toolroll 0.9.103 → 0.9.105

package/dist/budget-alerts.d.ts

@@ -1,19 +0,0 @@
-/**
- * Budget alerts (v105): at 50, 80 and 100 % of a monthly budget, once each a
- * month, a notification goes out (to everyone's usual places; a person's
- * budget to that person) and the ledger keeps it. Only the highest mark newly
- * reached is sent: a budget that jumps past three marks at once says so once.
- * Budgets are dollars: only work billed to an API key counts (a subscription
- * costs nothing extra).
- */
-import type { Store } from "./store.js";
-import { type BudgetState } from "./spend.js";
-export declare function budgetAlertPass(store: Store, now: Date): {
-    sent: {
-        budget: number;
-        mark: number;
-    }[];
-};
-/** The loop beside the console: a pass a minute. */
-export declare function startBudgetAlerts(store: Store, everyMs?: number): () => void;
-export type { BudgetState };

package/dist/build-review.d.ts

@@ -1,38 +0,0 @@
-import type { Store } from "./store.js";
-import type { Runner } from "./builder.js";
-import { type BuildFinding } from "./contracts/review-findings.js";
-export { buildReviewOf, buildReviewHeadline, buildReviewLines, findingWords, type BuildReviewView } from "./review-switch.js";
-export declare const AUTOMATIC_REVIEWER = "automatic review";
-/**
- * Called when a build is accepted as done, inside its disposition. Queues the
- * one review when the switch is on and the approved check passed; a request
- * the queue refuses is recorded as not reviewed so the result still reaches
- * the person. Idempotent per run.
- */
-export declare function queueBuildReview(store: Store, repo: string, runId: number, root: string, now: Date): void;
-/** The HIGH findings as one revision note, within the revise path's limit. */
-export declare function revisionNoteOf(high: readonly BuildFinding[]): string;
-export type BuildReviewReport = {
-    run: number;
-    outcome: "reviewed" | "sent-back" | "not-reviewed";
-    detail: string;
-};
-/**
- * The worker's review pass, after its builds: every open automatic review in
- * this worker's projects gets its one reviewer run. Other open review asks are
- * closed unrun, as before. A review that cannot finish settles as not
- * reviewed; nothing waits on it.
- */
-export declare function buildReviewPass(store: Store, options: {
-    runner: string;
-    token: string;
-    repos: readonly string[];
-    root: string;
-    clock: () => Date;
-    watchIncarnation?: string;
-    agent?: Runner;
-    shouldStop?: () => boolean;
-    idleTimeoutMs?: number;
-    timeoutMs?: number;
-    maxTurns?: number;
-}): Promise<BuildReviewReport[]>;

package/dist/builder-restart.d.ts

@@ -1,21 +0,0 @@
-import { type Store } from "./store.js";
-/** At most this many automatic restarts in this window (tried, whatever came of them). */
-export declare const RESTART_LIMIT = 3;
-export declare const RESTART_WINDOW_MS: number;
-export type BuilderWish = {
-    desired: "running" | "stopped";
-    build: string;
-    schema: number;
-    setBy: string;
-    setAt: string;
-};
-export declare function builderWish(store: Store): BuilderWish | null;
-export declare function databaseFormat(store: Store): number | null;
-/** Record what a person asked for. A `stopped` keeps the last known build. */
-export declare function recordBuilderWish(store: Store, desired: "running" | "stopped", by: string, build: string, now: Date): void;
-/** An update, a deploy's drain or a stop in progress: this is someone else's restart to make. */
-export declare function restartPaused(store: Store, now: Date): boolean;
-export type RestartAdmission = "admitted" | "not-wanted" | "paused" | "attempts";
-/** The wish, the pause and the count, read again and the attempt written in one transaction: two callers can't both
- * take the last attempt, and a crash after this still counted. */
-export declare function admitBuilderRestart(store: Store, now: Date): RestartAdmission;

