@ours.network/fleet 0.9.4 → 0.9.7

package/dist/monitor.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 // Code constants (not config — YAGNI, design §2).
@@ -242,12 +242,16 @@ function stillInComposer(pane, line) {
 }
 export class Monitor {
     name;
+    identity;
     cfg;
     deps;
     ep;
     statusPath;
     cursorPath;
+    statePath;
     cursor = null;
+    deliveredCursor = null;
+    pendingState = null;
     fatal = false;
     stopped = false;
     bootDeadline = 0;
@@ -256,32 +260,43 @@ export class Monitor {
     // ended in an API error with no completed turn in between.
     apiErrorStreak = 0;
     turnFailThreshold;
+    /** Active degradations, keyed by cause. Empty means armed. */
+    causes = new Map();
     constructor(o) {
         this.name = o.name;
+        this.identity = o.identity ?? o.name;
         this.cfg = o.cfg;
         this.deps = o.deps;
         this.ep = resolveEndpoint(o.deps.env);
         this.statusPath = join(o.agentDir, '.monitor-status');
         this.cursorPath = join(o.agentDir, '.notify-cursor');
+        this.statePath = join(o.agentDir, '.monitor-state.json');
         const n = o.cfg.turn_fail_threshold;
         this.turnFailThreshold = typeof n === 'number' && n >= 1 ? n : DEFAULT_TURN_FAIL_THRESHOLD;
     }
-    /** Prime at the stream tip (or resume a persisted cursor if the daemon is down). */
+    /** Resume the last delivered cursor; only a brand-new monitor primes at stream tip. */
     async prime() {
+        const persisted = this.readPersistedCursor();
+        if (persisted !== null) {
+            this.cursor = persisted;
+            this.deliveredCursor = persisted;
+            this.writeStatus();
+            return;
+        }
         try {
             const body = await this.doFetch('tip', LONGPOLL_TIMEOUT_MS);
             this.cursor = typeof body.cursor === 'number' ? body.cursor : 0;
             this.persistCursor();
-            this.setStatus('armed');
+            this.writeStatus();
         }
         catch (e) {
             if (e instanceof AuthError) {
                 this.fatal = true;
-                this.setStatus(`failed: ${e.message}`);
+                this.degrade('auth', e.message, 'failed');
             }
             else {
-                this.cursor = this.readPersistedCursor();
-                this.setStatus(`degraded: prime failed (${msg(e)})`);
+                this.cursor = null;
+                this.degrade('connectivity', `prime failed (${msg(e)})`);
             }
         }
     }
@@ -291,35 +306,61 @@ export class Monitor {
             return;
         this.bootDeadline = this.deps.now() + BOOT_GRACE_MS;
         let backoff = 0;
+        const pending = [];
         while (!this.stopped) {
             if (!this.deps.isAlive(pid)) {
-                this.setStatus('degraded: session offline');
+                this.degrade('offline', 'session offline');
                 return;
             }
             let body;
             try {
                 body = await this.doFetch(String(this.cursor ?? 0), LONGPOLL_TIMEOUT_MS);
                 backoff = 0;
+                // A poll that worked proves the stream is healthy — and only that.
+                this.recover('connectivity');
             }
             catch (e) {
                 if (this.stopped)
                     return;
                 if (e instanceof AuthError) {
                     this.fatal = true;
-                    this.setStatus(`failed: ${e.message}`);
+                    this.degrade('auth', e.message, 'failed');
                     return;
                 }
                 backoff = Math.min(backoff + BACKOFF_STEP_MS, BACKOFF_MAX_MS);
-                this.setStatus(`degraded: stream hiccup (${msg(e)})`);
+                this.degrade('connectivity', `stream hiccup (${msg(e)})`);
                 await this.deps.sleep(backoff);
                 continue;
             }
-            this.advance(body.cursor);
+            this.advance(body.cursor, false);
             const batch = filterEvents(body.events ?? [], this.cfg.wake_sources);
-            if (batch.length === 0)
+            pending.push(...batch);
+            if (pending.length === 0) {
+                this.persistCursor();
                 continue;
-            await this.coalesce(batch);
-            await this.deliver(pid, batch);
+            }
+            this.pendingState = {
+                count: pending.length,
+                eventTypes: uniq(pending.map(event => event.event ?? 'unknown')),
+                attempts: (this.pendingState?.attempts ?? 0) + 1,
+            };
+            this.persistState();
+            await this.coalesce(pending);
+            // Do not durably commit this cursor until the session explicitly accepts
+            // the wake. If delivery fails or the runner crashes, the daemon replays
+            // from the last committed cursor and the wake is attempted again.
