@claudexor/cli 1.0.1 → 2.1.3

package/dist/control-services.d.ts

@@ -0,0 +1,2490 @@
+import { type OperatorDecisionRecord, JournalManager, InteractionRegistry, ProjectPartitions, ProjectStore, ResourceStore, QuotaRegistry } from "@claudexor/daemon";
+import { listTrustService, updateTrustService } from "./trust-services.js";
+import { type ResourceAttachmentRef, type ControlSpecAnswersRequest, type ControlSpecQuestionsRequest } from "@claudexor/schema";
+import { AuthReadinessService } from "@claudexor/gateway";
+import { createSetupJobManager } from "./setup-jobs.js";
+import { SetupJobStore } from "./setup-job-store.js";
+import { SetupLifecycleBinding } from "./setup-lifecycle-binding.js";
+import { type ThreadApplyOptions } from "./thread-delivery.js";
+type SetupJobManager = ReturnType<typeof createSetupJobManager>;
+type SetupBinding = SetupLifecycleBinding<SetupJobStore, SetupJobManager>;
+type HarnessListInput = {
+    fresh?: boolean;
+    includeFakes?: boolean;
+    harnessIds?: string[];
+};
+export declare function controlServices(interactions: InteractionRegistry, projects: () => ProjectStore, threads: ProjectPartitions, setupBinding: SetupBinding, journalManager: JournalManager, authReadiness: AuthReadinessService, resources: ResourceStore, quotaRegistry: () => QuotaRegistry, daemonJobs: () => Promise<Array<{
+    runId?: string;
+    state: string;
+    finishedAt?: string;
+}>>): {
+    preflightRunRequirements: (request: import("@claudexor/schema").ControlRunStartRequest) => Promise<void>;
+    createUpload: (input: unknown, idempotencyKey: string) => Promise<{
+        state: "cancelled" | "open" | "uploading" | "uploaded";
+        uploadId: string;
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    writeUpload: (uploadId: string, chunks: AsyncIterable<Uint8Array>) => Promise<{
+        state: "cancelled" | "open" | "uploading" | "uploaded";
+        uploadId: string;
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    uploadStatus: (uploadId: string) => Promise<{
+        state: "cancelled" | "open" | "uploading" | "uploaded";
+        uploadId: string;
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    cancelUpload: (uploadId: string) => Promise<{
+        state: "cancelled" | "open" | "uploading" | "uploaded";
+        uploadId: string;
+        receivedBytes: number;
+        expectedBytes: number;
+    }>;
+    finalizeUpload: (uploadId: string, expectedSha256: string | undefined, idempotencyKey: string) => Promise<{
+        name: string;
+        kind: "file" | "image";
+        resourceId: string;
+        mime: string;
+        sha256: string;
+        sizeBytes: number;
+        createdAt: string;
+        deduplicated: boolean;
+    }>;
+    validateResources: (refs: ResourceAttachmentRef[]) => Promise<void>;
+    runRetention: import("./retention-service.js").RetentionRunner;
+    listProjects: () => Promise<{
+        projects: unknown[];
+    }>;
+    registerProject: (input: Parameters<ProjectStore["register"]>[0]) => Promise<{
+        created_at: string;
+        schema_version: 2;
+        id: string;
+        updated_at: string;
+        root: string;
+    }>;
+    relinkProject: (id: string, root: string) => Promise<{
+        created_at: string;
+        schema_version: 2;
+        id: string;
+        updated_at: string;
+        root: string;
+    }>;
+    createThread: (input: unknown) => Promise<{
+        state: "active" | "closed" | "trashed" | "purged";
+        created_at: string;
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        mode: "ask" | "plan" | "audit" | "agent" | "orchestrate";
+        schema_version: 2;
+        id: string;
+        auth_preference: "auto" | "subscription" | "api_key";
+        credential_profile_id: string | null;
+        title: string | null;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        run_ids: string[];
+        head_run_id: string | null;
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    listThreads: () => Promise<{
+        threads: unknown[];
+    }>;
+    threadDetail: (id: string) => Promise<{
+        thread: unknown;
+        sessions: unknown[];
+        turns: unknown[];
+    }>;
+    createThreadTurn: (id: string, prompt: string, opts: {
+        kind?: unknown;
+        parentRunId?: string | null;
+        planRunId?: string | null;
+        attachments?: ResourceAttachmentRef[];
+        idempotency?: {
+            key: string;
+            client: string;
+            request: unknown;
+        };
+    }) => Promise<{
+        created_at: string;
+        kind: "initial" | "followup" | "decision";
+        id: string;
+        prompt: string;
+        attachments: {
+            path: string;
+            name: string;
+            kind: "file" | "image";
+            resource_id: string;
+            mime: string;
+            sha256: string;
+            size_bytes: number;
+        }[];
+        thread_id: string;
+        run_id: string | null;
+        parent_run_id: string | null;
+        plan_run_id: string | null;
+        enqueue_error: {
+            code: string | null;
+            message: string;
+            retryable: boolean;
+            failed_at: string;
+        } | null;
+    }>;
+    updateThread: (id: string, patch: {
+        title?: string;
+        state?: string;
+        primaryHarness?: string | null;
+        credentialProfileId?: string | null;
+        eligibleHarnesses?: string[];
+    }) => Promise<{
+        state: "active" | "closed" | "trashed" | "purged";
+        created_at: string;
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        mode: "ask" | "plan" | "audit" | "agent" | "orchestrate";
+        schema_version: 2;
