toolroll 0.9.103 → 0.9.105

package/dist/principal.d.ts

@@ -1,42 +0,0 @@
-import type { Store } from "./store.js";
-declare const verifiedApproverBrand: unique symbol;
-export type VerifiedApprover = {
-    readonly [verifiedApproverBrand]: true;
-    readonly name: string;
-    /** The approver row's credential generation at mint; re-proved on every use. */
-    readonly generation: number;
-    /** The admitted repos, in the surface's own order — `r1..rN` maps by index. */
-    readonly repos: readonly string[];
-    readonly ceilingDigest: string;
-};
-/** The lead's ceiling digest: the admitted repos IN ORDER, hashed — `rN`
- * is an index, so two surfaces naming the same repos in a different order
- * hold different ceilings (slice-2 review, finding 3). */
-export declare function ceilingDigestOf(repos: readonly string[]): string;
-/** True only for an object this module minted — never for a structural copy. */
-export declare function isVerifiedApprover(value: unknown): value is VerifiedApprover;
-export type PrincipalRefusal = {
-    ok: false;
-    reason: "no-approvers" | "unknown" | "revoked" | "locked" | "not-an-approver" | "generation" | "forged";
-};
-/** The password road: the CLI, and any ceremony that retypes it. */
-export declare function verifyApproverByPassword(store: Store, name: string, token: string, repos: readonly string[]): {
-    ok: true;
-    who: VerifiedApprover;
-} | PrincipalRefusal;
-/**
- * The session road: the edge has already proved the cookie, csrf, and the
- * origin, and holds the generation the session was opened under. This
- * re-proves the ROW — present, an approver, not revoked, SAME generation —
- * so a name alone mints nothing, and a credential rotation since the
- * session opened ends the principal.
- */
-export declare function verifyApproverStanding(store: Store, name: string, generation: number, repos: readonly string[]): {
-    ok: true;
-    who: VerifiedApprover;
-} | PrincipalRefusal;
-/** Re-prove a principal minted earlier: minted here, intact, same row, same generation, still an approver. */
-export declare function reproveApprover(store: Store, who: VerifiedApprover): {
-    ok: true;
-} | PrincipalRefusal;
-export {};

package/dist/probe.d.ts

@@ -1,46 +0,0 @@
-/**
- * Asking an environment whether it has what the work needs.
- *
- * A probe is an operator-authored command line whose exit 0 means "present
- * and alive": `gh auth status`, `test -n "$SUPABASE_KEY"`. It runs through
- * a real shell, deliberately — the design's own examples need expansion and
- * `test` — and that is safe only because of who wrote it: probes are stored
- * by the operator, at `cap add`, with the author recorded. Nothing an agent
- * or a scanned repository writes is ever executed as a probe; the scanner
- * synthesizes probes from a fixed template over validated identifiers or
- * stores none at all.
- *
- * The answer is a claim about one machine at one moment. `verified` carries
- * when and by whom; anything else carries the probe's own words — "exit 1",
- * "timed out", "sh not found" — because collapsing those to a bit discards
- * exactly what tells an operator whether to paste a key or fix a PATH.
- */
-import { type ExecResult, type RunOptions } from "./exec.js";
-import { type Capability, type Store } from "./store.js";
-export type Runner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
-/** Probes are cheap questions; one that hangs is already an answer. */
-export declare const PROBE_TIMEOUT_MS = 10000;
-export type ProbeOutcome = {
-    kind: Capability["kind"];
-    name: string;
-    status: "verified" | "failed" | "unprobed";
-    /** The probe's words when it did not say yes. */
-    detail?: string;
-};
-/**
- * Whether a capability is verified *right now*: a stale yes is not a yes.
- * Presence is not enough, and neither is a verification whose expiry passed.
- */
-export declare function isVerified(capability: Capability, now: Date): boolean;
-/** Run one capability's probe and record what it said. */
-export declare function probeOne(store: Store, capability: Capability, by: string, now: Date, runner?: Runner, env?: Record<string, string>): Promise<ProbeOutcome>;
-/**
- * Probe a repo's capabilities — all of them, or the named subset. Statuses
- * land in the store as each probe answers; the returned outcomes are for
- * reporting, not the source of truth.
- */
-export declare function probeRepo(store: Store, repo: string, by: string, now: Date, options?: {
-    runner?: Runner;
-    only?: ReadonlySet<string>;
-    env?: Record<string, string>;
-}): Promise<ProbeOutcome[]>;

