toolroll 0.9.103 → 0.9.105

package/dist/tui-contract.d.ts

@@ -1,144 +0,0 @@
-/**
- * What the terminal UI (src/tui, bundled into dist/tui.js) reads and asks for, and nothing more. The CLI side
- * (tui-source.ts) implements it with in-process reads of this installation's database and with every write sent
- * through `runOperate` as the local owner (local-owner.ts runAsLocalOwner), so the screen holds no authority of its
- * own: a write the local owner may not make is refused there, and the screen shows the refusal's words.
- *
- * Types only, with no imports: both the CLI build (tsc) and the terminal UI bundle (esbuild) read this file.
- */
-/** One task in the list, as the board says it. */
-export type TuiRow = {
-    readonly id: string;
-    readonly title: string;
-    /** The board's one status word (Needs you, Running, Ready, …). */
-    readonly status: string;
-    readonly detail: string;
-    readonly needsYou: boolean;
-    /** The attempt running now, if any: what Stop names. */
-    readonly liveRunId: number | null;
-    readonly repo: string | null;
-    /** Home's group (home-groups.ts homeGroupOf): waits on you, working, done, or none (cancelled, replaced). */
-    readonly group: "you" | "working" | "done" | null;
-};
-/** A parked question on a task, answered by choosing one of its options. */
-export type TuiDecision = {
-    readonly id: number;
-    readonly question: string;
-    readonly options: readonly {
-        readonly id: string;
-        readonly label: string;
-    }[];
-};
-/** One task in full. */
-export type TuiTask = {
-    readonly id: string;
-    readonly title: string;
-    readonly status: string;
-    readonly detail: string;
-    /** The plan waiting for approval: its exact digest (what the yes binds) and every line of it. Null: none waits. */
-    readonly plan: {
-        readonly digest: string;
-        readonly lines: readonly string[];
-    } | null;
-    readonly liveRunId: number | null;
-    /** A finished result that can be marked Complete or sent back with a revision. */
-    readonly hasResult: boolean;
-    readonly decisions: readonly TuiDecision[];
-    /** "Can I merge?" (merge-checklist.ts, `toolroll task ready`'s lines): the answer, then each check. Empty: no result. */
-    readonly ready?: readonly string[];
-};
-/** The welcome's steps, as lines (welcome-facts.ts). */
-export type TuiSetup = {
-    readonly left: number;
-    readonly lines: readonly string[];
-};
-export type TuiSnapshot = {
-    readonly rows: readonly TuiRow[];
-    /** One line about what waits on the person, or null when nothing does. */
-    readonly needsYou: string | null;
-    /** The projects tasks can be filed in (the first is the default). */
-    readonly projects: readonly string[];
-    /** Whether the local owner has set a password (decides where a refusal leads). */
-    readonly passwordSet: boolean;
-    /** One line about flaky tests and project memory waiting, and the commands that show them; null when there's nothing. */
-    readonly learning?: string | null;
-};
-export type TuiAct = {
-    readonly kind: "new";
-    readonly text: string;
-    readonly repo: string | null;
-}
-/** Build: the terms the person just read (fast-start.ts). */
- | {
-    readonly kind: "build";
-    readonly preview: string;
-    readonly digest: string;
-} | {
-    readonly kind: "approve";
-    readonly id: string;
-    readonly digest: string;
-} | {
-    readonly kind: "stop";
-    readonly id: string;
-    readonly runId: number;
-} | {
-    readonly kind: "revise";
-    readonly id: string;
-    readonly text: string;
-} | {
-    readonly kind: "complete";
-    readonly id: string;
-} | {
-    readonly kind: "retry";
-    readonly id: string;
-} | {
-    readonly kind: "answer";
-    readonly decision: number;
-    readonly option: string;
-};
-/** What Build would approve: the same lines every approval surface reads. */
-export type TuiFastTerms = {
-    readonly preview: string;
-    readonly digest: string;
-    readonly terms: readonly {
-        readonly label: string;
-        readonly words: string;
-    }[];
-};
-/** A write's answer: its words. `needsPassword`: refused because the local owner may not do it. */
-export type TuiActResult = {
-    readonly ok: true;
-    readonly message: string;
-    readonly id?: string;
-} | {
-    readonly ok: false;
-    readonly message: string;
-    readonly needsPassword: boolean;
-};
-/** The plane, as the screen sees it. */
-export interface TuiSource {
-    snapshot(): Promise<TuiSnapshot>;
-    task(id: string): Promise<TuiTask | null>;
-    /** The newest output lines of the task's live attempt (empty when none runs). */
-    live(id: string): readonly string[];
-    /** A counter that moves when the plane's work changes (the store's wake sequence). */
-    changed(): number;
-    act(act: TuiAct): Promise<TuiActResult>;
-    /** A small task's exact terms, or null when it takes the ordinary road (New task then files it). */
-    fastTerms(text: string, repo: string | null): Promise<TuiFastTerms | null>;
-    /** The welcome's steps, or null once setup is done. */
-    setup(): Promise<TuiSetup | null>;
-}
-/** What only the process that opened the screen knows: whether quitting stops its agents, the browser, the ask-once. */
-export interface TuiSession {
-    /** Quitting would stop the Toolroll this terminal started (no background service runs it). */
-    owned(): boolean;
-    /** Open this computer's browser on the console, signed in. Resolves with what to say. */
-    openBrowser(): Promise<string>;
-    /** Whether to ask, now, "Keep Toolroll running in the background?" (once per installation). */
-    shouldAskBackground(): boolean;
-    /** Record the answer; yes moves Toolroll to the background service. Resolves with what to say. */
-    answerBackground(yes: boolean): Promise<string>;
-}
-/** How the screen ended: leave as it is, stop the agents this terminal started, or keep them running in the background. */
-export type TuiExit = "leave" | "stop" | "keep";

