toolroll 0.9.54 → 0.9.55

package/dist/server/chrome.d.ts

@@ -0,0 +1,291 @@
+import { type BrowserSignIn, type BrowserUpdateNotice, type BrowserWorkspace } from "../browser-workspace.js";
+import { type Decision, type Run } from "../store.js";
+import { type tally } from "../summary.js";
+import { type ServerResponse } from "node:http";
+import { type Html } from "../html.js";
+import { type ProjectPeek } from "./render-pages.js";
+import { type Who } from "./session.js";
+/** The spend line for a 7am reader: whole cents, "runs", the gap still named. */
+export declare function consoleSpend(summary: ReturnType<typeof tally<Run & {
+    taskId: string;
+}>>): string;
+/** ISO to the minute — "2026-08-12 17:56" — for anywhere a person reads a time. */
+export declare function when(iso: string | null): string;
+/** The same minute as a `<time>`: the full stamp on a desk, "16:39" / "Yesterday 16:39" / "Sep 28" on a phone. */
+export declare function whenTime(iso: string | null): Html;
+/** Overdue is derived at render — display never writes. */
+export declare function isOverdue(decision: Decision, now: Date): boolean;
+/**
+ * A refusal that stays inside the console: same shell, a problem banner, and
+ * a way back — the error path is the one place a console must not stop
+ * being a console. Bearer callers still get plain text; they parse, not read.
+ */
+export declare function refuse(response: ServerResponse, who: Who | null, status: number, message: string, backHref?: string): void;
+/** The demo's one-line promise, on every page. */
+export declare const DEMO_BANNER = "Demo: a scripted lead and sample projects. Nothing calls a model, reaches outside or spends. For your own project, run npx toolroll up in its folder.";
+/** The demo notice on a phone: one line. */
+export declare const DEMO_BANNER_SHORT = "Demo: sample projects. Nothing calls a model or spends.";
+/**
+ * The Operations Ledger: the design system Alex approved in Figma and the
+ * design/ shadcn package, carried as pure CSS on server-rendered HTML.
+ * Deliberately not the React library: the console ships zero dependencies
+ * and zero page JavaScript under a CSP that forbids scripts, and a look is
+ * not worth that posture. The same semantic tokens render both system light
+ * and dark themes.
+ */
+/** The shared palette, light and dark (2026-09-27, "Signal"): neutral grey
+ * grounds, ink for every act a person can take, and one chart magenta, the
+ * colour nautical charts print lights and cautions in, for what needs a
+ * person (the needs-you count, the act that resolves a screen, focus and
+ * selection). Status keeps its own four hues; magenta never means "failed".
+ * The frame is the ground the sidebar sits on; work sits on paper sheets
+ * inset into it. Semantic names only; every surface (server pages, the
+ * React workspace, the pre-script fallback) reads these.
+ *
+ * The console's stylesheet lives in console.css, shipped beside this module:
+ * the palette above in light, dark and pinned themes, then the page rules.
+ * Its bytes are the served sheet's (WORKSPACE_STYLE hashes them). */
+export declare const STYLE: string;
+/** Appearance: a three-way segmented switch, one tap per choice. */
+export declare const THEME_CONTROLS_CSS = ".task-repo select{width:100%;min-height:2.75rem;font-size:1rem}.task-repo-add{margin:.35rem .1rem .5rem}.task-repo-add a{display:inline-flex;align-items:center;min-height:2.25rem}details.result-request-open.result-request-form>summary{border:0;background:transparent;padding:.5rem 0;min-height:2.75rem;font-weight:600;display:list-item;list-style:revert}details.result-request-open.result-request-form>summary::-webkit-details-marker{display:revert}form.js-autosave button[type=submit]{display:none}.provider-row{border-bottom:1px solid var(--so-line);padding:.35rem 0}.provider-row:first-of-type{border-top:1px solid var(--so-line)}.provider-head{display:flex;align-items:center;gap:.75rem;margin:.4rem 0 0}.provider-status{display:inline-flex;align-items:center;gap:.4rem;color:var(--so-muted);font-size:.875rem}.provider-status i{width:.5rem;height:.5rem;border-radius:50%;background:var(--so-muted)}.provider-status--ok i{background:var(--so-success)}.provider-status--warn i{background:var(--so-attention)}.provider-status--off i{background:transparent;border:1.5px solid var(--so-muted)}details.provider-manage>summary{cursor:pointer;color:var(--so-accent-text);font-size:.875rem;min-height:2.5rem;display:list-item;padding-block:.5rem}.card.props .row{display:grid;gap:.1rem;margin:0 0 .75rem}.card.props .row>.meta{display:block;font-size:.75rem}.card.props .row>.meta::first-letter{text-transform:uppercase}.card.props .row>.mono{font-family:var(--font-sans);font-size:.875rem}.card.props .row>.mono .seal{font-family:var(--font-mono);font-size:.8125rem}details.evidence-files{margin:1rem 0}details.evidence-files>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:600}details.evidence-files ul{list-style:none;margin:0;padding:0}details.evidence-files li{display:flex;justify-content:space-between;gap:1rem;padding:.5rem 0;border-bottom:1px solid var(--so-line)}.result-action .result-feedback-link{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;text-decoration:none}@media(hover:hover) and (pointer:fine){.result-action .result-feedback-link:hover{background:var(--so-raised)}}.so-sr-only{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}.verdict{margin:.5rem 0 .75rem}.verdict-chips{display:flex;flex-wrap:wrap;gap:.4rem;list-style:none;padding:0;margin:0}.verdict-chip{display:inline-flex;align-items:center;gap:.3rem;min-height:1.75rem;padding:.2rem .65rem;border-radius:999px;font-size:.8125rem;font-weight:600;background:var(--so-neutral-soft);color:var(--so-neutral-ink)}.verdict-chip svg{width:.9rem;height:.9rem}.verdict-chip--success{background:var(--so-success-soft);color:var(--so-success)}.verdict-chip--danger{background:var(--so-danger-soft);color:var(--so-danger)}.verdict-chip--warning{background:var(--so-warning-soft);color:var(--so-warning)}.verdict-chip--info{background:var(--so-info-soft);color:var(--so-info)}.verdict-by{margin:.4rem 0 0}details.result-request-open{margin:.5rem 0}details.result-request-open>summary{display:inline-flex;align-items:center;min-height:2.5rem;padding:.5rem 1rem;border:1px solid var(--so-input-line);border-radius:.5rem;background:var(--so-paper);color:var(--so-ink);font-weight:600;cursor:pointer;list-style:none}details.result-request-open>summary::-webkit-details-marker{display:none}details.result-request-open[open]>summary{margin-bottom:.75rem}.settings-tiles{display:grid;gap:1.25rem;margin:0 0 2rem}.settings-tiles h2{margin:0 0 .5rem;font-size:.875rem;font-weight:600;color:var(--so-muted)}.settings-tiles section>div{display:grid;grid-template-columns:repeat(auto-fill,minmax(8.5rem,1fr));gap:.5rem}.settings-tiles a>span{display:grid;gap:.1rem;min-width:0}.settings-tiles .provider-status{font-weight:400;font-size:.8125rem}.settings-tiles a{display:flex;align-items:center;gap:.6rem;min-height:3rem;padding:.65rem .8rem;border:1px solid var(--so-line);border-radius:.625rem;background:var(--so-paper);color:var(--so-ink);text-decoration:none;font-weight:550;font-size:.875rem}@media(hover:hover) and (pointer:fine){.settings-tiles a:hover{border-color:var(--so-input-line);background:var(--so-raised)}}.settings-tiles a>svg{width:1.1rem;height:1.1rem;flex-shrink:0;color:var(--so-accent-text)}details.settings-more{margin:.25rem 0 1.25rem}details.settings-more>summary{cursor:pointer;min-height:2.75rem;display:list-item;padding-block:.7rem;font-weight:550}details.settings-more>summary .meta{font-weight:400;margin-left:.35rem}.settings-changed{margin-top:-.25rem}.appearance{margin:0 0 28px}.appearance h2{margin:0 0 10px}.theme-switch{display:inline-flex;flex-wrap:nowrap;max-width:100%;gap:4px;padding:4px;margin:0;border:1px solid var(--so-line);border-radius:10px;background:var(--so-raised)}.theme-switch .theme-choice,.so-native-region .theme-switch .theme-choice{flex:1 1 0;width:auto;white-space:nowrap;min-height:40px;padding:8px 16px;border:0;border-radius:7px;background:transparent;color:var(--so-muted);font:inherit;font-weight:550;box-shadow:none;cursor:pointer}@media(hover:hover) and (pointer:fine){.theme-switch .theme-choice:hover{color:var(--so-ink)}}.theme-switch .theme-choice[aria-pressed=\"true\"]{background:var(--so-paper);color:var(--so-ink);box-shadow:0 1px 2px rgb(0 0 0 / .1)}.appearance .meta{margin:8px 0 0}@media(max-width:600px){.theme-switch .theme-choice{min-height:44px}}.update-notes{white-space:pre-wrap;overflow-wrap:anywhere;font:inherit;max-height:18rem;overflow:auto}";
+/** The page CSS this module writes itself (not the imported modules'), for the stylesheet contract tests. */
+export declare const PAGE_CSS: string;
+/** The Inbox tabs (console v2): a segmented track of real links; the dot marks a tab with something new, on phones only. */
