@aexhq/sdk 0.46.4-canary → 0.50.0

package/dist/_contracts/session-file-query.js

@@ -1,178 +0,0 @@
-import { SessionStateError } from "./sdk-errors.js";
-/** Package-private path-selector guard shared by transport orchestration. */
-export function isPathSelector(selector) {
-    return Boolean(selector && typeof selector === "object" && "path" in selector);
-}
-function normalizeSessionFileLookupPath(path) {
-    return path.replace(/\\/g, "/").replace(/^\/+/, "");
-}
-export function resolveSessionFileSelector(files, selector, sessionId) {
-    const target = normalizeSessionFileLookupPath(selector.path);
-    if (!target) {
-        throw new SessionStateError("files.download: file path must be non-empty", { sessionId, path: selector.path });
-    }
-    const matches = files.filter((file) => {
-        if (typeof file.filename !== "string")
-            return false;
-        const filename = normalizeSessionFileLookupPath(file.filename);
-        if (selector.match === "suffix") {
-            return filename === target || filename.endsWith(`/${target}`);
-        }
-        return filename === target;
-    });
-    if (matches.length === 1)
-        return matches[0];
-    if (matches.length > 1) {
-        throw new SessionStateError(`files.download: file path "${selector.path}" matched multiple files`, { sessionId, path: selector.path, matches: matches.map((file) => file.filename ?? file.id) });
-    }
-    throw new SessionStateError(`files.download: file path "${selector.path}" was not found`, {
-        sessionId,
-        path: selector.path
-    });
-}
-export function filterSessionFiles(files, query) {
-    return files.filter((file) => sessionFileMatchesQuery(file, query));
-}
-/**
- * The single filename-matcher for cross-session / per-session file SEARCH. A
- * string is a case-insensitive SUBSTRING match; a RegExp is tested as given (and
- * reset to `lastIndex = 0` so a reused `/g` regex is safe). Sharing this SSoT is
- * what closes the T16 crash class: session-file search no longer assumes `filename`
- * is a string and passes a RegExp into `escapeRegExp(...).replace(...)`.
- */
-export function toFilenameMatcher(filename) {
-    if (typeof filename === "string") {
-        const needle = filename.toLowerCase();
-        return (name) => name.toLowerCase().includes(needle);
-    }
-    return (name) => {
-        filename.lastIndex = 0;
-        return filename.test(name);
-    };
-}
-export function classifySessionFile(file) {
-    const contentType = normalizeContentType(file.contentType);
-    if (contentType) {
-        if (contentType === "application/json" || contentType.endsWith("+json") || contentType.includes("json")) {
-            return "json";
-        }
-        if (contentType.startsWith("text/"))
-            return "text";
-        if (contentType.startsWith("image/"))
-            return "image";
-        if (contentType.startsWith("audio/"))
-            return "audio";
-        if (contentType.startsWith("video/"))
-            return "video";
-        if (contentType === "application/pdf")
-            return "pdf";
-        if (contentType === "application/zip" ||
-            contentType === "application/gzip" ||
-            contentType === "application/x-gzip" ||
-            contentType === "application/x-tar" ||
-            contentType === "application/x-7z-compressed" ||
-            contentType === "application/vnd.rar" ||
-            contentType === "application/zstd") {
-            return "archive";
-        }
-        if (contentType === "application/octet-stream")
-            return "binary";
-        return "unknown";
-    }
-    const extension = extensionOf(file.filename);
-    if (!extension)
-        return "unknown";
-    if (["json", "jsonl", "ndjson"].includes(extension))
-        return "json";
-    if (["txt", "log", "md", "markdown", "csv", "tsv", "xml", "html", "htm", "yaml", "yml"].includes(extension)) {
-        return "text";
-    }
-    if (["png", "jpg", "jpeg", "gif", "webp", "avif", "bmp", "tif", "tiff", "svg"].includes(extension)) {
