toolroll 0.9.53 → 0.9.55

package/dist/discord-settings.js

@@ -1,75 +1,41 @@
 import { loadPrimary } from "./webhooks.js";
+import { html, postForm } from "./html.js";
 import { loadDiscordCredentials } from "./discord-api.js";
 import { ChatState } from "./chat-delivery-state.js";
-const escape = (text) => text
-    .replaceAll("&", "&")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;")
-    .replaceAll("'", "&#39;");
-export function discordSettingsHtml(store, dir, csrf, options = {}) {
+export function discordSettingsHtml(store, dir, options = {}) {
     const credentials = loadDiscordCredentials(dir), state = new ChatState(store, "discord"), bindings = credentials ? state.bindings(credentials.installation).filter(one => state.live(one)) : [], binding = options.who === undefined ? null : bindings.find(one => one.approver === options.who) ?? null, others = bindings.length - (binding === null ? 0 : 1);
-    const runtime = credentials
-        ? state.db
-            .prepare("SELECT connected,problem,lease_until FROM discord_runtime WHERE installation=?")
-            .get(credentials.installation)
-        : null;
+    const runtime = credentials ? state.runtime(credentials.installation) : null;
     const now = options.now ?? new Date(), live = runtime &&
-        typeof runtime.lease_until === "string" &&
-        runtime.lease_until > now.toISOString() &&
+        runtime.leaseUntil !== null &&
+        runtime.leaseUntil > now.toISOString() &&
         runtime.connected;
-    const hidden = `<input type="hidden" name="csrf" value="${escape(csrf)}">`;
-    const password = '<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>';
-    const post = (action, content) => `<form method="post" action="/settings/discord/${action}" class="card">${hidden}${content}</form>`;
-    let content = "";
+    const password = html `<label>Your Toolroll password<input style="min-height:44px" type="password" name="password" autocomplete="current-password" required></label>`;
+    const post = (action, content) => postForm(`/settings/discord/${action}`, content, { attrs: { class: "card" } });
+    const parts = [];
     if (!credentials) {
-        content =
-            "<p>Manage projects and review results in a private Discord conversation.</p>" +
-                '<details open><summary>Create your Discord app</summary><ol><li><a href="https://discord.com/developers/applications" target="_blank" rel="noopener noreferrer">Create an application</a>, then copy its token from the Bot page.</li><li>Keep the Interactions Endpoint URL empty and privileged intents off.</li><li>Under Installation, enable Guild Install with the bot scope and no server permissions. Use its install link to add it to your server, then open a direct message to the bot.</li></ol></details>' +
-                post("connect", '<label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" required></label>' +
-                    password +
-                    '<p class="meta">The token stays on this installation. Next, pair your own Discord account.</p><button type="submit">Connect Discord</button>');
+        parts.push(html `<p>Manage projects and review results in a private Discord conversation.</p>`, html `<details open><summary>Create your Discord app</summary><ol><li><a href="https://discord.com/developers/applications" target="_blank" rel="noopener noreferrer">Create an application</a>, then copy its token from the Bot page.</li><li>Keep the Interactions Endpoint URL empty and privileged intents off.</li><li>Under Installation, enable Guild Install with the bot scope and no server permissions. Use its install link to add it to your server, then open a direct message to the bot.</li></ol></details>`, post("connect", html `<label>Bot token<input style="min-height:44px" type="password" name="bot-token" autocomplete="off" required></label>${password}<p class="meta">The token stays on this installation. Next, pair your own Discord account.</p><button type="submit">Connect Discord</button>`));
     }
     else {
-        content = `<p><strong>${escape(credentials.workspace)}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`;
+        parts.push(html `<p><strong>${credentials.workspace}</strong> · ${live ? "Connected" : "Waiting for connection"}</p>`);
         if (runtime?.problem)
-            content += `<p role="status">${escape(String(runtime.problem))}</p>`;
+            parts.push(html `<p role="status">${String(runtime.problem)}</p>`);
         if (!live && !runtime?.problem)
-            content +=
-                "<p>Keep the Toolroll worker running to receive Discord messages.</p>";
+            parts.push(html `<p>Keep the Toolroll worker running to receive Discord messages.</p>`);
         if (options.code) {
-            content +=
-                "<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll Discord app. It expires in 10 minutes.</p>" +
-                    `<label>Pairing message<input type="text" readonly value="pair ${escape(options.code)}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>` +
-                    '<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/discord">Check connection</a>';
+            parts.push(html `<h2>Pair your account</h2><p>Send this in a direct message to your Toolroll Discord app. It expires in 10 minutes.</p>`, html `<label>Pairing message<input type="text" readonly value="pair ${options.code}" autocomplete="off" style="width:100%;max-width:100%;font-size:14px;min-height:44px"></label>`, html `<a class="button-link" style="min-height:44px;white-space:nowrap" href="/settings/discord">Check connection</a>`);
         }
         else if (binding && state.live(binding)) {
-            const pending = Number(state.db
-                .prepare("SELECT count(*) n FROM discord_part p JOIN discord_event e ON e.id=p.event WHERE e.binding=? AND p.state='pending'")
-                .get(binding.id)?.n ?? 0);
-            const failed = Number(state.db
-                .prepare("SELECT count(*) n FROM discord_part p JOIN discord_event e ON e.id=p.event WHERE e.binding=? AND p.state='dropped'")
-                .get(binding.id)?.n ?? 0);
-            content +=
-                `<p>Your Discord account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>` +
-                    "<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>" +
-                    '<p><a href="/chat">Open saved chat</a></p>' +
-                    (loadPrimary(process.env, dir) === "discord"
-                        ? "<p>Task updates are sent here.</p>"
-                        : post("alerts", '<button type="submit">Send task updates here</button>'));
+            const { pending, dropped: failed } = state.partCounts(binding.id);
+            parts.push(html `<p>Your Discord account is paired.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} paired too.` : ""}${pending ? ` ${pending} replies waiting to send.` : ""}${failed ? ` ${failed} replies could not be delivered. Open the saved chat to recover them.` : ""}</p>`, html `<p>Try “What needs my attention?” or “Show the evidence for the latest result.”</p>`, html `<p><a href="/chat">Open saved chat</a></p>`, loadPrimary(process.env, dir) === "discord"
+                ? html `<p>Task updates are sent here.</p>`
+                : post("alerts", html `<button type="submit">Send task updates here</button>`));
         }
         else {
-            content += post("pair", "<h2>Pair your account</h2><p>Your paired Discord account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll." +
-                (others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : "") + "</p>" +
-                password +
-                '<button type="submit">Create pairing code</button>');
+            parts.push(post("pair", html `<h2>Pair your account</h2><p>Your paired Discord account can read your connected projects and confirm proposed changes. Password approvals still open in Toolroll.${others ? ` ${others} teammate${others === 1 ? " is" : "s are"} already paired.` : ""}</p>${password}<button type="submit">Create pairing code</button>`));
         }
         if (binding && state.live(binding) && !options.code)
-            content += post("unpair", password + '<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>');
-        content +=
-            "<details><summary>Connection settings</summary>" +
-                post("disconnect", password + '<button type="submit">Disconnect Discord</button>') +
-                "</details>";
+            parts.push(post("unpair", html `${password}<p class="meta">Unpairing ends every open button in your chat. Teammates are unaffected.</p><button type="submit">Unpair my account</button>`));
+        parts.push(html `<details><summary>Connection settings</summary>${post("disconnect", html `${password}<button type="submit">Disconnect Discord</button>`)}</details>`);
     }
-    return `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Discord</h1>${options.problem ? `<p class="problem" role="alert">${escape(options.problem)}</p>` : ""}${content}<details><summary>Access and setup</summary><p>Private messages and replies use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>The worker connects out to Discord. It does not need a public webhook or a Tailscale account.</p></details></section>`;
+    return html `<section style="max-width:42rem;overflow-wrap:anywhere"><p><a href="/settings">Settings</a></p><h1>Discord</h1>${options.problem ? html `<p class="problem" role="alert">${options.problem}</p>` : ""}${parts}<details><summary>Access and setup</summary><p>Private messages and replies use your Toolroll permissions. Shared channels are not supported. Secure review links use this installation’s configured HTTPS console address.</p><p>The worker connects out to Discord. It does not need a public webhook or a Tailscale account.</p></details></section>`;
 }

