codebyplan 1.13.64 → 1.13.66

package/dist/lib/types.d.ts

@@ -0,0 +1,843 @@
+export type Json = string | number | boolean | null | {
+    [key: string]: Json | undefined;
+} | Json[];
+export interface Repo {
+    id: string;
+    name: string;
+    path: string | null;
+    git_branch: string | null;
+    auto_push_enabled: boolean;
+    user_id: string | null;
+    is_session_active: boolean;
+    session_status: string;
+    needs_refresh: boolean;
+    last_session_at: string | null;
+    server_port: number | null;
+    server_type: string;
+    active_servers: Json | null;
+    tech_stack: Json | null;
+    branch_config?: Json | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface RepoSyncState {
+    id: string;
+    repo_id: string;
+    last_synced_at: string | null;
+    was_skipped: boolean;
+    files_synced_count: number;
+    files_pushed: number;
+    files_pulled: number;
+    files_deleted: number;
+    files_skipped: number;
+    sync_duration_ms: number | null;
+    sync_version: string | null;
+    user_id: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface CheckpointIdea {
+    description: string;
+    requirements: string[];
+    images: string[];
+    assessment?: string;
+}
+export interface Checkpoint {
+    id: string;
+    repo_id: string;
+    title: string | null;
+    number: number;
+    goal: string | null;
+    idea: string | null;
+    idea_requirements: string | null;
+    ideas: CheckpointIdea[] | null;
+    deadline: string | null;
+    start_date: string | null;
+    status: string;
+    launch_id: string | null;
+    worktree_id: string | null;
+    assigned_to: string | null;
+    branch_name: string | null;
+    context: Json | null;
+    research: Json | null;
+    qa: Json | null;
+    plan: Json | null;
+    user_context: string | null;
+    is_claude_written: boolean;
+    context_development: Record<string, unknown> | null;
+    resources: Json | null;
+    completed_at: string | null;
+    created_at: string;
+}
+export interface Task {
+    id: string;
+    checkpoint_id: string | null;
+    repo_id: string | null;
+    title: string;
+    number: number;
+    requirements: string | null;
+    status: string;
+    files_changed: Json | null;
+    context: Json | null;
+    qa: Json | null;
+    research: Json | null;
+    user_context: string | null;
+    is_claude_written: boolean;
+    context_development: Record<string, unknown> | null;
+    resources: Json | null;
+    app_file_approval_by_user: boolean;
+    deadline: string | null;
+    branch_name: string | null;
+    template_id: string | null;
+    completed_at: string | null;
+    created_at: string;
+}
+export interface Round {
+    id: string;
+    task_id: string;
+    number: number;
+    requirements: string | null;
+    status: string;
+    files_changed: Json | null;
+    context: Json | null;
+    qa: Json | null;
+    user_context: string | null;
+    is_claude_written: boolean;
+    context_development: Record<string, unknown> | null;
+    resources: Json | null;
+    started_at: string | null;
+    completed_at: string | null;
+    duration_minutes: number | null;
+    triggered_by: string | null;
+}
+export interface WorkPlan {
+    id: string;
+    repo_id: string;
+    week_number: number;
+    year: number;
+    items: Json | null;
+    completed: Json | null;
+    created_at: string;
+}
+export interface Launch {
+    id: string;
+    repo_id: string;
+    title: string;
+    type: string;
+    status: string;
+    version: string | null;
+    user_requirements: Json | null;
+    created_at: string;
+}
+export interface SessionLog {
+    id: string;
+    repo_id: string;
+    session_date: string;
+    day_number: number;
+    session_number: number;
+    content: Json | null;
+    created_at: string;
+}
+export interface Worktree {
+    id: string;
+    repo_id: string;
+    name: string;
+    path: string | null;
+    status: string;
+    device_id?: string;
+    repo_path?: string;
+    branch?: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface PortAllocation {
+    id: string;
+    repo_id: string;
+    port: number;
+    label: string;
+    server_type: string;
+    auto_start: string;
+    command: string | null;
+    working_dir: string | null;
+    env_vars: Json;
+    external_refs: Json;
+    worktree_id: string | null;
+    user_id: string | null;
+    created_at: string | null;
+    updated_at: string | null;
+}
+/** Desktop app server config types -- matches ~/.codebyplan/server-configs.json format */