-        return "image";
-    }
-    if (["mp3", "wav", "flac", "m4a", "aac", "ogg", "oga", "opus"].includes(extension))
-        return "audio";
-    if (["mp4", "mov", "m4v", "webm", "mkv", "avi"].includes(extension))
-        return "video";
-    if (extension === "pdf")
-        return "pdf";
-    if (["zip", "tar", "tgz", "gz", "bz2", "xz", "7z", "rar", "zst"].includes(extension))
-        return "archive";
-    if (["bin", "exe", "dll", "so", "dylib", "dmg", "iso"].includes(extension))
-        return "binary";
-    return "unknown";
-}
-function sessionFileMatchesQuery(file, query) {
-    const normalizedPath = typeof file.filename === "string" ? normalizeSessionFileQueryPath(file.filename) : "";
-    if (query.path !== undefined && normalizedPath !== normalizeSessionFileQueryPath(query.path)) {
-        return false;
-    }
-    if (query.filename !== undefined) {
-        const basename = basenameOf(normalizedPath);
-        if (typeof query.filename === "string") {
-            if (basename !== query.filename)
-                return false;
-        }
-        else {
-            query.filename.lastIndex = 0;
-            if (!query.filename.test(basename))
-                return false;
-        }
-    }
-    if (query.dir !== undefined && !directoryMatches(normalizedPath, query.dir, query.recursive ?? true)) {
-        return false;
-    }
-    if (query.extension !== undefined && extensionOf(normalizedPath) !== normalizeExtension(query.extension)) {
-        return false;
-    }
-    if (query.contentType !== undefined && !contentTypeMatches(file.contentType, query.contentType)) {
-        return false;
-    }
-    if (query.type !== undefined && classifySessionFile(file) !== query.type) {
-        return false;
-    }
-    return true;
-}
-function normalizeSessionFileQueryPath(path) {
-    let normalized = path.replace(/\\/g, "/").replace(/^\/+/, "");
-    while (normalized === "files" || normalized.startsWith("files/")) {
-        normalized = normalized === "files" ? "" : normalized.slice("files/".length);
-    }
-    return normalized.replace(/\/+$/, "");
-}
-function basenameOf(path) {
-    return path.split("/").filter(Boolean).pop() ?? "";
-}
-function directoryMatches(path, dir, recursive) {
-    const normalizedDir = normalizeSessionFileQueryPath(dir);
-    if (normalizedDir.length === 0)
-        return true;
-    const prefix = `${normalizedDir}/`;
-    if (!path.startsWith(prefix))
-        return false;
-    const remainder = path.slice(prefix.length);
-    return remainder.length > 0 && (recursive || !remainder.includes("/"));
-}
-function normalizeExtension(extension) {
-    return extension.replace(/^\.+/, "").toLowerCase();
-}
-function extensionOf(path) {
-    if (!path)
-        return "";
-    const basename = basenameOf(normalizeSessionFileQueryPath(path));
-    const index = basename.lastIndexOf(".");
-    return index > 0 && index < basename.length - 1 ? basename.slice(index + 1).toLowerCase() : "";
-}
-function normalizeContentType(contentType) {
-    return (contentType ?? "").split(";")[0].trim().toLowerCase();
-}
-function contentTypeMatches(actual, expected) {
-    const normalizedActual = normalizeContentType(actual);
-    const normalizedExpected = normalizeContentType(expected);
-    if (!normalizedActual || !normalizedExpected)
-        return false;
-    if (normalizedExpected.endsWith("/*")) {
-        return normalizedActual.startsWith(normalizedExpected.slice(0, -1));
-    }
-    return normalizedActual === normalizedExpected;
-}

package/dist/_contracts/session-record.d.ts

@@ -1,112 +0,0 @@
-import type { SessionCostTelemetry } from "./session-cost.js";
-import { type CustodyManifestV1, type CustodyRedactionFinding } from "./session-custody.js";
-import type { AexEvent } from "./event-envelope.js";
-import type { Session, SessionFile } from "./runtime-types.js";
-import type { PlatformSubmission } from "./submission.js";
-export declare const SESSION_RECORD_SCHEMA_VERSION: "aex.session-record.v1";
