toolroll 0.9.104 → 0.9.105

package/dist/scope.d.ts

@@ -1,1098 +0,0 @@
-export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS, type EvidenceKind } from "./contracts/acceptance-terms.js";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { type LocalTransport } from "./local-owner.js";
-import { isAcpProfile, type AcpProviderId } from "./acp-agents.js";
-export { isAcpProfile };
-import { type NetworkProfile } from "./egress.js";
-import { type WritesMode } from "./writes-mode.js";
-import { type CheckAccess } from "./check-access.js";
-import { type EvidenceKind } from "./contracts/acceptance-terms.js";
-import { type AcceptanceCriterion, type AcceptanceProblem, type ScopeTerms } from "./contracts/scope.js";
-import type { Store, Mutation } from "./store.js";
-import type { QualityMode } from "./quality.js";
-import type { AuthMode } from "./keys.js";
-import type { ProviderId } from "./provider.js";
-import { type PhaseRoute, type ReadinessLookup, type RiskLevel } from "./phase-routing.js";
-export declare function hashToken(token: string): string;
-/**
- * A person's chosen password gets a real KDF. Bare sha256 is fine for the
- * minted 256-bit tokens — nothing brute-forces that space — but a password a
- * human picked lives in a much smaller one, so it is salted and stretched
- * (scrypt), and the stored string names its own scheme so both generations
- * of credential verify side by side.
- */
-export declare function hashPassword(password: string): string;
-/** Verify a presented secret against a stored hash of either scheme. */
-export declare function verifyCredential(stored: string, presented: string): boolean;
-/**
- * The execution profile (Parity II foundations, findings 1/2/13/14/22):
- * WHAT RUNS, bound into what the operator signs. A discriminated union —
- * each variant asserts only what its provider actually supports, with the
- * EFFECTIVE constants the argv will carry, never aspirations. The model
- * is always an exact string and always emitted on the argv: nothing in an
- * approved profile is left for later resolution to decide (ruling 10).
- * providerVersion and resolvedFrom are PROVENANCE and live outside these
- * shapes (finding 20) — they never enter a digest.
- */
-export declare const CLAUDE_LIMITS: {
-    readonly maxTurns: 1000;
-    readonly repairMaxTurns: 4;
-    readonly timeoutSeconds: 1200;
-    readonly repairTimeoutSeconds: 300;
-};
-export declare const CODEX_SHAPED_LIMITS: {
-    readonly timeoutSeconds: 1200;
-    readonly repairTimeoutSeconds: 300;
-};
-export declare const GEMINI_LIMITS: {
-    readonly timeoutSeconds: 1200;
-    readonly repairTimeoutSeconds: 300;
-};
-/** An ACP agent runs under two clocks at once: the whole attempt, and silence (no line from the agent). */
-export declare const ACP_LIMITS: {
-    readonly timeoutSeconds: 3600;
-    readonly idleTimeoutSeconds: 900;
-    readonly repairTimeoutSeconds: 900;
-    readonly repairIdleTimeoutSeconds: 300;
-};
-export type ClaudeProfile = {
-    provider: "claude";
-    /** The exact model string the argv carries. Never empty, never "default". */
-    model: string;
-    /** Claude's real argv semantic. `auto` is the safe unattended posture:
-     * Claude's classifier allows routine project work and stops risky acts.
-     * `acceptEdits` remains readable for approvals created before auto mode;
-     * bypass is still a separate, explicitly signed escalation. */
-    permissionArgv: "auto" | "acceptEdits" | "bypassPermissions";
-    maxTurns: number;
-    repairMaxTurns: number;
-    timeoutSeconds: number;
-    /** Absent on legacy approvals, where timeoutSeconds remains an absolute
-     * wall clock. New approvals bind an activity watchdog instead. */
-    timeoutKind?: "idle";
-    repairTimeoutSeconds: number;
-    /** Exact model for repairs, or the stable literal "inherit" (= the
-     * build model, which is itself exact). */
-    repairModel: string;
-    /** What the build may reach (egress.ts), resolved when the scope was written; absent on approvals sealed before
-     * network policies, which run narrowed (egress.ts legacyNetwork). */
-    network?: NetworkProfile;
-    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
-     * write allowlists, which keep writing anywhere their fence allows. */
-    writes?: WritesMode;
-    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
-    checkAccess?: Exclude<CheckAccess, "sandboxed">;
-    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
-     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
-    fencePolicy?: 2;
-    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
-    readDeny?: string[];
-    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
-    machLookup?: string[];
-};
-export type CodexShapedProfile = {
-    provider: "codex" | "openrouter";
-    model: string;
-    /** Codex's real constraint surface. Full access is rendered with the
-     * CLI's combined --dangerously-bypass-approvals-and-sandbox switch; the
-     * value here records the resulting sandbox posture in the signed profile. */
-    sandboxMode: "workspace-write" | "danger-full-access";
-    /** The tool has no argv turn limit. New approvals use an inactivity
-     * watchdog; legacy approvals retain their signed wall-clock bound. */
-    maxTurns: "unsupported";
-    repairMaxTurns: "unsupported";
-    timeoutSeconds: number;
-    timeoutKind?: "idle";
-    repairTimeoutSeconds: number;
-    repairModel: string;
-    network?: NetworkProfile;
-    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
-     * write allowlists, which keep writing anywhere their fence allows. */
-    writes?: WritesMode;
-    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
-    checkAccess?: Exclude<CheckAccess, "sandboxed">;
-    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
-     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
-    fencePolicy?: 2;
-    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
-    readDeny?: string[];
-    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
-    machLookup?: string[];
-};
-export type GeminiProfile = {
-    provider: "gemini";
-    model: string;
-    /** Gemini's real dial (`--approval-mode`): auto_edit auto-approves edit
-     * tools only (the acceptEdits parallel); yolo auto-approves everything
-     * and files only where claude files bypassPermissions. `default` and
-     * `plan` are not profile values — headless `default` just fails tools,
-     * and `plan` is read-only while the protocol requires workspace writes. */
-    approvalArgv: "auto_edit" | "yolo";
-    /** No argv turn bound exists (v0.57.0 audit); new approvals use an
-     * inactivity watchdog, while legacy approvals keep their signed clock. */
-    maxTurns: "unsupported";
-    repairMaxTurns: "unsupported";
-    timeoutSeconds: number;
-    timeoutKind?: "idle";
-    repairTimeoutSeconds: number;
-    repairModel: string;
-    network?: NetworkProfile;
-    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
-     * write allowlists, which keep writing anywhere their fence allows. */
-    writes?: WritesMode;
-    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
-    checkAccess?: Exclude<CheckAccess, "sandboxed">;
-    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
-     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
-    fencePolicy?: 2;
-    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
-    readDeny?: string[];
-    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
-    machLookup?: string[];
-};
-/**
- * An agent over the Agent Client Protocol (acp-agents.ts, docs/plans/acp-adapter.md).