package/dist/tui-source.d.ts

@@ -1,14 +0,0 @@
-import type { OperateOptions } from "./operate.js";
-import type { ConnectionChecker } from "./provider-connection.js";
-import type { TuiSource } from "./tui-contract.js";
-export type TuiSourceOptions = {
-    databaseFile: string;
-    clock?: () => Date;
-    /** Passed to every runOperate (tests: a fixed clock, seams). */
-    operate?: OperateOptions;
-    /** The agents' sign-in check for the Setup screen (tests pass their own). */
-    check?: ConnectionChecker;
-};
-export declare function createTuiSource(options: TuiSourceOptions): TuiSource & {
-    close(): void;
-};

package/dist/typed-start.d.ts

@@ -1,51 +0,0 @@
-import type { Store } from "./store.js";
-/** The card's last line on Telegram, outside the terms (terms are digest-bound), in Toolroll's fixed words. */
-export declare const TYPED_START_LINE = "Tap Start work, or reply yes.";
-/** What a yes that counted for nothing says. It is never passed to the lead. */
-export declare const TYPED_START_REFUSED = "That yes didn't start anything. Tap Start work on the card.";
-/** Whether a typed message is exactly one of the fixed yes words: trimmed, lower-cased, one trailing `.` or `!` removed.
- * Anything longer or different ("yes but make it blue", "ok", "sure") is an ordinary message to the lead. */
-export declare function typedYes(text: string): boolean;
-export type TypedStartCard = {
-    proposal: number;
-    cardMessage: string;
-    stamp: string;
-    how: "reply" | "next";
-};
-/**
- * The Start card a yes in this chat answers, by ids, or null. Every condition from the plan:
- * - the chat's last sent card is a card for a `task_start` proposal: sent (a confirmed message id), never
- *   uncertain, the last part of its event, sent with its buttons and the fixed "reply yes" line, its terms whole on the
- *   card (sharedActionAllowsChallenge);
- * - the message is a Telegram reply to that card's message (`reply`), or replies to nothing and its message id is the
- *   card's plus one (`next`): nothing at all was sent or typed in the chat between them;
- * - the proposal is pending, the only pending proposal in the person's own thread with the lead (never a team room),
- *   drafted in a turn that answered (one finalized after a timeout doesn't qualify).
- */
-export declare function typedStartCard(store: Store, chat: {
-    binding: number;
-    chatId: string;
-    approver: string;
-}, message: {
-    id: string;
-    replyTo: string | null;
-}): TypedStartCard | null;
-/** Record a typed yes for the message just saved (event `m<update_id>`), in the caller's transaction. */
-export declare function recordTypedStart(store: Store, event: string, card: TypedStartCard, now: Date): void;
-export type TypedStartRow = {
-    provider: "telegram";
-    event: string;
-    proposal: number;
-    cardMessage: string;
-    stamp: string;
-    how: "reply" | "next";
-    outcome: "started" | "refused" | "not-counted" | null;
-    taskId: string | null;
-};
-/** A message's typed-yes record, or null when it has none. */
-export declare function typedStartOf(store: Store, provider: "telegram", event: string): TypedStartRow | null;
-/** Whether an UNSETTLED typed yes names exactly this proposal: the only thing `typedStart` may open, and only once. */
-export declare function typedStartNames(store: Store, typed: {
-    provider: string;
-    event: string;
-}, proposal: number): boolean;

