@astrale-os/sdk 0.6.0-beta.15 → 0.6.0-beta.17

package/dist/deployment/adapter/adapter.d.ts

@@ -39,8 +39,9 @@ export interface Adapter<Parameters extends object = object> {
     list?(parameters: Parameters, context: ListContext): Promise<readonly ListedDeployment[]>;
     /**
      * Keep one published deployment where the host has no registry principal to mark it (a platform
-     * namespace). Called only after its Publication commits. Absent: the registry marks it (Admin's
-     * Services).
+     * namespace). Called only after its Publication commits. Rejects with a `RetainRefusal` when the
+     * host can no longer keep it (absent or retired), which no rerun changes; any other rejection is
+     * transient. Absent: the registry marks it (Admin's Services).
      */
     retain?(parameters: Parameters, context: RetainContext): Promise<void>;
     /**

package/dist/deployment/adapter/index.d.ts

@@ -1,5 +1,6 @@
 export type { Adapter, AdapterEnvironmentContext, AdapterInput } from './adapter.js';
 export { defineAdapter, defineDeployment, isAdapter } from './define.js';
+export { RetainRefusal } from './release/refusal.js';
 export type * from './bundle/index.js';
 export type * from './release/index.js';
 /** @deprecated The contract before adapter interface v2; see `./legacy/index.ts`. */

package/dist/deployment/adapter/index.js

@@ -1 +1,2 @@
 export { defineAdapter, defineDeployment, isAdapter } from './define.js';
+export { RetainRefusal } from './release/refusal.js';

package/dist/deployment/adapter/release/refusal.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Why the host can no longer keep one published deployment (`Adapter.retain`): it is `absent`
+ * (the host holds no deployment of that label, or it was deleted) or `retired` (withdrawn, never
+ * served again). No rerun keeps it; a new version publishes a new deployment. Any other rejection
+ * of `retain` is transient: once it has passed, a rerun keeps the deployment.
+ */
+export declare class RetainRefusal extends Error {
+    readonly reason: 'absent' | 'retired';
+    constructor(reason: RetainRefusal['reason'], message: string);
+}

package/dist/deployment/adapter/release/refusal.js

@@ -0,0 +1,14 @@
+/**
+ * Why the host can no longer keep one published deployment (`Adapter.retain`): it is `absent`
+ * (the host holds no deployment of that label, or it was deleted) or `retired` (withdrawn, never
+ * served again). No rerun keeps it; a new version publishes a new deployment. Any other rejection
+ * of `retain` is transient: once it has passed, a rerun keeps the deployment.
+ */
+export class RetainRefusal extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'RetainRefusal';
+        this.reason = reason;
+    }
+}

package/dist/deployment/address/summary.d.ts

@@ -30,8 +30,9 @@ export declare const PLATFORM_OWNER = "platform";
  * `summary:<label>` in the routing KV of a platform dispatch namespace (CT20, AM-131): the
  * `DeploymentSummaryV1` of one deployment without its record, which stays at `record:<label>`.
  *
- * Its writers are the deployer (`cloudflare({ namespace })`), which writes it once at activation,
- * before `record:<label>`, then marks it published (`retain`), and the platform retirement tooling
+ * Its writers are the deployer (`cloudflare({ namespace })`), which writes it at activation,
+ * before `record:<label>`, names in it the new key of a script it recreates under the label after
+ * an operator deleted it, and marks it published (`retain`), and the platform retirement tooling
  * (SV6), which records a withdrawal. So it names the deployment by its label (`id` is the label),
  * is owned by `platform`, is `active` until withdrawn, and carries no `lastCallAt` or `expiresAt`:
  * nothing on the platform namespace keeps those clocks, and listings read them from the calls

