toolroll 0.9.103 → 0.9.105

package/dist/daemon.d.ts

@@ -1,226 +0,0 @@
-/**
- * The daemon manager: the loop as a service, with no crontab in sight.
- *
- * `toolroll daemon install` writes the platform's own supervision unit —
- * a launchd LaunchAgent on macOS, a systemd user unit on Linux, a Task
- * Scheduler task on Windows, chosen by process.platform — pointed at
- * `toolroll watch`, and loads it. The OS keeps it alive across crashes
- * and reboots; watch's incarnation recovery is what makes those restarts
- * safe, so the two halves were built for each other.
- *
- * The runner token never enters the unit file. It is written 0600 to a
- * credential file beside the database (the same discipline as the Telegram
- * bot token), and the unit runs `watch --token-file <path>`. A unit file is
- * the kind of thing that ends up in a dotfiles repo; a credential file
- * beside the database is the kind of thing backup tooling already treats
- * as sensitive.
- *
- * The lifecycle (OS containment and login recovery plan) is ONE contract
- * for the CLI daemon and the desktop service, which share the launchd road
- * below:
- *   - an installed always-on controller restarts after an unexpected
- *     clean exit as well as a crash (launchd KeepAlive=true, systemd
- *     Restart=always, a cmd restart loop under Task Scheduler);
- *   - start is idempotent — a healthy running service is never killed
- *     because the installer or the app window ran again;
- *   - a CHANGED definition (runtime, entry, flags) really reloads: the old
- *     job is booted out, its disappearance is awaited (the pending-bootout
- *     race), and the new unit is bootstrapped;
- *   - explicit stop unloads AND disables, so nothing relaunches it until a
- *     person installs again — which re-enables;
- *   - status tells a loaded definition from a fresh working controller,
- *     and names a missing runtime, a missing entry, or a disabled service.
- *
- * Everything here is generation plus one supervisor invocation, both
- * injectable — the tests read the generated unit and script `launchctl`,
- * and never touch the machine's real supervision.
- */
-import type { ExecResult, RunOptions } from "./exec.js";
-import type { Store } from "./store.js";
-export type SupervisorRunner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
-/** What every installed service — CLI watch or desktop controller — is made of. */
-export type ServiceDefinition = {
-    platform: "darwin" | "linux" | "win32";
-    label: string;
-    unitPath: string;
-    unitContent: string;
-    logPath: string;
-    /** The executable the unit runs (the pinned Node binary, or an explicit wrapper). */
-    bin: string;
-    /** The JavaScript entry the runtime is given, when there is one. */
-    entry: string | null;
-};
-export type DaemonPlan = ServiceDefinition & {
-    tokenFile: string;
-};
-/** A stable fingerprint of a unit's text: the changed-definition test. */
-export declare function definitionDigest(unitContent: string): string;
-/**
- * Pin a service to the Node runtime that is executing Toolroll.
- *
- * launchd does not inherit an interactive shell's PATH, so invoking a JS
- * package bin through `#!/usr/bin/env node` can install successfully and then
- * fail before the CLI starts. The service instead runs the absolute Node
- * binary with the package entry as its first argument. An explicitly supplied
- * non-JavaScript executable remains an escape hatch for wrappers and packaged
- * binaries.
- */
