@agentxm/extension-resolution 0.28.14-preview.1789139351.5cd4595aa

package/dist/src/pack-dependency-resolution.js

@@ -0,0 +1,422 @@
+/**
+ * Pack dependency resolution: every declared member resolved to one exact
+ * identity under the pack's constraints, workspace authority, and the
+ * minimum-release-age policy.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as semver from "semver";
+import { formatFqn, parseFqnOrThrow, toExtensionTypePlural, } from "@agentxm/extension-model/unstable/extensions";
+import { PackConstraintShadowed, PackDependencyConflict, PackDependencyInvalid, PackDependencyMissing, PackDependencyUnsatisfied, SourceAuthorityBlocked, } from "./errors.js";
+import { releaseAgeExemptionForIdentity } from "./release-age-policy.js";
+const validateSelectedDependency = (candidate, expectedType, parsed, fqn, constraint) => {
+    if (candidate.type !== expectedType ||
+        (candidate.refType !== "registry" && candidate.refType !== "workspace") ||
+        candidate.owner !== parsed.owner ||
+        candidate.name !== parsed.name) {
+        return new PackDependencyConflict({
+            detail: `Authorized dependency resolution does not match pack dependency ${fqn}`,
+        });
+    }
+    if (!semver.satisfies(candidate.version, constraint)) {
+        return new PackDependencyConflict({
+            detail: `Authorized dependency ${fqn}@${candidate.version} does not satisfy ${constraint}`,
+        });
+    }
+    return Effect.succeed({
+        owner: parsed.owner,
+        type: expectedType,
+        name: parsed.name,
+        ref: candidate,
+    });
+};
+const registrySourceForDependency = (pack, owner, sourceOverride) => {
+    const source = sourceOverride ?? (pack.source.type === "registry" ? pack.source : undefined);
+    if (source === undefined) {
+        return Effect.fail(new PackDependencyInvalid({
+            detail: `Cannot resolve pack dependencies from non-registry source`,
+        }));
+    }
+    return Effect.succeed({
+        ...source,
+        owner: Option.some(owner),
+    });
+};
+const workspaceConstraintConflict = (pack, memberFqn, workspaceVersion, constraint) => new PackConstraintShadowed({
+    packSource: pack.source.type === "workspace" ? "workspace" : "registry",
+    packFqn: formatFqn({ owner: pack.owner, type: "pack", name: pack.pack.name }),
+    memberFqn,
+    constraint,
+    workspaceVersion,
+});
+const resolveDependencyRef = (pack, expectedType, fqn, constraint, sources, minimumReleaseAge, sourceOverride, workspaceResolver, dependencyResolver) => Effect.gen(function* () {
+    const parsed = parseFqnOrThrow(fqn);
+    if (parsed.type !== expectedType) {
+        return yield* new PackDependencyInvalid({
+            detail: `Pack dependency type mismatch for expected ${expectedType}`,
+        });
+    }
+    if (workspaceResolver !== undefined) {
+        const workspace = yield* workspaceResolver({
+            owner: parsed.owner,
+            type: expectedType,
+            name: parsed.name,
+            constraint,
+            root: formatFqn({ owner: pack.owner, type: "pack", name: pack.pack.name }),
+        });
+        if (workspace.kind === "blocked") {
+            return yield* new SourceAuthorityBlocked({
+                detail: workspace.fact.detail,
+                recovery: workspace.fact.recovery,
+            });
+        }
+        if (workspace.kind === "selected") {
+            const candidate = workspace.ref;
+            if (candidate.type !== expectedType ||
+                candidate.refType !== "workspace" ||
+                candidate.owner !== parsed.owner ||
+                candidate.name !== parsed.name) {
+                return yield* new PackDependencyConflict({
+                    detail: `Configured workspace authority does not match pack dependency ${fqn}`,
+                });
+            }
+            if (!semver.satisfies(candidate.version, constraint)) {
+                return yield* workspaceConstraintConflict(pack, fqn, candidate.version, constraint);
+            }
+            return {