package/dist/process-custody.d.ts

@@ -1,17 +0,0 @@
-import type { ObservedProcess, ProcessObservationFailure } from "./process-tree.js";
-import type { Store } from "./store.js";
-import type { ExecResult, RunOptions } from "./exec.js";
-/** Existing append-only ledger; a diagnostic is not exit evidence. */
-export declare function recordProcessObservationFailure(store: Store, runId: number, now: Date, failure: ProcessObservationFailure): void;
-/** Preserve observed IDs through the existing serialized write boundary. This
- * writes process facts only; it does not declare exit or replay observers. */
-export declare function preserveObservedProcesses(store: Store, runId: number, now: Date, rows: readonly ObservedProcess[]): boolean;
-type Runner = (file: string, args: readonly string[], options?: RunOptions) => Promise<ExecResult>;
-/** Reserve each spawn before the OS call. A crash before its PID is recorded
- * leaves an explicit unknown, even if earlier setup/check processes exited.
- * Only the returning transport can certify that its reserved spawn made no child.
- * Retained PIDs are read-only witnesses, never authority to signal a process.
- * A native OS object (v53) rides the same witness: named at the spawn, and
- * marked empty only when the OS proved it so — never on a transport exit. */
-export declare function witnessedRunner(store: Store, runId: number, clock: () => Date, runner: Runner): Runner;
-export {};

package/dist/process-liveness.d.ts

@@ -1,13 +0,0 @@
-type HistoricalWitness = {
-    observedAt: unknown;
-    finishedAt: unknown;
-    exitedAt?: unknown;
-};
-/** How long a run must have been over before a number its group once held can be read as someone else's. */
-export declare const REUSED_GROUP_AFTER_MS: number;
-/** Read-only checks of retained process witnesses. Saved PIDs authorize no
- * signal. ESRCH or proven macOS PID reuse establishes absence; everything
- * unknown stays occupied. This concerns the historical identity, not whether
- * the numeric PID/PGID is currently populated by unrelated processes. */
-export declare function processMayBeAlive(pid: number, group: boolean, witness?: HistoricalWitness): boolean;
-export {};

package/dist/process-tree.d.ts

@@ -1,39 +0,0 @@
-import { type ChildProcess } from "node:child_process";
-export type ObservedProcess = {
-    pid: number;
-    group: boolean;
-};
-export type ProcessObservationFailure = {
-    phase: "sample" | "periodic" | "final-exit" | "stop" | "supervisor";
-    operation: "snapshot" | "descendant-write" | "exit-write" | "signal" | "diagnostic-read";
-    code: string;
-    rootPid: number | null;
-    at: string;
-    identityUnknown: boolean;
-};
-export type ProcessTreeObserver = {
-    onDescendant?: (pid: number, group: boolean) => void;
-    /** A dedicated durable fallback for the exact identities already observed.
-     * Return true only after preserving every row. Never replay arbitrary callbacks. */
-    onDescendantWriteFailure?: (rows: readonly ObservedProcess[]) => boolean;
-    /** An observed PID (and its group, when recorded) is now proven absent.
-     * This never follows merely from reparenting or the root's exit. */
-    onDescendantExit?: (pid: number, group: boolean) => void;
-    /** Diagnostics never establish exit or erase a custody witness. */
-    onObservationFailure?: (failure: ProcessObservationFailure) => void;
-    onUnknown?: () => void;
-};
-/** Capture current descendants before asking an owned process to exit.
- * A cooperative root may exit before the next periodic observation; even
- * a killed tool can retain its PID briefly after its process group is gone. */
-export declare function sampleProcessTree(child: ChildProcess): void;
-/** Observe escaped process groups while their ancestry is still provable.
- * Durable witnesses prevent recovery from mistaking a dead harness for a dead
- * shell. They never grant permission to send a signal after worker recovery. */
-export declare function observeProcessTree(child: ChildProcess, observer: ProcessTreeObserver): void;
-/** Freeze the owned handle, then its live descendants before killing them.
- * Claude's tool shells create new process groups, so killing only -rootPid
- * leaves writers behind. Re-scan after freezing parents to catch a child born
- * during the previous scan. Every target comes from current ancestry of the
- * still-owned handle, never from a saved PID. Unknown ancestry stays blocked. */
-export declare function stopProcessTree(child: ChildProcess): boolean;

