gutterpress 0.9.0-alpha.2 → 0.10.0-alpha.4

package/dist/lib/remote-auth/recovery/classify.d.ts

@@ -1,38 +1,42 @@
 /**
- * Error-to-kind classifier for the sync-recovery subsystem — the SINGLE
- * source of truth for git error classification.
+ * Error/health classification for sync + repair — the SINGLE source of truth.
  *
- * Maps a thrown error (from isomorphic-git or sync.ts) plus an optional
- * RepoHealth preflight to a SyncErrorKind. The building blocks
- * (isPushRejected, isMergeConflictError, classifyTransportFailure) are
- * exported and consumed by sync.ts — there is exactly ONE implementation of
- * each decoder, not parallel copies "kept in sync by spec".
+ * 2026-08-14 simplification (owner directive): the 17-kind SyncErrorKind
+ * taxonomy and its 16 per-kind handlers are gone. Every structural problem a
+ * repo can have now has ONE answer — `repairRepo()` (repair.ts) — so
+ * classification collapses to three health verdicts:
  *
- * classifyFromHealth() is the health-only classifier used by preflight
- * callers (no thrown error yet — e.g. the desktop at project-open): it returns
- * null for a healthy repo so the caller can skip recovery entirely.
+ *   - null           — healthy, nothing to do
+ *   - "stale_lock"   — a leftover lock old enough to sweep
+ *   - "needs_repair" — anything structural (missing/corrupt `.git`, broken
+ *                      ref store, detached HEAD, interrupted merge/rebase/
+ *                      cherry-pick left by an external tool)
  *
+ * The transport decoders (auth/offline/insecure) and the merge/push guards
+ * used by sync.ts remain here unchanged — outcome mapping, not repair.
  * This module is pure — no I/O, no side effects.
  */
-import type { RepoHealth, SyncErrorKind } from "./types.ts";
+import type { RepoHealth } from "./types.ts";
 /**
- * Minimum age before a leftover git lock counts as STALE for a preflight
- * classification. recover-stale-lock.ts imports this same constant as its
- * act-or-retry threshold, so preflight and handler can never disagree: a lock
- * young enough to pass preflight is exactly a lock the handler would defer
- * with retry_later ("a live process may still hold it").
+ * Minimum age before a leftover git lock counts as STALE. locks.ts imports
+ * this same constant as its sweep threshold, so preflight and sweep can never
+ * disagree: a lock young enough to pass preflight is exactly a lock the sweep
+ * would defer ("a live process may still hold it").
  */
 export declare const STALE_LOCK_MIN_AGE_MS: number;
+/** The collapsed repair taxonomy — see the module header. */
+export type RepairNeed = "stale_lock" | "needs_repair";
 /**
- * Thrown by syncProject's structural preflight when the repo must be repaired
- * before any sync work can safely run. The `code` string is the STABLE
- * contract hosts may match on across the dynamic-import boundary (where
- * `instanceof` is unreliable); `kind` names the repair to dispatch.
+ * Thrown by sync's structural preflight when the repo must be repaired before
+ * any sync work can safely run. The `code` string is the STABLE contract
+ * hosts may match on across the dynamic-import boundary (where `instanceof`
+ * is unreliable); `kind` says whether a lock sweep suffices or the full
+ * repair pipeline is needed.
  */
 export declare class RepoNeedsRecoveryError extends Error {
-    readonly kind: SyncErrorKind;
+    readonly kind: RepairNeed;
     readonly code = "RepoNeedsRecovery";
-    constructor(kind: SyncErrorKind);
+    constructor(kind: RepairNeed);
 }
 /** Type guard for {@link RepoNeedsRecoveryError} (matches on the stable code). */
 export declare function isRepoNeedsRecoveryError(e: unknown): e is RepoNeedsRecoveryError;
@@ -40,9 +44,8 @@ export declare function isRepoNeedsRecoveryError(e: unknown): e is RepoNeedsReco
  * Thrown by transport.ts's onAuth when a stored credential EXISTS but the
  * remote URL fails isCredentialTransmissionSafe (non-loopback http). Loud and
  * typed on purpose: the old behavior (silently withholding the credential)
- * surfaced as a 401 → "auth" → "reconnect" loop, and recover-auth then deleted
- * the credential for the whole host. The `code` string is the STABLE contract
- * (matchable across dynamic-import boundaries where `instanceof` fails).
