toolroll 0.9.103 → 0.9.105

package/dist/server/request-context.d.ts

@@ -1,78 +0,0 @@
-/** What one console request knows about itself, readable anywhere below its handler. */
-import { AsyncLocalStorage } from "node:async_hooks";
-import type { ServerResponse } from "node:http";
-import { type Html } from "../html.js";
-import type { workCountsByProject, WorkIndexPage } from "../work-index.js";
-export type RequestFacts = {
-    appOrigins?: readonly (string | null)[];
-    sso?: {
-        label: string;
-        fresh: boolean;
-    } | undefined;
-    refusal?: (response: ServerResponse, status: number, body: Html) => void;
-    theme?: "light" | "dark" | null;
-    accent?: string | null;
-    updateSeen?: string | null;
-    /** The signed-in browser session's form token ("" for an API token): every POST form carries it (postForm). */
-    csrf: string;
-    returnTo: string;
-    actor?: string;
-    createdTask?: string;
-    /** This request's latency timeline (latency-timeline.ts): kept when the answer was slow. */
-    timeline?: import("../latency-timeline.js").Timeline;
-    browser?: boolean;
-    workspaceRead?: boolean;
-    /** Why a `?format=workspace` GET was made (`x-toolroll-read`, readPurpose below): bookkeeping only, never authority. */
-    readPurpose?: ReadPurpose;
-    /** A workspace read from an app that runs page work itself (`x-toolroll-work`, task-page-in-app.md §2): it picks
-     * which of two forms of the same page is sent, never what may be read. */
-    appWork?: boolean;
-    /** The route table row that matched this request (route-table.ts ids), for the in-place allowlists (serve.ts). */
-    routeId?: string;
-    /** Receipt reconciliation, task and result reads (`request`, `task`, `result`): work is read afresh, never cached. */
-    freshWork?: boolean;
-    /** A workspace re-read's If-None-Match: the content validator it holds from its last read. */
-    workspaceIfNoneMatch?: string;
-    workspaceRequest?: string | null;
-    workCounts?: ReturnType<typeof workCountsByProject>;
-    workCrew?: {
-        project: string | null;
-        page: WorkIndexPage;
-    };
-    /** The chrome this request already read (console-chrome.ts keys): one snapshot per request, however often it asks. */
-    chromeReads?: Map<string, unknown>;
-    lens?: string | null;
-    workspaceValidator?: {
-        key: string;
-        revision: string;
-        expiresAt: number;
-        etag: string;
-    };
-    /** Passwordless is on and this is a signed-in browser: ceremony password fields render as nothing (html.ts reauth). */
-    passwordless?: boolean;
-    /** The browser session's open project (display only: the sidebar's picker names it). */
-    openProject?: string | null;
-    /** Easy start: a local owner with no password yet: every step-up field is the Set a password link instead (this href). */
-    localStepUp?: string;
-    /** Easy-start C2: the browser mutation key is required here, so every page that posts carries the key fill script. */
-    keyFill?: boolean;
-    /** Easy-start C2: this session's key is from an earlier console start (or it has none): how to reconnect. */
-    reconnect?: import("./mutation-key.js").Reconnect | null;
-};
-/**
- * The request's own session facts, readable from anywhere below the
- * dispatcher without threading them through forty call sites: the csrf
- * token every POST form carries, and the path a switch returns
- * to. AsyncLocalStorage follows the request's own async chain, so two
- * interleaved requests never read each other's token.
- */
-export declare const requestContext: AsyncLocalStorage<RequestFacts>;
-/** Run a render outside a live request (a test, a background render) as if a browser session with this token asked. */
-export declare function withFormToken<T>(csrf: string, render: () => T): T;
-/**
- * What a workspace read is for (docs/plans/live-pages-and-home.md A1.4), from its `x-toolroll-read` header. It is a hint
- * about bookkeeping (does the read extend the session, does it mint an approval nonce), never proof that a person
- * clicked, and no authorisation decision reads it. Absent, `poll` or anything unknown is today's re-read: `poll`.
