toolroll 0.9.104 → 0.9.105

package/dist/nightly-check.d.ts

@@ -1,107 +0,0 @@
-import { fileIdentity, groupIdentity, journeyIdentity, unitIdentity, versionIdentity, type CheckReport } from "./contracts/release-check.js";
-import type { StandingOrder } from "./contracts/flow.js";
-import { type Store } from "./store.js";
-import type { Runner } from "./worktree.js";
-import type { StandingFiring } from "./flow-schedule.js";
-/** How long a nightly may be missing before its flow says so. */
-export declare const NIGHTLY_MISSED_MS: number;
-export declare const NIGHTLY_STEM = "nightly";
-export type MainCheck = NonNullable<StandingOrder["check"]>;
-/** What every nightly firing files: fixed here, never read from the trigger's settings. */
-export declare const NIGHTLY_GOAL = "Run the full release check on main's head.";
-export declare const NIGHTLY_NOT = "Changing anything: this is a check only.";
-export declare const NIGHTLY_ACCEPTANCE: readonly {
-    id: string;
-    statement: string;
-    how: null;
-    evidence: "check"[];
-}[];
-/** The ledger act that records a person's approval of a nightly check, keyed by its trigger. */
-export declare const NIGHTLY_APPROVED = "nightly check approved";
-/** The ledger act that records a person turning GitHub's nightly into release debt for a project (nightly-github.ts). */
-export declare const GITHUB_NIGHTLY_ON = "github nightly debt on";
-/** The digest a person's approval of the nightly signs: the trigger, the project, the schedule, the check-only terms
- * and the fixed words each firing files. */
-export declare function nightlyDigestOf(trigger: number, repo: string, schedule: string, check: MainCheck): string;
-/**
- * The approval of a nightly check as the plane recorded it when a person proved themselves (createNightlyCheckFlow):
- * the newest ledger row for this trigger. The trigger's own settings never stand in for it — anyone who can edit them
- * could write one.
- */
-export declare function nightlyApprovalOf(store: Store, trigger: number): {
-    digest: string;
-    by: string;
-    proof: string;
-    at: string;
-} | null;
-/** How often the watch loop reads each recorded remote's main again, and how old a read may be when a nightly fires
- * or debt is cleared against it (review round 2: one window, two refreshes wide, for both decisions). */
-export declare const TRUSTED_MAIN_REFRESH_MS: number;
-export declare const TRUSTED_MAIN_FIRE_MS: number;
-export declare const TRUSTED_MAIN_CLEAR_MS: number;
-/**
- * Main's head as Toolroll's own process last read it from the project's RECORDED remote (remote-main.ts: the recorded
- * URL, a private plane-owned Git directory, objects that arrive only by fetch) — never a ref in the project's Git
- * directory, which a build shares and can move (review round 1). Null when there is no read young enough, when the
- * last read failed, or when the read was of another remote than the one recorded now (review round 2).
- */
-export declare function trustedMainOf(store: Store, repo: string, now: Date, maxAgeMs: number): string | null;
-/** The watch loop's read of each project's recorded remote main that the nightly check, GitHub's nightly (its runs count
- * only at commits on main's history) or main's debt needs, at most
- * every 30 minutes. Each read is a fresh fetch into a private directory. A failed read forgets the last one. A good
- * one hands its verified objects to the project's Git store (hardened git, content-addressed: git checks every object
- * against its hash, and filing verifies the commit again), so the nightly can check a merge the checkout never pulled. */
-export declare function refreshTrustedMains(store: Store, root: string, now: Date, runner?: Runner): Promise<number>;
-/**
- * Set up the nightly full check for a project, approved by a person proved now (their password or a re-check; never a
- * lead or remote token). Its schedule starts paused unless `start`; turning it on is the flow's own switch.
