@bakers-build/conductor 0.0.0-stage → 0.1.0-next.42

package/dist/src/cli/migrate-addon-names.js

@@ -0,0 +1,334 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { inspectConfigSource } from '@bakers-build/core';
+import { listConductorConfigFiles } from '../config.js';
+import { ConfigSourceEditor } from './config-source-edit.js';
+// BB-224 (Finding 8b, spec v3 decision 17): the `bakers config upgrade` RENAME pass.
+//
+// The addon packages were renamed `@bakers-build/plugin-<name>` → `@bakers-build/addon-<name>`
+// (decision 14) and the core barrels `@bakers-build/core/{builtins,plugins}` were
+// deleted (Finding 6). Both are npm-breaking for an existing install, whose
+// `.bakers/` configs still name the old packages — so `bakers config upgrade` rewrites them
+// in the user's PROJECT `./.bakers/` and HOME `~/.bakers/` configs.
+//
+// All THREE deleted/renamed specifiers are covered, and — BB-230 — so is the
+// FOURTH: the `@bakers-build/bakers/plugins` host barrel.
+//
+// BB-224 excluded that barrel on the premise that it "still exists as a
+// back-compat aggregator", so a config naming it keeps resolving. That premise is
+// INSTALL-DEPENDENT and false for a dev-clone install: `@bakers-build/bakers` is the
+// workspace's leaf SINK, so nothing depends on it and it is absent from
+// `bakers-cli/node_modules/@bakers-build/`; it is also the only package exporting
+// `./plugins` (`@bakers-build/core`'s export map has no such subpath). The `bakers` shim
+// prefers a checkout's own build over the global install by design, so exactly
+// there the barrel is unresolvable and that one config line dies while its
+// sibling `addon-*` slots resolve fine.
+//
+// The barrel itself keeps existing — this is not repairing a dead reference, it is
+// making configs stop NAMING a barrel the project docs already tell them not to
+// name. Both barrels are therefore migrated the same closed-set way, over the same
+// `CORE_PLUGINS_BARREL_EXPORTS` table. Two deliberate consequences:
+//   - the table is a SUPERSET of what `@bakers-build/bakers/plugins` actually re-exports
+//     (`host/src/plugins-barrel.ts` omits the fakes on purpose — they are
+//     workspace-only and must not be a published package's dependency). Mapping
+//     them anyway is right: such a descriptor is broken today, and retargeting it
+//     at `@bakers-build/addon-fake` fixes it.
+//   - `loadInstructions` IS a barrel export but is not a plugin factory and is
+//     absent from the table, so it stays untouched — as does any other unmapped
+//     `export:`.
+//
+// Covered per config dir:
+//   - the connection config `bakers.config.js` (its `plugins[]` / `addons[]`);
+//   - EVERY engine config the loader itself recognises — the default
+//     `conductor.config.js` AND each `<variant>.conductor.config.js`
+//     (BB-137 naming convention, enumerated via `listConductorConfigFiles` so
+//     the pass and the loader can never disagree). A legacy `conductor.config.js`
+//     still carrying `site`/`plugins` (the back-compat connection source) is
+//     therefore covered too, and its `plugins[]` entries are mapped on the
+//     CONNECTION surface — see `builtinsTargetFor`.
+//
+// Safety (decision 18 + the v3 risk register):
+//   - Replacement is anchored on a CLOSED set of 14 known package names inside
+//     a matched quote pair — never a broad `@bakers-build/plugin-.*` sweep. A
+//     hand-written config's comments, formatting and unrelated code survive.
+//     The `@bakers-build/core/plugins` rewrite is likewise closed-set: it is driven by
+//     the barrel's OWN export list, and an export name outside that list is left
+//     untouched rather than retargeted at a guess.
+//   - `*Plugin` interface identifiers (`RemotePlugin`, `herdrExecutorPlugin`, …)
+//     and the `plugins:`/`addons:` config KEYS are excluded BY CONSTRUCTION: a
+//     replacement only ever fires on a full quoted specifier, and none of those
+//     is one.