- * Full access inside the OS fence is the only posture: nothing else could be
- * made true (an agent may run commands without asking). There is no turn
- * limit; both clocks bound every attempt, and a repair has its own pair.
- */
-export type AcpProfile = {
-    provider: AcpProviderId;
-    /** Exact, and one the agent offered when it was checked. */
-    model: string;
-    permission: "full";
-    maxTurns: "unsupported";
-    repairMaxTurns: "unsupported";
-    timeoutSeconds: number;
-    idleTimeoutSeconds: number;
-    repairTimeoutSeconds: number;
-    repairIdleTimeoutSeconds: number;
-    repairModel: string;
-    network?: NetworkProfile;
-    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
-     * write allowlists, which keep writing anywhere their fence allows. */
-    writes?: WritesMode;
-    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
-    checkAccess?: Exclude<CheckAccess, "sandboxed">;
-    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
-     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
-    fencePolicy?: 2;
-    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
-    readDeny?: string[];
-    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
-    machLookup?: string[];
-};
-export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile | AcpProfile;
-/** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */
-export declare function idleClock(profile: ExecutionProfile): boolean;
-/**
- * The watchdogs an attempt runs under, from its sealed profile and the overall bound the caller resolved: an ACP
- * profile gets both clocks at once (the deadline and its silence window — a repair its own pair); the others one,
- * a no-progress window when the profile says idle, else a deadline.
- */
-export declare function watchdogsOf(profile: ExecutionProfile, timeoutMs: number, repair?: boolean): {
-    timeoutMs?: number;
-    idleTimeoutMs?: number;
-};
-/** The durable unattended permission choices exposed by the console. The
- * provider-specific argv is still what gets sealed into an approval; this
- * small cross-provider type is only the operator-facing policy. */
-export type UnattendedPermissionMode = "auto" | "bypassPermissions";
-export declare const PROFILE_DIGEST_VERSION = 2;
-/** The stored snapshot bytes: version embedded IN the snapshot (finding 17). */
-export declare function canonicalProfileJson(profile: ExecutionProfile): string;
-/** sha256 over a domain-separated canonical encoding, truncated to the
- * same 128 bits every other safety digest here uses (finding 21). */
-export declare function profileDigestOf(profile: ExecutionProfile): string;
-export declare const CHAIN_DIGEST_VERSION = 1;
-export declare const LIVE_CHAIN_VERSION = 2;
-/** One entry of an approved fallback chain: the WHOLE execution profile
- * (so a claude->codex switch cannot inherit one provider's repair config)
- * and the auth mode it runs under. Order is authority. */
-export type ChainEntry = {
-    profile: ExecutionProfile;
-    authMode: "subscription" | "api-key";
-};
-/** The stored snapshot bytes for a chain: the version rides IN the
- * snapshot, exactly like a single profile's. */
-export declare function canonicalChainJson(entries: readonly ChainEntry[], version?: number): string;
-/** sha256 over a domain-separated canonical chain encoding — a DIFFERENT
- * domain from a single profile ("standing-orders:chain:" vs
- * ":profile:"), so a chain digest can never collide with a profile
- * digest, truncated to the same 128 bits. */
-export declare function chainDigestOf(entries: readonly ChainEntry[], version?: number): string;
-/** Strict re-hydration of a stored chain — every entry proved through the
- * single-profile rehydrator; anything unexpected is null. */
-export declare function chainFromJson(json: string | null, version?: number): ChainEntry[] | null;
-/**
- * THE STRICT RAW TERMS READ (raw authority repair): the stored columns of
- * a scope or a standing order, proved EXACTLY — a JSON list is a list of
- * strings and nothing else, a rubric is a list of whole criteria carrying
- * exactly the keys this code writes and parsing with zero problems, a
- * budget is a safe integer or null. Nothing is filtered, defaulted, or
- * coerced on the way to an authority: the words say what is wrong, and
- * the caller refuses.
- */
-export declare function exactStringList(value: unknown, what: string): {
-    ok: true;
-    list: string[];
-} | {
-    ok: false;
-    problem: string;
-};
-export declare function exactAcceptance(value: unknown): {
-    ok: true;
-    criteria: AcceptanceCriterion[];
-} | {
-    ok: false;
-    problem: string;
-};
-export declare function exactSafeIntegerOrNull(value: unknown, what: string): string | null;
-/**
- * The longest clock a snapshot may bind, in seconds: a JavaScript timer
- * holds at most 2^31 − 1 milliseconds, and a bound past that fires at
- * once instead of never — a "timeout" that is not one. Every stored
- * clock is proved against this before it is believed (v48 integrity).
- */
-export declare const MAX_TIMER_SECONDS: number;
-/** A positive integer the platform can represent exactly. */
-export declare function safePositiveInteger(v: unknown): v is number;
-/** A positive whole number of seconds a timer can actually wait. */
-export declare function timerSafeSeconds(v: unknown): v is number;
-/**
- * Whether an object carries exactly the named keys: every required key
- * present, only optional keys otherwise, nothing unknown. Stored snapshots
- * are proved this way so a key this code never writes is a refusal, never
- * an ignorable extra.
- */
-export declare function exactKeys(value: object, required: readonly string[], optional: readonly string[]): boolean;
-/** Strict re-hydration of a stored snapshot — every field type-proved;
- * anything unexpected is null, never a guess. */
-export declare function profileFromJson(json: string | null): ExecutionProfile | null;
-export type { AcceptanceCriterion, AcceptanceProblem };
-/**
- * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
- * console form, a template or a schedule's terms): fail closed, every
- * problem reported at once, each naming its path — the acceptance contract
- * (contracts/scope.ts) reads it. An absent or empty `value` parses to `[]`
- * with no problems: whether that is ALLOWED is a question for the caller
- * (`propose` says yes; every authoring road says no), never for this parser.
- */
-export declare function parseAcceptanceCriteria(value: unknown): {
-    criteria: AcceptanceCriterion[];
-    problems: AcceptanceProblem[];
-};
-/** The exact bytes a rubric's SIGNED terms reduce to for the digest: sorted
- * by id, `how` dropped (advisory, never signed), evidence kinds sorted so
- * two equivalent lists never digest differently. */
-/**
- * The plain-text rubric encoding shared by every non-JSON authoring
- * surface — the console's rubric textarea (one line each) and the CLI's
- * `--acceptance` flag (one line per `;`-separated entry): one criterion
- * per line, shaped
- *
- *   [id:] statement | evidence,kinds [| how]
- *
- * `id` is optional — auto-numbered `c1`, `c2`, ... in encounter order when
- * every line omits it, so a person can write the rubric without inventing
- * ids by hand. This function never validates; it only turns text into the
- * same plain-object shape `parseAcceptanceCriteria` already validates, so
- * both entry points can never drift on what counts as a valid criterion.
