toolroll 0.9.103 → 0.9.105

package/dist/teams-api.d.ts

@@ -1,33 +0,0 @@
-import { ChatDeliveryError, type ChatIdentity } from "./chat-delivery-state.js";
-export type TeamsCredentials = ChatIdentity & {
-    tenant: string;
-    secret: string;
-};
-export declare class TeamsError extends ChatDeliveryError {
-}
-export declare const teamsCredentialFile: (dir: string) => string;
-export declare const teamsGuid: (v: unknown) => v is string;
-export declare function teamsIdentity(app: string, tenant: string): ChatIdentity;
-export declare function loadTeamsCredentials(dir: string): TeamsCredentials | null;
-export declare function saveTeamsCredentials(dir: string, value: TeamsCredentials): void;
-export declare function clearTeamsCredentials(dir: string): void;
-/** A bot access token for outbound calls (client credentials), cached until shortly before expiry. */
-export declare function teamsAccessToken(credentials: Pick<TeamsCredentials, "app" | "secret">, fetcher?: typeof fetch, now?: number): Promise<string>;
-export declare function forgetTeamsToken(): void;
-export type TeamsApi = (method: "GET" | "POST" | "PUT", serviceUrl: string, path: string, body?: Record<string, unknown>) => Promise<Record<string, unknown>>;
-/** Outbound Bot Framework calls: only conversation routes, only under an https service URL Microsoft named in a signed token. */
-export declare function teamsApi(credentials: TeamsCredentials, fetcher?: typeof fetch): TeamsApi;
-/** Confirm the app can sign in; the tenant and app id shape the installation identity. */
-export declare function checkTeamsCredentials(app: string, tenant: string, secret: string, fetcher?: typeof fetch): Promise<TeamsCredentials>;
-export declare function forgetTeamsKeys(): void;
-export type TeamsClaims = {
-    appId: string;
-    serviceUrl: string | null;
-};
-/**
- * Prove an inbound activity came from the Bot Framework for this app: an
- * RS256 token from the Bot Framework issuer, for this app id, not expired,
- * signed by a published key. The serviceurl claim must match the activity
- * so a stolen token cannot redirect replies.
- */
-export declare function verifyTeamsToken(header: string | undefined, appId: string, fetcher?: typeof fetch, now?: number): Promise<TeamsClaims | null>;

package/dist/teams-chat.d.ts

@@ -1,36 +0,0 @@
-import { ChatState, type ChatEvent, type ChatIdentity } from "./chat-delivery-state.js";
-import { type ChatAckHooks, type ChatLiveTransport, type LiveReplies } from "./chat-live.js";
-import { type ChatDeliveryOptions } from "./chat-delivery.js";
-import { type TeamsApi } from "./teams-api.js";
-export type TeamsChatOptions = Omit<ChatDeliveryOptions, "state" | "label" | "member" | "partSize" | "maxProposal" | "live"> & {
-    api: TeamsApi;
-    /** The live "Working on it…" message (chat-live.ts): on in the worker. */
-    liveReplies?: LiveReplies;
-};
-export declare const teamsUserId: (v: unknown) => v is string;
-/** A conversation id; a channel post's carries its thread as ";messageid=<first message>" (v89). */
-export declare const teamsConversationId: (v: unknown) => v is string;
-export declare function teamsMember(api: TeamsApi, state: ChatState, installation: string, member: string, channel: string): Promise<boolean>;
-export declare const teamsDelivery: (options: TeamsChatOptions) => ChatDeliveryOptions;
-export declare const processTeamsEvent: (options: TeamsChatOptions) => Promise<boolean>;
-export declare const planTeamsRooms: (options: TeamsChatOptions) => Promise<void>;
-export declare const planTeamsNotifications: (options: TeamsChatOptions) => Promise<void>;
-/**
- * Save one Bot Framework activity before it is acknowledged: a personal
- * message (or `pair <code>`), a channel message where the bot was mentioned,
- * or an Adaptive Card submit carrying one of our tokens. The token that
- * authenticated the request is never stored; only the service URL the
- * conversation replies through is kept, per conversation.
- */
-export declare function receiveTeams(state: ChatState, identity: ChatIdentity, raw: unknown, serviceUrlClaim: string | null, now: Date): boolean;
-/** One Adaptive Card: plain text (within PLATFORM_LIMITS.teams: teamsMessages splits longer), then the buttons (submit tokens, or one link). */
-export declare function teamsCard(text: string, actions: Record<string, unknown>[]): Record<string, unknown>;
-/** Text longer than one Teams message, as several, never cut: the leading parts as plain messages, and the last as
- * `last` makes it (a card with the buttons, or a message), so the buttons come after all of the text. */
-export declare function teamsMessages(text: string, markdown: boolean, last: (text: string) => Record<string, unknown>): Record<string, unknown>[];
-/** Send the next pending part: a plain message, an edit, or a card with its tokens. */
-export declare function deliverTeamsPart(options: TeamsChatOptions): Promise<boolean>;
-/** The live message for one owner message: a plain Markdown activity, replaced whole (PUT) on every edit. */
-export declare function teamsLive(options: Pick<TeamsChatOptions, "api" | "identity">, state: ChatState, event: ChatEvent, spacingMs?: number): ChatLiveTransport | null;
-/** Teams gives bots no reactions: the arrival ack is "typing…", with nothing to take off. */
-export declare function teamsAckHooks(options: Pick<TeamsChatOptions, "api" | "identity">, state: ChatState): ChatAckHooks;

