toolroll 0.9.104 → 0.9.105

package/dist/graph.d.ts

@@ -1,164 +0,0 @@
-/**
- * Which work graph is already here.
- *
- * Chosen by looking, not by asking — an operator who already keeps their work
- * in beads should not be made to declare that to a tool standing in the same
- * directory. But **detection is not authorization.** Finding a populated
- * tracker says it exists; it says nothing about whether its owner wants Night
- * Orders scheduling, closing, or restructuring what is in it. Nothing here
- * writes, enrolls, or grants anything.
- *
- * **Nothing is ever installed.** No package manager, no package runner, no
- * initializer — `bd init` stages files, edits agent integrations, and can make
- * a commit, so it is the operator's to run. This module runs read commands
- * against binaries that are already on PATH, and prints what it cannot do.
- *
- * Data and runtime are detected independently, and that separation is the
- * point. A populated tracker with no working runtime is real work that this
- * machine cannot currently dispatch, and saying so at 9am is the whole job —
- * the alternative is finding out inside a dead loop at 3am.
- *
- * Where a fact is not established it is `unverified`, and unverified fails
- * closed. A backend whose dependency edges we cannot confirm is shown and may
- * even be recommended, but it is not dispatchable, because §4's rule is that
- * scheduling edges are never emulated: a private graph other tools cannot see
- * is shadow data.
- */
-import { type ExecResult, type RunOptions } from "./exec.js";
-export type BackendKind = "beads" | "backlog-md" | "github-issues";
-/**
- * Whether the backend carries dependency edges of its own.
- *
- * `unverified` is not a soft `native`. It means nobody has confirmed it, and a
- * scheduler must treat it as absent rather than assume in its own favour.
- */
-export type Deps = "native" | "unverified" | "none";
-export type Runtime = {
-    state: "ok";
-    version: string | null;
-} | {
-    state: "missing";
-    binary: string;
-} | {
-    state: "outdated";
-    version: string;
-    needs: string;
-} | {
-    state: "unreadable";
-    reason: string;
-};
-/**
- * What was counted, and which question it answers. A ready count and an open
- * count are different numbers, and labelling one as the other would misreport
- * how much work is actually dispatchable.
- */
-export type Count = {
-    of: "ready" | "open";
-    value: number;
-};
-export type Detection = {
-    kind: BackendKind;
-    label: string;
-    /** Repositories whose data was found on disk, or which have issues. */
-    repos: string[];
-    /** null when nothing could be counted — absence of a number, not zero. */
-    count: Count | null;
-    deps: Deps;
-    runtime: Runtime;
-    /** Whether work here could actually be scheduled tonight. */
-    dispatchable: boolean;
-    /** What could not be read, in words. Never silently dropped. */
-    problems: string[];
-};
-/**
- * The ladder from §3. `ambiguous` is a deliberate outcome and not a failure:
- * several populated trackers mean the operator has to say which one, because
- * task count is not write authority and the biggest tracker may be the
- * abandoned one.
- */
-export type Choice = {
-    action: "recommend";
-    kind: BackendKind;
-    dispatchable: boolean;
-    why: string;
-} | {
-    action: "ambiguous";
-    kinds: BackendKind[];
-    why: string;
-} | {
-    action: "built-in";
-    why: string;
-};
-export type ChooseOptions = {
-    /** A backend the operator already enrolled. Outranks anything detected. */
