@quantiya/codevibe-claude-plugin 2.0.76 → 2.0.77

package/node_modules/@quantiya/codevibe-core/dist/session-resume/e2e-fault.d.ts

@@ -0,0 +1,28 @@
+export declare const E2E_FAULT_ENV = "CODEVIBE_E2E_FAULT";
+export declare const E2E_RELEASE_FILE_ENV = "CODEVIBE_E2E_RELEASE_FILE";
+declare const E2E_FAULTS: readonly ["exit-without-teardown", "hold-after-resume-lock", "exit-after-ledger-seal", "exit-after-resume-create", "fail-resume-publish", "exit-after-retire-note"];
+export type E2eFault = (typeof E2E_FAULTS)[number];
+/** P61B-S1-N1: the hold never outlives a stalled harness. */
+export declare const E2E_HOLD_MAX_MS: number;
+export declare function e2eFault(env?: NodeJS.ProcessEnv): E2eFault | null;
+/** E2E-8 / E2E-9 / E2E-11: end a resume at one of its crash points, naming it on stdout first. */
+export declare function exitAtResumeFaultPoint(point: 'exit-after-ledger-seal' | 'exit-after-resume-create' | 'exit-after-retire-note', predecessorSessionId: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    write?: (text: string) => void;
+    exit?: (code: number) => void;
+}): void;
+/** E2E-10: fail S's publish while finishing a non-targeted interrupted resume. */
+export declare function failResumePublishIfFaulted(env?: NodeJS.ProcessEnv): void;
+/** Name an active fault on stderr; returns whether one is active. */
+export declare function warnIfE2eFault(env?: NodeJS.ProcessEnv, write?: (text: string) => void): boolean;
+/** E2E-3: hold after taking P's resume lock until the release file appears, or `E2E_HOLD_MAX_MS` passes. */
+export declare function holdAfterResumeLock(predecessorSessionId: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    write?: (text: string) => void;
+    exists?: (file: string) => boolean;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}): Promise<void>;
+/** E2E-4: end the process without teardown once the first exchange is durable. */
+export declare function exitWithoutTeardownIfFaulted(env?: NodeJS.ProcessEnv, exit?: (code: number) => void): void;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/session-resume/hosted-loader.d.ts

@@ -0,0 +1,88 @@
+/**
+ * P61 session resume — read a session's hosted context copy
+ * (SESSION-RESUME-DESIGN.md §8.1 "Following the hosted chain", §8.4, §9.3).
+ *
+ * The hosted copy can hold rows that are on no chain (an AGENT_TURN batch
+ * uploaded before a local rollback, A7). The loader therefore decrypts every
+ * row, follows the chain from the item whose `prev_hash` is null, resolves
+ * forks against the clean-exit `contextTail`, and runs the selected chain
+ * through the same pure verifier the local log uses. It never trusts row
+ * order or completeness from the server.
+ */
+import { type ContextItem } from '../orchestration-shell/context-items';
+import type { ContextItemRowWire } from '../types/session';
+export interface ContextTail {
+    seq: string;
+    itemSha256: string;
+}
+/** One decrypted hosted row: its plaintext JSON (hashed for the chain) and parsed item. */
+export interface HostedEntry {
+    json: string;
+    item: Pick<ContextItem, 'seq' | 'prev_hash'>;
+}
+export type HostedChainSelection = 
+/** The chain ends exactly at contextTail. */
+{
+    kind: 'complete';
+    entries: HostedEntry[];
+}
+/** The chain contains contextTail and continues past it (writes after a last-ditch tail). */
+ | {
+    kind: 'continues-past-tail';
+    entries: HostedEntry[];
+}
+/** Branches fork after contextTail: everything after the fork is left out (one warning line). */
+ | {
+    kind: 'cut-at-tail';
+    entries: HostedEntry[];
+}
+/** The single chain ends before contextTail: the last updates were never uploaded. */
+ | {
+    kind: 'short';
+    entries: HostedEntry[];
+}
+/** No contextTail (crash, signal, sweep, phone end): "didn't end cleanly". */
+ | {
+    kind: 'no-tail';
+    entries: HostedEntry[];
+}
+/** A branch passes contextTail's seq without containing it, or holds a different item at that seq. */
+ | {
+    kind: 'integrity';
+}
+/** A fork no contextTail can resolve. */
+ | {
+    kind: 'ambiguous';
+};
+/** Decrypt one hosted row to its plaintext JSON (desktop-side only). */
+export declare function decryptHostedRow(row: Pick<ContextItemRowWire, 'ciphertext'>, sessionKeyBase64: string): string;
+/**
+ * §8.4 — choose the chain to resume from, given every decrypted hosted row.
+ * Pure: tested over fixtures for each table row.
+ */
+export declare function selectHostedChain(entries: HostedEntry[], tail: ContextTail | null): HostedChainSelection;
+export type HostedLoadResult = {
+    ok: true;
+    selection: Exclude<HostedChainSelection, {
+        kind: 'integrity';
+    } | {
+        kind: 'ambiguous';
+    }>;
+    items: ContextItem[];
+} | {
+    ok: false;
+    reason: 'integrity' | 'ambiguous' | 'undecryptable';
+};
+/**
+ * Decrypt, select and verify. A row that does not decrypt with P's key is an
+ * integrity failure (the key unwrapped P's envelope, so every genuine row
+ * decrypts); a row that decrypts but does not parse is ignored as off-chain.
+ */
+export declare function loadHostedChain(sessionId: string, rows: ContextItemRowWire[], sessionKeyBase64: string, tail: ContextTail | null): HostedLoadResult;
+/** Page `listContextItems` to the end (design §9.3). */
+export declare function fetchAllHostedRows(client: {
+    listContextItems(sessionId: string, nextToken?: string | null): Promise<{
+        items: ContextItemRowWire[];
+        nextToken: string | null;
+    }>;
+}, sessionId: string): Promise<ContextItemRowWire[]>;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/local-completeness.d.ts