package/dist/teams-settings.d.ts

@@ -1,14 +0,0 @@
-/** Settings → Teams: connect the Entra app once (operator), then each
- * teammate pairs their own Teams account. The messaging endpoint the bot
- * registration must point at is shown here; it has to be reachable from the
- * internet, which a tailnet-only address is not. One page with Slack and
- * Discord (chat-settings-page.ts). */
-import type { Store } from "./store.js";
-import { type Html } from "./html.js";
-export declare function teamsSettingsHtml(store: Store, dir: string, options?: {
-    code?: string;
-    problem?: string;
-    now?: Date;
-    who?: string;
-    publicUrl?: string | null;
-}): Html;

package/dist/teams.d.ts

@@ -1,24 +0,0 @@
-import type { IncomingMessage, ServerResponse } from "node:http";
-import { chatObject as object } from "./chat-delivery.js";
-import { type TeamsChatOptions } from "./teams-chat.js";
-import type { Store } from "./store.js";
-import { type Admission } from "./request-budget.js";
-export declare const TEAMS_ACTIVITY_BYTES: number;
-export declare const TEAMS_MESSAGES_PATH = "/teams/messages";
-/** The receiver: prove the Bot Framework token for this app, save the activity, acknowledge. Nothing runs here. */
-export declare function handleTeamsHttp(request: IncomingMessage, response: ServerResponse, options: {
-    store: Store;
-    dir: string;
-    fetcher?: typeof fetch;
-    clock?: () => Date;
-    admitSource: (request: IncomingMessage) => Admission;
-    admitTenant: (tenant: string) => Admission;
-}): Promise<boolean>;
-/** The worker-side loop: a lease per installation, one pass a second. */
-export declare function followTeams(options: Omit<TeamsChatOptions, "identity" | "api" | "owner" | "current"> & {
-    dir: string;
-    signal: AbortSignal;
-    notifications: () => boolean;
-    fetcher?: typeof fetch;
-}): Promise<void>;
-export { object };

