toolroll 0.9.67 → 0.9.68

package/dist/task-sizing.js

@@ -15,15 +15,14 @@
  * The task text is data to the classifier, never instructions, and all it
  * can return is one of three sizes, a yes/no, and a short reason.
  */
-import { Buffer } from "node:buffer";
 import { randomUUID } from "node:crypto";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { readSizeAnswer, SIZING_MODEL_SCHEMA } from "./contracts/task-sizing.js";
-import { strictJsonParse } from "./converse.js";
 import { redactSecretLines, scanForSecrets } from "./evidence.js";
 import { run, terminateOwnedProcesses } from "./exec.js";
+import { CLAUDE_NO_TOOLS_ARGS, claudeJsonBody } from "./claude-print.js";
 import { JEV_MODEL, JEV_URL } from "./flow-sort.js";
 import { readProviderKey } from "./keys.js";
 import {} from "./phase-routing.js";
@@ -93,13 +92,11 @@ export function claudeSizer(runner = run, model = SIZING_CLAUDE_MODEL, budgetMs
                 sizingText(input),
             ].join("\n");
             const result = await runner("claude", [
-                "-p", "--output-format", "json", "--json-schema", JSON.stringify(SIZING_MODEL_SCHEMA), "--safe-mode", "--no-session-persistence", "--tools", "", "--permission-mode", "dontAsk",
-                "--permission-prompts", "none", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}', "--model", model,
+                "-p", "--output-format", "json", "--json-schema", JSON.stringify(SIZING_MODEL_SCHEMA), ...CLAUDE_NO_TOOLS_ARGS, "--model", model,
             ], { cwd: dir, stdin: prompt, timeoutMs: budgetMs, maxBuffer: 256 * 1024, omitEnv: ALL_CREDENTIAL_ENV, processGroup: true, owner, beforeSpawn: () => !signal.aborted });
             if (signal.aborted || result.notFound || result.timedOut || result.code !== 0)
                 return null;
-            const parsed = strictJsonParse(Buffer.from(result.stdout, "utf8"), 256 * 1024, 12);
-            const body = parsed.ok && typeof parsed.value === "object" && parsed.value !== null && !Array.isArray(parsed.value) ? parsed.value : null;
+            const body = claudeJsonBody(result.stdout, 256 * 1024);
             if (body === null || body["is_error"] === true || body["subtype"] !== "success")
                 return null;
             return answerOf(body["structured_output"]);
@@ -184,10 +181,6 @@ export function installFilingSizer(sizer, budgetMs = SIZING_BUDGET_MS) {
     return () => { installed = previous; budget = previousBudget; };
 }
 let budget = SIZING_BUDGET_MS;
-/** Whether filings in this process are classified. */
-export function filingSizerInstalled() {
-    return installed !== null;
-}
 /**
  * After a filing: ask the classifier (within the budget) and apply its size
  * to the still-unapproved task. Runs in the background; the filing already

