toolroll 0.9.104 → 0.9.105

package/dist/release-card.d.ts

@@ -1,170 +0,0 @@
-import { type ReleaseCheckPurpose, type ReleaseTerms } from "./contracts/release-terms.js";
-import type { Scope } from "./scope.js";
-import { type Store } from "./store.js";
-/** One signed term as the card says it. `key` names the scope field or the release term's path. */
-export type TermLine = {
-    key: string;
-    label: string;
-    value: string;
-};
-/** The scope's own terms the card names, in order. A contract test holds `goal`, `outOfScope`, `touches` and
- * `acceptance` (contracts/scope.ts) and the scope's other signed fields to this list; the agent profile and the phase
- * route follow as one line per signed setting (`profile.…`, `route.…`). */
-export declare const SCOPE_TERM_LABELS: {
-    readonly title: "Title";
-    readonly project: "Project";
-    readonly filedBy: "Filed by";
-    readonly goal: "Goal";
-    readonly outOfScope: "Not in scope";
-    readonly touches: "Paths it may touch";
-    readonly acceptance: "Done when";
-    readonly qualityMode: "Evidence standard";
-    readonly agents: "Agents and model";
-    readonly permission: "Agents may";
-    readonly checks: "Checks";
-    readonly checkAccess: "Check access";
-    readonly budgetMicrousd: "Budget per attempt";
-    readonly candidate: "Candidate commit";
-};
-/** Every field of the release terms, by its path in the terms (contracts/release-terms.ts), against the schema's
- * own leaves: the contract test checks every one has a label. */
-export declare const RELEASE_TERM_LABELS: Readonly<Record<string, string>>;
-/** Every field of a release check's purpose (contracts/release-terms.ts releaseCheckPurposeSchema): the sealed form
- * Toolroll's own releases take while their checks run outside the sandbox. A contract test checks every leaf has one. */
-export declare const RELEASE_CHECK_LABELS: Readonly<Record<string, string>>;
-/** What a release scope sealed, either form: release terms (later test-only commits may carry) or a release check's
- * purpose (every later commit asks again). The identity both share is read from here, never from a title or an id. */
-export type ReleaseSeal = {
-    kind: "terms";
-    terms: ReleaseTerms;
-    identity: ReleaseTerms;
-} | {
-    kind: "check";
-    purpose: ReleaseCheckPurpose;
-    identity: ReleaseCheckPurpose;
-};
-export declare function releaseSealOf(scope: Pick<Scope, "releaseTerms" | "releaseCheck"> | null): ReleaseSeal | null;
-/** What an unsandboxed (or sign-ins) release check means, said before anyone approves it. Null in the sandbox. */
-export declare function releaseAccessWords(access: ReleaseTerms["access"]): string | null;
-/** The leaf paths of a zod object schema (nested objects joined with dots). */
-export declare function schemaLeaves(schema: unknown, prefix?: string): string[];
-/** Every signed term of `scope`, its release terms included, one line each. Reads only. */
-export declare function approvalTermsOf(store: Store, scope: Scope, words: {
-    profile: (profile: Scope["profile"]) => string | null;
-}): TermLine[];
-export declare const termsText: (lines: readonly TermLine[]) => string;
-export type ChangeList = {
-    /** The merge commit of the last verified release, or null when none is recorded. */
-    baseline: string | null;
-    /** Newest first; null when it couldn't be read. */
-    commits: {
-        sha: string;
-        subject: string;
-    }[] | null;
-    source: "recorded" | "pull-request" | "unread";
-    digest: string;
-    /** A release is on the record but its merge commit can't be read (eval-harness review 2, finding 4). */
-    baselineUnreadable?: true;
-    /** Why the list couldn't be read whole (Codex round 2, finding 6): the pull request moved, or it is longer than
-     * GitHub lists. Part of the digest; never a shortened list. */
-    why?: string;
-};
-/**
- * The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
- * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag.