package/dist/builder.d.ts

@@ -1,409 +0,0 @@
-import { type NetworkProfile } from "./egress.js";
-import { type CheckAccess } from "./check-access.js";
-import type { WritesMode } from "./writes-mode.js";
-import type { LaunchNetwork } from "./invoke.js";
-import type { ProviderId } from "./contracts/provider.js";
-import { type MachineSample } from "./check-load.js";
-import { type PreparedEvidence } from "./prepared-evidence.js";
-import { type ExecResult, type RunOptions } from "./exec.js";
-import type { Decision, Store } from "./store.js";
-import { type ExecutionProfile, type Scope } from "./scope.js";
-import { type ParsedDecision, type Problem } from "./decision.js";
-import { type AgentOutcome } from "./invoke.js";
-import { type LiveCloseReason } from "./live-input.js";
-import { type DiffStatFacts } from "./proof.js";
-import { type AuthoritySnapshot, type MilestoneState } from "./plan.js";
-export type Runner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
-/**
- * The native shell for an operator-approved repository command. There are
- * exactly two consumers: dependency setup before an agent starts, and the
- * verification command after it commits. Keeping the choice here prevents a
- * Windows worker from trying to spawn `/bin/sh` while leaving the approved
- * command itself byte-for-byte unchanged.
- */
-export declare function approvedCommandShell(command: string, platform?: NodeJS.Platform, windowsShell?: string): {
-    file: string;
-    args: string[];
-    display: string;
-};
-/**
- * Whether an approved project check failed at its launch boundary because a
- * local executable was unavailable. The numeric shell codes are the primary
- * signal. Windows `cmd.exe` can instead return 1 with one exact diagnostic,
- * so that spelling is admitted only on Windows. Free-form test output such as
- * `MODULE_NOT_FOUND` is deliberately not enough: assertions are untrusted and
- * must not turn an ordinary product failure into environment recovery.
- */
-export declare function verificationExecutableMissing(result: ExecResult, platform?: NodeJS.Platform): boolean;
-/**
- * The approved command's own program — its first word — when the plane, looking it up itself before the check starts,
- * finds no such executable; null when it exists or can't be told (eval-harness review 2, finding 5): a first word with
- * any quoting, expansion, assignment or redirection, a shell builtin, or Windows (cmd.exe's lookup isn't modelled).
- * A path is looked up from the checkout; a bare name on `path`'s absolute folders.
- */
-export declare function approvedProgramMissing(command: string, cwd: string, path: string | undefined, platform?: NodeJS.Platform): string | null;
-/**
- * Whether a check's first attempt failed at its launch, so the approved recovery setup may run and the check run again
- * (eval-harness review 1, finding 6; review 2, finding 5). Only a result the plane made without spawning qualifies.
- * Any shell output, including a perfect "not found" line after a missing-program lookup, remains a check failure.
- * A later passing check still counts as a retry (check-failure.ts), which an automatic release approval refuses.
- */
-export declare function launchFailedBeforeCheck(result: ExecResult, nonce: string | null, missing: string | null, platform?: NodeJS.Platform): boolean;
-export type BuildRequest = {
-    taskId: string;
-    taskRef: number;
-    runner: string;
-    /**
-     * The exact lease this attempt was dispatched under. Optional for a person
-     * driving `build` by hand; an unattended pass always sets it, because the
-     * runner-name check alone cannot tell a live attempt from a superseded one
-     * the same runner started earlier.
-     */
-    leaseId?: string;
-    /**
-     * The runner's own credential, for the CREDENTIALED pulse (arc 2 finding
-     * 33): with it, every mid-build beat re-proves the token against the
-     * current hash, and a takeover's rotation fences this attempt at its
-     * next beat. Absent (a person driving `build` by hand), the beat falls
-     * back to the unauthenticated touch, exactly as before.
-     */
-    runnerToken?: string;
-    /**
-     * Real time, read repeatedly. `now` is one instant and a build is not: a
-     * lease heartbeated with the timestamp the build started at is a lease that
-     * stopped being extended the moment it began.
-     */
-    clock?: () => Date;
-    /** How often the pulse beats while the agent runs. 0 disables it. */
-    pulseMs?: number;
-    /** Live steering's dispatcher interval (steer-live.ts); tests shorten it. */
-    steerTickMs?: number;
-    worktree: string;
-    branch: string;
-    now: Date;
-    /**
-     * The open run record this attempt writes its facts to. Required: nothing
-     * spends without a record that will outlive it, and the invocation
-     * gateway refuses a paid call whose run is missing or already finished.
-     */
-    runId: number;
-    /** Claude's native dollar cap for this attempt: the harness stops
-     * itself at this figure. Absent = uncapped. */
-    maxBudgetUsd?: number;
-    /** Fires with the provider's process-group id the moment it exists —