-export declare function daemonLaunchCommand(args: {
-    execPath: string;
-    entry?: string;
-    explicitBin?: string;
-}): {
-    bin: string;
-    binArgs: string[];
-} | null;
-/** One service per repo, named so two repos' watches never collide. */
-export declare function labelFor(repo: string): string;
-/** The label a watch installed before the rename to Toolroll runs under: still found, stopped and uninstalled. */
-export declare function legacyLabelFor(repo: string): string;
-/**
- * The launchd unit shared by the CLI daemon and the desktop service.
- * KeepAlive requests relaunch after either clean exit or crash. macOS may
- * defer nondemand launches; the desktop's live controller supervisor covers
- * controller exits independently. Login/OS-service recovery requires the
- * physical certification, not just a valid plist.
- */
-export declare function launchdPlist(args: {
-    label: string;
-    command: readonly string[];
-    workingDirectory: string;
-    pathEnv: string;
-    logPath: string;
-    environment?: Record<string, string>;
-    associatedBundleId?: string;
-    keepAlive?: boolean;
-    startInterval?: number;
-    runAtLoad?: boolean;
-}): string;
-/**
- * Everything `install` would do, computed without doing it — the unit text,
- * where it goes, where logs land. `--dry-run` prints exactly this.
- */
-export declare function planDaemon(args: {
-    platform: NodeJS.Platform;
-    bin: string;
-    binArgs: readonly string[];
-    runner: string;
-    repo: string;
-    configDir: string;
-    watchFlags: readonly string[];
-    home?: string;
-    /** The interactive installer's executable search path, pinned into the
-     * service so logged-in provider CLIs remain discoverable after reboot. */
-    pathEnv?: string;
-    /** Defaults to labelFor(repo). */
-    label?: string;
-}): DaemonPlan | {
-    error: string;
-};
-/** The desktop shell's always-on controller: the same launchd contract, pointed at the desktop host. */
-export declare function planDesktopService(args: {
-    node: string;
-    helper: string;
-    stateDir: string;
-    label: string;
-    home?: string;
-    pathEnv?: string;
-    environment?: Record<string, string>;
-    associatedBundleId?: string;
-}): ServiceDefinition;
-export type ServiceStart = {
-    ok: true;
-    changed: boolean;
-    action: "bootstrapped" | "reloaded" | "started" | "running";
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * The shared launchd road. Idempotent start: a loaded job whose definition
- * is unchanged is kickstarted WITHOUT -k (a running one is left alone; a
- * stopped one starts); a loaded job whose definition changed is booted out,
- * awaited, and bootstrapped afresh; an unloaded label is enabled (an
- * explicit stop had disabled it) and bootstrapped. Nothing here kills a
- * healthy service to prove it can.
- */
-export declare function installLaunchdService(definition: ServiceDefinition, run: SupervisorRunner): Promise<ServiceStart>;
-/** Replace a file whole: a flushed temporary beside it, renamed over it, and the directory flushed, so a crash
- * leaves the old text or the new, never a torn one. */
-export declare function writeFileDurably(file: string, content: string | Uint8Array, mode?: number): void;
-/** Explicit stop: unload AND disable, so nothing relaunches it until a person installs again. `waitMs` is how long
- * the job may take to leave launchd (5 s by default; a watch's `toolroll up` can take 45 s to exit). */
-export declare function stopLaunchdService(definition: ServiceDefinition, run: SupervisorRunner, wait?: {
