toolroll 0.9.65 → 0.9.68

package/dist/tool-broker.js

@@ -20,6 +20,8 @@
 import { spawn } from "node:child_process";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+import { accessSync, constants, existsSync, realpathSync } from "node:fs";
+import { delimiter, isAbsolute, resolve, sep } from "node:path";
 const BODY_LIMIT = 4 * 1024 * 1024;
 const ANSWER_LIMIT = 32 * 1024 * 1024;
 const STOP_GRACE_MS = 2_000;
@@ -59,6 +61,54 @@ export function serverEnv(base, omit, pass, values) {
         delete env[name];
     return Object.assign(env, pass, values);
 }
+/**
+ * The first of a server's command and path-like arguments that resolves inside an untrusted folder (a build's checkout
+ * or caches), or null. The command is resolved as spawn would: a path against `cwd`, a bare name through PATH; an
+ * argument counts when it names an existing path (relative to `cwd`) or is written as one (`./x`, `../x`, `/x`).
+ */
+export function workspaceBytes(command, args, cwd, path, untrusted) {
+    if (untrusted.length === 0)
+        return null;
+    const base = cwd ?? process.cwd();
+    // Canonical on-disk names, folded where the filesystem ignores case (macOS, Windows), so `/Users/a/CHECKOUT` is the checkout.
+    const fold = process.platform === "darwin" || process.platform === "win32" ? (one) => one.toLowerCase() : (one) => one;
+    const real = (one) => { try {
+        return fold(realpathSync.native(one));
+    }
+    catch {
+        return fold(resolve(one));
+    } };
+    const roots = untrusted.map(real);
+    const within = (one) => { const at = real(one); return roots.some(root => at === root || at.startsWith(`${root}${sep}`)); };
+    // A root's name anywhere in an argument (inline code, a list of paths) counts, however it's spelled.
+    const mentions = (arg) => { const text = fold(arg); return roots.some(root => text.includes(root)) || untrusted.some(root => text.includes(fold(root))); };
+    const located = command.includes("/") || command.includes(sep) ? resolve(base, command)
+        : (path ?? "").split(delimiter).filter(Boolean).map(dir => resolve(base, dir, command)).find(one => { try {
+            accessSync(one, constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        } }) ?? null;
+    if (located !== null && within(located))
+        return located;
+    // A relative path once meant "in the checkout" (servers started there): it is refused rather than read elsewhere.
+    if (!isAbsolute(command) && (command.includes("/") || command.includes(sep)))
+        return `${command} (a relative path)`;
+    for (const arg of args) {
+        if (mentions(arg))
+            return `${arg} (names what this build writes)`;
+        // A flag's value (`--config=x`, `-c=x`) is checked as its own argument.
+        for (const piece of [arg, ...(arg.startsWith("-") && arg.includes("=") ? [arg.slice(arg.indexOf("=") + 1)] : [])]) {
+            if (piece.startsWith("./") || piece.startsWith("../"))
+                return `${piece} (a relative path)`;
+            const candidate = resolve(base, piece);
+            if ((isAbsolute(piece) || existsSync(candidate)) && within(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
 /** A local server, started on first use and spoken to over its stdin and stdout. */
 class LocalServer {
     tool;
@@ -68,6 +118,7 @@ class LocalServer {
     buffer = "";
     next = 1;
     pending = new Map();
+    refusal = null;
     constructor(tool, options) {
         this.tool = tool;
         this.options = options;
@@ -75,7 +126,19 @@ class LocalServer {
     pid() { return this.child?.pid ?? null; }
     start() {
         const env = serverEnv(this.options.env ?? process.env, this.options.omitEnv ?? [], this.options.pass ?? {}, this.tool.values);
+        const planted = workspaceBytes(this.tool.spec.command, this.tool.spec.args, this.options.cwd, env["PATH"], this.options.untrusted ?? []);
+        if (planted !== null) {
+            this.refusal = `The tool's server would run ${planted}, inside what this build can write, so it was not started.`;
+            return null;
+        }
         const wrap = this.options.wrap?.() ?? null;
+        if (wrap === null) {
+            const why = this.options.unwrapped?.() ?? null;
+            if (why !== null) {
+                this.refusal = why;
+                return null;
+            }
+        }
         const { file, args } = wrap === null ? { file: this.tool.spec.command, args: [...this.tool.spec.args] } : wrap(this.tool.spec.command, this.tool.spec.args);
         const child = spawn(file, args, { env, ...(this.options.cwd === undefined ? {} : { cwd: this.options.cwd }), stdio: ["pipe", "pipe", "ignore"], detached: process.platform !== "win32" });
         this.child = child;
@@ -131,8 +194,9 @@ class LocalServer {
         // A new session (a reconnect) starts a fresh server: a server answers initialize once.
         if (message.method === "initialize" && this.initialized)
             this.stop();
-        if (this.child === null)
-            this.start();
+        if (this.child === null && this.start() === null) {
+            return Promise.resolve(isRequest(message) ? rpcError(message.id, this.refusal ?? "The tool could not start.") : null);
+        }
         if (message.method === "initialize")
             this.initialized = true;
         if (!isRequest(message)) {

