gutterpress 0.10.0 → 0.10.1-beta.2

package/dist/{index-wq3r5pj7.js → index-p0ebr7dh.js}

@@ -4,7 +4,7 @@ import {
   launchChromium,
   marginBoxAlign,
   marginBoxRectPt
-} from "./index-ycpvr0am.js";
+} from "./index-7hrvksrb.js";
 
 // src/engine/compiler/build.ts
 import { readFile } from "node:fs/promises";
@@ -1282,6 +1282,62 @@ var DESC_JS = `(el) => {
     const src = el.tagName === "IMG" ? " src=" + (el.getAttribute("src") || "").slice(-40) : "";
     return el.tagName.toLowerCase() + cls + src;
   }`;
+var ABS_CONTAINING_BLOCK_JS = `(cs) => {
+    if (cs.position !== "static") return true;
+    for (const prop of [
+      "transform", "translate", "rotate", "scale", "perspective",
+      "filter", "backdropFilter",
+    ]) {
+      const value = cs[prop];
+      if (value && value !== "none") return true;
+    }
+    if (/\\b(layout|paint|strict|content)\\b/.test(cs.contain)) return true;
+    if (cs.containerType && cs.containerType !== "normal") return true;
+    return /\\b(transform|translate|rotate|scale|perspective|filter)\\b/.test(cs.willChange);
+  }`;
+var CLIP_EDGES_JS = `((establishesAbsContainingBlock) => {
+    const open = () => ({ left: -Infinity, right: Infinity, top: -Infinity, bottom: Infinity });
+    const rootStyle = getComputedStyle(document.documentElement);
+    const propagates = (a, rootOverflow) =>
+      a === document.documentElement ||
+      (a === document.body && rootOverflow === "visible");
+    return (el) => {
+      const edges = open();
+      const chain = [];
+      const elStyle = getComputedStyle(el);
+      const fixed = elStyle.position === "fixed";
+      let binds = !fixed && elStyle.position !== "absolute";
+      for (let a = el.parentElement; a; a = a.parentElement) {
+        const cs = getComputedStyle(a);
+        if (!fixed && !binds && establishesAbsContainingBlock(cs)) binds = true;
+        const own = open();
+        const clipsX =
+          binds && cs.overflowX !== "visible" && !propagates(a, rootStyle.overflowX);
+        const clipsY =
+          binds && cs.overflowY !== "visible" && !propagates(a, rootStyle.overflowY);
+        if (clipsX || clipsY) {
+          const r = a.getBoundingClientRect();
+          const clipMargin = parseFloat(cs.overflowClipMargin) || 0;
+          if (clipsX) {
+            const grow = cs.overflowX === "clip" ? clipMargin : 0;
+            own.left = r.left + parseFloat(cs.borderLeftWidth) - grow;
+            own.right = r.right - parseFloat(cs.borderRightWidth) + grow;
+            edges.left = Math.max(edges.left, own.left);
+            edges.right = Math.min(edges.right, own.right);
+          }
+          if (clipsY) {
+            const grow = cs.overflowY === "clip" ? clipMargin : 0;
+            own.top = r.top + parseFloat(cs.borderTopWidth) - grow;
+            own.bottom = r.bottom - parseFloat(cs.borderBottomWidth) + grow;
+            edges.top = Math.max(edges.top, own.top);
+            edges.bottom = Math.min(edges.bottom, own.bottom);
+          }
+        }
+        chain.push({ ancestor: a, style: cs, edges: own });
+      }
+      return { edges, chain };
+    };
+  })(${ABS_CONTAINING_BLOCK_JS})`;
 function pagePseudoContexts(model) {
   const used = new Set(pseudoVariants(model));
   const standard = new Set(["left", "right", "recto", "verso", "first", "blank"]);
@@ -1762,25 +1818,11 @@ ${mapCss}`;
             return reasons;
           };
 
