toolroll 0.9.104 → 0.9.105

package/dist/flow-triggers.d.ts

@@ -1,303 +0,0 @@
-import type { Runner } from "./backend.js";
-import { type FlowAct } from "./flow-engine.js";
-import { type FlowDefinition } from "./flows.js";
-import { type DistinctHeaders, type WebhookSender } from "./webhook-signing.js";
-import { type ContractResult } from "./contracts/contract.js";
-import { FLOW_TRIGGER_KINDS, type ChatApp, type FlowTriggerKind, type TriggerConfig, type TriggerInput } from "./contracts/flow.js";
-import { type MailReader } from "./mailbox.js";
-import type { FlowCardSource, FlowRow, FlowTriggerRow, Store } from "./store.js";
-export { FLOW_TRIGGER_KINDS };
-export type { ChatApp, FlowTriggerKind, TriggerConfig, TriggerInput };
-export declare const CHAT_APP_NAMES: Record<ChatApp, string>;
-/** What each kind is called on the canvas. */
-export declare const FLOW_TRIGGER_WORDS: Record<FlowTriggerKind, string>;
-/** How often the worker checks GitHub and Linear, and how it backs off when they don't answer. */
-export declare const POLL_EVERY_MS: number;
-/** At most this many cards from one check or one delivery; the rest wait for the next. */
-export declare const CARDS_PER_CHECK = 10;
-/**
- * A trigger's settings read by their one schema (`label: required`, `unknown key 'flows'`). A setting given as null is
- * left out, and a button's blank question lines are dropped, as every release has read them. Then what the schema can't
- * say, named by its path: no hidden characters and nothing that looks like a key, anywhere in the settings.
- */
-export declare function readTriggerSettings(raw: unknown): ContractResult<TriggerInput>;
-/** A schedule said in words ("every 2 hours", "daily 09:00 Europe/London", "monday 09:00") or in its stored form ("daily:09:00"). */
-export declare function scheduleFromWords(text: string): string | null;
-/** A GitHub repository as owner/name, read from a project's origin remote when it is on GitHub. */
-export declare function githubRepoOf(path: string): string | null;
-/** A trigger's settings, checked whole against the flow it starts cards in (readTriggerSettings, then the flow, its zones,
- * the project's scripts and the schedule). Throws FlowContractError, each line naming its setting. */
-export declare function validateTriggerConfig(raw: unknown, context: {
-    store: Store;
-    flow: FlowRow;
-    definition: FlowDefinition;
-    actor: string;
-}): TriggerConfig;
-/** Whether an email is one this trigger takes: from a named sender (or domain), with the words in its subject. */
-export declare function mailMatches(config: Extract<TriggerConfig, {
-    kind: "email";
-}>, mail: {
-    from: string;
-    subject: string;
-}): boolean;
-/** The trigger in the words the canvas and its cards use. */
-export declare function describeTrigger(config: TriggerConfig, store: Store): string;
-/** The trigger in two short lines for the canvas: what it is, and the one detail that tells it apart. */
-export declare function triggerHeadline(config: TriggerConfig, store: Store): {
-    name: string;
-    detail: string;
-};
-export declare function triggerConfigOf(trigger: FlowTriggerRow): TriggerConfig | null;
-/** A saved trigger's config (`configJson`, which carries no version) read by its one schema, what it leaves out filled. */
-export declare function readTriggerConfig(raw: unknown): ContractResult<TriggerConfig>;
-/** v126: who signs a webhook trigger's deliveries; one saved before senders were chosen is unsigned. */
-export declare const senderOf: (config: Extract<TriggerConfig, {
-    kind: "webhook";
-}>) => WebhookSender;
-/** Whether this trigger takes deliveries at a secret address rather than being checked. */
-/** Whether a raw trigger the caller is about to add would take deliveries (an address): read leniently, before validation. */
