@bridge4dev/runner 0.11.0 → 0.22.1

package/dist/protocol.js

@@ -45,6 +45,13 @@ export const SessionDescriptorSchema = z.object({
         path: z.string(),
         projectId: z.string().uuid(),
         trustMode: z.enum(['STRICT', 'NORMAL', 'AUTO']),
+        /**
+         * Session 15. Optional: an API older than this release does not send it,
+         * and «not said» must keep the behaviour every deployed runner has now —
+         * inventing a restriction from silence would stop agents committing on
+         * every project the moment a runner updated ahead of its API.
+         */
+        agentAutoCommit: z.boolean().optional(),
         budgetUsd: z.number().nullable(),
         budgetMinutes: z.number().nullable(),
     }),
@@ -62,6 +69,57 @@ export const SessionDescriptorSchema = z.object({
         .regex(/^[A-Za-z0-9][A-Za-z0-9._\-/]*$/)
         .optional()
         .catch(undefined),
+    /**
+     * Session 13: the branch as a decision rather than a coincidence.
+     *
+     * `branchHint` said «call it this if you like»; the runner then guessed what
+     * to do about a name that already existed (silently reuse it) or did not
+     * (create it off whatever the folder was on). Both guesses lose work. The
+     * plan says which of the two the API meant, and the runner fails loudly when
+     * reality disagrees.
+     *
+     * `.catch(undefined)` for the same reason as `branchHint`: this field travels
+     * inside hello_ack, which carries EVERY session of the server, so one
+     * malformed plan must cost its own session at most — never the frame
+     * (QA-100 MAJOR-1). Falling back to `branchHint` restores exactly the old
+     * behaviour.
+     */
+    branchPlan: z
+        .object({
+        branch: z
+            .string()
+            .max(120)
+            .regex(/^[A-Za-z0-9][A-Za-z0-9._\-/]*$/),
+        source: z.enum(['NEW', 'CONTINUE']),
+        baseBranch: z
+            .string()
+            .max(200)
+            .regex(/^[A-Za-z0-9][A-Za-z0-9._\-/]*$/)
+            .optional(),
+        baseSha: z
+            .string()
+            .regex(/^[0-9a-f]{7,64}$/i)
+            .optional(),
+    })
+        .optional()
+        .catch(undefined),
+    /**
+     * Where this session works (session 16).
+     *
+     * `DIRECT` — in the project folder itself, on the branch it is already on.
+     * There is no worktree, no session branch and no «Apply»: the work is already
+     * where the person wanted it. This is the ordinary case, because the person
+     * runs their own terminal agents in that same folder anyway — we were paying
+     * the whole price of isolation and not getting any.
+     *
+     * `BRANCH` — the historical worktree-and-branch arrangement. The API hands it
+     * out when the folder is already taken by another live session, because two
+     * agents in one folder fight exactly the way a human and an agent do.
+     *
+     * Optional, and absent means `BRANCH`: an API older than this release says
+     * nothing, and silence must keep the behaviour every deployed runner has now.
+     */
+    workMode: z.enum(['DIRECT', 'BRANCH']).optional().catch(undefined),
     // Auto-provisioned DevBridge MCP access (dbk_ key scoped to the workspace
     // project). Preferred over the [mcp] section of config.toml when present.
     mcp: z.object({ url: z.string().url(), token: z.string().min(1) }).optional(),
@@ -115,6 +173,25 @@ export const GatewayFrameSchema = z.discriminatedUnion('type', [
         allow: z.boolean(),
         note: z.string().optional(),
     }),
+    // Session 12: the human's answer to a parked agent question. `action` splits
+    // "here is the decision" from "let me reply in words instead", and both keep
+    // the agent's turn alive.
+    z.object({
+        type: z.literal('question_answer'),
+        sessionId: z.string().uuid(),
+        askId: z.string().min(1).max(64),
+        action: z.enum(['answer', 'discuss']),
+        answers: z
+            .array(z.object({
+            questionId: z.string().min(1).max(120),
+            values: z.array(z.string().max(2_000)).max(16),
+            custom: z.string().max(10_000).optional(),
+            notes: z.string().max(2_000).optional(),
+        }))
+            .max(4)
+            .optional(),
+        text: z.string().max(20_000).optional(),
+    }),
     z.object({ type: z.literal('session_stop'), sessionId: z.string().uuid() }),
     z.object({ type: z.literal('session_interrupt'), sessionId: z.string().uuid() }),
     // Server-wide settings changed mid-connection (session 8) — today just the
@@ -123,6 +200,19 @@ export const GatewayFrameSchema = z.discriminatedUnion('type', [
         type: z.literal('server_settings'),
         maxSessions: z.number().int().positive().optional().catch(undefined),
     }),
+    /**
+     * Project-level policy changed while sessions are running (session 15).