package/dist/discord.js

@@ -37,9 +37,7 @@ export async function followDiscord(options) {
                 current.botToken === credentials.botToken &&
                 state.owns(credentials.installation, owner));
         };
-        const problem = (message) => state
-            .prepare("UPDATE chat_runtime SET problem=? WHERE installation=? AND owner=?")
-            .run(message, credentials.installation, owner);
+        const problem = (message) => state.setProblem(credentials.installation, owner, message);
         const api = discordApi(credentials.botToken);
         const client = new Client({
             // Guild messages and their content are needed for rooms; the Message
@@ -63,9 +61,7 @@ export async function followDiscord(options) {
             if (!same() || !validated)
                 return;
             connected = true;
-            state
-                .prepare("UPDATE chat_runtime SET connected=?,problem=NULL WHERE installation=? AND owner=?")
-                .run(new Date().toISOString(), credentials.installation, owner);
+            state.setConnected(credentials.installation, owner, new Date());
         };
         client.on("shardReady", online);
         client.on("shardResume", online);
@@ -133,11 +129,7 @@ export async function followDiscord(options) {
         try {
             await client.login(credentials.botToken);
             while (same()) {
-                const retry = state
-                    .prepare("SELECT retry_at FROM chat_runtime WHERE installation=?")
-                    .get(credentials.installation)?.retry_at;
-                if (!connected ||
-                    (typeof retry === "string" && retry > new Date().toISOString())) {
+                if (!connected || state.retryAt(credentials.installation) > new Date().toISOString()) {
                     await pause(1000);
                     continue;
                 }
@@ -160,9 +152,7 @@ export async function followDiscord(options) {
             alive = false;
             options.signal.removeEventListener("abort", stop);
             await client.destroy().catch(() => { });
-            state
-                .prepare("UPDATE chat_runtime SET owner=NULL,lease_until=NULL,connected=NULL WHERE installation=? AND owner=?")
-                .run(credentials.installation, owner);
+            state.stop(credentials.installation, owner);
         }
         await pause(5000);
     }