-export declare function rawTakesDeliveries(raw: unknown): boolean;
-/** Whether a trigger brings in items from anyone (chat-management.md §0a.3): GitHub issues or pull requests from anyone,
- * or mail from any sender. A widening: it takes a person's password, on every road that adds one. */
-export declare function admitsAnyone(config: TriggerConfig): boolean;
-/** The same, read leniently from a raw trigger before validation (so the form can ask for the password first). */
-export declare function rawAdmitsAnyone(raw: unknown): boolean;
-export declare function takesDeliveries(config: TriggerConfig): boolean;
-/** A webhook's signing secret (made here, or pasted from its sender). In the keychain (or an owner-only file where there's none), never a column. */
-export declare function saveHookSecret(dir: string, trigger: number, secret: string, credential?: string): void;
-/** Exactly this credential's secret, or null: never another's. */
-export declare function readHookSecret(dir: string, trigger: number, credential?: string): string | null;
-/** The Linear API key the worker checks Linear with: the environment, or kept by Toolroll (the keychain, or an owner-only file beside the database). */
-export declare function readLinearKey(dir: string | null): string | null;
-export declare function saveLinearKey(dir: string, key: string): {
-    ok: true;
-} | {
-    ok: false;
-    message: string;
-};
-export declare function removeLinearKey(dir: string): void;
-/** The public address webhooks reach this console at (a reverse proxy such as Caddy, exposing /hooks/ only). */
-export declare function readHooksBase(dir: string | null): string | null;
-export declare function saveHooksBase(dir: string, value: string): {
-    ok: true;
-    base: string | null;
-} | {
-    ok: false;
-    message: string;
-};
-export declare const HOOK_PATH = "/hooks/flow/";
-export type TriggerReveal = {
-    path: string;
-    address: string | null;
-    secret: string | null;
-};
-export type TriggerMade = {
-    ok: true;
-    id: number;
-    said: string;
-    reveal: TriggerReveal | null;
-} | {
-    ok: false;
-    message: string;
-};
-/** Add a trigger to a flow. A webhook trigger's address (and GitHub's signing secret) is returned once and never stored readable. */
-/**
- * `ingress: "proved"`: the caller proved a password typed now (a credential act, docs/plans/passwordless.md) — only then
- * may a trigger that takes deliveries be made with an address. Without it a webhook is made with none (its panel's
- * set-up, which asks for the password, makes one), and GitHub/Linear webhook delivery is refused.
- */
-export declare function addFlowTriggerTo(store: Store, flow: FlowRow, raw: unknown, actor: string, now: Date, dir: string | null, options?: {
-    shown?: boolean;
-    ingress?: "proved";
-    /** The person proved themselves for this act (a password, or a session under Passwordless): a trigger that admits
-     * anyone is added only then. */
-    widening?: "proved";
-}): TriggerMade;
-/** A new secret address for a webhook trigger (the old one stops working at once). */
-export declare function renewFlowHook(store: Store, trigger: FlowTriggerRow, now: Date, dir: string): TriggerMade;
-/**
- * Pause a trigger, or turn it on again. A schedule that never had a time (a routine moved to a flow while it waited
- * for approval, v115) starts counting from now, as a new schedule does; one that was due while it was off fires once.
- */
-export declare function setFlowTriggerOn(store: Store, trigger: FlowTriggerRow, on: boolean, now: Date, by?: string): void;
-export declare function removeFlowTrigger(store: Store, trigger: FlowTriggerRow, now: Date, dir: string | null, by?: string): void;
-/** `onTime`: the clock's own firing of a schedule (never Run now or Check now); only those can run on their own.
