toolroll 0.9.48 → 0.9.50

package/dist/serve.d.ts

@@ -1,606 +1,3 @@
-import { type BrowserWorkspace, type BrowserNeedAction, type BrowserSignIn, type BrowserUpdateNotice, type BrowserSettingsGroup } from './browser-workspace.js';
-import { CodingWorkspace } from './coding-workspace.js';
-import { type FetchLike } from "./flow-share.js";
-import { type MailSender } from "./flow-actions.js";
-import { type TriggerIo } from "./flow-triggers.js";
-import { type CliHttpOptions, type RunOperateAs } from './cli-http.js';
-import { type AssignmentSnapshot } from './assignment.js';
-import type { PublishExec } from './publish.js';
-import { type TaskStatus } from './task-status.js';
-import { type VersionRunner } from "./model-catalog.js";
-import { type Server } from "node:http";
-import { type ProofVerdict, type CriterionMatrixRow } from "./proof.js";
-import { type Decision, type Run, type Store, type TaskState } from "./store.js";
-import { previewGithubRepo, cloneGithubRepo, listGithubRepos } from "./onboard.js";
-import { run as execRun } from "./exec.js";
-import { type FirstRunStep } from "./first-run.js";
-import { type Gap } from "./gaps.js";
-import { type AgentChoice } from "./agentconfig.js";
-import { type RouteProjection, type RouteOverride, type RouteStamp, type RiskLevel } from "./phase-routing.js";
-import { type Phase } from "./provider.js";
-import { type IntegrationIo } from "./integrations.js";
-import { launchRuntimeUpdate } from "./toolroll-update.js";
-import type { RepairChainRow } from "./store.js";
-import type { RevisionLineage } from "./store.js";
-import type { SubscriptionMateRunner } from "./subscription-chat.js";
-import { type InstallMethod } from "./install-method.js";
-export type ServeOptions = {
-    /** Tests: runs a person's command for the HTTP MCP gateway instead of operate.ts's. */
-    runOperateAs?: import("./mcp-person.js").RunOperateAs;
-    /** `toolroll demo`: the scripted lead that answers Chat instead of a model. */
-    demoLead?: import("./demo.js").DemoLead;
-    /** Tests: the bin whose real path says how Toolroll was installed (Settings → Updates' command). */
-    installBin?: string;
-    /** Native coding workspace injection for isolated integration tests. */
-    codingWorkspace?: CodingWorkspace;
-    /** Read-only worker connections for heavy reads (read-executor.ts); 0 reads in-process. Default: off under tests. */
-    readWorkers?: number;
-    store: Store;
-    evidenceRoot: string;
-    clock?: () => Date;
-    /**
-     * The console's canonical https origin, when TLS terminates in front
-     * (arc 3 finding 2/16): EXACTLY an origin — no path, query, credentials.
-     * The one trust anchor for secure-context features: it joins the allowed
-     * hosts, its origin authorizes POSTs, cookies turn Secure, and the
-     * install/push cards light up. X-Forwarded-* is consulted only from a
-     * loopback peer, the same-host proxy (public-access.ts).
-     */
-    publicUrl?: string;
-    /** Tests: the shared command boundary `POST /api/cli` runs (default: operate.ts's runOperateAs). */
-    cliRunner?: RunOperateAs;
-    /** Tests: remote command metadata until the shared contract declares it. */
-    cliModeOf?: CliHttpOptions['modeOf'];
-    /** Tests: the clock request budgets for API tokens count by (request-budget.ts). */
-    requestBudgetClock?: () => number;
-    /** Where repos.json lives — every enrollment locks exactly this file. */
-    registryPath?: string;
-    /** This console fronts an `up` process: onboarding copy says how to watch. */
-    upConsole?: boolean;
-    /**
-     * The lead on by default (onboarding): with no lead set up, the agent CLI
-     * signed in on this computer runs it, once. `up` and `serve` turn this on;
-     * tests opt in.
-     */
-    leadByDefault?: boolean;
-    /** Test seam: the operating system the sign-in command is written for. */
-    platform?: NodeJS.Platform;
-    /** Extra Host values this server answers as (a Tailscale name, a LAN ip:port). */
-    allowedHosts?: readonly string[];
-    /**
-     * This computer's names on its tailnet (onboarding): read at start and every
-     * few minutes; the console answers to each on its own port without an
-     * --allow-host, and the phone card names the address. Absent = none.