+export interface DesktopServerConfig {
+    label: string;
+    port: number | null;
+    command: string;
+    server_type: string;
+    auto_start: string;
+}
+export interface DesktopWorktreeConfig {
+    name: string;
+    path: string;
+    cloud_id?: string;
+    servers: DesktopServerConfig[];
+}
+export interface DesktopRepoConfig {
+    name: string;
+    path: string;
+    servers: DesktopServerConfig[];
+    cloud_id?: string;
+    worktrees?: DesktopWorktreeConfig[];
+}
+export interface DesktopServerConfigsFile {
+    repos: DesktopRepoConfig[];
+}
+export interface ListResponse<T> {
+    data: T[];
+    count: number;
+}
+export interface SingleResponse<T> {
+    data: T;
+}
+export interface SyncFilesData {
+    commands: SyncFile[];
+    agents: SyncFile[];
+    skills: SyncFile[];
+    rules: SyncFile[];
+    hooks: SyncFile[];
+    claude_md: SyncFile[];
+    settings: SyncFile[];
+    templates: SyncFile[];
+    docs_stack: SyncFile[];
+    docs: SyncFile[];
+    contexts: SyncFile[];
+    global_settings: SyncFile[];
+}
+export interface SyncFile {
+    id?: string;
+    name: string;
+    content: string;
+    category?: string | null;
+    updated_at?: string;
+    scope?: string;
+    content_hash?: string | null;
+}
+export interface TechStackEntry {
+    name: string;
+    category: string;
+    /** Detected behavioural capabilities (e.g., "jsx", "node-server", "cli-bin"). Optional for backwards compat. */
+    capabilities?: string[];
+}
+export interface AppTechStack {
+    name: string;
+    path: string;
+    stack: TechStackEntry[];
+}
+export interface TechStackResult {
+    repo: TechStackEntry[];
+    apps: AppTechStack[];
+    flat: TechStackEntry[];
+}
+export interface TechStackRow {
+    id: string;
+    repo_id: string;
+    name: string;
+    version: string | null;
+    category: string | null;
+    source_path: string | null;
+    is_dev: boolean;
+    dep_type: string | null;
+    last_seen_at: string;
+    created_at: string;
+    updated_at: string;
+}
+export interface TechStackSyncPayload {
+    dependencies: {
+        name: string;
+        version?: string;
+        category?: string;
+        source_path?: string;
+        is_dev?: boolean;
+        dep_type?: string;
+    }[];
+}
+export interface TechStackSyncSession {
+    id: string;
+    repo_id: string;
+    user_id: string | null;
+    started_at: string;
+    completed_at: string | null;
+    upserted_count: number;
+    removed_count: number;
+    added_names: string[];
+    removed_names: string[];
+    version_changed_names: string[];
+    changed: boolean;
+    status: "in_progress" | "completed" | "failed";
+}
+export interface TaskTemplate {
+    id: string;
+    repo_id: string | null;
+    name: string;
+    description: string | null;
+    requirements: string | null;
+    trigger_type: string;
+    trigger_config: Json;
+    auto_create: boolean;
+    user_id: string | null;
+    default_branch: string | null;
+    instructions: string | null;
+    priority: number | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface SyncLock {
+    id: string;
+    user_id: string;
+    repo_id: string;
+    worktree_id: string | null;
+    locked_by: string;
+    reason: string | null;
+    locked_at: string;
+    expires_at: string;
+    created_at: string;
+}
+export interface SyncConflict {
+    id: string;
+    user_id: string;
+    repo_id: string;
+    claude_file_id: string;
+    conflict_type: string;
+    local_content: string | null;
+    remote_content: string | null;
+    base_content: string | null;
+    resolution_type: string | null;
+    resolved_content: string | null;
+    status: string;
+    sync_lock_id: string | null;
+    resolved_by_repo_id: string | null;
+    detected_at: string;
+    resolved_at: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface FileChange {
+    id: string;
+    repo_id: string;
+    checkpoint_id: string | null;
+    task_id: string | null;
+    round_id: string | null;
+    file_path: string;
+    action: string;
+    source: string;
+    claude_approved: boolean;
+    user_approved: boolean;
+    approval_locked: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface ClaudeFileRepo {
+    id: string;
+    claude_file_id: string;
+    repo_id: string;
+    last_synced_at: string | null;
+    last_synced_content_hash: string | null;
+    sync_status: string;
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * Contents of `.codebyplan/repo.json` — repo-level identity (committed).
