toolroll 0.9.104 → 0.9.105

package/dist/check-levels-ui.d.ts

@@ -1,36 +0,0 @@
-/** Settings → Projects → Checks: how much checks after each build, in plain
- * words. One choice (Quick, Full, Off) and the quick command beside the full
- * one. Every change takes the password and lands in the ledger; approving a
- * command restates exactly what will run, unattended, before the yes. */
-import { type Html } from "./html.js";
-import { type CheckLevel } from "./check-levels.js";
-import type { VerifyCommand } from "./store.js";
-export type CheckSettingsView = {
-    repo: string;
-    name: string;
-    csrf: string;
-    canChange: boolean;
-    level: CheckLevel;
-    full: VerifyCommand | null;
-    quick: VerifyCommand | null;
-    /** A starting point for the quick command, from the project's scripts. */
-    suggestion: string | null;
-    /** The project's automatic review switch (review-switch.ts), beside its checks. */
-    review?: {
-        on: boolean;
-        source: "project" | "hands-off" | "default";
-    };
-    /** Batch checks (batch-checks.ts): off by default. */
-    batch?: {
-        on: boolean;
-    };
-    /** Small tasks start right away (fast-start.ts). */
-    fast?: {
-        on: boolean;
-    };
-    said: string | null;
-    problem: string | null;
-};
-export declare function checkSettingsHtml(view: CheckSettingsView): Html;
-/** The follow-up list's look (result-follow-ups.ts); the checks page itself is kit markup. */
-export declare const CHECK_SETTINGS_CSS = "\n  .follow-ups .follow-up-list { margin: .4rem 0; padding-left: 1.1rem; display: grid; gap: .25rem; }\n  .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: flex; flex-wrap: wrap; gap: .5rem; margin: .5rem 0 0; }\n  .follow-ups .follow-up-act { margin: 0; }\n  .follow-ups button { min-height: 44px; }\n  @media (max-width: 480px) { .follow-ups .follow-up-acts, .follow-ups .follow-up-act { display: grid; } .follow-ups .follow-up-act button { width: 100%; } }\n";

