wicked-crew 0.7.40 → 0.7.46

package/dist/core/bus.d.ts

@@ -0,0 +1,99 @@
+/**
+ * THE CREW BUS (wicked-core#631) — every bus row in-daemon crew code writes or reads goes through
+ * the ENGINE that holds the bus.
+ *
+ * The daemon's bus file is the engine's (DES-TEAMING-002 T0): the engine opens it once, through its
+ * bundled SQLite, and never closes it. A second SQLite library in the same process cannot share that
+ * file safely: POSIX locks belong to the process, so two libraries do not exclude each other's
+ * writes, and a close in either drops the other's locks (sqlite.org/howtocorrupt.html §2.2.1,
+ * F-E2E-021). So crew holds no SQLite library at all. It emits with `Core.busEmit` and reads with
+ * `Core.busRead`; the engine is the one writer and the one reader on its bus.
+ *
+ * The adapter attaches its engine to the bus file it handed it (`attachEngineBus`), and each seam
+ * names the bus it uses by path. A seam whose bus no engine holds cannot arm: it throws, and the
+ * seam logs and disables itself. tests/bus-no-write.test.ts fails the build if in-daemon code
+ * names a SQLite library or wicked-bus.
+ */
+/** The engine's two bus calls (wicked-core-ts `Core.busEmit` / `Core.busRead`). */
+export interface EngineBus {
+    busEmit(eventJson: string): Promise<number>;
+    busRead(afterId: number, limit: number, typePrefix?: string | null, includeExpired?: boolean | null): Promise<string>;
+}
+/** One row, as wicked-bus `emit` takes it. */
+export interface BusRow {
+    event_type: string;
+    domain: string;
+    subdomain?: string;
+    payload: unknown;
+    idempotency_key?: string;
+    producer_id?: string;
+    /** Per-event TTL in whole hours (wicked-bus `emit`'s override); default the bus config's. */
+    ttl_hours?: number;
+}
+/** One `events` row as the engine reads it back: every column the file has, `payload` parsed
+ *  (the stored string when it is not JSON). */
+export interface BusEvent {
+    event_id: number;
+    event_type: string;
+    domain: string;
+    subdomain: string;
+    payload: unknown;
+    idempotency_key: string;
+    emitted_at: number;
+    [k: string]: unknown;
+}
+/** Test seam only: the bus for a path no engine is attached to (tests/setup/bus-double.ts). */
+export declare const busTesting: {
+    unattached: ((dbPath: string) => EngineBus) | undefined;
+};
+/** The engine at `dbPath` serves every seam that names that bus (the adapter, once its engine is up). */
+export declare function attachEngineBus(dbPath: string, engine: EngineBus): void;
+/** Undo {@link attachEngineBus} (the adapter, on close) — only if `engine` is still the one attached. */
+export declare function detachEngineBus(dbPath: string, engine: EngineBus): void;
+/** The resolved path of the bus at `dbPath` when an engine holds it; throws when none does (a seam
+ *  checks this at arm time, so a seam with no bus disables itself before arming anything). */
+export declare function requireEngineBus(dbPath: string | undefined): string;
+/**
+ * Emit one row on the bus at `dbPath`. Resolves to the row's `event_id`; a key already on the bus
+ * resolves to the existing row's id (the engine's dedup: success, as wicked-bus's WB-002 was).
+ * Rejects when no engine holds the bus or the engine refuses the row (`WB-001 …`).
+ */
+export declare function emitOnBus(dbPath: string, row: BusRow): Promise<number>;
+/**
+ * Every row on the bus at `dbPath` whose type starts with `typePrefix`, oldest first. `history:
+ * true` includes rows past their TTL: the daemon's bus is never swept, so an expired row is still
+ * the record (the activity feed, the team route); a live consumer leaves it off.
+ */
+export declare function readBus(dbPath: string, typePrefix: string, opts?: {
+    history?: boolean;
+}): Promise<BusEvent[]>;
+export interface BusTapOptions {
+    /** The bus db (the one the daemon handed its engine). */
+    dbPath: string | undefined;
+    /** `<prefix>.**` or an exact type, optionally `@<domain>` (`wicked.interactive.**`, `wicked.qe.**`, …). */
+    filter: string;
+    /** Poll cadence, ms. */
+    pollIntervalMs?: number | undefined;
+    /** Called once per matching row, in order; awaited before the next row. */
+    handler: (event: BusEvent) => void | Promise<void>;
+    /** A failed read (`event` null) or a failed handler (the row). Never retried; the cursor moves on. */
+    onError?: ((err: Error, event?: BusEvent | null) => void) | undefined;
+}
+export interface BusTap {
+    /** The bus file this tap reads. */
+    readonly dbPath: string;
+    /** Stop polling; resolves once an in-flight handler has returned. */
+    stop(): Promise<void>;
+}
+/**
+ * Arm a tap: poll the engine's bus from its newest row (rows already on the bus are history, as
+ * wicked-bus's `latest` cursor treated them), cursor in memory, handing each matching row to the
+ * handler in order. Rejects when no engine holds the bus or the filter is not one crew supports
+ * (the caller logs and disables its seam); a failed read goes to `onError` and the next poll
+ * retries it. A
+ * restart starts at the newest row again, so rows emitted while the daemon was down are not
+ * delivered; a failed handler is not retried. A bus file replaced under the same path is followed:
+ * the engine answers cursor 0 and the tap reads the new file from its first row.
