@b00dea/cockpit 0.0.0-stage → 0.1.1

package/dist/surfaces/harness-registry.d.ts

@@ -0,0 +1,260 @@
+export declare const HARNESS_REGISTRY: readonly [Readonly<{
+    target: "claudecode";
+    type: 'agent';
+    displayName: "Claude Code";
+    rulesyncTarget: "claudecode";
+    rulesyncFeatures: readonly ["rules", "mcp", "subagents", "skills", "hooks", "permissions"];
+    outputs: Readonly<{
+        instruction: "CLAUDE.md";
+        skills: ".claude/skills";
+        mcp: ".mcp.json";
+        permissions: readonly string[];
+    }>;
+    guard: Readonly<{
+        capability: 'instructed';
+        firing: Readonly<{
+            state: 'enforced';
+            evidence: 'not_applicable';
+            measuredOn: "2026-11-01";
+            measuredVersion: "2.1.316";
+            provenance: "with the exact push pre-allowed by permissions, the hook refused git push to a protected branch and the remote stayed empty while git status ran; the same checkout without the hook pushed";
+        }>;
+    }>;
+    native: Readonly<{
+        state: 'instructed';
+        reason: "a person has not yet reviewed whether the tool loads and triggers them as written";
+    }>;
+    sessionStart: Readonly<{
+        state: 'instructed';
+        evidence: 'not_applicable';
+        measuredOn: "2026-11-03";
+        measuredVersion: "2.1.317";
+        provenance: "a SessionStart hook in .claude/settings.json ran under claude -p and the agent quoted its stdout back, while a hook under a misspelled event name never ran and Claude Code named it as ignored";
+    }>;
+    remoteMcp: Readonly<{
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string;
+        helper: boolean;
+        provenance: string;
+        state: 'instructed';
+        headers: true;
+        measuredOn: "2026-11-04";
+    }>;
+    servedCheckoutGrant: Readonly<{
+        state: 'enforced' | 'unavailable';
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string | null;
+        provenance: string;
+        measuredOn: "2026-11-04";
+    }>;
+}>, Readonly<{
+    target: "codexcli";
+    type: 'agent';
+    displayName: "Codex";
+    rulesyncTarget: "codexcli";
+    rulesyncFeatures: readonly ["rules", "mcp", "subagents", "skills", "hooks", "permissions"];
+    outputs: Readonly<{
+        instruction: "AGENTS.md";
+        skills: ".agents/skills";
+        mcp: ".codex/config.toml";
+        permissions: readonly string[];
+    }>;
+    guard: Readonly<{
+        capability: 'instructed';
+        firing: Readonly<{
+            state: 'enforced';
+            evidence: 'human_needed';
+            measuredOn: "2026-11-01";
+            measuredVersion: "0.165.0";
+            provenance: "only after a person trusts the hook: untrusted, Codex skipped it and git push ran; trusted (forced with --dangerously-bypass-hook-trust), it refused the push. Trust is per machine and cockpit doctor warns until it is given";
+        }>;
+    }>;
+    native: Readonly<{
+        state: 'instructed';
+        reason: "a person has not yet reviewed whether the tool loads and triggers them as written";
+    }>;
+    sessionStart: Readonly<{
+        state: 'instructed';
+        evidence: 'human_needed';
+        measuredOn: "2026-11-03";
+        measuredVersion: "0.166.0";
+        provenance: "only after a person trusts the hook, as for the guard: a trusted SessionStart hook in .codex/hooks.json ran under codex exec and the agent quoted its stdout back, while a hook under a misspelled event name never ran";
+    }>;
+    remoteMcp: Readonly<{
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string;
+        helper: boolean;
+        provenance: string;
+        state: 'instructed';
+        headers: true;
+        measuredOn: "2026-11-04";
+    }>;
+    servedCheckoutGrant: Readonly<{
+        state: 'enforced' | 'unavailable';