- * `ranScript`: for a script's, what code it ran (scriptRanDigestOf), which must be the code a grant signed. */
-export type Incoming = {
-    key: string;
-    title: string;
-    description: string | null;
-    source: FlowCardSource;
-    onTime?: boolean;
-    ranScript?: string | null;
-};
-type Made = "added" | "seen" | "skipped";
-/** One outside thing into one card through a trigger (a chat channel's message, v89): at most once per key. */
-export declare function addTriggerCard(store: Store, trigger: FlowTriggerRow, item: Incoming, by: string, now: Date): {
-    made: Made;
-    note: string | null;
-    card: number | null;
-};
-/** Press a button trigger: the first answer is the card's title, the rest its details. */
-export declare function pressFlowButton(store: Store, trigger: FlowTriggerRow, answers: readonly unknown[], actor: string, now: Date): FlowAct;
-export type TriggerIo = {
-    gh: Runner;
-    fetch: typeof fetch;
-    dir: string | null;
-    /** How mail is read (default: IMAP; tests pass a scripted mailbox). */
-    mail?: MailReader;
-    /** v90: how a schedule's script runs (default: the same runner as gh) and where (default: beside the database). */
-    shell?: Runner;
-    scratch?: string;
-    /** Whether this machine can confine a script (tests only; default: the macOS sandbox or bubblewrap is here). */
-    fenceAvailable?: () => boolean;
-    /** The home folder a launch is fenced around (tests only; default: this user's). */
-    home?: string;
-};
-export type TriggerPass = {
-    added: number;
-    checked: number;
-    problems: string[];
-};
-/** Every trigger in one project that is due: schedules and other flows here, GitHub, Linear and email by asking them. */
-export declare function runFlowTriggers(store: Store, repo: string, now: Date, io: TriggerIo): Promise<TriggerPass>;
-/** "Check now" on the canvas: one trigger, right away, in words. */
-export declare function checkFlowTriggerNow(store: Store, trigger: FlowTriggerRow, now: Date, io: TriggerIo): Promise<{
-    ok: boolean;
-    said: string;
-}>;
-/**
- * A plane review: the last 24 hours, one card per problem worth fixing. Each problem is noted once a day; a problem
- * whose card is still open joins it (a note with the day's counts and evidence) instead of making another, and one
- * whose card is finished starts a new card, since it came back. A clean day adds nothing and tells nobody.
- * `scheduled` moves the trigger to its next morning; "Run now" leaves its times alone.
- */
-export declare function firePlaneReview(store: Store, trigger: FlowTriggerRow, config: Extract<TriggerConfig, {
-    kind: "plane-review";
-}>, now: Date, scheduled: boolean): Promise<{
-    added: number;
-    joined: number;
-    said: string;
-}>;
-/** Where a person sees everything that waits on them. */
-export declare const NEEDS_YOU_HREF = "/tasks?view=needs-you";
-/** A plane review whose summary mentions long waits on a person links to Needs you. */
-export declare function planeStatusLink(config: TriggerConfig | null, status: string | null): {
-    label: string;
-    href: string;
-} | null;
-/** v96: a schedule (a subagent's routine) makes its card now, once per press, and keeps its own times. */
-export declare function runScheduleNow(store: Store, trigger: FlowTriggerRow, actor: string, now: Date): {
-    ok: true;
-    card: number;
-} | {
-    ok: false;
-    said: string;
-};
-type Found = (Incoming & {
-    at: string | null;
-}) | {
-    key: string;
-    skip: string;
-    label: string;
-    at: string | null;
-};
-/** A GitHub issue or pull request as a card, or why it is left out; null when it doesn't match. */
-export declare function githubItem(config: Extract<TriggerConfig, {
-    kind: "github";
-}>, raw: unknown, what: "issue" | "pull"): Found | null;
-/** A failed workflow run as a card: one card per failing commit on the watched branch. */
-export declare function githubRunItem(config: Extract<TriggerConfig, {
-    kind: "github";
-}>, raw: unknown): Found | null;
-export declare const LINEAR_URL = "https://api.linear.app/graphql";
-export declare const LINEAR_QUERY = "query FlowTrigger($filter: IssueFilter) { issues(filter: $filter, first: 50, orderBy: updatedAt) { nodes { identifier title description url updatedAt state { name } team { key } labels { nodes { name } } } } }";
-/** A Linear issue as a card; null when it doesn't match the trigger. */
-export declare function linearItem(config: Extract<TriggerConfig, {
-    kind: "linear";
-}>, raw: unknown): Found | null;
-/** v126: headers as Node's `headersDistinct` gives them, one value per line they arrived on, so a security header sent
- * twice is seen twice (Node's `headers` joins repeated custom headers with commas). */
-export type HookDelivery = {
-    headers: DistinctHeaders;
-    body: Buffer;
-};
-/** `retryAfter` (seconds): a 429's Retry-After. */
-export type HookAnswer = {
-    status: number;
-    said: string;
-    retryAfter?: number;
-};
-/** A webhook delivery at a trigger's secret address: prove it, read it, make at most the cards it names. Nothing runs here. */
-export declare function receiveFlowHook(store: Store, token: string, delivery: HookDelivery, dir: string, now: Date): HookAnswer;
-/**
- * v126: make a trigger's held deliveries into their cards while the last hour has room, oldest first. Each card in its
- * own write transaction, which reads everything it acts on under the write lock: the trigger (still active, still
- * taking deliveries), the hour's room, the oldest held receipt, the flow; then the same guards intake has (a failing
- * run already owned by another card in the project is left out). The card and the receipt's move to accepted land
- * together, or neither does.