- */
-/** The one criterion a filing may carry when nobody has written the rubric
- * yet: the console's scout follow-ups file with it, and `--acceptance plan`
- * on the command line expands to it. A mode with planAuto sends such a
- * filing to the planner instead of building against it. */
-export declare const PLACEHOLDER_RUBRIC_STATEMENT = "The operator has reviewed this follow-up and written a real rubric before approving it.";
-export declare const PLACEHOLDER_RUBRIC: AcceptanceCriterion[];
-export declare function rubricIsPlaceholder(acceptance: readonly {
-    statement: string;
-    evidence: readonly string[];
-}[]): boolean;
-/** Split a `--acceptance` rubric into criteria. Criteria are `;`-separated,
- * but a `;` inside a statement must not split it: every criterion ends with
- * its `|<evidence kinds>` part, so a segment with no `|` is the front of the
- * next one and is glued back on. The single word `plan` means the placeholder. */
-export declare function splitAcceptanceRubric(text: string): string[];
-export declare const isCommitSha: (value: string) => boolean;
-export declare function acceptanceLinesToInput(lines: readonly string[]): unknown[];
-/** The inverse of `acceptanceLinesToInput`, for pre-filling an editor from
- * a stored rubric — round-trips through `parseAcceptanceCriteria` exactly. */
-export declare function acceptanceToLines(criteria: readonly AcceptanceCriterion[]): string[];
-export declare function canonicalAcceptance(criteria: readonly AcceptanceCriterion[]): {
-    id: string;
-    statement: string;
-    evidence: EvidenceKind[];
-}[];
-/**
- * A scope's terms, from the scope contract (contracts/scope.ts): what
- * success looks like in the operator's words (`goal`), what the task is
- * explicitly not allowed to turn into (`outOfScope`), the paths it expects
- * to touch (advisory, and worth stating), and the signed acceptance rubric
- * — `[]` on every scope proposed before v39 and on any legacy road that
- * still calls `propose` directly: a scope-producing ROAD enforces
- * non-emptiness, never this type, never `propose`, never the digest.
- */
-export type SavedScopeTerms = {
-    [K in keyof ScopeTerms]-?: Exclude<ScopeTerms[K], undefined>;
-};
-export type Scope = SavedScopeTerms & {
-    taskId: string;
-    /** v41: evidence policy, signed with the scope. Default is omitted from
-     * the digest so every pre-v41 approval remains byte-for-byte valid. */
-    qualityMode?: QualityMode;
-    /** The dollar cap per build attempt, integer micro-dollars (v15) —
-     * approved spend, restated at the yes, enforced by the provider's own
-     * stop. NULL = no per-attempt cap was asked for. */
-    budgetMicrousd: number | null;
-    proposedAt: string;
-    /** Of the scope as written. Approval is bound to this exact value. */
-    digest: string;
-    approvedAt: string | null;
-    approvedBy: string | null;
-    /** The digest that was actually agreed to, which may now be stale. */
-    approvedDigest: string | null;
-    /** How the approval happened (v29): 'password' = the ceremony;
-     * 'mode' = sealed by the signer's live mode (modeDigest names it);
-     * 'chat' = the owner's own two taps in their paired chat, under their chat-approval setting or a signed term
-     * (modeDigest names that authority; the yes is the person's and doesn't lapse with it).
-     * 'schedule' = a standing order's firing (modeDigest names the order); 'lead' = the owner's lead (never a person);
-     * 'unknown' = a stored word this code doesn't write, which no reader treats as authority (approval-policy plan). */
-    approvalBasis?: ApprovalBasis | "unknown" | null;
-    modeDigest?: string | null;
-    /** v24 (optional so hand-built scopes in tests stay valid): the working
-     * execution profile, its resolution state, and the immutable snapshot
-     * the approval act sealed. */
-    profile?: ExecutionProfile | null;
-    profileState?: "resolved" | "unresolved";
-    unresolvedReason?: string | null;
-    approvedProfile?: ExecutionProfile | null;
-    /** The raw snapshot bytes the row carries (v48 integrity): what the
-     * strict stored-scope projection proves, exactly, before any seal or
-     * consent surface believes the rehydrated `profile`. */
-    profileJson?: string | null;
-    approvedProfileJson?: string | null;
-    digestVersion?: number;
-    /** v30-v114 fallback chains (history): the working and sealed chain
-     * snapshots and which kind the approval sealed. Never written since v115
-     * (a re-approval writes `profile` and clears the sealed chain); an old
-     * chain approval still decodes and verifies. */
-    proposedChainJson?: string | null;
-    approvedChainJson?: string | null;
-    approvalKind?: "profile" | "chain";
-    /** v47 phase routing: the signed risk level, the WORKING canonical route
-     * the digest bound, and the immutable snapshot the seal COPIED from it.