+ */
+export declare function tapBus(opts: BusTapOptions): Promise<BusTap>;
+//# sourceMappingURL=bus.d.ts.map

package/dist/core/bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bus.d.ts","sourceRoot":"","sources":["../../src/core/bus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,mFAAmF;AACnF,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvH;AAED,8CAA8C;AAC9C,MAAM,WAAW,MAAM;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;+CAC+C;AAC/C,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAaD,+FAA+F;AAC/F,eAAO,MAAM,UAAU,EAAE;IAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,GAAG,SAAS,CAAA;CAEjF,CAAC;AAEF,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAEvE;AAED,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAGvE;AAED;8FAC8F;AAC9F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGnE;AAaD;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E;AAQD;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CASvH;AAsBD,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,2GAA2G;IAC3G,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,sGAAsG;IACtG,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvE;AAED,MAAM,WAAW,MAAM;IACrB,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA2DjE"}

package/dist/core/bus.js

@@ -0,0 +1,176 @@
+/**
+ * THE CREW BUS (wicked-core#631) — every bus row in-daemon crew code writes or reads goes through
+ * the ENGINE that holds the bus.
+ *
+ * The daemon's bus file is the engine's (DES-TEAMING-002 T0): the engine opens it once, through its
+ * bundled SQLite, and never closes it. A second SQLite library in the same process cannot share that
+ * file safely: POSIX locks belong to the process, so two libraries do not exclude each other's
+ * writes, and a close in either drops the other's locks (sqlite.org/howtocorrupt.html §2.2.1,
+ * F-E2E-021). So crew holds no SQLite library at all. It emits with `Core.busEmit` and reads with
+ * `Core.busRead`; the engine is the one writer and the one reader on its bus.
+ *
+ * The adapter attaches its engine to the bus file it handed it (`attachEngineBus`), and each seam
+ * names the bus it uses by path. A seam whose bus no engine holds cannot arm: it throws, and the
+ * seam logs and disables itself. tests/bus-no-write.test.ts fails the build if in-daemon code
+ * names a SQLite library or wicked-bus.
+ */
+import { resolve } from 'node:path';
+/** Rows per read: a burst drains over a few polls instead of one unbounded read. */
+const BATCH = 500;
+const engines = new Map();
+/** Test seam only: the bus for a path no engine is attached to (tests/setup/bus-double.ts). */
+export const busTesting = {
+    unattached: undefined,
+};
+/** The engine at `dbPath` serves every seam that names that bus (the adapter, once its engine is up). */
+export function attachEngineBus(dbPath, engine) {
+    engines.set(resolve(dbPath), engine);
+}
+/** Undo {@link attachEngineBus} (the adapter, on close) — only if `engine` is still the one attached. */
+export function detachEngineBus(dbPath, engine) {
+    const key = resolve(dbPath);
+    if (engines.get(key) === engine)
+        engines.delete(key);
+}
+/** The resolved path of the bus at `dbPath` when an engine holds it; throws when none does (a seam
+ *  checks this at arm time, so a seam with no bus disables itself before arming anything). */
+export function requireEngineBus(dbPath) {
+    engineFor(dbPath);
+    return resolve(dbPath);
+}
+/** The engine holding the bus at `dbPath`; throws when there is none. */
+function engineFor(dbPath) {
+    if (dbPath === undefined)
+        throw new Error('no bus named (the daemon hands each seam its engine bus)');
+    const key = resolve(dbPath);
+    const engine = engines.get(key) ?? busTesting.unattached?.(key);
+    if (engine === undefined) {
+        throw new Error(`no engine holds the bus at ${key} (the engine was handed no bus, or another one)`);
+    }
+    return engine;
+}
+/**
+ * Emit one row on the bus at `dbPath`. Resolves to the row's `event_id`; a key already on the bus
+ * resolves to the existing row's id (the engine's dedup: success, as wicked-bus's WB-002 was).