-          // Does this box establish the containing block for an absolutely
-          // positioned descendant? Overflow clipping binds an abspos
-          // .gp-pin only from its containing block outward — MEASURED: a
-          // pin whose box lay entirely outside a STATIC overflow:hidden
-          // (and overflow:clip) wrapper printed complete and still behind
-          // the page text; the wrapper's clip never touched it.
-          const establishesAbsContainingBlock = (cs) => {
-            if (cs.position !== "static") return true;
-            for (const prop of [
-              "transform", "translate", "rotate", "scale", "perspective",
-              "filter", "backdropFilter",
-            ]) {
-              const value = cs[prop];
-              if (value && value !== "none") return true;
-            }
-            if (/\\b(layout|paint|strict|content)\\b/.test(cs.contain)) return true;
-            if (cs.containerType && cs.containerType !== "normal") return true;
-            return /\\b(transform|translate|rotate|scale|perspective|filter)\\b/.test(cs.willChange);
-          };
+          // Which ancestors clip a .gp-behind, and where their edges fall —
+          // the same measured rule the pre-print width check clamps against
+          // (see CLIP_EDGES_JS). This pass walks its \`chain\` so it can name
+          // the ancestor doing the cutting.
+          const clipEdges = ${CLIP_EDGES_JS};
 
