toolroll 0.9.53 → 0.9.55

package/dist/chat-decide.d.ts

@@ -9,8 +9,9 @@
  * their own chat; otherwise, and for a plan that widens permissions, exceeds the limit or touches protected paths, the
  * card keeps its link.
  *
- * Channel-agnostic: Telegram renders these today, and Slack, Discord and Teams reach the same acts through the same
- * tokens (the `channel` column). Every act runs through the door the console uses. */
+ * The same in every chat app: Telegram's bridge and the shared engine Slack, Discord and Teams run on (chat-delivery.ts)
+ * offer, mint and answer these through the same tokens (the `channel` column). Every act runs through the door the
+ * console uses. */
 import { DECIDE_ACTS } from "./contracts/chat-callback-rows.js";
 import { type ChatApprovalLimits } from "./chat-approval.js";
 import { type VerifiedApprover } from "./principal.js";
@@ -78,10 +79,11 @@ export type DecideOffer = {
     text: string | null;
     rows: Array<Array<ActSpec | DecideLink>>;
 };
-/** What lets this person's chat approve on this repository now: their lasting chat-approval setting (chat-approval.ts),
- * or else a live signed mode carrying the chatApprove term, signed by them. `digest` names that authority for the
+/** What lets this person's chat on `channel` approve on this repository now: their lasting chat-approval setting
+ * (chat-approval.ts), or else a live signed mode carrying the chatApprove term, signed by them, that names this chat
+ * app (a mode signed before the term named its apps covers Telegram alone). `digest` names that authority for the
  * ledger; the yes itself is the person's tap and is sealed as theirs, so it doesn't lapse when the authority does. */
-export declare function chatApproveMode(store: Store, repo: string | null, approver: string, now: Date): {
+export declare function chatApproveMode(store: Store, repo: string | null, approver: string, now: Date, channel: DecideChannel): {
     ok: true;
     digest: string;
     limits: ChatApprovalLimits;
@@ -94,7 +96,7 @@ export declare function chatApproveMode(store: Store, repo: string | null, appro
 export declare function permissionPlainWords(profile: Scope["profile"] | null | undefined): string | null;
 /** A plan this person's chat may approve now: the term, the plan's exact bytes, and none of the reasons it must open
  * Toolroll instead. `digest` binds the scope and the plan document the card shows. */
-export declare function planInChat(store: Store, taskId: string, approver: string, now: Date, root?: string): {
+export declare function planInChat(store: Store, taskId: string, approver: string, now: Date, channel: DecideChannel, root?: string): {
     ok: true;
     modeDigest: string;
     source: "setting" | "mode";
@@ -105,7 +107,7 @@ export declare function planInChat(store: Store, taskId: string, approver: strin
     why: string;
 };
 /** A ready pull request this person's chat may merge now, bound to the exact commit. */
-export declare function mergeInChat(store: Store, taskId: string, run: number, approver: string, now: Date): {
+export declare function mergeInChat(store: Store, taskId: string, run: number, approver: string, now: Date, channel: DecideChannel): {
     ok: true;
     modeDigest: string;
     source: "setting" | "mode";
@@ -119,7 +121,7 @@ export declare function mergeInChat(store: Store, taskId: string, run: number, a
 export declare function planCardText(store: Store, taskId: string, scope: Scope, root?: string, channel?: DecideChannel): string;
 /** The acts a card about this target can take in chat right now, or null when none can (the card keeps its own
  * link). Reads only; nothing is minted. */
-export declare function decideOffer(store: Store, target: DecideTarget, who: VerifiedApprover, now: Date, root?: string, channel?: DecideChannel): DecideOffer | null;
+export declare function decideOffer(store: Store, target: DecideTarget, who: VerifiedApprover, now: Date, channel: DecideChannel, root?: string): DecideOffer | null;
 /** One fingerprint of what the card offers, without its tokens: a repaint with the same offer keeps its buttons. */
 export declare function offerFingerprint(offer: DecideOffer): string;
 /** The card's buttons, minted now (message unknown until it is sent: `placeDecideTokens` puts them on it). */

package/dist/chat-decide.js

@@ -9,8 +9,9 @@
  * their own chat; otherwise, and for a plan that widens permissions, exceeds the limit or touches protected paths, the
  * card keeps its link.