+ * Rejects when no engine holds the bus or the engine refuses the row (`WB-001 …`).
+ */
+export async function emitOnBus(dbPath, row) {
+    return engineFor(dbPath).busEmit(JSON.stringify(row));
+}
+/** One page of rows after `afterId` whose type starts with `typePrefix` (live ones unless
+ *  `includeExpired`). */
+async function readPage(engine, afterId, typePrefix, includeExpired = false) {
+    return JSON.parse(await engine.busRead(afterId, BATCH, typePrefix, includeExpired));
+}
+/**
+ * Every row on the bus at `dbPath` whose type starts with `typePrefix`, oldest first. `history:
+ * true` includes rows past their TTL: the daemon's bus is never swept, so an expired row is still
+ * the record (the activity feed, the team route); a live consumer leaves it off.
+ */
+export async function readBus(dbPath, typePrefix, opts = {}) {
+    const engine = engineFor(dbPath);
+    const out = [];
+    for (let after = 0;;) {
+        const page = await readPage(engine, after, typePrefix, opts.history === true);
+        out.push(...page.rows);
+        if (page.rows.length < BATCH || page.next <= after)
+            return out;
+        after = page.next;
+    }
+}
+/**
+ * A tap filter: `<prefix>.**` (every type under the prefix) or `<type>` (exactly that type), either
+ * with an optional `@<domain>` (only that publisher) — the two wicked-bus filter forms crew's seams
+ * use, meaning what they mean to wicked-bus `matchesFilter`. Any other form throws at arm.
+ */
+function compileFilter(filter) {
+    const at = filter.indexOf('@');
+    const type = at === -1 ? filter : filter.slice(0, at);
+    const domain = at === -1 ? '' : filter.slice(at + 1);
+    const ofDomain = (e) => domain === '' || e.domain === domain;
+    if (type.endsWith('.**') && !type.slice(0, -3).includes('*')) {
+        const typePrefix = type.slice(0, -2);
+        return { typePrefix, matches: (e) => ofDomain(e) && e.event_type.length > typePrefix.length };
+    }
+    if (type !== '' && !type.includes('*')) {
+        return { typePrefix: type, matches: (e) => ofDomain(e) && e.event_type === type };
+    }
+    throw new Error(`unsupported bus filter ${JSON.stringify(filter)} (use <prefix>.** or an exact type, optionally @<domain>)`);
+}
+/**
+ * Arm a tap: poll the engine's bus from its newest row (rows already on the bus are history, as
+ * wicked-bus's `latest` cursor treated them), cursor in memory, handing each matching row to the
+ * handler in order. Rejects when no engine holds the bus or the filter is not one crew supports
+ * (the caller logs and disables its seam); a failed read goes to `onError` and the next poll
+ * retries it. A
+ * restart starts at the newest row again, so rows emitted while the daemon was down are not
+ * delivered; a failed handler is not retried. A bus file replaced under the same path is followed:
+ * the engine answers cursor 0 and the tap reads the new file from its first row.
+ */
+export async function tapBus(opts) {
+    const engine = engineFor(opts.dbPath);
+    const dbPath = resolve(opts.dbPath);
+    const { typePrefix, matches } = compileFilter(opts.filter);
+    let stopped = false;
+    let inFlight = null;
+    const report = (err, event) => {
+        opts.onError?.(err instanceof Error ? err : new Error(String(err)), event);
+    };
+    // Where the tap starts: the bus tail as of arming. `null` until that read succeeds — a failed
+    // first read is reported and retried by the next poll, never a guessed start.