package/dist/teams-chat.js

@@ -6,12 +6,11 @@ import { chatAskButtons } from "./chat-ask.js";
 import { ChatDeliveryError, ChatState, chatHash, partContent } from "./chat-delivery-state.js";
 import { channelAccess, chatObject as object, heldForWatch, planChatNotifications, planRoomMessages, processChatEvent, splitChatText } from "./chat-delivery.js";
 import { PLATFORM_LIMITS } from "./text-limits.js";
-import { roomCommand } from "./chat-rooms.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { renderReply } from "./reply-shape.js";
 import { armedCardText, armedYesLabel, proposalLink, proposalOutcomeText, proposalPreview } from "./chat-channel.js";
 import { chatFlowButtons } from "./chat-flow.js";
-import { channelInbox } from "./chat-inbox.js";
+import { admitChatEvent } from "./chat-admission.js";
 import { chatResultHref } from "./chat-controls.js";
 import { TeamsError } from "./teams-api.js";
 import { readTeamsSubmit } from "./contracts/teams-callback.js";
@@ -113,16 +112,10 @@ export function receiveTeams(state, identity, raw, serviceUrlClaim, now) {
             ...(Array.isArray(activity.attachments) && activity.attachments.length > 0 ? { unsupported: "Incoming files are not supported yet. Describe the request in a message; saved result screenshots open from their links." } : {}) };
         eventId = chatHash(`${identity.installation}:message:${id}`);
     }
-    const words = "text" in payload ? payload.text ?? "" : "";
-    // v89: a channel that feeds a flow takes anyone's message (as a card, with no say over anything); "flow 12" connects one.
-    const inbox = isRoom && kind === "message" ? channelInbox(state.store, "teams", identity.installation, channel, words) : { watched: false, command: false };
-    const roomish = isRoom && (state.room(identity.installation, channel) !== null || (kind === "message" && roomCommand(words) !== null) || inbox.watched || inbox.command);
-    if (isRoom && !roomish)
-        return false;
-    const binding = state.bindingFor(identity.installation, member);
-    const open = inbox.watched && !inbox.command;
-    if (kind === "pair" ? !!binding || isRoom : !open && (!binding || !state.live(binding) || (binding.channel !== channel && !roomish)))
+    const admitted = admitChatEvent(state, "teams", identity.installation, { kind, member, channel, isRoom, payload });
+    if (admitted === null)
         return false;
+    const { binding } = admitted;
     return state.store.transact(() => {
         state.setMeta(identity.installation, serviceKey(channel), activity.serviceUrl, now);
         return state.enqueue({

package/dist/teams.js

@@ -4,7 +4,7 @@ import { adapterPolicy } from "./server/route-policy.js";
  * has no client-initiated socket, so inbound activities arrive over HTTPS
  * and everything else runs from the database like the other channels. */
 import { randomBytes } from "node:crypto";
-import { setTimeout as sleep } from "node:timers/promises";
+import { abortablePause, workChatQueue } from "./chat-follow.js";
 import { ChatState } from "./chat-delivery-state.js";
 import { chatObject as object } from "./chat-delivery.js";
 import { loadTeamsCredentials, teamsAccessToken, teamsApi, verifyTeamsToken, TeamsError } from "./teams-api.js";
@@ -78,10 +78,7 @@ export async function handleTeamsHttp(request, response, options) {
 /** The worker-side loop: a lease per installation, one pass a second. */
 export async function followTeams(options) {
     const owner = randomBytes(16).toString("hex"), state = new ChatState(options.store, "teams");
-    const pause = async (ms) => { try {
-        await sleep(ms, undefined, { signal: options.signal });
-    }
-    catch { /* shutdown */ } };
+    const pause = abortablePause(options.signal);
     while (!options.signal.aborted) {
         const credentials = loadTeamsCredentials(options.dir);
         if (!credentials || !state.lease(credentials.installation, owner, new Date())) {
@@ -110,20 +107,16 @@ export async function followTeams(options) {
                 await pause(30_000);
                 continue;
             }
-            while (same()) {
-                if (state.retryAt(credentials.installation) > new Date().toISOString()) {
-                    await pause(1000);
-                    continue;
-                }
-                await processTeamsEvent(chat);
-                if (same())
-                    await planTeamsRooms(chat);
-                if (same())
-                    await deliverTeamsPart(chat);
-                if (same() && options.notifications())
-                    await planTeamsNotifications(chat);
-                await pause(1000);
-            }
+            await workChatQueue({
+                same,
+                ready: () => !(state.retryAt(credentials.installation) > new Date().toISOString()),
+                pause,
+                notifications: () => options.notifications(),
+                process: () => processTeamsEvent(chat),
+                rooms: () => planTeamsRooms(chat),
+                deliver: () => deliverTeamsPart(chat),
+                notify: () => planTeamsNotifications(chat),
+            });
         }
         catch {
             if (alive)

