toolroll 0.9.36 → 0.9.38

package/dist/coding-handoff.js

@@ -10,6 +10,8 @@ import { parseAcceptanceCriteria, proposeGuarded } from './scope.js';
 import { validateTaskText } from './task-text.js';
 import { PROOF_LIMITS } from './proof.js';
 import { readPreparedEvidence } from './prepared-evidence.js';
+import { parseCodingHandoffReceipt } from './contracts/coding-handoff.js';
+import { parseCodingSessionDocument } from './contracts/coding-workspace.js';
 import { BRANCH_PREFIXES, taskBranch } from './names.js';
 const PREFIX = 'coding:';
 const SHA = /^[a-f0-9]{40}$/;
@@ -84,7 +86,7 @@ function sessionFor(db, store, sessionId, actor) {
     const row = db.prepare('SELECT owner,generation,repo,document FROM coding_session WHERE id=?').get(sessionId);
     if (!row || row['owner'] !== actor)
         throw Error('This coding session is not available to your account.');
-    const session = JSON.parse(String(row['document']));
+    const session = parseCodingSessionDocument(String(row['document']));
     const generation = actorGeneration(store, actor, String(row['repo']));
     if (row['generation'] !== generation || session.id !== sessionId || session.owner !== actor || session.generation !== generation || session.repo !== row['repo'])
         throw Error('The coding session no longer matches your account or project.');
@@ -132,18 +134,22 @@ function makeReceipt(terms) {
     const id = learningSha(JSON.stringify(terms)).slice(0, 32), taskId = `coding-review-${id}`;
     return { ...terms, id, taskId, branch: taskBranch(taskId) };
 }
-function parseReceipt(row) {
+/** The saved bytes are verified before they are parsed; identity and branch are checked on the parsed terms. */
+export function parseReceipt(row) {
     const payload = String(row['payload']);
     if (learningSha(payload) !== row['sha'])
         throw Error('The coding handoff receipt could not be verified.');
-    const receipt = JSON.parse(payload);
+    const read = parseCodingHandoffReceipt(payload);
+    if (!read.ok)
+        throw Error(`The coding handoff receipt could not be read: ${read.issues.map(issue => issue.line).join('; ')}`);
+    const receipt = read.value;
     const { id, taskId, branch, ...terms } = receipt;
     const expected = makeReceipt(terms);
-    if (receipt.version !== 1 || row['id'] !== id || id !== expected.id || taskId !== expected.taskId || !BRANCH_PREFIXES.some(prefix => branch === `${prefix}${taskId}`) || !SHA.test(receipt.base) || !SHA.test(receipt.candidate))
+    if (row['id'] !== id || id !== expected.id || taskId !== expected.taskId || !BRANCH_PREFIXES.some(prefix => branch === `${prefix}${taskId}`) || !SHA.test(receipt.base) || !SHA.test(receipt.candidate))
         throw Error('The coding handoff receipt identity could not be verified.');
     return receipt;
 }
-function sealPayload(receipt, scopeDigest) {
+export function sealPayload(receipt, scopeDigest) {
     return JSON.stringify({ version: 1, id: receipt.id, receiptSha256: learningSha(JSON.stringify(receipt)), scopeDigest });
 }
 function verifySeal(db, receipt, digest) {

package/dist/coding-types.d.ts

@@ -1,29 +1,5 @@
-import type { CodingContext } from './coding-context.js';
-export type CodingStatus = 'starting' | 'ready' | 'working' | 'needs-input' | 'stopping' | 'interrupted' | 'failed' | 'uncertain' | 'closed';
-export type CodingSession = {
-    id: string;
-    owner: string;
-    generation: number;
-    repo: string;
-    title: string;
-    provider: 'codex';
-    model: string | null;
-    branch: string;
-    base: string;
-    worktree: string;
-    nativeThreadId: string | null;
-    turnId: string | null;
-    status: CodingStatus;
-    error: string | null;
-    createdAt: string;
-    updatedAt: string;
-    deliveryReviewRequired?: boolean;
-    initialRequest?: {
-        requestId: string;
-        prompt: string;
-    };
-    context?: CodingContext;
-};
+export type { CodingSession, CodingStatus } from './contracts/coding-workspace.js';
+import type { CodingSession } from './contracts/coding-workspace.js';
 export type CodingItem = {
     id: string;
     type: string;

