@ever-works/contracts 1.0.0 → 1.0.2

package/dist/feed.types-BUfAuVJZ.d.ts

@@ -0,0 +1,1372 @@
+/**
+ * Provider selection for each capability category
+ */
+interface ProvidersDto {
+    /** Search provider plugin ID */
+    search?: string;
+    /** Screenshot provider plugin ID */
+    screenshot?: string;
+    /** AI provider plugin ID */
+    ai?: string;
+    /** Content extractor provider plugin ID */
+    contentExtractor?: string;
+    /** Pipeline provider plugin ID */
+    pipeline?: string;
+}
+
+/**
+ * Cadence options for work scheduled updates
+ */
+declare enum WorkScheduleCadence {
+    HOURLY = "hourly",
+    EVERY_3_HOURS = "every_3_hours",
+    EVERY_8_HOURS = "every_8_hours",
+    EVERY_12_HOURS = "every_12_hours",
+    DAILY = "daily",
+    WEEKLY = "weekly",
+    MONTHLY = "monthly"
+}
+/**
+ * Status options for work schedule
+ */
+declare enum WorkScheduleStatus {
+    DISABLED = "disabled",
+    ACTIVE = "active",
+    PAUSED = "paused",
+    CANCELED = "canceled"
+}
+/**
+ * Billing mode options for scheduled updates
+ */
+declare enum WorkScheduleBillingMode {
+    SUBSCRIPTION = "subscription",
+    USAGE = "usage"
+}
+
+declare const IMPORT_SOURCE_TYPES: readonly ["data_repo", "awesome_readme", "link_existing", "works_config"];
+type ImportSourceType = (typeof IMPORT_SOURCE_TYPES)[number];
+declare const AWESOME_README_IMPORT_MODES: readonly ["clone", "reuse_source"];
+type AwesomeReadmeImportMode = (typeof AWESOME_README_IMPORT_MODES)[number];
+type RepositoryRole = 'data' | 'work' | 'website';
+interface RepositoryTarget {
+    owner?: string;
+    repo: string;
+}
+interface RelatedRepositories {
+    data?: RepositoryTarget;
+    work?: RepositoryTarget;
+    website?: RepositoryTarget;
+}
+interface WorksConfigSnapshot {
+    name?: string;
+    initialPrompt?: string;
+    model?: string;
+    websiteRepo?: string;
+    scheduleCadence?: WorkScheduleCadence | null;
+    providers?: ProvidersDto;
+}
+interface SourceRepository<TImportedAt = string> {
+    url: string;
+    owner: string;
+    repo: string;
+    /**
+     * Which kind of import produced this record — and, since APW-01, that an
+     * **App Work** did.
+     *
+     * The widening is additive (APW-01 plan §3.2, `plan.md:310`): `IMPORT_SOURCE_TYPES`
+     * keeps its four members and every existing reader still sees the four
+     * `ImportSourceType` values it always did. The three `app_*` members are a
+     * separate closed set (`APP_SOURCE_REPOSITORY_TYPES`), so an imported entry can
+     * never become an App Work and an App Work can never be mistaken for an import
+     * (APW-01 FR-54). `supportsWorkSourceSync` answers `false` for all three: an App
+     * Work's repository is not an import source.
+     */
+    type: ImportSourceType | AppSourceRepositoryType;
+    importedAt: TImportedAt;
+    relatedRepositories?: RelatedRepositories;
+    worksConfig?: WorksConfigSnapshot;
+    /**
+     * APW-01 — the repository a `fork` or a `private-copy` App Work follows.
+     *
+     * **Absent for a `link`**, which has no upstream at all. The field lives on the
+     * shared shape (rather than only on `AppSourceRecord`) so a reader of this DTO
+     * can describe an App Work without importing the App-source module
+     * (`plan.md:310-317`).
+     */
+    upstream?: AppUpstreamRef;
+    /** APW-01 — the Blueprint shown in the create preview; APW-03 applies it on ready. */
+    blueprintId?: string;
+    /** APW-01 — how that Blueprint was matched, so every reader sees the same answer. */
+    blueprintMatchSource?: AppSourceBlueprintMatchSource;
+    /** APW-01 — true only when this App Work's creation made the fork or private copy (R-4). */
+    createdByThisWork?: boolean;
+    /**
+     * APW-01 — the member's decline of FR-29a's automatic start.
+     *
+     * Written only when the member declined, so an absent field means "on" and no
+     * existing row or caller changes meaning (`plan.md:240`, §4.2 step 10).
+     */
+    autoProvision?: boolean;
+}
+interface RepoVisibility {
+    data: boolean;
+    website: boolean;
+    work: boolean;
+}
+interface ImportEnrichmentConfig {
+    expansionFactor?: number;
+}
+interface AnalyzeRepositoryResponseDto {
+    sourceUrl: string;
+    owner: string;
+    repo: string;
+    detectedType: ImportSourceType | null;
+    isPublic: boolean;
+    requiresAuth: boolean;
+    structure?: {
+        hasDataFolder: boolean;
+        hasConfig: boolean;
+        hasReadme: boolean;
+        hasWorksConfig?: boolean;
+        isMultiFile?: boolean;
+        itemCount?: number;
+        categoryCount?: number;
+    };
+    worksConfig?: WorksConfigSnapshot;
+    relatedDataRepo?: {
+        name: string;
+        owner: string;
+    };
+    baseSlug?: string;
+    slugConflict?: {
+        hasConflict: boolean;
+        conflictingRepos: string[];
+        suggestedSlug: string;
+    };
+    hasDataRepoWriteAccess?: boolean;
+    error?: string;
+}
+interface ImportWorkDto {
+    sourceUrl: string;
+    sourceType: ImportSourceType;
+    awesomeReadmeImportMode?: AwesomeReadmeImportMode;
+    name: string;
+    owner?: string;
+    organization?: boolean;
+    gitProvider: string;
+    deployProvider?: string;
+    createMissingRepos?: boolean;
+    sync?: boolean;
+    providers?: ProvidersDto;
+    restoreWorksConfig?: boolean;
+    enrichmentConfig?: ImportEnrichmentConfig;
+}
+
+/**
+ * App Works — the Upstream model: fork readiness, Actions hygiene, upstream
+ * sync, divergence, and the closed reason-code sets the Upstream card, a test
+ * id and a translation key are all derived from.
+ *
+ * Owning epic: **APW-02** (Fork lifecycle — readiness, Actions hygiene, upstream
+ * sync, divergence, checkout keys).
+ *
+ * Spec: `docs/specs/features/app-works/APW-02-fork-lifecycle/spec.md`
+ * Plan: `docs/specs/features/app-works/APW-02-fork-lifecycle/plan.md` §3.4
+ * Tasks: `APW-02-fork-lifecycle/tasks.md` T50 (the three closed sets)
+ * Bindings: `CONTRACTS.md` §0 (R-8, R-14, R-21), §2, §4 (job table).
+ *
+ * FR-65 is the reason this file exists: readiness reasons, sync results and
+ * warning codes must each be a **closed set with one stable value per
+ * user-visible state**, and a provider-specific failure must be reported through
+ * the typed provider reason rather than a composed `handler_failed:<code>`
+ * string.
+ */
+
+/**
+ * The five readiness states (plan.md:353, data-model.md:105, spec.md:455-460).
+ *
+ * `waiting_for_setup_pr` is a normal resting state, not a failure: a linked
+ * repository and an adopted fork always pass through it (R-4).
+ */
+declare const APP_READINESS_STATES: readonly ["preparing", "ready", "timed_out", "failed", "waiting_for_setup_pr"];
+/** Union derived from {@link APP_READINESS_STATES}. */
+type AppReadinessState = (typeof APP_READINESS_STATES)[number];
+/**
+ * The eight coarse outcomes a sync run can end in (plan.md:354-363), reported as
+ * `sync.lastResult`.
+ *
+ * Kept alongside {@link APP_SYNC_REASONS} rather than replaced by it: the plan
+ * fixes this set, T50 adds a finer one, and nothing is ever removed (R-26).
+ */
+declare const APP_SYNC_RESULTS: readonly ["up_to_date", "fast_forwarded", "pull_request_opened", "pull_request_updated", "conflict", "skipped", "paused", "failed"];
+/** Union derived from {@link APP_SYNC_RESULTS}. */
+type AppSyncResult = (typeof APP_SYNC_RESULTS)[number];
+/**
+ * The fifteen fine-grained sync reasons (tasks.md:739-742), reported as
+ * `sync.lastReason` and written by the sync service — never a composed string.
+ */
+declare const APP_SYNC_REASONS: readonly ["up_to_date", "fast_forwarded", "pull_request_opened", "pull_request_updated", "pull_request_merged", "pull_request_closed", "conflict", "held_for_workflow_review", "skipped_rate_limited", "skipped_budget", "license_worse", "disabled_by_spec", "paused", "provider_unsupported", "failed"];
+/** Union derived from {@link APP_SYNC_REASONS}. */
+type AppSyncReason = (typeof APP_SYNC_REASONS)[number];
+/**
+ * The ten readiness failure reasons (tasks.md:737-738) — one member per
+ * user-visible state, written by the readiness handler and surfaced as
+ * `readiness.reason`.
+ *
+ * `setup_pull_request_closed` (spec.md:309) and `access_revoked` (spec.md:295)
+ * are the two the spec names directly; a provider failure is reported through
+ * {@link AppReadinessHandlerReason}, never through a composed member.
