@kynver-app/runtime 0.2.24 → 0.2.29

package/dist/landing-gate.d.ts

@@ -1,24 +0,0 @@
-import type { GitAncestry } from "./git.js";
-export type WorkerLandingBlockReason = "dirty_worktree_no_pr";
-export interface WorkerLandingSnapshot {
-    finalResult: unknown;
-    changedFiles: string[];
-    headCommit?: string | null;
-    prUrl?: string | null;
-    artifactBundlePath?: string | null;
-    patchPath?: string | null;
-    gitAncestry?: GitAncestry | null;
-}
-export interface WorkerLandingVerdict {
-    /** When true, do not treat the worker as cleanly landed/done. */
-    blocked: boolean;
-    reason?: WorkerLandingBlockReason;
-    /** Human-readable attention reason for boards and completion payloads. */
-    detail?: string;
-}
-/**
- * Hard landing gate: a recorded final result is not sufficient when the worker
- * left uncommitted code and has no commit/PR/patch/bundle landing path.
- */
-export declare function assessWorkerLanding(snapshot: WorkerLandingSnapshot): WorkerLandingVerdict;
-export declare function landingAttentionReason(verdict: WorkerLandingVerdict): string | undefined;

package/dist/lane/landing-maintainer-local.d.ts

@@ -1,15 +0,0 @@
-export interface LandingMaintainerLocalAction {
-    kind: "land_pr" | "skip" | "noop" | "repair_dispatch_hint";
-    prNumber?: number;
-    prUrl?: string;
-    reason: string;
-}
-export interface LandingMaintainerLocalOutcome {
-    action: LandingMaintainerLocalAction;
-    executed: boolean;
-    exitCode: number | null;
-    stdout: string;
-    stderr: string;
-}
-export declare function runLandingWrapper(prNumber: number, repoRoot: string, execute: boolean): LandingMaintainerLocalOutcome;
-export declare function resolveLandingMaintainerRepoRoot(args: Record<string, string | boolean>): string;

package/dist/lane/landing-maintainer-tick.d.ts

@@ -1,16 +0,0 @@
-export interface LandingMaintainerTickResult {
-    repo: string;
-    fleet: boolean;
-    execute: boolean;
-    coordinator: unknown;
-    localOutcomes: Array<{
-        action: {
-            kind: string;
-            prNumber?: number;
-            reason: string;
-        };
-        executed: boolean;
-        exitCode: number | null;
-    }>;
-}
-export declare function runLandingMaintainerLaneTick(args: Record<string, string | boolean>): Promise<LandingMaintainerTickResult>;

package/dist/lane/lane-spec.d.ts

@@ -1,8 +0,0 @@
-/** Runtime mirror of server landing-maintainer lane policy. */
-export declare const LANDING_MAINTAINER_LANE_SPEC: {
-    readonly slug: "landing-maintainer";
-    readonly originCron: "maintain-8-blocker-and-pr-landing-workers";
-    readonly defaultRepo: "Totalsolutionsync/Kynver";
-    readonly landScript: "scripts/agent-os-land-pr.mjs";
-    readonly landScriptArgs: readonly ["--skip-not-ready"];
-};

package/dist/lane/lane-tick-cli.d.ts

@@ -1 +0,0 @@
-export declare function runLaneTickCli(args: Record<string, string | boolean>, laneFromArgv?: string): Promise<void>;

package/dist/lease-renewal.d.ts

@@ -1,15 +0,0 @@
-export interface RenewActiveLeasesResult {
-    renewed: string[];
-    failed: Array<{
-        worker: string;
-        reason: string;
-    }>;
-    skipped: string[];
-}
-/**
- * Renew leases for board-linked workers whose process is still alive.
- * Prevents dispatch/reaper from reclaiming a task while a local worker runs.
- */
-export declare function renewActiveTaskLeases(runId: string, args: Record<string, string | boolean>): Promise<RenewActiveLeasesResult>;
-/** True when this run already has a live worker bound to the same board task. */
-export declare function hasLiveWorkerForTask(runId: string, taskId: string): boolean;