- * Whether the plane recorded one, and its merge commit (eval-harness review 2, finding 4):
- * `recorded: false` only when no merged release is on the record at all; a recorded one whose commit isn't a full id is
- * `recorded: true` with `sha: null` — something to refuse on, never "no previous release".
- */
-export declare function releaseBaselineRecord(store: Store, repo: string): {
-    recorded: false;
-} | {
-    recorded: true;
-    sha: string | null;
-};
-/** How long the change list's settings check may take before the list is unread. */
-export declare const CONFIG_LIST_MS = 60000;
-/** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
- * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
- * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
- * history). When they can't be read, why, in Toolroll's own fixed words (never the repository's text), so a card says
- * why it shows no list rather than a shortened one. */
-export declare function readCommitsBetween(repo: string, from: string, to: string): {
-    ok: true;
-    commits: {
-        sha: string;
-        subject: string;
-    }[];
-} | {
-    ok: false;
-    why: string;
-};
-/** readCommitsBetween's list, or null when it can't be read. */
-export declare function commitsBetween(repo: string, from: string, to: string): {
-    sha: string;
-    subject: string;
-}[] | null;
-/** GitHub lists at most this many of a pull request's commits; a longer one is never shown as complete. */
-export declare const PULL_REQUEST_COMMITS_MAX = 250;
-/** A commit subject is someone else's text: one line, control-free (src/terminal-text.ts), bounded. The card digest
- * binds this cleaned text, so every surface shows exactly what was bound (Codex round 2, finding 7). */
-export declare const subjectText: (subject: string) => string;
-/** How the plane reads GitHub for a pull request's commits (a seam for tests). */
-export type PullRequestReader = (args: readonly string[]) => {
-    status: number | null;
-    stdout: string;
-};
-/**
- * A pull request's own commits from GitHub, for the recorded owner/name, complete and bound to the candidate (Codex
- * round 2, finding 6): every page (`--paginate`), accepted only when the pull request's head is `head`, the newest
- * listed commit is `head` and the count is the pull request's own count. Otherwise why, never a shortened list.
- */
-export declare function pullRequestCommits(slug: string, pr: number, head: string, read?: PullRequestReader): {
-    ok: true;
-    commits: {
-        sha: string;
-        subject: string;
-    }[];
-} | {
-    ok: false;
-    why: string;
-};
-/** The ledger act that records a verified release (the merged tree proved equal to the approved one). */
-export declare const RELEASE_VERIFIED_ACTION = "release verified";
-/**
- * Record a verified release (Codex round 2, finding 1: verified release history apart from carrying). The coordinator
- * calls it once main's merge commit was proved to hold the approved tree; the plane proves it again here, from its own
- * records only: the task is a release scope of a project, and `merge` read as a verified Git object from the project's
- * recorded Git directory has exactly the sealed approved tree. False when anything doesn't hold (nothing written).
- */
-export declare function recordVerifiedRelease(store: Store, input: {
-    taskId: string;
-    merge: string;
-    now: Date;
-}): boolean;
-/**
- * The last verified release of `repo`, from either record: a merged release authority's succeeded merge, or a verified
- * release row (recordVerifiedRelease). The newer stands. Shaped as releaseBaselineRecord.