+            let accepted = false;
+            try {
+                accepted = await this.deliver(pid, pending);
+            }
+            catch (e) {
+                this.degrade('delivery', `delivery failed (${msg(e)})`);
+            }
+            if (accepted) {
+                pending.length = 0;
+                this.pendingState = null;
+                this.persistCursor();
+            }
         }
     }
     stop() {
@@ -336,22 +377,35 @@ export class Monitor {
             return;
         try {
             const more = await this.doFetch(String(this.cursor ?? 0), COALESCE_HOLD_MS);
-            this.advance(more.cursor);
+            this.advance(more.cursor, false);
             batch.push(...filterEvents(more.events ?? [], this.cfg.wake_sources));
         }
         catch { /* no stragglers / abort — deliver what we have */ }
     }
     async deliver(pid, batch) {
+        const line = formatNotificationLine(batch);
+        if (this.deps.delivery) {
+            const result = await this.deps.delivery.submit(line);
+            if (!result.succeeded) {
+                // Name the reason: "refused" and "cancelled" are the agent's answer,
+                // not a transport problem, and an operator has to be able to tell them
+                // apart from a dead socket.
+                this.degrade('delivery', `wake ${result.outcome}${result.detail ? ` (${result.detail})` : ''}`);
+                return false;
+            }
+            this.recover('delivery', 'modal');
+            this.recordTurn('completed');
+            return true;
+        }
         const state = await this.awaitInjectable(pid);
         if (state !== 'ready') {
             if (state === 'offline')
-                this.setStatus('degraded: offline during delivery');
+                this.degrade('offline', 'offline during delivery');
             else if (state === 'modal')
-                this.setStatus(`degraded: modal wedge — pane held a dialog for ` +
+                this.degrade('modal', `modal wedge — pane held a dialog for ` +
                     `${MODAL_GIVE_UP_MS / 1000}s, wake not injected`);
-            return; // events remain covered by unread.json / SessionStart backlog
+            return false;
         }
-        const line = formatNotificationLine(batch);
         await this.clearComposer(); // start from an empty composer
         await this.deps.tmux.sendText(this.name, line); // send-keys -l + Enter
         let delivered = false;
@@ -360,21 +414,27 @@ export class Monitor {
         // dead pane makes safeCapture return '' ⇒ not-in-composer ⇒ breaks, no wasted Enter.
         for (let i = 0; i < MAX_ENTER_RETRIES; i++) {
             await this.deps.sleep(POST_VERIFY_MS);
-            const pane = await safeCapture(this.deps.tmux, this.name);
-            if (!stillInComposer(pane, line)) {
+            const capture = await safeCapture(this.deps.tmux, this.name);
+            if (!capture.ok) {
+                this.degrade('delivery', 'capture failed during injection verification');
+                return false;
+            }
+            if (!stillInComposer(capture.pane, line)) {
                 delivered = true;
                 break;
             }
             await this.deps.tmux.sendKey(this.name, 'Enter');
         }
         if (!delivered) {
-            this.setStatus('degraded: injection unverified');
-            return;
+            this.degrade('delivery', 'injection unverified');
+            return false;
         }
+        this.recover('delivery', 'modal');
         // The wake landed and a turn started; observe how that turn terminates so a
         // refusal-wedge (every turn dies with `API Error:` while delivery stays green)
         // becomes visible in `.monitor-status` instead of masquerading as armed (#19).
