@reticlehq/server 3.5.0 → 3.7.0

package/dist/memory/cloud/memory-scope.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Which project a shared-memory read is about, on the wire and in the response.
+ *
+ * `GET /v1/memory` used to be asked with the API key and `?subject`, and nothing else. The key covers
+ * a whole workspace, and a workspace can hold more than one repo: a `cloud.json` naming project B was
+ * read with a key that also reaches project A, so B's agent could be handed A's "established
+ * knowledge" and never know it. Two repos, one key, and the wrong one's facts arrive looking exactly
+ * like the right one's.
+ *
+ * The link file has always known the answer — `resolveProjectCloud` returns it as `projectId`, and
+ * every reader simply did not pass it on.
+ *
+ * ## Why the envelope, and not the entries
+ *
+ * Sending `projectId` is the fix, and it only works once the platform filters on it. Against a server
+ * that does not know the parameter yet, the client would go on being handed the whole workspace and
+ * would report it as this project's knowledge — the same lie, now with a parameter in the URL that
+ * makes it look handled. So the response is checked here too, and WHERE it is checked is the lesson:
+ * the platform puts the project id on the response ENVELOPE — `{ projectId, entries }` — and not on
+ * each entry. An entry-level filter therefore matched nothing, kept everything, and read as a fix
+ * while being none. `scopeOfMemoryResponse` reads the envelope and refuses the whole response when
+ * it names another project, or names none.
+ *
+ * The entry-level filter stays as a second pass. It is redundant against the platform's real shape,
+ * and it is the right answer against a server that labels entries instead — cheap to keep, and
+ * nothing here rests on it.
+ *
+ * ## Every reader, and that word is load-bearing
+ *
+ * Three callers read this endpoint: the `reticle_memory` tool, flow replay's automatic consultation,
+ * and `reticle memory` at a terminal. The first cut gave the first two an entry-level filter and the
+ * third the parameter alone, while a comment claimed all three were covered — and none of the three
+ * was, because the project id arrives on the envelope. They now share `scopedMemoryEntries`, so a
+ * fourth reader cannot get a different answer than the other three.
+ *
+ * Lives beside `cloud-sync.ts` rather than in `recall/` because that is where the other platform path
+ * constants live, and because both readers already reach this directory: a home under `recall/` would
+ * make `flows` reach a directory it never needed.
+ */
+/**
+ * The wire names, spelled once.
+ *
+ * `PROJECT_ID` is a request parameter AND a response field. They are the same word on purpose — the
+ * server echoes back what it was asked about — and one constant keeps a rename from moving only one
+ * of the two, which would silently restore the unfiltered read. `SUBJECT` is a request parameter only
+ * and is named for the same reason: it is a spelling the platform owns, not ours.
+ */
+export declare const MemoryScopeField: {
+    readonly PROJECT_ID: "projectId";
+    readonly SUBJECT: "subject";
+};
+/**
+ * What a read is asked about: the linked project, and optionally one subject within it.
+ *
+ * `projectId` takes `null` as well as `undefined`, because that is the shape `resolveProjectCloud`
+ * already answers with — "the link declared none" is one fact, and making every caller spell the
+ * conversion is how a reader starts wondering whether the two spellings mean different things.
+ */
+export interface MemoryReadScope {
+    /** The cloud project the link file names. Absent, `null` and empty all mean "no project to name". */
+    projectId: string | null | undefined;
+    subject?: string | undefined;
+}
+/**
+ * Who a memory read is for. An agent's read names the agent and the platform counts it as a
+ * consultation; the daemon's sync names its purpose and is never counted as one.
+ */
+export declare const MemoryReadHeader: {
+    readonly AGENT: "x-reticle-agent";
+    readonly PURPOSE: "x-reticle-read-purpose";
+};
+export declare const MemoryReadPurpose: {
+    readonly SYNC: "sync";
+};
+/**
+ * The headers of an agent's memory read: the key, and the agent whose call made the read. A replay's
+ * read went without the agent, and the platform credited it to "an agent that did not name itself".
+ * No agent is named when no single agent made the call: a guess would credit the wrong one.
+ */
+export declare function memoryReadHeaders(apiKey: string): Record<string, string>;
+/**
+ * The URL for one memory read.