+     *
+     * `trustMode` and `agentAutoCommit` used to be fixed at session launch, so a
+     * manager tightening trust changed a database row and nothing else while the
+     * card reported the new level as a fact. Both are read on every tool call.
+     */
+    z.object({
+        type: z.literal('workspace_settings'),
+        workspaceId: z.string().min(1).max(64),
+        trustMode: z.enum(['STRICT', 'NORMAL', 'AUTO']).optional(),
+        agentAutoCommit: z.boolean().optional(),
+    }),
     z.object({
         type: z.literal('session_settings'),
         sessionId: z.string().uuid(),
@@ -142,12 +232,25 @@ export const GatewayFrameSchema = z.discriminatedUnion('type', [
         // The strict `RunnerCommandName` union on the API side stays the authority.
         // Known names: validate_path, clean, purge_session, reset_workspace,
         // git_status, git_diff, git_commit, apply_session, revert_apply, fs_view,
-        // auth_status, login_start, login_code, self_update.
+        // git_log, git_show, auth_status, login_start, login_code, self_update,
+        // git_branches, update_from_base, git_push, git_refs, workspace_state,
+        // recipe_state, verify_start, verify_status, verify_cancel,
+        // preview_checkout, preview_stop, propose_commit_message, git_stage,
+        // git_unstage, git_discard, git_pull, git_merge_abort.
         name: z.string().min(1).max(64),
         workspaceId: z.string().optional(),
         sessionId: z.string().optional(),
         args: z.record(z.unknown()).optional(),
     }),
+    /**
+     * Session 14: the API stored a verification verdict, so stop redelivering it.
+     *
+     * The verdict travels as its own frame rather than as a command answer,
+     * because a build takes minutes and a relayed command lives for seconds. That
+     * makes the frame losable — a reconnect mid-build, a closed tab, an API too
+     * old to know the frame — so it is queued on disk until this arrives.
+     */
+    z.object({ type: z.literal('verify_report_ack'), runId: z.string().min(1).max(64) }),
     z.object({ type: z.literal('revoked'), reason: z.string() }),
     z.object({ type: z.literal('error'), message: z.string() }),
 ]);

package/dist/recipe-schema.d.ts

@@ -0,0 +1,310 @@
+import { z } from 'zod';
+/**
+ * Mirror of `packages/shared/src/schemas/dev-recipe.ts` — the DevBridge side is
+ * the source of truth, exactly like `protocol.ts` mirrors the API's wire types.
+ *
+ * Copied rather than imported on purpose: this package is published to npm on
+ * its own and installed by users who have no DevBridge workspace, so a
+ * `@devbridge/shared` import would make the published tarball unresolvable.
+ * The two files are small, additive, and change together in one release.
+ *
+ * Deliberately NOT `.strict()`: the same JSON is stored in a JSONB column on
+ * the API side, and a strict schema turns «a newer release added a field» into
+ * «the whole recipe is unreadable» for every row written before it.