- */
-export declare function createNightlyCheckFlow(store: Store, input: {
-    repo: string;
-    schedule: string;
-    as: string;
-    token: string;
-    start: boolean;
-}, now: Date): {
-    ok: true;
-    flow: number;
-    trigger: number;
-} | {
-    ok: false;
-    message: string;
-};
-/** A nightly firing (fileStandingOrder routes here): the approval checked again, main's head read, one check-only task
- * filed and sealed by its standing order. */
-export declare function fileNightlyCheck(store: Store, input: {
-    flowId: number;
-    repo: string;
-    trigger: number;
-    schedule: string;
-    order: StandingOrder;
-    title: string;
-    slot: string;
-}, now: Date): StandingFiring;
-/** Whether a task is a nightly check of main (check only: it never deploys, merges or completes). */
-export declare const isNightlyTask: (store: Store, taskId: string) => boolean;
-/** Every item a failed check failed: each failed identity, each failed group or version, and the whole part for a
- * part that couldn't say which items (it stopped, never reported, or crashed). No report: every part. */
-export declare function failedItems(report: CheckReport | null): string[];
-/** The words of one failure notice: "2 unit files, app/pages". */
-export declare function failureSummary(items: readonly string[]): string;
-/**
- * Whether a full run's report shows `item` itself ran and PASSED there (security review): a failed identity has to be
- * reported passed by name — missing, skipped, or a passing part around it never clears it. A part-level item clears
- * when that whole part ran and passed.
- */
-export declare function coversItem(report: CheckReport, item: string): boolean;
-/**
- * The plane's sweep (watch's follow-up checks): settle each finished nightly (failure rows and one attention notice),
- * then let each finished full release check clear the main failures it covers. Returns how many it settled.
- */
-export declare function settleReleaseChecks(store: Store, root: string, now: Date): number;
-/** The nightly's flow health: "the nightly check hasn't run since …" after 26 hours without a firing. Null when it ran
- * recently, or the project has no nightly check. */
-export declare function nightlyHealthWords(store: Store, repo: string, configuredAt: string, now: Date): string | null;
-export { fileIdentity, groupIdentity, journeyIdentity, unitIdentity, versionIdentity };
-/** The items the nightly check of main found failing that are still open: a full check reports each by name. */
-export declare function openMainFailureItems(store: Store, repo: string): string[];

package/dist/nightly-github.d.ts

@@ -1,318 +0,0 @@
-import { GITHUB_NIGHTLY_ON } from "./nightly-check.js";
-import { type Store } from "./store.js";
-export { GITHUB_NIGHTLY_ON };
-/** The one workflow file whose runs count: exactly this path, never one with an `@` suffix or another folder's. */
-export declare const NIGHTLY_WORKFLOW_PATH = ".github/workflows/nightly.yml";
-/** GitHub's re-run horizon: a counted run is read again for new attempts for this long. */
-export declare const NIGHTLY_WATCH_MS: number;
-/** Listing never goes further back than this: no run older than it can still be unfinished. */
-export declare const NIGHTLY_LIST_HORIZON_MS: number;
-/** Pages of runs one read lists at most; a longer backlog resumes on the next read. */
-export declare const NIGHTLY_PAGES_PER_READ = 10;
-/** A boundary's one bounded read (deploy, merge, pre-tag), and the background read's overall deadline. */
-export declare const NIGHTLY_BOUNDARY_READ_MS = 20000;
-export declare const NIGHTLY_BACKGROUND_READ_MS = 60000;
-/** How often the watch loop reads each opted-in project's nightly. */
-export declare const NIGHTLY_BACKGROUND_EVERY_MS: number;
-export declare const SHARDS_PASSED_STEP = "Every shard passed";
-export declare const SHARDS_COVERED_STEP = "Every shard ran the whole suite";
-/** One GitHub REST read through the plane's own gh (release-adapters.ts githubReads), bounded by `timeoutMs`. */
-export type GhRead = (path: string, timeoutMs: number) => Promise<{
-    ok: true;
-    body: unknown;
-} | {
-    ok: false;
-    why: string;
-}>;
-/** Main as the plane read it from the recorded remote: whether a commit is on its first-parent history ("unknown" when
- * main hasn't been read lately, the commit isn't here yet, or the read of main is older than `since` — a run created
- * after main was read may be on a main that read hasn't seen), and whether one main commit contains another. */
