toolroll 0.9.52 → 0.9.54

package/dist/liveness.d.ts

@@ -1,30 +0,0 @@
-/**
- * Attended-liveness semantics (Parity II Phase 1, S3) — the ONE definition
- * every attended feature consumes. A browser proves presence only by
- * RENEWING a heartbeat; absence is inferred only from renewal ceasing,
- * never from observing a tab close (which is not reliably observable).
- * Renewal can extend nothing past an absolute expiry and can never mint
- * or broaden authority — it only keeps an already-signed authorization
- * usable (strategy rulings 1c/12).
- *
- * The state contract, exact (spec finding 11/18):
- * - "expired" iff now >= absoluteExpiryAt — checked FIRST; renewal is
- *   irrelevant past the absolute wall.
- * - a null beat (never renewed) is "lapsed".
- * - a FUTURE beat is "lapsed": strict means strict — a clock that claims
- *   tomorrow proves nothing about presence now.
- * - "live"  iff now - lastBeatAt <= 20s (one 15s beat + 5s jitter).
- * - "grace" iff now - lastBeatAt <= 45s (one missed beat, forgiven —
- *   background-tab throttling survives grace, not live).
- * - otherwise "lapsed".
- *
- * Session COOKIE lifetimes (12h idle / 7d absolute in serve.ts) are a
- * different thing and are untouched by all of this.
- */
-export declare const BEAT_MS = 15000;
-/** live = one beat plus jitter. */
-export declare const LIVE_MS = 20000;
-/** grace = one whole missed beat beyond live, forgiven. */
-export declare const GRACE_MS = 45000;
-export type AttendedLiveness = "live" | "grace" | "lapsed" | "expired";
-export declare function attendedLivenessState(lastBeatAt: number | null, now: number, absoluteExpiryAt: number): AttendedLiveness;

package/dist/liveness.js

@@ -1,42 +0,0 @@
-/**
- * Attended-liveness semantics (Parity II Phase 1, S3) — the ONE definition
- * every attended feature consumes. A browser proves presence only by
- * RENEWING a heartbeat; absence is inferred only from renewal ceasing,
- * never from observing a tab close (which is not reliably observable).
- * Renewal can extend nothing past an absolute expiry and can never mint
- * or broaden authority — it only keeps an already-signed authorization
- * usable (strategy rulings 1c/12).
- *
- * The state contract, exact (spec finding 11/18):
- * - "expired" iff now >= absoluteExpiryAt — checked FIRST; renewal is
- *   irrelevant past the absolute wall.
- * - a null beat (never renewed) is "lapsed".
- * - a FUTURE beat is "lapsed": strict means strict — a clock that claims
- *   tomorrow proves nothing about presence now.
- * - "live"  iff now - lastBeatAt <= 20s (one 15s beat + 5s jitter).
- * - "grace" iff now - lastBeatAt <= 45s (one missed beat, forgiven —
- *   background-tab throttling survives grace, not live).
- * - otherwise "lapsed".
- *
- * Session COOKIE lifetimes (12h idle / 7d absolute in serve.ts) are a
- * different thing and are untouched by all of this.
- */
-export const BEAT_MS = 15_000;
-/** live = one beat plus jitter. */
-export const LIVE_MS = 20_000;
-/** grace = one whole missed beat beyond live, forgiven. */
-export const GRACE_MS = 45_000;
-export function attendedLivenessState(lastBeatAt, now, absoluteExpiryAt) {
-    if (now >= absoluteExpiryAt)
-        return "expired";
-    if (lastBeatAt === null)
-        return "lapsed";
-    if (lastBeatAt > now)
-        return "lapsed";
-    const age = now - lastBeatAt;
-    if (age <= LIVE_MS)
-        return "live";
-    if (age <= GRACE_MS)
-        return "grace";
-    return "lapsed";
-}

