@haystackeditor/cli 0.15.29 → 0.15.31

package/dist/commands/precompute-delivery.js

@@ -0,0 +1,319 @@
+import { execFileSync, spawn } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const requestFile = 'request.json';
+const receiptFile = 'receipt.json';
+const deliverySchema = 'precompute-delivery-v1';
+const windows = process.platform === 'win32';
+// Windows mode bits do not represent access control. Pass paths as data to a
+// fixed script; never interpolate repository paths into PowerShell source.
+function windowsAccess(paths, operation) {
+    const script = `
+$ErrorActionPreference = 'Stop'
+# A parent pwsh process can export incompatible PowerShell 7 module paths.
+$env:PSModulePath = [System.IO.Path]::Combine($PSHOME, 'Modules')
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$paths = ConvertFrom-Json -InputObject $env:HAYSTACK_DELIVERY_ACL_PATHS
+foreach ($path in $paths) {
+  $item = Get-Item -LiteralPath $path -Force
+  if (($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Reparse point rejected' }
+  if ($env:HAYSTACK_DELIVERY_ACL_OPERATION -eq 'protect') {
+    if (-not $item.PSIsContainer) { throw 'Expected directory' }
+    $acl = New-Object System.Security.AccessControl.DirectorySecurity
+    $acl.SetOwner($sid)
+    $acl.SetAccessRuleProtection($true, $false)
+    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')
+    $acl.AddAccessRule($rule)
+    Set-Acl -LiteralPath $path -AclObject $acl
+  }
+  if ($env:HAYSTACK_DELIVERY_ACL_OPERATION -eq 'own') {
+    $acl = Get-Acl -LiteralPath $path
+    $acl.SetOwner($sid)
+    Set-Acl -LiteralPath $path -AclObject $acl
+  }
+  $acl = Get-Acl -LiteralPath $path
+  if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value) { throw 'Unexpected owner' }
+  if ($item.PSIsContainer -and -not $acl.AreAccessRulesProtected) { throw 'Unprotected directory' }
+  $allowed = $false
+  foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+    if ($rule.AccessControlType -eq 'Allow') {
+      if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'Unexpected access rule' }
+      if (($rule.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::ReadData) -ne 0) { $allowed = $true }
+    }
+  }
+  if (-not $allowed) { throw 'Missing owner access' }
+}
+`;
+    execFileSync('powershell.exe', ['-NoLogo', '-NoProfile', '-NonInteractive',
+        '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], {
+        env: { ...process.env, HAYSTACK_DELIVERY_ACL_PATHS: JSON.stringify(paths),
+            HAYSTACK_DELIVERY_ACL_OPERATION: operation },
+        stdio: 'ignore', windowsHide: true, timeout: 2000,
+    });
+}
+function privateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    if (!lstatSync(path).isDirectory())
+        throw new Error('Delivery directory is unavailable.');
+    // The complete directory chain receives one protected ACL before capture.
+    if (windows)
+        return;
+    const descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        fchmodSync(descriptor, 0o700);
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function syncDirectory(path) {
+    // Node cannot flush a Windows directory through a read-only file descriptor.
+    if (windows)
+        return;
+    const descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function publishJson(path, value, immutable = false) {
+    const temporary = join(dirname(path), `.${basename(path)}-${randomUUID()}.tmp`);
+    const descriptor = openSync(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+    try {
+        try {
+            writeFileSync(descriptor, JSON.stringify(value) + '\n');
+            if (immutable && !windows)
+                fchmodSync(descriptor, 0o400);
+            fsyncSync(descriptor);
+        }
+        finally {
+            closeSync(descriptor);
+        }
+        renameSync(temporary, path);
+        syncDirectory(dirname(path));
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+function object(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function onlyKeys(value, keys) {
+    return Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+}
+function characters(value, allowed, length) {
+    return typeof value === 'string' && value.length > 0
+        && (length === undefined || value.length === length)
+        && [...value].every(character => allowed.includes(character));
+}
+function isDeliveryId(value) {
+    if (typeof value !== 'string')
+        return false;
+    const parts = value.split('-');
+    return parts.length === 5 && parts.every((part, index) => characters(part, '0123456789abcdef', [8, 4, 4, 4, 12][index]));
+}
+function validateRequest(value) {
+    if (!object(value) || !onlyKeys(value, ['schemaVersion', 'deliveryId', 'request'])
+        || value.schemaVersion !== deliverySchema || !isDeliveryId(value.deliveryId)
+        || !object(value.request))
+        throw new Error('Invalid captured delivery.');
+    const request = value.request;
+    const component = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.-';
+    if (!onlyKeys(request, ['owner', 'repository', 'baseCommit', 'workCommit', 'observedAt',
+        'cacheKey', 'patchGzBase64', 'patchSha256'])
+        || !characters(request.owner, component) || request.owner.length > 100