+ * This is the sentinel file used by `findCodebyplanConfig` walk-up.
+ */
+export interface RepoConfig {
+    repo_id: string;
+    organization_id?: string;
+    project_id?: string;
+}
+/**
+ * Contents of `.codebyplan/server.json` — server/port config (committed).
+ * `codebyplan config` fills these in; setup writes stubs.
+ */
+export interface ServerConfig {
+    server_port: number | null;
+    server_type: string | null;
+    auto_push_enabled: boolean;
+    port_allocations: PortAllocation[];
+}
+/**
+ * Contents of `.codebyplan/server.local.json` — gitignored per-worktree
+ * port overlay. Written by `codebyplan ports --write-local`; never committed.
+ *
+ * Holds only the fields relevant to the active worktree's port allocation.
+ * Does NOT include `auto_push_enabled` (that lives only in server.json).
+ *
+ * `port_allocations` is typed `Partial<PortAllocation>[]`: the rows are an
+ * allowlist projection of the API response (see branch-port-resolver.ts
+ * ALLOWED_FIELDS), so any individual field may be absent. Readers
+ * (readServerLocalConfig) must treat each field as optional rather than
+ * assume a fully-populated PortAllocation.
+ */
+export interface ServerLocalConfig {
+    server_port: number | null;
+    server_type: string | null;
+    port_allocations: Partial<PortAllocation>[];
+}
+/**
+ * Contents of `.codebyplan/git.json` — branch strategy config (committed).
+ * `codebyplan config` fills these in; setup writes stubs.
+ */
+export interface GitConfig {
+    git_branch: string | null;
+    branch_config: Json | null;
+}
+/**
+ * Contents of `.codebyplan/shipment.json` — shipment surfaces config (committed).
+ * `codebyplan config` fills this in; setup writes stub.
+ */
+export interface ShipmentConfig {
+    shipment: Json | null;
+}
+/**
+ * Contents of `.codebyplan/vendor.json` — reserved (committed).
+ * Formerly held `vendor_docs_path`; removed in CHK-116 when the vendor/ filesystem
+ * mirror was retired in favour of DB-backed DocsByPlan MCP. Written as an empty
+ * stub for forward compatibility.
+ */
+export type VendorConfig = Record<string, never>;
+/**
+ * Per-framework configuration block within `.codebyplan/e2e.json`.
+ * Controls whether a given E2E framework is enabled, which app it targets,
+ * and framework-specific options (e.g. Playwright base_url, Maestro platforms).
+ */
+export interface E2eFrameworkConfig {
+    enabled: boolean;
+    app: string | null;
+    config_path: string | null;
+    auto_run: boolean;
+    test_dir?: string;
+    base_url?: string;
+    platforms?: Array<"android" | "ios">;
+}
+/**
+ * Credential variable names for a specific E2E framework within `.codebyplan/e2e.json`.
+ * Stores only the environment variable NAMES — never the secret values themselves.
+ */
+export interface E2eFrameworkCredentials {
+    email_var?: string;
+    password_var?: string;
+}
+/**
+ * Credential sourcing block within `.codebyplan/e2e.json`.
+ * Points to the gitignored env file that holds the secrets and records whether
+ * a provision script is available. The `frameworks` map holds only var names,
+ * never secret values.