package/dist/envelope.js

@@ -71,6 +71,16 @@ export const DOCUMENTED_REASONS = [
     "repair-attempts-spent", // the chain's signed attempt cap is spent
     "repair-no-progress", // two consecutive repair attempts failed to shrink the unresolved set
     "repair-refused-integrity", // a refutation named an altered term, not a gap — no automatic repair
+    "ambiguous", //         a value could mean two things (a lease id or a branch) — refused, never guessed
+    "drift", //             the branch, pull request or result moved from the gated commit
+    "check-failed", //      the release check failed; it stays visible and nothing reruns it
+    "ci-failed", //         a required pull-request check failed or is missing — nothing merged
+    "base-moved", //        main gained a commit the release branch lacks — nothing merged
+    "tree-mismatch", //     main's merge commit has a different tree than the gated commit — nothing tagged
+    "conflict", //          a task or tag exists for a different commit
+    "mixed-runtime", //     the console, worker and CLI names don't run one build
+    "gate-held", //         a deployment stopped before its swap and left new work paused — `release --release-gate <id>`
+    "after-swap", //        the deployment got past stopping the service, so its pause is its own recovery's to lift
 ];
 let captured = null;
 let captureHook = null;

package/dist/evidence-pack.d.ts

@@ -2,6 +2,7 @@ import { type Filer } from "./approval-policy.js";
 import { type AssignmentAccess, type AssignmentSnapshot } from "./assignment.js";
 import type { SealedLedgerEntry, Store } from "./store.js";
 import type { LedgerChainReport } from "./ledger-chain.js";
+import { type Html } from "./html.js";
 export declare const EVIDENCE_PACK_FORMAT = "standing-orders/evidence-pack/v1";
 /** How to recheck one entry's seal, for whoever reads the JSON. */
 export declare const SEAL_RECIPE = "hash = sha256(prev + \"\\n\" + JSON.stringify([id, at, actor, repo, taskId, runId, action, outcome, source, detail]))";
@@ -179,7 +180,7 @@ export declare function ledgerExportChunks(store: Store, range: {
 }, access: AssignmentAccess, who: string, now: Date, evidenceRoot: string): Generator<string, void, undefined>;
 export declare const EVIDENCE_PACK_CSS: string;
 /** The pack as a page: the same facts, in the order an auditor reads them. No script. */
-export declare function evidencePackHtml(pack: EvidencePack): string;
+export declare function evidencePackHtml(pack: EvidencePack): Html;
 /** The page as a file on its own (the CLI's --html): the same facts with just enough style to print. */
 export declare function standaloneEvidenceHtml(pack: EvidencePack): string;
 export {};