+    let cursor = null;
+    const start = async () => {
+        try {
+            cursor = JSON.parse(await engine.busRead(0, 0, null)).next;
+        }
+        catch (err) {
+            report(err, null);
+        }
+    };
+    await start();
+    const poll = async () => {
+        if (cursor === null)
+            return start();
+        let page;
+        try {
+            page = await readPage(engine, cursor, typePrefix);
+        }
+        catch (err) {
+            report(err, null);
+            return;
+        }
+        for (const row of page.rows) {
+            if (stopped)
+                return;
+            cursor = row.event_id;
+            if (!matches(row))
+                continue;
+            try {
+                await opts.handler(row);
+            }
+            catch (err) {
+                report(err, row);
+            }
+        }
+        if (!stopped)
+            cursor = page.next;
+    };
+    const timer = setInterval(() => {
+        if (stopped || inFlight !== null)
+            return;
+        inFlight = poll().finally(() => {
+            inFlight = null;
+        });
+    }, opts.pollIntervalMs ?? 2000);
+    timer.unref();
+    return {
+        dbPath,
+        stop: async () => {
+            stopped = true;
+            clearInterval(timer);
+            if (inFlight !== null)
+                await inFlight;
+        },
+    };
+}
+//# sourceMappingURL=bus.js.map

package/dist/core/bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bus.js","sourceRoot":"","sources":["../../src/core/bus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCpC,oFAAoF;AACpF,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;AAE7C,+FAA+F;AAC/F,MAAM,CAAC,MAAM,UAAU,GAAgE;IACrF,UAAU,EAAE,SAAS;CACtB,CAAC;AAEF,yGAAyG;AACzG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,MAAiB;IAC/D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,MAAiB;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,OAAO,CAAC,MAAO,CAAC,CAAC;AAC1B,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,MAA0B;IAC3C,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,iDAAiD,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,GAAW;IACzD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;yBACyB;AACzB,KAAK,UAAU,QAAQ,CAAC,MAAiB,EAAE,OAAe,EAAE,UAAyB,EAAE,cAAc,GAAG,KAAK;IAC3G,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAAY,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,UAAkB,EAAE,OAA8B,EAAE;IAChG,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,IAAM,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK;YAAE,OAAO,GAAG,CAAC;QAC/D,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;IAChF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;AAC/H,CAAC;AAsBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAmB;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC;IACrC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,KAAsB,EAAQ,EAAE;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,8FAA8F;IAC9F,8EAA8E;IAC9E,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAa,CAAC,IAAI,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,EAAE,CAAC;IAEd,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,EAAE,CAAC;QACpC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,OAAO,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO;QACzC,QAAQ,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7B,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,OAAO;QACL,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,QAAQ,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/deliver-exclusions.d.ts

@@ -0,0 +1,71 @@
+/**
+ * WHAT THE DELIVER PUSH LEAVES BEHIND — the crew#434 classifier, as one reusable predicate.
+ *
+ * The rules themselves are not new: they have run inside `deliverPrScript`'s generated bash since
+ * crew#434 (an untracked candidate is staged UNLESS it looks like scratch or key material, and
+ * every exclusion is printed with its reason). What is new is that they are now readable from
+ * TypeScript, because a second consumer needs the SAME answer.
+ *
+ * ## Why (F3, ship-proof C7)
+ *
+ * The deliver gate's consent diffstat is computed from `GET /runs/:id/diff`, whose untracked pass
+ * appended every non-ignored untracked path as an all-addition hunk. The push does not carry every
+ * non-ignored untracked path. On a run whose creator left a `tmp/` behind, the gate read
+ * **"109 files changed, +258, -2"** and the commit pushed **4 files, +47, -2** — 27x over, on the
+ * one gate with an irreversible external side effect. The script printed
+ * `deliver: EXCLUDED (scratch-dir): tmp/ (105 files)`, so the exclusion applied to the push and
+ * not to the number the operator approved.
+ *
+ * The number on a consent surface has to be the number that ships, so the diff the gate reads now
+ * runs this classifier over its untracked candidates.
+ *
+ * ## Drift
+ *
+ * There are necessarily TWO implementations — this one runs in the daemon, the other is generated
+ * bash running in the run worktree — and only one of them decides what is actually pushed. The
+ * shell is therefore the source of truth and this module tracks it; they are pinned together by
+ * `tests/deliver-gate-diffstat.test.ts`, which runs the REAL script over a fixture tree and
+ * requires the committed set to equal the set this function keeps.
+ *
+ * It is a GUARD, NOT A SILENT DROP: the script still prints every excluded path with its reason
+ * into the phase output (retained and served on the run wire), and this module only changes which
+ * files a *preview* of the push counts.
+ */
+/**
+ * The deliver script's untracked RECOVERY SENTINEL (crew#432): a failed push leaves this empty file
+ * at the worktree root so the engine's terminal reap never removes a worktree whose work was
+ * committed but not delivered, and the next attempt removes it before staging. It is never part of
+ * the push, so it is never part of the consent diffstat either (N2, ship re-proof): the retry gate
+ * read "5 files changed" for a commit of 4 because this predicate did not know the name. The
+ * script's `S=` line is generated FROM this constant, so the name cannot drift between the two.
+ */
+export declare const DELIVER_STRANDED_SENTINEL = ".wicked-crew-delivery-stranded";
+/** Past this, an otherwise-unrecognised file is scratch by size alone (the generic net). */
+export declare const OVERSIZE_BYTES = 1048576;
+/**
+ * Why the deliver push would exclude this path on its NAME alone — the arms that need no `stat`:
+ * the denylist, the `socket` basename, `.DS_Store`, and a scratch directory at any depth. `null`
+ * means "no name rule fires"; the caller still owes the size rule ({@link deliverExclusionReason}).