+export declare const INBOX_TABS_CSS: string;
+export declare const WORKSPACE_STYLE: {
+    path: string;
+    serve(request: import("node:http").IncomingMessage, response: ServerResponse): void;
+};
+/** Everything the sidebar needs to draw itself for one request. */
+export type Chrome = {
+    projectScoped?: boolean;
+    active: "code" | "inbox" | "board" | "queue" | "fleet" | "workbench" | "work" | "done" | "activity" | "review" | "system" | "tasks" | "runs" | "caps" | "recipes" | "projects" | "flows" | "settings" | "chat" | "people" | "ledger" | "spend" | "mode" | "menu" | "none";
+    project: string | null;
+    /** The surface's scope for the scope bar — which rows this screen can
+     * show. Derived from the ROUTE, not the session: portfolio and fleet are
+     * all-project even while a project is open; the board says which of its
+     * two modes it is in. Absent = the session default (open project, else
+     * all projects). Display only — switching stays POST + CSRF. */
+    scope?: "all" | "project" | "board-all";
+    /** The saturated inbox count — never a sum of unbounded list reads. */
+    inboxCount: number;
+    /** The project the Tasks count covers: the request's own project view
+     * (the open project, or /work's ?project=), null for every admitted project. */
+    inboxProject?: string | null;
+    /** The Tasks badge's words, naming what it covers: "3 need you in shop". */
+    inboxLabel?: string;
+    inboxSaturated: boolean;
+    settings: boolean;
+    /** This database is a demo sandbox: banner every page, spend fenced. */
+    demo?: boolean;
+    /** The active operating mode's banner (M1): rides every page scoped to
+     * a repo with a live mode — a signed posture is never invisible. */
+    modeBanner?: {
+        words: string;
+        name: string;
+    };
+    /** Providers whose sign-in stopped working: every page says so, once. */
+    signIn?: BrowserSignIn[];
+    /** A newer Toolroll: a quiet notice for an operator until they dismiss this version. */
+    update?: BrowserUpdateNotice;
+    /** An update waiting on something, what, and the action that clears it: every page, for an operator. */
+    updateWaiting?: {
+        words: string;
+    };
+    /** The chat tab renders only where chat could ever be allowed. */
+    chat?: boolean;
+    code?: boolean;
+    /** A rendered list pane makes the page master-detail. */
+    listPane?: Html;
+    /** A compact pulse for the currently open workspace. Null in the
+     * cross-workspace view; absent only when the store could not answer. */
+    projectPeek?: ProjectPeek | null;
+    /** The switcher (board pass): every enrolled project inside the ceiling,
+     * most recently opened first — the one-tap switch on any screen. */
+    projects?: {
+        path: string;
+        name: string;
+    }[];
+    /** The session's csrf token, for the switcher's forms; "" when the
+     * request has no cookie session (bearer), which renders the switcher
+     * inert. */
+    csrf?: string;
+    /** Where a switch made on this screen returns to. */
+    returnTo?: string;
+};
+/**
+ * A server-rendered region that stays current: when the page's live stream
+ * says something changed (GET /live, live-bus.ts), fetch this page's own
+ * fragment and swap it in place — no flicker, no scroll reset. Inside the
+ * workspace the page's one stream is already open (browser/live.ts) and
+ * announces each event on `window`; a page without it opens its own stream
+ * to the workspace room. A redirect or auth failure navigates to /login
+ * instead of ever inserting the login page into the region (finding 4). The
+ * swapped markup is this server's own rendering of the same route — escaped
+ * at the sink like every page, fetched same-origin — and the nonce'd CSP
+ * refuses to execute anything the region could smuggle. Nothing reads on a timer.
+ */
+export declare function regionScript(regionId: string, fragmentName: string, path?: string): string;
+/**
+ * The live transcript's DEDICATED poller (arc 1 §4): a JSON byte-offset
+ * protocol, not an HTML fragment — the response is raw sanitized text and
+ * the ONLY sink is textContent, so nothing here can become markup. One
+ * request in flight, visibility-paused, stops on `final`, and a `replaced`
+ * answer restarts from zero with a visible line — never a silent re-read.