+ */
+declare const APP_READINESS_FAILURE_REASONS: readonly ["access_revoked", "dispatch_unavailable", "copy_refused", "too_large", "provider_unsupported", "timed_out", "setup_pull_request_closed", "handler_failed", "blueprint_apply_failed", "data_repository_missing"];
+/** Union derived from {@link APP_READINESS_FAILURE_REASONS}. */
+type AppReadinessFailureReason = (typeof APP_READINESS_FAILURE_REASONS)[number];
+/**
+ * The warning codes of spec §6.2, camelCased (spec.md:519-534, tasks.md:742-743).
+ *
+ * One member per table row, in table order. The task text says "the ten spec
+ * §6.2 rows" while the table has twelve; the table is the source and dropping
+ * the two extra rows would be a removal (R-26), so all twelve are here.
+ */
+declare const APP_UPSTREAM_WARNING_CODES: readonly ["upstreamArchived", "upstreamUnavailable", "forkMissing", "privateCopyMissing", "rateLimited", "defaultBranchRenamed", "privateCopyTooLarge", "historyRewritten", "needsAdmin", "appPermissionMissing", "notReady", "workflowsGated"];
+/** Union derived from {@link APP_UPSTREAM_WARNING_CODES}. */
+type AppUpstreamWarningCode = (typeof APP_UPSTREAM_WARNING_CODES)[number];
+/**
+ * The upstream's own health (plan.md:364), derived from a provider read and
+ * cached in the Upstream state row.
+ */
+declare const APP_UPSTREAM_STATUSES: readonly ["available", "archived", "unavailable", "none", "unknown"];
+/** Union derived from {@link APP_UPSTREAM_STATUSES}. */
+type AppUpstreamStatus = (typeof APP_UPSTREAM_STATUSES)[number];
+/**
+ * The Actions hygiene outcome (plan.md:365-372).
+ *
+ * `needs_admin` and `permission_missing` are named states that must NOT block
+ * readiness or sync (FR-30); `not_applicable` is a linked repository, which
+ * hygiene never touches (FR-31).
+ */
+declare const APP_ACTIONS_STATES: readonly ["pending", "clean", "needs_admin", "permission_missing", "failed", "not_applicable"];
+/** Union derived from {@link APP_ACTIONS_STATES}. */
+type AppActionsState = (typeof APP_ACTIONS_STATES)[number];
+/** Why a readiness job was dispatched (plan.md:433). */
+declare const APP_FORK_READINESS_REASONS: readonly ["initial", "retry", "redispatch", "setup_merged"];
+/** Union derived from {@link APP_FORK_READINESS_REASONS}. */
+type AppForkReadinessReason = (typeof APP_FORK_READINESS_REASONS)[number];
+/** The Work Repository as the Upstream card reports it (plan.md:376-382). */
+interface AppUpstreamWorkRepositoryView {
+    owner: string;
+    repo: string;
+    url: string;
+    defaultBranch: string;
+    /** `missing` is the FR-42 state: every background job stops and says so. */
+    status: 'available' | 'missing';
+}
+/** The upstream as the Upstream card reports it (plan.md:383-390). */
+interface AppUpstreamView {
+    owner: string;
+    repo: string;
+    url: string;
+    defaultBranch: string;
+    /** Set when upstream renamed its default branch and sync followed it (FR-43). */
+    previousDefaultBranch?: string;
+    status: AppUpstreamStatus;
+}
+/**
+ * The readiness block of the Upstream response (plan.md:391-399 + tasks.md:743).
+ *
+ * `manualRetriesLeft` counts FR-19's 3-per-hour **Try again** allowance;
+ * `handlerReason` carries the typed provider refusal (reason and the single
+ * permission it needs, FR-54) instead of a composed string.
+ */
+interface AppUpstreamReadinessView {
+    state: AppReadinessState;
+    reason?: AppReadinessFailureReason;
+    handlerReason?: AppReadinessHandlerReason;
+    startedAt: string;
+    readyAt?: string;
+    setupPullRequestUrl?: string;
+    setupPullRequestNumber?: number;
+    manualRetriesLeft: number;
+}
+/**
+ * A typed provider refusal (tasks.md:743-745, FR-54).
+ *
+ * `code` is the provider's own reason, not a closed App Works set: the platform
+ * layer already owns that union, and restating it here would give it two
+ * definitions.
+ */
+interface AppReadinessHandlerReason {
+    code: string;
+    permission?: string;
+}
+/** Commits ahead of and behind upstream, with when they were read (plan.md:400, FR-46/FR-47). */
+interface AppUpstreamDivergenceView {
+    aheadBy: number;
+    behindBy: number;
+    computedAt: string;
+    stale: boolean;
+}
+/** The sync block of the Upstream response (plan.md:401-415). */
+interface AppUpstreamSyncView {
+    /** The App spec's five-field cron, or `null` when none is configured. */
+    schedule: string | null;
+    nextRunAt?: string;
+    running: boolean;
+    lastResult?: AppSyncResult;
+    lastReason?: AppSyncReason;
+    lastStartedAt?: string;
+    lastFinishedAt?: string;
+    lastCommitCount?: number;
+    pullRequest?: {
+        number: number;
+        url: string;
+    };
+    /** The one open conflict Task, reused rather than duplicated (FR-38). */
+    conflictTaskId?: string;
+    manualSyncsLeft: number;
+    rateLimitedUntil?: string;
+    rateLimitedPersistent: boolean;
+}
+/** The Actions hygiene block of the Upstream response (plan.md:416-421). */
+interface AppUpstreamActionsView {
+    state: AppActionsState;
+    disabled: Array<{
+        path: string;
+    }>;
+    kept: Array<{
+        path: string;
+    }>;
+    checkedAt?: string;
+}
+/** One warning, with its code and the parameters its copy interpolates (FR-65). */
+interface AppUpstreamWarning {
+    code: AppUpstreamWarningCode;
+    params?: Record<string, string>;
+}
+/**
+ * `GET /api/works/:id/upstream` (plan.md:373-423, resolution R-8).
+ *
+ * `relation` reuses APW-01's mode union rather than restating the same three
+ * values. `upstream` and `sync` are `null` for a linked App Work, which has no
+ * upstream at all (FR-44).
+ */
+interface AppUpstreamStateResponse {
+    workId: string;
+    relation: AppRepositoryMode;
+    dataRepository: AppUpstreamWorkRepositoryView;
+    upstream: AppUpstreamView | null;
+    readiness: AppUpstreamReadinessView;
+    divergence: AppUpstreamDivergenceView | null;
+    sync: AppUpstreamSyncView | null;
+    actions: AppUpstreamActionsView | null;
+    warnings: AppUpstreamWarning[];
+}
+/** The probe schedule after the request: 2, 4, 8 and 15 seconds (FR-18, spec.md:288). */
+declare const APP_FORK_READINESS_POLL_DELAYS_MS: readonly [2000, 4000, 8000, 15000];
+/** Then every 15 seconds until the deadline (FR-18, spec.md:288-289). */
+declare const APP_FORK_READINESS_POLL_INTERVAL_MS = 15000;
+/** At most 15 minutes of checking, then **timed out** with one Activity entry (FR-18, spec.md:289). */
+declare const APP_FORK_READINESS_TIMEOUT_MS = 900000;
+/** The p95 target for a fork becoming ready (plan.md:427). */
+declare const APP_FORK_READINESS_READY_LATENCY_MS = 30000;
+/** **Try again** is limited to 3 per App Work per hour (FR-19, spec.md:293-294). */
+declare const APP_FORK_READINESS_MANUAL_RETRIES_PER_HOUR = 3;
+/** A readiness job that never reported for 10 minutes is restarted, at most 3 times (FR-23, spec.md:302-303). */
+declare const APP_FORK_READINESS_MAX_REDISPATCH = 3;
+/** A job that was never started or stopped reporting for 10 minutes is stale (FR-23, spec.md:302). */
+declare const APP_FORK_READINESS_IDLE_MS = 600000;
+/**
+ * The floor a non-production installation may shorten the deadline to —
+ * **never** applied in production, which always uses the 15 minutes (FR-18a,
+ * spec.md:290-292).
