@vibe-commit/capture 0.7.0 → 0.9.0

package/dist/oauth/retire.d.ts

@@ -31,6 +31,8 @@
  */
 import type { IngestCredential } from "../credential.js";
 export declare const RETIRE_PATH = "/oauth/ingest-credential/retire";
+/** One best-effort revoke of a credential `g` holds, and the bound on a verb's whole retry of the queue (`pending_revoke.ts`). */
+export declare const REVOKE_TIMEOUT_MS = 3000;
 export type Retire = 
 /** The server revoked the old credential. */
 {
@@ -62,3 +64,11 @@ export declare function retireCredential(mcpEndpoint: string, replacement: Inges
  * result carries nothing of the credential.
  */
 export declare function selfRevokeCredential(mcpEndpoint: string, credential: IngestCredential, deps: RetireDeps): Promise<Retire>;
+/**
+ * `selfRevokeCredential`, plus the one thing a RETRY needs to know: `gone` is a 401, the server saying it does not accept this
+ * credential — already revoked, expired or never real — so there is nothing left to revoke and a queued retry stops. Every
+ * other result is `selfRevokeCredential`'s.
+ */
+export declare function selfRevokeOutcome(mcpEndpoint: string, credential: IngestCredential, deps: RetireDeps): Promise<Retire | {
+    readonly kind: "gone";
+}>;

package/dist/oauth/retire.js

@@ -31,6 +31,8 @@
  */
 import { HTTP_TIMEOUT_MS } from "./signin.js";
 export const RETIRE_PATH = "/oauth/ingest-credential/retire";
+/** One best-effort revoke of a credential `g` holds, and the bound on a verb's whole retry of the queue (`pending_revoke.ts`). */
+export const REVOKE_TIMEOUT_MS = 3_000;
 export function retireUrl(mcpEndpoint) {
     return new URL(RETIRE_PATH, mcpEndpoint).toString();
 }
@@ -75,6 +77,15 @@ export async function retireCredential(mcpEndpoint, replacement, old, deps) {
  * result carries nothing of the credential.
  */
 export async function selfRevokeCredential(mcpEndpoint, credential, deps) {
+    const outcome = await selfRevokeOutcome(mcpEndpoint, credential, deps);
+    return outcome.kind === "gone" ? { kind: "failed" } : outcome;
+}
+/**
+ * `selfRevokeCredential`, plus the one thing a RETRY needs to know: `gone` is a 401, the server saying it does not accept this
+ * credential — already revoked, expired or never real — so there is nothing left to revoke and a queued retry stops. Every
+ * other result is `selfRevokeCredential`'s.
+ */
+export async function selfRevokeOutcome(mcpEndpoint, credential, deps) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? HTTP_TIMEOUT_MS);
     try {
@@ -91,6 +102,8 @@ export async function selfRevokeCredential(mcpEndpoint, credential, deps) {
         });
         if (res.status === 404)
             return { kind: "unknown" };
+        if (res.status === 401)
+            return { kind: "gone" };
         if (res.status !== 200)
             return { kind: "failed" };
         const doc = (await res.json());

package/dist/oauth/retire.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/oauth/retire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAiB7D,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,WAA6B,EAC7B,GAAqB,EACrB,IAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,CAAC,MAAM,EAAE,EAAE;gBAC/C,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;QAC/D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,GAAG,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,UAA4B,EAC5B,IAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,EAAE;gBAC9C,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACpC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;QAC/D,OAAO,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/oauth/retire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAE7D,kIAAkI;AAClI,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAiBvC,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,WAA6B,EAC7B,GAAqB,EACrB,IAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,CAAC,MAAM,EAAE,EAAE;gBAC/C,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;QAC/D,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,GAAG,EAAE,OAAO,KAAK,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,UAA4B,EAC5B,IAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,UAA4B,EAC5B,IAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,EAAE;gBAC9C,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACpC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;QAC/D,OAAO,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/paths.d.ts

@@ -19,11 +19,32 @@ export declare function rootDir(home: string): string;
 export declare function credentialsPath(home: string): string;
 /** The per-project consent allow list. Consulted BEFORE any transcript read (D56 §D19). */
 export declare function projectsPath(home: string): string;
+/**
+ * Folder grants (any-folder capture, R3): a folder whose no-repo sessions may be captured under a `local:folder:` identity.
