peaks-loop 4.0.0-beta.14 → 4.0.0-beta.16

package/dist/services/audit-independent/security-audit-service.js

@@ -1,316 +0,0 @@
-/**
- * peaks-security-audit service — independent security audit skill driver.
- *
- * Slice v2.12.0 (Group A, Tier 2). The skill is decoupled from the
- * peaks-rd 5-way fan-out (per PRD AC-2.x) and lives as a standalone
- * CLI surface: `peaks security-audit run --rid <id> ...`.
- *
- * The service owns:
- *   - 5-state detection of the security-audit runtime
- *     (handoff-missing / template-missing / dispatch-failed / template-malformed / ready)
- *   - Loading + sha256 verification of the prd/handoff.md
- *   - Loading the project-level security-template.md
- *   - Producing the audit envelope (verdict + violations) to write
- *     to `.peaks/_runtime/<sid>/audit/security-<rid>.md`
- *
- * The actual LLM-in-loop audit step is NOT in this service — the
- * parent LLM (peaks-security-audit skill prompt) reads the template,
- * runs the audit, and returns a structured envelope. This service
- * is the pure I/O + validation core; the LLM is the judgement core.
- *
- * Why a service (not inlined in the CLI):
- *   - Unit-testable in isolation (6 case per PRD AC-2.8)
- *   - The 5-state detector mirrors the ecc-bridge detectEcc pattern
- *     (slice 7 Group D), keeping the surface uniform
- *   - Future migration to peaks sub-agent dispatch (peaks-rd main
- *     loop can opt to call this service directly without re-implementing
- *     the handoff verification)
- *
- * Cross-references:
- *   - PRD: `.peaks/_runtime/<sid>/prd/handoff.md` (sha256-locked, schemaVersion: 2)
- *   - Template: `.peaks/project-scan/security-template.md`
- *   - Output: `.peaks/_runtime/<sid>/audit/security-<rid>.md`
- *   - Schema: `.peaks/project-scan/audit-output-schema.md` (schemaVersion: 1)
- */
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { join, resolve, isAbsolute } from 'node:path';
-import { createHash } from 'node:crypto';
-/**
- * Validate a raw value as a SecurityAuditEnvelope. Mirrors the
- * `isEccEnvelope` strict-shape pattern.
- */
-export function isSecurityAuditEnvelope(value) {
-    if (value === null || typeof value !== 'object')
-        return false;
-    const obj = value;
-    if (typeof obj.verdict !== 'string')
-        return false;
-    if (obj.verdict !== 'pass' && obj.verdict !== 'warn' && obj.verdict !== 'block') {
-        return false;
-    }
-    if (!Array.isArray(obj.violations))
-        return false;
-    if (typeof obj.summary !== 'string')
-        return false;
-    for (const v of obj.violations) {
-        if (v === null || typeof v !== 'object')
-            return false;
-        const vo = v;
-        if (typeof vo.dimension !== 'string')
-            return false;
-        if (typeof vo.severity !== 'string')
-            return false;
-        if (vo.severity !== 'CRITICAL' && vo.severity !== 'HIGH' && vo.severity !== 'MED' && vo.severity !== 'LOW') {
-            return false;
-        }
-        if (typeof vo.file !== 'string')
-            return false;
-        if (typeof vo.line !== 'number' || !Number.isFinite(vo.line))
-            return false;
-        if (typeof vo.hint !== 'string')
-            return false;
-    }
-    return true;
-}
-/**
- * Read the peaks-prd handoff frontmatter + body, verify sha256 matches
- * the body. Returns null on missing file or sha256 mismatch; otherwise
- * returns the parsed frontmatter + body string.
- *
- * Defensive: we read frontmatter via a 1-line regex match, not via
- * a YAML parser. The handoff service (`src/services/prd/handoff-service.ts`)
- * is the canonical writer; we only consume its output here.