package/dist/teardown-git.d.ts

@@ -1,164 +0,0 @@
-import { type ExecResult } from "./exec.js";
-import { type Runner } from "./worktree.js";
-export type Git = (cwd: string, args: readonly string[]) => Promise<ExecResult>;
-/** Fixed on every teardown command, ahead of its own arguments. */
-export declare const TEARDOWN_FLAGS: readonly string[];
-/** Exit code of a refused command (git's own fatal code, so no caller reads it as "not found" or "no"). */
-export declare const REFUSED_CODE = 128;
-/** The command-running setting a `git config --list --show-scope -z` listing sets, or null. Only local and worktree
- * scope count: teardown commands never read system or global config. `lfsChecked`: the caller refuses a checkout whose
- * `.lfsconfig` names a git-lfs extension (lfsExtensionIn), so git-lfs's own exact filters may stand (runsCommand).
- * Fails closed: a listing that can't be classified names a setting. */
-export declare function commandSetting(listing: string, options?: {
-    lfsChecked?: boolean;
-}): string | null;
-/** The `-c` settings that carry the operator's own values (CARRIED_VALUES, LFS_FILTER) from a global/system listing. */
-export declare function carriedSettings(listing: string): string[];
-/** Why a teardown command was refused, or null when `result` isn't a refusal. */
-export declare function refusal(result: ExecResult): string | null;
-/** The one way teardown runs git, including the target checkout immediately before removal. Every command runs
- * against a write view of its repository (gitView), whose config is the one inspected and whose info is a copy, so a
- * setting or attributes file an agent adds after the inspection is never read (a build's process can outlive its turn:
- * on macOS containment is observational, src/containment.ts, and a sibling build shares the repository). A removal's
- * target is bound to the same repository as the folder it is removed from. A removal without --force runs under the
- * target's own view (its own config.worktree folded in), so git's last check of whether it is clean reads it as the
- * target itself would. `binding.repo`: the project's main checkout, from the plane's records, when the caller has it. */
-export declare function teardownGit(runner?: Runner, binding?: GitBinding, lockTimeoutMs?: number, gitFile?: string): Git;
-/**
- * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
- * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic
- * maintenance, no submodule recursion, no signing), refused outright when the checkout's own config includes a file
- * or names a command — a filter, an external diff, a textconv, a pager — which a build could have planted. It reads no
- * global or system config: only their values (identity, line endings, a standard git-lfs install) are carried over.
- * It never enters a submodule or nested repository (whose config it never read).
- */
-/**
- * Whether a checkout's own git config (its repository's config and its worktree's config.worktree) includes another
- * file, read without git: every git command follows includes as it starts, so an include of the build's could point
- * git at any file, a pipe that never ends among them. Each file is read only as the regular file it is, bounded; one
- * that can't be read so counts as including.
- */
-/** What is left of a caller's deadline, in ms (viewedGitSync's `deadline`): absent, no deadline. */
-type Limit = () => number;
-export declare function checkoutIncludes(checkout: string, gitFile?: string, limit?: Limit): boolean;
-/** What includeIn answers when Git didn't finish parsing the file in time: still a refusal, named as what it is. */
-export declare const INCLUDE_PARSE_TIMED_OUT = "Git didn't finish reading it in time";
-export type GitBinding = {
-    repo?: string | null;
-};
-/** The shared git folder of a recorded project, read from disk and proven as boundDirs proves it: the project's own
- * real `.git` folder, holding no `commondir`. No pointer file or `commondir` an agent can write decides it, and no git
- * runs (a page visit reads this). Throws with the reason otherwise. */
-export declare function recordedCommonDir(repo: string): string;
-/** Where git incidents are recorded: beside the fenced views folder (git-incident.ts). */
-export declare function gitIncidentRecord(): string;
-/** Settings fixed on every write through a view: `worktree add` records absolute paths (relative ones would need a
- * config write, which a view keeps); no transport at all (a caller that fetches allows its one protocol by name, as the
- * nightly check's local fetch does with protocol.file.allow); and no split index (its shared index files would be
- * written in the plane's GIT_DIR). */
-export declare const WRITE_VIEW_FLAGS: readonly string[];
-/** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
- * program (anything but INERT_LFS). A file that
- * isn't a plain one, or doesn't parse, counts as naming one. */
-export declare function lfsExtensionIn(checkout: string, gitFile?: string, limit?: Limit): boolean;
-/** The hardened runners' own reads before the caller's command (the checkout's config listing): their own bounds, never
- * the caller's. A caller's small `maxBuffer` is for its own command's output (builder.ts reads one ls-tree line with
- * 2 KiB): inherited, it failed the config listing once a project's .git/config grew past 2 KiB (one [branch] section per
- * work branch), and every prepared release check then failed as "its config couldn't be read" (runs 3316–3324). */
-export declare const CONFIG_READ_BYTES: number;
-export declare const CONFIG_READ_MS = 30000;
-/** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
- * plane made, inspected there, so neither can change between the inspection and the run. `mode` "read" is for reading