+ */
+declare const APP_FORK_READINESS_TIMEOUT_OVERRIDE_MIN_MS = 5000;
+/** The environment variable that carries the non-production override (FR-18a). */
+declare const APP_FORK_READINESS_TIMEOUT_ENV = "EVER_WORKS_APP_FORK_READINESS_TIMEOUT_MS";
+/** An open setup pull request is checked at least every 10 minutes (FR-24a, spec.md:306-307). */
+declare const APP_SETUP_PR_CHECK_ON_VIEW_MIN_INTERVAL_MS = 60000;
+/** …and within 60 seconds of the App Work being viewed; at most this many per tick (FR-24a, CONTRACTS.md:480). */
+declare const APP_SETUP_PR_CHECK_BATCH = 50;
+/** Mondays at 06:00 UTC when the App spec declares no schedule (FR-32, spec.md:329-330). */
+declare const APP_UPSTREAM_SYNC_DEFAULT_SCHEDULE = "0 6 * * 1";
+/** A schedule firing more often than once an hour is treated as hourly (FR-32, spec.md:329-330). */
+declare const APP_UPSTREAM_SYNC_MIN_INTERVAL_MS = 3600000;
+/** Each App Work's run is delayed by a stable 0–300 seconds (FR-32, spec.md:330-331). */
+declare const APP_UPSTREAM_SYNC_JITTER_MAX_MS = 300000;
+/** **Sync now** is limited to 6 per App Work per hour (FR-33, spec.md:332-333). */
+declare const APP_UPSTREAM_SYNC_MANUAL_PER_HOUR = 6;
+/** **Sync now** answers within 2 seconds without waiting (FR-33, spec.md:332). */
+declare const APP_UPSTREAM_SYNC_ACK_BUDGET_MS = 2000;
+/** At most one sync runs per App Work at a time — the lock TTL (FR-34, spec.md:334). */
+declare const APP_UPSTREAM_SYNC_LOCK_TTL_MS = 1800000;
+/** The dispatcher tick, every 10 minutes (CONTRACTS.md:480). */
+declare const APP_UPSTREAM_SYNC_DISPATCH_CRON = "*/10 * * * *";
+/** At most 50 syncs per 10-minute tick (FR-53, spec.md:379). */
+declare const APP_UPSTREAM_SYNC_DISPATCH_BATCH = 50;
+/** One sync makes at most 20 provider calls (FR-49, spec.md:373). */
+declare const APP_UPSTREAM_SYNC_MAX_PROVIDER_CALLS = 20;
+/** The branch a sync pull request comes from (FR-36, spec.md:340-342). */
+declare const APP_UPSTREAM_SYNC_BRANCH = "ever-works/upstream-sync";
+/** The conflict Task's label prefix, one open Task per App Work (FR-38, spec.md:345-346). */
+declare const APP_UPSTREAM_CONFLICT_LABEL_PREFIX = "app-upstream-conflict:";
+/** Up to 50 conflicting paths are listed in the conflict Task (FR-38, spec.md:346). */
+declare const APP_UPSTREAM_CONFLICT_MAX_PATHS = 50;
+/** Hygiene is capped at 100 workflows per run, and records at most 100 kept and 100 disabled (FR-28/FR-29). */
+declare const APP_ACTIONS_HYGIENE_MAX_WORKFLOWS = 100;
+/** Fewer than 300 requests left in the member's budget skips the run until the reset plus 60 s (FR-50, spec.md:374-375). */
+declare const APP_RATE_LIMIT_MIN_REMAINING = 300;
+/** The grace period added to the provider's reset time (FR-50, spec.md:374-375). */
+declare const APP_RATE_LIMIT_RESET_GRACE_MS = 60000;
+/** Secondary rate limits back off starting at 60 seconds (FR-51, spec.md:376-377). */
+declare const APP_RATE_LIMIT_BACKOFF_BASE_MS = 60000;
+/** …doubling to at most 60 minutes (FR-51, spec.md:377). */
+declare const APP_RATE_LIMIT_BACKOFF_MAX_MS = 3600000;
+/** Three consecutive rate-limited runs make the notice persistent (FR-52, spec.md:378). */
+declare const APP_RATE_LIMITED_PERSISTENT_AFTER = 3;
+/** Divergence counts are refreshed when the App Work is viewed and they are older than 10 minutes (FR-46). */
+declare const APP_DIVERGENCE_TTL_MS = 600000;
+/** …and at least once a day (FR-46, spec.md:364-365). */
+declare const APP_DIVERGENCE_DAILY_MS = 86400000;
+/** "Upstream behind" is emitted when behind grows by 25 or more since the last emission (FR-48, spec.md:368-369). */
+declare const APP_BEHIND_EVENT_STEP = 25;
+/** An unreadable upstream is re-checked every 24 hours (FR-41, spec.md:354-355). */
+declare const APP_UPSTREAM_UNAVAILABLE_RECHECK_MS = 86400000;
+/**
+ * Why APW-03's license gate is asked to re-evaluate an App Work —
+ * `AppLicenseService.request(workId, reason)`.
+ *
+ * Added by **APW-02 T26**, whose task text fixes the contract: "`AppLicenseService.request(workId,
+ * reason)` gains its reason union in CONTRACTS §2A as part of this task's PR". The union did not
+ * exist anywhere in this package, and it is declared here — in APW-02's own Upstream module, beside
+ * the sync limits that produce two of its three members — rather than in a second file, so
+ * `AppLicenseService` has exactly one reason vocabulary.
+ *
+ * Members, and the caller each one comes from:
+ *
+ * - `upstream_synced` — APW-02 §6.3 step 8 / FR-40: a sync moved the tracked branch
+ *   (`APW-02/plan.md:751-752`, status service `app-upstream-state.service.ts:989`).
+ * - `upstream_merged` — APW-02 FR-62 / T29: a sync pull request was merged, so the license is asked
+ *   once more for the range that landed (`APW-02/tasks.md:719`).
+ * - `blueprint_applied` — APW-03 §2.5 step 0: a Blueprint was applied and its `license` block may
+ *   have changed the classification (`APW-03/plan.md:286`).
+ *
+ * APW-03 appends its own triggers (registry refresh, manual re-check, header evidence —
+ * `CONTRACTS.md:487`) to this list when its job lands: the union is **append-only** (R-26), and a
+ * caller that switches exhaustively over it gains a compile error rather than a silent default.
+ */
+declare const APP_LICENSE_EVALUATION_REASONS: readonly ["upstream_synced", "upstream_merged", "blueprint_applied"];
+/** Union derived from {@link APP_LICENSE_EVALUATION_REASONS}. */
+type AppLicenseEvaluationReason = (typeof APP_LICENSE_EVALUATION_REASONS)[number];
+/**
+ * Whether a manual **Sync now** may start, given how many ran in the current
+ * hour — `at most 6`, so the seventh is refused (FR-33).
+ *
+ * Fails closed on anything that is not a non-negative count.
+ */
+declare function appManualSyncAllowed(manualSyncsThisHour: number): boolean;
+/**
+ * Whether the member's remaining provider budget lets a run start — FR-50 says
+ * "fewer than 300 remaining", so exactly 300 still runs.
+ *
+ * Fails closed on an unknown budget.
+ */
+declare function appRateLimitAllowsSync(remainingRequests: number): boolean;
+
+/**
+ * App Works — the App source model: how an App Work relates to the repository
+ * it was made from, plus the inspect (preview) and create contracts both doors
+ * share.
+ *
+ * Owning epic: **APW-01** (App Work kind & create from any repository URL).
+ * The persisted source record and the App spec's `source` block are APW-01's
+ * (CONTRACTS.md §1 `source`, §2, §2A), so they live here and APW-03/04/09/11
+ * read them rather than restating them.
+ *
+ * Spec: `docs/specs/features/app-works/APW-01-app-work-kind/spec.md`
+ * Plan: `docs/specs/features/app-works/APW-01-app-work-kind/plan.md` §3.2
+ * Bindings: `docs/specs/features/app-works/CONTRACTS.md` §0 (R-1, R-2, R-12),
+ * §2, §2A, §7A, §12.
+ *
+ * Three things this file deliberately does NOT do:
+ *  - it does not redeclare `RepositoryRole`, `RelatedRepositories`,
+ *    `ImportSourceType` or `SourceRepository` — they already ship in
+ *    `../api/work/import-source.dto.ts` and are imported here;
+ *  - it does not widen `IMPORT_SOURCE_TYPES` (Work Import validates against it,
+ *    CONTRACTS.md §2) — the `app_*` types are a separate closed set;
+ *  - it declares no canonical App-spec type (`LicenseClass`,
+ *    `BlueprintMatchSource`, `AppSpec` …): those are APW-03's, and the preview
+ *    subsets here carry source-prefixed names on purpose so the apps barrel can
+ *    never see the same export twice.
+ */
+
+/**
+ * The persisted `works.sourceRepository.type` values an App Work may carry
+ * (APW-01 plan.md:293, CONTRACTS.md:266).
+ *
+ * A new constant on purpose: `IMPORT_SOURCE_TYPES` is **not** widened, because
+ * Work Import validates against it and an imported entry must never become an
+ * App Work (APW-01 FR-54).
+ */
+declare const APP_SOURCE_REPOSITORY_TYPES: readonly ["app_link", "app_fork", "app_private_copy"];
+/** Union derived from {@link APP_SOURCE_REPOSITORY_TYPES}. */
+type AppSourceRepositoryType = (typeof APP_SOURCE_REPOSITORY_TYPES)[number];
+/**
+ * The upstream a fork or private copy follows (APW-01 plan.md:295-299).
+ *
+ * This is the **persisted** shape (`{ owner, repo }`); the App spec's own
+ * `source.upstream.repo` is the single `owner/name` string — see
+ * {@link AppSourceBlock}.
+ */
+interface AppUpstreamRef {
+    owner: string;
+    repo: string;
+    defaultBranch: string;
+}
+/**
+ * The role the App Work's code repository is persisted under — **`website`**,
+ * whose UI label is literally "Work Repository" (APW-01 FR-2, CONTRACTS.md
+ * §2 vocabulary fix). It is never `data`: `data` holds the Work's *content*.
+ *
+ * Reused from the shipping DTO rather than redeclared, so the two cannot drift.
+ */
+declare const APP_WORK_REPOSITORY_ROLE: RepositoryRole;
+/**
+ * The relation (mode) the member chose, as every API surface spells it
+ * (APW-01 plan.md:325; openapi `AppWorkCreateRequest.repositoryMode`).
+ *
+ * The nine deploy-target literals of R-12 are the *other* axis; this one is
+ * "how did we get a Work Repository".
+ */
+declare const APP_REPOSITORY_MODES: readonly ["link", "fork", "private-copy"];
+/** Union derived from {@link APP_REPOSITORY_MODES}. */
+type AppRepositoryMode = (typeof APP_REPOSITORY_MODES)[number];
+/**
+ * Mode → persisted source type (CONTRACTS.md:266). One entry per mode and no
+ * value twice, so a reader can never map two modes onto one record.
+ */
+declare const APP_SOURCE_REPOSITORY_TYPE_BY_MODE: Readonly<Record<AppRepositoryMode, AppSourceRepositoryType>>;
+/**
+ * The Work Repository name suffixes (APW-01 FR-20a, spec.md:341-349).