package/dist/coding-workspace.d.ts

@@ -60,6 +60,8 @@ export declare class CodingWorkspace {
     constructor(options: Options);
     private authorize;
     private read;
+    /** Preserve legacy reads, but never mutate an unidentified row or save an unreadable record's error projection. */
+    private catalogRow;
     private admit;
     private releaseOperation;
     list(actor: CodingActor): CodingSession[];

package/dist/coding-workspace.js

@@ -9,6 +9,7 @@ import { run } from './exec.js';
 import { processMayBeAlive } from './process-liveness.js';
 import { createCodexCodingProvider } from './coding-provider.js';
 import { verifyCodingContext } from './coding-context.js';
+import { codingSessionDocument, parseCodingSessionDocument } from './contracts/coding-workspace.js';
 export class CodingActionError extends Error {
     delivery;
     sessionId;
@@ -77,8 +78,10 @@ export class CodingWorkspace {
             const clean = !prior || prior['clean'] === 1;
             this.recoveryRequired = !clean;
             this.db.prepare('INSERT OR REPLACE INTO coding_owner VALUES(1,?,?,?,?)').run(this.owner, process.pid, prior?.['native_pid'] ?? null, clean ? 1 : 0);
-            for (const row of this.db.prepare('SELECT document FROM coding_session').all()) {
-                const session = JSON.parse(String(row['document']));
+            for (const row of this.db.prepare('SELECT * FROM coding_session').all()) {
+                const { session, usable } = this.catalogRow(row);
+                if (!usable)
+                    continue;
                 if (session.status !== 'closed' && (!clean || busy.has(session.status)))
                     this.save({ ...session, status: clean ? 'interrupted' : 'uncertain', turnId: null, error: clean ? null : 'The previous server stopped without a verified process exit. Work is preserved; session recovery needs a process check before resuming.' });
             }
@@ -99,7 +102,23 @@ export class CodingWorkspace {
         const row = this.db.prepare('SELECT document FROM coding_session WHERE id=?').get(id);
         if (!row)
             throw Error('Coding session unavailable.');
-        return JSON.parse(String(row['document']));
+        return parseCodingSessionDocument(String(row['document']));
+    }
+    /** Preserve legacy reads, but never mutate an unidentified row or save an unreadable record's error projection. */
+    catalogRow(row) {
+        try {
+            const session = parseCodingSessionDocument(String(row['document']));
+            const usable = session.id === row['id'] && session.owner === row['owner'] && session.generation === row['generation'] && session.repo === row['repo'];
+            return { session, usable };
+        }
+        catch (error) {
+            return { usable: false, session: {
+                    id: String(row['id']), owner: String(row['owner']), generation: Number(row['generation']), repo: String(row['repo']),
+                    title: 'Unreadable coding session', provider: 'codex', model: null, branch: '', base: '', worktree: '',
+                    nativeThreadId: null, turnId: null, status: 'failed', createdAt: '', updatedAt: '',
+                    error: error instanceof Error ? error.message : 'The saved coding session could not be read.',
+                } };
+        }
     }
     admit() {
         if (this.closed || this.closing || this.persistenceFailed)
@@ -116,7 +135,7 @@ export class CodingWorkspace {
         }
     }
     list(actor) {
-        return this.db.prepare('SELECT document FROM coding_session WHERE owner=? AND generation=? ORDER BY rowid DESC').all(actor.name, actor.generation).map(row => JSON.parse(String(row['document'])));
+        return this.db.prepare('SELECT * FROM coding_session WHERE owner=? AND generation=? ORDER BY rowid DESC').all(actor.name, actor.generation).map(row => this.catalogRow(row).session);
     }
     /** Inspect a fixed metadata window before loading admitted documents.
      * A filtered window can be short without proving the entire list empty. */
@@ -127,13 +146,18 @@ export class CodingWorkspace {
         const window = rows.slice(0, 100);
         const admitted = window.filter(row => options.authorized(String(row['repo'])));
         const selected = admitted.slice(0, Math.min(100, Math.max(1, options.limit)));
-        return { sessions: selected.map(row => this.get(String(row['id']), actor)), truncated: rows.length > window.length || admitted.length > selected.length };
+        const sessions = selected.map(row => {
+            const session = this.catalogRow(this.db.prepare('SELECT * FROM coding_session WHERE id=? AND owner=? AND generation=?').get(String(row['id']), actor.name, actor.generation)).session;