- * a checkout an agent may still be writing (the code page): every command also takes readFlags(), and the view holds
- * no info/attributes. "build" is the plane's staging and committing of a build's work, which writes the repository
- * through the view (gitView). */
-export declare function checkoutGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;
-/**
- * Flags for reading a checkout an agent writes while a page waits (docs/plans/get-side-effects.md). Command-line
- * settings win over anything the checkout's config says, even one changed after it was inspected: no fsmonitor, hooks,
- * pager or credential helper; no network (lazy fetch off, every protocol refused); and attributes read from the empty
- * tree, so no filter or textconv a .gitattributes names can run. A diff also takes --no-ext-diff --no-textconv.
- */
-export declare const PAGE_READ_FLAGS: readonly string[];
-/** The read flags, for every read of an agent-written checkout, whatever the HTTP method (security review of
- * 01bf3114): the worktree's attributes come from the empty tree. Git still reads the repository's info/attributes and
- * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
- * also runs against a view of the checkout's repository (gitView; checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
- * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
-export declare function readFlags(gitFile?: string): readonly string[];
-/**
- * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
- * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
- * config, the operator's own values carried, PAGE_READ_FLAGS and a view of the checkout's repository (gitView: they hold even if its config
- * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
- */
-export declare function checkoutGitSync(cwd: string, args: readonly string[], options?: {
-    timeoutMs?: number;
-    maxBuffer?: number;
-    binding?: GitBinding;
-}): string;
-/**
- * checkoutGitSync's run, answering git's exit status instead of throwing on a non-zero one (a refusal, or a repository
- * that changed while git ran, still throws): for reads whose "no" is an exit code (`merge-base --is-ancestor`), and,
- * with `buffer`, for blobs read as bytes (their output is never rewritten).
- */
-export declare function viewedGitSync(cwd: string, args: readonly string[], options: {
-    timeoutMs?: number;
-    deadline?: number;
-    maxBuffer?: number;
-    binding?: GitBinding;
-}): {
-    status: number | null;
-    stdout: string;
-};
-export declare function viewedGitSync(cwd: string, args: readonly string[], options: {
-    timeoutMs?: number;
-    deadline?: number;
-    maxBuffer?: number;
-    binding?: GitBinding;
-    buffer: true;
-    input?: Buffer;
-    git?: string;
-}): {
-    status: number | null;
-    stdout: Buffer;
-};
-/**
- * checkoutGit ("build": the repository written through its view) for callers that name the repository with a leading
- * `git -C <dir>` instead of a cwd: worktree add and remove in a project's repository, a merge in a checkout of it.
- * The project's repository is shared with every build, which can write its config, info and hooks; nothing here runs
- * what they name. Anything but git goes to `inner` as given.
- */
-export declare function hardenedGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;
-/** Asked once per git executable (eval-harness review 2, follow-up): a fixed git given to viewedGitSync is probed
- * itself, never answered for by the one PATH names. */
-export declare function lazyFetchSupported(gitFile?: string): boolean;
-/** For tests: forget the probes' answers, or set one for every executable (null forgets). */
-export declare function setLazyFetchSupportedForTest(value: boolean | null): void;
-/** The words for a partial clone refused on a git without `--no-lazy-fetch`. */
-export declare const PARTIAL_CLONE_REFUSAL = "this project is a partial clone; protected reads need git 2.45 or newer";
-/** `--no-lazy-fetch` where the installed git has it, else nothing (and lazyFetchSetting refuses partial clones). */
-export declare function noLazyFetch(): readonly string[];
-/**
- * The repository setting (local or worktree scope of a `git config --list --show-scope -z` listing) that makes lazy
- * fetching possible, or null: `extensions.partialClone` set at all, any `remote.<name>.promisor` not plainly false, or
- * any `remote.<name>.partialCloneFilter` set (git makes that remote a promisor). Fails closed: a listing that can't be
- * read names a setting. `remote.<name>.vcs` (a foreign-VCS helper) is named too, though the classifier already refuses
- * it (commandSetting: not in the remote allowlist), as it does every `protocol.*` key and every include.
- */
-export declare function lazyFetchSetting(listing: string): string | null;
-/**
- * For the reads that run git directly on a repository rather than through a view: with `--no-lazy-fetch` they run as
- * they always have (the flag stops any fetch). Without it, they must not check a repository's config and then run git
- * on it (the config could change in between, or an include could set what the check never saw): `inner`, wrapped so
- * every git command runs through a frozen read view (checkoutGit "read"), whose own config listing (includes refused,
- * command and protocol settings refused, a partial clone refused) is the config git then runs with.
- */
-export declare function lazyFetchSafeGit(inner?: Runner): Runner;
-/**
- * The checkout a folder sits in, for choosing a folder (easy-start): the nearest parent holding a `.git`, then read
- * through checkoutGitSync, so a config that includes another file (a FIFO), or sets a command, is refused and the read
- * is bounded. Null when there is no checkout or it can't be read that way.
- */
-export declare function checkoutTop(dir: string, timeoutMs?: number): string | null;
-export {};