package/dist/telegram-lead.js

@@ -1,5 +1,5 @@
 import { CHAT_ACTIONS, sharedActionAllowsChallenge, sharedActionPayload } from "./chat-actions.js";
-import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
+import { taskInCeiling, mirrorToTaskChat, couldNotAnswerText, channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText } from "./chat-channel.js";
 export { channelRepos as telegramConversationRepos, resolveChannelLead as resolveTelegramLead, tooLongText, whichTaskText, replyContextFor, NO_PHONE_LINK, NO_TASK_LINK, proposalLink, confirmedLink, proposalPreview, proposalOutcomeText, handoffCardText, confirmedCardText, CHAT_ACTION_PARITY as TELEGRAM_ACTION_PARITY, parityGaps } from "./chat-channel.js";
 /**
  * The paired phone as one more way to use the same assistant.
@@ -23,7 +23,7 @@ export { channelRepos as telegramConversationRepos, resolveChannelLead as resolv
  * the console and CLI state), and the door re-proves everything again.
  */
 import { createHash, randomBytes } from "node:crypto";
-import { LEAD_MESSAGE_MAX_CHARS, leadFailureText, runLeadTurn } from "./lead.js";
+import { leadFailureText, runLeadTurn } from "./lead.js";
 import { confirmLeadProposal, dismissLeadProposal } from "./lead-doors.js";
 import { ceilingDigestOf, verifyApproverStanding } from "./principal.js";
 import { LEAD_ASK_OTHER } from "./store.js";

package/dist/telegram.js

@@ -27,7 +27,7 @@ import { chmodSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { closedQuestionWords, validateNote } from "./decision.js";
 import { isShotsKind, resultShotsFor } from "./result-shots.js";
-import { isLifecycleNotification, isTelegramProgressNotification, RESULT_SHOTS_KIND, TELEGRAM_HOLD_REASONS } from "./store.js";
+import { isLifecycleNotification, isTelegramProgressNotification, TELEGRAM_HOLD_REASONS } from "./store.js";
 import { telegramProgressCard } from "./telegram-progress.js";
 import { enqueueEveningDigests, finishedView, isTaskFact, joinsBatch, needsPerson, quietCardView } from "./chat-quiet.js";
 import { BATCH_MS, chatText, chatTitle, factLinkLabel, mentions, nameTelegramBot } from "./chat-voice.js";

package/dist/token-notices.d.ts

@@ -1,10 +1,3 @@
-/**
- * API token notices (v111): 7 days and 1 day before a token expires, its person is told once each, in their own chats
- * and browsers (a personal notification), and the ledger keeps it. Only the nearest notice newly due is sent, so a
- * token made with a day left says so once. Replaced and revoked tokens get none. The same pass records the end of each
- * rotated token whose overlap has passed; it already signs no one in (tokenLive), so a late pass grants nothing.
- */
-import { tokenLive } from "./api-tokens.js";
 import type { Store } from "./store.js";
 export declare const TOKEN_NOTICE_KIND = "api-token-expiry";
 export declare function tokenNoticePass(store: Store, now: Date): {
@@ -14,9 +7,5 @@ export declare function tokenNoticePass(store: Store, now: Date): {
     }[];
     ended: number;
 };
-/** Whether a token's console card warns that it expires soon (within the first notice's days). */
-export declare function expiresSoon(token: Parameters<typeof tokenLive>[0] & {
-    replacedBy: string | null;
-}, now: number): boolean;
 /** The loop beside the console: a pass a minute. */
 export declare function startTokenNotices(store: Store, everyMs?: number): () => void;