+ * surfaced as a 401 → "auth" → "reconnect" loop. The `code` string is the
+ * STABLE contract (matchable across dynamic-import boundaries).
  */
 export declare class InsecureTransportError extends Error {
     readonly code = "InsecureTransport";
@@ -51,7 +54,7 @@ export declare class InsecureTransportError extends Error {
 /** Type guard for {@link InsecureTransportError} (matches on the stable code). */
 export declare function isInsecureTransportError(e: unknown): e is InsecureTransportError;
 export declare function isPushRejected(e: unknown): boolean;
-/** Type guard exposing MergeConflictError's per-file payload (used by sync.ts). */
+/** Type guard exposing MergeConflictError's per-file payload (converge-merge). */
 export declare function isMergeConflictError(e: unknown): e is {
     data: {
         filepaths: string[];
@@ -60,50 +63,35 @@ export declare function isMergeConflictError(e: unknown): e is {
         deleteByTheirs: string[];
     };
 };
+/**
+ * Unrelated histories — the local project and the configured online project
+ * share no common starting point. Sync surfaces this as a plain setup error
+ * (a wrong online address must never be silently spliced into the book).
+ */
+export declare function isUnrelatedHistories(e: unknown): boolean;
 export declare function classifyTransportFailure(e: unknown): "auth_required" | "network_unavailable" | "insecure_transport" | null;
 /**
- * Classify a structural repo condition from a RepoHealth snapshot alone.
- * Used by preflight callers (no thrown error — e.g. project-open), and by
- * classifyGitError's structural step so there is ONE ordering, not two.
- *
- * Returns null for a healthy repo (nothing to recover).
- *
- * ORDERING: interrupted-operation checks MUST precede the detached-head check
- * (an in-progress rebase usually detaches HEAD — the abort repair must win over
- * the rescue-branch repair), and specific interrupted-op repairs precede the
- * generic stale-lock cleanup.
- *
- * `minLockAgeMs` gates the stale-lock classification: at preflight (the
- * default, STALE_LOCK_MIN_AGE_MS) a younger lock is treated as healthy because
- * a live process may still hold it — the same rule recover-stale-lock.ts
- * applies before acting. Error-path callers pass 0: a lock that just made a
- * sync THROW is worth routing regardless of age (the handler still re-checks
- * and returns retry_later while it is fresh).
+ * True when a thrown error smells like LOCAL repo corruption (unreadable
+ * objects/refs/index) rather than a transport or logic failure — the signal
+ * for a host's mid-sync catch to run `repairRepo()`. NOTE on NotFoundError
+ * ambiguity: a transport 404 also surfaces as NotFoundError, but
+ * transport.ts's fetchRemoteTip rewrites those to an HttpError(401) BEFORE
+ * they can reach this heuristic, so a raw NotFoundError here is a LOCAL
+ * ref-resolution failure.
  */
-export declare function classifyFromHealth(health: RepoHealth, opts?: {
-    minLockAgeMs?: number;
-}): SyncErrorKind | null;
+export declare function isLikelyRepoCorruption(e: unknown): boolean;
 /**
- * Map a thrown error plus optional repo-health facts to a SyncErrorKind.
- *
- * Called by the recovery dispatcher BEFORE invoking the per-kind handler.
+ * Classify a repo's structural condition from a RepoHealth snapshot.
+ * Returns null for a healthy repo, "stale_lock" when the only problem is a
+ * sweepable lock, and "needs_repair" for everything structural — the repair
+ * pipeline (repair.ts) handles every structural case in one ordered pass, so
+ * finer distinctions buy nothing.
  *
- * ORDERING (BUG 1 — transient transport beats structural health):
- *   1. missing_git_dir — when there is genuinely no repo, a transport error is
- *      meaningless (nothing to talk to a remote ABOUT), so the missing-repo
- *      guidance must win even over an auth/network error.