package/dist/pricing.d.ts

@@ -1,45 +0,0 @@
-/**
- * Pinned build-model prices (tournament design v3, stage 1; the round-3
- * findings are the spec). Integer micro-dollars per SINGLE token, rounded
- * UP from list prices, with the cache token classes priced separately —
- * finding 24: a "one call" tail computed from rates alone bounds nothing;
- * quantity must be pinned too, so every model row carries its context
- * window and maximum output, and the tail is the worst legal call:
- * every context token at the DEAREST input class plus every output token.
- *
- * Conservative by construction: reservations overcharge, never under.
- * PRICE_VERSION is stamped into approved tournament terms — a price table
- * edit never silently reprices an existing approval.
- */
-export declare const BUILD_PRICE_VERSION = 1;
-export type BuildModelPrice = {
-    /** Micro-dollars per token, ceil'd from list. */
-    inMicrousd: number;
-    outMicrousd: number;
-    cacheWriteMicrousd: number;
-    cacheReadMicrousd: number;
-    /** The pinned request envelope's quantity bounds (finding 24). */
-    contextTokens: number;
-    maxOutputTokens: number;
-};
-export declare function buildPriceOf(model: string): BuildModelPrice | null;
-export declare const PRICED_BUILD_MODELS: readonly string[];
-/**
- * The non-spendable overrun reserve: the worst one API call the pinned
- * envelope permits. Claude's native cap checks the budget AFTER each
- * call, so the true maximum is budget + one full call — this is that
- * call, priced at the dearest input class (finding 24's arithmetic).
- * Held apart from the spendable budget and NEVER granted to a later
- * invocation: each lineage invocation's native cap derives from
- * max(spendable − accounted, 0) alone.
- */
-export declare function oneCallTailMicrousd(model: string): number | null;
-/** Settlement at pinned rates from a usage report that itemizes cache
- * classes; absent classes count as zero, absent totals fail closed by
- * returning null (the caller latches unknown spend, never guesses). */
-export declare function settleBuildMicrousd(model: string, usage: {
-    inputTokens?: number;
-    outputTokens?: number;
-    cacheWriteTokens?: number;
-    cacheReadTokens?: number;
-}): number | null;

package/dist/pricing.js

@@ -1,77 +0,0 @@
-/**
- * Pinned build-model prices (tournament design v3, stage 1; the round-3
- * findings are the spec). Integer micro-dollars per SINGLE token, rounded
- * UP from list prices, with the cache token classes priced separately —
- * finding 24: a "one call" tail computed from rates alone bounds nothing;
- * quantity must be pinned too, so every model row carries its context
- * window and maximum output, and the tail is the worst legal call:
- * every context token at the DEAREST input class plus every output token.
- *
- * Conservative by construction: reservations overcharge, never under.
- * PRICE_VERSION is stamped into approved tournament terms — a price table
- * edit never silently reprices an existing approval.
- */
-export const BUILD_PRICE_VERSION = 1;
-const PRICES = {
-    "claude-sonnet-5": {
-        inMicrousd: 3,
-        outMicrousd: 15,
-        cacheWriteMicrousd: 4, // 1.25x input, ceil'd
-        cacheReadMicrousd: 1, // 0.1x input, ceil'd up
-        contextTokens: 200_000,
-        maxOutputTokens: 64_000,
-    },
-    "claude-opus-5": {
-        inMicrousd: 15,
-        outMicrousd: 75,
-        cacheWriteMicrousd: 19,
-        cacheReadMicrousd: 2,
-        contextTokens: 200_000,
-        maxOutputTokens: 32_000,
-    },
-    "claude-haiku-4-5": {
-        inMicrousd: 1,
-        outMicrousd: 5,
-        cacheWriteMicrousd: 2,
-        cacheReadMicrousd: 1,
-        contextTokens: 200_000,
-        maxOutputTokens: 64_000,
-    },
-};
-export function buildPriceOf(model) {
-    return PRICES[model] ?? null;
-}
-export const PRICED_BUILD_MODELS = Object.keys(PRICES);
-/**
- * The non-spendable overrun reserve: the worst one API call the pinned
- * envelope permits. Claude's native cap checks the budget AFTER each
- * call, so the true maximum is budget + one full call — this is that
- * call, priced at the dearest input class (finding 24's arithmetic).
- * Held apart from the spendable budget and NEVER granted to a later
- * invocation: each lineage invocation's native cap derives from
- * max(spendable − accounted, 0) alone.
- */
-export function oneCallTailMicrousd(model) {
-    const price = buildPriceOf(model);
-    if (price === null)
-        return null;
-    const dearestInput = Math.max(price.inMicrousd, price.cacheWriteMicrousd, price.cacheReadMicrousd);
-    return price.contextTokens * dearestInput + price.maxOutputTokens * price.outMicrousd;
-}
-/** Settlement at pinned rates from a usage report that itemizes cache
- * classes; absent classes count as zero, absent totals fail closed by
- * returning null (the caller latches unknown spend, never guesses). */
-export function settleBuildMicrousd(model, usage) {
-    const price = buildPriceOf(model);
-    if (price === null)
-        return null;
-    const { inputTokens, outputTokens } = usage;
-    if (inputTokens === undefined || outputTokens === undefined)
-        return null;
-    if (!Number.isFinite(inputTokens) || !Number.isFinite(outputTokens) || inputTokens < 0 || outputTokens < 0)
-        return null;
-    return (inputTokens * price.inMicrousd +
-        outputTokens * price.outMicrousd +
-        (usage.cacheWriteTokens ?? 0) * price.cacheWriteMicrousd +
-        (usage.cacheReadTokens ?? 0) * price.cacheReadMicrousd);
-}