- */
-export type ReadPurpose = "poll" | "navigate" | "prefetch";
-export declare function readPurpose(header: string | string[] | undefined): ReadPurpose;

package/dist/server/retired-routes.d.ts

@@ -1,17 +0,0 @@
-/** Retired addresses (docs/plans/plain-toolroll.md P1.4): Home (`/`) and Tasks (`/tasks`) are the pages; every old page
- * answers with a permanent redirect to its place there, for good, so a bookmark, an old push or an installed phone's old
- * service worker still lands right. A redirect keeps only the query keys its target knows, and decides nothing: the
- * target admits the person and filters what they may see, exactly as if they had opened it. */
-import type { ServerResponse } from "node:http";
-/** The Tasks page's own address for a view, a project and the other keys it knows. */
-export declare function tasksHref(over?: {
-    view?: string | null;
-    project?: string | null;
-    scope?: "all" | null;
-    state?: string | null;
-    cursor?: string | null;
-}): string;
-/** Each retired GET row (route-table.ts `retired`), and where it now lives. */
-export declare const RETIRED_ROUTES: Readonly<Record<string, (url: URL) => string>>;
-/** A retired GET's answer: 301 to where it lives now. Permanent: the old address never comes back. */
-export declare function retiredRedirect(id: string, url: URL, response: ServerResponse): void;

package/dist/server/route-policy.d.ts

@@ -1,18 +0,0 @@
-import type { Caller, ProjectResolver, RouteDeclaration, RouteScope } from './route-table.js';
-export interface RoutePrincipal {
-    caller: Caller;
-    capability: 'none' | 'read' | 'act';
-    viewer?: boolean;
-    token?: boolean;
-}
-export type PolicyResult = {
-    ok: true;
-} | {
-    ok: false;
-    status: 403;
-    reason: 'caller' | 'scope' | 'project';
-};
-/** The row supplies the minimum capability and the project resolver. Passwords/nonces are re-proved by the handler. */
-export declare function evaluateRoutePolicy(route: RouteDeclaration, principal: RoutePrincipal, resolve: (source: ProjectResolver) => boolean, operationScope?: RouteScope): PolicyResult;
-export declare function withEdgePolicy<T>(route: RouteDeclaration, run: () => T): T;
-export declare function adapterPolicy(principal: RoutePrincipal, scope?: RouteScope, resolve?: (source: ProjectResolver) => boolean): PolicyResult;

package/dist/server/route-table.d.ts

@@ -1,114 +0,0 @@
-/**
- * THE ROUTE TABLE: every address this server answers, in one ordered list.
- *
- * Each row declares its method, its exact pattern, which callers may reach it,
- * the scope it needs, how its project is found, and what a project-limited
- * account may do there. The server matches a request against this table before
- * any handler runs; a request no row declares is refused (fail closed). The
- * scattered allowlists that used to repeat these facts by hand (the limited
- * account's read/write sets, the viewer's POST set, the selected-project
- * exceptions) are projections of this table.
- *
- * A row's `role` says who among its admitted callers may use it (an approver,
- * or an instance operator), with the words a caller without it hears. Every
- * row has exactly one handler (handler-registry.ts); handlers do not re-match
- * paths or restate these checks. They still re-prove what can change after
- * admission: passwords, nonces, webhook signatures, object membership, stale
- * sessions and revoked tokens.
- */
-import type { LocalOwnerAct } from "../local-owner.js";
-/** Who presents the request. `service` is a verified external sender (a signed webhook, an OAuth return carrying its one-time state). */
-export type Caller = "anonymous" | "service" | "cookie" | "bearer" | "oauth" | "coordinator" | "lead";
-/** What the caller must hold: nothing, read, act (an approver or an `act` token), or a fresh password/provider check on top. */
-export type RouteScope = "none" | "read" | "act" | "step-up";
-/** Where the request's project comes from. */
-export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "task-ref" | "run" | "decision" | "incident" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
-/**
- * What a project-limited account may do here:
- * - `deny`: instance access only.
- * - `collection`: a listing within a concrete visible project.
- * - `unscoped`: allowed without a concrete project (the handler filters to the account's projects).
- * - `resource`: the named object's project must be visible, and so must the request's project.
- * - `self`: the caller's own settings or saved objects; the handler proves ownership and each project named.
- * - `proposal`: a chat proposal: the saved owner/room and project must be visible.
- * - `conversation`: a shared room's own audience admission, else instance access.
