@gajae-code/coding-agent 0.13.2 → 0.14.0

package/dist/types/session-import/service.d.ts

@@ -0,0 +1,47 @@
+import { CodexImportError } from "./codex";
+export type SessionImportErrorCode = CodexImportError["code"] | "invalid_request" | "binding_invalid" | "content_too_large" | "destination_conflict" | "publish_uncertain" | "atomic_unavailable" | "durability_not_provable" | "durability_failed" | "identity_mismatch" | "validation_failed" | "io_failed" | "internal_failed";
+export interface SessionImportFailure {
+    status: "failed";
+    provider: "codex";
+    sourceSessionId?: string;
+    code: SessionImportErrorCode;
+    phase: string;
+    retryable: boolean;
+    message: string;
+    limitBytes?: number;
+    observedBytes?: number;
+    causeCode?: string;
+}
+export interface SessionImportSuccess {
+    status: "imported" | "existing";
+    provider: "codex";
+    sourceSessionId: string;
+    targetSessionId: string;
+    targetPath: string;
+    sourceBytes: number;
+    transcriptBytes: number;
+    mappedEvents: number;
+    quarantinedEvents: number;
+    droppedEvents: number;
+    quarantineTruncated: boolean;
+    redactedValues: number;
+}
+export type SessionImportResult = SessionImportSuccess | SessionImportFailure;
+export interface SessionImportBatchResult {
+    provider: "codex";
+    status: "success" | "partial" | "failed" | "existing";
+    results: SessionImportResult[];
+}
+export declare function importCodexSessions(cwd: string, requestedIds: readonly string[]): Promise<SessionImportBatchResult>;
+export declare function formatSessionImportBatch(result: SessionImportBatchResult): string;
+/**
+ * Provider-neutral session import service (issue #3709).
+ *
+ * Pipeline: bounded read-only source load → format detection → provider adapter
+ * → normalization + fail-closed redaction → head/tail bounding → persistence
+ * into a NEW GJC session through the public SessionManager API.
+ *
+ * The source file is never written, moved, or enumerated. The live session is
+ * never touched by this module; callers switch sessions explicitly after a
+ * successful materialization.
+ */