package/dist/check-levels.d.ts

@@ -1,70 +0,0 @@
-import type { Store, VerifyCommand } from "./store.js";
-export declare const CHECK_LEVELS: readonly ["quick", "full", "off"];
-export type CheckLevel = (typeof CHECK_LEVELS)[number];
-export declare const isCheckLevel: (value: unknown) => value is CheckLevel;
-export declare const CHECK_LEVEL_WORDS: Readonly<Record<CheckLevel, string>>;
-export declare const CHECK_LEVEL_HINTS: Readonly<Record<CheckLevel, string>>;
-/** Ledger actions. The ledger is append-only, so the newest entry is the setting. */
-export declare const PROJECT_LEVEL_ACTION = "check level changed";
-export declare const TASK_LEVEL_ACTION = "task checks chosen";
-export declare const RUN_LEVEL_ACTION = "checks used";
-/** The quick command's grant lives beside the full one under its own key. */
-export declare const quickVerifyKey: (repo: string) => string;
-export declare function liveQuickCommand(store: Store, repo: string): VerifyCommand | null;
-/** Ledger reads go through the repo index: `repo = ?` (or IS NULL for unplaced work). */
-export declare const repoClause: (repo: string | null) => [string, string[]];
-export declare function repoOfRun(store: Store, runId: number): string | null;
-export type ProjectCheckLevel = {
-    level: CheckLevel;
-    setBy: string | null;
-    at: string | null;
-};
-/** A project's level. With nothing recorded it is Full: a project that existed
- * before levels keeps exactly the check it had. New projects are stamped Quick
- * when they are added (stampNewProjectLevel). */
-export declare function projectCheckLevel(store: Store, repo: string): ProjectCheckLevel;
-/** An approver's act: set the project's level. The ledger keeps before → after. */
-export declare function setProjectCheckLevel(store: Store, repo: string, level: CheckLevel, by: string, now: Date): {
-    changed: boolean;
-    before: CheckLevel;
-};
-/** A project added from now on starts on Quick. One that already has a level,
- * or an approved check from before levels existed, is left exactly as it is. */
-export declare function stampNewProjectLevel(store: Store, repo: string, now: Date): boolean;
-/** A task's own choice, if it made one; a revision inherits the task it revises. */
-export declare function taskCheckLevel(store: Store, taskId: string): CheckLevel | null;
-/** A filing choice: this task's checks, overriding the project. Fixed once its
- * plan is approved, so what the approver saw is what runs. */
-export declare function setTaskCheckLevel(store: Store, taskId: string, level: CheckLevel, by: string, now: Date): {
-    ok: true;
-} | {
-    ok: false;
-    message: string;
-};
-export type EffectiveCheckLevel = {
-    level: CheckLevel;
-    from: "task" | "project";
-};
-export declare function effectiveCheckLevel(store: Store, repo: string | null, taskId: string | null): EffectiveCheckLevel;
-/** The command a level runs. Quick without its own command runs the full one
- * (and says so: the level that ran is Full). Off runs nothing. */
-export declare function checkCommandFor(store: Store, repo: string, level: CheckLevel): {
-    level: CheckLevel;
-    command: VerifyCommand | null;
-};
-/** Readiness uses the result's level, falling back to the task/project for legacy
- * runs. Quick's approved command (or its Full fallback) is required; Off is not. */
-export declare function requiredCheckCommandFor(store: Store, repo: string | null, taskId: string, level: CheckLevel | null | undefined): VerifyCommand | null;
-/** The builder records which level a run used, so its result says it honestly. */
-export declare function recordRunCheckLevel(store: Store, run: {
-    id: number;
-    taskId: string;
-    repo: string | null;
-}, level: CheckLevel, from: EffectiveCheckLevel["from"], now: Date): void;
-/** The level a finished run's checks used; null for a run from before levels. */
-export declare function runCheckLevel(store: Store, runId: number): CheckLevel | null;
-/** A starting point for the quick command, from the project's own scripts.
- * It is only a suggestion: a person approves the exact command. */
-export declare function suggestQuickCommand(repo: string): string | null;
-/** "skip the tests", "run the full checks": a filing request in chat, as a level. */
-export declare function checkLevelFromWords(text: string): CheckLevel | null;