         await this.observeTurnOutcome(pid);
+        return true;
     }
     /**
      * Watch the pane until the just-triggered turn settles, then fold its outcome
@@ -389,12 +449,16 @@ export class Monitor {
                 return; // shutting down — leave status
             if (!this.deps.isAlive(pid) || !(await this.deps.tmux.has(this.name)))
                 return; // loop marks offline
-            const pane = await safeCapture(this.deps.tmux, this.name);
-            if (looksApiError(pane)) {
+            const capture = await safeCapture(this.deps.tmux, this.name);
+            if (!capture.ok) {
+                this.degrade('delivery', 'capture failed during turn observation');
+                return;
+            }
+            if (looksApiError(capture.pane)) {
                 this.recordTurn('api-error');
                 return;
             }
-            if (!looksRunning(pane)) {
+            if (!looksRunning(capture.pane)) {
                 this.recordTurn('completed');
                 return;
             }
@@ -404,14 +468,17 @@ export class Monitor {
     }
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     recordTurn(outcome) {
+        if (outcome === 'inconclusive')
+            return; // no evidence either way; leave the streak
         if (outcome === 'api-error')
             this.apiErrorStreak++;
-        else if (outcome === 'completed')
+        else
             this.apiErrorStreak = 0;
-        // 'inconclusive' leaves the streak (and therefore the status) unchanged.
-        this.setStatus(this.apiErrorStreak >= this.turnFailThreshold
-            ? 'degraded: turns failing (api error)'
-            : 'armed');
+        if (this.apiErrorStreak >= this.turnFailThreshold)
+            this.degrade('turns-failing', 'turns failing (api error)');
+        else if (outcome === 'completed')
+            // A turn that ran to the end is the ONLY thing that clears this.
+            this.recover('turns-failing');
     }
     /**
      * Reset the composer to empty before typing a wake. Without this, any
@@ -443,8 +510,13 @@ export class Monitor {
                 await this.deps.sleep(this.bootDeadline - now);
                 continue;
             }
-            const pane = await safeCapture(this.deps.tmux, this.name);
-            if (!looksModal(pane))
+            const capture = await safeCapture(this.deps.tmux, this.name);
+            if (!capture.ok) {
+                this.degrade('delivery', 'capture failed while checking session readiness');
+                await this.deps.sleep(MODAL_RETRY_MS);
+                continue;
+            }
+            if (!looksModal(capture.pane))
                 return 'ready';
             if (modalWaits++ >= MAX_MODAL_WAITS)
                 return 'modal';
@@ -457,7 +529,7 @@ export class Monitor {
         const timer = this.deps.timers.set(() => ctrl.abort(), holdMs);
         let resp;
         try {
-            resp = await this.deps.fetch(`${this.ep.url(this.name)}?since=${since}`, { headers: this.ep.headers, signal: ctrl.signal });
+            resp = await this.deps.fetch(`${this.ep.url(this.identity)}?since=${since}`, { headers: this.ep.headers, signal: ctrl.signal });
         }
         finally {
             this.deps.timers.clear(timer);
@@ -469,16 +541,22 @@ export class Monitor {
             throw new Error(`daemon returned HTTP ${resp.status}`);
         return resp.json();
     }
-    advance(cursor) {
+    advance(cursor, persist = true) {
         if (typeof cursor === 'number' && cursor !== this.cursor) {
             this.cursor = cursor;
-            this.persistCursor();
+            if (persist)
+                this.persistCursor();
+            else
+                this.persistState();
         }
     }
     persistCursor() {
         try {
-            if (this.cursor !== null)
+            if (this.cursor !== null) {
+                this.deliveredCursor = this.cursor;
                 writeFileSync(this.cursorPath, `${this.cursor}\n`);
+                this.persistState();
+            }
         }
         catch (e) {
             this.deps.log(`[${this.name}] monitor: failed to persist cursor: ${msg(e)}`);
@@ -486,24 +564,81 @@ export class Monitor {
     }
     readPersistedCursor() {
         try {
+            if (existsSync(this.statePath)) {
+                const state = JSON.parse(readFileSync(this.statePath, 'utf8'));
+                if ((state.identity !== undefined && state.identity !== this.identity)
+                    || (state.profileKey !== undefined && state.profileKey !== this.ep.origin))
