toolroll 0.9.103 → 0.9.105

package/dist/webhook-signing.d.ts

@@ -1,27 +0,0 @@
-import { WEBHOOK_SENDERS } from "./contracts/flow.js";
-export { WEBHOOK_SENDERS };
-export type WebhookSender = (typeof WEBHOOK_SENDERS)[number];
-/** The senders whose deliveries carry a signature (everything but `none`). */
-export type SigningSender = Exclude<WebhookSender, "none">;
-export declare const SENDER_WORDS: Record<WebhookSender, string>;
-/** Node's `headersDistinct`: every header's values, one per line it arrived on. */
-export type DistinctHeaders = Record<string, string[] | undefined>;
-export type Proof = {
-    ok: true;
-    signedId: string | null;
-} | {
-    ok: false;
-    said: string;
-};
-/** A Standard Webhooks timestamp may be this far from now, either way. */
-export declare const STANDARD_TOLERANCE_MS: number;
-/** A `whsec_` secret's key bytes, or null when it isn't one. */
-export declare function standardKey(secret: string): Buffer | null;
-/** Whether a delivery was signed with this secret by this sender. `none` proves nothing and is never passed here. */
-export declare function proveDelivery(sender: SigningSender, secret: string, headers: DistinctHeaders, body: Buffer, now: Date): Proof;
-/** Whether a pasted secret has its sender's shape (Sentry's and Vercel's come from them; the others can be made here). */
-export declare function secretShapeOk(sender: SigningSender, secret: string): boolean;
-/** A new secret for a sender Toolroll can make one for; Sentry's and Vercel's are pasted from them. */
-export declare function makeSecret(sender: "standard" | "github-style"): string;
-/** Whether Toolroll makes this sender's secret (and shows it once), rather than asking for the sender's own. */
-export declare const makesSecret: (sender: SigningSender) => sender is "standard" | "github-style";

package/dist/webhooks.d.ts

@@ -1,84 +0,0 @@
-import type { Notification, Store } from "./store.js";
-export type WebhookKind = "slack" | "discord";
-export type WebhookTarget = {
-    kind: WebhookKind;
-    url: string;
-};
-export declare const LEGACY_WEBHOOK_WARNING = "Legacy webhooks are deprecated. Connect Slack or Discord in Chat settings.";
-export declare const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
-export type MessagingChannel = "telegram" | "slack" | "discord" | "teams";
-export declare const MESSAGING_CHANNELS: readonly MessagingChannel[];
-export declare function isMessagingChannel(value: string): value is MessagingChannel;
-export declare function saveConsoleUrl(dir: string, url: string): {
-    ok: true;
-} | {
-    ok: false;
-    message: string;
-};
-/** Every configured mirror. Environment wins over files, like the bot token. */
-export declare function loadWebhookTargets(env: Record<string, string | undefined>, dir: string): WebhookTarget[];
-/** The operator's explicit choice of which service carries the pages. */
-export declare function savePrimary(dir: string, channel: MessagingChannel): void;
-export declare function loadPrimary(env: Record<string, string | undefined>, dir: string): MessagingChannel | null;
-/**
- * Which service actually carries the pages, and whether that was chosen or
- * merely fell out of what happens to be configured. Explicit choice wins
- * WHEN its channel is actually configured (a primary pointing at nothing
- * falls through rather than silencing every page); otherwise Telegram if
- * present (it can hold buttons), else the first other connected service. `implicit` is the flag
- * every status surface uses to say "you have several — pick one".
- */
-export declare function effectivePrimary(env: Record<string, string | undefined>, dir: string, telegramConfigured: boolean): {
-    channel: MessagingChannel | null;
-    implicit: boolean;
-    configured: MessagingChannel[];
-    legacyWarning?: string;
-};
-export declare function loadConsoleUrl(env: Record<string, string | undefined>, dir: string): string | null;
-/** Where `up` last served its console, kept beside the database so `onboard` names the same address (operate.ts). */
-export declare const UP_CONSOLE_FILE = "up-console.json";
-export declare function readUpConsoleUrl(dir: string): string | null;
-/** This machine's own console, where `up` last served it: only a plain http address on a loopback name (127.0.0.1,
- * localhost, ::1), never a host guessed from it; null otherwise. */
-export declare function localConsoleUrl(dir: string): string | null;
-/**
- * The origin a phone link may open, or null. The SAME console-url setting
- * chat links use — read again on every call, never cached, so a changed or
- * removed setting stops the next link — held to a stricter shape than a
- * desktop link: exactly an https origin (no credentials, path, query,
- * fragment), not loopback, and, when the console this process co-hosts
- * states its own `--public-url`, exactly that origin. A model, a Host
- * header or a proposal field never supplies it, and nothing here probes
- * the address: a valid shape is a place to send a person, not a promise
- * that it answers.
- */
-export declare function phoneOrigin(env: Record<string, string | undefined>, dir: string, options?: {
-    serverOrigin?: string | null;
-}): string | null;
-/** Where in the console this notification wants a person. */
-export declare function linkFor(consoleUrl: string | null, notification: Notification): string | null;
-/**
- * One notification, one platform. The payloads are the simplest thing each
- * platform documents; the console link is the call to action, because the
- * message is a mirror and the UI is the instrument.
- */
-export declare function postWebhook(target: WebhookTarget, notification: Notification, link: string | null, fetcher?: typeof fetch): Promise<{
-    ok: true;
-} | {
-    ok: false;
-    error: string;
-}>;
-export type WebhookReport = {
-    sent: number;
-    problems: string[];
-};
-/** Only the chosen service sends; an interactive adapter suppresses its old mirror. */
-export declare function activeWebhookTargets(env: Record<string, string | undefined>, dir: string, channel: MessagingChannel | null): WebhookTarget[];
-/** Each destination owns its claim and receipt; a successful one never hides another's retry. */
-export declare function webhookPass(store: Store, options: {
-    targets: WebhookTarget[];
-    consoleUrl: string | null;
-    owner?: string;
-    clock?: () => Date;
-    fetcher?: typeof fetch;
-}): Promise<WebhookReport>;

