toolroll 0.9.103 → 0.9.105

package/dist/reply-voice.d.ts

@@ -1,23 +0,0 @@
-export type ReplyVoice = {
-    /** Characters of the shaped reply. */
-    characters: number;
-    sentences: number;
-    /** The `PLAIN_WORDS` rows said outside code, plus "owner" when the reply calls the person "the owner". */
-    internalWords: string[];
-    /** Opens with its own steps or a filler word ("I checked", "Let me", "Sure,") instead of the answer. */
-    narratedOpening: boolean;
-};
-/** A reply longer than this is counted as long in the eval's report. */
-export declare const LONG_REPLY_CHARACTERS = 320;
-export declare function replyVoice(reply: string): ReplyVoice;
-export type VoiceSummary = {
-    answers: number;
-    medianCharacters: number;
-    /** Share of answers over `LONG_REPLY_CHARACTERS`, from 0 to 1. */
-    longShare: number;
-    /** Internal words said, summed over the answers. */
-    internalWords: number;
-    narratedOpenings: number;
-};
-/** One model's answers, summed up for the report. */
-export declare function summarizeVoice(voices: readonly ReplyVoice[]): VoiceSummary;

package/dist/report-summary.d.ts

@@ -1,22 +0,0 @@
-import type { Store } from "./store.js";
-import type { ParsedReport } from "./scout-report.js";
-/** The report a scout delivered, for get_task: title, summary, follow-ups —
- * verified before it is read; the document itself stays on the task page. */
-export declare function reportSummaryFor(store: Store, evidenceRoot: string | undefined, taskRef: number): {
-    title: string;
-    summary: string;
-    followUps: {
-        title: string;
-        goal: string;
-    }[];
-} | {
-    problem: string;
-} | null;
-/** The longest full report a later flow step is given through {{stage.<id>.report}}. */
-export declare const REPORT_FILL_LIMIT = 20000;
-/** What a report zone gives the zones after it besides its summary: its items as a numbered list (title, why, URL)
- * and the report's markdown, capped. Empty strings when it has neither. */
-export declare function reportFillIns(report: Pick<ParsedReport, "items" | "report">): {
-    items: string;
-    report: string;
-};

package/dist/reported-usage.d.ts

@@ -1,69 +0,0 @@
-import type { Billing } from "./spend.js";
-/** Several reported models are kept as their sorted ids joined by this (it has spaces, so no one id can equal it):
- * a run whose calls ran different models never reads as any one of them. */
-export declare const MODELS_JOIN = " + ";
-export declare function reportedModelOf(value: unknown): string | null;
-/** The one model a Claude result's `modelUsage` names; null when it names none, several, or anything malformed. */
-export declare function soleReportedModel(modelUsage: unknown): string | null;
-/** Two reports of the same piece of work (a resumed turn, a second init): unknown if either is, the model when they
- * agree, otherwise every model named, sorted (never one chosen). */
-export declare function combineReportedModels(a: string | null, b: string | null): string | null;
-export declare function providerTurnsOf(value: unknown): number | null;
-export declare function reportedCostUsdOf(value: unknown): number | null;
-/** One provider call's own report. `tokensIn` is everything the model read (cached included) when the provider
- * reported every part of it (run-efficiency.ts usageOf), else null. */
-export type ProviderReport = {
-    modelReported: string | null;
-    providerTurns: number | null;
-    reportedCostUsd: number | null;
-    tokensIn: number | null;
-    cacheReadTokens: number | null;
-    cacheWriteTokens: number | null;
-};
-/** What the session's own `system`/`init` events named: the one model they agree on, or that they disagree. */
-export type ClaudeInitModel = {
-    model: string | null;
-    conflict: boolean;
-};
-/** A Claude primary `result` (streamed or buffered `--output-format json`), with what the session's inits named. The
- * init's model is the session's own; inits that disagree leave it unknown; with no init naming one, the result's
- * `modelUsage` counts only when it names exactly one model. */
-export declare function claudeResultReport(result: Record<string, unknown>, init?: ClaudeInitModel): ProviderReport;
-/** Codex's `turn.completed` usage: its input already counts what came from cache; it reports no cache writes, no
- * model and no cost in `exec --json`, so those stay unknown. */
-export declare function codexUsageReport(usage: unknown): ProviderReport;
-/** One of the three amounts, never added to another. */
-export type ReportedAmount = {
-    kind: "api";
-    microusd: number;
-}
-/** The provider's own reported cost of work a subscription covers: usage, not billed (null: it reported none). */
- | {
-    kind: "subscription";
-    reportedUsd: number | null;
-} | {
-    kind: "unknown";
-};
-/** A run's amount, from its fixed billing and its priced spend (run_spend). Subscription work reads its provider's
- * reported cost as usage, never as dollars; billed work without a reported or priced cost is unknown. v141 (Codex
- * round 1 #4, #10): billing this computer's default guessed (`basis` not evidence) is unknown, and so is a run whose
- * cost the provider never reported (its `cost_usd` then holds a conservative charge, never a measurement). */
-export declare function runAmountOf(run: {
-    billing: Billing | null;
-    spendMicrousd: number | null;
-    costUsd: number | null;
-    basis?: "evidence" | "default" | null;
-    costUnknown?: boolean;
-}): ReportedAmount;
-/** A chat request's amount: a subscription chat's reported cost is usage; an API chat's settled charge is dollars,
- * unless its spend is unknown (then the amount is, whatever was settled against the reservation). v141 (Codex round 1
- * #4): a subscription harness's request is subscription usage only when its own events said it was billed to the plan
- * (`billingReported`); one they said used a key is API dollars at its reported cost; one they said nothing of is
- * unknown. Absent `billingReported` keeps the older reading for callers that predate it. */
-export declare function chatTurnAmountOf(turn: {
-    provider: string;
-    settledMicrousd: number | null;
-    unknownSpend: boolean;
-    reportedCostUsd: number | null;
-    billingReported?: "subscription" | "api-key" | null;
-}): ReportedAmount;

