@abot-ai/runtime 1.3.1 → 1.4.0

package/dist/plugins/system/source/process-result.js

@@ -0,0 +1,86 @@
+import { failureResult, successResult, } from "../../../src/plugin-sdk/index.js";
+const STREAM_EXCERPT_CHARS = 2_000;
+const IDENTITY_EXCERPT_CHARS = 512;
+const LEGACY_EVIDENCE_LABELS = {
+    command_process_completion: "system command process completion",
+    launch_request_dispatch: "application launch request dispatch",
+};
+export function systemProcessResult(target, result, evidenceScope, application) {
+    const stdoutOmittedChars = Math.max(0, result.stdout.length - STREAM_EXCERPT_CHARS);
+    const stderrOmittedChars = Math.max(0, result.stderr.length - STREAM_EXCERPT_CHARS);
+    const data = {
+        evidenceScope,
+        evidence: LEGACY_EVIDENCE_LABELS[evidenceScope],
+        independentOutcomeCheck: "not_performed",
+        target: target.id,
+        transport: target.transport,
+        processStatus: result.status,
+        spawnedProcess: result.spawnedProcess ?? null,
+        ...(application ? { catalogApplication: application } : {}),
+        outputTruncated: result.outputTruncated,
+        summaryOmittedChars: {
+            stdout: stdoutOmittedChars,
+            stderr: stderrOmittedChars,
+        },
+        observationMeta: {
+            kind: "volatile_external",
+            carryPolicy: "never",
+        },
+    };
+    const output = [
+        `Adapter evidence: ${evidenceScope}. Independent outcome check: not performed. Completion/dispatch alone does not verify the requested application, window or system effect; evaluate command evidence separately.`,
+        `Target: ${target.id} (${target.transport})`,
+        `Process status: ${result.status}; exit code: ${result.exitCode ?? "unavailable"}`,
+        result.spawnedProcess
+            ? `Spawned helper: ${identityExcerpt(result.spawnedProcess.executable)}; PID ${result.spawnedProcess.pid} in runtime OS namespace. Identity comes from spawn arguments, not application image inspection.`
+            : "Spawned helper identity: not recorded.",
+        ...(application
+            ? [
+                `Revalidated catalog identity: ${identityExcerpt(application.id)} (identity only; no application process/window check).`,
+            ]
+            : []),
+        "STDOUT excerpt:",
+        result.stdout.slice(0, STREAM_EXCERPT_CHARS) || "(empty)",
+        "STDERR excerpt:",
+        result.stderr.slice(0, STREAM_EXCERPT_CHARS) || "(empty)",
+        `Summary omitted characters: stdout=${stdoutOmittedChars}, stderr=${stderrOmittedChars}. Raw stream capture truncated: ${result.outputTruncated}.`,
+    ].join("\n");
+    if (hasSuccessfulSystemObservation(result)) {
+        return successResult({
+            output,
+            stdout: result.stdout,
+            stderr: result.stderr,
+            exitCode: 0,
+            data,
+        });
+    }
+    const errorCode = result.status === "completed"
+        ? "system_command_failed"
+        : `system_${result.status}`;
+    return failureResult({
+        errorCode,
+        message: hasUncertainDescendantState(result)
+            ? "System command observation stopped. External or detached descendants may remain; inspect the target before retrying."
+            : "The target did not report successful command completion.",
+        output,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}),
+        data,
+    });
+}
+function hasSuccessfulSystemObservation(result) {
+    if (result.status !== "completed")
+        return false;
+    return result.exitCode === 0;
+}
+function hasUncertainDescendantState(result) {
+    if (result.status === "timeout")
+        return true;
+    return result.status === "aborted";
+}
+function identityExcerpt(identity) {
+    if (identity.length <= IDENTITY_EXCERPT_CHARS)
+        return identity;
+    return `${identity.slice(0, IDENTITY_EXCERPT_CHARS)} [${identity.length - IDENTITY_EXCERPT_CHARS} characters omitted; full identity in result data]`;
+}

