gutterpress 0.10.0 → 0.10.1-beta.1

package/dist/lib/remote-auth/transport.d.ts

@@ -1,6 +1,5 @@
 import httpNode from "isomorphic-git/http/node";
 import { type HostCredential, type TokenStore } from "./token-store.ts";
-import type { OperationLogger } from "./operation-log.ts";
 import type { GitCache, RemoteTransport } from "./sync-types.ts";
 /**
  * The git repo directory for a project dir. A project IS its git repo, so this
@@ -17,6 +16,19 @@ export declare function repoDirFor(projectDir: string): Promise<string>;
  * http carries no network exposure, so it stays allowed.
  */
 export declare function isCredentialTransmissionSafe(url: string): boolean;
+/**
+ * Thrown by {@link onAuthFor} when a stored credential EXISTS but the remote
+ * URL fails {@link isCredentialTransmissionSafe} (non-loopback http). Loud and
+ * typed on purpose: the old behavior (silently withholding the credential)
+ * surfaced as a 401 → "auth" → "reconnect" loop. The `code` string is the
+ * STABLE contract (matchable across dynamic-import boundaries).
+ */
+export declare class InsecureTransportError extends Error {
+    readonly code = "InsecureTransport";
+    constructor();
+}
+/** Type guard for {@link InsecureTransportError} (matches on the stable code). */
+export declare function isInsecureTransportError(e: unknown): e is InsecureTransportError;
 export declare function onAuthFor(credential: HostCredential | undefined): {
     onAuth?: undefined;
 } | {
@@ -35,13 +47,19 @@ export declare function resolveTransport(dir: string, options: {
     tokenStore?: TokenStore;
 }): Promise<RemoteTransport>;
 /**
- * The failure arms shared verbatim by {@link SyncOutcome}, {@link PullOutcome}
- * and {@link PushOutcome} — so one classifier serves all three operations.
- * Decoding delegates to the shared recovery classifier
- * (classifyTransportFailure): auth_required → "auth", network_unavailable →
- * "offline", insecure_transport → "error" with its dedicated message (NEVER
- * "auth" — reconnecting can't fix an http:// address, and the auth recovery
- * path deletes the stored credential), anything else → the generic "error" arm.
+ * Decode a thrown transport error into the outcome it maps to, or null when it
+ * is not a transport failure at all. The single source of truth for transport
+ * error decoding — sync.ts and clone.ts consume it rather than keeping
+ * parallel copies.
+ */
+export declare function classifyTransportFailure(e: unknown): "auth_required" | "network_unavailable" | "insecure_transport" | null;
+/**
+ * The failure arms of {@link SyncOutcome}. Decoding delegates to
+ * {@link classifyTransportFailure}: auth_required → "auth",
+ * network_unavailable → "offline", insecure_transport → "error" with its
+ * dedicated message (NEVER "auth" — reconnecting can't fix an http:// address,
+ * and the auth recovery path deletes the stored credential), anything else →
+ * the generic "error" arm.
  */
 export declare function failureOutcome(e: unknown, snapshotId?: string): {
     status: "auth" | "offline" | "error";
@@ -51,7 +69,7 @@ export declare function failureOutcome(e: unknown, snapshotId?: string): {
 /** Friendly setup-problem message for the expected gate errors, else null. */
 export declare function setupErrorMessage(e: unknown): string | null;
 /**
- * Snapshot-first step shared by syncProject / pullChanges / pushChanges
+ * Snapshot-first step used by syncProject
  * (ADR 0006 D5): commit any unsaved work in the WHOLE repo BEFORE any network
  * or merge step, so a forced post-merge checkout can never discard it. The
  * working-tree check runs lazily at action time on the caller's function-scoped
@@ -65,44 +83,28 @@ export declare function snapshotBeforeAction(args: {