+ * ⛔ A separate file from `projects.json` on purpose: that one is keyed by git common dir and enumerated as clones (`status`,
+ * `machine_state`), and a folder in it would be listed as one. Keyed by the folder's REALPATH. Client-side only: never synced,
+ * because the server holds no path and never refuses a `local:` slug. Absent file: no folder is granted.
+ */
+export declare function foldersPath(home: string): string;
 /**
  * The slug-keyed grant list — owners, repos, exclusions and refusals. Read next to
  * `projects.json` by `consent.ts`'s `isCaptureAllowed`, BEFORE any transcript read.
  */
 export declare function grantsPath(home: string): string;
+/**
+ * What the SERVER told this machine about the account, and the refusals a hook saw (slice 2, S4). ⛔ A separate file
+ * from `grants.json` on purpose: hooks write this one and never write `grants.json`, whose `updateGrants`
+ * read-modify-write has no lock — a hook racing `vibecommit off` could otherwise restore a turned-off repo. Written whole
+ * and atomically; read by `consent.ts`'s `isCaptureAllowed` next to `grants.json`.
+ */
+export declare function grantsAccountPath(home: string): string;
+/**
+ * Credentials `g` made and then removed from this machine whose revoke did not reach the server (slice 2, S4, R3-11): the next CLI
+ * verb retries each one. ⛔ **It holds a bearer token**, because a self-revoke is made with the credential itself and the local
+ * credential file was deleted. Mode 0600 like `credentials.json`, written atomically, CLI-only, and a row leaves it the moment the
+ * server says there is nothing left to revoke.
+ */
+export declare function pendingRevokePath(home: string): string;
 /**
  * The HUMAN lane's signed-in session — `CR-084d`. Mode 0600, enforced on read by
  * the same `readSecretFile` the ingest credential goes through.
@@ -95,6 +116,12 @@ export declare function repoDayNoticePath(home: string, repoKey: string, day: st
  * `day` is a UTC `YYYY-MM-DD` supplied by the caller, never read from a local clock here.
  */
 export declare function machineDayNoticePath(home: string, day: string, key: string): string;
+/**
+ * Once-per-`(machine, account epoch)` marker — slice 2, notice state 10 ("your account grants N repositories not captured on this
+ * machine yet"). The epoch is the server's version of the user's grants, so the message is spoken again only when the grants
+ * changed; a repeat per session or per day would nag about the same unchanged gap. `epoch` is a non-negative integer, `key` the state.
+ */
+export declare function machineEpochNoticePath(home: string, epoch: number, key: string): string;
 /**
  * Once-per-CLONE marker — 0.7.0, notices 6-8 and the `SessionStart` install record (eng review D4 · A).
  *
@@ -163,6 +190,27 @@ export declare function sessionStatePath(home: string, key: SessionKey): string
  * repo-less bucket, and a caller with no repo has nothing to scan.
  */
 export declare function repoSessionsDir(home: string, repoKey: string): string | null;
+/**
+ * ⛔ The directory that holds per-SESSION state which is not any one repo's: the session's target record
+ * (`session_targets.ts`) and the digest → work-tree notes.
+ *
+ * Under `state/notices/` and NOT beside the repo digests, and not a new `state/` entry, on purpose: two suites pin entry-name
+ * sets (`study-contract.test.ts` pins `state/` to `notices` and `sessions`; `agent-registry.test.ts` counts the entries of
+ * `state/sessions/` as repo digests, and the study harness binds both). `notices/` is already a mixed namespace
+ * (`machine-day`, `machine-epoch`, `clone`, `repo-day`, one directory per session id) that nothing enumerates. None of the
+ * files here has a `.json` suffix, so no scan that reads `*.json` can mistake one for a repo's session state.