-export declare const SESSION_RECORD_MANIFEST_SCHEMA_VERSION: "aex.session-record.manifest.v1";
-export type SessionRecordArchiveNamespaceV1 = "metadata" | "events" | "files";
-export type SessionRecordFileStatusV1 = "present" | "absent" | "pending" | "unavailable" | "not_applicable" | "error";
-export type SessionRecordArchiveFileRoleV1 = "session_metadata" | "submission_snapshot" | "cost" | "custody" | "typed_events" | "coordinator_events_manifest" | "file";
-export interface SessionRecordSubmissionSnapshotV1 {
-    readonly submission: PlatformSubmission;
-}
-export interface SessionRecordCostV1 {
-    readonly status: SessionRecordFileStatusV1;
-    readonly telemetry?: SessionCostTelemetry;
-}
-export interface SessionRecordMetadataV1 {
-    readonly session: Session;
-    readonly submission?: SessionRecordSubmissionSnapshotV1;
-    readonly cost?: SessionRecordCostV1;
-    readonly custody?: CustodyManifestV1;
-}
-export interface SessionRecordEventsV1 {
-    /** Typed `channel: "event"` records in the SDK `events/events.jsonl` export. */
-    readonly typed: readonly AexEvent[];
-}
-export interface SessionRecordV1 {
-    readonly schemaVersion: typeof SESSION_RECORD_SCHEMA_VERSION;
-    readonly sessionId: string;
-    readonly metadata: SessionRecordMetadataV1;
-    readonly events: SessionRecordEventsV1;
-    readonly sessionFiles: readonly SessionFile[];
-    readonly manifest: SessionRecordManifestV1;
-}
-export interface SessionRecordNamespaceV1 {
-    readonly name: SessionRecordArchiveNamespaceV1;
-    readonly prefix: `${SessionRecordArchiveNamespaceV1}/`;
-    readonly status: SessionRecordFileStatusV1;
-    readonly description: string;
-}
-export interface SessionRecordArchiveFileV1 {
-    readonly namespace: SessionRecordArchiveNamespaceV1;
-    readonly path: string;
-    readonly role: SessionRecordArchiveFileRoleV1;
-    readonly status: SessionRecordFileStatusV1;
-    readonly id?: string;
-    readonly filename?: string | null;
-    readonly sizeBytes?: number;
-    readonly contentType?: string;
-    readonly recordCount?: number;
-}
-export interface SessionRecordArtifactSummaryV1 {
-    readonly id: string;
-    readonly filename: string | null;
-    readonly sizeBytes?: number;
-    readonly contentType?: string;
-}
-export interface SessionRecordDownloadErrorV1 {
-    readonly namespace: "files";
-    readonly id: string;
-    readonly filename: string | null;
-    readonly message: string;
-}
-export interface SessionRecordManifestV1 {
-    readonly schemaVersion: typeof SESSION_RECORD_MANIFEST_SCHEMA_VERSION;
-    readonly sessionRecordSchemaVersion: typeof SESSION_RECORD_SCHEMA_VERSION;
-    readonly sessionId: string;
-    readonly namespaces: readonly SessionRecordNamespaceV1[];
-    readonly files: readonly SessionRecordArchiveFileV1[];
-    /** Captured session files included in the archive. */
-    readonly sessionFiles: readonly SessionRecordArtifactSummaryV1[];
-    readonly errors: readonly SessionRecordDownloadErrorV1[];
-}
-export interface BuildSessionRecordDownloadManifestV1Input {
-    readonly sessionId: string;
-    readonly sessionFiles: readonly SessionRecordArtifactSummaryV1[];
-    readonly errors?: readonly SessionRecordDownloadErrorV1[];
-    readonly typedEventCount?: number;
-    readonly submission?: SessionRecordFileManifestInputV1;
-    readonly cost?: SessionRecordFileManifestInputV1;
-    readonly custody?: SessionRecordFileManifestInputV1;
-    readonly coordinatorEventsManifest?: SessionRecordFileManifestInputV1;
-}
-export interface SessionRecordFileManifestInputV1 {
-    readonly status: SessionRecordFileStatusV1;
-    readonly recordCount?: number;
-}
-export interface SessionRecordArchiveEntryForRedactionV1 {
-    readonly path: string;
-    readonly bytes: Uint8Array;
-    readonly contentType?: string;
-    /**
-     * Customer-authored file bytes are intentionally outside the public-record
-     * redaction guarantee. Metadata, event exports, and manifests remain scanned.