package/dist/types/session-import/types.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Provider-neutral session-import contract (issue #3709).
+ *
+ * An import accepts ONE explicit user-selected Codex or Claude transcript/export
+ * file, normalizes it into the intermediate representation below, and rebuilds a
+ * bounded, redacted continuation context inside a NEW GJC session. The source
+ * file is only ever read; provider process state is never scraped.
+ */
+/** Providers with a first-party observable transcript/export format. */
+export type SessionImportProviderId = "codex" | "claude";
+/** Concrete on-disk format variants the adapters understand. */
+export type SessionImportFormatId = "codex-rollout-jsonl" | "claude-code-jsonl" | "claude-export-json";
+/** One normalized conversational unit produced by a provider adapter. */
+export interface ImportedMessage {
+    /** Conversational role. Tool evidence is attached to assistant turns. */
+    role: "user" | "assistant";
+    /** Visible text (may be empty when only tool evidence exists). */
+    text: string;
+    /** ISO-8601 source timestamp when the record carried one. */
+    timestamp?: string;
+    /**
+     * Bounded, already redacted tool/file evidence lines (e.g. `$ ls` → `ok`).
+     * Rendered inline after the text so completed work stays visible.
+     */
+    toolEvidence?: string[];
+}
+/** Provider-neutral normalized conversation. */
+export interface ImportedConversation {
+    provider: SessionImportProviderId;
+    format: SessionImportFormatId;
+    /** Source-side session/conversation identifier when the format carries one. */
+    sourceSessionId?: string;
+    /** Source title when the format carries one. */
+    title?: string;
+    /** Source workspace cwd when the format carries one. */
+    cwd?: string;
+    messages: ImportedMessage[];
+}
+/** Deterministic, actionable import failure codes. */
+export type SessionImportErrorCode = "invalid_request" | "source_not_found" | "source_unreadable" | "source_changed" | "unsupported_format" | "format_mismatch" | "malformed_input" | "content_too_large" | "destination_conflict" | "io_failed";
+/** Import pipeline phase a failure belongs to. */
+export type SessionImportPhase = "request" | "read" | "detect" | "parse" | "normalize" | "persist" | "switch";
+export declare class SessionImportError extends Error {
+    readonly code: SessionImportErrorCode;
+    readonly phase: SessionImportPhase;
+    readonly retryable: boolean;
+    readonly limitBytes?: number;
+    readonly observedBytes?: number;
+    constructor(code: SessionImportErrorCode, phase: SessionImportPhase, message: string, options?: {
+        retryable?: boolean;
+        limitBytes?: number;
+        observedBytes?: number;
+    });
+}
+/** One record the adapter could not map. Never carries raw content. */
+export interface ImportQuarantineRecord {
+    /** 1-based record/line number in the source. */
+    record: number;
+    byteLength: number;
+    sha256: string;
+    reason: "invalid_json" | "unknown_record" | "missing_fields" | "oversized_record";
+}
+/** Bounded tallies reported to the user and persisted in provenance. */
+export interface SessionImportCounts {
+    /** Records successfully mapped into the normalized conversation. */
+    mapped: number;
+    /** Records quarantined (never silently dropped). */
+    quarantined: number;
+    /** Secret/credential redactions applied to imported text. */
+    redacted: number;
+    /** Messages omitted from the rendered context by head/tail bounding. */
+    omitted: number;
+}
+/** Provenance persisted as a `custom` session entry on the import target. */
+export interface SessionImportProvenance {
+    schemaVersion: 1;
+    customType: "session-import";
+    provider: SessionImportProviderId;
+    format: SessionImportFormatId;
+    /** Basename of the explicit user-selected source file (never a full path). */
+    sourceFileName: string;
+    sourceSessionId?: string;
+    sourceTitle?: string;
+    /** SHA-256 over the exact source bytes that were imported. */
+    sourceSha256: string;
+    sourceBytes: number;
+    /** RFC 4122 UUID of the GJC session that received the import. */
+    targetSessionId: string;
+    importedAt: string;
+    converterVersion: number;
+    sanitizerVersion: number;
+    counts: SessionImportCounts;
+    /** True when head/tail bounding elided part of the conversation. */
+    truncated: boolean;
+    quarantine: {
+        present: boolean;
+        truncated: boolean;
+        records: ImportQuarantineRecord[];
+    };
+}
+/** Fully prepared import: parsed, normalized, redacted, bounded. No session state mutated yet. */
+export interface PreparedSessionImport {
+    conversation: ImportedConversation;
+    /** Rendered continuation context for the `custom_message` entry. */
+    contextText: string;
+    provenance: Omit<SessionImportProvenance, "targetSessionId" | "importedAt">;
+    counts: SessionImportCounts;
+    /** Distinct redaction pattern ids that fired (for the user-facing summary). */
+    redactionKinds: string[];
+    sourcePath: string;
+    sourceSha256: string;
+    sourceBytes: number;
+}
+/** Result of a completed import into a freshly created session file. */
+export interface SessionImportCompleted {
+    targetSessionId: string;
+    targetPath: string;
+    title: string;
+    prepared: PreparedSessionImport;
+}

package/dist/types/setup/paseo/check.d.ts

@@ -0,0 +1,16 @@
+import type { SetupCheckResult } from "./result-types";
+import { type PaseoSetupDependencies } from "./setup-deps";
+export declare const STALE_GUIDANCE = "Paseo has not picked up the new provider entry yet. Paseo does not reload config.json automatically; restart the Paseo daemon yourself when convenient (GJC will not restart it for you).";
+export interface CheckOptions {
+    readonly mpreset?: string;
+    readonly force?: boolean;
+}
+/**
+ * Diagnose the installation.
+ *
+ * Precedence is total and the predicates are disjoint by construction:
+ * drift absorbs every non-clean L1 condition, and the remaining three states
+ * partition the L2 outcome space (reachable-with-entry / reachable-without-entry
+ * / unreachable).
+ */
+export declare function checkPaseoSetup(deps: PaseoSetupDependencies, options?: CheckOptions): Promise<SetupCheckResult>;