+ *
+ * Split out so a caller can classify 100 000 untracked paths without 100 000 synchronous `stat`
+ * calls on the daemon's event loop (codex review of the F3 PR, MEDIUM): only a path that survives
+ * every name rule is ever stat'd, and under a scratch directory none of them are.
+ *
+ * `relPath` is repo-relative with `/` separators — git's own spelling, which
+ * `git status --porcelain -z` and `git ls-files -z` emit on every platform.
+ *
+ * The order of the arms is the script's order, and it matters: a `tmp/x.db` reports
+ * `denylisted-name`, exactly as the shell's `[ -n "$RN" ] ||` guards do.
+ */
+export declare function deliverExclusionByName(relPath: string): string | null;
+/**
+ * Why the deliver push would EXCLUDE this untracked path, or `null` when it rides — the whole
+ * ladder, name rules first and then the size rule.
+ *
+ * `sizeBytes` is the file's size, or `null` when it could not be stat'd; an unknown size is never
+ * treated as oversize (the shell's `wc -c < "$F" 2>/dev/null || echo 0` degrades the same way).
+ * A caller that wants to avoid the `stat` for a path a name rule already rejects calls
+ * {@link deliverExclusionByName} first.
+ */
+export declare function deliverExclusionReason(relPath: string, sizeBytes: number | null): string | null;
+//# sourceMappingURL=deliver-exclusions.d.ts.map

package/dist/core/deliver-exclusions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-exclusions.d.ts","sourceRoot":"","sources":["../../src/core/deliver-exclusions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,mCAAmC,CAAC;AAgB1E,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAerE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK/F"}

package/dist/core/deliver-exclusions.js

@@ -0,0 +1,110 @@
+/**
+ * WHAT THE DELIVER PUSH LEAVES BEHIND — the crew#434 classifier, as one reusable predicate.
+ *
+ * The rules themselves are not new: they have run inside `deliverPrScript`'s generated bash since
+ * crew#434 (an untracked candidate is staged UNLESS it looks like scratch or key material, and
+ * every exclusion is printed with its reason). What is new is that they are now readable from
+ * TypeScript, because a second consumer needs the SAME answer.
+ *
+ * ## Why (F3, ship-proof C7)
+ *
+ * The deliver gate's consent diffstat is computed from `GET /runs/:id/diff`, whose untracked pass
+ * appended every non-ignored untracked path as an all-addition hunk. The push does not carry every
+ * non-ignored untracked path. On a run whose creator left a `tmp/` behind, the gate read
+ * **"109 files changed, +258, -2"** and the commit pushed **4 files, +47, -2** — 27x over, on the
+ * one gate with an irreversible external side effect. The script printed
+ * `deliver: EXCLUDED (scratch-dir): tmp/ (105 files)`, so the exclusion applied to the push and
+ * not to the number the operator approved.
+ *
+ * The number on a consent surface has to be the number that ships, so the diff the gate reads now
+ * runs this classifier over its untracked candidates.
+ *
+ * ## Drift
+ *
+ * There are necessarily TWO implementations — this one runs in the daemon, the other is generated
+ * bash running in the run worktree — and only one of them decides what is actually pushed. The
+ * shell is therefore the source of truth and this module tracks it; they are pinned together by
+ * `tests/deliver-gate-diffstat.test.ts`, which runs the REAL script over a fixture tree and
+ * requires the committed set to equal the set this function keeps.
+ *
+ * It is a GUARD, NOT A SILENT DROP: the script still prints every excluded path with its reason
+ * into the phase output (retained and served on the run wire), and this module only changes which
+ * files a *preview* of the push counts.
+ */
+/**
+ * The deliver script's untracked RECOVERY SENTINEL (crew#432): a failed push leaves this empty file
+ * at the worktree root so the engine's terminal reap never removes a worktree whose work was
+ * committed but not delivered, and the next attempt removes it before staging. It is never part of
+ * the push, so it is never part of the consent diffstat either (N2, ship re-proof): the retry gate
+ * read "5 files changed" for a commit of 4 because this predicate did not know the name. The
+ * script's `S=` line is generated FROM this constant, so the name cannot drift between the two.