-     */
-    readonly customerContent?: boolean;
-}
-export interface SessionRecordArchiveRedactionFindingV1 {
-    readonly entryPath: string;
-    readonly path: string;
-    readonly reason: CustodyRedactionFinding["reason"];
-    readonly valueLength?: number;
-}
-export declare class SessionRecordArchiveRedactionError extends Error {
-    readonly code = "session_record_archive_not_public_safe";
-    readonly findings: readonly SessionRecordArchiveRedactionFindingV1[];
-    constructor(findings: readonly SessionRecordArchiveRedactionFindingV1[]);
-}
-export declare function buildSessionRecordDownloadManifestV1(input: BuildSessionRecordDownloadManifestV1Input): SessionRecordManifestV1;
-export declare function scanSessionRecordArchiveEntriesV1(entries: readonly SessionRecordArchiveEntryForRedactionV1[]): readonly SessionRecordArchiveRedactionFindingV1[];
-export declare function assertSessionRecordArchivePublicSafeV1(entries: readonly SessionRecordArchiveEntryForRedactionV1[]): void;

package/dist/_contracts/session-record.js

@@ -1,165 +0,0 @@
-import { scanCustodyPayloadForSensitiveValues } from "./session-custody.js";
-export const SESSION_RECORD_SCHEMA_VERSION = "aex.session-record.v1";
-export const SESSION_RECORD_MANIFEST_SCHEMA_VERSION = "aex.session-record.manifest.v1";
-export class SessionRecordArchiveRedactionError extends Error {
-    code = "session_record_archive_not_public_safe";
-    findings;
-    constructor(findings) {
-        super(`session record archive contains non-public data at ${formatArchiveFindingPaths(findings)}`);
-        this.name = "SessionRecordArchiveRedactionError";
-        this.findings = Object.freeze([...findings]);
-    }
-}
-export function buildSessionRecordDownloadManifestV1(input) {
-    const sessionFiles = input.sessionFiles.map((file) => normalizeArtifactSummary(file));
-    const errors = (input.errors ?? []).map((error) => Object.freeze({ ...error }));
-    return Object.freeze({
-        schemaVersion: SESSION_RECORD_MANIFEST_SCHEMA_VERSION,
-        sessionRecordSchemaVersion: SESSION_RECORD_SCHEMA_VERSION,
-        sessionId: input.sessionId,
-        namespaces: Object.freeze([
-            namespace("metadata", "Session record metadata, submission snapshot, custody, and cost files."),
-            namespace("events", "Typed event-channel exports."),
-            namespace("files", "Captured files produced by the session.")
-        ]),
-        files: Object.freeze([
-            file("metadata", "metadata/session.json", "session_metadata", "present"),
-            file("metadata", "metadata/submission.json", "submission_snapshot", input.submission?.status ?? "unavailable"),
-            file("metadata", "metadata/cost.json", "cost", input.cost?.status ?? "pending"),
-            file("metadata", "metadata/custody.json", "custody", input.custody?.status ?? "pending"),
-            file("events", "events/events.jsonl", "typed_events", "present", {
-                recordCount: input.typedEventCount ?? 0
-            }),
-            file("events", "events/manifest.json", "coordinator_events_manifest", input.coordinatorEventsManifest?.status ?? "unavailable"),
-            ...sessionFiles.map((fileSummary) => artifactFile("files", "file", "files/", fileSummary))
-        ]),
-        sessionFiles: Object.freeze(sessionFiles),
-        errors: Object.freeze(errors)
-    });
-}
-function namespace(name, description) {
-    return Object.freeze({
-        name,
-        prefix: `${name}/`,
-        status: "present",
-        description
-    });
-}
-function file(namespaceName, path, role, status, extra) {
-    return Object.freeze({
-        namespace: namespaceName,
-        path,
-        role,
-        status,
-        ...(extra?.recordCount !== undefined ? { recordCount: extra.recordCount } : {})
