toolroll 0.9.40 → 0.9.42

package/dist/contracts/model-catalog.js

@@ -0,0 +1,14 @@
+/**
+ * What the model catalog (model-catalog.ts) reads from outside Toolroll: the Codex CLI's own model list
+ * (`~/.codex/models_cache.json`) and npm's latest-version answer for each agent CLI. Both belong to someone else, so
+ * both are read loosely: unknown keys are ignored, an entry that doesn't fit is skipped, and a file or answer that
+ * doesn't fit at all reads as nothing (an empty list, no version) — never an error.
+ */
+import { z } from "zod";
+import { modelIdSchema } from "./provider.js";
+/** One listed Codex model: a usable id, shown in the picker. Its display name is used when it is text. */
+export const codexModelSchema = z.object({ slug: modelIdSchema, visibility: z.literal("list"), display_name: z.unknown().optional() });
+/** The Codex cache file: its `models` list, entries read one by one with `codexModelSchema`. */
+export const codexModelsCacheSchema = z.object({ models: z.array(z.unknown()) });
+/** npm's `/<package>/latest` answer: a version starting with major.minor.patch. */
+export const npmLatestSchema = z.object({ version: z.string().regex(/^\d+\.\d+\.\d+/) });

package/dist/contracts/native-census.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The macOS process census the recovery helper prints (docs/plans/zod-revamp.md, item 19): `schema: 1`, the boot,
+ * the collector, and one identity per process. The parser in process-recovery-native.ts reads it with these schemas
+ * and keeps its fail-closed reason codes: a top-level problem is `malformed-native-census`, one in a process row
+ * `malformed-process-identity`. Duplicate pids and unique ids, the 64-bit bound on ids and completeness run in plain
+ * code after parsing. Unknown keys are dropped, and each identity is rebuilt in its sealed key order.
+ */
+import { z } from "zod";
+export declare const NATIVE_CENSUS_ERRORS: readonly ["kernel-process-table-unreadable", "process-membership-unreadable", "process-identity-unreadable", "boot-identity-unreadable", "coalition-counters-unreadable", "coalition-counters-changed", "coalition-count-mismatch", "anchor-identity-unreadable"];
+export declare const darwinProcessIdentitySchema: z.ZodObject<{
+    pid: z.ZodInt;
+    ppid: z.ZodNullable<z.ZodInt>;
+    uid: z.ZodNullable<z.ZodInt>;
+    birthMs: z.ZodNullable<z.ZodNumber>;
+    uniqueId: z.ZodNullable<z.ZodString>;
+    parentUniqueId: z.ZodNullable<z.ZodString>;
+    traced: z.ZodNullable<z.ZodBoolean>;
+    executable: z.ZodNullable<z.ZodString>;
+    originalParentVersion: z.ZodNullable<z.ZodInt>;
+    pidVersion: z.ZodExactOptional<z.ZodInt>;
+}, z.core.$strip>;
+export type DarwinProcessIdentity = z.infer<typeof darwinProcessIdentitySchema>;
+/** Top level only: process rows are read one by one, so a bad row gets its own reason. */
+export declare const darwinNativeCensusSchema: z.ZodObject<{
+    schema: z.ZodLiteral<1>;
+    bootId: z.ZodNullable<z.ZodString>;
+    collectorPid: z.ZodInt;
+    complete: z.ZodBoolean;
+    processes: z.ZodArray<z.ZodUnknown>;
+    errors: z.ZodArray<z.ZodEnum<{
+        "anchor-identity-unreadable": "anchor-identity-unreadable";
+        "boot-identity-unreadable": "boot-identity-unreadable";
+        "coalition-count-mismatch": "coalition-count-mismatch";
+        "coalition-counters-changed": "coalition-counters-changed";
+        "coalition-counters-unreadable": "coalition-counters-unreadable";
+        "kernel-process-table-unreadable": "kernel-process-table-unreadable";
+        "process-identity-unreadable": "process-identity-unreadable";
+        "process-membership-unreadable": "process-membership-unreadable";
+    }>>;
+}, z.core.$strip>;
+/** A kernel id within 64 bits (the schema checks the digits). */
+export declare const kernelIdInRange: (id: string) => boolean;