- */
-export function readAndVerifyHandoff(handoffPath, projectRoot) {
-    if (!handoffPath || !isAbsolute(handoffPath)) {
-        const absolutePath = resolve(projectRoot, handoffPath);
-        if (!existsSync(absolutePath))
-            return null;
-        return readAndVerifyHandoff(absolutePath, projectRoot);
-    }
-    if (!existsSync(handoffPath))
-        return null;
-    let raw;
-    try {
-        raw = readFileSync(handoffPath, 'utf8');
-    }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-        return null;
-    }
-    // Frontmatter pattern: `---` line, then key: value pairs, then `---` line.
-    const match = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
-    if (match === null)
-        return null;
-    const frontmatterRaw = match[1];
-    const body = match[2];
-    const sha256Match = frontmatterRaw.match(/^sha256:\s*([a-f0-9]{64})\s*$/m);
-    const schemaVersionMatch = frontmatterRaw.match(/^schemaVersion:\s*(\d+)\s*$/m);
-    if (sha256Match === null || schemaVersionMatch === null)
-        return null;
-    const sha256Expected = sha256Match[1];
-    const schemaVersion = parseInt(schemaVersionMatch[1], 10);
-    const sha256Actual = createHash('sha256').update(body, 'utf8').digest('hex');
-    if (sha256Expected !== sha256Actual)
-        return null;
-    return {
-        frontmatter: { sha256: sha256Expected, schemaVersion },
-        body,
-    };
-}
-/**
- * Read the project-level security-template.md. Returns the body
- * string (with frontmatter stripped) or null if the file is absent.
- * Does NOT validate the template content; the parent LLM validates
- * by reading.
- */
-export function readSecurityTemplate(projectRoot) {
-    const templatePath = join(projectRoot, '.peaks', 'project-scan', 'security-template.md');
-    if (!existsSync(templatePath))
-        return null;
-    try {
-        return readFileSync(templatePath, 'utf8');
-    }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-        return null;
-    }
-}
-/**
- * 5-state detector. The parent skill inspects the state and either
- * proceeds (when `ready`) or records a degradation note and falls
- * back (when any other state).
- *
- * Soft-fail policy mirrors `detectEcc` (slice 7 Group D): the CLI
- * never throws; it returns a typed detect result.
- */
-export function detectSecurityAudit(input) {
-    const warnings = [];
-    const nextActions = [];
-    const handoffPath = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'prd', 'handoff.md');
-    const handoffPresent = existsSync(handoffPath);
-    const templatePath = join(input.projectRoot, '.peaks', 'project-scan', 'security-template.md');
-    const templatePresent = existsSync(templatePath);
-    if (!handoffPresent) {
-        return {
-            state: 'handoff-missing',
-            handoffPresent: false,
-            templatePresent,
-            warnings: [`peaks-prd handoff not found at ${handoffPath}`],
-            nextActions: [
-                'Run peaks-prd handoff init to produce a sha256-locked handoff before running peaks security-audit.',
-                'Until the handoff exists, peaks-security-audit cannot start (gate fail).'
-            ]
-        };
-    }
-    if (!templatePresent) {
-        return {
-            state: 'template-missing',
-            handoffPresent: true,
-            templatePresent: false,
-            warnings: [`security-template.md not found at ${templatePath}`],
-            nextActions: [
-                'Run peaks project template init to bootstrap the 3 audit templates (security-template, perf-template, audit-output-schema).',
-                'Until the template exists, peaks-security-audit cannot start (gate fail).'
-            ]
-        };
-    }
-    if (input.dispatchError !== undefined) {
-        return {
-            state: 'dispatch-failed',
-            handoffPresent: true,
-            templatePresent: true,
-            warnings: [
-                `Audit dispatch failed: ${input.dispatchError instanceof Error ? input.dispatchError.message : String(input.dispatchError)}`
-            ],
-            nextActions: [
-                'Inspect the audit prompt template for the failure cause.',
-                'peaks-security-audit falls back to inline LLM review (degradation note: security-audit-dispatch-failed).'
-            ]
-        };
-    }
-    if (input.envelope !== undefined && !isSecurityAuditEnvelope(input.envelope)) {
-        return {
-            state: 'envelope-malformed',
-            handoffPresent: true,
-            templatePresent: true,
-            warnings: [
-                'Security-audit returned a value that failed envelope validation (expected { verdict, violations, summary }).'