+        id: string;
+        auth_preference: "auto" | "subscription" | "api_key";
+        credential_profile_id: string | null;
+        title: string | null;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        run_ids: string[];
+        head_run_id: string | null;
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    trashThread: (id: string) => Promise<{
+        state: "active" | "closed" | "trashed" | "purged";
+        created_at: string;
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        mode: "ask" | "plan" | "audit" | "agent" | "orchestrate";
+        schema_version: 2;
+        id: string;
+        auth_preference: "auto" | "subscription" | "api_key";
+        credential_profile_id: string | null;
+        title: string | null;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        run_ids: string[];
+        head_run_id: string | null;
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    restoreThread: (id: string) => Promise<{
+        state: "active" | "closed" | "trashed" | "purged";
+        created_at: string;
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        mode: "ask" | "plan" | "audit" | "agent" | "orchestrate";
+        schema_version: 2;
+        id: string;
+        auth_preference: "auto" | "subscription" | "api_key";
+        credential_profile_id: string | null;
+        title: string | null;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        run_ids: string[];
+        head_run_id: string | null;
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    purgeThread: (id: string) => Promise<{
+        state: "active" | "closed" | "trashed" | "purged";
+        created_at: string;
+        workspace: {
+            mode: "in_place" | "isolated";
+            worktree_path: string | null;
+            base_sha: string | null;
+            delivered_through_run_id: string | null;
+        };
+        mode: "ask" | "plan" | "audit" | "agent" | "orchestrate";
+        schema_version: 2;
+        id: string;
+        auth_preference: "auto" | "subscription" | "api_key";
+        credential_profile_id: string | null;
+        title: string | null;
+        updated_at: string;
+        repo: {
+            root: string;
+            base_ref: string;
+        } | null;
+        primary_harness: string | null;
+        eligible_harnesses: string[];
+        run_ids: string[];
+        head_run_id: string | null;
+        trashed_at: string | null;
+        purge_after: string | null;
+        pre_trash_state: "active" | "closed" | null;
+    }>;
+    applyThread: (id: string, opts: ThreadApplyOptions) => Promise<{
+        applied: boolean;
+        status: string;
+        headMoved: boolean;
+        detail: string | null;
+        delivery: import("@claudexor/schema").ControlDeliveryResponse | null;
+    }>;
+    setTurnEnqueueError: (turnId: string, message: string, code: string | null, retryable?: boolean) => void;
+    listTrust: typeof listTrustService;
+    updateTrust: typeof updateTrustService;
+    pendingInteractions: (runId: string) => {
+        harnessId: string | null;
+        attemptId: string | null;
+        questions: {
+            options: {
+                label: string;
+                description: string | null;
+            }[];
+            id: string;
+            question: string;
+            header: string | null;
+            multi_select: boolean;
+        }[];
+        runId: string;
+        interactionId: string;
+        sourceTool: string | null;
+        requestedAt: string;
+        timeoutAt: string | null;
+    }[];
+    answerInteraction: (runId: string, interactionId: string, answers: unknown) => {
+        status: import("@claudexor/daemon").InteractionAnswerStatus;
+        message?: string;
+    };
+    operatorDecision: (runId: string, params: unknown) => OperatorDecisionRecord | null;
+    recordOperatorDecision: (runId: string, params: unknown, decision: Omit<OperatorDecisionRecord, "runId">, idempotency?: {
+        key: string;
+        client: string;
+        request: unknown;
+    }) => OperatorDecisionRecord;
+    beginDelivery: (params: unknown, input: {
+        key: string;
+        client: string;
+        operation: string;
+        request: unknown;
+    }) => Promise<{
+        reused: boolean;
+        id: string;
+        state: import("@claudexor/daemon").JobState;
+        params: unknown;
+        result?: unknown;
+        error?: string;
+        errorCode?: string;
+        errorStatus?: number;
+        createdAt: string;
+        runId?: string;
+        taskId?: string;
+        runDir?: string;
+        startedAt?: string;
+        finishedAt?: string;
+    }>;
+    completeDelivery: (id: string, result: unknown) => Promise<void>;
+    failDelivery: (id: string, error: unknown) => Promise<void>;
+    harnesses: (input?: HarnessListInput) => Promise<{
+        harnesses: {
+            configuredModel: string | null;
+            configuredModelCheck: {
+                status: "ok" | "rejected";
+                message?: string | null;
+            } | null;
+            readiness: {
+                status: "pass" | "fail" | "skip";
+                detail: string | null;
+                kind: "binary" | "auth" | "model" | "smoke" | "probe";
+                id: string;
+                title: string;
+            }[];
+            id: string;
+            available: boolean;
+            status: "ok" | "degraded" | "unavailable";
+            manifest: import("@claudexor/schema").HarnessManifest | null;
+            enabledIntents: import("@claudexor/schema").Intent[];
+            routableIntents: import("@claudexor/schema").Intent[];