package/dist/project-access.d.ts

@@ -1,17 +0,0 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-/** null explicitly means instance access; [] grants no project access. */
-export type ProjectAccess = readonly string[] | null;
-export declare function normalizeProjectAccess(value: unknown): string[] | null;
-/** Corrupt or missing authority never falls back to instance access. */
-export declare function readProjectAccess(value: unknown): ProjectAccess;
-export declare function projectAccessAllows(access: ProjectAccess, repo: string | null): boolean;
-/** SQL: projectAccessAllows for an `approver` row (`alias`) and a project path expression, for the dispatch belts. A
- * null list reaches every project; an unreadable one reaches none. */
-export declare const accountReachesSql: (alias: string, repo: string) => string;
-/** A server-proved resource, never an unchecked header or submitted path.
- * CLI ceremonies must pass their resource explicitly; global ceremonies
- * without a project refuse project-scoped credentials. */
-export declare const projectAuthority: AsyncLocalStorage<{
-    actor: string;
-    repo: string | null;
-}>;

package/dist/project-activity.d.ts

@@ -1,20 +0,0 @@
-/** Shared presentation for browser and no-script Activity; facts come only
- * from projectOutcomes. No alternate counting or status interpretation. */
-import type { ActivityFamily, ProjectOutcomes } from './project-outcomes.js';
-export declare const activityAge: (ms: number | null) => string;
-export declare const activityMoney: (usd: number | null) => string;
-export declare const ACTIVITY_ACTORS: {
-    human: string;
-    lead: string;
-    landed: string;
-    'machine-or-unknown': string;
-};
-export type ActivityMetric = {
-    label: string;
-    value: string;
-    detail: string;
-    rows: ActivityFamily[];
-};
-export declare const activityScope: (report: ProjectOutcomes) => string;
-export declare const activityLimit: (report: ProjectOutcomes) => string;
-export declare function activityMetrics(report: ProjectOutcomes): ActivityMetric[];