package/dist/local-pr-attention-reconcile.d.ts

@@ -1,25 +0,0 @@
-export interface LocalPrAttentionReconcileOutcome {
-    runId: string;
-    worker: string;
-    action: "marked_done" | "skipped";
-    reason: string;
-    prUrl?: string;
-    mergeCommit?: string | null;
-}
-export interface LocalPrAttentionReconcileResult {
-    workers: LocalPrAttentionReconcileOutcome[];
-}
-interface PrLookupResult {
-    prUrl: string;
-    state: string;
-    mergedAt?: string | null;
-    mergeCommit?: string | null;
-}
-export interface LocalPrAttentionReconcileOptions {
-    lookupPr?: (input: {
-        repoDir: string;
-        prNumber: number;
-    }) => PrLookupResult | null;
-}
-export declare function reconcileLocalOnlyMergedPrAttention(options?: LocalPrAttentionReconcileOptions): LocalPrAttentionReconcileResult;
-export {};

package/dist/local-run-store/admission-enforce.d.ts

@@ -1,38 +0,0 @@
-export declare const ADMISSION_SLOT_KEY_PREFIX = "worker-slot-n:";
-export interface AdmissionSlotDecision {
-    admitted: boolean;
-    /** Set when admitted via a numbered reservation (absent in off/shadow no-op admits). */
-    slot?: number;
-    reason?: "disk_backstop" | "slots_exhausted";
-}
-/**
- * Pre-spawn admission (enforce only; off/shadow admit unconditionally — the
- * existing gate stays authoritative there). `diskActiveWorkers` MUST be a
- * fresh count taken at call time, not the tick-start gate sample.
- */
-export declare function acquireWorkerAdmissionSlot(input: {
-    runId: string;
-    workerName: string;
-    maxSlots: number;
-    diskActiveWorkers: number;
-}): AdmissionSlotDecision;
-/** Free the numbered slot a worker holds (terminal transition / spawn abort). Never throws. */
-export declare function releaseWorkerAdmissionSlot(runId: string, workerName: string): void;
-/**
- * Per-tick numbered-slot reconcile (enforce only; called from the shared
- * admission reconcile): refresh slots whose owner worker is live, release
- * slots whose owner is provably dead, and adopt live workers holding no
- * slot (pre-flip spawns) so the reservation view converges with reality.
- */
-export declare function reconcileNumberedAdmissionSlots(input: {
-    liveWorkers: Array<{
-        runId: string;
-        workerName: string;
-    }>;
-}): {
-    refreshed: number;
-    deadReleased: number;
-    adopted: number;
-};
-export declare function admissionEnforceCounters(): Record<string, number>;
-export declare function __resetAdmissionEnforceCountersForTests(): void;

package/dist/local-run-store/admission-shadow.d.ts

@@ -1,56 +0,0 @@
-import type { LocalRunStoreSurfaceMode } from "./surface-flags.js";
-export declare const ADMISSION_RESERVATION_TTL_MS: number;
-/**
- * Re-arm the adoption pass when the surface is observed OFF (re-review
- * finding 2): workers spawned during an off window take no reservations, so
- * the first reconcile after an off→active flag transition must adopt them
- * silently — otherwise an operator toggling the emergency brake poisons the
- * `missingForLive` metric that gates D2b. Called from the tick's off branch
- * (the reconcile itself never runs while off).
- */
-export declare function rearmAdmissionAdoptionPass(): void;
-export declare function admissionMode(env?: NodeJS.ProcessEnv): LocalRunStoreSurfaceMode;
-/** Take/refresh the reservation for a spawned worker. Never throws. */
-export declare function takeWorkerSlotReservation(runId: string, workerName: string): void;
-/** Release on worker terminal transition. Never throws. */
-export declare function releaseWorkerSlotReservation(runId: string, workerName: string): void;
-export interface AdmissionShadowReconcile {
-    liveReservations: number;
-    refreshed: number;
-    deadReleased: number;
-    /** Pre-reconcile: live workers with no reservation (missed takes; 0 on the adoption pass). */
-    missingForLive: number;
-    /** Pre-reconcile: reservations with no live worker (crash backstop firing OR a missed release). */
-    orphaned: number;
-    /** True when this call was the silent adoption pass. */
-    adoptionPass: boolean;
-}
-/**
- * Per-tick reconcile with PRE-reconcile classified measurement (review B —
- * measuring after adoption/release repaired the evidence made the old parity
- * count a tautology; comparing against a minutes-earlier disk sample made it
- * noise). The instrument now compares like-for-like at the same instant,
- * BEFORE repairing anything:
- *
- *  - `missingForLive` (counted as divergence, post-adoption-pass): a live
- *    worker with no reservation means `takeWorkerSlotReservation` missed —
- *    a real lifecycle defect. Reads as: broken take → non-zero every tick.
- *  - `orphaned` (reported, folded into `deadSlotsReleased` when released):
- *    crash-terminated workers legitimately leave orphans for the reconcile
- *    to reap — that is the design's crash backstop, not a defect. A broken
- *    COMPLETION-release shows up as `deadSlotsReleased` trending with the
- *    completion rate instead of the (rare) crash rate.
- *
- * Then the repair: refresh live slots, adopt missing ones, release dead
- * ones. No cross-time disk-count comparison exists anymore.
- */
-export declare function reconcileAdmissionShadow(input: {
-    /** Live workers by identity (from the same records the gate counts). */
-    liveWorkers: Array<{
-        runId: string;
-        workerName: string;
-    }>;
-}): AdmissionShadowReconcile;
-/** Counters snapshot for the operator-tick posture (surface active only). */
-export declare function admissionShadowCounters(): Record<string, number>;
-export declare function __resetAdmissionShadowCountersForTests(): void;