+//   - Idempotent: a config already on `addon-*` produces zero matches and is
+//     left BYTE-unchanged (no rewrite, no backup, no report line).
+//   - `--dry-run` prints the line diff and writes nothing.
+//   - A real rewrite backs the original up next to the file, like the
+//     schema-migration path does.
+/** Suffix of the pre-rewrite backup a real (non-dry) rewrite leaves behind. */
+export const ADDON_RENAME_BAK_SUFFIX = '.pre-addon-rename.bak';
+const AUTH_BASIC = '@bakers-build/addon-auth-basic';
+const REMOTE_DRUPAL = '@bakers-build/addon-remote-drupal';
+const WORKSPACE_GIT = '@bakers-build/addon-workspace-git';
+const FAKE = '@bakers-build/addon-fake';
+/**
+ * The 14 addon packages renamed by BB-224 (spec v3 decision 14), including
+ * the BB-220 `pi` agent addon merged in from develop. A CLOSED
+ * set — the pass rewrites only these exact specifiers, so an unknown
+ * `@bakers-build/plugin-something` is left alone rather than silently retargeted at a
+ * package that does not exist.
+ */
+export const RENAMED_ADDONS = [
+    'auth-basic',
+    'claude',
+    'codex',
+    'deployment',
+    'dropsh',
+    'essentials',
+    'fake',
+    'bakers-ui',
+    'herdr',
+    'kimi',
+    'opencode',
+    'pi',
+    'remote-drupal',
+    'workspace-git',
+];
+/**
+ * `'@bakers-build/plugin-<known>'` (or `"…"` / `` `…` ``), with an optional subpath
+ * (`/preset`), inside a MATCHED quote pair. The quote pair + the closing anchor
+ * are what make this an exact-specifier match: `@bakers-build/plugin-herdr-x` cannot
+ * match `herdr`, and a bare `RemotePlugin` identifier cannot match at all.
+ * Longest name first so a longer name always wins the alternation.
+ */
+const QUOTED_LEGACY_ADDON = new RegExp(`(['"\`])@bakers-build/plugin-(${[...RENAMED_ADDONS]
+    .sort((a, b) => b.length - a.length)
+    .join('|')})((?:/[^'"\`]*)?)\\1`, 'g');
+/** `'@bakers-build/core/builtins'` inside a matched quote pair (the deleted preset). */
+const QUOTED_LEGACY_BUILTINS = /(['"`])@bakers-build\/core\/builtins\1/g;
+/**
+ * Where each export of the host barrels lives now — the DELETED
+ * `@bakers-build/core/plugins` and (BB-230) the meta package's
+ * `@bakers-build/bakers/plugins`, which is unresolvable from a dev-clone install.
+ *
+ * The key set is the barrel's own export list — `core/src/plugins/registry-exports.ts`
+ * as of the commit that deleted it — re-pointed at the addon that owns each
+ * factory today. `defaultExport` records whether the target package
+ * DEFAULT-exports exactly that factory; when it does, the descriptor's `export:`
+ * becomes redundant and is dropped.
+ *
+ * Deliberately absent, so they are left untouched:
+ *   - `selectRemote`/`selectWorkspace`/`selectExecutor`/`selectAgent(s)` — moved
+ *     to `@bakers-build/conductor/contract`, but they are config-shape SELECTORS, not
+ *     plugin factories, so no descriptor can legitimately name them;
+ *   - any other/unknown export name — a config naming one is reported by the
+ *     loader rather than silently retargeted at a package that may not have it.