package/dist/token-notices.js

@@ -4,7 +4,7 @@
  * token made with a day left says so once. Replaced and revoked tokens get none. The same pass records the end of each
  * rotated token whose overlap has passed; it already signs no one in (tokenLive), so a late pass grants nothing.
  */
-import { expiryNoticeDue, EXPIRY_NOTICE_DAYS, tokenLive } from "./api-tokens.js";
+import { expiryNoticeDue, EXPIRY_NOTICE_DAYS } from "./api-tokens.js";
 export const TOKEN_NOTICE_KIND = "api-token-expiry";
 export function tokenNoticePass(store, now) {
     const ended = store.endRotatedApiTokens(now);
@@ -32,10 +32,6 @@ export function tokenNoticePass(store, now) {
     }
     return { sent, ended };
 }
-/** Whether a token's console card warns that it expires soon (within the first notice's days). */
-export function expiresSoon(token, now) {
-    return expiryNoticeDue(token, now) !== null;
-}
 /** The loop beside the console: a pass a minute. */
 export function startTokenNotices(store, everyMs = 60_000) {
     let stopped = false;

package/dist/tool-secret-store.d.ts

@@ -56,7 +56,6 @@ export declare function detectSecretStore(options?: {
 export declare function chooseSecretStore(store: SecretBackend | "files" | DetectedStore | null): void;
 /** This computer's store (found once), or null for owner-only files. */
 export declare function secretBackend(env?: NodeJS.ProcessEnv): SecretBackend | null;
-export declare const secretStoreKind: () => SecretStoreKind;
 /** Where secrets rest, in the words Settings and `toolroll integrations` share; `problem` when Toolroll's folder can't be used. */
 export declare function secretStorage(): {
     kind: SecretStoreKind;
@@ -166,5 +165,3 @@ export declare function writeSealed(backend: SecretBackend, folder: SecretFolder
 export declare function readHeldSecret(state: string, name: string, file: readonly string[]): string | null;
 /** Keep (or, with null, remove) a held secret: see readHeldSecret. */
 export declare function writeHeldSecret(state: string, name: string, file: readonly string[], value: string | null): void;
-/** Whether a held secret has a value, without reading it where that can be helped. */
-export declare function heldSecretSet(state: string, name: string, file: readonly string[]): boolean;

package/dist/tool-secret-store.js

@@ -32,6 +32,7 @@ import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:
 import { closeSync, constants, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { envValue } from "./names.js";
+import { sleep } from "./sleep.js";
 export class SecretStoreError extends Error {
 }
 /** The words Settings and `toolroll integrations` use for where secrets rest. */
@@ -200,7 +201,6 @@ function currentStore(env) {
 export function secretBackend(env = process.env) {
     return currentStore(env).backend;
 }
-export const secretStoreKind = () => secretBackend()?.kind ?? "files";
 /** Where secrets rest, in the words Settings and `toolroll integrations` share; `problem` when Toolroll's folder can't be used. */
 export function secretStorage() {
     const found = currentStore(process.env);
@@ -701,7 +701,7 @@ export async function withSecretLockAsync(folder, name, work, options = {}) {
     while (!takeLock(lock, options.staleMs ?? 120_000)) {
         if (Date.now() - started > (options.waitMs ?? 120_000))
             throw new SecretStoreError("A sign-in is being renewed elsewhere. Try again in a moment.");
-        await new Promise(resolve => setTimeout(resolve, 25));
+        await sleep(25);
     }
     try {
         return await work();
@@ -823,12 +823,3 @@ export function writeHeldSecret(state, name, file, value) {
             writeSealed(backend, folder, item, value);
     });
 }
-/** Whether a held secret has a value, without reading it where that can be helped. */
-export function heldSecretSet(state, name, file) {
-    try {
-        return readHeldSecret(state, name, file) !== null;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/toolroll-update.d.ts