package/dist/welcome-facts.d.ts

@@ -1,18 +0,0 @@
-import { type WelcomeModel } from "./first-run.js";
-import { type ConnectionChecker } from "./provider-connection.js";
-import type { Store } from "./store.js";
-export type WelcomeHere = {
-    model: WelcomeModel;
-    projects: readonly string[];
-};
-/** The welcome model for this computer now. `check`: the agent sign-in check (tests pass their own). */
-export declare function welcomeHere(store: Store, databaseFile: string, now: Date, options?: {
-    check?: ConnectionChecker;
-    platform?: NodeJS.Platform;
-}): Promise<WelcomeHere>;
-export type WelcomeStepKey = "agent" | "project" | "task";
-export declare const WELCOME_STEPS: readonly WelcomeStepKey[];
-/** One step as lines for a terminal: its number and name, Done or what to do next, in plain words. */
-export declare function welcomeStepLines(model: WelcomeModel, key: WelcomeStepKey): string[];
-/** The welcome as lines for a terminal: how many steps are left, then each step. */
-export declare function welcomeLines(model: WelcomeModel): string[];

package/dist/when-html.d.ts

@@ -1,40 +0,0 @@
-/**
- * A time a person reads. A desk shows the full stamp, as before; a phone (760px and narrower) shows the short
- * one — "16:39" today, "Yesterday 16:39", "Sep 28" otherwise — and the full stamp stays in the title. Stamps are
- * UTC to the minute, so the server counts in UTC; in the browser `localizeTimes` rewords each of these with the same
- * formatter in the viewer's own zone, as the React views do. The CSS that picks one lives in the shared page
- * stylesheet (`.so-when-*` in serve.ts).
- */
-import { type Html } from "./html.js";
-/** The viewer's own time zone (a browser's); UTC where there is none to read. */
-export declare function viewerZone(): string;
-/** The one formatter for a time a person reads, on every surface: "16:39" today, "Yesterday 16:39" /
- * "Tomorrow 16:39" beside it, "Sep 28" otherwise ("Sep 28 2025" in another year), counted in `zone`. With `clock`,
- * a date further out keeps its time of day too ("Sep 28 16:39"), for deadlines and histories where the hour matters. */
-export declare function shortWhen(iso: string, now?: Date, zone?: string, clock?: boolean): string;
-/** A flow card's deadline in the viewer's zone, always with its time of day: "No reply by 16:30" today,
- * "No reply by Tomorrow 16:30", "Moves on Oct 2 16:30" further out (a label's trailing " at" reads wrong before a date). */
-export declare function deadlineWords(deadline: {
-    at: string;
-    label: string;
-}, now?: Date, zone?: string): string;
-/** How long ago, in one short mark: "now", "4m", "2h", "3d". A future stamp reads "now"; an unreadable one, "". */
-export declare function shortAge(iso: string, now?: Date): string;
-/** The exact minute in `zone` ("2026-09-30 16:39", with " UTC" when it is UTC): a time's title, one hover away. */
-export declare function fullWhen(iso: string, zone?: string): string;
-/** Every server-rendered stamp (`whenHtml`'s `<time data-when>`) inside `root`, reworded by the one formatter in the
- * viewer's zone: the same words on a desk and a phone, the exact minute in the title. An exact stamp
- * (`exactWhenHtml`'s `data-when="exact"`, the ledger's seconds) keeps its seconds, in the viewer's zone, and its
- * ISO title. The server's UTC words stay only without script. Times React writes and relative ages ("3 min ago")
- * carry no `data-when` and are never touched. */
-export declare function localizeTimes(root: ParentNode, now?: Date, zone?: string): void;
-/** The exact second in `zone` ("2026-09-30 16:39:12", with " UTC" when it is UTC): an audit record's stamp. */
-export declare function exactWhen(iso: string, zone?: string): string;
-/** The `<time>` for an exact stamp: its seconds in UTC words on the server, the viewer's zone in a browser. */
-export declare function exactWhenHtml(iso: string): Html;
-/** The `<time>` for a stamp: `full` is the words a desk shows ("2026-09-30 16:39 UTC"). Empty for no stamp. */
-export declare function whenHtml(iso: string | null, full: string, now?: Date): Html;
-/** "2026-09-30 16:39 UTC" — the desk's words for a stamp. */
-export declare const utcMinute: (iso: string) => string;
-/** Both the desk and phone forms of a UTC stamp. */
-export declare const whenUtc: (iso: string | null, now?: Date) => Html;