+ */
+export const CORE_PLUGINS_BARREL_EXPORTS = {
+    DrupalBbRemote: { target: REMOTE_DRUPAL, defaultExport: false },
+    FakeBbRemote: { target: FAKE, defaultExport: false },
+    FakeWorkspace: { target: FAKE, defaultExport: false },
+    GitWorkspace: { target: WORKSPACE_GIT, defaultExport: false },
+    basicAuthProvider: { target: AUTH_BASIC, defaultExport: true },
+    drupalRemote: { target: REMOTE_DRUPAL, defaultExport: true },
+    // @bakers-build/addon-fake ships the whole deterministic triple as NAMED exports
+    // (no default), so these keep their `export:`.
+    fakeRemote: { target: FAKE, defaultExport: false },
+    fakeWorkspace: { target: FAKE, defaultExport: false },
+    gitWorkspace: { target: WORKSPACE_GIT, defaultExport: true },
+};
+/**
+ * The host-barrel specifiers a descriptor may name. Both map through
+ * `CORE_PLUGINS_BARREL_EXPORTS`: `@bakers-build/core/plugins` is DELETED, and
+ * `@bakers-build/bakers/plugins` (BB-230) is unresolvable from a dev-clone install
+ * because the meta package that exports it is the workspace's leaf sink.
+ */
+export const HOST_BARREL_PATHS = [
+    '@bakers-build/core/plugins',
+    '@bakers-build/bakers/plugins',
+];
+/**
+ * The object-literal entry that encloses `at`, e.g.
+ * `{ use: '@bakers-build/core/builtins', with: { basic: token } }`. Empty string when
+ * the occurrence is a BARE string entry (`addons: ['@bakers-build/core/builtins']`) —
+ * the backward scan then hits the array/argument boundary first.
+ */
+function enclosingEntry(text, at) {
+    let depth = 0;
+    let start = -1;
+    for (let i = at; i >= 0; i--) {
+        const c = text[i];
+        if (c === '}')
+            depth++;
+        else if (c === '{') {
+            if (depth === 0) {
+                start = i;
+                break;
+            }
+            depth--;
+        }
+        else if (depth === 0 && (c === '[' || c === '(' || c === ';')) {
+            break;
+        }
+    }
+    if (start < 0)
+        return '';
+    let d = 0;
+    for (let i = start; i < text.length; i++) {
+        const c = text[i];
+        if (c === '{')
+            d++;
+        else if (c === '}') {
+            d--;
+            if (d === 0)
+                return text.slice(start, i + 1);
+        }
+    }
+    return text.slice(start);
+}
+/** The nearest `plugins:` / `addons:` array key BEFORE `at`, if any. */
+function nearestArrayKey(text, at) {
+    const re = /\b(plugins|addons)\s*:/g;
+    let last;
+    for (let m = re.exec(text); m !== null && m.index < at; m = re.exec(text)) {
+        last = m[1];
+    }
+    return last;
+}
+/**
+ * `@bakers-build/core/builtins` was ONE preset contributing to BOTH surfaces, so its
+ * replacement is per-occurrence (spec v3 decision 17, the Finding 6/8 interplay):
+ *
+ *   | signal (first that applies)                  | target                      |
+ *   | the entry carries a `basic` token            | `@bakers-build/addon-auth-basic`  |
+ *   | the nearest array key is `plugins:`          | `@bakers-build/addon-auth-basic`  |
+ *   | the file is a connection config              | `@bakers-build/addon-auth-basic`  |
+ *   | otherwise (engine `addons:` / a slot)        | `@bakers-build/addon-remote-drupal` |
+ *
+ * The `plugins:` rule is what makes a LEGACY `conductor.config.js` (engine file
+ * name, but still carrying a connection `site`/`plugins`) come out right.
+ */
+function builtinsTargetFor(text, at, surface) {
+    if (/basic/i.test(enclosingEntry(text, at)))
+        return AUTH_BASIC;
+    if (nearestArrayKey(text, at) === 'plugins')
+        return AUTH_BASIC;
+    return surface === 'connection' ? AUTH_BASIC : REMOTE_DRUPAL;
+}
+/**
+ * Rewrite the legacy specifiers in one config's SOURCE TEXT — all of them: the
+ * renamed `@bakers-build/plugin-*` packages, the deleted `@bakers-build/core/builtins`
+ * preset, and the host-barrel descriptors naming either `@bakers-build/core/plugins`
+ * (deleted) or `@bakers-build/bakers/plugins` (BB-230). Pure; line
+ * count is preserved (every replacement is line-local), which is what lets the
+ * reported diff be a plain index-aligned line diff.