package/dist/repos.d.ts

@@ -1,67 +0,0 @@
-/**
- * Which repositories the operator has actually committed to.
- *
- * Discovery is total and costs nothing, so it stays the way you find things.
- * Enrollment is the smaller, deliberate list: what gets reported by default,
- * and later what may be written to. Keeping the two separate is what lets the
- * first run need no configuration while the tenth run stays quiet.
- *
- * The file is plain JSON in a conventional location because someone will want
- * to edit it by hand or check it into their dotfiles — which also means it is
- * untrusted input and gets validated like any other.
- */
-export declare const CONFIG_VERSION = 2;
-export type ProjectRegistry = {
-    repos: string[];
-    roots: string[];
-};
-export type LoadResult = {
-    repos: string[];
-} | {
-    error: string;
-};
-export type RegistryLoadResult = ProjectRegistry | {
-    error: string;
-};
-type RegistryUpdateFailure = {
-    ok: false;
-    reason: "locked" | "registry" | "abandoned";
-    message: string;
-};
-export declare function configPath(env: Record<string, string | undefined>, home: string): string;
-export declare function loadProjectRegistry(file: string): Promise<RegistryLoadResult>;
-/** Compatibility view for reports, CLI enrollment, and the MCP surface. */
-export declare function loadRepos(file: string): Promise<LoadResult>;
-export declare function saveRepos(file: string, repos: readonly string[]): Promise<void>;
-/**
- * The ONE locked registry update (onboarding findings 9/17/19/25/29/30):
- * every writer — CLI add/remove, the console, up's enrollment — goes
- * through here. The lock is an exclusive-create file whose body carries
- * {pid, token, at}; a LIVE owner's lock is never touched; stale recovery
- * runs only after kill(pid, 0) proves the owner dead, serialized through
- * a second exclusive reaper lock that re-reads the exact snapshot it
- * observed before unlinking. The owner releases only while its hold is
- * under 25s — past that it abandons WITHOUT unlinking and reports so; the
- * deadline is checked BEFORE publication, so a committed rename is never
- * reported as failed. Reads: only ENOENT means an empty registry —
- * malformed JSON, wrong shape, EACCES, and I/O errors REFUSE.
- */
-export declare function updateRepos(file: string, transform: (repos: string[]) => string[]): Promise<{
-    ok: true;
-    repos: string[];
-} | RegistryUpdateFailure>;
-/** Atomically update repositories and roots without either writer erasing the other. */
-export declare function updateProjectRegistry(file: string, transform: (registry: ProjectRegistry) => ProjectRegistry): Promise<{
-    ok: true;
-    registry: ProjectRegistry;
-} | RegistryUpdateFailure>;
-export declare function addRepos(existing: readonly string[], incoming: readonly string[]): string[];
-export declare function removeRepos(existing: readonly string[], targets: readonly string[]): string[];
-/** Beside the saved list: how many times each line has been removed from it (written under its lock). */
-export declare function registryRemovalsFile(file: string): string;
-/**
- * How many times each saved line has been removed, as recorded under the saved list's lock. A file that can't be read
- * as one answers null: its caller treats every line as changed (fail closed).
- */
-export declare function registryRemovals(file: string): Record<string, number> | null;
-export {};