+            this.authorize(actor, session.repo);
+            return session;
+        });
+        return { sessions, truncated: rows.length > window.length || admitted.length > selected.length };
     }
     get(id, actor) {
         const row = this.db.prepare('SELECT document FROM coding_session WHERE id=? AND owner=? AND generation=?').get(id, actor.name, actor.generation);
         if (!row)
             throw Error('This coding session is not available to your account.');
-        const session = JSON.parse(String(row['document']));
+        const session = parseCodingSessionDocument(String(row['document']));
         this.authorize(actor, session.repo);
         return session;
     }
@@ -204,13 +228,16 @@ export class CodingWorkspace {
     }
     save(session) {
         session.updatedAt = now();
-        this.db.prepare('INSERT INTO coding_session(id,owner,generation,repo,document) VALUES(?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET document=excluded.document,revision=revision+1').run(session.id, session.owner, session.generation, session.repo, JSON.stringify(session));
+        this.db.prepare('INSERT INTO coding_session(id,owner,generation,repo,document) VALUES(?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET document=excluded.document,revision=revision+1').run(session.id, session.owner, session.generation, session.repo, codingSessionDocument(session));
     }
     byThread(thread) {
         if (typeof thread !== 'string')
             return null;
-        const row = this.db.prepare("SELECT document FROM coding_session WHERE json_extract(document,'$.nativeThreadId')=?").get(thread);
-        return row ? JSON.parse(String(row['document'])) : null;
+        const row = this.db.prepare("SELECT * FROM coding_session WHERE json_extract(document,'$.nativeThreadId')=?").get(thread);
+        if (!row)
+            return null;
+        const { session, usable } = this.catalogRow(row);
+        return usable ? session : null;
     }
     putItem(session, item) {
         // Re-reading unchanged native history must not invalidate the request
@@ -285,8 +312,10 @@ export class CodingWorkspace {
         if (event.kind === 'exit') {
             this.flush();
             this.loaded.clear();
-            for (const row of this.db.prepare('SELECT document FROM coding_session').all()) {
-                const session = JSON.parse(String(row['document']));
+            for (const row of this.db.prepare('SELECT * FROM coding_session').all()) {
+                const { session, usable } = this.catalogRow(row);
+                if (!usable)
+                    continue;
                 if (busy.has(session.status))
                     this.save({ ...session, status: 'uncertain', error: 'The agent connection closed. Work is preserved; delivery and process exit need to be checked before continuing.' });
             }
@@ -522,7 +551,12 @@ export class CodingWorkspace {
         this.operations.add(id);
         try {
             if (this.provider) {
-                const active = this.db.prepare('SELECT document FROM coding_session').all().some(row => busy.has(JSON.parse(String(row['document'])).status));
+                const active = this.db.prepare('SELECT * FROM coding_session').all().some(row => {
+                    const { session, usable } = this.catalogRow(row);
+                    if (!usable)
+                        throw new CodingActionError('A saved coding session could not be checked. Repair its record before reconnecting the agent.', 'rejected', id);
+                    return busy.has(session.status);
+                });
                 if (active)
                     throw new CodingActionError('Another coding turn is still active. Wait for it to finish or stop it before reconnecting the agent.', 'rejected', id);
                 await this.provider.close();
@@ -754,8 +788,10 @@ export class CodingWorkspace {
             this.db.close();
             return;
         }
-        for (const row of this.db.prepare('SELECT document FROM coding_session').all()) {
-            const session = JSON.parse(String(row['document']));
+        for (const row of this.db.prepare('SELECT * FROM coding_session').all()) {
+            const { session, usable } = this.catalogRow(row);
+            if (!usable)
+                continue;
             const uncertain = this.db.prepare("SELECT 1 FROM coding_submission WHERE session=? AND status IN ('preparing','pending','uncertain')").get(session.id);
             if (!uncertain && (busy.has(session.status) || session.status === 'uncertain'))
                 this.save({ ...session, status: 'interrupted', turnId: null, error: null });

