gutterpress 0.10.0 → 0.10.1-beta.2

package/dist/{preview-shell-c5mfa3q0.js → preview-shell-kyjq59d9.js}

@@ -19,6 +19,11 @@
   var pendingSwap = null;
   var pendingSwapTimer = null;
   var SCROLL_IDLE_MS = 250;
+  // True while the book iframe has a live in-flow block editor open
+  // (preview-interface.js's blockEditStateChanged, protocol v8). A swap
+  // replaces the whole iframe, so swapping mid-edit would destroy the caret
+  // and the author's uncommitted typing with it — see holdForEdit below.
+  var blockEditOpen = false;
   if (!active) return;
 
   // Transparent bridge relay: forward host-toolbar commands to the active book
@@ -27,26 +32,36 @@
     try {
       if (window.parent !== window && e.source === window.parent) {
         if (active && active.contentWindow) active.contentWindow.postMessage(e.data, '*');
+        // Opening the in-flow editor needs KEYBOARD focus in the book, and a
+        // postMessage carries no user activation the book could focus itself
+        // with. The host focuses this shell frame; this hands it the rest of
+        // the way down to the active book iframe, whose own window-focus
+        // listener then seats the caret.
+        if (e.data && e.data.type === 'gutterpress:cmd' && e.data.cmd === 'beginBlockEdit' && active) {
+          try { active.focus(); } catch (_f) {}
+        }
       } else if (active && e.source === active.contentWindow) {
         var data = e.data;
         if (data && data.type === 'gutterpress:event' && data.name === 'viewportChanged') {
           lastViewportChangeAt = Date.now();
           if (pendingSwap) armPendingSwap();
         }
-        if (active === hotReloadFrame && data && data.type === 'gutterpress:event' && data.name === 'ready') return;
-        if (active === hotReloadFrame && data && data.type === 'gutterpress:event' && data.name === 'renderingComplete') {
-          var detail = {}, sourceDetail = data.detail || {};
-          for (var key in sourceDetail) {
-            if (Object.prototype.hasOwnProperty.call(sourceDetail, key)) detail[key] = sourceDetail[key];
-          }
-          detail.hotReload = true;
-          var startedAt = hotReloadFrame.__gutterpressReloadStartedAt;
-          detail.hotReloadMs = typeof startedAt === 'number' ? Math.max(0, Date.now() - startedAt) : 0;
-          detail.revision = hotReloadFrame.__gutterpressRevision;
-          detail.updateMode = 'full-reload';
-          data = { type: data.type, name: data.name, detail: detail };
-          hotReloadFrame = null;
+        if (data && data.type === 'gutterpress:event' && data.name === 'blockEditStateChanged') {
+          blockEditOpen = !!(data.detail && data.detail.open);
+          // Releasing the hold: a swap that arrived mid-edit is still queued,
+          // so start it now that the caret is gone.
+          if (!blockEditOpen && pendingSwap) armPendingSwap();
         }
+        // A swapped-in frame's own lifecycle events are the shell's business,
+        // not the host's: finish() reports the swap (see reportSwapComplete).
+        // Relaying them too would either double-report or — when the frame
+        // paginates before its `load` event, which is the common case — report
+        // nothing at all, because the message arrives while the frame is still
+        // `building` and matches no branch here.
+        if (
+          active === hotReloadFrame && data && data.type === 'gutterpress:event' &&
+          (data.name === 'ready' || data.name === 'renderingComplete')
+        ) return;
         if (window.parent !== window) window.parent.postMessage(data, '*');
       } else if (retiring && e.source === retiring.contentWindow && window.parent !== window) {
         var retiringData = e.data;
@@ -135,7 +150,33 @@
     building = null;
   }
 