+        || !characters(request.repository, component) || request.repository.length > 100
+        || !characters(request.baseCommit, '0123456789abcdef', 40)
+        || !characters(request.workCommit, '0123456789abcdef', 40)
+        || !characters(request.patchSha256, '0123456789abcdef', 64)
+        || typeof request.observedAt !== 'number' || !Number.isSafeInteger(request.observedAt)
+        || request.observedAt < 0 || typeof request.cacheKey !== 'string' || request.cacheKey.length === 0
+        || typeof request.patchGzBase64 !== 'string')
+        throw new Error('Invalid captured request.');
+    const patch = Buffer.from(request.patchGzBase64, 'base64');
+    if (patch.toString('base64') !== request.patchGzBase64
+        || createHash('sha256').update(patch).digest('hex') !== request.patchSha256) {
+        throw new Error('Captured patch identity does not match.');
+    }
+}
+export class PrecomputeDeliveryAccessError extends Error {
+    delivery;
+    constructor(delivery) {
+        super('Captured request access was rejected.');
+        this.delivery = delivery;
+        this.name = 'PrecomputeDeliveryAccessError';
+    }
+}
+export function readPrecomputeDelivery(requestPath) {
+    if (requestPath !== resolve(requestPath) || basename(requestPath) !== requestFile
+        || !isDeliveryId(basename(dirname(requestPath))))
+        throw new Error('Invalid delivery path.');
+    // A redirected path must never carry authority to write a fallback receipt.
+    if (!lstatSync(dirname(requestPath)).isDirectory() || !lstatSync(requestPath).isFile()) {
+        throw new Error('Captured request path is unavailable.');
+    }
+    const descriptor = openSync(requestPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    let value;
+    let privateMode = false;
+    try {
+        const status = fstatSync(descriptor);
+        if (!status.isFile())
+            throw new Error('Captured request is unavailable.');
+        privateMode = (status.mode & 0o077) === 0;
+        value = JSON.parse(readFileSync(descriptor, 'utf8'));
+    }
+    finally {
+        closeSync(descriptor);
+    }
+    validateRequest(value);
+    if (value.deliveryId !== basename(dirname(requestPath)))
+        throw new Error('Delivery identity does not match.');
+    try {
+        if (windows)
+            windowsAccess([dirname(requestPath), requestPath], 'verify');
+        else if (!privateMode)
+            throw new Error('Captured request is not private.');
+    }
+    catch {
+        // This validated identity permits a failed receipt only. No caller may
+        // treat a rejected read as permission to send the captured request.
+        throw new PrecomputeDeliveryAccessError(value);
+    }
+    return value;
+}
+export function writePrecomputeDeliveryReceipt(requestPath, delivery, result) {
+    const receipt = {
+        schemaVersion: 'precompute-delivery-receipt-v1',
+        deliveryId: delivery.deliveryId,
+        repository: `${delivery.request.owner}/${delivery.request.repository}`,
+        sourceCommit: delivery.request.workCommit,
+        updatedAt: new Date().toISOString(),
+        requestIdentity: {
+            baseCommit: delivery.request.baseCommit, workCommit: delivery.request.workCommit,
+            observedAt: delivery.request.observedAt, cacheKey: delivery.request.cacheKey,
+            patchSha256: delivery.request.patchSha256,
+        },
+        ...result,
+    };
+    publishJson(join(dirname(requestPath), receiptFile), receipt);
+    if (result.status !== 'pending') {
+        rmSync(requestPath, { force: true });
+        syncDirectory(dirname(requestPath));
+    }
+}
+function pruneTerminalDeliveries(metadata, deliveries) {
+    const pointer = JSON.parse(readFileSync(join(metadata, 'precompute-latest.json'), 'utf8'));
+    if (!object(pointer) || pointer.schemaVersion !== 'precompute-delivery-pointer-v1'
+        || !isDeliveryId(pointer.deliveryId))
+        return;
+    const terminal = [];
+    for (const entry of readdirSync(deliveries, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !isDeliveryId(entry.name) || entry.name === pointer.deliveryId)
+            continue;
+        const path = join(deliveries, entry.name);
+        try {
+            const descriptor = openSync(join(path, receiptFile), constants.O_RDONLY | constants.O_NOFOLLOW);
+            let receipt;
+            try {
+                receipt = JSON.parse(readFileSync(descriptor, 'utf8'));
+            }
+            finally {
+                closeSync(descriptor);
+            }
+            if (!object(receipt) || receipt.schemaVersion !== 'precompute-delivery-receipt-v1'
+                || receipt.deliveryId !== entry.name
+                || !['acknowledged', 'failed', 'timed-out'].includes(String(receipt.status))
+                || typeof receipt.updatedAt !== 'string')
+                continue;
+            const updatedAt = Date.parse(receipt.updatedAt);
+            if (!Number.isFinite(updatedAt))
+                continue;
+            terminal.push({ path, deliveryId: entry.name, updatedAt });
+        }
+        catch {
+            // Unreadable or concurrently changing records are never deletion evidence.