package/dist/tooling/cli/arguments.d.ts

@@ -1,5 +1,6 @@
 import type { LintReportFormat } from '../linter/index.js';
-export declare const COMMANDS: readonly ['dev', 'build', 'deploy', 'list', 'test', 'lint', 'package', 'upgrade'];
+import { type Version } from '../../platform/versioning/index.js';
+export declare const COMMANDS: readonly ['dev', 'build', 'deploy', 'diff', 'list', 'publish', 'test', 'lint', 'package', 'upgrade', 'yank'];
 export type Command = (typeof COMMANDS)[number];
 export interface ParsedArgs {
     readonly command: Command;
@@ -13,6 +14,13 @@ export interface ParsedArgs {
     readonly channel?: string;
     readonly check?: boolean;
     readonly json?: boolean;
+    /** `yank`: the published version it names. */
+    readonly version?: Version;
+    /** `yank --undo`: restore the version instead of yanking it. */
+    readonly undo?: boolean;
+    readonly allowDirty?: boolean;
+    /** `list`: instances to ask what they run, in argument order. */
+    readonly instances?: readonly string[];
 }
 /** Parse the frozen `astrale-domain` command grammar without performing effects. */
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;

package/dist/tooling/cli/arguments.js

@@ -1,14 +1,18 @@
 import { isAbsolute, normalize } from 'node:path';
+import { acceptVersion } from '../../platform/versioning/index.js';
 import { installCommand } from '../../project/install-command.js';
 export const COMMANDS = [
     'dev',
     'build',
     'deploy',
+    'diff',
     'list',
+    'publish',
     'test',
     'lint',
     'package',
     'upgrade',
+    'yank',
 ];
 /** Parse the frozen `astrale-domain` command grammar without performing effects. */
 export function parseArgs(argv) {
@@ -18,12 +22,15 @@ export function parseArgs(argv) {
     const fix = rest.includes('--fix');
     const deployOnly = rest.includes('--deploy-only');
     const json = rest.includes('--json');
+    const undo = rest.includes('--undo');
+    const allowDirty = rest.includes('--allow-dirty');
     let secretsFile;
     let credentialFile;
     let identity;
     let suite;
     let format;
     let environment;
+    const instances = [];
     const cleaned = [];
     for (let index = 0; index < rest.length; index += 1) {
         const argument = rest[index];
@@ -57,13 +64,24 @@ export function parseArgs(argv) {
         else if (argument.startsWith('--environment=')) {
             environment = requiredValue('--environment', argument.slice('--environment='.length));
         }
+        else if (command === 'list' && argument === '--instance') {
+            // Only `list` asks instances; elsewhere `--instance` stays unknown, as deploy removed it.
+            instances.push(requiredValue('--instance', rest[++index]));
+        }
+        else if (command === 'list' && argument.startsWith('--instance=')) {
+            instances.push(requiredValue('--instance', argument.slice('--instance='.length)));
+        }
         else if (argument === '--suite') {
             suite = requiredValue('--suite', rest[++index]);
         }
         else if (argument.startsWith('--suite=')) {
             suite = requiredValue('--suite', argument.slice('--suite='.length));
         }
-        else if (argument === '--fix' || argument === '--deploy-only' || argument === '--json') {
+        else if (argument === '--fix' ||
+            argument === '--deploy-only' ||
+            argument === '--json' ||
+            argument === '--undo' ||
+            argument === '--allow-dirty') {
             continue;
         }
         else if (argument.startsWith('-')) {
@@ -75,9 +93,20 @@ export function parseArgs(argv) {
     }
     if (fix && command !== 'lint')
         throw new Error('`--fix` is only valid for `lint`.');
-    if (json && command !== 'build' && command !== 'deploy' && command !== 'list') {
-        throw new Error('`--json` is only valid for `build`, `deploy` or `list`.');
+    if (json &&
+        command !== 'build' &&
+        command !== 'deploy' &&
+        command !== 'diff' &&
+        command !== 'list' &&
+        command !== 'publish' &&
+        command !== 'yank') {
+        throw new Error('`--json` is only valid for `build`, `deploy`, `diff`, `list`, `publish` or `yank`.');
     }
+    if (allowDirty && command !== 'publish') {
+        throw new Error('`--allow-dirty` is only valid for `publish`.');
+    }
+    if (undo && command !== 'yank')
+        throw new Error('`--undo` is only valid for `yank`.');
     if (format !== undefined && command !== 'lint') {
         throw new Error('`--format` is only valid for `lint`.');
     }
@@ -89,8 +118,13 @@ export function parseArgs(argv) {
     }
     if (deployOnly && command !== 'dev' && command !== 'deploy')
         refuseDeployOnly(undefined);
-    if (identity !== undefined && command !== 'dev' && command !== 'deploy' && command !== 'list') {
-        throw new Error('`--as` is only valid for `dev`, `deploy` or `list`.');
+    if (identity !== undefined &&
+        command !== 'dev' &&
+        command !== 'deploy' &&
+        command !== 'diff' &&
+        command !== 'list' &&
+        command !== 'publish') {
+        throw new Error('`--as` is only valid for `dev`, `deploy`, `diff`, `list` or `publish`.');
     }
     if (environment !== undefined &&
         command !== 'dev' &&
@@ -137,6 +171,7 @@ export function parseArgs(argv) {
                 env: environment ?? '',
                 ...(json ? { json: true } : {}),
                 ...(identity === undefined ? {} : { identity }),
+                ...(instances.length === 0 ? {} : { instances: [...new Set(instances)] }),
             };
         case 'build':
         case 'package':
@@ -144,6 +179,30 @@ export function parseArgs(argv) {
                 throw new Error(`\`${command}\` does not accept positional arguments.`);
             }
             return { command, env: '', ...(json ? { json: true } : {}) };
+        case 'diff':
+            // The version is package.json's: no command takes a version number (tech Versioning).
+            if (positionals.length > 0) {
+                throw new Error('`diff` does not accept positional arguments; it reads package.json.');
+            }
+            return {
+                command: 'diff',
+                env: '',
+                ...(json ? { json: true } : {}),
+                ...(identity === undefined ? {} : { identity }),
+            };
+        case 'publish': {
+            // The version is package.json's: the one positional names the Environment (tech Versioning).
+            if (positionals.length !== 1) {
+                throw new Error('`publish` takes exactly one Environment, e.g. `publish production`; it reads the version from package.json.');
+            }
+            return {
+                command: 'publish',
+                env: positionals[0],
+                ...(json ? { json: true } : {}),
+                ...(allowDirty ? { allowDirty: true } : {}),
+                ...(identity === undefined ? {} : { identity }),
+            };
+        }
         case 'test':
             if (positionals.length > 0) {
                 throw new Error('`test` does not accept positional arguments; use `--environment`.');
@@ -153,6 +212,18 @@ export function parseArgs(argv) {
                 env: environment ?? '',
                 ...(suite === undefined ? {} : { suite }),
             };
+        case 'yank': {
+            if (positionals.length !== 1) {
+                throw new Error('`yank` takes exactly one published version, e.g. `yank 1.5.0`.');
+            }
+            return {
+                command: 'yank',
+                env: '',
+                version: acceptVersion(positionals[0]),
+                ...(undo ? { undo: true } : {}),
+                ...(json ? { json: true } : {}),
+            };
+        }
         case 'lint':
             if (positionals.length > 0)
                 throw new Error('`lint` does not accept positional arguments.');