- */
-export declare function drainHeldDeliveries(store: Store, trigger: FlowTriggerRow, now: Date): number;
-/**
- * v126: a delivery refused before it could be read (too large, a body that wouldn't read): it proves nothing, so it
- * counts toward its address's minute like any unproven delivery. The answer to give instead when that count is over.
- */
-export declare function hookRefusedUnread(store: Store, token: string, now: Date): HookAnswer | null;
-/** A signing secret pasted on the secure panel behind the password, never in chat: Linear's, or a signed webhook's
- * sender's (Sentry's or Vercel's own, or a Standard or GitHub-style one made elsewhere). */
-export declare function saveSigningSecret(store: Store, trigger: FlowTriggerRow, secret: string, now: Date, dir: string): {
-    ok: true;
-    said: string;
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * v126: a new secret for a webhook whose sender Toolroll makes secrets for (Standard Webhooks, GitHub-style), shown once.
- * Its address stays as it is (New address is its own action). Sentry's and Vercel's secrets are theirs, pasted instead.
- * The only place such a secret is made: creating a trigger (from the panel, the gallery or an import) never does.
- */
-export declare function setUpFlowHook(store: Store, trigger: FlowTriggerRow, now: Date, dir: string): TriggerMade;
-/**
- * v126: change who signs a webhook's deliveries, in place: the trigger keeps its id, address and what it has received
- * (keys carry the sender, so nothing received unsigned stands for anything signed). Its credentials move to the next
- * generation with no secret: it isn't ready until it is set up again. Settings the new sender doesn't read are left out.
- */
-export declare function changeFlowHookSender(store: Store, trigger: FlowTriggerRow, sender: unknown, actor: string, now: Date, dir: string): {
-    ok: true;
-    said: string;
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * v126: which project (and, for Vercel, team) a Sentry or Vercel webhook takes deliveries from, set in place: the
- * trigger keeps its id, address, secret and history; blank takes any project the secret covers. Only from the settings
- * read here, so a change racing it doesn't land on top of it.
- */
-export declare function setFlowHookScope(store: Store, trigger: FlowTriggerRow, scope: {
-    project: unknown;
-    team: unknown;
-}, actor: string, now: Date): {
-    ok: true;
-    said: string;
-} | {
-    ok: false;
-    message: string;
-};
-/** Whether a webhook trigger can prove its deliveries: an unsigned webhook always (its address is all it has), the others
- * once the current generation's secret is saved. */
-export declare function hookReady(trigger: FlowTriggerRow, dir: string | null): boolean;
-export declare const FORM_PATH = "/hooks/form/";
-/** Share a button as a secret link anyone can fill in, without signing in. The link is shown once; only its hash is kept. */
-export declare function shareFlowButton(store: Store, trigger: FlowTriggerRow, now: Date, dir: string | null): TriggerMade;
-export declare function stopSharingFlowButton(store: Store, trigger: FlowTriggerRow, now: Date): void;
-/** The page's bytes (the public route writes them itself, with its own headers). */
-export type FormAnswer = {
-    status: number;
-    html: string;
-};
-/** GET a shared form: its questions. */
-export declare function flowFormPage(store: Store, token: string, now: Date): FormAnswer;
-/** POST a shared form: at most one card per submission, keys refused, a limit per hour, and quiet about what a bot did wrong. */
-export declare function receiveFlowForm(store: Store, token: string, fields: URLSearchParams, now: Date): FormAnswer;

package/dist/flow-unattended-words.d.ts

@@ -1,48 +0,0 @@
-/** The words a "runs on its own" grant signs (flow-unattended.ts), kept free of server imports so the flow page's
- * signing form says each limit exactly as the signature will. */
-export declare const dollarWords: (micro: number) => string;
-/** The most runs a day a grant may allow. */
-export declare const UNATTENDED_MAX_RUNS = 50;
-/** The largest per-attempt budget a grant may name: $100. */
-export declare const UNATTENDED_MAX_BUDGET_MICROUSD = 100000000;
-/** A per-attempt budget as typed ("5", "$7.50", "" for no cap), the one way the server and the flow page read it. */