+                    return null;
+                if (typeof state.deliveredCursor === 'number') {
+                    this.deliveredCursor = state.deliveredCursor;
+                    return state.deliveredCursor;
+                }
+            }
             if (!existsSync(this.cursorPath))
                 return null;
             const n = parseInt(readFileSync(this.cursorPath, 'utf8').trim(), 10);
+            if (Number.isFinite(n))
+                this.deliveredCursor = n;
             return Number.isFinite(n) ? n : null;
         }
         catch {
             return null;
         }
     }
-    setStatus(s) {
+    /** Atomically persist body-free delivery state; restart always resumes from deliveredCursor. */
+    persistState() {
+        try {
+            const tmp = `${this.statePath}.${process.pid}.tmp`;
+            writeFileSync(tmp, JSON.stringify({
+                version: 1,
+                identity: this.identity,
+                profileKey: this.ep.origin,
+                observedCursor: this.cursor,
+                deliveredCursor: this.deliveredCursor,
+                pending: this.pendingState,
+                updatedAt: new Date(this.deps.now()).toISOString(),
+            }, null, 2) + '\n', { mode: 0o600 });
+            renameSync(tmp, this.statePath);
+        }
+        catch (e) {
+            this.deps.log(`[${this.name}] monitor: failed to persist state: ${msg(e)}`);
+        }
+    }
+    /** Record a degradation under its own cause and republish the status. */
+    degrade(cause, detail, level = 'degraded') {
+        const previous = this.causes.get(cause);
+        this.causes.set(cause, { level, detail, at: new Date(this.deps.now()).toISOString() });
+        this.writeStatus();
+        if (previous?.detail !== detail)
+            this.deps.log(`[${this.name}] monitor ${level}: ${cause} — ${detail}`);
+    }
+    /**
+     * Clear exactly the causes this recovery signal speaks to. Anything else
+     * stays: one successful poll must never be able to erase `turns failing`.
+     */
+    recover(...causes) {
+        let changed = false;
+        for (const cause of causes)
+            changed = this.causes.delete(cause) || changed;
+        if (changed)
+            this.deps.log(`[${this.name}] monitor recovered: ${causes.join(', ')}`);
+        this.writeStatus();
+    }
+    /**
+     * One line per active cause, each dated; `armed` when there are none. Every
+     * line carries an ISO timestamp so an operator can tell a live status from a
+     * stale one left behind by a monitor that stopped writing.
+     */
+    writeStatus() {
+        const lines = this.causes.size
+            ? [...this.causes.entries()].map(([cause, e]) => `${e.level}: ${cause} at ${e.at} — ${e.detail}`)
+            : [`armed at ${new Date(this.deps.now()).toISOString()}`];
         try {
-            writeFileSync(this.statusPath, `${s}\n`);
+            writeFileSync(this.statusPath, lines.join('\n') + '\n');
         }
         catch (e) {
             this.deps.log(`[${this.name}] monitor: failed to write status: ${msg(e)}`);
         }
-        if (!s.startsWith('armed'))
-            this.deps.log(`[${this.name}] monitor ${s}`);
     }
 }
 export function createMonitor(o) {
@@ -511,10 +646,10 @@ export function createMonitor(o) {
 }
 async function safeCapture(tmux, name) {
     try {
-        return await tmux.capture(name);
+        return { ok: true, pane: await tmux.capture(name) };
     }
     catch {
-        return '';
+        return { ok: false, pane: '' };
     }
 }
 const msg = (e) => e?.message ?? String(e);

package/dist/ops.d.ts

@@ -1,18 +1,31 @@
 import type { FleetConfig, ResolvedRole } from './config.js';
-import type { SupervisorBackend } from './supervisor/types.js';
+import type { InstallOutcome as BackendInstallOutcome, SupervisorBackend } from './supervisor/types.js';
+/** An install outcome tagged with the role it belongs to. */
+export interface InstallOutcome extends BackendInstallOutcome {
+    role: string;
+}
 export interface OpsDeps {
     backend: SupervisorBackend;
     binPath: string;
     log(line: string): void;
+    /**
+     * Called the INSTANT a registration is created, before anything else can
+     * fail. A creation transaction that learns about registrations only from
+     * `up()`'s return value learns nothing when `up()` throws — and the service
+     * it just registered is then invisible to rollback (6.2). Optional: plain
+     * `ours-fleet up` has no transaction to tell.