@@ -162,7 +162,6 @@ export type StartOptions = {
     /** An older version replaces the current one only when asked for by name. */
     allowDowngrade?: boolean;
 };
-declare function nextAt(hhmm: string, now: Date): Date;
 /** Record an update without running it: the console's job resumes exactly this journal id. */
 export declare function prepareRuntimeUpdate(o: StartOptions, now: Date): RuntimeUpdateJournal | {
     refused: string;
@@ -257,4 +256,3 @@ export declare function launchRuntimeUpdate(args: {
 }): Promise<void>;
 /** The job's last act: its definition goes, so nothing can start it again. Only the definition for this id. */
 export declare function retireUpdateJob(id: string, home?: string): void;
-export declare const nextScheduledAt: typeof nextAt;

package/dist/toolroll-update.js

@@ -40,6 +40,7 @@ import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES,
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
+import { sleep } from "./sleep.js";
 /** Loaded on first use (as backup.ts and store.ts do), so modules that only import this one (the console,
  * and tests that load it in a browser-like environment) never need `node:sqlite` itself. */
 function sqlite() {
@@ -1583,7 +1584,7 @@ export function machineSystem(home = homedir(), env = process.env, seams = {}) {
     };
     return {
         now: () => new Date(),
-        sleep: ms => new Promise(done => setTimeout(done, ms)),
+        sleep,
         release: async (version) => {
             const body = await json(`${REGISTRY}/${NAME}/${version}`);
             return { version: String(body.version ?? ""), tarball: String(body.dist?.tarball ?? ""), integrity: String(body.dist?.integrity ?? ""), attestations: body.dist?.attestations?.url ?? null };
@@ -1805,4 +1806,3 @@ export function retireUpdateJob(id, home = homedir()) {
     }
     catch { /* none */ }
 }
-export const nextScheduledAt = nextAt;

package/dist/verification-evidence.d.ts

@@ -2,7 +2,6 @@ import type { Artifact, Store, VerifyCommand } from "./store.js";
 import type { VerifyCommandFacts } from "./proof.js";
 import { type AdjudicateResult } from "./proof.js";
 export declare const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
-export declare const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
 export declare const isVerificationReceipt: (a: Artifact) => boolean;
 export declare function sealVerificationReceipt(store: Store, root: string, runId: number, head: string, command: VerifyCommand, result: VerifyCommandFacts, now: Date, reusedFrom?: {
     run: number;

package/dist/verification-evidence.js

@@ -12,7 +12,6 @@ import { LEGACY_GATE_SOURCE, readVerificationView } from "./contracts/verificati
 import { readCandidateEndpoints, savedInventoryPaths } from "./contracts/diff-stat.js";
 import { liveQuickCommand, quickVerifyKey, runCheckLevel } from "./check-levels.js";
 export const VERIFICATION_RECEIPT_CAPTURE = "machine verification receipt v1";
-export const REVIEW_GATE_NAME = "REVIEW-VERIFICATION.json";
 const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 const binding = (a) => ({ artifactId: a.id, sha256: a.sha256, bytesStored: a.bytesStored, bytesOriginal: a.bytesOriginal, truncated: a.truncated, redacted: a.redacted, captureStatus: a.captureStatus });
 export const isVerificationReceipt = (a) => a.kind === "structured-output" && (a.capture === VERIFICATION_RECEIPT_CAPTURE || a.capture === "machine verification reuse v1");

package/dist/webhooks.d.ts

@@ -6,7 +6,6 @@ export type WebhookTarget = {
 };
 export declare const LEGACY_WEBHOOK_WARNING = "Legacy webhooks are deprecated. Connect Slack or Discord in Chat settings.";
 export declare const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
-export declare const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
 export type MessagingChannel = "telegram" | "slack" | "discord" | "teams";
 export declare const MESSAGING_CHANNELS: readonly MessagingChannel[];
 export declare function isMessagingChannel(value: string): value is MessagingChannel;

package/dist/webhooks.js

@@ -17,7 +17,6 @@ const FILE_OF = { slack: "slack-webhook", discord: "discord-webhook" };
 const POST_TIMEOUT_MS = 10_000;
 export const LEGACY_WEBHOOK_WARNING = "Legacy webhooks are deprecated. Connect Slack or Discord in Chat settings.";
 export const CONSOLE_URL_ENV = "TOOLROLL_CONSOLE_URL";
-export const PRIMARY_ENV = "TOOLROLL_MESSAGING_PRIMARY";
 const CONSOLE_FILE = "console-url";
 const PRIMARY_FILE = "messaging-primary";
 export const MESSAGING_CHANNELS = ["telegram", "slack", "discord", "teams"];