+ */
+export declare const RECIPE_STEP_NAMES: readonly ["install", "build", "test", "verify", "deploy"];
+export type RecipeStepName = (typeof RECIPE_STEP_NAMES)[number];
+export declare const RECIPE_MAX_TIMEOUT_SEC = 3600;
+export declare const RECIPE_DEFAULT_TIMEOUT_SEC = 900;
+/** Where a project's recipe proposal lives, relative to the repository root. */
+export declare const PROJECT_RECIPE_PATH = ".devbridge/project.json";
+export declare const ProjectRecipeStepSchema: z.ZodObject<{
+    run: z.ZodEffects<z.ZodString, string, string>;
+    timeoutSec: z.ZodOptional<z.ZodNumber>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    run: string;
+    env?: Record<string, string> | undefined;
+    timeoutSec?: number | undefined;
+}, {
+    run: string;
+    env?: Record<string, string> | undefined;
+    timeoutSec?: number | undefined;
+}>;
+export declare const ProjectRecipeHealthSchema: z.ZodObject<{
+    url: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    shaPath: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    shaPath?: string | undefined;
+}, {
+    url: string;
+    shaPath?: string | undefined;
+}>;
+export declare const ProjectRecipePreviewSchema: z.ZodObject<{
+    run: z.ZodEffects<z.ZodString, string, string>;
+    stop: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    url: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    project: z.ZodOptional<z.ZodString>;
+    timeoutSec: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    run: string;
+    url?: string | undefined;
+    project?: string | undefined;
+    timeoutSec?: number | undefined;
+    stop?: string | undefined;
+}, {
+    run: string;
+    url?: string | undefined;
+    project?: string | undefined;
+    timeoutSec?: number | undefined;
+    stop?: string | undefined;
+}>;
+export declare const ProjectRecipeSchema: z.ZodObject<{
+    version: z.ZodDefault<z.ZodOptional<z.ZodLiteral<1>>>;
+    steps: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        install: z.ZodOptional<z.ZodObject<{
+            run: z.ZodEffects<z.ZodString, string, string>;
+            timeoutSec: z.ZodOptional<z.ZodNumber>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }>>;
+        build: z.ZodOptional<z.ZodObject<{
+            run: z.ZodEffects<z.ZodString, string, string>;
+            timeoutSec: z.ZodOptional<z.ZodNumber>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }>>;
+        test: z.ZodOptional<z.ZodObject<{
+            run: z.ZodEffects<z.ZodString, string, string>;
+            timeoutSec: z.ZodOptional<z.ZodNumber>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }>>;
+        verify: z.ZodOptional<z.ZodObject<{
+            run: z.ZodEffects<z.ZodString, string, string>;
+            timeoutSec: z.ZodOptional<z.ZodNumber>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }>>;
+        deploy: z.ZodOptional<z.ZodObject<{
+            run: z.ZodEffects<z.ZodString, string, string>;
+            timeoutSec: z.ZodOptional<z.ZodNumber>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }, {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        verify?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        build?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        install?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        test?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        deploy?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+    }, {
+        verify?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        build?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        install?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        test?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        deploy?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+    }>>>;
+    health: z.ZodOptional<z.ZodObject<{
+        url: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+        shaPath: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+        shaPath?: string | undefined;
+    }, {
+        url: string;
+        shaPath?: string | undefined;
+    }>>;
+    preview: z.ZodOptional<z.ZodObject<{
+        run: z.ZodEffects<z.ZodString, string, string>;
+        stop: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        url: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        project: z.ZodOptional<z.ZodString>;
+        timeoutSec: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        run: string;
+        url?: string | undefined;
+        project?: string | undefined;
+        timeoutSec?: number | undefined;
+        stop?: string | undefined;
+    }, {
+        run: string;
+        url?: string | undefined;
+        project?: string | undefined;
+        timeoutSec?: number | undefined;
+        stop?: string | undefined;
+    }>>;
+    notes: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    version: 1;
+    steps: {
+        verify?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        build?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        install?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        test?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        deploy?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+    };
+    preview?: {
+        run: string;
+        url?: string | undefined;
+        project?: string | undefined;
+        timeoutSec?: number | undefined;
+        stop?: string | undefined;
+    } | undefined;
+    notes?: string | undefined;
+    health?: {
+        url: string;
+        shaPath?: string | undefined;
+    } | undefined;
+}, {
+    preview?: {
+        run: string;
+        url?: string | undefined;
+        project?: string | undefined;
+        timeoutSec?: number | undefined;
+        stop?: string | undefined;
+    } | undefined;
+    version?: 1 | undefined;
+    notes?: string | undefined;
+    steps?: {
+        verify?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        build?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        install?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        test?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+        deploy?: {
+            run: string;
+            env?: Record<string, string> | undefined;
+            timeoutSec?: number | undefined;
+        } | undefined;
+    } | undefined;
+    health?: {
+        url: string;
+        shaPath?: string | undefined;
+    } | undefined;
+}>;
+export type ProjectRecipe = z.infer<typeof ProjectRecipeSchema>;
+export type ProjectRecipeStep = z.infer<typeof ProjectRecipeStepSchema>;
+export declare function parseProjectRecipe(value: unknown): {
+    ok: true;
+    recipe: ProjectRecipe;
+} | {
+    ok: false;
+    error: string;
+};
+/** Key-sorted JSON, so a reordered file does not read as a different recipe. */
+export declare function canonicalRecipeJson(recipe: unknown): string;
+/** Steps this recipe actually defines, in execution order. */
+export declare function recipeSteps(recipe: ProjectRecipe | null | undefined): RecipeStepName[];
+//# sourceMappingURL=recipe-schema.d.ts.map

package/dist/recipe-schema.js

@@ -0,0 +1,103 @@
+import { z } from 'zod';
+/**
+ * Mirror of `packages/shared/src/schemas/dev-recipe.ts` — the DevBridge side is
+ * the source of truth, exactly like `protocol.ts` mirrors the API's wire types.