package/dist/unfenced-test-support.d.ts

@@ -1,2 +0,0 @@
-import type { Store } from "./store.js";
-export declare function allowWhereUnfenced<T extends Store>(store: T): T;

package/dist/up-processes.d.ts

@@ -1,162 +0,0 @@
-export type UpRoleName = "console" | "worker";
-export type UpConsoleConfig = {
-    host: string;
-    port: number;
-    allowedHosts: string[] | null;
-    publicUrl: string | null;
-    localRunner: string;
-    poolRoot: string;
-    repos: string[];
-    projectRoots: string[];
-    registryPath: string;
-    editor: boolean;
-    /** Easy-start C4: how `up` itself was authorised at this start ("full": a password verified; "local": local mode's
-     * owner; "none": nothing). The console mints a sign-in link only of this kind, whatever a later message asks for. */
-    startAuthority: UpStartAuthority;
-};
-/** How an `up` start was authorised (resolveUpApprover). */
-export type UpStartAuthority = "full" | "local" | "none";
-export type UpWorkerConfig = {
-    runner: string;
-    token: string;
-    repos: string[];
-    pinnedRepos: string[];
-    projectRoots: string[];
-    registryPath: string;
-    pool: string;
-    forMs: number | null;
-    publicUrl: string | null;
-    stopGraceMs: number;
-    verbose: boolean;
-    terminal: boolean;
-    /** How long a start waits for a predecessor's watch lease to expire (a crashed worker's, after a restart). */
-    leaseWaitMs: number;
-    /** Saved projects this start couldn't reach (a folder that didn't answer, a drive not connected): looked at again
-     * while it runs, and connected once they answer, on the same saved-list authority the start had. */
-    deferredRepos?: string[];
-    /** Each of those lines' removal count when this start read the saved list: a different count at binding means it was
-     * removed since (even if saved again), and the start's authority for it is gone. */
-    deferredGenerations?: Record<string, number>;
-    /** The saved line each of `repos` was proved from: a project stays while its line is saved, whatever else answers. */
-    repoLines?: Record<string, string[]>;
-};
-export type UpRoleStart = {
-    type: "start";
-    role: "console";
-    databaseFile: string;
-    containment: string | null;
-    build: string;
-    config: UpConsoleConfig;
-} | {
-    type: "start";
-    role: "worker";
-    databaseFile: string;
-    containment: string | null;
-    build: string;
-    config: UpWorkerConfig;
-};
-export type ParentToRole = {
-    type: "repos";
-    repos: string[];
-} | {
-    type: "stopping";
-} | {
-    type: "hard-stop";
-}
-/** A full link names its account; a local one names none (the console reads local mode's owner itself). */
- | {
-    type: "sign-in-link";
-    id: number;
-    kind: "full";
-    account: string;
-} | {
-    type: "sign-in-link";
-    id: number;
-    kind: "local";
-};
-export type RoleToParent = {
-    type: "ready";
-    role: UpRoleName;
-    build: string;
-    pid: number;
-    url: string | null;
-    port: number | null;
-} | {
-    type: "log";
-    line: string;
-} | {
-    type: "repos";
-    repos: string[];
-}
-/** The saved projects the worker still holds start authority for (it only ever shrinks: connected or removed). */
- | {
-    type: "deferred";
-    repos: string[];
-} | {
-    type: "failed";
-    reason: "port-busy" | "start";
-    detail: string;
-} | {
-    type: "fatal";
-    detail: string;
-} | {
-    type: "sign-in-link";
-    id: number;
-    link: string | null;
-} | {
-    type: "closed";