package/dist/contracts/native-census.js

@@ -0,0 +1,36 @@
+/**
+ * The macOS process census the recovery helper prints (docs/plans/zod-revamp.md, item 19): `schema: 1`, the boot,
+ * the collector, and one identity per process. The parser in process-recovery-native.ts reads it with these schemas
+ * and keeps its fail-closed reason codes: a top-level problem is `malformed-native-census`, one in a process row
+ * `malformed-process-identity`. Duplicate pids and unique ids, the 64-bit bound on ids and completeness run in plain
+ * code after parsing. Unknown keys are dropped, and each identity is rebuilt in its sealed key order.
+ */
+import { z } from "zod";
+export const NATIVE_CENSUS_ERRORS = ["kernel-process-table-unreadable", "process-membership-unreadable", "process-identity-unreadable", "boot-identity-unreadable", "coalition-counters-unreadable", "coalition-counters-changed", "coalition-count-mismatch", "anchor-identity-unreadable"];
+/** A kernel unique id: a decimal unsigned 64-bit integer as text (the bound itself is checked after parsing). */
+const kernelId = z.string().regex(/^(0|[1-9][0-9]{0,19})$/);
+const count = z.int().min(0);
+const version32 = z.int().min(0).max(0xffffffff);
+export const darwinProcessIdentitySchema = z.object({
+    pid: z.int().min(1),
+    ppid: count.nullable(),
+    uid: count.nullable(),
+    birthMs: z.number().positive().nullable(),
+    uniqueId: kernelId.nullable(),
+    parentUniqueId: kernelId.nullable(),
+    traced: z.boolean().nullable(),
+    executable: z.string().max(4096).regex(/^[^\x00-\x1f\x7f]*$/).nullable(),
+    originalParentVersion: version32.nullable(),
+    pidVersion: version32.exactOptional(),
+});
+/** Top level only: process rows are read one by one, so a bad row gets its own reason. */
+export const darwinNativeCensusSchema = z.object({
+    schema: z.literal(1),
+    bootId: z.string().regex(/^[a-fA-F0-9-]{36}$/).nullable(),
+    collectorPid: z.int().min(2),
+    complete: z.boolean(),
+    processes: z.array(z.unknown()).max(100_000),
+    errors: z.array(z.enum(NATIVE_CENSUS_ERRORS)),
+});
+/** A kernel id within 64 bits (the schema checks the digits). */
+export const kernelIdInRange = (id) => BigInt(id) <= 0xffffffffffffffffn;

package/dist/contracts/observation-request.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A focused observation request (observations.ts `parseObservationCases`): the file a builder writes to ask for one to
+ * four focused test runs, each naming a criterion, base or head, one test file and one test name.
+ *
+ * Toolroll defines this request, so it is strict: an unknown key, at the top or in an observation, is refused, as it
+ * always was. It must say `version: 1`, as it always had to: a request without `version`, or with any other version, is
+ * refused. What JSON Schema can't say —
+ * a criterion the brief asked about, a normalized test path, a usable test name, one distinct observation per
+ * criterion — is checked after parsing.
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+export declare const observationCaseSchema: z.ZodObject<{
+    criterion: z.ZodString;
+    at: z.ZodEnum<{
+        base: "base";
+        head: "head";
+    }>;
+    testPath: z.ZodString;
+    testName: z.ZodString;
+}, z.core.$strict>;
+export declare const observationRequestSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    observations: z.ZodArray<z.ZodObject<{
+        criterion: z.ZodString;
+        at: z.ZodEnum<{
+            base: "base";
+            head: "head";
+        }>;
+        testPath: z.ZodString;
+        testName: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ObservationCase = z.infer<typeof observationCaseSchema>;
+export type ObservationRequest = z.infer<typeof observationRequestSchema>;
+/** A parsed request (JSON already read). Only version 1 is read; there is no earlier version to upgrade. */
+export declare function readObservationRequest(input: unknown): ContractResult<ObservationRequest>;

package/dist/contracts/observation-request.js

@@ -0,0 +1,25 @@
+/**
+ * A focused observation request (observations.ts `parseObservationCases`): the file a builder writes to ask for one to
+ * four focused test runs, each naming a criterion, base or head, one test file and one test name.
+ *
+ * Toolroll defines this request, so it is strict: an unknown key, at the top or in an observation, is refused, as it
+ * always was. It must say `version: 1`, as it always had to: a request without `version`, or with any other version, is
+ * refused. What JSON Schema can't say —
+ * a criterion the brief asked about, a normalized test path, a usable test name, one distinct observation per
+ * criterion — is checked after parsing.
+ */
+import { z } from "zod";
+import { readVersioned, versioned } from "./contract.js";
+export const observationCaseSchema = z.strictObject({
+    criterion: z.string(),
+    at: z.enum(["base", "head"]),
+    testPath: z.string(),
+    testName: z.string(),
+});
+export const observationRequestSchema = versioned(1, {
+    observations: z.array(observationCaseSchema).min(1).max(4),
+});
+/** A parsed request (JSON already read). Only version 1 is read; there is no earlier version to upgrade. */
+export function readObservationRequest(input) {
+    return readVersioned(observationRequestSchema, input);
+}