+ */
+export interface E2eCredentials {
+    source: string;
+    gitignored: boolean;
+    provision_script: string | null;
+    frameworks: Record<string, E2eFrameworkCredentials>;
+}
+/**
+ * Contents of `.codebyplan/e2e.json` — E2E test framework configuration (committed,
+ * locally managed by /cbp-setup-e2e; NOT pulled from the DB).
+ *
+ * The at-rest stub written by setup/config is `{}` — both fields are optional so
+ * an empty object is a valid E2eConfig until /cbp-setup-e2e populates it.
+ *
+ * `frameworks` maps framework names (e.g. "playwright", "maestro") to their
+ * per-framework config. `credentials` holds only the env var NAMES and the path
+ * to the gitignored file that contains the actual secrets — secret values are
+ * never stored here.
+ */
+export interface E2eConfig {
+    frameworks?: Record<string, E2eFrameworkConfig>;
+    credentials?: E2eCredentials;
+}
+/**
+ * Per-app ESLint configuration entry within `.codebyplan/eslint.json`.
+ * Records which presets are enabled for one app/package (keyed by its
+ * `source_path` in the parent map), any user rule-severity overrides, and
+ * pointers to the relevant /cbp-setup-eslint reference docs. Holds NO rule
+ * bodies — those live in the DB ESLint presets and the generated
+ * `eslint.config.mjs`.
+ */
+export interface EslintAppConfig {
+    app: string;
+    enabled_presets: string[];
+    rule_overrides?: Record<string, "error" | "warn" | "off">;
+    config_path: string;
+    reference_docs?: string[];
+}
+/**
+ * Contents of `.codebyplan/eslint.json` — per-app ESLint setup state (committed,
+ * locally managed by /cbp-setup-eslint; NOT pulled from the DB).
+ *
+ * The at-rest stub written by setup/config/migration is `{}` — `apps` is optional
+ * so an empty object is a valid EslintLocalConfig until /cbp-setup-eslint populates
+ * it. `apps` maps each app/package `source_path` (e.g. "apps/web", or "." for a
+ * single-app repo) to its EslintAppConfig. The rules themselves live in the DB
+ * ESLint presets and the generated `eslint.config.mjs`; this file only records
+ * which presets are enabled per app so /cbp-setup-eslint can refresh idempotently.
+ */
+export interface EslintLocalConfig {
+    apps?: Record<string, EslintAppConfig>;
+}
+/**
+ * Per-module entry in `.codebyplan/architecture.json`.
+ * Written by `codebyplan arch-map stamp`; read by `status` and `drift` subcommands.
+ */
+export interface ArchitectureModuleEntry {
+    path: string;
+    map_file: string;
+    generated_from_sha: string | null;
+    depth: "skeleton" | "deep";
+    generated_at: string | null;
+}
+/**
+ * Contents of `.codebyplan/architecture.json` — module map manifest (committed).
+ * Written as an empty stub by `setup` and `config`; updated by `arch-map stamp`.
+ */
+export interface ArchitectureConfig {
+    version: number;
+    modules: ArchitectureModuleEntry[];
+}
+/**
+ * Contents of `.codebyplan/device.local.json` — per-device identity (gitignored).
+ * Written by setup and `writeLocalConfig`; never committed.
+ */
+export interface DeviceConfig {
+    device_id: string;
+}
+/**
+ * Per-line toggle configuration for the statusline renderer.
+ * All toggles default to `true` (all lines visible).
+ */
+export interface StatuslineLines {
+    identity: boolean;
+    context: boolean;
+    cost: boolean;
+    rate_limits: boolean;
+    repo_pr: boolean;
+    worktree: boolean;
+    infra_drift: boolean;
+    package_freshness: boolean;
+}
+/**
+ * Contents of `.codebyplan/statusline.json` — committed statusline config.
+ * Controls which line sections are rendered and whether ANSI colour is
+ * suppressed. Created on demand by `codebyplan statusline` and `setup`;
+ * never emitted by `codebyplan config` (no DB representation).