- */
-export declare function verifiedReleaseBaseline(store: Store, repo: string): {
-    recorded: false;
-} | {
-    recorded: true;
-    sha: string | null;
-};
-/** What changed since the last verified release, for a release's sealed identity (terms or a release check's purpose),
- * from Toolroll's records only. */
-export declare function releaseChangeList(store: Store, terms: Pick<ReleaseTerms, "repo" | "approvedSha" | "pr">, read?: PullRequestReader): ChangeList;
-export type ReleaseCard = {
-    /** Binds the scope digest, the plan form's digest, the baseline and the change list. */
-    digest: string;
-    short: string;
-    full: string;
-    fileName: string;
-    changes: ChangeList;
-};
-/** The card digest: everything the person is shown that can change under them. */
-export declare function cardDigestOf(scopeDigest: string, formDigest: string, changes: Pick<ChangeList, "baseline" | "digest">): string;
-export declare function releaseCardOf(store: Store, scope: Scope, formDigest: string, words: {
-    profile: (profile: Scope["profile"]) => string | null;
-}, read?: PullRequestReader): ReleaseCard;

package/dist/release-carry.d.ts

@@ -1,261 +0,0 @@
-import { type TreeChange, type VerifiedCommit } from "./commit-extract.js";
-import { type ReleaseCheckPurpose, type ReleasePolicy, type ReleaseTerms } from "./contracts/release-terms.js";
-import { type ExecResult } from "./exec.js";
-import { type ReleaseAuthority, type ReleaseCarry, type Store } from "./store.js";
-/** The journey scripts: tests, by Alex's decision (they carry). */
-export declare const JOURNEY_SCRIPTS: readonly string[];
-/** What carries (version 1). Everything else asks again — including every other `test/**` or `scripts/**` file (the
- * harness, what it imports, helpers and fixtures), so no harness file can slip in under a class. */
-export declare const CARRY_RULES: Readonly<{
-    version: 1;
-    classes: readonly {
-        name: string;
-        matches: (path: string) => boolean;
-    }[];
-    /** Never carry, even when a class above matches them. */
-    never: readonly {
-        why: string;
-        matches: (path: string) => boolean;
-    }[];
-}>;
-/** The limits (Alex, 2026-10-25): 400 changed lines and 20 files after the approval, 800 lines of churn. */
-export declare const CARRY_LIMITS: Readonly<{
-    lines: 400;
-    files: 20;
-    churn: 800;
-}>;
-/** "Ask for every release commit": a project setting, newest choice wins (a ledger row each); off by default. */
-export declare const ASK_EVERY_COMMIT_ACTION = "release carrying changed";
-export declare function asksEveryReleaseCommit(store: Store, repo: string): boolean;
-/** Set "Carry release approvals when checks aren't sandboxed". `by` is who set it; turning it on is only ever called
- * after a person's own proof (release-cli.ts). */
-export declare function setUnsandboxedCarry(store: Store, repo: string, on: boolean, by: string, now: Date): void;
-export declare function setAskEveryReleaseCommit(store: Store, repo: string, ask: boolean, by: string, now: Date): void;
-/** The effective policy now: the runtime rules, the project's protected paths and the limits. */
-export declare function effectivePolicy(store: Store, repo: string, options?: {
-    noCarry?: boolean;
-}): ReleasePolicy;
-/** The stricter of two policies: what either protects asks again, the lower limit wins, either one's "ask" asks. Null
- * when either is a policy this runtime doesn't know (then nothing carries). */
-export declare function stricterOf(a: ReleasePolicy | null, b: ReleasePolicy | null): ReleasePolicy | null;
-/**
- * A path as the rules compare it: lower case (a case-insensitive file system reads docs/Plans as docs/plans), each part
- * without the trailing dots and spaces Windows drops, and no empty or `.` parts (a verified tree never holds them, but
- * the rules don't rely on that).
- */
-export declare function rulePath(path: string): string;
-/**
- * Why one changed path doesn't carry, in words, or null when it does. Every rule reads the normalized path. `fresh`: the
- * paths that didn't exist at the approved commit. A test that was there stays exactly as it was (H4): new tests go in new
- * files. Only "unchanged" holds up, since `vi.mock` hoists and a top-level hook reaches every case above it, so an
- * appended line can disarm what it follows.
- */
-export declare function changeRefusal(change: TreeChange, policy: ReleasePolicy, fresh?: ReadonlySet<string>): string | null;
-/**
- * A release scope's terms, from the plane's own records: the project's repository, the approved commit and its
- * verified tree, the effective policy, the live release check grant and the check access (only the fence), and the
- * expiry. Null with why when the release can't carry at all (it then asks for every commit, as before).