+ *
+ * Encoded with `encodeURIComponent` rather than `URLSearchParams`, which spells a space `+`. Both are
+ * valid in a query string and the server may accept either — but this is a URL a test asserts against
+ * and a person reads in a log, and one spelling is easier to reason about than two.
+ */
+export declare function memoryReadUrl(baseUrl: string, scope: MemoryReadScope): string;
+/**
+ * Drop the entries that state they belong to another project.
+ *
+ * The field is read defensively because the wire is somebody else's server: a number, an object or an
+ * absent key all mean "this entry does not say", and only a non-empty string that disagrees is enough
+ * to refuse one. See the note above for why silence is kept rather than dropped.
+ */
+export declare function keepOwnProject(entries: readonly unknown[], projectId: string | null | undefined): unknown[];
+/**
+ * Whether a memory response can be read as THIS project's knowledge.
+ *
+ * The platform puts the project id on the response ENVELOPE, not on each entry (see the module note).
+ * Reading it there is the only check that works against the real shape: an entry-level filter sees no
+ * project field at all and keeps everything, so a server that ignores the request parameter — or
+ * resolves the key to a different project — hands back a whole workspace under this project's
+ * heading with nothing to distinguish it.
+ */
+export declare const MemoryResponseScope: {
+    /** The envelope names the project this read asked about. Its entries may be read. */
+    readonly OWN: "own";
+    /** The envelope names a DIFFERENT project. Nothing in it belongs to this one. */
+    readonly OTHER: "other";
+    /**
+     * The envelope does not say which project it is about — an older server, or a shape we do not
+     * know. Unverifiable, which is NOT the same as empty and must not be shown as though it were.
+     */
+    readonly UNSCOPED: "unscoped";
+    /**
+     * This read named no project to begin with, so there is nothing for the envelope to contradict.
+     * The env-credential path with no `cloud.json`: CI, and a single-project setup that never linked.
+     */
+    readonly NOT_ASKED: "not-asked";
+};
+export type MemoryResponseScope = (typeof MemoryResponseScope)[keyof typeof MemoryResponseScope];
+/** The two verdicts that permit reading the entries. Named so no caller re-derives the pair. */
+export declare const isReadableMemoryScope: (scope: MemoryResponseScope) => boolean;
+/**
+ * What the envelope says about which project this response is about.
+ *
+ * A missing or non-string field is `UNSCOPED` rather than a mismatch: the wire is somebody else's
+ * server, and "this response never said" is a different fact from "this response named a rival".
+ * Both refuse; only the message a reader shows differs.
+ */
+export declare function scopeOfMemoryResponse(body: unknown, projectId: string | null | undefined): MemoryResponseScope;
+/**
+ * The entries a reader may treat as this project's, or `undefined` when the response cannot be read
+ * that way at all.
+ *
+ * `undefined` is the point of the return type. Three callers need three different sentences and none
+ * of them is a list: the tool reports `UNVERIFIED`, the CLI refuses out loud, and replay attaches
+ * nothing. "This project knows nothing" and "the server answered about something else" are different
+ * facts, and only the first is safe to act on.
+ */
+export declare function scopedMemoryEntries(body: unknown, projectId: string | null | undefined): unknown[] | undefined;
+/**
+ * The same filter, for a caller that prints the server's envelope rather than reading a list.
+ *
+ * `reticle memory` writes the response to stdout as JSON, so filtering has to preserve every other
+ * field the server sent and replace only `entries`. A body whose `entries` is not an array is handed
+ * back as it arrived: at that point the envelope has already been accepted, and guessing further is
+ * how a diagnostic command starts dropping the thing it was asked to print.
+ *
+ * It REFUSES on its own, answering `undefined` for a body it cannot show to be this project's. It
+ * used to hand the body back and leave the check to a JSDoc line telling callers to run
+ * `scopeOfMemoryResponse` first — which is the exact failure this module documents, written one
+ * function below the lesson. A reader that hands a body back cannot refuse it: the day somebody
+ * calls this first, a sibling project's knowledge goes to stdout with nothing to stop it. The
+ * `undefined` is what makes the unsafe call unexpressible rather than merely discouraged — a caller
+ * cannot print what it was not handed.
+ *
+ * The caller therefore checks for `undefined` and refuses out loud, instead of asking twice.
+ */
+export declare function scopeMemoryResponse(body: unknown, projectId: string | null | undefined): unknown;

package/dist/memory/cloud/memory-scope.js

@@ -0,0 +1,227 @@
+/**
+ * Which project a shared-memory read is about, on the wire and in the response.