+ */
+export declare function targetsDir(home: string): string;
+/** Where every repo's `<digest>/` state directory lives. */
+export declare function sessionsRoot(home: string): string;
+/** One session's target record: scan cursors, resolved roots, targets, undecided names. Not a `.json` (see `targetsDir`). */
+export declare function sessionTargetsPath(home: string, sessionId: string): string;
+/** Which work tree a state digest names — written by `spool.ts` when a commit is spooled. Null for no repo key. */
+export declare function repoKeyNotePath(home: string, repoKey: string): string | null;
+/** The digest a work tree's state directory is named by (`repoSessionsDir`). Exposed for the spool-evidence reader. */
+export declare function repoKeyDigest(repoKey: string): string;
+/** The stem every file of one session is named by (`<stem>.json`, `.spool.jsonl`, …). */
+export declare function sessionFileStem(sessionId: string): string;
 /**
  * Where Claude Code writes transcripts.
  *
@@ -206,7 +254,12 @@ export declare function codexTranscriptRoot(home: string, env: NodeJS.ProcessEnv
  * all**. The repository that IS one sits a directory below it, so its project
  * key munges to that workspace's name with the child directory appended — a
  * name with no directory under `projects/` — and a project-key-derived root
- * would refuse the one real transcript there is.
+ * would refuse the one real transcript there is. (That is the same shape as the
+ * parent-folder sessions any-folder capture now reads: a session launched in a
+ * folder above its repos has no single repo whose key could name its transcript's
+ * directory. The boundary therefore stays registry-computed and can only refuse;
+ * WHICH repos or folder a session's bytes go to is `session_targets`' decision,
+ * made after this confinement, never an input to it.)
  *
  * ⇒ ⛔ **The interior shape is enforced by `isCursorTranscript` instead**, which
  * runs AFTER the registry-computed boundary and can only refuse. Read that

package/dist/paths.js

@@ -14,8 +14,8 @@
  * @provenance vibecommit-schema ingest_sessions.file_key — CHECK bound 1..128, retyped
  */
 import { createHash } from "node:crypto";
-import { realpathSync } from "node:fs";
 import { join, sep } from "node:path";
+import { physicalPath } from "./physical_path.js";
 /** Root of the client's own state. Never Claude Code's — see the plan's keychain note. */
 export function rootDir(home) {
     return join(home, ".vibecommit");
@@ -28,6 +28,15 @@ export function credentialsPath(home) {
 export function projectsPath(home) {
     return join(rootDir(home), "projects.json");
 }
+/**
+ * Folder grants (any-folder capture, R3): a folder whose no-repo sessions may be captured under a `local:folder:` identity.
+ * ⛔ A separate file from `projects.json` on purpose: that one is keyed by git common dir and enumerated as clones (`status`,
+ * `machine_state`), and a folder in it would be listed as one. Keyed by the folder's REALPATH. Client-side only: never synced,
+ * because the server holds no path and never refuses a `local:` slug. Absent file: no folder is granted.
+ */
+export function foldersPath(home) {
+    return join(rootDir(home), "folders.json");
+}
 /**
  * The slug-keyed grant list — owners, repos, exclusions and refusals. Read next to
  * `projects.json` by `consent.ts`'s `isCaptureAllowed`, BEFORE any transcript read.
@@ -35,6 +44,24 @@ export function projectsPath(home) {
 export function grantsPath(home) {
     return join(rootDir(home), "grants.json");
 }
+/**
+ * What the SERVER told this machine about the account, and the refusals a hook saw (slice 2, S4). ⛔ A separate file
+ * from `grants.json` on purpose: hooks write this one and never write `grants.json`, whose `updateGrants`
+ * read-modify-write has no lock — a hook racing `vibecommit off` could otherwise restore a turned-off repo. Written whole
+ * and atomically; read by `consent.ts`'s `isCaptureAllowed` next to `grants.json`.
+ */
+export function grantsAccountPath(home) {
+    return join(rootDir(home), "grants-account.json");
+}
+/**
+ * Credentials `g` made and then removed from this machine whose revoke did not reach the server (slice 2, S4, R3-11): the next CLI
+ * verb retries each one. ⛔ **It holds a bearer token**, because a self-revoke is made with the credential itself and the local
+ * credential file was deleted. Mode 0600 like `credentials.json`, written atomically, CLI-only, and a row leaves it the moment the
+ * server says there is nothing left to revoke.