package/dist/plugins/system/source/process-runner.d.ts

@@ -0,0 +1,3 @@
+import type { SystemProcessInput, SystemProcessResult } from "./contracts.js";
+/** Bounded process observation; exit zero proves command completion, not effects. */
+export declare function runSystemProcess(input: SystemProcessInput): Promise<SystemProcessResult>;

package/dist/plugins/system/source/process-runner.js

@@ -0,0 +1,103 @@
+import { spawn } from "node:child_process";
+const STREAM_MAX_CHARS = 16_000;
+/** Bounded process observation; exit zero proves command completion, not effects. */
+export function runSystemProcess(input) {
+    if (input.abortSignal?.aborted)
+        return Promise.resolve({
+            exitCode: null,
+            stdout: "",
+            stderr: "",
+            status: "aborted",
+            outputTruncated: false,
+        });
+    return new Promise((resolve) => {
+        const streamMaxChars = Math.min(input.outputMaxChars ?? STREAM_MAX_CHARS, 512_000);
+        let stdout = "";
+        let stderr = "";
+        let truncated = false;
+        let settled = false;
+        let status = "completed";
+        let spawnedProcess;
+        let timeout;
+        let stopGrace;
+        const finish = (exitCode) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            if (stopGrace)
+                clearTimeout(stopGrace);
+            input.abortSignal?.removeEventListener("abort", abort);
+            resolve(Object.freeze({
+                exitCode,
+                stdout,
+                stderr,
+                status,
+                outputTruncated: truncated,
+                ...(spawnedProcess ? { spawnedProcess } : {}),
+            }));
+        };
+        const child = spawn(input.executable, [...input.args], {
+            ...(input.cwd ? { cwd: input.cwd } : {}),
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            detached: process.platform !== "win32",
+        });
+        child.once("spawn", () => {
+            if (child.pid === undefined)
+                return;
+            spawnedProcess = {
+                pid: child.pid,
+                pidNamespace: "runtime_os",
+                executable: input.executable,
+                identitySource: "spawn_arguments",
+            };
+        });
+        const stop = (reason) => {
+            if (settled)
+                return;
+            status = reason;
+            const pid = child.pid;
+            if (pid && process.platform !== "win32") {
+                try {
+                    process.kill(-pid, "SIGKILL");
+                }
+                catch {
+                    child.kill("SIGKILL");
+                }
+            }
+            else {
+                child.kill("SIGKILL");
+            }
+            // Native/external descendants can outlive a stopped transport; never claim
+            // their termination from the shell observation alone.
+            stopGrace = setTimeout(() => finish(null), 1_000);
+            stopGrace.unref();
+        };
+        const abort = () => stop("aborted");
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            const remaining = streamMaxChars - stdout.length;
+            truncated ||= chunk.length > remaining;
+            stdout += chunk.slice(0, remaining);
+        });
+        child.stderr.on("data", (chunk) => {
+            const remaining = streamMaxChars - stderr.length;
+            truncated ||= chunk.length > remaining;
+            stderr += chunk.slice(0, remaining);
+        });
+        child.once("error", (error) => {
+            status = "spawn_failed";
+            stderr = error.message.slice(0, STREAM_MAX_CHARS);
+            finish(null);
+        });
+        child.once("close", (code) => finish(code));
+        timeout = setTimeout(() => stop("timeout"), input.timeoutMs ?? 30_000);
+        timeout.unref();
+        input.abortSignal?.addEventListener("abort", abort, { once: true });
+        if (input.abortSignal?.aborted)
+            abort();
+    });
+}

package/dist/plugins/system/source/target-observation.d.ts

@@ -0,0 +1,18 @@
+import type { SystemProcessRunner, SystemTarget, SystemTargetId } from "./contracts.js";
+import { observeSystemHost } from "./host-observation.js";
+type TargetObservation = Readonly<(SystemTarget & {
+    available: true;
+    commandExecutionAvailable: true;
+    guiSessionStatus: "not_checked";
+}) | {
+    id: SystemTargetId;
+    available: false;
+    reason: string;
+}>;
+export type SystemTargetObservation = Readonly<{
+    host: ReturnType<typeof observeSystemHost>;
+    availabilityScope: "command_execution_only";
+    targets: readonly TargetObservation[];
+}>;
+export declare function observeSystemTargets(run?: SystemProcessRunner): Promise<SystemTargetObservation>;
+export {};

