = {
-    service: string;
-    repo: string;
-    by: string;
-    kit: string | null;
-    template: string | null;
-    verifier: string;
-    clientId: string;
-    clientSecret: string | null;
-    token: string;
-    resource: string;
-    redirect: string;
-    expires: number;
-    /** The scope asked for, when one was: the grant when the token answer leaves `scope` out (RFC 6749 §5.1). */
-    scope?: string | null;
-    /** Where the service revokes a token, when its metadata said: a run's own token is revoked there when the run ends. */
-    revoke?: string | null;
-    /** The signer's account generation when the password was typed at Connect: a rotation or revocation since ends the visit. */
-    generation?: number;
-    /** From a kit: the one grant the password at Connect proved (its subagent, this tool, this project); nothing else. */
-    grant?: {
-        subagent: number;
-        tool: string;
-        repo: string;
-    } | null;
-};
-/** A server's sign-in: the resource metadata its 401 names (or the well-known one), then its authorization server's metadata. */
-export declare function discoverSignIn(mcpUrl: string, fetcher?: Fetch): Promise<Server | null>;
-/**
- * Start connecting a service: find its sign-in, register this console as a
- * client, and hand back the address to send the person to (and the visit the
- * callback finishes). The person's password was checked before this.
- */
-export declare function startConnect(input: {
-    service: string;
-    repo: string;
-    by: string;
-    origin: string;
-    kit?: string | null;
-    template?: string | null;
-    readOnly?: boolean;
-}, fetcher?: Fetch, now?: number): Promise<{
-    ok: true;
-    go: string;
-    state: string;
-    visit: ConnectVisit;
-} | {
-    ok: false;
-    said: string;
-}>;
-/** The spec a connected service joins the project with: its MCP address, signed in with the token its sign-in gave. */
-export declare function connectedSpec(serviceId: string): ToolSpec | null;
-/**
- * Finish connecting: trade the code for tokens, add the tool to the project
- * (or refresh its sign-in, when it's there already), keep the tokens in its
- * secrets, and test it.
- */
-export declare function finishConnect(store: Store, visit: ConnectVisit, code: string, now: Date, options?: {
-    fetcher?: Fetch;
-    home?: string | undefined;
-    test?: boolean;
-    omitEnv?: readonly string[];
-    /** The signer's standing, checked again after the token answer and before anything changes. */
-    stillStanding?: () => boolean;
-}): Promise<{
-    ok: true;
-    said: string;
-} | {
-    ok: false;
-    said: string;
-}>;
-/** Keep connected services signed in: any token expiring within ten minutes is refreshed (the worker's pass, and before a subagent's call). */
-export declare function refreshConnections(store: Store, repos: readonly string[], now: Date, options?: {
-    fetcher?: Fetch;
-    home?: string | undefined;
-}): Promise<{
-    refreshed: number;
-    problems: string[];
-}>;

package/dist/mcp-core.d.ts

@@ -1,110 +0,0 @@
-import { type GatewayToolName } from "./contracts/gateway-tools.js";
-import type { Store } from "./store.js";
-import { type VerifiedCoordinator } from "./coordinator.js";
-export declare const MODERN = "2026-07-28";
-export declare const LEGACY = "2025-11-25";
-/** The modern revision namespaces its per-request metadata. */
-export declare const META_VERSION = "io.modelcontextprotocol/protocolVersion";
-export declare const META_SERVER = "io.modelcontextprotocol/serverInfo";
-export declare const META_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
-/** The revision's own error code for an unsupported protocol version. */
-export declare const UNSUPPORTED_VERSION = -32022;
-export declare const MAX_REQUEST: number;
-export declare const MAX_DEPTH = 32;
-export type Json = null | boolean | number | string | Json[] | {
-    [key: string]: Json;
-};
-export declare function depthOf(value: unknown): number;
-/** One handler per tool; its input is GATEWAY_TOOL_INPUTS[name]
- * (src/contracts/gateway-tools.ts) — THE source for parsing and inputSchema.
