@vincentt-xr/cli 0.20.0 → 0.22.0

package/dist/preview/runner.d.ts

@@ -2,6 +2,7 @@ import { type ControlKind, type TunnelState, type UAClass } from "../tunnel/inde
 import type { DiagEvent } from "@vincentt-xr/harness/events";
 import { type EventTags } from "../relay/server.js";
 import { type ResolvedConfig } from "../shared/config.js";
+import { type UpgradeFacts } from "../shared/upgradeError.js";
 /** The path a 404 advisory names: the request's own path, without its query. */
 export declare function requestPathOf(url: string | undefined): string;
 /**
@@ -31,7 +32,25 @@ export type PreviewEndReason = "stopped"
  * elapsed without the client getting back): same remedy, different diagnosis,
  * and the copy explains the bound only at the moment it bites.
  */
- | "grace_cap" | "authz_revoked" | "authz_unconfirmed"
+ | "grace_cap" | "authz_revoked"
+/**
+ * The edge drained the session because the platform stopped confirming it,
+ * and said so (CONTROL `authz_expired`). Final: a new preview is a new link,
+ * so nothing is re-minted and nothing redials.
+ */
+ | "authz_lapsed"
+/**
+ * The platform refused this CLI's version, on the heartbeat (426) or on a
+ * dial (410 + `X-Vincentt-Refusal: cli_upgrade_required`). One screen for
+ * both. No further platform call is made, the DELETE included.
+ */
+ | "upgrade_required"
+/**
+ * The edge broke the agreed tunnel wire (a malformed 101 caps header, a
+ * CONTROL frame this connection cannot read, or a fatal OPEN). Final: a redial reaches the
+ * same edge, so the tunnel client has already stopped dialling.
+ */
+ | "protocol_violation"
 /**
  * The 30-minute heartbeat-silence flip. NEVER reported as `hard_max`: a
  * session ended at minute 30 has not reached its 12-hour ceiling, and saying
@@ -130,8 +149,11 @@ export interface StartPreviewOptions {
     onOriginError?: (label: string, code: string) => void;
     /** Their dev server answered again. Re-arms the advisory; prints NOTHING. */
     onOriginRecovered?: () => void;
-    /** The session ended for a reason the creator did not cause. */
-    onEnded?: (reason: PreviewEndReason) => void;
+    /**
+     * The session ended for a reason the creator did not cause. `refusal` carries
+     * the validated floor facts on `upgrade_required` only.
+     */
+    onEnded?: (reason: PreviewEndReason, refusal?: UpgradeFacts) => void;
     /** The hard max is approaching. A WARNING, never an ending (L20b). */
     onExpiring?: () => void;
     /** Injected for tests. */
@@ -154,11 +176,11 @@ export interface RunningPreview {
 }
 export declare function startPreview(opts: StartPreviewOptions): Promise<RunningPreview>;
 /**
- * Two of the three CONTROL kinds are endings. `expiring` is NOT: it is the
- * hard-max warning, and it arrives on the same channel. Mapping it to an ending
- * would take away a link that has half an hour left, at exactly the moment the
- * creator is being warned to plan around it — so it returns null and the caller
- * renders the warning instead.
+ * Three of the four kinds that reach onControl are endings. `expiring` is NOT:
+ * it is the hard-max warning, and it arrives on the same channel. Mapping it to
+ * an ending would take away a link that has half an hour left, at exactly the
+ * moment the creator is being warned to plan around it, so it returns null and
+ * the caller renders the warning instead. (`viewer_gone` never reaches here.)
  */
 export declare function controlToReason(kind: ControlKind): PreviewEndReason | null;
 /**
@@ -199,7 +221,7 @@ export declare function refusalToReason(status: number): PreviewEndReason | null
  * reason maps to its own screen. A 410 with no reason gets the cause-free
  * ending. See the note on PreviewEndedError.
  */
-export declare function runHeartbeat(config: ResolvedConfig, sessionId: string, fetchImpl: typeof fetch, onEnded?: (reason: PreviewEndReason) => void): Promise<void>;
+export declare function runHeartbeat(config: ResolvedConfig, sessionId: string, fetchImpl: typeof fetch, onEnded?: (reason: PreviewEndReason, refusal?: UpgradeFacts) => void): Promise<void>;
 /**
  * The API's `endReason` → the CLI's ending screen.
  *