-    enrolled?: BackendKind;
-};
-/**
- * What the operator would run to set a backend up, and what it would do to
- * their repository.
- *
- * This is text, and stays text. `bd init` creates or updates `AGENTS.md` and
- * installs Claude and Codex integrations unless told not to — which is a
- * substantial thing to do to somebody's repository, and not ours to do on
- * their behalf. A tool that refuses to run `bd init` for you and then quietly
- * ran it from inside a helpful setup prompt would have spent the only
- * credibility it had.
- *
- * There is deliberately no prompt. A wizard would cost the zero-config opening
- * this tool is built around, and half the intended audience is an agent or a
- * scheduled run, where anything that blocks on an answer simply hangs.
- *
- * Commands are quoted from each tool's own documentation rather than inferred.
- * Backlog.md is detected but not offered here, because its install path has
- * not been verified — and printing a command that has not been checked is how
- * an operator ends up running the wrong thing on our say-so.
- */
-export type SetupOption = {
-    kind: BackendKind | "built-in";
-    label: string;
-    /** null when there is nothing to install. */
-    install: string | null;
-    /** null when there is nothing to initialize. */
-    init: string | null;
-    /** What it changes in the repository. Never omitted where there is one. */
-    sideEffects: string | null;
-    note: string | null;
-};
-export declare function setupOptions(): SetupOption[];
-export type Runner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
-export type DetectOptions = {
-    runner?: Runner;
-    /** Injected so the pure half of detection needs no fixture tree. */
-    exists?: (path: string) => boolean;
-};
-/** Reading a tracker is local work; only the GitHub one crosses the network. */
-export declare const LOCAL_TIMEOUT_MS = 10000;
-export declare const NETWORK_TIMEOUT_MS = 20000;
-/**
- * Dependency fields on GitHub Issues need a newer `gh` than the REST route
- * does. The version gate is therefore about *native edges*, not about whether
- * issues can be read at all — an older gh still counts them, it just cannot be
- * trusted to schedule from them.
- */
-export declare const GH_DEPS_MIN_VERSION = "2.94.0";
-export declare const LABELS: Record<BackendKind, string>;
-export declare function detectGraphs(repos: readonly string[], options?: DetectOptions): Promise<Detection[]>;
-/** null when no version-shaped token is present — unknown, not zero. */
-export declare function parseVersion(text: string): string | null;
-/** Negative, zero, or positive, like every other comparator. */
-export declare function compareVersions(left: string, right: string): number;
-/**
- * The ladder from §3, as a pure function so the policy can be read and tested
- * without a filesystem.
- *
- * The rung that does the most work is the third: several populated repo-local
- * trackers mean Toolroll stays in discovery until a person says which one.
- * Picking the largest would be inventing authority out of a row count.
- *
- * GitHub Issues is never chosen automatically. It has native edges, but a
- * populated issue tracker is evidence people file issues, not evidence anyone
- * wants an unattended agent closing them — the design requires existing
- * dependency use *and* a confirmed write scope, and neither is established by
- * looking.
- */
-export declare function chooseBackend(detections: readonly Detection[], options?: ChooseOptions): Choice;