+                owner: parsed.owner,
+                type: expectedType,
+                name: parsed.name,
+                ref: candidate,
+            };
+        }
+    }
+    if (dependencyResolver !== undefined) {
+        const candidate = yield* dependencyResolver({
+            owner: parsed.owner,
+            type: expectedType,
+            name: parsed.name,
+            constraint,
+            root: formatFqn({ owner: pack.owner, type: "pack", name: pack.pack.name }),
+        });
+        return yield* validateSelectedDependency(candidate, expectedType, parsed, fqn, constraint);
+    }
+    const source = yield* registrySourceForDependency(pack, parsed.owner, sourceOverride);
+    const matches = yield* Effect.scoped(sources.find(source, {
+        names: [parsed.name],
+        type: expectedType,
+        owner: Option.some(parsed.owner),
+        versionRange: Option.some(constraint),
+        ...(minimumReleaseAge === undefined ? {} : { minimumReleaseAge }),
+    }));
+    const matchingRef = matches.find((candidate) => candidate.type === expectedType &&
+        candidate.refType === "registry" &&
+        candidate.owner === parsed.owner &&
+        candidate.name === parsed.name);
+    if (matchingRef === undefined) {
+        return yield* new PackDependencyInvalid({
+            detail: `Unable to resolve pack dependency ${fqn}@${constraint}`,
+        });
+    }
+    return {
+        owner: parsed.owner,
+        type: expectedType,
+        name: parsed.name,
+        ref: matchingRef,
+    };
+});
+const dependencyReleaseAgeRecord = (args) => ({
+    reason: "minimum-release-age",
+    target: args.dependencyTarget,
+    dependencyPath: [args.packTarget, args.dependencyTarget],
+    requestedRange: args.constraint,
+    ...(args.selectedVersion === undefined ? {} : { selectedVersion: args.selectedVersion }),
+    candidateVersion: args.evidence.version,
+    publishedAt: args.evidence.publishedAt,
+    eligibleAt: args.evidence.eligibleAt,
+    minimumReleaseAgeSeconds: args.evidence.minimumReleaseAgeSeconds,
+});
+const resolveDependencyRefWithReleaseAge = (pack, expectedType, fqn, constraint, sources, evaluation, sourceOverride, workspaceResolver, dependencyResolver) => Effect.gen(function* () {
+    const parsed = parseFqnOrThrow(fqn);
+    if (parsed.type !== expectedType) {
+        return yield* new PackDependencyInvalid({
+            detail: `Pack dependency type mismatch for expected ${expectedType}`,
+        });
+    }
+    if (workspaceResolver !== undefined) {
+        const workspace = yield* workspaceResolver({
+            owner: parsed.owner,
+            type: expectedType,
+            name: parsed.name,
+            constraint,
+            root: formatFqn({ owner: pack.owner, type: "pack", name: pack.pack.name }),
+        });
+        if (workspace.kind === "blocked") {
+            return yield* new SourceAuthorityBlocked({
+                detail: workspace.fact.detail,
+                recovery: workspace.fact.recovery,
+            });
+        }
+        if (workspace.kind === "selected") {
+            const candidate = workspace.ref;
+            if (candidate.type !== expectedType ||
+                candidate.refType !== "workspace" ||
+                candidate.owner !== parsed.owner ||
+                candidate.name !== parsed.name) {
+                return yield* new PackDependencyConflict({
+                    detail: `Configured workspace authority does not match pack dependency ${fqn}`,
+                });
+            }
+            if (!semver.satisfies(candidate.version, constraint)) {
+                return yield* workspaceConstraintConflict(pack, fqn, candidate.version, constraint);
+            }
+            return {
+                kind: "selected",
+                dependency: {
+                    owner: parsed.owner,
+                    type: expectedType,
+                    name: parsed.name,
+                    ref: candidate,
+                },
+                holdbacks: [],
+                bypasses: [],
+            };
+        }
+    }
+    if (dependencyResolver !== undefined) {