package/dist/telegram-flow.d.ts

@@ -1,112 +0,0 @@
-import { type FlowChoiceVisit, type FlowSendContent } from "./flow-send.js";
-import { type FlowStage } from "./flows.js";
-import { type InlineButton } from "./telegram-lead.js";
-import { type FlowCardRow, type FlowRow, type Store, type TelegramBinding, type TelegramFlowAction, type TelegramFlowChoice, type TelegramFlowPrompt } from "./store.js";
-/** A flow decision's notice: one per visit, and again (`:ask:<ms>`) when the owner asks the lead to approve it. */
-export declare const FLOW_DECIDE_KEY: RegExp;
-type Waiting = {
-    card: FlowCardRow;
-    flow: FlowRow;
-    stage: FlowStage;
-    draft: FlowStage | null;
-};
-/** The card, if it is still at that visit, waiting at a decision. */
-export declare function flowDecisionAt(store: Store, cardId: number, entry: number): Waiting | null;
-/**
- * A flow decision as Telegram shows it: the action and where each button takes the card first, then the draft (as
- * the card holds it now, so what is approved is what is read) and why a subagent handed it over, then the flow and
- * zone. `said` is the saved notice's body: the words before its instruction are the subagent's handoff.
- */
-export declare function flowDecisionText(waiting: Waiting, said: string | null, head?: string): string;
-/** Buttons for one visit, minted before the send; `place` stamps the message they landed on. */
-export declare function flowButtons(store: Store, binding: TelegramBinding, waiting: Waiting, now: Date): {
-    keyboard: InlineButton[][];
-    tokens: string[];
-};
-/** What a "Send to me" or "Person chooses" visit sent, read back for its message. */
-export declare function flowSentContent(store: Store, card: number, entry: number): FlowSendContent | null;
-/** A sent visit's links as one row of buttons: Toolroll's pages under the trusted origin, and its pull request. */
-export declare function flowSendKeyboardRow(origin: string | null, content: FlowSendContent): InlineButton[];
-/** A choice as Telegram shows it, first: what to choose, then where each option (and a reply) takes the card. The
- * options are the ones its buttons carry: offered when sent, and still offered. */
-export declare function flowChoiceHead(visit: FlowChoiceVisit, content: FlowSendContent): string[];
-/** A choice's buttons for one visit, one option to a row, minted before the send; `place` stamps the message they landed on. */
-export declare function flowChoiceButtons(store: Store, binding: TelegramBinding, visit: FlowChoiceVisit, content: FlowSendContent, now: Date): {
-    keyboard: InlineButton[][];
-    tokens: string[];
-};
-/** A tapped option, applied inside the update's transaction. */
-export declare function applyFlowChoiceTap(store: Store, binding: TelegramBinding, choice: TelegramFlowChoice, message: {
-    text: string;
-}, repos: readonly string[] | null, now: Date): FlowTapEffect[];
-export type FlowTapEffect = {
-    kind: "ack";
-    text: string;
-}
-/** The message repainted; `keyboard` (absent: none) replaces its buttons, and links are paths under the console. */
- | {
-    kind: "edit";
-    text: string;
-    keyboard?: FlowKeyboard;
-    place?: string[];
-} | {
-    kind: "prompt";
-    text: string;
-    placeholder: string;
-    prompt: Omit<TelegramFlowPrompt, "messageId">;
-};
-/** A repainted message's buttons: a token, or a link to a console path. `place` names fresh flow buttons to stamp on the message. */
-export type FlowKeyboard = Array<Array<{
-    label: string;
-    token: string;
-} | {
-    label: string;
-    link: {
-        label: string;
-        path: string;
-    };
-}>>;
-/** Where a card is now, for a message whose buttons no longer act: named and linked only when it is in one of the
- * viewer's projects, and linked only while it still waits on someone. Never a live button. */
-export declare function flowWhereNow(store: Store, cardId: number, repos: readonly string[] | null): {
-    said: string;
-    keyboard: FlowKeyboard;
-};
-/** A tapped flow button, applied inside the update's transaction. */
-export declare function applyFlowTap(store: Store, binding: TelegramBinding, action: TelegramFlowAction, message: {
-    chatId: string;
-    messageId: string;
-    text: string;
-}, repos: readonly string[] | null, now: Date): FlowTapEffect[];
-export type FlowConfirm = {
-    token: string;
-    binding: number;
-    chatId: string;
-    messageId: string;
-    card: number;
-    entry: number;
-    phase: "yes" | "cancel";
-    expiresAt: string;
-    consumedAt: string | null;
-};
-/** A Yes or Cancel this module armed, or null when the token isn't one. */
-export declare function flowConfirmOf(store: Store, token: string): FlowConfirm | null;
-/** The second tap, inside the update's transaction: Yes decides the card through the console's door, once; Cancel puts
- * the card's own buttons back. The caller has proved the binding, chat and message are the ones it was armed on. */
-export declare function applyFlowConfirm(store: Store, binding: TelegramBinding, confirm: FlowConfirm, message: {
-    text: string;
-}, repos: readonly string[] | null, now: Date): FlowTapEffect[];
-export type FlowReplyEffect = {
-    kind: "say";
-    text: string;
-}
-/** The edited draft, back for a decision: send it with these buttons, then place them. */
- | {
-    kind: "decide";
-    text: string;
-    keyboard: InlineButton[][];
-    tokens: string[];
-};
-/** A reply to an Edit or Send back prompt, applied inside the update's transaction. */
-export declare function applyFlowReply(store: Store, binding: TelegramBinding, prompt: TelegramFlowPrompt, text: string, repos: readonly string[] | null, now: Date): FlowReplyEffect[];
-export {};