package/dist/guides.d.ts

@@ -1,22 +0,0 @@
-/**
- * Binary-served agent guides (arc 5): the binary is the distribution
- * channel. An agent asks the exact version it is driving — `skills list`
- * names these, `skills get <name>` prints one — and the answer is right
- * by construction, because the content ships compiled into the package.
- * No file reads, no network: string constants survive npx, pruning, and
- * every install layout.
- *
- * The `operating` guide is THE shared source for the installed SKILL.md
- * body (skills.ts composes from it), so the installed snapshot and the
- * served guide cannot drift apart within one version.
- */
-/** Every guide opens with this: the manual defers to the machine. */
-export declare const AUTHORITY_LINE: string;
-export type Guide = {
-    readonly name: string;
-    readonly title: string;
-    readonly oneLiner: string;
-    readonly content: string;
-};
-export declare const GUIDES: readonly Guide[];
-export declare function guideNamed(name: string): Guide | null;

package/dist/handover-note.d.ts

@@ -1,33 +0,0 @@
-import type { Store } from "./store.js";
-export type VerificationLine = {
-    run: number;
-    revision: string | null;
-    words: string;
-    href: string;
-};
-export type HandoverNote = {
-    taskId: string;
-    currentTask: string;
-    asOf: string;
-    revision: {
-        head: string;
-        branch: string | null;
-        run: number;
-    } | null;
-    acceptedDecisions: string[];
-    rejectedApproaches: string[];
-    openFindings: string[];
-    verification: VerificationLine[];
-    beforeAfter: string[];
-    nextAction: string;
-    /** Lists cut at their limit, so a reader knows there is more. */
-    more: number;
-};
-/** The note for a task, or null for no such task. Pass the evidence root to include before-and-after readings. */
-export declare function handoverNoteOf(store: Store, root: string, taskId: string, now: Date): HandoverNote | null;
-/** Plain lines: the CLI's answer, and what the task page shows. */
-export declare function handoverLines(note: HandoverNote): string[];
-/** Whether there is anything to hand over: a first attempt on a new task starts with no note at all. */
-export declare const handoverHasContent: (note: HandoverNote) => boolean;
-/** The note as a fresh agent reads it. Every line is quoted: a record of where the work stands, never an instruction. */
-export declare function handoverBriefLines(note: HandoverNote): string[];

package/dist/health-cli.d.ts

@@ -1,3 +0,0 @@
-import { type ConnectOptions } from './connect-cli.js';
-/** Read the running server, never a fresh CLI process's empty counters or the local database. */
-export declare function runHealthCommand(argv: readonly string[], write: (line: string) => void, options?: ConnectOptions): Promise<number>;

package/dist/home-groups.d.ts

@@ -1,39 +0,0 @@
-/**
- * Home's three groups (docs/plans/one-step-chat.md H1): what waits on you, what is working, what is done. One rule for
- * every surface that groups work this way (Home in the browser, the terminal UI), so they never disagree. Pure: no
- * server, store or rendering imports, so the terminal UI's source can use it too.
- */
-export type HomeGroup = "you" | "working" | "done";
-/** The groups in the order every surface shows them. */
-export declare const HOME_GROUPS: readonly HomeGroup[];
-/** Each group's heading. */
-export declare const HOME_GROUP_LABEL: Readonly<Record<HomeGroup, string>>;
-/** What the rule reads of a work index item (work-index.ts WorkIndexItem): the Tasks views that list it. */
-export type HomeGroupFacts = {
-    readonly status: {
-        readonly views: readonly string[];
-    };
-};
-/**
- * Which group a work index item belongs to, in this order: it waits on you when the Needs you view lists it; it is
- * working when the Running or the Queued view lists it (it runs, or it waits its turn or on Toolroll or another task:
- * nobody is asked), so Working is exactly what the Running and Queued figures count; it is done when it is complete.
- * Null for anything else: cancelled, replaced, put away.
- */
-export declare function homeGroupOf(item: HomeGroupFacts): HomeGroup | null;
-/** The work index totals Home's figures show, each the count of the Tasks list its figure opens. */
-export type HomeFigures = {
-    readonly waitingOnYou: number;
-    readonly running: number;
-    readonly queued: number;
-    readonly done: number;
-};
-/** Home's figures from work index totals (work-index.ts WorkIndexCounts): Done is the whole Completed list. */
-export declare function homeFiguresOf(totals: {
-    readonly "needs-you": number;
-    readonly running: number;
-    readonly queued: number;
-    readonly completed: number;
-}): HomeFigures;
-/** "Waiting on you 2 · Running 1 · Queued 0 · Done 14": the opening line of `toolroll status` and chat /status. */
-export declare function homeFiguresLine(figures: HomeFigures): string;