package/dist/project-admission.d.ts

@@ -1,105 +0,0 @@
-/**
- * Adding and removing projects: the ONE road for the command line, the lead
- * and the console's own "Add a project". A project is admitted when its
- * folder is proved to be a Git repository, canonicalized to its checkout
- * root, saved in the store's project list, and enrolled in the machine's
- * locked project registry; a running `up` adopts it from there without a
- * restart. Each change is one ledger row naming who made it and from where.
- *
- * Removing is reversible: the project leaves the lists and the builder, and
- * its tasks, results and settings stay saved. Deleting everything Toolroll
- * holds for a project is project-delete.ts, behind its own confirmation.
- */
-import { type ProjectExec } from "./project.js";
-import type { Store } from "./store.js";
-/** Where an addition or removal came from, as the ledger says it. */
-export type AdmissionOrigin = "cli" | "lead" | "console";
-/** Who made it: the ledger's actor (an account, `lead for <owner>`, or this computer's user) and the road. */
-export type AdmissionActor = {
-    label: string;
-    origin: AdmissionOrigin;
-};
-export type AdmissionFailure = {
-    ok: false;
-    reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed" | "moved";
-    message: string;
-};
-/** `remote`: the origin URL this add recorded as the project's trusted remote (null: none), and why one wasn't. */
-export type Admitted = {
-    ok: true;
-    repo: string;
-    name: string;
-    added: boolean;
-    remote: {
-        url: string | null;
-        why: string | null;
-    };
-};
-export type Released = {
-    ok: true;
-    repo: string;
-    name: string;
-    removed: boolean;
-};
-export declare const PROJECT_ADDED = "project added";
-/** A folder's real path (a folder), null (not one), or "no-answer" (it didn't answer in time). */
-export type FolderResolver = (path: string) => Promise<string | null | "no-answer">;
-export declare const PROJECT_REMOVED = "project removed";
-/** The checkout root a folder belongs to, canonical; never a shell. */
-export declare function proveProjectRoot(path: string, exec?: ProjectExec, resolveFolder?: FolderResolver): Promise<{
-    ok: true;
-    repo: string;
-} | AdmissionFailure>;
-/** Registry first, then the project and its audit records in one transaction. Re-adds preserve trust. */
-export declare function admitProject(store: Store, input: {
-    /** null: a console with no machine registry (a bare `serve`) keeps only the project list. */
-    registryFile: string | null;
-    path: string;
-    actor: AdmissionActor;
-    now: Date;
-    exec?: ProjectExec;
-    /** Only the authorized CLI add opts in; console/open/onboarding never discover a remote. */
-    captureOrigin?: boolean;
-    /** Explicit value from the owner/instance-operator CLI boundary. */
-    remoteUrl?: string;
-    /** The caller's authority, asked again about the proved repo inside the locked registry update and inside the
-     * database transaction (the console: nothing it proved before an await moved, and the repo is still visible). */
-    stillAllowed?: (repo: string) => boolean;
-    /** How the folder and its checkout root are resolved (the console: off its thread, under a deadline). Absent:
-     * canonicalProject. */
-    resolveFolder?: FolderResolver;
-}): Promise<Admitted | AdmissionFailure>;
-/**
- * Remove one project from the lists and the builder. Its tasks, results and
- * settings stay saved; adding it again brings it back. A path that isn't a
- * saved project changes nothing.
- */
-export declare function releaseProject(store: Store, input: {
-    registryFile: string | null;
-    path: string;
-    actor: AdmissionActor;
-    now: Date;
-}): Promise<Released | AdmissionFailure>;
-/** The registry `up` watches: beside the database, so an isolated database never enrolls into another's list. */
-export declare function registryBeside(databaseFile: string): string;
-/**
- * Who is adding from the command line. Running it on this computer against
- * a database this user owns is the owner's authority; a lead token acts as
- * `lead for <owner>`, and only for an owner who may manage every project.
- * Any other credential is refused rather than read as the owner.
- */
-export declare function commandLineActor(store: Store, input: {
-    databaseFile: string;
-    leadToken?: string;
-    user?: string;
-}): AdmissionActor | AdmissionFailure;
-/** Whether a builder is running now (its heartbeat is a minute apart), so an addition is in the console within seconds. */
-export declare function consoleRunning(store: Store, now: Date): boolean;
-/** The one plain line after an addition: where the project is now. */
-export declare function addedWords(name: string, added: boolean, running: boolean): string;
-/**
- * Whether a registry entry carries an admission this boundary recorded:
- * its project row. `up` adopts a project added after it started only with
- * this record, so a hand-edited registry line is not authority by itself.
- */
-export declare function admissionRecorded(store: Store, repo: string): boolean;

package/dist/project-cli.d.ts

@@ -1,19 +0,0 @@
-import type { Store } from './store.js';
-export type ProjectProfile = {
-    version: 1;
-    repo: string;
-    tokenFile: string | null;
-};
-export declare const projectProfilePath: (databaseFile: string) => string;
-export declare function readProjectProfile(databaseFile: string): ProjectProfile | null;
-export declare function runProjectCommand(positional: readonly string[], flags: Map<string, string | true>, context: {
-    store: Store;
-    databaseFile: string;
-    write: (line: string) => void;
-    json: boolean;
-    registryFile?: string;
-    now?: Date;
-}): Promise<number>;
-/** Only known credential-aware adapters consume the remembered reference.
- * Explicit credentials always win; no legacy action gains implicit authority. */
-export declare function applyProjectProfile(command: string, positional: readonly string[], flags: Map<string, string | true>, databaseFile: string): void;