-    problem: string | null;
-};
-/** One role's side of the channel: the same shape over IPC (a child process) and in memory (one process). */
-export type RolePort = {
-    send: (message: RoleToParent) => void;
-    onMessage: (handler: (message: ParentToRole) => void) => void;
-    /** First call: drain. Every later call: stop now (the second signal's hard stop). */
-    onStop: (handler: (hard: boolean) => void) => void;
-};
-/** The parent's word to a role, checked before anything acts on it. */
-export declare function parentMessage(value: unknown): ParentToRole | null;
-/** A role's word to the parent, checked before the parent relays or acts on it. */
-export declare function roleMessage(value: unknown, role: UpRoleName): RoleToParent | null;
-/** The start message a role child waits for. The console's config carries no runner token; anything else refuses. */
-export declare function startMessage(value: unknown): UpRoleStart | null;
-/** Two ends of an in-memory channel: one process composing both roles (tests and the desktop host), same messages. */
-export declare function memoryChannel(role: UpRoleName): {
-    port: RolePort;
-    parent: {
-        send: (message: ParentToRole) => void;
-        onMessage: (handler: (message: RoleToParent) => void) => void;
-        stop: (hard: boolean) => void;
-    };
-};
-/** A build identity: the version and the exact code of the module that composes `up`. Both roles must report the
- * parent's own, or the parent stops rather than run a console and a worker from different builds. */
-export declare function buildIdentity(version: string, moduleFile: string): string;
-/** How many replacements in a row may end before becoming ready, with no refusal said, before `up` stops. */
-export declare const ROLE_NOT_READY_REPLACEMENTS = 3;
-/**
- * One supervised role's generations (Codex review round 1, finding 5): readiness is per generation, not for the role's
- * whole life. When a generation ends, the verdict is:
- * - `fail-start`: the role never became ready at all; the start fails as one, as before the split;
- * - `restart`: this generation was ready and crashed afterwards (the supervisor starts it again);
- * - `end`: a replacement refused to start (another build, another database, a start refused) — permanent, so the whole
- *   `up` stops rather than loop — or ROLE_NOT_READY_REPLACEMENTS replacements in a row ended before readiness.
- */
-export declare class RoleGenerations {
-    private everReady;
-    private generationReady;
-    private refusal;
-    private notReadyStreak;
-    /** A new generation was spawned: nothing about it is known yet. */
-    spawned(): void;
-    /** This generation became ready; true when it is the role's first readiness ever. */
-    ready(): boolean;
-    /** This generation refused its start for good (it said why, or its build is another). */
-    refused(detail: string): void;
-    /** What this generation said when it refused, if it did. */
-    refusedWith(): string | null;
-    /** Whether any generation ever became ready. */
-    wasReady(): boolean;
-    /** This generation ended (not stopped by `up`): what happens next. */
-    ended(): "fail-start" | "restart" | "end";
-}

package/dist/up-role-child.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/update-notice.d.ts

@@ -1,5 +0,0 @@
-/** The update notice's words, shared by the server page and the console. Plain text; callers escape. */
-export declare function updateNoticeWords(notice: {
-    version: string;
-    security: boolean;
-}): string;