-            ],
-            nextActions: [
-                'Verify the security-audit skill prompt matches PRD AC-2.x output shape.',
-                'If the envelope shape is intentionally different, file a bug at the peaks-loop repo.'
-            ]
-        };
-    }
-    return {
-        state: 'ready',
-        handoffPresent: true,
-        templatePresent: true,
-        warnings,
-        nextActions
-    };
-}
-/**
- * Render a SecurityAuditEnvelope to the canonical audit artifact body
- * (markdown). Mirrors `adaptEccEnvelopeToRdCodeReview` in ecc-bridge.ts:
- * produce a markdown body with all required sections, ready to write
- * to `.peaks/_runtime/<sid>/audit/security-<rid>.md`.
- */
-export function renderSecurityAuditArtifact(env, opts) {
-    const counts = {};
-    for (const v of env.violations) {
-        counts[v.severity] = (counts[v.severity] ?? 0) + 1;
-    }
-    const criticalCount = counts['CRITICAL'] ?? 0;
-    const findingsBullets = env.violations.length === 0
-        ? '- (none)'
-        : env.violations.map((v) => `- [${v.severity}] ${v.dimension} @ ${v.file}:${v.line} — ${v.hint}`).join('\n');
-    const requiredFixes = env.violations.length === 0
-        ? ''
-        : [
-            '## Required fixes',
-            '',
-            ...env.violations.map((v) => `- [${v.severity}] ${v.file}:${v.line} — ${v.hint}`),
-            ''
-        ].join('\n');
-    const body = [
-        '## Summary',
-        '',
-        env.summary,
-        '',
-        '## Threat model coverage',
-        '',
-        `audited at: ${opts.generatedAt}`,
-        `verdict: ${env.verdict}`,
-        `handoffHash: ${opts.handoffHash}`,
-        '',
-        '## Findings',
-        '',
-        findingsBullets,
-        '',
-        requiredFixes,
-        '## Verdict',
-        '',
-        `verdict: ${env.verdict}`,
-        `CRITICAL: ${criticalCount}`,
-        ''
-    ].filter((s) => s.length > 0).join('\n');
-    return {
-        body,
-        violationsCount: env.violations.length,
-        verdict: env.verdict,
-    };
-}
-/**
- * Write the rendered audit artifact to
- * `.peaks/_runtime/<sid>/audit/security-<rid>.md`.
- *
- * Atomic write (tmp + rename) to avoid partial writes on crash.
- * Returns the absolute path on success.
- */
-export function writeSecurityAuditArtifact(projectRoot, sessionId, rid, body) {
-    const targetDir = join(projectRoot, '.peaks', '_runtime', sessionId, 'audit');
-    mkdirSync(targetDir, { recursive: true });
-    const targetPath = join(targetDir, `security-${rid}.md`);
-    // tmp + rename for atomicity
-    const tmpPath = `${targetPath}.tmp`;
-    writeFileSync(tmpPath, body, 'utf8');
-    // Sync rename: on Windows, fs.renameSync overwrites if target exists (Node 22+)
-    const { renameSync } = require('node:fs');
-    renameSync(tmpPath, targetPath);
-    return targetPath;
-}
-/**
- * Convenience: run `detectSecurityAudit` + `renderSecurityAuditArtifact`
- * + `writeSecurityAuditArtifact` in one call.
- *
- * Returns `{ detect, artifactPath, violationsCount, verdict }` or
- * `{ detect, artifactPath: null, ... }` when not ready.
- */
-export function runSecurityAudit(input) {
-    const detect = detectSecurityAudit({
-        projectRoot: input.projectRoot,
-        sessionId: input.sessionId,
-        ...(input.dispatchError !== undefined ? { dispatchError: input.dispatchError } : {}),
-        ...(input.envelope !== undefined ? { envelope: input.envelope } : {})
-    });
-    if (detect.state !== 'ready' || input.envelope === undefined) {
-        return { detect, artifactPath: null, violationsCount: 0, verdict: null };
-    }
-    // detect.state === 'ready' implies input.envelope passed isSecurityAuditEnvelope.