-     */
-    tailnetNames?: () => Promise<readonly string[]>;
-    /**
-     * The first-account road (setup review): while NO approver exists, the
-     * login page offers "create the first account", gated by this code —
-     * printed once by the process that started the server, never stored.
-     * Five wrong codes close the road until the server restarts. The moment
-     * an approver exists, the page is the ordinary sign-in.
-     */
-    setupCode?: string;
-    /**
-     * Where the Telegram bot token lives when set from here. Present = the
-     * settings card renders; absent = no settings surface at all.
-     */
-    telegramTokenFile?: string;
-    /** Where messaging config files live (beside the database) — enables the
-     * primary-messenger selector on the settings screen. */
-    configDir?: string;
-    /** Test seam for the Slack setup handshake. */
-    slackFetcher?: typeof fetch;
-    /** Settings → Updates seams: the latest release, how this Toolroll was
-     * installed, its version, and how the updater job starts. Tests and
-     * screenshots inject these; production reads the registry and launchd. */
-    updates?: {
-        latest?: () => Promise<{
-            version: string;
-        }>;
-        method?: InstallMethod;
-        current?: string;
-        dist?: string;
-        launch?: typeof launchRuntimeUpdate;
-    };
-    discordFetcher?: typeof fetch;
-    /** Injected by tests: Microsoft sign-in, key metadata and Teams conversation calls. */
-    teamsFetcher?: typeof fetch;
-    /** Injected by tests: how "Check now" reaches GitHub (gh) and Linear (fetch). */
-    flowTriggerIo?: Partial<TriggerIo>;
-    /**
-     * The repo this console serves. Scopes run evidence to that repo's tasks
-     * (and unplaced ones) and turns on the gaps and capabilities views —
-     * without it those pages say so instead of guessing.
-     */
-    repo?: string;
-    /**
-     * The full authorization ceiling (v2 review, finding 1): `repos` this
-     * server may show and operate on, plus `projectRoots` under which any git
-     * repository qualifies. `repo` above is sugar for one entry in `repos`.
-     * No configuration at all is the legacy unscoped mode — everything
-     * visible, and stated as such where the code decides.
-     */
-    repos?: readonly string[];
-    projectRoots?: readonly string[];
-    /** Repositories the co-located `up` process has proved and is watching.
-     * Kept as a callback so projects added after startup appear immediately
-     * without turning the durable registry itself into an authorization source. */
-    currentRepos?: () => readonly string[];
-    /** Injected by tests: the fetch direct-API chat turns use, and where chat
-     * keys are read from (defaults to process.env). */
-    chatFetcher?: typeof fetch;
-    /** Subscription-backed mate transport; injected in tests so no real
-     * Codex or Claude membership turn is consumed. */
-    subscriptionChatRunner?: SubscriptionMateRunner;
-    /** Tests: stands in for `codex mcp list --json` in the project (the Tools page's "Found on this computer"). */
-    codexToolList?: (cwd: string) => Promise<string | null>;
-    /** Tests: the home whose ~/.toolroll (or older ~/.standing-orders) tool-secrets and ~/.claude.json the Tools page uses. */
-    toolHome?: string;
-    /** v87: sends Send email steps' mail and the settings test (tests inject one). */
-    mailSender?: MailSender;
-    /** Injected by tests: how Flows → Import fetches a flow file's address. */
-    flowFetch?: FetchLike;
-    /** v89: Google's token endpoint (tests inject a scripted one). */
-    googleFetch?: typeof fetch;
-    /** Tests: every request a one-click connection makes (discovery, registration, tokens). */
-    connectFetch?: typeof fetch;
-    /** Tests: every request sign-in with the identity provider makes (discovery, keys, tokens). */
-    ssoFetch?: typeof fetch;
-    chatEnv?: Record<string, string | undefined>;
-    /**
-     * The live peek's locality ASSERTION (live-peek v3 §3): the administrator
-     * who starts serve names the runner this machine owns. This is documented
-     * as an assertion, not machine-bound credential enforcement — the product
-     * has none anywhere. Absent = the peek is off, and says so.