package/dist/local-run-store/dispatch-claim-recovery-startup.d.ts

@@ -1,11 +0,0 @@
-import { type StrandedClaimRecoveryResult } from "./dispatch-claim-recovery.js";
-export declare function __resetStartupClaimRecoveryForTests(): void;
-export declare function maybeRunStartupClaimRecovery(input: {
-    agentOsId: string;
-    baseUrl: string;
-    secret: string;
-    hasLiveWorker: (intent: {
-        runId: string;
-        workerName: string;
-    }) => boolean;
-}): Promise<StrandedClaimRecoveryResult | null>;

package/dist/local-run-store/dispatch-claim-recovery.d.ts

@@ -1,54 +0,0 @@
-export interface StrandedClaimRecoveryOutcome {
-    taskId: string;
-    leaseToken: string;
-    runId: string | null;
-    workerName: string | null;
-    action: "released" | "finalized_late" | "deferred_orphan" | "release_refused" | "deferred_transport" | "skipped";
-    detail?: string;
-}
-export interface StrandedClaimRecoveryResult {
-    mode: "off" | "shadow" | "enforce";
-    scanned: number;
-    outcomes: StrandedClaimRecoveryOutcome[];
-}
-/**
- * Scan /proc for a live process whose cmdline references `pathFragment`.
- * Linux only — on other platforms the probe reports no orphan, so recovery
- * PROCEEDS TO RELEASE after the stall window (review A6: an unfindable
- * orphan can never report anyway — it has no worker record — so the release
- * narrows the pre-existing 1 h expiry window rather than adding risk; prod
- * boxes are Linux). Bounded, never throws.
- */
-export declare function findLiveProcessByCmdlinePath(pathFragment: string): number | null;
-export interface RecoverStrandedClaimsOptions {
-    nowMs?: number;
-    strandedAfterMs?: number;
-    /** Same liveness delegation as the shadow scan (worker.json + pid). */
-    hasLiveWorker: (intent: {
-        runId: string;
-        workerName: string;
-    }) => boolean;
-    /** Derive the deterministic worktree path for a claim's spawn intent. */
-    worktreePathFor: (intent: {
-        runId: string;
-        workerName: string;
-    }) => string;
-    /** Injectable orphan probe (defaults to the /proc cmdline scan). */
-    findOrphanPid?: (worktreePath: string) => number | null;
-    /**
-     * Perform the server release for one stranded claim. MUST present the
-     * claim's lease token (§7.7). Returns released=true only on server ack.
-     */
-    releaseClaim: (input: {
-        taskId: string;
-        leaseToken: string;
-        runId: string;
-    }) => Promise<{
-        released: boolean;
-        transportError?: boolean;
-        detail?: string;
-    }>;
-}
-export declare function recoverStrandedDispatchClaims(opts: RecoverStrandedClaimsOptions): Promise<StrandedClaimRecoveryResult>;
-export declare function dispatchClaimRecoveryCounters(): Record<string, number>;
-export declare function __resetDispatchClaimRecoveryForTests(): void;