package/dist/preview/runner.js

@@ -26,6 +26,7 @@ import { withoutCliCredentials } from "../shared/config.js";
 import { ProjectUnreachableError } from "../lib/backend.js";
 import { AuthExpiredError } from "../shared/authError.js";
 import { apiFetch } from "../shared/http.js";
+import { UpgradeRequiredError, parseDeclared, parseMinimum, } from "../shared/upgradeError.js";
 import { terminalSafe } from "../lib/terminalText.js";
 /** The path a 404 advisory names: the request's own path, without its query. */
 export function requestPathOf(url) {
@@ -63,6 +64,17 @@ export async function startPreview(opts) {
     let heartbeat;
     let minted;
     let stopped = false;
+    // Set once the platform refuses this CLI's version: every later platform
+    // call would be refused too, so none is made.
+    let versionRefused = false;
+    const ended = (reason, refusal) => {
+        if (reason === "upgrade_required") {
+            versionRefused = true;
+            if (heartbeat !== undefined)
+                clearInterval(heartbeat);
+        }
+        opts.onEnded?.(reason, refusal);
+    };
     const stop = async () => {
         if (stopped)
             return;
@@ -84,8 +96,9 @@ export async function startPreview(opts) {
         // best-effort in intent even though it is in effect: the 12-hour ceiling
         // and the edge's 60-second fail-closed deadline both reap a session whose
         // DELETE never landed.
-        if (minted)
+        if (minted && !versionRefused) {
             await endPreviewSession(config, minted.sessionId, fetchImpl);
+        }
     };
     try {
         // The MINT comes first. Everything below it costs the creator a dev-server
@@ -231,7 +244,7 @@ export async function startPreview(opts) {
                     opts.onExpiring?.();
                     return;
                 }
-                opts.onEnded?.(reason);
+                ended(reason);
             },
             onOriginError: opts.onOriginError,
             onStateChange: opts.onTunnelState,
@@ -241,8 +254,13 @@ export async function startPreview(opts) {
             onReconnectRefused: (status) => {
                 const reason = refusalToReason(status);
                 if (reason !== null)
-                    opts.onEnded?.(reason);
+                    ended(reason);
             },
+            onProtocolViolation: () => ended("protocol_violation"),
+            onRefused: (_reason, minimum, declared) => ended("upgrade_required", {
+                minimum: parseMinimum(minimum),
+                declared: parseDeclared(declared),
+            }),
         });
         tunnel.start();
         // The heartbeat is keepalive AND re-authorization: every beat re-runs
@@ -252,10 +270,10 @@ export async function startPreview(opts) {
         // One beat in flight at a time: a slow api must not stack up requests.
         let beating = false;
         heartbeat = setInterval(() => {
-            if (beating)
+            if (beating || versionRefused)
                 return;
             beating = true;
-            void runHeartbeat(config, minted.sessionId, fetchImpl, opts.onEnded).finally(() => {
+            void runHeartbeat(config, minted.sessionId, fetchImpl, ended).finally(() => {
                 beating = false;
             });
         }, minted.heartbeatSec * 1000);
@@ -284,18 +302,24 @@ export async function startPreview(opts) {
     }
 }
 /**
- * Two of the three CONTROL kinds are endings. `expiring` is NOT: it is the
- * hard-max warning, and it arrives on the same channel. Mapping it to an ending
- * would take away a link that has half an hour left, at exactly the moment the
- * creator is being warned to plan around it — so it returns null and the caller
- * renders the warning instead.
+ * Three of the four kinds that reach onControl are endings. `expiring` is NOT:
+ * it is the hard-max warning, and it arrives on the same channel. Mapping it to
+ * an ending would take away a link that has half an hour left, at exactly the
+ * moment the creator is being warned to plan around it, so it returns null and
+ * the caller renders the warning instead. (`viewer_gone` never reaches here.)
  */
 export function controlToReason(kind) {
-    if (kind === "superseded")
-        return "superseded";
-    if (kind === "revoke")
-        return "authz_revoked";
-    return null;
+    switch (kind) {
+        case "superseded":
+            return "superseded";
+        case "revoke":
+            return "authz_revoked";
+        case "authz_expired":
+            return "authz_lapsed";
+        case "expiring":
+        case "viewer_gone":
+            return null;
+    }
 }
 /**
  * A refused RECONNECT dial → the ending screen it means.
@@ -346,6 +370,10 @@ export async function runHeartbeat(config, sessionId, fetchImpl, onEnded) {
         await heartbeatPreviewSession(config, sessionId, fetchImpl);
     }
     catch (err) {
+        if (err instanceof UpgradeRequiredError) {
+            onEnded?.("upgrade_required", { minimum: err.minimum, declared: err.declared });
+            return;
+        }
         if (err instanceof AuthExpiredError) {
             onEnded?.("auth_expired");
             return;