package/dist/contracts/provider.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Which harness runs, on which model (provider.ts `AgentSpec`): a provider id and a model id, null for the harness's
+ * default. One schema for the pair; `ProviderId` and `AgentSpec` are derived from it. Model ids cross providers
+ * ("anthropic/claude-sonnet-4.5", "gpt-5-codex", "opus"): bounded and printable, never leading with a dash (argv
+ * safety), and no TOML-hostile characters. That OpenRouter and Gemini need an explicit model runs after parsing.
+ *
+ * A refusal names its field and never repeats the value it was given: a provider or model field is where a pasted
+ * credential would land, and a refusal is shown, logged and sent on.
+ */
+import { z } from "zod";
+export declare const PROVIDER_ID_VALUES: readonly ["claude", "codex", "openrouter", "gemini"];
+export declare const providerIdSchema: z.ZodEnum<{
+    claude: "claude";
+    codex: "codex";
+    gemini: "gemini";
+    openrouter: "openrouter";
+}>;
+export declare const MODEL_ID: RegExp;
+export declare const modelIdSchema: z.ZodString;
+export declare const agentSpecSchema: z.ZodObject<{
+    provider: z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+        gemini: "gemini";
+        openrouter: "openrouter";
+    }>;
+    model: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ProviderId = z.infer<typeof providerIdSchema>;
+export type AgentSpec = z.infer<typeof agentSpecSchema>;

package/dist/contracts/provider.js

@@ -0,0 +1,15 @@
+/**
+ * Which harness runs, on which model (provider.ts `AgentSpec`): a provider id and a model id, null for the harness's
+ * default. One schema for the pair; `ProviderId` and `AgentSpec` are derived from it. Model ids cross providers
+ * ("anthropic/claude-sonnet-4.5", "gpt-5-codex", "opus"): bounded and printable, never leading with a dash (argv
+ * safety), and no TOML-hostile characters. That OpenRouter and Gemini need an explicit model runs after parsing.
+ *
+ * A refusal names its field and never repeats the value it was given: a provider or model field is where a pasted
+ * credential would land, and a refusal is shown, logged and sent on.
+ */
+import { z } from "zod";
+export const PROVIDER_ID_VALUES = ["claude", "codex", "openrouter", "gemini"];
+export const providerIdSchema = z.enum(PROVIDER_ID_VALUES);
+export const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+export const modelIdSchema = z.string().regex(MODEL_ID);
+export const agentSpecSchema = z.object({ provider: providerIdSchema, model: modelIdSchema.nullable() });