package/dist/html.d.ts

@@ -1,85 +0,0 @@
-/**
- * Server HTML, escaped by construction.
- *
- * - `Html` is markup this module made. Nothing else can make one: the class
- *   is private and branded, so a string never passes for markup.
- * - `html` is the only way to write markup. Its literal text is the
- *   author's; every interpolated value is text and is escaped, unless it is
- *   already `Html`. Arrays render in order; null, undefined and booleans
- *   render nothing, so `${cond && html`…`}` reads naturally.
- * - `postForm` is the only way to write a POST form. It adds the request's
- *   CSRF field itself, so a form cannot forget it.
- * - Page sinks (the shell, `respond` for text/html, the workspace's page
- *   snapshot) take `Html` and turn it into bytes with `htmlString`.
- *
- * The script, style and JSON constructors exist for the page shell: their
- * sources are code, and each refuses content that could close its element.
- *
- * This module has no server dependencies (the browser bundle shares time
- * helpers that use it); the server's request context supplies the CSRF token.
- */
-declare const MADE_HERE: unique symbol;
-/** Markup this module made. Only this module holds the token its constructor asks for. */
-export declare class Html {
-    #private;
-    constructor(token: typeof MADE_HERE, markup: string);
-    /** The bytes, for a sink. */
-    static markupOf(fragment: Html): string;
-    toString(): string;
-    toJSON(): string;
-}
-export type HtmlValue = Html | string | number | bigint | boolean | null | undefined | readonly HtmlValue[];
-export declare const isHtml: (value: unknown) => value is Html;
-/** The markup of an `Html` value, for a sink that writes bytes. */
-export declare function htmlString(fragment: Html): string;
-/** Markup with every interpolation escaped as text, except values that are already `Html`. */
-export declare function html(strings: TemplateStringsArray, ...values: readonly HtmlValue[]): Html;
-/** Parts in order, with an optional separator between them. */
-export declare function joinHtml(parts: Iterable<HtmlValue>, separator?: HtmlValue): Html;
-/** Plain text, escaped (for a sink that takes Html when the content is only words). */
-export declare const textHtml: (text: string) => Html;
-export type AttributeValue = string | number | boolean | null | undefined;
-/** Attributes as `name="value"` pairs: true is a bare attribute; false, null and undefined are left out. */
-export declare function attributes(values: Readonly<Record<string, AttributeValue>>): Html;
-export type PostFormOptions = {
-    /** Attributes on the form element (class, id, aria-label, data-…). */
-    attrs?: Readonly<Record<string, AttributeValue>>;
-    /** Hidden fields, after the CSRF field (null and undefined are left out). */
-    hidden?: Readonly<Record<string, string | number | null | undefined>>;
-    /** The open project's revision this page was rendered under: a stale tab's post is refused. */
-    projectRevision?: number | string | null;
-    /** Where the action returns afterwards (a same-site path). */
-    returnTo?: string | null;
-    /** Forms before a session exists (sign-in, sign-up, a join link) have no CSRF field. */
-    signedOut?: true;
-};
-/** The server's request context supplies the request's CSRF token (server/request-context.ts). */
-export declare function provideFormToken(source: () => string | undefined): void;
-export declare function providePasswordless(source: () => boolean): void;
-/**
- * A ceremony's re-authentication field: rendered as given, or — with Passwordless on for this signed-in browser —
- * nothing at all (the form posts an empty password; the act proves the session). Never used for credential acts,
- * the sign-in form, a new password, or a secret or API key field.
- */
-export declare function reauth(field: Html): Html;
-/** The same question for a page's own script that builds a re-authentication field itself. */
-export declare const passwordlessRendering: () => boolean;
-/**
- * A POST form: the action, the request's one CSRF field, the optional
- * project revision and return fields, other hidden fields, then the body.
- * Outside a console request there is no CSRF to give, so it refuses.
- */
-export declare function postForm(action: string, body: HtmlValue, options?: PostFormOptions): Html;
-/**
- * Markup edited after rendering: each match of `pattern` in the page is replaced by markup the replacer builds
- * (with html`…`), or kept as it was (null), so nothing unescaped can enter. For whole-page passes (a sign-in that
- * stands in for passwords, the browser shell's insertions).
- */
-export declare function replaceMarkup(page: Html, pattern: RegExp, replace: (match: string, ...groups: string[]) => Html | null): Html;
-/** An inline script whose source is code. Its text may not close the element or open a comment. */
-export declare function scriptElement(source: string, attrs?: Readonly<Record<string, AttributeValue>>): Html;
-/** A style element whose rules are code. */
-export declare function styleElement(css: string, attrs?: Readonly<Record<string, AttributeValue>>): Html;
-/** Inert JSON for a page script to read: no character of it can end the element. */
-export declare function jsonScript(value: unknown, attrs?: Readonly<Record<string, AttributeValue>>): Html;
-export {};