package/dist/evidence-pack.js

@@ -15,6 +15,7 @@ import { rulesWords } from "./approval-policy.js";
 import { assignmentOf } from "./assignment.js";
 import { projectName } from "./project.js";
 import { changedFilesOf } from "./result-completion.js";
+import { html, htmlString, joinHtml, styleElement } from "./html.js";
 export const EVIDENCE_PACK_FORMAT = "standing-orders/evidence-pack/v1";
 /** How to recheck one entry's seal, for whoever reads the JSON. */
 export const SEAL_RECIPE = 'hash = sha256(prev + "\\n" + JSON.stringify([id, at, actor, repo, taskId, runId, action, outcome, source, detail]))';
@@ -173,13 +174,12 @@ export function* ledgerExportChunks(store, range, scope, access, who, now, evide
     yield `],"truncated":${JSON.stringify({ entries: moreEntries, packs: morePacks })}}`;
 }
 // ---- The printable page -----------------------------------------------------
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-const when = (at) => at === null ? "—" : `${e(at.slice(0, 16).replace("T", " "))} UTC`;
-const short = (hash) => hash === null ? "—" : `<code title="${e(hash)}">${e(hash.slice(0, 12))}</code>`;
+const when = (at) => at === null ? html `—` : html `${at.slice(0, 16).replace("T", " ")} UTC`;
+const short = (hash) => hash === null ? html `—` : html `<code title="${hash}">${hash.slice(0, 12)}</code>`;
 const usd = (value) => value === null ? "—" : `$${value.toFixed(value < 1 ? 4 : 2)}`;
 /** Only a web address links; anything else (a stored value that isn't one) is shown as text. */
-const link = (url) => /^https:\/\/[^\s"'<>]+$/.test(url) ? `<a href="${e(url)}">${e(url)}</a>` : e(url);
-const filer = (who) => who === null || who.name === null ? "automation" : who.kind === "person" ? e(who.name) : `${e(who.name)} (${e(who.kind)})`;
+const link = (url) => /^https:\/\/[^\s"'<>]+$/.test(url) ? html `<a href="${url}">${url}</a>` : html `${url}`;
+const filer = (who) => who === null || who.name === null ? html `automation` : who.kind === "person" ? html `${who.name}` : html `${who.name} (${who.kind})`;
 export const EVIDENCE_PACK_CSS = `.evidence-pack{max-width:960px;min-width:0}.evidence-pack h1{margin:0}.evidence-pack h2{font-size:.9375rem;margin:24px 0 8px}.evidence-pack h3{font-size:.875rem;margin:16px 0 6px}` +
     `.evidence-head{display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap;align-items:baseline}.evidence-pack dl{display:grid;grid-template-columns:minmax(120px,180px) minmax(0,1fr);gap:4px 16px;margin:0}` +
     `.evidence-pack dt{color:var(--muted-foreground);font-size:.8125rem}.evidence-pack dd{margin:0;min-width:0;overflow-wrap:anywhere}.evidence-pack table{width:100%;border-collapse:collapse;font-size:.8125rem}` +
@@ -193,66 +193,62 @@ export const EVIDENCE_PACK_CSS = `.evidence-pack{max-width:960px;min-width:0}.ev
 export function evidencePackHtml(pack) {
     const task = pack.task;
     const chain = pack.ledger.chain.ok
-        ? `<p class="evidence-chain ok" data-evidence-chain="ok"><strong>Ledger chain verified</strong> · ${pack.ledger.chain.entries} entries · head ${short(pack.ledger.chain.head)}${pack.ledger.chain.checkedAt === null ? "" : ` · checked in full ${when(pack.ledger.chain.checkedAt)}`}${pack.ledger.checkpoint === null ? "" : ` · last checkpoint at entry #${pack.ledger.checkpoint.through}`}</p>`
-        : `<p class="evidence-chain problem" role="alert" data-evidence-chain="broken"><strong>Ledger chain broken</strong> · ${e(pack.ledger.chain.problem)}</p>`;
+        ? html `<p class="evidence-chain ok" data-evidence-chain="ok"><strong>Ledger chain verified</strong> · ${pack.ledger.chain.entries} entries · head ${short(pack.ledger.chain.head)}${pack.ledger.chain.checkedAt === null ? "" : html ` · checked in full ${when(pack.ledger.chain.checkedAt)}`}${pack.ledger.checkpoint === null ? "" : html ` · last checkpoint at entry #${pack.ledger.checkpoint.through}`}</p>`
+        : html `<p class="evidence-chain problem" role="alert" data-evidence-chain="broken"><strong>Ledger chain broken</strong> · ${pack.ledger.chain.problem}</p>`;
     const versions = pack.versions.map((version, index) => {
         const scope = version.scope;
         const approved = scope?.approved ?? null;
         const approvals = scope === null ? [] : scope.approvals.filter(one => one.digest === (approved?.digest ?? scope.digest));
         const rows = [
-            ["Filed", `${when(version.filedAt)} by ${filer(version.filedBy)}`],
-            ...(scope === null ? [["Scope", "None written"]] : [
-                ["Goal", e(scope.goal)],
-                ...(scope.touches.length ? [["Touches", scope.touches.map(e).join(", ")]] : []),
-                ...(scope.acceptance.length ? [["Acceptance", `<ol class="criteria">${scope.acceptance.map(one => `<li>${e(one.statement)}</li>`).join("")}</ol>`]] : []),
-                ...(scope.writtenBy.length ? [["Scope written by", [...new Set(scope.writtenBy.map(one => one.author))].map(e).join(", ")]] : []),
-                ["Approved", approved === null ? "Not approved" : `${e(approved.by)}${approved.basis === "mode" ? " (operating mode)" : ""} · ${when(approved.at)}${approved.current ? "" : " · the scope changed after this"}`],
-                ...(approvals.length > 1 ? [["Approvals", approvals.map(one => `${e(one.approver)} · ${when(one.at)}`).join("<br>")]] : []),
+            ["Filed", html `${when(version.filedAt)} by ${filer(version.filedBy)}`],
+            ...(scope === null ? [["Scope", html `None written`]] : [
+                ["Goal", html `${scope.goal}`],
+                ...(scope.touches.length ? [["Touches", joinHtml(scope.touches, ", ")]] : []),
+                ...(scope.acceptance.length ? [["Acceptance", html `<ol class="criteria">${scope.acceptance.map(one => html `<li>${one.statement}</li>`)}</ol>`]] : []),