           for (const el of document.querySelectorAll("*")) {
             const cs = getComputedStyle(el);
@@ -1823,47 +1865,25 @@ ${mapCss}`;
               const boundary = el.closest(".page, .spread");
               if (boundary) {
                 const elRect = el.getBoundingClientRect();
-                // Clip binding: an in-flow .gp-behind is bound by every
-                // ancestor's overflow, but an abspos one only from its
-                // containing block outward — static wrappers in between
-                // never clip it (measured; see the pass comment above).
-                let clipBinds = cs.position !== "absolute" && cs.position !== "fixed";
-                for (let ancestor = el.parentElement; ancestor; ancestor = ancestor.parentElement) {
-                  const ancestorStyle = getComputedStyle(ancestor);
-                  if (!clipBinds && establishesAbsContainingBlock(ancestorStyle)) clipBinds = true;
+                for (const link of clipEdges(el).chain) {
+                  const ancestor = link.ancestor;
+                  const ancestorStyle = link.style;
                   const reasons = stackingReasons(ancestor, ancestorStyle);
                   // Clipping never reorders layers — it can only CUT the
                   // art (measured, pass comment above): warn only where the
-                  // border box crosses a binding ancestor's clip edge on an
-                  // axis whose overflow is not \`visible\`. The clip edge is
-                  // the padding box, grown by overflow-clip-margin where
-                  // that axis's value is \`clip\` (px values only; keyword
-                  // forms parse NaN -> 0, i.e. the ungrown padding box).
-                  // 1px epsilon: the measured cut lands exactly at the
-                  // edge, and sub-pixel layout rounding is not an overhang.
+                  // border box crosses THIS ancestor's own clip edges, which
+                  // are ±Infinity on any axis it does not bind. 1px epsilon:
+                  // the measured cut lands exactly at the edge, and sub-pixel
+                  // layout rounding is not an overhang.
                   const cuts = [];
-                  if (clipBinds && (ancestorStyle.overflowX !== "visible" || ancestorStyle.overflowY !== "visible")) {
-                    const r = ancestor.getBoundingClientRect();
-                    const clipMargin = parseFloat(ancestorStyle.overflowClipMargin) || 0;
-                    if (ancestorStyle.overflowX !== "visible") {
-                      const grow = ancestorStyle.overflowX === "clip" ? clipMargin : 0;
-                      const left = r.left + parseFloat(ancestorStyle.borderLeftWidth) - grow;
-                      const right = r.right - parseFloat(ancestorStyle.borderRightWidth) + grow;
-                      if (elRect.left < left - 1)
-                        cuts.push(Math.round(left - elRect.left) + "px past its left clip edge");
-                      if (elRect.right > right + 1)
-                        cuts.push(Math.round(elRect.right - right) + "px past its right clip edge");
-                    }
-                    if (ancestorStyle.overflowY !== "visible") {
-                      const grow = ancestorStyle.overflowY === "clip" ? clipMargin : 0;
-                      const top = r.top + parseFloat(ancestorStyle.borderTopWidth) - grow;
-                      const bottom = r.bottom - parseFloat(ancestorStyle.borderBottomWidth) + grow;
-                      if (elRect.top < top - 1)
-                        cuts.push(Math.round(top - elRect.top) + "px past its top clip edge");
-                      if (elRect.bottom > bottom + 1)
-                        cuts.push(Math.round(elRect.bottom - bottom) + "px past its bottom clip edge");
-                    }
-                  }
+                  if (elRect.left < link.edges.left - 1)
+                    cuts.push(Math.round(link.edges.left - elRect.left) + "px past its left clip edge");
+                  if (elRect.right > link.edges.right + 1)
+                    cuts.push(Math.round(elRect.right - link.edges.right) + "px past its right clip edge");
+                  if (elRect.top < link.edges.top - 1)
+                    cuts.push(Math.round(link.edges.top - elRect.top) + "px past its top clip edge");
+                  if (elRect.bottom > link.edges.bottom + 1)
+                    cuts.push(Math.round(elRect.bottom - link.edges.bottom) + "px past its bottom clip edge");
                   if ((reasons.length || cuts.length) && !seenLayerTraps.has(ancestor)) {
                     seenLayerTraps.add(ancestor);
                     const effects = [];
@@ -1968,6 +1988,20 @@ async function findWidthOffenders(page, model, bleedSlugExtensionPt, restoreView
     const boxes = JSON.parse(await page.evaluate(`(() => {
         const LIMIT = ${limitPx} + 1;
         const desc = ${DESC_JS};
+        // Shrink-to-fit only reacts to overflow that ESCAPES: a clipping or
+        // scrolling ancestor contains its subtree's overflow, so the
+        // document's own width never grows and the book prints at 1.0x.
+        // MEASURED (Chrome 151, a marker word read off \`pdftotext -bbox\`
+        // against an unshrunk control): a 900px box inside a 300px
+        // \`overflow: hidden\` shell printed unshrunk, as did the same box
+        // under clip/auto/scroll — and a real 208-page book whose two
+        // "offenders" both sat under \`overflow-x: clip\` printed
+        // coordinate-identical with them restored. WHICH ancestors clip, and
+        // where their edges fall, is CLIP_EDGES_JS's measured rule — shared
+        // with the layer-containment audit, which measures overhang past the
+        // same edges. Only the x edges matter here: shrink-to-fit is a width
+        // response.
+        const clipEdges = ${CLIP_EDGES_JS};
         const out = [];
         for (const el of document.querySelectorAll("*")) {
           const r = el.getBoundingClientRect();
@@ -1977,6 +2011,9 @@ async function findWidthOffenders(page, model, bleedSlugExtensionPt, restoreView
           // width) — both trigger the same whole-document shrink-to-fit,
           // measured: a left bleed alone cost 16%.
           if (right <= LIMIT && r.width <= LIMIT && r.left >= -1) continue;
+          // ...but only where it actually escapes its clipping ancestors.
+          const clip = clipEdges(el).edges;
+          if (Math.min(right, clip.right) <= LIMIT && Math.max(r.left, clip.left) >= -1) continue;
           let deepest = true;
           for (const c of el.children) {
             if (c.getBoundingClientRect().width >= r.width - 1) { deepest = false; break; }