-     * the worker-process ledger records it (v14). */
-    onProviderSpawn?: (pid: number) => void;
-    /** Where evidence files live. Defaults to ~/.toolroll/evidence (or an older ~/.standing-orders/evidence). */
-    evidenceRoot?: string;
-    /** A draft preserved from an interrupted predecessor. The fresh attempt
-     * still reviews it and writes its own nonce-bound handoff. */
-    recoveredDraftRun?: number;
-    recoveredDraftKind?: "completed" | "partial";
-    /** Defaults to the safe one; see the note on permissions above. */
-    permissionMode?: "acceptEdits" | "auto" | "plan";
-    /** Named honestly, never the default, and only ever set by a person. */
-    skipPermissions?: boolean;
-    /** The harness this build runs on. Repair ALWAYS inherits it — a session
-     * resumed across providers is not a session (Codex provider review, Q3). */
-    provider?: ProviderId;
-    model?: string;
-    /**
-     * The model repair turns run on. Repair is a few-k, one-job resumption —
-     * the §9 economics argument in miniature — so it may run cheaper than the
-     * builder. Defaults to the builder's model.
-     */
-    repairModel?: string;
-    maxTurns?: number;
-    timeoutMs?: number;
-    agent?: Runner;
-    git?: Runner;
-    /** Runs the approved worktree setup command (M5.7). Tests inject; production uses exec. */
-    setup?: Runner;
-    /** Runs the repository's approved verification command (Priority 2), after
-     * commit. Tests inject; production uses exec. */
-    verify?: Runner;
-    /** Reads the machine's cores and load for a release check's limit and load record (check-load.ts). Tests inject;
-     * production reads the operating system. */
-    machine?: () => MachineSample;
-    /**
-     * The stop fence (audit IV-1, completed): re-proved AFTER the agent and
-     * BEFORE the commit. A stop that lands while the agent runs preserves
-     * the work uncommitted for the successor — late output cannot commit.
-     */
-    shouldStop?: () => boolean;
-};
-/**
- * What the agent handed over when it parked: the validated decision and the
- * evidence rows already written for it. The caller seals it with
- * `finalize` (a `park` ending) — nothing here has touched the claim or the task.
- */
-export type ParkPackage = {
-    decision: ParsedDecision;
-    artifactIds: number[];
-};
-export type BuildResult = {
-    ok: true;
-    parked?: undefined;
-    committed: boolean;
-    /** The agent said no-change and the tree proves it: done, nothing to publish. */
-    noChange?: boolean;
-    branch: string;
-    summary: string;
-} | {
-    ok: true;
-    parked: ParkPackage;
-    branch: string;
-} | {
-    ok: false;
-    reason: BuildRefusal;
-    message: string;
-    problems?: Problem[];
-};
-export type BuildRefusal = "skills-unavailable"
-/** Sprint 8: the organisation policy stops this provider, model or permission level. */
- | "policy" | "unapproved" | "scope-changed" | "stale-approval" | "mode-ended" | "capability" | "no-claim" | "not-yours" | "not-leased" | "protected-branch" | "wrong-branch" | "moved-branch" | "fenced" | "agent" | "agent-reported" | "no-op"
-/** Run 2085: the agent stopped before its handoff; its work was kept for the retry. */
- | "no-handoff" | "moved-head" | "timeout" | "git" | "commit-failure" | "malformed-decision" | "provider-init" | "setup" | "revision-brief" | "external" | "stopped" | "plan-revised" | "plan-revision-blocked" | "provider-unattested" | "provider-protocol" | "runner-custody" | "auth-mode" | "route-authority" | "containment" | "protected-storage";
-/** Long enough for real work; short enough that a stuck build ends the same night. */
-export declare const DEFAULT_BUILD_TIMEOUT_MS: number;
-export declare const DEFAULT_MAX_TURNS = 40;
-/**
- * Bounded repair (§6): a malformed park gets the same session back, twice,
- * with a compact error naming exactly what failed — then it is an incident.
- * The turns are short and narrow because the job is narrow: re-emit one
- * file. Sandcastle's mechanism, sized to sandcastle's numbers.
- */
-export declare const REPAIR_TURNS = 2;
-export declare const REPAIR_MAX_TURNS = 4;
-export declare const REPAIR_TIMEOUT_MS: number;
-/**
- * How often a running build says "still here" — extending its lease and its
- * runner's liveness in one beat. Every 15 s against a one-minute liveness
- * window (runner.ts) means three beats can be lost to load before anything
- * looks dead.
- */
-export declare const DEFAULT_PULSE_MS = 15000;
-/** Branches an unattended agent may never commit to, whatever it was asked. */
-export declare const PROTECTED: Set<string>;
-/**
- * Setup shells run under an ALLOWLIST, not the operator's shell minus two
- * names (audit IV-5, completed): the deterministic basics a package
- * manager needs and nothing that could carry a credential. A setup that
- * needs more exports it inside its own approved command text — visibly,
- * on the approval screen.
- */
-export declare const SETUP_ENV_ALLOWLIST: readonly string[];
-/** Belt over the allowlist's suspenders: even if these ever appear in `env`, they die here. */
-export declare const SETUP_ENV_DENYLIST: readonly string[];