- *   2. Clearly transient/transport errors (auth, network) — these are decoded
- *      from the THROWN ERROR and win over the remaining structural health
- *      flags (detached HEAD, stale lock). Rationale: you cannot repair repo
- *      STRUCTURE while you are offline or signed out, and the scary
- *      backup+rescue-branch+confirm repair is the wrong first response to a
- *      blip — the friendly "reconnect" / "try later" is correct. Once the user
- *      is back online, the next sync re-runs preflight (no thrown error) and
- *      the structural kind surfaces then (step 3).
- *   3. Structural health flags (detached HEAD, stale lock) — applied when the
- *      failure is NOT a transient transport error (e.g. a preflight with no
- *      error, or a non-transport error).
- *   4. Remaining error-code/message heuristics (conflicts, corrupt index,
- *      unrelated histories, missing objects/ref-store, wrong remote/branch).
+ * `minLockAgeMs` gates the stale-lock verdict: at preflight (the default) a
+ * younger lock is treated as healthy because a live process may still hold
+ * it. Error-path callers pass 0: a lock that just made a sync THROW is worth
+ * routing regardless of age (the sweep still defers while it is fresh).
  */
-export declare function classifyGitError(err: unknown, health?: RepoHealth): SyncErrorKind;
+export declare function classifyFromHealth(health: RepoHealth, opts?: {
+    minLockAgeMs?: number;
+}): RepairNeed | null;

package/dist/lib/remote-auth/recovery/inspect.d.ts

@@ -12,15 +12,16 @@
  * Notes on two health facts:
  *   - hasGitDir is true whenever `.git/` EXISTS, even with a missing/corrupt
  *     HEAD (a damaged repo is still a repo — see the inline note at the check).
- *   - hasStaleLock uses the stale-lock handler's OWN lock scanner
- *     (findLockCandidates in recover-stale-lock.ts) — one implementation, so
+ *   - hasStaleLock uses the lock sweep's OWN scanner
+ *     (findLockCandidates in locks.ts) — one implementation, so
  *     health and handler can never disagree about which locks exist.
  *
  * All probes are best-effort and throw-free (the caller must never see an
  * exception from a preflight probe).
  */
 import type { LogData } from "../operation-log.ts";
-import type { RepoHealth, RecoveryContext, SyncErrorKind } from "./types.ts";
+import type { RepairNeed } from "./classify.ts";
+import type { RepoHealth } from "./types.ts";
 /**
  * Probe the local repository and return a RepoHealth snapshot.
  * Never throws — on any error the relevant flag is set conservatively.
@@ -31,7 +32,10 @@ import type { RepoHealth, RecoveryContext, SyncErrorKind } from "./types.ts";
  * pull step immediately performs the same walk anyway (sync-simplicity
  * mandate: no redundant walks on the hot path).
  */
-export declare function inspectRepo(ctx: Pick<RecoveryContext, "repoDir" | "source">, opts?: {
+export declare function inspectRepo(ctx: {
+    repoDir: string;
+    source?: import("../../project-source.ts").ProjectSource;
+}, opts?: {
     checkLocalChanges?: boolean;
 }): Promise<RepoHealth>;
 /**
@@ -39,15 +43,12 @@ export declare function inspectRepo(ctx: Pick<RecoveryContext, "repoDir" | "sour
  * its commit, and read its root tree. Throws when any step fails (missing or
  * corrupt object/ref); resolves when the repo is fully readable.
  *
- * This is the SAME verification recover-missing-objects.ts performs to check
- * whether a fetch actually repaired the object store — it is exported here so
- * that check and the repair command's diagnosis step share ONE implementation
- * rather than two copies that could drift. `inspectRepo`'s health flags are
+ * Exported so the repair
+ * command's diagnosis step and any host check share ONE implementation. `inspectRepo`'s health flags are
  * all filesystem-presence checks (no object is ever read), so they cannot
  * detect object-store corruption on their own — callers that need to catch
- * `corrupt_index` / `missing_or_corrupt_objects` / `unrelated_histories` /
- * `wrong_remote_or_branch` must run this probe and feed a caught error
- * through `classifyGitError`.
+ * unreadable objects/refs must run this probe and feed a caught error through
+ * `isLikelyRepoCorruption` (classify.ts) to decide whether to repairRepo().
