toolroll 0.9.42 → 0.9.43

package/dist/flows-cli.js

@@ -10,7 +10,8 @@
 import { readFileSync, statSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { envelopeJson } from './envelope.js';
-import { addCardToFlow, advanceFlows, crossProjectProblem, flowDefinitionOf } from './flow-engine.js';
+import { addCardToFlow, advanceFlows, crossProjectProblem, decideFlowCard, flowDefinitionOf } from './flow-engine.js';
+import { chooseFlowCard } from './flow-send.js';
 import { saveScript } from './flow-scripts.js';
 import { exportFlow, fetchFlowFile, FLOW_FILE_MAX_BYTES, FlowFileError, importFlow, parseFlowFile, planFlowImport } from './flow-share.js';
 import { STARTER_FLOWS, starterFlowOf, starterOf, startersFor, starterTerms, switchOnStarter } from './flow-starters.js';
@@ -51,6 +52,10 @@ export const FLOWS_DESCRIPTORS = [
             { name: 'title', takesValue: true, meaning: "the card's title" },
             { name: 'description', takesValue: true, meaning: 'its details' },
             { name: 'zone', takesValue: true, meaning: 'a zone id or name' }] },
+    { action: 'card approve', synopsis: "approve a card waiting at a Person decides step (or pick --option at a Person chooses step), as the console's Approve does", mutation: 'identity-idempotent', positionals: ['flow', 'card'], flags: [...write,
+            { name: 'option', takesValue: true, meaning: "at a Person chooses step: the option's words or its number" }] },
+    { action: 'card send-back', synopsis: "send a waiting card back with a note, as the console's Send back (or a reply at a Person chooses step) does", mutation: 'identity-idempotent', positionals: ['flow', 'card'], flags: [...write,
+            { name: 'note', takesValue: true, meaning: 'what should change' }] },
     { action: 'export', synopsis: 'write a flow as a *.toolroll-flow.json file: zones, paths, trigger settings and scripts; never secrets, webhook addresses, names or cards', mutation: 'none', positionals: ['flow'], flags: [...read,
             { name: 'out', takesValue: true, meaning: 'write the file here (default: print it)' }] },
     { action: 'import', synopsis: 'make a flow from a flow file or a gist/GitHub https address; previews in plain words until --yes; triggers arrive off and scripts wait for approval', mutation: 'unkeyed', positionals: ['file'], flags: [...write, yes, repo,
@@ -407,6 +412,43 @@ export async function runFlowsCommand(positional, flags, context) {
         const card = store.getFlowCard(added.card);
         return ok({ applied: true, card: card === null ? { id: added.card } : cardOf(definition, card), said: added.said }, [`${added.said} Card #${added.card}.`]);
     }
+    if (action === 'card approve' || action === 'card send-back') {
+        // The console's own doors (decideFlowCard, chooseFlowCard): the same decider, visit and project checks, and the same card history.
+        const approving = action === 'card approve';
+        const note = text('note')?.trim() ?? null;
+        if (args[1] === undefined || (!approving && (note === null || note === '')))
+            return fail('usage', approving ? 'Use flows card approve <flow> <card> [--option <words|number>].' : 'Use flows card send-back <flow> <card> --note "<what should change>".', EXIT.usage);
+        const card = /^[1-9][0-9]{0,9}$/.test(args[1]) ? store.getFlowCard(Number(args[1])) : null;
+        if (card === null || card.flow !== flow.id)
+            return refuse(flow.repo, 'unknown-card', `Flow #${flow.id} has no card #${args[1]}. toolroll flows show ${flow.id} lists its cards.`);
+        const stage = definition.stages.find(one => one.id === card.stage);
+        let decided;
+        if (stage?.kind === 'choose') {
+            if (approving) {
+                const given = text('option')?.trim() ?? '';
+                const options = stage.options ?? [];
+                const choice = /^[1-9]$/.test(given) && Number(given) <= options.length ? Number(given) - 1 : options.findIndex(one => one.label.toLowerCase() === given.toLowerCase());
+                if (given === '' || choice < 0)
+                    return refuse(flow.repo, 'choose-option', `${stage.title} asks for a choice: give --option with one of ${options.map((one, at) => `${at + 1} “${one.label}”`).join(', ')}.`, EXIT.usage);
+                decided = chooseFlowCard(store, { card: card.id, entry: card.entry, choice, label: options[choice].label, note: null, actor: who, where: 'the command line', repos: reachable, evidenceRoot: context.evidenceRoot }, now);
+            }
+            else
+                decided = chooseFlowCard(store, { card: card.id, entry: card.entry, choice: null, note, actor: who, where: 'the command line', repos: reachable, evidenceRoot: context.evidenceRoot }, now);
+        }
+        else if (stage?.kind === 'approval') {
+            if (text('option') !== null)
+                return fail('usage', '--option is for a Person chooses step; this card waits for a decision.', EXIT.usage);
+            decided = decideFlowCard(store, { card: card.id, decision: approving ? 'approve' : 'send-back', note, actor: who, repos: reachable, evidenceRoot: context.evidenceRoot, entry: card.entry, where: 'the command line' }, now);
+        }
+        else
+            return refuse(flow.repo, 'not-waiting', card.state === 'active' ? `Card #${card.id} isn't waiting for a decision; it's in ${stage?.title ?? card.stage}.` : `Card #${card.id} is ${card.state}; nothing is waiting on it.`);
+        if (!decided.ok)
+            return refuse(flow.repo, 'refused', decided.message);
+        record(flow.repo, 'accepted', `flow #${flow.id} card #${card.id} · ${stage.title}`);
+        settle(flow.repo);
+        const after = store.getFlowCard(card.id);
+        return ok({ applied: true, card: after === null ? { id: card.id } : cardOf(definition, after), said: decided.said }, [decided.said]);
+    }
     if (action === 'trigger add') {
         if (args[1] === undefined)
             return fail('usage', 'Use flows trigger add <flow> <json|file|->, like \'{"kind":"schedule","schedule":"daily 09:00","title":"Standup"}\'.', EXIT.usage);