package/dist/workspace-ui.d.ts

@@ -261,14 +261,6 @@ export declare function workStatusOf(facts: WorkFacts, resultDisplay?: DisplaySt
 export declare function workCounts(rows: readonly {
     views: readonly WorkView[];
 }[]): Record<WorkView, number>;
-/** All's order: rank, then most recently updated. */
-export declare function compareWorkRows(a: {
-    rank: number;
-    updatedAt: string;
-}, b: {
-    rank: number;
-    updatedAt: string;
-}): number;
 /** The shell's three primary destinations, from the page's own active
  * key: every old page keeps its key and lights the destination it now
  * lives under. */

package/dist/workspace-ui.js

@@ -18,7 +18,7 @@
  */
 import { ACCEPT_NEEDS_REASON, FAILED_CHECK, cantAcceptYetOf, evidenceProblemOf } from "./result-acts.js";
 export { ACCEPT_NEEDS_REASON, cantAcceptYetOf, evidenceProblemOf };
-import { GOAL_ASSESSMENT_PENDING, manualReviewOnly, plainReasonWords } from "./proof.js";
+import { manualReviewOnly, plainReasonWords } from "./proof.js";
 import { OPEN_RESULT, plainReasonOf, stageOfCode, taskStatusOf, workToneOf } from "./task-status.js";
 import { whenUtc } from "./when-html.js";
 import { html, postForm } from "./html.js";
@@ -54,7 +54,6 @@ export function reviewFactsOf(retry, reviewerAlive, automaticPending = false) {
 }
 /** The tokens a review in flight wears — the dispatch codes, unchanged. */
 export const REVIEW_TOKENS = new Set(["reviewing", "review-pending", "review-failed", "review-exhausted"]);
-const retriesLeft = (count, explicit = true) => `${count}${explicit ? " explicit" : ""} ${count === 1 ? "retry" : "retries"}`;
 /**
  * A review that is queued, running, failed with a retry left, or
  * exhausted is the result's PRIMARY status — the machine is still
@@ -504,10 +503,6 @@ export function workCounts(rows) {
             counts[view] += 1;
     return counts;
 }
-/** All's order: rank, then most recently updated. */
-export function compareWorkRows(a, b) {
-    return a.rank - b.rank || (a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0);
-}
 const WORK_KEYS = new Set(["inbox", "board", "queue", "work", "done", "activity", "review", "tasks", "runs", "workbench", "recipes", "ledger"]);
 const SETTINGS_KEYS = new Set(["fleet", "caps", "people", "mode", "system", "settings"]);
 export function primaryDestinationOf(active) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.67",
+  "version": "0.9.68",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"