+            disabledIntents: import("@claudexor/schema").Intent[];
+            checks: import("@claudexor/schema").ConformanceCheck[];
+            reasons: string[];
+            authSources: import("@claudexor/schema").AuthSourceReadiness[];
+        }[];
+    }>;
+    harnessModels: (input: {
+        harnessId: string;
+        route?: "local_session" | "api_key";
+    }) => Promise<{
+        source: "none" | "api" | "manifest";
+        harnessId: string;
+        verifiedAgainst: string | null;
+        models: {
+            id: string;
+            label: string | null;
+            routes: ("api_key" | "local_session")[] | null;
+            context_window: number | null;
+        }[];
+    }>;
+    authReadiness: (input: {
+        harnessId: string;
+        request: unknown;
+    }) => Promise<{
+        authRequest: "auto" | "subscription" | "api_key";
+        harnessId: string;
+        requestedSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+        observedAt: string;
+        readiness: {
+            source: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+            availability: "unknown" | "available" | "unavailable";
+            verification: "passed" | "failed" | "not_run";
+            detail?: string | undefined;
+        };
+    }>;
+    agentCapabilities: () => Promise<{
+        generatedAt: string;
+        ok: true;
+        version: string;
+        mutability: {
+            readOnlyModes: ("ask" | "plan" | "audit" | "agent" | "orchestrate")[];
+            writeModes: ("ask" | "plan" | "audit" | "agent" | "orchestrate")[];
+            isolationKinds: ("live" | "envelope")[];
+            workspaceModes: ("in_place" | "isolated")[];
+            accessProfiles: ("readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native")[];
+            applyModes: ("apply" | "commit" | "branch" | "pr")[];
+        };
+        harnesses: {
+            status: "unavailable" | "ok" | "degraded";
+            enabled: boolean;
+            displayName: string;
+            id: string;
+            reasons: string[];
+            providerFamily: "openai" | "anthropic" | "google" | "cursor" | "opencode" | "xai" | "local" | "unknown";
+            enabledIntents: string[];
+            disabledIntents: string[];
+            configuredModel: string | null;
+            configuredModelValid: boolean | null;
+            models: {
+                source: "none" | "api" | "manifest";
+                count: number;
+                verifiedAgainst: string | null;
+            };
+            webPolicy: "none" | "native" | "tools" | "uncontrolled";
+            attachmentInputs: {
+                kind: "file" | "image";
+                mime_types: string[];
+                max_bytes: number;
+                max_count: number;
+                transport: "file_path" | "base64_stream" | "base64_inline" | "text_inline";
+            }[];
+            effortLevels: ("low" | "medium" | "high" | "xhigh" | "max")[];
+            accessProfilesSupported: ("readonly" | "workspace_write" | "full" | "external_sandbox_full" | "inherit_native")[];
+            readonlyMechanism: "none" | "fs_sandbox" | "permission_deny" | "tool_allowlist";
+        }[];
+        availableHarnesses: string[];
+        modes: ("ask" | "plan" | "audit" | "agent" | "orchestrate")[];
+        runControlKeys: string[];
+        cliCommands: {
+            id: string;
+            mutability: "read" | "write" | "delivery" | "ops";
+            stability: "stable" | "experimental";
+            recovery: boolean;
+        }[];
+        mcpTools: string[];
+        runApplyStates: string[];
+    }>;
+    createSetupJob: (input: {
+        request: unknown;
+        idempotencyKey: string;
+        clientId: string;
+    }) => Promise<{
+        message: string;
+        harness: "cursor" | "codex" | "claude";
+        startedAt: string | null;
+        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+        profileId: string | null;
+        command: string | null;
+        createdAt: string;
+        jobId: string;
+        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+        finishedAt: string | null;
+        action: "login";
+        guideUrl: string | null;
+        outcome?: {
+            reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        execution?: {
+            observedAt: string;
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    source: "procfs_stat" | "proc_pidinfo";
+                    pid: number;
+                    platform: "linux" | "darwin";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        deadlineAt?: string | undefined;
+        authCapability?: {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "disclosed";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "running";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            completedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "completed";
+            receipt: {
+                availability: "unknown" | "available" | "unavailable";
+                verification: "passed" | "failed" | "not_run";
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                receiptId: string;
+                attemptId: string;
+                effective: "local" | "vendor_native" | "managed_api_key" | null;
+                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                costKnowledge: "exact" | "unknown" | "estimated";
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                responseDigest: string;
+                streamDigest: string;
+                scratchBeforeDigest: string;
+                scratchAfterDigest: string;
+                stream: {
+                    aborted: boolean;