     authorEmail?: string;
     cache: GitCache;
 }): Promise<string | undefined>;
-/**
- * Structural preflight — never touch the tree of a damaged repo. An interrupted
- * merge/rebase/cherry-pick, detached HEAD, stale lock, or missing `.git` must be
- * REPAIRED before any sync work: snapshot-first would otherwise commit whatever
- * is on disk (e.g. the literal conflict markers a half-done native-git merge
- * leaves in tracked files) and push it to every collaborator. Throwing the
- * typed error routes the caller through the recover() path.
- * `checkLocalChanges: false` — only the structural flags matter here.
- *
- * Runs INSIDE the caller's repo lock. Shared by pullChanges and pushChanges.
- */
-export declare function assertNoStructuralDamage(projectDir: string, logger: OperationLogger): Promise<void>;
 export declare function currentBranchOrThrow(dir: string): Promise<string>;
 /**
- * Run `fn` (a fetch that moves remote-tracking refs) with a rollback guard
- * (deep-analysis R15): isomorphic-git updates refs/remotes/<remote>/* from
- * the ref advertisement BEFORE collecting the packfile, so an abort
- * mid-transfer (e.g. the defaultGitHttp idle timeout) leaves refs pointing
- * at oids with no local object. Such a dangling ref poisons the next fetch —
+ * Run `fn` (a fetch that moves ONE remote-tracking ref) with a rollback guard
+ * (deep-analysis R15): isomorphic-git updates `refs/remotes/<remote>/<branch>`
+ * from the ref advertisement BEFORE collecting the packfile, so an abort
+ * mid-transfer (e.g. the defaultGitHttp idle timeout) leaves the ref pointing
+ * at an oid with no local object. Such a dangling ref poisons the next fetch —
  * zero `have`s → the server streams the ENTIRE repository (the OOM
- * fetchRemoteTip's `ref` choice exists to prevent) — and resolving it reports
+ * `fetchRemoteTip`'s `ref` choice exists to prevent) — and resolving it reports
  * missing-object "corruption" on a never-corrupt repo.
  *
- * `listRefs` names the refs at risk; it runs again after a throw so refs
- * CREATED by `fn` are covered too. If `fn` throws, every ref that moved to an
- * oid whose object is MISSING locally is restored to its previous oid (or
- * deleted if it didn't exist); refs whose objects DID land are kept — the
- * pack made it. On success no ref is touched. Restoration is best-effort,
- * per ref, and never masks `fn`'s error.
+ * If `fn` throws and the ref moved to an oid whose object is MISSING locally,
+ * it is restored to its previous oid (or DELETED if it did not exist before).
+ * A ref whose object DID land is kept — the pack made it. On success no ref is
+ * touched.
+ *
+ * Every read here is best-effort and never masks `fn`'s error: a damaged ref
+ * store must not block the guarded fetch, because the recovery handlers run on
+ * exactly such repos and skipping `fn` would skip the repair itself. An
+ * unreadable pre-scan simply degrades to the delete-if-dangling arm.
  */
-export declare function guardRefs<T>(dir: string, listRefs: () => Promise<string[]>, cache: GitCache, fn: () => Promise<T>): Promise<T>;
-/** Single-ref form of {@link guardRefs} — guards one remote-tracking ref. */
 export declare function guardTrackingRef<T>(dir: string, ref: string, cache: GitCache, fn: () => Promise<T>): Promise<T>;
-/**
- * Remote-wide form of {@link guardRefs} for a fetch that may move or create
- * ANY refs/remotes/<remote>/* ref (e.g. `singleBranch: false`).
- */
-export declare function guardRemoteRefs<T>(dir: string, remote: string, cache: GitCache, fn: () => Promise<T>): Promise<T>;
 /**
  * Fetch the tracked branch's online tip. Returns `null` when the online
  * repository has no such branch yet (a freshly created empty repo).