package/dist/guides.js

@@ -141,6 +141,8 @@ applies the console's rules exactly.
   \`flows trigger pause|resume|remove|check <id> <trigger>\`; \`flows script
   save --repo PATH --name <n> (--file <path in project> | --body <file>)
   --about "<line>"\`; \`flows card add <id> --title <t> [--zone <z>]\`;
+  \`flows card approve <id> <card>\` and \`flows card send-back <id> <card>
+  --note <text>\` only when the person asked for that decision;
   \`flows archive <id>\`.
 - create, edit, archive and trigger add answer with a preview
   (\`applied: false\`, \`terms\`) until \`--yes\`. Show the person the terms

package/dist/mate-contract.js

@@ -16,7 +16,7 @@ export const MATE_CONTRACT = [
     "Investigate before reporting a limitation: when a tool refuses or something looks unsupported, read get_capabilities and the relevant skill (get_skills, then that skill's instructions) before telling the owner it can't be done. Then say what you checked, what is missing, and the one next step.",
     "Ask rarely: only when the answer changes the work and you cannot settle it from tools or project memory. Then use ask_owner: one question, 2-4 short options (Something else is added), shown as buttons after your reply; the tapped option comes back as the owner's next message. Keep your reply to one short line leading into it, and do not repeat the options in your text.",
     "propose_* drafts, never completes. Confirmation and execution approvals still apply. Never request credentials in chat. Read get_task currentExecution before acting; revisions retain task identity and old cards retain exact targets.",
-    "The operator talks plainly and names work by what it is about ('the login page', 'that payout fix'), rarely by id. Use the current task when there is one; otherwise find it with list_tasks search, and if several fit, ask which by title. When they want work moved forward, read get_task and draft its next step: changes to a result still waiting on them → propose_review revise; guidance for work in progress → propose_steer; stopped → resume and failed → retry with propose_task_action; waiting for approval → show_control approval; new work, or more on something already completed → propose_task in the same project, naming the earlier task in its goal.",
+    "The operator talks plainly and names work by what it is about ('the login page', 'that payout fix'), rarely by id. Use the current task when there is one; otherwise find it with list_tasks search, and if several fit, ask which by title. When they want work moved forward, read get_task and draft its next step: changes to a result still waiting on them → propose_review revise; guidance for work in progress → propose_steer; stopped → resume and failed → retry with propose_task_action; waiting for approval, or 'approve X' → offer_approval for exactly that plan or flow card, which sends its own Approve buttons to the owner's chat (their tap approves it; you never do), and only when it says why not, say that in one line and show_control approval; new work, or more on something already completed → propose_task in the same project, naming the earlier task in its goal.",
     "Talk like a colleague in everyday words: task titles, 'the changes', 'the checks', 'try again'. Never say execution, run, scope, digest, dispatch or lane to the operator; say what happens next and what they can do.",
     "Read get_result for the exact execution/run; page nextFeedbackOffset. propose_review revise requests changes; note saves feedback. Use read notes only; clarify ambiguous intent. Ready is a saved result, not a reviewer stage. Historical missing assessments never require rerunning work. Failed checks and missing files remain visible; completion never deploys or changes checks.",
     "For screenshots, call get_result_images for that exact execution and run. On Telegram say they follow, never that they were delivered; elsewhere name result and image count. Limit 8/reply. If nextImageOffset exists, name remaining count; call it again with that offset or with the image ids it listed when asked. Select a newer revision explicitly; never describe unselected images or expose paths.",