package/dist/publish/api.js

@@ -5,9 +5,9 @@
 //
 // The bytes do NOT transit the API. Open returns one presigned PUT per file,
 // each signed for one exact key; the CLI PUTs direct to S3 and then commits.
-import { clientHeaders } from "../shared/clientHeader.js";
 import { rejectAuthExpired } from "../shared/authError.js";
-import { apiFetch } from "../shared/http.js";
+import { apiFetch, apiRequest } from "../shared/http.js";
+import { rejectUpgradeRequired } from "../shared/upgradeError.js";
 /**
  * The api's publish states, `domain.PublishState*`. apiPublishStates.test.ts
  * checks this list against the committed api capture, so a state the api adds
@@ -82,8 +82,12 @@ export class PublishApiError extends Error {
         this.name = "PublishApiError";
     }
 }
-/** Rejects with AuthExpiredError on a 401; every other status becomes a PublishApiError. */
+/**
+ * Rejects with UpgradeRequiredError on a 426 and AuthExpiredError on a 401;
+ * every other status becomes a PublishApiError.
+ */
 async function readError(res) {
+    await rejectUpgradeRequired(res);
     rejectAuthExpired(res);
     let body = {};
     try {
@@ -95,14 +99,10 @@ async function readError(res) {
     const retryAfter = res.headers.get("retry-after");
     return new PublishApiError(res.status, body.code ?? `http_${res.status}`, body.message ?? `request failed (${res.status})`, body.detail ?? {}, retryAfter ? Number(retryAfter) : undefined);
 }
-function authHeaders(cfg) {
-    return { ...clientHeaders(), authorization: `Bearer ${cfg.pat}` };
-}
+const AUTHENTICATED = { authenticated: true };
 /** The ONE call before the checklist. liveVersion + livePublishedAt ride it, by design. */
 export async function readProject(cfg, projectId, fetchImpl = apiFetch) {
-    const res = await fetchImpl(`${cfg.apiUrl}/projects/${encodeURIComponent(projectId)}`, {
-        headers: authHeaders(cfg),
-    });
+    const res = await apiRequest(cfg, `/projects/${encodeURIComponent(projectId)}`, {}, AUTHENTICATED, fetchImpl);
     if (!res.ok)
         throw await readError(res);
     const raw = (await res.json());
@@ -137,15 +137,15 @@ export async function readProject(cfg, projectId, fetchImpl = apiFetch) {
  * and specific fact.
  */
 export async function openUpload(cfg, projectId, files, note, fetchImpl = apiFetch, builtWith) {
-    const res = await fetchImpl(`${cfg.apiUrl}/projects/${encodeURIComponent(projectId)}/publishes`, {
+    const res = await apiRequest(cfg, `/projects/${encodeURIComponent(projectId)}/publishes`, {
         method: "POST",
-        headers: { ...authHeaders(cfg), "content-type": "application/json" },
+        headers: { "content-type": "application/json" },
         body: JSON.stringify({
             files,
             ...(note ? { note } : {}),
             ...(builtWith ? { builtWith } : {}),
         }),
-    });
+    }, AUTHENTICATED, fetchImpl);
     if (!res.ok)
         throw await readError(res);
     const body = (await res.json());
@@ -159,7 +159,7 @@ export async function openUpload(cfg, projectId, files, note, fetchImpl = apiFet
     };
 }
 export async function commitUpload(cfg, projectId, uploadId, fetchImpl = apiFetch) {
-    const res = await fetchImpl(`${cfg.apiUrl}/projects/${encodeURIComponent(projectId)}/publishes/${encodeURIComponent(uploadId)}/commit`, { method: "POST", headers: authHeaders(cfg) });
+    const res = await apiRequest(cfg, `/projects/${encodeURIComponent(projectId)}/publishes/${encodeURIComponent(uploadId)}/commit`, { method: "POST" }, AUTHENTICATED, fetchImpl);
     if (!res.ok)
         throw await readError(res);
     let raw;
@@ -174,7 +174,7 @@ export async function commitUpload(cfg, projectId, uploadId, fetchImpl = apiFetc
 /** Abandon an open upload. Idempotent server-side; a failure here must never mask the real error. */
 export async function abandonUpload(cfg, projectId, uploadId, fetchImpl = apiFetch) {
     try {
-        await fetchImpl(`${cfg.apiUrl}/projects/${encodeURIComponent(projectId)}/publishes/${encodeURIComponent(uploadId)}`, { method: "DELETE", headers: authHeaders(cfg) });
+        await apiRequest(cfg, `/projects/${encodeURIComponent(projectId)}/publishes/${encodeURIComponent(uploadId)}`, { method: "DELETE" }, AUTHENTICATED, fetchImpl);
     }
     catch {
         // Best-effort cleanup: the TTL reaps the row either way.