package/dist/local-run-store/dispatch-receipts.d.ts

@@ -1,90 +0,0 @@
-import { type LocalRunStoreSurfaceMode } from "./surface-flags.js";
-export interface DispatchReceiptIdentity {
-    taskId: string;
-    leaseToken: string;
-}
-export interface DispatchClaimIntent extends DispatchReceiptIdentity {
-    runId: string;
-    workerName: string;
-    provider: string | null;
-}
-export declare function dispatchReceiptsMode(env?: NodeJS.ProcessEnv): LocalRunStoreSurfaceMode;
-export declare function recordDispatchClaimReceipt(intent: DispatchClaimIntent): void;
-export declare function recordDispatchSpawnedReceipt(identity: DispatchReceiptIdentity): void;
-export declare function recordDispatchReleasedReceipt(identity: DispatchReceiptIdentity, reasonClass: string): void;
-export declare function recordCompletionSentReceipt(identity: DispatchReceiptIdentity): void;
-export declare function recordCompletionAckedReceipt(identity: DispatchReceiptIdentity, outcome: "acknowledged" | "rejected"): void;
-/**
- * Shadow invariant: the worker record says this completion still needs to be
- * POSTed, but the store already holds a `completion-acked` receipt — the ack
- * was recorded locally and then lost from worker.json (torn ack / replay).
- * Report-only: the POST still happens (server idempotency absorbs it); the
- * divergence is counted so the shadow window can prove how often replays are
- * store-detectable before D1b short-circuits them.
- */
-export declare function noteCompletionReplayIfAcked(identity: DispatchReceiptIdentity): boolean;
-/** Reason-class extraction for released receipts (never the full detail text). */
-export declare function releaseReasonClass(failureDetail: string | null | undefined): string;
-/**
- * D1b — completion replay short-circuit: in ENFORCE mode a worker replaying a
- * completion whose ack the store already holds (outcome "acknowledged") skips
- * the POST entirely — the local receipt is authoritative for "the server
- * already accepted this". Shadow/off keep today's behavior (POST proceeds,
- * server idempotency absorbs it). The observation counter still fires via
- * `noteCompletionReplayIfAcked` at the call site; this adds the decision.
- */
-export declare function shouldShortCircuitCompletionReplay(identity: DispatchReceiptIdentity): boolean;
-export declare function recordDispatchStartFailedReceipt(taskId: string, runId: string): void;
-export declare function listRecentDispatchStartFailures(runId: string, opts?: {
-    nowMs?: number;
-    windowMs?: number;
-}): string[];
-/**
- * Attempt embedded in a lease token (`${attempt}:${uuid}`), or null. D1b R2:
- * completion-ack exclusion must be attempt-aware — a PRIOR attempt's ack must
- * not mask a LATER claim's stranding.
- */
-export declare function leaseTokenAttempt(token: string): number | null;
-export interface DispatchReceiptInvariantScan {
-    scannedClaims: number;
-    /** Claim receipts past the stall window with no spawned/released receipt and no live worker. */
-    strandedClaimCandidates: number;
-    /** Bracketed/aged receipt rows removed this scan (retention). */
-    prunedReceipts: number;
-}
-/**
- * Report-only shadow scan (review-N1 hardened): the window is recency-bounded
- * (`recordedAfter`, 7 days) AND self-pruning — bracketed (spawned/released)
- * claim trios older than 24 h are deleted each scan, so old bracketed claims
- * can never pin the window and blind the counter on a busy box.
- *
- * A claim with a LIVE worker is never a candidate — that is the crux case
- * (crash between spawn and the `spawned` receipt), and flagging it would
- * train operators to distrust the counter. A claim whose task already holds a
- * `completion-acked` receipt is never a candidate either (review N4: a
- * crux-crashed claim whose worker went on to finish and report is closed
- * evidence, not a stranding). Liveness is delegated via `hasLiveWorker` so
- * this module stays free of run-store imports.
- *
- * Known false-positive class (documented, closed by D1b's worktree-path
- * probe): a crash between `provider.start` and `saveWorker` leaves a live
- * ORPHAN child with no worker record — the worker.json-based probe cannot see
- * it, so it counts as stranded until the orphan exits.
- *
- * Scope: `spawnClaimed` dispatches only. land_pr dispatches carry no claim
- * receipts (plan D1a item 1); their aborts share `abortClaimedSpawn` and may
- * emit `released` receipts with no matching claim — harmless, the scan
- * iterates claims only.
- */
-export declare function scanDispatchReceiptInvariants(options?: {
-    nowMs?: number;
-    strandedAfterMs?: number;
-    hasLiveWorker?: (intent: {
-        runId: string;
-        workerName: string;
-    }) => boolean;
-}): DispatchReceiptInvariantScan;
-/** Counters snapshot for the operator-tick posture (report-only). */
-export declare function dispatchReceiptCounters(): Record<string, number>;
-/** Test-only: reset in-memory shadow counters. */
-export declare function __resetDispatchReceiptCountersForTests(): void;