package/dist/project-concurrency.d.ts

@@ -1,62 +0,0 @@
-export declare const PROJECT_CONCURRENCY_DEFAULT = 2;
-export declare const projectConcurrencyPath: (databaseFile: string) => string;
-/** A number as typed: a whole number from 1 to RUNNER_CAPACITY_MAX, or null. */
-export declare function parseProjectConcurrency(value: string): number | null;
-/** Every saved number, by canonical project path. An unreadable file reads as none saved. */
-export declare function savedProjectConcurrency(databaseFile: string): Map<string, number>;
-/** The project's own number: saved, or the default. */
-export declare function projectConcurrency(databaseFile: string, repo: string): number;
-/** Save one project's number atomically; returns the number before and after. */
-export declare function saveProjectConcurrency(databaseFile: string, repo: string, n: number): {
-    before: number;
-    after: number;
-};
-/** What a project actually gets on one worker: its number, never above the worker's capacity. */
-export declare function effectiveConcurrency(setting: number, capacity: number): number;
-/**
- * The in-process record of when each project's builder last finished a
- * pass, shared by every project loop of one service. A project that yields
- * a free slot to another waits only until that project has had a pass to
- * take it: a waiting project that cannot use the slot (a missing tool, a
- * paused provider) never holds a busy one back for long.
- */
-export declare class ProjectPasses {
-    private readonly finished;
-    private tick;
-    /** A monotonic stamp, so ordering never depends on the wall clock. */
-    stamp(): number;
-    passed(repo: string): void;
-    lastPass(repo: string): number;
-}
-export type SlotFacts = {
-    repo: string;
-    /** This worker's capacity. */
-    capacity: number;
-    /** Builds this worker holds now, by project (the asking lane holds none). */
-    running: ReadonlyMap<string, number>;
-    /** Each project's own number. */
-    limitOf: (repo: string) => number;
-    /** Projects with work this worker could start now. */
-    waiting: ReadonlySet<string>;
-    /** Since when this lane has been yielding, or null. */
-    yieldingSince: number | null;
-    passes: ProjectPasses;
-};
-export type SlotAnswer = {
-    take: true;
-} | {
-    take: false;
-    why: "limit" | "capacity" | "fair-share";
-    to?: string;
-};
-/**
- * May a build lane of `repo` start one more task now?
- *
- * - never past the project's own number (capped by the worker's capacity);
- * - never past the worker's capacity;
- * - fair share: a project already building yields a free slot to any other
- *   project with ready work that is building fewer, until that project has
- *   had a pass to take it. A project building nothing never yields, so every
- *   project with work gets its first build ahead of another's second.
- */
-export declare function maySlotTake(facts: SlotFacts): SlotAnswer;

package/dist/project-delete-ui.d.ts

@@ -1,96 +0,0 @@
-/**
- * Settings → Project: what Toolroll holds for a project, and deleting
- * it. An instance operator deletes in two steps: type the project's name,
- * then read exactly what goes and confirm with their password (or a fresh
- * sign-in with the identity provider). The repository itself stays.
- */
-import { type FallbackSetting } from "./fallback.js";
-import type { ProjectSandbox } from "./project-sandbox.js";
-import type { ProjectNetwork } from "./egress.js";
-import type { WritesMode } from "./writes-mode.js";
-import { type CheckAccess } from "./check-access.js";
-import { type Html } from "./html.js";
-import { type ProjectHoldings } from "./project-delete.js";
-/** Check access: a wider level's warning shows only under the option chosen. Everything else on the page is kit markup. */
-export declare const PROJECT_DELETE_CSS: string;
-export type ProjectSettingsView = {
-    remoteUrl?: string | null;
-    /** The code map's switch and, while it runs, the holdout's end date. */
-    codeMap?: {
-        on: boolean;
-        enrollUntil: string | null;
-        canEndHoldout: boolean;
-        href: string;
-    };
-    repo: string;
-    name: string;
-    holdings: ProjectHoldings;
-    running: string[];
-    canDelete: boolean;
-    /** How many of its tasks build at once: the saved number, what its worker allows, how many build now. */
-    builds?: {
-        setting: number;
-        capacity: number | null;
-        building: number;
-        canChange: boolean;
-    };
-    /** What its builds can reach: the project's named tools and whether each loads (names and words only, never a
-     * secret), or why they couldn't be read. */
-    access?: {
-        tools: {
-            name: string;
-            loads: boolean;
-            words: string;
-        }[];
-    } | {
-        problem: string;
-    };
-    /** Live view (live-detail.ts): whether running agents' commands and their output show, and whether this person may change it. */
-    liveView?: {
-        commands: boolean;
-        canChange: boolean;
-        nonce?: string;
-    };
-    /** What its builds may reach on the network (egress.ts), and whether this person may change it. */
-    network?: {
-        setting: ProjectNetwork;
-        canChange: boolean;
-    };
-    /** Who takes over when an agent runs out of its plan (fallback.ts), and whether this person may change it. */
-    fallback?: {
-        setting: FallbackSetting | null;
-        canChange: boolean;
-    };
-    /** Where its builds may write (writes-mode.ts), and whether this person may change it. */
-    writes?: {
-        setting: WritesMode;
-        canChange: boolean;
-    };
-    /** What its builds and checks may not read, and the macOS services and protected files they may still use
-     * (project-sandbox.ts), and whether this person may change it. */
-    sandbox?: {
-        setting: ProjectSandbox;
-        canChange: boolean;
-    };
-    /** How far its checks reach (check-access.ts): the level, who changed it last, and whether this person may narrow it
-     * (an approver for the project) or also widen it (an instance operator). */
-    checkAccess?: {
-        setting: CheckAccess;
-        changed: {
-            by: string;
-            at: string;
-        } | null;
-        canNarrow: boolean;
-        canWiden: boolean;
-        /** This machine can't sandbox checks at all, and an operator allowed them to run anyway: every level runs unsandboxed. */
-        unconfinedHere?: boolean;
-        /** Why sign-ins can't be chosen (off for now), or null: they can. */
-        signInsUnavailable?: string | null;
-    };
-};
-export declare function projectSettingsHtml(view: ProjectSettingsView, said: {
-    said?: string | null;
-    problem?: string | null;
-}): Html;
-/** The second step: exactly what goes, and the password. */
-export declare function projectDeleteConfirmHtml(view: ProjectSettingsView, problem: string | null): Html;