@@ -0,0 +1,10 @@
+/**
+ * P61 §8.4 for P's local log: its verified chain against P's clean-exit
+ * `contextTail`. A local log is one chain, so the hash of item i is the next
+ * item's `prev_hash`, and the last item's hash is the reader's tail hash. The
+ * outcomes are the hosted loader's, minus forks.
+ */
+import type { ContextItem } from '../orchestration-shell/context-items';
+import type { ContextTail } from './hosted-loader';
+export type LocalCompleteness = 'complete' | 'continues-past-tail' | 'short' | 'no-tail' | 'integrity';
+export declare function checkLocalCompleteness(items: readonly ContextItem[], localTail: ContextTail | null, contextTail: ContextTail | null): LocalCompleteness;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/local-records.d.ts

@@ -0,0 +1,121 @@
+/**
+ * P61 session resume — local owner records and resume locks
+ * (SESSION-RESUME-DESIGN.md §6.2, §8.5 INV-1/INV-2/INV-8/INV-11, §12.5;
+ * Phase B implementation design §2, §4).
+ *
+ * Every record appears with its full content atomically: it is written to a
+ * private temp file, fsynced, then `link()`ed into place, which fails if the
+ * name exists. A record that cannot be parsed or validated is classified
+ * fail-closed (an unreadable owner record means read-only; an unreadable lock
+ * means held) and is never treated as a dead process. Records are never
+ * rewritten in place; finishing and releasing add a second record.
+ */
+import { type ProcessIdentity } from '../local-executor/process-identity';
+/** `~/.codevibe/resume-state` — a sibling of `context-items`, never inside a session's log directory. */
+export declare function resumeStateRoot(): string;
+export declare function resumeStateDir(sessionId: string): string;
+/** A process identity is usable only when well-formed (code map finding 6). */
+export declare function isValidProcessIdentity(value: unknown): value is ProcessIdentity;
+/**
+ * Create `finalPath` with `content` iff it does not exist. The full content is
+ * durable before the name appears, so a reader never sees a torn record.
+ */
+export declare function createRecordAtomically(finalPath: string, content: string, 
+/** `false`: the directory must already exist (a lock release never recreates a swept directory). */
+options?: {
+    createDirectory?: boolean;
+}): Promise<'created' | 'exists'>;
+export type OwnerRecordState = 'finished' | 'dead' | 'live' | 'absent' | 'unreadable';
+/**
+ * Written once at shell start, before the first context append. A failure
+ * never blocks the shell: the record is then absent and resumers stay
+ * read-only (INV-3).
+ */
+export declare function writeOwnerRecord(sessionId: string, userId: string): Promise<boolean>;
+/**
+ * The last teardown step, after the INACTIVE update and the last log write.
+ * Never called when teardown did not converge.
+ */
+export declare function markOwnerFinished(sessionId: string): Promise<boolean>;
+/**
+ * Classify a session's owner record on this computer (design §6.2). A
+ * finished mark wins even while its process is alive (S1R8 R8-L1a). A record
+ * for another user (INV-11), another session, or with a malformed identity is
+ * unreadable, never dead.
+ */
+export declare function classifyOwnerRecord(sessionId: string, signedInUserId: string, isAlive?: (identity: ProcessIdentity) => Promise<boolean>): Promise<OwnerRecordState>;
+export type OwnerTakeover = 'taken' | 'live' | 'finished' | 'unreadable' | 'raced';
+/**
+ * Make this process S's recorded owner when finishing an interrupted resume
+ * (§6.2 step 2, INV-1/INV-2/INV-8): the replaying process starts S's shell or
+ * rebuilds its log, so S's owner record must name it, not the dead process