package/dist/local-run-store/index.d.ts

@@ -1,15 +0,0 @@
-export type { AdmissionReservation, LocalRunStore, OperationReceiptRecord, ProcessIdentityRecord, RecoveryCheckpointRecord, ReserveOutcome, } from "./local-run-store.js";
-export { classifyDatabaseDirectory, type ClassifyOptions, type FilesystemClassification, } from "./sqlite/sqlite-filesystem-policy.js";
-export { LOCAL_SCHEMA_VERSION, SchemaDowngradeRefusedError, } from "./sqlite/sqlite-schema.js";
-export { FilesystemPolicyError, SqliteLocalRunStore, type OpenSqliteLocalRunStoreOptions, } from "./sqlite/sqlite-local-run-store.js";
-export { openSqliteLocalRunStoreWithRecovery, type OpenWithRecoveryResult, } from "./sqlite/sqlite-recovery.js";
-export { __resetLocalRunStoreLifecycleForTests, __setLocalRunStoreLifecycleTestOverrides, closeLocalRunStore, getLocalRunStore, getLocalRunStoreLifecycleStatus, LOCAL_RUN_STORE_OPEN_RETRY_MS, probeLocalRunStore, type LocalRunStoreLifecycleStatus, } from "./store-lifecycle.js";
-export { __resetDispatchReceiptCountersForTests, dispatchReceiptCounters, dispatchReceiptsMode, noteCompletionReplayIfAcked, recordCompletionAckedReceipt, recordCompletionSentReceipt, recordDispatchClaimReceipt, recordDispatchReleasedReceipt, recordDispatchSpawnedReceipt, recordDispatchStartFailedReceipt, listRecentDispatchStartFailures, leaseTokenAttempt, releaseReasonClass, scanDispatchReceiptInvariants, shouldShortCircuitCompletionReplay, type DispatchClaimIntent, type DispatchReceiptIdentity, type DispatchReceiptInvariantScan, } from "./dispatch-receipts.js";
-export { dispatchClaimRecoveryCounters, findLiveProcessByCmdlinePath, recoverStrandedDispatchClaims, __resetDispatchClaimRecoveryForTests, type RecoverStrandedClaimsOptions, type StrandedClaimRecoveryOutcome, type StrandedClaimRecoveryResult, } from "./dispatch-claim-recovery.js";
-export { maybeRunStartupClaimRecovery, __resetStartupClaimRecoveryForTests, } from "./dispatch-claim-recovery-startup.js";
-export { anyLocalRunStoreSurfaceActive, LOCAL_RUN_STORE_SURFACES, parseLocalRunStoreSurfaceMode, resolveLocalRunStoreSurfaceFlags, type LocalRunStoreSurfaceDefinition, type LocalRunStoreSurfaceFlags, type LocalRunStoreSurfaceKey, type LocalRunStoreSurfaceMode, type ResolvedLocalRunStoreSurfaceFlags, } from "./surface-flags.js";
-export { buildLocalRunStoreTickPosture, type LocalRunStoreTickPosture, } from "./tick-posture.js";
-export { __resetAdmissionShadowCountersForTests, admissionShadowCounters, ADMISSION_RESERVATION_TTL_MS, rearmAdmissionAdoptionPass, reconcileAdmissionShadow, releaseWorkerSlotReservation, takeWorkerSlotReservation, type AdmissionShadowReconcile, } from "./admission-shadow.js";
-export { acquireWorkerAdmissionSlot, admissionEnforceCounters, ADMISSION_SLOT_KEY_PREFIX, reconcileNumberedAdmissionSlots, releaseWorkerAdmissionSlot, __resetAdmissionEnforceCountersForTests, type AdmissionSlotDecision, } from "./admission-enforce.js";
-export { __resetSmallSurfaceCountersForTests, assessQuotaCooldownReservation, clearQuotaCooldownReservation, readMeshLeaseCheckpoint, recordQuotaCooldownReservation, restoreKeeperBackoffCheckpoint, saveKeeperBackoffCheckpoint, saveMeshLeaseCheckpoint, smallSurfaceCounters, type MeshLeaseGrant, } from "./small-surfaces.js";
-export { __resetRemoteSurfaceFlagsCacheForTests, extractLocalRunStoreFlagsFromOperatorTickResponse, getRemoteSurfaceFlags, persistRemoteSurfaceFlags, remoteSurfaceFlagsPath, type RemoteSurfaceModeMap, } from "./remote-surface-flags.js";