+ */
+export declare function transcriptScript(path?: string, elementId?: string): string;
+/**
+ * The chrome layer: the jump palette and elapsed tickers. Pure
+ * navigation — no key ever posts, so the palette cannot approve anything;
+ * ceremonies stay POST + password + CSRF, untouched. Reads its index from
+ * a non-executable JSON script tag rendered by the same authorized page.
+ */
+/** The rail's presentation-only state is safe beside a password ceremony:
+ * it never reads a field or sends a request, and keeps the chat collapsible
+ * from its very first screen while the palette and global keys remain absent. */
+export declare function sidebarScript(): string;
+export declare function chromeScript(): string;
+/**
+ * A page described, not yet rendered (arc 4): every chromed HTML route
+ * returns one of these and ONE helper (sendScreen, inside the server)
+ * owns the nonce, the palette index, the shortcuts overlay, script
+ * composition, and the CSP. Renderers stopped calling shell() themselves
+ * so those five things cannot drift apart per route.
+ */
+export type Screen = {
+    title: string;
+    body: Html;
+    chrome?: Chrome;
+    /** The page's own executable behavior (a region poller, the push
+     * enrollment script). fetches: true when it calls fetch — connect-src
+     * is granted only then. */
+    functional?: {
+        script: string;
+        fetches?: boolean;
+    };
+    refreshSeconds?: number;
+    /** Render sensitive even when no password field is visible — one-time
+     * secrets and judgment calls the classifier cannot see. */
+    forceSensitive?: boolean;
+    /** Structured conversation; complex guarded forms stay native islands. */
+    workspace?: Partial<Pick<BrowserWorkspace, 'conversation' | 'team' | 'focus' | 'result' | 'notices' | 'view' | 'firstRun' | 'phone' | 'home'>> & {
+        /** Markup the workspace shows in place; it becomes bytes where the page's JSON is written (sendScreen). */
+        catchUpHtml?: Html;
+        controlsHtml?: Html;
+        pageHtml?: Html | null;
+    };
+};
+export declare const ROLE_TITLES: Record<"plan" | "build" | "review" | "repair", string>;
+export declare function screen(title: string, body: Html, options?: Omit<Screen, "title" | "body">): Screen;
+/**
+ * The sensitivity classifier (arc 4, findings 3/17): a body showing a
+ * password input renders WITHOUT the chrome additions (palette, overlay,
+ * global keys) — the page's own functional script still ships. Tolerant
+ * of quoting, casing, and whitespace; `data-type="password"` and prose
+ * mentioning passwords do not match. This is defense-in-depth over a
+ * file whose only HTML producer is its own double-quoted template
+ * convention — forceSensitive is the escape hatch for what a regex
+ * cannot judge.
+ */
+export declare const SENSITIVE_INPUT: RegExp;
+/** The design contract every page carries (impeccable direction, 2026-09-27). */
+export declare const DESIGN_CONTRACT: Html;
+/** The shortcuts overlay: display-only, toggled by the chrome layer,
+ * absent from sensitive pages. Navigation help in plain words — no key
+ * ever posts. */
+export declare const KBD_HELP: Html;
+export declare function shell(title: string, body: Html, options?: {
+    nav?: boolean;
+    chrome?: Chrome;
+    /** A password ceremony is on this page: the chrome gains no forms, so
+     * the switcher renders inert — the name, and the one /projects link. */
+    sensitive?: boolean;
+    /** Whether the presentation-only desktop rail control has a nonce'd
+     * handler. Sensitive pages may opt in; one-time-secret pages do not. */
+    sidebarToggle?: boolean;
+    refreshSeconds?: number;
+    /** The page's one nonce'd script: region pollers + the chrome layer,
+     * composed by sendScreen. Read-only regions only; one nonce per
+     * response. fallbackRefresh marks a page whose script POLLS — only
+     * those earn the noscript meta-refresh (a chrome-layer-only page with
+     * forms must never re-render what someone was typing). */
+    live?: {
+        nonce: string;
+        script: string;
+        fallbackRefresh?: boolean;
+    };
+}): Html;
+/** ONE way a person is named on any surface (U3): the same chip everywhere. */
+export declare function personChip(name: string): Html;
+/** The brand, as the workspace sidebar shows it. */
+export declare const BRAND_HTML: Html;
+/** A page on its own, in the workspace's look but with no script: the brand, then the page. */
+export declare function focusDocument(title: string, body: Html): Html;
+export declare function chatMoney(microusd: number | null): string;
+export declare function relativeAge(iso: string, now: Date): string;
+/** The project chip every all-scope row wears: null is UNPLACED, said so. */
+export declare function projectChip(repo: string | null | undefined): Html;
+/**
+ * Creating work is the product's first verb, so it gets a whole calm page:
+ * a title, the goal that becomes the scope draft, and the project it lands
+ * in — then straight to the approve card, which is the aha the flow serves.