+ */
+export const DELIVER_STRANDED_SENTINEL = '.wicked-crew-delivery-stranded';
+/** Basename globs that mean "scratch or key material, never a run's product" (crew#434). */
+const DENYLISTED = [
+    /\.db$/, /\.db-wal$/, /\.db-shm$/,
+    /\.sqlite$/, /\.sqlite2$/, /\.sqlite3$/, /\.sqlite-wal$/, /\.sqlite-shm$/,
+    /\.sock$/, /\.pid$/,
+    /\.env$/, /\.env\./, /^\.envrc$/,
+    /\.gif$/, /\.webm$/, /\.mp4$/, /\.mov$/,
+    /\.pem$/, /\.key$/, /\.p12$/, /\.pfx$/,
+    /^id_rsa/, /credentials/,
+];
+/** The scratch/cache directory names the push never carries, at any depth. */
+const SCRATCH_DIRS = ['tmp', '.tmp', 'scratch', '.cache', 'coverage'];
+/** Past this, an otherwise-unrecognised file is scratch by size alone (the generic net). */
+export const OVERSIZE_BYTES = 1048576;
+/**
+ * Why the deliver push would exclude this path on its NAME alone — the arms that need no `stat`:
+ * the denylist, the `socket` basename, `.DS_Store`, and a scratch directory at any depth. `null`
+ * means "no name rule fires"; the caller still owes the size rule ({@link deliverExclusionReason}).
+ *
+ * Split out so a caller can classify 100 000 untracked paths without 100 000 synchronous `stat`
+ * calls on the daemon's event loop (codex review of the F3 PR, MEDIUM): only a path that survives
+ * every name rule is ever stat'd, and under a scratch directory none of them are.
+ *
+ * `relPath` is repo-relative with `/` separators — git's own spelling, which
+ * `git status --porcelain -z` and `git ls-files -z` emit on every platform.
+ *
+ * The order of the arms is the script's order, and it matters: a `tmp/x.db` reports
+ * `denylisted-name`, exactly as the shell's `[ -n "$RN" ] ||` guards do.
+ */
+export function deliverExclusionByName(relPath) {
+    // The script's own recovery sentinel, at the worktree root only — the shell's first arm.
+    if (relPath === DELIVER_STRANDED_SENTINEL)
+        return 'delivery-sentinel';
+    const base = relPath.slice(relPath.lastIndexOf('/') + 1);
+    // The script classifies on a LOWERCASED basename so DEPLOY.KEY / .ENV / SOCKET.PATH cannot
+    // bypass the denylist by case (crew#439).
+    const lower = base.toLowerCase();
+    if (DENYLISTED.some((re) => re.test(lower)))
+        return 'denylisted-name';
+    if (lower.includes('socket'))
+        return 'socket-name';
+    // `.DS_Store` is matched on the ORIGINAL basename, as the shell does.
+    if (base === '.DS_Store')
+        return 'ds-store';
+    const segments = relPath.split('/');
+    // Every segment BUT the last is a directory of the path (`/$F` against `*/tmp/*` in the shell).
+    if (segments.slice(0, -1).some((s) => SCRATCH_DIRS.includes(s)))
+        return 'scratch-dir';
+    return null;
+}
+/**
+ * Why the deliver push would EXCLUDE this untracked path, or `null` when it rides — the whole
+ * ladder, name rules first and then the size rule.
+ *
+ * `sizeBytes` is the file's size, or `null` when it could not be stat'd; an unknown size is never
+ * treated as oversize (the shell's `wc -c < "$F" 2>/dev/null || echo 0` degrades the same way).
+ * A caller that wants to avoid the `stat` for a path a name rule already rejects calls
+ * {@link deliverExclusionByName} first.
+ */
+export function deliverExclusionReason(relPath, sizeBytes) {
+    const byName = deliverExclusionByName(relPath);
+    if (byName !== null)
+        return byName;
+    if (sizeBytes !== null && sizeBytes > OVERSIZE_BYTES)
+        return 'oversize-1mib';
+    return null;
+}
+//# sourceMappingURL=deliver-exclusions.js.map

package/dist/core/deliver-exclusions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-exclusions.js","sourceRoot":"","sources":["../../src/core/deliver-exclusions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAE1E,4FAA4F;AAC5F,MAAM,UAAU,GAAG;IACjB,OAAO,EAAE,WAAW,EAAE,WAAW;IACjC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe;IACzE,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,SAAS,EAAE,WAAW;IAChC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;IACvC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACtC,SAAS,EAAE,aAAa;CACzB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAEtE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,yFAAyF;IACzF,IAAI,OAAO,KAAK,yBAAyB;QAAE,OAAO,mBAAmB,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,2FAA2F;IAC3F,0CAA0C;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,CAAC;IACnD,sEAAsE;IACtE,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,gGAAgG;IAChG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,SAAwB;IAC9E,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,cAAc;QAAE,OAAO,eAAe,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/deliver-text.d.ts

@@ -28,8 +28,14 @@
  * run either way; only the deliver phase's own commit is guaranteed to match it.