package/dist/tooling/cli/commit.d.ts

@@ -21,3 +21,15 @@ export declare function deploymentCommit(input: {
     readonly runtimeModule: string;
     readonly signal: AbortSignal;
 }): Promise<DeploymentCommitV1 | null>;
+/**
+ * Whether a remote-tracking branch of the repository already holds a commit. A Publication records
+ * the commit it was built from, and release-please computes the next number from the pushed
+ * history: publishing a commit nobody pushed risks the same number being computed again (tech
+ * Versioning [.73872]). Nothing when git cannot tell. Reads the local remote-tracking refs only,
+ * never the network.
+ */
+export declare function commitPushed(input: {
+    readonly projectDir: string;
+    readonly sha: string;
+    readonly signal: AbortSignal;
+}): Promise<boolean | undefined>;

package/dist/tooling/cli/commit.js

@@ -46,6 +46,25 @@ export async function deploymentCommit(input) {
         ...(base === undefined ? {} : { base }),
     });
 }
+/**
+ * Whether a remote-tracking branch of the repository already holds a commit. A Publication records
+ * the commit it was built from, and release-please computes the next number from the pushed
+ * history: publishing a commit nobody pushed risks the same number being computed again (tech
+ * Versioning [.73872]). Nothing when git cannot tell. Reads the local remote-tracking refs only,
+ * never the network.
+ */
+export async function commitPushed(input) {
+    if (!SHA.test(input.sha))
+        return undefined;
+    const branches = await git(input.projectDir, input.signal, [
+        'branch',
+        '--remotes',
+        '--contains',
+        input.sha,
+        '--format=%(refname)',
+    ]);
+    return branches === undefined ? undefined : branches.length > 0;
+}
 /**
  * The prefixes of the release tags of the package the Domain is released from, or nothing when
  * no release line holds the Domain.