-    });
-}
-function artifactFile(namespaceName, role, prefix, artifact) {
-    return Object.freeze({
-        namespace: namespaceName,
-        path: `${prefix}${artifact.filename ?? artifact.id}`,
-        role,
-        status: "present",
-        id: artifact.id,
-        filename: artifact.filename,
-        ...(artifact.sizeBytes !== undefined ? { sizeBytes: artifact.sizeBytes } : {}),
-        ...(artifact.contentType !== undefined ? { contentType: artifact.contentType } : {})
-    });
-}
-function normalizeArtifactSummary(input) {
-    return Object.freeze({
-        id: input.id,
-        filename: input.filename,
-        ...(input.sizeBytes !== undefined ? { sizeBytes: input.sizeBytes } : {}),
-        ...(input.contentType !== undefined ? { contentType: input.contentType } : {})
-    });
-}
-export function scanSessionRecordArchiveEntriesV1(entries) {
-    const findings = [];
-    for (const entry of entries) {
-        if (entry.customerContent || !shouldScanArchiveEntry(entry)) {
-            continue;
-        }
-        for (const finding of scanArchiveEntry(entry)) {
-            findings.push(finding);
-        }
-    }
-    return Object.freeze(findings);
-}
-export function assertSessionRecordArchivePublicSafeV1(entries) {
-    const findings = scanSessionRecordArchiveEntriesV1(entries);
-    if (findings.length > 0) {
-        throw new SessionRecordArchiveRedactionError(findings);
-    }
-}
-function shouldScanArchiveEntry(entry) {
-    if (entry.path.startsWith("files/")) {
-        return false;
-    }
-    const contentType = entry.contentType?.toLowerCase() ?? "";
-    if (contentType.startsWith("text/") ||
-        contentType.includes("json") ||
-        contentType.includes("xml") ||
-        contentType.includes("yaml")) {
-        return true;
-    }
-    return /\.(?:json|jsonl|ndjson|txt|log|md|csv|tsv|ya?ml)$/i.test(entry.path);
-}
-function scanArchiveEntry(entry) {
-    const text = new TextDecoder().decode(entry.bytes);
-    const parsedValues = parseArchiveTextValues(entry.path, text);
-    const rawFindings = parsedValues.length > 0
-        ? parsedValues.flatMap((value) => [...scanCustodyPayloadForSensitiveValues(value.value)].map((finding) => ({
-            ...finding,
-            path: `${value.path}${finding.path === "$" ? "" : finding.path.slice(1)}`
-        })))
-        : scanCustodyPayloadForSensitiveValues(text);
-    return Object.freeze(rawFindings
-        .filter((finding) => !isAllowedArchiveHighEntropyField(entry.path, finding))
-        .map((finding) => Object.freeze({
-        entryPath: entry.path,
-        path: finding.path,
-        reason: finding.reason,
-        ...(finding.valueLength !== undefined ? { valueLength: finding.valueLength } : {})
-    })));
-}
-function isAllowedArchiveHighEntropyField(entryPath, finding) {
-    if (finding.reason !== "high_entropy_token" || !entryPath.endsWith("manifest.json")) {
-        return false;
-    }
-    return /^\$(?:\.files\[\d+\]|\.sessionFiles\[\d+\])\.id$/.test(finding.path);
-}
-function parseArchiveTextValues(path, text) {
-    if (/\.json$/i.test(path)) {
-        const parsed = tryParseJson(text);
-        return parsed.ok ? Object.freeze([{ path: "$", value: parsed.value }]) : Object.freeze([]);
-    }
-    if (/\.(?:jsonl|ndjson)$/i.test(path)) {
-        const values = [];
-        const lines = text.split(/\r?\n/);
-        for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
-            if (!line?.trim()) {
-                continue;
-            }
-            const parsed = tryParseJson(line);
-            if (!parsed.ok) {
-                return Object.freeze([]);
-            }
-            values.push({ path: `$[${i}]`, value: parsed.value });
-        }