-    waitMs?: number;
-    sleep?: (ms: number) => Promise<void>;
-}): Promise<{
-    ok: true;
-    wasLoaded: boolean;
-} | {
-    ok: false;
-    message: string;
-}>;
-/**
- * The same repo's watch as installed under the label it had before the
- * rename to Toolroll, when its unit is still on disk; null otherwise.
- * Installing the new one stops and removes it, so two watches never run.
- */
-export declare function installedLegacyDaemon(args: Parameters<typeof planDaemon>[0]): DaemonPlan | null;
-/**
- * Install the watch, then retire its copy from before the rename. The new
- * job goes in first: when its install fails the legacy watch is left
- * running, so the repo is never left without one. Only once the new job is
- * installed is the legacy one stopped and removed; the new one is then
- * started again, since it may have stepped aside while the legacy watch
- * still held the repo's lease.
- */
-export declare function installReplacingLegacy(plan: DaemonPlan, token: string, legacy: DaemonPlan | null, run: SupervisorRunner): Promise<ServiceStart>;
-/** Write the token 0600 and the unit, then hand the unit to the supervisor. */
-export declare function installDaemon(plan: DaemonPlan, token: string, run: SupervisorRunner): Promise<ServiceStart>;
-export declare function uninstallDaemon(plan: DaemonPlan, run: SupervisorRunner): Promise<{
-    ok: true;
-    existed: boolean;
-}>;
-/**
- * The definition a label is INSTALLED under, read back from the unit file
- * (the certificate's view: whatever is on disk is the baseline, so `stale`
- * is false by construction and the runtime/entry are the installed ones).
- * Null when no unit file exists for the label.
- */
-export declare function installedServiceDefinition(args: {
-    label: string;
-    platform?: NodeJS.Platform;
-    home?: string;
-    configDir?: string;
-    logPath?: string;
-}): ServiceDefinition | null;
-export type ServiceStatus = {
-    /** `loaded` = the supervisor knows the definition but no process runs;
-     * `disabled` = an explicit stop turned it off. Neither is "working". */
-    state: "running" | "loaded" | "disabled" | "not-installed";
-    pid: number | null;
-    detail: string;
-    /** Diagnostics a person can act on: a missing runtime, a missing entry. */
-    problems: string[];
-    /** The installed unit's fingerprint, or null when no unit file exists. */
-    installedDigest: string | null;
-    /** Whether the installed unit still matches what this build would write. */
-    stale: boolean;
-};
-/** Runtime facts that make a loaded definition unable to become a working controller. */
-export declare function runtimeProblems(definition: ServiceDefinition): string[];
-export declare function daemonStatus(plan: ServiceDefinition, run: SupervisorRunner): Promise<ServiceStatus>;
-/**
- * A supervisor PID is necessary but not sufficient: macOS can leave a
- * process stuck behind a protected-folder access check before it ever
- * opens the queue. The credentialed runner heartbeat is the end-to-end
- * readiness receipt that proves a service reached the work loop — and a
- * FRESH one, newer than what stood before the start, so a stale row from
- * the previous incarnation cannot pass for the new controller.
- */
-export declare function awaitFreshHeartbeat(store: Store, runnerName: string, heartbeatBefore: string | null, deadlineMs?: number, sleep?: (ms: number) => Promise<void>): Promise<{
-    ok: true;
-    heartbeatAt: string;
-} | {
-    ok: false;
-}>;