+        const candidate = yield* dependencyResolver({
+            owner: parsed.owner,
+            type: expectedType,
+            name: parsed.name,
+            constraint,
+            root: formatFqn({ owner: pack.owner, type: "pack", name: pack.pack.name }),
+        });
+        return {
+            kind: "selected",
+            dependency: yield* validateSelectedDependency(candidate, expectedType, parsed, fqn, constraint),
+            holdbacks: [],
+            bypasses: [],
+        };
+    }
+    const source = yield* registrySourceForDependency(pack, parsed.owner, sourceOverride);
+    const resolution = yield* Effect.scoped(sources.resolveNamedRegistry(source, {
+        name: parsed.name,
+        type: expectedType,
+        owner: parsed.owner,
+        versionRange: Option.some(constraint),
+        releaseAgeEvaluation: evaluation,
+    }));
+    const packTarget = formatFqn({ owner: pack.owner, type: "pack", name: pack.pack.name });
+    const dependencyTarget = formatFqn(parsed);
+    if (resolution.kind === "not_found") {
+        return yield* new PackDependencyMissing({ dependencyTarget });
+    }
+    if (resolution.kind === "version_unsatisfied") {
+        return yield* new PackDependencyUnsatisfied({ dependencyTarget, constraint });
+    }
+    if (resolution.kind === "policy_held") {
+        return {
+            kind: "policy_held",
+            holdback: dependencyReleaseAgeRecord({
+                packTarget,
+                dependencyTarget,
+                constraint,
+                evidence: resolution.candidate,
+            }),
+        };
+    }
+    const ref = resolution.ref;
+    return {
+        kind: "selected",
+        dependency: {
+            owner: parsed.owner,
+            type: expectedType,
+            name: parsed.name,
+            ref,
+        },
+        holdbacks: resolution.kind === "exempted" || resolution.newerHeld === undefined
+            ? []
+            : [
+                dependencyReleaseAgeRecord({
+                    packTarget,
+                    dependencyTarget,
+                    constraint,
+                    evidence: resolution.newerHeld,
+                    selectedVersion: ref.version,
+                }),
+            ],
+        bypasses: resolution.kind === "selected"
+            ? []
+            : [
+                {
+                    ...dependencyReleaseAgeRecord({
+                        packTarget,
+                        dependencyTarget,
+                        constraint,
+                        evidence: resolution.bypassed,
+                        selectedVersion: ref.version,
+                    }),
+                    ...resolution.exemption,
+                },
+            ],
+    };
+});
+const toResolvedMap = (dependencies) => Object.fromEntries(dependencies.map((dependency) => {
+    const ref = dependency.ref;
+    return [
+        formatFqn(dependency),
+        ref.refType === "registry"
+            ? {
+                source: "registry",
+                version: ref.version,
+                publisherBindingId: ref.publisherBindingId,
+                integrity: Option.getOrElse(ref.integrity, () => ""),
+            }
+            : {
+                source: "workspace",
+                version: ref.version,
+                sourceIdentity: `workspace:${ref.owner}/${toExtensionTypePlural(ref.type)}/${ref.name}`,
+                contentIdentity: ref.sourceHash,
+            },
+    ];
+}));
+const resolveDependencyGroup = (pack, dependencies, expectedType, sources, minimumReleaseAge, sourceOverride, workspaceResolver, dependencyResolver) => Effect.forEach(dependencies, ([fqn, constraint]) => resolveDependencyRef(pack, expectedType, fqn, constraint, sources, minimumReleaseAge, sourceOverride, workspaceResolver, dependencyResolver), { concurrency: "unbounded" });
+/**
+ * Group dependency FQNs by extension type.
+ *
+ * The `groups` record is keyed by every non-pack extension type, so a new type
+ * fails compile here rather than being silently dropped from pack membership.
