@quantiya/codevibe-core 2.0.79 → 2.0.81

package/dist/appsync/appsync-client.d.ts

@@ -1041,7 +1041,9 @@ export declare class AppSyncClient {
     /**
      * Update a session
      */
-    updateSession(input: UpdateSessionInput): Promise<Session>;
+    updateSession(input: UpdateSessionInput, options?: {
+        expectedUserId?: string;
+    }): Promise<Session>;
     private doUpdateSession;
     /**
      * Get a session
@@ -2012,6 +2014,10 @@ export declare class AppSyncClient {
     private handleApplyUserDecisionWatcherError;
     private cleanupApplyUserDecisionWatcherState;
     private heartbeatTimers;
+    private heartbeatReadiness;
+    /** Local producer health, not a quota/transport flag. Reconnect must not
+     * advertise readiness while the owning transcript reader is degraded. */
+    setHeartbeatReadiness(sessionId: string, ready: () => boolean): () => void;
     /** Identity tokens invalidate in-flight pulses when a session is stopped. */
     private heartbeatTokens;
     /** Shared initial confirmation makes duplicate start calls idempotent. */

package/dist/appsync/index.d.ts

@@ -25,6 +25,8 @@ export { MAX_SYNC_SOURCE_ANCHOR_BYTES } from './sync-source-cursor';
 export type { DesktopSyncSourceStream, DesktopSyncSourceFrame, DesktopSyncSourceCursor, DesktopSyncSourceJournal, DesktopSyncSourceInventory, DesktopSyncSourceAnchor, DesktopSyncSourcePosition, DesktopSyncSourceGap } from './sync-source-cursor';
 export type { DesktopSyncSourcePair } from './sync-source-pair';
 export { readDesktopSyncFile } from './sync-source-file';
+export { DEFAULT_SYNC_SOURCE_RECOVERY_POLICY, planSyncSourceRecovery, resolveSyncSourceRecoveryPolicy } from './sync-source-recovery';
+export type { SyncSourceRecoveryPolicy, SyncSourceMessageObservation } from './sync-source-recovery';
 export type { DesktopSyncFileIdentity, DesktopSyncFileFrame, DesktopSyncFileAdmission } from './sync-source-file';
 export { DesktopSyncReadClient, SyncReadClientError } from './sync-read-client';
 export type { DesktopSyncRegistrationAttempt, DesktopSyncReadCredential, SyncReadEvent, SyncHistoryPage } from './sync-read-client';

package/dist/appsync/sync-mobile-echo.d.ts

@@ -274,6 +274,15 @@ export interface DesktopMobileEchoJournal {
     }): Promise<void>;
     /** Uses native record time, not replay time; reserves one exact byte occurrence. */
     claim(frame: DesktopMobileEchoFrame, content: string, nativeTimestamp: string): Promise<boolean>;
+    /** Read-only, under the existing row lock: freeze exact eligible IDs and
+     * one-to-one native proofs. Caller must persist the plan before settlement. */
+    planOmitted(records: Iterable<{
+        sourceSha256: string;
+        content: string;
+        timestamp: string;
+    }>): Promise<string>;
+    /** Idempotent exact removals; never rematch history or consult wall clocks. */
+    settleOmitted(plan: string): Promise<number>;
     /** Call only after the real native cursor is durably at/past this position. */
     reconcile(streamSha256: string, committedByteOffset: number): Promise<number>;
 }