package/dist/work-index.d.ts

@@ -1,175 +0,0 @@
-import { type Store, type TaskState } from './store.js';
-import { type AssignmentSnapshot } from './assignment.js';
-import type { WorkAction, WorkSummaryAccess } from './work-summary.js';
-import type { WorkStatus, WorkView } from './workspace-ui.js';
-import { type Ask, type AskChip } from './needs-you.js';
-export type WorkIndexCounts = Record<WorkView, number>;
-export type WorkIndexItem = {
-    rootId: string;
-    activeTaskId: string;
-    title: string;
-    repo: string | null;
-    state: TaskState;
-    assignmentState: AssignmentSnapshot['state'];
-    createdAt: string;
-    updatedAt: string;
-    versionCount: number;
-    earlierActiveCount: number;
-    familyProblem: string | null;
-    liveRunId: number | null;
-    unfinishedRunId: number | null;
-    resultRunId: number | null;
-    resultTaskId: string | null;
-    resultOutcome: string | null;
-    publicationUrl: string | null;
-    status: WorkStatus;
-    /** What a Needs you row asks of a person (needs-you.ts); null for every other row. */
-    ask: Ask | null;
-    /** The row's chip under its group: the specific ask (needs-you.ts askChipOf), or none. */
-    chip: AskChip | null;
-    /** What a Needs you row asks, in Home's six groups (ASK_GROUP_SQL); null for every other row. */
-    askGroup: WorkAskGroup | null;
-    primaryAction: WorkAction | null;
-    completion: {
-        actor: string;
-        at: string;
-        digest: string;
-        landed?: string;
-    } | null;
-    evidence: 'recorded';
-    /** The viewer's own lead took it on (lead-voice.ts): "<name> is on it.", by the name they gave it, read now. */
-    lead?: string;
-    /** Put away (v145, task-tidy.md): by whom (a person's name, or tidy), why and when. Only the Archived view lists it. */
-    archived?: {
-        by: string;
-        byKind: 'person' | 'tidy';
-        reason: string;
-        at: string;
-    };
-};
-/** `root`: the evidence root, so a result whose checks were Off can read the release check that covers it.
- * `completedSince` (an ISO time): the Completed view lists only what was completed at or after it, filtered before the
- * page limit, and the page's `completedSince` counts them all. */
-export type WorkIndexOptions = {
-    view?: WorkView;
-    limit?: number;
-    cursor?: string | null;
-    project?: string | null;
-    state?: TaskState;
-    leadId?: string;
-    root?: string;
-    completedSince?: string;
-    /** Only these families (by root task id): the sidebar reads its rows' own words this way. */
-    roots?: readonly string[];
-};
-/** How the list is grouped: the Needs you rows by their ask, then building, then the rest. */
-export type WorkIndexGroup = Ask | 'building' | 'rest';
-export type WorkIndexGroupCounts = Record<WorkIndexGroup, number>;
-/** What a Needs you row asks, as Home groups it (docs/plans/live-pages-and-home.md B1.2): a release to approve, a plan
- * to approve, a question to answer, something that went wrong, a result to review, or anything else that needs the
- * person. A release is a plan to approve whose active task the plane's sealed state names a release (release-approval.ts
- * releaseTaskOf, docs/plans/home-other-asks.md v2.1); a failed release is still something that went wrong and a
- * release's result still a result to review. */
-export type WorkAskGroup = 'release' | 'approve' | 'answer' | 'wrong' | 'review' | 'other';
-export declare const WORK_ASK_GROUPS: readonly WorkAskGroup[];
-/** `asks`: the exact Needs you totals per ask group, over every row in view (never only the page). `completedSince`:
- * how many the Completed view lists from `options.completedSince` on (0 without it). `builderWaits`: how many Needs you
- * rows wait for a builder to connect or start (no worker registered or none online). */
-export type WorkIndexPage = {
-    items: WorkIndexItem[];
-    totals: WorkIndexCounts;
-    groups: WorkIndexGroupCounts;
-    asks: Record<WorkAskGroup, number>;
-    completedSince: number;
-    builderWaits: number;
-    projects: WorkProjectCounts[];
-    nextCursor: string | null;
-    limit: number;
-    view: WorkView;
-};
-export type WorkProjectCounts = {
-    repo: string | null;
-    totals: WorkIndexCounts;
-    queued: number;
-    doneRecently: number;
-};
-export declare const WORK_INDEX_PAGE_LIMIT = 40;
-export declare const WORK_INDEX_MAX_LIMIT = 100;
-/** The index codes that wait on nobody: finished or running work, and every wait (needs-you.ts CODE_READING). */