-    const env = input.envelope;
-    const handoffPath = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'prd', 'handoff.md');
-    const verified = readAndVerifyHandoff(handoffPath, input.projectRoot);
-    const handoffHash = verified?.frontmatter.sha256 ?? 'unknown';
-    const rendered = renderSecurityAuditArtifact(env, {
-        rid: input.rid,
-        handoffHash,
-        generatedAt: input.generatedAt
-    });
-    const artifactPath = writeSecurityAuditArtifact(input.projectRoot, input.sessionId, input.rid, rendered.body);
-    return {
-        detect,
-        artifactPath,
-        violationsCount: rendered.violationsCount,
-        verdict: rendered.verdict
-    };
-}

package/dist/services/context/dispatch-context-guard.d.ts

@@ -1,27 +0,0 @@
-/** Build the canonical artifact path for a given session/rid/role/idx/ext. */
-export declare function artifactPath(projectRoot: string, sid: string, rid: string, role: string, idx: number, ext?: string): string;
-/** Build the canonical shared channel path. */
-export declare function sharedChannelPath(projectRoot: string, sid: string, rid: string, batchId: string): string;
-/**
- * Assert that `artifactPath` lives under
- * `projectRoot/.peaks/_sub_agents/<sid>/artifacts/`. Rejects
- * symlink/junction escapes and `..` segments.
- *
- * Throws an Error with `.code = 'INVALID_ARTIFACT_PATH'` on rejection.
- */
-export declare function assertSafeArtifactPath(artifactPathInput: string, projectRoot: string): string;
-/**
- * Assert that `channelPath` lives under
- * `projectRoot/.peaks/_sub_agents/<sid>/shared/`. Same R-2 logic as
- * `assertSafeArtifactPath` but with a different canonical subdir.
- *
- * Throws an Error with `.code = 'INVALID_SHARED_CHANNEL_PATH'` on rejection.
- */
-export declare function assertSafeSharedChannelPath(channelPathInput: string, projectRoot: string): string;
-/**
- * Soft-warn check on the artifact file name pattern. Returns null if
- * the name matches `<rid>-<role>-<idx>.<ext>`, otherwise returns a
- * warning string. Does NOT reject (the path is still in the canonical
- * dir; the warning is for human/audit readability per G7.4.c).
- */
-export declare function checkArtifactNameConvention(artifactPathInput: string): string | null;

package/dist/services/context/dispatch-context-guard.js

@@ -1,192 +0,0 @@
-/**
- * G7.4 path safety + G8 path safety — R-2 symlink/junction guard for
- * sub-agent artifact + shared channel paths.
- *
- * Slice #009's `assertSafeDispatchRecordPath` covers the dispatch record
- * path. This module covers two adjacent paths under the same canonical
- * root (`.peaks/_sub_agents/<sid>/`):
- *
- *   - `artifacts/<rid>-<role>-<idx>.<ext>`   (G7 write-artifact)
- *   - `shared/<batchId>.json`                (G8 share / shared-read)
- *
- * Both reuse the same R-2 logic: reject `..` segments BEFORE the OS
- * resolver collapses them (POSIX normalize silently drops `..`), reject
- * absolute paths that escape the canonical root, resolve symlinks via
- * `realpathSync` and re-check the resolved path.
- *
- * The canonical-root pattern is intentionally identical to the slice #009
- * helper, so future audits can reuse one mental model: "all sub-agent
- * state files must live under `.peaks/_sub_agents/<sid>/` and pass the
- * same R-2 guard."