package/dist/index.js

@@ -1,16 +1,15 @@
 import {
-  APP_HEARTBEAT_FRESH_MS,
   AUTO_SNAPSHOT_DEFAULT_MINUTES,
   AUTO_SNAPSHOT_MAX_MINUTES,
   AUTO_SNAPSHOT_MIN_MINUTES,
   AUTO_SYNC_DEFAULT_MINUTES,
   AUTO_SYNC_MAX_MINUTES,
   AUTO_SYNC_MIN_MINUTES,
+  AUTO_SYNC_PUSH_INTERVAL_MINUTES,
   BUILT_IN_TEMPLATE_IDS,
   BUILT_IN_THEME_IDS,
   FileTokenStore,
   GITHUB_HOST,
-  GenericTokenAuthProvider,
   GitHubAuthProvider,
   MANIFEST_FILENAMES,
   PLUGINS_DIR,
@@ -18,9 +17,7 @@ import {
   PRESET_IDS,
   PublishSelectionsStore,
   RECOMMENDED_PLUGINS,
-  RepoNeedsRecoveryError,
   SNIPPETS_DIR,
-  STALE_LOCK_MIN_AGE_MS,
   SYNC_SNAPSHOT_MESSAGE,
   TARGETS,
   TARGET_IDS,
@@ -28,14 +25,11 @@ import {
   addLocalPlugin,
   addNpmPlugin,
   adoptFolder,
-  appHeartbeatPath,
   applyTheme,
   autoSnapshotDelayMs,
   autoSyncDelayMs,
-  buildPreflightDiagnostics,
   checkCss,
   checkToolAvailability,
-  classifyFromHealth,
   cloneRepository,
   connectGenericHost,
   connectPublishProvider,
@@ -55,20 +49,13 @@ import {
   getPreviousTheme,
   getSystemDiagnostics,
   hasProjectManifest,
-  heartbeatTtlMs,
   importTemplateFromFolder,
   importThemeFromFile,
   importThemeFromFolder,
   importThemeFromUrl,
   inspectImage,
-  inspectRepo,
-  isAppHeartbeatFresh,
   isGitInternalPath,
-  isLikelyRepoCorruption,
-  isRepoNeedsRecoveryError,
   isSshRemoteUrl,
-  isUnbornRepo,
-  keepImageVersion,
   knownForgeTokenUrl,
   listBuiltInTemplates,
   listBuiltInThemes,
@@ -85,29 +72,17 @@ import {
   loadManifest,
   loadManifestWithPath,
   log,
-  migrateUrlCredential,
-  normalizeForgeHost,
   openPath,
   parseRemoteOrigin,
-  preflightStructuralReason,
-  provenancePath,
   publishConnectionStatus,
   publishCredentialKey,
   publishProviderFor,
   publishTargetFor,
-  pullChanges,
-  pushChanges,
-  readAppHeartbeat,
-  readImageVersion,
   readManifestFields,
-  readProjectProvenance,
   readPublishSettings,
   readSnippet,
   readThemeCss,
-  redactCredential,
-  removeAppHeartbeat,
   removeProjectTheme,
-  repairRepo,
   reportMissingTools,
   resolveActiveStyles,
   resolveBuiltInTheme,
@@ -137,18 +112,16 @@ import {
   substituteVariables,
   syncProject,
   testRemoteAccess,
-  validateProjectPlugins,
-  verifyRepoReadable,
-  writeAppHeartbeat
-} from "./index-ge7q9xj3.js";
+  validateProjectPlugins
+} from "./index-h1x7krkg.js";
 import {
   BUILD_DIAGNOSTIC_CODES
-} from "./index-wq3r5pj7.js";
+} from "./index-p0ebr7dh.js";
 import {
   BuildError,
   DEFAULT_PRINT_OPTS,
   readyProbeExpr
-} from "./index-ycpvr0am.js";
+} from "./index-7hrvksrb.js";
 import {
   AUTO_SNAPSHOT_MESSAGE,
   HISTORY_PAGE_LIMIT,
@@ -156,9 +129,8 @@ import {
   isNoChangesError,
   providerFor,
   resolveLogger,
-  restoreVersionWithBackup,
-  shortOid
-} from "./index-mdefp0y5.js";
+  restoreVersionWithBackup
+} from "./index-dtrftayr.js";
 import {
   capabilitiesFor,
   detectProjectSource,
@@ -168,8 +140,6 @@ import {
 } from "./index-v5mp7a6q.js";
 import"./index-37x76zdn.js";
 export {
-  writeAppHeartbeat,
-  verifyRepoReadable,
   validateProjectPlugins,
   testRemoteAccess,
   syncProject,
@@ -177,7 +147,6 @@ export {
   startPreviewServer,
   splitOutPath,
   slugifyProjectName,
-  shortOid,
   setPublishProviderConfig,
   setPluginEnabled,
   setManifestFields,
@@ -205,31 +174,19 @@ export {
   reportMissingTools,
   repoSubPath,
   repoRootForSource,
-  repairRepo,
   removeProjectTheme,
-  removeAppHeartbeat,
-  redactCredential,
   readyProbeExpr,
   readThemeCss,
   readSnippet,
   readPublishSettings,
-  readProjectProvenance,
   readManifestFields,
-  readImageVersion,
-  readAppHeartbeat,
-  pushChanges,
-  pullChanges,
   publishTargetFor,
   publishProviderFor,
   publishCredentialKey,
   publishConnectionStatus,
   providerFor,
-  provenancePath,
-  preflightStructuralReason,
   parseRemoteOrigin,
   openPath,
-  normalizeForgeHost,
-  migrateUrlCredential,
   log,
   loadManifestWithPath,
   loadManifest,
@@ -246,21 +203,14 @@ export {
   listBuiltInThemes,
   listBuiltInTemplates,
   knownForgeTokenUrl,
-  keepImageVersion,
-  isUnbornRepo,
   isSshRemoteUrl,
-  isRepoNeedsRecoveryError,
   isNoChangesError,
-  isLikelyRepoCorruption,
   isGitInternalPath,
-  isAppHeartbeatFresh,
-  inspectRepo,
   inspectImage,
   importThemeFromUrl,
   importThemeFromFolder,
   importThemeFromFile,
   importTemplateFromFolder,
-  heartbeatTtlMs,
   hasProjectManifest,
   getSystemDiagnostics,
   getPreviousTheme,
@@ -282,15 +232,12 @@ export {
   connectPublishProvider,
   connectGenericHost,
   cloneRepository,
-  classifyFromHealth,
   checkToolAvailability,
   checkCss,
   capabilitiesFor,
-  buildPreflightDiagnostics,
   autoSyncDelayMs,
   autoSnapshotDelayMs,
   applyTheme,
-  appHeartbeatPath,
   adoptFolder,
   addNpmPlugin,
   addLocalPlugin,
@@ -298,9 +245,7 @@ export {
   TARGET_IDS,
   TARGETS,
   SYNC_SNAPSHOT_MESSAGE,
-  STALE_LOCK_MIN_AGE_MS,
   SNIPPETS_DIR,
-  RepoNeedsRecoveryError,
   RESTORE_BACKUP_MESSAGE,
   RECOMMENDED_PLUGINS,
   PublishSelectionsStore,
@@ -310,7 +255,6 @@ export {
   MANIFEST_FILENAMES,
   HISTORY_PAGE_LIMIT,
   GitHubAuthProvider,
-  GenericTokenAuthProvider,
   GITHUB_HOST,
   FileTokenStore,
   DEFAULT_PRINT_OPTS,
@@ -318,12 +262,12 @@ export {
   BUILT_IN_THEME_IDS,
   BUILT_IN_TEMPLATE_IDS,
   BUILD_DIAGNOSTIC_CODES,
+  AUTO_SYNC_PUSH_INTERVAL_MINUTES,
   AUTO_SYNC_MIN_MINUTES,
   AUTO_SYNC_MAX_MINUTES,
   AUTO_SYNC_DEFAULT_MINUTES,
   AUTO_SNAPSHOT_MIN_MINUTES,
   AUTO_SNAPSHOT_MESSAGE,
   AUTO_SNAPSHOT_MAX_MINUTES,
-  AUTO_SNAPSHOT_DEFAULT_MINUTES,
-  APP_HEARTBEAT_FRESH_MS
+  AUTO_SNAPSHOT_DEFAULT_MINUTES
 };