  *
- * Channel-agnostic: Telegram renders these today, and Slack, Discord and Teams reach the same acts through the same
- * tokens (the `channel` column). Every act runs through the door the console uses. */
+ * The same in every chat app: Telegram's bridge and the shared engine Slack, Discord and Teams run on (chat-delivery.ts)
+ * offer, mint and answer these through the same tokens (the `channel` column). Every act runs through the door the
+ * console uses. */
 import { DECIDE_ACTS, readDecideActionRow } from "./contracts/chat-callback-rows.js";
 import { createHash, randomBytes } from "node:crypto";
 import { acceptAndCompleteAsOperator, assignmentOf, owedAcceptance } from "./assignment.js";
@@ -19,7 +20,7 @@ import { applyChatTaskAction, chatTaskStamp } from "./chat-task-actions.js";
 import { chatTitle } from "./chat-voice.js";
 import { readVerifiedArtifact } from "./evidence.js";
 import { effectiveChatApproval } from "./chat-approval.js";
-import { modeTermsFromJson } from "./modes.js";
+import { chatApproveChatsOf, chatNames, modeTermsFromJson } from "./modes.js";
 import { parseExecutionPlanDocument } from "./plan.js";
 import { verifyApproverStanding } from "./principal.js";
 import { pullRequestFollowOf } from "./pull-request-flow.js";
@@ -47,10 +48,11 @@ const sha = (text) => createHash("sha256").update(text).digest("hex");
 const isAct = (one) => "act" in one;
 const title = (store, taskId) => phoneText(chatTitle(store, taskId), 60);
 // ---- the chatApprove term ----------------------------------------------------------
-/** What lets this person's chat approve on this repository now: their lasting chat-approval setting (chat-approval.ts),
- * or else a live signed mode carrying the chatApprove term, signed by them. `digest` names that authority for the
+/** What lets this person's chat on `channel` approve on this repository now: their lasting chat-approval setting
+ * (chat-approval.ts), or else a live signed mode carrying the chatApprove term, signed by them, that names this chat
+ * app (a mode signed before the term named its apps covers Telegram alone). `digest` names that authority for the
  * ledger; the yes itself is the person's tap and is sealed as theirs, so it doesn't lapse when the authority does. */
-export function chatApproveMode(store, repo, approver, now) {
+export function chatApproveMode(store, repo, approver, now, channel) {
     if (repo === null)
         return { ok: false, why: "Approving from chat isn't turned on for this project." };
     const setting = effectiveChatApproval(store, repo, approver);
@@ -62,6 +64,9 @@ export function chatApproveMode(store, repo, approver, now) {
         return setting;
     if (mode.signedBy !== approver || !store.accountCanAccess(approver, repo))
         return { ok: false, why: "Only the person who signed this project's mode can approve from chat." };
+    const chats = chatApproveChatsOf(terms);
+    if (!chats.includes(channel))
+        return { ok: false, why: `Your mode approves from ${chatNames(chats)} only. Sign it again to approve from ${chatNames([channel])}.` };
     return { ok: true, digest: mode.digest, limits: { fullAccess: terms.permissionDefault === "escalated", capMicrousd: terms.perAttemptBudgetMicrousd }, source: "mode" };
 }
 /** What a plan's yes allows an agent to do, in a few plain words (the approval sheet's "You're allowing"). */
@@ -87,7 +92,7 @@ function fullAccess(profile) {
 const money = (micro) => `$${(micro / 1_000_000).toFixed(2)}`;
 /** A plan this person's chat may approve now: the term, the plan's exact bytes, and none of the reasons it must open
  * Toolroll instead. `digest` binds the scope and the plan document the card shows. */
-export function planInChat(store, taskId, approver, now, root) {
+export function planInChat(store, taskId, approver, now, channel, root) {
     const ref = store.lookupRef(taskId);
     const scope = store.getScope(taskId);
     if (ref === null || ref.repo === null || scope === null)
@@ -96,7 +101,7 @@ export function planInChat(store, taskId, approver, now, root) {
         return { ok: false, why: "This plan is already approved." };
     if (ref.plan === "requested")
         return { ok: false, why: "The plan is still being written." };
-    const mode = chatApproveMode(store, ref.repo, approver, now);
+    const mode = chatApproveMode(store, ref.repo, approver, now, channel);
     if (!mode.ok)
         return mode;
     if (store.getTask(taskId)?.state === "cancelled" || store.getTask(taskId)?.state === "done")
@@ -148,7 +153,7 @@ export function planInChat(store, taskId, approver, now, root) {
     return { ok: true, modeDigest: mode.digest, source: mode.source, scope, digest: sha(`${scope.digest}:${plan?.sha256 ?? ""}`) };
 }
 /** A ready pull request this person's chat may merge now, bound to the exact commit. */
-export function mergeInChat(store, taskId, run, approver, now) {
+export function mergeInChat(store, taskId, run, approver, now, channel) {
     const ref = store.lookupRef(taskId);
     const publication = store.publicationForRun(run);