+     */
+    onInstalled?(outcome: InstallOutcome): void;
 }
 /** Materialize a role's state dir from config: briefing + markers. Returns the dir. */
 export declare function applyRole(role: ResolvedRole, opts?: {
     fresh?: boolean;
     temp?: boolean;
     configPath?: string;
+    identityGuarantee?: 'verified' | 'created' | 'unverified';
 }): string;
 /** Create/start roles declaratively. Idempotent; active roles keep their context. */
-export declare function up(cfg: FleetConfig, names: string[], deps: OpsDeps, configPath?: string): Promise<void>;
+export declare function up(cfg: FleetConfig, names: string[], deps: OpsDeps, configPath?: string, identityGuarantee?: 'verified' | 'created' | 'unverified'): Promise<InstallOutcome[]>;
 export declare function down(cfg: FleetConfig, names: string[], deps: OpsDeps): Promise<void>;
 /** Re-sync from config + bounce. mode 'keep' resumes context; 'fresh' wipes it. */
 export declare function restartRoles(cfg: FleetConfig, names: string[], deps: OpsDeps, mode: 'keep' | 'fresh', configPath?: string): Promise<void>;

package/dist/ops.js

@@ -5,6 +5,7 @@ import { agentDir, fleetDDir } from './paths.js';
 import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
+import { resetRestartLedger } from './runner.js';
 // Launch staggering now lives at the harness-launch point (the runner's start
 // gate, driven by `start_stagger_ms`), so it covers systemd host-boot too — not
 // just the `up`/`restart` command loop below. The old in-loop FLEET_START_STAGGER
@@ -36,6 +37,7 @@ export function applyRole(role, opts = {}) {
     writeFileSync(join(dir, 'briefing.md'), generateBriefing(role, adapter.vocabulary, {
         stateDir: dir, worklogPath: join(dir, 'WORKLOG.md'),
         routinesPath: join(dir, 'ROUTINES.md'), briefingBody,
+        identityGuarantee: opts.identityGuarantee,
     }));
     if (opts.fresh)
         for (const f of ['.booted', '.session-id', '.exit-status'])
@@ -46,32 +48,53 @@ function selectRoles(cfg, names) {
     return names.length ? names.map(n => findRole(cfg, n)) : cfg.roles;
 }
 /** Create/start roles declaratively. Idempotent; active roles keep their context. */
-export async function up(cfg, names, deps, configPath) {
+export async function up(cfg, names, deps, configPath, identityGuarantee) {
+    const outcomes = [];
     for (const role of selectRoles(cfg, names)) {
-        const dir = applyRole(role, { configPath });
-        // If the role isn't running, boot fresh so it reads the briefing we just wrote.
-        const status = await deps.backend.status(role.name).catch(() => '');
-        if (!/running|active \(/.test(status))
+        const dir = applyRole(role, { configPath, identityGuarantee });
+        // Only a *definite* stop boots fresh so the role reads the briefing we just
+        // wrote. A running, restarting, or unprobeable role keeps its context —
+        // guessing "stopped" from an unanswered probe silently discards a live
+        // conversation.
+        // An explicit operator `up` is the sanctioned way to release a held-down
+        // role: the still-alive runner polls this file and resumes (3.2).
+        resetRestartLedger(dir);
+        const live = await deps.backend.liveness(role.name)
+            .catch(e => ({ state: 'unknown', detail: e instanceof Error ? e.message : String(e) }));
+        if (live.state === 'stopped')
             rmSync(join(dir, '.booted'), { force: true });
-        await deps.backend.install(role.name, deps.binPath);
+        else if (live.state === 'unknown')
+            deps.log(`  ! ${role.name}: liveness unknown, keeping session context — ${live.detail}`);
+        // Report what each install actually did, so a creation transaction can undo
+        // only the registrations IT made (6.2). Announced immediately as well as
+        // returned: a later role in this same loop can throw, and the registrations
+        // already made must still be undoable.
+        const outcome = { ...await deps.backend.install(role.name, deps.binPath), role: role.name };
+        if (outcome.created)
+            deps.onInstalled?.(outcome);
+        outcomes.push(outcome);
         deps.log(`↑ up: ${role.name} (harness: ${role.harness}, identity: ${role.identity}${role.cwd ? `, cwd: ${role.cwd}` : ''})`);
     }
+    return outcomes;
 }
 export async function down(cfg, names, deps) {
     for (const role of selectRoles(cfg, names)) {
+        // Never swallow the backend's reason. "maybe not running" hid real stop
+        // failures — a wedged unit, an unreachable user bus — behind a guess.