+                ...(scope.writtenBy.length ? [["Scope written by", joinHtml([...new Set(scope.writtenBy.map(one => one.author))], ", ")]] : []),
+                ["Approved", approved === null ? html `Not approved` : html `${approved.by}${approved.basis === "mode" ? " (operating mode)" : ""} · ${when(approved.at)}${approved.current ? "" : " · the scope changed after this"}`],
+                ...(approvals.length > 1 ? [["Approvals", joinHtml(approvals.map(one => html `${one.approver} · ${when(one.at)}`), html `<br>`)]] : []),
                 ["Scope digest", short(scope.digest)],
             ]),
         ];
-        const runs = version.runs.length === 0 ? `<p class="meta">No agent ran.</p>` :
-            `<div class="evidence-table"><table><thead><tr><th>Run</th><th>Role</th><th>Agent</th><th>Outcome</th><th>Cost</th><th>Finished</th><th>Commit</th></tr></thead><tbody>` +
-                version.runs.map(run => `<tr><td><a href="/r/${run.id}">#${run.id}</a></td><td>${e(run.role)}</td><td>${e(run.agent)}${run.model ? ` · ${e(run.model)}` : ""}</td><td>${e(run.outcome ?? "running")}</td><td>${usd(run.costUsd)}</td><td>${when(run.finishedAt)}</td><td>${short(run.head)}</td></tr>`).join("") +
-                `</tbody></table></div>`;
-        const changes = version.runs.filter(run => run.role === "builder" || run.role === "repair").map(run => `<p class="meta">Run #${run.id}${run.diff === null ? "" : ` · diff ${short(run.diff.sha256)}${run.diff.complete ? "" : " (partial)"}`}</p>` +
-            (run.changedFiles === null ? `<p class="meta">Its changed files couldn't be read.</p>` : run.changedFiles.length === 0 ? `<p class="meta">No files changed.</p>` : `<ul class="files">${run.changedFiles.map(file => `<li>${e(file)}</li>`).join("")}</ul>`)).join("");
-        return `<section data-evidence-version="${e(version.id)}"><h2>${pack.versions.length > 1 ? `${index === 0 ? "Request" : `Revision ${index}`} · ` : "Request and approval · "}${e(version.id)}</h2><dl>${rows.map(([label, value]) => `<dt>${label}</dt><dd>${value}</dd>`).join("")}</dl>` +
-            `<h3>Agents</h3>${runs}${changes === "" ? "" : `<h3>Changes</h3>${changes}`}</section>`;
-    }).join("");
+        const runs = version.runs.length === 0 ? html `<p class="meta">No agent ran.</p>` :
+            html `<div class="evidence-table"><table><thead><tr><th>Run</th><th>Role</th><th>Agent</th><th>Outcome</th><th>Cost</th><th>Finished</th><th>Commit</th></tr></thead><tbody>${version.runs.map(run => html `<tr><td><a href="/r/${run.id}">#${run.id}</a></td><td>${run.role}</td><td>${run.agent}${run.model ? html ` · ${run.model}` : ""}</td><td>${run.outcome ?? "running"}</td><td>${usd(run.costUsd)}</td><td>${when(run.finishedAt)}</td><td>${short(run.head)}</td></tr>`)}</tbody></table></div>`;
+        const changes = version.runs.filter(run => run.role === "builder" || run.role === "repair").map(run => html `<p class="meta">Run #${run.id}${run.diff === null ? "" : html ` · diff ${short(run.diff.sha256)}${run.diff.complete ? "" : " (partial)"}`}</p>${run.changedFiles === null ? html `<p class="meta">Its changed files couldn't be read.</p>` : run.changedFiles.length === 0 ? html `<p class="meta">No files changed.</p>` : html `<ul class="files">${run.changedFiles.map(file => html `<li>${file}</li>`)}</ul>`}`);
+        return html `<section data-evidence-version="${version.id}"><h2>${pack.versions.length > 1 ? `${index === 0 ? "Request" : `Revision ${index}`} · ` : "Request and approval · "}${version.id}</h2><dl>${rows.map(([label, value]) => html `<dt>${label}</dt><dd>${value}</dd>`)}</dl><h3>Agents</h3>${runs}${changes.length === 0 ? "" : html `<h3>Changes</h3>${changes}`}</section>`;
+    });
     const result = pack.result;
-    const outcome = result === null ? `<section><h2>Result</h2><p class="meta">No finished result yet.</p></section>` :
-        `<section data-evidence-result><h2>Result</h2><dl>` +
-            `<dt>Checks</dt><dd>${e(result.checks.detail)}${result.checks.command ? ` <code>${e(result.checks.command)}</code>` : ""}</dd>` +
-            `<dt>Marked complete</dt><dd>${result.completedBy === null ? "Not yet" : `${e(result.completedBy)} · ${when(result.completedAt)}`}</dd>` +
-            `<dt>Published</dt><dd>${result.publication === null ? "Not published" : `${e(result.publication.state)}${result.publication.prUrl ? ` · ${link(result.publication.prUrl)}` : ""}${result.publication.remoteState ? ` · ${e(result.publication.remoteState.toLowerCase())}` : ""}`}</dd>` +
-            `<dt>Commit</dt><dd>${short(result.base)} → ${short(result.head)}</dd>` +
-            (result.caveats.length ? `<dt>Caveats</dt><dd>${result.caveats.map(e).join("<br>")}</dd>` : "") +
-            `</dl></section>`;
+    const outcome = result === null ? html `<section><h2>Result</h2><p class="meta">No finished result yet.</p></section>` :
+        joinHtml([html `<section data-evidence-result><h2>Result</h2><dl>`,
+            html `<dt>Checks</dt><dd>${result.checks.detail}${result.checks.command ? html ` <code>${result.checks.command}</code>` : ""}</dd>`,
+            html `<dt>Marked complete</dt><dd>${result.completedBy === null ? "Not yet" : html `${result.completedBy} · ${when(result.completedAt)}`}</dd>`,
+            html `<dt>Published</dt><dd>${result.publication === null ? "Not published" : html `${result.publication.state}${result.publication.prUrl ? html ` · ${link(result.publication.prUrl)}` : ""}${result.publication.remoteState ? html ` · ${result.publication.remoteState.toLowerCase()}` : ""}`}</dd>`,
+            html `<dt>Commit</dt><dd>${short(result.base)} → ${short(result.head)}</dd>`,
+            result.caveats.length ? html `<dt>Caveats</dt><dd>${joinHtml(result.caveats, html `<br>`)}</dd>` : "",
+            html `</dl></section>`]);