- */
-export declare function releaseTermsFor(store: Store, input: {
-    repo: string;
-    version: string;
-    branch: string;
-    pr: number;
-    candidate: string;
-    now: Date;
-    noCarry?: boolean;
-}): {
-    ok: true;
-    terms: ReleaseTerms;
-} | {
-    ok: false;
-    why: string;
-};
-/**
- * A release check's purpose (docs/plans/pipeline-speed.md, P0), for a release whose terms can't be made (its checks run
- * outside the sandbox, or carrying is off): from the plane's own records — the project's repository, the approved commit
- * and its verified tree, the live release check grant and the check access. It never carries a later commit; it marks
- * this exact candidate as a release's check (strict report rules, no CI stand-in, the plane's own rerun after confirmed
- * infrastructure on the same candidate under the same approval). Null with why when even that can't be read.
- */
-export declare function releaseCheckPurposeFor(store: Store, input: {
-    repo: string;
-    version: string;
-    branch: string;
-    pr: number;
-    candidate: string;
-}): {
-    ok: true;
-    purpose: ReleaseCheckPurpose;
-} | {
-    ok: false;
-    why: string;
-};
-/** One carried commit, as the summary and the merge message list it. */
-export type LandedCommit = {
-    sha: string;
-    files: {
-        path: string;
-        added: number;
-        deleted: number;
-    }[];
-};
-export type CarryRefusal = {
-    ok: false;
-    reason: "authority" | "ancestry" | "shape" | "rules" | "limits" | "build" | "artifact" | "stale";
-    message: string;
-    path?: string;
-};
-export type PreflightPlan = {
-    authority: ReleaseAuthority;
-    to: string;
-    toTree: string;
-    commits: LandedCommit[];
-    changedLines: number;
-    files: number;
-    churn: number;
-    policy: ReleasePolicy;
-    currentPolicyDigest: string;
-};
-/**
- * Step 2, read-only: nothing from the candidate is installed, built or run here. Objects come from the project's own
- * Git directory as Toolroll records it, hashed here; the authority is read live.
- */
-export declare function preflightCarry(store: Store, input: {
-    authority: number;
-    to: string;
-    epoch?: number | null;
-    now: Date;
-}): {
-    ok: true;
-    plan: PreflightPlan;
-} | CarryRefusal;
-/** How a build step runs: the fenced default, or a test's stand-in. */
-export type BuildRunner = (file: string, args: readonly string[], options: {
-    cwd: string;
-    env: Record<string, string>;
-    writable: readonly string[];
-    timeoutMs: number;
-}) => Promise<ExecResult>;
-/** The default build runner: the OS fence, writes only where named, and no network — its only way out is a proxy of its
- * own that allows no host. No fence on this machine, no build. */
-export declare function fencedBuildRunner(store: Store): BuildRunner;
-/** What the writer scan reads from the OS: injectable so each refusal shape can be shown (tests), real by default. */
-export type WriterScanIO = {
-    platform: NodeJS.Platform;
-    /** This process: its pid, and the user the build runs as (its effective uid). */
-    pid: number;
-    uid: number;
-    /** Linux: the numeric entries of /proc. Throws when /proc can't be listed. */
-    procPids(): string[];
-    /** Linux: readlink /proc/<pid>/cwd. Throws with the errno code. */
-    procCwd(pid: string): string;
-    /** Linux: a process's real and effective uid (/proc/<pid>/status, readable even when its folder isn't) and its start
-     * time in clock ticks since boot (/proc/<pid>/stat). Throws with the errno code. Never the owner of its /proc files:
-     * a process can make those root's (PR_SET_DUMPABLE 0). */
-    procIdentity(pid: string): {
-        uids: number[];
-        startTicks: number;
-    };
-    /** Linux: now, in clock ticks since boot (from /proc/uptime), and the ticks in a second; null when unreadable. */
-    nowTicks(): {