+ *
+ * `-app` when the App Work was created from an app template, `-website`
+ * otherwise — the unchanged default for Website/Work Templates and for every
+ * non-`app` kind. A naming convention ONLY: the persisted role stays
+ * {@link APP_WORK_REPOSITORY_ROLE} and no new role value is added.
+ */
+declare const APP_SOURCE_REPOSITORY_NAME_SUFFIXES: {
+    readonly app: "-app";
+    readonly default: "-website";
+};
+/** The Work Repository file that carries the App spec (APW-01 FR-29, spec.md:374). */
+declare const APP_SOURCE_SPEC_FILE = ".works/works.yml";
+/** The spec version an App Work records — `.works/works.yml` version 2 (spec.md:374). */
+declare const APP_SOURCE_SPEC_VERSION = 2;
+/** The kind discriminator an App Work records (spec.md:375). */
+declare const APP_SOURCE_SPEC_KIND = "app";
+/**
+ * The App spec's `source` block as written into the Work Repository
+ * (APW-01 FR-29, CONTRACTS.md:102-105, APW-03 schema.md §5).
+ *
+ * Field names are the schema's, not this file's: `upstream.repo` is the single
+ * `owner/name` string, and `branch` is the Work Repository branch that is built
+ * and deployed. `relation` must equal the relation recorded at creation
+ * (`source_relation_mismatch`, schema.md:119-120) — a hand edit cannot turn a
+ * fork into a link.
+ */
+interface AppSourceBlock {
+    /** `link` · `fork` · `private-copy` (schema.md:114). */
+    relation: AppRepositoryMode;
+    /** Absent when `relation` is `link`, which forbids it (schema.md:115, R13). */
+    upstream?: {
+        /** `owner/name`, matching `^[A-Za-z0-9-]{1,39}/[A-Za-z0-9._-]{1,100}$`. */
+        repo: string;
+        /** Upstream's default branch at creation; a Git ref name, 1–255 chars. */
+        defaultBranch?: string;
+    };
+    /** The Work Repository branch that is built and deployed; 1–255 chars. */
+    branch?: string;
+}
+/**
+ * `works.sourceRepository` for `kind: app` (APW-01 plan.md:240).
+ *
+ * Extends the shipping {@link SourceRepository} so the shared fields
+ * (`url`, `owner`, `repo`, `importedAt`, `relatedRepositories`) keep exactly one
+ * definition; `type` is narrowed to the three `app_*` values. Top-level
+ * `owner`/`repo` are the **Work Repository** (the `website` role) — the app-code
+ * fork is recorded there, never under `data` (CONTRACTS.md:267).
+ *
+ * `worksConfig` is inherited from the shared shape and is deliberately kept:
+ * FR-43 forbids *writing* generator settings into an App Work's file, and
+ * removing the field would narrow a shape other readers still type against.
+ */
+interface AppSourceRecord<TImportedAt = string> extends Omit<SourceRepository<TImportedAt>, 'type'> {
+    type: AppSourceRepositoryType;
+    /** Present for `fork` and `private-copy`; absent for `link`. */
+    upstream?: AppUpstreamRef;
+    /** The Blueprint resolved server-side at create time (APW-01 FR-29b). */
+    blueprintId?: string;
+    /** How that Blueprint was matched, so every caller sees the same decision. */
+    blueprintMatchSource?: AppSourceBlueprintMatchSource;
+    /** True only when THIS creation issued the fork request or made the copy (R-4). */
+    createdByThisWork?: boolean;
+    /**
+     * The member's decline of FR-29a's automatic start (App spec plan.md:240,
+     * APW-01 plan.md §3.1, §4.2 step 10).
+     *
+     * **Written only when the member declined**, so an absent property means "on":
+     * no migration, no backfill, and no existing caller or stored row changes
+     * meaning. It is what `AppSourceInitializerService` step 8 reads to skip the
+     * automatic provisioning start, leaving the Overview's Provisioning card in its
+     * **Not started** state with a **Provision** button instead. It is never cleared
+     * automatically.
+     *
+     * `boolean` rather than the literal `false` so a future "explicitly on" value is
+     * expressible without changing this shape (R-26, additive only).
+     */
+    autoProvision?: boolean;
+}
+/**
+ * The value `SourceRepository.type` accepts once APW-01's widening lands
+ * (plan.md:310). Declared here so that edit — which belongs to
+ * `../api/work/import-source.dto.ts`, not to this file — has one name to import.
+ */
+type WorkSourceRepositoryType = ImportSourceType | AppSourceRepositoryType;
+/** Re-exported for readers of an App source record; the DTO is the definition. */
+type AppSourceRelatedRepositories = RelatedRepositories;
+/**
+ * The three deploy targets, and the ONLY definition of them
+ * (CONTRACTS.md:335): APW-06 imports and re-exports this as
+ * `APP_DEPLOY_TARGETS` instead of writing a second array.
+ *
+ * `none` is "None — don't deploy yet" and is the default; there is no separate
+ * deferred-deploy state (R-12, CONTRACTS.md:55).
+ */
+declare const APP_DEPLOY_TARGET_CHOICES: readonly ["none", "your-cluster", "ever-works-apps"];
+/** Union derived from {@link APP_DEPLOY_TARGET_CHOICES}. */
+type AppDeployTargetChoice = (typeof APP_DEPLOY_TARGET_CHOICES)[number];
+/**
+ * The closed set of user-facing inspect and create reason codes — the 24 rows of
+ * APW-01 spec §6.3 (spec.md:606-633), in table order. Append-only: a member is
+ * never renamed or removed, and a code is never reused for another situation
+ * (CONTRACTS.md §12).
+ */
+declare const APP_SOURCE_REASON_CODES: readonly ["invalid_url", "provider_not_connected", "insufficient_scope", "not_found", "sso_authorization_required", "oauth_app_restricted", "empty_repository", "no_push_access", "archived", "forking_disabled", "own_repository", "target_owner_unavailable", "target_owner_forbidden", "too_large_for_private_copy", "uses_lfs", "copy_name_unavailable", "in_use_by_another_account", "app_work_exists", "create_in_progress", "rate_limited", "managed_hosting_unavailable", "cluster_target_unavailable", "app_works_disabled", "blueprint_mismatch"];
+/** Union derived from {@link APP_SOURCE_REASON_CODES}. */
+type AppSourceReasonCode = (typeof APP_SOURCE_REASON_CODES)[number];
+/**
+ * Fail-closed guard for a reason code arriving off the wire, out of a job
+ * payload or out of a test fixture: anything that is not a member is `false`,
+ * never a coerced string.
+ */
+declare function isAppSourceReasonCode(value: unknown): value is AppSourceReasonCode;
+/**
+ * Whether a mode or a deploy target is offered, and — when it is not — the ONE
+ * stable code that explains it (APW-01 FR-5, FR-12, FR-33).
+ *
+ * `reason` is absent exactly when `available` is true, so a disabled option
+ * always has text a card, a test id and a translation key can be derived from.
+ */
+interface AppModeAvailability {
+    available: boolean;
+    reason?: AppSourceReasonCode;
+}
+/**
+ * A deploy target's availability (APW-01 FR-33/FR-34, tasks.md:82-83).
+ *
+ * `providerId` is set only when the target is available **and** is not `none`
+ * — it is the plugin the create request persists, from which APW-06 derives the
+ * runtime's target exactly once (FR-34).
+ */
+interface AppDeployTargetAvailability extends AppModeAvailability {
+    providerId?: string;
+}
+/** The three states a Blueprint preview can be in (plan.md:396, openapi:228). */
+declare const APP_SOURCE_BLUEPRINT_STATUSES: readonly ["matched", "none", "unavailable"];
+/** Union derived from {@link APP_SOURCE_BLUEPRINT_STATUSES}. */
+type AppSourceBlueprintStatus = (typeof APP_SOURCE_BLUEPRINT_STATUSES)[number];
+/**
+ * How the Blueprint was matched (APW-01 plan.md:240).
+ *
+ * APW-03 owns the canonical `BlueprintMatchSource` (CONTRACTS.md §2A); this is
+ * the source record's spelling of the same five members and carries the prefix
+ * so the apps barrel never re-exports one name twice.
+ */
+declare const APP_SOURCE_BLUEPRINT_MATCH_SOURCES: readonly ["manifest", "alias", "fork", "probe", "explicit"];
+/** Union derived from {@link APP_SOURCE_BLUEPRINT_MATCH_SOURCES}. */
+type AppSourceBlueprintMatchSource = (typeof APP_SOURCE_BLUEPRINT_MATCH_SOURCES)[number];
+/**
+ * One prompted value a Blueprint asks for (APW-01 FR-55, tasks.md:85).
+ *
+ * **Never a value**: the preview shows the name, the description and whether
+ * the value is required; the member's answers travel write-only on the create
+ * request and are never echoed by any read.
+ */
+interface AppBlueprintPrompt {
+    name: string;
+    description?: string;
+    required: boolean;
+}
+/** The Blueprint the create preview shows and the platform settles server-side. */
+interface AppBlueprintPreview {
+    status: AppSourceBlueprintStatus;
+    id?: string;
+    version?: string;
+    verified?: boolean;
+    /** Display name, shown when present (APW-01 tasks.md:778). */
+    name?: string;
+    /** The entry's trademark notice, shown when present (APW-01 tasks.md:778). */
+    notice?: string;
+    matchSource?: AppSourceBlueprintMatchSource;
+    prompts?: AppBlueprintPrompt[];
+}
+/**
+ * The four license classes (APW-01 FR-8, R-3 in CONTRACTS.md:46).