+  // Tell the host the swap is done. This is a synchronous fact the shell knows
+  // — the replacement is paginated (onReady resolved), promoted, and refreshed
+  // — rather than a relayed message whose arrival depends on whether the
+  // frame's pagination beat its own `load` event.
+  function reportSwapComplete(frame, pageState) {
+    if (window.parent === window) return;
+    var startedAt = frame.__gutterpressReloadStartedAt;
+    window.parent.postMessage({
+      type: 'gutterpress:event',
+      name: 'renderingComplete',
+      detail: {
+        totalPages: pageState ? pageState.totalPages : 0,
+        hotReload: true,
+        hotReloadMs: typeof startedAt === 'number' ? Math.max(0, Date.now() - startedAt) : 0,
+        revision: frame.__gutterpressRevision,
+        updateMode: 'full-reload'
+      }
+    }, '*');
+  }
+
   function swap(instance, revision) {
+    // The editor lived in the frame we are about to retire, so the hold is
+    // void whatever the book document last reported. Every update path reaches
+    // swap() through armPendingSwap(), which refuses while an edit is open, so
+    // this only fires when the frame goes away some other way — but a flag
+    // left stuck true would freeze hot reload for the session.
+    blockEditOpen = false;
     discardBuilding();
     var frame = document.createElement('iframe');
     frame.style.visibility = 'hidden';
@@ -175,7 +216,8 @@
       hotReloadFrame = frame;
       building = null;
       var api = fwin(frame) && fwin(frame).previewAPI;
-      if (api && typeof api.refresh === 'function') api.refresh();
+      var pageState = api && typeof api.refresh === 'function' ? api.refresh() : null;
+      reportSwapComplete(frame, pageState);
       frame.style.visibility = 'visible';
       frame.removeAttribute('aria-hidden');
       appliedInstance = instance;
@@ -229,6 +271,13 @@
 
   function armPendingSwap() {
     if (pendingSwapTimer !== null) clearTimeout(pendingSwapTimer);
+    // An open in-flow editor holds the swap indefinitely — there is no timeout
+    // to race, because an author may legitimately sit in one block for
+    // minutes. The hold is released by blockEditStateChanged{open:false},
+    // which preview-interface.js emits on EVERY close path (commit, cancel,
+    // blur, SPA-forced), and defensively by swap() below in case the frame
+    // carrying the editor goes away first.
+    if (blockEditOpen) return;
     var delay = Math.max(0, SCROLL_IDLE_MS - (Date.now() - lastViewportChangeAt));
     if (delay === 0) beginPendingSwap();
     else pendingSwapTimer = setTimeout(beginPendingSwap, delay);
@@ -243,17 +292,23 @@
   // Paged.js's `.pagedjs_page` DOM to find a chapter's live page range and
   // graft a freshly-paginated replacement into it. Paged.js has been removed
   // (native-only-migration-plan.md Phase 6). A native in-place splice was
-  // also tried and removed (2026-08-08 review): grafting a fresh
-  // `.gutterpress-chapter` node in and calling `Gutterpress.refresh()` is not
-  // sound, because `refresh()` -> `relayout()` only re-`measure()`s the
-  // EXISTING strips — it never re-runs `buildStrips()`/`explodeChildren()`.
-  // So any page context the edit introduces (a new `@page`/`page:`
-  // assignment inside the chapter) is silently dropped: measured 2 preview
-  // pages where the same content prints 3 — a preview<->PDF divergence, the
-  // worst failure this project can produce. It also bought nothing: measured
-  // end-to-end (file write -> change visible, 5 samples, 34pp field guide)
-  // the plain full reload (`swap`, below) is 509ms avg vs the incremental
-  // splice's 998ms avg. Every content-update now goes straight to `swap()`.
+  // also tried and removed (2026-08-08 review), and the standing reason is
+  // PERFORMANCE, not soundness: measured end-to-end (file write -> change
+  // visible, 5 samples, 34pp field guide) the plain full reload (`swap`,
+  // below) is 509ms avg vs the incremental splice's 998ms avg. Every
+  // content-update goes straight to `swap()`.
+  //
+  // CORRECTED 2026-08-24: the 2026-08-08 review ALSO recorded a soundness
+  // objection — that `refresh()` -> `relayout()` "only re-measures the
+  // EXISTING strips", silently dropping any page context the edit
+  // introduces. That is false against the current `fragment.ts`, whose
+  // `relayout()` unwraps the strips and re-runs `buildStrips()` from
+  // scratch before re-measuring, precisely so a mutation that adds or
+  // removes a page-context run is seen. Do not cite the old objection as a
+  // reason a DOM mutation cannot be re-paginated — it can, and the inline
+  // editing work depends on it (docs/inline-editing-plan.md, ADR 0009
+  // decision 4 as revised). The perf comparison above still stands on its
+  // own for the full-document reload path.
 