package/dist/contracts/acceptance-terms.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The acceptance rubric's vocabulary and limits: the evidence kinds a criterion may require, and how many criteria
+ * and bytes a rubric may hold. A leaf with no imports but TEXT_LIMITS, because the plan contract (src/contracts/plan.ts)
+ * reads these through scope.ts while scope.ts reads the plan contract's criterion: kept here, both load in either order.
+ */
+export declare const EVIDENCE_KINDS: readonly ["check", "screenshot", "changed-path", "manual-review"];
+export type EvidenceKind = (typeof EVIDENCE_KINDS)[number];
+export declare const ACCEPTANCE_LIMITS: {
+    readonly criteria: 12;
+    readonly id: 40;
+    readonly statement: 1000;
+    readonly how: 500;
+    readonly evidenceKinds: 4;
+};

package/dist/contracts/acceptance-terms.js

@@ -0,0 +1,16 @@
+/**
+ * The acceptance rubric's vocabulary and limits: the evidence kinds a criterion may require, and how many criteria
+ * and bytes a rubric may hold. A leaf with no imports but TEXT_LIMITS, because the plan contract (src/contracts/plan.ts)
+ * reads these through scope.ts while scope.ts reads the plan contract's criterion: kept here, both load in either order.
+ */
+import { TEXT_LIMITS } from "../text-limits.js";
+export const EVIDENCE_KINDS = ["check", "screenshot", "changed-path", "manual-review"];
+export const ACCEPTANCE_LIMITS = {
+    criteria: 12,
+    id: TEXT_LIMITS.acceptanceIdBytes,
+    // A statement is one testable outcome; three hundred bytes forced people to
+    // drop the qualifying clause that made it testable.
+    statement: TEXT_LIMITS.acceptanceStatementBytes,
+    how: TEXT_LIMITS.acceptanceHowBytes,
+    evidenceKinds: EVIDENCE_KINDS.length,
+};