-export declare function unattendedBudgetOf(typed: string): {
-    ok: true;
-    value: number | null;
-} | {
-    ok: false;
-    message: string;
-};
-/** Runs a day as typed ("3", "" for no limit), the one way the server and the flow page read it. */
-export declare function unattendedRunsOf(typed: string): {
-    ok: true;
-    value: number | null;
-} | {
-    ok: false;
-    message: string;
-};
-/** "Oct 19": the end's day, where space is short (the exact time goes beside it, on hover). */
-export declare const untilDayWords: (iso: string) => string;
-/** "Oct 19, 14:05 UTC": the expiry as every surface says it. */
-export declare const untilWords: (iso: string) => string;
-/** Who approves, with what permissions and against which criteria. */
-export declare function unattendedHeadWords(owner: string, acceptance: {
-    task: readonly {
-        statement: string;
-    }[];
-    report: readonly {
-        statement: string;
-    }[];
-}): string[];
-/** "daily at 09:00" from a stored schedule ("daily:09:00@Europe/London"), kept here so every surface says it alike. */
-export declare function scheduleWords(stored: string): string;
-/** Which schedules the grant covers, by name and time. */
-export declare const unattendedCoverWords: (triggers: readonly {
-    words: string;
-}[]) => string;
-/** The optional limits. */
-export declare function unattendedLimitWords(budgetMicrousd: number | null, dailyRunCap: number | null): string[];
-/** What it never covers, and what ends it. */
-export declare const UNATTENDED_RULE_WORDS: readonly string[];
-export declare const unattendedEndWords: (expiry: string) => string;
-export declare const unattendedEndAfterWords: (days: number) => string;

package/dist/flow-unattended.d.ts

@@ -1,259 +0,0 @@
-import type { AcceptanceCriterion } from "./contracts/scope.js";
-import { untilWords } from "./flow-unattended-words.js";
-import type { FlowRow, FlowTriggerRow, Store } from "./store.js";
-/** Grant history, run reservations and the last prepared script snapshots shared by UI/worker processes. Additive only. */
-export declare const FLOW_UNATTENDED_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_script_provenance (\n  repo TEXT NOT NULL, name TEXT NOT NULL, snapshot TEXT, PRIMARY KEY (repo, name)\n);\nCREATE TABLE IF NOT EXISTS flow_unattended_grant (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  flow            INTEGER NOT NULL,\n  repo            TEXT NOT NULL,\n  flow_revision   INTEGER NOT NULL,\n  terms_json      TEXT NOT NULL,\n  digest          TEXT NOT NULL,\n  signed_by       TEXT NOT NULL,\n  signed_at       TEXT NOT NULL,\n  absolute_expiry TEXT NOT NULL,\n  revoked_at      TEXT,\n  revoked_by      TEXT,\n  revoke_reason   TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS flow_unattended_live ON flow_unattended_grant (flow) WHERE revoked_at IS NULL;\nCREATE INDEX IF NOT EXISTS flow_unattended_digest ON flow_unattended_grant (digest);\nCREATE TABLE IF NOT EXISTS flow_unattended_run (\n  grant_id INTEGER NOT NULL,\n  day      TEXT NOT NULL,\n  task_id  TEXT NOT NULL,\n  at       TEXT NOT NULL,\n  PRIMARY KEY (grant_id, task_id)\n);\nCREATE INDEX IF NOT EXISTS flow_unattended_run_day ON flow_unattended_run (grant_id, day);\n";
-/** The fixed acceptance criteria a flow's work zones file with: the same for every card, so a grant can freeze them. */
-export declare const FLOW_ACCEPTANCE: {
-    report: AcceptanceCriterion[];
-    task: AcceptanceCriterion[];
-};
-/** The limits a grant may name, and their one parser, live with its words (the flow page validates with them too). */
-export { UNATTENDED_MAX_BUDGET_MICROUSD, UNATTENDED_MAX_RUNS } from "./flow-unattended-words.js";
-/** The code a script schedule runs, as signed: the script's version and content digest, and for one that runs a project
- * file, that file's path and, sorted by path, the digest of its bytes and of every project file it statically imports. */
-export type SignedScript = {
-    provenance: 2;
-    name: string;
-    version: number;
-    digest: string;
-    file: string | null;
-    files: {
-        path: string;
-        digest: string;
-    }[];
-};
-/** One schedule a grant covers: which trigger, what sort, the digest of its settings when signed, and its name in words.