     const follow = publication === null ? null : pullRequestFollowOf(store, publication.id);
@@ -158,7 +163,7 @@ export function mergeInChat(store, taskId, run, approver, now) {
         return { ok: false, why: "This pull request is already merged." };
     if (follow.readyHead !== publication.headSha)
         return { ok: false, why: "This pull request changed since this card was sent." };
-    const mode = chatApproveMode(store, ref.repo, approver, now);
+    const mode = chatApproveMode(store, ref.repo, approver, now, channel);
     if (!mode.ok)
         return mode;
     return { ok: true, modeDigest: mode.digest, source: mode.source, head: publication.headSha };
@@ -216,7 +221,7 @@ export function planCardText(store, taskId, scope, root, channel) {
 // ---- what a card offers ---------------------------------------------------------------
 /** The acts a card about this target can take in chat right now, or null when none can (the card keeps its own
  * link). Reads only; nothing is minted. */
-export function decideOffer(store, target, who, now, root, channel) {
+export function decideOffer(store, target, who, now, channel, root) {
     const ref = store.lookupRef(target.taskId);
     if (ref === null || ref.repo === null || !who.repos.includes(ref.repo))
         return null;
@@ -241,14 +246,14 @@ export function decideOffer(store, target, who, now, root, channel) {
             return { text: null, rows: [[{ act: "retry", run: null, digest: stamp }], [{ label: DECIDE_LABELS.look, path: chatControlHref("task", target.taskId) }]] };
         }
         case "plan": {
-            const plan = planInChat(store, target.taskId, who.name, now, root);
+            const plan = planInChat(store, target.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return null;
             return { text: planCardText(store, target.taskId, plan.scope, root, channel),
                 rows: [[{ act: "approve", run: null, digest: plan.digest }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: plan.digest }]] };
         }
         case "merge": {
-            const merge = mergeInChat(store, target.taskId, target.run, who.name, now);
+            const merge = mergeInChat(store, target.taskId, target.run, who.name, now, channel);
             if (!merge.ok)
                 return null;
             return { text: null, rows: [[{ act: "merge", run: target.run, digest: merge.head }], [{ label: DECIDE_LABELS.look, path: chatResultHref(target.taskId, target.run, "changes") }]] };
@@ -348,7 +353,7 @@ function targetOf(row) {
     }
 }
 /** Why the card's act no longer applies, or null while it still does — checked at the offer and again at the yes. */
-function staleWhy(store, row, who, now, root) {
+function staleWhy(store, row, who, now, channel, root) {
     switch (row.act) {
         case "accept":
         case "changes": {
@@ -366,13 +371,13 @@ function staleWhy(store, row, who, now, root) {
         }
         case "approve":
         case "not-now": {
-            const plan = planInChat(store, row.taskId, who.name, now, root);
+            const plan = planInChat(store, row.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return plan.why;
             return plan.digest === row.digest ? null : "The plan changed since this card was sent.";
         }
         case "merge": {
-            const merge = mergeInChat(store, row.taskId, row.run ?? 0, who.name, now);
+            const merge = mergeInChat(store, row.taskId, row.run ?? 0, who.name, now, channel);
             if (!merge.ok)
                 return merge.why;
             return merge.head === row.digest ? null : "This pull request changed since this card was sent.";
@@ -459,13 +464,13 @@ export function applyDecideTap(store, seat, input) {
     }
     if (row.phase === "cancel") {
         spend();
-        const offer = decideOffer(store, target, who, now, input.root, seat.channel);
+        const offer = decideOffer(store, target, who, now, seat.channel, input.root);
         if (offer === null)
             return { ack: "Cancelled.", edit: { text: body, rows: linksFor(target), tokens: [] } };
         const minted = mintDecideButtons(store, seat, target, offer, now, input.message);
         return { ack: "Cancelled.", edit: { text: offer.text ?? body, ...minted } };
     }
-    const why = staleWhy(store, row, who, now, input.root);
+    const why = staleWhy(store, row, who, now, seat.channel, input.root);
     if (why !== null)
         return stale(why);
     if (row.phase === "offer") {
@@ -503,7 +508,7 @@ export function applyDecideTap(store, seat, input) {
             return retried.ok ? done("✓ Queued again. Existing approvals and holds still apply.") : notDone(retried.message);
         }
         case "approve": {
-            const plan = planInChat(store, row.taskId, who.name, now, input.root);
+            const plan = planInChat(store, row.taskId, who.name, now, seat.channel, input.root);
             if (!plan.ok)
                 return notDone(plan.why);
             // The owner's own yes, sealed as theirs ("chat"), never as a mode's: it stands like the console's after the mode or setting ends.