package/dist/database-reclaim.d.ts

@@ -1,4 +0,0 @@
-import type { Database } from "./store.js";
-/** Reclaim whole free pages on databases created without auto_vacuum. Call only after committing writes.
- * A migration needs at least 1 MiB to justify the I/O; retention reclaims whenever more than 25% is free. */
-export declare function reclaimDatabase(db: Database, reason: "migration" | "retention"): boolean;

package/dist/decision.d.ts

@@ -1,119 +0,0 @@
-/**
- * The decision payload, validated (§7).
- *
- * The convention agents drift from in prose is a schema here, and the schema
- * is fail-closed: a payload missing anything a person would need on a phone
- * screen at 7am is not a decision, it is a malformed one — and the caller's
- * next move is bounded repair, not a guess at what the agent meant.
- *
- * Everything in the payload is written by an agent, which means everything in
- * it is untrusted twice over: it will be rendered into a web page, printed
- * into terminals, and — after the operator answers — quoted back into another
- * agent's brief. The caps and the control-character rejection here are the
- * first line of that defence; the escaping at each sink is the second. The
- * caps also keep one screen one screen: an option list that needs scrolling
- * has already failed the milestone sentence.
- */
-import { type DecisionPayload } from "./contracts/decision.js";
-/** A decision as read: the payload's fields, its text trimmed, and the optional ones present or null. */
-export type ParsedDecision = Omit<DecisionPayload, "assignee" | "deadline"> & {
-    assignee: string | null;
-    /** Normalized to toISOString(), like every timestamp in the store. */
-    deadline: string | null;
-};
-export type Problem = {
-    reason: string;
-    message: string;
-};
-export type ParseResult = {
-    ok: true;
-    decision: ParsedDecision;
-} | {
-    ok: false;
-    problems: Problem[];
-};
-/** One screen's worth, enforced rather than hoped for. The payload's fields are bounded by its schema (src/contracts/decision.ts, from TEXT_LIMITS). */
-export declare const LIMITS: {
-    /** Bytes, before parsing. Applied by the reader too; this is the backstop. */
-    readonly payload: number;
-    /** UTF-16 code units (TEXT_LIMITS.note: revise feedback, steering and decision notes); the byte backstop lives in validateNote. */
-    readonly note: 4000;
-};
-/** Bytes an operator's note may occupy — the UTF-8 backstop under LIMITS.note. */
-export declare const NOTE_BYTE_CAP: 16000;
-/** Why a question closed without an answer (v119), in plain words. */
-export declare function closedQuestionReason(reason: "scope-changed" | "cancelled"): string;
-/** The same, said once on one line wherever its answer would show. */
-export declare function closedQuestionWords(reason: "scope-changed" | "cancelled"): string;
-/**
- * The one validator every note passes — before a draft persists AND inside
- * the answer CAS, which stays the final gate. Trims, then refuses empty,
- * oversized (units or bytes), control-carrying, or invisibly-reordering
- * text. Ordinary Unicode with internal newlines and tabs passes untouched.
- */
-export declare function validateNote(raw: string): {
-    ok: true;
-    note: string;
-} | {
-    ok: false;
-    problem: string;
-};
-/** Whether text carries controls that could become escapes at a sink. Newlines and tabs pass. */
-export declare function hasForbiddenControls(text: string): boolean;
-/**
- * Controls OR direction-override invisibles — the full disguise kit. For
- * text that becomes standing authority or a task identity (setup commands,
- * imported issue titles): a title reading "fix docs" while spelled
- * backwards is not a title, it is a costume.
- */
-export declare function hasDisguisedText(text: string): boolean;
-/**
- * A parked decision, read against its contract (src/contracts/decision.ts): fail closed, every problem at once, each
- * naming its path (`options[1].reversible: required`) under the reason code the repair turn, incidents and tests have
- * always used (`missing-reversible`). A decision written without `version` reads as it always did.
- */
-export declare function parseDecision(raw: string): ParseResult;
-/**
- * The terminal handoff: how every non-parking attempt says how it ended.
- *
- * gnhf's lesson, typed: "the agent seemed to finish" is not an outcome. A
- * clean tree is a success only when the agent SAID no-change; changes are
- * committed only when it said completed; and a missing, malformed, or
- * contradictory handoff is a protocol failure that earns a strike rather
- * than a guess that earns a commit.
- */
-export type ParsedHandoff = {
-    status: "completed" | "no-change" | "failed";
-    conclusion: string;
-    /** Compact, structured operator output. Version-1 handoffs rehydrate with
-     * empty lists; version 2 agents fill these directly. */
-    changes: string[];
-    verification: string[];
-    followUps: string[];
-};
-export declare const HANDOFF_VERSION = 2;
-export declare const HANDOFF_CONCLUSION_CAP = 600;
-/** The handoff's whole-file and list caps, exported so the brief states
- * exactly what the parser holds it to (raw authority repair). */
-export declare const HANDOFF_PAYLOAD_CAP: number;
-export declare const HANDOFF_LIST_CAP = 8;
-export declare const HANDOFF_ITEM_CAP = 240;
-export declare function parseHandoff(raw: string): {
-    ok: true;
-    handoff: ParsedHandoff;
-} | {
-    ok: false;
-    problems: Problem[];
-};
-/**
- * The compact error a repair turn is resumed with: every problem by name,
- * then the one instruction. Written for an agent that already holds the
- * context — it needs the list of what failed, not the theory of why.
- */
-/**
- * Every unattended agent runs headless (run 2085): its turn ending IS the
- * process exiting, so a command left in the background, a wakeup or a loop
- * never gets a second turn — the attempt just ends without its handoff.
- */
-export declare const HEADLESS_RULE: readonly string[];
-export declare function repairPrompt(problems: readonly Problem[], mailbox: string): string;