- */
-import { realpathSync } from 'node:fs';
-import { dirname, isAbsolute, relative, resolve } from 'node:path';
-const SUB_AGENTS_DIR = '_sub_agents';
-const ARTIFACTS_SUBDIR = 'artifacts';
-const SHARED_SUBDIR = 'shared';
-const ARTIFACT_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*\.[A-Za-z0-9]+$/;
-const BATCH_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-/** Build the canonical artifact path for a given session/rid/role/idx/ext. */
-export function artifactPath(projectRoot, sid, rid, role, idx, ext = 'md') {
-    if (typeof role !== 'string' || role.length === 0) {
-        throw new Error('artifactPath: role must be non-empty');
-    }
-    if (!Number.isInteger(idx) || idx < 1) {
-        throw new Error(`artifactPath: idx must be positive integer (got ${idx})`);
-    }
-    const safeSid = sanitizeSegment(sid, 'sessionId');
-    const safeRid = sanitizeSegment(rid, 'requestId');
-    const safeRole = sanitizeSegment(role, 'role');
-    const safeExt = ext.replace(/[^A-Za-z0-9]/g, '');
-    if (safeExt.length === 0) {
-        throw new Error(`artifactPath: ext must be alphanumeric (got "${ext}")`);
-    }
-    return resolve(projectRoot, '.peaks', SUB_AGENTS_DIR, safeSid, ARTIFACTS_SUBDIR, `${safeRid}-${safeRole}-${String(idx).padStart(3, '0')}.${safeExt}`);
-}
-/** Build the canonical shared channel path. */
-export function sharedChannelPath(projectRoot, sid, rid, batchId) {
-    if (typeof batchId !== 'string' || batchId.length === 0) {
-        throw new Error('sharedChannelPath: batchId must be non-empty');
-    }
-    const safeSid = sanitizeSegment(sid, 'sessionId');
-    const safeRid = sanitizeSegment(rid, 'requestId');
-    if (!BATCH_ID_PATTERN.test(batchId)) {
-        throw new Error(`sharedChannelPath: batchId must match ${BATCH_ID_PATTERN} (got "${batchId}")`);
-    }
-    return resolve(projectRoot, '.peaks', SUB_AGENTS_DIR, safeSid, SHARED_SUBDIR, `${safeRid}-${batchId}.json`);
-}
-/**
- * Assert that `artifactPath` lives under
- * `projectRoot/.peaks/_sub_agents/<sid>/artifacts/`. Rejects
- * symlink/junction escapes and `..` segments.
- *
- * Throws an Error with `.code = 'INVALID_ARTIFACT_PATH'` on rejection.
- */
-export function assertSafeArtifactPath(artifactPathInput, projectRoot) {
-    if (!isAbsolute(artifactPathInput)) {
-        throw invalidPathError(artifactPathInput, 'must be absolute');
-    }
-    const rawSegments = artifactPathInput.split(/[\\/]/);
-    if (rawSegments.includes('..')) {
-        throw invalidPathError(artifactPathInput, 'must not contain .. segments');
-    }
-    const expected = resolve(projectRoot, '.peaks', SUB_AGENTS_DIR);
-    const rel = relative(expected, artifactPathInput);
-    if (rel.startsWith('..') || isAbsolute(rel)) {
-        throw invalidPathError(artifactPathInput, 'must be under .peaks/_sub_agents/');
-    }
-    let realArtifact;
-    let realRoot;
-    try {
-        const parent = dirname(artifactPathInput);
-        const realParent = realpathSync(parent);
-        realArtifact = resolve(realParent, artifactPathInput.slice(parent.length + 1));
-        realRoot = realpathSync(projectRoot);
-    }
-    catch {
-        const fallback = resolve(projectRoot, '.peaks', SUB_AGENTS_DIR);
-        const rel2 = relative(fallback, artifactPathInput);
-        if (rel2.startsWith('..') || isAbsolute(rel2)) {
-            throw invalidPathError(artifactPathInput, 'must be under .peaks/_sub_agents/');
-        }
-        return artifactPathInput;
-    }
-    const realRel = relative(realRoot, realArtifact);
-    if (realRel.startsWith('..') || isAbsolute(realRel)) {
-        throw invalidPathError(artifactPathInput, 'symlink/junction escapes project root');
-    }
-    const realExpected = resolve(realRoot, '.peaks', SUB_AGENTS_DIR);
-    const realRelExpected = relative(realExpected, realArtifact);
-    if (realRelExpected.startsWith('..') || isAbsolute(realRelExpected)) {
-        throw invalidPathError(artifactPathInput, 'must be under .peaks/_sub_agents/');
-    }
-    return realArtifact;
-}
-/**
- * Assert that `channelPath` lives under
- * `projectRoot/.peaks/_sub_agents/<sid>/shared/`. Same R-2 logic as
- * `assertSafeArtifactPath` but with a different canonical subdir.