package/dist/plugins/system/source/target-observation.js

@@ -0,0 +1,29 @@
+import { observeSystemHost } from "./host-observation.js";
+import { runSystemProcess } from "./process-runner.js";
+import { resolveSystemTarget } from "./targets.js";
+export async function observeSystemTargets(run = runSystemProcess) {
+    const observations = [];
+    for (const id of ["linux", "macos", "windows"]) {
+        try {
+            const target = await resolveSystemTarget(id, run);
+            observations.push({
+                ...target,
+                available: true,
+                commandExecutionAvailable: true,
+                guiSessionStatus: "not_checked",
+            });
+        }
+        catch (error) {
+            observations.push({
+                id,
+                available: false,
+                reason: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return {
+        host: observeSystemHost(),
+        availabilityScope: "command_execution_only",
+        targets: observations,
+    };
+}

package/dist/plugins/system/source/targets.d.ts

@@ -0,0 +1,8 @@
+import { type SystemProcessRunner, type SystemTarget, type SystemTargetId } from "./contracts.js";
+export declare function powershellArguments(script: string): string[];
+export declare function powershellLiteral(value: string): string;
+export declare function shellLiteral(value: string): string;
+export declare function windowsSystemCommandScript(command: string, cwd: string): string;
+export declare function findExecutable(name: string, additional?: readonly string[]): Promise<string | undefined>;
+export declare function resolveSystemTarget(id: SystemTargetId, run?: SystemProcessRunner): Promise<SystemTarget>;
+export declare function readSystemTargetId(value: unknown): SystemTargetId;

package/dist/plugins/system/source/targets.js

@@ -0,0 +1,101 @@
+import { constants } from "node:fs";
+import { access } from "node:fs/promises";
+import { delimiter, join } from "node:path";
+import { SystemOperationError, } from "./contracts.js";
+import { runSystemProcess } from "./process-runner.js";
+import { isWslHostRuntime, readSystemHostFacts } from "./host-observation.js";
+export function powershellArguments(script) {
+    const preamble = "$ErrorActionPreference='Stop';[Console]::OutputEncoding=[Text.UTF8Encoding]::new();$global:LASTEXITCODE=0;";
+    return [
+        "-NoLogo",
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(preamble + script, "utf16le").toString("base64"),
+    ];
+}
+export function powershellLiteral(value) {
+    return "'" + value.replaceAll("'", "''") + "'";
+}
+export function shellLiteral(value) {
+    return "'" + value.replaceAll("'", "'\"'\"'") + "'";
+}
+export function windowsSystemCommandScript(command, cwd) {
+    return `Set-Location -LiteralPath ${powershellLiteral(cwd)};${command}\nif ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`;
+}
+export async function findExecutable(name, additional = []) {
+    const candidates = [
+        ...additional,
+        ...(process.env.PATH ?? "")
+            .split(delimiter)
+            .filter(Boolean)
+            .map((directory) => join(directory, name)),
+    ];
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch {
+            /* next observed candidate */
+        }
+    }
+    return undefined;
+}
+export async function resolveSystemTarget(id, run = runSystemProcess) {
+    if (isNativeUnixTarget(id))
+        return resolveNativeUnixTarget(id);
+    if (id !== "windows")
+        throw new SystemOperationError("system_target_unavailable", `The runtime is not executing on ${id}.`);
+    const nativeWindows = process.platform === "win32";
+    const wslWindows = isWslHostRuntime(readSystemHostFacts());
+    if (!hasWindowsExecutionTransport(nativeWindows, wslWindows))
+        throw new SystemOperationError("system_target_unavailable", "No Windows execution transport is available on this host.");
+    const canonicalShell = nativeWindows
+        ? join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+        : "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe";
+    const shell = await findExecutable("powershell.exe", [canonicalShell]);
+    if (!shell)
+        throw new SystemOperationError("system_target_unavailable", "A native Windows PowerShell executable was not found; Windows interop is unavailable.");
+    const probe = await run({
+        executable: shell,
+        args: powershellArguments("[Environment]::OSVersion.Platform.ToString()"),
+        timeoutMs: 5_000,
+    });
+    if (!hasObservedWindowsPlatform(probe))
+        throw new SystemOperationError("system_target_unavailable", "Windows PowerShell could not execute. WSL executable interop may be disabled; enable a real Windows execution transport on the host.");
+    return { id, transport: nativeWindows ? "native" : "wsl_interop", shell };
+}
+export function readSystemTargetId(value) {
+    if (value === "linux" || value === "macos" || value === "windows")
+        return value;
+    throw new SystemOperationError("system_target_required", "Select an explicit target returned by system_targets: linux, macos, or windows.");
+}
+function isNativeUnixTarget(id) {
+    if (id === "linux")
+        return process.platform === "linux";
+    if (id === "macos")
+        return process.platform === "darwin";
+    return false;
+}
+async function resolveNativeUnixTarget(id) {
+    try {
+        await access("/bin/bash", constants.X_OK);
+    }
+    catch {
+        throw new SystemOperationError("system_target_unavailable", "The native target has no executable /bin/bash.");
+    }
+    return { id, transport: "native", shell: "/bin/bash" };
+}
+function hasWindowsExecutionTransport(nativeWindows, wslWindows) {
+    if (nativeWindows)
+        return true;
+    return wslWindows;
+}
+function hasObservedWindowsPlatform(probe) {
+    if (probe.status !== "completed")
+        return false;
+    if (probe.exitCode !== 0)
+        return false;
+    return probe.stdout.trim() === "Win32NT";
+}