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string | null;
+        provenance: string;
+        measuredOn: "2026-11-04";
+    }>;
+}>, Readonly<{
+    target: "opencode";
+    type: 'agent';
+    displayName: "OpenCode";
+    rulesyncTarget: "opencodev1";
+    rulesyncFeatures: readonly ["rules", "mcp", "subagents", "skills", "hooks"];
+    outputs: Readonly<{
+        instruction: "AGENTS.md";
+        skills: ".opencode/skills";
+        mcp: "opencode.jsonc";
+        permissions: readonly string[];
+    }>;
+    guard: Readonly<{
+        capability: 'instructed';
+        firing: Readonly<{
+            state: 'enforced';
+            evidence: 'not_applicable';
+            measuredOn: "2026-11-01";
+            measuredVersion: "1.19.4";
+            provenance: "the plugin refused git push and a native read of a secrets file while an unprotected read stayed allowed; before read was routed through the guard, the same read returned the file";
+        }>;
+    }>;
+    native: Readonly<{
+        state: 'instructed';
+        reason: "a person has not yet reviewed whether the tool loads and triggers them as written";
+    }>;
+    sessionStart: {
+        state: 'unavailable';
+        evidence: 'not_applicable';
+        measuredOn: string;
+        measuredVersion: null;
+        provenance: string;
+    };
+    remoteMcp: Readonly<{
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string;
+        helper: boolean;
+        provenance: string;
+        state: 'instructed';
+        headers: true;
+        measuredOn: "2026-11-04";
+    }>;
+    servedCheckoutGrant: Readonly<{
+        state: 'enforced' | 'unavailable';
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string | null;
+        provenance: string;
+        measuredOn: "2026-11-04";
+    }>;
+}>, Readonly<{
+    target: "cursor";
+    type: 'agent';
+    displayName: "Cursor";
+    rulesyncTarget: "cursor";
+    rulesyncFeatures: readonly ["rules", "mcp", "subagents", "skills", "hooks", "permissions"];
+    outputs: Readonly<{
+        instruction: ".cursor/rules";
+        skills: ".cursor/skills";
+        mcp: ".cursor/mcp.json";
+        permissions: readonly string[];
+    }>;
+    guard: Readonly<{
+        capability: 'unavailable';
+        measuredOn: "2026-10-28";
+        reason: "no guard adapter is checked in, so cockpit generates no guard hook";
+    }>;
+    native: Readonly<{
+        state: 'generated';
+        measuredOn: "2026-10-28";
+        reason: "cockpit writes the files, but no run of the tool beside a broken control has shown that it loads them";
+    }>;
+    sessionStart: {
+        state: 'unavailable';
+        evidence: 'not_applicable';
+        measuredOn: string;
+        measuredVersion: null;
+        provenance: string;
+    };
+    remoteMcp: Readonly<{
+        state: 'unavailable';
+        evidence: 'not_applicable';
+        headers: false;
+        helper: false;
+        measuredOn: "2026-11-04";
+        measuredVersion: null;
+        provenance: "cockpit writes no remote MCP server for this tool: its remote transport and header spelling have not been checked";
+    }>;
+    servedCheckoutGrant: Readonly<{
+        state: 'enforced' | 'unavailable';
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string | null;
+        provenance: string;
+        measuredOn: "2026-11-04";
+    }>;
+}>, Readonly<{
+    target: "grokcli";
+    type: 'agent';
+    displayName: "Grok Build";
+    rulesyncTarget: "grokcli";
+    rulesyncFeatures: readonly ["rules", "mcp", "subagents", "skills", "hooks", "permissions"];
+    outputs: Readonly<{
+        instruction: "AGENTS.md";
+        skills: ".grok/skills";
+        mcp: ".grok/config.toml";
+        permissions: readonly string[];
+    }>;
+    guard: Readonly<{
+        capability: 'unavailable';
+        measuredOn: "2026-10-28";