-     * `routeEra` is the durable marker: null on a row PROVEN to predate v47
-     * (legacy — its sealed profile alone governs), the route version on every
-     * row filed since — for those, a missing or unreadable route is corrupt
-     * and fails closed everywhere. */
-    riskLevel?: RiskLevel;
-    /** A prepared commit the machine checks out instead of running an agent
-     * (v69). Signed into the digest; must descend from the task's base. */
-    candidate?: string | null;
-    proposedRouteJson?: string | null;
-    approvedRouteJson?: string | null;
-    routeEra?: number | null;
-    /** THE RAW TERMS VERDICT (raw authority repair): null when every stored
-     * term and metadata column read back EXACTLY — touches a JSON list of
-     * strings, the rubric a list of whole criteria with no unknown key, the
-     * budget a safe integer or null, the quality mode, risk level, approval
-     * kind, profile state, digest version, and route era each one of the
-     * words this code writes — and the words when one did not. The lenient
-     * fields above (`touches`, `acceptance`, …) are the console's reading;
-     * every authority — consent, seal, chain, dispatch — refuses on a
-     * non-null verdict, so filtering, defaulting, or coercion can never
-     * turn a corrupt row into authority. Undefined on a hand-built scope. */
-    termsProblem?: string | null;
-    /** Who wrote the text (mate arc, ruling 2): a confirmed lead proposal,
-     * the coordinator, a scout, or a person (null). Read raw and proved by
-     * `termsProblem` — a word outside these is a stated problem, never a
-     * value that slips past the lead quarantine at a mode seal. `lead`: the lead wrote it through its token (CLI); it is
-     * the lead's own text, not another machine's, so it isn't quarantined (`quarantinedAuthor`). */
-    proposedVia?: ScopeAuthor | null;
-    /** v135 (docs/plans/release-once.md): a release scope's terms — repository, version, pull request, approved commit,
-     * carry policy, grant, check access, expiry. Part of the digest when present; a person's seal of them opens the
-     * release's authority record. */
-    releaseTerms?: ReleaseTerms | null;
-    /** v138 (docs/plans/pipeline-speed.md, P0): a release check's purpose when the release can't carry (no terms) — this
-     * exact candidate is a release's check. Part of the digest when present; never present beside terms. */
-    releaseCheck?: ReleaseCheckPurpose | null;
-};
-/** Who wrote a scope's text, when not a person (approval-policy plan §1.4). */
-export type ScopeAuthor = "mate" | "coordinator" | "scout" | "lead";
-/** The authorities a seal can stand on (approval-policy plan §1.5). Anything else stands on nothing. */
-/** `carried`: a later commit of a release carried under a person's release approval (release-once.md); only the carry
- * transaction ever writes it. */
-/** `auto-check` / `auto-green`: a release task the plane approved itself under the project's "Approve automatically when
- * checks pass" (docs/plans/auto-approve-green.md) — `auto-check` lets its check run, `auto-green` is the release
- * approval once CI and that check passed. Only release-auto.ts writes them; neither is ever a person's. */
-export type ApprovalBasis = "password" | "mode" | "chat" | "grant" | "schedule" | "lead" | "carried" | "auto-check" | "auto-green";
-export declare const APPROVAL_BASES: readonly ApprovalBasis[];
-export type Approval = {
-    approved: true;
-    at: string;
-    by: string;
-} | {
-    approved: false;
-    reason: "none" | "changed" | "never-proposed";
-};
-export type ScopeInput = {
-    taskId: string;
-    /** v102: the person writing these words (a web edit, a chat confirmation, a coding hand-off); the requester rule refuses them. */
-    author?: string;
-    goal: string;
-    outOfScope?: string | null;
-    touches?: readonly string[];
-    /** v24: an EXPLICIT profile skips resolution in the store (a schedule's
-     * approved firings and the demo's illustrative scopes use this road). */
-    profile?: ExecutionProfile;
-    /** A task-level permission choice. When absent, the task's stored choice
-     * (if any), then the installation default, decides the concrete profile. */
-    permissionMode?: UnattendedPermissionMode;
-    /** Concrete task quality choice. When absent, the task override and then
-     * the installation default are resolved by the store. */
-    qualityMode?: QualityMode;
-    /** v69: a prepared commit to install as this attempt — no agent runs. */
-    candidate?: string | null;
-    /** Integer micro-dollars per build attempt; digest-bound when present. */
-    budgetMicrousd?: number | null;
-    /** The mode road's escalated filing default (C7): the resolved profile
-     * seals claude bypassPermissions / gemini yolo; codex-shaped unchanged. */
-    posture?: "escalated";
-    /** Who wrote this text (mate arc, ruling 2): `mate` for a confirmed mate
-     * proposal — mode coverage then never seals it; a human rewrite clears it. */
-    proposedVia?: ScopeAuthor | null;
-    /** v39: the signed acceptance rubric. Absent digests exactly like `[]` —
-     * see `Scope.acceptance`. `propose` itself never requires this to be
-     * non-empty; the roads that call it do. */
-    acceptance?: readonly AcceptanceCriterion[];
-    /** v135: release terms (release-carry.ts releaseTermsFor), from the plane's own records. Undefined keeps any terms
-     * the scope already carries; null removes them. */
-    releaseTerms?: ReleaseTerms | null;
-    /** v138: a release check's purpose (release-carry.ts releaseCheckPurposeFor), from the plane's own records. Undefined
-     * keeps any purpose the scope already carries; null removes it. */
-    releaseCheck?: ReleaseCheckPurpose | null;
-    now: Date;
-    mutation?: Mutation;
-};
-/**
- * The exact bytes an operator agreed to.
- *
- * Every field that constrains the work goes in. If a change to a field would
- * change what an operator would have said, it has to move the digest, or the
- * approval it invalidates would be an approval of something else.
- */
-export declare function digestOf(scope: Pick<Scope, "goal" | "outOfScope" | "touches"> & {
-    budgetMicrousd?: number | null;
-    /** v39: the rubric, folded in ONLY when non-empty — the same absent/`[]`
-     * equivalence budgetMicrousd has always used, so a scope proposed before
-     * this migration, or by a road that never sends one, digests to exactly
-     * what it digested to before this field existed. `how` never enters
-     * here (advisory, never signed); evidence kinds do. */
-    acceptance?: readonly AcceptanceCriterion[];
-    qualityMode?: QualityMode;
-    /** v69: a prepared commit, folded in only when present so every earlier
-     * digest is untouched. */
-    candidate?: string | null;
-    /** v135: release terms, folded in only when present. */
-    releaseTerms?: ReleaseTerms | null;
-    /** v138: a release check's purpose, folded in only when present. */
-    releaseCheck?: ReleaseCheckPurpose | null;
-}, target?: ExecutionProfile | null | {
-    chain: readonly ChainEntry[];
-    version?: number;
-}, route?: PhaseRoute | null): string;
-export declare function propose(store: Store, input: ScopeInput): Scope;
-export type GuardedProposeResult = {
-    ok: true;
-    scope: Scope;
-} | {
-    ok: false;
-    reason: "changed" | "claimed" | "bad-goal" | "bad-out-of-scope" | "bad-touches" | "bad-acceptance" | "acceptance-required";
-    message?: string;
-};
-/**
- * A scope edit from a surface where the editor might be stale — two browser
- * tabs, a form submitted after the world moved. `sawDigest` names the version
- * the editor was looking at (null: they saw no scope at all); a mismatch is a
- * refusal, never a silent overwrite of somebody else's words. Edits are also
- * refused while a live claim holds the task: the running build read its scope
- * at start, and rewording the agreement under it would make the digest lie
- * about what the work was agreed to. Field caps and control-character rules
- * live here because every one of these strings will later be rendered.
- *
- * v39: this is a scope-producing ROAD, not the `propose` primitive, so it is
- * where the rubric becomes mandatory — every edit through here (a fresh
- * proposal or a rewrite of an already-approved one) must carry at least one
- * criterion, or it is refused with a clear `acceptance-required` reason
- * rather than silently filing without one. A scope that already carries a
- * live, unrewritten approval from before this code existed never reaches
- * this function again unless somebody edits it — which is exactly when the
- * requirement should start applying.