package/dist/routine.d.ts

@@ -1,228 +0,0 @@
-/**
- * Routines: standing orders that fire on a schedule (Phase C).
- *
- * A routine is a pre-approved template — goal, exclusions, touches,
- * requirements, schedule, budget — whose approval is what makes every
- * instance legitimately automatic. The template's digest covers EVERY term
- * that constrains the standing order, not just the scope trio: a schedule
- * moved from weekly to hourly, or a budget quietly removed, changes what the
- * operator agreed to exactly as much as a rewritten goal would.
- *
- * The schedule algebra lives here, pure, because its two failure modes are
- * subtle enough to deserve names (Codex planning/routines review, finding
- * 10): advancing one interval after downtime leaves the next firing in the
- * past — a catch-up burst; advancing to `now + interval` drifts the cadence
- * forever. The rule is ALIGNED advancement: the next occurrence strictly
- * after now, anchored to the occurrence that just fired (for `every`) or to
- * the clock itself (for `daily`). Missed slots while nothing was running
- * fire ONCE — the overdue occurrence — and are never backfilled.
- */
-import { type Routine, type Store } from "./store.js";
-import { type ExecutionProfile, type AcceptanceCriterion } from "./scope.js";
-import { type PhaseRoute } from "./phase-routing.js";
-export type Schedule = {
-    kind: "every";
-    minutes: number;
-} | {
-    kind: "daily";
-    hhmm: string;
-    timezone?: string;
-}
-/** v96: Monday to Friday. */
- | {
-    kind: "weekdays";
-    hhmm: string;
-    timezone?: string;
-} | {
-    kind: "weekly";
-    day: number;
-    hhmm: string;
-    timezone?: string;
-};
-export declare const WEEKDAYS: readonly ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
-export declare function validTimezone(value: string): boolean;
-/** Bounds a person would pick on purpose: 5 minutes to 7 days. */
-export declare const MIN_EVERY_MINUTES = 5;
-export declare const MAX_EVERY_MINUTES: number;
-/**
- * Existing daily schedules remain UTC. Calendar schedules may name an IANA
- * timezone, whose wall-clock time stays fixed across daylight saving changes.
- * No cron expressions in v1 — a schedule the operator cannot read at a
- * glance is a schedule they cannot honestly approve.
- */
-export declare function parseSchedule(text: string): Schedule | null;
-export declare function scheduleText(schedule: Schedule): string;
-/** The schedule, in words an operator agrees to. */
-export declare function describeSchedule(schedule: Schedule): string;
-/**
- * The first occurrence after approval: the schedule starts counting from the
- * yes, because "approved at 14:07, every 60 minutes" firing instantly would
- * spend before the approver's hand left the keyboard.
- */
-export declare function firstFireAt(schedule: Schedule, now: Date): string;
-/**
- * Aligned advancement: the smallest cadence occurrence STRICTLY after now.
- * `anchor` is the occurrence that just fired (or was just skipped) — the
- * cadence grid grows from it, so a pass that ran late does not tilt every
- * later firing by its lateness.
- */
-export declare function nextFireAt(schedule: Schedule, anchorIso: string, now: Date): string;
-/** Every term the digest must bind — a change to any is a different order. */
-export type RoutineTerms = {
-    repo: string;
-    goal: string;
-    outOfScope: string | null;
-    touches: string[];
-    /** v39: the signed rubric every instance's scope copies forward, byte
-     * for byte, at fire time — never re-authored per firing. */
-    acceptance: AcceptanceCriterion[];
-    requirements: string[];
-    schedule: string;
-    singleFlight: boolean;