package/dist/lib/source-provider.d.ts

@@ -38,6 +38,18 @@ export interface SnapshotOptions {
     repoRoot?: string;
     /** Optional log file for debugging snapshot operations. */
     logFile?: string;
+    /**
+     * The CALLER's object cache, when the snapshot is one step of a longer
+     * locked operation (sync). Committing rewrites `.git/index`, and
+     * isomorphic-git's index cache invalidates on a stat comparison that can
+     * miss a same-second rewrite of the same size — so a caller that keeps
+     * using its own cache afterwards would keep reading the PRE-snapshot index.
+     * That is not cosmetic: `git.checkout` derives STAGE from it, and a stale
+     * STAGE makes an unmodified file look locally modified. Pass the cache and
+     * the snapshot's own `git.add`/`git.commit` refresh it in place. Omit it
+     * for standalone snapshots — they get a private cache, released on return.
+     */
+    cache?: GitCache;
 }
 /**
  * The git repo directory a project's operations run against. A project IS its

package/dist/{lint-p2sw53d9.js → lint-p6a4bkvh.js}

@@ -1,21 +1,21 @@
 import {
   MANIFEST_FILENAMES,
   runLint
-} from "./cli-eq5naw4m.js";
+} from "./cli-df7gcyns.js";
 import {
   log
-} from "./cli-cqtggsng.js";
+} from "./cli-mcb484g3.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-dx6sxj2t.js";
+import"./cli-ak1tagkr.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/dist/{new-hvq0x91q.js → new-4cdzfbsj.js}

@@ -5,23 +5,23 @@ import {
   TARGETS,
   TARGET_IDS,
   scaffoldProject
-} from "./cli-eq5naw4m.js";
+} from "./cli-df7gcyns.js";
 import {
   resolveGhostscript
-} from "./cli-cqtggsng.js";
+} from "./cli-mcb484g3.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-dx6sxj2t.js";
+import"./cli-ak1tagkr.js";
 import {
   isToolAvailable
 } from "./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/dist/{plugin-pssmk0dx.js → plugin-a89tqspy.js}

@@ -1,19 +1,19 @@
 import {
   addNpmPlugin,
   parseNpmPluginSpec
-} from "./cli-eq5naw4m.js";
-import"./cli-cqtggsng.js";
+} from "./cli-df7gcyns.js";
+import"./cli-mcb484g3.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-dx6sxj2t.js";
+import"./cli-ak1tagkr.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/dist/{preflight-4j00yd0g.js → preflight-r4y3f8f9.js}

@@ -2,21 +2,21 @@ import {
   executeValidation,
   publishTargetFor,
   reportMissingTools
-} from "./cli-eq5naw4m.js";
+} from "./cli-df7gcyns.js";
 import {
   log
-} from "./cli-cqtggsng.js";
+} from "./cli-mcb484g3.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-dx6sxj2t.js";
+import"./cli-ak1tagkr.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/dist/{preview-d4s6gk6p.js → preview-k8n2kew7.js}

@@ -6,10 +6,10 @@ import {
   runBuild,
   splitOutPath,
   startPreviewServer
-} from "./cli-eq5naw4m.js";
+} from "./cli-df7gcyns.js";
 import {
   log
-} from "./cli-cqtggsng.js";
+} from "./cli-mcb484g3.js";
 import {
   UsageError,
   parseEngine,
@@ -18,13 +18,13 @@ import {
   rejectExtraPositionals,
   rejectUnknownFlags,
   resolvePort
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-dx6sxj2t.js";
+import"./cli-ak1tagkr.js";
 import"./cli-c41yr7he.js";
 import {
   BuildError
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/dist/{publish-tkc26en7.js → publish-jnhjp2vd.js}

@@ -7,22 +7,22 @@ import {
   publishCredentialKey,
   publishProviderFor,
   runPublish
-} from "./cli-eq5naw4m.js";
+} from "./cli-df7gcyns.js";
 import {
   FileTokenStore,
   log
-} from "./cli-cqtggsng.js";
+} from "./cli-mcb484g3.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-dx6sxj2t.js";
+import"./cli-ak1tagkr.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/dist/{source-provider-3tcj6qg2.js → source-provider-2j5x2hyw.js}