+ *
+ * `unknown` is a first-class answer, never a guessed class: when the lookup is
+ * unavailable inspect still answers, with the license marked unknown.
+ */
+declare const APP_SOURCE_LICENSE_CLASSES: readonly ["green", "amber", "red", "unknown"];
+/** Union derived from {@link APP_SOURCE_LICENSE_CLASSES}. */
+type AppSourceLicenseClass = (typeof APP_SOURCE_LICENSE_CLASSES)[number];
+/** The three evidence sources of the App spec's `license` block (APW-03 schema.md:143). */
+declare const APP_SOURCE_LICENSE_SOURCES: readonly ["detected", "blueprint", "user"];
+/** Union derived from {@link APP_SOURCE_LICENSE_SOURCES}. */
+type AppSourceLicenseSource = (typeof APP_SOURCE_LICENSE_SOURCES)[number];
+/**
+ * The license preview inspect returns (plan.md:402).
+ *
+ * `source` cannot be `user` here: nothing is persisted before create, so the
+ * only evidence available is what was detected or what the Blueprint declares.
+ */
+interface AppSourceLicensePreview {
+    spdx: string | null;
+    class: AppSourceLicenseClass;
+    source: Exclude<AppSourceLicenseSource, 'user'>;
+}
+/** What inspect is asked for (openapi `AppSourceInspectRequest`). */
+interface AppSourceInspectRequest {
+    /** GitHub repository URL; trimmed before parsing, at most 400 characters (FR-6). */
+    repositoryUrl: string;
+    /** Validated against the URL parser's host rules, not a literal list. */
+    gitProvider?: string;
+    /**
+     * A catalog id. When sent, the resolver previews exactly that entry; when it
+     * does not match the repository, create answers `blueprint_mismatch`
+     * (APW-01 FR-56).
+     */
+    blueprintId?: string;
+}
+/**
+ * One owner the caller can fork into, with the state of its existing-fork check
+ * (APW-01 FR-9, plan.md:192-194).
+ *
+ * `existingForkChecked` is REQUIRED: an owner the 15-call budget did not reach
+ * keeps its computed `available`, carries **no** reason code and is reported as
+ * not checked — never as "no fork". Creating into it still adopts a fork that
+ * exists there (FR-19).
+ */
+interface AppTargetOwner {
+    login: string;
+    type: 'user' | 'organization';
+    available: boolean;
+    reason?: AppSourceReasonCode;
+    /** Present only when the scan reached this owner and found a fork. */
+    existingFork?: {
+        owner: string;
+        repo: string;
+        fullName: string;
+        url: string;
+        inUseByAnotherAccount: boolean;
+    };
+    existingForkChecked: boolean;
+}
+/**
+ * The inspection result (plan.md:371-406; openapi `AppSourceInspectResponse`).
+ *
+ * Inspect writes nothing: no repository, no row, no Activity, no file (FR-5),
+ * which is why a provider-side refusal still answers 200 with every mode marked
+ * unavailable and a classified reason.
+ */
+interface AppSourceInspectResponse {
+    repository: {
+        owner: string;
+        repo: string;
+        fullName: string;
+        url: string;
+        description?: string;
+        defaultBranch: string;
+        stars: number;
+        sizeKb: number;
+        visibility: 'public' | 'private' | 'internal';
+        archived: boolean;
+        empty: boolean;
+        isFork: boolean;
+        /** The immediate parent, when the repository is a fork. */
+        parent?: string;
+        /** The fork network's root, when the provider reports one. */
+        source?: string;
+        allowForking: boolean;
+        /** Set when the repository moved; the old coordinates (APW-02 FR-15). */
+        movedFrom?: string;
+        usesLfs: boolean;
+    };
+    access: {
+        canPush: boolean;
+        canAdmin: boolean;
+    };
+    modes: Record<AppRepositoryMode, AppModeAvailability>;
+    /** `null` when neither Link nor Fork is available. */
+    defaultMode: AppRepositoryMode | null;
+    /** The caller first, then the offered organizations A–Z (≤ 30 in P1, ≤ 200 in P2). */
+    targetOwners: AppTargetOwner[];
+    blueprint: AppBlueprintPreview;
+    /** `source` is `detected` or `blueprint`; `unknown` is a real answer (FR-8). */
+    license: AppSourceLicensePreview;
+    deployTargets: Record<AppDeployTargetChoice, AppDeployTargetAvailability>;
+    /** The CALLER's own existing App Work — never another account's. */
+    existingAppWork?: {
+        id: string;
+        name: string;
+        slug: string;
+    };
+    /**
+     * True when the existing-fork scan did not reach every offered owner
+     * (APW-01 FR-9, tasks.md:84-85).
+     *
+     * Required, not optional: a client that forgets it would silently render a
+     * partial scan as complete. (APW-01 tasks.md:748 later calls it optional,
+     * which would weaken this; R-26 forbids that, so the required reading wins.)
+     */
+    scanIncomplete: boolean;
+    /** ISO timestamp, present when `rate_limited` refused something. */
+    retryAfter?: string;
+}
+/**
+ * The repository facts the mode resolver reads. Deliberately narrower than
+ * {@link AppSourceInspectResponse} so it can be built from a provider read, a
+ * cached inspect or a test fixture without inventing a response.
+ */
+interface AppRepositoryModeFacts {
+    canPush: boolean;
+    archived: boolean;
+    empty: boolean;
+    allowForking: boolean;
+    usesLfs: boolean;
+    /** The provider-reported size in KB; absent or unmeasurable fails closed. */
+    sizeKb?: number | null;
+    visibility: 'public' | 'private' | 'internal';
+    /** The pasted repository is itself a fork. */
+    isFork: boolean;
+    /** The member owns this repository in the target account (FR-18). */
+    isOwnRepository: boolean;
+    /** Another account already uses this repository in Ever Works (FR-26). */
+    isInUseByAnotherAccount: boolean;
+}
+/** The resolver's answer: every mode, plus the one the form should pre-select. */
+interface AppRepositoryModeResolution {
+    modes: Record<AppRepositoryMode, AppModeAvailability>;
+    defaultMode: AppRepositoryMode | null;
+}
+/**
+ * Which modes the create form may offer, and which one it pre-selects —
+ * FR-17, FR-18 and FR-20 exactly, in the order those requirements list their
+ * conditions, so a disabled card always has the reason the spec gives it.
+ *
+ * Fails closed on an unmeasurable `sizeKb`: a repository whose size could not be
+ * read is NOT offered as a private copy, because "we could not measure it" must
+ * never be rendered as "it fits".
+ */
+declare function resolveAppRepositoryModes(factsInput: AppRepositoryModeFacts): AppRepositoryModeResolution;
+/**
+ * The fields APW-01 ADDS to the existing create request (plan.md:421-428;
+ * openapi `AppWorkCreateRequest`). The rest of the create DTO is unchanged and
+ * is deliberately not restated here.
+ */
+interface AppWorkCreateRequest {
+    kind: 'app';
+    repositoryUrl: string;
+    /** Required for `kind: app`; the three {@link APP_REPOSITORY_MODES}. */
+    repositoryMode?: AppRepositoryMode;
+    /** Required for `fork` and `private-copy`; the caller's account or organization. */
+    targetOwner?: string;
+    /** The supported way to give a Blueprint to a repository no catalog entry lists (APW-03 FR-81). */
+    blueprintId?: string;
+    /**
+     * Write-only prompted App env values (APW-01 FR-55). Never echoed by any
+     * read; handed to APW-07 and stored encrypted once the App spec exists.
+     */
+    appEnv?: Record<string, string>;
+}
+/**
+ * The `appSource` block of the create answer (openapi:274-282).
+ *
+ * Every client — form, chat, MCP server, command line — reads the platform's
+ * own decision here instead of re-deriving it.
+ */
+interface AppSourceCreatedView {
+    relation: AppRepositoryMode;
+    /** `preparing` on create; the closed set is APW-02's `APP_READINESS_STATES`. */
+    readiness: AppReadinessState;
+    dataRepository: {
+        owner: string;
+        repo: string;
+        url?: string;
+    };
+    /** Absent for `link`. */
+    upstream?: AppUpstreamRef;
+    deployTarget: AppDeployTargetChoice;
+    /** The Blueprint the platform settled server-side (APW-01 FR-29b). */
+    blueprint?: {
+        id: string;
+        version?: string;
+        name?: string;
+        matchSource?: AppSourceBlueprintMatchSource;
+    };
+}
+/** The create answer (openapi `AppWorkCreateResponse`). */
+interface AppWorkCreateResponse {
+    status: 'success';
+    appSource?: AppSourceCreatedView;
+    /** Present and true when an equivalent App Work already existed (FR-23). */
+    alreadyExisted?: boolean;
+}
+/**
+ * The delete body's App-Work fields (openapi:160-173, plan.md:433-435).
+ *
+ * `delete_data_repository` keeps its existing meaning — the fork or the private
+ * copy (FR-38) — and is refused for a `link` relation. `delete_stored_data` is a
+ * SEPARATE choice (R-15) and needs `confirm_slug` to equal the App Work's slug,
+ * checked server-side before anything else happens (FR-40b). Omitting either
+ * flag means "keep" for every caller, including chat and MCP (FR-39).