package/dist/telegram-lead.d.ts

@@ -1,151 +0,0 @@
-import { type PhoneLink } from "./chat-channel.js";
-export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps, type PhoneLink, type ResolvedLead, type ParitySupport } from "./chat-channel.js";
-import { type LeadAsk, type Store, type TelegramBinding } from "./store.js";
-import type { SubscriptionLeadRunner } from "./subscription-chat.js";
-import { type TelegramLiveTiming } from "./telegram-live.js";
-import type { TelegramTransport } from "./telegram.js";
-import { type TelegramCallbackButton, type TelegramUpdate } from "./contracts/telegram-callback.js";
-/** How long one claimed turn may go without a heartbeat before another poller may take it over. */
-export declare const CONVERSATION_CLAIM_MS: number;
-/** A busy engine (one turn at a time) defers a queued message this long, up to the age bound below. */
-export declare const CONVERSATION_RETRY_MS = 5000;
-export declare const CONVERSATION_MAX_AGE_MS: number;
-/** Waiting for the lead itself (it is answering, or earlier messages wait in the person's lead queue) is bounded longer:
- * two hours from the message's arrival, never reset as it moves from waiting behind the queue to waiting on a turn. */
-export declare const CONVERSATION_WAIT_MAX_AGE_MS: number;
-/** A card's buttons live this long; its armed Yes and Cancel last CONFIRM_TTL_MS. */
-export declare const CARD_TTL_MS: number;
-/** Telegram's own message ceiling, with room for our part headers (the same bound telegram.ts splits at). */
-export declare const PART_CAP = 3900;
-export type TelegramConversationOptions = {
-    /** Where evidence lives — the same root the console and CLI read results from. */
-    evidenceRoot: string;
-    /** Injected by tests; production invokes the isolated local harness. */
-    subscriptionRunner?: SubscriptionLeadRunner;
-    /**
-     * The https origin a phone link may open, read again on EVERY call (a
-     * card is linked immediately before it is sent or edited, never from a
-     * stored URL), or null when no trusted origin is configured. Production
-     * wires `phoneOrigin` from webhooks.ts; absent, no card carries a link.
-     */
-    phoneOrigin?: () => string | null;
-    /** Injected by tests: how a Merge tapped in chat reaches GitHub (production: mergePullRequest). */
-    merge?: (input: {
-        runId: number;
-        by: string;
-    }) => Promise<{
-        ok: true;
-    } | {
-        ok: false;
-        message: string;
-    }>;
-    /** Injected by tests: the live reply's timings (telegram-live.ts); production uses its defaults. */
-    liveTiming?: TelegramLiveTiming;
-};
-/** One Bot API call, the shape telegram.ts injects. */
-export type Transport = TelegramTransport;
-/**
- * The phone's project ceiling: the enrolled registry, canonicalized and
- * deduplicated IN ORDER exactly as the console's managed list is, then
- * narrowed to what this approver's account may access. Order matters —
- * `r1..rN` is an index and the ceiling digest hashes the order — so a
- * console session over the same enrollment shares its digest here.
- */
-/** The engine's request identity for one inbound message: exact bot, binding and update, never text. */
-export declare function telegramRequestId(botId: string, bindingId: number, updateId: number): string;
-/** The one channel problem that is transient: the registry could not be read now. Retried, never a refusal. */
-export declare const UNREADABLE_REGISTRY = "current project access could not be read";
-/**
- * Is the channel still what a turn opened under? The live binding must be
- * the SAME row and generation, its approver still an approver, and the
- * enrolled ceiling (reloaded now) still the exact list the principal
- * holds — or, for a reply recovered after a restart, the ceiling digest
- * its session was minted under. A string names what changed; null means
- * nothing did.
- */
-export declare function telegramChannelProblem(store: Store, expected: {
-    botId: string;