- * `script` is there exactly when the kind is "script". */
-export type CoveredTrigger = {
-    id: number;
-    kind: "schedule" | "script" | "plane-review";
-    digest: string;
-    words: string;
-    script?: SignedScript;
-};
-export type UnattendedTerms = {
-    flow: number;
-    /** Saving the flow moves its revision: what was signed was this drawing. */
-    flowRevision: number;
-    repo: string;
-    /** The signer, who must stay the flow's owner. */
-    owner: string;
-    /** The schedules signed for, frozen: any other trigger, or one of these changed, is not covered. */
-    triggers: CoveredTrigger[];
-    /** Always safe: an escalated posture is never covered. */
-    permissions: "safe";
-    acceptance: {
-        report: AcceptanceCriterion[];
-        task: AcceptanceCriterion[];
-    };
-    perAttemptBudgetMicrousd: number | null;
-    /** Filings per UTC day, reserved at filing. */
-    dailyRunCap: number | null;
-    absoluteExpiry: string;
-};
-export declare const unattendedTermsJson: (terms: UnattendedTerms) => string;
-/** sha256 over a domain-separated canonical encoding, 32 hex like the mode digest. */
-export declare function unattendedDigestOf(terms: UnattendedTerms): string;
-/** Strict rehydration: anything unexpected is null, never a guess. */
-export declare function unattendedTermsFromJson(json: string | null): UnattendedTerms | null;
-export { untilWords };
-/** Every term in words: what the ceremony shows and the password signs. */
-export declare function unattendedWords(terms: UnattendedTerms): string[];
-export type UnattendedGrant = {
-    id: number;
-    flow: number;
-    repo: string;
-    terms: UnattendedTerms;
-    digest: string;
-    signedBy: string;
-    signedAt: string;
-    absoluteExpiry: string;
-};
-/** SQL: whether the grant whose digest is `digest` still stands at `now` for work in `repo` — live, unexpired, its
- * signer an active approver who can still reach the flow's project and this one, still the owner of the very flow
- * revision signed, and neither project protected. Shared by every dispatch belt. */
-export declare const grantStandsSql: (digest: string, now: string, repo: string) => string;
-/** Why a grant ended, as its row and ledger line say it. A renewal's ledger line is the new signature's. */
-export type UnattendedEnd = "expired" | "revoked" | "renewed" | "flow changed" | "schedule changed" | "script changed" | "project protected" | "access changed";
-/**
- * The one road for what ends grants from outside this module (store.ts calls it): a flow's schedule added, paused,
- * resumed or removed; a project's approval rules protecting work; an account's access or standing changing. Every live
- * grant the filter names ends now, durably, with its ledger line, and its queued approvals are withdrawn. Call inside
- * the mutation's transaction. Returns how many ended.