package/dist/repository-context-ui.d.ts

@@ -1,3 +0,0 @@
-import { type Html } from "./html.js";
-import type { RepositoryContext } from './repository-context.js';
-export declare function repositoryContextHtml(repo: string, query: string, result: RepositoryContext | null, csrf: string): Html;

package/dist/repository-context.d.ts

@@ -1,66 +0,0 @@
-export type RepositoryContextRequest = {
-    repo: string;
-    query: string;
-    mode?: 'search' | 'impact';
-    audience?: 'lead' | 'crew';
-    /** The admitted project from Toolroll's records: repo itself, or the project a crew worktree belongs to. Every read is
-     * bound to its git folder. */
-    project?: string;
-    baseRevision?: string;
-    cacheRoot?: string;
-    refresh?: boolean;
-    maxBytes?: number;
-};
-export type RepositoryCheckout = {
-    repo: string;
-    gitDir: string;
-    head: string;
-    baseRevision: string;
-    sourceHash: string;
-    source: 'working-tree' | 'base-commit';
-};
-export type RepositoryRelationship = {
-    from: string;
-    to: string;
-    kind: 'imports' | 're-exports' | 'dynamic-import';
-    file: string;
-    line: number;
-    provenance: 'explicit';
-};
-export type RepositoryExcerpt = {
-    file: string;
-    line: number;
-    endLine: number;
-    sha256: string;
-    text: string;
-    reason: string;
-    symbol: string | null;
-};
-export type RepositoryContext = {
-    version: 1;
-    readOnly: boolean;
-    query: string;
-    mode: 'search' | 'impact';
-    asOf: string;
-    checkout: RepositoryCheckout | null;
-    index: {
-        engine: 'typescript-ast' | 'text-search';
-        status: 'ready' | 'missing' | 'stale' | 'unavailable';
-        generation: string | null;
-        extractor: string | null;
-    };
-    excerpts: RepositoryExcerpt[];
-    relationships: RepositoryRelationship[];
-    omissions: {
-        files: number;
-        excerpts: number;
-        relationships: number;
-        sourceBytes: number;
-    };
-    warnings: string[];
-};
-/** Synchronous, read-only capture for DB transaction and provider-admission callers.
- * Call once and persist the returned selection; resume uses that capture, never fresh source. */
-export declare function repositoryContextRead(request: Omit<RepositoryContextRequest, 'refresh'>): RepositoryContext;
-/** Explicit refresh is the only cache-writing path. It never changes project/task records. */
-export declare function repositoryContext(request: RepositoryContextRequest): Promise<RepositoryContext>;

package/dist/request-budget-ui.d.ts

@@ -1,14 +0,0 @@
-/**
- * Settings → Sessions & tokens: each token's request limits in its line, and — for an instance operator — one
- * disclosure to change them for everyone's tokens or for one token (request-budget.ts). Saving takes the operator's
- * password (or a fresh identity-provider sign-in), in a browser only.
- */
-import type { ApiTokenRow, Database } from "./store.js";
-import { type Html } from "./html.js";
-/** The old card look; the section is built from the kit now. Kept for chrome.ts, which still concatenates it. */
-export declare const REQUEST_LIMITS_CSS = "";
-/** "120 requests a minute · 10,000 a day" for one token's line. */
-export declare function tokenLimitWords(db: Database, token: ApiTokenRow): string;
-/** The operator's section: everyone's tokens, or one token. Blank fields use the default shown. Saving takes the
- * operator's password (or Passwordless, or a fresh identity-provider sign-in). */
-export declare function requestLimitsHtml(db: Database, tokens: readonly ApiTokenRow[], now: number): Html;