package/dist/tool-secret-store.d.ts

@@ -56,7 +56,6 @@ export declare function detectSecretStore(options?: {
 export declare function chooseSecretStore(store: SecretBackend | "files" | DetectedStore | null): void;
 /** This computer's store (found once), or null for owner-only files. */
 export declare function secretBackend(env?: NodeJS.ProcessEnv): SecretBackend | null;
-export declare const secretStoreKind: () => SecretStoreKind;
 /** Where secrets rest, in the words Settings and `toolroll integrations` share; `problem` when Toolroll's folder can't be used. */
 export declare function secretStorage(): {
     kind: SecretStoreKind;
@@ -166,5 +165,3 @@ export declare function writeSealed(backend: SecretBackend, folder: SecretFolder
 export declare function readHeldSecret(state: string, name: string, file: readonly string[]): string | null;
 /** Keep (or, with null, remove) a held secret: see readHeldSecret. */
 export declare function writeHeldSecret(state: string, name: string, file: readonly string[], value: string | null): void;
-/** Whether a held secret has a value, without reading it where that can be helped. */
-export declare function heldSecretSet(state: string, name: string, file: readonly string[]): boolean;

package/dist/tool-secret-store.js

@@ -32,6 +32,7 @@ import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:
 import { closeSync, constants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { envValue } from "./names.js";
+import { sleep } from "./sleep.js";
 export class SecretStoreError extends Error {
 }
 /** The words Settings and `toolroll integrations` use for where secrets rest. */
@@ -200,7 +201,6 @@ function currentStore(env) {
 export function secretBackend(env = process.env) {
     return currentStore(env).backend;
 }
-export const secretStoreKind = () => secretBackend()?.kind ?? "files";
 /** Where secrets rest, in the words Settings and `toolroll integrations` share; `problem` when Toolroll's folder can't be used. */
 export function secretStorage() {
     const found = currentStore(process.env);
@@ -701,7 +701,7 @@ export async function withSecretLockAsync(folder, name, work, options = {}) {
     while (!takeLock(lock, options.staleMs ?? 120_000)) {
         if (Date.now() - started > (options.waitMs ?? 120_000))
             throw new SecretStoreError("A sign-in is being renewed elsewhere. Try again in a moment.");
-        await new Promise(resolve => setTimeout(resolve, 25));
+        await sleep(25);
     }
     try {
         return await work();
@@ -823,12 +823,3 @@ export function writeHeldSecret(state, name, file, value) {
             writeSealed(backend, folder, item, value);
     });
 }
-/** Whether a held secret has a value, without reading it where that can be helped. */
-export function heldSecretSet(state, name, file) {
-    try {
-        return readHeldSecret(state, name, file) !== null;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/toolroll-update.d.ts

@@ -162,7 +162,6 @@ export type StartOptions = {
     /** An older version replaces the current one only when asked for by name. */
     allowDowngrade?: boolean;
 };
-declare function nextAt(hhmm: string, now: Date): Date;
 /** Record an update without running it: the console's job resumes exactly this journal id. */
 export declare function prepareRuntimeUpdate(o: StartOptions, now: Date): RuntimeUpdateJournal | {
     refused: string;
@@ -257,4 +256,3 @@ export declare function launchRuntimeUpdate(args: {
 }): Promise<void>;
 /** The job's last act: its definition goes, so nothing can start it again. Only the definition for this id. */
 export declare function retireUpdateJob(id: string, home?: string): void;
-export declare const nextScheduledAt: typeof nextAt;