package/dist/contracts/recipes.d.ts

@@ -0,0 +1,166 @@
+/**
+ * A recipe document (recipes.ts): reusable work a person imports, exports, previews and saves. One schema for both
+ * versions, a discriminated union on `version` — version 1 is fixed work, version 2 adds questions whose answers fill
+ * `{{key}}` placeholders. Recipes are strict and always were: every key is required, and an unknown one (an approval,
+ * provider or credential setting smuggled in) is refused by name.
+ *
+ * A success check is the scope's own saved criterion (src/contracts/scope.ts), strict about its keys. The reader fills
+ * an absent or empty `how` with null before parsing, as the scope reader always has. What JSON Schema can't say runs
+ * in recipes.ts after parsing, each refusal naming its field: the 32 KB size, text and placeholder rules, schedules,
+ * the budget/schedule/deliverable/planning combinations, question keys and the scope reader's byte, control-character
+ * and duplicate checks. Saved recipes and previews keep their exact bytes, so their digests still match.
+ */
+import { z } from "zod";
+import { type ContractResult } from "./contract.js";
+export declare const RECIPE_FORMAT = "standing-orders-recipe";
+/** Numbers the recipe rules use, in plain code after parsing (bytes of the whole document, characters of a field). */
+export declare const RECIPE_LIMITS: {
+    readonly documentBytes: 32768;
+    readonly description: 400;
+    readonly inputs: 8;
+    readonly label: 80;
+    readonly answer: 500;
+};
+/** A question a version 2 recipe asks: its key, its label and an optional default answer (null for none). */
+export declare const recipeInputSchema: z.ZodObject<{
+    key: z.ZodString;
+    label: z.ZodString;
+    defaultValue: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const recipeV1Schema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    format: z.ZodLiteral<"standing-orders-recipe">;
+    name: z.ZodString;
+    description: z.ZodString;
+    goal: z.ZodString;
+    outOfScope: z.ZodNullable<z.ZodString>;
+    touches: z.ZodArray<z.ZodString>;
+    acceptance: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        id: z.ZodString;
+        statement: z.ZodString;
+        evidence: z.ZodArray<z.ZodEnum<{
+            "changed-path": "changed-path";
+            check: "check";
+            "manual-review": "manual-review";
+            screenshot: "screenshot";
+        }>>;
+        how: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>>;
+    planning: z.ZodEnum<{
+        auto: "auto";
+        required: "required";
+        skip: "skip";
+    }>;
+    deliverable: z.ZodEnum<{
+        branch: "branch";
+        report: "report";
+    }>;
+    schedule: z.ZodNullable<z.ZodString>;
+    costCeilingUsd: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const recipeV2Schema: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    format: z.ZodLiteral<"standing-orders-recipe">;
+    name: z.ZodString;
+    description: z.ZodString;
+    goal: z.ZodString;
+    outOfScope: z.ZodNullable<z.ZodString>;
+    touches: z.ZodArray<z.ZodString>;
+    acceptance: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        id: z.ZodString;
+        statement: z.ZodString;
+        evidence: z.ZodArray<z.ZodEnum<{
+            "changed-path": "changed-path";
+            check: "check";
+            "manual-review": "manual-review";
+            screenshot: "screenshot";
+        }>>;
+        how: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>>;
+    planning: z.ZodEnum<{
+        auto: "auto";
+        required: "required";
+        skip: "skip";
+    }>;
+    deliverable: z.ZodEnum<{
+        branch: "branch";
+        report: "report";
+    }>;
+    schedule: z.ZodNullable<z.ZodString>;
+    costCeilingUsd: z.ZodNullable<z.ZodNumber>;
+    inputs: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodString;
+        defaultValue: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const recipeDocumentSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    format: z.ZodLiteral<"standing-orders-recipe">;
+    name: z.ZodString;
+    description: z.ZodString;
+    goal: z.ZodString;
+    outOfScope: z.ZodNullable<z.ZodString>;
+    touches: z.ZodArray<z.ZodString>;
+    acceptance: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        id: z.ZodString;
+        statement: z.ZodString;
+        evidence: z.ZodArray<z.ZodEnum<{
+            "changed-path": "changed-path";
+            check: "check";
+            "manual-review": "manual-review";
+            screenshot: "screenshot";
+        }>>;
+        how: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>>;
+    planning: z.ZodEnum<{
+        auto: "auto";
+        required: "required";
+        skip: "skip";
+    }>;
+    deliverable: z.ZodEnum<{
+        branch: "branch";
+        report: "report";
+    }>;
+    schedule: z.ZodNullable<z.ZodString>;
+    costCeilingUsd: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    format: z.ZodLiteral<"standing-orders-recipe">;
+    name: z.ZodString;
+    description: z.ZodString;
+    goal: z.ZodString;
+    outOfScope: z.ZodNullable<z.ZodString>;
+    touches: z.ZodArray<z.ZodString>;
+    acceptance: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        id: z.ZodString;
+        statement: z.ZodString;
+        evidence: z.ZodArray<z.ZodEnum<{
+            "changed-path": "changed-path";
+            check: "check";
+            "manual-review": "manual-review";
+            screenshot: "screenshot";
+        }>>;
+        how: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>>;
+    planning: z.ZodEnum<{
+        auto: "auto";
+        required: "required";
+        skip: "skip";
+    }>;
+    deliverable: z.ZodEnum<{
+        branch: "branch";
+        report: "report";
+    }>;
+    schedule: z.ZodNullable<z.ZodString>;
+    costCeilingUsd: z.ZodNullable<z.ZodNumber>;
+    inputs: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        label: z.ZodString;
+        defaultValue: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "version">;
+export type RecipeDocument = z.infer<typeof recipeDocumentSchema>;
+export type RecipeInput = z.infer<typeof recipeInputSchema>;
+/** Read a recipe's structure (format and version already checked): every refusal is a path-named issue. */
+export declare function readRecipeDocument(input: Record<string, unknown>): ContractResult<RecipeDocument>;