+ */
+interface AppWorkDeleteRequest {
+    delete_data_repository?: boolean;
+    delete_stored_data?: boolean;
+    confirm_slug?: string;
+}
+/** The shared error body for the App-source routes (openapi `AppSourceError`). */
+interface AppSourceErrorBody {
+    status: 'error';
+    code: AppSourceReasonCode;
+    message: string;
+    /** Only the caller's own identifiers ever appear here (FR-51). */
+    details?: {
+        owner?: string;
+        fullName?: string;
+        workId?: string;
+        workName?: string;
+        retryAfter?: string;
+    };
+}
+/**
+ * At most 15 provider API calls per inspect, the existing-fork scan included
+ * (APW-01 FR-7, spec.md:290). The single biggest number in the create path.
+ */
+declare const APP_INSPECT_MAX_PROVIDER_CALLS = 15;
+/**
+ * The fixed checks that precede the fork scan — repository read 1, default-branch
+ * read at most 1, caller read 1, organizations read 1, `.gitattributes` read 1 —
+ * bounded so the scan always has room (APW-01 FR-9, spec.md:302, plan.md:187-190).
+ */
+declare const APP_INSPECT_FIXED_PROVIDER_CALLS = 5;
+/**
+ * A new owner is started only while at least this many calls remain
+ * (APW-01 FR-9, spec.md:303, plan.md:191).
+ */
+declare const APP_INSPECT_OWNER_MIN_CALLS_REMAINING = 3;
+/** Whether the budget still allows starting the scan of one more owner. */
+declare function canStartTargetOwnerScan(callsRemaining: number): boolean;
+/** Inspect answers within 8 seconds at p95 (APW-01 FR-7, spec.md:291). */
+declare const APP_INSPECT_P95_BUDGET_MS = 8000;
+/** Inspect caches its answer per member and repository for 60 seconds (spec.md:291). */
+declare const APP_INSPECT_CACHE_TTL_MS = 60000;
+/** Inspect is rate-limited to 30 requests per minute per member (spec.md:292). */
+declare const APP_INSPECT_RATE_LIMIT_PER_MINUTE = 30;
+/** Owners offered in P1: the caller's account first, then organizations A–Z (spec.md:300). */
+declare const APP_TARGET_OWNER_SCAN_LIMIT_P1 = 30;
+/** Owners offered in P2 — the same scan, paginated further (spec.md:300, tasks.md:745). */
+declare const APP_TARGET_OWNER_SCAN_LIMIT_P2 = 200;
+/**
+ * The private copy ceiling, 500 MB as GitHub reports size in KB
+ * (APW-01 FR-20, spec.md:337, plan.md:412).
+ *
+ * APW-02 imports THIS constant for `createRepositoryCopy({ maxSizeKb })`; it is
+ * never restated (plan.md:460-461).
+ */
+declare const APP_PRIVATE_COPY_MAX_SIZE_KB = 512000;
+/**
+ * How many names a private copy may try: the copy, then `-copy-2` … `-copy-5`
+ * (APW-01 FR-20, spec.md:340, plan.md:413).
+ */
+declare const APP_PRIVATE_COPY_NAME_ATTEMPTS = 5;
+/** Concurrent creates for one member/upstream/mode/owner are serialised this long (FR-22, spec.md:356). */
+declare const APP_CREATE_LOCK_TTL_MS = 120000;
+/** The idempotency window: an identical create returns the same App Work (FR-23, spec.md:358). */
+declare const APP_CREATE_IDEMPOTENCY_WINDOW_MS = 600000;
+/** The create response returns within 10 seconds and never waits for a fork (FR-21, spec.md:350). */
+declare const APP_CREATE_RESPONSE_BUDGET_MS = 10000;
+/**
+ * The repository URL ceiling, reused from the Repository Work rules that
+ * inspect and create must follow exactly (APW-01 FR-6, spec.md:289).
+ */
+declare const APP_REPOSITORY_URL_MAX_LENGTH = 400;
+/**
+ * One predicate for both doors, so inspect's URL field and create's cannot
+ * drift apart. Fails closed on a non-string body arriving off the wire.
+ */
+declare function appRepositoryUrlLengthExceeded(repositoryUrl: string): boolean;
+
+/**
+ * Merge policy — the configurable enforcement matrix for agent-driven merges
+ * (Wave 3, founder decision D4).
+ *
+ * The platform does NOT hardcode whether an agent may merge its own pull
+ * request. Whether it may is a POLICY, resolvable at four scopes
+ * (tenant → organization → Work → Agent) and layered over a conservative
+ * platform DEFAULT. Operators keep the safe posture by doing nothing and can
+ * opt into "agents merge when green" — or anything in between — per scope.
+ *
+ * This package holds the zero-dependency storage/wire shapes only. The
+ * resolution algorithm, the deep merge and the single decision point
+ * (`canAgentMerge`) live in `@ever-works/agent` (`policy/`), and enforcement
+ * lives at the git facade + the Task finalize path.
+ */
+/** Merge strategy a provider can be asked to use when landing a pull request. */
+type MergeMethod = 'merge' | 'squash' | 'rebase';
+/**
+ * Canonical list of merge methods. Kept as a const so validators (DTO
+ * `@IsIn`, import sanitizers) share one source of truth with the type.
+ */
+declare const MERGE_METHODS: readonly MergeMethod[];
+/**
+ * The fully-resolved policy. Every field is REQUIRED here — a resolved policy
+ * is always complete, because unset fields fall through to the next scope and
+ * ultimately to {@link PLATFORM_DEFAULT_MERGE_POLICY}.
+ */
+interface MergePolicy {
+    /**
+     * May an agent land a pull request at all? `false` does not stop the agent
+     * from OPENING one (that is `AgentPermissions.canOpenPullRequests`) — it
+     * stops the merge itself.
+     */
+    allowAgentMerge: boolean;
+    /** Require the run's quality gate to be green before an agent may merge. */
+    requireGreenGate: boolean;
+    /** Require a recorded human approval before an agent may merge. */
+    requireHumanApproval: boolean;
+    /** Merge strategies an agent may use. An empty list refuses every merge. */
+    allowedMergeMethods: MergeMethod[];
+    /**
+     * Branch names an agent may never merge INTO, matched case-insensitively
+     * against the pull request's base branch (a leading `refs/heads/` is
+     * stripped before comparison).
+     */
+    protectedBranches: string[];
+}
+/**
+ * The scopes a policy can be stored at, from least to most specific. The
+ * most specific scope that declares a field wins for THAT field
+ * (see {@link MERGE_POLICY_SCOPE_PRECEDENCE}).
+ */
+type MergePolicyScope = 'tenant' | 'organization' | 'work' | 'agent';
+/**
+ * Documented precedence, least specific first:
+ *
+ *   platform default  <  tenant  <  organization  <  Work  <  Agent
+ *
+ * Resolution is FIELD-BY-FIELD (a deep merge, not a whole-object override):
+ * a Work that sets only `allowAgentMerge` inherits the other four fields from
+ * its organization / tenant / the platform default. `null` or an omitted key
+ * at any scope means "inherit", never "false".
+ */
+declare const MERGE_POLICY_SCOPE_PRECEDENCE: readonly MergePolicyScope[];
+/**
+ * What a scope actually stores: a PARTIAL policy. Absent/`null` fields
+ * inherit from the next-least-specific scope. This is the shape of the
+ * additive `mergePolicy` `simple-json` column on `tenants`, `organizations`,
+ * `works` and `agents`.
+ */
+type MergePolicyOverride = Partial<MergePolicy>;
+/**
+ * Which scope a resolved policy (or one of its fields) came from. `'default'`
+ * means no scope in the chain declared it and the platform default applies.
+ */
+type MergePolicySource = MergePolicyScope | 'default';
+/**
+ * The platform DEFAULT — deliberately conservative, and deliberately NOT a
+ * hardcode: every field is overridable at any of the four scopes. An operator
+ * who wants agents to land their own green work sets
+ * `{ allowAgentMerge: true, requireHumanApproval: false }` at the scope of
+ * their choosing.
+ */
+declare const PLATFORM_DEFAULT_MERGE_POLICY: MergePolicy;
+/** Every field name of {@link MergePolicy}; the deep-merge iterates this. */
+declare const MERGE_POLICY_FIELDS: readonly (keyof MergePolicy)[];
+/** One link of the resolution chain, reported so a preview can explain itself. */
+interface MergePolicyChainEntry {
+    /** The scope this link represents (`'default'` is always the first link). */
+    scope: MergePolicySource;
+    /** Row id of the scope entity; `null` for the platform default. */
+    id: string | null;
+    /**
+     * Fields this link CONTRIBUTED to the final policy — i.e. it declared them
+     * and no more specific link overrode them. An empty array means the link
+     * exists in the ancestry but was fully shadowed (or declared nothing).
+     */
+    fields: (keyof MergePolicy)[];
+}
+/** Result of one policy resolution. */
+interface ResolvedMergePolicy {
+    /** The complete, effective policy. */
+    policy: MergePolicy;
+    /**
+     * The MOST SPECIFIC scope that contributed at least one field, or
+     * `'default'` when nothing in the chain declared anything.
+     */
+    source: MergePolicySource;
+    /** Least → most specific, starting at the platform default. */
+    chain: MergePolicyChainEntry[];
+}
+/**
+ * Stable refusal codes from the single decision point. Kept machine-readable
+ * so callers (facade, worker, UI) can branch without string-matching prose.