-    costCeilingUsd: number | null;
-    /** Per-instance dollar cap in micro-USD (v16); null = only the backstop. */
-    budgetPerRunMicrousd?: number | null;
-};
-/**
- * The exact standing order an operator agreed to, as 128 bits. Same shape
- * and length as a scope digest, and for the same reason: approval binds to
- * this value, and editing any term strands the old yes.
- */
-export declare function routineDigestOf(terms: RoutineTerms, profile?: ExecutionProfile | null, route?: PhaseRoute | null): string;
-export type RoutineProblem = {
-    field: string;
-    problem: string;
-};
-/** Instance ids are `<name>-YYYYMMDD-HHMM`, so the name must be an id stem. */
-export declare const ROUTINE_NAME: RegExp;
-/**
- * Fail closed on every field at once, like plan parsing: an operator fixing
- * a routine definition should learn everything wrong in one round.
- */
-export declare function validateRoutineTerms(terms: RoutineTerms, options?: {
-    /** The STORED row's name (final authority closure): validated with the
-     * terms wherever a stored routine is read back, so a raw name this
-     * code never files — one no instance id could be stamped from — is
-     * as invalid as an empty rubric, and no door moves on it. */
-    name?: string;
-}): RoutineProblem[];
-/** The stored row's terms, for re-proving the digest against what is actually there. */
-export declare function termsOf(routine: Routine): RoutineTerms;
-/** The instance task id: the routine's name stamped with its scheduled slot. */
-export declare function instanceId(name: string, scheduledForIso: string): string;
-/** The rolling budget window: seven days, and every surface says so. */
-export declare const BUDGET_WINDOW_MS: number;
-export type ApproveRoutineResult = {
-    ok: true;
-    routine: Routine;
-} | {
-    ok: false;
-    reason: "no-such-routine" | "profile-unresolved" | "changed" | "no-approvers" | "not-an-approver" | "requester";
-};
-/**
- * A person agrees to the standing order — schedule, budget, and "each
- * firing builds without asking" included, because the digest binds them.
- * Same ceremony as a scope approval: credential re-proved inside the same
- * transaction as the write, digest named rather than assumed.
- */
-export declare function approveRoutine(store: Store, routineId: number, by: string, now: Date, sawDigest: string, token: string): ApproveRoutineResult;
-export type FireOutcome = {
-    ok: true;
-    taskId: string;
-    scheduledFor: string;
-} | {
-    ok: false;
-    reason: "no-such-routine" | "not-approved" | "paused" | "not-due" | "bad-schedule" | "slot-taken" | "single-flight" | "budget" | "unmeasured" | "route-unfrozen";
-    detail?: string;
-};
-export declare function fireRoutine(store: Store, routineId: number, now: Date, options?: {
-    manual?: boolean;
-}): FireOutcome;
-/**
- * THE AGENTS A STANDING ORDER HOLDS (v48), as one honest word per state,
- * read by every surface — the routine page, the CLI, the firing:
- *
- *   frozen      — approved, and the approval's snapshot reads back exact;
- *   pending     — filed with an exact route, awaiting the yes (or the yes
- *                 went stale on an edit);
- *   unfrozen    — approved BEFORE agents were frozen: the approval stands
- *                 on its terms but no firing can run until the agents are
- *                 refreshed and the order approved again;
- *   unreadable  — the row carries route or profile bytes that do not read
- *                 back (corrupt): nothing approves or fires;
- *   unresolved  — filed under a configuration that could not name an
- *                 exact agent for every role (or whose route carries a