+ */
+export function pendingRevokePath(home) {
+    return join(rootDir(home), "pending-revoke.json");
+}
 /**
  * The HUMAN lane's signed-in session — `CR-084d`. Mode 0600, enforced on read by
  * the same `readSecretFile` the ingest credential goes through.
@@ -120,6 +147,14 @@ export function repoDayNoticePath(home, repoKey, day, state) {
 export function machineDayNoticePath(home, day, key) {
     return join(stateDir(home), "notices", "machine-day", sanitise(day), `${sanitise(key)}.json`);
 }
+/**
+ * Once-per-`(machine, account epoch)` marker — slice 2, notice state 10 ("your account grants N repositories not captured on this
+ * machine yet"). The epoch is the server's version of the user's grants, so the message is spoken again only when the grants
+ * changed; a repeat per session or per day would nag about the same unchanged gap. `epoch` is a non-negative integer, `key` the state.
+ */
+export function machineEpochNoticePath(home, epoch, key) {
+    return join(stateDir(home), "notices", "machine-epoch", sanitise(String(epoch)), `${sanitise(key)}.json`);
+}
 /**
  * Once-per-CLONE marker — 0.7.0, notices 6-8 and the `SessionStart` install record (eng review D4 · A).
  *
@@ -178,6 +213,41 @@ export function repoSessionsDir(home, repoKey) {
         return null;
     return join(stateDir(home), "sessions", repoDigest(repoKey));
 }
+/**
+ * ⛔ The directory that holds per-SESSION state which is not any one repo's: the session's target record
+ * (`session_targets.ts`) and the digest → work-tree notes.
+ *
+ * Under `state/notices/` and NOT beside the repo digests, and not a new `state/` entry, on purpose: two suites pin entry-name
+ * sets (`study-contract.test.ts` pins `state/` to `notices` and `sessions`; `agent-registry.test.ts` counts the entries of
+ * `state/sessions/` as repo digests, and the study harness binds both). `notices/` is already a mixed namespace
+ * (`machine-day`, `machine-epoch`, `clone`, `repo-day`, one directory per session id) that nothing enumerates. None of the
+ * files here has a `.json` suffix, so no scan that reads `*.json` can mistake one for a repo's session state.
+ */
+export function targetsDir(home) {
+    return join(stateDir(home), "notices", "_session-targets");
+}
+/** Where every repo's `<digest>/` state directory lives. */
+export function sessionsRoot(home) {
+    return join(stateDir(home), "sessions");
+}
+/** One session's target record: scan cursors, resolved roots, targets, undecided names. Not a `.json` (see `targetsDir`). */
+export function sessionTargetsPath(home, sessionId) {
+    return join(targetsDir(home), `${sanitise(sessionId)}.targets`);
+}
+/** Which work tree a state digest names — written by `spool.ts` when a commit is spooled. Null for no repo key. */
+export function repoKeyNotePath(home, repoKey) {
+    if (repoKey === "")
+        return null;
+    return join(targetsDir(home), `${repoDigest(repoKey)}.repo`);
+}
+/** The digest a work tree's state directory is named by (`repoSessionsDir`). Exposed for the spool-evidence reader. */
+export function repoKeyDigest(repoKey) {
+    return repoDigest(repoKey);
+}
+/** The stem every file of one session is named by (`<stem>.json`, `.spool.jsonl`, …). */
+export function sessionFileStem(sessionId) {
+    return sanitise(sessionId);
+}
 /** A fixed-length, collision-free filename component for a work-tree path. */
 function repoDigest(repoKey) {
     return createHash("sha256").update(repoKey).digest("hex").slice(0, 32);
@@ -237,7 +307,12 @@ export function codexTranscriptRoot(home, env) {
  * all**. The repository that IS one sits a directory below it, so its project
  * key munges to that workspace's name with the child directory appended — a
  * name with no directory under `projects/` — and a project-key-derived root
- * would refuse the one real transcript there is.