package/dist/local-run-store/local-run-store.d.ts

@@ -1,106 +0,0 @@
-/**
- * Node 24 migration N4.1 — the replaceable LocalRunStore adapter contract.
- *
- * Covers ONLY host-local concerns the durable-harness plan needs:
- * attempt/process identity, admission reservations, operation
- * receipts/idempotency, recovery checkpoints, and the local schema version.
- * It deliberately does NOT model global AgentOS task authority —
- * AgentOS/PostgreSQL stays authoritative; nothing here may become a source
- * of truth for tasks, plans, or audit.
- *
- * Implementations: sqlite/ (qualification under N4). A future fallback
- * implementation must pass the same contract suite
- * (__tests__/local-run-store/contract-suite.ts).
- */
-export interface ProcessIdentityRecord {
-    processKey: string;
-    pid: number;
-    runtimeVersion: string;
-    nodeVersion: string;
-    startedAt: string;
-    registeredAt: string;
-}
-export interface AdmissionReservation {
-    key: string;
-    owner: string;
-    expiresAt: string;
-}
-export interface ReserveOutcome {
-    acquired: boolean;
-    /** The live reservation after the attempt (the winner's, not necessarily the caller's). */
-    current: AdmissionReservation;
-}
-export interface OperationReceiptRecord {
-    idempotencyKey: string;
-    operation: string;
-    resultJson: string | null;
-    recordedAt: string;
-}
-export interface RecoveryCheckpointRecord {
-    scope: string;
-    seq: number;
-    payloadJson: string;
-    createdAt: string;
-}
-export interface LocalRunStore {
-    /** Upsert this process's identity row (idempotent per processKey). */
-    registerProcessIdentity(input: {
-        processKey: string;
-        pid: number;
-        runtimeVersion: string;
-        nodeVersion: string;
-        startedAt: string;
-    }): ProcessIdentityRecord;
-    getProcessIdentity(processKey: string): ProcessIdentityRecord | null;
-    /**
-     * Try to acquire a keyed admission slot. An unexpired reservation held by
-     * another owner loses; an expired one is replaced. Re-acquiring your own
-     * live reservation refreshes it.
-     */
-    tryReserveAdmission(key: string, owner: string, ttlMs: number, now?: Date): ReserveOutcome;
-    releaseAdmission(key: string, owner: string): boolean;
-    /**
-     * Bounded reservation scan (durable-harness D2 shadow parity + dead-slot
-     * release): filter by escaped-LIKE key prefix; optionally include expired
-     * rows (default live-only). Oldest expiry first.
-     */
-    listAdmissionReservations(input?: {
-        keyPrefix?: string;
-        includeExpired?: boolean;
-        limit?: number;
-        now?: Date;
-    }): AdmissionReservation[];
-    /** Record an operation receipt; a duplicate idempotency key is reported, never overwritten. */
-    recordOperationReceipt(input: {
-        idempotencyKey: string;
-        operation: string;
-        resultJson?: string | null;
-    }): {
-        deduplicated: boolean;
-    };
-    getOperationReceipt(idempotencyKey: string): OperationReceiptRecord | null;
-    /**
-     * Bounded receipt scan for invariant checks (durable-harness D1 shadow):
-     * filter by exact `operation`, key prefix, and/or a recency floor
-     * (`recordedAfter`, ISO — strictly newer than), oldest first. `limit`
-     * defaults to a small bound — this is a diagnostic surface, not a query
-     * engine.
-     */
-    listOperationReceipts(input?: {
-        operation?: string;
-        keyPrefix?: string;
-        recordedAfter?: string;
-        limit?: number;
-    }): OperationReceiptRecord[];
-    /** Delete receipts by exact key (retention pruning). Returns rows removed. */
-    deleteOperationReceiptsByKeys(keys: string[]): number;
-    saveRecoveryCheckpoint(input: {
-        scope: string;
-        payloadJson: string;
-    }): {
-        seq: number;
-    };
-    latestRecoveryCheckpoint(scope: string): RecoveryCheckpointRecord | null;
-    localSchemaVersion(): number;
-    close(): void;
-}