     const decisions = pack.ledger.entries.filter(one => one.source !== "request");
     const requests = pack.ledger.entries.length - decisions.length;
     const askedWords = `${requests} ${requests === 1 ? "request" : "requests"} made through the console (accepted or refused)`;
-    const ledger = `<section><h2>Ledger</h2>${decisions.length === 0 ? `<p class="meta">No entries.</p>` :
-        `<div class="evidence-table"><table><thead><tr><th>#</th><th>Time</th><th>Who</th><th>What</th><th>Outcome</th><th>Seal</th></tr></thead><tbody>` +
-            decisions.map(one => `<tr data-ledger-id="${one.id}"><td>${one.id}</td><td>${when(one.at)}</td><td>${e(one.actor)}</td><td>${e(one.action)}${one.detail ? `<br><span class="meta">${e(one.detail)}</span>` : ""}</td><td>${e(one.outcome)}</td><td>${short(one.seal?.hash ?? null)}</td></tr>`).join("") +
-            `</tbody></table></div>`}${requests > 0 ? `<p class="meta">Plus ${askedWords}, listed in the JSON.</p>` : ""}${pack.ledger.truncated ? `<p class="meta">This pack holds ${decisions.length} of the task's entries and the newest ${requests} requests; the ledger export has the rest.</p>` : ""}</section>`;
+    const ledger = html `<section><h2>Ledger</h2>${decisions.length === 0 ? html `<p class="meta">No entries.</p>` :
+        html `<div class="evidence-table"><table><thead><tr><th>#</th><th>Time</th><th>Who</th><th>What</th><th>Outcome</th><th>Seal</th></tr></thead><tbody>${decisions.map(one => html `<tr data-ledger-id="${one.id}"><td>${one.id}</td><td>${when(one.at)}</td><td>${one.actor}</td><td>${one.action}${one.detail ? html `<br><span class="meta">${one.detail}</span>` : ""}</td><td>${one.outcome}</td><td>${short(one.seal?.hash ?? null)}</td></tr>`)}</tbody></table></div>`}${requests > 0 ? html `<p class="meta">Plus ${askedWords}, listed in the JSON.</p>` : ""}${pack.ledger.truncated ? html `<p class="meta">This pack holds ${decisions.length} of the task's entries and the newest ${requests} requests; the ledger export has the rest.</p>` : ""}</section>`;
     const cost = pack.totals.runs === 0 ? "None ran" : `${pack.totals.runs} ${pack.totals.runs === 1 ? "run" : "runs"} · ${usd(pack.totals.costUsd)}`;
     // The rules as they stand, and each change to them (the approval above was under whichever applied then).
-    const rules = pack.rules === null ? "None" : `${e(pack.rules.now)}${pack.rules.changes.length === 0 ? "" :
-        `<ul class="criteria">${pack.rules.changes.slice(-5).map(one => `<li class="meta">${when(one.at)} · ${e(one.by)}: ${e(one.change)}</li>`).join("")}</ul>`}`;
-    return `<article class="evidence-pack" data-evidence-pack="${e(task.id)}">` +
-        `<div class="evidence-head"><h1>Evidence pack</h1><p class="evidence-actions"><a href="/t/${encodeURIComponent(task.id)}/evidence?format=json" download>Download JSON</a> · <a href="/t/${encodeURIComponent(task.id)}">Back to task</a></p></div>` +
-        `<p><strong>${e(task.title)}</strong></p>` +
-        `<dl><dt>Task</dt><dd>${e(task.id)}${task.project === null ? "" : ` · ${e(task.project)}`} · ${e(task.state)}</dd>` +
-        `<dt>Approval rules</dt><dd>${rules}</dd><dt>Agents</dt><dd>${cost}</dd>` +
-        `<dt>Prepared</dt><dd>${when(pack.generatedAt)} for ${e(pack.generatedBy)}</dd></dl>${chain}` +
-        versions + outcome + ledger +
-        `<p class="evidence-foot">Pack digest <code>${e(pack.digest)}</code>. Each ledger entry's seal can be rechecked from the JSON: ${e(pack.ledger.recipe)}.</p></article>`;
+    const rules = pack.rules === null ? html `None` : html `${pack.rules.now}${pack.rules.changes.length === 0 ? "" :
+        html `<ul class="criteria">${pack.rules.changes.slice(-5).map(one => html `<li class="meta">${when(one.at)} · ${one.by}: ${one.change}</li>`)}</ul>`}`;
+    return joinHtml([html `<article class="evidence-pack" data-evidence-pack="${task.id}">`,
+        html `<div class="evidence-head"><h1>Evidence pack</h1><p class="evidence-actions"><a href="/t/${encodeURIComponent(task.id)}/evidence?format=json" download>Download JSON</a> · <a href="/t/${encodeURIComponent(task.id)}">Back to task</a></p></div>`,
+        html `<p><strong>${task.title}</strong></p>`,
+        html `<dl><dt>Task</dt><dd>${task.id}${task.project === null ? "" : ` · ${task.project}`} · ${task.state}</dd>`,
+        html `<dt>Approval rules</dt><dd>${rules}</dd><dt>Agents</dt><dd>${cost}</dd>`,
+        html `<dt>Prepared</dt><dd>${when(pack.generatedAt)} for ${pack.generatedBy}</dd></dl>${chain}`,
+        versions, outcome, ledger,
+        html `<p class="evidence-foot">Pack digest <code>${pack.digest}</code>. Each ledger entry's seal can be rechecked from the JSON: ${pack.ledger.recipe}.</p></article>`]);
 }
 /** The page as a file on its own (the CLI's --html): the same facts with just enough style to print. */
 export function standaloneEvidenceHtml(pack) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Evidence pack · ${e(pack.task.id)}</title>` +
-        `<style>:root{--muted-foreground:#5c5c5c;--border:#dedede;--success:#1a7f37;--font-mono:ui-monospace,SFMono-Regular,Menlo,monospace}` +
+    const css = `:root{--muted-foreground:#5c5c5c;--border:#dedede;--success:#1a7f37;--font-mono:ui-monospace,SFMono-Regular,Menlo,monospace}` +
         `body{font:14px/1.5 system-ui,-apple-system,sans-serif;margin:32px auto;padding:0 16px;max-width:960px;color:#171717;background:#fff}.meta{color:var(--muted-foreground);font-size:.8125rem}.evidence-actions{display:none}` +
-        EVIDENCE_PACK_CSS + `</style></head><body>${evidencePackHtml(pack)}</body></html>\n`;
+        EVIDENCE_PACK_CSS;
+    // The file is the sink: its bytes.
+    return htmlString(html `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Evidence pack · ${pack.task.id}</title>${styleElement(css)}</head><body>${evidencePackHtml(pack)}</body></html>
+`);
 }