+ * would refuse the one real transcript there is. (That is the same shape as the
+ * parent-folder sessions any-folder capture now reads: a session launched in a
+ * folder above its repos has no single repo whose key could name its transcript's
+ * directory. The boundary therefore stays registry-computed and can only refuse;
+ * WHICH repos or folder a session's bytes go to is `session_targets`' decision,
+ * made after this confinement, never an input to it.)
  *
  * ⇒ ⛔ **The interior shape is enforced by `isCursorTranscript` instead**, which
  * runs AFTER the registry-computed boundary and can only refuse. Read that
@@ -331,15 +406,11 @@ export function isTranscriptFile(_root, path) {
 export function isCursorTranscript(root, path) {
     if (!isInside(root, path))
         return false;
-    let realRoot;
-    let realPath;
-    try {
-        realRoot = realpathSync(root);
-        realPath = realpathSync(path);
-    }
-    catch {
+    // C71 (3): the one resolver.
+    const realRoot = physicalPath(root, "fail");
+    const realPath = physicalPath(path, "fail");
+    if (realRoot === null || realPath === null)
         return false;
-    }
     if (!realPath.endsWith(TRANSCRIPT_SUFFIX))
         return false;
     const segments = realPath.slice(realRoot.length + 1).split(sep);
@@ -465,8 +536,13 @@ export function isInside(root, candidate) {
     let realRoot;
     let realCandidate;
     try {
-        realRoot = realpathSync(root);
-        realCandidate = realpathSync(candidate);
+        // C70: physical resolution (`..` after a link is the link target's parent), missing = outside, as `realpathSync` threw.
+        const rootPath = physicalPath(root, "fail");
+        const candidatePath = physicalPath(candidate, "fail");
+        if (rootPath === null || candidatePath === null)
+            return false;
+        realRoot = rootPath;
+        realCandidate = candidatePath;
     }
     catch {
         return false;

package/dist/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEtC,0FAA0F;AAC1F,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACnC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAa;IAC9E,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,OAAe,EACf,GAAW,EACX,KAAa;IAEb,OAAO,IAAI,CACT,QAAQ,CAAC,IAAI,CAAC,EACd,SAAS,EACT,UAAU,EACV,UAAU,CAAC,OAAO,CAAC,EACnB,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAa;IAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACnG,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAe;IAC5D,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAsB;IACjE,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACzC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAsB;IACtE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,IAAY;IAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IAC3D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,qEAAqE;IACrE,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,sBAAsB,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,cAAsB;IACjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,SAAS,OAAO,EAAE,CAAC;IAC/B,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,SAAiB;IACtD,IAAI,QAAgB,CAAC;IACrB,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB,EAAE,SAAiB;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAsB;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACzC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAsB;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QACzD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAsB;IACnE,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACzC,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QACzD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAsB;IACjE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,0FAA0F;AAC1F,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACnC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAa;IAC9E,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,OAAe,EACf,GAAW,EACX,KAAa;IAEb,OAAO,IAAI,CACT,QAAQ,CAAC,IAAI,CAAC,EACd,SAAS,EACT,UAAU,EACV,UAAU,CAAC,OAAO,CAAC,EACnB,QAAQ,CAAC,GAAG,CAAC,EACb,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW;IAC7E,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAa;IAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACnG,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAe;IAC5D,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAC7D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,6HAA6H;AAC7H,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAiB;IAChE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC3D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAsB;IACjE,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACzC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAsB;IACtE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,IAAY;IAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IAC3D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,qEAAqE;IACrE,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,sBAAsB,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,cAAsB;IACjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,SAAS,OAAO,EAAE,CAAC;IAC/B,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,SAAiB;IACtD,IAAI,QAAgB,CAAC;IACrB,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,wHAAwH;QACxH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC9D,QAAQ,GAAG,QAAQ,CAAC;QACpB,aAAa,GAAG,aAAa,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB,EAAE,SAAiB;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,GAAsB;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACzC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAsB;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QACzD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAsB;IACnE,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACzC,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QACzD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAsB;IACjE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,MAAM,IAAI,GACR,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAC7C,CAAC"}

package/dist/pending_revoke.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Pending revokes (slice 2, S4, R3-11): the WRITE-AHEAD record of a credential `g` has made and not yet been told to keep.