package/dist/demo-chat.d.ts

@@ -1,32 +0,0 @@
-import { type Html } from "./html.js";
-import type { DemoExchange } from "./demo.js";
-/** What a finished exchange's stored result holds, read back from its evidence. */
-export type DemoResultView = {
-    diff: string | null;
-    checkLog: string | null;
-    checks: {
-        status: string;
-        detail: string;
-    };
-    screenshot: {
-        href: string;
-        caption: string;
-    } | null;
-    additions: number;
-    deletions: number;
-    files: number;
-    taskHref: string;
-};
-/** The conversation itself; the live script swaps this region in place. */
-export declare function demoThreadHtml(exchanges: readonly DemoExchange[], resultOf: (exchange: DemoExchange) => DemoResultView | null): Html;
-export declare function demoChatHtml(input: {
-    exchanges: readonly DemoExchange[];
-    version: number;
-    problem: string | null;
-    resultOf: (exchange: DemoExchange) => DemoResultView | null;
-}): Html;
-/**
- * Keeps a running build live: polls while one is working and swaps the
- * thread in place, unless the visitor is typing inside it. Enter sends.
- */
-export declare const DEMO_CHAT_SCRIPT = "(() => {\n  const thread = () => document.getElementById(\"demo-thread\");\n  let timer = 0;\n  const editing = region => region.contains(document.activeElement) && document.activeElement.matches(\"textarea, input\") || region.querySelector(\"details[open] textarea:not(:placeholder-shown)\") !== null;\n  const tick = async () => {\n    const region = thread();\n    if (!region) { timer = setTimeout(tick, 400); return; }\n    if (region.dataset.working !== \"1\") return;\n    try {\n      const answer = await fetch(\"/chat/demo/live\", { headers: { accept: \"application/json\" }, credentials: \"same-origin\" });\n      if (answer.ok) {\n        const next = await answer.json();\n        if (String(next.version) !== region.dataset.version && !editing(region)) {\n          region.innerHTML = next.html;\n          region.dataset.version = String(next.version);\n          region.dataset.working = next.working ? \"1\" : \"0\";\n          if (!next.working) {\n            const last = region.querySelector(\".demo-turn:last-of-type .demo-result\");\n            if (last) last.scrollIntoView({ block: \"nearest\", behavior: matchMedia(\"(prefers-reduced-motion: reduce)\").matches ? \"auto\" : \"smooth\" });\n          }\n        }\n      }\n    } catch { /* the next tick tries again */ }\n    if (thread()?.dataset.working === \"1\") timer = setTimeout(tick, 700);\n  };\n  const start = () => { clearTimeout(timer); tick(); };\n  document.addEventListener(\"keydown\", event => {\n    const field = event.target;\n    if (event.key !== \"Enter\" || event.shiftKey || event.isComposing || !(field instanceof HTMLTextAreaElement) || field.id !== \"demo-message\") return;\n    if (field.value.trim() === \"\") return;\n    event.preventDefault();\n    field.form?.requestSubmit();\n  });\n  window.addEventListener(\"standing-orders:workspace-rendered\", start);\n  if (document.readyState === \"loading\") document.addEventListener(\"DOMContentLoaded\", start); else start();\n})();";