package/dist/request-budget.d.ts

@@ -1,127 +0,0 @@
-/**
- * Request budgets for person API tokens (v112): how many requests one `so_` token may make across all accepting routes.
- * One budget per token, keyed by its credential row id (a person's API token, v118) (never the secret, its name or an address), shared by those
- * routes. A read token gets 120 requests in any sliding minute, an act token 30, and either 10,000 in a rolling day;
- * an instance operator may override any of these for the installation or for one token in the console (step-up).
- *
- * The token's saved access decides its class: nothing in a request body moves it. A request is counted once when it
- * is admitted, however long it then holds the server (a task wait long-poll is one request, not one per second).
- * Over budget answers 429 with Retry-After; the first refusal in each exhausted window is ledgered, never each one.
- *
- * Tracking is in memory and bounded: at most TRACKED_TOKENS tokens (least recently used goes first, saved before it
- * goes), each with at most PER_MINUTE_MAX request times and one counter per minute of the day. It is saved every
- * FLUSH_MS, on eviction, on server close and at once on a refusal, so a restart doesn't hand a client hammering the
- * server a fresh budget. Anything unreadable (a policy or saved usage outside its bounds) refuses: fail closed.
- */
-import type { Database, Store } from "./store.js";
-import type { TokenAccess } from "./api-tokens.js";
-export declare const REQUEST_BUDGET_SCHEMA = "\nCREATE TABLE IF NOT EXISTS request_budget_limit (\n  target          TEXT PRIMARY KEY CHECK (target = '*' OR (length(target) = 12 AND target NOT GLOB '*[^0-9a-f]*')),\n  read_per_minute INTEGER CHECK (read_per_minute IS NULL OR read_per_minute BETWEEN 1 AND 600),\n  act_per_minute  INTEGER CHECK (act_per_minute IS NULL OR act_per_minute BETWEEN 1 AND 600),\n  per_day         INTEGER CHECK (per_day IS NULL OR per_day BETWEEN 1 AND 100000),\n  set_by          TEXT NOT NULL,\n  set_at          TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS request_budget_usage (\n  token_id  TEXT PRIMARY KEY,\n  minute    TEXT NOT NULL,\n  day       TEXT NOT NULL,\n  noted     TEXT NOT NULL,\n  saved_at  INTEGER NOT NULL\n);\n";
-export declare const REQUEST_BUDGET_DEFAULTS: Readonly<{
-    read: 120;
-    act: 30;
-    day: 10000;
-}>;
-export declare const PER_MINUTE_MAX = 600;
-export declare const PER_DAY_MAX = 100000;
-export declare const TRACKED_TOKENS = 1024;
-export declare const FLUSH_MS = 5000;
-/** Which limit a refusal hit: the body of a 429 names only this and Retry-After. */
-export type BudgetLimit = "read-per-minute" | "act-per-minute" | "per-day" | "per-minute";
-export type Admission = {
-    ok: true;
-} | {
-    ok: false;
-    status: 429;
-    limit: BudgetLimit;
-    retryAfter: number;
-} | {
-    ok: false;
-    status: 503;
-};
-export type BudgetRoute = "api" | "mcp";
-/** An override: null leaves that limit to the installation (for a token) or the default. */
-export type LimitOverride = {
-    readPerMinute: number | null;
-    actPerMinute: number | null;
-    perDay: number | null;
-};
-export type EffectiveLimits = {
-    perMinute: number;
-    perDay: number;
-    overridden: boolean;
-};
-/** The words for a 429, in one line. */
-export declare const limitWords: (limit: BudgetLimit, retryAfter: number) => string;
-/** A limit typed into a form: a whole number within bounds, "" for none, or a problem. */
-export declare function parseLimit(raw: string, max: number): number | null | {
-    problem: string;
-};
-/** Every override: the installation's under "*", each token's under its id. */
-export declare function limitOverrides(db: Database): Map<string, LimitOverride>;
-/** Token override, then the installation's, then the default — per limit. */
-export declare function effectiveLimits(db: Database, tokenId: string, access: TokenAccess): EffectiveLimits;
-/** Set (or, all null, clear) an override, with the change in the policy ledger. The caller checks who may. */
-export declare function setLimitOverride(store: Store, target: string, next: LimitOverride, by: string, now: Date): {
-    before: LimitOverride | null;
-    after: LimitOverride | null;
-};
-export type RequestBudgetOptions = {
-    store: Store;
-    /** Milliseconds since the epoch; tests inject their own. */
-    clock?: () => number;
-    tracked?: number;
-    flushMs?: number;
-};
-/** One per server: both routes share it, so a token's allowance is never doubled. */
-export declare class RequestBudget {
-    private readonly store;
-    private readonly clock;
-    private readonly tracked;
-    private readonly flushMs;
-    private readonly usage;
-    private lastFlush;
-    constructor(options: RequestBudgetOptions);
-    /** How many tokens are tracked in memory now (never more than `tracked`). */
-    get size(): number;
-    /**
-     * Admit one request by an authenticated token, or say why not. Called once per HTTP request, before its body is
-     * read. Anything unreadable refuses with 503 and nothing runs.
-     */
-    admit(tokenId: string, route: BudgetRoute): Admission;
-    private check;
-    /** Save every changed entry. A server calls this on a timer and when it closes. */
-    flush(): void;
-    private save;
-    /** The tracked entry (now the most recently used), from memory or as last saved; the least recently used is saved and let go. */
-    private load;
-}
-/** Per-minute allowances for non-person-token identities and unauthenticated ingress. Password accounts get room
- * for two-second follower polling plus ordinary commands; OAuth exchanges stay keyed by source address. */
-export declare const SOURCE_BUDGET_DEFAULTS: Readonly<{
-    password: 120;
-    oauthToken: 30;
-    coordinator: 120;
-    teamsSource: 120;
-    teamsTenant: 600;
-}>;
-/**
- * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
- * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
- * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
- */
-export declare class SourceAdmission {
-    private readonly perMinute;
-    private readonly clock;
-    private readonly tracked;
-    private readonly usage;
-    private readonly keyMode;
-    constructor(options: {
-        perMinute: number;
-        clock?: () => number;
-        tracked?: number;
-        keyMode?: "source" | "exact";
-    });
-    get size(): number;
-    admit(key: string): Admission;
-}