+ */
+export interface StatuslineConfig {
+    lines: StatuslineLines;
+    no_color: boolean;
+}
+/**
+ * Contents of `.codebyplan/statusline.local.json` — gitignored per-device
+ * renderer selection. Stores only the chosen runtime; absent means default
+ * to `"bash"`.
+ */
+export interface StatuslineLocalConfig {
+    renderer: "bash" | "node" | "python";
+}
+/**
+ * Aggregate type representing the full `.codebyplan/` directory layout.
+ * All committed files are required; device (local) is always present at runtime
+ * but gitignored.
+ */
+export interface CodebyplanLayout {
+    repo: RepoConfig;
+    server: ServerConfig;
+    git: GitConfig;
+    shipment: ShipmentConfig;
+    vendor: VendorConfig;
+    e2e: E2eConfig;
+    device: DeviceConfig;
+    /** Committed statusline toggle config (optional — absent until first `statusline` run or `setup`). */
+    statusline?: StatuslineConfig;
+    /** Gitignored per-device renderer selection (optional — absent until user picks a renderer). */
+    statuslineLocal?: StatuslineLocalConfig;
+}
+/** System-managed ESLint configuration preset (mirrors eslint_presets table). */
+export interface EslintPreset {
+    id: string;
+    name: string;
+    description: string | null;
+    tech_match: Json;
+    rules: Json;
+    dependencies: Json;
+    config_fragment: string | null;
+    display_order: number;
+    is_system: boolean;
+    user_id: string | null;
+    created_at: string;
+    updated_at: string;
+}
+/** Shape of eslint_presets.tech_match JSONB column. */
+export interface EslintPresetTechMatch {
+    /**
+     * Tech-name requirements (legacy gate). When present and non-empty, every
+     * listed tech must be in the query's tech list for the preset to match.
+     *
+     * Optional because capability-only presets (e.g., `cli`) gate entirely on
+     * `requires_capabilities` and omit `requires` from the DB shape. See
+     * migration `20260424074737_eslint_cli_preset_capability_only.sql`.
+     */
+    requires?: string[];
+    excludes?: string[];
+    /**
+     * Optional strict capability gate. When present with at least one entry, the preset
+     * matches only if ALL listed capabilities are present in the detected set.
+     *
+     * An empty array `[]` behaves identically to omitting the field — the preset is
+     * NOT gated (vacuously passes `.every()`). Use a non-empty array to declare
+     * strict capability requirements; omit the field to skip the capability gate.
+     *
+     * See also: `route.ts` strict D5 semantics (absent `capabilities` query param =
+     * empty set, presets with non-empty `requires_capabilities` do NOT match).
+     */
+    requires_capabilities?: string[];
+}
+/** Per-repo per-app ESLint configuration state (mirrors eslint_repo_configs table). */
+export interface EslintRepoConfig {
+    id: string;
+    repo_id: string;
+    source_path: string;
+    active_preset_ids: string[];
+    rule_overrides: Json;
+    generated_hash: string | null;
+    last_synced_at: string | null;
+    created_at: string;
+    updated_at: string;
+}
+/** GET response shape with resolved presets attached. */
+export interface EslintRepoConfigWithPresets extends EslintRepoConfig {
+    presets: EslintPreset[];
+}
+export interface AutoPushResult {
+    pushed: boolean;
+    message: string;
+    error?: string;
+}
+export interface PromotionResult {
+    promoted: boolean;
+    pr_url: string | null;
+    pr_number: number | null;
+    checklist_id: string | null;
+    message: string;
+    error?: string;
+}
+export interface MergeChecklistTemplate {
+    id: string;
+    repo_id: string;
+    scope: "repo" | "branch_level";
+    branch_level: string | null;
+    title: string;
+    description: string | null;
+    order: number;
+    is_required: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface MergeChecklistItem {
+    title: string;
+    description: string | null;
+    is_required: boolean;
+    checked: boolean;
+    checked_at: string | null;
+}
+export interface MergeChecklist {
+    id: string;
+    checkpoint_id: string;
+    template_id: string | null;
+    branch_level: string;
+    title: string;
+    status: string;
+    completed_at: string | null;
+    completed_by: string | null;
+    pr_url: string | null;
+    pr_number: number | null;
+    items: MergeChecklistItem[];
+    created_at: string;
+    updated_at: string;
+}
+/**
+ * CI check categories — maps to the stages a CI pipeline runs.