package/dist/scripts/add-runtime-model.js

@@ -1,3 +1,4 @@
+import { mergeRuntimeModelAddition, parseRuntimeModelProfileId, } from "./runtime-model-addition.js";
 import { constants } from "node:fs";
 import { access, mkdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
@@ -15,13 +16,6 @@ function requireValue(argv, index, flag) {
     }
     return value;
 }
-function parseProfile(value) {
-    const profile = value.trim();
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(profile)) {
-        throw new Error("--profile must start with a letter or number and use only letters, numbers, dot, underscore, or dash");
-    }
-    return profile;
-}
 function parseArgs(argv, commandMode) {
     let rootDir = process.cwd();
     let provider;
@@ -56,12 +50,12 @@ function parseArgs(argv, commandMode) {
             continue;
         }
         if (arg === "--profile") {
-            profile = parseProfile(requireValue(argv, index, "--profile"));
+            profile = parseRuntimeModelProfileId(requireValue(argv, index, "--profile"));
             index += 1;
             continue;
         }
         if (arg.startsWith("--profile=")) {
-            profile = parseProfile(arg.slice("--profile=".length));
+            profile = parseRuntimeModelProfileId(arg.slice("--profile=".length));
             continue;
         }
         if (arg === "--base-url") {
@@ -135,49 +129,6 @@ function readConfigMap(parent, key) {
         throw new Error(`${key} must be a JSON object`);
     return value;
 }
-function mergeRuntimeConfig(runtimeConfig, options) {
-    const models = readConfigMap(runtimeConfig, "models");
-    const providers = readConfigMap(models, "providers");
-    const profiles = readConfigMap(models, "profiles");
-    if (profiles[options.profile] !== undefined) {
-        throw new Error(`model profile already exists: ${options.profile}; no files were changed`);
-    }
-    const existingProvider = providers[options.provider];
-    if (existingProvider !== undefined) {
-        if (!isRecord(existingProvider) ||
-            existingProvider.type !== options.provider) {
-            throw new Error(`provider id is already configured with a different adapter: ${options.provider}; no files were changed`);
-        }
-        if (options.provider === "ollama" &&
-            options.baseUrl &&
-            existingProvider.baseUrl !== options.baseUrl) {
-            throw new Error(`provider ${options.provider} already uses a different base URL; no files were changed`);
-        }
-    }
-    return {
-        providerAdded: existingProvider === undefined,
-        config: {
-            ...runtimeConfig,
-            models: {
-                ...models,
-                providers: {
-                    ...providers,
-                    ...(existingProvider === undefined
-                        ? {
-                            [options.provider]: buildProviderConfig(options.provider, options.baseUrl),
-                        }
-                        : {}),
-                },
-                profiles: {
-                    ...profiles,
-                    [options.profile]: {
-                        configRef: `./models/${options.profile}.config.json`,
-                    },
-                },
-            },
-        },
-    };
-}
 function selectDefaultProfile(runnerConfig, profile) {
     const models = readConfigMap(runnerConfig, "models");
     const defaults = readConfigMap(models, "defaults");
@@ -211,7 +162,13 @@ export async function runAddRuntimeModel(argv = process.argv.slice(2), runOption
     if (options.setDefault) {
         parseRequestRunnerConfig(runnerConfig, runnerConfigPath);
     }
-    const merged = mergeRuntimeConfig(runtimeConfig, options);
+    const merged = mergeRuntimeModelAddition(runtimeConfig, {
+        profileId: options.profile,
+        providerId: options.provider,
+        provider: buildProviderConfig(options.provider, options.baseUrl),
+        profile: { configRef: `./models/${options.profile}.config.json` },
+        baseUrl: options.baseUrl,
+    });
     const nextRunnerConfig = options.setDefault
         ? selectDefaultProfile(runnerConfig, options.profile)
         : runnerConfig;