package/dist/export-ui.d.ts

@@ -1,4 +1,9 @@
+/**
+ * Settings → Data (v105): an instance operator downloads everything Standing
+ * Orders knows as one .zip. One form: the password, typed again, and a button.
+ */
+import { type Html } from "./html.js";
 export declare const EXPORT_CSS: string;
-export declare function dataExportHtml(csrf: string, notice: {
+export declare function dataExportHtml(notice: {
     problem?: string | null;
-}): string;
+}): Html;

package/dist/export-ui.js

@@ -2,16 +2,10 @@
  * Settings → Data (v105): an instance operator downloads everything Standing
  * Orders knows as one .zip. One form: the password, typed again, and a button.
  */
-const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+import { html, postForm } from "./html.js";
 export const EXPORT_CSS = `.data-export{max-width:720px;min-width:0}.data-export label{display:grid;gap:4px;margin:14px 0 0;font-size:.875rem}` +
     `.data-export input[type=password]{width:100%;max-width:360px;box-sizing:border-box}.data-export button[type=submit]{margin-top:14px;min-height:44px;white-space:nowrap}`;
-export function dataExportHtml(csrf, notice) {
-    const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : "";
-    return `<section class="data-export">${note}` +
-        `<p>Everything Toolroll knows, as one .zip: projects, tasks, runs and cost, the action ledger, evidence packs, chats, flows, teammates and settings. ` +
-        `Passwords, keys and tokens are never included.</p>` +
-        `<form method="post" action="/settings/data"><input type="hidden" name="csrf" value="${e(csrf)}">` +
-        `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
-        `<button type="submit">Download export</button></form>` +
-        `<p class="meta">The same export from the command line: <code>toolroll export --out &lt;path&gt; [--zip]</code></p></section>`;
+export function dataExportHtml(notice) {
+    const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : "";
+    return html `<section class="data-export">${note}<p>Everything Toolroll knows, as one .zip: projects, tasks, runs and cost, the action ledger, evidence packs, chats, flows, teammates and settings. Passwords, keys and tokens are never included.</p>${postForm("/settings/data", html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label><button type="submit">Download export</button>`)}<p class="meta">The same export from the command line: <code>toolroll export --out &lt;path&gt; [--zip]</code></p></section>`;
 }