package/dist/tooling/cli/deploy-mode.d.ts

@@ -1,4 +1,3 @@
-import type { LoadedEnvironment } from './project.js';
 /**
  * The deploy mode of one Environment for one command (CT33), chosen by the configuration itself:
  * an unchanged configuration keeps its mode, and so its behaviour, across an SDK upgrade, as long as
@@ -41,12 +40,15 @@ export type LegacyDirectReason =
 };
 export type CloudflareDirectParameter = 'route' | 'workerName' | 'identityIssuer' | 'addressing' | 'signingIdentity';
 export interface DeployRefusal {
-    readonly reason: 'astrale-instance' | 'astrale-signing-identity' | 'mixed-parameters' | 'scheduled-triggers' | 'development-canonical';
+    readonly reason: 'astrale-instance' | 'astrale-signing-identity' | 'mixed-parameters' | 'scheduled-triggers' | 'development-canonical' | 'publish-legacy-direct';
     /** The configuration or command to write instead, for the author. */
     readonly guidance: string;
 }
-/** The commands that select a deploy mode. `publish` refuses every Environment that is not canonical. */
-export type DeployModeCommand = 'deploy' | 'dev';
+/**
+ * The commands that select a deploy mode. `publish` names only an immutable deployment, so it
+ * refuses every Environment that is not canonical (CT33, R-G03).
+ */
+export type DeployModeCommand = 'deploy' | 'dev' | 'publish';
 /**
  * Select the deploy mode of one Environment (CT33). It reads the configuration and the command
  * only, and has no effect.
@@ -56,7 +58,8 @@ export type DeployModeCommand = 'deploy' | 'dev';
  * before any effect, since their one consumer pins an older SDK (AM-72). Otherwise the Environment
  * is on the legacy direct-mode path when adapter-cloudflare names a direct-mode parameter or no
  * `namespace`, or when its adapter declares no `deployRelease`. Everything else is canonical,
- * except under `dev`, which serves the legacy direct-mode path only.
+ * except under `dev`, which serves the legacy direct-mode path only. `publish` refuses the legacy
+ * direct-mode path: a stable target serves no release, so no version can name it.
  *
  * Within canonical adapter-cloudflare (with `namespace`), a direct-mode parameter is refused
  * rather than silently selecting either mode, and so is `wrangler.triggers`: an immutable
@@ -66,5 +69,14 @@ export type DeployModeCommand = 'deploy' | 'dev';
 export declare function selectDeployMode(input: {
     readonly command: DeployModeCommand;
     readonly environment: string;
-    readonly definition: LoadedEnvironment;
+    /** The Environment's definition, of which selection reads only the adapter and its parameters. */
+    readonly definition: {
+        readonly deployment: {
+            readonly adapter: {
+                readonly name: string;
+                readonly deployRelease?: unknown;
+            };
+            readonly parameters: object;
+        };
+    };
 }): DeployMode;