-     */
-    desktopIdentity?: string;
-    /** Trusted native admission callback; enrollment rows alone never supply this authority. */
-    additionalProjectRepos?: () => readonly string[];
-    /** The co-located `up`'s exact admitted repositories, read on every request: its startup projects plus those
-     * added since (`repos add`, the lead, the console) and minus those removed. When given it replaces `repos` as
-     * the exact part of the ceiling, so an addition or removal shows without a restart. */
-    admittedRepos?: () => readonly string[];
-    connectionProbe?: typeof execRun;
-    connectionHome?: string;
-    /** Test seam for Chat's first tasks: the `gh` and `git grep` reads. */
-    firstTaskRunner?: typeof execRun;
-    /** Test seam for Settings → Integrations: how its checks reach services (fetch, gh, mail servers). */
-    integrationIo?: Partial<IntegrationIo>;
-    modelCatalogFetcher?: typeof fetch;
-    /** Test seams for Settings → Models: CLI version probes and the PATH they search. */
-    modelRunner?: VersionRunner;
-    modelPath?: string;
-    localRunner?: string;
-    /** The checkout pool root the peek confines itself to (realpath-proved). */
-    poolRoot?: string;
-    /**
-     * Editor deep links (arc 6): a DEPLOYMENT capability, not an activation.
-     * vscode:// links open on the BROWSER's machine, so links render only
-     * when three statements align: the operator started serve with
-     * --editor vscode AND --runner (this machine owns the worktrees), the
-     * run belongs to that runner, and THIS session turned links on for
-     * this device. "vscode" is the only value; the scheme is never data.
-     */
-    editorLinks?: "vscode";
-    /**
-     * The attended-mint capability (Phase 2E): present only on a co-located
-     * `up` console, which alone can hold a session. `headOf` reads the
-     * repository's CURRENT head — the exact commit the signed terms pin.
-     */
-    attended?: {
-        runner: string;
-        headOf: (repo: string) => Promise<string | null>;
-        coordinator?: import("./held.js").HeldSessionCoordinator;
-    };
-    /** Injected by tests: the onboarding ceremony's gh-facing halves — the
-     * ceremony's gating, nonce, and enrollment logic is what the HTTP tests
-     * prove; gh itself is proved by onboard.test.ts. */
-    ghPreview?: typeof previewGithubRepo;
-    ghClone?: typeof cloneGithubRepo;
-    ghList?: typeof listGithubRepos;
-    /** Injected by tests: the git and gh calls pull-request setup and Merge make. */
-    publishExec?: PublishExec;
-};
-/** Where `up`'s one-time sign-in link points, and how long it works. */
-export declare const SIGN_IN_LINK_PATH = "/login/once/";
-export declare const SIGN_IN_LINK_MS: number;
-/** The console's server, and the one-time sign-in link `up` opens: a path on this server, or null for no such approver.
- * closeCoding starts the coding shutdown on its own, ahead of the rest of a stop; close() awaits the same promise. */
-export type DecisionServer = Server & {
-    mintSignInLink(account: string): string | null;
-    closeCoding(): Promise<void>;
-};
-/** How long a stop waits for teammates and the lead's follow pass before closing anyway. */
-export declare const SHUTDOWN_WAIT_MS = 5000;
+import { type DecisionServer, type ServeOptions } from "./server/shared.js";
 export declare function createDecisionServer(options: ServeOptions): DecisionServer;
-/**
- * A vscode://file href, or null (arc 6, finding 2): the link exists only
- * when every part is provably tame — an absolute, control-free worktree;
- * a relative, single-line path whose segments contain no empty, dot,
- * dot-dot, or backslash components (so lexical resolution stays below the
- * worktree); a line inside the same 1..1,000,000 range the comment form
- * enforces. Encoding failures return null — a file row degrades to plain
- * text, never to a 500. The scheme is a constant, never data.