  */
 export declare function verifyRepoReadable(dir: string): Promise<void>;
 /**
@@ -64,11 +65,11 @@ export declare function isUnbornRepo(repoDir: string): boolean;
  * classifyFromHealth returned (a pure mapping — it cannot drift from the
  * classifier's decision order, because it never re-implements it).
  */
-export declare function preflightStructuralReason(kind: SyncErrorKind | null): string;
+export declare function preflightStructuralReason(kind: RepairNeed | null): string;
 /**
  * Build a flat, secret-free record of the preflight decision inputs for the
  * operation log. Every health boolean is recorded (so support can see the FULL
  * picture, not just the one-word kind), plus the opened dir vs repo root, the
  * chosen kind, and the single reason that drove it.
  */
-export declare function buildPreflightDiagnostics(openedDir: string, repoDir: string, health: RepoHealth, kind: SyncErrorKind | null): LogData;
+export declare function buildPreflightDiagnostics(openedDir: string, repoDir: string, health: RepoHealth, kind: RepairNeed | null): LogData;

package/dist/lib/remote-auth/recovery/locks.d.ts

@@ -0,0 +1,20 @@
+export interface LockCandidate {
+    /** Absolute path to the lock file. */
+    path: string;
+    /** Age in ms relative to `now` (now - mtime). */
+    ageMs: number;
+}
+/**
+ * Gather every candidate lock file (top-level + refs/**) with its age.
+ * Locks that vanish between discovery and stat are simply dropped (a racing
+ * delete is fine to ignore). Never throws.
+ */
+export declare function findLockCandidates(gitDir: string, now: number): Promise<LockCandidate[]>;
+/**
+ * Delete every stale lock under `gitDir` — but ONLY when every candidate is
+ * stale (one fresh lock defers the whole sweep; a live process may hold it).
+ *
+ * Returns "clean" (nothing found), "swept" (all removed), or "fresh"
+ * (deferred — the caller should retry later).
+ */
+export declare function sweepStaleLocks(gitDir: string, now?: number, minAgeMs?: number): Promise<"clean" | "swept" | "fresh">;

package/dist/lib/remote-auth/recovery/repair.d.ts

@@ -0,0 +1,29 @@
+import type { HostCredential, TokenStore } from "../token-store.ts";
+export interface RepairOptions {
+    projectDir: string;
+    /** Explicit credential; wins over the token store (nuclear re-clone only). */
+    credential?: HostCredential;
+    /** Host-keyed store used to resolve the credential for the remote's host. */
+    tokenStore?: TokenStore;
+    authorName?: string;
+    authorEmail?: string;
+    /** Operation log (same file sync writes to). */
+    logFile?: string;
+}
+export interface RepairResult {
+    status: "repaired" | "retry_later" | "failed";
+    /** One author-language sentence describing the outcome. */
+    message: string;
+    /** Author-language lines describing what was done (for the log/details). */
+    actions: string[];
+    /** Present when the re-clone ran: on-disk backup of the old `.git`. */
+    damagedGitBackupPath?: string;
+    /** Suggested delay before retrying (present on "retry_later"). */
+    retryAfterMs?: number;
+}
+/**
+ * Repair a damaged repository. See the module header for the pipeline and
+ * invariants. Never throws for expected outcomes — everything is reported
+ * through {@link RepairResult}.
+ */
+export declare function repairRepo(options: RepairOptions): Promise<RepairResult>;

package/dist/lib/remote-auth/recovery/types.d.ts

@@ -1,131 +1,11 @@
 /**
- * Shared types and dispatcher contract for the sync-recovery subsystem.
+ * Shared types for the repo health probe + repair pipeline.
  *
- * Every recover-<x>.ts handler imports from here. This module contains ZERO
- * logic — it is a pure type surface. The dispatcher (dispatch.ts) maps a
- * SyncErrorKind to its handler and is wired in the Integrate phase.
- *
- * Author-facing copy rules: no git words, no tokens, no internal paths visible
- * to users. Every user-visible string lives in manual-guidance.ts.
- */
-import type httpNode from "isomorphic-git/http/node";
-import type { ProjectSource } from "../../project-source.ts";
-import type { ConflictFile } from "../sync.ts";
-import type { HostCredential, TokenStore } from "../token-store.ts";
-/**
- * Every failure mode the recovery subsystem can handle. The classifier
- * (classify.ts) maps a thrown error + repo health facts to one of these.