package/dist/lib/git-fs.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `node:fs`, with crash-atomic writes for git's MUTABLE metadata.
+ *
+ * WHY THIS EXISTS. isomorphic-git writes `.git/index`, `HEAD`, `packed-refs`
+ * and loose refs with a plain `fs.writeFile` — an open-truncate-write. If the
+ * process dies between the truncate and the write (the writer force-quits the
+ * app, the OS kills it, the machine sleeps badly) the file is left EMPTY or
+ * half-written, and the repository can no longer be read. That is the one
+ * class of history damage Gutterpress itself causes; every other class needs
+ * an outside actor. Since isomorphic-git takes `fs` as a parameter, replacing
+ * the write with temp-file + `rename` removes the truncation window entirely
+ * — a reader sees either the old file or the new one, never a torn one.
+ *
+ * SCOPE. Only git's mutable metadata is redirected. Working-tree files and
+ * content-addressed objects keep the plain write: objects are written once
+ * under a hash of their contents (a torn object is a NEW file that simply
+ * fails to inflate, it never destroys a good one), and the working tree is
+ * the author's own files, which `rename` semantics would not improve.
+ *
+ * NOT A DURABILITY BARRIER. There is deliberately no `fsync`: this closes the
+ * PROCESS-DEATH window, where the page cache survives and `rename` is atomic
+ * to every reader. Surviving sudden power loss would mean fsync-ing the temp
+ * file and its directory on every ref write, which is a real cost on the
+ * snapshot hot path and guards a failure the app does not cause.
+ *
+ * Everything not named below passes through to `node:fs` unchanged, so
+ * `import { gitFs as fs }` is a drop-in for `import * as fs from "node:fs"`.
+ */
+import * as nodeFs from "node:fs";
+/** True when `file` is git metadata that must be replaced, never truncated. */
+export declare function needsAtomicWrite(file: unknown): file is string;
+/**
+ * `node:fs` with the two writers above swapped in — the object callers import
+ * as `fs` and hand to isomorphic-git. Everything else passes through
+ * untouched.
+ *
+ * WHY an object and not `export * from "node:fs"`: bun build with
+ * `--packages=external` compiles a star re-export of a BUILTIN into a
+ * `__reExport(exports, node_fs)` call whose `node_fs` binding is never
+ * emitted, so the built lib throws `ReferenceError: node_fs is not defined`
+ * on import. A plain spread has no such hazard.
+ */
+export declare const gitFs: typeof nodeFs;