-/**
- * A bounded, redacted diagnostic from untrusted tool output (audit IV-5):
- * assignments and URL userinfo that look credential-shaped are blanked
- * before a byte reaches SQLite, a page, or a webhook. Coarse on purpose —
- * over-redacting a diagnostic costs a glance at the real log; under-
- * redacting costs a secret.
- */
-/** Why a git command failed, in words, for a refusal: the hardened runner's own reason, or git's first line. Keeping it
- * is the point: runs 3316–3324 and run 3332 lost theirs, and only a person guessing was left. */
-export declare function gitFailureWords(result: ExecResult): string;
-export declare function redactSecretText(text: string): string;
-/** The same blanking with no length cap, for a log that keeps its length (a flow script's output). */
-export declare function redactSecretAssignments(text: string): string;
-/** A build's network (egress.ts): the one its approval sealed, or — sealed before network policies existed — the
- * narrowed legacy one (provider hosts and the repository's registries, nothing added since). */
-export declare function launchNetworkOf(store: Store, taskRef: number, profile: ExecutionProfile): LaunchNetwork;
-/** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
- * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
- * approval sealed less its agent's own provider hosts (never its checks'). */
-export declare function checkLaunchOf(store: Store, runId: number, profile: ExecutionProfile, platform?: NodeJS.Platform): {
-    access: CheckAccess;
-    network: NetworkProfile | null;
-};
-/** Where a build may write (writes-mode.ts): what its approval sealed, or — sealed before write allowlists — anywhere
- * its fence allows, as it was approved. */
-export declare function launchWritesOf(profile: ExecutionProfile): WritesMode;
-export declare function proveApprovedProfile(scope: Scope | null, given: {
-    provider: string;
-    model: string | undefined;
-    maxTurns: number | undefined;
-    timeoutMs: number | undefined;
-    skipPermissions: boolean;
-}, 
-/** The fallback entry a chain run is bound to, proved by its walk: what must run instead of the base. */
-pinned?: ExecutionProfile | null): {
-    ok: true;
-    effective: {
-        model: string;
-        maxTurns: number | undefined;
-        timeoutMs: number;
-        skipPermissions: boolean;
-        profile: ExecutionProfile;
-    };
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * Build one task, if everything says it may.
- *
- * The gates are re-checked here rather than assumed from the caller, because
- * this is the last point before somebody's repository changes, and a caller
- * that forgot one is exactly the caller this is protecting against.
- */
-export declare function build(store: Store, request: BuildRequest): Promise<BuildResult>;
-/**
- * Everything the post-provider settlement closes over: an explicit record,
- * so the prepared-candidate road runs THE SAME settlement the agent road
- * runs — one state machine, never a paraphrase. `fenced()` reads the pulse's live flag: settlement
- * decisions are about NOW, not about the moment of capture.
- */
-/** The prepared candidate must be a commit this repository holds and must
- * descend from the task's base (the first attempt's base once one exists,
- * otherwise the current HEAD). Plain words on refusal, nothing touched. */
-export declare function proveCandidate(git: Runner, worktree: string, candidate: string, pinnedBase: string | null): Promise<string | null>;
-/** Make the worktree's tracked tree EXACTLY the candidate commit's tree —
- * renames, deletions and additions included — without moving HEAD, so the
- * result is uncommitted work on the task branch, as an agent would leave it.
- * Untracked files (the protocol mailbox among them) are not touched. */
-export declare function bringWorktreeTo(git: Runner, worktree: string, candidate: string): Promise<{
-    ok: true;
-} | {
-    ok: false;
-    message: string;
-}>;
-export type CapturedBuild = {
-    store: Store;
-    request: BuildRequest;
-    agent: BuildRequest["agent"];
-    git: Runner;
-    worktree: string;
-    branch: string;
-    baseRevision: string;
-    taskId: string;
-    taskRef: number;
-    runner: string;
-    provider: string;
-    scope: Scope | null;
-    effective: {
-        model: string;
-        maxTurns: number | undefined;
-        timeoutMs: number;
-        skipPermissions: boolean;
-        profile: ExecutionProfile;
-    };
-    answers: {
-        decision: Decision & {
-            taskId: string;
-        };
-        choice: string;
-        note: string | null;
-    }[];
-    timeoutMs: number;
-    root: string;
-    mailbox: string;
-    done: string;
-    /** The proof manifest's nonce-bound filename (Priority 2) — optional for
-     * the agent to write, read the same way as the handoff once it finishes. */
-    proof: string;
-    preparedEvidence?: PreparedEvidence;
-    rubric?: string;
-    clock: () => Date;
-    fenced: () => boolean;
-    /** The adaptive-execution-plan binding, when this attempt received a plan
-     * with milestones. Optional: a build with no plan (or an older free-form