+        reason: "no guard adapter is checked in, so cockpit generates no guard hook";
+    }>;
+    native: Readonly<{
+        state: 'generated';
+        measuredOn: "2026-10-28";
+        reason: "cockpit writes the files, but no run of the tool beside a broken control has shown that it loads them";
+    }>;
+    sessionStart: {
+        state: 'unavailable';
+        evidence: 'not_applicable';
+        measuredOn: string;
+        measuredVersion: null;
+        provenance: string;
+    };
+    remoteMcp: Readonly<{
+        state: 'unavailable';
+        evidence: 'not_applicable';
+        headers: false;
+        helper: false;
+        measuredOn: "2026-11-04";
+        measuredVersion: null;
+        provenance: "cockpit writes no remote MCP server for this tool: its remote transport and header spelling have not been checked";
+    }>;
+    servedCheckoutGrant: Readonly<{
+        state: 'enforced' | 'unavailable';
+        evidence: 'not_applicable' | 'human_needed';
+        measuredVersion: string | null;
+        provenance: string;
+        measuredOn: "2026-11-04";
+    }>;
+}>];
+export type HarnessRegistryRow = typeof HARNESS_REGISTRY[number];
+export type SurfaceTarget = HarnessRegistryRow['target'];
+export type GuardSurfaceTarget = Extract<HarnessRegistryRow, {
+    readonly guard: {
+        readonly capability: 'instructed';
+    };
+}>['target'];
+export declare const SURFACE_TARGETS: readonly SurfaceTarget[];
+export declare const GUARD_SURFACE_TARGETS: readonly GuardSurfaceTarget[];
+export declare const DEFAULT_SURFACE_TOOLS: readonly ("claudecode" | "codexcli" | "opencode")[];
+/** The listed tools in registry order, so rendering and drift do not depend on how the list is spelled. */
+export declare function listedSurfaceTargets(tools: readonly string[]): readonly SurfaceTarget[];
+export declare const SURFACE_EXECUTION_CONTROL_PATHS: readonly string[];
+export declare const SURFACE_PUBLICATION_ANCHORS: readonly string[];
+export declare function isGuardSurfaceTarget(value: unknown): value is GuardSurfaceTarget;
+/**
+ * A date a capability was measured on: a real calendar day, written YYYY-MM-DD, that is not still
+ * to come. Re-measuring a tool changes its date here and in the rows that quote it; the shape is
+ * checked rather than pinned to one literal, so a new run does not mean editing a type and a guard.
+ */
+export declare function isMeasurementDate(value: unknown, today?: Date): value is string;
+export declare function harnessFact(target: SurfaceTarget): HarnessRegistryRow;

package/dist/surfaces/harness-registry.js

@@ -0,0 +1,146 @@
+// Guard firing and instruction loading for these harnesses are dated runs (the firing records below
+// and the projection's instruction capabilities), so this record claims no pending measurement for
+// them; what stays open is a person's review of the rendered skills.
+const reviewedNative = Object.freeze({
+    state: 'instructed',
+    reason: 'a person has not yet reviewed whether the tool loads and triggers them as written',
+});
+// Cockpit writes rules, skills, MCP and permission files for these harnesses through the
+// generator, so `unavailable` (nothing emitted) would be false; nothing yet shows the tool reads them.
+const generatedNative = Object.freeze({
+    state: 'generated',
+    measuredOn: '2026-10-28',
+    reason: 'cockpit writes the files, but no run of the tool beside a broken control has shown that it loads them',
+});
+const noGuardAdapter = Object.freeze({
+    capability: 'unavailable',
+    measuredOn: '2026-10-28',
+    reason: 'no guard adapter is checked in, so cockpit generates no guard hook',
+});
+// A dated run of the real tool against the generated guard. It replaces the adapter's own record in
+// the capability matrix only while that adapter stays native; the adapter keeps recording the
+// transport shape it was written against.