package/dist/demo.d.ts

@@ -1,153 +0,0 @@
-/**
- * `toolroll demo` (adoption track, step 4) — a seeded, throwaway
- * sandbox: ninety seconds from npx to seeing the product mid-flight, with
- * zero real repos, zero agents, zero spend.
- *
- * The honesty contract (Codex adoption review, findings 8 and 9):
- *
- *   - The database is stamped `demo` BEFORE any row exists — an append-only
- *     installation fact with no unset API. Every spending or external-effect
- *     command (tick, watch, build, publish, reconcile, daemon, bridge,
- *     intake) fails closed on the stamp, so a kept sandbox
- *     can never be mistaken for real work by a worker pointed at it later.
- *     The console banner is decoration; the fence is enforcement.
- *   - The seeded history is SYNTHETIC and does not pretend otherwise: runs
- *     are written with the same permissive store methods the test suite
- *     uses, inside a database that can never join operational history,
- *     because nothing that computes provider success or spends quota will
- *     open it (the fence again).
- *   - The throwaway password goes to the terminal and to a mode-0600 file
- *     inside the sandbox — NEVER into the --json envelope, a URL, or the
- *     database.
- *
- * Everything lives under one mkdtemp directory: database, evidence,
- * "repos". Ctrl-C tears it down; --keep preserves it (still fenced).
- */
-import { type Store } from "./store.js";
-export type DemoSeed = {
-    login: {
-        name: string;
-        password: string;
-    };
-    repos: string[];
-};
-/**
- * Seed a believable fleet mid-flight. The store MUST already carry the
- * demo stamp — this function refuses to seed an unfenced database, so no
- * caller can accidentally write synthetic history somewhere real.
- */
-export declare function seedDemo(store: Store, repos: {
-    api: string;
-    web: string;
-}, evidenceRoot: string, now: Date): DemoSeed;
-/** Two tiny real repositories, so repo-bound surfaces have something true
- * to point at. git is optional here — a plain directory still demos. */
-export declare function makeDemoRepos(root: string): {
-    api: string;
-    web: string;
-};
-export declare function createDemoSandbox(now: Date): {
-    sandbox: string;
-    store: Store;
-    seed: DemoSeed;
-    evidenceRoot: string;
-    passwordFile: string;
-    lead: DemoLead;
-};
-type DemoProject = "payments-api" | "web-console";
-type DemoFile = {
-    path: string;
-    before: string | null;
-    after: string;
-};
-export type DemoPlan = {
-    kind: "flaky-test" | "bug" | "copy" | "flag" | "default";
-    project: DemoProject;
-    title: string;
-    goal: string;
-    boundaries: string[];
-    checks: string[];
-    /** What the builder reports while it works, one line per beat. */
-    progress: string[];
-    conclusion: string;
-    checkOutput: string;
-    screenshot: {
-        caption: string;
-        accent: readonly [number, number, number];
-    };
-    files: DemoFile[];
-};
-/** The scripted lead's choice: a plan named by the request's words, else the default. */
-export declare function pickDemoPlan(text: string): DemoPlan;
-export type DemoExchange = {
-    id: number;
-    /** What the visitor typed, or the note that asked for this plan. */
-    asked: string;
-    reply: string;
-    plan: DemoPlan;
-    /** A visitor's extra instruction carried into the plan by Change it or Request changes. */
-    note: string | null;
-    state: "proposed" | "replaced" | "working" | "ready" | "complete" | "sent-back";
-    stage: "planning" | "building" | "checking" | null;
-    progress: string | null;
-    taskId: string | null;
-    runId: number | null;
-    approvedAt: number | null;
-};
-export type DemoLead = {
-    exchanges(): readonly DemoExchange[];
-    /** Changes whenever anything a reader would see changes. */
-    version(): number;
-    ask(text: string, now: Date): DemoExchange;
-    approve(id: number, now: Date): {
-        ok: true;
-    } | {
-        ok: false;
-        message: string;
-    };
-    change(id: number, note: string, now: Date): {
-        ok: true;
-    } | {
-        ok: false;
-        message: string;
-    };
-    requestChanges(id: number, note: string, now: Date): {
-        ok: true;
-    } | {
-        ok: false;
-        message: string;
-    };
-    /** Complete through the real completion act, then mark the exchange. */
-    complete(id: number, now: Date, act: (taskId: string, runId: number) => {
-        ok: true;
-    } | {
-        ok: false;
-        message: string;
-    }): {
-        ok: true;
-    } | {
-        ok: false;
-        message: string;
-    };
-    advance(now: Date): void;
-    stop(): void;
-};
-/**
- * The scripted lead. `stepMs` is one beat: planning takes one, building two
- * (one per progress line), checks one, so a build lands Ready in four beats.
- * State advances on a timer AND whenever someone reads, so a page and the
- * Tasks list agree without anyone polling.
- */
-export declare function createDemoLead(input: {
-    store: Store;
-    repos: {
-        api: string;
-        web: string;
-    };
-    evidenceRoot: string;
-    approver: string;
-    token: string;
-    stepMs?: number;
-    clock?: () => Date;
-}): DemoLead;
-export {};