package/dist/scripts/runtime-model-addition.d.ts

@@ -0,0 +1,13 @@
+import { type JsonObject } from "./runtime-setup-files.js";
+export declare function parseRuntimeModelProfileId(value: string): string;
+/** Shared additive merge for CLI file references and Web inline model profiles. */
+export declare function mergeRuntimeModelAddition(runtimeConfig: JsonObject, input: {
+    profileId: string;
+    providerId: string;
+    provider: JsonObject;
+    profile: JsonObject;
+    baseUrl?: string;
+}): Readonly<{
+    config: JsonObject;
+    providerAdded: boolean;
+}>;

package/dist/scripts/runtime-model-addition.js

@@ -0,0 +1,53 @@
+import { isRecord } from "./runtime-setup-files.js";
+export function parseRuntimeModelProfileId(value) {
+    const profile = value.trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(profile)) {
+        throw new Error("--profile must start with a letter or number and use only letters, numbers, dot, underscore, or dash");
+    }
+    return profile;
+}
+function readConfigMap(parent, key) {
+    const value = parent[key];
+    if (value === undefined)
+        return {};
+    if (!isRecord(value))
+        throw new Error(`${key} must be a JSON object`);
+    return value;
+}
+/** Shared additive merge for CLI file references and Web inline model profiles. */
+export function mergeRuntimeModelAddition(runtimeConfig, input) {
+    const models = readConfigMap(runtimeConfig, "models");
+    const providers = readConfigMap(models, "providers");
+    const profiles = readConfigMap(models, "profiles");
+    if (profiles[input.profileId] !== undefined) {
+        throw new Error(`model profile already exists: ${input.profileId}; no files were changed`);
+    }
+    const existingProvider = providers[input.providerId];
+    if (existingProvider !== undefined) {
+        if (!isRecord(existingProvider) ||
+            existingProvider.type !== input.provider.type) {
+            throw new Error(`provider id is already configured with a different adapter: ${input.providerId}; no files were changed`);
+        }
+        if (input.provider.type === "ollama" &&
+            input.baseUrl &&
+            existingProvider.baseUrl !== input.baseUrl) {
+            throw new Error(`provider ${input.providerId} already uses a different base URL; no files were changed`);
+        }
+    }
+    return {
+        providerAdded: existingProvider === undefined,
+        config: {
+            ...runtimeConfig,
+            models: {
+                ...models,
+                providers: {
+                    ...providers,
+                    ...(existingProvider === undefined
+                        ? { [input.providerId]: input.provider }
+                        : {}),
+                },
+                profiles: { ...profiles, [input.profileId]: input.profile },
+            },
+        },
+    };
+}

package/dist/scripts/runtime-setup-files.d.ts

@@ -10,4 +10,6 @@ export declare function writeJsonObject(path: string, value: JsonObject, options
     exclusive?: boolean;
 }>): Promise<void>;
 export declare function buildProviderConfig(provider: Provider, baseUrl?: string): JsonObject;
-export declare function buildModelConfig(template: JsonObject, provider: Provider, model: string): JsonObject;
+export declare function buildModelConfig(template: JsonObject, provider: Provider, model: string, contextWindowTokens?: number): JsonObject;
+export declare function parseContextWindowTokens(value: unknown): number | undefined;
+export declare function readDefaultContextWindowTokens(): Promise<number>;