+ *
+ * ```
+ *   addPendingRevoke(home, credential, endpoint, now)   at the mint, BEFORE anything else: refuses (never overwrites) when it cannot
+ *   removePendingRevoke(home, token)                    after the revoke, or after the credential is kept: re-reads, removes ONE row
+ *   revokeHeld(home, token, fetch)                      one best-effort revoke (3 s) of a row, to ITS recorded origin
+ *   retryPendingRevokes(home, env, fetch, now)          every user-facing verb, once, at its start: one 3 s bound across all rows
+ *   readPendingRevokes(home)                            how many are waiting (for `status`'s `pending` count)
+ * ```
+ *
+ * ## ⛔ WHY IT IS WRITE-AHEAD
+ *
+ * `g` is the one place a credential is made ahead of consent (exception 3). So the credential lives in MEMORY until the yes:
+ * `credentials.json` does not exist before it, and the row below is written the instant the server hands the token over. A kill, a
+ * second Ctrl+C, a SIGHUP at the y/N or an unexpected throw therefore leaves a ROW (which the next verb revokes), never a live
+ * credential on disk that nothing remembers. The yes commits in this order: the grants, then `credentials.json`, then the row's
+ * deletion; a retry skips and drops any row whose token IS the current credential, so a kill between the last two never revokes what
+ * the user kept.
+ *
+ * ## ⛔ THE FILE HOLDS A BEARER TOKEN — the same exposure class as `credentials.json`, held to the same rules
+ *   - written mode 0600 under the 0700 directory, temp + rename;
+ *   - READ through `readSecretFile`: a file or folder others can read is refused, and an insecure or unreadable file is NEVER
+ *     overwritten (the writer refuses, and `g` fails closed);
+ *   - never printed, logged or returned: `status` counts the rows and shows nothing else, `--json` included;
+ *   - a hook never touches it (only the CLI verbs import this module; `test/connect-account.test.ts` walks the hooks' import graph).
+ *
+ * ## ⛔ A ROW IS NEVER DROPPED UNREVOKED, except by the clock
+ *   - it leaves on a 2xx, a 401 (the server does not accept it: already dead) or a 404 (a server that cannot revoke);
+ *   - or at `minted_at` + 91 days: a token that was never on disk was never used, and an ingest credential ends 90 days unused;
+ *   - there is no row cap that drops one: at the cap `addPendingRevoke` REFUSES, and `g` fails closed.
+ *
+ * ## ⛔ THE ORIGIN IS THE ROW'S
+ *
+ * A row records the issuing server's origin and a retry goes ONLY there (https, or http on loopback: `isAllowedIngestUrl`), never to
+ * wherever `VIBECOMMIT_MCP_URL` points today.
+ */
+import { IngestCredential, type SecretFileRead } from "./credential.js";
+import { type Queue } from "./pending_revoke_file.js";
+import { REVOKE_TIMEOUT_MS } from "./oauth/retire.js";
+export { readPendingRevokes, type PendingRevoke } from "./pending_revoke_file.js";
+/** More rows than `g` can produce in earnest: past it `g` refuses rather than drop one. */
+export declare const MAX_ROWS = 8;
+/** One best-effort revoke, and the bound on a verb's whole retry. */
+export { REVOKE_TIMEOUT_MS };
+export type AddRevoke = {
+    readonly kind: "written";
+}
+/** The file is there but is not safe to read or write (others can read it, or it is not what this client wrote). It was not touched. */
+ | {
+    readonly kind: "refused";
+    readonly read: Extract<Queue, {
+        kind: "refused";
+    }>["read"];
+}
+/** `MAX_ROWS` unrevoked rows already wait. None was dropped. */
+ | {
+    readonly kind: "full";
+}
+/** The write itself failed. */
+ | {
+    readonly kind: "failed";
+};
+/**
+ * Write the row for a credential that has just been made. Never overwrites a file it cannot read, never drops a row.