  */
 import type { GateSpec, PhaseDef, SessionView } from './types.js';
-/** The PR title / commit subject cap — git's conventional subject width. */
-export declare const DELIVER_TITLE_MAX = 72;
+/**
+ * The PR title cap — GitHub's own limit (crew#550 P-1: a 72-character cap on the PR title still
+ * severed the intent inside a quoted phrase). The COMMIT subject keeps git's conventional width,
+ * {@link COMMIT_SUBJECT_MAX}; a longer title then opens the commit body in full.
+ */
+export declare const DELIVER_TITLE_MAX = 256;
+/** The commit subject cap — git's conventional subject width (crew#550). */
+export declare const COMMIT_SUBJECT_MAX = 72;
 /** One phase of the run, with as much as is known about it at composition time. */
 export interface DeliverPhaseFact {
     id: string;
@@ -89,9 +95,16 @@ export interface DeliverTextFacts {
         number: number;
         url: string;
     } | null;
+    /** crew#550: extra git trailers for the commit (`Co-Authored-By: …`), from
+     *  {@link DELIVER_TRAILERS_ENV}; absent/empty = only the `Delivered-By:` trailer. */
+    trailers?: string[];
+    /** crew#550 P-7: the follow-ups the evaluator flagged (its `FOLLOW-UPS:` block, read from the
+     *  evaluator units' output by {@link extractFollowUps}). `[]` = read, none flagged; absent = not
+     *  read (a definition-time composition), and the section is left out. */
+    followUps?: string[];
 }
 export interface DeliverText {
-    /** ≤ {@link DELIVER_TITLE_MAX} characters, one line, never cut mid-word. */
+    /** The PR title: ≤ {@link DELIVER_TITLE_MAX} characters, one line, never cut mid-word. */
     title: string;
     /** Markdown; never empty. */
     body: string;
@@ -110,7 +123,7 @@ export interface IssueRefs {
 export declare function conventionalPrefix(workflowId: string | null | undefined): string;
 /**
  * The PR title / commit subject: the intent's first line, whole when it fits, otherwise cut at the
- * last word boundary that leaves room for a single `…` — so the result is ≤ 72 characters and never
+ * last word boundary that leaves room for a single `…` — so the result is ≤ 256 characters and never
  * ends mid-word (the F-3R2-014 headline `…scenario CLN-2) aga`). Dangling punctuation before the
  * ellipsis is dropped. A blank intent names the run instead — through the SAME bounded cut, so a
  * long caller-supplied session id (the CLI passes `--session` through) is never cut mid-id either
@@ -118,13 +131,19 @@ export declare function conventionalPrefix(workflowId: string | null | undefined
  */
 export declare function deliverTitle(intent: string, runId: string, workflowId?: string | null): string;
 /**
- * `line` whole when it fits, else cut at a word boundary with a single `…` — ≤ 72 characters —
+ * `line` whole when it fits, else cut at a word boundary with a single `…` — ≤ `max` characters —
  * choosing the LAST boundary at nesting depth 0: never inside a quoted or bracketed phrase (crew#550
  * P-1: `… truncated at '(Failed):' and 'sign a seat…`). A straight apostrophe opens a quote only
  * after a space or at the start (so `daemon's` is a word, not a quote). When no depth-0 boundary
  * exists inside the room, any word boundary is taken; a single 72+ character token is cut hard.
  */
-export declare function boundedTitle(line: string): string;
+export declare function boundedTitle(line: string, max?: number): string;
+/**
+ * The commit subject for a PR title (crew#550): the title itself when it fits git's 72-character
+ * subject width, else the same depth-aware word-boundary cut at 72. The deliver script puts the
+ * full title at the top of the commit body whenever the two differ.
+ */
+export declare function commitSubject(title: string): string;
 /**
  * The issues the intent names, split into the ones it says it fixes and the rest.
  *
@@ -134,7 +153,7 @@ export declare function boundedTitle(line: string): string;
  * on a wicked-studio delivery must close #214). Any other owner-less `repo#N` rides verbatim as
  * information; `owner/repo#N` is left exactly as written.
  */
-export declare function issueRefs(intent: string, repoRef?: string | null): IssueRefs;
+export declare function issueRefs(rawIntent: string, repoRef?: string | null): IssueRefs;
 /**
  * How much of the intent the deliver SCRIPT carries in its embedded fallback text. The script is
  * one `bash -lc` argument, and `LaunchSchema.problem` has no length cap, so an unbounded intent
@@ -184,10 +203,9 @@ export declare function baseWorkflowId(workflowId: string, runId: string): strin
  * The facts from a persisted run view — what the daemon answers on `GET /runs/:id/deliver-text`.