- * Output is built field-by-field; spreading a database row into a result is
- * forbidden in this module (arch-tested). */
-export type ToolContext = {
-    store: Store;
-    who: VerifiedCoordinator;
-    /** The installation's enrolled repos (repos.json), when the launcher
-     * knows them — list_repos answers allowlist ∩ enrolled. null = the
-     * launcher could not read the registry; the allowlist alone answers. */
-    enrolled: readonly string[] | null;
-    /** The raw credential, per-SERVER closure state — never module state:
-     * two serveMcp instances in one process must not cross credentials
-     * (implementation review, finding 5). Filing re-authenticates with it
-     * inside its own transaction. */
-    token: string;
-    now: Date;
-    /** Decisions this connection read with get_decision — propose_answer needs one. */
-    readDecisions: Set<number>;
-    /** Where evidence lives, when the launcher knows — get_task reads a scout's report from here. */
-    evidenceRoot?: string;
-};
-export type Answer = {
-    ok: true;
-    body: Json;
-} | {
-    ok: false;
-    message: string;
-};
-type Tool = {
-    name: GatewayToolName;
-    description: string;
-    inputSchema: Json;
-    handle: (ctx: ToolContext, args: Record<string, unknown>) => Answer;
-};
-/** The gateway's tools in tools/list order, each inputSchema derived from its contract. */
-export declare const TOOLS: Tool[];
-/** The tools/list payload for a registry. No outputSchema: MCP output schemas describe structuredContent, and these
- * tools return text content only (round-2 finding 1). */
-export declare const toolsPayload: (tools: readonly {
-    name: string;
-    description: string;
-    inputSchema: Json;
-}[]) => {
-    tools: Json;
-};
-/** A modern result is schema-complete; a cacheable one (tools/list, discover) carries `ttlMs: 0` and the narrowest scope. */
-export declare function shapeResult(era: "modern" | "legacy", result: Record<string, Json>, cacheable: boolean): Record<string, Json>;
-/** One JSON-RPC message, read and checked before any method applies. */
-export type ReadMessage = {
-    ok: true;
-    hasId: boolean;
-    id: Json;
-    method: string;
-    params: Record<string, unknown>;
-    meta: Record<string, unknown>;
-} | {
-    ok: false;
-    id: Json;
-    code: number;
-    message: string;
-};
-/** Read one message's text: size, JSON, no batching, depth, `jsonrpc`, and the id rules. A notification is the message
- * that carries NO id — the method name never decides (round-3 finding 3). MCP RequestId is a string or an INTEGER
- * (round-2 finding 2): floats, null, and object shapes refuse wherever an id appears. */
-export declare function readMessage(text: string): ReadMessage;
-/** ClientCapabilities is an OBJECT shape (round-3 finding 5): an array is not a capabilities declaration. */
-export declare const capabilitiesShape: (value: unknown) => boolean;
-/** What a tools/call came to: a JSON-RPC error (`fatal` = the stdio server must exit after it) or a tool result. */
-export type CallOutcome = {
-    kind: "error";
-    code: number;
-    message: string;
-    fatal: boolean;
-} | {
-    kind: "result";
-    result: Record<string, Json>;
-};
-/** The `arguments` of a call: only an ABSENT value defaults to empty (round-3 finding 2), and the root is an object
- * BEFORE any schema applies (round-2 finding 2): 42 or false never passes an empty schema. */
-export declare function callArguments(params: Record<string, unknown>): Record<string, unknown> | null;
-/** A handler's answer as a tools/call result: a refusal is `isError`, never a protocol error. */
-export declare function answerResult(answered: Answer): Record<string, Json>;
-/**
- * One coordinator tools/call. ONE snapshot per call (review finding 3): the version check, the credential re-read, and
- * every data read share a transaction, so a concurrent migration cannot slip between them; filing's own BEGIN IMMEDIATE
- * reenters this one. tools/list visibility is presentation — authorization happens HERE, on every call, against the
- * live credential row.
- */
-export declare function callCoordinatorTool(call: Omit<ToolContext, "who" | "now"> & {
-    clock: () => Date;
-}, params: Record<string, unknown>): CallOutcome;
-export {};