-export type MainHistory = {
-    /** `deadline`: wall-clock milliseconds by which the local history work stops ("unknown" then). */
-    onMain(sha: string, since: string, deadline: number): "yes" | "no" | "unknown";
-    /** Three-state, like onMain: "unknown" when history couldn't be read whole or the deadline passed. */
-    mainContains(sha: string, ancestor: string, deadline: number): "yes" | "no" | "unknown";
-};
-export type NightlyDeps = MainHistory & {
-    gh: GhRead;
-    now: () => Date;
-};
-/** One read inside a read's deadline. */
-type Get = (path: string) => Promise<{
-    ok: true;
-    body: unknown;
-} | {
-    ok: false;
-    why: string;
-}>;
-/** Whether a project opted in, as the plane recorded a person's step: the newest such ledger row, read strictly. */
-export declare function githubNightlyOf(store: Store, repo: string): {
-    slug: string;
-    url: string;
-    record: number;
-    by: string;
-    at: string;
-} | null;
-/** Every project that ever opted in (a broken or superseded record still counts here: its debt still holds). */
-export declare function githubNightlyRepos(store: Store): string[];
-/** A lane's stable id: its workflow file and the required check's name when it was seeded. */
-export declare const laneIdOf: (workflow: string, name: string) => string;
-/** One lane per required check whose name no lane (by its name or an alias) answers to yet. A retired lane whose name
- * is required again opens again. */
-export declare function seedLanes(store: Store, repo: string, now: Date): void;
-/** The live lane a job of `workflow` named `name` belongs to: a person's alias first (the newest for that name), then
- * the lane seeded under it. Never a guess: anything else is no lane. */
-export declare function resolveLane(store: Store, repo: string, workflow: string, name: string): string | null;
-/** The name a lane is shown by: its newest alias, else the name it was seeded under. */
-export declare function laneName(store: Store, repo: string, laneId: string): string;
-/** `toolroll release nightly --github`: a person turns GitHub's nightly into release debt for this project. The
- * repository is the project's recorded remote's, never the checkout's. */
-export declare function optInGithubNightly(store: Store, input: {
-    repo: string;
-    as: string;
-    token: string;
-}, now: Date): {
-    ok: true;
-    slug: string;
-    lanes: number;
-} | {
-    ok: false;
-    message: string;
-};
-/** `--lane-alias <old-id> <new name>`: a person says a renamed job is the same lane. Open debt goes with the lane. */
-export declare function aliasNightlyLane(store: Store, input: {
-    repo: string;
-    laneId: string;
-    name: string;
-    as: string;
-    token: string;
-}, now: Date): {
-    ok: true;
-} | {
-    ok: false;
-    message: string;
-};
-/** `--lane-retire <lane-id>`: a person retires a lane no required check names any more; its open debt closes,
- * recorded as theirs. */
-export declare function retireNightlyLane(store: Store, input: {
-    repo: string;
-    laneId: string;
-    as: string;
-    token: string;
-}, now: Date): {
-    ok: true;
-    closed: number;
-} | {
-    ok: false;
-    message: string;
-};
-type GhRun = {
-    id: number;
-    path: string;
-    repository: string | null;
-    headRepository: string | null;
-    headBranch: string | null;
-    headSha: string;
-    event: string;
-    status: string;
-    runAttempt: number;
-    createdAt: string;
-};
-type GhStep = {
-    number: number;
-    name: string;
-    status: string;
-    conclusion: string | null;
-};
-export type GhJob = {
-    id: number;
-    name: string;
-    status: string;
-    conclusion: string | null;
-    startedAt: string | null;
-    completedAt: string | null;
-    headSha: string;
-    runId: number;
-    runAttempt: number | null;
-    steps: GhStep[] | null;
-};
-/** Whether a run is one of the project's own nightly runs on main (everything but main's history, checked apart). */
-export declare function nightlyRunBinds(run: Pick<GhRun, "path" | "repository" | "headRepository" | "headBranch" | "event" | "headSha">, slug: string): boolean;
-export type Cause = "passed" | "test-failure" | "runner-failure" | "not-run";
-/**
- * Why a completed lane job ended as it did, from GitHub's own job and step records in the same attempt
- * (evals-nightly.md, "Cause of a failure"). Fails closed: anything not positively the runner's is a test failure.