package/dist/mate-tools.js

@@ -48,7 +48,9 @@ import { TOOL_CATALOG, discoverTools, projectToolsOf, secretsSetFor, toolCommand
 import { deciderOf, durationWords, FLOW_KIND_WORDS, FLOW_TEMPLATES, flowFromSteps, stepsFor, withKeptSteps } from "./flows.js";
 import { parseContract, toModelSchema } from "./contracts/contract.js";
 import { LEAD_TOOL_INPUTS, LEAD_TOOL_READ_INPUTS, LEAD_TOOL_OPTIONS, LEAD_TOOL_OUTPUTS, reportToolOutput } from "./contracts/lead-tools.js";
-import { flowDefinitionOf } from "./flow-engine.js";
+import { flowCardHref, flowDefinitionOf } from "./flow-engine.js";
+import { planInChat } from "./chat-decide.js";
+import { flowDecisionAt } from "./telegram-flow.js";
 import { flowPersonOf } from "./flow-send.js";
 import { flowInsights } from "./flow-insights.js";
 import { describeTrigger, FLOW_TRIGGER_KINDS, triggerConfigOf } from "./flow-triggers.js";
@@ -491,6 +493,46 @@ const MATE_TOOL_HANDLERS = {
             return id === null ? tooMany() : { ok: true, body: { card: id, label: entry.label, action: "open existing control; nothing changed" } };
         },
     },
+    offer_approval: {
+        description: "When the owner asks to approve one thing (a plan waiting on them, or a flow card waiting at a Person decides step), send that item's own Approve and Send back buttons to their paired chat right away. Their tap there is the approval (two taps, as on any decision card); you never approve. Give task for a plan, or card for a flow card (its number from get_flows). When it can't be approved in chat, the answer says why: say that in one line and open show_control approval (a plan) or the flow, never that you can't approve.",
+        handle: (ctx, args) => {
+            const pairedHere = ctx.channel === "telegram";
+            const paired = ctx.store.handle.prepare("SELECT 1 FROM telegram_binding WHERE approver = ? AND approver_generation = ? AND revoked_at IS NULL LIMIT 1")
+                .get(ctx.who.name, ctx.store.accountOf(ctx.who.name)?.generation ?? -1) !== undefined;
+            const stamp = ctx.now.getTime();
+            if (args["card"] !== undefined) {
+                const cardId = Number(args["card"]);
+                const card = Number.isSafeInteger(cardId) ? ctx.store.getFlowCard(cardId) : null;
+                const flow = card === null ? null : ctx.store.getFlow(card.flow);
+                if (card === null || flow === null || !ctx.who.repos.includes(flow.repo))
+                    return { ok: false, message: "not-found: no such flow card in your projects" };
+                const waiting = flowDecisionAt(ctx.store, card.id, card.entry);
+                const href = flowCardHref(flow.id, card.id);
+                if (waiting === null)
+                    return { ok: true, body: { offered: false, why: card.state === "active" ? "That card isn't waiting for a decision now." : "That card isn't waiting any more.", open: href } };
+                const decider = deciderOf(waiting.stage, waiting.flow);
+                if (decider !== null && decider !== ctx.who.name)
+                    return { ok: true, body: { offered: false, why: `Only ${decider} decides here.`, open: href } };
+                if (!pairedHere || !paired)
+                    return { ok: true, body: { offered: false, why: pairedHere ? "Your chat isn't paired for decisions." : "Buttons go to your paired chat; here, approve it on the card.", open: href } };
+                ctx.store.enqueueNotification({ dedupeKey: `flow-decide:${card.id}:${card.entry}:ask:${stamp}`, kind: "flow-decision", pushClass: "attention", recipient: ctx.who.name,
+                    subject: `${flow.name}: ${card.title} needs your decision`.slice(0, 200), body: `${waiting.stage.title}: approve it, or send it back with a note.`, link: href, source: { project: flow.repo } }, ctx.now);
+                return { ok: true, body: { offered: true, item: `flow card ${card.id}`, shown: "Approve and Send back buttons follow your reply in this chat; the owner's tap decides it" } };
+            }
+            const task = taskIdOf(args);
+            if (task === null || admittedRef(ctx, task) === null)
+                return notFound();
+            const current = ctx.store.taskFamilyOf(task, ctx.who.repos, false)?.current.id ?? task;
+            const plan = planInChat(ctx.store, current, ctx.who.name, ctx.now, ctx.evidenceRoot);
+            if (!plan.ok)
+                return { ok: true, body: { offered: false, task: current, why: plan.why, control: "approval" } };
+            if (!pairedHere || !paired)
+                return { ok: true, body: { offered: false, task: current, why: pairedHere ? "Your chat isn't paired for decisions." : "Buttons go to your paired chat; here, approve it on its card.", control: "approval" } };
+            ctx.store.enqueueNotification({ dedupeKey: `plan-ready:${current}:ask:${stamp}`, kind: "plan-ready", recipient: ctx.who.name, subject: `${current}: plan ready for review`,
+                body: "Approve it here, or open it to edit first.", source: { taskRef: ctx.store.lookupRef(current).id } }, ctx.now);
+            return { ok: true, body: { offered: true, item: `plan for ${current}`, task: current, shown: "Approve & start follows your reply in this chat; the owner's two taps approve it" } };
+        },
+    },
     get_result: {
         description: "Read exact execution/run and feedback. Use get_task currentExecution; page nextFeedbackOffset.",
         handle: (ctx, args) => {