@@ -16,7 +16,7 @@ import {
   snapshotWorkingTreeUnlocked,
   stageChanges,
   withRepoLock
-} from "./cli-k1065rkg.js";
+} from "./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 export {

package/dist/{source-provider-vanafrt9.js → source-provider-kn41jmbs.js}

@@ -16,7 +16,7 @@ import {
   snapshotWorkingTreeUnlocked,
   stageChanges,
   withRepoLock
-} from "./index-mdefp0y5.js";
+} from "./index-dtrftayr.js";
 import"./index-v5mp7a6q.js";
 import"./index-37x76zdn.js";
 export {

package/dist/{validate-w9vfefrw.js → validate-prnybpkx.js}

@@ -1,20 +1,20 @@
 import {
   executeAndReport
-} from "./cli-eq5naw4m.js";
+} from "./cli-df7gcyns.js";
 import {
   log
-} from "./cli-cqtggsng.js";
+} from "./cli-mcb484g3.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-dx6sxj2t.js";
+import"./cli-ak1tagkr.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gutterpress",
-  "version": "0.10.0",
+  "version": "0.10.1-beta.1",
   "description": "Markdown-to-PDF converter for professional print layout using a native Chromium print engine and Ghostscript.",
   "author": "itlackey",
   "license": "MPL-2.0",

package/dist/lib/app-heartbeat.d.ts

@@ -1,102 +0,0 @@
-/**
-  * app-heartbeat.ts — detect a running Gutterpress app before a CLI repair
- * mutates the repo.
- *
- * WHY: `gutterpress repair` and the desktop's own recovery path both call into
- * the recovery subsystem, but each runs in its own OS process. The per-repo
- * FIFO lock (source-provider.ts) only serializes operations WITHIN a process,
- * so `gutterpress repair` run from a terminal while the desktop has the same
- * project open can race a live sync/snapshot. Rather than build a
- * cross-process lock manager, the desktop leaves a small liveness marker
- * behind while a project is open, and `repair` checks it before mutating.
- *
- * The marker lives at `<repoDir>/.git/gutterpress-app-heartbeat` (NOT in
- * userData) so `repair`, given only a repo directory, can find it without any
- * knowledge of the desktop's install. It is deliberately NOT a lock:
- *   - It never blocks the desktop itself, or any other repair run with --force.
- *   - It carries no locking semantics — just "an app touched this repo
- *     recently, maybe check before you assume it's idle".
- *   - It is written best-effort (a failed write must never surprise the
- *     author with a crash) and read best-effort (a missing/corrupt file
- *     means "no app appears to have this open", not an error).
- *
- * Two invariants that keep this file inert to the rest of the recovery
- * subsystem:
- *   - Filename does not match any pattern `findLockCandidates` scans
- *     (recover-stale-lock.ts: fixed top-level `*.lock` names + `refs/**`) —
- *     so stale-lock recovery can never see or remove it.
- *   - It lives under `.git`, which `hasPendingChanges`/`listWorkdirChanges`
- *     (source-provider.ts) always ignores (`git.isIgnored` treats a `.git`
- *     path segment as ignored unconditionally) — so it can never look like an
- *     uncommitted author change.
- */
-/**
- * Fallback freshness window used only when a heartbeat carries no `ttlMs`
- * (an older writer, or one with no cadence to report). Prefer a
- * cadence-derived TTL — see {@link heartbeatTtlMs} — since the actual
- * refresh cadence ranges 1 min–24 h (AUTO_SYNC_MIN/MAX_MINUTES,