package/dist/appsync/sync-source-cursor.d.ts

@@ -17,9 +17,19 @@ export interface DesktopSyncSourcePosition {
     byteOffset: number;
     anchor: DesktopSyncSourceAnchor | null;
     discardUntilNewline: boolean;
+    /** Durable rebase marker, projected by the paired owner; never a new input. */
+    recovered?: {
+        previousOffset: number;
+        boundaryOffset: number;
+        skippedHistory: boolean;
+        recordedAt: number;
+        /** Opaque bounded cleanup intent in the existing encrypted projection. */
+        projection?: string | null;
+    };
     /** Recovery hint only, never persisted: finish this linked PREPARING frame
      * before the reader may discard a later backlog range. */
     pendingFrameEndOffset?: number;
+    pendingFrame?: Pick<DesktopSyncSourceFrame, 'startOffset' | 'endOffset' | 'sourceSha256'>;
 }
 export interface DesktopSyncSourceGap {
     startOffset: number;
@@ -28,6 +38,8 @@ export interface DesktopSyncSourceGap {
     reason: 'BACKLOG_LIMIT' | 'OVERSIZED_RECORD' | 'PARTIAL_RECORD' | 'MALFORMED_RECORD' | 'EMPTY_RECORD';
     discardUntilNewline: boolean;
 }
+/** Shared preflight: reject malformed caller coordinates before inspecting WAL progress. */
+export declare function validSourceRebase(previous: DesktopSyncSourcePosition, target: DesktopSyncSourceAnchor, skipped: boolean): boolean;
 declare const schema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     kind: z.ZodLiteral<"SOURCE_CURSOR">;
@@ -507,6 +519,8 @@ export interface DesktopSyncSourceJournal {
     admit(frame: DesktopSyncSourceFrame, prepare: ((operationId: string) => Promise<CreateDesktopSyncEventInput>) | null, projectionAfter?: string | null): Promise<string | null>;
     /** Persist an intentional reader safety gap, never a network/quota fallback. */
     skip(gap: DesktopSyncSourceGap): Promise<void>;
+    /** A verified native rewrite, only after all already admitted operations settle. */
+    rebase(previous: DesktopSyncSourcePosition, target: DesktopSyncSourceAnchor, skippedHistory: boolean, recordedAt: number, recoveryProjection?: string | null): Promise<void>;
     /** Repairs interrupted preparation/settlement without source bytes or new encryption. */
     recover(): Promise<void>;
     /** Bounded cloud drain, separate from native source admission. */

package/dist/appsync/sync-source-file.d.ts

@@ -1,4 +1,5 @@
 import { type DesktopSyncSourceAnchor, type DesktopSyncSourcePosition, type DesktopSyncSourceGap } from './sync-source-cursor';
+import { type SyncSourceMessageObservation, type SyncSourceRecoveryPolicy } from './sync-source-recovery';
 export interface DesktopSyncFileIdentity {
     filePath: string;
     fileIdentity: Readonly<{
@@ -16,6 +17,15 @@ export interface DesktopSyncFileAdmission<T> {
     restore(source: Readonly<DesktopSyncFileIdentity>, initial: DesktopSyncSourcePosition): Promise<DesktopSyncSourcePosition | null>;
     admit(event: T, source: Readonly<DesktopSyncFileFrame>): Promise<void>;
     skip(gap: DesktopSyncSourceGap, source: Readonly<DesktopSyncFileIdentity>): Promise<void>;
+    rebase?(previous: DesktopSyncSourcePosition, target: DesktopSyncSourceAnchor, skippedHistory: boolean, recoveryProjection?: string | null): Promise<DesktopSyncSourcePosition>;
+    recovered?(recovery: NonNullable<DesktopSyncSourcePosition['recovered']>): Promise<void>;
+    beforeRead?(position: Readonly<DesktopSyncSourcePosition>, source: Readonly<DesktopSyncFileIdentity>, size: number): Promise<void>;
+    /** Freeze an exact-ID cleanup plan BEFORE committing the rebase. Only newly
+     * omitted records are supplied; this callback never dispatches history. */
+    prepareRecovery?(records: Iterable<{
+        event: T;
+        frame: DesktopSyncFileFrame;
+    }>): Promise<string>;
 }
 /** Bounded descriptor-based reader. Admission/fsync, not cloud delivery, advances it. */
 export declare function readDesktopSyncFile<T>(options: {
@@ -26,8 +36,13 @@ export declare function readDesktopSyncFile<T>(options: {
     isCurrent(): boolean;
     maxBacklogBytes?: number;
     maxRecordBytes?: number;
+    recovery?: {
+        inspect(line: string): SyncSourceMessageObservation | null;
+        policy?: SyncSourceRecoveryPolicy;
+    };
 }): Promise<{
     position: DesktopSyncSourcePosition;
     size: number;
     mtimeMs: number;
+    recovered?: DesktopSyncSourcePosition['recovered'];
 } | null>;