package/dist/types/setup/paseo/install-saga.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Four-step install saga with reverse-order compensation.
+ *
+ * GJC writes to four files it does not own, across two applications, with no
+ * distributed lock available. Nothing here can be made atomic across files, so
+ * the design is instead: refuse early, record enough to recover, and undo in
+ * reverse on failure.
+ *
+ * Forward order is fixed:
+ *   1. `~/.paseo/config.json` provider entry + provider-key provenance
+ *   2. `~/.paseo/orchestration-preferences.json` seeded roles + seeded-key provenance
+ *   3. `<agentDir>/paseo-skills/` symlink bridge
+ *   4. `~/.gjc/agent/config.yml` `skills.customDirectories` append
+ *
+ * Steps 1 and 2 each mutate a Paseo file AND the GJC provenance ledger. Those
+ * are separate files, so a durable intent record is written BEFORE either one,
+ * carrying preflight and expected-post identities for BOTH. Recovery classifies
+ * each file independently and refuses whenever the ledger diverged.
+ */
+import type { CasReceipt } from "../../config/atomic-yaml-patch";
+import { type IntentStep, type ProvenanceLedger } from "./paseo-ownership";
+import type { PartialInstallEvidence } from "./result-types";
+/** One completed forward step, retaining exactly what its inverse needs. */
+export interface CompletedStep {
+    readonly label: string;
+    /** Undo this step. Resolves to `"reverted"`, or `"conflict"` when the resource moved underneath us. */
+    undo(): Promise<StepUndoResult>;
+}
+export type StepUndoResult = {
+    readonly status: "reverted";
+} | {
+    readonly status: "conflict";
+    readonly detail: string;
+    readonly retained: readonly string[];
+};
+export declare class SagaStepError extends Error {
+    readonly label: string;
+    readonly retained: readonly string[];
+    constructor(label: string, message: string, retained?: readonly string[]);
+}
+export interface CompensationOutcome {
+    readonly compensated: readonly string[];
+    readonly uncompensated: readonly string[];
+    readonly evidence: PartialInstallEvidence;
+}
+/**
+ * Undo completed steps newest-first, halting at the first inverse that reports
+ * a conflict.
+ *
+ * Halting is deliberate: once one resource has diverged, continuing to unwind
+ * the others would leave a stranger mix of reverted and live state that no
+ * later run could interpret. Stopping preserves an interpretable prefix.
+ */
+export declare function compensate(completed: readonly CompletedStep[], failure: SagaStepError): Promise<CompensationOutcome>;
+export interface JsonStepInput {
+    readonly label: string;
+    readonly step: IntentStep;
+    readonly targetPath: string;
+    readonly provenancePath: string;
+    readonly intentPath: string;
+    readonly ownedKeys: readonly string[];
+    /** Mutates the parsed target in place. */
+    readonly mutate: (draft: Record<string, unknown>) => void;
+    /** Produces the ledger that must exist once this step commits. */
+    readonly nextLedger: (ledger: ProvenanceLedger) => ProvenanceLedger;
+    /** Reverts the target, removing only what this step added. */
+    readonly revert: (draft: Record<string, unknown>) => void;
+    /** Produces the ledger that must exist once this step is undone. */
+    readonly revertLedger: (ledger: ProvenanceLedger) => ProvenanceLedger;
+    readonly now: Date;
+}
+export interface JsonStepOutput {
+    readonly completed: CompletedStep;
+    readonly changed: boolean;
+    readonly backupPath?: string;
+}
+/**
+ * Run one JSON step: intent, target publish, ledger commit, intent clear.
+ *
+ * The intent is written first and cleared last. Between those points a crash is
+ * recoverable because the record alone identifies whether the target carries
+ * pre-write bytes, the exact bytes we intended, or something a third party
+ * produced.
+ */
+export declare function runJsonStep(input: JsonStepInput): Promise<JsonStepOutput>;
+/** Wrap a `CasReceipt` as a compensable step. */
+export declare function receiptStep(label: string, receipt: CasReceipt): CompletedStep;
+export interface RecoverIntentOptions {
+    /**
+     * Act on the classification rather than only reporting it.
+     *
+     * Install passes `true`. `--check` passes `false` because it must stay
+     * read-only: it surfaces the lingering intent as drift and leaves the repair
+     * to the next install.
+     */
+    readonly repair: boolean;
+}
+/**
+ * Classify a lingering intent left by an interrupted run, and optionally act.
+ *
+ * The outcome comes from classifying BOTH the target and the ledger:
+ *
+ * - `discard`   the publish never landed, so nothing was mutated. Safe to clear.
+ * - `complete-ledger` the publish landed but the ledger commit did not. Re-running
+ *   the same install re-derives and commits the identical provenance in step 1,
+ *   so recovery is to PROCEED. The intent is deliberately left in place until
+ *   that step overwrites it, because clearing it first would lose recoverability
+ *   if the retry is interrupted too.
+ * - `refuse`    a third party changed one of the files. Never replay a recorded
+ *   write over someone else's change.
+ */
+export declare function recoverIntent(intentPath: string, options?: RecoverIntentOptions): Promise<{
+    recovered: boolean;
+    detail: string;
+} | undefined>;