package/dist/contracts/chat-actions.d.ts

@@ -0,0 +1,328 @@
+/**
+ * Shared chat actions (chat-actions.ts): one schema for each action's data — what the lead proposes and what a saved
+ * proposal carries after `prepareSharedAction` has checked and rewritten it — and one for the saved proposal itself.
+ * The allowed fields (`CHAT_ACTION_FIELDS`) and the request types are derived from these; what JSON Schema can't say
+ * (credentials and control characters in text, each field's length, a zone or option that exists, who may act) runs
+ * in `prepareSharedAction` after parsing, with its own named refusal.
+ *
+ * A flow drawing, trigger or script inside a request is read by its own contract (flows.ts `validateFlowDefinition`,
+ * flow-triggers.ts `validateTriggerConfig`, flow-scripts.ts `validateScript`) when the action is prepared, in every
+ * vocabulary those accept; here it is only "a value".
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+/**
+ * Each action's data, field order as the lead reads it in `get_actions`. Fields a branch ignores or reads through
+ * its own validator stay unknown: 0.9.36 accepted null and other non-string values there. Preparation still checks
+ * the selected branch and saves the same request bytes. No schema defaults or coercion may change its stamp.
+ */
+export declare const chatActionRequestSchemas: {
+    readonly skill_import: z.ZodObject<{
+        repo: z.ZodString;
+        content: z.ZodOptional<z.ZodString>;
+        files: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            base64: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    readonly skill_enable: z.ZodObject<{
+        repo: z.ZodString;
+        version: z.ZodString;
+    }, z.core.$strict>;
+    readonly skill_disable: z.ZodObject<{
+        repo: z.ZodString;
+        version: z.ZodString;
+    }, z.core.$strict>;
+    readonly skill_restore: z.ZodObject<{
+        repo: z.ZodString;
+        restore: z.ZodInt;
+    }, z.core.$strict>;
+    readonly skill_test: z.ZodObject<{
+        repo: z.ZodString;
+        version: z.ZodString;
+        sample: z.ZodString;
+        nonce: z.ZodString;
+    }, z.core.$strict>;
+    readonly knowledge_instructions: z.ZodObject<{
+        repo: z.ZodString;
+        instructions: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly knowledge_save: z.ZodObject<{
+        repo: z.ZodString;
+        title: z.ZodString;
+        content: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly knowledge_remove: z.ZodObject<{
+        repo: z.ZodString;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    readonly knowledge_restore: z.ZodObject<{
+        repo: z.ZodString;
+        restore: z.ZodInt;
+    }, z.core.$strict>;
+    readonly tool_add: z.ZodObject<{
+        repo: z.ZodString;
+        catalog: z.ZodOptional<z.ZodUnknown>;
+        name: z.ZodOptional<z.ZodUnknown>;
+        command: z.ZodOptional<z.ZodUnknown>;
+        args: z.ZodOptional<z.ZodUnknown>;
+        url: z.ZodOptional<z.ZodUnknown>;
+        secrets: z.ZodOptional<z.ZodUnknown>;
+        about: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly tool_remove: z.ZodObject<{
+        repo: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strict>;
+    readonly flow_create: z.ZodObject<{
+        repo: z.ZodString;
+        name: z.ZodString;
+        definition: z.ZodUnknown;
+        trigger: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly flow_starter: z.ZodObject<{
+        repo: z.ZodString;
+        starter: z.ZodString;
+    }, z.core.$strict>;
+    readonly flow_edit: z.ZodObject<{
+        flow: z.ZodInt;
+        name: z.ZodOptional<z.ZodString>;
+        definition: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly flow_card_add: z.ZodObject<{
+        flow: z.ZodInt;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodUnknown>;
+        zone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly flow_card_move: z.ZodObject<{
+        card: z.ZodInt;
+        zone: z.ZodString;
+    }, z.core.$strict>;
+    readonly flow_card_approve: z.ZodObject<{
+        card: z.ZodInt;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly flow_card_send_back: z.ZodObject<{
+        card: z.ZodInt;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    /** An option by its number (from 1), or a reply that becomes the note. */