         try {
             await deps.backend.stop(role.name);
             deps.log(`■ stopped ${role.name}`);
         }
-        catch {
-            deps.log(`  (could not stop ${role.name} — maybe not running)`);
+        catch (e) {
+            deps.log(`  ! could not stop ${role.name}: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
 }
 /** Re-sync from config + bounce. mode 'keep' resumes context; 'fresh' wipes it. */
 export async function restartRoles(cfg, names, deps, mode, configPath) {
     for (const role of selectRoles(cfg, names)) {
-        applyRole(role, { fresh: mode === 'fresh', configPath });
+        const dir = applyRole(role, { fresh: mode === 'fresh', configPath });
+        resetRestartLedger(dir); // explicit restart closes the circuit
         await deps.backend.restart(role.name);
         deps.log(mode === 'fresh'
             ? `↻ ${role.name} — force-restarted (FRESH — context cleared, briefing reloaded)`

package/dist/permissions.d.ts

@@ -0,0 +1,70 @@
+import type { CommonPermissions, ResolvedRole } from './config.js';
+import type { UnattendedCapability } from './harness/types.js';
+/**
+ * The capability floor every unattended role must clear. These are not
+ * nice-to-haves: an agent that cannot read its briefing, append its worklog,
+ * bind its identity, arm its monitor, edit its workspace, or run the status
+ * commands its briefing prescribes cannot carry out the job it was spawned for
+ * — and, being unattended, will report no error while failing to.
+ */
+export declare const UNATTENDED_FLOOR: readonly UnattendedCapability[];
+export interface FloorResult {
+    meets: boolean;
+    missing: UnattendedCapability[];
+}
+/** Which floor capabilities a set of granted capabilities fails to cover. */
+export declare function checkUnattendedFloor(granted: readonly UnattendedCapability[]): FloorResult;
+/**
+ * One role's neutral permissions, resolved through its harness adapter.
+ *
+ * Both `ours-fleet config` and `ours-fleet doctor` render this same object, so
+ * the two commands cannot disagree about what a configuration actually means.
+ * Before this existed, `translatePermissions()` was implemented by every
+ * adapter and called by nobody: the warnings it produced — including "this
+ * combination is not represented exactly" — were unreachable.
+ */
+export interface RolePermissionAnalysis {
+    role: string;
+    harness: string;
+    permissions: CommonPermissions;
+    /** Whether the harness can express neutral permissions at all. */
+    supported: boolean;
+    /** The harness's own settings, when it can. */
+    native?: Record<string, unknown>;
+    /** Whether those settings represent the neutral intent exactly. */
+    exact?: boolean;
+    /** What the native settings actually permit an unattended agent to do. */
+    capabilities?: UnattendedCapability[];
+    /** Whether those capabilities clear the unattended floor. */
+    floor?: FloorResult;
+    /**
+     * How hard a floor shortfall is. A role that auto-denies (`unattended: deny`)
+     * silently does less than asked, so that is a failure; one that waits can at
+     * least be rescued by a human attaching a console, so that is a warning.
+     */
+    floorSeverity?: 'fail' | 'warn';
+    /** Native settings that contradict the neutral block; empty when they agree. */
+    conflicts?: PermissionConflict[];
+    /** A role-named line when the floor is not met; absent when it is. */
+    floorWarning?: string;
+    /** Role-named translation warnings, ready to print verbatim by any command. */
+    warnings: string[];
+}
+export interface PermissionConflict {
+    /** The native setting both sources speak to, e.g. `permission_mode`. */
+    key: string;
+    /** What the neutral `permissions:` block translates to. */
+    fromNeutral: string;
+    /** What `harness_options` states directly. */
+    fromNative: string;
+    /** The role-named line commands print. */
+    warning: string;
+}
+/** Resolve one role's permissions through its adapter. Never throws. */
+export declare function analyzeRolePermissions(role: ResolvedRole): RolePermissionAnalysis;
+/** Every line a command should show for a role: translation, conflicts, floor. */
+export declare function allWarnings(a: RolePermissionAnalysis): string[];
+/** Resolve every role's permissions, in config order. */
+export declare function analyzeFleetPermissions(roles: ResolvedRole[]): RolePermissionAnalysis[];
+/** Render an analysis's native settings compactly, for one-line reporting. */
+export declare function formatNative(native: Record<string, unknown> | undefined): string;