+        }
+    }
+    terminal.sort((left, right) => right.updatedAt - left.updatedAt || right.deliveryId.localeCompare(left.deliveryId));
+    for (const entry of terminal.slice(50))
+        rmSync(entry.path, { recursive: true, force: true });
+    if (terminal.length > 50)
+        syncDirectory(deliveries);
+}
+/** An exclusive durable marker prevents a second invocation from posting this delivery. */
+export function claimPrecomputeDelivery(requestPath) {
+    const path = join(dirname(requestPath), 'sender-started');
+    const descriptor = openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+    try {
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+    syncDirectory(dirname(path));
+}
+export const startPrecomputeDelivery = async (metadataDirectory, request) => {
+    const metadata = resolve(metadataDirectory);
+    privateDirectory(metadata);
+    syncDirectory(dirname(metadata));
+    const deliveries = join(metadata, 'precompute-deliveries');
+    privateDirectory(deliveries);
+    syncDirectory(metadata);
+    const deliveryId = randomUUID();
+    const delivery = { schemaVersion: deliverySchema, deliveryId, request };
+    validateRequest(delivery);
+    const staging = join(deliveries, `.pending-${deliveryId}`);
+    const published = join(deliveries, deliveryId);
+    const requestPath = join(published, requestFile);
+    privateDirectory(staging);
+    let publishedRequest = false;
+    try {
+        if (windows)
+            windowsAccess([metadata, deliveries, staging], 'protect');
+        publishJson(join(staging, requestFile), delivery, true);
+        // Elevated Windows tokens can default new file ownership to Administrators.
+        if (windows)
+            windowsAccess([join(staging, requestFile)], 'own');
+        writePrecomputeDeliveryReceipt(join(staging, requestFile), delivery, { status: 'pending' });
+        renameSync(staging, published);
+        syncDirectory(deliveries);
+        publishedRequest = true;
+        const pointer = {
+            schemaVersion: 'precompute-delivery-pointer-v1', deliveryId,
+            repository: `${request.owner}/${request.repository}`, sourceCommit: request.workCommit,
+        };
+        publishJson(join(metadata, 'precompute-latest.json'), pointer);
+        try {
+            pruneTerminalDeliveries(metadata, deliveries);
+        }
+        catch {
+            // Retain any undeletable old records. Housekeeping cannot prevent the
+            // newly captured request from reaching its sender.
+        }
+        const workerPath = fileURLToPath(new URL('./precompute-delivery-worker.js', import.meta.url));
+        if (!lstatSync(workerPath).isFile())
+            throw new Error('Detached sender is unavailable.');
+        await new Promise((resolveSpawn, rejectSpawn) => {
+            const child = spawn(process.execPath, [workerPath, requestPath], {
+                detached: true, stdio: 'ignore', env: process.env, windowsHide: true,
+            });
+            child.once('error', () => rejectSpawn(new Error('Detached sender could not start.')));
+            child.once('spawn', () => { child.unref(); resolveSpawn(); });
+        });
+        return { deliveryId, requestPath };
+    }
+    catch (error) {
+        if (publishedRequest)
+            writePrecomputeDeliveryReceipt(requestPath, delivery, { status: 'failed', reason: 'sender-not-started' });
+        throw error;
+    }
+    finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+};

package/dist/commands/verify-explore.d.ts

@@ -0,0 +1,14 @@
+export interface VerifyExploreOptions {
+    repo: string;
+    json?: boolean;
+    side?: string;
+    execJson?: string;
+    cwd?: string;
+    commandTimeout?: string;
+    close?: boolean;
+    action?: string;
+    requestId?: string;
+    wait?: boolean;
+}
+export declare function verifyCasesCommand(runId: string, options: VerifyExploreOptions): Promise<void>;
+export declare function verifyExploreCommand(runId: string, caseId: string, options: VerifyExploreOptions): Promise<void>;

package/dist/commands/verify-explore.js

@@ -0,0 +1,180 @@
+import { randomUUID } from 'node:crypto';
+import { resolveAuthContext } from '../utils/auth.js';
+import { haystackJson } from '../utils/haystack-api.js';
+const RUN_ID = /^cv_[0-9a-f]{48}$/;
+const CASE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const ACTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const TERMINAL = new Set(['complete', 'errored', 'uncertain']);
+function object(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function timestamp(value) {
+    return typeof value === 'string' && Number.isFinite(Date.parse(value));
+}
+function terminalSafe(value) {
+    return value.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g, '');
+}
+async function context(runId, repository) {
+    if (!RUN_ID.test(runId))
+        throw new Error('Use the exact cv_… run ID from verification.');
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository || '')) {
+        throw new Error('--repo must be owner/repository.');
+    }
+    const [owner, repo] = repository.split('/');
+    if ([owner, repo].some(part => part === '.' || part === '..'))