package/dist/types/setup/paseo/json-publisher.d.ts

@@ -0,0 +1,76 @@
+/** Serialization Paseo itself produces. Verified byte-identical against the live config. */
+export declare function serializeJson(value: unknown): string;
+export declare function hashBytes(bytes: string): string;
+/** Marker recorded when a target did not exist at preflight. */
+export declare const ABSENT_IDENTITY = "absent";
+export type PublishRefusal = {
+    readonly reason: "parse-refusal";
+    readonly detail: string;
+} | {
+    readonly reason: "format-drift";
+    readonly detail: string;
+} | {
+    readonly reason: "cas-conflict";
+    readonly expected: string;
+    readonly actual: string;
+};
+export declare class PaseoPublishError extends Error {
+    readonly refusal: PublishRefusal;
+    readonly targetPath: string;
+    constructor(targetPath: string, refusal: PublishRefusal);
+}
+export interface ReadTargetResult {
+    readonly exists: boolean;
+    /** Raw bytes as read, or `""` when absent. */
+    readonly raw: string;
+    /** Hash of `raw`, or `ABSENT_IDENTITY` when absent. */
+    readonly identity: string;
+    /** Parsed object; `{}` when absent. */
+    readonly parsed: Record<string, unknown>;
+}
+/**
+ * Read and validate a target without writing anything.
+ *
+ * Throws `PaseoPublishError` on unparseable JSON or on a formatting mismatch,
+ * so callers never have to decide whether a file is safe to touch.
+ */
+export declare function readTarget(targetPath: string): Promise<ReadTargetResult>;
+export interface PublishPlan {
+    /** Bytes that will be published. */
+    readonly nextRaw: string;
+    /** Hash of `nextRaw` -- the expected post-publish identity, computable before any rename. */
+    readonly expectedIdentity: string;
+    /** True when the mutation produced no change and publication can be skipped. */
+    readonly unchanged: boolean;
+}
+/**
+ * Apply `mutate` to a validated read and compute the exact bytes to publish.
+ *
+ * Split out from {@link publishPlan} so the install saga can record the expected
+ * post-publish identity in its durable intent BEFORE anything is written.
+ */
+export declare function planPublish(current: ReadTargetResult, mutate: (draft: Record<string, unknown>) => void): PublishPlan;
+export interface PublishOptions {
+    /** Identity the target must still carry at publication time. */
+    readonly expectedIdentity: string;
+    /** Take a mode-0600 backup beside the original before replacing it. */
+    readonly backup: boolean;
+    readonly now: Date;
+}
+export interface PublishResult {
+    readonly published: boolean;
+    readonly backupPath?: string;
+    readonly identity: string;
+}
+/**
+ * Publish `plan.nextRaw` to `targetPath` under a compare-and-swap on
+ * `options.expectedIdentity`.
+ *
+ * The CAS is re-read immediately before the rename, which is the narrowest
+ * window GJC can achieve. It does not defend against Paseo re-writing the file
+ * later from its own stale in-memory copy -- Paseo exposes no lock or version
+ * API, so that remains a documented residual risk detected by `--check`.
+ */
+export declare function publishPlan(targetPath: string, plan: PublishPlan, options: PublishOptions): Promise<PublishResult>;
+/** Current on-disk identity, or {@link ABSENT_IDENTITY} when the file does not exist. */
+export declare function currentIdentity(targetPath: string): Promise<string>;