package/dist/check-load.d.ts

@@ -1,85 +0,0 @@
-import { z } from "zod";
-export declare const CHECK_LOAD_CAPTURE = "release check load v1";
-/** One reading of the machine: its cores and one-minute load (NaN where it isn't measured: Windows reports 0). */
-export type MachineSample = {
-    cores: number;
-    load: number;
-};
-export declare const machineSample: (platform?: NodeJS.Platform, read?: () => number[], cores?: () => number) => MachineSample;
-/** The check's budget on a quiet machine: three quarters of the cores, at least 2 (release-check.mjs checkBudget). */
-export declare const normalFree: (cores: number) => number;
-/** The check's budget under `load` (release-check.mjs checkBudget's `free`). Unmeasured load budgets from the cores. */
-export declare const freeAt: (cores: number, load: number) => number;
-/** Cut: the budget is at most half its normal size. Unmeasured load is never cut. */
-export declare const budgetCut: (cores: number, load: number) => boolean;
-/** A release check's limit never goes past this, however busy the machine. */
-export declare const CHECK_LIMIT_CEILING_MS: number;
-/** …nor past this many times the approved limit. */
-export declare const CHECK_LIMIT_MAX_FACTOR = 2;
-/**
- * The limit a release check runs under: the approved one, unless the machine's load at its start cuts the check's
- * budget to half or less — then the approved limit times normal/granted, at most twice it and never past the ceiling
- * (an approved limit already at or past the ceiling is never extended). `why` says which, in words.
- */
-export declare function checkLimitFor(grantMs: number, sample: MachineSample): {
-    limitMs: number;
-    why: string;
-};
-/** When a check ends itself before its limit (release-check.mjs checkDeadline, from its start): src/check-load.test.ts
- * holds the two equal. A check that ran at least this long ran into its own limit. */
-export declare const selfStopAfter: (limitMs: number) => number;
-/** The samples read for the budget the check started with: the check waits up to ten minutes for the load to drop
- * (release-check.mjs), so the least load in its first eleven — before its own load counts — is what it budgeted from at
- * best. The least, so a check that found a quieter moment is never called cut. */
-export declare const CUT_WINDOW_MS: number;
-declare const recordSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    cores: z.ZodInt;
-    grantMs: z.ZodInt;
-    limitMs: z.ZodInt;
-    why: z.ZodString;
-    startedAt: z.ZodString;
-    elapsedMs: z.ZodNullable<z.ZodInt>;
-    samples: z.ZodArray<z.ZodObject<{
-        atMs: z.ZodInt;
-        load: z.ZodNullable<z.ZodNumber>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-export type CheckLoadRecord = z.infer<typeof recordSchema>;
-/** A sealed record read back, or null when it isn't one (an older run has none: then nothing is excused). */
-export declare function readCheckLoad(value: unknown): CheckLoadRecord | null;
-/**
- * Why a release check that ran out of time did so because the machine was busy — or null. Every fact is the plane's:
- * its load readings in the first eleven minutes (the least of them) cut the check's budget to half or less, and the
- * check's last attempt ran into its own limit (at least `selfStopAfter(limitMs)`), or the plane stopped it at the limit
- * (`stoppedAtLimit`). A check with its normal budget that times out is never excused here: a real hang stays a failure.
- */
-export declare function busyMachineTimeout(record: CheckLoadRecord | null, grantMs: number, stoppedAtLimit: boolean): string | null;
-/**
- * Watches one release check: the limit at its start, the load every 15 s while it runs, and how long its last attempt
- * took. Advisory to the check itself (the limit is a plane value the check is told), and the only source of the record.
- */
-export declare class CheckLoadWatch {
-    private readonly grantMs;
-    private readonly options;
-    private readonly started;
-    private readonly samples;
-    private readonly timer;
-    private readonly cores;
-    private attemptStart;
-    private elapsed;
-    readonly limitMs: number;
-    readonly why: string;
-    constructor(grantMs: number, options?: {
-        sample?: () => MachineSample;
-        clock?: () => number;
-        everyMs?: number;
-    });
-    private push;
-    /** Around each attempt of the command: the last one's time is the record's. */
-    attemptStarted(): void;
-    attemptEnded(): void;
-    /** Stops the readings and gives the record to seal. */
-    finish(): CheckLoadRecord;
-}
-export {};

package/dist/check-only-standing.d.ts

@@ -1,36 +0,0 @@
-import type { CheckAccess } from "./check-access.js";
-import type { Store } from "./store.js";
-export type CheckAuthorization = {
-    id: number;
-    taskRef: number;
-    run: number;
-    candidate: string;
-    commandDigest: string;
-    level: "quick" | "full";
-    access: CheckAccess;
-    scopeDigest: string;
-    expiresAt: string;
-    usedRequest: number | null;
-};
-export declare function readAuthorization(row: Record<string, unknown>): CheckAuthorization;
-/** The approval an authorization stands on: the plan's seal, on these exact bytes, still standing as dispatch reads it. */
-export declare function approvedScopeStands(store: Store, taskRef: number, scopeDigest: string, now: Date): boolean;
-/** The plain reason an authorization doesn't stand, or null: this exact commit and command, on the result it was
- * written for, under the same standing approval, not put away. */
-export declare function authorizationProblem(store: Store, auth: CheckAuthorization, input: {
-    head: string;
-    digest: string;
-}, now: Date): string | null;
-/** At the run: the used authorization this request claimed. */
-export declare function recheckStanding(store: Store, input: {
-    request: number;
-    runId: number;
-    head: string;
-    digest: string;
-}): {
-    ok: true;
-    access: CheckAccess;
-} | {
-    ok: false;
-    problem: string;
-};