package/dist/local-run-store/remote-surface-flags.d.ts

@@ -1,15 +0,0 @@
-import type { LocalRunStoreSurfaceKey, LocalRunStoreSurfaceMode } from "./surface-flags.js";
-export type RemoteSurfaceModeMap = Partial<Record<LocalRunStoreSurfaceKey, LocalRunStoreSurfaceMode>>;
-export declare function remoteSurfaceFlagsPath(agentOsId: string): string;
-/** Pull the delivered flag map off an operator-tick response (tolerant). */
-export declare function extractLocalRunStoreFlagsFromOperatorTickResponse(operatorTick: unknown): RemoteSurfaceModeMap | null;
-/** Persist a delivery atomically and refresh the in-process cache. Never throws. */
-export declare function persistRemoteSurfaceFlags(agentOsId: string, flags: RemoteSurfaceModeMap): void;
-/**
- * Server-delivered modes for this box (cached). Empty map when nothing has
- * ever been delivered, the file is unreadable, or no workspace is configured.
- * Never throws.
- */
-export declare function getRemoteSurfaceFlags(nowMs?: number): RemoteSurfaceModeMap;
-/** Test-only: drop the cache so the next read hits disk. */
-export declare function __resetRemoteSurfaceFlagsCacheForTests(): void;

package/dist/local-run-store/small-surfaces.d.ts

@@ -1,37 +0,0 @@
-/** Matches the keeper's HEALTHY_RESET window — older counts are stale evidence. */
-export declare const KEEPER_CHECKPOINT_MAX_AGE_MS: number;
-export declare function saveKeeperBackoffCheckpoint(input: {
-    consecutiveFailures: number;
-    exitCode: number | null;
-    exitSignal: string | null;
-}): void;
-/** Enforce only: resume the failure count across keeper restarts. */
-export declare function restoreKeeperBackoffCheckpoint(): number | null;
-export interface MeshLeaseGrant {
-    leaseToken: string | null;
-    holderBoxId: string | null;
-    authorized: boolean;
-    updatedAt: string;
-}
-export declare function saveMeshLeaseCheckpoint(runId: string, grant: MeshLeaseGrant): void;
-/**
- * Enforce: the store is the read source (JSON kept for external readers).
- * Shadow: returns null (JSON stays authoritative) but counts divergence
- * against the JSON value the caller read.
- */
-export declare function readMeshLeaseCheckpoint(runId: string, jsonValue: MeshLeaseGrant | null): MeshLeaseGrant | null;
-export declare function recordQuotaCooldownReservation(provider: string, cooldownMs: number): void;
-export declare function clearQuotaCooldownReservation(provider: string): void;
-/**
- * The reservation-backed cooldown verdict. Enforce: this IS the verdict
- * (race-free record/prune; a torn JSON can no longer fail open into attempt
- * burns). Shadow: returns null (JSON verdict stands) but counts divergence
- * against it. Returns the reservation's expiry when cooling down, null when
- * clear.
- */
-export declare function assessQuotaCooldownReservation(provider: string, jsonBlocked: boolean): {
-    blocked: boolean;
-    retryAtIso: string | null;
-} | null;
-export declare function smallSurfaceCounters(): Record<string, number>;
-export declare function __resetSmallSurfaceCountersForTests(): void;