- */
-export declare function endUnattendedGrants(store: Store, filter: {
-    flow: number;
-} | {
-    repo: string;
-} | {
-    signer: string;
-} | {
-    script: {
-        repo: string;
-        name: string;
-    };
-}, by: string, reason: Exclude<UnattendedEnd, "expired" | "revoked" | "renewed">, now: Date): number;
-/** The live grant for a flow, or null. One past its expiry is closed here, durably (like activeMode). A grant whose
- * signer is no longer an active approver, or whose flow moved on, covers nothing. */
-export declare function activeUnattendedGrant(store: Store, flowId: number, now: Date): UnattendedGrant | null;
-/** Close every grant past its expiry (the console's background pass). Returns how many ended. */
-export declare function closeExpiredUnattendedGrants(store: Store, now: Date): number;
-/** The projects a flow's work zones file in (a build zone may name another). */
-export declare function workReposOf(flow: FlowRow): string[];
-/** sha256 over a trigger's identity and canonical settings: what a grant freezes for each schedule it covers. */
-export declare function triggerDigestOf(trigger: Pick<FlowTriggerRow, "id" | "flow" | "kind" | "configJson">): string | null;
-/** Asynchronous preparation, never called from filing transactions or page rendering. */
-export declare function scriptProvenanceOf(store: Store, repo: string, name: string, fresh?: boolean): Promise<SignedScript | null>;
-export declare function prepareUnattendedCandidates(store: Store, flowId: number): Promise<void>;
-/** What an on-time script firing ran, as its firing records it: a digest of the code pinned just before and just after
- * the run, when both were the same and were the script row that ran; else null (it can't have run the code signed). */
-export declare function scriptRanDigestOf(before: SignedScript | null, after: SignedScript | null, ran: {
-    version: number;
-    digest: string;
-}): string | null;
-/** Whether `flowId`'s live grant signed `triggerId`'s script: only then does a firing pin the code it runs. */
-export declare function grantSignsScriptOf(store: Store, flowId: number, triggerId: number, now: Date): boolean;
-/** A schedule a grant could cover, and whether it is covered only when the owner picks it (`optional`, with why). */
-export type UnattendedCandidate = CoveredTrigger & {
-    optional: string | null;
-};
-/**
- * The flow's active schedules a grant could cover. A plain schedule makes its own card from its own words, so it is
- * covered by default. A script's items and a plane review's problems are outside content (issues, mail, what a run
- * saw), so they are covered only when the owner picks them. A standing order files under its own signed terms, and a
- * paused or unreadable schedule, or a script whose code can't be read safely, is never offered.
- */
-export declare function unattendedCandidates(store: Store, flowId: number): UnattendedCandidate[];
-/** A digest of the schedules the page offered, so a signature never covers one the person didn't read. */
-export declare const candidatesDigestOf: (candidates: readonly UnattendedCandidate[]) => string;
-/** Why `signer` can't let this flow run on its own, or null: what the flow page shows instead of the form. */
-export declare function unattendedSignProblem(store: Store, flow: FlowRow, signer: string): string | null;
-/** `include`: the schedules (trigger ids) the owner picked beyond the plain ones covered by default. */
-export type UnattendedAsk = {
-    days: number;
-    budgetMicrousd: number | null;
-    dailyRunCap: number | null;
-    include?: number[];
-};
-/** Read what a person typed: whole days 1–MODE_MAX_DAYS, an optional dollar budget, an optional runs-a-day cap. */
-export declare function parseUnattendedAsk(input: {
-    days: unknown;
-    budget?: unknown;
-    runs?: unknown;
-    include?: unknown;
-}): {
-    ok: true;
-    ask: UnattendedAsk;
-} | {
-    ok: false;
-    message: string;
-};
-/** The exact terms a signature would cover now, for these schedules. */
-export declare function unattendedTermsFor(flow: FlowRow, owner: string, ask: UnattendedAsk, triggers: readonly CoveredTrigger[], now: Date): UnattendedTerms;
-/** Sign (or renew) the grant. The caller has already checked the signer's password; every predicate is proved again
- * here against the flow as it now stands: files asynchronously first, then database facts inside the transaction. `sawRevision` and `sawSchedules` (candidatesDigestOf),
- * when given, are the flow and the schedules the person read. Renewing ends the old grant and withdraws what it sealed. */
-export declare function signUnattended(store: Store, input: {
-    flow: number;
-    signer: string;
-    ask: UnattendedAsk;
-    sawRevision?: number;
-    sawSchedules?: string;
-}, now: Date): Promise<{
-    ok: true;
-    grant: UnattendedGrant;
-} | {
-    ok: false;
-    message: string;
-}>;
-/**
- * The signature itself, in one transaction. `before` is what signUnattended read around its file pass. Chat's door is
- * synchronous, so it signs without one, over the script snapshots the worker's pass keeps (prepareUnattendedCandidates)
- * and the schedules its card showed (`sawSchedules`). A snapshot older than the files fails closed: a firing runs a
- * signed script only if it is still the very code signed.