- */
-export declare function proposeGuarded(store: Store, input: Omit<ScopeInput, "acceptance"> & {
-    sawDigest: string | null;
-    taskRef: number | null;
-    acceptance?: unknown;
-}): GuardedProposeResult;
-/**
- * A person says yes.
- *
- * Takes the digest they were shown, so agreeing to a scope that changed while
- * they were reading it fails rather than silently approving the new one.
- */
-/**
- * Register somebody who is allowed to agree to scopes.
- *
- * The token is shown once and stored only as a hash, exactly like a runner's.
- * It exists because an approval nobody has to authenticate is not a gate: an
- * agent that can run these commands can read a scope's digest out of `task
- * show` and approve its own brief with it. Requiring a credential the agent
- * was never given is what keeps "a person agreed to this" true.
- */
-export type AddApproverResult = {
-    ok: true;
-    name: string;
-    token: string;
-    bootstrap: boolean;
-    chosen: boolean;
-} | {
-    ok: false;
-    reason: "not-an-approver" | "weak-password";
-};
-export declare function addApprover(store: Store, name: string, now: Date, by?: {
-    name: string;
-    token: string;
-}, newToken?: () => string, mutation?: Mutation, 
-/** A password the person chose. Absent, a token is minted and shown once. */
-password?: string): AddApproverResult;
-export type ApproveResult = {
-    ok: true;
-    scope: Scope;
-} | {
-    ok: false;
-    reason: "no-scope" | "changed" | "no-approvers" | "not-an-approver" | "profile-unresolved" | "unrouted";
-}
-/** v102: the project's approval rules stopped it — the requester can't approve, protected work needs a person —
- * or recorded this person's yes and needs a second one (`second-approver`). */
- | {
-    ok: false;
-    reason: "requester" | "person-required";
-} | {
-    ok: false;
-    reason: "second-approver";
-    have: number;
-    need: number;
-    already: boolean;
-}
-/** Sprint 8: the organisation policy stops these terms (a provider, a model, the permission ceiling); `message` says which. */
- | {
-    ok: false;
-    reason: "policy";
-    message: string;
-}
-/** Cockpit B2: a remembered password can't approve these terms (protected, escalated, or a quarantined filing). */
- | {
-    ok: false;
-    reason: "password-now";
-}
-/** Approval policy, phase 1: a machine credential (the lead's token, a remote API token) is not a person. */
- | {
-    ok: false;
-    reason: "machine-proof";
-}
-/** v145 (task-tidy.md): the task is put away; it is restored before anyone can approve it. */
- | {
-    ok: false;
-    reason: "archived";
-}
-/** The task was cancelled: a cancelled task takes no approval, by any road (a stale page, the CLI). */
- | {
-    ok: false;
-    reason: "cancelled";
-};
-/**
- * Whether this name-and-token pair is a person the store knows. Shared by
- * every act that requires a human's authority — approving a scope, answering
- * a decision — because "who said yes" must never be a string the caller
- * typed. Fails closed: with no approver registered there is nobody who can
- * agree to anything, and treating that as "authority is not required here"
- * would make the gate optional — which is the same as not having one.
- */
-/**
- * IDENTITY, split from authority (modes chain, D2/E2): who this credential
- * belongs to and what standing they hold. Viewers authenticate here and
- * read; every consequential act goes through authenticateApprover below,
- * which additionally demands ACTIVE approver standing — so the forty
- * ceremony sites enforce the role without one of them changing.
- */
-export declare function authenticateAccount(store: Store, by: string, secret: string): {
-    ok: true;
-    role: "approver" | "viewer";
-    generation: number;
-} | {
-    ok: false;
-    reason: "no-approvers" | "unknown" | "revoked" | "locked";
-    retryAfterMs?: number;
-};
-/**
- * v100: someone who signed in with the identity provider moments ago has no
- * password to type again. The console marks such a request with this, for
- * that person only, and an EMPTY password then stands for the fresh sign-in
- * at every step-up that reaches `authenticateApprover` (scope
- * approval, chat-action review, the console's own ceremonies). A typed
- * password is always checked, and nothing else stands in.
- */
-/**
- * PASSWORD FRESHNESS (docs/plans/agents-cockpit.md B2), and the one place an empty password field is ever honoured.
- *
- * - An identity-provider re-check made **on request** (a step-up's re-authentication, never an ordinary sign-in) stands
- *   in for one password typed now, for ONE step-up of any kind, within five minutes: it is consumed by the act it
- *   proves (`sso-now`). Never reused across acts.
- * - A password verified on this session, or that explicit re-check, stands in for fifteen minutes — but only inside an
- *   allowlisted act (`withFreshness`), only for this person, only on a direct local request (`fresh-password`,
- *   `fresh-sso`). Never extended by use.
- * Every fact is read at the moment of the act (`FreshFacts` are live readers, not a snapshot), so a sign-out, a session
- * revoked or rotated, a credential change or Forget made while a request was in flight is seen by it.
- */
-export type FreshOp = "approve-standard" | "chat-send" | "reply-question";
-/** "session": Passwordless is on and this is the person's own live browser session (docs/plans/passwordless.md). */
-/** "remote-token" / "lead-token": a machine credential stood in for the person (a remote run's API token, a lead's
- * token) — fine for ordinary acts it is allowed, never for a credential act (it would mint a way in with no password). */
-/** "local-owner" (easy-start C1): the local owner of a laptop install, in an allowlisted act (local-owner.ts) — a person,
- * never a credential act, and its approvals stand only while local mode stays on at their generation. */
-export type AuthMethod = "password-now" | "sso-now" | "fresh-password" | "fresh-sso" | "session" | "cli-login" | "remote-token" | "lead-token" | "local-owner";
-/**
- * The local CLI's remembered login, marked for the one command that read it (operate.ts credentialsFrom): with
- * Passwordless on, a proof made with it records "cli-login" — never a typed password — and no credential act accepts it.
- * Scoped to that command's async chain; a browser request in the console's own process never carries it.