+ */
+type MergeRefusalCode = 'agent-merge-disabled' | 'protected-branch' | 'target-branch-unknown' | 'merge-method-not-allowed' | 'gate-not-green' | 'human-approval-required'
+/** No recorded approval names this pull request at all. */
+ | 'approval-missing'
+/** An approval exists for this pull request, but for an EARLIER head commit. */
+ | 'approval-stale'
+/** A matching approval exists but is older than `MERGE_APPROVAL_MAX_AGE_MS`. */
+ | 'approval-expired'
+/** The recorded decision was not made by a human (guardrail / no decider). */
+ | 'approval-not-human'
+/** The approver is not entitled to approve for this Task's scope. */
+ | 'approver-not-entitled'
+/** The pull request is draft/closed/merged at merge time. */
+ | 'pull-request-not-open'
+/** Provider CI is not green at merge time (it may have been at approval time). */
+ | 'pull-request-not-green'
+/** The live head commit could not be read, so nothing can be pinned to it. */
+ | 'head-sha-unknown';
+/** Outcome of the single decision point (`canAgentMerge`). */
+interface MergeDecision {
+    allowed: boolean;
+    /** Human-readable explanation; present only when `allowed === false`. */
+    reason?: string;
+    /** Machine-readable counterpart of `reason`. */
+    code?: MergeRefusalCode;
+    /** The policy the decision was made against, and where it came from. */
+    source?: MergePolicySource;
+}
+
+/**
+ * Connection credential transport (AW-15) — the organization setting and the
+ * pure verdict every create, update and connection attempt shares.
+ *
+ * ## What already worked, and what is new
+ *
+ * An MCP connection whose auth headers hold LITERAL values has always been
+ * able to use a plain `http://` endpoint. That keeps working: such a
+ * connection is allowed and flagged `insecure_transport` (a warning) so the
+ * owner sees the credential travels unencrypted.
+ *
+ * Resolving `{{cred.key}}` references inside headers is new, so nothing relies
+ * on sending a resolved secret over plain http. A reference aimed at a
+ * plain-http endpoint is refused (`https_required`) and the secret is never
+ * looked up.
+ *
+ * An organization can opt into refusing literal credentials over plain http
+ * too, with the setting below. It is OFF unless the organization turns it on.
+ */
+/** Stored on `organizations.connection_policy`. `null` / `{}` = every default. */
+interface OrganizationConnectionPolicy {
+    /**
+     * "Require https for connection credentials". When `true`, a connection
+     * whose auth headers carry ANY value (literal or reference) must use an
+     * `https:` endpoint. Default `false`: literal credentials over plain http
+     * keep working, with a warning.
+     */
+    requireHttpsForCredentials?: boolean;
+}
+/** The setting's key inside `OrganizationConnectionPolicy`. */
+declare const REQUIRE_HTTPS_FOR_CREDENTIALS_SETTING: "requireHttpsForCredentials";
+/** The setting's human name, used verbatim in every refusal it causes. */
+declare const REQUIRE_HTTPS_FOR_CREDENTIALS_SETTING_LABEL = "Require https for connection credentials";
+/**
+ * Shape guard for the stored / submitted policy. Unknown keys are dropped and
+ * only a real boolean is kept, so a junk value can never switch enforcement on
+ * or off by accident. An object with nothing left is `null` ("all defaults").
+ */
+declare function sanitizeOrganizationConnectionPolicy(raw: unknown): OrganizationConnectionPolicy | null;
+/** Does this stored policy refuse literal credentials over plain http? Default: no. */
+declare function organizationRequiresHttpsForCredentials(policy: unknown): boolean;
+/**
+ * The verdict for one endpoint + header map.
+ *
+ *   secure          no credential leaves in cleartext (https, stdio, or no headers)
+ *   insecure        literal credentials over plain http — allowed, with a warning
+ *   refused         nothing may be sent; `reason` says why
+ */
+type CredentialTransportVerdict = {
+    verdict: 'secure';
+} | {
+    verdict: 'insecure';
+} | {
+    verdict: 'refused';
+    reason: CredentialTransportRefusalReason;
+};
+/**
+ *   credential_references  a `{{cred.key}}` reference aimed at plain http
+ *   organization_policy    literal credentials over plain http while the
+ *                          organization requires https
+ */
+type CredentialTransportRefusalReason = 'credential_references' | 'organization_policy';
+interface CredentialTransportInput {
+    url: string | null | undefined;
+    transport?: string | null;
+    headers: Readonly<Record<string, string>> | null | undefined;
+    /** The organization setting. Omitted / `false` = literal credentials over http stay allowed. */
+    requireHttpsForCredentials?: boolean;
+}
+/**
+ * Decide how one connection may send its headers.
+ *
+ * `stdio` rows are exempt — they never dial a network address. A header map
+ * with no non-empty value carries no credential, so plain http without
+ * headers is `secure` in every case (it sends nothing to protect).
+ */
+declare function assessCredentialTransport(input: CredentialTransportInput): CredentialTransportVerdict;
+
+/**
+ * Live Feed — wire types for the narrated view of the activity log.
+ *
+ * The Live Feed is a reading surface over the `activity_log` rows Ever Works
+ * already writes. It owns no store of its own: every entry below is one
+ * existing activity record, projected into a line a person can read without
+ * decoding an action token.
+ *
+ * The API returns STRUCTURE, never English. A narration is a message key plus
+ * sanitized parameters, and a destination is a typed pointer, so the web
+ * renders both through its own translations and route constants and any
+ * other client (CLI, MCP) can do the same.
+ */
+/** The five buckets every entry classifies into. Derived, never stored. */
+type FeedKind = 'work' | 'decision' | 'delivery' | 'problem' | 'system';
+/** Display order of the kind chips (keyboard `1`-`5` follows this order). */
+declare const FEED_KINDS: readonly FeedKind[];
+/**
+ * Who did the thing: an agent, the signed-in user, an external source
+ * (a connector, a repository, a deployed site), or the platform itself.
+ */
+type FeedActorKind = 'agent' | 'user' | 'external' | 'system';
+declare const FEED_ACTOR_KINDS: readonly FeedActorKind[];
+/** Default page size. */
+declare const FEED_PAGE_SIZE_DEFAULT = 30;
+/** A page never holds more than this many entries. */
+declare const FEED_PAGE_SIZE_MAX = 50;
+/** At most this many agents can be watched at once. */
+declare const FEED_MAX_AGENT_FILTER = 20;
+/** How far back the feed reads. Older records stay on the Activity log. */
+declare const FEED_HISTORY_DAYS = 90;
+/** Automatic paging stops after this many pages in one visit. */
+declare const FEED_MAX_AUTO_PAGES = 20;
+/** Every interpolated narration value is truncated to this many characters. */
+declare const FEED_NARRATION_PARAM_MAX_CHARS = 120;
+/** Default and maximum look-back window of the actor roster, in hours. */
+declare const FEED_ACTORS_WINDOW_HOURS_DEFAULT = 168;
+declare const FEED_ACTORS_WINDOW_HOURS_MAX = 720;
+interface FeedActorDto {
+    kind: FeedActorKind;
+    /** Set when `kind === 'agent'`. */
+    agentId?: string | null;
+    /**
+     * Display name. For an agent, the name captured when the record was
+     * written, else the agent's current name. `null` when no name is known,
+     * in which case the renderer uses its own label for the kind.
+     */
+    label: string | null;
+    /** An agent's avatar mode, when it still exists. */
+    avatarMode?: string | null;
+}
+interface FeedNarrationDto {
+    /** A leaf key under the renderer's narration namespace, or `fallback`. */
+    key: string;
+    /** Sanitized values. Only fields allowed for the action type ever appear. */
+    params: Record<string, string | number>;
+}
+/** What an entry can point at. */
+type FeedTargetType = 'run' | 'task' | 'mission' | 'idea' | 'agent' | 'work' | 'inbox' | 'skill';
+declare const FEED_TARGET_TYPES: readonly FeedTargetType[];
+/**
+ * The most specific thing an entry is about. `null` on the entry when there
+ * is nothing to open (for example the agent was deleted), in which case the
+ * entry renders as plain text rather than a dead link.