package/dist/lib/host-policy.d.ts

@@ -40,6 +40,17 @@ export interface AutoSyncPolicy {
 export declare const AUTO_SYNC_MIN_MINUTES = 1;
 export declare const AUTO_SYNC_MAX_MINUTES: number;
 export declare const AUTO_SYNC_DEFAULT_MINUTES = 2;
+/**
+ * Minutes between PUSH-enabled auto-sync passes (owner decision 2026-08-23).
+ * Every ~2-minute tick still PULLS — a collaborator's work keeps arriving
+ * promptly — but only a tick whose push window has elapsed also pushes, and
+ * the desktop pushes once more on project close/app exit. This is what keeps
+ * an actively-typing author from minting a snapshot-and-push every 2 minutes
+ * (the "commit wall"): between push windows, ticks with an unmoved remote
+ * commit nothing at all. Deliberately a constant, NOT a settings knob — the
+ * sync cadence is hidden policy, same as the tick interval's default.
+ */
+export declare const AUTO_SYNC_PUSH_INTERVAL_MINUTES = 15;
 /**
  * Resolve the debounce delay (ms) for the host's auto-snapshot timer, or
  * `null` when automatic snapshots are disabled. Pure — the testable core of
@@ -61,8 +72,9 @@ export declare function autoSnapshotDelayMs(policy: Partial<AutoSnapshotPolicy>
  * the default and is then clamped into [AUTO_SYNC_MIN_MINUTES,
  * AUTO_SYNC_MAX_MINUTES].
  *
- * Note: the host orchestrator ALSO debounces on file-change triggers; this
- * cadence governs only the periodic safety timer (§4.2 "Periodic safety").
+ * Note: this is the host orchestrator's ONLY sync trigger — the file-change
+ * debounce that used to sit beside it was removed (it could never fire before
+ * this interval already had).
  */
 export declare function autoSyncDelayMs(policy: Partial<AutoSyncPolicy> | undefined): number | null;
 /**