- * host-policy.ts) and a fixed 2-minute window reads a live app as "closed"
- * for most of any longer cadence.
- */
-export declare const APP_HEARTBEAT_FRESH_MS: number;
-export interface AppHeartbeat {
-    /** PID of the process that wrote the heartbeat (diagnostic only — never
-     *  used to `kill`/signal anything). */
-    pid: number;
-    /** Epoch ms the heartbeat was last (re)written. */
-    timestamp: number;
-    /**
-     * Freshness window (ms) the writer says applies to THIS heartbeat, derived
-     * from its own refresh cadence (see {@link heartbeatTtlMs}). When present,
-     * `isAppHeartbeatFresh` honors it instead of its `maxAgeMs` fallback param —
-     * the writer knows how often it actually refreshes; the reader doesn't.
-     */
-    ttlMs?: number;
-}
-/**
- * The freshness window a heartbeat writer should stamp for a given refresh
- * cadence (the actual interval this writer refreshes the marker on — e.g.
- * `autoSyncDelayMs(settings.versionHistory)`). `null` (feature disabled, no
- * periodic refresh at all) falls back to {@link APP_HEARTBEAT_FRESH_MS}.
- *
- * Standard heartbeat rule: TTL should comfortably exceed the refresh period
- * so one missed/delayed tick doesn't read as "closed". Exported so both the
- * desktop (the writer, which knows its own cadence) and tests can compute it
- * consistently.
- */
-export declare function heartbeatTtlMs(periodicMs: number | null): number;
-/** Absolute path to the heartbeat marker for a repo. */
-export declare function appHeartbeatPath(repoDir: string): string;
-/**
- * Write/refresh the heartbeat marker. Best-effort: a failed write (missing
- * `.git` dir, read-only filesystem, …) is swallowed — it must never surface
- * as an error to the author, since it is only ever a background liveness
- * signal, not a required operation.
- *
- * `ttlMs`, when supplied, should be {@link heartbeatTtlMs} applied to this
- * writer's OWN actual refresh cadence — it is stamped into the marker so a
- * reader with no knowledge of that cadence still judges freshness correctly.
- * Omit it (or pass `undefined`) when the caller has no cadence to report; the
- * reader then falls back to its own `maxAgeMs` default.
- */
-export declare function writeAppHeartbeat(repoDir: string, now?: number, pid?: number, ttlMs?: number): Promise<void>;
-/**
- * Remove the heartbeat marker (project close / app quit). Best-effort: an
- * already-missing or unreadable file is not an error.
- */
-export declare function removeAppHeartbeat(repoDir: string): Promise<void>;
-/**
- * Read + parse the heartbeat marker. Returns `null` when absent, unreadable,
- * or corrupt (never throws — a damaged heartbeat is just "no signal").
- */
-export declare function readAppHeartbeat(repoDir: string): Promise<AppHeartbeat | null>;
-/**
- * True when a FRESH heartbeat exists for this repo — i.e. the gutterpress app
- * appears to have this project open right now. Absent/stale/corrupt all read
- * as "not open" (fail open: `repair` should not block on ambiguous signal).
- *
- * Freshness window: the heartbeat's own stamped `ttlMs` (derived from the
- * writer's actual refresh cadence — see {@link heartbeatTtlMs}) wins when
- * present; `maxAgeMs` is only a fallback for a heartbeat with none.
- */
-export declare function isAppHeartbeatFresh(repoDir: string, now?: number, maxAgeMs?: number): Promise<boolean>;