+ */
+interface FeedTargetDto {
+    type: FeedTargetType;
+    id: string;
+}
+interface FeedEntryDto {
+    /** The activity record id. */
+    id: string;
+    /** ISO timestamp of when it happened. */
+    createdAt: string;
+    kind: FeedKind;
+    /** The record's own status (`pending`, `in_progress`, `completed`, `failed`, `cancelled`). */
+    status: string;
+    /** The record's action type, for clients that want to group or count. */
+    actionType: string;
+    actor: FeedActorDto;
+    narration: FeedNarrationDto;
+    target: FeedTargetDto | null;
+    workId?: string | null;
+}
+interface FeedPageDto {
+    /** Newest first. */
+    items: FeedEntryDto[];
+    /** Opaque cursor for the next older page, or `null` at the end. */
+    nextCursor: string | null;
+    hasMore: boolean;
+    /** Oldest point the feed reads back to (ISO). Paging stops here. */
+    historyFloor: string;
+    /** Populated once per-user seen state is available. */
+    unseenCount?: number;
+    lastSeenAt?: string | null;
+}
+interface FeedActorSummaryDto {
+    agentId: string;
+    label: string;
+    /** The agent's current status (`active`, `running`, `paused`, ...). */
+    status: string;
+    avatarMode?: string | null;
+    /** Entries attributed to the agent inside the requested window. */
+    count: number;
+    /** ISO timestamp of the agent's newest entry in the window, if any. */
+    lastActivityAt: string | null;
+}
+interface FeedActorsDto {
+    actors: FeedActorSummaryDto[];
+    windowHours: number;
+}
+/** Computed while-you-were-away payload. Never stored. */
+interface FeedAwaySummaryDto {
+    awayForMs: number;
+    windowStart: string;
+    windowEnd: string;
+    truncatedToWindow: boolean;
+    truncatedToScanCap: boolean;
+    total: number;
+    byKind: Record<FeedKind, number>;
+    topActors: FeedActorSummaryDto[];
+    otherActorCount: number;
+    decisionsWaiting: number;
+    failures: number;
+    narrative?: {
+        text: string;
+        model: string;
+        tokens: number;
+    } | null;
+}
+/** Stable error codes the feed endpoints answer with. */
+type FeedErrorCode = 'invalid-cursor' | 'too-many-agents';
+
+export { APP_RATE_LIMIT_MIN_REMAINING as $, AWESOME_README_IMPORT_MODES as A, APP_FORK_READINESS_POLL_INTERVAL_MS as B, APP_FORK_READINESS_READY_LATENCY_MS as C, APP_FORK_READINESS_REASONS as D, APP_FORK_READINESS_TIMEOUT_ENV as E, type FeedNarrationDto as F, APP_FORK_READINESS_TIMEOUT_MS as G, APP_FORK_READINESS_TIMEOUT_OVERRIDE_MIN_MS as H, IMPORT_SOURCE_TYPES as I, APP_INSPECT_CACHE_TTL_MS as J, APP_INSPECT_FIXED_PROVIDER_CALLS as K, APP_INSPECT_MAX_PROVIDER_CALLS as L, type MergePolicyOverride as M, APP_INSPECT_OWNER_MIN_CALLS_REMAINING as N, type OrganizationConnectionPolicy as O, type ProvidersDto as P, APP_INSPECT_P95_BUDGET_MS as Q, type RelatedRepositories as R, type SourceRepository as S, APP_INSPECT_RATE_LIMIT_PER_MINUTE as T, APP_LICENSE_EVALUATION_REASONS as U, APP_PRIVATE_COPY_MAX_SIZE_KB as V, WorkScheduleCadence as W, APP_PRIVATE_COPY_NAME_ATTEMPTS as X, APP_RATE_LIMITED_PERSISTENT_AFTER as Y, APP_RATE_LIMIT_BACKOFF_BASE_MS as Z, APP_RATE_LIMIT_BACKOFF_MAX_MS as _, WorkScheduleBillingMode as a, type AppSourceRelatedRepositories as a$, APP_RATE_LIMIT_RESET_GRACE_MS as a0, APP_READINESS_FAILURE_REASONS as a1, APP_READINESS_STATES as a2, APP_REPOSITORY_MODES as a3, APP_REPOSITORY_URL_MAX_LENGTH as a4, APP_SETUP_PR_CHECK_BATCH as a5, APP_SETUP_PR_CHECK_ON_VIEW_MIN_INTERVAL_MS as a6, APP_SOURCE_BLUEPRINT_MATCH_SOURCES as a7, APP_SOURCE_BLUEPRINT_STATUSES as a8, APP_SOURCE_LICENSE_CLASSES as a9, APP_UPSTREAM_WARNING_CODES as aA, APP_WORK_REPOSITORY_ROLE as aB, type AppActionsState as aC, type AppBlueprintPreview as aD, type AppDeployTargetAvailability as aE, type AppDeployTargetChoice as aF, type AppForkReadinessReason as aG, type AppLicenseEvaluationReason as aH, type AppModeAvailability as aI, type AppReadinessFailureReason as aJ, type AppReadinessHandlerReason as aK, type AppReadinessState as aL, type AppRepositoryMode as aM, type AppRepositoryModeFacts as aN, type AppRepositoryModeResolution as aO, type AppSourceBlock as aP, type AppSourceBlueprintMatchSource as aQ, type AppSourceBlueprintStatus as aR, type AppSourceCreatedView as aS, type AppSourceErrorBody as aT, type AppSourceInspectRequest as aU, type AppSourceInspectResponse as aV, type AppSourceLicenseClass as aW, type AppSourceLicensePreview as aX, type AppSourceLicenseSource as aY, type AppSourceReasonCode as aZ, type AppSourceRecord as a_, APP_SOURCE_LICENSE_SOURCES as aa, APP_SOURCE_REASON_CODES as ab, APP_SOURCE_REPOSITORY_NAME_SUFFIXES as ac, APP_SOURCE_REPOSITORY_TYPES as ad, APP_SOURCE_REPOSITORY_TYPE_BY_MODE as ae, APP_SOURCE_SPEC_FILE as af, APP_SOURCE_SPEC_KIND as ag, APP_SOURCE_SPEC_VERSION as ah, APP_SYNC_REASONS as ai, APP_SYNC_RESULTS as aj, APP_TARGET_OWNER_SCAN_LIMIT_P1 as ak, APP_TARGET_OWNER_SCAN_LIMIT_P2 as al, APP_UPSTREAM_CONFLICT_LABEL_PREFIX as am, APP_UPSTREAM_CONFLICT_MAX_PATHS as an, APP_UPSTREAM_STATUSES as ao, APP_UPSTREAM_SYNC_ACK_BUDGET_MS as ap, APP_UPSTREAM_SYNC_BRANCH as aq, APP_UPSTREAM_SYNC_DEFAULT_SCHEDULE as ar, APP_UPSTREAM_SYNC_DISPATCH_BATCH as as, APP_UPSTREAM_SYNC_DISPATCH_CRON as at, APP_UPSTREAM_SYNC_JITTER_MAX_MS as au, APP_UPSTREAM_SYNC_LOCK_TTL_MS as av, APP_UPSTREAM_SYNC_MANUAL_PER_HOUR as aw, APP_UPSTREAM_SYNC_MAX_PROVIDER_CALLS as ax, APP_UPSTREAM_SYNC_MIN_INTERVAL_MS as ay, APP_UPSTREAM_UNAVAILABLE_RECHECK_MS as az, WorkScheduleStatus as b, organizationRequiresHttpsForCredentials as b$, type AppSourceRepositoryType as b0, type AppSyncReason as b1, type AppSyncResult as b2, type AppTargetOwner as b3, type AppUpstreamActionsView as b4, type AppUpstreamDivergenceView as b5, type AppUpstreamReadinessView as b6, type AppUpstreamRef as b7, type AppUpstreamStateResponse as b8, type AppUpstreamStatus as b9, type FeedAwaySummaryDto as bA, type FeedErrorCode as bB, type FeedKind as bC, type FeedPageDto as bD, type FeedTargetDto as bE, type FeedTargetType as bF, MERGE_METHODS as bG, MERGE_POLICY_FIELDS as bH, MERGE_POLICY_SCOPE_PRECEDENCE as bI, type MergeDecision as bJ, type MergeMethod as bK, type MergePolicy as bL, type MergePolicyChainEntry as bM, type MergePolicyScope as bN, type MergePolicySource as bO, type MergeRefusalCode as bP, PLATFORM_DEFAULT_MERGE_POLICY as bQ, REQUIRE_HTTPS_FOR_CREDENTIALS_SETTING as bR, REQUIRE_HTTPS_FOR_CREDENTIALS_SETTING_LABEL as bS, type ResolvedMergePolicy as bT, type WorkSourceRepositoryType as bU, appManualSyncAllowed as bV, appRateLimitAllowsSync as bW, appRepositoryUrlLengthExceeded as bX, assessCredentialTransport as bY, canStartTargetOwnerScan as bZ, isAppSourceReasonCode as b_, type AppUpstreamSyncView as ba, type AppUpstreamView as bb, type AppUpstreamWarning as bc, type AppUpstreamWarningCode as bd, type AppUpstreamWorkRepositoryView as be, type AppWorkCreateRequest as bf, type AppWorkCreateResponse as bg, type AppWorkDeleteRequest as bh, type CredentialTransportInput as bi, type CredentialTransportRefusalReason as bj, type CredentialTransportVerdict as bk, FEED_ACTORS_WINDOW_HOURS_DEFAULT as bl, FEED_ACTORS_WINDOW_HOURS_MAX as bm, FEED_ACTOR_KINDS as bn, FEED_HISTORY_DAYS as bo, FEED_KINDS as bp, FEED_MAX_AGENT_FILTER as bq, FEED_MAX_AUTO_PAGES as br, FEED_NARRATION_PARAM_MAX_CHARS as bs, FEED_PAGE_SIZE_DEFAULT as bt, FEED_PAGE_SIZE_MAX as bu, FEED_TARGET_TYPES as bv, type FeedActorDto as bw, type FeedActorKind as bx, type FeedActorSummaryDto as by, type FeedActorsDto as bz, type AnalyzeRepositoryResponseDto as c, resolveAppRepositoryModes as c0, sanitizeOrganizationConnectionPolicy as c1, type AwesomeReadmeImportMode as d, type ImportEnrichmentConfig as e, type ImportSourceType as f, type ImportWorkDto as g, type RepoVisibility as h, type RepositoryRole as i, type RepositoryTarget as j, type WorksConfigSnapshot as k, type AppBlueprintPrompt as l, type FeedEntryDto as m, APP_ACTIONS_HYGIENE_MAX_WORKFLOWS as n, APP_ACTIONS_STATES as o, APP_BEHIND_EVENT_STEP as p, APP_CREATE_IDEMPOTENCY_WINDOW_MS as q, APP_CREATE_LOCK_TTL_MS as r, APP_CREATE_RESPONSE_BUDGET_MS as s, APP_DEPLOY_TARGET_CHOICES as t, APP_DIVERGENCE_DAILY_MS as u, APP_DIVERGENCE_TTL_MS as v, APP_FORK_READINESS_IDLE_MS as w, APP_FORK_READINESS_MANUAL_RETRIES_PER_HOUR as x, APP_FORK_READINESS_MAX_REDISPATCH as y, APP_FORK_READINESS_POLL_DELAYS_MS as z };