- */
-export type LimitedAccess = "deny" | "collection" | "unscoped" | "resource" | "self" | "proposal" | "conversation";
-export type Domain = "tasks" | "flows" | "chat" | "settings" | "people" | "remote" | "pages" | "live";
-/** `edge`: answered before the console's sign-in (its own protocol proves the caller). `console`: after identify(). */
-export type Stage = "edge" | "console";
-export type RouteMethod = "GET" | "POST" | "GET,HEAD";
-/** Who among the admitted callers may use the route: anyone, an approver, or an instance operator (an approver with instance-wide access). */
-export type RouteRole = "any" | "approver" | "operator";
-/** What a caller without the role hears: the console's refusal page (plain text for a token), or a protocol answer. */
-export type RouteRefusal = {
-    readonly message: string;
-    readonly back?: string;
-} | {
-    readonly status: number;
-    readonly type: string;
-    readonly body: string;
-};
-export interface RouteDeclaration {
-    readonly id: string;
-    readonly domain: Domain;
-    readonly stage: Stage;
-    readonly method: RouteMethod;
-    /** An anchored regular expression source matched against the decoded-free pathname. */
-    readonly pattern: string;
-    readonly callers: readonly Caller[];
-    readonly scope: RouteScope;
-    readonly project: ProjectResolver;
-    readonly limited: LimitedAccess;
-    /** A cookie session with no open project is sent to the project opener first (console GET only). */
-    readonly needsProject: boolean;
-    /** A viewer (watch-only) account may POST here. */
-    readonly viewer: boolean;
-    /** Signed hooks and health are the only roads exposed before Host validation. */
-    readonly host: "before" | "after";
-    /** Protocol authentication stays in its adapter, before its operation handler. */
-    readonly proof: "console" | "public" | "adapter";
-    /** A concrete path this row must win, for the precedence test. */
-    readonly sample: string;
-    /** The exact answer to a caller the row does not admit, when the route has its own protocol (else a plain 403). */
-    readonly scopeRefusal?: string;
-    readonly callerRefusal?: {
-        readonly status: number;
-        readonly type: string;
-        readonly body: string;
-    };
-    /** Checked after caller, scope and project admission, before the handler. */
-    readonly role: RouteRole;
-    /** The role counts only through a browser sign-in: an API token hears the same refusal. */
-    readonly roleBrowser: boolean;
-    readonly roleRefusal?: RouteRefusal;
-    /** The largest form body a POST here reads (else the console's default). */
-    readonly bodyCap?: number;
-    /** Cockpit B2: whether a password remembered on this session may stand in here (`allowlist`), or never. Only the
-     * allowlisted acts run their check inside `withFreshness` (scope.ts); every other step-up is `never`. */
-    readonly freshness: "never" | "allowlist";
-    /**
-     * Easy-start C1: whether a local owner's session (a laptop install's passwordless owner) may use this row, decided for
-     * every row when the table loads (localMarkOf below). `allow` rows name the act they are (local-owner.ts
-     * LOCAL_OWNER_ACTS); the console's admission refuses a local owner everywhere else before the handler runs.
-     */
-    readonly local: "allow" | "deny";
-    readonly localAct: LocalOwnerAct | null;
-    /** A retired page (docs/plans/plain-toolroll.md P1.4): a permanent GET redirect to where it lives now
-     * (retired-routes.ts), admitted exactly as that target is, and no page handler of its own. */
-    readonly retired?: true;
-}
-/** Every edge row, decided: allow where a local owner's cookie may reach it, deny where its adapter refuses one (or no
- * cookie is ever read there). A new edge row fails the table's load until it is listed here. */
-export declare const EDGE_LOCAL: Readonly<Record<string, {
-    local: "allow" | "deny";
-    why: string;
-}>>;
-/** The ids the local marks name, for the inventory test (a mark naming no row is stale). */
-export declare const LOCAL_MARKED_IDS: readonly string[];
-/** The sole route table, in match order. */
-export declare const ROUTES: readonly RouteDeclaration[];
-/** The first row that declares this method and path, or null: an undeclared request never reaches a handler. */