+ */
+const partitionDependencies = (dependencies) => {
+    const groups = {
+        skill: [],
+        "mcp-server": [],
+        subagent: [],
+        rule: [],
+        hook: [],
+        knowledge: [],
+    };
+    const unsupported = [];
+    for (const [fqn, constraint] of Object.entries(dependencies)) {
+        const parsed = parseFqnOrThrow(fqn);
+        if (parsed.type === "pack") {
+            unsupported.push(fqn);
+            continue;
+        }
+        groups[parsed.type].push([fqn, constraint]);
+    }
+    return { groups, unsupported };
+};
+export const resolvePackDependencies = (pack, sources, minimumReleaseAge, sourceOverride, workspaceResolver, dependencyResolver) => Effect.gen(function* () {
+    const dependencies = partitionDependencies(pack.pack.dependencies);
+    if (dependencies.unsupported.length > 0) {
+        return yield* new PackDependencyInvalid({
+            detail: `Pack declares ${dependencies.unsupported.length} unsupported dependency type${dependencies.unsupported.length === 1 ? "" : "s"}: ${dependencies.unsupported.join(", ")}`,
+        });
+    }
+    const resolveGroup = (type) => resolveDependencyGroup(pack, dependencies.groups[type], type, sources, minimumReleaseAge, sourceOverride, workspaceResolver, dependencyResolver);
+    const resolvedSkills = yield* resolveGroup("skill");
+    const resolvedMcpServers = yield* resolveGroup("mcp-server");
+    const resolvedSubagents = yield* resolveGroup("subagent");
+    const resolvedRules = yield* resolveGroup("rule");
+    const resolvedHooks = yield* resolveGroup("hook");
+    const resolvedKnowledge = yield* resolveGroup("knowledge");
+    return {
+        resolvedSkills: toResolvedMap(resolvedSkills),
+        resolvedMcpServers: toResolvedMap(resolvedMcpServers),
+        resolvedSubagents: toResolvedMap(resolvedSubagents),
+        resolvedRules: toResolvedMap(resolvedRules),
+        resolvedHooks: toResolvedMap(resolvedHooks),
+        resolvedKnowledge: toResolvedMap(resolvedKnowledge),
+        dependencyRefs: [
+            ...resolvedSkills,
+            ...resolvedMcpServers,
+            ...resolvedSubagents,
+            ...resolvedRules,
+            ...resolvedHooks,
+            ...resolvedKnowledge,
+        ].map((dependency) => dependency.ref),
+    };
+});
+export const resolvePackDependenciesWithReleaseAge = (pack, sources, evaluation, sourceOverride, workspaceResolver, dependencyResolver) => Effect.gen(function* () {
+    const packExemption = pack.refType === "registry"
+        ? releaseAgeExemptionForIdentity(evaluation, {
+            owner: pack.owner,
+            type: "pack",
+            name: pack.pack.name,
+        })
+        : undefined;
+    const dependencyEvaluation = packExemption?.bypassCause === "exclude"
+        ? { ...evaluation, grantedExemption: packExemption }
+        : evaluation;
+    const dependencies = partitionDependencies(pack.pack.dependencies);
+    if (dependencies.unsupported.length > 0) {
+        return yield* new PackDependencyInvalid({
+            detail: `Pack declares ${dependencies.unsupported.length} unsupported dependency type${dependencies.unsupported.length === 1 ? "" : "s"}: ${dependencies.unsupported.join(", ")}`,
+        });
+    }
+    const entries = [
+        ...dependencies.groups.skill.map(([fqn, constraint]) => ({
+            type: "skill",
+            fqn,
+            constraint,
+        })),
+        ...dependencies.groups["mcp-server"].map(([fqn, constraint]) => ({
+            type: "mcp-server",
+            fqn,
+            constraint,
+        })),
+        ...dependencies.groups.subagent.map(([fqn, constraint]) => ({
+            type: "subagent",
+            fqn,
+            constraint,
+        })),