-        return Object.freeze(values);
-    }
-    return Object.freeze([]);
-}
-function tryParseJson(text) {
-    try {
-        return { ok: true, value: JSON.parse(text) };
-    }
-    catch {
-        return { ok: false };
-    }
-}
-function formatArchiveFindingPaths(findings) {
-    return findings.map((finding) => `${finding.entryPath}${finding.path} (${finding.reason})`).join(", ");
-}

package/dist/_contracts/session-retention.d.ts

@@ -1,201 +0,0 @@
-export declare const SESSION_RETENTION_SCHEMA_VERSION = 1;
-export declare const SESSION_DELETION_MANIFEST_KIND = "aex.session_deletion_manifest.v1";
-export declare const SESSION_DELETION_JOB_KIND = "aex.session_deletion_job.v1";
-export declare const SESSION_DELETION_MANIFEST_CONTENT_TYPE = "application/json; charset=utf-8";
-export declare const SESSION_RETENTION_REDACTION_SCANNER_VERSION = 1;
-export declare const SESSION_DELETION_REASONS: readonly ["manual_delete", "retention_gc"];
-export type SessionDeletionReason = (typeof SESSION_DELETION_REASONS)[number];
-export declare const SESSION_DELETION_MANIFEST_MODES: readonly ["dry_run", "final"];
-export type SessionDeletionManifestMode = (typeof SESSION_DELETION_MANIFEST_MODES)[number];
-export declare const SESSION_DELETION_CANDIDATE_STATUSES: readonly ["selected", "blocked"];
-export type SessionDeletionCandidateStatus = (typeof SESSION_DELETION_CANDIDATE_STATUSES)[number];
-export declare const SESSION_DELETION_BLOCKERS: readonly ["non_terminal", "retention_policy_disabled", "missing_terminal_at", "unexpired", "held", "retention_exempt", "unresolved_cleanup", "unresolved_custody"];
-export type SessionDeletionBlocker = (typeof SESSION_DELETION_BLOCKERS)[number];
-export declare const SESSION_DELETION_COUNT_CLASSES: readonly ["object_store_objects", "files", "logs", "events", "assets", "db_event_rows", "db_file_rows", "capture_failures", "storage_samples", "custody_manifests"];
-export type SessionDeletionCountClass = (typeof SESSION_DELETION_COUNT_CLASSES)[number];
-export declare const SESSION_DELETION_COUNT_STATUSES: readonly ["counted", "not_counted", "partial", "failed"];
-export type SessionDeletionCountStatus = (typeof SESSION_DELETION_COUNT_STATUSES)[number];
-export declare const SESSION_DELETION_JOB_STATUSES: readonly ["queued", "planning", "blocked", "manifest_written", "deleting", "delete_failed", "completed", "failed"];
-export type SessionDeletionJobStatus = (typeof SESSION_DELETION_JOB_STATUSES)[number];
-export declare const SESSION_DELETION_PROOF_STATUSES: readonly ["not_started", "running", "completed", "failed"];
-export type SessionDeletionProofStatus = (typeof SESSION_DELETION_PROOF_STATUSES)[number];
-export declare const SESSION_DELETION_WRITE_STATUSES: readonly ["not_written", "written", "write_failed"];
-export type SessionDeletionWriteStatus = (typeof SESSION_DELETION_WRITE_STATUSES)[number];
-export declare const SESSION_RETENTION_EXCLUDED_VALUE_CLASSES: readonly ["raw_paths", "object_keys", "filenames", "object_sizes", "hashes", "provider_ids", "vault_ids", "resource_ids", "resource_handles", "signed_urls"];
-export type SessionRetentionExcludedValueClass = (typeof SESSION_RETENTION_EXCLUDED_VALUE_CLASSES)[number];
-export interface SessionRetentionPolicyV1 {
-    readonly mode: "retain_indefinitely" | "delete_after_days";
-    readonly manualDelete: "enabled";
-    readonly automaticDeletion: "disabled" | "enabled";
-    readonly retentionDays?: number;
-}
-export interface SessionRetentionPolicyInput {
-    readonly automaticDeletion?: boolean;
-    readonly retentionDays?: number;
-}
-export interface SessionDeletionCandidateSessionV1 {
-    readonly sessionId: string;
-    readonly workspaceId: string;
-    readonly status: string;
-    readonly createdAt?: string;
-    readonly terminalAt?: string;