+ *
+ * Copied rather than imported on purpose: this package is published to npm on
+ * its own and installed by users who have no DevBridge workspace, so a
+ * `@devbridge/shared` import would make the published tarball unresolvable.
+ * The two files are small, additive, and change together in one release.
+ *
+ * Deliberately NOT `.strict()`: the same JSON is stored in a JSONB column on
+ * the API side, and a strict schema turns «a newer release added a field» into
+ * «the whole recipe is unreadable» for every row written before it.
+ */
+export const RECIPE_STEP_NAMES = ['install', 'build', 'test', 'verify', 'deploy'];
+export const RECIPE_MAX_TIMEOUT_SEC = 3_600;
+export const RECIPE_DEFAULT_TIMEOUT_SEC = 900;
+/** Where a project's recipe proposal lives, relative to the repository root. */
+export const PROJECT_RECIPE_PATH = '.devbridge/project.json';
+const RecipeCommandSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(2_000)
+    .refine((value) => !/[\r\n]/.test(value), 'A recipe command must be a single line');
+export const ProjectRecipeStepSchema = z.object({
+    run: RecipeCommandSchema,
+    timeoutSec: z.number().int().min(5).max(RECIPE_MAX_TIMEOUT_SEC).optional(),
+    env: z.record(z.string().max(200), z.string().max(4_000)).optional(),
+});
+export const ProjectRecipeHealthSchema = z.object({
+    url: z
+        .string()
+        .url()
+        .max(500)
+        .refine((value) => /^https?:\/\//i.test(value), 'The health URL must be http or https')
+        .refine((value) => !/^https?:\/\/[^/@]*@/i.test(value), 'The health URL must not carry credentials'),
+    shaPath: z.string().max(200).optional(),
+});
+export const ProjectRecipePreviewSchema = z.object({
+    run: RecipeCommandSchema,
+    stop: RecipeCommandSchema.optional(),
+    url: z
+        .string()
+        .url()
+        .max(500)
+        .refine((value) => /^https?:\/\//i.test(value), 'The preview URL must be http or https')
+        .optional(),
+    project: z
+        .string()
+        .trim()
+        .min(1)
+        .max(60)
+        .regex(/^[a-z0-9][a-z0-9_-]*$/i, 'Invalid docker compose project name')
+        .optional(),
+    timeoutSec: z.number().int().min(5).max(RECIPE_MAX_TIMEOUT_SEC).optional(),
+});
+export const ProjectRecipeSchema = z.object({
+    version: z.literal(1).optional().default(1),
+    steps: z
+        .object({
+        install: ProjectRecipeStepSchema.optional(),
+        build: ProjectRecipeStepSchema.optional(),
+        test: ProjectRecipeStepSchema.optional(),
+        verify: ProjectRecipeStepSchema.optional(),
+        deploy: ProjectRecipeStepSchema.optional(),
+    })
+        .optional()
+        .default({}),
+    health: ProjectRecipeHealthSchema.optional(),
+    preview: ProjectRecipePreviewSchema.optional(),
+    notes: z.string().max(4_000).optional(),
+});
+export function parseProjectRecipe(value) {
+    const parsed = ProjectRecipeSchema.safeParse(value);
+    if (parsed.success)
+        return { ok: true, recipe: parsed.data };
+    const issue = parsed.error.issues[0];
+    const where = issue?.path.length ? `${issue.path.join('.')}: ` : '';
+    return { ok: false, error: `${where}${issue?.message ?? 'the recipe is not valid'}` };
+}
+/** Key-sorted JSON, so a reordered file does not read as a different recipe. */
+export function canonicalRecipeJson(recipe) {
+    const normalise = (value) => {
+        if (Array.isArray(value))
+            return value.map(normalise);
+        if (value && typeof value === 'object') {
+            const entries = Object.entries(value)
+                .filter(([, v]) => v !== undefined)
+                .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+            return Object.fromEntries(entries.map(([k, v]) => [k, normalise(v)]));
+        }
+        return value;
+    };
+    return JSON.stringify(normalise(recipe));
+}
+/** Steps this recipe actually defines, in execution order. */
+export function recipeSteps(recipe) {
+    if (!recipe?.steps)
+        return [];
+    return RECIPE_STEP_NAMES.filter((name) => Boolean(recipe.steps?.[name]?.run));
+}
+//# sourceMappingURL=recipe-schema.js.map

package/dist/recipe.d.ts

@@ -0,0 +1,94 @@
+import { type ProjectRecipe, type RecipeStepName } from './recipe-schema.js';
+export interface RecipeStateResult {
+    /** Absolute path we looked at, for the message when it is missing. */
+    path: string;
+    present: boolean;
+    /** The file as written, masked and capped — this is what a human approves. */
+    raw: string | null;
+    recipe: ProjectRecipe | null;
+    /** Why it could not be used, in a sentence. */
+    error: string | null;
+    /** Fingerprint of the parsed recipe; null when it did not parse. */
+    sha: string | null;
+    /** Steps the file defines, in execution order. */
+    steps: RecipeStepName[];
+    /**
+     * Every command this recipe would execute, one entry each — and THIS, not
+     * `raw`, is what the approval screen must show (session 15).