   function markActiveReady() {
     onReady(active, function () {

package/dist/{publish-tkc26en7.js → publish-emk644a8.js}

@@ -7,22 +7,22 @@ import {
   publishCredentialKey,
   publishProviderFor,
   runPublish
-} from "./cli-eq5naw4m.js";
+} from "./cli-7n848af2.js";
 import {
   FileTokenStore,
   log
-} from "./cli-cqtggsng.js";
+} from "./cli-0z6zf98d.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-ydpf09d9.js";
+import"./cli-eewynen9.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/dist/{source-provider-3tcj6qg2.js → source-provider-2j5x2hyw.js}

@@ -16,7 +16,7 @@ import {
   snapshotWorkingTreeUnlocked,
   stageChanges,
   withRepoLock
-} from "./cli-k1065rkg.js";
+} from "./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 export {

package/dist/{source-provider-vanafrt9.js → source-provider-kn41jmbs.js}

@@ -16,7 +16,7 @@ import {
   snapshotWorkingTreeUnlocked,
   stageChanges,
   withRepoLock
-} from "./index-mdefp0y5.js";
+} from "./index-dtrftayr.js";
 import"./index-v5mp7a6q.js";
 import"./index-37x76zdn.js";
 export {

package/dist/{validate-w9vfefrw.js → validate-be54bdc6.js}

@@ -1,20 +1,20 @@
 import {
   executeAndReport
-} from "./cli-eq5naw4m.js";
+} from "./cli-7n848af2.js";
 import {
   log
-} from "./cli-cqtggsng.js";
+} from "./cli-0z6zf98d.js";
 import {
   UsageError,
   rejectExtraPositionals,
   rejectUnknownFlags
-} from "./cli-149edp6b.js";
-import"./cli-zfcryxg8.js";
+} from "./cli-ydpf09d9.js";
+import"./cli-eewynen9.js";
 import"./cli-c41yr7he.js";
 import {
   EXIT_CODES
 } from "./cli-46ycxe6r.js";
-import"./cli-k1065rkg.js";
+import"./cli-w692g6dx.js";
 import"./cli-v5mp7a6q.js";
 import"./cli-37x76zdn.js";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gutterpress",
-  "version": "0.10.0",
+  "version": "0.10.1-beta.2",
   "description": "Markdown-to-PDF converter for professional print layout using a native Chromium print engine and Ghostscript.",
   "author": "itlackey",
   "license": "MPL-2.0",