package/dist/toolroll-update.js

@@ -40,6 +40,7 @@ import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES,
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
+import { sleep } from "./sleep.js";
 /** Loaded on first use (as backup.ts and store.ts do), so modules that only import this one (the console,
  * and tests that load it in a browser-like environment) never need `node:sqlite` itself. */
 function sqlite() {
@@ -1583,7 +1584,7 @@ export function machineSystem(home = homedir(), env = process.env, seams = {}) {
     };
     return {
         now: () => new Date(),
-        sleep: ms => new Promise(done => setTimeout(done, ms)),
+        sleep,
         release: async (version) => {
             const body = await json(`${REGISTRY}/${NAME}/${version}`);
             return { version: String(body.version ?? ""), tarball: String(body.dist?.tarball ?? ""), integrity: String(body.dist?.integrity ?? ""), attestations: body.dist?.attestations?.url ?? null };
@@ -1805,4 +1806,3 @@ export function retireUpdateJob(id, home = homedir()) {
     }
     catch { /* none */ }
 }
-export const nextScheduledAt = nextAt;

package/dist/unfenced-test-support.d.ts

@@ -0,0 +1,2 @@
+import type { Store } from "./store.js";
+export declare function allowWhereUnfenced<T extends Store>(store: T): T;

package/dist/unfenced-test-support.js

@@ -0,0 +1,11 @@
+/**
+ * Tests that run real commands on a machine with no OS fence (CI's Ubuntu runners, where unprivileged namespaces are
+ * off) allow unconfined agents on their own store, as an instance operator there would; anywhere a fence exists,
+ * nothing changes and the fence is what the test runs under.
+ */
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+export function allowWhereUnfenced(store) {
+    if (!macosFenceAvailable() && !linuxFenceAvailable())
+        store.setUnfencedAgentsAllowed(true, "test", new Date(0));
+    return store;
+}

package/dist/verification-evidence.d.ts

@@ -2,7 +2,6 @@ import type { Artifact, Store, VerifyCommand } from "./store.js";
 import type { VerifyCommandFacts } from "./proof.js";
 import { type AdjudicateResult } from "./proof.js";
 export declare const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
-export declare const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
 export declare const isVerificationReceipt: (a: Artifact) => boolean;
 export declare function sealVerificationReceipt(store: Store, root: string, runId: number, head: string, command: VerifyCommand, result: VerifyCommandFacts, now: Date, reusedFrom?: {
     run: number;

package/dist/verification-evidence.js

@@ -12,7 +12,6 @@ import { LEGACY_GATE_SOURCE, readVerificationView } from "./contracts/verificati
 import { readCandidateEndpoints, savedInventoryPaths } from "./contracts/diff-stat.js";
 import { liveQuickCommand, quickVerifyKey, runCheckLevel } from "./check-levels.js";
 export const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
-export const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
 const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 const binding = (a) => ({ artifactId: a.id, sha256: a.sha256, bytesStored: a.bytesStored, bytesOriginal: a.bytesOriginal, truncated: a.truncated, redacted: a.redacted, captureStatus: a.captureStatus });
 export const isVerificationReceipt = (a) => a.kind === "structured-output" && (a.capture === VERIFICATION_RECEIPT_CAPTURE || a.capture === "machine verification reuse v1");

package/dist/webhooks.d.ts

@@ -6,7 +6,6 @@ export type WebhookTarget = {
 };
 export declare const LEGACY_WEBHOOK_WARNING = "Legacy webhooks are deprecated. Connect Slack or Discord in Chat settings.";
 export declare const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
-export declare const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
 export type MessagingChannel = "telegram" | "slack" | "discord" | "teams";
 export declare const MESSAGING_CHANNELS: readonly MessagingChannel[];
 export declare function isMessagingChannel(value: string): value is MessagingChannel;

package/dist/webhooks.js

@@ -17,7 +17,6 @@ const FILE_OF = { slack: "slack-webhook", discord: "discord-webhook" };
 const POST_TIMEOUT_MS = 10_000;
 export const LEGACY_WEBHOOK_WARNING = "Legacy webhooks are deprecated. Connect Slack or Discord in Chat settings.";
 export const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
-export const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
 const CONSOLE_FILE = "console-url";
 const PRIMARY_FILE = "messaging-primary";
 export const MESSAGING_CHANNELS = ["telegram", "slack", "discord", "teams"];