  * The deliver phase itself (running while it asks) is listed as `this PR`.
  *
- * `resolved.workflowId` is the DEFINITION the route resolved for the run (`resolveRunWorkflow`
- * over the full registry): the engine stores an instance id (`wf-<uuid>`) that `sessionsDetail()`
- * patches back to a name for BUILT-INS only, so a user-registered workflow would otherwise read as
- * `workflow wf-…` here. Absent, the view's id is used (with the per-run composition suffix cut).
+ * `resolved.workflowId` is the run's preset or workflow NAME the route resolved from the engine's
+ * record (`runIdentityOf`, seam X2) — `null` for a user plan or a free-text run, which names no
+ * workflow. Absent (`undefined`), the view's id is used (with the per-run composition suffix cut).
  */
 export declare function factsFromRun(view: SessionView, runUrl: string | null, resolved?: {
     workflowId?: string | null;
@@ -195,6 +213,8 @@ export declare function factsFromRun(view: SessionView, runUrl: string | null, r
         number: number;
         url: string;
     } | null;
+    /** crew#550: the evaluator follow-ups, when the caller read the evaluator units' output. */
+    followUps?: string[];
 }): DeliverTextFacts;
 /** What is known at LAUNCH, from the workflow definition — the script's embedded fallback. */
 export declare function factsFromWorkflow(input: {
@@ -209,6 +229,22 @@ export declare function factsFromWorkflow(input: {
         url: string;
     } | null;
 }): DeliverTextFacts;
+/**
+ * The environment variable naming extra commit trailers for delivered work (crew#550), one per
+ * line — e.g. `Co-Authored-By: Name <address>`. Only well-formed single-line `Token: value`
+ * trailers are kept; anything else is dropped rather than breaking the commit's trailer block.
+ */
+export declare const DELIVER_TRAILERS_ENV = "WICKED_CREW_DELIVER_TRAILERS";
+/** The configured trailers, validated; `[]` when none. */
+export declare function configuredTrailers(env?: NodeJS.ProcessEnv): string[];
+/**
+ * The environment variable naming the PUBLIC origin a PR's run link may use (crew#550 P-2) — the
+ * studio address a reviewer can open (`https://studio.example.com`). Unset, a PR body names the run
+ * id and carries no link: the daemon's own loopback address opens only on the daemon's host.
+ */
+export declare const PUBLIC_ORIGIN_ENV = "WICKED_CREW_PUBLIC_ORIGIN";
+/** The configured public origin, or `null`. */
+export declare function configuredPublicOrigin(env?: NodeJS.ProcessEnv): string | null;
 /**
  * `s` as ONE URL path segment, RFC 3986 strict: everything but unreserved characters is
  * percent-encoded — `encodeURIComponent` alone leaves `!'()*` alone, and `'` in particular must not
@@ -216,9 +252,20 @@ export declare function factsFromWorkflow(input: {
  */
 export declare function urlPathSegment(s: string): string;
 /**
- * The studio bookmark for a run under a daemon origin (`http://127.0.0.1:7701/runs/<id>`), or
- * null. LOOPBACK ORIGINS ONLY (review W3-K4): a daemon bound to a LAN host or IP would otherwise
- * put that host into a public PR body; the run id itself is always named in the text.
+ * The run link for a PR body under the configured PUBLIC origin ({@link configuredPublicOrigin}),
+ * or null (crew#550 P-2). Never a loopback URL: `http://127.0.0.1:<port>/runs/<id>` opens only on
+ * the daemon's own host, so a PR carrying it gave every other reader a dead link. A loopback,
+ * unparseable or non-http(s) origin yields no link; the run id itself is always named in the text.
  */
 export declare function runUrlFor(origin: string | null | undefined, runId: string): string | null;
+/** At most this many follow-ups ride a PR body; each is cut to {@link FOLLOW_UP_MAX_CHARS}. */
+export declare const FOLLOW_UPS_MAX = 10;
+export declare const FOLLOW_UP_MAX_CHARS = 300;
+/**
+ * The follow-ups an evaluator's output flags (crew#550 P-7): the list under its `FOLLOW-UPS:`
+ * heading (or the heading line's own text), ending at the first line that is neither an item nor
+ * the continuation of one. `none` / `n/a` yields nothing. Every block in the text is read, in order,
+ * de-duplicated, capped at {@link FOLLOW_UPS_MAX}.
+ */
+export declare function extractFollowUps(text: string): string[];
 //# sourceMappingURL=deliver-text.d.ts.map