- */
-export type SyncErrorKind = "non_fast_forward" | "merge_conflict" | "binary_conflict" | "auth_required" | "network_unavailable" | "insecure_transport" | "detached_head" | "stale_lock" | "corrupt_index" | "missing_git_dir" | "missing_or_corrupt_objects" | "unrelated_histories" | "wrong_remote_or_branch" | "interrupted_rebase" | "interrupted_cherry_pick" | "interrupted_merge" | "unknown";
-/**
- * Machine token for the primary CTA in the guidance dialog. The host switches
- * on this to route the button to the right flow. The human-readable label the
- * button shows lives in `ManualGuidance.recommendedAction` (never this token).
- */
-export type RecoveryActionKey = "sync" | "reconnect" | "resolve_conflict" | "restore_repo" | "check_connection";
-/**
- * How much irreversible change a repair makes. The confirmation gate shows
- * a plain-language summary appropriate to the risk level.
- */
-export type RecoveryRisk = "none" | "low" | "medium" | "high";
-/**
- * Jargon-free guidance the host shows when a repair is blocked or fails.
- * No git words, no tokens, no internal paths.
- */
-export interface ManualGuidance {
-    /** One-sentence plain-language summary of what went wrong. */
-    userSummary: string;
-    /** The single most important action the user should take next. */
-    recommendedNextStep: string;
-    /** Action label for the primary button in the UI. */
-    recommendedAction: string;
-    /** Machine token the host switches on to route the primary button's action. */
-    recommendedActionKey: RecoveryActionKey;
-    /** Optional secondary steps (shown as a list). */
-    safeNextSteps?: string[];
-    /** Details for a support ticket — may contain technical info. */
-    supportDetails?: string;
-    /** Path to the backup zip, when one was created before the failure. */
-    backupZipPath?: string;
-}
-/** The backup zip created before a risky repair. */
-export interface RecoveryBackup {
-    /** Absolute path to the zip file under os.tmpdir()/print-sync-recovery/. */
-    zipPath: string;
-    /** ISO timestamp the backup was created. */
-    createdAt: string;
-    /** Files included in the backup (relative paths). */
-    entries: string[];
-}
-/**
- * What a confirmation gate shows the user before a risky repair.
- * The UI must render this information — never silently start a risky repair.
- */
-export interface RepairConfirmation {
-    repair: SyncErrorKind;
-    risk: RecoveryRisk;
-    /** Plain-language summary of what the repair will do. */
-    summary: string;
-    /** Path to the backup zip (already created and verified). */
-    backupZipPath: string;
-    willChangeLocalFiles: boolean;
-    willChangeGitMetadata: boolean;
-    willChangeRemote: boolean;
-    /** True when the backup alone is enough to undo the repair. */
-    canBeUndoneFromBackup: boolean;
-}
-/** Gate the host must satisfy: show the user what will happen and ask. */
-export interface ConfirmationGate {
-    confirmRepair(req: RepairConfirmation): Promise<boolean>;
-}
-/**
- * Outcome of a recovery attempt. Each status maps to a host-side action:
- * - recovered        → refresh the project; show a success toast.
- * - retry_later      → schedule a retry after retryAfterMs; show a soft message.
- * - needs_user       → show the conflict chooser / reconnect dialog.
- * - blocked          → show guidance and a "what do I do?" panel.
- * - failed_no_changes_made → show guidance; nothing was changed locally or remotely.
- * - failed_backup_available → show guidance + "open backup folder" button.
- */
-export type RecoveryResult = {
-    status: "recovered";
-    message: string;
-    backupZipPath?: string;
-} | {
-    status: "retry_later";
-    message: string;
-    retryAfterMs: number;
-} | {
-    status: "needs_user";
-    message: string;
-    guidance: ManualGuidance;
-    files?: ConflictFile[];
-    backupZipPath?: string;
-    /**
-     * Conflict tip OIDs threaded through to the host so it can call
-     * resolveConflicts with the correct local/remote versions after the user
-     * chooses. Present on the per-file conflict-chooser paths only.