package/dist/contracts/native-census.d.ts

@@ -1,42 +0,0 @@
-/**
- * The macOS process census the recovery helper prints (docs/plans/zod-revamp.md, item 19): `schema: 1`, the boot,
- * the collector, and one identity per process. The parser in process-recovery-native.ts reads it with these schemas
- * and keeps its fail-closed reason codes: a top-level problem is `malformed-native-census`, one in a process row
- * `malformed-process-identity`. Duplicate pids and unique ids, the 64-bit bound on ids and completeness run in plain
- * code after parsing. Unknown keys are dropped, and each identity is rebuilt in its sealed key order.
- */
-import { z } from "zod";
-export declare const NATIVE_CENSUS_ERRORS: readonly ["kernel-process-table-unreadable", "process-membership-unreadable", "process-identity-unreadable", "boot-identity-unreadable", "coalition-counters-unreadable", "coalition-counters-changed", "coalition-count-mismatch", "anchor-identity-unreadable"];
-export declare const darwinProcessIdentitySchema: z.ZodObject<{
-    pid: z.ZodInt;
-    ppid: z.ZodNullable<z.ZodInt>;
-    uid: z.ZodNullable<z.ZodInt>;
-    birthMs: z.ZodNullable<z.ZodNumber>;
-    uniqueId: z.ZodNullable<z.ZodString>;
-    parentUniqueId: z.ZodNullable<z.ZodString>;
-    traced: z.ZodNullable<z.ZodBoolean>;
-    executable: z.ZodNullable<z.ZodString>;
-    originalParentVersion: z.ZodNullable<z.ZodInt>;
-    pidVersion: z.ZodExactOptional<z.ZodInt>;
-}, z.core.$strip>;
-export type DarwinProcessIdentity = z.infer<typeof darwinProcessIdentitySchema>;
-/** Top level only: process rows are read one by one, so a bad row gets its own reason. */
-export declare const darwinNativeCensusSchema: z.ZodObject<{
-    schema: z.ZodLiteral<1>;
-    bootId: z.ZodNullable<z.ZodString>;
-    collectorPid: z.ZodInt;
-    complete: z.ZodBoolean;
-    processes: z.ZodArray<z.ZodUnknown>;
-    errors: z.ZodArray<z.ZodEnum<{
-        "anchor-identity-unreadable": "anchor-identity-unreadable";
-        "boot-identity-unreadable": "boot-identity-unreadable";
-        "coalition-count-mismatch": "coalition-count-mismatch";
-        "coalition-counters-changed": "coalition-counters-changed";
-        "coalition-counters-unreadable": "coalition-counters-unreadable";
-        "kernel-process-table-unreadable": "kernel-process-table-unreadable";
-        "process-identity-unreadable": "process-identity-unreadable";
-        "process-membership-unreadable": "process-membership-unreadable";
-    }>>;
-}, z.core.$strip>;
-/** A kernel id within 64 bits (the schema checks the digits). */
-export declare const kernelIdInRange: (id: string) => boolean;

package/dist/contracts/native-census.js

@@ -1,36 +0,0 @@
-/**
- * The macOS process census the recovery helper prints (docs/plans/zod-revamp.md, item 19): `schema: 1`, the boot,
- * the collector, and one identity per process. The parser in process-recovery-native.ts reads it with these schemas
- * and keeps its fail-closed reason codes: a top-level problem is `malformed-native-census`, one in a process row
- * `malformed-process-identity`. Duplicate pids and unique ids, the 64-bit bound on ids and completeness run in plain
- * code after parsing. Unknown keys are dropped, and each identity is rebuilt in its sealed key order.
- */
-import { z } from "zod";
-export const NATIVE_CENSUS_ERRORS = ["kernel-process-table-unreadable", "process-membership-unreadable", "process-identity-unreadable", "boot-identity-unreadable", "coalition-counters-unreadable", "coalition-counters-changed", "coalition-count-mismatch", "anchor-identity-unreadable"];
-/** A kernel unique id: a decimal unsigned 64-bit integer as text (the bound itself is checked after parsing). */
-const kernelId = z.string().regex(/^(0|[1-9][0-9]{0,19})$/);
-const count = z.int().min(0);
-const version32 = z.int().min(0).max(0xffffffff);
-export const darwinProcessIdentitySchema = z.object({
-    pid: z.int().min(1),
-    ppid: count.nullable(),
-    uid: count.nullable(),
-    birthMs: z.number().positive().nullable(),
-    uniqueId: kernelId.nullable(),
-    parentUniqueId: kernelId.nullable(),
-    traced: z.boolean().nullable(),
-    executable: z.string().max(4096).regex(/^[^\x00-\x1f\x7f]*$/).nullable(),
-    originalParentVersion: version32.nullable(),
-    pidVersion: version32.exactOptional(),
-});
-/** Top level only: process rows are read one by one, so a bad row gets its own reason. */
-export const darwinNativeCensusSchema = z.object({
-    schema: z.literal(1),
-    bootId: z.string().regex(/^[a-fA-F0-9-]{36}$/).nullable(),
-    collectorPid: z.int().min(2),
-    complete: z.boolean(),
-    processes: z.array(z.unknown()).max(100_000),
-    errors: z.array(z.enum(NATIVE_CENSUS_ERRORS)),
-});
-/** A kernel id within 64 bits (the schema checks the digits). */
-export const kernelIdInRange = (id) => BigInt(id) <= 0xffffffffffffffffn;