package/dist/project-delete.d.ts

@@ -1,59 +0,0 @@
-import type { ExecResult } from "./exec.js";
-import type { Runner } from "./worktree.js";
-import { type Store } from "./store.js";
-export declare const OWN_BRANCHES: readonly string[];
-export type ProjectHoldings = {
-    tasks: number;
-    versions: number;
-    runs: number;
-    evidence: number;
-    checkouts: number;
-    chats: number;
-    flows: number;
-    cards: number;
-    subagents: number;
-    budgets: number;
-    settings: number;
-};
-export type ProjectDeleteResult = {
-    ok: true;
-    repo: string;
-    removed: ProjectHoldings & {
-        branches: number;
-        rows: number;
-    };
-    left: string[];
-    ledgerId: number;
-} | {
-    ok: false;
-    reason: "running" | "failed";
-    said: string;
-    running?: string[];
-};
-/** The project's Models rows, counted with its settings and deleted by forgetProjectModels only. */
-export declare const MODEL_SETTINGS: readonly [table: string, column: string][];
-/** The project's settings tables, for the deletion test's inventory. */
-export declare const PROJECT_SETTINGS: readonly [table: string, column: string][];
-/** What Toolroll holds for a project, counted. */
-export declare function projectHoldings(store: Store, repo: string): ProjectHoldings;
-/** What's in it, in words: "12 tasks, 3 versions, 30 runs, …". Empty kinds are left out. */
-export declare function holdingsWords(held: ProjectHoldings & {
-    branches?: number;
-}): string;
-/** The project's work that is running right now, in words; empty when none is. */
-export declare function projectRunning(store: Store, repo: string, now: Date): string[];
-export type GitRunner = (args: readonly string[], cwd: string) => Promise<ExecResult>;
-/**
- * Delete the project. Refuses while any of its work is running (checked
- * again inside the deletion). Its tasks are held first so nothing new
- * starts while the checkouts and branches go.
- */
-export declare function deleteProject(store: Store, repo: string, options: {
-    actor: string;
-    via: "console" | "command line";
-    now: Date;
-    evidenceRoot: string | null;
-    poolRoot: string | null;
-    git?: GitRunner;
-    runner?: Runner;
-}): Promise<ProjectDeleteResult>;

package/dist/project-demo.d.ts

@@ -1,12 +0,0 @@
-export declare const projectDemoPath: (databaseFile: string) => string;
-/** A demo URL as typed: an http(s) address with no sign-in details, at most 500 characters, or null. */
-export declare function parseDemoUrl(value: string): string | null;
-/** Every saved demo URL, by canonical project path. An unreadable file reads as none saved. */
-export declare function savedProjectDemos(databaseFile: string): Map<string, string>;
-/** The project's demo URL, or null when it has none. */
-export declare function projectDemoUrl(databaseFile: string, repo: string): string | null;
-/** Save (or, with null, clear) one project's demo URL atomically; returns it before and after. */
-export declare function saveProjectDemo(databaseFile: string, repo: string, url: string | null): {
-    before: string | null;
-    after: string | null;
-};