package/dist/check-only.d.ts

@@ -1,15 +0,0 @@
-import type { Store } from "./store.js";
-/** How long a recheck may still start after its build finished. */
-export declare const CHECK_ONLY_WINDOW_MS: number;
-export declare const RECHECK_ACTOR = "Toolroll";
-/**
- * Written only from the existing approval of this exact commit: the seal this run was admitted under, still standing,
- * on the bytes this run built. Null when anything is missing, and the person's Run checks stays the only road.
- */
-export declare function authorizeCheckOnly(store: Store, runId: number, now: Date): number | null;
-/** Claim one authorization and ask for its check, in one transaction. Null: nothing was asked. */
-export declare function claimRecheck(store: Store, authorization: number, now: Date): {
-    request: number;
-} | null;
-/** Each sweep: a standing authorization whose result has no readable verdict asks for its one check. */
-export declare function requestMissingRechecks(store: Store, root: string, now: Date): number;

package/dist/check-progress.d.ts

@@ -1,78 +0,0 @@
-/** Live facts extracted from the approved check's ordinary output. */
-export declare const CHECK_SUITES: readonly ["unit", "flows", "app"];
-export type CheckSuiteName = (typeof CHECK_SUITES)[number];
-export type CheckSuiteState = "pending" | "running" | "passed" | "failed" | "unknown";
-export type CheckSuiteProgress = {
-    state: CheckSuiteState;
-    passed: number;
-    failed: number;
-    skipped: number;
-    total: number | null;
-    /** Only when the journeys run in parallel groups: how many groups have passed or failed, of how many. */
-    groups?: CheckGroupsProgress;
-};
-export type CheckGroupsProgress = {
-    passed: number;
-    failed: number;
-    total: number;
-};
-export type CheckProgressSnapshot = {
-    version: 1;
-    final: boolean;
-    line: string;
-    suites: Record<CheckSuiteName, CheckSuiteProgress>;
-};
-export declare function checkProgressLine(suites: Record<CheckSuiteName, CheckSuiteProgress>): string;
-/** A machine-only count line that is safe to send through a push provider. */
-export declare function isCheckProgressLine(value: string): boolean;
-export declare function parseCheckProgressSnapshot(raw: string): CheckProgressSnapshot | null;
-/**
- * Incrementally reads stdout and stderr. Each stream keeps its own partial
- * line so simultaneous journey output cannot splice two records together.
- */
-export declare class CheckProgressTracker {
-    private readonly update;
-    private readonly suites;
-    private readonly buffers;
-    private readonly events;
-    private last;
-    private recognized;
-    /** Each part's parallel journey run (scripts/e2e-parallel.mjs), by its release-check tag ("" for untagged output):
-     * the scripted flows and app parts run at once, so one shared run would mix their groups. */
-    private readonly parallels;
-    constructor(update: (snapshot: CheckProgressSnapshot) => void);
-    feed(chunk: string, stream?: "stdout" | "stderr"): void;
-    finish(): CheckProgressSnapshot | null;
-    snapshot(final?: boolean): CheckProgressSnapshot;
-    private emit;
-    private read;
-    /** One group's journey line: count its events, and take its own totals line as that group's result. */
-    private readGroup;
-    /** The suite is the sum of its groups; its total is known once every group has reported one. */
-    private summarize;
-}
-/** How often a running check's display snapshot may be written: the page and the phone read it, nobody needs more. */
-export declare const CHECK_PROGRESS_WRITE_MS = 1000;
-export type ProgressWriter = {
-    /** A display snapshot: written now if the last write is old enough, else kept (the newest wins) for one later write.
-     * Never throws: a display write that fails is kept (a final one until it is saved) for the next write or flush. */
-    push: (snapshot: CheckProgressSnapshot) => void;
-    /** Write a kept snapshot now (the final one again, when its write failed); nothing waits after. Never throws: true
-     * when nothing is left unsaved. */
-    flush: () => boolean;
-};
-/**
- * Coalesced display writes for a running check (isolated-checks.md, stage 1): a test runner can print thousands of
- * lines a second, and every changed snapshot was its own write transaction. Display snapshots are now written at most
- * once per interval, the latest one winning; the final snapshot is written at once, exactly, and nothing older is ever
- * written after it. A final snapshot whose write fails is kept until a write of it succeeds (the next flush, or a later
- * final push replacing it): Codex review round 1, finding 6. A failing display store never throws out of the writer,
- * so it can't keep the check's outcome from being sealed. The check's evidence (its log, exit and report) never passes
- * through here.
- */
-export declare function coalescedProgressWriter(save: (snapshot: CheckProgressSnapshot) => void, options?: {
-    intervalMs?: number;
-    now?: () => number;
-    setTimer?: (run: () => void, ms: number) => unknown;
-    clearTimer?: (timer: unknown) => void;
-}): ProgressWriter;