-        ticks: number;
-        hz: number;
-    } | null;
-    /** macOS: each process's pid, effective uid and whether it is a zombie (ps), or null when ps failed. */
-    processes(): {
-        pid: number;
-        uid: number;
-        zombie: boolean;
-    }[] | null;
-    /** macOS: lsof's cwd listing, its stdout and how it ended. */
-    lsof(): {
-        stdout: string;
-        status: number | null;
-        signal: string | null;
-        code: string | null;
-    };
-    /** macOS: a second look at these pids (ps): each one still there, with its uid, whether it is a zombie and when it
-     * started (ms, whole seconds); a pid missing from the map is gone. Null when ps failed. */
-    describe(pids: readonly number[]): Map<number, {
-        uid: number;
-        zombie: boolean;
-        startedMs: number | null;
-    }> | null;
-    /** Whether a pid is gone (ESRCH). */
-    gone(pid: number): boolean;
-};
-/** When the build began: wall-clock ms, and on Linux the clock ticks since boot. */
-export type BuildStart = {
-    ms: number;
-    ticks: {
-        ticks: number;
-        hz: number;
-    } | null;
-};
-/**
- * Pids whose working folder is inside `root` (lsof on macOS, /proc on Linux), or null when that can't be shown (the
- * caller refuses: nothing is digested unless it is shown that no writer remains). A process is passed over only when
- * it is gone, or provably runs as another user than the build; one of the build's own user that can't be read refuses.
- *
- * On Linux a fenced build can't leave one at all: the sandbox runtime starts every launch in a PID namespace of its own
- * (bwrap --unshare-pid, --die-with-parent), and when the build's process ends the kernel kills everything left in that
- * namespace, a detached or new-session child included, before the launch returns. The scan is the check for whatever
- * runs outside such a namespace (an unfenced runner) and the proof on macOS, where Seatbelt has no PID namespace.
- */
-export declare function processesInside(root: string, since: BuildStart | null, io?: WriterScanIO): number[] | null;
-/** Files left out of the artifact digest and listed as doc changes instead. */
-export declare const ARTIFACT_EXCLUDED: readonly string[];
-/**
- * The digest of one built tree's production artifacts, read as untrusted: every entry walked with lstat, opened with
- * O_NOFOLLOW and checked again on the descriptor; only regular files inside `root` count; a symlink, a special file or a
- * path that escapes refuses. Each entry records path, mode and sha256.
- */
-export declare function digestTree(root: string, paths: readonly string[]): {
-    ok: true;
-    digest: string;
-    entries: number;
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * Step 3 for one commit: extract it (verified objects, regular files only) into a fresh folder, install from its
- * lockfile with no scripts and no network (npm checks every package against the lockfile's integrity hash), build it,
- * list what `npm pack` would ship, wait until nothing runs from the folder any more, and digest dist/ plus the packed
- * files twice — a difference means something is still writing, and refuses.
- */
-export declare function artifactDigest(gitDir: string, sha: string, runner: BuildRunner, options?: {
-    timeoutMs?: number;
-    npmCache?: string;
-}): Promise<{
-    ok: true;
-    digest: string;
-} | {
-    ok: false;
-    message: string;
-}>;
-/** The release task's id for a commit (release.ts gateTaskId's naming). */
-export declare const carriedTaskId: (version: string, sha: string) => string;
-export type CarryResult = {
-    ok: true;
-    taskId: string;
-    carry: ReleaseCarry;
-    retried: boolean;
-} | CarryRefusal;
-/**
- * Carry a person's release approval to commit `to`, or say exactly why not. The lead may ask; only these rules decide.
- * A refusal seals nothing and writes no row.