+                    startedEvents: number;
+                    completedEvents: number;
+                    errorEvents: number;
+                    unexpectedToolEvents: number;
+                    interactionEvents: number;
+                    sessionMismatchEvents: number;
+                    eventsAfterCompleted: number;
+                };
+                evidenceRefs: string[];
+                costUsd?: number | undefined;
+            };
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "interrupted_unknown";
+            interruptedAt: string;
+        } | undefined;
+        authorization?: {
+            args: string[];
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            executable: {
+                sha256: string;
+                mode: number;
+                realpath: string;
+                size: number;
+                device: string;
+                inode: string;
+            };
+        } | undefined;
+        nativeCommand?: {
+            commandDigest: string;
+            finishedAt: string;
+            executionId: string;
+            manifestDigest: string;
+            permitIssuedAt: string | null;
+            commandStarted: boolean;
+            exitCode: number | null;
+            signal: string | null;
+            errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+        } | undefined;
+        terminationReconciliation?: {
+            status: "empty";
+            observedAt: string;
+        } | undefined;
+    }>;
+    listSetupJobs: (input?: unknown) => Promise<{
+        jobs: {
+            message: string;
+            harness: "cursor" | "codex" | "claude";
+            startedAt: string | null;
+            state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+            profileId: string | null;
+            command: string | null;
+            createdAt: string;
+            jobId: string;
+            phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+            finishedAt: string | null;
+            action: "login";
+            guideUrl: string | null;
+            outcome?: {
+                reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+                exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
+            } | undefined;
+            execution?: {
+                observedAt: string;
+                commandDigest: string;
+                executionId: string;
+                manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        source: "procfs_stat" | "proc_pidinfo";
+                        pid: number;
+                        platform: "linux" | "darwin";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                permitIssuedAt?: string | undefined;
+            } | undefined;
+            deadlineAt?: string | undefined;
+            authCapability?: {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "disclosed";
+            } | {
+                attemptId: string;
+                startedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "running";
+            } | {
+                attemptId: string;
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "completed";
+                receipt: {
+                    availability: "unknown" | "available" | "unavailable";
+                    verification: "passed" | "failed" | "not_run";
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    receiptId: string;
+                    attemptId: string;
+                    effective: "local" | "vendor_native" | "managed_api_key" | null;
+                    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                    costKnowledge: "exact" | "unknown" | "estimated";
+                    startedAt: string;
+                    completedAt: string;
+                    challengeDigest: string;
+                    requestDigest: string;
+                    responseDigest: string;
+                    streamDigest: string;
+                    scratchBeforeDigest: string;
+                    scratchAfterDigest: string;
+                    stream: {
+                        aborted: boolean;
+                        startedEvents: number;
+                        completedEvents: number;
+                        errorEvents: number;
+                        unexpectedToolEvents: number;
+                        interactionEvents: number;
+                        sessionMismatchEvents: number;
+                        eventsAfterCompleted: number;
+                    };
+                    evidenceRefs: string[];
+                    costUsd?: number | undefined;
+                };
+            } | {
+                attemptId: string;
+                startedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "interrupted_unknown";
+                interruptedAt: string;
+            } | undefined;
+            authorization?: {
+                args: string[];
+                commandDigest: string;
+                executionId: string;
+                manifestDigest: string;
+                executable: {
+                    sha256: string;
+                    mode: number;
+                    realpath: string;
+                    size: number;
+                    device: string;
+                    inode: string;
+                };
+            } | undefined;
+            nativeCommand?: {
+                commandDigest: string;
+                finishedAt: string;
+                executionId: string;
+                manifestDigest: string;
+                permitIssuedAt: string | null;
+                commandStarted: boolean;
+                exitCode: number | null;
+                signal: string | null;