package/dist/check-repair.d.ts

@@ -1,47 +0,0 @@
-import type { Store } from "./store.js";
-export type CheckRepairState = "waiting" | "repairing" | "rerunning" | "with-person" | "parked" | "fixed" | "closed";
-export type CheckRepair = {
-    id: number;
-    familyRoot: string;
-    ownerTask: string;
-    repo: string;
-    revision: string;
-    sourceRun: number;
-    state: CheckRepairState;
-    why: string;
-    repairTask: string | null;
-    attempt: number | null;
-    createdAt: string;
-    updatedAt: string;
-};
-export declare function checkRepairsOfTask(store: Store, taskId: string): CheckRepair[];
-export declare function checkRepairOfRun(store: Store, runId: number): CheckRepair | null;
-/** What makes this failure this failure: the command, how it ended, and which files failed. Never the log's own bytes,
- * which differ on every run. */
-export declare function failureKeyOf(receipt: string, log: string): string;
-/**
- * Route one failed check. Runs at disposition. A failure already on record for this family and revision changes nothing,
- * unless it was the one rerun of an unrelated failure, which now goes to a person through the ledger's own rerun stop.
- */
-export declare function routeFailedCheck(store: Store, repo: string, root: string, runId: number, now: Date): CheckRepair | null;
-export type StartRepair = {
-    ok: true;
-    draft: string;
-    attempt: number;
-    approved: boolean;
-} | {
-    ok: false;
-    reason: "unknown" | "refused";
-    message: string;
-};
-/** A person asks for the repair. The draft takes the normal plan approval: this is not that approval. */
-export declare function startCheckRepair(store: Store, root: string, runId: number, now: Date): StartRepair;
-/** A passing result in the family ends its failed-check rows. Rows the person already holds end too: the code passes now. */
-export declare function settleCheckRepairs(store: Store, taskId: string, verdict: string, now: Date): void;
-/** Each sweep: a parked failure whose task is free again takes its next step, unless a newer attempt replaced it. */
-export declare function resumeParkedRepairs(store: Store, root: string, now: Date): number;
-/** A build was accepted as finished: count what it answered, then route its check if it failed. Bookkeeping that never
- * costs the build its result: a problem here leaves the finding open and the failed check on the result. */
-export declare function followBuiltRun(store: Store, repo: string, root: string, runId: number, worktree: string, now: Date): void;
-/** How a failed check stands, for a person, in one line. */
-export declare function checkRepairWords(row: CheckRepair): string;