+ *
+ * `GET /v1/memory` used to be asked with the API key and `?subject`, and nothing else. The key covers
+ * a whole workspace, and a workspace can hold more than one repo: a `cloud.json` naming project B was
+ * read with a key that also reaches project A, so B's agent could be handed A's "established
+ * knowledge" and never know it. Two repos, one key, and the wrong one's facts arrive looking exactly
+ * like the right one's.
+ *
+ * The link file has always known the answer — `resolveProjectCloud` returns it as `projectId`, and
+ * every reader simply did not pass it on.
+ *
+ * ## Why the envelope, and not the entries
+ *
+ * Sending `projectId` is the fix, and it only works once the platform filters on it. Against a server
+ * that does not know the parameter yet, the client would go on being handed the whole workspace and
+ * would report it as this project's knowledge — the same lie, now with a parameter in the URL that
+ * makes it look handled. So the response is checked here too, and WHERE it is checked is the lesson:
+ * the platform puts the project id on the response ENVELOPE — `{ projectId, entries }` — and not on
+ * each entry. An entry-level filter therefore matched nothing, kept everything, and read as a fix
+ * while being none. `scopeOfMemoryResponse` reads the envelope and refuses the whole response when
+ * it names another project, or names none.
+ *
+ * The entry-level filter stays as a second pass. It is redundant against the platform's real shape,
+ * and it is the right answer against a server that labels entries instead — cheap to keep, and
+ * nothing here rests on it.
+ *
+ * ## Every reader, and that word is load-bearing
+ *
+ * Three callers read this endpoint: the `reticle_memory` tool, flow replay's automatic consultation,
+ * and `reticle memory` at a terminal. The first cut gave the first two an entry-level filter and the
+ * third the parameter alone, while a comment claimed all three were covered — and none of the three
+ * was, because the project id arrives on the envelope. They now share `scopedMemoryEntries`, so a
+ * fourth reader cannot get a different answer than the other three.
+ *
+ * Lives beside `cloud-sync.ts` rather than in `recall/` because that is where the other platform path
+ * constants live, and because both readers already reach this directory: a home under `recall/` would
+ * make `flows` reach a directory it never needed.
+ */
+import { callingClientName } from '../../hooks/coding-agents.js';
+/**
+ * The path this module builds, spelled once, for the same reason as the names below.
+ *
+ * Here rather than in `cloud-sync.ts`'s group of `CLOUD_*_PATH` constants: that group describes the
+ * calls THAT file makes, and cloud-sync has no memory reader at all. Adding this one there would make
+ * the group a registry of every endpoint in the package rather than a description of one file's calls.
+ */
+const CLOUD_MEMORY_PATH = '/v1/memory';
+/**
+ * The wire names, spelled once.
+ *
+ * `PROJECT_ID` is a request parameter AND a response field. They are the same word on purpose — the
+ * server echoes back what it was asked about — and one constant keeps a rename from moving only one
+ * of the two, which would silently restore the unfiltered read. `SUBJECT` is a request parameter only
+ * and is named for the same reason: it is a spelling the platform owns, not ours.
+ */
+export const MemoryScopeField = {
+    PROJECT_ID: 'projectId',
+    SUBJECT: 'subject',
+};
+/**
+ * The project id to name, or `undefined` when there is none.
+ *
+ * `null`, `undefined` and `''` all say the same thing and all arrive in practice: `resolveProjectCloud`
+ * answers `null` when the link declares nothing, an absent argument is `undefined`, and a truncated
+ * config gives `''`. One helper, so the URL builder and the response filter cannot disagree about
+ * which of them counts as unscoped — a disagreement that would send `?projectId=` and come back
+ * empty, which reads as "this project knows nothing" rather than as a bug.
+ *
+ * Returns the id rather than a boolean so callers get the narrowing with it. A `boolean` predicate
+ * would leave `string | null | undefined` as-is and force a `String(...)` at the call site, which is
+ * a cast dressed up as a conversion.
+ */
+const projectToName = (projectId) => 'string' === typeof projectId && projectId.length > 0 ? projectId : undefined;
+/**
+ * Who a memory read is for. An agent's read names the agent and the platform counts it as a
+ * consultation; the daemon's sync names its purpose and is never counted as one.