package/dist/lib/remote-auth/clone.d.ts

@@ -7,22 +7,6 @@ export interface CloneProgressEvent {
     loaded: number;
     total?: number;
 }
-/**
- * Provider provenance recorded next to a cloned project (ADR 0006 D4):
- * metadata for the repo picker / re-auth UX, never consulted by the
- * editing/preview/build paths.
- */
-export interface ProjectProvenance {
-    provider: "github";
-    owner: string;
-    repo: string;
-    /**
-     * Legacy GitHub-App installation id. New clones never write it (the OAuth
-     * App model has no installations — ADR 0006 D1 amendment 2026-06-10); kept
-     * optional so provenance files written by 0.4.x betas still parse.
-     */
-    installationId?: string;
-}
 export interface CloneRepositoryOptions {
     /** HTTPS clone URL. Tokens embedded in the URL are stripped (D7). */
     url: string;
@@ -49,8 +33,6 @@ export interface CloneRepositoryOptions {
     onProgress?: (event: CloneProgressEvent) => void;
     /** When provided, credentials embedded in `url` are migrated into it (D7). */
     tokenStore?: TokenStore;
-    /** Provider provenance to record beside the clone (ADR 0006 D4). */
-    provenance?: ProjectProvenance;
     /**
      * Injectable git HTTP transport for tests (isomorphic-git's `http` client
      * shape). Defaults to isomorphic-git's node client.
@@ -63,9 +45,6 @@ export interface CloneRepositoryResult {
     /** The checked-out branch. */
     branch?: string;
 }
-export declare function provenancePath(projectDir: string): string;
-/** Read recorded provider provenance for a project, if any. Never throws. */
-export declare function readProjectProvenance(projectDir: string): Promise<ProjectProvenance | null>;
 /**
  * Reduce a (possibly renderer-/user-supplied) project folder name to a single
  * safe path segment: path separators become dashes and leading dots are