+const claudeFiring = Object.freeze({
+    state: 'enforced', evidence: 'not_applicable', measuredOn: '2026-11-01', measuredVersion: '2.1.316',
+    provenance: 'with the exact push pre-allowed by permissions, the hook refused git push to a protected branch and the remote stayed empty while git status ran; the same checkout without the hook pushed',
+});
+const codexFiring = Object.freeze({
+    state: 'enforced', evidence: 'human_needed', measuredOn: '2026-11-01', measuredVersion: '0.165.0',
+    provenance: 'only after a person trusts the hook: untrusted, Codex skipped it and git push ran; trusted (forced with --dangerously-bypass-hook-trust), it refused the push. Trust is per machine and cockpit doctor warns until it is given',
+});
+const openCodeFiring = Object.freeze({
+    state: 'enforced', evidence: 'not_applicable', measuredOn: '2026-11-01', measuredVersion: '1.19.4',
+    provenance: 'the plugin refused git push and a native read of a secrets file while an unprotected read stayed allowed; before read was routed through the guard, the same read returned the file',
+});
+// The session-start drift check is guidance: the tool runs `cockpit check` as a session starts and
+// shows its report to the agent, which nothing makes act on it. Each run below put a marker line from
+// the hook into the agent's context, beside a misspelled event that never ran.
+const claudeSessionStart = Object.freeze({
+    state: 'instructed', evidence: 'not_applicable', measuredOn: '2026-11-03', measuredVersion: '2.1.317',
+    provenance: 'a SessionStart hook in .claude/settings.json ran under claude -p and the agent quoted its stdout back, while a hook under a misspelled event name never ran and Claude Code named it as ignored',
+});
+const codexSessionStart = Object.freeze({
+    state: 'instructed', evidence: 'human_needed', measuredOn: '2026-11-03', measuredVersion: '0.166.0',
+    provenance: 'only after a person trusts the hook, as for the guard: a trusted SessionStart hook in .codex/hooks.json ran under codex exec and the agent quoted its stdout back, while a hook under a misspelled event name never ran',
+});
+const noSessionStart = (reason) => ({ state: 'unavailable', evidence: 'not_applicable', measuredOn: '2026-11-03', measuredVersion: null, provenance: reason });
+// What each tool's native MCP file can say for a remote (streamable HTTP) server. A header must come
+// from an environment reference or a headers helper, never a literal; a tool that cannot express a
+// server's credential gets nothing for that server, because a server written without it would start,
+// fail to authenticate and read as configured. Each run connected the tool to a loopback server that
+// recorded the request headers, beside a control spelled the way the tool does not read.
+const remoteMcpMeasured = (fact) => Object.freeze({ state: 'instructed', headers: true, measuredOn: '2026-11-04', ...fact });
+const noRemoteMcp = Object.freeze({ state: 'unavailable', evidence: 'not_applicable', headers: false, helper: false,
+    measuredOn: '2026-11-04', measuredVersion: null,
+    provenance: 'cockpit writes no remote MCP server for this tool: its remote transport and header spelling have not been checked' });
+// Whether `cockpit use` can grant a checkout served from outside the declared one through a
+// machine-local file the tool reads. Each run wrote into the granted directory and into an
+// ungranted control beside it.
+const servedGrant = (fact) => Object.freeze({ measuredOn: '2026-11-04', ...fact });
+const noServedGrant = servedGrant({ state: 'unavailable', evidence: 'not_applicable', measuredVersion: null,
+    provenance: 'the tool was not installed where this was measured, so cockpit use writes nothing for it' });
+const completeRulesyncFeatures = Object.freeze(['rules', 'mcp', 'subagents', 'skills', 'hooks', 'permissions']);
+const nonPermissionRulesyncFeatures = Object.freeze(['rules', 'mcp', 'subagents', 'skills', 'hooks']);
+export const HARNESS_REGISTRY = Object.freeze([
+    Object.freeze({
+        target: 'claudecode', type: 'agent', displayName: 'Claude Code', rulesyncTarget: 'claudecode',
+        rulesyncFeatures: completeRulesyncFeatures,