- */
-export declare const rememberedLogin: AsyncLocalStorage<{
-    login: {
-        name: string;
-        token: string;
-    } | null;
-}>;
-export declare const FRESH_WINDOW_MS: number;
-/** How long an explicit provider re-check stands in for one password typed now. */
-export declare const SSO_NOW_MS: number;
-export type FreshFacts = {
-    actor: string;
-    /** Straight from this computer: a loopback peer naming a loopback host, with no forwarding headers of any kind. */
-    local: boolean;
-    /** The request's route is on the freshness allowlist (route-table.ts `freshness: "allowlist"`): the table decides. */
-    allowlisted: boolean;
-    /** The session is still signed in, under the account's current credential generation, not revoked. */
-    live: () => boolean;
-    /** When a password was last verified on this session; when the provider last re-checked on request (window start);
-     * and an unconsumed re-check for one step-up. */
-    passwordAt: () => number | null;
-    ssoReauthAt: () => number | null;
-    ssoNow: () => number | null;
-    /** Spend the re-check; the answer puts it back (a refund) when the act it proved doesn't happen. */
-    consumeSsoNow: () => () => void;
-    /** Nothing before this counts (Forget). */
-    floor: () => number;
-    /** Record a verified password entry on this session (the console decides whether this request may start one). */
-    stamp: (at: number) => void;
-};
-export declare const freshFacts: AsyncLocalStorage<FreshFacts | null>;
-/**
- * Run an act a re-check may prove, spending the re-check only if the act happens: when it throws (a rolled-back
- * transaction) or `failed` says it was refused, every re-check it spent is put back. ONLY for acts whose every effect
- * is in one database transaction (an approval, a chat approval proposal, a chat turn opening): there, "refused" and
- * "thrown" prove nothing happened. Every other step-up spends its re-check whatever comes of it (fail-closed: at worst
- * the person confirms with their provider again). Synchronous acts only.
- */
-export declare function spendingOnlyOnSuccess<T>(act: () => T, failed: (result: T) => boolean): T;
-/** Run an allowlisted act: within it, a fresh password or re-check may stand in for one typed now. */
-export declare function withFreshness<T>(op: FreshOp, act: () => T): T;
-/** The freshness this act may stand on now, or null: only inside an allowlisted act on an allowlisted route, for this
- * person, on a direct local request, on a live session, within the window, after any Forget. `preview` asks it from a
- * page (a GET) about the allowlisted act its form posts to — for words only, never to authorise. */
-export declare function freshnessFor(by: string, now?: number, preview?: boolean): {
-    method: "fresh-password" | "fresh-sso";
-    at: number;
-} | null;
-/** Whether an explicit provider re-check is waiting to stand in for one step-up (the page says "Confirmed with …"). */
-export declare function ssoNowAvailable(by: string, now?: number): boolean;
-/**
- * Proof that this person is here now, for any account step-up (an approver's or not): a password typed now, or an
- * explicit provider re-check (consumed). The core of every console step-up; `authenticateApprover` adds standing.
- */
-export declare function proveAccountNow(store: Store, by: string, token: string, options?: {
-    credential?: boolean;
-}): {
-    ok: true;
-    method: AuthMethod;
-    at: number;
-} | {
-    ok: false;
-    reason: "no-approvers" | "not-an-approver";
-};
-/**
- * A credential act (docs/plans/passwordless.md, the closed list: one that creates or widens a way in): only a password
- * typed now, or a one-use identity-provider re-check, proves it — never a session, never a remembered password.
- */
-/** Whether an empty password would pass for `by` right now because Passwordless is on and this is their live browser
- * session. Read only — the act itself proves it again inside `proveAccountNow`. */
-export declare function passwordlessSessionFor(store: Store, by: string): boolean;
-/** Whether a proof is one a credential act accepts: a password typed now, or a one-use identity-provider re-check. */
-export declare const credentialProof: (method: AuthMethod) => boolean;
-export declare function proveCredential(store: Store, by: string, token: string, repo?: string | null): {
-    ok: true;
-    method: AuthMethod;
-    at: number;
-} | {
-    ok: false;
-    reason: "no-approvers" | "not-an-approver";
-};
-export declare function authenticateApprover(store: Store, by: string, token: string, repo?: string | null, options?: {
-    credential?: boolean;
-}): {
-    ok: true;
-    method: AuthMethod;
-    at: number;
-} | {
-    ok: false;
-    reason: "no-approvers" | "not-an-approver";
-};
-/**
- * What an approval needs besides the password (v100: an identity-provider
- * sign-in moments ago stands in for the password; nothing stands in for
- * this): an active account in the approver role, with access to the project.
- */
-export declare function approverStanding(store: Store, by: string, repo?: string | null): {
-    ok: true;
-} | {
-    ok: false;
-    reason: "no-approvers" | "not-an-approver";
-};
-/**
- * C1's atomic road: file the scope AND seal its approval in ONE
- * transaction, under a mode the SAME transaction re-proves. The caller
- * has already authenticated the actor and matched channel rules; this
- * function owns the predicate's transactional half — mode active, actor
- * IS the signer, repo matches, and the sealed digest is the filed one
- * (trivially true here: they are the same transaction). Never
- * sealScopeApproval after a filing — that was the TOCTOU.
- */
-/**
- * C1's coverage question, answerable from ANY filing road: does a live
- * mode make THIS actor's credentialed filing auto-approve here, and with
- * which defaults? Callers re-ask INSIDE their filing transaction — an
- * answer carried across transactions would be the TOCTOU again.
- */
-export declare function modeFilingCoverage(store: Store, repo: string | null, actor: string, now: Date): {
-    digest: string;
-    escalated: boolean;
-    defaultBudgetMicrousd: number | null;
-} | null;
-export declare function fileAndSealUnderMode(store: Store, input: ScopeInput & {
-    repo: string | null;
-    actor: string;
-}): {
-    ok: true;
-    scope: Scope;
-    basis: "mode";
-} | {
-    ok: false;
-    reason: "no-mode" | "not-signer" | "not-covered" | "coordinator-filed" | "acceptance-required" | "profile-unresolved";
-    detail?: string;
-};
-export declare function approve(store: Store, taskId: string, by: string, now: Date, sawDigest: string, token: string, mutation?: Mutation, 
-/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it.
- * `typed`: a typed yes to a Start card (one-step-chat.md C5), the message that was the yes, recorded beside the marker. */
-fastStart?: {
-    rule: string;
-    at: string;
-    typed?: {
-        provider: string;
-        event: string;
-    };
-}, 
-/** A person's own yes in chat (owner's decision, docs/plans/toolroll-cards.md): their tap or signed-in click stands in
- * for a password, so `token` is unused. Every rule below still applies. The caller has proved the person is the one
- * tapping. `shown` is what a card that showed its terms whole showed: those words, and the digest kept when it was
- * made. Null when the card showed less: the seal then opens none of the walls a person's reading opens. */
-chat?: {
-    modeDigest: string;
-    shown: {
-        expect: string;
-        terms: string;
-    } | null;
-}): ApproveResult;
-/** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
-export declare const APPROVAL_PROOF = "approval proved";
-/** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
-export declare const approvalProofDetail: (at: number, generation: number, digest: string, local?: {
-    generation: number;
-    transport: LocalTransport;
-}) => string;
-/** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
-export declare function approvalProofOf(store: Store, taskId: string, by: string, digest: string): {
-    method: string;
-    at: string;
-} | null;
-/** Whether a remembered password may approve these terms: one approver (no protected work), standard permissions
- * (never escalated), and not filed by a coordinator, a lead or a scout (those keep their own password ceremony). */
-export declare function freshlyApprovable(store: Store, taskId: string, scope: Scope, singleApprover: boolean): boolean;
-/**
- * Whether this task may be built.