-export declare const WAITING_CODES: readonly string[];
-/** A code's ask: a saved result is Review (unless its build may still run), otherwise its need's ask. */
-export declare function askOfCode(code: string, custody?: boolean): Ask;
-export declare class WorkIndexCursorError extends Error {
-    constructor();
-}
-/** A single SQLite statement gives rows and exact totals one read snapshot.
- * Completion is a recorded acknowledgment of the latest run/scope/family by
- * its current lead or an admitted approver, invalidated by newer source facts.
- * Its historical receipt hash also binds disk state, which is deliberately
- * rechecked only on opening/acting. This query grants no completion authority.
- * Project counters share the page's admitted project/state filter.
- * Cursors bind the admitted scope, project and view, never broaden access. */
-export declare function workIndexPage(store: Store, now: Date, access: WorkSummaryAccess, options?: WorkIndexOptions): WorkIndexPage;
-/** An exact family lookup through the list's saved-fact projection. It remains
- * permission-bound and bypasses pagination, never action-time verification. */
-export declare function workIndexTask(store: Store, taskId: string, now: Date, access: WorkSummaryAccess, root?: string): WorkIndexItem | null;
-export declare function workCountsByProject(store: Store, now: Date, access: WorkSummaryAccess): WorkProjectCounts[];
-/** One row per task family the person may see (the Tasks list's own projection: current version, admission, unplaced
- * work and the ceiling as the list applies them), with what the cockpit's states read (agent-state.ts): its code, whether
- * it waits on a person, whether a lead took it on, and its live, unfinished and result runs. Every family, no page. */
-export type WorkStateRow = {
-    repo: string | null;
-    rootId: string;
-    code: string;
-    needs: boolean;
-    personNeed: boolean;
-    leadClaim: boolean;
-    liveRun: number | null;
-    unfinished: number | null;
-    resultRun: number | null;
-    /** The Tasks list ranks it as waiting its turn (custody confirmations from another computer included). */
-    waits: boolean;
-    /** What it needs now, as an identity: its code and the question, hold, result or stop it is about. A new one of
-     * these — or a changed plan or approval terms (its digests) — is a new thing to need a person, even on the same task. */
-    version: string;
-    /** When what it needs now began: the newest of its plan's proposal, its question, its hold, its result and its stop
-     * (each fixed once written, so an unrelated edit never moves it). Newer asks are named first. */
-    at: string;
-    /** The agent its ask is about: the live one, or the one whose question or decision it parked on. */
-    askRun: number | null;
-    /** Every task_ref of the family (its versions), for counting each of its live attempts. */
-    members: number[];
-};
-export declare function workStateRows(store: Store, now: Date, access: WorkSummaryAccess): WorkStateRow[];
-/** Activity uses the Tasks list's exact family admission and saved completion rules.
- * Only the requested project enters the projection. The extra row signals truncation;
- * attempts are aggregated in SQLite, never loaded as an unbounded history. */
-export declare function workOutcomeRows(store: Store, now: Date, access: WorkSummaryAccess, project: string, since: string, limit: number): Record<string, unknown>[];
-/** Families whose headline is Ready for review, newest first: the Tasks
- * list's own rows, so a completed family (root or any revision), a failed
- * check and a superseded version never count. */
-export declare function workReadyForReview(store: Store, now: Date, access: WorkSummaryAccess, limit?: number): {
-    count: number;
-    results: {
-        rootId: string;
-        taskId: string;
-        run: number | null;
-    }[];
-};
-/** One row per task family for tidy (docs/plans/task-tidy.md): the Tasks list's own projection, so tidy's "unfinished",
- * "live" and "complete" are the words the list shows. `members` are every version's task_ref ids. */
-export type WorkTidyRow = {
-    rootId: string;
-    currentId: string;
-    title: string;
-    repo: string | null;
-    state: TaskState;
-    code: string;
-    live: boolean;
-    archived: boolean;
-    broken: boolean;
-    updatedAt: string;
-    members: number[];
-    memberIds: string[];
-};
-export declare function workTidyRows(store: Store, now: Date, access: WorkSummaryAccess): WorkTidyRow[];