+        outputs: Object.freeze({ instruction: 'CLAUDE.md', skills: '.claude/skills', mcp: '.mcp.json', permissions: Object.freeze(['.claude/settings.json']) }),
+        guard: Object.freeze({ capability: 'instructed', firing: claudeFiring }), native: reviewedNative, sessionStart: claudeSessionStart,
+        remoteMcp: remoteMcpMeasured({ evidence: 'human_needed', measuredVersion: '2.1.318', helper: true,
+            provenance: 'from a project .mcp.json, Claude Code sent the Authorization header a ${NAME} reference named while a $NAME control went out literally; it ran a headersHelper given with --mcp-config, but refused to run one from the project file until a person trusts the workspace, and a misspelled headerHelper sent nothing' }),
+        servedCheckoutGrant: servedGrant({ state: 'enforced', evidence: 'human_needed', measuredVersion: '2.1.318',
+            provenance: 'a directory in .claude/settings.local.json permissions.additionalDirectories was written and the control refused, and a malformed twin granted nothing; measured in an untrusted workspace, so whether it combines with the committed list once a person trusts the workspace is unmeasured' }),
+    }),
+    Object.freeze({
+        target: 'codexcli', type: 'agent', displayName: 'Codex', rulesyncTarget: 'codexcli',
+        rulesyncFeatures: completeRulesyncFeatures,
+        outputs: Object.freeze({ instruction: 'AGENTS.md', skills: '.agents/skills', mcp: '.codex/config.toml', permissions: Object.freeze(['.codex/config.toml']) }),
+        guard: Object.freeze({ capability: 'instructed', firing: codexFiring }), native: reviewedNative, sessionStart: codexSessionStart,
+        remoteMcp: remoteMcpMeasured({ evidence: 'not_applicable', measuredVersion: '0.166.0', helper: true,
+            provenance: 'from a project .codex/config.toml in a directory Codex had not been told to trust, codex exec sent the bearer_token_env_var and env_http_headers values and the http_headers_helper output, named a misspelled http_header_helper as ignored, and sent a ${NAME} written in http_headers literally' }),
+        servedCheckoutGrant: servedGrant({ state: 'unavailable', evidence: 'not_applicable', measuredVersion: '0.166.0',
+            provenance: 'Codex reads no machine-local project file; --add-dir at start made the worktree writable and without it the write was refused, so cockpit use prints that flag and writes nothing' }),
+    }),
+    Object.freeze({
+        target: 'opencode', type: 'agent', displayName: 'OpenCode', rulesyncTarget: 'opencodev1',
+        rulesyncFeatures: nonPermissionRulesyncFeatures,
+        outputs: Object.freeze({ instruction: 'AGENTS.md', skills: '.opencode/skills', mcp: 'opencode.jsonc', permissions: Object.freeze(['opencode.jsonc']) }),
+        guard: Object.freeze({ capability: 'instructed', firing: openCodeFiring }), native: reviewedNative,
+        // OpenCode 1.19.5 delivered session.created to a project plugin beside a misspelled hook that
+        // never ran, but its model call failed, so no plugin hook was shown to put text in the agent's context.
+        sessionStart: noSessionStart('OpenCode 1.19.5 delivers session.created to a plugin, but no run has shown a plugin putting text in the agent\'s context, so cockpit generates no session-start check'),
+        remoteMcp: remoteMcpMeasured({ evidence: 'not_applicable', measuredVersion: '1.19.5', helper: false,
+            provenance: 'opencode mcp list sent headers expanded from {env:NAME} in a project opencode.jsonc while a ${NAME} control went out literally; its remote server schema has no headers helper, so a server that declares one is not written for it' }),
+        servedCheckoutGrant: servedGrant({ state: 'enforced', evidence: 'not_applicable', measuredVersion: '1.19.5',
+            provenance: 'the machine-local grant file holding the worktree path allowed the write and the control was denied, and a pattern naming a missing grant file stopped OpenCode at start, naming the file' }),
+    }),
+    Object.freeze({
+        target: 'cursor', type: 'agent', displayName: 'Cursor', rulesyncTarget: 'cursor',
+        rulesyncFeatures: completeRulesyncFeatures,
+        // Rules overlays only: cockpit's own instructions reach Cursor through the root AGENTS.md.