package/dist/deploy-gate.d.ts

@@ -1,20 +0,0 @@
-import type { Store } from "./store.js";
-export type DeploymentGate = {
-    ok: true;
-    taskId: string;
-    head: string;
-    repo: string;
-    approvedBy: string;
-} | {
-    ok: false;
-    message: string;
-};
-/** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
-export declare function deploymentGate(store: Store, input: {
-    runId: number;
-    evidenceRoot: string;
-    now: Date;
-    /** Inside `toolroll release` (its own reserved deploy): a release's own automatic approval also stands
-     * (docs/plans/auto-approve-green.md). Anywhere else only a person's approval deploys. */
-    releaseFlow?: boolean;
-}): DeploymentGate;

package/dist/deploy-lock.d.ts

@@ -1,8 +0,0 @@
-/** Separate from orders.db: no live writer is reserved while deployment drains or backs up.
- * SQLite owns the OS lock until close/process death, including SIGKILL. Never unlink this file:
- * replacing its inode would let two contenders hold different locks for the same journal. */
-export type DeploymentLock = {
-    assertHeld(journalFile: string): void;
-    release(): void;
-};
-export declare function acquireDeploymentLock(journalFile: string, waitMs?: number): DeploymentLock;

package/dist/deploy-phase.d.ts

@@ -1,37 +0,0 @@
-/** What `toolroll release` does with a deployment that stopped at a phase; "refuse" for a word that is no phase. */
-export type DeployAction = "none" | "lift-pause" | "forward" | "roll-back" | "refuse";
-type RowAction = Exclude<DeployAction, "refuse">;
-type Flag = "beforeSwap" | "beforePause" | "migrationStarted" | "restartable" | "deployed";
-type Row = {
-    readonly phase: string;
-    readonly action: RowAction;
-    readonly flags: readonly Flag[];
-};
-/** The rows of a parsed data file, or an Error naming what is wrong with it. Never a partial table. */
-export declare function deployPhaseRows(data: unknown): readonly Row[];
-/** Every phase, in journal order. */
-export declare const DEPLOY_PHASES: readonly string[];
-export declare const isDeployPhase: (phase: unknown) => phase is string;
-/** The one action a journal's phase calls for; "refuse" for anything that is not a phase. */
-export declare const deployActionOf: (phase: unknown) => DeployAction;
-/** The word itself, or an Error: a journal is never written with a word the table does not hold. */
-export declare function assertDeployPhase(phase: string): string;
-/** The service was never stopped. */
-export declare const BEFORE_SWAP: readonly string[];
-/** Before the swap, with the pause in place. */
-export declare const PAUSED_BEFORE_SWAP: readonly string[];
-/** The candidate's store opened the live database, or the new service ran on it. */
-export declare const MIGRATION_STARTED: readonly string[];
-/** The old service is proved stopped: the previous definition may be started again. */
-export declare const RESTARTABLE: readonly string[];
-/** The new service may be running: never rolled back by a journal alone. */
-export declare const FORWARD_ONLY: readonly string[];
-/** Nothing is left to recover. Not the same as deployed: a released deployment never installed its runtime. */
-export declare const NEEDS_NO_RECOVERY: readonly string[];
-/** The deployment finished and its runtime is the installed one. */
-export declare const isDeployed: (phase: unknown) => boolean;
-/** Stopped where nothing was changed (before its pause), or with nothing left to do. */
-export declare const stoppedWhereNothingChanged: (phase: unknown) => boolean;
-/** The phase a lifted pause leaves behind (release-gate.ts). */
-export declare const RELEASED: string;
-export {};