package/dist/contracts/recipes.js

@@ -0,0 +1,52 @@
+/**
+ * A recipe document (recipes.ts): reusable work a person imports, exports, previews and saves. One schema for both
+ * versions, a discriminated union on `version` — version 1 is fixed work, version 2 adds questions whose answers fill
+ * `{{key}}` placeholders. Recipes are strict and always were: every key is required, and an unknown one (an approval,
+ * provider or credential setting smuggled in) is refused by name.
+ *
+ * A success check is the scope's own saved criterion (src/contracts/scope.ts), strict about its keys. The reader fills
+ * an absent or empty `how` with null before parsing, as the scope reader always has. What JSON Schema can't say runs
+ * in recipes.ts after parsing, each refusal naming its field: the 32 KB size, text and placeholder rules, schedules,
+ * the budget/schedule/deliverable/planning combinations, question keys and the scope reader's byte, control-character
+ * and duplicate checks. Saved recipes and previews keep their exact bytes, so their digests still match.
+ */
+import { z } from "zod";
+import { parseContract, versioned } from "./contract.js";
+import { savedCriterionSchema } from "./scope.js";
+export const RECIPE_FORMAT = "standing-orders-recipe";
+/** Numbers the recipe rules use, in plain code after parsing (bytes of the whole document, characters of a field). */
+export const RECIPE_LIMITS = { documentBytes: 32_768, description: 400, inputs: 8, label: 80, answer: 500 };
+/** A question a version 2 recipe asks: its key, its label and an optional default answer (null for none). */
+export const recipeInputSchema = z.strictObject({
+    key: z.string(),
+    label: z.string(),
+    defaultValue: z.string().nullable(),
+});
+const recipeFields = {
+    format: z.literal(RECIPE_FORMAT),
+    name: z.string(),
+    description: z.string(),
+    goal: z.string(),
+    outOfScope: z.string().nullable(),
+    touches: z.array(z.string()),
+    acceptance: z.array(savedCriterionSchema),
+    planning: z.enum(["auto", "required", "skip"]),
+    deliverable: z.enum(["branch", "report"]),
+    schedule: z.string().nullable(),
+    costCeilingUsd: z.number().positive().nullable(),
+};
+export const recipeV1Schema = versioned(1, recipeFields);
+export const recipeV2Schema = versioned(2, { ...recipeFields, inputs: z.array(recipeInputSchema).min(1).max(RECIPE_LIMITS.inputs) });
+export const recipeDocumentSchema = z.discriminatedUnion("version", [recipeV1Schema, recipeV2Schema]);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** A success check as the scope reader reads it: an absent or empty `how` is null; every other key, known or not, as given. */
+function checkBody(entry) {
+    if (!isRecord(entry) || (entry["how"] !== undefined && entry["how"] !== ""))
+        return entry;
+    return { ...entry, how: null };
+}
+/** Read a recipe's structure (format and version already checked): every refusal is a path-named issue. */
+export function readRecipeDocument(input) {
+    const body = Array.isArray(input["acceptance"]) ? { ...input, acceptance: input["acceptance"].map(checkBody) } : input;
+    return input["version"] === 2 ? parseContract(recipeV2Schema, body) : parseContract(recipeV1Schema, body);
+}

package/dist/contracts/retention.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Retention settings (retention.ts): which kinds of data have a period, and how long each is kept — a whole number of
+ * days from 1 to 3650, or null for forever. One schema for the kind, the period and the full set of periods; the
+ * types retention.ts exports are derived from them.
+ *
+ * `retention_setting` rows are read by the store (`retentionChosen`, item 18's to move onto `retentionRowSchema`): a
+ * row's kind and days as SQLite's CHECK constraint keeps them, unknown columns ignored. Text a person types ("90d",
+ * "1y", "forever") is turned into days in plain code (retention.ts `parsePeriod`) and then checked by this schema.
+ */
+import { z } from "zod";
+export declare const RETENTION_KIND_VALUES: readonly ["evidence", "checkouts", "chat", "notifications"];
+export declare const retentionKindSchema: z.ZodEnum<{
+    chat: "chat";
+    checkouts: "checkouts";
+    evidence: "evidence";
+    notifications: "notifications";
+}>;
+export declare const RETENTION_DAYS: {
+    readonly min: 1;
+    readonly max: 3650;
+};
+/** A period: whole days from 1 to 3650, or null for forever. */
+export declare const retentionDaysSchema: z.ZodNullable<z.ZodInt>;
+/** Every kind's period, as the sweep and the settings page read them. */
+export declare const retentionPeriodsSchema: z.ZodObject<{
+    evidence: z.ZodNullable<z.ZodInt>;
+    checkouts: z.ZodNullable<z.ZodInt>;
+    chat: z.ZodNullable<z.ZodInt>;
+    notifications: z.ZodNullable<z.ZodInt>;
+}, z.core.$strip>;
+/** A saved `retention_setting` row: only a kind someone chose has one. */
+export declare const retentionRowSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        chat: "chat";
+        checkouts: "checkouts";
+        evidence: "evidence";
+        notifications: "notifications";
+    }>;
+    days: z.ZodNullable<z.ZodInt>;
+}, z.core.$strip>;
+export type RetentionKind = z.infer<typeof retentionKindSchema>;
+export type RetentionPeriods = z.infer<typeof retentionPeriodsSchema>;