package/dist/install-method.d.ts

@@ -1,17 +0,0 @@
-/**
- * How this Toolroll was installed, read from where its bin really lives, and
- * the one command that updates it that way. Only the path is read: nothing is
- * run and nothing leaves the computer.
- */
-export type InstallKind = "npm" | "pnpm" | "bun" | "yarn" | "homebrew" | "npx" | "source" | "managed" | "desktop";
-export type InstallMethod = {
-    kind: InstallKind;
-    updateCommand: string;
-};
-export declare const UPDATE_COMMANDS: Record<InstallKind, string>;
-export type InstallProbe = {
-    realpath?: (path: string) => string;
-    exists?: (path: string) => boolean;
-};
-/** The install method of the bin at `bin` (the running one by default). Unknown shapes read as npm, the common case. */
-export declare function installMethod(bin?: string | undefined, probe?: InstallProbe): InstallMethod;

package/dist/integrations-ui.d.ts

@@ -1,17 +0,0 @@
-/**
- * Settings → Integrations: which integrations work. One record each: its name
- * and state, the account it's connected as, when it last worked and last
- * failed, what uses it, and one action. The list comes from saved checks; a
- * render never waits on one (see integrations.ts). Built from the revamp kit;
- * the Settings frame adds the title.
- */
-import { type Html } from "./html.js";
-import { type Integration, type SecretsKept } from "./integrations.js";
-/** The page is kit pieces now; nothing of the old look is left. Kept as an export for the shared stylesheet. */
-export declare const INTEGRATIONS_CSS = "";
-export declare function integrationsHtml(list: readonly Integration[], csrf: string, said: {
-    said?: string | null;
-    problem?: string | null;
-    checking?: boolean;
-    secrets?: SecretsKept;
-}): Html;