package/dist/vanished-retry.d.ts

@@ -1,30 +0,0 @@
-import { type Store } from "./store.js";
-/** The automatic-retry limits, in one place. */
-export declare const RETRY_LIMIT = 3;
-export declare const RETRY_SPEND_TIMES = 2;
-/** claim.ts MAX_STRIKES (store.ts loads this file, so the claim road isn't imported here; a test pins them equal). */
-export declare const VANISHED_MAX_STRIKES = 3;
-/** What recovery did with a task: back in the queue, waiting for its old process to be proven stopped, stopped for a
- * person, or nothing at all (not a task of ours to move). */
-export type VanishedAnswer = "queued" | "waiting" | "stopped" | "none";
-export type RetryStop = "no-budget" | "attempts" | "spend";
-/**
- * The one recovery decision, once per run. The caller has proved the runner gone; this re-reads everything else. A
- * task a tick claimed never left `queued`, so releasing its lease alone would dispatch it again: what stops a retry here
- * is the state or hold this writes, in this transaction. Safe to call again: the run is charged once, decided once.
- */
-export declare function settleVanished(store: Store, taskRef: number, now: Date): VanishedAnswer;
-/** Each sweep: a charged run whose old process wasn't yet proven stopped gets its decision now. */
-export declare function retryVanishedWhenStopped(store: Store, now: Date): number;
-/** A person acted, so a new episode starts. The strikes are theirs to clear on their own road. */
-export declare function clearRetryEpisode(store: Store, taskRef: number): void;
-/** Why Toolroll stopped retrying this task, or null: it reads as a need until a person acts. */
-export declare function vanishedStopOf(store: Store, taskRef: number): {
-    why: RetryStop;
-    run: number;
-} | null;
-/** The need's words: the first stop on a plan with no budget, or a limit reached. */
-export declare function vanishedStopSentence(stop: {
-    why: RetryStop;
-    run: number | null;
-}): string;

package/dist/verification-evidence.d.ts

@@ -1,68 +0,0 @@
-import type { Artifact, Store, VerifyCommand } from "./store.js";
-import type { VerifyCommandFacts } from "./proof.js";
-import { type AdjudicateResult } from "./proof.js";
-import { type ComposedLinks, type Coverage } from "./release-recheck.js";
-export declare const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
-export declare const isVerificationReceipt: (a: Artifact) => boolean;
-/** A release check's own facts for a version 3 receipt (release-once.md): its coverage, its sealed check artifacts, and
- * for a composed check the links its reader proves again. */
-export type ReleaseCheckFacts = {
-    coverage: Coverage;
-    check: {
-        attempt: "full" | "targeted";
-        report: string | null;
-        inventory: string | null;
-        exitCode?: number | null;
-        retried?: string[] | null;
-    };
-    composed: ComposedLinks | null;
-};
-/** Whether a coverage lets a check pass: only full or composed (absent: a check that isn't a release check). */
-export declare const coveragePasses: (coverage: unknown) => boolean;
-/**
- * THE one place a release check's coverage meets its outcome (security review): a check whose coverage is partial or
- * identity-removed is a failed attempt for every reader — the verdict, the run's check, the receipt's `result`, reuse,
- * follow-ups, the deploy gates — whatever its command exited with. The raw exit is kept in the receipt's `check`.
- */
-export declare function effectiveCheckFacts(raw: VerifyCommandFacts, facts: ReleaseCheckFacts | null): {
-    result: VerifyCommandFacts;
-    facts: ReleaseCheckFacts | null;
-};
-export declare function sealVerificationReceipt(store: Store, root: string, runId: number, head: string, command: VerifyCommand, result: VerifyCommandFacts, now: Date, reusedFrom?: {
-    run: number;
-    digest: string;
-}, release?: ReleaseCheckFacts): void;
-/** Read and bind existing evidence, never backfill historical receipts. A legacy
- * single-attempt machine header is sufficient only with its exact approved grant
- * and sealed candidate endpoints. Recovery logs without a receipt stay explicit. */
-export declare function verificationEvidence(store: Store, root: string, runId: number): {
-    ok: true;
-    bytes: string | null;
-    digest: string;
-} | {
-    ok: false;
-    problem: string;
-};
-/** Only a sealed failed check can start unattended diagnosis. Lost custody,
- * changed approvals/trees and incomplete evidence still need attention; they
- * must not become another code-writing attempt. Keep the log out of the small
- * revision artifact and re-read it when the repair builder starts. */
-export declare function failedVerificationEvidence(store: Store, root: string, runId: number): {
-    kind: "none";
-} | {
-    kind: "unavailable";
-    problem: string;
-} | {
-    kind: "failed";
-    digest: string;
-    receipt: string;
-    log: string;
-};
-/** A fresh review may assess a pre-upgrade result which stopped solely because
- * no builder proof was written. Read original sealed facts; never run checks,
- * backfill receipts, rewrite artifacts, or reuse a different candidate's gate.
- * Called inside review ingestion, after its exact bindings have been proved. */
-export declare function assessmentFromSavedEvidence(store: Store, root: string, runId: number): AdjudicateResult | null;
-/** Reuse is exclusive to a machine-authored observation revision, with its
- * own current approval and complete new observations. Never synthesize a pass. */
-export declare function reuseObservationVerification(store: Store, root: string, runId: number, now: Date): VerifyCommandFacts | null;