- */
-export declare function editorFileHref(worktree: string, path: string, line?: number | null): string | null;
-/** Earlier versions of a task still in flight, in plain words: queued
- * while they only wait, running once one has started; null when none. */
-export declare function earlierVersionsWords(active: number, running: number): string | null;
-/** The Agents view every console surface renders (v47): the SAME
- * projection the CLI prints — who plans, builds, and revises,
- * whether each was recommended, overridden, or pinned, its reasons, and
- * the readiness the task's runners have reported (ready / unavailable /
- * unknown — an unknown is said, never upgraded). Readiness is volatile and
- * never part of what an approval signs, so the ceremony shows the agents
- * and their reasons only. */
-export type RouteView = {
-    kind: "route" | "legacy" | "unreadable";
-    source: "approved" | "proposed" | "live" | null;
-    projection: RouteProjection | null;
-    /** A proven pre-routing row: its approved agent profile, nothing more. */
-    legacy: {
-        provider: string;
-        model: string;
-        repairModel: string;
-        approved: boolean;
-    } | null;
-    /** A routed row whose agents cannot be read — fail closed, in words. */
-    problem: string | null;
-    riskLevel: RiskLevel;
-    overrides: RouteOverride[];
-    /** An approver may edit: a live claim, a tournament, or a viewer session refuses. */
-    editable: boolean;
-    editableWhy: string | null;
-    /** A planner change after a draft landed asks for a real re-plan. */
-    replanOnPlanChange: boolean;
-    /** The scope digest the change forms CAS against; null = no scope yet. */
-    digest: string | null;
-    /** v48: the configured, role-valid agents an approver may choose from —
-     * every option an exact pair the operator named once in configuration.
-     * The form offers these and nothing else. */
-    choices: Record<Phase, AgentChoice[]>;
-};
-/** The page CSS this module writes itself (not the imported modules'), for the stylesheet contract tests. */
-export declare const PAGE_CSS: string;
-/** Everything the sidebar needs to draw itself for one request. */
-type Chrome = {
-    projectScoped?: boolean;
-    active: "code" | "inbox" | "board" | "queue" | "fleet" | "workbench" | "work" | "done" | "activity" | "review" | "system" | "tasks" | "runs" | "caps" | "routines" | "recipes" | "projects" | "flows" | "settings" | "chat" | "people" | "ledger" | "spend" | "mode" | "menu" | "none";
-    project: string | null;
-    /** The surface's scope for the scope bar — which rows this screen can
-     * show. Derived from the ROUTE, not the session: portfolio and fleet are
-     * all-project even while a project is open; the board says which of its
-     * two modes it is in. Absent = the session default (open project, else
-     * all projects). Display only — switching stays POST + CSRF. */
-    scope?: "all" | "project" | "board-all";
-    /** The saturated inbox count — never a sum of unbounded list reads. */
-    inboxCount: number;
-    /** The project the Tasks count covers: the request's own project view
-     * (the open project, or /work's ?project=), null for every admitted project. */
-    inboxProject?: string | null;
-    /** The Tasks badge's words, naming what it covers: "3 need you in shop". */
-    inboxLabel?: string;
-    inboxSaturated: boolean;
-    settings: boolean;
-    /** This database is a demo sandbox: banner every page, spend fenced. */
-    demo?: boolean;
-    /** The active operating mode's banner (M1): rides every page scoped to
-     * a repo with a live mode — a signed posture is never invisible. */
-    modeBanner?: {
-        words: string;
-        name: string;
-    };
-    /** Providers whose sign-in stopped working: every page says so, once. */
-    signIn?: BrowserSignIn[];
-    /** A newer Toolroll: a quiet notice for an operator until they dismiss this version. */
-    update?: BrowserUpdateNotice;
-    /** An update waiting on something, what, and the action that clears it: every page, for an operator. */
-    updateWaiting?: {
-        words: string;
-    };
-    /** The chat tab renders only where chat could ever be allowed. */
-    chat?: boolean;
-    code?: boolean;
-    /** A rendered list pane makes the page master-detail. */
-    listPane?: string;
-    /** A compact pulse for the currently open workspace. Null in the
-     * cross-workspace view; absent only when the store could not answer. */
-    projectPeek?: ProjectPeek | null;
-    /** The switcher (board pass): every enrolled project inside the ceiling,
-     * most recently opened first — the one-tap switch on any screen. */
-    projects?: {
-        path: string;
-        name: string;
-    }[];
-    /** The session's csrf token, for the switcher's forms; "" when the
-     * request has no cookie session (bearer), which renders the switcher
-     * inert. */
-    csrf?: string;
-    /** Where a switch made on this screen returns to. */
-    returnTo?: string;
-};
-/**
- * A page described, not yet rendered (arc 4): every chromed HTML route
- * returns one of these and ONE helper (sendScreen, inside the server)
- * owns the nonce, the palette index, the shortcuts overlay, script
- * composition, and the CSP. Renderers stopped calling shell() themselves
- * so those five things cannot drift apart per route.