package/dist/integrations.d.ts

@@ -1,138 +0,0 @@
-import type { Store } from "./store.js";
-import type { Runner } from "./backend.js";
-import type { ConnectionChecker } from "./provider-connection.js";
-export type IntegrationState = "connected" | "not-set-up" | "broken";
-export type IntegrationGroup = "chat" | "code" | "mail" | "tools" | "monitoring" | "agents";
-/** Where a person goes (or what they run) to set something up or fix it. */
-export type IntegrationPlace = {
-    href: string | null;
-    command: string | null;
-};
-export type IntegrationAction = ({
-    kind: "setup";
-    label: "Set up";
-} & IntegrationPlace) | {
-    kind: "test";
-    label: "Check connection";
-} | ({
-    kind: "fix";
-    label: "Fix";
-    words: string;
-} & IntegrationPlace)
-/** A project's youiyoux requests: one switch, and the problem to fix when it is Broken. */
- | {
-    kind: "switch";
-    label: "Turn off" | "Turn on";
-    repo: string;
-    on: boolean;
-    words: string | null;
-};
-export type Integration = {
-    key: string;
-    group: IntegrationGroup;
-    name: string;
-    state: IntegrationState;
-    /** The account or workspace name, never a credential. */
-    account: string | null;
-    /** One short fact, such as which projects can be pushed to. */
-    detail: string | null;
-    /** Whether a check has answered for this integration yet (always true for those with nothing to check). */
-    checked: boolean;
-    checkedAt: string | null;
-    lastSuccessAt: string | null;
-    lastError: string | null;
-    lastErrorAt: string | null;
-    usedBy: string[];
-    action: IntegrationAction;
-    /** A project's own MCP tool: it shows a letter, never a logo matched by name. */
-    custom?: true;
-    /** A project's MCP tool: how its runs get credentials ("Short-lived token per run", "Key held by Toolroll"). */
-    credentials?: string;
-};
-export declare const STATE_WORDS: Record<IntegrationState, string>;
-export type ProbeResult = {
-    outcome: "ok";
-    account?: string | null;
-    detail?: string | null;
-} | {
-    outcome: "failed";
-    problem: string;
-    account?: string | null;
-    detail?: string | null;
-    fix?: Partial<IntegrationPlace>;
-} | {
-    outcome: "absent";
-    problem: string;
-    setup?: Partial<IntegrationPlace>;
-};
-export type IntegrationIo = {
-    store: Store;
-    /** The folder beside the database where credential files live; null when there is none. */
-    dir: string | null;
-    telegramTokenFile: string | null;
-    env: Record<string, string | undefined>;
-    /** The projects whose MCP tools and GitHub push rights are listed. */
-    repos: readonly string[];
-    fetch?: typeof fetch;
-    /** How `gh` runs (tests replace it). */
-    gh?: Runner;
-    /** The same sign-in check Settings → AI providers makes. */
-    checkConnection?: ConnectionChecker;
-    /** Where project tool secrets live. */
-    toolHome?: string | undefined;
-    /** Whether a mail server answers at host:port (tests replace it). */
-    reach?: (host: string, port: number, secure: boolean) => Promise<void>;
-    clock?: () => Date;
-};
-/** Remove every known secret value and anything shaped like a token; keep it to one short line. */
-export declare function scrubIntegrationText(text: string, secrets?: readonly (string | null | undefined)[]): string;
-type CheckRow = {
-    key: string;
-    outcome: "ok" | "failed" | "absent";
-    account: string | null;
-    detail: string | null;
-    problem: string | null;
-    checkedAt: string;
-    okAt: string | null;
-    error: string | null;
-    errorAt: string | null;
-};
-export declare function readIntegrationChecks(store: Store): Map<string, CheckRow>;
-export declare function recordIntegrationCheck(store: Store, key: string, result: ProbeResult, now: Date): void;
-/** Whether something answers at host:port: a connection opened and closed, no login and no message. */
-export declare function reachServer(host: string, port: number, secure: boolean): Promise<void>;
-/** Every integration as it stands now, from files and saved history only: no network, no process, never slow. */
-export declare function integrationsNow(io: IntegrationIo): Integration[];
-/** Run the checks (all, or the named ones), record each answer, and return the list. */
-export declare function checkIntegrations(io: IntegrationIo, keys?: readonly string[]): Promise<Integration[]>;
-/** The one line `status` and `onboard` add when something is Broken; null when nothing is. */
-export declare function integrationsBrokenLine(list: readonly Integration[]): string | null;
-/** Where secrets rest (project-tools.ts toolSecretStorage), as Settings and the CLI take it. */
-export type SecretsKept = {
-    words: string;
-    filesOnly: boolean;
-    problem?: string;
-};
-/** The one line about where secrets rest, or null: a folder that can't be used always; files only once something set up holds secrets. */
-export declare function secretsNote(list: readonly Integration[], secrets: SecretsKept | null | undefined): {
-    words: string;
-    problem: boolean;
-} | null;
-/** The CLI's lines: one per integration, then the fix under anything Broken; last, where secrets are kept when that is
- * files only, or why they can't be used (secretsNote). */
-export declare function renderIntegrations(list: readonly Integration[], secrets?: SecretsKept | null): string[];
-export type IntegrationMonitor = {
-    /** The list now, from the last answers saved. It only reads: a page calls it on every render (docs/plans/get-side-effects.md). */
-    list(): Integration[];
-    /** Check now and wait (Check connection, Check now, or the first answer in a test). */
-    check(keys?: readonly string[]): Promise<Integration[]>;
-    /** The background pass: start a check when the last one is older than the cache. Never called from a page. */
-    refreshIfDue(): void;
-    /** Whether a background check is running. */
-    readonly checking: boolean;
-};
-export declare function createIntegrationMonitor(io: () => IntegrationIo, options?: {
-    cacheMs?: number;
-    now?: () => number;
-}): IntegrationMonitor;
-export {};