package/dist/workspace-ui.d.ts

@@ -261,14 +261,6 @@ export declare function workStatusOf(facts: WorkFacts, resultDisplay?: DisplaySt
 export declare function workCounts(rows: readonly {
     views: readonly WorkView[];
 }[]): Record<WorkView, number>;
-/** All's order: rank, then most recently updated. */
-export declare function compareWorkRows(a: {
-    rank: number;
-    updatedAt: string;
-}, b: {
-    rank: number;
-    updatedAt: string;
-}): number;
 /** The shell's three primary destinations, from the page's own active
  * key: every old page keeps its key and lights the destination it now
  * lives under. */

package/dist/workspace-ui.js

@@ -18,7 +18,7 @@
  */
 import { ACCEPT_NEEDS_REASON, FAILED_CHECK, cantAcceptYetOf, evidenceProblemOf } from "./result-acts.js";
 export { ACCEPT_NEEDS_REASON, cantAcceptYetOf, evidenceProblemOf };
-import { GOAL_ASSESSMENT_PENDING, manualReviewOnly, plainReasonWords } from "./proof.js";
+import { manualReviewOnly, plainReasonWords } from "./proof.js";
 import { OPEN_RESULT, plainReasonOf, stageOfCode, taskStatusOf, workToneOf } from "./task-status.js";
 import { whenUtc } from "./when-html.js";
 import { html, postForm } from "./html.js";
@@ -54,7 +54,6 @@ export function reviewFactsOf(retry, reviewerAlive, automaticPending = false) {
 }
 /** The tokens a review in flight wears — the dispatch codes, unchanged. */
 export const REVIEW_TOKENS = new Set(["reviewing", "review-pending", "review-failed", "review-exhausted"]);
-const retriesLeft = (count, explicit = true) => `${count}${explicit ? " explicit" : ""} ${count === 1 ? "retry" : "retries"}`;
 /**
  * A review that is queued, running, failed with a retry left, or
  * exhausted is the result's PRIMARY status — the machine is still
@@ -504,10 +503,6 @@ export function workCounts(rows) {
             counts[view] += 1;
     return counts;
 }
-/** All's order: rank, then most recently updated. */
-export function compareWorkRows(a, b) {
-    return a.rank - b.rank || (a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0);
-}
 const WORK_KEYS = new Set(["inbox", "board", "queue", "work", "done", "activity", "review", "tasks", "runs", "workbench", "recipes", "ledger"]);
 const SETTINGS_KEYS = new Set(["fleet", "caps", "people", "mode", "system", "settings"]);
 export function primaryDestinationOf(active) {

package/dist/writes-mode.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Where a build may write (docs/plans/agent-baseline-hardening.md arc 2). `workspace`: only its allowlist (agent-fence.ts
+ * WriteAllowlist), whatever its permission mode; `anywhere`: anywhere its fence doesn't deny, as builds did before.
+ */
+export type WritesMode = "workspace" | "anywhere";
+export declare const WRITES_DEFAULT: WritesMode;
+export declare const isWritesMode: (value: unknown) => value is WritesMode;
+/** What an approval card and the CLI say of where a build may write (absent: sealed before write allowlists). */
+export declare function writesWords(writes: WritesMode | undefined): string;

package/dist/writes-mode.js

@@ -0,0 +1,8 @@
+export const WRITES_DEFAULT = "workspace";
+export const isWritesMode = (value) => value === "workspace" || value === "anywhere";
+/** What an approval card and the CLI say of where a build may write (absent: sealed before write allowlists). */
+export function writesWords(writes) {
+    return writes === "workspace" ? "only its checkout, its caches and its temp folder"
+        : writes === "anywhere" ? "anywhere outside Toolroll's fenced folders (an approver's choice)"
+            : "anywhere outside Toolroll's fenced folders (approved before write limits)";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.65",
+  "version": "0.9.68",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"
@@ -84,6 +84,8 @@
     "@types/react-dom": "19.3.0",
     "@types/ws": "8.18.2",
     "@xterm/addon-fit": "0.11.0",
+    "@xterm/addon-unicode11": "0.9.0",
+    "@xterm/addon-webgl": "0.19.0",
     "@xterm/xterm": "6.0.0",
     "@xyflow/react": "12.12.0",
     "class-variance-authority": "0.7.1",
@@ -124,6 +126,8 @@
   },
   "dependencies": {
     "@slack/socket-mode": "3.1.0",
+    "@xterm/addon-serialize": "0.14.0",
+    "@xterm/headless": "6.0.0",
     "discord.js": "14.27.0",
     "imapflow": "2.2.5",
     "mailparser": "3.9.36",