package/dist/lib/app-heartbeat.d.ts

@@ -1,102 +0,0 @@
-/**
-  * app-heartbeat.ts — detect a running Gutterpress app before a CLI repair
- * mutates the repo.
- *
- * WHY: `gutterpress repair` and the desktop's own recovery path both call into
- * the recovery subsystem, but each runs in its own OS process. The per-repo
- * FIFO lock (source-provider.ts) only serializes operations WITHIN a process,
- * so `gutterpress repair` run from a terminal while the desktop has the same
- * project open can race a live sync/snapshot. Rather than build a
- * cross-process lock manager, the desktop leaves a small liveness marker
- * behind while a project is open, and `repair` checks it before mutating.
- *
- * The marker lives at `<repoDir>/.git/gutterpress-app-heartbeat` (NOT in
- * userData) so `repair`, given only a repo directory, can find it without any
- * knowledge of the desktop's install. It is deliberately NOT a lock:
- *   - It never blocks the desktop itself, or any other repair run with --force.
- *   - It carries no locking semantics — just "an app touched this repo
- *     recently, maybe check before you assume it's idle".
- *   - It is written best-effort (a failed write must never surprise the
- *     author with a crash) and read best-effort (a missing/corrupt file
- *     means "no app appears to have this open", not an error).
- *
- * Two invariants that keep this file inert to the rest of the recovery
- * subsystem:
- *   - Filename does not match any pattern `findLockCandidates` scans
- *     (recover-stale-lock.ts: fixed top-level `*.lock` names + `refs/**`) —
- *     so stale-lock recovery can never see or remove it.
- *   - It lives under `.git`, which `hasPendingChanges`/`listWorkdirChanges`
- *     (source-provider.ts) always ignores (`git.isIgnored` treats a `.git`
- *     path segment as ignored unconditionally) — so it can never look like an
- *     uncommitted author change.
- */
-/**
- * Fallback freshness window used only when a heartbeat carries no `ttlMs`
- * (an older writer, or one with no cadence to report). Prefer a
- * cadence-derived TTL — see {@link heartbeatTtlMs} — since the actual
- * refresh cadence ranges 1 min–24 h (AUTO_SYNC_MIN/MAX_MINUTES,
- * host-policy.ts) and a fixed 2-minute window reads a live app as "closed"
- * for most of any longer cadence.
- */
-export declare const APP_HEARTBEAT_FRESH_MS: number;
-export interface AppHeartbeat {
-    /** PID of the process that wrote the heartbeat (diagnostic only — never
-     *  used to `kill`/signal anything). */
-    pid: number;
-    /** Epoch ms the heartbeat was last (re)written. */
-    timestamp: number;
-    /**
-     * Freshness window (ms) the writer says applies to THIS heartbeat, derived
-     * from its own refresh cadence (see {@link heartbeatTtlMs}). When present,
-     * `isAppHeartbeatFresh` honors it instead of its `maxAgeMs` fallback param —
-     * the writer knows how often it actually refreshes; the reader doesn't.
-     */
-    ttlMs?: number;
-}
-/**
- * The freshness window a heartbeat writer should stamp for a given refresh
- * cadence (the actual interval this writer refreshes the marker on — e.g.
- * `autoSyncDelayMs(settings.versionHistory)`). `null` (feature disabled, no
- * periodic refresh at all) falls back to {@link APP_HEARTBEAT_FRESH_MS}.
- *
- * Standard heartbeat rule: TTL should comfortably exceed the refresh period
- * so one missed/delayed tick doesn't read as "closed". Exported so both the
- * desktop (the writer, which knows its own cadence) and tests can compute it
- * consistently.
- */
-export declare function heartbeatTtlMs(periodicMs: number | null): number;
-/** Absolute path to the heartbeat marker for a repo. */
-export declare function appHeartbeatPath(repoDir: string): string;
-/**
- * Write/refresh the heartbeat marker. Best-effort: a failed write (missing
- * `.git` dir, read-only filesystem, …) is swallowed — it must never surface
- * as an error to the author, since it is only ever a background liveness
- * signal, not a required operation.
- *
- * `ttlMs`, when supplied, should be {@link heartbeatTtlMs} applied to this
- * writer's OWN actual refresh cadence — it is stamped into the marker so a
- * reader with no knowledge of that cadence still judges freshness correctly.
- * Omit it (or pass `undefined`) when the caller has no cadence to report; the
- * reader then falls back to its own `maxAgeMs` default.
- */
-export declare function writeAppHeartbeat(repoDir: string, now?: number, pid?: number, ttlMs?: number): Promise<void>;
-/**
- * Remove the heartbeat marker (project close / app quit). Best-effort: an
- * already-missing or unreadable file is not an error.
- */
-export declare function removeAppHeartbeat(repoDir: string): Promise<void>;
-/**
- * Read + parse the heartbeat marker. Returns `null` when absent, unreadable,
- * or corrupt (never throws — a damaged heartbeat is just "no signal").
- */
-export declare function readAppHeartbeat(repoDir: string): Promise<AppHeartbeat | null>;
-/**
- * True when a FRESH heartbeat exists for this repo — i.e. the gutterpress app
- * appears to have this project open right now. Absent/stale/corrupt all read
- * as "not open" (fail open: `repair` should not block on ambiguous signal).
- *
- * Freshness window: the heartbeat's own stamped `ttlMs` (derived from the
- * writer's actual refresh cadence — see {@link heartbeatTtlMs}) wins when
- * present; `maxAgeMs` is only a fallback for a heartbeat with none.
- */
-export declare function isAppHeartbeatFresh(repoDir: string, now?: number, maxAgeMs?: number): Promise<boolean>;

package/dist/lib/remote-auth/image-clash.d.ts

@@ -1,17 +0,0 @@
-/** Read one version's exact bytes by BLOB oid. */
-export declare function readImageVersion(options: {
-    projectDir: string;
-    oid: string;
-}): Promise<Uint8Array>;
-/**
- * Keep a specific version of a clashing image: write the blob's exact bytes
- * to the file and snapshot. Serialized on the per-repo lock like every other
- * mutating operation.
- */
-export declare function keepImageVersion(options: {
-    projectDir: string;
-    path: string;
-    oid: string;
-    authorName?: string;
-    authorEmail?: string;
-}): Promise<void>;