+ */
+export const MemoryReadHeader = {
+    AGENT: 'x-reticle-agent',
+    PURPOSE: 'x-reticle-read-purpose',
+};
+export const MemoryReadPurpose = { SYNC: 'sync' };
+/**
+ * The headers of an agent's memory read: the key, and the agent whose call made the read. A replay's
+ * read went without the agent, and the platform credited it to "an agent that did not name itself".
+ * No agent is named when no single agent made the call: a guess would credit the wrong one.
+ */
+export function memoryReadHeaders(apiKey) {
+    const agent = callingClientName();
+    return {
+        authorization: `Bearer ${apiKey}`,
+        ...(agent === undefined ? {} : { [MemoryReadHeader.AGENT]: agent }),
+    };
+}
+/**
+ * The URL for one memory read.
+ *
+ * Encoded with `encodeURIComponent` rather than `URLSearchParams`, which spells a space `+`. Both are
+ * valid in a query string and the server may accept either — but this is a URL a test asserts against
+ * and a person reads in a log, and one spelling is easier to reason about than two.
+ */
+export function memoryReadUrl(baseUrl, scope) {
+    const parts = [];
+    if (scope.subject !== undefined) {
+        parts.push(`${MemoryScopeField.SUBJECT}=${encodeURIComponent(scope.subject)}`);
+    }
+    const projectId = projectToName(scope.projectId);
+    if (projectId !== undefined) {
+        parts.push(`${MemoryScopeField.PROJECT_ID}=${encodeURIComponent(projectId)}`);
+    }
+    const url = `${baseUrl}${CLOUD_MEMORY_PATH}`;
+    return 0 === parts.length ? url : `${url}?${parts.join('&')}`;
+}
+/**
+ * Drop the entries that state they belong to another project.
+ *
+ * The field is read defensively because the wire is somebody else's server: a number, an object or an
+ * absent key all mean "this entry does not say", and only a non-empty string that disagrees is enough
+ * to refuse one. See the note above for why silence is kept rather than dropped.
+ */
+export function keepOwnProject(entries, projectId) {
+    const mine = projectToName(projectId);
+    if (mine === undefined)
+        return [...entries];
+    return entries.filter((entry) => {
+        if (null === entry || 'object' !== typeof entry)
+            return true;
+        const stated = entry[MemoryScopeField.PROJECT_ID];
+        if ('string' !== typeof stated || 0 === stated.length)
+            return true;
+        return stated === mine;
+    });
+}
+/**
+ * Whether a memory response can be read as THIS project's knowledge.
+ *
+ * The platform puts the project id on the response ENVELOPE, not on each entry (see the module note).
+ * Reading it there is the only check that works against the real shape: an entry-level filter sees no
+ * project field at all and keeps everything, so a server that ignores the request parameter — or
+ * resolves the key to a different project — hands back a whole workspace under this project's
+ * heading with nothing to distinguish it.
+ */
+export const MemoryResponseScope = {
+    /** The envelope names the project this read asked about. Its entries may be read. */
+    OWN: 'own',
+    /** The envelope names a DIFFERENT project. Nothing in it belongs to this one. */
+    OTHER: 'other',
+    /**
+     * The envelope does not say which project it is about — an older server, or a shape we do not
+     * know. Unverifiable, which is NOT the same as empty and must not be shown as though it were.
+     */
+    UNSCOPED: 'unscoped',
+    /**
+     * This read named no project to begin with, so there is nothing for the envelope to contradict.
+     * The env-credential path with no `cloud.json`: CI, and a single-project setup that never linked.
+     */
+    NOT_ASKED: 'not-asked',
+};
+/** The two verdicts that permit reading the entries. Named so no caller re-derives the pair. */
+export const isReadableMemoryScope = (scope) => MemoryResponseScope.OWN === scope || MemoryResponseScope.NOT_ASKED === scope;
+/**
+ * What the envelope says about which project this response is about.
+ *
+ * A missing or non-string field is `UNSCOPED` rather than a mismatch: the wire is somebody else's
+ * server, and "this response never said" is a different fact from "this response named a rival".
+ * Both refuse; only the message a reader shows differs.