+                errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+            } | undefined;
+            terminationReconciliation?: {
+                status: "empty";
+                observedAt: string;
+            } | undefined;
+        }[];
+    }>;
+    setupJobStatus: (input: unknown) => Promise<{
+        message: string;
+        harness: "cursor" | "codex" | "claude";
+        startedAt: string | null;
+        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+        profileId: string | null;
+        command: string | null;
+        createdAt: string;
+        jobId: string;
+        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+        finishedAt: string | null;
+        action: "login";
+        guideUrl: string | null;
+        outcome?: {
+            reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        execution?: {
+            observedAt: string;
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    source: "procfs_stat" | "proc_pidinfo";
+                    pid: number;
+                    platform: "linux" | "darwin";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        deadlineAt?: string | undefined;
+        authCapability?: {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "disclosed";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "running";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            completedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "completed";
+            receipt: {
+                availability: "unknown" | "available" | "unavailable";
+                verification: "passed" | "failed" | "not_run";
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                receiptId: string;
+                attemptId: string;
+                effective: "local" | "vendor_native" | "managed_api_key" | null;
+                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                costKnowledge: "exact" | "unknown" | "estimated";
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                responseDigest: string;
+                streamDigest: string;
+                scratchBeforeDigest: string;
+                scratchAfterDigest: string;
+                stream: {
+                    aborted: boolean;
+                    startedEvents: number;
+                    completedEvents: number;
+                    errorEvents: number;
+                    unexpectedToolEvents: number;
+                    interactionEvents: number;
+                    sessionMismatchEvents: number;
+                    eventsAfterCompleted: number;
+                };
+                evidenceRefs: string[];
+                costUsd?: number | undefined;
+            };
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "interrupted_unknown";
+            interruptedAt: string;
+        } | undefined;
+        authorization?: {
+            args: string[];
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            executable: {
+                sha256: string;
+                mode: number;
+                realpath: string;
+                size: number;
+                device: string;
+                inode: string;
+            };
+        } | undefined;
+        nativeCommand?: {
+            commandDigest: string;
+            finishedAt: string;
+            executionId: string;
+            manifestDigest: string;
+            permitIssuedAt: string | null;
+            commandStarted: boolean;
+            exitCode: number | null;
+            signal: string | null;
+            errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+        } | undefined;
+        terminationReconciliation?: {
+            status: "empty";
+            observedAt: string;
+        } | undefined;
+    }>;
+    setupJobSnapshot: (input: unknown) => Promise<{
+        cursor: string;
+        sequence: number;
+        job: {
+            message: string;
+            harness: "cursor" | "codex" | "claude";
+            startedAt: string | null;
+            state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+            profileId: string | null;
+            command: string | null;
+            createdAt: string;
+            jobId: string;
+            phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+            finishedAt: string | null;
+            action: "login";
+            guideUrl: string | null;
+            outcome?: {
+                reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+                exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
+            } | undefined;
+            execution?: {
+                observedAt: string;
+                commandDigest: string;
+                executionId: string;
+                manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        source: "procfs_stat" | "proc_pidinfo";
+                        pid: number;
+                        platform: "linux" | "darwin";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                permitIssuedAt?: string | undefined;
+            } | undefined;
+            deadlineAt?: string | undefined;
+            authCapability?: {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "disclosed";
+            } | {
+                attemptId: string;
+                startedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "running";
+            } | {
+                attemptId: string;
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "completed";
+                receipt: {
+                    availability: "unknown" | "available" | "unavailable";
+                    verification: "passed" | "failed" | "not_run";
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    receiptId: string;