package/dist/operate.js

@@ -204,6 +204,7 @@ import { readPulls } from "./pulls.js";
 import { startMaintenance } from "./maintenance.js";
 import { livePin, modelWatchPass } from "./model-catalog.js";
 import { runModelsCommand } from "./models-cli.js";
+import { ALL_PROJECTS, chatApprovalSettings, chatApprovalWords, setChatApproval } from "./chat-approval.js";
 import { updateAdmissionPaused, UPDATE_PAUSED } from "./desktop-update-gate.js";
 import { beads } from "./beads.js";
 import { githubIssues } from "./issues.js";
@@ -470,6 +471,8 @@ Flows — processes cards move through; the console's rules
   toolroll flows script save --repo <path> --name <name> (--file <path in project> | --body <file>)
       --about "<one line>" [--language shell|python|node] [--timeout-minutes <n>]
   toolroll flows card add <id> --title <t> [--description <d>] [--zone <zone>]
+  toolroll flows card approve <id> <card> [--option <words|number>]
+  toolroll flows card send-back <id> <card> --note <text>
   toolroll flows archive <id>
       writes take --as <you> --token <t> (or the remembered login); create,
       edit, archive and trigger add preview until --yes
@@ -639,7 +642,7 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "max", "cap", "probe", "kind", "expires", "cmd", "since", "repair-model",
     "choose", "note", "max-open-decisions", "max-held-sessions", "name", "days", "publication", "auto-approve", "review-auto", "entries", "port", "host", "allow-host",
     "for", "tick-every", "bridge-every", "reconcile-every", "incarnation",
-    "say", "ceiling-usd",
+    "say", "ceiling-usd", "cap-usd",
     "token-file", "bin", "poll", "github", "remote", "head-prefix", "password",
     // v102: project rules.
     "not-requester", "protect", "protect-paths",
@@ -658,7 +661,7 @@ export const OPERATE_VALUE_FLAGS = new Set([
     // onboard: the starter flows to switch on.
     "starter",
     // flows: templates, steps, scripts and cards.
-    "template", "steps", "about", "language", "timeout-minutes", "body", "description", "zone",
+    "template", "steps", "about", "language", "timeout-minutes", "body", "description", "zone", "option",
     "token-env", "after", "repair-max-attempts", "consumer", "batch", "feedback", "source", "view", "cursor", "why", "supersedes", "decision", "sessions", "timeout",
     // pings follow responsibility: replacements.
     "replaced-by", "replaces",
@@ -671,7 +674,7 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "json", "yes", "all", "brief", "local", "history", "latest-watch", "dry-run", "file", "allow-paid-fallback",
     "clear", "follow", "ready", "all-tasks", "inbound-only", "help", "undo", "anyone", "allow-dispatch", "allow-merge", "merge-delete-branch",
     "no-open", "remove", "no-verify", "no-follow", "end", "report", "off", "tmux",
-    "self-heal", "plan-auto", "chat-approve", "repair-auto", "review-retry-auto", "no-local",
+    "self-heal", "plan-auto", "chat-approve", "full-access", "repair-auto", "review-retry-auto", "no-local",
     "html", "csv", "alerts-only",
     // v105: the full export.
     "zip",
@@ -1088,6 +1091,8 @@ async function dispatch(command, positional, flags, context) {
             return proposalsCommand(positional, flags, context);
         case "mode":
             return modeCommand(positional, flags, context);
+        case "chat-approval":
+            return chatApprovalCommand(positional, flags, context);
         case "people":
             return peopleCommand(positional, flags, context);
         case "keys":
@@ -5755,6 +5760,51 @@ async function peopleCommand(positional, flags, context) {
     ]);
 }
 const MODE_ACTIONS = ["set", "show", "revoke"];
+/** `chat-approval show | on | off [--repo <path>]`: the person's lasting choice to approve plans and merges from their
+ * paired chat (chat-approval.ts), for all their projects or one. On (or wider limits) previews until --yes and takes
+ * the password, like Settings; off is one step. Either way a ledger line. */
+async function chatApprovalCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const action = positional[0] ?? "show";
+    const command = `chat-approval ${action}`;
+    if (!["show", "on", "off"].includes(action))
+        return fail(write, json, "chat-approval", "usage", "Use chat-approval show | on | off [--repo <path>] [--full-access] [--cap-usd <n>] [--yes].", EXIT.usage);
+    const acting = await askCredentials(flags, context);
+    if (acting === null)
+        return fail(write, json, command, "unauthenticated", "Approving from chat is your own setting: pass --as <you> --token <your password> (or sign in once with toolroll up).", EXIT.refused);
+    const authed = authenticateApprover(store, acting.name, acting.token);
+    if (!authed.ok)
+        return fail(write, json, command, "unauthenticated", "That name and password aren't an approver's. Nothing was changed.", EXIT.refused);
+    const given = text(flags, "repo");
+    const scope = given === undefined ? ALL_PROJECTS : canonicalProject(given) ?? resolve(given);
+    if (scope !== ALL_PROJECTS && !store.accountCanAccess(acting.name, scope))
+        return fail(write, json, command, "unknown-project", "That isn't one of your projects.", EXIT.refused);
+    const where = scope === ALL_PROJECTS ? "all your projects" : projectName(scope);
+    if (action === "show") {
+        const rows = chatApprovalSettings(store, acting.name).map(one => ({ scope: one.scope === ALL_PROJECTS ? "all" : one.scope, enabled: one.enabled, fullAccess: one.fullAccess, capMicrousd: one.capMicrousd, updatedAt: one.updatedAt }));
+        return succeed(write, json, command, { settings: rows }, () => rows.length === 0 ? ["Approving from chat is off everywhere. Turn it on: toolroll chat-approval on [--repo <path>]"]
+            : rows.map(one => `${one.scope === "all" ? "All projects" : projectName(one.scope)}: ${one.enabled ? `on · ${chatApprovalWords(one)}` : "off"}`));
+    }
+    const now = clock();
+    if (action === "off") {
+        const saved = setChatApproval(store, { approver: acting.name, scope, enabled: false, via: "the command line" }, now);
+        return saved.ok ? succeed(write, json, command, { applied: true, scope: scope === ALL_PROJECTS ? "all" : scope }, () => [saved.said]) : fail(write, json, command, "refused", saved.message, EXIT.refused);
+    }
+    const usd = text(flags, "cap-usd");
+    const cap = usd === undefined ? null : Number(usd);
+    if (cap !== null && !(Number.isFinite(cap) && cap >= 0 && cap <= 10_000))
+        return fail(write, json, command, "usage", "Give --cap-usd in dollars, like 5.", EXIT.usage);
+    const limits = { fullAccess: flag(flags, "full-access"), capMicrousd: cap === null ? null : Math.round(cap * 1_000_000) };
+    const terms = [
+        `Your own taps in your paired chat approve plans and merges in ${where}, until you turn it off: it doesn't expire.`,
+        `Limits: ${chatApprovalWords(limits)}.`,
+        "Plans written for you, protected paths, two-person rules and your organisation's policy still open in Toolroll.",
+    ];
+    if (!flag(flags, "yes"))
+        return succeed(write, json, command, { applied: false, scope: scope === ALL_PROJECTS ? "all" : scope, terms }, () => [`Turn on approving from chat for ${where}`, ...terms.map(one => `  ${one}`), "", "Nothing has changed. Add --yes to make this change."]);
+    const saved = setChatApproval(store, { approver: acting.name, scope, enabled: true, limits, via: "the command line" }, now);
+    return saved.ok ? succeed(write, json, command, { applied: true, scope: scope === ALL_PROJECTS ? "all" : scope, terms }, () => [saved.said]) : fail(write, json, command, "refused", saved.message, EXIT.refused);
+}
 async function modeCommand(positional, flags, context) {
     const { store, write, json, clock } = context;
     const [action] = positional;

package/dist/process-recovery-eligibility.d.ts

@@ -50,7 +50,7 @@ export declare function preparedCandidateObserverGapEligibility(store: Store, in
             digest: string;
             approvedAt: string;
             approvedBy: string;
-            approvalBasis: "mode" | "password";
+            approvalBasis: "chat" | "mode" | "password";
             modeDigest: string | null;
         };
         readonly command: {

package/dist/scope.d.ts

@@ -263,8 +263,10 @@ export type Scope = SavedScopeTerms & {
     /** The digest that was actually agreed to, which may now be stale. */
     approvedDigest: string | null;
     /** How the approval happened (v29): 'password' = the ceremony;
-     * 'mode' = sealed by the signer's live mode (modeDigest names it). */
-    approvalBasis?: "password" | "mode" | null;
+     * 'mode' = sealed by the signer's live mode (modeDigest names it);
+     * 'chat' = the owner's own two taps in their paired chat, under their chat-approval setting or a signed term
+     * (modeDigest names that authority; the yes is the person's and doesn't lapse with it). */
+    approvalBasis?: "password" | "mode" | "chat" | null;
     modeDigest?: string | null;
     /** v24 (optional so hand-built scopes in tests stay valid): the working
      * execution profile, its resolution state, and the immutable snapshot