package/dist/appsync/sync-source-pair.d.ts

@@ -1,5 +1,5 @@
 import type { CreateDesktopSyncEventInput } from './sync-event-client';
-import type { DesktopSyncSourceFrame, DesktopSyncSourceGap, DesktopSyncSourceJournal, DesktopSyncSourcePosition, DesktopSyncSourceStream } from './sync-source-cursor';
+import type { DesktopSyncSourceFrame, DesktopSyncSourceGap, DesktopSyncSourceJournal, DesktopSyncSourcePosition, DesktopSyncSourceStream, DesktopSyncSourceAnchor } from './sync-source-cursor';
 type Prepare = ((operationId: string) => Promise<CreateDesktopSyncEventInput>) | null;
 export interface DesktopSyncSourcePair {
     /** Restore the earliest unfinished lane, never the latest volatile reader offset. */
@@ -7,6 +7,7 @@ export interface DesktopSyncSourcePair {
     /** Both slots are fixed for this source's lifetime; null explicitly ignores a slot. */
     admit(frame: DesktopSyncSourceFrame, prepare: readonly [Prepare, Prepare]): Promise<readonly [string | null, string | null]>;
     skip(gap: DesktopSyncSourceGap): Promise<void>;
+    rebase(previous: DesktopSyncSourcePosition, target: DesktopSyncSourceAnchor, skippedHistory: boolean, recoveryProjection?: string | null): Promise<DesktopSyncSourcePosition>;
     recover(): Promise<void>;
     /** The bound is per lane; two lanes cannot starve each other. */
     drain(maximumPerLane?: number, signal?: AbortSignal): Promise<number>;

package/dist/appsync/sync-source-recovery.d.ts

@@ -0,0 +1,35 @@
+import { type DesktopSyncSourceAnchor, type DesktopSyncSourcePosition } from './sync-source-cursor';
+/** Owner-approved recovery defaults. These are local catch-up bounds, not quotas. */
+export interface SyncSourceRecoveryPolicy {
+    staleAfterMs: number;
+    maximumRecentMessages: number;
+    anchorSearchBytes: number;
+    maximumScanBytes: number;
+}
+export declare const DEFAULT_SYNC_SOURCE_RECOVERY_POLICY: Readonly<SyncSourceRecoveryPolicy>;
+export interface SyncSourceMessageObservation {
+    timestampMs: number;
+    isMessage: boolean;
+}
+export interface SyncSourceRecoveryPlan {
+    anchor: DesktopSyncSourceAnchor;
+    skippedHistory: boolean;
+    /** Current-file end of the uniquely relocated old checkpoint. Never scan
+     * already-acknowledged history as new omitted-echo evidence. */
+    resumeOffset: number;
+}
+export declare function resolveSyncSourceRecoveryPolicy(): SyncSourceRecoveryPolicy;
+/** Metadata-only traversal, bounded by the caller; never advances a cursor. */
+export declare function scanSyncSourceFrames(fd: number, start: number, end: number): Generator<{
+    start: number;
+    end: number;
+    bytes: Buffer;
+}>;
+/** Same-descriptor, bounded scan. It never dispatches or returns message content. */
+export declare function planSyncSourceRecovery(options: {
+    fd: number;
+    size: number;
+    previous: DesktopSyncSourcePosition;
+    inspect(line: string): SyncSourceMessageObservation | null;
+    policy?: SyncSourceRecoveryPolicy;
+}): SyncSourceRecoveryPlan;