-export declare function matchRoute(method: string, pathname: string, stage?: Stage): RouteDeclaration | null;
-/** Refuses a malformed table at startup: duplicate ids, duplicate method+pattern rows, or a row shadowed by an earlier one for its own sample. */
-export declare function assertRouteTable(routes?: readonly RouteDeclaration[]): void;

package/dist/server/runtime.d.ts

@@ -1,342 +0,0 @@
-import { type ProjectIdentities } from "../project-identity.js";
-import type { FreshFacts } from '../scope.js';
-import type { createPersonalQueueRuntime } from '../lead-queue-runtime.js';
-import type { FlowRooms } from '../flow-live.js';
-import type { IntegrationMonitor } from '../integrations.js';
-import type { OidcSettings } from '../oidc.js';
-import type { OpenRouterModels } from '../openrouter-models.js';
-import type { ProjectCeiling } from '../project.js';
-import type { TaskRooms } from '../task-live.js';
-/** Captured server state and shared guards. Getters preserve live state across requests. */
-import { type IncomingMessage, type ServerResponse } from "node:http";
-import { type AssignmentSnapshot } from '../assignment.js';
-import { type BrowserPhoneCard, type BrowserResultView, type BrowserTaskTab, type BrowserUpdates } from '../browser-workspace.js';
-import type { Html } from '../html.js';
-import { CodingWorkspace } from '../coding-workspace.js';
-import { type FormFieldOf, type FormView } from "../contracts/console-api.js";
-import type { DemoLead } from "../demo.js";
-import { type FirstRunStep, type FirstTaskSuggestion } from "../first-run.js";
-import { type GoogleVisit } from "../google-mail.js";
-import { type ConnectVisit } from "../mcp-connect.js";
-import { type CatalogSeams } from "../model-catalog.js";
-import { type FailureExplanation } from '../needs-you.js';
-import { type OidcClaims, type OidcProvider, type OidcVisit } from "../oidc.js";
-import { type Principal } from "../operate-remote.js";
-import { type VerifiedApprover } from "../principal.js";
-import { type ProjectSettingsView } from "../project-delete-ui.js";
-import { type ProviderConnection } from "../provider-connection.js";
-import { type ProviderId } from "../provider.js";
-import { authenticateApprover as checkApproverPassword, type Scope } from "../scope.js";
-import { SourceBudget } from "../sign-in-guard.js";
-import type { CoordinatorProposal, DirectChatProviderId, LeadMessage, LeadProposal, LeadTurn, PlanRevision, TaskFamily, TaskRef } from "../store.js";
-import { type Decision, type LeadAsk, type LeadThreadScope, type Run, type Store, type Task, type TaskState } from "../store.js";
-import type { TeamChatProviderResolver } from '../team-chat-authorization.js';
-import type { TeamResponse } from '../team-contract.js';
-import { createTeamRuntime } from '../team-runtime.js';
-import { type ToolsView } from "../tools-ui.js";
-import { type ReviewFacts } from "../workspace-ui.js";
-import { WorktreePool } from "../worktree.js";
-import { type Chrome, type Screen } from "./chrome.js";
-import { type ServeOptions } from "./http.js";
-import { type ChatEnablement, type LiveTurn, type ReplacedThread, type TaskChatFocus } from "./render-chat.js";
-import { type ProjectPeek } from "./render-pages.js";
-import { type ResultDetail } from "./render-results.js";
-import { taskBody, type PlanContractView, type PlanRevisionLedgerView, type RevisionDocView, type RevisionView, type RouteView } from "./render-tasks.js";
-import { PersistentSessions, type Session, type SsoIntent, type Who } from "./session.js";
-export interface ServerRuntime {
-    codingActorAllowed: (actor: {
-        name: string;
-        generation: number;
-    }) => boolean;
-    coding: CodingWorkspace | null;
-    codingProjectAllowed: (repo: string) => boolean;
-    store: Store;
-    sendScreen: (response: ServerResponse, status: number, s: Screen) => void;
-    chromeFor: (project: string | null, active: Chrome["active"], listPane?: import("../html.js").Html, scope?: Chrome["scope"]) => Chrome;
-    visible: (repo: string | null) => boolean;
-    managedRepos: () => string[];
-    codingProblem: string | undefined;
-    unscopedMode: boolean;
-    admissionList: () => string[] | null;
-    routeViewOf: (taskId: string, ref: TaskRef | null, scope: Scope | null, now: Date, who: Who) => RouteView | null;
-    workAccess: () => {