package/dist/lib/remote-auth/converge-merge.d.ts

@@ -1,5 +1,23 @@
-import type { GitCache, ImageClash } from "./sync-types.ts";
-export type { ImageClash };
+import { onlineSiblingPath, isOnlineSibling } from "./sync-messages.ts";
+export { onlineSiblingPath, isOnlineSibling };
+import type { GitCache, KeptBothFile } from "./sync-types.ts";
+export type { KeptBothFile };
+/** Type guard exposing MergeConflictError's per-file payload. */
+export declare function isMergeConflictError(e: unknown): e is {
+    data: {
+        filepaths: string[];
+        bothModified: string[];
+        deleteByUs: string[];
+        deleteByTheirs: string[];
+    };
+};
+/**
+ * A non-forced `git.checkout` refused to overwrite working-tree files whose
+ * content moved after we committed them. isomorphic-git detects this in its
+ * analysis pass and throws BEFORE touching the tree, so the refusal is
+ * atomic: nothing on disk has been written.
+ */
+export declare function isCheckoutConflict(e: unknown): boolean;
 export interface ConvergeResult {
     /** The branch tip after the merge (the merge commit, or the ff/no-op tip). */
     oid: string;
@@ -8,13 +26,13 @@ export interface ConvergeResult {
      * the writer should blend these. Empty when everything merged cleanly.
      */
     combinedFiles: string[];
-    /** Clashing images (newer version kept) for the non-blocking picker. */
-    imageClashes: ImageClash[];
+    /** Files kept as a pair: ours at `path`, theirs at `onlinePath`. */
+    keptBothFiles: KeptBothFile[];
 }
 /** Snapshot message for the equalization commit (driver-unreachable cases). */
 export declare const CONVERGE_PREPARE_MESSAGE = "Getting your changes ready to combine with the online version";
-/** Snapshot message for the post-merge restore commit (newer-wins/edits). */
-export declare const CONVERGE_RESTORE_MESSAGE = "Kept the newest version of files that can't be combined";
+/** Snapshot message for the post-merge restore commit (kept-both/edits). */
+export declare const CONVERGE_RESTORE_MESSAGE = "Kept both versions of the files that can't be combined";
 /** The merge commit message (same wording the old sync used). */
 export declare const CONVERGE_MERGE_MESSAGE = "Combined your changes with the online version";
 /**
@@ -44,5 +62,4 @@ export declare function convergeMerge(params: {
     };
     authorName?: string;
     authorEmail?: string;
-    allowUnrelatedHistories?: boolean;
 }): Promise<ConvergeResult>;

package/dist/lib/remote-auth/generic-auth.d.ts

@@ -15,7 +15,6 @@
  * SECURITY INVARIANT: token values never appear in error messages or logs.
  */
 import type httpNode from "isomorphic-git/http/node";
-import type { HostCallbacks, RemoteAuthProvider } from "./github-auth.ts";
 import { type HostCredential } from "./token-store.ts";
 /** What the Advanced Setup UI collects for "Connect a Git server". */
 export interface GenericTokenConnectInput {
@@ -38,14 +37,6 @@ export interface GenericTokenConnectInput {
      */
     repoUrl?: string;
 }
-/**
- * The {@link RemoteAuthProvider} `connect` input for the generic provider:
- * the UI-collected fields plus the standard host callbacks (`onUserCode` is
- * part of the shared contract but unused — there is no device code in the
- * token flow; pass a no-op, or use {@link connectGenericHost} directly).
- */
-export interface GenericHostCallbacks extends HostCallbacks, GenericTokenConnectInput {
-}
 export interface GenericAuthOptions {
     /** Injectable git HTTP transport for tests. */
     httpClient?: typeof httpNode;
@@ -82,16 +73,3 @@ export declare function knownForgeTokenUrl(host: string): string | null;
  * a full end-to-end verification of the token against a real repository.
  */
 export declare function connectGenericHost(input: GenericTokenConnectInput, options?: GenericAuthOptions): Promise<HostCredential>;
-/**
- * {@link RemoteAuthProvider} wrapper for the generic token flow, so host apps
- * can route any non-GitHub origin through the shared provider contract.
- */
-export declare class GenericTokenAuthProvider implements RemoteAuthProvider {
-    private readonly options;
-    constructor(options?: GenericAuthOptions);
-    /** Handles any smart-HTTP(S) host that is not github.com (device flow). */
-    matches(origin: URL): boolean;
-    connect(callbacks: GenericHostCallbacks): Promise<HostCredential>;
-    /** Revalidate a stored credential: false only on a definitive rejection. */
-    validate(credential: HostCredential): Promise<boolean>;
-}

package/dist/lib/remote-auth/git-http.d.ts

@@ -31,7 +31,7 @@
  *
  * One timer serves the whole request (re-armed via `refresh()`; no per-chunk
  * allocation). On timeout the thrown error's message classifies as offline in
- * recovery/classify.ts. Known limitation (documented, not fixable at this
+ * transport.ts. Known limitation (documented, not fixable at this
  * layer): isomorphic-git's client accepts no AbortSignal, so an abandoned
  * timed-out transfer's socket is left to the OS/agent to reap.
  *