package/dist/lib/remote-auth/recovery/classify.d.ts

@@ -1,97 +0,0 @@
-/**
- * Error/health classification for sync + repair — the SINGLE source of truth.
- *
- * 2026-08-14 simplification (owner directive): the 17-kind SyncErrorKind
- * taxonomy and its 16 per-kind handlers are gone. Every structural problem a
- * repo can have now has ONE answer — `repairRepo()` (repair.ts) — so
- * classification collapses to three health verdicts:
- *
- *   - null           — healthy, nothing to do
- *   - "stale_lock"   — a leftover lock old enough to sweep
- *   - "needs_repair" — anything structural (missing/corrupt `.git`, broken
- *                      ref store, detached HEAD, interrupted merge/rebase/
- *                      cherry-pick left by an external tool)
- *
- * The transport decoders (auth/offline/insecure) and the merge/push guards
- * used by sync.ts remain here unchanged — outcome mapping, not repair.
- * This module is pure — no I/O, no side effects.
- */
-import type { RepoHealth } from "./types.ts";
-/**
- * Minimum age before a leftover git lock counts as STALE. locks.ts imports
- * this same constant as its sweep threshold, so preflight and sweep can never
- * disagree: a lock young enough to pass preflight is exactly a lock the sweep
- * would defer ("a live process may still hold it").
- */
-export declare const STALE_LOCK_MIN_AGE_MS: number;
-/** The collapsed repair taxonomy — see the module header. */
-export type RepairNeed = "stale_lock" | "needs_repair";
-/**
- * Thrown by sync's structural preflight when the repo must be repaired before
- * any sync work can safely run. The `code` string is the STABLE contract
- * hosts may match on across the dynamic-import boundary (where `instanceof`
- * is unreliable); `kind` says whether a lock sweep suffices or the full
- * repair pipeline is needed.
- */
-export declare class RepoNeedsRecoveryError extends Error {
-    readonly kind: RepairNeed;
-    readonly code = "RepoNeedsRecovery";
-    constructor(kind: RepairNeed);
-}
-/** Type guard for {@link RepoNeedsRecoveryError} (matches on the stable code). */
-export declare function isRepoNeedsRecoveryError(e: unknown): e is RepoNeedsRecoveryError;
-/**
- * Thrown by transport.ts's onAuth when a stored credential EXISTS but the
- * remote URL fails isCredentialTransmissionSafe (non-loopback http). Loud and
- * typed on purpose: the old behavior (silently withholding the credential)
- * surfaced as a 401 → "auth" → "reconnect" loop. The `code` string is the
- * STABLE contract (matchable across dynamic-import boundaries).
- */
-export declare class InsecureTransportError extends Error {
-    readonly code = "InsecureTransport";
-    constructor();
-}
-/** Type guard for {@link InsecureTransportError} (matches on the stable code). */
-export declare function isInsecureTransportError(e: unknown): e is InsecureTransportError;
-export declare function isPushRejected(e: unknown): boolean;
-/** Type guard exposing MergeConflictError's per-file payload (converge-merge). */
-export declare function isMergeConflictError(e: unknown): e is {
-    data: {
-        filepaths: string[];
-        bothModified: string[];
-        deleteByUs: string[];
-        deleteByTheirs: string[];
-    };
-};
-/**
- * Unrelated histories — the local project and the configured online project
- * share no common starting point. Sync surfaces this as a plain setup error
- * (a wrong online address must never be silently spliced into the book).
- */
-export declare function isUnrelatedHistories(e: unknown): boolean;
-export declare function classifyTransportFailure(e: unknown): "auth_required" | "network_unavailable" | "insecure_transport" | null;
-/**
- * True when a thrown error smells like LOCAL repo corruption (unreadable
- * objects/refs/index) rather than a transport or logic failure — the signal
- * for a host's mid-sync catch to run `repairRepo()`. NOTE on NotFoundError
- * ambiguity: a transport 404 also surfaces as NotFoundError, but
- * transport.ts's fetchRemoteTip rewrites those to an HttpError(401) BEFORE
- * they can reach this heuristic, so a raw NotFoundError here is a LOCAL
- * ref-resolution failure.
- */
-export declare function isLikelyRepoCorruption(e: unknown): boolean;
-/**
- * Classify a repo's structural condition from a RepoHealth snapshot.
- * Returns null for a healthy repo, "stale_lock" when the only problem is a
- * sweepable lock, and "needs_repair" for everything structural — the repair
- * pipeline (repair.ts) handles every structural case in one ordered pass, so
- * finer distinctions buy nothing.
- *
- * `minLockAgeMs` gates the stale-lock verdict: at preflight (the default) a
- * younger lock is treated as healthy because a live process may still hold
- * it. Error-path callers pass 0: a lock that just made a sync THROW is worth
- * routing regardless of age (the sweep still defers while it is fresh).
- */
-export declare function classifyFromHealth(health: RepoHealth, opts?: {
-    minLockAgeMs?: number;
-}): RepairNeed | null;