+        throw new Error('Invalid repository.');
+    const { token } = await resolveAuthContext({ owner, repo });
+    return {
+        token,
+        path: `/api/agent/cloud-verifier/runs/${runId}/cases`,
+        query: `?repository=${encodeURIComponent(repository)}`,
+    };
+}
+export async function verifyCasesCommand(runId, options) {
+    const ctx = await context(runId, options.repo);
+    const payload = await haystackJson(ctx.path + ctx.query, ctx.token, {
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!object(payload) || !Array.isArray(payload.cases)
+        || payload.cases.some(item => !object(item) || item.runId !== runId
+            || typeof item.caseId !== 'string' || !CASE_ID.test(item.caseId)
+            || (item.side !== 'base' && item.side !== 'head')
+            || typeof item.revisionSha !== 'string' || !/^[0-9a-f]{40}$/.test(item.revisionSha)
+            || !timestamp(item.expiresAt) || !Array.isArray(item.capabilities)
+            || item.capabilities.join(',') !== 'open,exec,close')) {
+        throw new Error('Server returned an invalid retained-case catalog.');
+    }
+    const cases = payload.cases;
+    const seen = new Set();
+    for (const item of cases) {
+        const key = JSON.stringify([item.runId, item.caseId, item.side]);
+        if (seen.has(key))
+            throw new Error('Server returned duplicate case identities.');
+        seen.add(key);
+    }
+    if (options.json) {
+        console.log(JSON.stringify({ runId, cases }));
+        return;
+    }
+    if (!cases.length) {
+        console.log('No saved cases are available. They appear after completion and expire 24 hours later.');
+        return;
+    }
+    for (const item of cases)
+        console.log(`${item.caseId} ${item.side} — available until ${item.expiresAt}`);
+    console.log(`Open a copy: haystack verify explore ${runId} CASE_ID --repo ${options.repo} --side head`);
+}
+function parseAction(payload, runId, caseId, side, actionId) {
+    if (!object(payload) || !object(payload.action))
+        throw new Error('Invalid action response.');
+    const action = payload.action;
+    if (action.runId !== runId || action.caseId !== caseId || action.side !== side || action.actionId !== actionId
+        || typeof action.state !== 'string'
+        || !['queued', 'claimed', 'running', 'complete', 'errored', 'uncertain'].includes(action.state)
+        || !timestamp(action.expiresAt)
+        || (action.error !== null && typeof action.error !== 'string')
+        || (action.output !== null && (!object(action.output)
+            || typeof action.output.stdout !== 'string' || typeof action.output.stderr !== 'string'
+            || typeof action.output.exitCode !== 'number' || !Number.isInteger(action.output.exitCode)))) {
+        throw new Error('Server returned an action for the wrong case or an invalid result.');
+    }
+    return action;
+}
+function newRequest(options, actionId) {
+    if (options.close) {
+        if (options.execJson !== undefined || options.cwd || options.commandTimeout) {
+            throw new Error('--close cannot be combined with a command.');
+        }
+        return { actionId, kind: 'close' };
+    }
+    if (options.execJson === undefined) {
+        if (options.cwd || options.commandTimeout)
+            throw new Error('--cwd and --command-timeout require --exec-json.');
+        return { actionId, kind: 'open' };
+    }
+    const argv = JSON.parse(options.execJson);
+    if (!Array.isArray(argv) || argv.length < 1 || argv.length > 128 || !argv[0]
+        || argv.some(arg => typeof arg !== 'string' || arg.includes('\0'))) {
+        throw new Error('--exec-json must contain 1–128 string arguments with a non-empty executable.');
+    }
+    const cwd = options.cwd ?? '/home/user/pj';
+    const timeoutMs = Number(options.commandTimeout ?? '60') * 1_000;
+    if (!cwd.startsWith('/') || /[\0\r\n]/.test(cwd) || cwd.length > 4_096) {
+        throw new Error('--cwd must be an absolute path inside the sandbox.');
+    }
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1_000 || timeoutMs > 300_000) {
+        throw new Error('--command-timeout must be between 1 and 300 seconds.');
+    }
+    const request = { actionId, kind: 'exec', argv, cwd, timeoutMs };