- *                 stated problem): refresh once the agents are configured.
- *
- * `refresh` says whether the one recovery road — re-resolve the agents
- * from today's configuration and approve again — applies.
- */
-export type RoutineAgentsState = {
-    state: "frozen" | "pending" | "unfrozen" | "unreadable" | "unverified" | "unresolved";
-    approvable: boolean;
-    refresh: boolean;
-    problem: string | null;
-};
-/**
- * THE ONE INTEGRITY PROJECTION (v48 authority repair): every question about a standing
- * order's agents — what the page says, whether a yes may be minted,
- * whether an approval may land, whether a firing may proceed — is answered
- * from this one reading of the row, computed BEFORE any mutation and never
- * from a column alone.
- *
- *   approved  the stamp exists, the digest column matches the stored terms'
- *             digest, and that digest re-derives from the stored terms,
- *             working profile, and working route (a column rewritten under
- *             a reused digest is not an approval).
- *   live      the approval stands AND its frozen snapshot is whole: both
- *             snapshot columns read back, they hash with the stored terms to
- *             the very digest the approver signed, no leg states a problem,
- *             and the build and repair legs are the sealed profile's exact
- *             pairs. Only a live approval fires; nothing else does.
- *   agents    the word every surface uses, with whether a yes could bind
- *             (`approvable`) and whether the one recovery road applies
- *             (`refresh`).
- */
-export type RoutineIntegrity = {
-    approved: boolean;
-    live: boolean;
-    /** Why the approval is not live, when it is not — in words a page can show. */
-    liveProblem: string | null;
-    agents: RoutineAgentsState;
-};
-/** The FULL row (v48 integrity): every term the digest binds, both
- * snapshot pairs, and the unreadable flags. There is no partial
- * projection — a reading that skipped the re-derivation could call a
- * rewritten row approved. */
-type IntegrityRow = Routine;
-export declare function routineIntegrity(routine: IntegrityRow): RoutineIntegrity;
-/** The agents word every surface uses — one reading of the projection. */
-export declare function routineAgentsState(routine: IntegrityRow): RoutineAgentsState;
-export type RefreshRoutineResult = {
-    ok: true;
-    routine: Routine;
-    changed: boolean;
-} | {
-    ok: false;
-    reason: "no-such-routine" | "unresolved";
-    problem: string;
-};
-/**
- * THE RECOVERY ROAD (v48): re-resolve a standing order's agents — the
- * four-role route and the profile that restates its build and repair legs
- * — from today's configuration, and file them as the order's WORKING
- * agents under a digest that binds them. Nothing is approved here: a
- * refreshed order reads "edited — approve again", the approver reads the
- * exact agents it now names and agrees to them with the password, and
- * only that yes freezes the snapshot a firing copies. A routine whose
- * terms already bind these exact agents is left byte-for-byte alone.
- * A configuration that still cannot name an exact, runnable agent for
- * every role answers with the words and changes nothing.
- */
-export declare function refreshRoutineAgents(store: Store, routineId: number, now: Date): RefreshRoutineResult;
-/** The standing order, in the words an operator has to agree to. */
-export declare function describeRoutine(routine: Routine): string[];
-/** The agents a standing order's approval freezes, in the same words the
- * task page and chat use — or why it cannot say. */
-export declare function routineAgentsWords(routine: Routine): string[];
-export {};