+ * that prepared S. Allowed only under P's resume lock, and only when the
+ * recorded owner is dead or absent. A dead record is renamed aside by exact
+ * path (records are never rewritten in place or deleted); until the new one
+ * appears, readers see "absent", which only makes them read-only.
+ */
+export declare function takeOverOwnerRecord(sessionId: string, signedInUserId: string, isAlive?: (identity: ProcessIdentity) => Promise<boolean>, 
+/**
+ * `/resume` hand-off (§12.6): the pid of this process's live parent, passed
+ * only after this process adopted P's lock from that parent. A live owner
+ * with exactly this pid prepared S and is waiting on this child, so it is
+ * handed over like a dead one.
+ */
+handOffParentPid?: number): Promise<OwnerTakeover>;
+export interface ResumeLockHandle {
+    predecessorSessionId: string;
+    generation: number;
+    nonce: string;
+    path: string;
+}
+export type ResumeLockOutcome = {
+    acquired: true;
+    handle: ResumeLockHandle;
+} | {
+    acquired: false;
+    reason: 'held';
+};
+/**
+ * At most one resumer of P proceeds on this computer (INV-2). The highest
+ * generation decides: released or dead ⇒ create the next generation; live,
+ * unreadable or foreign ⇒ held. Creating the next generation is exclusive,
+ * and the acquisition is re-checked once it exists (`acquisitionStands`).
+ */
+export declare function acquireResumeLock(predecessorSessionId: string, signedInUserId: string, isAlive?: (identity: ProcessIdentity) => Promise<boolean>, 
+/**
+ * Test seams: `beforeCreate` runs between reading the generations and creating the next one;
+ * `afterOwnCheck` between the re-check's read of this process's lock file and its tombstone check.
+ */
+seams?: {
+    beforeCreate?: () => Promise<void>;
+    afterOwnCheck?: () => Promise<void>;
+}): Promise<ResumeLockOutcome>;
+/**
+ * Release by adding the generation's released mark (never by deleting the lock), bound to the lock by
+ * its nonce. Only while this handle's lock file is still in place, and never by creating a directory:
+ * a release after a sweep renamed the directory away must not recreate it (P61B-S1-R4-F1).
+ */
+export declare function releaseResumeLock(handle: ResumeLockHandle): Promise<void>;
+/**
+ * `/resume` hand-off (Phase B design §4): the child adopts generation `n`
+ * only if the lock's nonce matches the one its parent passed and the lock's
+ * holder is the child's live parent process.
+ */
+export declare function adoptHandedOffResumeLock(token: string, signedInUserId: string, parentPid?: number, isAlive?: (identity: ProcessIdentity) => Promise<boolean>): Promise<ResumeLockHandle | null>;
+export declare function resumeLockHandOffToken(handle: ResumeLockHandle): string;
+/** Same window as the context-items retention sweep (`CONTEXT_ITEMS_RETENTION_MS`). */
+export declare const RESUME_STATE_RETENTION_MS: number;
+/** Fire-and-forget from shell boot, at most once per process (as `scheduleContextItemsGc`). */
+export declare function scheduleResumeStateGc(activeSessionId: string): void;
+/**
+ * The resume-state retention sweep: a session directory whose newest file is older than the window
+ * is removed, never the active session's, never one with a live owner or a held lock, and never on an
+ * unreadable mtime. A tombstone left by an earlier sweep is removed once nothing uses it. Returns the
+ * number of session directories removed.
+ */
+export declare function gcResumeState(deps: {
+    activeSessionId: string;
+    nowMs?: number;
+    isAlive?: (identity: ProcessIdentity) => Promise<boolean>;
+}): Promise<number>;
+export declare function resetResumeStateGcForTests(): void;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/picker-rows.d.ts