+ */
+/** One queue card. Taken work renders pinned — visible, never draggable. */
+/** The person's pinned theme from their own cookie; null follows the device. */
+export declare function pinnedTheme(cookieHeader: string | undefined): "light" | "dark" | null;
+export declare function themeAttribute(): Html;
+/** A chosen accent (Settings → Appearance) re-pigments the signal tokens only, after the shared stylesheet. */
+export declare function accentHead(): Html;
+/** Drawn, one stroke weight, like the tab bar's icons — never a glyph. */
+export declare const GRIP_ICON: Html;
+export declare const TO_FRONT_ICON: Html;
+/** One stroke weight, from the tab bar's set: the sidebar's primary rows
+ * wear an icon each; the foot's list stays text, the way Linear's does. */
+export declare const strokeIcon: (paths: Html | string) => Html;
+/** Where the queue lives now: the board, flipped to dispatch order. */
+export declare const QUEUE_VIEW = "/board?view=order";
+export declare const FOLDER_PATHS: Html;
+export declare const CHAT_PATHS: Html;
+export declare const WORK_PATHS: Html;
+export declare const NAV_ICONS: Partial<Record<Chrome["active"], Html>>;
+/** One grouped destination inside an accordion group or the /menu overflow. */
+export type NavRow = {
+    key: Chrome["active"];
+    href: string;
+    label: string;
+    hint: string;
+};
+/**
+ * The workspace shell (package 1): three primary rows (chat, work,
+ * projects) above two accordion groups. Work tools is where work is
+ * arranged, planned, and scheduled — the board, its order view, the
+ * flat task list, recipes, the portfolio, and the action
+ * ledger. Settings is who and what the fleet runs on — fleet,
+ * requirements, people, operating mode, system — plus the agent-defaults
+ * page where the console offers it. Both draw from the same two lists on
+ * a desk (accordion groups) and on a phone (/menu sections), so the two
+ * never disagree, and a project-scoped login sees exactly the rows it
+ * saw before: moving a link never widens role or project visibility.
+ */
+export declare function workToolRows(scoped?: boolean, _offersChat?: boolean, offersCode?: boolean): NavRow[];
+export declare function settingsRows(scoped?: boolean, offersSettings?: boolean): NavRow[];
+/** Which accordion group opens by default for a given active page. */
+export declare const TOOL_KEYS: Set<"activity" | "board" | "caps" | "chat" | "code" | "done" | "fleet" | "flows" | "inbox" | "ledger" | "menu" | "mode" | "none" | "people" | "projects" | "queue" | "recipes" | "review" | "runs" | "settings" | "spend" | "system" | "tasks" | "work" | "workbench">;
+export declare const SETTINGS_KEYS: Set<"activity" | "board" | "caps" | "chat" | "code" | "done" | "fleet" | "flows" | "inbox" | "ledger" | "menu" | "mode" | "none" | "people" | "projects" | "queue" | "recipes" | "review" | "runs" | "settings" | "spend" | "system" | "tasks" | "work" | "workbench">;
+/** The builds screen's views (reduction pass §1): done, the review queue,
+ * and activity are ways of looking at builds, not destinations. */
+export declare function buildsViews(current: "builds" | "done" | "review" | "activity"): Html;
+export declare const CHEVRON_ICON: Html;
+/** The drag grip: a 2rem touch-sized handle that owns its touches
+ * (touch-action: none), so a finger on it drags instead of scrolling. */
+export declare const GRIP_HANDLE: Html;
+/** Badges, labels and buttons read in sentence case, whatever word a record stores. */
+export declare const sentenceCase: (word: string) => string;
+/** Only an https github.com pull URL earns an anchor (audit IV-11) — a
+ * corrupted row renders as text, never as navigation. */
+export declare function safePrUrl(url: string | null): string | null;
+/** A shortened fingerprint for display — enough to compare by eye; the
+ * full value rides in the title attribute and in every form field. */
+export declare function shortDigest(digest: string): Html;
+/** One display line, bounded — turn text is data, never layout. */
+export declare function oneLineOf(text: string, cap: number): string;