package/dist/restart-certification.d.ts

@@ -1,133 +0,0 @@
-/**
- * Restart certification (plan acceptance 7): a BASELINE of the boot, the
- * runtime, the installed service and the database's live custody, taken
- * before a login or reboot; and a VERIFICATION afterwards against the same
- * database — boot identity as the OS reports it, service liveness by a
- * fresh heartbeat, recovery of what the old boot left pending, task
- * completion — without printing a secret and without rebooting anything.
- *
- * The precise limits, written into every baseline so nobody reads more
- * into a pass than it proves:
- *   - macOS LaunchAgents resume at USER LOGIN after a reboot, not before
- *     FileVault unlock / login; a machine that sits at the login window
- *     runs nothing.
- *   - Linux user services depend on a login session or `loginctl
- *     enable-linger`; without linger the user manager stops at logout.
- *   - The Windows Task Scheduler logon trigger is a LOGON trigger, not a
- *     boot service.
- *   - This tool never reboots, logs out, or restarts a service itself. A
- *     physical reboot that has not happened is not claimed: `bootChanged`
- *     is the OS's own word, and `unknown` stays unknown.
- */
-import { type BootIdentity } from "./boot-identity.js";
-import { type ServiceDefinition, type ServiceStatus, type SupervisorRunner } from "./daemon.js";
-import { type Store } from "./store.js";
-export declare const RESTART_LIMITS: readonly string[];
-export type RestartBaseline = {
-    version: 2;
-    runnerName: string | null;
-    completionTasks: string[];
-    recordedAt: string;
-    host: string;
-    boot: {
-        id: string | null;
-        source: string | null;
-        problem: string | null;
-    };
-    runtime: {
-        digest: string;
-        nodeVersion: string;
-        execPath: string;
-        platform: NodeJS.Platform;
-        packageVersion: string | null;
-    };
-    containment: Record<string, unknown>;
-    service: (ServiceStatus & {
-        label: string;
-        platform: string;
-    }) | null;
-    database: {
-        identity: string;
-        schemaVersion: number;
-        runners: {
-            name: string;
-            host: string;
-            heartbeatAt: string;
-            alive: boolean;
-            retired: boolean;
-        }[];
-        pendingStops: {
-            run: number;
-            taskRef: number;
-            requestedAt: string;
-            problem: string | null;
-        }[];
-        openRuns: {
-            id: number;
-            taskRef: number;
-            role: string;
-            runner: string;
-            leaseId: string;
-        }[];
-        runningTasks: string[];
-        witnesses: {
-            run: number;
-            pid: number | null;
-            host: string;
-            bootId: string | null;
-            containment: string | null;
-            open: boolean;
-            machineId?: string | null;
-        }[];
-    };
-    limits: readonly string[];
-};
-export type BaselineInputs = {
-    store: Store;
-    service?: {
-        definition: ServiceDefinition;
-        run: SupervisorRunner;
-    } | undefined;
-    now?: Date;
-    packageVersion?: string | null;
-    boot?: BootIdentity;
-    runnerName?: string;
-    completionTasks?: string[];
-    /** Injectable reader for runtime fixtures; production re-reads its actual files. */
-    runtimeDigest?: () => string;