+    readonly flow_card_choose: z.ZodObject<{
+        card: z.ZodInt;
+        choice: z.ZodOptional<z.ZodNullable<z.ZodInt>>;
+        note: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly flow_card_cancel: z.ZodObject<{
+        card: z.ZodInt;
+    }, z.core.$strict>;
+    readonly flow_card_comment: z.ZodObject<{
+        card: z.ZodInt;
+        note: z.ZodString;
+    }, z.core.$strict>;
+    readonly flow_card_assign: z.ZodObject<{
+        card: z.ZodInt;
+        owner: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>;
+    readonly flow_card_watch: z.ZodObject<{
+        card: z.ZodInt;
+        watching: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly flow_script_save: z.ZodObject<{
+        repo: z.ZodString;
+        script: z.ZodObject<{}, z.core.$catchall<z.ZodUnknown>>;
+    }, z.core.$strict>;
+    readonly flow_trigger_add: z.ZodObject<{
+        flow: z.ZodInt;
+        trigger: z.ZodUnknown;
+    }, z.core.$strict>;
+    readonly flow_trigger_pause: z.ZodObject<{
+        trigger: z.ZodInt;
+    }, z.core.$strict>;
+    readonly flow_trigger_resume: z.ZodObject<{
+        trigger: z.ZodInt;
+    }, z.core.$strict>;
+    readonly flow_trigger_remove: z.ZodObject<{
+        trigger: z.ZodInt;
+    }, z.core.$strict>;
+    readonly teammate_create: z.ZodObject<{
+        repo: z.ZodString;
+        template: z.ZodOptional<z.ZodUnknown>;
+        name: z.ZodOptional<z.ZodUnknown>;
+        soul: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly teammate_soul: z.ZodObject<{
+        teammate: z.ZodInt;
+        soul: z.ZodString;
+    }, z.core.$strict>;
+    readonly teammate_state: z.ZodObject<{
+        teammate: z.ZodInt;
+        state: z.ZodEnum<{
+            active: "active";
+            paused: "paused";
+            removed: "removed";
+        }>;
+    }, z.core.$strict>;
+    readonly teammate_note: z.ZodObject<{
+        teammate: z.ZodInt;
+        note: z.ZodString;
+    }, z.core.$strict>;
+    readonly teammate_answer: z.ZodObject<{
+        question: z.ZodInt;
+        choice: z.ZodOptional<z.ZodUnknown>;
+        text: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly teammate_tools: z.ZodObject<{
+        teammate: z.ZodInt;
+        tool: z.ZodString;
+        change: z.ZodEnum<{
+            grant: "grant";
+            revoke: "revoke";
+            rule: "rule";
+        }>;
+        action: z.ZodOptional<z.ZodUnknown>;
+        use: z.ZodOptional<z.ZodUnknown>;
+        limitField: z.ZodOptional<z.ZodUnknown>;
+        limitOver: z.ZodOptional<z.ZodUnknown>;
+        undoWith: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly teammate_memory: z.ZodObject<{
+        teammate: z.ZodInt;
+        memory: z.ZodInt;
+        change: z.ZodEnum<{
+            edit: "edit";
+            forget: "forget";
+        }>;
+        text: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly teammate_routine: z.ZodObject<{
+        teammate: z.ZodInt;
+        change: z.ZodEnum<{
+            add: "add";
+            remove: "remove";
+        }>;
+        routine: z.ZodOptional<z.ZodUnknown>;
+        schedule: z.ZodOptional<z.ZodUnknown>;
+        text: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>;
+    readonly teammate_undo: z.ZodObject<{
+        teammate: z.ZodInt;
+        call: z.ZodInt;
+    }, z.core.$strict>;
+    readonly kit_setup: z.ZodObject<{
+        repo: z.ZodString;
+        kit: z.ZodString;
+    }, z.core.$strict>;
+    readonly decision_record: z.ZodObject<{
+        repo: z.ZodString;
+        claim: z.ZodString;
+        why: z.ZodString;
+        supersedes: z.ZodOptional<z.ZodInt>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    readonly decision_retire: z.ZodObject<{
+        repo: z.ZodString;
+        decision: z.ZodInt;
+        reason: z.ZodString;
+    }, z.core.$strict>;
+    /** The line, and (from 1) the line it replaces; 0 or none adds it. */
+    readonly lead_about_you: z.ZodObject<{
+        line: z.ZodString;
+        replaces: z.ZodOptional<z.ZodInt>;
+    }, z.core.$strict>;
+    readonly scope_approve: z.ZodObject<{
+        task: z.ZodString;
+    }, z.core.$strict>;
+    readonly result_accept: z.ZodObject<{
+        task: z.ZodString;
+        run: z.ZodInt;
+    }, z.core.$strict>;