package/dist/serve.js

@@ -154,6 +154,7 @@ import { MODELS_CSS, modelsHtml, modelsScript } from "./models-ui.js";
 import { ASSISTANTS, modelChoices, detectPreparation, previewProjectInstructions, addProjectInstructions } from "./setup-guide.js";
 import { previewSetup, approveSetup } from "./control-setup.js";
 import { controlSetupHtml, setupPreviewHtml, connectionHtml, connectionWords, hiddenFields } from "./control-ui.js";
+import { ALL_PROJECTS as CHAT_APPROVAL_ALL, chatApprovalWords, setChatApproval } from "./chat-approval.js";
 import { composerSchedule, scheduleEditorHtml, scheduleEditorScript } from "./task-composer.js";
 import { listCoordinators } from "./coordinator.js";
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
@@ -1721,7 +1722,7 @@ export function createDecisionServer(options) {
             const ref = run === null ? null : store.refForId(run.taskRef);
             return { repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId, action: `${resource[1] === "d" ? "decision" : resource[1] === "i" ? "incident" : "run"} ${resource[3] ?? "view"}` };
         }
-        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke"]);
+        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
         const placed = ["/tasks/add", "/routines/add"].includes(url.pathname) ? body?.get("repo")?.trim() : null;
         return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
@@ -1749,6 +1750,9 @@ export function createDecisionServer(options) {
         if ((request.method === "GET" && path === "/settings/telegram") ||
             (request.method === "POST" && ["/settings/telegram/pair", "/settings/telegram/unpair", "/settings/telegram/retry"].includes(path)))
             return true;
+        // A person's own chat-approval setting; the route proves each project it names.
+        if (request.method === "POST" && ["/settings/chat-approval/confirm", "/settings/chat-approval/save", "/settings/chat-approval/off"].includes(path))
+            return true;
         // Coding routes require an instance operator, then prove saved ownership and project access.
         if (path === "/code" || path.startsWith("/code/"))
             return true;
@@ -7287,7 +7291,7 @@ export function createDecisionServer(options) {
                 const note = (body.get("note") ?? "").trim() || null;
                 if (note !== null && note.length > LIMITS.note)
                     return answer(400, { ok: false, said: `Keep the note to ${LIMITS.note.toLocaleString("en-US")} characters; this is ${note.length.toLocaleString("en-US")}.` });
-                const decided = decideFlowCard(store, { card: target.id, decision, note, actor: who.name, repos: projects, evidenceRoot, draft: body.get("draft") }, now);
+                const decided = decideFlowCard(store, { card: target.id, decision, note, actor: who.name, repos: projects, evidenceRoot, draft: body.get("draft"), where: "the console" }, now);
                 return decided.ok ? settle(decided.said) : answer(409, { ok: false, said: decided.message });
             }
             if (verb === "choose") {
@@ -8287,6 +8291,51 @@ export function createDecisionServer(options) {
             store.retryTelegramReplies(who.name, now);
             return redirect(response, "/settings/telegram");
         }
+        // Approving from chat, as the person's lasting setting (chat-approval.ts): for all their projects or one. Turning it
+        // on or changing its limits is the mode's ceremony (the exact terms, a single-use nonce bound to them, the password
+        // typed again); turning it off is one step, csrf only. Every change is a ledger line.
+        if (url.pathname === "/settings/chat-approval/confirm" || url.pathname === "/settings/chat-approval/save" || url.pathname === "/settings/chat-approval/off") {
+            const body = readForm(posted, CONSOLE_FORMS.chatApproval);
+            if (who.via !== "cookie" || who.role !== "approver")
+                return refuse(response, who, 403, "An approver turns on approving from their own chat.", "/settings");
+            if (["scope", "full-access", "cap-usd", "nonce", "digest", "token"].some(key => body.getAll(key).length > 1))
+                return refuse(response, who, 400, "Submit one value for each field.", "/settings");
+            const given = (body.get("scope") ?? "all").trim();
+            const scope = given === "all" || given === "" ? CHAT_APPROVAL_ALL : canonicalProject(given) ?? given;
+            if (scope !== CHAT_APPROVAL_ALL && !(visible(scope) && store.accountCanAccess(who.name, scope)))
+                return refuse(response, who, 403, "That isn't one of your projects.", "/settings");
+            const where = scope === CHAT_APPROVAL_ALL ? "all your projects" : projectName(scope);
+            if (url.pathname.endsWith("/off")) {
+                const saved = setChatApproval(store, { approver: who.name, scope, enabled: false, via: "the console" }, now);
+                return saved.ok ? redirect(response, `/settings?said=${encodeURIComponent(saved.said)}`) : refuse(response, who, 400, saved.message, "/settings");
+            }
+            const usd = (body.get("cap-usd") ?? "").trim();
+            const cap = usd === "" ? null : Number(usd);
+            if (cap !== null && !(Number.isFinite(cap) && cap >= 0 && cap <= 10_000))
+                return refuse(response, who, 400, "Give the attempt limit in dollars, like 5.", "/settings");
+            const limits = { fullAccess: body.get("full-access") === "1", capMicrousd: cap === null ? null : Math.round(cap * 1_000_000) };
+            const digest = createHash("sha256").update(JSON.stringify({ scope, ...limits })).digest("hex");
+            if (url.pathname.endsWith("/confirm")) {
+                const nonce = mintApprovalNonce(who.name, "chat-approval", digest);
+                const html = `<h1 style="overflow-wrap:anywhere">Approve from chat in ${escape(where)}</h1>` +
+                    `<form method="post" action="/settings/chat-approval/save" class="card approve-form">` +
+                    hiddenFields({ csrf: who.session.csrf, nonce, digest, scope: scope === CHAT_APPROVAL_ALL ? "all" : scope, "full-access": limits.fullAccess ? "1" : "", "cap-usd": usd }) +
+                    `<p>Your own taps in your paired chat approve plans and merges until you turn this off. It doesn't expire.</p>` +
+                    `<p class="recap">Limits: ${escape(chatApprovalWords(limits))}.</p>` +
+                    `<p class="recap">Plans written for you, protected paths, two-person rules and your organisation's policy still open in Toolroll.</p>` +
+                    `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>` +
+                    `<div class="sticky-actions"><button type="submit">Turn on</button></div></form>` +
+                    `<p class="meta"><a href="/settings">Back</a></p>`;
+                return sendScreen(response, 200, screen("Approve from chat", html, { chrome: chromeFor(projectOf(who, request) ?? null, "settings") }));
+            }
+            if (!consumeApprovalNonce(body.get("nonce") ?? "", who.name, "chat-approval", body.get("digest") ?? "") || body.get("digest") !== digest)
+                return refuse(response, who, 409, "That form is stale. Read the terms again.", "/settings");
+            const proved = authenticateAccount(store, who.name, body.get("token") ?? "");
+            if (!proved.ok || proved.role !== "approver" || proved.generation !== who.session.generation)
+                return refuse(response, who, 403, "Turning on approving from chat takes your password, typed again.", "/settings");
+            const saved = setChatApproval(store, { approver: who.name, scope, enabled: true, limits, via: "the console" }, now);
+            return saved.ok ? redirect(response, `/settings?said=${encodeURIComponent(saved.said)}`) : refuse(response, who, 400, saved.message, "/settings");
+        }
         if (url.pathname === "/settings/telegram/pair" || url.pathname === "/settings/telegram/unpair") {
             const body = readForm(posted, CONSOLE_FORMS.telegramPair);
             // The person's own pairing, under their password: a code minted for