package/dist/types/setup/paseo/orchestration-preferences.d.ts

@@ -0,0 +1,24 @@
+/** Every newly seeded orchestration role points at the base provider this setup registers. */
+export declare const SEEDED_ROLE_VALUE = "gjc";
+export interface OrchestrationSeed {
+    readonly mutate: (draft: Record<string, unknown>) => void;
+    readonly seededKeys: readonly string[];
+    readonly seededValues: Record<string, string>;
+}
+/**
+ * Plan the seeding of `providers.{impl,ui,research,planning,audit}`.
+ *
+ * Only empty roles are seeded. `preferences[]` and any other top-level key are
+ * never read or assigned, so an existing array keeps its identity and content.
+ */
+/** Read a role's current value, or `undefined` when unset. Shared by seeding and removal. */
+export declare function readRoleValue(preferences: Record<string, unknown>, key: string): string | undefined;
+/**
+ * Delete seeded roles from the nested `providers` map.
+ *
+ * `shouldDelete` gates each key on provenance, so a role the user reassigned
+ * after install is left alone. The `providers` object itself is removed only
+ * when it becomes empty, so a file GJC fully seeded returns to its prior shape.
+ */
+export declare function removeSeededRoles(draft: Record<string, unknown>, keys: readonly string[], shouldDelete: (key: string, currentValue: string | undefined) => boolean): void;
+export declare function createOrchestrationSeed(preferences: Record<string, unknown>): OrchestrationSeed;

package/dist/types/setup/paseo/paseo-ownership.d.ts

@@ -0,0 +1,87 @@
+import { ABSENT_IDENTITY } from "./json-publisher";
+export declare const PROVENANCE_VERSION = 1;
+export declare const INTENT_VERSION = 1;
+export interface ProvenanceLedger {
+    readonly version: number;
+    /** `agents.providers` keys GJC created, mapped to the value hash it wrote. */
+    readonly providerKeys: Record<string, string>;
+    /** Orchestration role keys GJC actually seeded, mapped to the value it wrote. */
+    readonly seededOrchestrationKeys: Record<string, string>;
+    /** Bridge directory path GJC created, when it created it. */
+    readonly bridgePath?: string;
+    /** Bridge entries GJC created, so the inverse removes exactly those. */
+    readonly bridgeEntries?: readonly string[];
+    /** True when GJC created the bridge directory itself (as opposed to populating an existing one). */
+    readonly bridgeDirCreated?: boolean;
+}
+export declare const EMPTY_LEDGER: ProvenanceLedger;
+export declare function readProvenance(provenancePath: string): Promise<ProvenanceLedger>;
+export declare function writeProvenance(provenancePath: string, ledger: ProvenanceLedger): Promise<void>;
+/**
+ * True only when GJC recorded this provider key AND the value still hashes to
+ * what GJC wrote. A user edit after install makes this false, which is what
+ * keeps `--remove` from destroying their change.
+ */
+export declare function isProvenancedProvider(ledger: ProvenanceLedger, key: string, currentValueHash: string): boolean;
+export declare function isProvenancedOrchestrationKey(ledger: ProvenanceLedger, key: string, currentValue: string): boolean;
+/** Every `gjc`/`gjc-<preset>` key GJC recorded, so a plain `--remove` cleans up earlier `--mpreset` runs. */
+export declare function provenancedProviderKeys(ledger: ProvenanceLedger): readonly string[];
+export type IntentStep = "provider-config" | "orchestration-preferences";
+/**
+ * Durable, credential-free intent record.
+ *
+ * Written before either the target publish or the ledger commit, and carrying
+ * BOTH identities for BOTH files, so recovery can classify each file as
+ * before / intended-after / divergent from this record alone. It stores only
+ * paths, key names, and hashes -- never file contents, diffs, or values -- so
+ * it stays credential-free even though `config.json` holds a bcrypt password.
+ */
+export interface IntentRecord {
+    readonly version: number;
+    readonly step: IntentStep;
+    readonly targetPath: string;
+    readonly ownedKeys: readonly string[];
+    readonly targetPreflightIdentity: string;
+    readonly targetExpectedIdentity: string;
+    readonly provenancePath: string;
+    readonly provenancePreflightIdentity: string;
+    readonly provenanceExpectedIdentity: string;
+    /**
+     * The exact ledger this step intended to commit.
+     *
+     * Carried so recovery can finish the commit without re-running the step. That
+     * matters for seed-if-empty work: once the target publish has landed the roles
+     * are no longer empty, so a retry would skip the step and the ledger would
+     * never be written. Contains only key names and hashes, never values from the
+     * user's files, so the record stays credential-free.
+     */
+    readonly provenancePayload?: ProvenanceLedger;
+    readonly startedAt: string;
+}
+export declare function writeIntent(intentPath: string, intent: IntentRecord): Promise<void>;
+export declare function readIntent(intentPath: string): Promise<IntentRecord | undefined>;
+export declare function clearIntent(intentPath: string): Promise<void>;
+/** Rebuild the ledger an interrupted step intended to commit, when it recorded one. */
+export declare function pendingLedgerOf(intent: IntentRecord): ProvenanceLedger | undefined;
+/** Where a file sits relative to an interrupted step. */
+export type IntentFileState = "before" | "intended-after" | "divergent";
+export declare function classifyIdentity(observed: string, preflight: string, expected: string): IntentFileState;
+export type IntentRecovery = {
+    readonly action: "discard";
+    readonly detail: string;
+} | {
+    readonly action: "complete-ledger";
+    readonly detail: string;
+} | {
+    readonly action: "refuse";
+    readonly detail: string;
+};
+/**
+ * Classify BOTH the target and the ledger before deciding what to do.
+ *
+ * Deliberately exhaustive over the nine combinations: a divergent ledger always
+ * refuses, because replaying a recorded ledger output over a third party's
+ * change would destroy it.
+ */
+export declare function classifyIntent(intent: IntentRecord): Promise<IntentRecovery>;
+export { ABSENT_IDENTITY };