-     * one) settles exactly as it always has, and a caller assembling a
-     * capture by hand need not know this protocol exists. */
-    plan?: PlanBinding;
-    /** A Claude build's live input (live-input.ts): why Toolroll closed its stdin, and its total turn budget. */
-    live?: {
-        close: LiveCloseReason | null;
-        maxTurns: number;
-    };
-};
-/** What settlement needs to know about the plan this attempt built against. */
-export type PlanBinding = {
-    /** This attempt's terminal revision-proposal file, worktree-relative. */
-    proposal: string;
-    /** The revision number the brief named — what a page and a page's
-     * notification say out loud. */
-    revision: number;
-    /** The signed scope and publication authority as they stood when the
-     * build STARTED. A revision auto-applies only if both still match. */
-    authority: AuthoritySnapshot;
-    /** The checkpoint reader's live state, shared with the pulse: settlement
-     * makes one more pass with it, so a final checkpoint that raced the last
-     * beat is not lost, and one the beat already ingested is not doubled. */
-    progress: ProgressIngestState;
-};
-/**
- * Everything the milestone-checkpoint reader carries between passes. Two
- * callers share one instance — the pulse's `beat()` and the single
- * settlement pass — which is exactly why the dedupe state lives here rather
- * than in either of them: the last beat and the final read routinely see
- * the same bytes, and a checkpoint written twice would read as progress
- * twice.
- */
-export type ProgressIngestState = {
-    runId: number;
-    taskRef: number;
-    /** Null when this task has no ledger row to attach a checkpoint to —
-     * `run_checkpoint.plan_revision` is NOT NULL, so nothing is recorded. */
-    planRevisionId: number | null;
-    expectedRevisionHash: string | null;
-    knownIds: readonly string[];
-    progressPath: string;
-    /** The exact bytes last ingested — a cheap `Buffer.equals` against the
-     * file skips the parse entirely on an unchanged checkpoint. */
-    lastRaw: Buffer | null;
-    /** The furthest state each milestone has reached, for the regression
-     * check. Not a full snapshot: only the states matter. */
-    lastStates: Map<string, MilestoneState>;
-};
-export declare function settleProviderOutcome(captured: CapturedBuild, result: AgentOutcome): Promise<BuildResult>;
-/**
- * Read the agent's optional proof, re-run the repository's approved
- * verification command if one is configured, and save the machine's one
- * verdict — computed once, here, and never re-inferred at render. Runs
- * strictly after commit and terminal-diff capture; every branch below
- * ends in `store.saveProofVerdict`, never in a thrown error that could
- * reach the caller and be mistaken for a build failure.
- */
-/** The sealed diff-stat artifact restated as facts: whether it captured
- * and verified, whether its file list was cut, the paths it names, and the
- * old name of every rename git paired (provenance, never a path). Anything
- * missing, failed, tampered or unparseable reads as not captured. */
-export declare function sealedDiffStatFacts(store: Store, root: string, statArtifactId: number): DiffStatFacts | null;
-/**
- * Read the mailbox, if the agent wrote one, and turn it into a package the
- * caller can seal — or a problem list repair can work from.
- *
- * The payload is preserved as evidence *before* it is judged: a malformed
- * park is still a person's best clue to what the agent meant, and the raw
- * bytes leave the worktree either way — ingested once, then removed, so no
- * later attempt can mistake them for its own agent's voice.
- */
-/** What a person reads when an attempt stopped before its handoff (run 2085). */
-export declare const NO_HANDOFF_WORDS = "The agent stopped before handing off; its work was kept and it is being resumed.";
-/** The body of the work-in-progress commit an unresumable no-handoff attempt leaves on its branch. */
-export declare const WIP_COMMIT_WORDS = "Work in progress: the agent stopped before handing off. Kept so the next attempt continues from it.";
-/** The short turn a stopped agent's own session is resumed with. */
-export declare function handoffResumePrompt(done: string): string;
-export declare const SERVICE_STOP_WORDS = "Toolroll stopped while this task was building.";
-/** The plain words for images left out of a commit. */
-export declare function evidenceImagesNotice(paths: readonly string[]): string;
-/**
- * What a non-zero agent exit means, in words a person can act on: the
- * harness's own result line names the ending (a turn ceiling, an error
- * during execution) and how many turns it took; only when it said nothing
- * do stderr or the bare exit code stand in. Two attempts died at exactly
- * the ceiling on 2026-09-04 and the ledger said "unknown" — the fact was
- * in the stream all along.
- */
-export declare function agentExitWords(outcome: {
-    code: number;
-    stderr: string;
-    finalMessage: string | null;
-    ending?: {
-        subtype: string | null;
-        turns: number | null;
-    } | null;
-}): string;