+        ...dependencies.groups.rule.map(([fqn, constraint]) => ({
+            type: "rule",
+            fqn,
+            constraint,
+        })),
+        ...dependencies.groups.hook.map(([fqn, constraint]) => ({
+            type: "hook",
+            fqn,
+            constraint,
+        })),
+        ...dependencies.groups.knowledge.map(([fqn, constraint]) => ({
+            type: "knowledge",
+            fqn,
+            constraint,
+        })),
+    ];
+    const resolutions = yield* Effect.forEach(entries, ({ type, fqn, constraint }) => resolveDependencyRefWithReleaseAge(pack, type, fqn, constraint, sources, dependencyEvaluation, sourceOverride, workspaceResolver, dependencyResolver), { concurrency: "unbounded" });
+    const holdbacks = resolutions.flatMap((resolution) => resolution.kind === "policy_held" ? [resolution.holdback] : resolution.holdbacks);
+    const bypasses = resolutions.flatMap((resolution) => resolution.kind === "selected" ? resolution.bypasses : []);
+    if (resolutions.some((resolution) => resolution.kind === "policy_held")) {
+        return { kind: "policy_held", holdbacks, bypasses };
+    }
+    const selected = resolutions.flatMap((resolution) => resolution.kind === "selected" ? [resolution.dependency] : []);
+    const byType = (type) => selected.filter((dependency) => dependency.type === type);
+    const resolvedSkills = byType("skill");
+    const resolvedMcpServers = byType("mcp-server");
+    const resolvedSubagents = byType("subagent");
+    const resolvedRules = byType("rule");
+    const resolvedHooks = byType("hook");
+    const resolvedKnowledge = byType("knowledge");
+    return {
+        kind: "selected",
+        holdbacks,
+        bypasses,
+        dependencies: {
+            resolvedSkills: toResolvedMap(resolvedSkills),
+            resolvedMcpServers: toResolvedMap(resolvedMcpServers),
+            resolvedSubagents: toResolvedMap(resolvedSubagents),
+            resolvedRules: toResolvedMap(resolvedRules),
+            resolvedHooks: toResolvedMap(resolvedHooks),
+            resolvedKnowledge: toResolvedMap(resolvedKnowledge),
+            dependencyRefs: selected.map((dependency) => dependency.ref),
+        },
+    };
+});
+//# sourceMappingURL=pack-dependency-resolution.js.map

package/dist/src/publisher-binding.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Publisher binding trust classification.
+ *
+ * A Registry resolution binds a publisher identity. When an operation
+ * proposes to replace an already accepted binding for the same configured
+ * extension with a different one, that transition is a trust decision a
+ * person makes at a prompt: no flag and no unattended mode can approve it.
+ * Every route that can replace an accepted binding — root and type update
+ * forms, reinstall and re-resolution, and pack closures — classifies the
+ * transition from the structured accepted and proposed identities here, so
+ * the same rule holds everywhere the transition can occur.
+ *
+ * A first acceptance is not a change, and an integrity mismatch while
+ * reacquiring the same accepted identity remains a hard failure elsewhere.
+ *
+ * Classification is all this module does: shaping the resulting plan risk
+ * condition belongs to the feature that owns the plan.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Option from "effect/Option";
+import type { ExtensionRef } from "@agentxm/extension-model/unstable/extensions/refs/extension-ref";
+import type { ExtensionType } from "@agentxm/extension-model/unstable/extensions";
+/**
+ * The Registry identity a step proposes to accept. Trust classification
+ * compares it with the accepted resolution for the same configured target,
+ * so a change of publisher is identified from structured data rather than
+ * from warning text.