package/dist/lib/remote-auth/recovery/inspect.d.ts

@@ -1,75 +0,0 @@
-/**
- * Preflight repo health probe for the sync-recovery subsystem.
- *
- * inspectRepo() reads local filesystem state ONLY — no network, no git objects,
- * never throws. It returns a RepoHealth snapshot that the classifier and policy
- * lookup use to decide which recovery path to take.
- *
- * Reuses:
- *   - gitDirFor (source-provider.ts) for the .git dir path
- *   - hasPendingChanges (source-provider.ts) for local-changes detection
- *
- * Notes on two health facts:
- *   - hasGitDir is true whenever `.git/` EXISTS, even with a missing/corrupt
- *     HEAD (a damaged repo is still a repo — see the inline note at the check).
- *   - hasStaleLock uses the lock sweep's OWN scanner
- *     (findLockCandidates in locks.ts) — one implementation, so
- *     health and handler can never disagree about which locks exist.
- *
- * All probes are best-effort and throw-free (the caller must never see an
- * exception from a preflight probe).
- */
-import type { LogData } from "../operation-log.ts";
-import type { RepairNeed } from "./classify.ts";
-import type { RepoHealth } from "./types.ts";
-/**
- * Probe the local repository and return a RepoHealth snapshot.
- * Never throws — on any error the relevant flag is set conservatively.
- *
- * `checkLocalChanges: false` skips the hasPendingChanges working-tree walk
- * (the one non-trivial probe) and reports hasLocalChanges=false. Use it when
- * only the structural flags matter — e.g. syncProject's preflight, whose
- * pull step immediately performs the same walk anyway (sync-simplicity
- * mandate: no redundant walks on the hot path).
- */
-export declare function inspectRepo(ctx: {
-    repoDir: string;
-    source?: import("../../project-source.ts").ProjectSource;
-}, opts?: {
-    checkLocalChanges?: boolean;
-}): Promise<RepoHealth>;
-/**
- * Confirm the repo's object store is actually readable: resolve HEAD, read
- * its commit, and read its root tree. Throws when any step fails (missing or
- * corrupt object/ref); resolves when the repo is fully readable.
- *
- * Exported so the repair
- * command's diagnosis step and any host check share ONE implementation. `inspectRepo`'s health flags are
- * all filesystem-presence checks (no object is ever read), so they cannot
- * detect object-store corruption on their own — callers that need to catch
- * unreadable objects/refs must run this probe and feed a caught error through
- * `isLikelyRepoCorruption` (classify.ts) to decide whether to repairRepo().
- */
-export declare function verifyRepoReadable(dir: string): Promise<void>;
-/**
- * True when HEAD names a branch that simply has no commits yet — a fresh
- * `git init` before the first snapshot. In that state `verifyRepoReadable`
- * throws the SAME NotFoundError as a damaged ref store, but the repo is
- * healthy, not corrupt. The distinguishing signal is the object store: a
- * fresh repo has NO objects at all, while ref damage on a real repo leaves
- * loose objects and/or packfiles behind.
- */
-export declare function isUnbornRepo(repoDir: string): boolean;
-/**
- * The SINGLE health signal that drove classification. Derived from the KIND
- * classifyFromHealth returned (a pure mapping — it cannot drift from the
- * classifier's decision order, because it never re-implements it).
- */
-export declare function preflightStructuralReason(kind: RepairNeed | null): string;
-/**
- * Build a flat, secret-free record of the preflight decision inputs for the
- * operation log. Every health boolean is recorded (so support can see the FULL
- * picture, not just the one-word kind), plus the opened dir vs repo root, the
- * chosen kind, and the single reason that drove it.
- */
-export declare function buildPreflightDiagnostics(openedDir: string, repoDir: string, health: RepoHealth, kind: RepairNeed | null): LogData;