package/dist/canonical-json.d.ts

@@ -1,14 +0,0 @@
-/**
- * Deterministic JSON for digests and equality. These bytes are sealed into approvals and stored digests, so neither
- * function may change its output for any input. The two differ on purpose and must stay distinct:
- *
- * - `canonicalJson` drops object keys whose value is undefined and returns JSON.stringify's own answer for a bare
- *   value (an undefined array element therefore renders as nothing: `[,1]`).
- * - `canonicalJsonUndefinedAsNull` keeps every key and renders an undefined (or otherwise unserializable) value as
- *   `null` — the planner contract's bytes.
- *
- * Both sort object keys by UTF-16 code units and keep arrays in order.
- */
-export declare function canonicalJson(value: unknown): string;
-/** Stable JSON for hashing and equality only — no filling, no trimming; undefined reads as null. */
-export declare function canonicalJsonUndefinedAsNull(value: unknown): string;

package/dist/capscan.d.ts

@@ -1,35 +0,0 @@
-/**
- * Reading what a repository says it needs.
- *
- * Detection walks files the repo itself controls — .env.example, .mcp.json,
- * supabase/config.toml, workflow files — which makes every byte here
- * untrusted input. The rule that keeps that safe: **scanned content never
- * becomes shell code.** A probe is either a fixed template over an
- * identifier that passed a strict validator, or it is absent. A name that
- * fails validation is dropped with a note, not quoted, not escaped, not
- * given the benefit of the doubt — escaping is how injection bugs are
- * born promising to behave.
- *
- * Detection is not authorization, and it is not verification either: every
- * capability found here lands `unprobed`. CI secret references are recorded
- * as `ci` capabilities with no probe — a secret living in GitHub's vault is
- * a fact about CI, not about this machine's environment, and synthesizing
- * a local env probe for it would manufacture a gap that is not real.
- */
-import type { Capability } from "./store.js";
-/** A capability as detected, before anybody decides to record it. */
-export type Found = {
-    kind: Capability["kind"];
-    name: string;
-    probe: string | null;
-    source: string;
-};
-export type ScanReport = {
-    found: Found[];
-    /** Names that appeared but failed validation — reported, never used. */
-    rejected: {
-        name: string;
-        source: string;
-    }[];
-};
-export declare function scanRepo(repo: string): ScanReport;