package/dist/store.d.ts

@@ -65,6 +65,13 @@ export declare const MATE_ASK_SCHEMA = "\nCREATE TABLE IF NOT EXISTS mate_ask (\
  * per option for one visit of one card, placed on the message it rides. A reply to that message is the note
  * (telegram_flow_prompt, mode send-back). The chat apps keep their buttons beside their messages (chat-delivery-state.ts). */
 export declare const FLOW_SEND_SCHEMA = "\nCREATE TABLE IF NOT EXISTS flow_send (\n  card         INTEGER NOT NULL REFERENCES flow_card(id),\n  entry        INTEGER NOT NULL,\n  stage        TEXT NOT NULL,\n  person       TEXT NOT NULL,\n  content_json TEXT NOT NULL,\n  created_at   TEXT NOT NULL,\n  PRIMARY KEY (card, entry)\n);\nCREATE TABLE IF NOT EXISTS telegram_flow_choice (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL REFERENCES telegram_binding(id) ON DELETE RESTRICT,\n  card        INTEGER NOT NULL REFERENCES flow_card(id),\n  entry       INTEGER NOT NULL,\n  choice      INTEGER NOT NULL,\n  label       TEXT NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_choice_visit ON telegram_flow_choice (card, entry);\n";
+/** An owner's lasting choice to approve plans and merges from their paired chat (chat-approval.ts), for all their
+ * projects (scope '*') or one (its path), with the limits they agreed to. Off unless a row says on; a project's own row
+ * outranks the all-projects one. `generation` is the account's at the change: a reset password ends it. */
+export declare const CHAT_APPROVAL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_approval_setting (\n  approver             TEXT NOT NULL,\n  scope                TEXT NOT NULL,\n  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),\n  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),\n  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),\n  generation           INTEGER NOT NULL,\n  digest               TEXT NOT NULL,\n  updated_by           TEXT NOT NULL,\n  updated_at           TEXT NOT NULL,\n  PRIMARY KEY (approver, scope)\n);\n";
+/** The second tap on a flow decision in Telegram (telegram-flow.ts): Approve arms Yes and Cancel, bound to the binding,
+ * chat, message and exact visit of the card; Yes decides it once. */
+export declare const TELEGRAM_FLOW_CONFIRM_SCHEMA = "\nCREATE TABLE IF NOT EXISTS telegram_flow_confirm (\n  token       TEXT PRIMARY KEY,\n  binding     INTEGER NOT NULL,\n  chat_id     TEXT NOT NULL,\n  message_id  TEXT NOT NULL,\n  card        INTEGER NOT NULL,\n  entry       INTEGER NOT NULL,\n  phase       TEXT NOT NULL CHECK (phase IN ('yes','cancel')),\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS telegram_flow_confirm_visit ON telegram_flow_confirm (card, entry);\n";
 export declare const CHAT_DECIDE_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_decide_action (\n  token       TEXT PRIMARY KEY,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  message     TEXT,\n  act         TEXT NOT NULL CHECK (act IN ('accept','changes','retry','approve','not-now','merge')),\n  phase       TEXT NOT NULL CHECK (phase IN ('offer','yes','cancel')),\n  task_id     TEXT NOT NULL,\n  run         INTEGER,\n  digest      TEXT NOT NULL,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_action_message ON chat_decide_action (channel, chat, message);\nCREATE TABLE IF NOT EXISTS chat_decide_prompt (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  channel     TEXT NOT NULL,\n  binding     INTEGER NOT NULL,\n  chat        TEXT NOT NULL,\n  task_id     TEXT NOT NULL,\n  run         INTEGER NOT NULL,\n  digest      TEXT NOT NULL,\n  message     TEXT,\n  created_at  TEXT NOT NULL,\n  expires_at  TEXT NOT NULL,\n  consumed_at TEXT\n);\nCREATE INDEX IF NOT EXISTS chat_decide_prompt_open ON chat_decide_prompt (channel, binding, consumed_at);\n";
 export type MateAsk = {
     turn: number;
@@ -2274,7 +2281,7 @@ export declare class Store {
      * exactly what the signed digest was bound to. Returns false when the
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
-        kind: "mode";
+        kind: "mode" | "chat";
         modeDigest: string;
     }, approverKind?: ApproverKind): boolean;
     /** Whether this task's scope carries a LIVE seal: approved, and the