- */
-type Screen = {
-    title: string;
-    body: string;
-    chrome?: Chrome;
-    /** The page's own executable behavior (a region poller, the push
-     * enrollment script). fetches: true when it calls fetch — connect-src
-     * is granted only then. */
-    functional?: {
-        script: string;
-        fetches?: boolean;
-    };
-    refreshSeconds?: number;
-    /** Render sensitive even when no password field is visible — one-time
-     * secrets and judgment calls the classifier cannot see. */
-    forceSensitive?: boolean;
-    /** Structured conversation; complex guarded forms stay native islands. */
-    workspace?: Partial<Pick<BrowserWorkspace, 'conversation' | 'team' | 'focus' | 'result' | 'catchUpHtml' | 'controlsHtml' | 'notices' | 'pageHtml' | 'view' | 'firstRun' | 'phone' | 'home'>>;
-};
-/**
- * The sensitivity classifier (arc 4, findings 3/17): a body showing a
- * password input renders WITHOUT the chrome additions (palette, overlay,
- * global keys) — the page's own functional script still ships. Tolerant
- * of quoting, casing, and whitespace; `data-type="password"` and prose
- * mentioning passwords do not match. This is defense-in-depth over a
- * file whose only HTML producer is its own double-quoted template
- * convention — forceSensitive is the escape hatch for what a regex
- * cannot judge.
- */
-export declare const SENSITIVE_INPUT: RegExp;
-/**
- * v100: for someone signed in with the identity provider, every step-up
- * password field (autocomplete="current-password"; a secret like a bot token
- * is never one) becomes that sign-in: confirmed, when the provider checked
- * them in the last ten minutes, or a link to be checked again, then back here.
- */
-export declare function ssoStepUps(html: string, sso: {
-    label: string;
-    fresh: boolean;
-}, returnTo: string): string;
-/**
- * The page for an address the console doesn't answer to (onboarding): what was opened, where it answers, and the exact
- * command that admits this address. It stands alone (styles inline, no script, no font), because every other asset
- * would be refused at this address too; and it holds nothing a stranger's page doesn't already know.
- */
-export declare function wrongHostPage(facts: {
-    opened: string | null;
-    served: string;
-    command: string | null;
-}): string;
-/**
- * The inbox (v3): only things stalling progress without a person, one card
- * per underlying stall, each with its verb inline or one step away. No
- * auto-refresh — approval links lead to the step-up screen, and a page
- * that might hold typed input never re-renders itself.
- */
-export type InboxTab = "needs-you" | "ready" | "running" | "all";
-export declare function parseInboxTab(raw: string | null): InboxTab | undefined;
-/** What each tab holds, as a short fingerprint: a tab is unread when its
- * fingerprint differs from the one this browser saw there last. */
-export declare function inboxFingerprints(data: Pick<Parameters<typeof inboxPage>[1], "decisions" | "approvals" | "requeueables" | "cancelledBlockers" | "gaps" | "needsVerification" | "ready" | "running">): Record<InboxTab, string>;
-declare function inboxPage(chrome: Chrome, data: {
-    csrf: string;
-    revision: number;
-    /** No project open in scoped mode: every admitted project at once,
-     * chips on every row, links only — acting means opening the project. */
-    rollup: boolean;
-    /** A project is OPEN: only then do decisions answer on the card. The
-     * legacy unscoped projectless inbox stays links-only too (commit-1
-     * review, finding 4) — the partial belongs to a chosen project. */
-    interactive: boolean;
-    decisions: (Decision & {
-        taskId: string;
-        repo?: string | null;
-    })[];
-    approvals: {
-        taskId: string;
-        title: string;
-        goal: string;
-        proposedAt: string;
-        repo?: string | null; /** v48 authority repair: the closed consent door's title, or null when a yes could bind. */
-        closed?: string | null;
-    }[];
-    requeueables: {
-        taskId: string;
-        title: string;
-        state: TaskState;
-        strikes: number;
-        incidentCount: number;
-        repo?: string | null;
-    }[];
-    cancelledBlockers: {
-        blockerId: string;
-        dependentCount: number;
-        exampleDependent: string;
-        repo?: string | null;