package/dist/contracts/native-census.d.ts

@@ -1,42 +0,0 @@
-/**
- * The macOS process census the recovery helper prints (docs/plans/zod-revamp.md, item 19): `schema: 1`, the boot,
- * the collector, and one identity per process. The parser in process-recovery-native.ts reads it with these schemas
- * and keeps its fail-closed reason codes: a top-level problem is `malformed-native-census`, one in a process row
- * `malformed-process-identity`. Duplicate pids and unique ids, the 64-bit bound on ids and completeness run in plain
- * code after parsing. Unknown keys are dropped, and each identity is rebuilt in its sealed key order.
- */
-import { z } from "zod";
-export declare const NATIVE_CENSUS_ERRORS: readonly ["kernel-process-table-unreadable", "process-membership-unreadable", "process-identity-unreadable", "boot-identity-unreadable", "coalition-counters-unreadable", "coalition-counters-changed", "coalition-count-mismatch", "anchor-identity-unreadable"];
-export declare const darwinProcessIdentitySchema: z.ZodObject<{
-    pid: z.ZodInt;
-    ppid: z.ZodNullable<z.ZodInt>;
-    uid: z.ZodNullable<z.ZodInt>;
-    birthMs: z.ZodNullable<z.ZodNumber>;
-    uniqueId: z.ZodNullable<z.ZodString>;
-    parentUniqueId: z.ZodNullable<z.ZodString>;
-    traced: z.ZodNullable<z.ZodBoolean>;
-    executable: z.ZodNullable<z.ZodString>;
-    originalParentVersion: z.ZodNullable<z.ZodInt>;
-    pidVersion: z.ZodExactOptional<z.ZodInt>;
-}, z.core.$strip>;
-export type DarwinProcessIdentity = z.infer<typeof darwinProcessIdentitySchema>;
-/** Top level only: process rows are read one by one, so a bad row gets its own reason. */
-export declare const darwinNativeCensusSchema: z.ZodObject<{
-    schema: z.ZodLiteral<1>;
-    bootId: z.ZodNullable<z.ZodString>;
-    collectorPid: z.ZodInt;
-    complete: z.ZodBoolean;
-    processes: z.ZodArray<z.ZodUnknown>;
-    errors: z.ZodArray<z.ZodEnum<{
-        "anchor-identity-unreadable": "anchor-identity-unreadable";
-        "boot-identity-unreadable": "boot-identity-unreadable";
-        "coalition-count-mismatch": "coalition-count-mismatch";
-        "coalition-counters-changed": "coalition-counters-changed";
-        "coalition-counters-unreadable": "coalition-counters-unreadable";
-        "kernel-process-table-unreadable": "kernel-process-table-unreadable";
-        "process-identity-unreadable": "process-identity-unreadable";
-        "process-membership-unreadable": "process-membership-unreadable";
-    }>>;
-}, z.core.$strip>;
-/** A kernel id within 64 bits (the schema checks the digits). */
-export declare const kernelIdInRange: (id: string) => boolean;

package/dist/contracts/native-census.js

@@ -1,36 +0,0 @@
-/**
- * The macOS process census the recovery helper prints (docs/plans/zod-revamp.md, item 19): `schema: 1`, the boot,
- * the collector, and one identity per process. The parser in process-recovery-native.ts reads it with these schemas
- * and keeps its fail-closed reason codes: a top-level problem is `malformed-native-census`, one in a process row
- * `malformed-process-identity`. Duplicate pids and unique ids, the 64-bit bound on ids and completeness run in plain
- * code after parsing. Unknown keys are dropped, and each identity is rebuilt in its sealed key order.
- */
-import { z } from "zod";
-export const NATIVE_CENSUS_ERRORS = ["kernel-process-table-unreadable", "process-membership-unreadable", "process-identity-unreadable", "boot-identity-unreadable", "coalition-counters-unreadable", "coalition-counters-changed", "coalition-count-mismatch", "anchor-identity-unreadable"];
-/** A kernel unique id: a decimal unsigned 64-bit integer as text (the bound itself is checked after parsing). */
-const kernelId = z.string().regex(/^(0|[1-9][0-9]{0,19})$/);
-const count = z.int().min(0);
-const version32 = z.int().min(0).max(0xffffffff);
-export const darwinProcessIdentitySchema = z.object({
-    pid: z.int().min(1),
-    ppid: count.nullable(),
-    uid: count.nullable(),
-    birthMs: z.number().positive().nullable(),
-    uniqueId: kernelId.nullable(),
-    parentUniqueId: kernelId.nullable(),
-    traced: z.boolean().nullable(),
-    executable: z.string().max(4096).regex(/^[^\x00-\x1f\x7f]*$/).nullable(),
-    originalParentVersion: version32.nullable(),
-    pidVersion: version32.exactOptional(),
-});
-/** Top level only: process rows are read one by one, so a bad row gets its own reason. */
-export const darwinNativeCensusSchema = z.object({
-    schema: z.literal(1),
-    bootId: z.string().regex(/^[a-fA-F0-9-]{36}$/).nullable(),
-    collectorPid: z.int().min(2),
-    complete: z.boolean(),
-    processes: z.array(z.unknown()).max(100_000),
-    errors: z.array(z.enum(NATIVE_CENSUS_ERRORS)),
-});
-/** A kernel id within 64 bits (the schema checks the digits). */
-export const kernelIdInRange = (id) => BigInt(id) <= 0xffffffffffffffffn;