package/dist/store.js

@@ -354,6 +354,40 @@ CREATE TABLE IF NOT EXISTS telegram_flow_choice (
 );
 CREATE INDEX IF NOT EXISTS telegram_flow_choice_visit ON telegram_flow_choice (card, entry);
 `;
+/** An owner's lasting choice to approve plans and merges from their paired chat (chat-approval.ts), for all their
+ * projects (scope '*') or one (its path), with the limits they agreed to. Off unless a row says on; a project's own row
+ * outranks the all-projects one. `generation` is the account's at the change: a reset password ends it. */
+export const CHAT_APPROVAL_SCHEMA = `
+CREATE TABLE IF NOT EXISTS chat_approval_setting (
+  approver             TEXT NOT NULL,
+  scope                TEXT NOT NULL,
+  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),
+  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),
+  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),
+  generation           INTEGER NOT NULL,
+  digest               TEXT NOT NULL,
+  updated_by           TEXT NOT NULL,
+  updated_at           TEXT NOT NULL,
+  PRIMARY KEY (approver, scope)
+);
+`;
+/** The second tap on a flow decision in Telegram (telegram-flow.ts): Approve arms Yes and Cancel, bound to the binding,
+ * chat, message and exact visit of the card; Yes decides it once. */
+export const TELEGRAM_FLOW_CONFIRM_SCHEMA = `
+CREATE TABLE IF NOT EXISTS telegram_flow_confirm (
+  token       TEXT PRIMARY KEY,
+  binding     INTEGER NOT NULL,
+  chat_id     TEXT NOT NULL,
+  message_id  TEXT NOT NULL,
+  card        INTEGER NOT NULL,
+  entry       INTEGER NOT NULL,
+  phase       TEXT NOT NULL CHECK (phase IN ('yes','cancel')),
+  created_at  TEXT NOT NULL,
+  expires_at  TEXT NOT NULL,
+  consumed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS telegram_flow_confirm_visit ON telegram_flow_confirm (card, entry);
+`;
 export const CHAT_DECIDE_SCHEMA = `
 CREATE TABLE IF NOT EXISTS chat_decide_action (
   token       TEXT PRIMARY KEY,
@@ -3964,6 +3998,9 @@ function initializeStore(db, file) {
     db.exec(MATE_ASK_SCHEMA);
     // Decisions in the chat app (no version bump: additive only): result, plan and merge buttons, and Request changes.
     db.exec(CHAT_DECIDE_SCHEMA);
+    // An owner's lasting chat-approval setting (no version bump: additive only; absent means off).
+    db.exec(CHAT_APPROVAL_SCHEMA);
+    db.exec(TELEGRAM_FLOW_CONFIRM_SCHEMA);
     // A flow's "Send to me" and "Person chooses" zones (no version bump: additive only).
     db.exec(FLOW_SEND_SCHEMA);
     db.exec(SPEND_SCHEMA);
@@ -8797,7 +8834,7 @@ export class Store {
                 // (setup review): the approval is what was stale, and it is new.
                 const ref = this.db.prepare("SELECT id FROM task_ref WHERE backend = ? AND external_id = ?").get(BUILT_IN, taskId);
                 if (ref !== undefined) {
-                    if (basis === undefined)
+                    if (basis === undefined || basis.kind === "chat")
                         this.noteTaskAct(Number(ref["id"]), "approved", now);
                     this.db.prepare("DELETE FROM hold WHERE owner_kind = 'backoff' AND owner_id = ?").run(`stale:${Number(ref["id"])}`);
                     this.db
@@ -8813,7 +8850,9 @@ export class Store {
                             subject: "Scope approved",
                             body: basis === undefined
                                 ? `Approved by ${currentActor()?.lead === true ? "the lead" : lifecycleWords(by, 40)}. A connected worker can take it next.`
-                                : "Approved automatically under the operating mode. A connected worker can take it next.",
+                                : basis.kind === "chat"
+                                    ? `Approved by ${lifecycleWords(by, 40)} in chat. A connected worker can take it next.`
+                                    : "Approved automatically under the operating mode. A connected worker can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
                     }
@@ -18513,6 +18552,7 @@ export class Store {
         const stamp = now.toISOString();
         this.db.prepare("UPDATE telegram_flow_action SET consumed_at = ? WHERE card = ? AND entry = ? AND consumed_at IS NULL").run(stamp, card, entry);
         this.db.prepare("UPDATE telegram_flow_prompt SET consumed_at = ? WHERE card = ? AND entry = ? AND consumed_at IS NULL").run(stamp, card, entry);
+        this.db.prepare("UPDATE telegram_flow_confirm SET consumed_at = ? WHERE card = ? AND entry = ? AND consumed_at IS NULL").run(stamp, card, entry);
     }
     recordTelegramFlowPrompt(prompt, now, hours = 24) {
         this.db.prepare("INSERT OR REPLACE INTO telegram_flow_prompt (chat_id, message_id, binding, card, entry, mode, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)")