+    if (Buffer.byteLength(JSON.stringify(request)) > 32 * 1_024)
+        throw new Error('Command request exceeds 32 KiB.');
+    return request;
+}
+export async function verifyExploreCommand(runId, caseId, options) {
+    if (!CASE_ID.test(caseId))
+        throw new Error('Use the exact case ID from `haystack verify cases`.');
+    const side = options.side ?? 'head';
+    if (side !== 'base' && side !== 'head')
+        throw new Error('--side must be base or head.');
+    if (options.action && (options.requestId || options.execJson !== undefined || options.close || options.cwd || options.commandTimeout)) {
+        throw new Error('--action reads an existing action; do not combine it with a new command.');
+    }
+    const actionId = options.action ?? options.requestId ?? randomUUID();
+    if (!ACTION_ID.test(actionId))
+        throw new Error('Action/request ID must be a UUID v4.');
+    const request = options.action ? null : newRequest(options, actionId);
+    const ctx = await context(runId, options.repo);
+    const actionPath = `${ctx.path}/${encodeURIComponent(caseId)}/${side}/actions`;
+    const pollCommand = `haystack verify explore ${runId} ${caseId} --repo ${options.repo} --side ${side} --action ${actionId}`;
+    const read = async () => parseAction(await haystackJson(`${actionPath}/${actionId}${ctx.query}`, ctx.token, {
+        signal: AbortSignal.timeout(30_000),
+    }), runId, caseId, side, actionId);
+    let action;
+    try {
+        action = request
+            ? parseAction(await haystackJson(actionPath + ctx.query, ctx.token, {
+                method: 'POST', headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(request), signal: AbortSignal.timeout(30_000),
+            }), runId, caseId, side, actionId)
+            : await read();
+    }
+    catch (error) {
+        throw new Error(`${error instanceof Error ? error.message : String(error)}\nCheck whether it was accepted before sending another command:\n${pollCommand}`);
+    }
+    if (options.wait !== false) {
+        const deadline = Date.now() + 10 * 60_000;
+        while (!TERMINAL.has(action.state) && Date.now() < deadline) {
+            await new Promise(resolve => setTimeout(resolve, 2_000));
+            try {
+                action = await read();
+            }
+            catch (error) {
+                throw new Error(`${String(error)}\nThe command was not resubmitted. Check it with:\n${pollCommand}`);
+            }
+        }
+    }
+    if (options.json)
+        console.log(JSON.stringify({ action }));
+    else {
+        console.log(`${caseId}/${side}: ${action.state}; available until ${action.expiresAt}`);
+        if (action.output) {
+            process.stdout.write(terminalSafe(action.output.stdout));
+            process.stderr.write(terminalSafe(action.output.stderr));
+            console.error(`Exit code: ${action.output.exitCode}`);
+        }
+        if (action.error)
+            console.error(terminalSafe(action.error));
+        if (!TERMINAL.has(action.state))
+            console.log(`Follow this action:\n${pollCommand}`);
+        else if (action.state === 'complete' && !action.output) {
+            console.log(options.close ? 'Working copy discarded. The saved case is unchanged.'
+                : 'Your working copy is ready. Add --exec-json to run commands in it.');
+        }
+    }
+    if (action.state === 'errored' || action.state === 'uncertain')
+        process.exitCode = 2;
+    else if (action.output?.exitCode)
+        process.exitCode = 1;
+    else if (!TERMINAL.has(action.state) && options.wait !== false)
+        process.exitCode = 2;
+}

package/dist/commands/verify-history.d.ts

@@ -0,0 +1,14 @@
+import type { VerifyHistoryReport } from '../types/verify-history.js';
+export interface VerifyHistoryOptions {
+    limit?: string;
+    account?: string;
+    json?: boolean;
+}
+/** Reject contradictory or mismatched data before printing health or findings. */
+export declare function parseVerifyHistoryReport(value: unknown, expected: {
+    owner: string;
+    name: string;
+    limit: number;
+}): VerifyHistoryReport;
+export declare function formatVerifyHistory(report: VerifyHistoryReport): string;
+export declare function verifyHistoryCommand(repository: string, options: VerifyHistoryOptions): Promise<void>;