@@ -0,0 +1,17 @@
+import type { UnlockedResumeRow } from './resume-rows';
+export declare const PICKER_TITLE = "Resume a session (ended in the last 7 days)";
+export declare const PICKER_KEYS = "\u2191/\u2193 choose \u00B7 Enter resume \u00B7 Esc cancel";
+export declare const PICKER_EMPTY = "No sessions you can resume from the last 7 days.";
+export declare const PICKER_VISIBLE_ROWS = 20;
+export interface PickerRow {
+    sessionId: string;
+    label: string;
+    locked: boolean;
+}
+export declare function computerLabel(creatorDeviceId: string | null, thisDeviceId: string, platformsByDeviceId: ReadonlyMap<string, string>): string;
+export declare function toPickerRows(rows: readonly UnlockedResumeRow[], ctx: {
+    nowMs: number;
+    thisDeviceId: string;
+    platformsByDeviceId: ReadonlyMap<string, string>;
+    home?: string;
+}): PickerRow[];

package/node_modules/@quantiya/codevibe-core/dist/session-resume/publish-retire.d.ts

@@ -0,0 +1,40 @@
+/**
+ * P61 publish-then-retire (INV-6; Phase B implementation design §5). For an
+ * admitted S whose shell will not start here — a non-targeted interrupted
+ * resume finished at a later entry point — S is first published (its hosted
+ * outbox drained, bounded), then retired with its marker as the clean-exit
+ * tail, so it becomes an ordinary resumable session. A failure leaves a retire
+ * note that every later resume entry point retries, draining first.
+ */
+import { type UpdateSessionInput } from '../types/session';
+export declare const PUBLISH_DRAIN_TIMEOUT_MS = 30000;
+export interface PublishRetireDeps {
+    /** Start hosted sync for S's log and drain it; resolves only when no upload is in flight. */
+    drain(successorSessionId: string): Promise<void>;
+    updateSession(input: UpdateSessionInput): Promise<unknown>;
+    writeRetireNote(note: {
+        successorSessionId: string;
+        predecessorSessionId: string;
+        marker: {
+            seq: string;
+            itemSha256: string;
+        };
+        encryptedLastPrompt?: string;
+    }): Promise<void>;
+    clearRetireNote(successorSessionId: string): Promise<void>;
+    timeoutMs?: number;
+}
+export type PublishRetireResult = 'retired' | 'noted';
+/** The message the user sees for a finished non-targeted resume (design §6.2 step 2). */
+export declare function finishedResumeMessage(predecessorSessionId: string, successorSessionId: string): string;
+export declare function publishThenRetire(args: {
+    successorSessionId: string;
+    predecessorSessionId: string;
+    marker: {
+        seq: string;
+        itemSha256: string;
+    };
+    /** S's picker preview: its last carried prompt, sealed with S's key (P61B-S1-L12). */
+    encryptedLastPrompt?: string;
+    deps: PublishRetireDeps;
+}): Promise<PublishRetireResult>;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/relaunch.d.ts