+ */
+export interface RegistryBindingProposal {
+    readonly extensionType: ExtensionType;
+    /** The configured (local) name whose accepted resolution the step replaces. */
+    readonly target: string;
+    readonly owner: string;
+    readonly packageName: string;
+    readonly version: string;
+    readonly publisherBindingId: string;
+}
+export interface PublisherBindingTransition {
+    readonly extensionType: ExtensionType;
+    /** The configured (local) name whose accepted resolution changes publisher. */
+    readonly target: string;
+    readonly owner: string;
+    readonly packageName: string;
+    /** The accepted publisher binding being replaced. */
+    readonly accepted: string;
+    /** The publisher binding the operation proposes to accept. */
+    readonly proposed: string;
+}
+/** The structured proposal an extension ref makes, when it is a Registry ref. */
+export declare const registryBindingProposal: (ref: ExtensionRef) => RegistryBindingProposal | undefined;
+/**
+ * Classify one proposed acceptance against the accepted resolution for the
+ * same configured target. Only a Registry binding replacing a different
+ * Registry binding is a publisher change.
+ */
+export declare const classifyPublisherBindingTransition: (args: {
+    readonly accepted: Option.Option<ExtensionRef>;
+    readonly proposed: RegistryBindingProposal;
+}) => Option.Option<PublisherBindingTransition>;
+/** The identity sentence a transition names in operator-facing wording. */
+export declare const describePublisherBindingTransition: (transition: PublisherBindingTransition) => string;
+/** The warning a step carries when its acceptance changes publisher. */
+export declare const publisherTransitionWarning: (transition: PublisherBindingTransition) => string;
+//# sourceMappingURL=publisher-binding.d.ts.map

package/dist/src/publisher-binding.js

@@ -0,0 +1,75 @@
+/**
+ * Publisher binding trust classification.
+ *
+ * A Registry resolution binds a publisher identity. When an operation
+ * proposes to replace an already accepted binding for the same configured
+ * extension with a different one, that transition is a trust decision a
+ * person makes at a prompt: no flag and no unattended mode can approve it.
+ * Every route that can replace an accepted binding — root and type update
+ * forms, reinstall and re-resolution, and pack closures — classifies the
+ * transition from the structured accepted and proposed identities here, so
+ * the same rule holds everywhere the transition can occur.
+ *
+ * A first acceptance is not a change, and an integrity mismatch while
+ * reacquiring the same accepted identity remains a hard failure elsewhere.
+ *
+ * Classification is all this module does: shaping the resulting plan risk
+ * condition belongs to the feature that owns the plan.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Option from "effect/Option";
+import { toExtensionTypePlural } from "@agentxm/extension-model/unstable/extensions";
+/** The configured (local) name a ref occupies in workspace settings. */
+const configuredNameFromRef = (ref) => {
+    switch (ref.type) {
+        case "skill":
+            return ref.skill.name;
+        case "pack":
+            return ref.pack.name;
+        case "mcp-server":
+            return ref.server.name;
+        case "subagent":
+            return ref.subagent.name;
+        case "rule":
+            return ref.rule.name;
+        case "hook":
+            return ref.hook.name;
+        case "knowledge":
+            return ref.knowledge.name;
+    }
+};
+/** The structured proposal an extension ref makes, when it is a Registry ref. */
+export const registryBindingProposal = (ref) => ref.refType === "registry"
+    ? {
+        extensionType: ref.type,
+        target: configuredNameFromRef(ref),
+        owner: ref.owner,
+        packageName: ref.name,
+        version: ref.version,
+        publisherBindingId: ref.publisherBindingId,
+    }
+    : undefined;
+/**
+ * Classify one proposed acceptance against the accepted resolution for the
+ * same configured target. Only a Registry binding replacing a different
+ * Registry binding is a publisher change.