+ */
+export function migrateAddonNames(text, surface) {
+    const source = inspectConfigSource(text);
+    if (source.syntax !== 'valid')
+        return { text, count: 0 };
+    const e = new ConfigSourceEditor(text);
+    let count = 0;
+    const keys = [...source.properties.keys()].filter((key) => /(?:\.plugin|\.use|^plugins\[\d+\]$|^addons\[\d+\]$)$/.test(key));
+    for (const key of keys) {
+        const p = e.property(key);
+        if (!p?.staticallyDetermined || typeof p.value !== 'string')
+            continue;
+        let value = e.expression(key);
+        value = value.replace(QUOTED_LEGACY_ADDON, (_match, quote, name, subpath) => `${quote}@bakers-build/addon-${name}${subpath}${quote}`);
+        value = value.replace(QUOTED_LEGACY_BUILTINS, (_match, quote) => `${quote}${builtinsTargetFor(e.text, p.valueStart, surface)}${quote}`);
+        if (HOST_BARREL_PATHS.includes(p.value)) {
+            const parent = key.replace(/\.(plugin|use)$/, '');
+            const name = e.property(`${parent}.export`);
+            const target = typeof name?.value === 'string'
+                ? CORE_PLUGINS_BARREL_EXPORTS[name.value]
+                : undefined;
+            if (target) {
+                value = `${value[0]}${target.target}${value[0]}`;
+                if (target.defaultExport && !e.expression(parent)?.includes('\n'))
+                    e.remove(`${parent}.export`);
+            }
+        }
+        if (value !== e.expression(key)) {
+            e.set(key, value);
+            count++;
+        }
+    }
+    for (const span of [...e.source.moduleSpecifiers].reverse()) {
+        const before = e.text.slice(span.start, span.end);
+        const after = before.replace(QUOTED_LEGACY_ADDON, (_match, quote, name, subpath) => `${quote}@bakers-build/addon-${name}${subpath}${quote}`);
+        if (before !== after) {
+            e.replace(span.start, span.end, after);
+            count++;
+        }
+    }
+    return { text: e.text, count };
+}
+/** An index-aligned `- old` / `+ new` line diff (line count is preserved). */
+function lineDiff(before, after) {
+    const a = before.split('\n');
+    const b = after.split('\n');
+    const out = [];
+    for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        if (a[i] === b[i])
+            continue;
+        if (a[i] !== undefined)
+            out.push(`  - ${a[i]}`);
+        if (b[i] !== undefined)
+            out.push(`  + ${b[i]}`);
+    }
+    return out;
+}
+/**
+ * Rename pass over ONE config file. Returns `undefined` when the file is absent
+ * or already on the new names (idempotency: no write, no backup, no report
+ * line — the file stays byte-identical).
+ */
+export function migrateAddonNamesInFile(path, surface, opts = {}) {
+    if (!existsSync(path))
+        return undefined;
+    const before = readFileSync(path, 'utf8');
+    const { text: after, count } = migrateAddonNames(before, surface);
+    if (count === 0 || after === before)
+        return undefined;
+    const diff = lineDiff(before, after);
+    const what = `${count} legacy addon reference(s) → @bakers-build/addon-*`;
+    if (opts.dryRun ?? false) {
+        return { action: `would rewrite ${path} (${what})`, diff, count };
+    }
+    const bak = `${path}${ADDON_RENAME_BAK_SUFFIX}`;
+    writeFileSync(bak, before, 'utf8');
+    writeFileSync(path, after, 'utf8');
+    return {
+        action: `rewrote ${path} (${what}; backup ${bak})`,
+        diff,
+        count,
+    };
+}
+/**
+ * Rename pass over every recognised config in the given `.bakers/` dirs (project
+ * + home). Emits report lines ONLY for files it actually rewrites, so an install
+ * already on `addon-*` adds no noise to the upgrade report.