-     */
-    localId?: string;
-    remoteId?: string;
-} | {
-    status: "blocked";
-    message: string;
-    guidance: ManualGuidance;
-    backupZipPath?: string;
-} | {
-    status: "failed_no_changes_made";
-    message: string;
-    guidance: ManualGuidance;
-} | {
-    status: "failed_backup_available";
-    message: string;
-    backupZipPath: string;
-    guidance: ManualGuidance;
-};
-/**
- * Preflight health snapshot of a local repo. Populated by inspectRepo()
- * (inspect.ts) before any recovery decision is made.
+ * 2026-08-14 simplification (owner directive): the old handler-dispatch type
+ * surface (SyncErrorKind taxonomy, RecoveryContext, RecoveryResult,
+ * ManualGuidance, confirmation gates, fault injection) is gone — repair is
+ * one automatic pipeline (repair.ts) and needs none of it. What remains is
+ * the health snapshot inspect.ts produces.
  */
 export interface RepoHealth {
     /** True when .git/ exists and looks like a valid git dir. */
@@ -137,15 +17,13 @@ export interface RepoHealth {
     /**
      * True when HEAD (or the ref store) could not even be READ — distinct from
      * a clean detached HEAD, where HEAD resolves fine but points at a commit
-     * instead of a branch. This means the repo's ref store or HEAD file is
-     * missing/corrupt, and routes to `missing_or_corrupt_objects` instead of
-     * `detached_head` (see classifyFromHealth).
+     * instead of a branch. Routes to the re-clone step of repairRepo.
      */
     headUnreadable: boolean;
     /**
      * True when a leftover git lock file exists (a previous operation may have
      * died). Detects any of index.lock, HEAD.lock, config.lock, packed-refs.lock,
-     * or a per-ref refs/**\/*.lock — the same set the stale-lock handler scans.
+     * or a per-ref refs/**\/*.lock — the same set the lock sweep scans.
      */
     hasStaleLock: boolean;
     /** How old the YOUNGEST detected lock file is in milliseconds, when present. */
@@ -159,77 +37,3 @@ export interface RepoHealth {
     /** True when the working tree has uncommitted changes. */
     hasLocalChanges: boolean;
 }
-/**
- * Named fault injection points every risky repair MUST call via
- * `ctx.faults?.before(point)`. Throwing from this hook simulates a failure
- * at that exact point so failsafe invariants can be asserted.
- */
-export type FaultPoint = "backup_create" | "backup_verify" | "after_backup_before_repair" | "fetch" | "merge" | "checkout_branch" | "abort_interrupted_operation" | "remove_operation_state" | "create_recovery_branch" | "commit_recovery_snapshot" | "remove_index_lock" | "remove_index" | "rebuild_index" | "clone_temp_repo" | "replace_git_dir" | "push" | "write_conflict_snapshot";
-export interface FaultInjector {
-    before(point: FaultPoint): Promise<void>;
-}
-/**
- * Everything a recover-<x>.ts handler needs. Extends SyncProjectOptions with
- * the repo-level facts that the dispatcher resolves once and passes down.
- */
-export interface RecoveryContext {
-    /** The project directory the user opened (may be a repo subfolder). */
-    projectDir: string;
-    /** Absolute path to the git repository root. */
-    repoDir: string;
-    /**
-     * The projectDir's classification, resolved ONCE by buildRecoveryContext and
-     * threaded to every consumer (inspectRepo, diagnoseProjectRemote) so the
-     * recovery path never re-walks parent dirs to re-classify the same folder.
-     * `null` records that classification failed; omitted means "not resolved" —
-     * consumers classify themselves in both cases.