package/dist/process-recovery-anchor.d.ts

@@ -1,75 +0,0 @@
-import type { SQLInputValue } from "node:sqlite";
-import type { DarwinCoalitionProcessIdentity, PreparedDarwinProcessCensus } from "./process-recovery-native.js";
-/** This version's causal argument was audited against these installed bytes:
- * up registers a fresh token BEFORE listening; every watch creates a fresh UUID;
- * heartbeat authenticates that closure's token and exact owner transactionally.
- * A new runtime needs its own audit, not a caller assertion of equivalent code. */
-export declare const SERVICE_ANCHOR_RUNTIME_V1_SHA256 = "9641efcb3b46717a7f122aa025e3945a08fa55ca046605276825a9d69eefd01d";
-export type DarwinServiceAnchorInput = {
-    databasePath: string;
-    targetRun: number;
-    anchorReviewerRun: number;
-    runtime: string;
-    runtimeSha256: string;
-    runner: string;
-    repo: string;
-    host: string;
-    bootId: string;
-    resourceCoalitionId: string;
-    service: string;
-    supervisorPid: number;
-    workerPid: number;
-    port: number;
-    /** Full expected arrays; compared privately, never included in a receipt. */
-    supervisorArgv: string[];
-    workerArgv: string[];
-    /** Recovery must prepare this helper itself from the known embedded source;
-     * never accept an executable or this result receipt from a client request. */
-    native: PreparedDarwinProcessCensus;
-    maxWaitMs?: number;
-};
-export type DarwinServiceAnchorReceipt = {
-    schema: 1;
-    kind: "authenticated-watch-continuity";
-    targetRun: number;
-    anchorReviewerRun: number;
-    host: string;
-    bootId: string;
-    observedAt: string;
-    runtimeSha256: string;
-    databasePath: string;
-    runner: string;
-    repo: string;
-    owner: string;
-    generation: number;
-    episode: number;
-    registeredAt: string;
-    heartbeatBefore: string;
-    heartbeatAfter: string;
-    service: string;
-    listener: string;
-    worker: DarwinCoalitionProcessIdentity;
-    supervisor: DarwinCoalitionProcessIdentity;
-    nativeSourceSha256: string;
-    nativeExecutableSha256: string;
-};
-export type DarwinServiceAnchorResult = {
-    ok: true;
-    receipt: DarwinServiceAnchorReceipt;
-} | {
-    ok: false;
-    reason: string;
-};
-export type RecoveryReadDatabase = {
-    prepare(sql: string): {
-        get(...parameters: SQLInputValue[]): Record<string, unknown> | undefined;
-        all(...parameters: SQLInputValue[]): Record<string, unknown>[];
-    };
-};
-/** Trusted read-only collection, not exit evidence. Reads an existing connection
- * (including a schema69 Store.handle), never opens/migrates or writes a database.
- * Under the trusted installed-code/credential model, renewing a saved pre-run
- * UUID while registration stays fixed establishes a pre-run live service bound.
- * It does NOT establish coalition inheritance, survivor exclusion, or authority
- * to clear process custody. Every incomplete observation returns a refusal. */
-export declare function collectDarwinServiceAnchor(db: RecoveryReadDatabase, input: DarwinServiceAnchorInput): Promise<DarwinServiceAnchorResult>;