+ */
+export function runAddonRenameMigration(opts = { bakersDirs: [] }) {
+    const actions = [];
+    let changed = false;
+    const seen = new Set();
+    for (const dir of opts.bakersDirs) {
+        if (seen.has(dir) || !existsSync(dir))
+            continue;
+        seen.add(dir);
+        const files = [
+            [join(dir, 'bakers.config.js'), 'connection'],
+            ...listConductorConfigFiles(dir).map((f) => [join(dir, f), 'engine']),
+        ];
+        for (const [path, surface] of files) {
+            const res = migrateAddonNamesInFile(path, surface, {
+                dryRun: opts.dryRun ?? false,
+            });
+            if (res === undefined)
+                continue;
+            actions.push(res.action, ...res.diff);
+            changed = true;
+        }
+    }
+    return { actions, changed };
+}

package/dist/src/cli/project-context.d.ts

@@ -0,0 +1,21 @@
+export interface BbWorkspaceOwner {
+    path: string;
+    before: string;
+}
+export interface BbProjectSelection {
+    project: string;
+    workspace?: string;
+}
+export type BbProjectOwner = BbWorkspaceOwner;
+/** Read committed bakers.build identity without executing conductor source. */
+export declare function readBbProjectSelection(path: string): BbProjectSelection;
+/** Establish the exact file that can receive a nested workspace choice. */
+export declare function bakersProjectOwner(path: string): BbProjectOwner;
+/** Read the committed project name without executing engine config. */
+export declare function readProjectSelection(path: string): string | undefined;
+/** Read the committed product-workspace name without executing engine config. */
+export declare function readBbWorkspaceSelection(path: string): string | undefined;
+/** Establish the conductor-owned source that the cockpit may update. */
+export declare function bakersWorkspaceOwner(path: string): BbWorkspaceOwner;
+/** Atomically update only the product-workspace field, preserving plugin slots. */
+export declare function writeBbWorkspaceSelection(owner: BbWorkspaceOwner, selected: string, hint: string): Promise<void>;

package/dist/src/cli/project-context.js

@@ -0,0 +1,105 @@
+import { existsSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { basename } from 'node:path';
+import { ConfigSourceEditor } from './config-source-edit.js';
+/** Read committed bakers.build identity without executing conductor source. */
+export function readBbProjectSelection(path) {
+    const editor = new ConfigSourceEditor(readFileSync(path, 'utf8'));
+    const invalid = () => new Error(`Cannot read committed bakers.project in ${path}; run bakers config upgrade --scope project.`);
+    const bakers = editor.property('bakers');
+    const bakersExpression = editor.expression('bakers');
+    const bakersHasSpread = bakersExpression
+        ? new ConfigSourceEditor(`export default ${bakersExpression};`).source
+            .unknownKeys
+        : false;
+    const project = editor.property('bakers.project');
+    const workspace = editor.property('bakers.workspace');
+    if (editor.source.shape !== 'object' ||
+        bakersHasSpread ||
+        editor.property('project') ||
+        editor.property('bb_workspace') ||
+        bakers?.nodeType !== 'ObjectExpression' ||
+        !project?.staticallyDetermined ||
+        typeof project.value !== 'string' ||
+        !project.value.trim() ||
+        (workspace !== undefined &&
+            (!workspace.staticallyDetermined ||
+                typeof workspace.value !== 'string' ||
+                !workspace.value.trim())))
+        throw invalid();
+    return {
+        project: project.value.trim(),
+        ...(workspace ? { workspace: workspace.value.trim() } : {}),
+    };
+}
+/** Establish the exact file that can receive a nested workspace choice. */
+export function bakersProjectOwner(path) {
+    const file = basename(path);
+    if (file !== 'conductor.config.js' && !file.endsWith('.conductor.config.js'))
+        throw new Error(`Cannot write bakers.build workspace selection to ${path}.`);
+    readBbProjectSelection(path);
+    return { path, before: readFileSync(path, 'utf8') };
+}
+/** Read the committed project name without executing engine config. */