+ */
+export const classifyPublisherBindingTransition = (args) => Option.flatMap(args.accepted, (accepted) => accepted.refType === "registry" &&
+    accepted.type === args.proposed.extensionType &&
+    accepted.publisherBindingId !== args.proposed.publisherBindingId
+    ? Option.some({
+        extensionType: args.proposed.extensionType,
+        target: args.proposed.target,
+        owner: args.proposed.owner,
+        packageName: args.proposed.packageName,
+        accepted: accepted.publisherBindingId,
+        proposed: args.proposed.publisherBindingId,
+    })
+    : Option.none());
+/** The identity sentence a transition names in operator-facing wording. */
+export const describePublisherBindingTransition = (transition) => `${transition.owner}/${toExtensionTypePlural(transition.extensionType)}/${transition.packageName}`;
+/** The warning a step carries when its acceptance changes publisher. */
+export const publisherTransitionWarning = (transition) => `Publisher identity changed (${transition.accepted} → ${transition.proposed}); confirm only if you trust the current publisher`;
+//# sourceMappingURL=publisher-binding.js.map

package/dist/src/release-age-policy.d.ts

@@ -0,0 +1,55 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import type { ExtensionFqnParts } from "@agentxm/extension-model/unstable/extensions/common";
+import type { ReleaseAgeEvaluation, ReleaseAgeEvidence, ReleaseAgeExemption } from "@agentxm/extension-model/unstable/extensions/release-age";
+import type { VersionEntry } from "@agentxm/registry-protocol/unstable/registry/schema";
+export declare const releaseAgeExemptionForIdentity: (evaluation: ReleaseAgeEvaluation, identity: ExtensionFqnParts) => ReleaseAgeExemption | undefined;
+export interface ReleaseAgeRecordBase {
+    readonly reason: "minimum-release-age";
+    readonly target: string;
+    readonly dependencyPath: ReadonlyArray<string>;
+    readonly requestedRange?: string;
+    readonly currentVersion?: string;
+    readonly selectedVersion?: string;
+    readonly candidateVersion: string;
+    readonly publishedAt: string;
+    readonly eligibleAt: string;
+    readonly minimumReleaseAgeSeconds: number;
+}
+export type ReleaseAgeHoldbackRecord = ReleaseAgeRecordBase;
+export type ReleaseAgeBypassRecord = ReleaseAgeRecordBase & ({
+    readonly bypassCause: "exclude";
+    readonly exemptionScope: "project" | "user";
+} | {
+    readonly bypassCause: "ignore-flag";
+});
+export type ReleaseAgeRecord = ReleaseAgeHoldbackRecord | ReleaseAgeBypassRecord;
+export interface ReleaseAgeOperationEvidence {
+    readonly evaluatedAt: string;
+    readonly holdbacks: ReadonlyArray<ReleaseAgeHoldbackRecord>;
+    readonly bypasses: ReadonlyArray<ReleaseAgeBypassRecord>;
+}
+/** Deduplicate and order operation evidence independently from concurrent resolution order. */
+export declare const normalizeReleaseAgeRecords: <Record extends ReleaseAgeRecord>(records: ReadonlyArray<Record>) => ReadonlyArray<Record>;
+export declare const parseMinimumReleaseAge: (value: string) => Option.Option<Duration.Duration>;
+/**
+ * Render a release-age window in the compact grammar the setting accepts, so
+ * output names the policy in the same units the reader would configure.
+ *
+ * Days are used only from two days up: the default window is written `24h`,
+ * and reporting it as `1d` would not match the setting the reader would edit.
+ * Falls back to whole seconds when the window is not a clean larger unit.
+ */
+export declare const formatMinimumReleaseAgeSeconds: (seconds: number) => string;
+export declare const isVersionEntryMature: (entry: VersionEntry, minimumAge: Duration.Duration) => Effect.Effect<boolean>;
+export declare const isVersionEntryEligibleAt: (entry: VersionEntry, evaluation: ReleaseAgeEvaluation) => boolean;
+export declare const releaseAgeEvidence: (entry: VersionEntry, evaluation: ReleaseAgeEvaluation) => ReleaseAgeEvidence;
+export declare const filterMatureVersions: (versions: ReadonlyArray<VersionEntry>, minimumAge: Duration.Duration) => Effect.Effect<ReadonlyArray<VersionEntry>>;
+export declare const releaseAgeHoldbackWarning: (args: {
+    readonly fqn: string;
+    readonly selectedVersion: string;
+    readonly heldVersion: string;
+    readonly minimumReleaseAge: string;
+}) => string;
+//# sourceMappingURL=release-age-policy.d.ts.map