package/dist/publish/command.d.ts

@@ -3,6 +3,7 @@ export declare const MAX_REOPENS = 2;
 import type { ResolvedConfig } from "../shared/config.js";
 import { type BuiltWith } from "../platform/resolve.js";
 import { type VincenttJson } from "../lib/settings.js";
+import { type ReadHead } from "./weight.js";
 export interface PublishDeps {
     print: (line: string) => void;
     /** Raw write, for the redrawn progress line only. */
@@ -42,6 +43,8 @@ export interface PublishDeps {
     probeFetch?: typeof fetch;
     /** Where the --json document goes (stdout). Defaults to print. */
     emit?: (line: string) => void;
+    /** The Heavy files section's image read, by output-relative path. Injected for tests; defaults to a read under the output folder. */
+    readHead?: ReadHead;
 }
 export interface PublishOptions {
     distDir?: string;

package/dist/publish/command.js

@@ -15,19 +15,22 @@ import { buildManifest, ManifestError } from "./manifest.js";
 import { checkBounds } from "./bounds.js";
 import { classifyDist } from "./classify.js";
 import { createProgress } from "./progress.js";
-import { UploadExpired, UploadFailed, uploadAll } from "./upload.js";
+import { UploadExpired, UploadFailed, UploadTargetRejected, UploadChecksumMismatch, uploadAll, } from "./upload.js";
+import { escapeTerminal } from "../lib/terminalText.js";
 /** Re-opens after an expired upload link, per publish, before giving up. */
 export const MAX_REOPENS = 2;
 import { waitUntilServing } from "./visibility.js";
 import * as copy from "./copy.js";
 import { publishedLimitRefused, resolveCountLimit, storageCeilingRefused, } from "../shared/countLimit.js";
 import { AuthExpiredError, authExpiredLines } from "../shared/authError.js";
+import { UpgradeRequiredError, upgradeRefusalLines, } from "../shared/upgradeError.js";
 import { EXIT } from "../lib/exitCodes.js";
 import { apiFetch, isTransportError } from "../shared/http.js";
 import { resolveBuiltWith } from "../platform/resolve.js";
 import { readSettings, resolveSettings, SettingsError, TEMPLATE_DEFAULTS, } from "../lib/settings.js";
 import { settingsRefusal } from "../lib/settingsCopy.js";
 import { rootAbsoluteFindings } from "./fit.js";
+import { heavyFileFindings } from "./weight.js";
 const COMMIT_RETRIES = 3;
 const COMMIT_RETRY_DELAY_MS = 2000;
 export async function publishCommand(deps, opts = {}) {
@@ -91,13 +94,11 @@ async function runPublish(deps, opts, onCommitted) {
     }
     catch (err) {
         if (err instanceof ManifestError) {
-            if (err.reason === "secret_path" || err.reason === "lfs_pointer") {
+            const block = outputRefusal(err, output, buildCommand);
+            if (block !== undefined) {
                 deps.print(copy.headerLine(await projectLabel(deps, binding.slug), await orgOf(deps)));
                 deps.print(copy.readingLine(err.stats?.files ?? 0, err.stats?.bytes ?? 0, output));
-                const lines = err.reason === "secret_path"
-                    ? copy.secretFiles(err.paths, output)
-                    : copy.lfsPointers(err.paths, output, buildCommand ?? undefined);
-                for (const l of lines)
+                for (const l of block)
                     deps.print(l);
                 return 1;
             }
@@ -129,6 +130,11 @@ async function runPublish(deps, opts, onCommitted) {
         project = await readProject(cfg, binding.projectId, fetchImpl);
     }
     catch (err) {
+        if (err instanceof UpgradeRequiredError) {
+            deps.print(copy.headerLine(await projectLabel(deps, binding.slug), await orgOf(deps)));
+            deps.print(copy.readingLine(manifest.files.length, manifest.totalBytes, output));
+            return refusedVersion(deps, err, { kind: "publish" });
+        }
         if (err instanceof AuthExpiredError)
             return authExpired(deps);
         if (err instanceof PublishApiError && err.status === 404) {
@@ -172,6 +178,8 @@ async function runPublish(deps, opts, onCommitted) {
     const manifestPaths = new Set(manifest.files.map((f) => f.path));
     const findings = await classifyDist(distDir, manifestPaths, (abs) => fs.readFile(abs, "utf8"), (dir, rel) => path.join(dir, ...rel.split("/")), { expectedHost: address });
     const rootAbsolute = rootAbsoluteFindings(await readHtmlFiles(distDir, manifest), manifestPaths);
+    // Warning-only: a fault in this section never changes the exit code.
+    const heavy = await heavyFileFindings(manifest.files, deps.readHead ?? ((rel, n) => readFileHead(path.join(distDir, ...rel.split("/")), n))).catch(() => []);