package/dist/work-summary.d.ts

@@ -1,61 +0,0 @@
-import { type DispatchAction } from "./dispatch.js";
-import type { Store } from "./store.js";
-import { type DisplayStatus, type WorkFacts, type WorkStatus } from "./workspace-ui.js";
-export type WorkPrincipal = "operator" | "coordinator";
-export type WorkTarget = {
-    taskId: string;
-    runId: number | null;
-    decisionId: number | null;
-};
-export type WorkAction = {
-    /** `recheck-stopped`: Toolroll looks again whether a finished build stopped (nobody vouches for it);
-     * `sign-in`: the agent's sign-in, in Settings; `answer-agent`: Reply to a running agent's question on the Agents board. */
-    code: DispatchAction | "inspect-task" | "inspect-findings" | "inspect-run" | "inspect-stop" | "inspect-decisions" | "reconcile-run" | "open-pr" | "recheck-stopped" | "sign-in" | "answer-agent";
-    label: string;
-    target: WorkTarget;
-    access: "read" | "operator-control" | "proposal-only" | "operator-handoff";
-    /** Never interpret a hint as permission to retry a mutation blindly. */
-    retry: "read-again" | "refresh-before-acting" | "reconcile-before-retry";
-};
-export type WorkSummary = {
-    taskId: string;
-    state: WorkFacts["state"];
-    resultRunId: number | null;
-    liveRunId: number | null;
-    status: WorkStatus;
-    primaryAction: WorkAction | null;
-    nextActions: WorkAction[];
-    diagnostics: NonNullable<WorkStatus["diagnostics"]>;
-    /** A stored verdict is not a new audit of files on disk. The console
-     * supplies its existing receipt projection when it has re-read them. */
-    evidence: "recorded" | "receipt-checked";
-};
-/** Call only after admitting the task's project. Keep the question's
- * exact run and id; never substitute a family's newest attempt. Expiry
- * is attention metadata in the decision owner, so overdue stays open.
- * Finishing a result does not answer its questions: only the normal
- * decision operation settles them, including on earlier family versions. */
-export declare function openWorkDecisionOf(store: Store, taskRef: number, now: Date): Exclude<WorkFacts["openDecision"], undefined>;
-/** One exact answer target across task and family projections. This is
- * still only a proposal for a coordinator, never approval authority. */
-export declare function workDecisionAction(taskId: string, decision: NonNullable<WorkFacts["openDecision"]>, principal: WorkPrincipal): WorkAction;
-/** Pure counterpart for callers already holding the same facts. */
-export declare function workSummaryOf(facts: WorkFacts, principal: WorkPrincipal, resultDisplay?: DisplayStatus): WorkSummary;
-export type WorkSummaryAccess = (
-/** `viewer`: the person reading, whose own lead's claim (lead-voice.ts) a task reads as "<name> is on it". */
-{
-    principal: "operator";
-    repos: readonly string[] | null;
-    includeUnplaced?: boolean;
-    viewer?: string | null;
-} | {
-    principal: "coordinator";
-    repos: readonly string[];
-}) & {
-    /** Remote task reads also restrict dependency details; omitted preserves existing local output. */
-    dependencyRepos?: readonly string[] | null;
-};
-/** Admission precedes reading question/proof bodies. Missing and foreign
- * tasks share the same result. The caller must authenticate/revalidate
- * its principal; this allowlist is not a credential. */
-export declare function taskWorkSummaryOf(store: Store, taskId: string, now: Date, access: WorkSummaryAccess): WorkSummary | null;