package/dist/tooling/cli/deploy-mode.js

@@ -22,7 +22,8 @@ const CLOUDFLARE_DIRECT_PARAMETERS = [
  * before any effect, since their one consumer pins an older SDK (AM-72). Otherwise the Environment
  * is on the legacy direct-mode path when adapter-cloudflare names a direct-mode parameter or no
  * `namespace`, or when its adapter declares no `deployRelease`. Everything else is canonical,
- * except under `dev`, which serves the legacy direct-mode path only.
+ * except under `dev`, which serves the legacy direct-mode path only. `publish` refuses the legacy
+ * direct-mode path: a stable target serves no release, so no version can name it.
  *
  * Within canonical adapter-cloudflare (with `namespace`), a direct-mode parameter is refused
  * rather than silently selecting either mode, and so is `wrangler.triggers`: an immutable
@@ -83,6 +84,14 @@ export function selectDeployMode(input) {
         reasons.push({ reason: 'no-deploy-release' });
     if (refusals.length > 0)
         return Object.freeze({ kind: 'refused', refusals: freeze(refusals) });
+    if (reasons.length > 0 && command === 'publish') {
+        return Object.freeze({
+            kind: 'refused',
+            refusals: freeze([
+                { reason: 'publish-legacy-direct', guidance: publishGuidance(environment, reasons) },
+            ]),
+        });
+    }
     if (reasons.length > 0)
         return Object.freeze({ kind: 'legacy-direct', reasons: freeze(reasons) });
     if (command === 'dev') {
@@ -124,6 +133,24 @@ function organizationGuidance(parameters, environment) {
         ? ''
         : ", and name the organisation that holds the deployment line in `astrale({ organization: '<Identity id>' })`";
 }
+/**
+ * Why a legacy direct-mode Environment cannot be published, and the configuration that makes it
+ * publishable: a version names an immutable deployment's release, which a stable target never
+ * serves.
+ */
+function publishGuidance(environment, reasons) {
+    const deploys = `\`astrale-domain publish ${environment}\` names an immutable deployment's release, and ${environment} deploys`;
+    if (reasons.some(({ reason }) => reason === 'no-deploy-release')) {
+        return (`${deploys} through an adapter without deployRelease, which replaces a stable target in ` +
+            'place and serves no release. Use an adapter that implements deployRelease (adapter ' +
+            "interface v2), such as astrale() on Admin's Services.");
+    }
+    const direct = reasons.flatMap((reason) => reason.reason === 'direct-parameter' ? [reason.parameter] : []);
+    return (`${deploys} on cloudflare()'s legacy direct mode, which serves no release. Deploy it into a ` +
+        'dispatch namespace with cloudflare({ namespace })' +
+        (direct.length === 0 ? '' : ` and remove ${direct.join(', ')}`) +
+        ", or on Admin's Services with astrale().");
+}
 /** A parameter is declared when its value is not `undefined`, as optional adapter parameters read. */
 function declares(parameters, name) {
     return Object.hasOwn(parameters, name) && parameters[name] !== undefined;

package/dist/tooling/cli/diff/declared.d.ts

@@ -0,0 +1,7 @@
+import type { Version } from '../../../platform/versioning/index.js';
+/**
+ * The version the author declares for the next release: `package.json` `version` in the Project
+ * directory, as release-please and `npm version` write it (tech Versioning [.21210]). No command
+ * takes a version number.
+ */
+export declare function declaredVersion(projectDir: string): Promise<Version>;

package/dist/tooling/cli/diff/declared.js

@@ -0,0 +1,27 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { acceptVersion } from '../../../platform/versioning/index.js';
+/**
+ * The version the author declares for the next release: `package.json` `version` in the Project
+ * directory, as release-please and `npm version` write it (tech Versioning [.21210]). No command
+ * takes a version number.
+ */
+export async function declaredVersion(projectDir) {
+    const path = join(projectDir, 'package.json');
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (cause) {
+        throw new TypeError(`Cannot read the Domain's version: ${path} is not a readable JSON file.`, {
+            cause,
+        });
+    }
+    const version = typeof manifest === 'object' && manifest !== null && !Array.isArray(manifest)
+        ? manifest.version
+        : undefined;
+    if (typeof version !== 'string') {
+        throw new TypeError(`${path} declares no version. The Domain's version is the package.json version, for example written by npm version minor.`);
+    }
+    return acceptVersion(version);
+}

package/dist/tooling/cli/diff/index.d.ts

@@ -0,0 +1,30 @@
+import type { Build } from '../../../deployment/index.js';
+import type { DomainRegistry } from '../registry/index.js';
+export type { DiffChangeV1, DiffReportV1 } from './report.js';
+export interface DiffCommandInput {
+    readonly projectDir: string;
+    readonly build: Build;
+    /** The build digest of every distinct bundler of the Project, bundled on demand. */
+    readonly builds: () => Promise<readonly string[]>;
+    readonly identity?: string;
+    readonly json: boolean;
+    readonly signal: AbortSignal;
+}
+export interface DiffCommandDependencies {
+    readonly open: (input: {
+        readonly projectDir: string;
+        readonly identity?: string;
+        readonly signal: AbortSignal;
+    }) => Promise<DomainRegistry>;
+    readonly stdout: (text: string) => void;
+    readonly stderr: (text: string) => void;
+}
+/**
+ * `astrale-domain diff [--as <identity>] [--json]`: the changes since the highest published stable
+ * version up to the declared one, and the smallest version they admit (tech Versioning [.72565]).
+ * On a feature branch the declared version is still the published one and the report is
+ * informational (exit 0); on a release PR an unpublished version that is too low fails (exit 1)
+ * with the [.105820] message. Reads the registry through the Astrale CLI under the caller's own
+ * credential and changes nothing.
+ */
+export declare function runDiff(input: DiffCommandInput, dependencies?: DiffCommandDependencies): Promise<number>;