package/dist/local-run-store/sqlite/sqlite-filesystem-policy.d.ts

@@ -1,16 +0,0 @@
-export interface FilesystemClassification {
-    verdict: "accepted" | "rejected";
-    /** Bounded operator-facing reason; never environment values. */
-    reason: string;
-    filesystemType: string | null;
-    mountPoint: string | null;
-    /** Realpath-resolved nearest existing ancestor the classification applied to. */
-    resolvedPath: string;
-}
-export interface ClassifyOptions {
-    /** Injectable mounts content (tests); default reads /proc/self/mounts. Return null when unavailable. */
-    mountsSource?: () => string | null;
-    /** Injectable realpath (tests); default resolves via the filesystem. */
-    resolveRealPath?: (p: string) => string;
-}
-export declare function classifyDatabaseDirectory(directory: string, options?: ClassifyOptions): FilesystemClassification;

package/dist/local-run-store/sqlite/sqlite-local-run-store.d.ts

@@ -1,68 +0,0 @@
-import type { AdmissionReservation, LocalRunStore, OperationReceiptRecord, ProcessIdentityRecord, RecoveryCheckpointRecord, ReserveOutcome } from "../local-run-store.js";
-import { type ClassifyOptions } from "./sqlite-filesystem-policy.js";
-export declare class FilesystemPolicyError extends Error {
-    constructor(reason: string);
-}
-export interface OpenSqliteLocalRunStoreOptions {
-    directory: string;
-    filename?: string;
-    /** Busy timeout in ms (writer contention wait). */
-    busyTimeoutMs?: number;
-    /** Test injection for the filesystem policy. */
-    classifyOptions?: ClassifyOptions;
-    now?: () => Date;
-}
-export declare class SqliteLocalRunStore implements LocalRunStore {
-    private readonly db;
-    private readonly now;
-    readonly databasePath: string;
-    private constructor();
-    static open(options: OpenSqliteLocalRunStoreOptions): SqliteLocalRunStore;
-    /** Writer helper — every mutation runs inside BEGIN IMMEDIATE. */
-    private inImmediateTransaction;
-    registerProcessIdentity(input: {
-        processKey: string;
-        pid: number;
-        runtimeVersion: string;
-        nodeVersion: string;
-        startedAt: string;
-    }): ProcessIdentityRecord;
-    getProcessIdentity(processKey: string): ProcessIdentityRecord | null;
-    tryReserveAdmission(key: string, owner: string, ttlMs: number, now?: Date): ReserveOutcome;
-    releaseAdmission(key: string, owner: string): boolean;
-    listAdmissionReservations(input?: {
-        keyPrefix?: string;
-        includeExpired?: boolean;
-        limit?: number;
-        now?: Date;
-    }): AdmissionReservation[];
-    recordOperationReceipt(input: {
-        idempotencyKey: string;
-        operation: string;
-        resultJson?: string | null;
-    }): {
-        deduplicated: boolean;
-    };
-    listOperationReceipts(input?: {
-        operation?: string;
-        keyPrefix?: string;
-        recordedAfter?: string;
-        limit?: number;
-    }): OperationReceiptRecord[];
-    deleteOperationReceiptsByKeys(keys: string[]): number;
-    getOperationReceipt(idempotencyKey: string): OperationReceiptRecord | null;
-    saveRecoveryCheckpoint(input: {
-        scope: string;
-        payloadJson: string;
-    }): {
-        seq: number;
-    };
-    latestRecoveryCheckpoint(scope: string): RecoveryCheckpointRecord | null;
-    localSchemaVersion(): number;
-    /** Explicit checkpoint policy: truncate the WAL back into the main db. */
-    checkpointTruncate(): void;
-    integrityCheck(): boolean;
-    /** Read-only config readback used by qualification assertions. */
-    pragma(name: "journal_mode" | "synchronous"): string;
-    close(): void;
-}

package/dist/local-run-store/sqlite/sqlite-recovery.d.ts

@@ -1,14 +0,0 @@
-import { SqliteLocalRunStore, type OpenSqliteLocalRunStoreOptions } from "./sqlite-local-run-store.js";
-export interface OpenWithRecoveryResult {
-    store: SqliteLocalRunStore;
-    recovered: boolean;
-    quarantinedTo: string | null;
-}
-/**
- * Open the store; on open failure or integrity failure, quarantine and
- * rebuild fresh. Schema-downgrade refusals are NOT recovered — a newer
- * schema is an operator decision, not corruption.
- */
-export declare function openSqliteLocalRunStoreWithRecovery(options: OpenSqliteLocalRunStoreOptions & {
-    quarantineStamp?: string;
-}): OpenWithRecoveryResult;