- */
-export declare function causeOf(job: GhJob, attempt: readonly GhJob[]): Cause;
-export type NightlyRead = {
-    ok: true;
-    listed: number;
-    checked: number;
-    complete: boolean;
-} | {
-    ok: false;
-    why: string;
-};
-/**
- * One read of the project's GitHub nightly within `budgetMs`: list runs from the cursor, re-read the watch list (new
- * and unfinished runs first, then the oldest-checked), record every completed lane job, open and clear failures. A
- * failed call stops where it is; what was recorded stays, and the cursor never moves past a page it couldn't read.
- */
-export declare function readGithubNightly(store: Store, repo: string, deps: NightlyDeps, budgetMs: number): Promise<NightlyRead>;
-/** Read one run by id, strictly. */
-export declare function readRun(get: Get, slug: string, id: number): Promise<GhRun | null>;
-/** Every job of one exact attempt of one run, every page, each GitHub's record of that run, attempt and commit. Null
- * when any page can't be read whole. */
-export declare function readAttemptJobs(get: Get, slug: string, run: number, attempt: number, sha: string): Promise<GhJob[] | null>;
-/** A recorded open failure of a lane. */
-export type LaneFailure = {
-    id: number;
-    repo: string;
-    laneId: string;
-    ghRun: number;
-    attempt: number;
-    jobId: number;
-    sha: string;
-    completedAt: string;
-    openedAt: string;
-};
-export declare function openFailures(store: Store, repo: string): LaneFailure[];
-/**
- * Clear each open failure that a later counted nightly run passed: a run created after the failed run (a rerun of an
- * older run never clears newer debt; Codex round 1, finding 2), the same lane, a job started after the failed one
- * completed, on a commit that contains the failed one. A re-run inside the same run never clears. Local history work
- * stops at `wall` (wall-clock ms); what is left is settled on a later read.
- */
-export declare function settleGithubNightly(store: Store, repo: string, history: Pick<MainHistory, "mainContains">, now: Date, wall?: number): {
-    cleared: number;
-    complete: boolean;
-    unresolved: string | null;
-};
-/** Main's history as the plane read it from the project's recorded remote (nightly-check.ts trustedMainOf), from the
- * verified objects in the project's own Git store; never a ref a build could move. */
-export declare function mainHistoryOf(store: Store, repo: string, now: Date): MainHistory;
-/**
- * The watch loop's background read (operate.ts refreshGithubNightlies): each opted-in project at most every
- * NIGHTLY_BACKGROUND_EVERY_MS, claimed in the store so two processes don't both read, within one overall deadline.
- */
-export declare function readGithubNightlies(store: Store, deps: {
-    gh: GhRead;
-    now: () => Date;
-    history?: (repo: string, now: Date) => MainHistory;
-}, budgetMs?: number): Promise<number>;
-/** What a hold stops: a deploy, the merge, the tag (pre-tag authorization), or an automatic approval (sealAutoGreen). */
-export type NightlyPhase = "deploy" | "merge" | "tag" | "auto";
-/** How long a boundary's re-read of a candidate's exemption stands for the stored checks inside the reservation, the
- * deployment gate and the installed runtime's deploy check after it. */
-export declare const EXEMPTION_FRESH_MS: number;
-/** "Oct 30, 06:17 UTC". */
-export declare const nightlyStamp: (iso: string) => string;
-/** The words of a nightly hold: the first open failure, how many more, and the way out at this point. */
-export declare function nightlyDebtWords(store: Store, held: readonly LaneFailure[], phase: NightlyPhase, release: boolean): string;
-/**
- * The stored check every boundary makes, inside the caller's own transaction where it has one (the deployment gate, the
- * deploy and merge reservations, the pre-tag step, an automatic approval): the project's open lane failures, less those
- * this exact task and candidate hold a fresh exemption for. Null when nothing holds. A project that never opted in has
- * no lane failures.