+ * `lease: true` is `g` holding the credential at its y/N: the row carries `{ pid, lease_until }` (30 minutes) so another verb's retry
+ * leaves it alone while it is kept; every other writer (a test, an orphaned row) has no lease and is retried at once.
+ */
+export declare function addPendingRevoke(home: string, credential: IngestCredential, endpoint: string, now: Date, options?: {
+    readonly lease?: boolean;
+}): AddRevoke;
+/** Remove ONE row, re-reading just before the write so a row queued in between survives. Deletes the file when it is empty. Never throws. */
+export declare function removePendingRevoke(home: string, token: string): void;
+/** Give the row up to the retry: `g` is no longer holding the credential, so the next verb may revoke it. Re-reads before it writes. */
+export declare function releaseLease(home: string, token: string): void;
+/**
+ * Is the row for `token` still there? `g` asks just before it commits, and the three answers are different things:
+ *   - `held`: the row is in a queue this client can use;
+ *   - `gone`: the queue is readable and the row is not in it — another verb settled (revoked) it;
+ *   - `unusable`: the queue is insecure or unreadable. Nobody revoked anything; this client can neither keep nor settle the record.
+ */
+export declare function holdsRow(home: string, token: string): "held" | "gone" | "unusable";
+/**
+ * What one best-effort revoke of the credential `g` holds came to:
+ *   - `revoked`: a 2xx, a 401 or a 404 — from the row's recorded origin when a readable row is there, and otherwise from the
+ *     credential IN MEMORY at the origin that minted it. Never "revoked" for any other reason;
+ *   - `waiting`: a readable row is there and the revoke did not land; the next verb retries it;
+ *   - `orphan`: no usable row (it is gone, or the queue became unreadable or insecure) AND the in-memory revoke did not land: the
+ *     credential may be live and nothing retries it. `insecure` carries the queue file's problem to print the insecure-file block;
+ *   - `unrevocable`: a 404 — the server has no revoke route, so the row ends (retrying is pointless) but the credential may still be live.
+ *     It is NOT "revoked": the caller prints the orphan wording, which says where to remove it ("0.8.0 truth fixes" F7).
+ */
+export interface HeldRevoke {
+    readonly kind: "revoked" | "waiting" | "orphan" | "unrevocable";
+    readonly insecure: Extract<SecretFileRead, {
+        kind: "insecure-file";
+    }> | null;
+}
+/**
+ * `g`'s every no-grant exit: one revoke within 3 s. With a readable row it goes to the row's recorded origin and removes the row on a
+ * 2xx, 401 or 404 (a failure gives the lease up so the next verb retries). With NO usable row — missing, or the queue refused — it
+ * revokes with the in-memory credential at the MINTED origin: a missing row is never taken for "already revoked".
+ */
+export declare function revokeHeld(home: string, credential: IngestCredential, mintedOrigin: string, fetchImpl: typeof fetch): Promise<HeldRevoke>;
+/**
+ * Every user-facing verb, once, at its start: one attempt at each row, and ONE 3 s bound across all of them (a row gets what is
+ * left of the bound, and none is attempted once it is spent). Silent, and needs no credential.
+ *
+ * Before EACH request it re-reads the queue and the current credential (a credential committed, or a row settled, after the loop
+ * began is never revoked on a stale view), and it
+ *   - skips and DROPS a row whose token is the current credential (the user kept it; the kill came between the credential's write
+ *     and the row's deletion) — compared on the file's raw token, so a mode problem does not hide a kept credential;
+ *   - skips (and keeps) a LEASED row: `g` is holding it at its y/N in another process;
+ *   - drops a row past `minted_at` + 91 days.
+ * Removes each row it settles as it goes, re-reading just before it writes. Returns how many rows still wait. Never throws.
+ */
+export declare function retryPendingRevokes(home: string, env: NodeJS.ProcessEnv, fetchImpl: typeof fetch, now: Date, deadlineMs?: number): Promise<number>;