package/dist/check-report.d.ts

@@ -1,177 +0,0 @@
-import { type VerifiedEntry } from "./commit-extract.js";
-import { type CheckContext, type CheckPart, type CheckInventory, type CheckReport, type ObligationSnapshot, type SealedInventory, type TargetedPlan } from "./contracts/release-check.js";
-import { type Store, type VerifyCommand } from "./store.js";
-/** The sealed artifacts' capture labels: what a reader looks for, by exact name. */
-export declare const CHECK_REPORT_CAPTURE = "release check report v1";
-export declare const CHECK_INVENTORY_CAPTURE = "release check inventory v1";
-export declare const TARGETED_PLAN_CAPTURE = "release check targeted plan v1";
-export declare const OBLIGATION_SNAPSHOT_CAPTURE = "release check obligation snapshot v1";
-export declare const CHECK_CONTEXT_CAPTURE = "release check context v1";
-/** How large a sealed check artifact may be (the report's own bound). */
-export declare const CHECK_ARTIFACT_CAP: number;
-/** The release check's harness, named: the orchestrator, its runners and helpers, Vitest's configuration and setup, and
- * the reporter. These never carry (release-carry.ts). The execution context digests far more (inHarnessDigest). */
-export declare const HARNESS_FILES: readonly string[];
-/** Vitest's include globs (vitest.config.ts), as the plane reads them: a change to that file is a harness change. */
-export declare const UNIT_INCLUDE: readonly RegExp[];
-export declare const isUnitFile: (path: string) => boolean;
-/** The project's own Git directory as Toolroll records it: `<realpath(repo)>/.git`, a real directory. */
-export declare function projectGitDir(repo: string): string | null;
-/** A digest of a payload, over its canonical JSON. */
-export declare const payloadDigest: (value: unknown) => string;
-/**
- * Whether a tree path is part of the harness for the execution context: every file EXCEPT the unit test files
- * themselves, the two journey scripts, docs and Markdown. No import tracing: a harness dependency reached by any road
- * (a `require`, a computed `import()`, a side-effect import, a `src/` helper, a config file) is inside this set, so a
- * change to it always changes the digest (fail closed).
- */
-export declare function inHarnessDigest(path: string): boolean;
-/** What the plane reads from a commit for a check: its tree's entries, its unit files and its harness. */
-export type TreeFacts = {
-    tree: string;
-    entries: VerifiedEntry[];
-    units: string[];
-    harness: string[];
-    harnessDigest: string;
-    lockfile: string | null;
-};
-/** The tree facts of `sha`, from objects hashed here (never the checkout). Null with why when they can't be read. */
-export declare function treeFactsOf(gitDir: string, sha: string): {
-    ok: true;
-    facts: TreeFacts;
-} | {
-    ok: false;
-    problem: string;
-};
-/** The execution context a check runs in: what must match for results to stand beside each other. The machine's load
- * budget is left out: it changes how fast a check runs, never what passes (scripts/release-check.mjs checkBudget). */
-export declare function checkContextOf(facts: TreeFacts, command: VerifyCommand, access: string): CheckContext;
-/** Every part a check can have. */
-export declare const FULL_PARTS: readonly CheckPart[];
-/** Changes no test reads: the plane's copy of scripts/release-check.mjs NOTHING (check-report.test.ts holds them equal). */
-export declare const NOTHING_PATHS: readonly RegExp[];
-/** Model-facing code, whose change runs the real-model journeys: the plane's copy of scripts/release-check.mjs MODEL. */
-export declare const MODEL_PATHS: readonly RegExp[];
-/** Whether a changed path can affect an upgrade: the plane's copy of scripts/release-check.mjs needsUpgrade. Its
- * version-only exception is decided apart, from verified blobs (versionOnlyChange), never from the path alone. */
-export declare function upgradeRelevant(file: string): boolean;
-/** The paths that differ between two verified trees: added, removed, or with another mode or blob. */
-export declare function changedPaths(facts: TreeFacts, base: TreeFacts): string[];
-/**
- * The parts a Full check owes, decided by the plane before it runs (eval-harness review 1, finding 2), never by the
- * check's own report: the typecheck and the build always; the unit suite when anything a test reads changed since
- * `base` (the plane's own record of the last release, both trees verified here) and the tree has unit files; the
- * scripted journeys likewise when the tree has the journey scripts; the real-model journeys when model-facing code
- * changed; the upgrade path when a change can affect an upgrade and the tree has it. With no base every one the tree
- * can run is owed. The check is told these on its handshake and runs at least them.
- */
-export declare function fullObligationsOf(facts: TreeFacts, base: TreeFacts | null, 
-/** package.json / package-lock.json paths whose change since `base` is only the project's own version, proved by the
- * plane from both verified blobs (versionBumpsOf): such a change alone doesn't owe the upgrade path. */
-versionBumps?: readonly string[]): CheckPart[];
-/** What a check must account for, sealed before it runs: every unit file of the tree, whatever runs (a targeted
- * check accounts for the rest through its base), and the parts it owes (a full check's from fullObligationsOf), and
- * whether CI may stand in for its unit suite. */
-export declare function inventoryOf(facts: TreeFacts, plan: TargetedPlan | null, full?: {
-    owed: readonly CheckPart[];
-    release: boolean;
-}): CheckInventory;
-/** A check about to run: its handshake (written on stdin, then closed) and the facts sealed with it. */
-export type PreparedAttempt = {
-    runId: number;
-    nonce: string;
-    stdin: string;