- */
-export declare function nightlyDebtHold(store: Store, input: {
-    repo: string;
-    taskId: string | null;
-    candidate: string | null;
-    phase: NightlyPhase;
-    release: boolean;
-    now: Date;
-}): {
-    why: string;
-    failures: LaneFailure[];
-} | null;
-/** How the project's GitHub nightly stands: whether it is on, when it was last read (and why not), when it last ran. */
-export type NightlyStatus = {
-    on: boolean;
-    lastOkAt: string | null;
-    lastWhy: string | null;
-    lastRunAt: string | null;
-    stale: boolean;
-};
-/** No nightly run seen for this long reads "hasn't run since". */
-export declare const NIGHTLY_STALE_MS: number;
-export declare function githubNightlyStatus(store: Store, repo: string, now: Date): NightlyStatus;
-/** A warning that never holds anything (Decision 1): GitHub couldn't be read, or the nightly hasn't run lately. */
-export declare function nightlyWarning(status: NightlyStatus, now: Date): string | null;
-/** One workflow's newest pull-request run on a candidate head, as an exemption reads it. */
-export type LaneJobs = {
-    run: number;
-    attempt: number;
-    status: string;
-    jobs: GhJob[];
-};
-/**
- * A release candidate's own pull-request CI, as an exemption needs it (modelled on scripts/release-proof.mjs): for each
- * workflow, the newest run on `head` from that pull request's `pull_request` event, that run's latest attempt's jobs
- * with their times, then the run read again. The newest run is chosen first: one that doesn't bind to this pull
- * request never lets an older run stand. `null` for a workflow with no such run; "unreadable" when anything can't be
- * read whole or changed during the read.
- */
-export declare function readLaneJobs(get: Get, slug: string, pr: number, head: string, workflows: readonly string[]): Promise<Map<string, LaneJobs | null> | "unreadable">;
-/** The files a lane's job runs that the candidate could otherwise rewrite to make a job of that name pass: its workflow
- * file and the CI scripts the workflows call. An exemption stands only when each is byte-identical (the same Git
- * blob) on the candidate and at the failed commit. The tests themselves are the candidate's, as for every required
- * check (the trust the required-checks gate already places in them). */
-export declare const LANE_PINNED_FILES: readonly ["scripts/ci-shards.mjs", "scripts/ci-scope.mjs", "scripts/ci-git.sh", "scripts/ci-no-skips.mjs"];
-export type NightlyBoundary = {
-    ok: true;
-    warning: string | null;
-} | {
-    ok: false;
-    why: string;
-    warning: string | null;
-};
-/**
- * A boundary (the coordinator's deploy, merge and pre-tag steps): one bounded read of GitHub's nightly, then this
- * candidate's exemptions read again from its own pull-request CI — minted only before the merge (`deploy`, `merge`);
- * at the tag an exemption obtained before the merge is re-read, never made — then the stored debt. A read that fails is
- * a warning and the stored debt still holds; an exemption that can't be re-read is no exemption here.
- */
-export declare function nightlyBoundary(store: Store, input: {
-    repo: string;
-    taskId: string;
-    candidate: string;
-    pr: number;
-    phase: Exclude<NightlyPhase, "auto">;
-}, deps: NightlyDeps, budgetMs?: number): Promise<NightlyBoundary>;
-/** One project-level Needs-you item: an open GitHub nightly lane failure, or a nightly check of main that failed. */
-export type NightlyNeed = {
-    key: string;
-    repo: string;
-    title: string;
-    reason: string;
-    href: string;
-    since: string;
-};
-/**
- * Needs you, for the projects `shown` admits: one item per open GitHub nightly lane failure (linking to its job on
- * GitHub, under the opted-in repository the plane recorded), and one per nightly check of main with open failures
- * (linking to its task). Oldest first.