+        outputs: Object.freeze({ instruction: '.cursor/rules', skills: '.cursor/skills', mcp: '.cursor/mcp.json', permissions: Object.freeze(['.cursor/cli.json']) }),
+        guard: noGuardAdapter, native: generatedNative, sessionStart: noSessionStart('cockpit generates no hook for this tool'),
+        remoteMcp: noRemoteMcp, servedCheckoutGrant: noServedGrant,
+    }),
+    Object.freeze({
+        target: 'grokcli', type: 'agent', displayName: 'Grok Build', rulesyncTarget: 'grokcli',
+        rulesyncFeatures: completeRulesyncFeatures,
+        outputs: Object.freeze({ instruction: 'AGENTS.md', skills: '.grok/skills', mcp: '.grok/config.toml', permissions: Object.freeze(['.grok/config.toml']) }),
+        guard: noGuardAdapter, native: generatedNative, sessionStart: noSessionStart('cockpit generates no hook for this tool'),
+        remoteMcp: noRemoteMcp, servedCheckoutGrant: noServedGrant,
+    }),
+]);
+export const SURFACE_TARGETS = Object.freeze(HARNESS_REGISTRY.map(row => row.target));
+export const GUARD_SURFACE_TARGETS = Object.freeze(HARNESS_REGISTRY
+    .filter((row) => row.guard.capability === 'instructed')
+    .map(row => row.target));
+// The tools a cockpit renders when cockpit.toml lists none: the ones whose guard firing is a dated run
+// of the real tool. A tool the matrix has not measured is rendered only when a team lists it.
+export const DEFAULT_SURFACE_TOOLS = GUARD_SURFACE_TARGETS;
+/** The listed tools in registry order, so rendering and drift do not depend on how the list is spelled. */
+export function listedSurfaceTargets(tools) {
+    return SURFACE_TARGETS.filter(target => tools.includes(target));
+}
+// Native MCP and permission outputs can select executable programs or relax harness authority.
+// The guard derives its protected files from this owner so a new harness cannot omit the boundary.
+export const SURFACE_EXECUTION_CONTROL_PATHS = Object.freeze([...new Set(HARNESS_REGISTRY.flatMap(row => [row.outputs.mcp, ...row.outputs.permissions]))].sort());
+export const SURFACE_PUBLICATION_ANCHORS = Object.freeze([...new Set(HARNESS_REGISTRY.flatMap(row => [row.outputs.instruction, row.outputs.skills, row.outputs.mcp, ...row.outputs.permissions]
+        .filter(path => path.includes('/')).map(path => path.split('/')[0]).filter(path => path.startsWith('.'))))].sort());
+export function isGuardSurfaceTarget(value) {
+    return typeof value === 'string' && GUARD_SURFACE_TARGETS.some(target => target === value);
+}
+/**
+ * A date a capability was measured on: a real calendar day, written YYYY-MM-DD, that is not still
+ * to come. Re-measuring a tool changes its date here and in the rows that quote it; the shape is
+ * checked rather than pinned to one literal, so a new run does not mean editing a type and a guard.