package/dist/deploy-rescue.d.ts

@@ -1,42 +0,0 @@
-import { FORWARD_ONLY } from "./deploy-phase.js";
-/** Phases where the new service may be running: recovery leaves them to the release, which resumes forward. */
-export { FORWARD_ONLY };
-export type RescueWorld = {
-    /** The live database. */
-    database: string;
-    /** The installation's state folder: deployments stage under staged-upgrades/ there. */
-    stateDir: string;
-    /** Every deployment journal under staged-upgrades/: its stage and contents, null when unreadable. */
-    journals(): {
-        stage: string;
-        journal: Record<string, unknown> | null;
-    }[];
-    /** The builder run's worktree, from the plane's records (the deploy script's --source), or null. */
-    runWorktree(run: number): string | null;
-    /** The deployment's own recovery for that stage (release-adapters.ts recoverDeploy). */
-    recover(input: {
-        run: number;
-        worktree: string;
-        stage: string;
-    }): Promise<{
-        ok: true;
-    } | {
-        ok: false;
-        message: string;
-    }>;
-};
-export type RescueOutcome = {
-    ok: true;
-    acted: boolean;
-    stage: string | null;
-    phase: string | null;
-    words: string[];
-} | {
-    ok: false;
-    reason: "usage" | "conflict" | "damaged" | "forward" | "failed";
-    message: string;
-};
-/** What recovery will do from a phase, in a few words. */
-export declare function rescuePlan(phase: string, journal: Record<string, unknown>): string[];
-/** Find the one unfinished deployment (or the named stage), verify its journal, and recover it (with `yes`). */
-export declare function rescueDeployment(stageArg: string | undefined, yes: boolean, world: RescueWorld): Promise<RescueOutcome>;

package/dist/deprecations.d.ts

@@ -1,20 +0,0 @@
-/**
- * D5 (schema v117): one AI concept, the lead. The central team service's CLI (the central `lead list|create|update|
- * member|transfer`, `conversation …`, and `chat`/`brief` with --lead, --conversation or a saved profile) and native
- * coding sessions (`session …`) were deprecated in 0.9.56 and are removed now: each answers with one line naming what
- * to use instead, changing nothing. `connect` stays — remote commands and `toolroll health` use the profile it saves.
- */
-export type Deprecated = "team" | "session";
-/** The one line a deprecated command prints on stderr: what it is, when it goes, and what to use instead. */
-export declare function deprecationWarning(command: string, kind: Deprecated): string;
-/** What a deprecated console page or API says about itself. */
-export declare const DEPRECATED_PAGE: Record<Deprecated, string>;
-/** The removed command an invocation names, as `{ named, kind }`; null when it is a live command. `chat`/`brief`
- * without --local went to the central service whenever a profile was saved (`savedProfile`, asked only then): that
- * invocation is removed too, never quietly run against this computer's lead instead. */
-export declare function removedCommand(argv: readonly string[], savedProfile?: () => boolean): {
-    named: string;
-    kind: Deprecated;
-} | null;
-/** The one line a removed command answers with. */
-export declare function removedMessage(named: string, kind: Deprecated): string;