package/dist/tooling/cli/diff/index.js

@@ -0,0 +1,58 @@
+import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
+import { DIM, RED, RESET } from '../log.js';
+import { RegistryCliError, openDomainRegistry } from '../registry/index.js';
+import { declaredVersion } from './declared.js';
+import { diffExitCode, renderDiff } from './render.js';
+import { diffReport, publishedSchema } from './report.js';
+/**
+ * `astrale-domain diff [--as <identity>] [--json]`: the changes since the highest published stable
+ * version up to the declared one, and the smallest version they admit (tech Versioning [.72565]).
+ * On a feature branch the declared version is still the published one and the report is
+ * informational (exit 0); on a release PR an unpublished version that is too low fails (exit 1)
+ * with the [.105820] message. Reads the registry through the Astrale CLI under the caller's own
+ * credential and changes nothing.
+ */
+export async function runDiff(input, dependencies = {
+    open: openDomainRegistry,
+    stdout: (text) => void process.stdout.write(text),
+    stderr: (text) => void process.stderr.write(text),
+}) {
+    const root = input.build.schema.compiled.root;
+    let report;
+    try {
+        const declared = await declaredVersion(input.projectDir);
+        const registry = await dependencies.open({
+            projectDir: input.projectDir,
+            ...(input.identity === undefined ? {} : { identity: input.identity }),
+            signal: input.signal,
+        });
+        report = await diffReport({
+            origin: root.origin,
+            declared,
+            revision: root.revision,
+            index: await registry.index(root.origin),
+            current: () => bundle.decode(input.build.schema.bundle.bytes()).root,
+            builds: input.builds,
+            published: async (publication) => publishedSchema(await registry.bundle(root.origin, publication), publication, root.origin),
+        });
+    }
+    catch (cause) {
+        if (!(cause instanceof RegistryCliError))
+            throw cause;
+        // Nothing on stdout: a JSON consumer reads one report or nothing.
+        dependencies.stderr(`${RED}✗${RESET} Domain registry: ${cause.code}: ${cause.message}\n`);
+        return 1;
+    }
+    const rendered = renderDiff(report);
+    // With --json, stdout carries only the report and the summary moves to stderr, as for deploy.
+    const summary = input.json ? dependencies.stderr : dependencies.stdout;
+    // The sentence takes the progress mark; the member rows below it keep their indentation.
+    for (const line of rendered.summary) {
+        summary(line.startsWith('  ') ? `${line}\n` : `${DIM}›${RESET} ${line}\n`);
+    }
+    if (rendered.refusal.length > 0)
+        dependencies.stderr(`${rendered.refusal.join('\n')}\n`);
+    if (input.json)
+        dependencies.stdout(`${JSON.stringify(report, null, 2)}\n`);
+    return diffExitCode(report);
+}

package/dist/tooling/cli/diff/render.d.ts

@@ -0,0 +1,15 @@
+import type { DiffReportV1 } from './report.js';
+/**
+ * 0 when the declared version is accepted, already published (the report is then informational:
+ * a feature branch keeps the last published number until its release), or has nothing to compare
+ * with; 1 when an unpublished declared version is too low.
+ */
+export declare function diffExitCode(report: DiffReportV1): 0 | 1;
+/**
+ * The report for a person. `summary` describes the comparison; `refusal` is the [.105820] message
+ * for an unpublished version that is too low (tech Versioning), printed as an error.
+ */
+export declare function renderDiff(report: DiffReportV1): {
+    readonly summary: readonly string[];
+    readonly refusal: readonly string[];
+};