- */
-export declare function nightlyNeedsYou(store: Store, shown: (repo: string) => boolean): NightlyNeed[];
-/** The release card's GitHub nightly lines: each open lane failure (held, or exempted for this candidate), then a
- * warning when GitHub couldn't be read or the nightly hasn't run lately. Empty when there is nothing to say. */
-export declare function nightlyReleaseLines(store: Store, input: {
-    repo: string;
-    taskId: string;
-    candidate: string | null;
-    now: Date;
-}): string[];
-/**
- * A deploy run's own boundary (scripts/deploy-browser.mjs, through the installed runtime; Codex round 1, finding 3):
- * the same bounded read as the coordinator's — GitHub's nightly, then this candidate's exemptions re-read — before the
- * stored check, so a deploy started by hand neither misses a new failure nor rides an exemption its CI no longer
- * supports. A task no release covers has no exemption to re-read; its nightly is still read. Anything that fails here
- * takes away the candidate's stored exemptions; the stored check that follows decides.
- */
-export declare function refreshNightlyForDeploy(store: Store, input: {
-    runId: number;
-    now: () => Date;
-    gh?: GhRead;
-    budgetMs?: number;
-}): Promise<NightlyBoundary | null>;

package/dist/notification-delivery.d.ts

@@ -1,19 +0,0 @@
-import type { Notification, Store } from "./store.js";
-type Claim = Notification & {
-    destination: string;
-    generation: number;
-};
-/** URLs and shell commands can contain secrets. Only a destination hash enters saved receipts. */
-export declare function notificationDestination(kind: string, target: string): string;
-/** One-release compatibility for operator-configured, installation-wide senders. Personal notifications never leave here. */
-export declare function claimNotifications(store: Store, destination: string, owner: string, now: Date): Claim[];
-export declare function finalizeNotification(store: Store, row: Claim, owner: string, outcome: {
-    ok: true;
-    receipt: string | null;
-} | {
-    ok: false;
-    error: string;
-}, now: Date): boolean;
-/** Recheck after earlier network sends: expiry or resolution must stop this send, not just its receipt. */
-export declare function notificationClaimHeld(store: Store, row: Claim, owner: string, now: Date): boolean;
-export {};

package/dist/notification-rows.d.ts

@@ -1,30 +0,0 @@
-/** Saved notifications, read and told apart without a store: the row readers, the lifecycle key and the predicates
- * the store and the chat core (chat-messages.ts) share. A leaf: it imports types only. */
-import type { LeadProposal, Notification, NotificationReceipt } from "./store.js";
-/** The one task a card is about: a task its confirmation created (a new
- * task, a revision), else the task it names (and, for feedback on a result,
- * that result). Null for a card about no single task. A pointer for
- * replies, never an authority. */
-export declare function proposalTaskOf(proposal: LeadProposal | null): {
-    task: string;
-    run: number | null;
-} | null;
-/** Every lifecycle dedupe key starts here: `life:<kind>:<identity>:<ordinal>`. */
-export declare const LIFECYCLE_KEY_PREFIX = "life:";
-/**
- * Task lifecycle updates (Telegram task updates, 2026-09-16): the CLOSED
- * vocabulary of routine progress facts the shared mutations record beside
- * the change that made them true. None carries a push class — they are
- * digest-eligible progress, never a page — and every one is project-bound
- * through the task it names. A decision, incident, gap, stall, publication
- * or merge page keeps its own producer; nothing here repeats one.