+ * Includes "audit" for dependency security scanning (e.g. pnpm audit).
+ */
+export type CiCategory = "unit_test" | "typecheck" | "build" | "lint" | "e2e" | "audit";
+/**
+ * Scope of a CI check — whether it runs only on changed apps or across the
+ * full repo regardless of what changed.
+ */
+export type CiScope = "per_app_changed" | "full_repo";
+/**
+ * A single CI check within a platform.
+ *
+ * When `delegates_to` is set, the check configuration lives in a separate
+ * sibling config file (e.g. `.codebyplan/eslint.json` for lint,
+ * `.codebyplan/e2e.json` for e2e). In that case `command` is omitted — the
+ * owning skill reads the delegate file for command resolution.
+ */
+export interface CiCheck {
+    /** Shell command to run. Omitted when delegates_to is set. */
+    command?: string;
+    /** Whether this check applies to changed apps only or the full repo. */
+    scope: CiScope;
+    /** Whether a failure in this check blocks the PR/merge. */
+    hard_fail: boolean;
+    /**
+     * Path to the config file that owns this check category.
+     * Set for lint (→ .codebyplan/eslint.json) and e2e (→ .codebyplan/e2e.json).
+     */
+    delegates_to?: string;
+}
+/**
+ * The set of CI checks configured for one platform (e.g. next_js, nestjs).
+ * All categories are optional — a platform that has no e2e, for example,
+ * simply omits that key.
+ */
+export type CiPlatformChecks = Partial<Record<CiCategory, CiCheck>>;
+/**
+ * Top-level delegation pointers — config files that own specific check
+ * categories across all platforms. Matching the per-check `delegates_to`
+ * field but at the config level for quick lookup.
+ */
+export interface CiDelegation {
+    /** Path to eslint.json — owns lint config for all platforms. */
+    lint?: string;
+    /** Path to e2e.json — owns e2e config for all platforms. */
+    e2e?: string;
+    /** Reference doc that is the authoritative platform-detection source. */
+    detection?: string;
+}
+/**
+ * GitHub Actions CI workflow enforcement state.
+ * Mirrors `.codebyplan/shipment.json` `branching_configured.required_check_enforced`
+ * pattern for idempotent CLI runs.
+ */
+export interface CiWorkflowConfig {
+    /** Whether the required GitHub status check has been enforced via API or UI. */
+    required_check_enforced: boolean;
+    /** ISO timestamp of when the check was enforced. */
+    required_check_enforced_at?: string;
+}
+/**
+ * Contents of `.codebyplan/ci.json` — per-platform CI check configuration
+ * (committed, locally managed by `codebyplan ci init`).
+ *
+ * `platforms` maps each detected platform slug (e.g. "next_js", "nestjs",
+ * "tauri", "package") to its CiPlatformChecks. Lint and e2e checks within
+ * each platform carry a `delegates_to` pointer to the owning config file
+ * rather than an inline `command`.
+ *
+ * The top-level `delegation` block mirrors the per-check `delegates_to` values
+ * for quick config-level lookup by scripts and skills.
+ */
+export interface CiConfig {
+    /** Per-platform CI check configuration, keyed by platform slug. */
+    platforms: Record<string, CiPlatformChecks>;
+    /** Top-level pointers to sibling config files that own specific check categories. */
+    delegation: CiDelegation;
+    /** Workflow-level enforcement state (required GitHub status check). */
+    workflow: CiWorkflowConfig;
+}
+/**
+ * Trigger event that causes a CD pipeline to run for a surface.
+ */
+export type CdTrigger = "push-to-main" | "release-tags" | "workflow_dispatch";
+/**
+ * Configuration for a single CD deployment surface (e.g. npm, tauri, vercel).