@@ -0,0 +1,72 @@
+/**
+ * P61 `/resume` relaunch (design §5.3 step 2–3, §12.6; Phase B design B-12, §4).
+ *
+ * After a converged teardown the parent runs `codevibe --resume <P>` as a
+ * child with the terminal handed over (`spawnSync`, `stdio: 'inherit'`) and
+ * exits with the child's status. The child's environment carries the nesting
+ * depth and the hand-off token for P's resume lock, which the child adopts
+ * only from its own live parent (`adoptHandedOffResumeLock`).
+ */
+import { type SpawnSyncReturns } from 'node:child_process';
+export declare const RESUME_DEPTH_ENV = "CODEVIBE_RESUME_DEPTH";
+export declare const RESUME_LOCK_ENV = "CODEVIBE_RESUME_LOCK";
+/** Switches nest at most this deep (§5.3 step 3). */
+export declare const MAX_RESUME_DEPTH = 8;
+/** An absent or non-numeric value counts as 0 (S2-A5). */
+export declare function parseResumeDepth(value: string | undefined): number;
+export declare function resumeCommandText(predecessorSessionId: string): string;
+/** §5.3 step 2: teardown failed or hit its deadline. */
+export declare function switchFailedMessage(predecessorSessionId: string): string;
+/** §10: a `/resume` switch whose child fails after the current session C has ended. */
+export declare function previousSessionEndedMessage(currentSessionId: string): string;
+/**
+ * The exit status of a process that printed the §10 "previous session also ended" line. A parent
+ * whose child exits with it passes it on without a second line, so a nested switch names only the
+ * most recent ended session.
+ */
+export declare const PREVIOUS_SESSION_HINTED_EXIT = 3;
+/** §5.3 step 3: at the depth cap the command is printed instead of relaunching. */
+export declare function depthCapMessage(predecessorSessionId: string): string;
+export interface RelaunchRequest {
+    predecessorSessionId: string;
+    /** `resumeLockHandOffToken(handle)` for P's lock, held by this process. */
+    lockToken: string;
+}
+export type RelaunchOutcome = {
+    kind: 'relaunched';
+    status: number;
+}
+/** `failed` is false only at the depth cap, where printing the command is the designed outcome. */
+ | {
+    kind: 'printed';
+    text: string;
+    failed: boolean;
+};
+/**
+ * Relaunch the CLI as `--resume <P>` and return the child's exit status, or the
+ * command to print at the depth cap. `cliPath` is this process's entry script.
+ */
+export declare function relaunchResume(args: {
+    request: RelaunchRequest;
+    cliPath: string;
+    env?: NodeJS.ProcessEnv;
+    execPath?: string;
+    spawn?: (command: string, argv: string[], options: {
+        stdio: 'inherit';
+        env: NodeJS.ProcessEnv;
+    }) => Pick<SpawnSyncReturns<Buffer>, 'status' | 'signal' | 'error'>;
+}): RelaunchOutcome;
+/**
+ * B-12 — `main`'s last step after the shell returns: relaunch for a converged
+ * `/resume` switch and exit with the child's status; print the command when
+ * the switch could not run. Otherwise the shell's own code stands.
+ */
+export declare function finishShellExit(code: number, exit: {
+    relaunch?: RelaunchRequest;
+    switchFailedFor?: string;
+    currentSessionId?: string;
+}, opts: {
+    cliPath: string;
+    write(text: string): void;
+    relaunch?: typeof relaunchResume;
+}): number;

package/node_modules/@quantiya/codevibe-core/dist/session-resume/restore-conversation.d.ts

@@ -0,0 +1,27 @@
+/**
+ * P61 §12.4 — the conversation entries a resumed session is seeded with,
+ * built from the carried items (P's verified items as the carry-over chose
+ * them, in P's seq order). Pure; the shell dispatches the result once as
+ * `RESTORE_CONVERSATION` before its first turn.
+ *
+ * - A human turn → `user-message`.
+ * - An agent reply → `advisory` labelled with the agent (§5.4).
+ * - A conductor reply → one `advisory` per recorded advisory segment (§12.9),
+ *   with that segment's source and hand-off flag; without valid segments, one
+ *   entry flagged `handoffExcluded` (the conservative legacy rule).
+ * - A session-scoped conductor decision → `planner-decision` (action and
+ *   rationale), never a `session_resumed` marker. A `brainstorm` decision's
+ *   `needsRepositoryContext` is recomputed here, in carried order, with the
+ *   shipped rule (design §12.4; it is not in the logged decision body).
+ * - A carried task → one display-only line under the exchange that started it,
+ *   `↳ task: <spec> — <verdict>` (§5.4; P61B-S1-F7).
+ * Rules, open questions and the marker add no entry here; the §5.4 summary
+ * shows the rule count. Entries keep their
+ * full text — the hand-off collectors read them exactly as they read P's —
+ * and the renderer shortens long restored replies for display only.
+ */
+import type { ContextItem } from '../orchestration-shell/context-items';
+import type { RestoredConversationEntry } from '../orchestration-shell/types';
+/** The last carried human prompt, as the restored view shows it (task items excluded); null if none. */
+export declare function lastCarriedHumanText(items: readonly ContextItem[]): string | null;
+export declare function buildRestoredEntries(items: readonly ContextItem[]): RestoredConversationEntry[];

package/node_modules/@quantiya/codevibe-core/dist/session-resume/resume-candidates.d.ts