package/dist/types/setup/paseo/paseo-setup.d.ts

@@ -0,0 +1,29 @@
+import type { PaseoInstallResult, PaseoRemoveResult, SetupCheckResult } from "./result-types";
+import type { PaseoSetupDependencies } from "./setup-deps";
+export interface PaseoSetupFlags {
+    readonly check?: boolean;
+    readonly json?: boolean;
+    readonly force?: boolean;
+    readonly remove?: boolean;
+    readonly mpreset?: string;
+}
+export declare class PaseoSetupUsageError extends Error {
+    constructor(message: string);
+}
+export type PaseoSetupOutcome = {
+    readonly kind: "check";
+    readonly result: SetupCheckResult;
+} | {
+    readonly kind: "install";
+    readonly result: PaseoInstallResult;
+} | {
+    readonly kind: "remove";
+    readonly result: PaseoRemoveResult;
+};
+/**
+ * Reject flag combinations that have no coherent meaning.
+ *
+ * Rejected before any read or write so a misuse can never leave partial state.
+ */
+export declare function assertUsableFlags(flags: PaseoSetupFlags): void;
+export declare function runPaseoSetup(flags: PaseoSetupFlags, deps: PaseoSetupDependencies): Promise<PaseoSetupOutcome>;

package/dist/types/setup/paseo/provider-config.d.ts

@@ -0,0 +1,35 @@
+import { type BuildChannel } from "../../build-metadata";
+import { type ReadTargetResult } from "./json-publisher";
+export interface PaseoProviderEntry {
+    extends: string;
+    label: string;
+    command: string[];
+    env: Record<string, string>;
+    enabled: boolean;
+}
+export type GjcCommandResolution = {
+    readonly ok: true;
+    readonly command: string[];
+    readonly channel: BuildChannel;
+} | {
+    readonly ok: false;
+    readonly channel: BuildChannel;
+    readonly detail: string;
+};
+export type ProviderConflict = {
+    readonly conflict: false;
+} | {
+    readonly conflict: true;
+    readonly subject: string;
+    readonly detail: string;
+};
+export declare function resolveGjcCommand(): GjcCommandResolution;
+export declare function providerKeyFor(mpreset?: string): string;
+export declare function buildProviderEntry(command: string[], mpreset?: string): PaseoProviderEntry;
+/**
+ * Produces the narrowly scoped mutation passed to {@link planPublish}. The
+ * read result is accepted so callers retain an explicit preflight-to-plan flow.
+ */
+export declare function createProviderMutation(_current: ReadTargetResult, key: string, entry: PaseoProviderEntry): (draft: Record<string, unknown>) => void;
+export declare function hasProviderConflict(config: Record<string, unknown>, key: string, entry: PaseoProviderEntry): ProviderConflict;
+export declare function providerEntryHash(entry: PaseoProviderEntry): string;