+ *
+ * Credentials are represented only by their environment variable NAMES — never
+ * by their actual secret values. Secret values are never stored in this config.
+ */
+export interface CdSurface {
+    /** The event that triggers this surface's CD pipeline. */
+    trigger: CdTrigger;
+    /**
+     * Optional path filter for the push trigger. When set, the pipeline only
+     * fires when the push touches files matching this glob (e.g.
+     * "packages/codebyplan-package/**" for the npm surface).
+     */
+    path_filter?: string;
+    /** Optional deployment environment name (e.g. "production", "staging"). */
+    environment?: string;
+    /**
+     * Whether a human approval gate is required before deployment. Maps to a
+     * GitHub Actions `environment` with a protection rule when true.
+     */
+    approval_required: boolean;
+    /**
+     * Whether OIDC-based short-lived credentials are used instead of long-lived
+     * API keys or tokens. True for npm Trusted Publishing; false for surfaces that
+     * use static secrets.
+     */
+    oidc_auth: boolean;
+    /**
+     * Whether the pipeline enforces a version gate before deploying
+     * (e.g. skip if the version is already published / the tag already exists).
+     */
+    version_gate: boolean;
+    /**
+     * Whether `codebyplan cd scaffold-workflow` generates a GitHub Actions
+     * workflow for this surface. True for npm (publish.yml) and tauri
+     * (release-desktop.yml); false for surfaces recorded as deploy policy only
+     * (e.g. vercel / railway / supabase) that have no auto-scaffolded workflow yet.
+     */
+    auto_scaffolded_workflow?: boolean;
+    /**
+     * Credential references for this surface — env var NAMES and optional
+     * pointer to a gitignored env file. Secret values are NEVER stored here.
+     */
+    credentials?: {
+        /** Names of the environment variables that carry secrets for this surface. */
+        env_var_names: string[];
+        /**
+         * Optional path to a gitignored env file that holds the secrets (e.g.
+         * ".env.local"). Never committed; never contain values here.
+         */
+        gitignored_env_file?: string;
+    };
+}
+/**
+ * Canonical CD surface identifiers. Extensible — callers may also use arbitrary
+ * string keys for custom/unknown surfaces.
+ */
+export type CdSurfaceId = "vercel" | "eas" | "npm" | "tauri" | "railway" | "supabase" | "vscode";
+/**
+ * Workflow-level CD state — tracks whether the GitHub Actions workflow files
+ * have been scaffolded into the project.
+ */
+export interface CdWorkflowConfig {
+    /** Whether the CD workflow YAML files have been written by `codebyplan cd scaffold-workflow`. */
+    workflows_scaffolded: boolean;
+    /** ISO timestamp of when the workflows were last scaffolded. */
+    scaffolded_at?: string;
+    /**
+     * Whether the npm OIDC Trusted Publisher rule has been verified on npmjs.com
+     * (recorded by `cbp-setup-cd` Step 7). Optional — absent until that step runs.
+     */
+    npm_oidc_publisher_verified?: boolean;
+}
+/**
+ * Contents of `.codebyplan/cd.json` — per-surface CD configuration
+ * (committed, locally managed by `codebyplan cd init`).
+ *
+ * `surfaces` maps each CD surface slug (e.g. "npm", "tauri", "vercel") to its
+ * CdSurface config. Surface detection is driven by `.codebyplan/shipment.json`
+ * surface keys — policy-explicit, NOT filesystem-inferred.
+ *
+ * Credentials are represented only by env var NAMES — secret values are never
+ * stored here or committed to the repo.
+ */
+export interface CdConfig {
+    /**
+     * Per-surface CD configuration. Keys are CdSurfaceId values or custom
+     * surface slugs matching shipment.json surface keys.
+     */
+    surfaces: Partial<Record<string, CdSurface>>;
+    /** Workflow-level scaffolding state. */
+    workflow: CdWorkflowConfig;
+}
+//# sourceMappingURL=types.d.ts.map