- *
- * `changed` is the interesting answer and the reason the digest exists: the
- * scope was approved, and then somebody — possibly an agent, possibly the
- * operator, possibly a different session — rewrote it. The old yes does not
- * transfer.
- */
-export declare function approvalOf(scope: Scope | null): Approval;
-/**
- * THE STRICT STORED-SCOPE PROJECTION (v48 integrity): the ONE reading of
- * a filed scope that a seal and every consent surface believe. Nothing
- * lenient stands in for it — the working profile and route are
- * re-parsed from their raw bytes with exact keys, safe integers, and
- * timer-safe clocks; the route's build and repair legs ARE the profile's
- * exact pairs; and the row's digest re-derives, complete, from these very values. A legacy row (no
- * route era) has no authority a person can newly agree to. One
- * disagreement is the words, and nothing — no nonce, no password field,
- * no approve action, no seal — is exposed on it.
- */
-export type ScopeAuthority = {
-    ok: true;
-    profile: ExecutionProfile;
-    route: PhaseRoute;
-    digest: string;
-    authMode: AuthMode | null;
-    chain?: ChainEntry[];
-} | {
-    ok: false;
-    reason: "terms" | "unrouted" | "unresolved" | "profile" | "chain" | "route" | "parity" | "digest" | "auth-mode";
-    problem: string;
-};
-/** What the strict projection reads OUTSIDE the row (atomic authority
- * closure): the operator's stored auth mode for a provider, strictly — a
- * present file that says neither word is a stated problem, never the
- * default a lenient read would coerce it to. Filing, consent, the seal,
- * and the spawn all hand in the same reader, so one broken file closes
- * every door in the same words. */
-export type ScopeAuthorityEnv = {
-    authMode?: (provider: ProviderId) => {
-        ok: true;
-        mode: AuthMode;
-    } | {
-        ok: false;
-        problem: string;
-    };
-};
-/**
- * THE PARITY every projection proves between a route and the profile and
- * terms it was filed beside (atomic authority closure): the build and
- * repair legs ARE the profile's exact pairs, and the route's signed risk
- * and quality ARE the row's — a row whose risk says high over a route
- * recommended for routine was not filed by this code, and neither the
- * seal, the consent door, nor the dispatch proof believes it. One
- * function, so the working side, the sealed side, and the last-mile
- * dispatch proof cannot drift. Null when everything agrees.
- */
-export declare function routeParityProblem(route: PhaseRoute, profile: ExecutionProfile, terms: {
-    riskLevel: RiskLevel;
-    qualityMode: QualityMode;
-}): string | null;
-export declare function scopeAuthorityOf(scope: Scope, env?: ScopeAuthorityEnv): ScopeAuthority;
-/** The rubric's approval-card lines (v39): one per criterion, the id in
- * front (the exact string a proof must answer by) and its required
- * evidence kinds after it — `how` is deliberately absent here, the same way
- * it is absent from the digest: it is guidance, never a signed term. */
-export declare function acceptanceWords(criteria: readonly AcceptanceCriterion[]): string[];
-/** The route's approval-card lines (v47): the WORKING route the digest
- * bound, projected with whatever readiness the caller can see — the same
- * bytes the task page and chat render. Empty on a scope with no route. */
-export declare function scopeRouteWords(scope: Pick<Scope, "proposedRouteJson">, readiness?: ReadinessLookup): string[];
-/** The scope, in the words an operator has to be able to agree or disagree with. */
-export declare function describeScope(scope: Scope, readiness?: ReadinessLookup, 
-/** Results routing: the evidence line when an earned rule chose the builder (route-rules.ts taskEvidenceWords). */
-evidence?: string | null): string[];
-/** The approval sheet's release lines (release-once.md): the release in one sentence, then what asks again. */
-export declare function releaseTermsSentence(terms: ReleaseTerms): string;
-/** The approval sheet's line for a release check purpose (pipeline-speed.md, P0): a release that can't carry. */
-export declare function releaseCheckSentence(purpose: ReleaseCheckPurpose): string;
-/** What asks again, in full: the terms behind the sentence. */
-export declare function releaseAsksAgainWords(terms: ReleaseTerms): string[];
-export { personProof } from "./person-proof.js";
-import { type ReleaseCheckPurpose, type ReleaseTerms } from "./contracts/release-terms.js";
-import { type AutoEvidence, type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
-/** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
-export declare const machineActing: () => boolean;
-/** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
- * (`{"v":1,"at":…,"digest":…}`, more fields allowed). Any other shape is no proof. */
-export declare function proofDetailOf(detail: unknown): {
-    at: string;
-    digest: string;
-} | null;
-/**
- * A person's approval of this task as it stands: approved, on the current digest, by the ceremony (`password`) or a
- * paired-chat tap (`chat`), with a person's proof recorded for that approver and those exact bytes. Release, deploy
- * and the protected-work counters ask this; a lead, a mode, a grant, a schedule or an approval with no proof is not
- * a person's.
- */
-export declare function personApprovalOf(store: Store, taskId: string): {
-    ok: true;
-    by: string;
-    at: string;
-    method: string;
-} | {
-    ok: false;
-    why: string;
-};
-/**
- * Who made a seal that says it came through a person's road (`password`, `chat`), from the acts recorded AT THAT SEAL
- * (approval policy §1.5): the proof rows its approver left at the seal's own instant, and the lead's task act then.
- * - `machine`: any proof there that isn't a person's (a lead or remote token, or a word this code doesn't know), or the
- *   lead's act — fail closed, whatever its digest says;
- * - `person`: a person's proof there for these exact bytes (parsed, either form);
- * - `automation`: a standing order's firing that no person's proof stands behind;
- * - `unproven`: none of these (a seal from before proof rows): it dispatches as before, and is never a person's yes.
- * An older proof for the same bytes never vouches for a later seal. The dispatch belts ask the same in SQL
- * (approval-authority.ts).