package/dist/scripts/runtime-setup-files.js

@@ -76,13 +76,16 @@ export function buildProviderConfig(provider, baseUrl) {
     }
     return { type: provider };
 }
-export function buildModelConfig(template, provider, model) {
+export function buildModelConfig(template, provider, model, contextWindowTokens) {
     const context = isRecord(template.context) ? template.context : {};
     return {
         ...template,
         label: model,
         provider,
         model,
+        ...(contextWindowTokens !== undefined
+            ? { contextWindowTokens: parseContextWindowTokens(contextWindowTokens) }
+            : {}),
         ...(provider === "openai"
             ? {
                 execution: {
@@ -98,3 +101,17 @@ export function buildModelConfig(template, provider, model) {
         },
     };
 }
+export function parseContextWindowTokens(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0)
+        throw new Error("Context window must be a positive whole number of tokens.");
+    return value;
+}
+export async function readDefaultContextWindowTokens() {
+    const template = await readJsonObject(join(resolveRuntimePackageRoot(import.meta.dirname), "examples/models/default.config.json"));
+    const value = parseContextWindowTokens(template.contextWindowTokens);
+    if (value === undefined)
+        throw new Error("The model template is missing its context window.");
+    return value;
+}

package/dist/src/capabilities/file-output-presentation.d.ts

@@ -0,0 +1,43 @@
+import type { BigIntStats } from "node:fs";
+import type { ResolvedRuntimeToolPath } from "./tool-types.js";
+export type ToolFileOutputLocation = "agent_work" | "workspace";
+export type ToolFileOutputOperation = "created" | "updated";
+/** Client presentation only; this receipt never belongs to a tool result. */
+export type ToolFileOutputReceipt = Readonly<{
+    version: 1;
+    location: ToolFileOutputLocation;
+    rootId: string;
+    relativePath: string;
+    logicalPath: string;
+    operation: ToolFileOutputOperation;
+}>;
+export type ToolFileOutputReport = Readonly<{
+    target: ResolvedRuntimeToolPath;
+    operation: ToolFileOutputOperation;
+    rootIdentity?: ToolFileOutputRootIdentity;
+}>;
+/** Captured from the actual mutation root while its directory handle is held. */
+export type ToolFileOutputRootIdentity = Readonly<{
+    device: string;
+    inode: string;
+    birthtimeNs: string;
+}>;
+/** Reports a committed file mutation to the host, outside model-visible data. */
+export type ToolFileOutputReporter = (report: ToolFileOutputReport) => void;
+type ToolFileOutputRootStats = Pick<BigIntStats, "dev" | "ino" | "birthtimeNs" | "isDirectory">;
+export declare function hasStableFileOutputRootIdentity(identity: ToolFileOutputRootStats): boolean;
+/**
+ * The caller supplies the canonical rootPath returned by the host resolver.
+ * Encoding: SHA-256 of UTF-8 JSON [v3 domain, location, canonical root, decimal
+ * device, inode, birthtimeNs, root marker token], with a sha256: prefix. The
+ * random marker distinguishes roots even if an inode and birth time are reused.
+ * Child changes must not invalidate the root, so mtime/ctime are never included.
+ * Older path-only hashes cannot match; unavailable birth identity fails closed.
+ */
+export declare function createFileOutputRootId(location: ToolFileOutputLocation, canonicalRoot: string, identity: ToolFileOutputRootStats, markerToken: string): string;
+export declare function isToolFileOutputLocation(value: unknown): value is ToolFileOutputLocation;
+/** A detached host report binding; filesystem authority is verified separately. */
+export declare function parseToolFileOutputRootIdentity(value: unknown): ToolFileOutputRootIdentity | undefined;
+/** Structural validation is not authorization; the server must verify origin. */
+export declare function parseToolFileOutputReceipt(value: unknown): ToolFileOutputReceipt | undefined;
+export {};