- */
-export declare const LIFECYCLE_KINDS: readonly ["task-filed", "scope-approved", "approval-withdrawn", "task-held", "task-released", "task-queued", "task-requeued", "task-cancelled", "run-started", "run-phase", "check-progress", "run-finished", "run-stopping", "run-stopped", "run-resumed", "review-requested", "review-finished", "acceptance-evidence", "acceptance-ready"];
-export type LifecycleKind = (typeof LIFECYCLE_KINDS)[number];
-/** A progress fact, told apart by its durable key — never by display text. */
-export declare function isLifecycleNotification(row: Pick<Notification, "dedupeKey">): boolean;
-/** Only known progress producers can repaint a card. Decisions and urgent
- * incidents keep their own alerts; a routine retry updates its saved attempt. */
-export declare function isTelegramProgressNotification(row: Pick<Notification, "dedupeKey" | "kind" | "pushClass" | "run">): boolean;
-export declare function readNotification(row: Record<string, unknown>): Notification;
-export declare function readNotificationReceipt(row: Record<string, unknown>): NotificationReceipt;

package/dist/oauth-run-token.d.ts

@@ -1,51 +0,0 @@
-import type { ToolSpec } from "./contracts/integration-metadata.js";
-/** The secrets a connected tool keeps: the bearer the MCP server takes, and what renewing it needs. */
-export declare const ACCESS = "OAUTH_ACCESS_TOKEN", REFRESH = "OAUTH_REFRESH_TOKEN", CLIENT = "OAUTH_CLIENT_ID", CLIENT_SECRET = "OAUTH_CLIENT_SECRET", TOKEN_URL = "OAUTH_TOKEN_URL", EXPIRES = "OAUTH_EXPIRES_AT", RESOURCE = "OAUTH_RESOURCE";
-/** The scope the sign-in granted, kept beside its token. Not one of the spec's secrets, so it never reaches a launch. */
-export declare const GRANTED = "OAUTH_GRANTED_SCOPE";
-/** Where the service revokes a token (RFC 7009), when its sign-in said. Not one of the spec's secrets either. */
-export declare const REVOKE_URL = "OAUTH_REVOKE_URL";
-/** A tool connected by signing in: a web tool whose sign-in is the access token. */
-export declare const signedIn: (spec: Pick<ToolSpec, "transport" | "bearer">) => boolean;
-/** Whether runs of a signed-in tool get their own token: only when there is a refresh token to make one with. */
-export declare const mintsRunTokens: (values: Readonly<Record<string, string>> | readonly string[]) => boolean;
-/** A sign-in address Toolroll will send a token to: https, or a stand-in on this computer. */
-export declare const signInAddress: (value: unknown) => value is string;
-export declare const readScope: (scope: string) => boolean;
-/** An OAuth `scope` value as scope tokens (RFC 6749), sorted and deduplicated; null when absent, empty or malformed. */
-export declare function scopeList(value: unknown): string[] | null;
-/**
- * The scope a run asks for: none (the saved grant, never more) for a build; for a research step, only the grant's
- * read scopes when it has some and others besides. A grant never said is left as it is.
- */
-export declare function runScope(granted: readonly string[] | null, readOnly: boolean): string[] | null;
-/**
- * One renewal of a sign-in at a time (per project and tool, in this process): a service that rotates its refresh
- * token on every use would otherwise see the same one twice, and whichever answer was saved last would be the
- * newest only by luck.
- */
-export declare function oneAtATime<T>(key: string, work: () => Promise<T>): Promise<T>;
-type Fetch = typeof fetch;
-/** A run's token: the access token alone, its expiry, a rotated refresh token to keep, and how to revoke it. */
-export type RunToken = {
-    access: string;
-    expires: string | null;
-    rotated: string | null;
-    revoke: (() => Promise<void>) | null;
-};
-/**
- * Trade the saved refresh token for an access token of this run's own. Plain reasons only: a service's answer is
- * never repeated, so no token can ride an error into a log or the run's record.
- */
-export declare function mintRunToken(values: Readonly<Record<string, string>>, options: {
-    scope: readonly string[] | null;
-    now: Date;
-    fetcher?: Fetch;
-}): Promise<{
-    ok: true;
-    token: RunToken;
-} | {
-    ok: false;
-    reason: string;
-}>;
-export {};

package/dist/observations.d.ts

@@ -1,36 +0,0 @@
-import type { Runner } from "./builder.js";
-import type { Store } from "./store.js";
-import { type ObservationCase } from "./contracts/observation-request.js";
-export declare const OBSERVATION_MAILBOX = "STANDING-ORDERS-OBSERVATIONS.json";
-export declare const OBSERVATION_CAPTURE = "machine focused observations v1";
-export declare const OBSERVATION_FILE = "REVIEW-OBSERVATIONS.json";
-export type ObservationBrief = {
-    kind: "evidence-observation";
-    sourceTask: string;
-    sourceRun: number;
-    sourceScopeDigest: string;
-    head: string;
-    originalBase: string;
-    unresolved: {
-        id: string;
-        statement: string;
-        detail: string[];
-    }[];
-    gateDigest: string;
-};
-export declare function focusedTestCommandSupported(command: string): boolean;
-export type { ObservationCase };
-export declare function originalTaskBase(store: Store, taskId: string): string | null;
-/** The existing sealed revision brief identifies this narrower kind of work.