- */
-export declare function proveCarry(store: Store, input: {
-    authority: number;
-    to: string;
-    requestId?: string;
-    epoch?: number | null;
-    now: Date;
-    runner?: BuildRunner;
-    runtime?: string;
-}): Promise<CarryResult>;
-/** The words a refused carry ends with: the commit, the path and the rule, and that a person approves it instead. */
-export declare function carryRefusalWords(refusal: CarryRefusal, to: string): string;
-export type { VerifiedCommit };

package/dist/release-ci-hold.d.ts

@@ -1,41 +0,0 @@
-/** A release's approval held for its pull request's CI (Codex review round 1, finding 4). A leaf module: the seal
- * primitive (store.ts), the person's ceremony (scope.ts), chat and release-auto.ts all read the same row. */
-import type { Store } from "./store.js";
-/**
- * A release filed while its pull request's CI was still running (pipeline-speed.md D2) waits for CI before anyone but
- * the automatic road may approve it (Codex review round 1, finding 4): `release-auto.ts holdApprovalForCi` records the
- * hold before the task is filed, and only the plane's own reading of exact-head CI passing lifts it
- * (`liftCiHold`). The newest row for the task wins; the hold names the candidate commit it waits on.
- * Since Alex's decision of 2026-10-29 (a person may approve during CI) the coordinator records a "CI still running"
- * note instead (below); a hold an older coordinator placed still holds until lifted.
- */
-export declare const RELEASE_CI_HELD_ACTION = "release approval waits for CI";
-export declare const RELEASE_CI_PASSED_ACTION = "release approval CI passed";
-/** The candidate whose CI a release task's approval waits for, or null when nothing holds it. Fail closed: a hold row
- * whose candidate can't be read still holds. */
-export declare function releaseCiHoldOf(store: Store, taskId: string): {
-    candidate: string | null;
-} | null;
-/** Why a person can't approve a release waiting for CI yet, in words. */
-export declare function releaseCiHoldWords(hold: {
-    candidate: string | null;
-}): string;
-/**
- * A person's release asks for approval while its pull request's CI still runs (Alex, 2026-10-29; pipeline-speed.md,
- * "Decision: a person's release asks during CI"). This row never holds approval: it lets the approval card say so, until
- * the plane reads exact-head CI passing (`liftCiHold` records RELEASE_CI_PASSED_ACTION, which ends it as it ends a
- * hold). Deployment gates and operation issuance also refuse while it remains, so a direct deploy cannot bypass
- * the coordinator's CI wait. Its absence is not a CI pass: the coordinator still reads exact-head checks itself.
- */
-export declare const RELEASE_CI_RUNNING_ACTION = "release asked while CI runs";
-export declare const RELEASE_CI_RUNNING_WORDS = "GitHub's checks are still running; nothing deploys until they pass.";
-/** The candidate whose CI was still running when the release task was filed, or null once the plane read it passing. */
-export declare function releaseCiRunningOf(store: Store, taskId: string): {
-    candidate: string | null;
-} | null;
-/** Record that the release task is filed while CI runs on `candidate` (before the task exists). Idempotent. */
-export declare function noteCiRunning(store: Store, input: {
-    taskId: string;
-    candidate: string;
-    now: Date;
-}): void;

package/dist/release-cli.d.ts

@@ -1,34 +0,0 @@
-/**
- * `toolroll release <branch>` (release.ts): the command line around the release coordinator.
- *
- * `release <lease>` used to return a runner's lease; that is `toolroll worker release <lease>` now. The old form still
- * works for a value shaped like a lease id (a UUID), with a one-line warning, until the next minor version. A
- * UUID-shaped value given with release options is refused rather than guessed at.