-    mode: "full" | "targeted";
-    inventory: CheckInventory;
-    context: CheckContext;
-    plan: TargetedPlan | null;
-    snapshot: ObligationSnapshot | null;
-    /** The identities the check was asked to report one by one (required ones). */
-    watch: string[];
-    /** The exact cases the check was asked about for learning only (docs/plans/learning-loops.md): never gate evidence. */
-    learn: string[];
-};
-/** A Full check's preparation refused (eval-harness review 2, finding 4): the plane recorded a release whose commit it
- * can't verify now, so the check's obligations can't be decided. The check isn't run (builder.ts: `baseline-unverifiable`). */
-export declare class CheckBaselineUnverifiable extends Error {
-}
-/**
- * Seal a check's attempt row before its command is spawned: intended mode, nonce hash, inventory and context (and for a
- * targeted check its plan and obligation snapshot, sealed as artifacts first). Null when the plane can't read the
- * commit, which leaves the check running exactly as it always has, with no handshake. Throws CheckBaselineUnverifiable,
- * having sealed nothing, when a recorded last release can't be verified.
- */
-export declare function prepareCheckAttempt(store: Store, root: string, input: {
-    runId: number;
-    repo: string;
-    head: string;
-    command: VerifyCommand;
-    access: string;
-    authority?: number | null;
-    plan?: TargetedPlan | null;
-    snapshot?: ObligationSnapshot | null;
-    watch?: readonly string[];
-    /** A release's check (signed release terms or a release authority): CI never stands in for its unit suite. Sealed in
-     * the inventory (whose digest the attempt row holds); only an explicit false lets CI stand in. */
-    release?: boolean;
-    /** Exact cases asked about for learning only (docs/plans/learning-loops.md): a separate handshake field, at most 200,
-     * that never joins `watch`, the inventory or anything the check owes. */
-    learn?: readonly string[];
-    /** The limit the check runs under when the plane gave it more than the approved one (check-load.ts checkLimitFor). */
-    limitMs?: number | undefined;
-}, now: Date): PreparedAttempt | null;
-/** Seal one JSON payload as a structured-output artifact under its capture label. */
-export declare function sealJson(store: Store, root: string, runId: number, name: string, value: unknown, capture: string, now: Date): number;
-/**
- * The check's report from its output: the LAST `TOOLROLL_CHECK_REPORT <json>` line carrying this nonce, at most 256 KiB,
- * that matches the contract. Lines without the nonce (a test's print, a leftover process's write) are passed over.
- */
-export declare function reportFromOutput(stdout: string, nonce: string): {
-    ok: true;
-    report: CheckReport;
-    raw: string;
-} | {
-    ok: false;
-    problem: string;
-};
-/**
- * After the check: seal its report (when it gave a valid one) and the inventory artifact. `exitCode` is the check's own
- * exit; a report that disagrees with it is no report. Returns the report, or null.
- */
-export declare function sealCheckOutcome(store: Store, root: string, attempt: PreparedAttempt, output: {
-    stdout: string;
-    exitCode: number | null;
-}, now: Date): CheckReport | null;
-/** One sealed check artifact of a run, read back and verified, or null (missing, ambiguous, cut short or changed). */
-export declare function readSealedJson(store: Store, root: string, runId: number, capture: string): {
-    value: unknown;
-    digest: string;
-} | null;
-/**
- * Why a Full release check has no result it can count — or null when it qualifies as one. The plane's own facts are the
- * exit it saw (`exitCode`, null when the check didn't exit on its own: timed out or stopped) and the inventory it sealed
- * before the check ran; the report must agree with both. A failed check (a nonzero exit) needs only a valid report: what
- * it failed on is its result. A passing exit needs every obligation the plane sealed (the inventory's parts, never the
- * report's own "selected") to have an outcome, and every part the report ran too: every part once, each run to its
- * end; the unit suite finished with a result for every sealed unit file (CI stands in only when the sealed plan allowed
- * it); every journey run finished, its groups listed before they ran, each passed group with a journey result; and the
- * upgrade path finished, its versions listed, every one run. An explicitly empty inventory (no groups of that kind) is
- * an outcome; a missing one is not. Missing, malformed, truncated or skipped-required results never read as a pass.
- */
-export declare function fullCheckProblem(input: {
-    report: CheckReport | null;
-    inventory: SealedInventory | null;
-    exitCode: number | null;
-}): string | null;
-/** Where a release bumps the project's own version: the plane's copy of scripts/release-check.mjs VERSIONED. */
-export declare const VERSIONED_PATHS: readonly string[];
-/**
- * Whether `path` changed from `before` to `after` only in the project's own version (pipeline-speed.md, item 4): the
- * plane's copy of scripts/release-check.mjs versionOnly — the top-level "version", and in the lockfile the root
- * package's. Anything else (a dependency, a script, a reordering, a duplicate key, a file added or removed, bytes that
- * aren't one JSON object) is a real change.
- */
-export declare function versionOnlyChange(path: string, before: Buffer | null, after: Buffer | null): boolean;
-/** The versioned files whose change from `base` to `facts` is only the version, read from verified blobs in the
- * project's own Git directory. Anything unreadable is a real change (owes more, never less). */
-export declare function versionBumpsOf(gitDir: string, base: TreeFacts, facts: TreeFacts): string[];