+export function readProjectSelection(path) {
+    try {
+        const property = new ConfigSourceEditor(readFileSync(path, 'utf8')).property('project');
+        return property?.staticallyDetermined &&
+            typeof property.value === 'string' &&
+            property.value.trim() !== ''
+            ? property.value.trim()
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read the committed product-workspace name without executing engine config. */
+export function readBbWorkspaceSelection(path) {
+    try {
+        const property = new ConfigSourceEditor(readFileSync(path, 'utf8')).property('bb_workspace');
+        return property?.staticallyDetermined &&
+            typeof property.value === 'string' &&
+            property.value.trim() !== ''
+            ? property.value.trim()
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Establish the conductor-owned source that the cockpit may update. */
+export function bakersWorkspaceOwner(path) {
+    const file = basename(path);
+    if (file !== 'conductor.config.js' && !file.endsWith('.conductor.config.js'))
+        throw new Error(`Cannot write bakers.build workspace selection to ${path}; expected conductor.config.js or a named conductor variant. No configuration was written.`);
+    const before = readFileSync(path, 'utf8');
+    const editor = new ConfigSourceEditor(before);
+    const property = editor.property('bb_workspace');
+    if (editor.source.shape === 'object' &&
+        !editor.source.unknownKeys &&
+        (!property ||
+            (property.staticallyDetermined && typeof property.value === 'string')))
+        return { path, before };
+    throw new Error(`Cannot establish a literal writable bb_workspace in ${path}. No configuration was written.`);
+}
+/** Atomically update only the product-workspace field, preserving plugin slots. */
+export async function writeBbWorkspaceSelection(owner, selected, hint) {
+    const editor = new ConfigSourceEditor(owner.before);
+    editor.set(editor.property('bakers.project') ? 'bakers.workspace' : 'bb_workspace', JSON.stringify(selected));
+    if ((existsSync(owner.path) ? readFileSync(owner.path, 'utf8') : null) !==
+        owner.before)
+        throw new Error(`Configuration changed while choosing; recheck ${owner.path} before retrying. No configuration was written.`);
+    const temporary = `${owner.path}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(temporary, editor.text, {
+            mode: statSync(owner.path).mode & 0o777,
+            flag: 'wx',
+        });
+        renameSync(temporary, owner.path);
+    }
+    catch {
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+        throw new Error(`Could not write bakers.build workspace to ${owner.path}. ${hint}`);
+    }
+}

package/dist/src/commands/conductor.d.ts

@@ -0,0 +1,91 @@
+import { type BbCommandHost, type BbCommandPlugin, type ConductorLogger, type ProcProbe, type UpdateCheckOptions } from '@bakers-build/core';
+import { Command } from 'commander';
+import type { BbExecutor } from '../plugins/executor.js';
+import { type ResolvedAgent } from '../plugins/plugins.js';
+import type { HerdrHost } from '../plugins/process-host.js';
+import type { BbRemote, ConductorStatus } from '../plugins/remote.js';
+import type { BbWorkspace } from '../plugins/workspace.js';
+import type { ConductorFileConfig } from '../types.js';
+export type { HerdrHost };
+/** Test seam: inject any subset of dependencies. */
+export interface BbCliDeps {
+    remote?: BbRemote;
+    executor?: BbExecutor;
+    workspace?: BbWorkspace;
+    agents?: ResolvedAgent[];
+    config?: ConductorFileConfig;
+    /** Injectable registry fetch for the start-time version check (tests). */
+    fetch?: typeof fetch;
+    /** Marker immediately before start hands control to conductor work. */
+    onStartLoop?: () => void;
+    /** Host contract (resolveBases); default: this install + cwd. */
+    host?: BbCommandHost;
+    /**
+     * The process host behind `start`. Defaults to the host contributed by a
+     * conductor addon (`processHosts`, last wins). A test MUST inject a fake,
+     * or the suite creates real workspaces + real conductor processes.