- */
-export declare function sealUnattended(store: Store, input: {
-    flow: number;
-    signer: string;
-    ask: UnattendedAsk;
-    sawRevision?: number;
-    sawSchedules?: string; /** Where the yes came from, for the ledger: "via slack · chat binding #3". */
-    road?: string;
-}, now: Date, before?: {
-    revision: number | undefined;
-    schedules: string;
-    prepared: string;
-}): {
-    ok: true;
-    grant: UnattendedGrant;
-} | {
-    ok: false;
-    message: string;
-};
-/** One click for any approver on the project: lowering authority needs no password. False when there was none. */
-export declare function revokeUnattended(store: Store, flowId: number, by: string, now: Date): boolean;
-/**
- * Whether a card came from one of the schedules this grant signed for, fired on time after it was signed: the firing
- * names the card and was the clock's (never Run now), its trigger is still active with the very settings signed, and no
- * person has moved the card or sent it back since. Anything else is a person's card, or one the grant never read.
- * A script schedule's firing must have run the very code signed (scriptRanDigestOf), and it must still be that code;
- * when it isn't, the grant ends here (unattendedCoverageFor).
- */
-export declare function cardFromSignedSchedule(store: Store, grant: UnattendedGrant, cardId: number, requireScript?: boolean): boolean;
-/** How many runs a grant has filed on `now`'s UTC day. */
-export declare function unattendedRunsToday(store: Store, grantId: number, now: Date): number;
-/** Whether the grant covers this card's next filing (in `repo`) now; call inside the filing transaction. */
-export declare function unattendedCoverageFor(store: Store, flow: FlowRow, card: {
-    id: number;
-}, repo: string, now: Date): UnattendedGrant | null;
-/** Count one run against the grant's day, in one statement that admits it only under the cap (so two filings racing
- * on two connections can't both take the last run). False when the day is full; then nothing is sealed. */
-export declare function reserveUnattendedRun(store: Store, grant: UnattendedGrant, taskId: string, now: Date): boolean;
-/** Give back a run reserved for a filing that then couldn't be sealed. */
-export declare function releaseUnattendedRun(store: Store, grant: UnattendedGrant, taskId: string): void;
-/** The grant that sealed (or pre-authorized) a task still stands for it: the same live digest, the flow unchanged and
- * still owned by the signer, the signer able to approve in the task's project, its scripts' code unchanged (else it
- * ends here), and the work not protected. */
-export declare function unattendedGrantStands(store: Store, digest: string, signer: string, taskRepo: string | null, touches: readonly string[], now: Date): boolean;
-/** The flow page's and CLI's view of the grant: the live state, and whether (and why not) this viewer can sign. */
-export type UnattendedView = {
-    active: {
-        until: string;
-        untilWords: string;
-        signedBy: string;
-        budgetMicrousd: number | null;
-        dailyRunCap: number | null;
-        runsToday: number;
-        words: string[];
-        covers: string[];
-    } | null;
-    canSign: boolean;
-    problem: string | null;
-    maxDays: number;
-    /** Whether the flow has a schedule, the only thing a grant covers. */
-    scheduled: boolean;
-    /** What a signature covers besides the limits and schedules the form chooses (unattendedLimitWords, unattendedCoverWords,
-     * unattendedEndAfterWords). */
-    terms: {
-        head: string[];
-        rules: string[];
-    };
-    /** The schedules it could cover (optional ones only when picked), and their digest, which the form sends back. */
-    schedules: {
-        id: number;
-        words: string;
-        optional: string | null;
-    }[];
-    schedulesDigest: string;
-    /** No live grant, and the latest one was ended by a change (the flow, a script, a schedule, the project's rules or
-     * the signer's access) before it would have run out: why, and when, so the page says it no longer runs on its own. */
-    ended: {
-        why: string;
-        at: string;
-    } | null;
-};
-export declare function unattendedViewOf(store: Store, flow: FlowRow, viewer: {
-    name: string;
-    approver: boolean;
-}, now: Date): UnattendedView;