package/dist/version.d.ts

@@ -1,2 +0,0 @@
-/** The package's own version, read from package.json beside dist/ or src/ — one source, never a literal. */
-export declare const PACKAGE_VERSION: string;

package/dist/wake-hub.d.ts

@@ -1,72 +0,0 @@
-/**
- * One shared wake poller per process (docs/plans/live-wakeups.md, slice 3).
- *
- * Every dispatch loop and build lane used to doze by reading `wakeSeq()` from SQLite every 50 ms on its own, so a
- * service with twelve projects and eight lanes made hundreds of reads a second while idle. The hub keeps ONE timer
- * per store: it runs only while something waits, reads the counter once per beat, and resolves each waiter whose
- * baseline the counter has passed.
- *
- * - A waiter resolves with why: "wake" (the counter moved past its baseline), "deadline" (its time came), or "poke"
- *   (its `until` became true, or someone poked it directly: a stop, a lost lease, a recovered reconciliation).
- * - No lost wakeup. The counter only ever moves forward, so a bump that lands after the caller read its baseline and
- *   before it registered is seen on the very next read. Registration is synchronous; nothing yields in between.
- * - Every waiter is checked on every beat (50 ms, well inside the one-second floor the plan asks for), including its
- *   `until`, which must be cheap and in-memory: it never reads the database.
- * - The hub only gives promptness, never permission: claim and spawn fences re-prove everything after a wake.
- * - Nothing here watches files or listens to commits. The timer is cleared as soon as nobody waits, so a stopped
- *   worker (or a finished test) keeps no timer alive.
- */
-export type WakeWhy = "wake" | "deadline" | "poke";
-/** Something a caller can poke to end the waits registered with it, now (a stop, a lost lease, a recovery). */
-export declare class WakePoker {
-    private readonly listeners;
-    poke(): void;
-    /** @internal */
-    listen(listener: () => void): () => void;
-}
-export type WakeWaiter = {
-    /** The counter value the caller last acted on. Any later value wakes it. */
-    baseline: number;
-    /** Epoch milliseconds: resolve with "deadline" once the clock reaches it. */
-    deadline: number;
-    /** A cheap, in-memory condition checked every beat (never a database read); true resolves with "poke". */
-    until?: () => boolean;
-    /** Pokes on this end the wait at once with "poke". */
-    poker?: WakePoker;
-};
-export type WakeHubOptions = {
-    /** How often the one timer reads the counter while something waits. */
-    intervalMs?: number;
-    now?: () => number;
-    setTimer?: (fn: () => void, ms: number) => unknown;
-    clearTimer?: (handle: unknown) => void;
-};
-export declare const WAKE_HUB_INTERVAL_MS = 50;
-export declare class WakeHub {
-    private readonly read;
-    private readonly waiters;
-    private timer;
-    private readonly intervalMs;
-    private readonly now;
-    private readonly setTimer;
-    private readonly clearTimer;
-    private readsMade;
-    constructor(read: () => number, options?: WakeHubOptions);
-    /** Wait until the counter passes `baseline`, the deadline comes, or the waiter is poked. */
-    changed(waiter: WakeWaiter): Promise<WakeWhy>;
-    /** End every wait in this process now (the service's stop signal). */
-    poke(): void;
-    /** How many waits are open (tests and diagnostics). */
-    waiting(): number;
-    /** Whether the beat timer is running (tests). */
-    running(): boolean;
-    /** How many counter reads the hub has made (tests: one per beat, whatever the number of waiters). */
-    reads(): number;
-    private arm;
-    private idleIfEmpty;
-    private beat;
-}
-/** The one hub for this store (one per process under `up`, which shares a store across project loops). */
-export declare function wakeHubFor(store: {
-    wakeSeq(): number;
-}): WakeHub;