+    readonly task_cancel: z.ZodObject<{
+        task: z.ZodString;
+    }, z.core.$strict>;
+    readonly task_resume: z.ZodObject<{
+        task: z.ZodString;
+        run: z.ZodInt;
+    }, z.core.$strict>;
+};
+export type ChatActionOperation = keyof typeof chatActionRequestSchemas;
+export declare const CHAT_ACTION_OPERATIONS: [ChatActionOperation, ...ChatActionOperation[]];
+export type ChatActionRequest<O extends ChatActionOperation = ChatActionOperation> = z.infer<(typeof chatActionRequestSchemas)[O]>;
+/** The fields each action takes, from its schema. */
+export declare const CHAT_ACTION_FIELDS: Record<ChatActionOperation, readonly string[]>;
+/** One action's data, refused by path (`card: required`, `payload: unknown key 'cards' (did you mean card?)`). */
+export declare function readChatActionRequest(operation: ChatActionOperation, input: unknown): ContractResult<Record<string, unknown>>;
+export declare const SHARED_ACTION_VERSION = 1;
+/**
+ * A prepared action as a proposal saves it: the action, its checked request, the project, the card's title and
+ * terms, the stamp that proves nothing changed before it is confirmed, and the state the stamp was taken over (each
+ * action's own staleness fence, read back only by that action).
+ */
+export declare const sharedActionSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    operation: z.ZodEnum<{
+        decision_record: "decision_record";
+        decision_retire: "decision_retire";
+        flow_card_add: "flow_card_add";
+        flow_card_approve: "flow_card_approve";
+        flow_card_assign: "flow_card_assign";
+        flow_card_cancel: "flow_card_cancel";
+        flow_card_choose: "flow_card_choose";
+        flow_card_comment: "flow_card_comment";
+        flow_card_move: "flow_card_move";
+        flow_card_send_back: "flow_card_send_back";
+        flow_card_watch: "flow_card_watch";
+        flow_create: "flow_create";
+        flow_edit: "flow_edit";
+        flow_script_save: "flow_script_save";
+        flow_starter: "flow_starter";
+        flow_trigger_add: "flow_trigger_add";
+        flow_trigger_pause: "flow_trigger_pause";
+        flow_trigger_remove: "flow_trigger_remove";
+        flow_trigger_resume: "flow_trigger_resume";
+        kit_setup: "kit_setup";
+        knowledge_instructions: "knowledge_instructions";
+        knowledge_remove: "knowledge_remove";
+        knowledge_restore: "knowledge_restore";
+        knowledge_save: "knowledge_save";
+        lead_about_you: "lead_about_you";
+        result_accept: "result_accept";
+        scope_approve: "scope_approve";
+        skill_disable: "skill_disable";
+        skill_enable: "skill_enable";
+        skill_import: "skill_import";
+        skill_restore: "skill_restore";
+        skill_test: "skill_test";
+        task_cancel: "task_cancel";
+        task_resume: "task_resume";
+        teammate_answer: "teammate_answer";
+        teammate_create: "teammate_create";
+        teammate_memory: "teammate_memory";
+        teammate_note: "teammate_note";
+        teammate_routine: "teammate_routine";
+        teammate_soul: "teammate_soul";
+        teammate_state: "teammate_state";
+        teammate_tools: "teammate_tools";
+        teammate_undo: "teammate_undo";
+        tool_add: "tool_add";
+        tool_remove: "tool_remove";
+    }>;
+    request: z.ZodObject<{}, z.core.$catchall<z.ZodUnknown>>;
+    repo: z.ZodString;
+    title: z.ZodString;
+    terms: z.ZodArray<z.ZodString>;
+    stamp: z.ZodString;
+    state: z.ZodObject<{}, z.core.$catchall<z.ZodUnknown>>;
+}, z.core.$strict>;
+export type SharedAction = z.infer<typeof sharedActionSchema>;
+/**
+ * A proposal saved before it carried `version` (every one through 0.9.36), as version 1. Its reader took the fields
+ * it knew and passed any others through unread, so this keeps exactly the known fields.
+ */
+export declare function upgradeUnversionedSharedAction(body: Record<string, unknown>): Record<string, unknown>;
+export declare const SHARED_ACTION_UPGRADES: {
+    readonly 0: typeof upgradeUnversionedSharedAction;
+};
+/** Legacy readers checked only the envelope. Confirmation still prepares the request again before acting. */
+export declare function readSharedAction(input: unknown): ContractResult<SharedAction>;