@@ -0,0 +1,52 @@
+/**
+ * P61 §6.2 step 1 — read the lists, then build the target-matching view.
+ * `listResumableSessions` is paged to the end (B-11). The account's
+ * `listSessions` read is the one the pre-listing retire uses, so the
+ * `--continue` comparison and the retire evaluate `willRetire` on the same
+ * rows (C2-F5). Interrupted resumes come from this computer's ledgers.
+ */
+import type { ResumeDetails } from '../types/session';
+import type { OwnerRecordState } from './local-records';
+import type { ResumeLedgerRead } from './resume-ledger';
+import { type UnlockedResumeRow } from './resume-rows';
+import type { TargetLedger, TargetSession } from './resume-target';
+import { type RetireCandidateRow } from './will-retire';
+export interface ResumeCandidateDeps {
+    nowMs(): number;
+    /** The session running in this process, if any (the `/resume` parent). */
+    ownSessionId?: string;
+    listResumableAll(): Promise<ResumeDetails[]>;
+    listSessions(): Promise<RetireCandidateRow[]>;
+    getResumeDetails(sessionId: string): Promise<ResumeDetails | null>;
+    unlock(details: ResumeDetails): Promise<UnlockedResumeRow>;
+    ownerState(sessionId: string): Promise<OwnerRecordState>;
+    listLedgers(): Promise<ResumeLedgerRead[]>;
+}
+export interface ResumeCandidates {
+    /** Resumable now, unlocked where this computer can. */
+    resumable: UnlockedResumeRow[];
+    /** ACTIVE rows this launch retires (`willRetire`), with their details unlocked. */
+    retiring: Array<{
+        row: RetireCandidateRow;
+        unlocked: UnlockedResumeRow | null;
+    }>;
+    /** The exact `willRetire` set, for step 3. */
+    willRetireIds: Set<string>;
+    ledgers: Extract<ResumeLedgerRead, {
+        state: 'ok';
+    }>[];
+    /** The target-matching view of all of the above. */
+    targetSessions: TargetSession[];
+    targetLedgers: TargetLedger[];
+}
+export declare function collectResumeCandidates(deps: ResumeCandidateDeps): Promise<ResumeCandidates>;
+/**
+ * §6.2: the steps run "before the picker opens", so a row this launch retires
+ * (`willRetire`) is listed with the resumable ones: "Already retired before
+ * listing (step 3)" (§6.2 table). It is dated by its freshness timestamp, the
+ * value `willRetire` and the `--continue` comparison use (§12.2.3). A retiring
+ * row whose details could not be read is left out: it can be neither shown nor
+ * unlocked. (E2E-4, other computer, e2e-container-b-r1: both pickers listed only
+ * the step-1 resumable read, so a crashed session stayed hidden after 10 min.)
+ */
+export declare function pickerCandidates(c: ResumeCandidates): UnlockedResumeRow[];

package/node_modules/@quantiya/codevibe-core/dist/session-resume/resume-chosen.d.ts