- */
-export declare function sealOriginOf(store: Store, taskId: string, by: string, digest: string, at: string): {
-    origin: "machine";
-    lead: boolean;
-} | {
-    origin: "person";
-    method: string;
-} | {
-    origin: "automation";
-} | {
-    origin: "unproven";
-};
-/** Text another machine wrote (a confirmed chat proposal, a coordinator, a scout): no mode, grant, remembered password
- * or chat tap seals it. The lead's own CLI text (`lead`) is not quarantined. */
-export declare const quarantinedAuthor: (via: string | null | undefined) => boolean;
-/** What a release task is about to do. */
-export type ReleaseAction = "dispatch" | "deploy" | "merge" | "complete";
-export type LiveRelease = {
-    applies: false;
-} | {
-    applies: true;
-    ok: true;
-    authority: ReleaseAuthority;
-    carry: ReleaseCarry | null;
-} | {
-    applies: true;
-    ok: false;
-    why: string;
-    authority: ReleaseAuthority | null;
-};
-/**
- * Whether a task that belongs to a release authority may do `action` now. It applies to EVERY such task, whether its
- * seal is the person's own or `carried`, and requires all of: the authority's current generation (never superseded,
- * revoked or expired before it started); a state that fits the action; the task is the authority's current tip; the
- * anchor's seal is a person's (personApprovalOf, unchanged) on the exact sealed anchor digest; the anchor's approver is
- * still an active approver with access to the project; for a carried task, a carry row for exactly this task, scope
- * digest, candidate and generation; the release check grant and check access as sealed (access only ever the fence);
- * a sealed policy this runtime knows; and, for deploy and merge, no open main-check failure blocking a composed check.
- * A task that belongs to no release reads `applies: false` — the ordinary rules decide it.
- */
-export declare function liveReleaseOf(store: Store, taskId: string, action: ReleaseAction, now?: Date): LiveRelease;
-/**
- * Open main-check failures (the nightly full check, part 3) block the deploy and the merge of a release whose gate
- * check was composed from a targeted run: a full pass is needed first. Null when nothing blocks.
- */
-export declare function mainDebtProblem(store: Store, repo: string, taskId: string): string | null;
-/**
- * A deploy gate (docs/plans/chat-management.md §0a.5): a scope whose signed terms name a prepared candidate or carry
- * release terms. Both are in the scope digest and written at filing, before any release authority exists, so this is
- * read from the scope alone: a first approval and a fallback gate filed without --release are deploy gates too. From
- * chat it is approved only through the release card.
- */
-export declare function deployGateScope(scope: Pick<Scope, "candidate" | "releaseTerms">): boolean;
-/**
- * Whether a scope's check is a release's check (docs/plans/pipeline-speed.md, P0): it carries signed release terms, or a
- * release check purpose sealed with it. Read from the scope's signed fields only, independent of whether the release can
- * carry. It makes the check stricter (a complete, valid report; CI never stands in for its units) and, through
- * check-failure.ts recheckReleaseTask, lets the plane rerun the identical candidate after confirmed infrastructure; it
- * never carries a later commit or approves anything.
- */
-export declare function releaseCheckScope(scope: Pick<Scope, "releaseTerms" | "releaseCheck"> | null): boolean;
-/**
- * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
- * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
- * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
- * and the person who turned it on still an approver there. Never a person's approval.
- */
-export declare function autoReleaseApprovalOf(store: Store, taskId: string, kind: "auto-check" | "auto-green"): {
-    ok: true;
-    by: string;
-    at: string;
-    evidence: AutoEvidence;
-} | {
-    ok: false;
-    why: string;
-};
-/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
- * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
-export declare function releaseApprovalOf(store: Store, taskId: string, _now?: Date): {
-    ok: true;
-    by: string;
-    at: string;
-    method: string;
-} | {
-    ok: false;
-    why: string;
-};
-/** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
- * only: freshnessFor decides whether it stands in, at the moment of use. */
-export declare function freshUntil(at: string): string | null;
-export type LocalApprovalRefusal = "local-mode-off" | "not-owner" | "no-scope" | "release" | "protected" | "escalated" | "coordinator" | "unsandboxed" | "imported";
-/**
- * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
- * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
- * precheck (an empty field passes) and the seal itself (approve(), inside its transaction). Refused: local mode off or
- * another person; no plan; release or deploy terms; protected or two-person work; an escalated profile; work a
- * coordinator filed; a project whose checks are stored as unsandboxed (or a plan that sealed that). Plans a lead or
- * a scout proposed are allowed.
- */
-export declare function localApprovalEligible(store: Store, by: string, taskId: string): {
-    ok: true;
-} | {
-    ok: false;
-    reason: LocalApprovalRefusal;
-    message: string;
-};
-/** A chain that may dispatch: version 2, a base and at least one fallback. An older chain is history, never this. */
-export declare function liveChainFromJson(json: string | null): ChainEntry[] | null;
-/** The chain in full, the words a yes agrees to: order, agent, model, how it bills, what it may do, and whether Toolroll
- * can see it run out. Every approval surface shows these lines; empty for a scope with no chain. */
-export declare function chainTermsLines(scope: Pick<Scope, "proposedChainJson">): string[];
-/** The act a local owner's work rule is read for: approving a plan, or completing (accepting) a result whose build
- * changed `changed` (the build's own diff; null when it can't be read, which counts as protected). */
-export type LocalWorkPurpose = {
-    act: "approve";
-} | {
-    act: "complete";
-    changed: readonly string[] | null;
-} | {
-    act: "plan";
-} | {
-    act: "retry";
-};
-/**
- * Whether the local owner may do this act on this task without a password: ONE rule (easy-start C5, split out for
- * local-owner slice 0), read inside the act's own transaction. Both acts refuse: local mode off or another person;
- * release or deploy work; protected or two-person work; work a coordinator filed (or a task with no built-in record).
- * Approving also refuses no plan, an escalated profile and a project stored as unsandboxed (what a build may do, which
- * is what an approval agrees to). Completing reads release work from the release records too, and protected work from
- * what the result actually changed as well as what its scope declared (v102's rule: declared paths are only a promise).
- * Asking for a plan (local-owner slice 2) reads approve's rule for a task that may have no scope yet (no declared paths
- * count as protected; the task's own permission mode counts as escalated), the release records too, and also refuses a
- * task from outside (an imported issue): a new act, so no existing act changes. Retrying (slice 3) is approve's rule
- * exactly (work the owner could approve again now), plus the release records and a task from outside.
- */
-export declare function localWorkEligible(store: Store, by: string, taskId: string, purpose: LocalWorkPurpose): {
-    ok: true;
-} | {
-    ok: false;
-    reason: LocalApprovalRefusal;
-    message: string;
-};