+ */
+export function scopeOfMemoryResponse(body, projectId) {
+    const mine = projectToName(projectId);
+    if (mine === undefined)
+        return MemoryResponseScope.NOT_ASKED;
+    if (null === body || 'object' !== typeof body)
+        return MemoryResponseScope.UNSCOPED;
+    const stated = body[MemoryScopeField.PROJECT_ID];
+    if ('string' !== typeof stated || 0 === stated.length)
+        return MemoryResponseScope.UNSCOPED;
+    return stated === mine ? MemoryResponseScope.OWN : MemoryResponseScope.OTHER;
+}
+/**
+ * The entries a reader may treat as this project's, or `undefined` when the response cannot be read
+ * that way at all.
+ *
+ * `undefined` is the point of the return type. Three callers need three different sentences and none
+ * of them is a list: the tool reports `UNVERIFIED`, the CLI refuses out loud, and replay attaches
+ * nothing. "This project knows nothing" and "the server answered about something else" are different
+ * facts, and only the first is safe to act on.
+ */
+export function scopedMemoryEntries(body, projectId) {
+    if (!isReadableMemoryScope(scopeOfMemoryResponse(body, projectId)))
+        return undefined;
+    if (null === body || 'object' !== typeof body)
+        return undefined;
+    const entries = body['entries'];
+    if (!Array.isArray(entries))
+        return undefined;
+    return keepOwnProject(entries, projectId);
+}
+/**
+ * The same filter, for a caller that prints the server's envelope rather than reading a list.
+ *
+ * `reticle memory` writes the response to stdout as JSON, so filtering has to preserve every other
+ * field the server sent and replace only `entries`. A body whose `entries` is not an array is handed
+ * back as it arrived: at that point the envelope has already been accepted, and guessing further is
+ * how a diagnostic command starts dropping the thing it was asked to print.
+ *
+ * It REFUSES on its own, answering `undefined` for a body it cannot show to be this project's. It
+ * used to hand the body back and leave the check to a JSDoc line telling callers to run
+ * `scopeOfMemoryResponse` first — which is the exact failure this module documents, written one
+ * function below the lesson. A reader that hands a body back cannot refuse it: the day somebody
+ * calls this first, a sibling project's knowledge goes to stdout with nothing to stop it. The
+ * `undefined` is what makes the unsafe call unexpressible rather than merely discouraged — a caller
+ * cannot print what it was not handed.
+ *
+ * The caller therefore checks for `undefined` and refuses out loud, instead of asking twice.
+ */
+export function scopeMemoryResponse(body, projectId) {
+    if (!isReadableMemoryScope(scopeOfMemoryResponse(body, projectId)))
+        return undefined;
+    if (null === body || 'object' !== typeof body)
+        return undefined;
+    const envelope = body;
+    const entries = envelope['entries'];
+    if (!Array.isArray(entries))
+        return body;
+    return { ...envelope, entries: keepOwnProject(entries, projectId) };
+}

package/dist/memory/cloud/sync-cycle.d.ts

@@ -1,10 +1,11 @@
+import { type ScreenshotSyncState } from './sync-screenshots.js';
 /**
  * The derived records that ride along with runs, and the file each one lives in.
  *
- * A list rather than three hand-written blocks so adding a fourth is one line and cannot be
- * half-done — the bundle, the hashing and the reporting all walk this.
+ * One list, so adding a record is one line and cannot be half-done: the bundle, the hashing, the
+ * reporting and the disk source (`sync-disk.ts`) all read it.
  */
-declare const DERIVED_RECORDS: readonly [{
+export declare const DERIVED_RECORDS: readonly [{
     readonly kind: "impact";
     readonly file: "impact.json";
 }, {
@@ -19,6 +20,12 @@ declare const DERIVED_RECORDS: readonly [{
 }, {
     readonly kind: "assertion-tiers";
     readonly file: "assertion-tiers.json";
+}, {
+    readonly kind: "coverage";
+    readonly file: "coverage.json";
+}, {
+    readonly kind: "notes";
+    readonly file: "notes.json";
 }];
 type DerivedKind = (typeof DERIVED_RECORDS)[number]['kind'];
 /** What the machine reads from disk. Injected so a cycle is testable with no filesystem at all. */
@@ -28,18 +35,20 @@ export interface SyncSource {
         runId: string;
         payload: unknown;
     }>;
-    /** Every saved flow. Small, upserted by name, so they ride along whenever anything else does. */
+    /** Every saved flow. Upserted by name, so the set is sent only when it changed. */
     flows: () => readonly unknown[];
     /**
      * Every bug capsule on disk — the minimal failing flow that reproduces a defect, plus its evidence.