@@ -514,7 +519,7 @@ export function applyDecideTap(store, seat, input) {
             return done("✓ Approved. Work starts when a worker is free.");
         }
         case "merge": {
-            const merge = mergeInChat(store, row.taskId, row.run ?? 0, who.name, now);
+            const merge = mergeInChat(store, row.taskId, row.run ?? 0, who.name, now, seat.channel);
             if (!merge.ok)
                 return notDone(merge.why);
             const via = `via ${seat.channel} · chat binding #${seat.binding} · ${merge.source} ${merge.modeDigest} · ${merge.head.slice(0, 12)}`;
@@ -567,7 +572,7 @@ export function applyDecideFeedback(store, seat, prompt, text, repos, root, now)
     const verified = verifyApproverStanding(store, seat.approver, seat.generation, repos);
     if (!verified.ok)
         return { said: "That result isn't available here now. Nothing was sent.", link: null };
-    const why = staleWhy(store, { act: "changes", taskId: prompt.taskId, run: prompt.run, digest: prompt.digest }, verified.who, now, root);
+    const why = staleWhy(store, { act: "changes", taskId: prompt.taskId, run: prompt.run, digest: prompt.digest }, verified.who, now, seat.channel, root);
     if (why !== null)
         return { said: `${why} Your feedback wasn't sent.`, link: { label: "Open task", path: chatControlHref("task", prompt.taskId) } };
     if (root === undefined)

package/dist/chat-delivery-state.d.ts

@@ -1,8 +1,7 @@
-import { type Store } from "./store.js";
-import { chatSchema, chatTables } from "./contracts/chat-tables.js";
+import { ChatCore, chatHash, type ChatBinding, type ChatProvider, type ChatRoom } from "./chat-core.js";
+import { ChatMessages } from "./chat-messages.js";
 import { savedChatPart, type ChatContent, type ChatEventBody } from "./contracts/chat-content.js";
-export { savedChatPart, type ChatContent, type ChatEventBody };
-export { chatSchema, chatTables };
+export { savedChatPart, chatHash, type ChatContent, type ChatEventBody, type ChatBinding, type ChatProvider, type ChatRoom };
 export type ChatIdentity = {
     installation: string;
     team?: string;
@@ -10,18 +9,6 @@ export type ChatIdentity = {
     bot: string;
     workspace: string;
 };
-export type ChatBinding = {
-    id: number;
-    installation: string;
-    team: string;
-    app: string;
-    member: string;
-    channel: string;
-    approver: string;
-    generation: number;
-    created: string;
-    revoked: string | null;
-};
 export type ChatEvent = {
     id: string;
     installation: string;
@@ -51,64 +38,20 @@ export type ChatPart = {
     next_at: string | null;
     created: string;
 };
-export type ChatRoom = {
-    id: number;
-    installation: string;
-    chat: string;
-    kind: "group" | "private";
-    conversation: string;
-    boundBy: string;
-    binding: number;
-    cursor: number;
-};
-export declare const chatHash: (text: string) => string;
-export declare class ChatState {
-    readonly store: Store;
-    readonly channel: "slack" | "discord" | "teams";
-    constructor(store: Store, channel: "slack" | "discord" | "teams");
-    prepare(sql: string): import("./store.js").Statement;
-    /** Small transport facts a channel must remember per chat (a Teams service URL). Never credentials. */
-    meta(installation: string, key: string): string | null;
-    setMeta(installation: string, key: string, value: string, now: Date): void;
-    private readRoom;
-    room(installation: string, chat: string): ChatRoom | null;
-    rooms(installation: string): ChatRoom[];
-    /** Point a chat at a conversation; an earlier choice for the same chat is revoked and delivery starts from now. */
-    bindRoom(args: {
-        installation: string;
-        chat: string;
-        kind: "group" | "private";
-        conversation: string;
-        by: string;
-        binding: number;
-    }, now: Date): {
-        ok: true;
-    } | {
-        ok: false;
-        reason: "group-taken";
-    };
-    unbindRoom(installation: string, chat: string, by: string, now: Date): boolean;
-    /** The shared rooms core's view of this installation's room records. */
-    roomBackend(installation: string, now: Date): import("./chat-rooms.js").RoomBackend;
-    advanceRoomCursor(id: number, messageId: number): boolean;
-    get db(): import("./store.js").Database;
-    /** Every unrevoked binding for an installation, oldest first: one per
-     * paired person (v73). Liveness is checked per binding with `live`. */
-    bindings(installation: string): ChatBinding[];
-    /** The unrevoked binding one channel member holds, if any. */
-    bindingFor(installation: string, member: string): ChatBinding | null;
-    bindingById(id: number): ChatBinding | null;
-    /** The oldest unrevoked binding — the single-person reading kept for
-     * status lines and fixtures; inbound, delivery and notices read