- *
- * Throws an Error with `.code = 'INVALID_SHARED_CHANNEL_PATH'` on rejection.
- */
-export function assertSafeSharedChannelPath(channelPathInput, projectRoot) {
-    if (!isAbsolute(channelPathInput)) {
-        throw invalidPathErrorShared(channelPathInput, 'must be absolute');
-    }
-    const rawSegments = channelPathInput.split(/[\\/]/);
-    if (rawSegments.includes('..')) {
-        throw invalidPathErrorShared(channelPathInput, 'must not contain .. segments');
-    }
-    const expected = resolve(projectRoot, '.peaks', SUB_AGENTS_DIR);
-    const rel = relative(expected, channelPathInput);
-    if (rel.startsWith('..') || isAbsolute(rel)) {
-        throw invalidPathErrorShared(channelPathInput, 'must be under .peaks/_sub_agents/shared/');
-    }
-    let realChannel;
-    let realRoot;
-    try {
-        const parent = dirname(channelPathInput);
-        const realParent = realpathSync(parent);
-        realChannel = resolve(realParent, channelPathInput.slice(parent.length + 1));
-        realRoot = realpathSync(projectRoot);
-    }
-    catch {
-        const fallback = resolve(projectRoot, '.peaks', SUB_AGENTS_DIR);
-        const rel2 = relative(fallback, channelPathInput);
-        if (rel2.startsWith('..') || isAbsolute(rel2)) {
-            throw invalidPathErrorShared(channelPathInput, 'must be under .peaks/_sub_agents/shared/');
-        }
-        return channelPathInput;
-    }
-    const realRel = relative(realRoot, realChannel);
-    if (realRel.startsWith('..') || isAbsolute(realRel)) {
-        throw invalidPathErrorShared(channelPathInput, 'symlink/junction escapes project root');
-    }
-    const realExpected = resolve(realRoot, '.peaks', SUB_AGENTS_DIR);
-    const realRelExpected = relative(realExpected, realChannel);
-    if (realRelExpected.startsWith('..') || isAbsolute(realRelExpected)) {
-        throw invalidPathErrorShared(channelPathInput, 'must be under .peaks/_sub_agents/shared/');
-    }
-    return realChannel;
-}
-/**
- * Soft-warn check on the artifact file name pattern. Returns null if
- * the name matches `<rid>-<role>-<idx>.<ext>`, otherwise returns a
- * warning string. Does NOT reject (the path is still in the canonical
- * dir; the warning is for human/audit readability per G7.4.c).