package/dist/check-stamp.d.ts

@@ -1,46 +0,0 @@
-import { type CheckAccess } from "./check-access.js";
-export declare const CHECK_STAMP_VERSION = 1;
-/** Every path: the launch had no write or read fence of that kind. */
-export declare const EVERYWHERE = "*";
-/** What the launch's network was: the machine's own, or the fence's, with exactly the hosts it allowed. */
-export type StampNetwork = {
-    mode: "machine";
-} | {
-    mode: "open" | "allowlist";
-    hosts: string[];
-};
-export type CheckStamp = {
-    version: typeof CHECK_STAMP_VERSION;
-    /** The level the commands ran at, whatever was sealed. */
-    level: CheckAccess;
-    /** The digest of the whole fence as given to the launch (invoke.ts fenceDigest); null with no fence. */
-    policyDigest: string | null;
-    /** Where it could write: exact grants, or [EVERYWHERE]. */
-    writable: string[];
-    /** What it was given to read beyond the fence's denies, or [EVERYWHERE]. */
-    readable: string[];
-    network: StampNetwork;
-};
-export type StampReading = {
-    state: "current";
-    stamp: CheckStamp;
-} | {
-    state: "unknown";
-    why: "missing" | "old" | "unreadable";
-};
-/** A launch with no fence at all. */
-export declare const unfencedStamp: () => CheckStamp;
-export declare const stampDigest: (stamp: CheckStamp) => string;
-/** One saved stamp, exactly its shape or unknown. */
-export declare function readStamp(text: unknown): StampReading;
-/**
- * A run's whole account of its checks: every launch it stamped. Any it can't read makes the whole unknown (one launch of
- * unknown reach is reach unknown); otherwise the widest stands, so a narrow command never hides a wider one. None: unknown.
- */
-export declare function readStamps(texts: readonly unknown[]): StampReading;
-/** Why relying on `reading` for a check that had to stay within `sealed` isn't possible, or null when it can be. */
-export declare function stampRefusal(reading: StampReading, sealed: CheckAccess): string | null;
-/** How a check ran, as a person reads it after the fact; null for a current sandboxed one, which needs no line. */
-export declare function ranWords(reading: StampReading): string | null;
-/** v154: one row per distinct launch of a run's commands (a run's repeats of one launch are one row). */
-export declare const V154_SCHEMA = "\nCREATE TABLE IF NOT EXISTS check_stamp (\n  id      INTEGER PRIMARY KEY,\n  run_id  INTEGER NOT NULL,\n  digest  TEXT NOT NULL,\n  stamp   TEXT NOT NULL,\n  at      TEXT NOT NULL,\n  UNIQUE (run_id, digest)\n);\n";