package/dist/webhook-limits.d.ts

@@ -1,23 +0,0 @@
-/**
- * Webhook floods (docs/plans/webhook-tasks.md §4): how many deliveries a trigger's address may fail in a minute. Held
- * in memory per store (a restart forgets it, which is harmless: it protects the process and the database's write rate,
- * not anything durable). It counts only what doesn't prove itself — a bad, missing or stale signature, an address that
- * isn't set up, an unknown address, and every delivery to an unsigned webhook (nothing proves those) — so a stranger
- * holding a leaked address can't crowd out the deliveries that are signed.
- */
-import type { Store } from "./store.js";
-/** At most this many unproven deliveries per address a minute; over it, further ones are answered 429 and do nothing. */
-export declare const UNPROVEN_PER_MINUTE = 60;
-/** Addresses that match no trigger share one count. */
-export declare const UNKNOWN_ADDRESS = "unknown";
-/** Count one unproven delivery to `address` at `now`. Whether it is over the minute's limit, and when to try again. */
-export declare function countUnproven(store: Store, address: string, now: Date): {
-    over: false;
-} | {
-    over: true;
-    retryAfterSeconds: number;
-};
-/** At most this many cards a trigger makes in a rolling hour (counted when each card is made). */
-export declare const CARDS_PER_HOUR = 30;
-/** At most this many signed deliveries a trigger holds while it waits for room; beyond it, deliveries are turned away. */
-export declare const HELD_AT_MOST = 200;

package/dist/webhook-readers.d.ts

@@ -1,56 +0,0 @@
-import type { WebhookSender } from "./webhook-signing.js";
-/** A webhook trigger's reading settings (its saved config, defaults filled). */
-export type ReaderSettings = {
-    sender: WebhookSender;
-    title: string;
-    titleField: string | null;
-    bodyField: string | null;
-    idField: string | null;
-    urlField: string | null;
-    project: string | null;
-    team: string | null;
-};
-/** What one delivery is, once read: an item (with the outside thing's identity and link, when it has them), a delivery
- * whose configured identity couldn't be used (made into nothing, with why), or one that isn't for this flow. */
-export type ReadDelivery = {
-    kind: "item";
-    identity: string | null;
-    url: string | null;
-    title: string;
-    description: string;
-    label: string;
-} | {
-    kind: "skip";
-    why: string;
-} | {
-    kind: "ignored";
-    why: string;
-};
-/** Whether outside words could hold a key or password (the same check cards' words get). */
-export declare const looksSecret: (value: string) => boolean;
-/** Where a sender's links may point: its own host, and (for Sentry) the organisation subdomains under it. */
-export type LinkHosts = readonly {
-    host: string;
-    subdomains: boolean;
-}[];
-export declare const SENTRY_HOSTS: LinkHosts;
-export declare const VERCEL_HOSTS: LinkHosts;
-/**
- * A link kept from a delivery: absolute https, at most 2,000 characters, no user information, and with its query and
- * fragment dropped (where tokens travel). `hosts` narrows it to a sender's own site (and its subdomains). Null when it
- * isn't one, or when what is left could still hold a secret.
- */
-export declare function safeLink(value: unknown, hosts: LinkHosts | null): string | null;
-/** The identity words a key may carry: at most 120 characters, nothing hidden, and nothing that looks like a secret. */
-export declare function identityOf(value: unknown): {
-    ok: true;
-    id: string;
-} | {
-    ok: false;
-    why: string;
-};
-/** Whether each provider's reader has read a real, captured delivery (test/fixtures/webhooks/*.captured.json), or only
- * its sender's documented examples so far: the panel says which until a captured one is in the suite. */
-export declare const READER_CAPTURED: Record<"sentry" | "vercel", boolean>;
-/** What a proven delivery says, by its sender's reader. */
-export declare function readDelivery(body: unknown, settings: ReaderSettings): ReadDelivery;