package/dist/process-recovery-anchor.d.ts

@@ -1,75 +0,0 @@
-import type { SQLInputValue } from "node:sqlite";
-import type { DarwinCoalitionProcessIdentity, PreparedDarwinProcessCensus } from "./process-recovery-native.js";
-/** This version's causal argument was audited against these installed bytes:
- * up registers a fresh token BEFORE listening; every watch creates a fresh UUID;
- * heartbeat authenticates that closure's token and exact owner transactionally.
- * A new runtime needs its own audit, not a caller assertion of equivalent code. */
-export declare const SERVICE_ANCHOR_RUNTIME_V1_SHA256 = "9641efcb3b46717a7f122aa025e3945a08fa55ca046605276825a9d69eefd01d";
-export type DarwinServiceAnchorInput = {
-    databasePath: string;
-    targetRun: number;
-    anchorReviewerRun: number;
-    runtime: string;
-    runtimeSha256: string;
-    runner: string;
-    repo: string;
-    host: string;
-    bootId: string;
-    resourceCoalitionId: string;
-    service: string;
-    supervisorPid: number;
-    workerPid: number;
-    port: number;
-    /** Full expected arrays; compared privately, never included in a receipt. */
-    supervisorArgv: string[];
-    workerArgv: string[];
-    /** Recovery must prepare this helper itself from the known embedded source;
-     * never accept an executable or this result receipt from a client request. */
-    native: PreparedDarwinProcessCensus;
-    maxWaitMs?: number;
-};
-export type DarwinServiceAnchorReceipt = {
-    schema: 1;
-    kind: "authenticated-watch-continuity";
-    targetRun: number;
-    anchorReviewerRun: number;
-    host: string;
-    bootId: string;
-    observedAt: string;
-    runtimeSha256: string;
-    databasePath: string;
-    runner: string;
-    repo: string;
-    owner: string;
-    generation: number;
-    episode: number;
-    registeredAt: string;
-    heartbeatBefore: string;
-    heartbeatAfter: string;
-    service: string;
-    listener: string;
-    worker: DarwinCoalitionProcessIdentity;
-    supervisor: DarwinCoalitionProcessIdentity;
-    nativeSourceSha256: string;
-    nativeExecutableSha256: string;
-};
-export type DarwinServiceAnchorResult = {
-    ok: true;
-    receipt: DarwinServiceAnchorReceipt;
-} | {
-    ok: false;
-    reason: string;
-};
-export type RecoveryReadDatabase = {
-    prepare(sql: string): {
-        get(...parameters: SQLInputValue[]): Record<string, unknown> | undefined;
-        all(...parameters: SQLInputValue[]): Record<string, unknown>[];
-    };
-};
-/** Trusted read-only collection, not exit evidence. Reads an existing connection
- * (including a schema69 Store.handle), never opens/migrates or writes a database.
- * Under the trusted installed-code/credential model, renewing a saved pre-run
- * UUID while registration stays fixed establishes a pre-run live service bound.
- * It does NOT establish coalition inheritance, survivor exclusion, or authority
- * to clear process custody. Every incomplete observation returns a refusal. */
-export declare function collectDarwinServiceAnchor(db: RecoveryReadDatabase, input: DarwinServiceAnchorInput): Promise<DarwinServiceAnchorResult>;