+     *
+     * `raw` is the whole file put through `maskString`, and a mask is a rewrite:
+     * the private-key pattern is `-----BEGIN … KEY-----[\s\S]*?(-----END …|$)`,
+     * so a single unterminated BEGIN line anywhere in the file replaces
+     * everything after it — including the commands — with `[MASKED:private-key]`.
+     * An agent that can edit its own branch could therefore hand a manager a
+     * recipe whose `deploy` step was invisible on the screen where they approved
+     * it, while the runner executed the real, unmasked text. The whole recipe
+     * model rests on «a human read exactly these commands».
+     *
+     * Masking each command on its own keeps a redaction inside the command it
+     * belongs to, and `redacted` says out loud that one happened.
+     */
+    commands: Array<{
+        step: string;
+        run: string;
+        redacted: boolean;
+    }>;
+    /**
+     * Commands layer 1 would refuse. Reported BEFORE approval so nobody approves
+     * a recipe whose build step can never run.
+     */
+    refusals: Array<{
+        step: string;
+        reason: string;
+    }>;
+}
+/**
+ * A stable fingerprint of a recipe.
+ *
+ * `verify_start` carries it and the runner refuses a run whose recipe does not
+ * match: an approval is an approval of specific commands, and «the approved
+ * recipe» has to mean the same bytes on both sides.
+ */
+export declare function recipeFingerprint(recipe: unknown): string;
+/**
+ * Read the proposal out of a checkout.
+ *
+ * `lstat` and not `stat`: a symlink at `.devbridge/project.json` pointing at
+ * `~/.aws/credentials` would otherwise be read and shown verbatim on the
+ * approval screen.
+ *
+ * The DIRECTORY is checked the same way, and separately (session 15): `lstat`
+ * on the file follows every symlink above it, so `.devbridge` itself being a
+ * link to somewhere else in the filesystem walked straight past the guard while
+ * the guard's own comment said it did not.
+ */
+export declare function readRecipeProposal(root: string): RecipeStateResult;
+/**
+ * Every command in the recipe, in the order a person should read them —
+ * `preview.run` and `preview.stop` included, exactly as the refusal check
+ * already covers them.
+ */
+export declare function recipeCommands(recipe: ProjectRecipe): Array<{
+    step: string;
+    run: string;
+    redacted: boolean;
+}>;
+/**
+ * Every command in the recipe that layer 1 would refuse, named by its step.
+ *
+ * Answered at read time, not at run time. A recipe whose `deploy` step contains
+ * `sudo systemctl restart` must fail the person reading the approval screen, not
+ * a build twenty minutes into a release.
+ */
+export declare function recipeRefusals(recipe: ProjectRecipe): Array<{
+    step: string;
+    reason: string;
+}>;
+/**
+ * Drop `//` and `/* *\/` comments without touching what is inside strings.
+ *
+ * A hand-rolled scanner rather than a regex: a regex that ignores string
+ * context eats the `//` in a URL, which is exactly what `health.url` is.
+ */
+export declare function stripJsonComments(text: string): string;
+//# sourceMappingURL=recipe.d.ts.map