-     * `bindingFor` / `bindingById` / `bindings`. */
-    binding(installation: string): ChatBinding | null;
-    live(binding: ChatBinding): boolean;
-    /** End one person's pairing and everything their chat could still do; teammates' bindings stay. */
-    revokeBinding(binding: ChatBinding, now?: Date): void;
-    revoke(installation: string, now?: Date): void;
+/** One app's chats on the shared core (the same object Telegram's run on): its events, planned parts and their buttons. */
+export declare class ChatState extends ChatMessages {
+    constructor(store: ChatCore["store"], provider: ChatProvider);
+    /** Pair-time half kept for the settings pages: mint a code for this installation and return it (only its hash is kept). */
     pairing(installation: string, approver: string, generation: number, now?: Date): string;
-    pair(identity: ChatIdentity, hash: string, member: string, channel: string, now: Date): ChatBinding | null;
-    /** Save a received event with its body (contracts/chat-content.ts), versioned. */
+    /**
+     * Consume a code sent in a chat (the shared rules, chat-core.ts). The installation's notice cursor starts from now
+     * on its FIRST pairing; a later person joins the running cursor (their own history is fenced by their binding's
+     * creation time).
+     */
+    pair(identity: ChatIdentity, hash: string, member: string, channel: string, now: Date, event?: string | null): ChatBinding | null;
+    /** The 60-second lease the Slack, Discord and Teams workers renew. */
+    lease(installation: string, owner: string, now: Date): boolean;
+    /** Save a received event with its body (contracts/chat-content.ts), versioned. False: it was already here. */
     enqueue(event: Omit<ChatEvent, "session" | "state" | "next_at" | "payload"> & {
         payload: ChatEventBody;
     }): boolean;
@@ -116,11 +59,44 @@ export declare class ChatState {
     next(installation: string, now: Date): ChatEvent | null;
     defer(event: string, problem: string, until: Date): void;
     finish(event: string, dropped?: boolean): void;
+    /** Point an event at the binding its pairing made. */
+    setEventBinding(event: string, binding: number): void;
     part(id: number): ChatPart | null;
+    /** The reply to an event, part by part, with each part's buttons minted with it; the event is then handled. Planned once. */
     plan(event: string, parts: ChatContent[], now: Date): void;
+    /** A proposal card's buttons on its part: earlier ones on that part are spent. Yes and Cancel last ten minutes. */
     tokens(part: number, proposal: number, phases: Array<"confirm" | "dismiss" | "yes" | "cancel">, now: Date): void;
-    lease(installation: string, owner: string, now: Date): boolean;
-    owns(installation: string, owner: string, now?: Date): boolean;
+    /** A proposal card's live buttons on one part, in the order they were minted. */
+    partTokens(part: number, now: Date): {
+        token: string;
+        phase: string;
+    }[];
+    /** The next part to send for an installation: notices only while notifications may go out. */
+    nextPart(installation: string, notices: boolean, now: Date, order?: "id" | "created"): ChatPart | null;
+    /** A part that will not go: why, in words the saved chat shows. */
+    dropPart(id: number, problem: string): void;
+    /** Try again no earlier than then (a screenshot waiting for its result's message). */
+    holdPart(id: number, until: string): void;
+    /** The app's upload identity for a part's file, and whether its bytes are up. */
+    setPartFile(id: number, file: string | null, uploaded?: boolean, message?: string | null): void;
+    /**
+     * Sent: on the app's own message id when it gave one (an uploaded file may not). A card's decide buttons
+     * (chat-decide.ts) now ride that message, and any older ones on it stop working; a "What should change?" names it.
+     */
+    partSent(id: number, message: string | null, now: Date, attempt?: boolean): void;
+    /** Not sent this time: counted, named, and (when the answer was lost rather than refused) counted as uncertain. */
+    partFailed(id: number, failure: {
+        problem: string;
+        until: string;
+        uncertain: boolean;
+    }, giveUpAfter?: number): void;
+    /** One person's replies still waiting to send, and those that could not be delivered (settings show both). */
+    partCounts(binding: number): {
+        pending: number;
+        dropped: number;
+    };
+    /** Replace a part's content and send it again (a repaint after a tap). */
+    repaint(id: number, content: ChatContent): void;
 }
 /** A saved part's content. One that can't be read is a delivery problem that names the field, never a guess. */
 export declare function partContent(payload: string): ChatContent;