-        principal: "operator";
-        repos: string[] | null;
-        includeUnplaced: boolean;
-        viewer: string | null;
-    };
-    evidenceRoot: string;
-    firstRunStepsNow: (now: Date) => FirstRunStep[] | null;
-    restricted: () => boolean;
-    revisionDocOf: (row: PlanRevision) => RevisionDocView | null;
-    familyOf: (taskId: string) => TaskFamily | null;
-    failureOf: (runs: readonly Run[], assignment: AssignmentSnapshot | null, readLog?: boolean) => FailureExplanation;
-    dockedConversation: (who: Who, focusTask: TaskChatFocus | null, chatProject: string | null, now: Date, back: string, resultRunId?: number | null) => import("../browser-workspace.js").BrowserConversation | null;
-    planViewOf: (taskRef: number) => {
-        document: string;
-        sha256: string;
-        run: number;
-    } | null;
-    mintApprovalNonce: (name: string, taskId: string, digest: string) => string;
-    planContractViewOf: (taskRef: number, scope: Scope | null) => PlanContractView | null;
-    familiesInView: (project: string | null, options?: Parameters<Store["taskFamiliesAdmitted"]>[2]) => TaskFamily[];
-    runIsTaskResult: (run: Pick<Run, "role" | "finishedAt">) => boolean;
-    explainAttempt: (run: Run, receipt: AssignmentSnapshot["receipt"] | null, readLog?: boolean) => FailureExplanation;
-    taskChatFocus: (taskId: string | null, now: Date, who?: Who, options?: {
-        mintNonce?: boolean;
-    }) => TaskChatFocus | null;
-    familyTasksInView: (project: string | null, state?: TaskState, limit?: number) => (Task & {
-        repo: string | null;
-    })[];
-    clock: () => Date;
-    taskRooms: TaskRooms;
-    identify: (request: IncomingMessage, touch?: boolean, limited?: boolean, refusedToken?: {
-        principal?: Principal;
-    }) => Who | null;
-    liveCeiling: () => {
-        repos: string[];
-        roots: readonly string[];
-        canon?: (path: string) => string | null;
-    };
-    /** Project identities without reading folders on the console's thread (project-identity.ts). */
-    identities: ProjectIdentities;
-    taskScreen: (response: ServerResponse, who: Who, taskId: string, problem: string | null, status: number, scopeDraft?: URLSearchParams, cancelDraft?: string, editPlan?: boolean, page?: TaskPageExtras) => void;
-    runVisible: (run: Run) => boolean;
-    runIsLive: (run: Pick<Run, "outcome" | "leaseId" | "taskRef">) => boolean;
-    options: ServeOptions;
-    reviewFactsFor: (runId: number) => ReviewFacts | null;
-    resultDetailOf: (run: Run, who: Who, now: Date) => ResultDetail;
-    taskRepoOf: (taskRef: number) => string | null;
-    ceiling: ProjectCeiling;
-    taskViewData: (taskId: string, who: Who, problem: string | null, render?: {
-        mintNonce?: boolean;
-    }) => Parameters<typeof taskBody>[0] | null;
-    consoleProjects: () => string[];
-    flowRooms: FlowRooms;
-    providerHome: string;
-    toolHome: string | undefined;
-    leadPrincipal: (who: Who & {
-        via: "cookie";
-    }) => VerifiedApprover | null;
-    chatScopeOf: (focusTask: TaskChatFocus | null, chatProject: string | null) => LeadThreadScope;
-    liveTurns: Map<number, LiveTurn>;
-    /** A lead reply started on a thread: pages with that conversation open follow it (server/live.ts). */
-    liveTurnStarted: (thread: number) => void;
-    leadConversationRows: (who: Who & {
-        via: "cookie";
-    }, principal: VerifiedApprover, focusTask: TaskChatFocus | null, now: Date, chatProject?: string | null) => {
-        messages: LeadMessage[];
-        proposals: LeadProposal[];
-        decisions: Map<number, Decision>;
-        coordinatorProposals: CoordinatorProposal[];
-        pending: LeadTurn | null;
-        recent: LeadTurn[];
-        ask: LeadAsk | null;
-        asks: Map<number, LeadAsk>;
-        previous: ReplacedThread | null;
-    };
-    demoLeadHere: () => DemoLead | null;
-    teamBrowserReply: (reply: TeamResponse, actor: {
-        name: string;
-        generation: number;
-    }, csrf: string) => TeamResponse;
-    team: ReturnType<typeof createTeamRuntime>;
-    /** The personal lead queue (lead-queue-runtime.ts): a message sent while the person's lead is busy waits here. */
-    personalQueue: ReturnType<typeof createPersonalQueueRuntime>;
-    teamChatProvider: TeamChatProviderResolver;