     const checklistInput = {
         projectName: project.name,
         orgName,
@@ -182,6 +190,7 @@ async function runPublish(deps, opts, onCommitted) {
         findings,
         output,
         rootAbsolute,
+        heavy,
     };
     let promptLine;
     let defaultYes;
@@ -261,6 +270,9 @@ async function runPublish(deps, opts, onCommitted) {
 async function runUpload(deps, cfg, i) {
     const open = () => openUpload(cfg, i.projectId, i.manifest.files, i.note, i.fetchImpl, i.builtWith);
     const openFailed = (err) => {
+        if (err instanceof UpgradeRequiredError) {
+            return refusedVersion(deps, err, { kind: "publish", address: i.address });
+        }
         if (err instanceof AuthExpiredError)
             return authExpired(deps);
         for (const l of openErrorLines(err, i.address, i.liveVersion, i.org))
@@ -328,7 +340,12 @@ async function runUpload(deps, cfg, i) {
                 deps.print(l);
             return 1;
         }
-        const failedPath = err instanceof UploadFailed || err instanceof UploadExpired ? err.path : "a file";
+        const failedPath = err instanceof UploadFailed ||
+            err instanceof UploadExpired ||
+            err instanceof UploadTargetRejected ||
+            err instanceof UploadChecksumMismatch
+            ? escapeTerminal(err.path)
+            : "a file";
         deps.print("");
         deps.print(`✗ Uploading ${failedPath} failed.`);
         deps.print("");
@@ -365,6 +382,15 @@ async function commitWithHealing(deps, cfg, i, uploadId) {
             return 0;
         }
         catch (err) {
+            // A version refusal is final: COMMIT_RETRIES is for transient failures,
+            // and each retry would be one more refused call.
+            if (err instanceof UpgradeRequiredError) {
+                return refusedVersion(deps, err, {
+                    kind: "publish",
+                    address: i.address,
+                    stillServing: i.liveVersion,
+                });
+            }
             // The token can lapse during a long upload. The files are stored and the
             // live address is unchanged, so signing in and publishing again is safe.
             if (err instanceof AuthExpiredError)
@@ -533,6 +559,23 @@ function openErrorLines(err, address, liveVersion, org) {
 function numericLimit(limit) {
     return typeof limit === "number" ? limit : 0;
 }
+/** The refusals about what the output holds, printed after the header and reading line. */
+function outputRefusal(err, output, buildCommand) {
+    switch (err.reason) {
+        case "secret_path":
+            return copy.secretFiles(err.paths, output);
+        case "path_escaped":
+            return copy.escapedFiles(err.paths, output);
+        case "credential_file":
+            return copy.credentialFiles(err.paths, output);
+        case "file_unreadable":
+            return copy.fileUnreadable(err.offendingPath, output);
+        case "lfs_pointer":
+            return copy.lfsPointers(err.paths, output, buildCommand ?? undefined);
+        default:
+            return undefined;
+    }
+}
 function manifestErrorLines(err, distDir, ctx) {
     if (err.reason === "no_dist")
         return copy.noDist(distDir, ctx.buildCommand);
@@ -559,6 +602,24 @@ function outputLabelOf(root, distDir, source) {
             : "";
     return { folder, sourceNote };
 }
+/** The first `n` bytes of a file, or fewer if it is shorter. */
+async function readFileHead(abs, n) {
+    const handle = await fs.open(abs, "r");
+    try {
+        const buf = Buffer.alloc(n);
+        let got = 0;
+        while (got < n) {
+            const { bytesRead } = await handle.read(buf, got, n - got, got);
+            if (bytesRead === 0)
+                break;
+            got += bytesRead;
+        }
+        return buf.subarray(0, got);
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+}
 /** Every `.html` in the manifest, for the root-absolute reference check. */
 async function readHtmlFiles(distDir, manifest) {
     const out = [];
@@ -588,6 +649,12 @@ function addressOf(project) {
         return project.liveUrl.replace(/^https?:\/\//, "").replace(/\/$/, "");
     }
 }
+/** The platform refused this CLI's version. Nothing further is sent. */
+function refusedVersion(deps, err, arm) {
+    for (const l of upgradeRefusalLines(err, arm))
+        deps.print(l);
+    return EXIT.UPGRADE_REQUIRED;
+}
 /** The api refused the token: the sign-in remedy, and the not-signed-in exit code. */
 function authExpired(deps) {
     for (const l of authExpiredLines())