-};
-export declare function restartRuntimeDigest(executable?: string, root?: string): string;
-/** Everything a person needs to compare later, none of what they must not see. */
-export declare function recordRestartBaseline(inputs: BaselineInputs): Promise<RestartBaseline>;
-export type RestartCheck = {
-    name: string;
-    ok: boolean;
-    detail: string;
-};
-export type RestartVerification = {
-    ok: boolean;
-    /** The OS's word: true = a different verified boot, false = the same boot, null = unknown either side. */
-    bootChanged: boolean | null;
-    expectation: "reboot" | "login" | "either";
-    checks: RestartCheck[];
-    current: RestartBaseline;
-    limits: readonly string[];
-};
-export type VerifyInputs = BaselineInputs & {
-    baseline: RestartBaseline;
-    /** What the operator did: a reboot must show a changed boot; a login (no reboot) the same one. */
-    expect?: "reboot" | "login" | "either";
-    /** Settle what the old boot left behind before judging recovery (the watch does this on its own; the certificate does it explicitly). */
-    recover?: boolean;
-};
-/**
- * Compare now against the baseline. Recovery is judged by the SAME rules
- * the controller uses (stopQuiescenceProblem, settleQuiescentStops): a
- * stop the old boot left pending settles only when its witnesses are
- * proven gone — by the verified boot change, or by the probes — and a
- * stop that still cannot settle is reported with the exact reason, never
- * forced.
- */
-export declare function verifyRestartRecovery(inputs: VerifyInputs): Promise<RestartVerification>;
-/** The baseline and verification are meant to be printed; this keeps a secret from ever entering them. */
-export declare function assertNoSecret(json: string, secrets: readonly string[]): void;

package/dist/result-actions.d.ts

@@ -1,36 +0,0 @@
-import type { Store } from "./store.js";
-import { type FeedbackImage } from "./result-review.js";
-import type { RevisionOrigin } from "./contracts/route-results.js";
-export type RevisionResult = {
-    ok: true;
-    id: string;
-} | {
-    ok: false;
-    status: number;
-    message: string;
-};
-type RevisionInput = Parameters<typeof createResultRevision>[2];
-/** Re-prove image custody and current result at each write. No file paths supplied by callers. */
-export declare function feedbackImageProblem(store: Store, root: string, runId: number, image: FeedbackImage | null | undefined): string | null;
-/** One user action: add the typed change and seal exactly the displayed
- * saved notes. A refusal rolls back the note; a replay returns the same task. */
-export declare function requestResultChanges(store: Store, evidenceRoot: string, input: RevisionInput & {
-    note: string;
-    path: string;
-    line: string;
-    request: string | null;
-    image?: FeedbackImage | null;
-}, now: Date): RevisionResult;
-export declare function createResultRevision(store: Store, evidenceRoot: string, input: {
-    run: number;
-    batch: string | null;
-    source: string | null;
-    actor: string;
-    repos: readonly string[] | null;
-    includeUnplaced?: boolean;
-    allowMode?: boolean;
-    /** Who this revision comes from (results routing): each caller says it from its own trusted context, never from
-     * `allowMode` or the actor's name. Only `person` counts against the model that built the result. */
-    origin: RevisionOrigin;
-}, now: Date): RevisionResult;
-export {};