-    bindingId: number;
-    approverGeneration: number;
-} & ({
-    repos: readonly string[];
-} | {
-    ceilingDigest: string;
-}), readProjects: () => Promise<readonly string[]>): Promise<string | null>;
-export declare function phoneLinkButton(origin: string | null, link: PhoneLink | null): InlineButton[] | null;
-/** One inline button: an opaque callback token (a real in-chat act) or a url (navigation, never authority). */
-/** The buttons under the lead's question: options two to a row, then "Something else". Each names the turn and the
- * option's place, nothing more; a tap re-proves that the question is still open and is the tapper's own. */
-export declare function askKeyboard(ask: LeadAsk): CallbackKeyboard;
-export type InlineButton = TelegramCallbackButton | {
-    text: string;
-    url: string;
-};
-type Keyboard = InlineButton[][];
-/** What a part persists: callback tokens only. A url is minted at send time, never stored. */
-type CallbackKeyboard = TelegramCallbackButton[][];
-/** Mint the card's tokens before the send, so a tap can never name a token that does not exist. */
-export declare function mintCardTokens(store: Store, binding: TelegramBinding, proposal: number, now: Date, messageId?: string, chatId?: string): {
-    keyboard: CallbackKeyboard;
-    tokens: string[];
-};
-export type CardEffect = {
-    kind: "ack";
-    text: string;
-} | {
-    kind: "edit";
-    text: string;
-    keyboard?: Keyboard;
-} | {
-    kind: "signal";
-    run: () => void;
-};
-/**
- * One tap on a proposal card, applied inside the update's own transaction
- * by the bridge (which already proved the live binding, the exact sender
- * and the exact chat). Returns what to tell Telegram afterwards. The
- * principal is minted from the binding row against the CURRENT enrolled
- * ceiling; the door re-proves standing, ceiling, session and the
- * proposal's own terms again inside its transaction.
- */
-export declare function applyProposalTap(store: Store, binding: TelegramBinding, token: string, message: NonNullable<NonNullable<TelegramUpdate["callback_query"]>["message"]>, repos: readonly string[] | null, options: TelegramConversationOptions, now: Date): {
-    effects: CardEffect[];
-    confirmed: boolean;
-    ignored: boolean;
-};
-/** A handoff card as sent or repainted: its persisted words, plus the one line saying why no link rides it. */
-export type ConversationReport = {
-    answered: number;
-    refused: number;
-    problems: string[];
-};
-/** A part's next attempt after a failed send: bounded backoff by attempt, or Telegram's own retry_after when it named a longer one. */
-export declare const PART_RETRY_MS: readonly [5000, 15000, 60000, 300000];
-/** Unsent parts are retried this long after the message arrived (the card's own lifetime); then the row fails, explicitly unsent. */
-export declare const DELIVERY_MAX_AGE_MS: number;
-export declare function splitParts(text: string): string[];
-/**
- * Run every claimable queued message for this bot, one at a time, each
- * outside any SQLite transaction. The caller holds the poll lease and
- * renews it; the row's own claim is renewed here. Bounded per call so a
- * flood cannot pin one pass forever.
- *
- * `only` splits the work for the follower: "turns" runs the model and
- * persists the reply but leaves the sending to the bridge's own cycle,
- * which calls back with "replies" — so a reply goes out from the same
- * place, in the same order and over the same connection as notifications,
- * never beside a long poll. Absent, a row is answered and sent in one go.
- */
-export declare function processTelegramConversations(args: {
-    store: Store;
-    botId: string;
-    transport: Transport;
-    owner: string;
-    clock: () => Date;
-    readProjects: () => Promise<readonly string[]>;
-    options: TelegramConversationOptions;
-    report: ConversationReport;
-    signal?: AbortSignal;
-    limit?: number;
-    only?: "turns" | "replies";
-}): Promise<void>;