@@ -0,0 +1,103 @@
+/**
+ * P61 — resume one chosen predecessor P (design §6.2 "P still ACTIVE", §8.1,
+ * §8.4, §10, §12.2.2). Every effect is injected.
+ *
+ * Order: refusals from `getResumeDetails` → unlock P here → P's resume lock →
+ * source (local or hosted) → completeness → carry-over plan → create S.
+ * The lock is kept on success (the caller releases it once S's shell has
+ * started) and released on every other outcome.
+ *
+ * When P is itself a successor (its row names `resumedFromSessionId`), §8.4's
+ * "Checking S itself" applies: if P's verified chain lacks its own carry-over
+ * marker, the carry-over is rebuilt from P's predecessor while that session's
+ * window is open and this computer holds its key (step 2), or the user is
+ * asked whether to continue without it (step 3).
+ */
+import type { ContextItem, ReadOnlyContextLogResult } from '../orchestration-shell/context-items';
+import { type ContextItemRowWire, type ResumeDetails } from '../types/session';
+import { type CarryOverPlan } from './carry-over';
+import { type CompletenessKind, type ContinueLabel, type CopyContext } from './completeness-copy';
+import type { OwnerRecordState, ResumeLockHandle, ResumeLockOutcome } from './local-records';
+import { type ResumeCreateDeps, type ResumeCreateResult } from './resume-create';
+import type { UnlockedResumeRow } from './resume-rows';
+export interface ResumeChosenDeps {
+    userId: string;
+    deviceId: string;
+    cwd: string;
+    isTTY: boolean;
+    /** Clock for §8.4 step 2's window check; defaults to `Date.now`. */
+    nowMs?: () => number;
+    getResumeDetails(sessionId: string): Promise<ResumeDetails | null>;
+    unlock(details: ResumeDetails): Promise<UnlockedResumeRow>;
+    ownerState(sessionId: string): Promise<OwnerRecordState>;
+    /** Retire a still-ACTIVE P whose owner here is finished or dead (as the sweep does). */
+    retireActive(sessionId: string): Promise<void>;
+    acquireLock(predecessorSessionId: string): Promise<ResumeLockOutcome>;
+    releaseLock(handle: ResumeLockHandle): Promise<void>;
+    readLocal(predecessorSessionId: string): Promise<ReadOnlyContextLogResult>;
+    /** P's post-mortem outbox drain; best effort, must settle (INV-1). */
+    drainPredecessorOutbox(predecessorSessionId: string): Promise<void>;
+    fetchHosted(predecessorSessionId: string): Promise<ContextItemRowWire[]>;
+    deviceLabel(deviceId: string | null): Promise<string>;
+    /** Arrow-key choice, Cancel by default; true = continue without them (or it). */
+    choose(prompt: string, continueLabel?: ContinueLabel): Promise<boolean>;
+    create: ResumeCreateDeps;
+}
+export type ResumeChosenResult = {
+    kind: 'resumed';
+    created: Extract<ResumeCreateResult, {
+        kind: 'admitted';
+    }>;
+    predecessor: UnlockedResumeRow;
+    plan: CarryOverPlan;
+    warnings: string[];
+    lock: ResumeLockHandle;
+}
+/** `/resume` parent: S prepared and its ledger sealed; P's lock is kept for the hand-off. */
+ | {
+    kind: 'prepared';
+    created: Extract<ResumeCreateResult, {
+        kind: 'prepared';
+    }>;
+    predecessor: UnlockedResumeRow;
+    plan: CarryOverPlan;
+    warnings: string[];
+    lock: ResumeLockHandle;
+} | {
+    kind: 'refused';
+    text: string | null;
+    create?: ResumeCreateResult;
+} | {
+    kind: 'cancelled';
+};
+export declare const isComplete: (kind: CompletenessKind) => kind is "complete" | "continues-past-tail";
+export type LoadedChain = {
+    ok: true;
+    items: ContextItem[];
+    kind: CompletenessKind;
+    ctx: CopyContext;
+} | {
+    ok: false;
+    text: string;
+};
+/**
+ * §8.1 and §8.4 for one session: choose its source, read the verified chain
+ * and classify it against the session's own `contextTail`. Only the session
+ * being resumed (whose resume lock this process holds) may act as its
+ * post-mortem writer; a §8.4 rebuild reads its source read-only.
+ */
+export declare function loadChain(args: {
+    sessionId: string;
+    details: ResumeDetails;
+    sessionKey: string;
+    writer: boolean;
+    deps: ResumeChosenDeps;
+}): Promise<LoadedChain>;
+export declare function resumeChosenSession(args: {
+    predecessorSessionId: string;
+    /** True when §6.2 step 3 retires (or retired) this row in this launch. */
+    retiring: boolean;
+    /** The `/resume` parent: prepare S and seal its ledger, but leave the create to the child. */
+    prepareOnly?: boolean;
+    deps: ResumeChosenDeps;
+}): Promise<ResumeChosenResult>;