package/dist/types/setup/paseo/remove.d.ts

@@ -0,0 +1,14 @@
+import type { PaseoRemoveResult } from "./result-types";
+import { type PaseoSetupDependencies } from "./setup-deps";
+export interface RemoveOptions {
+    readonly now: Date;
+    /** Undo the config.yml `skills.customDirectories` append. Supplied by the orchestrator. */
+    readonly unregisterBridgeDirectory?: () => Promise<void>;
+}
+/**
+ * Remove every target GJC can prove it owns.
+ *
+ * Returns `nothing-to-remove` when the ledger holds no ownership at all, which
+ * is distinct from removing zero keys because the user edited all of them.
+ */
+export declare function removePaseoSetup(deps: PaseoSetupDependencies, options: RemoveOptions): Promise<PaseoRemoveResult>;

package/dist/types/setup/paseo/result-types.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Result unions for `gjc setup paseo`.
+ *
+ * `SetupCheckResult` is deliberately four-valued. Parse failures, conflicts,
+ * missing executables, and partial-operation evidence are all `drift` carrying
+ * a structured reason -- they are NOT extra top-level statuses. Install and
+ * remove outcomes live in their own unions so command outcomes never leak into
+ * the diagnosis DTO.
+ */
+/** The four locked check states. Adding a fifth is a spec change, not an implementation detail. */
+export type SetupCheckStatus = "pass" | "drift" | "stale" | "skipped";
+/** Structured detail carried inside a `drift` result. */
+export type DriftReasonCode = "parse-refusal" | "format-drift" | "owned-key-conflict" | "missing-executable" | "partial-install" | "partial-removal" | "orphan-skill" | "unlinked-skill" | "missing-provider-entry" | "missing-bridge-link" | "missing-skills-directory" | "unseeded-orchestration-role";
+export interface DriftReason {
+    readonly code: DriftReasonCode;
+    /** Which owned path or key the reason concerns. Never a secret value. */
+    readonly subject: string;
+    readonly detail: string;
+}
+export interface SetupCheckResult {
+    readonly component: "paseo";
+    readonly status: SetupCheckStatus;
+    readonly reasons: readonly DriftReason[];
+    /** Human-facing next step, present for `stale` so the user knows a restart is theirs to make. */
+    readonly guidance?: string;
+}
+export interface PartialInstallEvidence {
+    readonly failedStep: string;
+    readonly detail: string;
+    /** Paths whose state was preserved for recovery. Never file contents. */
+    readonly retained: readonly string[];
+}
+export type PaseoInstallResult = {
+    readonly outcome: "installed";
+    readonly changed: readonly string[];
+} | {
+    readonly outcome: "partial-install";
+    readonly compensated: readonly string[];
+    readonly uncompensated: readonly string[];
+    readonly evidence: PartialInstallEvidence;
+};
+export interface PartialRemovalEvidence {
+    readonly failedStep: string;
+    readonly detail: string;
+    readonly retained: readonly string[];
+}
+export type PaseoRemoveResult = {
+    readonly outcome: "removed";
+    readonly removed: readonly string[];
+} | {
+    readonly outcome: "nothing-to-remove";
+} | {
+    readonly outcome: "partial-removal";
+    readonly removed: readonly string[];
+    readonly remaining: readonly string[];
+    readonly evidence: PartialRemovalEvidence;
+};
+/** Exit code for a check result. `stale` and `skipped` are not failures. */
+export declare function checkExitCode(result: SetupCheckResult): number;