package/dist/credential-broker/index.d.ts

@@ -9,7 +9,7 @@ export { KeychainVendorKeyStore } from "./vendor-key-store";
 export { BrokerTokenMinter, type RotationHandle } from "./broker-token";
 export { CHATGPT_UPSTREAM_CONFIG, chatGptUpstreamUrl, CHATGPT_TOKEN_ENDPOINT, CHATGPT_OAUTH_CLIENT_ID, CHATGPT_REFRESH_CONTENT_TYPE, } from "./chatgpt-config";
 export { FetchRefreshTransport, refreshOAuthToken, buildRefreshBody, type RefreshTransport, type RefreshOutcome, } from "./oauth-refresh";
-export { OAuthAccountLock, createOAuthAccountLock, defaultOAuthLockDir, type OAuthAccountLockOptions, type LockHandle, type LockOwner, } from "./oauth-account-lock";
+export { OAuthAccountLock, LocalLockBusyError, type LocalLockRole, createOAuthAccountLock, defaultOAuthLockDir, type OAuthAccountLockOptions, type LockHandle, type LockOwner, } from "./oauth-account-lock";
 export { buildCanonicalRequest, selfCredentialGuard, requestSha256, CanonicalRejectError, } from "./canonical";
 export type { CanonicalInput, CanonicalRequest } from "./canonical";
 export { scrubRequestBody } from "./scrubber";

package/dist/credential-broker/oauth-account-lock.d.ts

@@ -1,5 +1,26 @@
 /** Liveness of a recorded lock owner (only `dead` is ever reclaimed). */
 export type OwnerLiveness = "alive" | "dead" | "unknown";
+export type LocalLockRole = "oauth-account" | "sync-journal" | "sync-journal-store" | "tool-sync-recovery";
+/** Contention, not proof of corrupt persisted work. Never authorizes reclaim. */
+export declare class LocalLockBusyError extends Error {
+    readonly diagnostic: {
+        role: LocalLockRole;
+        lockId: string;
+        holderPid: number | null;
+        holderState: OwnerLiveness | "absent" | "unreadable";
+        heldMs: number | null;
+        waitMs: number;
+    };
+    readonly code = "LOCAL_LOCK_BUSY";
+    constructor(diagnostic: {
+        role: LocalLockRole;
+        lockId: string;
+        holderPid: number | null;
+        holderState: OwnerLiveness | "absent" | "unreadable";
+        heldMs: number | null;
+        waitMs: number;
+    });
+}
 /** The `owner.json` record written once per acquisition. */
 export interface LockOwner {
     pid: number;
@@ -12,6 +33,7 @@ export interface LockOwner {
 export interface OAuthAccountLockOptions {
     /** The canonical lockdir path (keyed to the OAuth account). */
     lockDir: string;
+    role?: LocalLockRole;
     /** GC callers must retain their recovery index unless unlink/rmdir succeeds.
      * Default callers keep the existing best-effort release behavior. */
     requireRemovalOnRelease?: boolean;
@@ -66,6 +88,7 @@ export interface LockHandle {
 /** The portable cross-process OAuth-account lock (§5 / AMEND-1). */
 export declare class OAuthAccountLock {
     private readonly lockDir;
+    private readonly role;
     private readonly requireRemovalOnRelease;
     private readonly ownerFile;
     private readonly reclaimGuardDir;
@@ -90,6 +113,7 @@ export declare class OAuthAccountLock {
      * ZERO side effects on the persisted bundle on any fail-closed path.
      */
     acquire(): Promise<LockHandle>;
+    private contentionError;
     /** Whether the EXISTING lockdir holder is reclaimable (dead), an ownerless strand
      *  (F6), or must be waited on. */
     private classifyExistingHolder;