- * A title, agent-authored mailbox, or handoff can never elect gate reuse. */
-export declare function observationBrief(store: Store, root: string, taskRef: number): ObservationBrief | null;
-export declare function parseObservationCases(raw: string, ids: readonly string[]): ObservationCase[];
-export type ObservationEvidence = {
-    artifact: number;
-    sha256: string;
-    content: string;
-};
-export declare function readObservationEvidence(store: Store, root: string, runId: number): ObservationEvidence | null;
-/** The supplied runner applies the build's existing stop, custody, environment
- * and approved command timeout. Only fixed argv is constructed here. */
-export declare function collectObservations(store: Store, root: string, runId: number, worktree: string, brief: ObservationBrief, cases: readonly ObservationCase[], execute: Runner, now: () => Date): Promise<void>;

package/dist/oidc.d.ts

@@ -1,71 +0,0 @@
-export type GroupRule = {
-    group: string;
-    role: "operator" | "viewer";
-    projects: "all" | string[];
-};
-export type OidcSettings = {
-    issuer: string;
-    clientId: string;
-    clientSecret: string | null;
-    /** What the sign-in button says: "Okta", "Microsoft", "Google". */
-    label: string;
-    scopes: string;
-    /** The ID token claim that lists a person's groups. */
-    groupsClaim: string;
-    rules: GroupRule[];
-    /** Who may still sign in with a Toolroll password once sign-in with the provider is on. */
-    passwords: "everyone" | "operators";
-};
-export type OidcProvider = {
-    issuer: string;
-    authorize: string;
-    token: string;
-    jwks: string;
-};
-export type OidcClaims = {
-    sub: string;
-    email: string | null;
-    name: string | null;
-    username: string | null;
-    groups: string[];
-    authTime: number | null;
-};
-type Fetch = typeof fetch;
-/** The provider's endpoints, from its discovery document; its issuer must be the one configured. */
-export declare function discoverOidc(issuer: string, fetcher?: Fetch): Promise<{
-    ok: true;
-    provider: OidcProvider;
-} | {
-    ok: false;
-    said: string;
-}>;
-/** The pieces a sign-in needs to come back to: kept by the console, and its state in a cookie on the browser that started it. */
-export type OidcVisit = {
-    state: string;
-    nonce: string;
-    verifier: string;
-};
-export declare function newOidcVisit(): OidcVisit;
-/** Where to send the person to sign in. `reauth` asks the provider to check them again now (a step-up). */
-export declare function oidcAuthorizeUrl(provider: OidcProvider, settings: OidcSettings, visit: OidcVisit, redirectUri: string, reauth?: boolean): string;
-/** The code, traded for the ID token. */
-export declare function exchangeOidcCode(provider: OidcProvider, settings: OidcSettings, code: string, visit: OidcVisit, redirectUri: string, fetcher?: Fetch): Promise<{
-    ok: true;
-    idToken: string;
-} | {
-    ok: false;
-    said: string;
-}>;
-/** Check the ID token: its signature by one of the provider's keys, then who issued it, for whom, until when, and for which sign-in. */
-export declare function verifyIdToken(idToken: string, provider: OidcProvider, settings: OidcSettings, nonce: string, now: Date, fetcher?: Fetch): Promise<{
-    ok: true;
-    claims: OidcClaims;
-} | {
-    ok: false;
-    said: string;
-}>;
-/** A person's role and projects from their groups: the first rule that matches ("*" matches everyone), or none. */
-export declare function accessFromGroups(groups: readonly string[], rules: readonly GroupRule[]): GroupRule | null;
-/** An account name for someone new: from their username or email, in the characters names allow, made unique. */
-export declare function accountNameFor(claims: OidcClaims, taken: (name: string) => boolean): string;
-export {};