-     */
-    source?: ProjectSource | null;
-    /** Current branch name (may be empty on detached HEAD). */
-    branch: string;
-    /** Sanitized HTTPS remote URL (no embedded credentials). */
-    remoteUrl?: string;
-    /** Short identifier for the repo used in backup paths. */
-    repoSlug: string;
-    /** Resolved credential for the remote host. */
-    credential?: HostCredential;
-    /** Host-keyed credential store (for clearing stale tokens). */
-    tokenStore?: TokenStore;
-    /** Injectable HTTP transport (real or test mock). */
-    httpClient?: typeof httpNode;
-    /** The user's display name for snapshot commits. */
-    authorName?: string;
-    /** The user's email for snapshot commits. Paired with `authorName` — a
-     *  recovery commit must carry the SAME identity a normal snapshot does. */
-    authorEmail?: string;
-    /** Gate the host must satisfy before a risky repair starts. */
-    confirmation: ConfirmationGate;
-    /** Fault injection hooks (tests only — omit in production). */
-    faults?: FaultInjector;
-    /** Clock override (tests only). Returns epoch ms. */
-    now?: () => number;
-    /**
-     * Optional path to a log file for debugging. When set, each recovery step
-     * (backup, fetch, merge, checkout, etc.) is appended as a timestamped line.
-     * Never logs secrets — only repo slug, branch, short OIDs, outcome status.
-     */
-    logFile?: string;
-}
-/**
- * The signature every recover-<x>.ts module MUST export.
- * The dispatcher (dispatch.ts) maps SyncErrorKind → RecoverFn.
- */
-export type RecoverFn = (ctx: RecoveryContext, error?: unknown) => Promise<RecoveryResult>;
-/**
- * Optional per-kind precondition probe a recover-<x>.ts module MAY export as
- * `stillApplies`. The dispatcher calls it — for serializeRepo:true kinds only,
- * INSIDE withRepoLock, immediately before invoking the handler body — to catch
- * the case where the condition that justified this kind was already resolved
- * (externally, or by a previous attempt) between classification and dispatch.
- * Returning false means there is nothing left to repair; the dispatcher
- * returns a benign no-op RecoveryResult without running the handler at all.
- * Must be read-only and throw-free from the caller's perspective (probes
- * should catch their own errors and resolve `true` — "assume it still
- * applies" — rather than reject, so a probe failure never blocks recovery).
- */
-export type StillAppliesFn = (ctx: RecoveryContext) => Promise<boolean>;

package/dist/lib/remote-auth/sync-messages.d.ts

@@ -11,8 +11,8 @@ export declare const MSG_SYNCED_MERGED = "Your changes are online, combined with
 export declare const MSG_OFFLINE = "Your changes are saved on this computer. gutterpress couldn't reach the online repository \u2014 try syncing again when you're back online.";
 export declare const MSG_AUTH = "The online repository didn't accept the saved connection. Reconnect and try again.";
 export declare const MSG_INSECURE_TRANSPORT = "This project's online address isn't secure, so the saved connection wasn't sent \u2014 connections are never sent over an insecure address. Switch the address to a secure one (starting with https), or to a local loopback address for a server on this computer, to sync.";
-export declare const MSG_RACE = "Someone else synced changes at the same moment. Your work is saved on this computer \u2014 please try Sync again.";
-export declare const MSG_CONFLICT = "Your copy and the online copy both changed. Choose which version to keep for each file \u2014 a safety snapshot of your work was taken first.";
+export declare const MSG_BUSY = "The online copy is changing very quickly right now. Your work is saved on this computer \u2014 try Sync again in a moment.";
+export declare const MSG_UNRELATED = "The online address points at a different project's files, so the two can't be combined. Check the project's online address.";
 export declare const MSG_NO_REMOTE = "This project isn't connected to an online repository yet.";
 export declare const MSG_SSH_REMOTE = "This project's online address uses SSH (git@\u2026), which gutterpress can't sync to. Switch it to the web (HTTPS) address to sync from here.";
 export declare const MSG_NO_BRANCH = "This project's version history isn't on a named branch, so it can't be synced right now.";
@@ -21,6 +21,5 @@ export declare const MSG_PULLED_MERGED = "The latest online changes were combine
 export declare const MSG_PULL_UP_TO_DATE = "You already have the latest online changes.";
 export declare const MSG_PUSH_UP_TO_DATE = "There's nothing new to send \u2014 everything is already online.";
 export declare const MSG_PULL_FIRST = "The online copy has changes you don't have yet. Get the latest changes first, then send yours.";
-export declare const MSG_EXPIRED_CHOICES = "Those combine choices have expired. Please run Sync again.";
 /** Message recorded on the automatic pre-sync snapshot (D5 invariant). */
 export declare const SYNC_SNAPSHOT_MESSAGE = "Snapshot before syncing";