+                    attemptId: string;
+                    effective: "local" | "vendor_native" | "managed_api_key" | null;
+                    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                    costKnowledge: "exact" | "unknown" | "estimated";
+                    startedAt: string;
+                    completedAt: string;
+                    challengeDigest: string;
+                    requestDigest: string;
+                    responseDigest: string;
+                    streamDigest: string;
+                    scratchBeforeDigest: string;
+                    scratchAfterDigest: string;
+                    stream: {
+                        aborted: boolean;
+                        startedEvents: number;
+                        completedEvents: number;
+                        errorEvents: number;
+                        unexpectedToolEvents: number;
+                        interactionEvents: number;
+                        sessionMismatchEvents: number;
+                        eventsAfterCompleted: number;
+                    };
+                    evidenceRefs: string[];
+                    costUsd?: number | undefined;
+                };
+            } | {
+                attemptId: string;
+                startedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "interrupted_unknown";
+                interruptedAt: string;
+            } | undefined;
+            authorization?: {
+                args: string[];
+                commandDigest: string;
+                executionId: string;
+                manifestDigest: string;
+                executable: {
+                    sha256: string;
+                    mode: number;
+                    realpath: string;
+                    size: number;
+                    device: string;
+                    inode: string;
+                };
+            } | undefined;
+            nativeCommand?: {
+                commandDigest: string;
+                finishedAt: string;
+                executionId: string;
+                manifestDigest: string;
+                permitIssuedAt: string | null;
+                commandStarted: boolean;
+                exitCode: number | null;
+                signal: string | null;
+                errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+            } | undefined;
+            terminationReconciliation?: {
+                status: "empty";
+                observedAt: string;
+            } | undefined;
+        };
+    }>;
+    setupJobEvents: (input: unknown) => Promise<{
+        message: string;
+        cursor: string;
+        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+        kind: "status";
+        time: string;
+        jobId: string;
+        previousCursor: string | null;
+        sequence: number;
+        job: {
+            message: string;
+            harness: "cursor" | "codex" | "claude";
+            startedAt: string | null;
+            state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+            profileId: string | null;
+            command: string | null;
+            createdAt: string;
+            jobId: string;
+            phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+            finishedAt: string | null;
+            action: "login";
+            guideUrl: string | null;
+            outcome?: {
+                reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+                exitCode?: number | null | undefined;
+                signal?: string | null | undefined;
+            } | undefined;
+            execution?: {
+                observedAt: string;
+                commandDigest: string;
+                executionId: string;
+                manifestDigest: string;
+                processGroup: {
+                    schemaVersion: 1;
+                    pgid: number;
+                    leader: {
+                        status: "known";
+                        source: "procfs_stat" | "proc_pidinfo";
+                        pid: number;
+                        platform: "linux" | "darwin";
+                        startToken: string;
+                        processGroupId: number;
+                    };
+                };
+                permitIssuedAt?: string | undefined;
+            } | undefined;
+            deadlineAt?: string | undefined;
+            authCapability?: {
+                attemptId: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "disclosed";
+            } | {
+                attemptId: string;
+                startedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "running";
+            } | {
+                attemptId: string;
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "completed";
+                receipt: {
+                    availability: "unknown" | "available" | "unavailable";
+                    verification: "passed" | "failed" | "not_run";
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    receiptId: string;
+                    attemptId: string;
+                    effective: "local" | "vendor_native" | "managed_api_key" | null;
+                    effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                    selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                    costKnowledge: "exact" | "unknown" | "estimated";
+                    startedAt: string;
+                    completedAt: string;
+                    challengeDigest: string;
+                    requestDigest: string;
+                    responseDigest: string;
+                    streamDigest: string;
+                    scratchBeforeDigest: string;