package/dist/export.js

@@ -29,20 +29,20 @@ import { readEmailSettings } from "./email-settings.js";
 import { SUBSCRIPTION_CAPABLE, readAuthMode } from "./keys.js";
 export const EXPORT_FORMAT = "standing-orders/export/v1";
 /** Tables that hold nothing but secrets or short-lived sign-in material, and derived search indexes. */
-const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "telegram_pairing", "slack_pair", "discord_pair", "teams_pair", "oauth_code", "oauth_refresh"]);
+const SECRET_TABLES = new Set(["web_session", "ceremony_nonce", "chat_pair", "oauth_code", "oauth_refresh"]);
 const DERIVED_TABLE = /^(sqlite_|memory_search)/;
 /** Columns that hold a secret (or what stands in for one): never exported. */
 const SECRET_COLUMNS = new Set([
     "api_token.secret_hash", "lead_credential.secret_hash", "approver.credential_hash", "coordinator_credential.credential_hash", "runner.credential_hash", "invite.token_hash",
     "flow_trigger.hook_hash", "push_subscription.endpoint", "push_subscription.p256dh", "push_subscription.auth",
-    "chat_turn.credential_key", "mate_session.credential_key", "mate_turn.credential_key", "bridge_lease.push_url", "workflow_preview.token",
+    "chat_turn.credential_key", "mate_session.credential_key", "mate_turn.credential_key", "chat_runtime.push_url", "workflow_preview.token",
     "quota.credential_fp", "oauth_grant.renew_hash", "oauth_client.source_hash",
 ]);
 /** A column named like this holds a secret unless it is reviewed below; an unreviewed one is dropped. */
 const SECRET_NAME = /hash|secret|token|passw|cookie|csrf|credential|p256dh|^auth$|key|nonce|endpoint|url/i;
 /** Reviewed: named like a secret, but it isn't one (a seal, a digest, a lookup name, an address with no key). */
 const REVIEWED_COLUMNS = new Set([
-    "artifact.key", "budget.scope_key", "mate_thread.scope_key", "diff_comment.source_key", "discord_meta.key", "slack_meta.key", "teams_meta.key",
+    "artifact.key", "budget.scope_key", "mate_thread.scope_key", "diff_comment.source_key", "chat_meta.key",
     "flow_trigger_event.key", "installation_fact.key", "mcp_idempotency.key", "memory_gap.key", "mutation.idempotency_key", "notification.dedupe_key",
     "service_cursor.key", "ledger_checkpoint.hash", "ledger_seal.hash", "merge_intent.grant_terms_hash", "plan_revision.parent_hash",
     "publication.body_hash", "publication.pr_url", "team_message.payload_hash", "team_request.payload_hash", "backend_grant.credential_scope",
@@ -55,7 +55,7 @@ export function categoryOf(table) {
         [/^(action_ledger|ledger_seal|ledger_checkpoint|sync_ledger)$/, "ledger"],
         [/^teammate/, "teammates"],
         [/^(flow|workflow_)/, "flows"],
-        [/^(chat_|mate_|team_|telegram_|slack_|discord_|teams_|notification|push_|bridge_lease)/, "chats"],
+        [/^(chat_|mate_|team_|notification|push_)/, "chats"],
         [/^(approver|api_token|lead_credential|invite|sso_identity|coordinator_|oauth_)/, "people"],
         [/^(run|artifact|claim|worktree$|execution_slot|criterion_review|diff_comment|proof_|review_request|repair_chain|incident|publication$|merge_|side_spend|knowledge_snapshot|learning_snapshot|skill_snapshot)/, "runs"],
         [/^(task|hold$|plan_|scope_|tool_seal|decision|external_|skill_test)/, "tasks"],

package/dist/flow-gallery-ui.d.ts

@@ -1,11 +1,12 @@
 import { type GalleryAnswers, type GalleryPreview, type GalleryTemplate, type GalleryTool } from "./flow-gallery.js";
 import { type FlowDefinition, type FlowStage } from "./flows.js";
+import { type Html } from "./html.js";
 export declare const GALLERY_CSS: string;
 /** A flow's main path, as a person reads it: from the start, each step's first way on (a sort's first answer, a choose's
  * first option that goes somewhere, else next; a check's failure when passing just ends), never back to a step shown. */
 export declare function mainPath(definition: FlowDefinition): FlowStage[];
 /** A flow's steps in order, joined by arrows; a person's decisions carry the accent. */
-export declare function stepStrip(definition: FlowDefinition): string;
+export declare function stepStrip(definition: FlowDefinition): Html;
 /** The gallery: every template, grouped, each with one "Use this". `repo` carries a chosen project to the template's page. */
 export declare function galleryHtml(input: {
     repo: string | null;
@@ -14,7 +15,7 @@ export declare function galleryHtml(input: {
         id: string;
         state: "connected" | "open" | "taken";
     }[] | null;
-}): string;
+}): Html;
 /** A template's page: its questions, then what it will do and never do, then Create. */
 export declare function galleryUseHtml(input: {
     template: GalleryTemplate;
@@ -32,4 +33,4 @@ export declare function galleryUseHtml(input: {
     /** The template's tools in this project; `said` is how the last Connect went. */
     tools?: readonly GalleryTool[];
     said?: string | null;
-}): string;
+}): Html;