+     */
+    herdr?: HerdrHost;
+    /**
+     * BB-232: the pid probe behind `stop`. Defaults to the real /proc reader —
+     * a test MUST inject a fake, or the suite signals real processes.
+     */
+    procProbe?: ProcProbe;
+    /**
+     * BB-450 D9: how long `start` waits between polls for a fresh heartbeat,
+     * and how many it takes before giving up and reporting **failed**. Defaults
+     * are a real wait budget (1s × 20 ≈ 20s); a test MUST inject both (with a
+     * no-op `sleep`) or it waits for real time.
+     */
+    startPollIntervalMs?: number;
+    startPollAttempts?: number;
+    /**
+     * BB-450 D10: `start --force`'s grace period — how long it waits between
+     * polls for the stopped conductor to actually exit before escalating to
+     * `SIGKILL`, and how many it takes before escalating. Defaults are a real
+     * wait budget (500ms × 10 ≈ 5s).
+     */
+    forceGraceIntervalMs?: number;
+    forceGraceAttempts?: number;
+    /** Test seam: replaces the real timer `start` waits on between polls. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Cache path, clock and fetch overrides for the start-time update check. */
+    updateCheckOptions?: UpdateCheckOptions;
+    /** stdin TTY override for the install prompt. */
+    stdinIsTTY?: boolean;
+    /** stdout TTY override for the install prompt. */
+    stdoutIsTTY?: boolean;
+    /** Environment for CI / selector detection. Defaults to process.env. */
+    env?: NodeJS.ProcessEnv;
+    /** One prompt line; empty string is default yes. Reject to cancel. */
+    askUpdate?: (question: string) => Promise<string>;
+    /** Invoke `bakers` with an argv array (no binary name). */
+    runBb?: (args: string[]) => Promise<void>;
+}
+/**
+ * Start-time auth gate. Returns true if authenticated (session or session-less
+ * provider); otherwise logs a single clear line and returns false.
+ */
+export declare function ensureAuthenticated(config: ConductorFileConfig, logger: ConductorLogger): Promise<boolean>;
+/**
+ * Other conductor records that name the SAME checkout as `own` (BB-450 D6,
+ * AC-19) — the exact ambiguity BB-281 recorded in the field: one checkout,
+ * two `bb_conductor` rows under different ids. Reported so the operator can
+ * see the stray; never signalled and never cleaned up here.
+ */
+export declare function strayConductorsOf(rows: ConductorStatus[], own: ConductorStatus): ConductorStatus[];
+/** Prompt for the developer Kürzel / user id on an interactive terminal. */
+/** Build the `oven` subcommand tree (lifecycle + registry). */
+export declare function createConductorCommand(deps: BbCliDeps): Command;
+/** The `oven` command plugin the host mounts (BB-201). BB-224
+ *  (Finding 7): the `bakers deployment` batch helper is no longer registered here —
+ *  it is its own command addon, `@bakers-build/addon-deployment`. */
+declare const conductorCommandPlugin: BbCommandPlugin;
+export default conductorCommandPlugin;
+/**
+ * Build a standalone program with the conductor command mounted — the test entry
+ * (mirrors what the host does for `bakers oven …`). `deps` inject fakes.
+ */
+export declare function buildConductorProgram(deps?: BbCliDeps): Command;
+/** Parse argv against the conductor program (test entry). */
+export declare function runConductorCli(argv: string[], deps?: BbCliDeps): Promise<void>;