package/dist/workspace-motion.d.ts

@@ -1,4 +0,0 @@
-/** Motion adapts presentation only. Native navigation, forms and tab state
- * remain owned by their existing handlers. No network or credential access. */
-export declare const WORKSPACE_MOTION_CSS: string;
-export declare const WORKSPACE_MOTION_SCRIPT: string;

package/dist/workspace-revision.d.ts

@@ -1,48 +0,0 @@
-/** Durable invalidation for authenticated workspace reads. This is cache
- * metadata only: it never grants access or certifies task/process state.
- *
- * The revision is one service_cursor row. Every Toolroll connection is wrapped
- * (trackWorkspaceWrites, from the Store) and moves it once per committed
- * meaningful write: inside a transaction at its outer COMMIT (a rollback, or a
- * savepoint rolled back to, moves nothing), and right after an autocommit
- * statement. Quiet writes (heartbeats, cursors, receipts) move nothing; a beat
- * after a liveness or lease gap is a revival and does. Readers in another
- * process see the commit through PRAGMA data_version. No trigger is installed:
- * the schema stays the schema (v114 dropped the 801 per-table triggers). */
-import type { Database } from './store.js';
-import type { Store } from './store.js';
-/** The service_cursor row every meaningful commit moves (live-bus.ts listens for it). */
-export declare const WORKSPACE_REVISION_KEY = "workspace-content:v1";
-/** What one statement does to the workspace: a transaction boundary, a write to a table (quiet or not), or nothing. */
-type Effect = {
-    kind: 'begin' | 'commit' | 'rollback' | 'none';
-} | {
-    kind: 'savepoint' | 'rollback-to' | 'release';
-    name: string;
-} | {
-    kind: 'write';
-    table: string;
-    quiet: boolean;
-};
-export declare function statementEffect(sql: string): Effect;
-/** Wrap one connection so each committed meaningful write moves the workspace revision exactly once. Native
- * extensions (scalar functions, isTransaction) pass through; a test spy on prepare/exec replaces only the facade's. */
-export declare function trackWorkspaceWrites(db: Database): Database;
-export type WorkspaceRevision = {
-    current(): string;
-    expiresAt(now: Date): number;
-};
-type WorkspaceValidator = {
-    etag: string;
-    revision: string;
-    expiresAt: number;
-};
-/** Per-server response metadata. Reads preserve insertion order; writes at
- * capacity discard the oldest key before storing the supplied validator. */
-export declare class WorkspaceValidatorCache {
-    private readonly entries;
-    get(key: string): WorkspaceValidator | undefined;
-    set(key: string, validator: WorkspaceValidator): void;
-}
-export declare function prepareWorkspaceRevision(store: Store): WorkspaceRevision;
-export {};