wicked-crew-api-types 0.106.0 → 0.108.0

package/index.d.ts

@@ -5158,11 +5158,12 @@ export interface SystemSettings {
   baseSkillPolicy?: 'warn' | 'require';
   /**
    * The DELIVER IDENTITY (crew#549; additive): the GitHub login the deliver phase must push as.
-   * The deliver script reads `gh api user` AND asks git which credential it would use for the
-   * remote's host, and REFUSES — before anything is staged, committed or pushed — when either
-   * disagrees with this login (or, with nothing configured, when those two disagree with each
-   * other). `''`/absent ⇒ the `GH_ACCOUNT` env var decides, and unset there means the phase
-   * pushes as whatever login gh holds, said aloud on the gate card.
+   * (crew#940) On a github.com origin the deliver script reads THIS login's own token from gh's
+   * keyring and uses it for its gh calls and its git fetch/push alone, whatever account gh has
+   * active; a login gh holds no token for is "GitHub credentials not configured", refused before
+   * anything is staged. An exported `GH_TOKEN` wins, and is refused when it authenticates as
+   * another login. `''`/absent ⇒ the `GH_ACCOUNT` env var decides, and unset there means the phase
+   * pushes as whatever login gh holds (git's credential cross-checked), said aloud on the gate card.
    *
    * A LOGIN ONLY — never a token. The credential itself stays in gh's keyring or in the daemon's
    * `GH_TOKEN`; `GET /settings` returns this login and no secret ever.
@@ -5395,6 +5396,9 @@ export interface RunInventoryResponse {
 export interface PresetStep {
   catalog: string;
   id: string;
+  /** (crew#928, wicked-core#854) The step changes no file in the run's tree; see
+   *  {@link TeamPlanStep.writes_nothing}. */
+  writes_nothing?: boolean;
   [k: string]: unknown;
 }
 
@@ -7197,7 +7201,8 @@ export interface DiagnosticsSkillsFinding {
    *  an `error` under `'require'` (the engine refuses every launch at intake); cleared by a publish
    *  that hands it. Also carried as `DiagnosticsSkills.baseSkill.finding`; `skills.phase-skill`
    *  (`warning`, crew#661) = a subsystem's phases declare a skill the published snapshot did not hold
-   *  when it armed, so they run without it — one per `DiagnosticsSkills.phaseSkillGaps` entry;
+   *  when it armed, so they run without it — one per `DiagnosticsSkills.phaseSkillGaps` entry (none
+   *  since crew#935);
    *  `skills.garden` (`error`, api-types 0.78.0, crew#753) = the installed wicked-garden is older
    *  than the daemon requires (`GardenRequiredBody.required`), so it is not used: found at seed,
    *  the runtime is `config-error` and the engine is handed a refusal path. Rides
@@ -7274,7 +7279,9 @@ export interface DiagnosticsSkills {
   /** Subsystems whose phases run WITHOUT a skill their workflow declares (crew#661; additive) — one
    *  entry per subsystem, judged when that seam ARMED (the decision holds until the daemon restarts).
    *  Each entry also rides `findings` as a `skills.phase-skill` warning. `[]` when every armed seam
-   *  holds its skill; ABSENT on a daemon before this field (read it as unknown, not as `[]`). */
+   *  holds its skill; ABSENT on a daemon before this field (read it as unknown, not as `[]`). Always
+   *  `[]` from a daemon carrying crew#935: the interactive seams launch wicked-core's presets, which
+   *  always run their skill (a snapshot without it fails the run), so no seam arms without it. */
   phaseSkillGaps?: DiagnosticsPhaseSkillGap[];
 }
 
@@ -8132,8 +8139,36 @@ export interface TeamPlanStep {
    *  phase's pool; a raise is refused (`wicked.team.plan.refused`, reason `pool_raised`). Omitted
    *  when unset. */
   pool?: number;
+  /** (crew#928, wicked-core#854) The step changes no file in the run's tree (capture-learnings'
+   *  `capture`, steering-author's `propose`). A plan whose every creator step sets it, and that has
+   *  no `run` step, may be scoped `SCOPE {"touch":[]}`, which scores 0. Set on a code phase it is
+   *  refused (`writes_nothing_on_code`). Omitted when unset. */
+  writes_nothing?: boolean;
 }
 