-        blockerRepo?: string | null;
-    }[];
-    gaps: Gap[];
-    /** A completed task whose proof is short or refuted and not yet accepted
-     * (Priority 2) — reads "needs verification" here too, never silently
-     * "done" just because the inbox does not otherwise look at finished work. */
-    needsVerification: {
-        taskId: string;
-        title: string;
-        verdict: "short" | "refuted";
-        repo?: string | null;
-        matrix?: CriterionMatrixRow[];
-        repairChain?: RepairChainRow | null;
-    }[];
-    /** The first-run steps; null once the installation has had its first Ready result. */
-    wizard: FirstRunStep[] | null;
-    /** Whether any worker is answering right now — said at the top when none is. */
-    worker: {
-        answering: number;
-        registered: number;
-        lastHeard: string | null;
-    };
-    now: Date;
-    /** Console v2: the tab shown, results ready to review, work running now,
-     * and the tabs holding something this browser hasn't seen (dots on a phone). */
-    tab?: InboxTab;
-    ready?: {
-        taskId: string;
-        title: string;
-        detail: string;
-        repo: string | null;
-    }[];
-    running?: {
-        taskId: string;
-        title: string;
-        detail: string;
-        repo: string | null;
-    }[];
-    unread?: readonly InboxTab[];
-}): Screen;
-/** The task composer's modes (console v2), as the words the lead reads for that one turn. */
-export type TaskComposerMode = "build" | "plan" | "answer";
-export declare const TASK_COMPOSER_MODES: Record<TaskComposerMode, string>;
-/**
- * The inline-answer enhancement (portfolio arc §2): submits a reversible
- * option's form as the urlencoded POST the forms-only gate expects, follows
- * the redirect, and — because an answered decision leaves the open list —
- * replaces ONLY that card with the answered receipt parsed from the
- * decision page's own rendering, or removes the card. Anything unexpected
- * (auth, a page that is not the decision's) navigates instead of inserting.
- * Nothing else on the page is touched: typed input elsewhere survives.
- */
-export declare function decisionAnswerScript(): string;
-type ProjectPeek = {
-    waiting: number;
-    queued: number;
-    running: number;
-    doneRecently: number;
-};
-/**
- * Creating work is the product's first verb, so it gets a whole calm page:
- * a title, the goal that becomes the scope draft, and the project it lands
- * in — then straight to the approve card, which is the aha the flow serves.
- */
-/** One queue card. Taken work renders pinned — visible, never draggable. */
-/**
- * The request's own session facts, readable from anywhere below the
- * dispatcher without threading them through forty call sites: the csrf
- * token the chrome's switcher forms carry, and the path a switch returns
- * to. AsyncLocalStorage follows the request's own async chain, so two
- * interleaved requests never read each other's token.
- */
-/** The person's pinned theme from their own cookie; null follows the device. */
-export declare function pinnedTheme(cookieHeader: string | undefined): "light" | "dark" | null;
-/** A request path fit for a log: the one-time sign-in link's code is left out. */
-export declare function redactedPath(path: string): string;
-/** The /queue page's one nonce'd script: delegated pointer-event drag (it
- * survives every fragment swap — finding 17) plus a poller that re-checks
- * focus, dirty inputs, and an in-flight drag AT SWAP TIME, never only
- * before the fetch. Select dirtiness compares against data-initial
- * (finding 18); missing that, a select counts clean.
- */
-export declare function queueScript(): string;
-/**
- * A revision's lineage and ACTUAL terms, in the same words on the task
- * page, the approval card, and chat (contract handoff task 2): which
- * source and build it revises, the ancestry to its root, the terms the
- * child really carries (read from its own scope — never restated from the
- * brief), what is re-resolved for THIS approval, what never inherits, and
- * — when the task continues a repair chain — the attempts used against
- * the signed cap.
- */
-export declare function revisionLineageWords(lineage: RevisionLineage): string[];
-/** Review priority: a deterministic, LABELED presentation aid over facts
- * the done list already carries. Band 0 goes first; the words name why.