- */
-export function checkArtifactNameConvention(artifactPathInput) {
-    const base = artifactPathInput.split(/[\\/]/).pop() ?? '';
-    if (ARTIFACT_NAME_PATTERN.test(base)) {
-        return null;
-    }
-    return `Artifact file name does not match <rid>-<role>-<idx>.<ext> convention: ${base}`;
-}
-function sanitizeSegment(value, field) {
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(`${field} must be non-empty`);
-    }
-    if (value.length > 256) {
-        throw new Error(`${field} must be ≤ 256 chars (got ${value.length})`);
-    }
-    for (let i = 0; i < value.length; i += 1) {
-        const code = value.charCodeAt(i);
-        if (code <= 0x20 || code === 0x7F) {
-            throw new Error(`${field} must not contain whitespace or control characters`);
-        }
-    }
-    if (value.includes('..') || value.includes('/') || value.includes('\\')) {
-        throw new Error(`${field} must not contain '..' or path separators`);
-    }
-    return value;
-}
-function invalidPathError(path, reason) {
-    const e = new Error(`Invalid artifact path: ${reason} (path: ${path})`);
-    e.code = 'INVALID_ARTIFACT_PATH';
-    return e;
-}
-function invalidPathErrorShared(path, reason) {
-    const e = new Error(`Invalid shared channel path: ${reason} (path: ${path})`);
-    e.code = 'INVALID_SHARED_CHANNEL_PATH';
-    return e;
-}

package/dist/services/context/shared-channel.d.ts

@@ -1,93 +0,0 @@
-export interface SharedChannelEntry {
-    readonly version: 1;
-    readonly at: string;
-    readonly from: string;
-    readonly key: string;
-    readonly value: Readonly<Record<string, unknown>>;
-    readonly valueSize: number;
-}
-export interface SharedChannel {
-    readonly batchId: string;
-    readonly createdAt: string;
-    readonly updatedAt: string;
-    readonly entries: Readonly<Record<string, SharedChannelEntry>>;
-}
-export declare const SHARED_CHANNEL_MAX_VALUE_BYTES: number;
-export declare const SHARED_CHANNEL_SOFT_VALUE_WARN = 1024;
-export declare const SHARED_CHANNEL_MAX_FILE_BYTES: number;
-export declare const SHARED_CHANNEL_TTL_DAYS = 30;
-export type WriteSharedEntryResult = {
-    readonly ok: true;
-    readonly entry: SharedChannelEntry;
-    readonly channelSize: number;
-    readonly lastWriteWins: boolean;
-    readonly softWarning: boolean;
-} | {
-    readonly ok: false;
-    readonly code: 'VALUE_TOO_LARGE' | 'INVALID_BATCH_ID' | 'WRITE_ERROR';
-    readonly message: string;
-};
-/**
- * Write a shared entry to the per-batch channel file. Atomic-write
- * (tmp + rename). Returns the new entry + channel size + last-write-wins
- * flag (true if the key already existed; the new value overwrites).
- *
- * RL-25 size limit: `value ≥ 64KB` is hard-rejected with `VALUE_TOO_LARGE`.
- * `value > 1KB and < 64KB` is a soft warning (returned in the result).
- */
-export declare function writeSharedEntry(opts: {
-    projectRoot: string;
-    sid: string;
-    rid: string;
-    batchId: string;
-    key: string;
-    from: string;
-    value: Record<string, unknown>;
-}): WriteSharedEntryResult;
-/**
- * Read the shared channel for a batch. Returns the channel with all
- * matching entries. Filters: `--since` (ISO8601) and `--key` (glob
- * pattern; simple `*` wildcard, no regex).
- *
- * If the channel file does not exist, returns an empty channel
- * (this is the dispatcher's "fresh batch" view).
- */
-export declare function readSharedChannel(opts: {
-    projectRoot: string;
-    sid: string;
-    rid: string;
-    batchId: string;
-    since?: string;
-    keyPattern?: string;
-}): SharedChannel;
-/**
- * Garbage-collect a single channel. Returns true if the file was
- * deleted, false if it did not exist.
- */
-export declare function gcChannel(opts: {
-    projectRoot: string;
-    sid: string;
-    rid: string;
-    batchId: string;
-}): boolean;
-/**
- * Check if a channel file is older than `SHARED_CHANNEL_TTL_DAYS` days
- * and should be GC'd as an orphan. Returns true if file is missing
- * (already GC'd) or older than TTL.
- */
-export declare function isOrphanChannel(opts: {
-    projectRoot: string;
-    sid: string;
-    rid: string;
-    batchId: string;
-    now?: Date;
-}): boolean;
-/**
- * Compile a simple key pattern with `*` wildcards to a matcher. Only
- * `*` is special; everything else is a literal. `*` matches zero or
- * more characters. Examples:
- *   "rd.*"       matches "rd.completed", "rd.found-blocker"
- *   "*.completed" matches "rd.completed", "qa.completed"
- *   "*"           matches everything
- */
-export declare function compileKeyPattern(pattern: string): (key: string) => boolean;