+/**
+ * The stable token of a plan-rule refusal (wicked-core `PlanRefusal::reason`). A refusal formatted
+ * by the engine's `PlanRefusal` reads `<token>: <detail>`; a skin matches the token, never the
+ * prose. NOT every `plan.refused` reason is one: some are plain text (an auto-mode floor override,
+ * a held edit the run ended before applying), and a launch / preview / `propose_plan` error message
+ * CONTAINS the refusal text behind a context prefix (`the plan is refused: <token>: …`), so search
+ * for the token rather than splitting on the first `:`. Open-ended: the engine may add tokens.
+ *
+ *  - `pool_raised` (crew#894, wicked-core#810): a step raised its phase's pool.
+ *  - `writes_nothing_on_code` (crew#928, wicked-core#854): `writes_nothing: true` on a step whose
+ *    phase executes code.
+ *  - `security_review_on_non_code_plan` (crew#928, wicked-core#846/#854): a `security_review` in a
+ *    plan where no step does code work; its diff evidence floor could never pass. The detail names
+ *    the step and either the held testing rule that added it (`rule TST-1002 requires it`) or `the
+ *    plan authored it`. Raised mid-run (a rule fired by the diff re-score) it FAILS the run, and
+ *    the run's error text carries the rule.
+ */
+export type PlanRefusalToken =
+  | 'pool_raised'
+  | 'writes_nothing_on_code'
+  | 'security_review_on_non_code_plan'
+  | (string & {});
+
 export interface TeamPlanOverride {
   remove: string[];
   reason: string;
@@ -8216,8 +8251,11 @@ export type TeamPlanAcceptedPayload = TeamEnvelope & {
 export type TeamPlanRefusedPayload = TeamEnvelope & {
   proposal_id: string;
   base_rev: number | null;
-  /** The engine's refusal reason, verbatim — e.g. `pool_raised` (crew#894, wicked-core#810: a plan
-   *  step raised a phase's `pool`; a step may only lower it). */
+  /** The engine's refusal reason, verbatim. A plan-rule refusal reads `<token>: <detail>` with a
+   *  {@link PlanRefusalToken} — e.g. `pool_raised` (crew#894, wicked-core#810: a plan step raised a
+   *  phase's `pool`; a step may only lower it), `security_review_on_non_code_plan` or
+   *  `writes_nothing_on_code` (crew#928); other reasons are plain text. A launch / preview /
+   *  `propose_plan` error message contains the same text behind a context prefix. */
   reason: string;
 };
 
@@ -10050,7 +10088,8 @@ export type EditorPermission =
  * fetched at `entry_url` (`GET /editors/:id/:version/entry`, the §8.2 headers, re-hashed per serve).
  * First-party editors ship inside studio's bundle (`<studio dist>/editors/<id>/editor.json` +
  * `index.html`, ids `wicked-*`) and are discovered at boot; third-party editors arrive as garden
- * packs and cannot be installed before the install-time conformance run (EP-C8).
+ * packs (`source: 'pack'`), installed by the operator once garden's `pack check` and the
+ * install-time conformance run have both passed.
  */
 export interface EditorView {
   id: string;
@@ -10069,20 +10108,52 @@ export interface EditorView {
   bytes: number;
   first_party: boolean;
   enabled: boolean;
-  source: 'studio-bundle';
+  /** `studio-bundle`: first-party, shipped with studio. `pack`: a third-party pack the operator installed. */
+  source: 'studio-bundle' | 'pack';
   entry_url: string;
 }
 
 /** `GET /editors` (operator+). */
 export interface ListEditorsResponse {
   editors: EditorView[];
-  /** Why `POST /editors` answers 501 today: third-party installs wait on EP-C8. */
-  installs: 'refused_until_conformance';
+  /** `conformance_required`: `POST /editors` installs a pack only after garden's `pack check` and the
+   *  install-time conformance run pass (`refused_until_conformance` before the install surface: every install was refused). */
+  installs: 'conformance_required' | 'refused_until_conformance';
 }
 
 /** `POST /editors` body (human-only): a pack directory holding `wicked-pack.json`. */
 export interface InstallEditorBody {
   packRoot: string;
+  /** Install it on (the default; an update keeps the editor's current switch) or off. */
+  enabled?: boolean;
+}
+
+/** `POST /editors` → 200: the pack's editors are installed (or updated in place) and listed. */
+export interface InstallEditorResponse {
+  installed: true;
+  /** The pack was installed before; its editors were replaced (a new hash asks for its grants again). */
+  updated: boolean;
+  editors: EditorView[];
+  check: PackCheckResult;
+  conformance: EditorConformanceSummary;
+}
+
+/** What the install-time conformance run found (garden `scripts/editor/conformance.py`). */
+export interface EditorConformanceSummary {
+  ok: boolean;
+  at: string;
+  /** Per editor: the version and entry sha256 the run tested (an install requires both to be the installed ones). */
+  editors: Array<{ id: string; version: string; sha256: string; ok: boolean; cases: Record<string, { ok: boolean }>; gaps: string[] }>;
+  /** Set when the run could not happen (no headless browser, no garden with the runner). */
+  error?: string;
+}
+
+/** `POST /editors` → 422 when the conformance run failed or could not run (fail closed). */
+export interface InstallEditorNotConformant {
+  code: 'editor_not_conformant' | 'conformance_unavailable';
+  error: string;
+  check: PackCheckResult;
+  conformance: EditorConformanceSummary;
 }
 
 /** One finding of garden's `pack check --json`. */
@@ -10101,11 +10172,12 @@ export interface PackCheckResult {
 }
 
 /**
- * `POST /editors` → 501: the pack passed garden's gate, and this is what the install WOULD ask the
- * operator to approve (§3.2 "Add these") once third-party installs open (EP-C8). Nothing was written.
+ * `POST /editors` → 501: the pack passed garden's gate but also ships skills or blocks, whose own
+ * approval (§3.2 "Add these") is not built yet; this is what it would ask the operator to approve.
+ * Nothing was written. (`third_party_editors_not_available` before the install surface: every pack was refused.)
  */
 export interface InstallEditorRefusal {
-  code: 'third_party_editors_not_available';
+  code: 'pack_ships_skills_or_blocks' | 'third_party_editors_not_available';
   error: string;
   check: PackCheckResult;
   pack: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-crew-api-types",
-  "version": "0.106.0",
+  "version": "0.108.0",
   "description": "The wire contract of the wicked-crew daemon's /api/v1 REST surface and /ws CoreEvent frames \u2014 types only, zero runtime",
   "type": "module",
   "types": "./index.d.ts",