      *
-     * Rides along with flows, and for the same reason: small, upserted by id, and worth nothing on the
+     * Sent like flows, only when the set changed: upserted by id, and worth nothing on the
      * machine that found the bug. A verdict count tells a dashboard THAT something broke; the capsule
      * is the only artifact that lets somebody else make it break again.
      */
     capsules: () => readonly unknown[];
     /** One derived record, or undefined when the file is absent. */
     derived: (kind: DerivedKind) => unknown;
+    /** One step screenshot of a run. Absent when this project keeps its screenshots local. */
+    screenshot?: (runId: string, file: string) => Uint8Array | undefined;
 }
 /** What the machine writes back. Separated from reads so a dry run is a source with no sink. */
 export interface SyncSink {
@@ -60,7 +69,7 @@ export interface PulledIssues {
     triage: Record<string, PulledIssue>;
 }
 /** `.reticle/cloud-state.json`. This machine's side of the conversation, never git-checked. */
-export interface CloudSyncState {
+export interface CloudSyncState extends ScreenshotSyncState {
     /** Opaque. Handed back to the server verbatim; the machine must never parse or invent one. */
     cursor?: string;
     lastPushAt?: number;
@@ -98,6 +107,21 @@ export interface CloudSyncState {
      */
     sentFlowsHash?: string;
     sentCapsulesHash?: string;
+    /**
+     * The hash of each derived record the platform last ACCEPTED from here. A platform that reports
+     * a hash of its own form of a record never matches ours, so the same record went every cycle.
+     */
+    sentDerivedHashes?: Record<string, string>;
+    /** The names of the flows the platform last took from here: one gone from disk is deleted there. */
+    sentFlowNames?: string[];
+    /**
+     * The link everything above was kept for: cloud, workspace and project (`credentialSlot`). A
+     * folder re-linked elsewhere starts a fresh record, so the new link gets the flows the old one
+     * already had, and none of the old link's runs.
+     */
+    link?: string;
+    /** When this folder was re-linked: runs made before it stay here unless the person moves them. */
+    linkedAt?: number;
     /**
      * A flow or capsule set the platform refused, kept so the refusal stays visible on the cycles that
      * do not resend it, and so the set is offered again once it changes or the platform reads more.
@@ -125,6 +149,8 @@ export interface SyncReport {
     ok: boolean;
     /** Runs the server accepted this cycle. */
     runsSent: number;
+    /** Step screenshots the server took this cycle, for runs it holds. */
+    screenshotsSent?: number;
     /** Runs it refused, with the reason, so a bad artifact is visible rather than silently stuck. */
     runsRejected: Array<{
         index: number;
@@ -183,6 +209,12 @@ interface SyncDeps {
         url: string;
         apiKey: string;
     };
+    /** The link this cycle sends for (`credentialSlot`); absent for an env-only key (CI). */
+    link?: string;
+    /** Send runs made under a previous link too: only ever because the person asked. */
+    moveHistory?: boolean;
+    /** The project flows are synced for. Absent when this cycle does not send flows: none is deleted. */
+    projectId?: string;
     source: SyncSource;
     sink: SyncSink;
     state: CloudSyncState;
@@ -197,11 +229,16 @@ interface SyncDeps {
         text: string;
     }>;
 }
+/** The server's per-part answer: accepted count and rejection list, each read defensively. */
+/** A 200 that never confirmed the runs it was sent. Kept queued, and said, rather than dropped. */
+export declare const MSG_RUNS_UNCONFIRMED = "sync 200 without a runs result: the server did not confirm the runs it was sent, so they stay queued";
 /**
  * Run one cycle. Never throws: the local record is already safe on disk, and a sync that can take
  * down the thing it is backing up is worse than no sync.
  */
-export declare function runSyncCycle(deps: SyncDeps): Promise<SyncReport>;
+/** The command that moves a folder's earlier runs to the link it has now. */
+export declare const MOVE_HISTORY_COMMAND = "reticle sync --move-history";
+export declare function runSyncCycle(given: SyncDeps): Promise<SyncReport>;
 /** One line a human can read, for the CLI and the daemon log. */
 export declare function describeSync(report: SyncReport): string;
 export {};