package/dist/project-file.d.ts

@@ -1,3 +0,0 @@
-/** A project file a script names, if it is one: inside the project, and there. Kept free of the runner's imports so a
- * flow's "runs on its own" grant (flow-unattended.ts) resolves the very file a script would run. */
-export declare function projectFile(root: string, path: string): string | null;

package/dist/project-identity.d.ts

@@ -1,52 +0,0 @@
-/**
- * Project identities as the console uses them, without touching a person's folders on its thread.
- *
- * A project's identity is its real path (project.ts canonicalProject). Resolving one reads the folder, and a folder can
- * stop answering (folder-look.ts), so the console never resolves one on a page or at startup on its own thread, and
- * never waits for one before it answers:
- *
- * - `hot` (display and grouping only): the last answer, else the path as saved. Nothing is started by asking.
- * - `strict` (visibility and authorization): only a resolved identity; an unknown one fails closed until the next
- *   refresh resolves it, so a stored path that leads outside its root never passes on its spelling.
- * - `vouched` (a path a request names): only a path whose identity is known, or one that is exactly a saved identity.
- *   Anything else is refused this time and resolved by the next background pass, never resolved inline.
- * - `resolveNow` (an action that needs a path checked now, a POST): resolved off the thread under the look's deadline.
- * - `refresh` (the console's background pass, the first started right after it listens): resolves what was asked about
- *   and what has gone stale. The console answers before any of it does; until a path answers it fails closed.
- *
- * An embedder or test that passes no identities gets `syncProjectIdentities`: the old synchronous reads, unchanged.
- */
-import { type FolderGate } from "./folder-gate.js";
-import { type FolderLookOptions } from "./folder-look.js";
-export type ProjectIdentities = {
-    /** For display and grouping only: the last known identity, else the path as saved (resolved lexically). Reads
-     * nothing. Never an authorization answer: use `strict`. */
-    hot: (path: string) => string;
-    /** For authorization: the known real folder path, else null (unknown or not a folder: fail closed until resolved).
-     * Reads nothing; an unknown path is asked about on the next refresh. */
-    strict: (path: string) => string | null;
-    /** The known identity: a real folder path, null (not a folder), or undefined (never answered). Reads nothing. */
-    known: (path: string) => string | null | undefined;
-    /** A request's path: its known identity, or the path itself when it is exactly one of `saved` (projects the plane
-     * itself proved and admitted); else undefined. */
-    vouched: (path: string, saved: () => Iterable<string>) => string | undefined;
-    /** This path's identity now, off the thread: a real folder path, null, or "no-answer" past the deadline. */
-    resolveNow: (path: string) => Promise<string | null | "no-answer">;
-    /** Resolve `paths`, everything asked about since, and answers older than a minute. False when some didn't answer. */
-    refresh: (paths: Iterable<string>) => Promise<boolean>;
-    /** Moves whenever a known identity changes or goes: a decision made before an await is re-checked against it right
-     * before its write. */
-    generation: () => number;
-    /** Whether a synchronous read inside `path` may happen on the console's thread now (folder-gate.ts): the folder it is
-     * in answered a look within the last few minutes, and no look at it since went unanswered. Reads nothing. */
-    answering: (path: string) => boolean;
-};
-/** How many folders a pass looks at side by side when they're looked at one by one (within FOLDER_LOOK_CHILDREN). */
-export declare const IDENTITY_LOOKS = 4;
-export declare function projectIdentities(look?: FolderLookOptions, now?: () => number): ProjectIdentities;
-/** The synchronous reads, as before: for embedders and tests that pass no identities. */
-export declare function syncProjectIdentities(): ProjectIdentities;
-/** The console's folder gate (folder-gate.ts): its own data folders (the database's, evidence, build checkouts) are read
- * freely when the console names them; a path read from a file a build can write (`pointer`), and anything else, only
- * while `answering` vouches for where it leads. */
-export declare function consoleFolderGate(identities: ProjectIdentities, own: readonly (string | undefined)[]): FolderGate;