package/dist/lib/remote-auth/recovery/locks.d.ts

@@ -1,20 +0,0 @@
-export interface LockCandidate {
-    /** Absolute path to the lock file. */
-    path: string;
-    /** Age in ms relative to `now` (now - mtime). */
-    ageMs: number;
-}
-/**
- * Gather every candidate lock file (top-level + refs/**) with its age.
- * Locks that vanish between discovery and stat are simply dropped (a racing
- * delete is fine to ignore). Never throws.
- */
-export declare function findLockCandidates(gitDir: string, now: number): Promise<LockCandidate[]>;
-/**
- * Delete every stale lock under `gitDir` — but ONLY when every candidate is
- * stale (one fresh lock defers the whole sweep; a live process may hold it).
- *
- * Returns "clean" (nothing found), "swept" (all removed), or "fresh"
- * (deferred — the caller should retry later).
- */
-export declare function sweepStaleLocks(gitDir: string, now?: number, minAgeMs?: number): Promise<"clean" | "swept" | "fresh">;

package/dist/lib/remote-auth/recovery/repair.d.ts

@@ -1,29 +0,0 @@
-import type { HostCredential, TokenStore } from "../token-store.ts";
-export interface RepairOptions {
-    projectDir: string;
-    /** Explicit credential; wins over the token store (nuclear re-clone only). */
-    credential?: HostCredential;
-    /** Host-keyed store used to resolve the credential for the remote's host. */
-    tokenStore?: TokenStore;
-    authorName?: string;
-    authorEmail?: string;
-    /** Operation log (same file sync writes to). */
-    logFile?: string;
-}
-export interface RepairResult {
-    status: "repaired" | "retry_later" | "failed";
-    /** One author-language sentence describing the outcome. */
-    message: string;
-    /** Author-language lines describing what was done (for the log/details). */
-    actions: string[];
-    /** Present when the re-clone ran: on-disk backup of the old `.git`. */
-    damagedGitBackupPath?: string;
-    /** Suggested delay before retrying (present on "retry_later"). */
-    retryAfterMs?: number;
-}
-/**
- * Repair a damaged repository. See the module header for the pipeline and
- * invariants. Never throws for expected outcomes — everything is reported
- * through {@link RepairResult}.
- */
-export declare function repairRepo(options: RepairOptions): Promise<RepairResult>;

package/dist/lib/remote-auth/recovery/types.d.ts

@@ -1,39 +0,0 @@
-/**
- * Shared types for the repo health probe + repair pipeline.
- *
- * 2026-08-14 simplification (owner directive): the old handler-dispatch type
- * surface (SyncErrorKind taxonomy, RecoveryContext, RecoveryResult,
- * ManualGuidance, confirmation gates, fault injection) is gone — repair is
- * one automatic pipeline (repair.ts) and needs none of it. What remains is
- * the health snapshot inspect.ts produces.
- */
-export interface RepoHealth {
-    /** True when .git/ exists and looks like a valid git dir. */
-    hasGitDir: boolean;
-    /** Current branch name, or undefined when HEAD is detached. */
-    currentBranch?: string;
-    /** True when HEAD is detached (no named branch). */
-    isDetachedHead: boolean;
-    /**
-     * True when HEAD (or the ref store) could not even be READ — distinct from
-     * a clean detached HEAD, where HEAD resolves fine but points at a commit
-     * instead of a branch. Routes to the re-clone step of repairRepo.
-     */
-    headUnreadable: boolean;
-    /**
-     * True when a leftover git lock file exists (a previous operation may have
-     * died). Detects any of index.lock, HEAD.lock, config.lock, packed-refs.lock,
-     * or a per-ref refs/**\/*.lock — the same set the lock sweep scans.
-     */
-    hasStaleLock: boolean;
-    /** How old the YOUNGEST detected lock file is in milliseconds, when present. */
-    lockAgeMs?: number;
-    /** True when a MERGE_HEAD file exists (interrupted merge). */
-    hasInterruptedMerge: boolean;
-    /** True when a rebase-in-progress directory exists. */
-    hasInterruptedRebase: boolean;
-    /** True when CHERRY_PICK_HEAD exists. */
-    hasInterruptedCherryPick: boolean;
-    /** True when the working tree has uncommitted changes. */
-    hasLocalChanges: boolean;
-}