-    pullRequestTargetOf: (runId: number) => string | null;
-    chatEnablement: () => ChatEnablement;
-    startLeadConversation: (who: Who & {
-        via: "cookie";
-    }, principal: VerifiedApprover, enabled: Extract<ChatEnablement, {
-        ok: true;
-    }>, ceilingUsd: number, follow: boolean, now: Date, scope?: LeadThreadScope, request?: string) => number;
-    projectFamilyPeek: (repo: string, now: Date) => ProjectPeek;
-    needsYouBadge: (project: string | null) => {
-        count: number;
-        saturated: boolean;
-    };
-    liveRefreshSeconds: () => number;
-    /** One work index page for an already-admitted reader, read at most once per workspace revision (console-chrome.ts). */
-    sharedIndexPage: (access: import("../work-summary.js").WorkSummaryAccess, options: import("../work-index.js").WorkIndexOptions) => import("../work-index.js").WorkIndexPage;
-    chatKeyFor: (provider: DirectChatProviderId) => {
-        key: string;
-        source: "environment" | "stored";
-    } | null;
-    chatCatalog: () => Promise<import("../converse.js").CatalogModel[] | null>;
-    /** The catalog as last fetched: what a page shows. A page never fetches. */
-    chatCatalogKnown: () => import("../converse.js").CatalogModel[] | null;
-    leadRecheckedAt: number;
-    checkLocalAgents: (fresh?: boolean) => Promise<void>;
-    localSignIn: {
-        at: number;
-        signedIn: boolean;
-        states: Record<"claude" | "codex", ProviderConnection["state"] | "unverified">;
-    } | null;
-    agentSignInCommand: () => string;
-    connectionCheck: (provider: ProviderId, fresh?: boolean) => Promise<ProviderConnection>;
-    /** What the last sign-in check said: what a page shows. A page never checks (docs/plans/get-side-effects.md). */
-    connectionKnown: (provider: ProviderId) => ProviderConnection | null;
-    /** The last answer of each other check a page shows; a page only reads it. */
-    lastChecks: import("./last-checks.js").LastChecks;
-    checkRelease: () => Promise<{
-        version: string;
-    } | {
-        problem: string;
-    }>;
-    modelCatalog: ((key: string | null, refresh?: boolean) => Promise<OpenRouterModels>) & {
-        known: (key: string | null) => OpenRouterModels | null;
-    };
-    modelSeams: CatalogSeams;
-    toolsViewOf: (repo: string, codex: unknown[] | null, kit?: string | null, wanted?: string | null) => ToolsView;
-    codexServers: (repo: string) => Promise<unknown[] | null>;
-    projectViewOf: (repo: string, who: Who) => ProjectSettingsView;
-    sessions: PersistentSessions;
-    integrations: IntegrationMonitor;
-    consoleOrigin: (host: string | undefined) => string | null;
-    storagePool: (databaseFile: string) => WorktreePool;
-    ssoSettings: () => OidcSettings | null;
-    leadWords: () => string | null;
-    settingsUpdates: (actor: string, csrf: string) => BrowserUpdates | null;
-    phoneSetup: (who: Who) => BrowserPhoneCard | undefined;
-    authenticateApprover: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
-    /** A credential act (passwordless.md's closed list): a password typed now, never a session or a remembered one. */
-    authenticateCredential: (who: Who, token: string, repo?: string | null) => ReturnType<typeof checkApproverPassword>;
-    projectOf: (who: Who, request: IncomingMessage) => string | null | undefined;
-    bustBadge: () => void;
-    revisionDestination: (child: string, back: string) => string;
-    deletedRepos: Set<string>;
-    lookupSession: (candidate: string, touch?: boolean) => Session | null;
-    authorizeMutation: (request: IncomingMessage, who: Who, body: FormView<FormFieldOf<"mutationGuard">>) => {
-        status: number;
-        message: string;
-        reconnect?: import("./mutation-key.js").Reconnect;
-    } | null;
-    leadSaid: Map<string, {
-        turn: number | null;
-        message: string;
-    }>;
-    armTaskResume: (response: ServerResponse, who: Who, taskId: string, named: string, returnTo: "chat" | "task", now: Date) => void;
-    chatFetcher: {
-        (input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
-        (input: string | URL | Request, init?: RequestInit): Promise<Response>;
-    };
-    chatCeilingDigest: (repos?: readonly string[]) => string;
-    consumeApprovalNonce: (nonce: string, name: string, taskId: string, digest: string) => boolean;