- */
-import { type ReleaseAdapters } from "./release.js";
-import { type GateReleaseWorld } from "./release-gate.js";
-import { type RescueWorld } from "./deploy-rescue.js";
-import { type RunLockSeams, type SettleWorld } from "./release-next.js";
-export declare const RELEASE_HELP: string;
-/** A runner lease id (claim.ts mints randomUUID()). */
-export declare const LEASE_SHAPED: RegExp;
-export declare const LEASE_DEPRECATION = "`toolroll release <lease>` is now `toolroll worker release <lease>`; the old form goes in the next minor version.";
-export type ReleaseCliDeps = {
-    adapters?: ReleaseAdapters;
-    stateDir?: string;
-    cwd?: string;
-    /** The deprecated lease form, handed to the worker command. */
-    releaseLease?: (args: readonly string[]) => Promise<number>;
-    warn?: (line: string) => void;
-    /** What --release-gate reads and changes (release-gate.ts); the installation's own by default. */
-    gateWorld?: GateReleaseWorld;
-    /** What --recover-deploy reads and runs (deploy-rescue.ts); the installation's own by default. */
-    rescueWorld?: RescueWorld;
-    /** What a stopped deployment left, settled before the release goes on (release-next.ts). Tests that inject adapters skip it. */
-    settle?: SettleWorld;
-    runLock?: RunLockSeams;
-    /** The plane's database for the authority commands (default: this installation's). */
-    database?: string;
-    now?: () => Date;
-};
-export declare function runReleaseCommand(args: readonly string[], write: (line: string) => void, deps?: ReleaseCliDeps): Promise<number>;

package/dist/release-coverage.d.ts

@@ -1,16 +0,0 @@
-import type { Store } from "./store.js";
-export type ReleaseCoverage = {
-    run: number;
-    head: string;
-};
-/** How many of the newest passing release checks one read considers. */
-export declare const RELEASE_SCAN_LIMIT = 20;
-export type IsAncestor = (repo: string, ancestor: string, descendant: string) => boolean | null;
-/** `git merge-base --is-ancestor`: true, false, or null when Git couldn't say. */
-export declare const gitIsAncestor: IsAncestor;
-export type ReleaseMemo = Map<string, ReleaseCoverage[]>;
-/** The release check covering `head` in `repo`, or null. `memo` keeps one read's receipts. */
-export declare function releaseCoverageOf(store: Store, root: string | undefined, repo: string | null, head: string | null, options?: {
-    memo?: ReleaseMemo;
-    isAncestor?: IsAncestor;
-}): ReleaseCoverage | null;

package/dist/release-gate.d.ts

@@ -1,84 +0,0 @@
-/**
- * `toolroll release --release-gate <id>`: lift one update pause that a browser deployment (scripts/deploy-browser.mjs)
- * left behind when it stopped before the swap and its own exit recovery never ran. The typical case is a deployment
- * killed outright (SIGKILL, a crash or power loss) while paused: nothing lifted the pause, and new work stays paused.
- *
- * The id alone proves nothing, and neither does the journal's phase. The pause is lifted only when every piece of
- * evidence agrees that the service was never swapped:
- *
- *   - the live database's update pause is owned by exactly this id
- *   - exactly one intact deployment journal names this id and this database, at a phase before the swap, with
- *     nothing recorded that only the swap writes (stopping, migration, the new service), and no new service definition
- *     staged
- *   - the live database is still at the schema that journal recorded
- *   - the service definition still names the runtime the journal started from (and is the one it saved), never the
- *     staged one
- *   - that runtime's service is running, nothing runs from the staged runtime, and no deployment is still running
- *
- * Anything missing, damaged or contradicting refuses and leaves the pause as it is. Without --yes it only shows the
- * proof; with --yes it lifts that one pause (the owner is checked again inside the same write) and journals it.