+ */
+export function isMeasurementDate(value, today = new Date()) {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value))
+        return false;
+    const parsed = new Date(`${value}T00:00:00.000Z`);
+    return !Number.isNaN(parsed.valueOf()) && parsed.toISOString().slice(0, 10) === value && value <= today.toISOString().slice(0, 10);
+}
+export function harnessFact(target) {
+    return HARNESS_REGISTRY.find(row => row.target === target);
+}

package/dist/surfaces/mcp.d.ts

@@ -0,0 +1,145 @@
+import { z } from 'zod';
+import { type SurfaceSourceFile, type SurfaceTarget } from './contract.js';
+declare const Source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"core">;
+    path: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"overlay">;
+    path: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"sibling">;
+    path: z.ZodString;
+    sha256: z.ZodString;
+    slug: z.ZodString;
+}, z.core.$strict>], "kind">;
+declare const StdioDeclaration: z.ZodObject<{
+    name: z.ZodString;
+    command: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    cwd: z.ZodString;
+    envNames: z.ZodArray<z.ZodString>;
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"core">;
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"overlay">;
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"sibling">;
+        path: z.ZodString;
+        sha256: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+declare const HttpDeclaration: z.ZodObject<{
+    name: z.ZodString;
+    transport: z.ZodLiteral<"http">;
+    url: z.ZodString;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    helper: z.ZodNullable<z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodArray<z.ZodString>;
+        cwd: z.ZodString;
+    }, z.core.$strict>>;
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"core">;
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"overlay">;
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"sibling">;
+        path: z.ZodString;
+        sha256: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+type McpSource = z.infer<typeof Source>;
+export type McpStdioDeclaration = z.infer<typeof StdioDeclaration>;
+export type McpHttpDeclaration = z.infer<typeof HttpDeclaration>;
+type McpDeclaration = McpStdioDeclaration | McpHttpDeclaration;
+export interface McpDiagnostic {
+    readonly code: 'MCP_INPUT_INVALID' | 'MCP_DECLARATION_INVALID' | 'MCP_COMMAND_CONFLICT' | 'MCP_NOT_APPROVED' | 'MCP_APPROVAL_UNKNOWN' | 'MCP_TRANSPORT_UNAVAILABLE';
+    readonly message: string;
+    readonly server?: string;
+    readonly sources?: readonly McpSource[];
+    /** The approval digest of the server's current declaration, on MCP_NOT_APPROVED. */
+    readonly sha256?: string;
+    /** The tools a server is not written for, on MCP_TRANSPORT_UNAVAILABLE. */
+    readonly targets?: readonly SurfaceTarget[];
+}
+interface McpLaunch {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+}
+export type McpServer = Readonly<{
+    name: string;
+    command: string;
+    args: readonly string[];
+    cwd: string;
+    envNames: readonly string[];
+    enabled: boolean;
+    sources: readonly McpSource[];
+}> | Readonly<{
+    name: string;
+    transport: 'http';
+    url: string;
+    headers: Readonly<Record<string, string>>;
+    helper: McpLaunch | null;
+    envNames: readonly string[];
+    enabled: boolean;
+    sources: readonly McpSource[];
+}>;
+export type McpHarnessServer = Readonly<{
+    name: string;
+    command: string;
+    args: readonly string[];
+    enabled: boolean;
+}> | Readonly<{
+    name: string;
+    url: string;
+    headers: Readonly<Record<string, string>>;
+    headersHelper: string | null;
+    enabled: boolean;
+}>;
+export interface McpCollection {
+    readonly servers: readonly McpServer[];
+    readonly wrappers: readonly {
+        readonly path: string;
+        readonly bytes: string;
+        readonly sha256: string;
+    }[];
+    readonly harnesses: readonly {
+        readonly target: SurfaceTarget;
+        readonly servers: readonly McpHarnessServer[];
+    }[];
+}
+export type McpCollectionOutcome = Readonly<{
+    kind: 'complete';
+    result: McpCollection;
+    diagnostics: readonly McpDiagnostic[];
+}> | Readonly<{
+    kind: 'refusal';
+    diagnostic: McpDiagnostic;
+}>;
+type McpParseOutcome = Readonly<{
+    kind: 'complete';
+    declarations: readonly McpDeclaration[];
+}> | Readonly<{
+    kind: 'refusal';
+    diagnostic: McpDiagnostic;
+}>;
+type McpIdentity = Pick<McpStdioDeclaration, 'command' | 'args' | 'cwd' | 'envNames'> | Pick<McpHttpDeclaration, 'transport' | 'url' | 'headers' | 'helper'>;
+/** The digest `[mcp.approved]` records for a server, so a changed declaration is no longer approved. */
+export declare function mcpApprovalDigest(declaration: McpIdentity, cockpitDirectory: string): string;
+export declare function collectMcpDeclarations(input: unknown): McpCollectionOutcome;
+export declare function hasTargetMcpServers(sources: readonly SurfaceSourceFile[], target: SurfaceTarget): boolean;
+export declare function parseMcpDeclarationFile(input: unknown): McpParseOutcome;
+export {};