package/dist/index.d.ts

@@ -29,6 +29,8 @@ export type { DurableSyncResult, DurableDesktopSyncWriterOptions, DesktopSyncSes
 export { MAX_SYNC_SOURCE_ANCHOR_BYTES } from './appsync';
 export type { DesktopSyncSourcePair } from './appsync';
 export { readDesktopSyncFile } from './appsync';
+export { DEFAULT_SYNC_SOURCE_RECOVERY_POLICY, planSyncSourceRecovery, resolveSyncSourceRecoveryPolicy } from './appsync';
+export type { SyncSourceRecoveryPolicy, SyncSourceMessageObservation } from './appsync';
 export type { DesktopSyncFileIdentity, DesktopSyncFileFrame, DesktopSyncFileAdmission } from './appsync';
 export type { DesktopSyncSourceStream, DesktopSyncSourceFrame, DesktopSyncSourceCursor, DesktopSyncSourceJournal, DesktopSyncSourceInventory, DesktopSyncSourceAnchor, DesktopSyncSourcePosition, DesktopSyncSourceGap } from './appsync';
 export { createToolActivitySyncTransport } from './tool-activity/sync-transport';
@@ -57,6 +59,7 @@ export * as AuditKeys from './audit-keys';
 export * as Substrate from './substrate';
 export { buildSeatbeltProfile, SandboxExecSubstrate } from './substrate';
 export * as CredentialBroker from './credential-broker';
+export { LocalLockBusyError } from './credential-broker/oauth-account-lock';
 export * as SubstrateLaunch from './substrate-launch';
 export * from './types';
 export * as Planner from './planner';
@@ -75,7 +78,7 @@ export { emitShellEvent, createShellEventEmitter } from './orchestration-shell';
 export { processMarkers, withRoleMarker } from './orchestration-shell';
 export { ToolActivityOutbox, type ToolActivityOutboxOptions, type ListPendingResult, } from './tool-activity';
 export { ToolActivityLedger, LedgerEntrySchema, LedgerFileSchema, LegacyOwnedFileSchema, type LedgerEntry, type LedgerFile, type LegacyOwnedFile, type OccurrenceRef, type ToolActivityLedgerOptions, } from './tool-activity';
-export { ToolReplayCursor, captureToolReplayBoundary, ReplayFrameTooLargeError, ReplayCursorStateSchema, DEFAULT_REPLAY_READ_BYTES, DEFAULT_REPLAY_MAX_FRAME_BYTES, type ReplayCursorState, type ReplayFrame, type ReadFramesResult, type ToolReplayCursorOptions, type ToolReplayInitialBoundary, } from './tool-activity';
+export { ToolReplayCursor, captureToolReplayBoundary, ReplayFrameTooLargeError, ReplayCursorStateSchema, DEFAULT_REPLAY_READ_BYTES, DEFAULT_REPLAY_MAX_FRAME_BYTES, type ReplayCursorState, type ReplayFrame, type ReadFramesResult, type ToolReplayCursorOptions, type ToolReplayInitialBoundary, type ToolReplayVerifiedBoundary, } from './tool-activity';
 export { ToolActivitySessionMap, InProcessRolloutLock, SessionMapRecordSchema, type RolloutLock, type RolloutOwnership, type SessionMapRecord, type ToolActivitySessionMapOptions, } from './tool-activity';
 export { ToolActivityConsolidator, isSessionKeyStaleError, isTerminalSessionError, type ObservedOccurrence, type ObserveDisposition, type ToolActivityTransport, type ToolActivityConsolidatorOptions, } from './tool-activity';
 export { SocketRolloutLock, type SocketRolloutLockOptions, FlockRolloutLock, type FlockRolloutLockOptions, type FlockSyncFn, type FlockFlag, createRolloutLock, type CreateRolloutLockOptions, } from './tool-activity';