package/dist/contracts/retention.js

@@ -0,0 +1,24 @@
+/**
+ * Retention settings (retention.ts): which kinds of data have a period, and how long each is kept — a whole number of
+ * days from 1 to 3650, or null for forever. One schema for the kind, the period and the full set of periods; the
+ * types retention.ts exports are derived from them.
+ *
+ * `retention_setting` rows are read by the store (`retentionChosen`, item 18's to move onto `retentionRowSchema`): a
+ * row's kind and days as SQLite's CHECK constraint keeps them, unknown columns ignored. Text a person types ("90d",
+ * "1y", "forever") is turned into days in plain code (retention.ts `parsePeriod`) and then checked by this schema.
+ */
+import { z } from "zod";
+export const RETENTION_KIND_VALUES = ["evidence", "checkouts", "chat", "notifications"];
+export const retentionKindSchema = z.enum(RETENTION_KIND_VALUES);
+export const RETENTION_DAYS = { min: 1, max: 3650 };
+/** A period: whole days from 1 to 3650, or null for forever. */
+export const retentionDaysSchema = z.int().min(RETENTION_DAYS.min).max(RETENTION_DAYS.max).nullable();
+/** Every kind's period, as the sweep and the settings page read them. */
+export const retentionPeriodsSchema = z.object({
+    evidence: retentionDaysSchema,
+    checkouts: retentionDaysSchema,
+    chat: retentionDaysSchema,
+    notifications: retentionDaysSchema,
+});
+/** A saved `retention_setting` row: only a kind someone chose has one. */
+export const retentionRowSchema = z.object({ kind: retentionKindSchema, days: retentionDaysSchema });

package/dist/contracts/storage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The checkout cleanup setting (storage.ts, Settings → Storage): when a finished task's clean checkout is removed.
+ * One schema for the four values `checkout_cleanup_setting.cleanup` may hold, and `CheckoutCleanup` derived from it.
+ * The words a person types ("week", "off", "2 days") become a value in plain code (storage.ts `parseCleanup`) and
+ * are then checked by this schema. The saved row is read by the store (item 18's to move onto `checkoutCleanupRowSchema`).
+ */
+import { z } from "zod";
+export declare const checkoutCleanupSchema: z.ZodEnum<{
+    "2d": "2d";
+    "7d": "7d";
+    finished: "finished";
+    never: "never";
+}>;
+/** A saved `checkout_cleanup_setting` row (at most one; none means the default), unknown columns ignored. */
+export declare const checkoutCleanupRowSchema: z.ZodObject<{
+    cleanup: z.ZodEnum<{
+        "2d": "2d";
+        "7d": "7d";
+        finished: "finished";
+        never: "never";
+    }>;
+}, z.core.$strip>;
+export type CheckoutCleanup = z.infer<typeof checkoutCleanupSchema>;

package/dist/contracts/storage.js

@@ -0,0 +1,10 @@
+/**
+ * The checkout cleanup setting (storage.ts, Settings → Storage): when a finished task's clean checkout is removed.
+ * One schema for the four values `checkout_cleanup_setting.cleanup` may hold, and `CheckoutCleanup` derived from it.
+ * The words a person types ("week", "off", "2 days") become a value in plain code (storage.ts `parseCleanup`) and
+ * are then checked by this schema. The saved row is read by the store (item 18's to move onto `checkoutCleanupRowSchema`).
+ */
+import { z } from "zod";
+export const checkoutCleanupSchema = z.enum(["finished", "2d", "7d", "never"]);
+/** A saved `checkout_cleanup_setting` row (at most one; none means the default), unknown columns ignored. */
+export const checkoutCleanupRowSchema = z.object({ cleanup: checkoutCleanupSchema });