-    readonly held?: boolean;
-    readonly retentionExempt?: boolean;
-    readonly unresolvedCleanup?: boolean;
-    readonly unresolvedCustody?: boolean;
-}
-export interface SessionDeletionBlockerV1 {
-    readonly code: SessionDeletionBlocker;
-    readonly observedAt: string;
-}
-export interface SessionDeletionCandidateV1 {
-    readonly status: SessionDeletionCandidateStatus;
-    readonly reason: SessionDeletionReason;
-    readonly evaluatedAt: string;
-    readonly eligibleAt?: string;
-    readonly blockers: readonly SessionDeletionBlockerV1[];
-}
-export interface SessionDeletionCandidateInput {
-    readonly session: SessionDeletionCandidateSessionV1;
-    readonly reason: SessionDeletionReason;
-    readonly policy?: SessionRetentionPolicyV1 | SessionRetentionPolicyInput;
-    readonly now: string;
-}
-export interface SessionDeletionCountV1 {
-    readonly class: SessionDeletionCountClass | string;
-    readonly count: number;
-    readonly status: SessionDeletionCountStatus;
-    readonly countedAt?: string;
-    readonly errorClass?: string;
-}
-export interface SessionDeletionManifestSessionV1 {
-    readonly sessionId: string;
-    readonly workspaceId: string;
-    readonly status: string;
-    readonly createdAt?: string;
-    readonly terminalAt?: string;
-    readonly eligibleAt?: string;
-}
-export interface SessionDeletionManifestRequestV1 {
-    readonly reason: SessionDeletionReason;
-    readonly actorClass: "user" | "api_key" | "system" | "operator";
-}
-export interface SessionDeletionManifestSummaryV1 {
-    readonly totalCount: number;
-    readonly failedCountClasses: number;
-    readonly partialCountClasses: number;
-    readonly blockerCount: number;
-    readonly counts: readonly SessionDeletionCountV1[];
-}
-export interface SessionDeletionManifestRedactionV1 {
-    readonly policy: "counts_status_timestamps_only";
-    readonly scannerVersion: typeof SESSION_RETENTION_REDACTION_SCANNER_VERSION;
-    readonly excludes: readonly SessionRetentionExcludedValueClass[];
-}
-export interface SessionDeletionManifestV1 {
-    readonly schemaVersion: typeof SESSION_RETENTION_SCHEMA_VERSION;
-    readonly kind: typeof SESSION_DELETION_MANIFEST_KIND;
-    readonly generatedAt: string;
-    readonly mode: SessionDeletionManifestMode;
-    readonly session: SessionDeletionManifestSessionV1;
-    readonly request: SessionDeletionManifestRequestV1;
-    readonly candidate: SessionDeletionCandidateV1;
-    readonly summary: SessionDeletionManifestSummaryV1;
-    readonly redaction: SessionDeletionManifestRedactionV1;
-}
-export interface SessionDeletionManifestInput {
-    readonly generatedAt: string;
-    readonly mode: SessionDeletionManifestMode;
-    readonly session: SessionDeletionCandidateSessionV1;
-    readonly request: SessionDeletionManifestRequestV1;
-    readonly candidate?: SessionDeletionCandidateV1;
-    readonly policy?: SessionRetentionPolicyV1 | SessionRetentionPolicyInput;
-    readonly counts?: readonly SessionDeletionCountV1[];
-}
-export interface SessionDeletionManifestProofV1 {
-    readonly status: SessionDeletionWriteStatus;
-    readonly mode?: SessionDeletionManifestMode;
-    readonly writtenAt?: string;
-}
-export interface SessionDeletionPurgeProofV1 {
-    readonly status: SessionDeletionProofStatus;
-    readonly startedAt?: string;
-    readonly completedAt?: string;
-    readonly deletedObjectCount?: number;
-}
-export interface SessionDeletionOrderProofV1 {
-    readonly manifest: SessionDeletionManifestProofV1;
-    readonly purge: SessionDeletionPurgeProofV1;
-}
-export interface SessionDeletionJobV1 {
-    readonly schemaVersion: typeof SESSION_RETENTION_SCHEMA_VERSION;
-    readonly kind: typeof SESSION_DELETION_JOB_KIND;
-    readonly jobId: string;