- */
-import { BEFORE_SWAP } from "./deploy-phase.js";
-import type { Database } from "./store.js";
-/** The journal phases a deployment passes before it stops the old service (deploy-phase.ts, the one table). */
-export { BEFORE_SWAP };
-export type GateReleaseWorld = {
-    /** The live database file. */
-    database: string;
-    /** The installation's state folder: deployments stage under staged-upgrades/ there. */
-    stateDir: string;
-    /** The live database, opened without migrating it. */
-    open(): Database;
-    /** The installed browser service definitions (LaunchAgents), path and text. */
-    servicePlists(): {
-        path: string;
-        text: string;
-    }[];
-    /** Every process on this machine: pid and full command line. */
-    processes(): {
-        pid: number;
-        command: string;
-    }[];
-    now(): Date;
-};
-type Journal = Record<string, unknown> & {
-    id: string;
-    phase: string;
-    database: string;
-    schema: number;
-    priorRuntime: string;
-    nextRuntime: string;
-};
-export type GateProof = {
-    ok: true;
-    id: string;
-    stage: string;
-    journal: Journal;
-    proof: string[];
-} | {
-    ok: false;
-    reason: string;
-    message: string;
-};
-/** The owner id written into the live pause's triggers, when there is one pause and it names one id. */
-export declare function gateOwner(db: Database): string | null;
-/** Every deployment journal under staged-upgrades/: the stage it is in and what it holds, or why it can't be read. */
-export declare function journals(stateDir: string): {
-    stage: string;
-    journal: Record<string, unknown> | null;
-}[];
-/** Whether the pause owned by `id` was left by a deployment that never began its swap, and the evidence that says so. */
-export declare function proveBeforeSwap(id: string, world: GateReleaseWorld): GateProof;
-export type GateReleaseOutcome = {
-    ok: true;
-    released: boolean;
-    id: string;
-    stage: string;
-    proof: string[];
-} | {
-    ok: false;
-    reason: string;
-    message: string;
-};
-/** Prove, then (with `yes`) lift exactly that pause and journal the release in the deployment's own journal. */
-export declare function releaseGate(id: string, world: GateReleaseWorld, yes: boolean): GateReleaseOutcome;

package/dist/release-git.d.ts

@@ -1,43 +0,0 @@
-/**
- * The release's repository as Toolroll records it (docs/plans/chat-management.md §0a.2), never as the gate checkout
- * says: the checkout is one of the plane's recorded projects (by real path), its Git directory is that project's own
- * plain `.git` folder, and its GitHub `owner/name` and the URL fetched from come from the recorded remote
- * (`project.remote_url`), not the checkout's `origin`. The checkout is where the release check ran the build's own code,
- * so its `.git/config` is treated as build-written.
- */
-export type ReleaseRepo = {
-    checkout: string;
-    gitDir: string;
-    remote: string;
-    slug: string;
-    ssh: boolean;
-};
-/** The programs the coordinator runs, by absolute path, found once when it starts. */
-export type ReleaseTools = {
-    git: string;
-    gh: string;
-    ssh: string;
-};
-/** owner/name and transport of a recorded GitHub remote, read strictly (https or ssh to github.com, nothing else). */
-export declare function releaseRemote(url: string): {
-    slug: string;
-    ssh: boolean;
-} | null;
-/** Fixed system folders: the only PATH the coordinator's Git and gh run with. */
-export declare const RELEASE_PATH = "/usr/bin:/bin:/usr/sbin:/sbin";
-/** Git, gh and ssh by absolute path: the system's Git (or the first in the fixed system folders), the installed gh as
- * this process's PATH finds it now, and the system ssh. Resolved once; never looked up again. */
-export declare function releaseTools(path?: string): ReleaseTools;
-/** The coordinator's Git and gh environment: an allowlist, a fixed PATH, no system or global Git config, no prompts. */
-export declare function releaseGitEnv(base?: Readonly<NodeJS.ProcessEnv>): NodeJS.ProcessEnv;
-/** Every coordinator Git command's fixed settings, ahead of its own arguments: the recorded Git directory and checkout,
- * no hooks, fsmonitor, replacement objects, pager or submodule recursion, only https (and ssh for an ssh remote), the
- * system ssh, and gh as the only credential helper. */
-export declare function releaseGitArgs(repo: ReleaseRepo, tools: ReleaseTools): string[];
-/** The named remote the coordinator fetches, looks and pushes through: defined only on its own command line (`-c`), so
- * no checkout setting names or rewrites it. */
-export declare const RELEASE_REMOTE = "toolroll-release";
-/** The first local or worktree setting a gate checkout's config holds that a release won't run with, or null: one
- * outside the allowlist (an include, a command, a proxy, TLS or header setting, a credential helper, a URL rewrite, a
- * hooks folder), a remote named like a URL or after the coordinator's own, or a remote over a transport helper. */
-export declare function releaseConfigProblem(listing: string): string | null;