- * It is never a verdict — the stored proof verdict stays the authority,
- * and an operator's acceptance lowers a band without touching it. */
-export type ReviewPriority = {
-    band: 0 | 1 | 2;
-    label: "needs action" | "review" | "no flags";
-    reasons: string[];
-};
-export type ReviewQueueFacts = {
-    /** Only an exact current task/run match carries the assignment status. */
-    assignment?: AssignmentSnapshot | null;
-    proofReasons?: readonly string[];
-    runId: number | null;
-    outcome: string | null;
-    proofVerdict: ProofVerdict | null;
-    proofAccepted: boolean;
-    proofMatrix: readonly CriterionMatrixRow[];
-    ciFailing: boolean;
-    publicationState: string | null;
-};
-export declare function reviewPriorityOf(row: ReviewQueueFacts): ReviewPriority;
-/** Ranked, stable: band first, then newest completion, then task id — the
- * same input always yields the same queue, whoever loads it. */
-export declare function rankReviewQueue<T extends ReviewQueueFacts & {
-    completedAt: string;
-    taskId: string;
-}>(rows: readonly T[]): (T & {
-    priority: ReviewPriority;
-})[];
-/** Whether a changed path sits inside the scope's signed "touches" — an
- * exact file, a directory prefix (with or without its slash), or a plain
- * `*` / `**` glob. Touches are advisory in the scope; here they only
- * decide which files wear the "outside the signed touches" flag. */
-export declare function withinSignedTouches(path: string, touches: readonly string[]): boolean;
-/** A stable, attribute-safe anchor for one file of the sealed patch —
- * derived from the path's bytes, never from the path's characters, so a
- * hostile file name can neither break the id nor escape the attribute. */
-export declare function diffFileAnchor(path: string): string;
-export type ReviewFileRow = {
-    path: string;
-    additions: number | null;
-    deletions: number | null;
-    renamedFrom: string | null;
-    anchor: string | null;
-    outsideTouches: boolean;
-    cited: boolean;
-};
-/** The changed-file list's own review priority: outside the signed
- * touches first, then files a machine cannot diff or a criterion never
- * cited, then the rest by churn. Presentation only — the sealed patch
- * keeps its own order beneath, byte for byte. */
-export declare function reviewFilePriority(file: ReviewFileRow, proofCitesPaths: boolean): ReviewPriority;
-export declare function orderChangedFiles(files: readonly ReviewFileRow[], proofCitesPaths: boolean): (ReviewFileRow & {
-    priority: ReviewPriority;
-})[];
-/** Older machine-checked results saved a mechanical sentence; say the same
- * facts in plain words (the version id stays, shortened). */
-export declare function plainConclusionOf(conclusion: string): string;
-/** A Needs you result's one action (needs-you.ts): a link to the act that resolves it, or Confirm it
- * stopped behind the password. Null under every other headline. */
-export declare function needActionOf(assignment: AssignmentSnapshot | null, status: TaskStatus | null, csrf: string, returnTo: string, result?: {
-    accepted: boolean;
-    humanReview: boolean;
-    run: number;
-    action: string;
-    rebuildable?: boolean;
-    refuted?: boolean;
-}): BrowserNeedAction | null;
-/** The facts region alone, for the open-run poll (A4). A finished run's
- * fragment says so instead of quietly growing forms (finding 5), and a run
- * that stopped being the task's live claim says so too — both carry the
- * stop marker, so an open tab quits refetching a dead build (round-4
- * finding 15). */
-export declare function runFactsFragment(run: Run, taskId: string, live: boolean, route?: RouteStamp | null): string;
-/** Settings destinations under short headings: an icon and a name each, and a chat app's logo and state. */
-export declare function settingsTiles(groups: BrowserSettingsGroup[]): string;
-/**
- * The settings groups, with each chat app's state from what the server already holds: not set up,
- * connected, or getting alerts (only when that service was chosen, or is the only one).
- * A Telegram bot whose saved delivery state reports a problem says so instead. With no config folder
- * the state is unknown, so the tiles carry none.
- */
-export declare function settingsGroups(messaging: {
-    channel: string | null;
-    implicit: boolean;
-    configured: string[];
-} | null, telegramFailing?: boolean): BrowserSettingsGroup[];
-export {};
+export { decisionAnswerScript, diffFileAnchor, earlierVersionsWords, editorFileHref, inboxFingerprints, needActionOf, orderChangedFiles, PAGE_CSS, parseInboxTab, pinnedTheme, plainConclusionOf, queueScript, rankReviewQueue, redactedPath, reviewFilePriority, reviewPriorityOf, revisionLineageWords, runFactsFragment, SENSITIVE_INPUT, settingsGroups, settingsTiles, SHUTDOWN_WAIT_MS, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_COMPOSER_MODES, withinSignedTouches, wrongHostPage, type DecisionServer, type InboxTab, type ReviewFileRow, type ReviewPriority, type ReviewQueueFacts, type RouteView, type ServeOptions, type TaskComposerMode } from "./server/shared.js";