-    readonly sessionId: string;
-    readonly workspaceId: string;
-    readonly reason: SessionDeletionReason;
-    readonly mode: SessionDeletionManifestMode;
-    readonly status: SessionDeletionJobStatus;
-    readonly createdAt: string;
-    readonly updatedAt?: string;
-    readonly order: SessionDeletionOrderProofV1;
-    readonly candidate?: SessionDeletionCandidateV1;
-    readonly summary?: SessionDeletionManifestSummaryV1;
-}
-export interface SessionDeletionJobInput {
-    readonly jobId: string;
-    readonly sessionId: string;
-    readonly workspaceId: string;
-    readonly reason: SessionDeletionReason;
-    readonly mode: SessionDeletionManifestMode;
-    readonly status: SessionDeletionJobStatus;
-    readonly createdAt: string;
-    readonly updatedAt?: string;
-    readonly order: SessionDeletionOrderProofV1;
-    readonly candidate?: SessionDeletionCandidateV1;
-    readonly summary?: SessionDeletionManifestSummaryV1;
-}
-export interface SessionDeletionManifestWriteObject {
-    readonly sessionId: string;
-    readonly workspaceId: string;
-    readonly contentType: typeof SESSION_DELETION_MANIFEST_CONTENT_TYPE;
-    readonly manifest: SessionDeletionManifestV1;
-}
-export interface SessionDeletionManifestObjectStore {
-    putSessionDeletionManifestObject(object: SessionDeletionManifestWriteObject): Promise<void>;
-}
-export interface SessionDeletionManifestWriteResult {
-    readonly status: "written";
-    readonly schemaVersion: typeof SESSION_RETENTION_SCHEMA_VERSION;
-    readonly sessionId: string;
-    readonly workspaceId: string;
-    readonly writtenAt: string;
-    readonly mode: SessionDeletionManifestMode;
-}
-export interface SessionDeletionManifestWriter {
-    writeSessionDeletionManifest(input: SessionDeletionManifestInput): Promise<SessionDeletionManifestWriteResult>;
-}
-export type SessionRetentionRedactionReason = "forbidden_field_name" | "uninspectable_value" | "bearer_token" | "provider_key" | "signed_url" | "object_store_key" | "vault_id" | "private_resource_handle" | "high_entropy_token" | "hash_like_value";
-export interface SessionRetentionRedactionFinding {
-    readonly path: string;
-    readonly reason: SessionRetentionRedactionReason;
-    readonly valueLength?: number;
-}
-export declare class SessionRetentionValidationError extends Error {
-    readonly code = "session_retention_contract_invalid";
-    constructor(message: string);
-}
-export declare class SessionRetentionRedactionError extends Error {
-    readonly code = "session_retention_payload_not_public_safe";
-    readonly findings: readonly SessionRetentionRedactionFinding[];
-    constructor(findings: readonly SessionRetentionRedactionFinding[]);
-}
-export declare function createSessionDeletionManifestWriter(store: SessionDeletionManifestObjectStore): SessionDeletionManifestWriter;
-export declare function writeSessionDeletionManifest(store: SessionDeletionManifestObjectStore, input: SessionDeletionManifestInput): Promise<SessionDeletionManifestWriteResult>;
-export declare function buildSessionRetentionPolicy(input?: SessionRetentionPolicyInput): SessionRetentionPolicyV1;
-export declare function evaluateSessionDeletionCandidate(input: SessionDeletionCandidateInput): SessionDeletionCandidateV1;
-export declare function buildSessionDeletionManifest(input: SessionDeletionManifestInput): SessionDeletionManifestV1;
-export declare function assertSessionDeletionOrder(proof: SessionDeletionOrderProofV1): void;
-export declare function buildSessionDeletionJob(input: SessionDeletionJobInput): SessionDeletionJobV1;
-export declare function scanSessionRetentionPayloadForSensitiveValues(input: unknown): readonly SessionRetentionRedactionFinding[];
-export declare function assertPublicSafeSessionRetentionPayload(input: unknown): void;