package/dist/lib/remote-auth/image-clash.d.ts

@@ -1,17 +0,0 @@
-/** Read one version's exact bytes by BLOB oid. */
-export declare function readImageVersion(options: {
-    projectDir: string;
-    oid: string;
-}): Promise<Uint8Array>;
-/**
- * Keep a specific version of a clashing image: write the blob's exact bytes
- * to the file and snapshot. Serialized on the per-repo lock like every other
- * mutating operation.
- */
-export declare function keepImageVersion(options: {
-    projectDir: string;
-    path: string;
-    oid: string;
-    authorName?: string;
-    authorEmail?: string;
-}): Promise<void>;

package/dist/lib/remote-auth/recovery/classify.d.ts

@@ -1,97 +0,0 @@
-/**
- * Error/health classification for sync + repair — the SINGLE source of truth.
- *
- * 2026-08-14 simplification (owner directive): the 17-kind SyncErrorKind
- * taxonomy and its 16 per-kind handlers are gone. Every structural problem a
- * repo can have now has ONE answer — `repairRepo()` (repair.ts) — so
- * classification collapses to three health verdicts:
- *
- *   - null           — healthy, nothing to do
- *   - "stale_lock"   — a leftover lock old enough to sweep
- *   - "needs_repair" — anything structural (missing/corrupt `.git`, broken
- *                      ref store, detached HEAD, interrupted merge/rebase/
- *                      cherry-pick left by an external tool)
- *
- * The transport decoders (auth/offline/insecure) and the merge/push guards
- * used by sync.ts remain here unchanged — outcome mapping, not repair.
- * This module is pure — no I/O, no side effects.
- */
-import type { RepoHealth } from "./types.ts";
-/**
- * Minimum age before a leftover git lock counts as STALE. locks.ts imports
- * this same constant as its sweep threshold, so preflight and sweep can never
- * disagree: a lock young enough to pass preflight is exactly a lock the sweep
- * would defer ("a live process may still hold it").
- */
-export declare const STALE_LOCK_MIN_AGE_MS: number;
-/** The collapsed repair taxonomy — see the module header. */
-export type RepairNeed = "stale_lock" | "needs_repair";
-/**
- * Thrown by sync's structural preflight when the repo must be repaired before
- * any sync work can safely run. The `code` string is the STABLE contract
- * hosts may match on across the dynamic-import boundary (where `instanceof`
- * is unreliable); `kind` says whether a lock sweep suffices or the full
- * repair pipeline is needed.
- */
-export declare class RepoNeedsRecoveryError extends Error {
-    readonly kind: RepairNeed;
-    readonly code = "RepoNeedsRecovery";
-    constructor(kind: RepairNeed);
-}
-/** Type guard for {@link RepoNeedsRecoveryError} (matches on the stable code). */
-export declare function isRepoNeedsRecoveryError(e: unknown): e is RepoNeedsRecoveryError;
-/**
- * Thrown by transport.ts's onAuth when a stored credential EXISTS but the
- * remote URL fails isCredentialTransmissionSafe (non-loopback http). Loud and
- * typed on purpose: the old behavior (silently withholding the credential)
- * surfaced as a 401 → "auth" → "reconnect" loop. The `code` string is the
- * STABLE contract (matchable across dynamic-import boundaries).
- */
-export declare class InsecureTransportError extends Error {
-    readonly code = "InsecureTransport";
-    constructor();
-}
-/** Type guard for {@link InsecureTransportError} (matches on the stable code). */
-export declare function isInsecureTransportError(e: unknown): e is InsecureTransportError;
-export declare function isPushRejected(e: unknown): boolean;
-/** Type guard exposing MergeConflictError's per-file payload (converge-merge). */
-export declare function isMergeConflictError(e: unknown): e is {
-    data: {
-        filepaths: string[];
-        bothModified: string[];
-        deleteByUs: string[];
-        deleteByTheirs: string[];
-    };
-};
-/**
- * Unrelated histories — the local project and the configured online project
- * share no common starting point. Sync surfaces this as a plain setup error
- * (a wrong online address must never be silently spliced into the book).
- */
-export declare function isUnrelatedHistories(e: unknown): boolean;
-export declare function classifyTransportFailure(e: unknown): "auth_required" | "network_unavailable" | "insecure_transport" | null;
-/**
- * True when a thrown error smells like LOCAL repo corruption (unreadable
- * objects/refs/index) rather than a transport or logic failure — the signal
- * for a host's mid-sync catch to run `repairRepo()`. NOTE on NotFoundError
- * ambiguity: a transport 404 also surfaces as NotFoundError, but
- * transport.ts's fetchRemoteTip rewrites those to an HttpError(401) BEFORE
- * they can reach this heuristic, so a raw NotFoundError here is a LOCAL
- * ref-resolution failure.
- */
-export declare function isLikelyRepoCorruption(e: unknown): boolean;
-/**
- * Classify a repo's structural condition from a RepoHealth snapshot.
- * Returns null for a healthy repo, "stale_lock" when the only problem is a
- * sweepable lock, and "needs_repair" for everything structural — the repair
- * pipeline (repair.ts) handles every structural case in one ordered pass, so
- * finer distinctions buy nothing.
- *
- * `minLockAgeMs` gates the stale-lock verdict: at preflight (the default) a
- * younger lock is treated as healthy because a live process may still hold
- * it. Error-path callers pass 0: a lock that just made a sync THROW is worth
- * routing regardless of age (the sweep still defers while it is fresh).
- */
-export declare function classifyFromHealth(health: RepoHealth, opts?: {
-    minLockAgeMs?: number;
-}): RepairNeed | null;