package/dist/publish/copy.d.ts

@@ -1,6 +1,7 @@
 import type { FileFindings } from "./classify.js";
 import type { BoundViolation } from "./bounds.js";
 import type { RootAbsoluteFinding } from "./fit.js";
+import type { HeavyFinding } from "./weight.js";
 import type { Offender } from "./manifest.js";
 export declare function truncate(value: string, max?: number): string;
 /** Bytes as the creator reads them. Decimal MB, matching what a build tool prints. */
@@ -46,6 +47,8 @@ export interface ChecklistInput {
     output?: OutputLabel;
     /** Root-absolute references that do not resolve. The section is absent when empty. */
     rootAbsolute?: RootAbsoluteFinding[];
+    /** Models and images over the weight limits. The section is absent when empty. */
+    heavy?: HeavyFinding[];
 }
 /**
  * The `Paths from the root` section: a second section of the checklist, same
@@ -53,6 +56,8 @@ export interface ChecklistInput {
  * empty heading. One explanation for the whole section.
  */
 export declare function pathsFromRootLines(findings: RootAbsoluteFinding[] | undefined, folder?: string): string[];
+/** The `Heavy files` section: warning-only, absent when there are no findings. */
+export declare function heavyFileLines(findings: HeavyFinding[] | undefined): string[];
 /**
  * The output folder as the creator reads it, `dist/` for the template. The
  * source is appended only when it is not the default, so the template's
@@ -171,6 +176,16 @@ export declare function outputOutside(shown: string): string[];
 export declare function outputInHidden(shown: string, hidden: string): string[];
 /** Flow U1 — hidden names or symlinks that would leak. After the header and reading line. */
 export declare function secretFiles(paths: Offender[], output?: OutputLabel): string[];
+/**
+ * Flow U1 — files whose folder resolved outside the output after the walk: a
+ * folder was swapped for a link while publish read it. The whole publish is
+ * refused, never just the file. After the header and reading line.
+ */
+export declare function escapedFiles(paths: Offender[], output?: OutputLabel): string[];
+/** Flow U1 — credential files, from the early checks or the hash step. After the header and reading line. */
+export declare function credentialFiles(paths: Offender[], output?: OutputLabel): string[];
+/** Flow U1 — a file that changed, became a link, or could not be read while checked or hashed. */
+export declare function fileUnreadable(filePath: string, output?: OutputLabel): string[];
 /** Flow U1 — Git LFS pointer files. The recorded build.command, verbatim, when there is one. */
 export declare function lfsPointers(paths: Offender[], output?: OutputLabel, buildCommand?: string): string[];
 /** A local path rule the creator's own build broke. Local, before any request. */