package/dist/surface.js

@@ -125,7 +125,7 @@ const GUIDE_ROWS = [
     ...MEMORY_DESCRIPTORS.map(spec => ({ invocation: `memory ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text, a decision id, or the decision sentence" }] } : {}) })),
     // Flow writes carry an approver's credential: an agent runs them only as the person asked, after showing the preview.
     ...FLOWS_DESCRIPTORS.map(spec => ({ invocation: `flows ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags,
-        ...("positionals" in spec ? { positionals: spec.positionals.map(name => ({ name, required: true, meaning: name === "flow" ? "a flow id from flows list" : "a trigger id from flows show, or for trigger add its settings as JSON, a JSON file, or -" })) } : {}) })),
+        ...("positionals" in spec ? { positionals: spec.positionals.map(name => ({ name, required: true, meaning: name === "flow" ? "a flow id from flows list" : name === "card" ? "a card id from flows show" : "a trigger id from flows show, or for trigger add its settings as JSON, a JSON file, or -" })) } : {}) })),
     ...MODELS_DESCRIPTORS.map(spec => ({ invocation: `models ${spec.action}`, synopsis: spec.synopsis, audience: "agent", agentMayInvoke: true, mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "target", required: true, meaning: "the CLI to update, or on/off" }] } : {}) })),
     // ---- the queue (agent surface) ----
     { invocation: "status", synopsis: "running work, queued reasons, results to review, the latest release check and plan windows", audience: "agent", agentMayInvoke: true, mutation: "none", flags: [jsonFlag, dbFlag] },
@@ -384,6 +384,9 @@ const GUIDE_ROWS = [
     operatorRead("review show", "whether a project's finished builds get one automatic review"),
     operator("review on", "one automatic review of each finished build whose check passes; only HIGH findings send it back, once"),
     operator("review off", "finished builds go straight to the person, unreviewed"),
+    operatorRead("chat-approval show", "whether your own taps in your paired chat approve plans and merges: all projects and each project's own setting"),
+    operator("chat-approval on", "let your paired chat approve plans and merges in all your projects or one (--repo); lasting, with limits; previews until --yes"),
+    operator("chat-approval off", "stop approving from chat for all your projects or one (--repo); one step"),
     operator("mode revoke", "revoke a repository's mode — one click, every act it covered falls back to its own ceremony"),
     operator("config set", "set phase or spend configuration"),
     operator("config clear", "clear phase or spend configuration"),

package/dist/teammate-work.js

@@ -206,7 +206,7 @@ function carryOut(store, flow, definition, stage, card, mate, context, answer, n
     if (answer.action === "approve" || answer.action === "send_back") {
         const draft = draftFor(definition, stage);
         const decided = decideFlowCard(store, {
-            card: card.id, decision: answer.action === "approve" ? "approve" : "send-back", note: answer.action === "approve" ? answer.reason || null : note(answer.note), actor, repos, teammate: mate.handle, entry: card.entry,
+            card: card.id, decision: answer.action === "approve" ? "approve" : "send-back", note: answer.action === "approve" ? answer.reason || null : note(answer.note), actor, repos, teammate: mate.handle, entry: card.entry, where: "a teammate",
             ...(answer.action === "approve" && draft !== null && answer.text !== "" ? { draft: wholeDraft(answer.text) } : {}),
             ...(io.evidenceRoot === undefined ? {} : { evidenceRoot: io.evidenceRoot }),
         }, now);

package/dist/telegram-flow.d.ts

@@ -2,6 +2,7 @@ import { type FlowChoiceVisit, type FlowSendContent } from "./flow-send.js";
 import { type FlowStage } from "./flows.js";
 import { type InlineButton } from "./telegram-mate.js";
 import type { FlowCardRow, FlowRow, Store, TelegramBinding, TelegramFlowAction, TelegramFlowChoice, TelegramFlowPrompt } from "./store.js";
+/** A flow decision's notice: one per visit, and again (`:ask:<ms>`) when the owner asks the lead to approve it. */
 export declare const FLOW_DECIDE_KEY: RegExp;
 type Waiting = {
     card: FlowCardRow;
@@ -41,21 +42,60 @@ export declare function applyFlowChoiceTap(store: Store, binding: TelegramBindin
 export type FlowTapEffect = {
     kind: "ack";
     text: string;
-} | {
+}
+/** The message repainted; `keyboard` (absent: none) replaces its buttons, and links are paths under the console. */
+ | {
     kind: "edit";
     text: string;
+    keyboard?: FlowKeyboard;
+    place?: string[];
 } | {
     kind: "prompt";
     text: string;
     placeholder: string;
     prompt: Omit<TelegramFlowPrompt, "messageId">;
 };
+/** A repainted message's buttons: a token, or a link to a console path. `place` names fresh flow buttons to stamp on the message. */
+export type FlowKeyboard = Array<Array<{
+    label: string;
+    token: string;
+} | {
+    label: string;
+    link: {
+        label: string;
+        path: string;
+    };
+}>>;
+/** Where a card is now, for a message whose buttons no longer act: named and linked only when it is in one of the
+ * viewer's projects, and linked only while it still waits on someone. Never a live button. */
+export declare function flowWhereNow(store: Store, cardId: number, repos: readonly string[] | null): {
+    said: string;
+    keyboard: FlowKeyboard;
+};
 /** A tapped flow button, applied inside the update's transaction. */
 export declare function applyFlowTap(store: Store, binding: TelegramBinding, action: TelegramFlowAction, message: {
     chatId: string;
     messageId: string;
     text: string;
 }, repos: readonly string[] | null, now: Date): FlowTapEffect[];
+export type FlowConfirm = {
+    token: string;
+    binding: number;
+    chatId: string;
+    messageId: string;
+    card: number;
+    entry: number;
+    phase: "yes" | "cancel";
+    expiresAt: string;
+    consumedAt: string | null;
+};
+/** A Yes or Cancel this module armed, or null when the token isn't one. */
+export declare function flowConfirmOf(store: Store, token: string): FlowConfirm | null;
+/** The second tap, inside the update's transaction: Yes decides the card through the console's door, once; Cancel puts
+ * the card's own buttons back. The caller has proved the binding, chat and message are the ones it was armed on. */
+export declare function applyFlowConfirm(store: Store, binding: TelegramBinding, confirm: FlowConfirm, message: {
+    text: string;
+}, repos: readonly string[] | null, now: Date): FlowTapEffect[];
 export type FlowReplyEffect = {
     kind: "say";
     text: string;