-    recordSignIn: (actor: string, action: string, outcome: string, detail?: string | null) => void;
-    ssoProvider: {
-        issuer: string;
-        provider: OidcProvider;
-        at: number;
-    } | null;
-    /** The identity provider as last discovered; a page never discovers it. */
-    providerKnown: (issuer: string) => import("../oidc.js").OidcProvider | null;
-    providerFor: (issuer: string) => Promise<{
-        ok: true;
-        provider: OidcProvider;
-    } | {
-        ok: false;
-        said: string;
-    }>;
-    connectVisits: Map<string, ConnectVisit>;
-    defaultProject: string | null;
-    googleVisits: Map<string, GoogleVisit>;
-    setupAttemptsLeft: number;
-    ssoOffer: () => {
-        label: string;
-        operatorsOnly: boolean;
-    } | null;
-    signInLinks: Map<string, import("./session.js").SignInLink>;
-    /** v147: this console start's key epoch (easy-start C2). */
-    keyEpoch: string;
-    /** Easy-start C2: the browser mutation key (server/mutation-key.ts): the one check, issuing and delivering a key. */
-    browserKeys: import("./mutation-key.js").BrowserKeys;
-    linkKey: (code: string) => string;
-    fromThisComputer: (request: IncomingMessage) => boolean;
-    /** Cockpit B2: the request's live password-freshness facts (null off a browser session). */
-    freshFactsOf: (request: IncomingMessage, who: Who | null) => FreshFacts | null;
-    passwordAllowed: (name: string) => boolean;
-    arrival: (request: IncomingMessage) => {
-        agent: string | null;
-        address: string;
-    };
-    cookieSecure: "" | "; Secure";
-    ssoVisits: Map<string, {
-        visit: OidcVisit;
-        provider: OidcProvider;
-        redirect: string;
-        intent: SsoIntent;
-        returnTo: string;
-        expires: number;
-        startedAt: number;
-        session: {
-            hash: string;
-            generation: number;
-        } | null;
-    }>;
-    ssoHandoffs: Map<string, {
-        claims: OidcClaims;
-        issuer: string;
-        intent: SsoIntent;
-        returnTo: string;
-        expires: number;
-        checkedAt: number | null;
-        session: {
-            hash: string;
-            generation: number;
-        } | null;
-    }>;
-    joinSourceOf: (request: IncomingMessage) => string;
-    signInBudget: SourceBudget;
-    signInActor: (name: string | null) => string;
-    minutesWords: (ms: number) => string;
-    joinGlobal: {
-        tokens: number;
-        refilledAt: number;
-    };
-    joinBySource: Map<string, {
-        tokens: number;
-        refilledAt: number;
-    }>;
-    catalogCache: {
-        at: number;
-        models: import("../converse.js").CatalogModel[];
-    } | null;
-    CHAT_CANDIDATE_TTL_MS: number;
-    CHAT_CANDIDATES_PER_APPROVER: 9;
-    peekSay: (message: string, final?: boolean) => import("../html.js").Html;
-    peekCache: Map<string, {
-        fragment: import("../html.js").Html;
-        bytes: number;
-        at: number;
-    }>;
-    PEEK_CACHE_TTL_MS: 10000;
-    peekCacheBytes: number;
-    peekInFlight: Map<string, Promise<import("../html.js").Html>>;
-    PEEK_GLOBAL_INFLIGHT: 4;
-    peekBySession: Map<string, number>;
-    PEEK_SESSION_INFLIGHT: 2;
-    peekName: (path: string) => import("../html.js").Html;
-    PEEK_FRAGMENT_BYTES: number;
-    peekEvict: () => void;
-    allowedHost: (host: string | undefined) => boolean;
-    revisionViewOf: (ref: ReturnType<Store["lookupRef"]>) => RevisionView | null;
-    revisionLedgerOf: (taskRef: number) => PlanRevisionLedgerView;
-    firstTasks: Map<string, {
-        until: number;
-        found: FirstTaskSuggestion[] | null;
-        reading: boolean;
-    }>;
-}
-/** What the task page's GET adds (docs/plans/one-page-task-and-agent.md): the tab its address names, and the Result tab's
- * selected result (its no-script HTML and its view), whether it is the task's current one. Refusals re-render without. */
-export type TaskPageExtras = {
-    tab?: BrowserTaskTab;
-    result?: {
-        html: Html;
-        selected: NonNullable<BrowserResultView["selected"]>;
-        current: boolean;
-    } | null;
-    /** The result runs the attempt picker may offer (the Result tab would show each); absent: every finished result run. */
-    admissible?: ReadonlySet<number>;
-};