+                    scratchAfterDigest: string;
+                    stream: {
+                        aborted: boolean;
+                        startedEvents: number;
+                        completedEvents: number;
+                        errorEvents: number;
+                        unexpectedToolEvents: number;
+                        interactionEvents: number;
+                        sessionMismatchEvents: number;
+                        eventsAfterCompleted: number;
+                    };
+                    evidenceRefs: string[];
+                    costUsd?: number | undefined;
+                };
+            } | {
+                attemptId: string;
+                startedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                disclosure: {
+                    schemaVersion: 1;
+                    protocolVersion: 1;
+                    harness: string;
+                    requested: "auto" | "subscription" | "api_key";
+                    requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                    requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                    networkScope: "selected_harness_only";
+                    billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                    incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                    mayConsumeQuota: boolean;
+                    generatedAt: string;
+                };
+                state: "interrupted_unknown";
+                interruptedAt: string;
+            } | undefined;
+            authorization?: {
+                args: string[];
+                commandDigest: string;
+                executionId: string;
+                manifestDigest: string;
+                executable: {
+                    sha256: string;
+                    mode: number;
+                    realpath: string;
+                    size: number;
+                    device: string;
+                    inode: string;
+                };
+            } | undefined;
+            nativeCommand?: {
+                commandDigest: string;
+                finishedAt: string;
+                executionId: string;
+                manifestDigest: string;
+                permitIssuedAt: string | null;
+                commandStarted: boolean;
+                exitCode: number | null;
+                signal: string | null;
+                errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+            } | undefined;
+            terminationReconciliation?: {
+                status: "empty";
+                observedAt: string;
+            } | undefined;
+        };
+    }[]>;
+    cancelSetupJob: (input: unknown) => Promise<{
+        message: string;
+        harness: "cursor" | "codex" | "claude";
+        startedAt: string | null;
+        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+        profileId: string | null;
+        command: string | null;
+        createdAt: string;
+        jobId: string;
+        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+        finishedAt: string | null;
+        action: "login";
+        guideUrl: string | null;
+        outcome?: {
+            reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        execution?: {
+            observedAt: string;
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    source: "procfs_stat" | "proc_pidinfo";
+                    pid: number;
+                    platform: "linux" | "darwin";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        deadlineAt?: string | undefined;
+        authCapability?: {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "disclosed";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "running";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            completedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "completed";
+            receipt: {
+                availability: "unknown" | "available" | "unavailable";
+                verification: "passed" | "failed" | "not_run";
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                receiptId: string;
+                attemptId: string;
+                effective: "local" | "vendor_native" | "managed_api_key" | null;
+                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                costKnowledge: "exact" | "unknown" | "estimated";
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                responseDigest: string;
+                streamDigest: string;
+                scratchBeforeDigest: string;
+                scratchAfterDigest: string;
+                stream: {
+                    aborted: boolean;
+                    startedEvents: number;
+                    completedEvents: number;
+                    errorEvents: number;
+                    unexpectedToolEvents: number;
+                    interactionEvents: number;
+                    sessionMismatchEvents: number;
+                    eventsAfterCompleted: number;
+                };
+                evidenceRefs: string[];
+                costUsd?: number | undefined;
+            };
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "interrupted_unknown";
+            interruptedAt: string;
+        } | undefined;
+        authorization?: {
+            args: string[];
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            executable: {
+                sha256: string;
+                mode: number;
+                realpath: string;
+                size: number;
+                device: string;
+                inode: string;
+            };
+        } | undefined;
+        nativeCommand?: {
+            commandDigest: string;
+            finishedAt: string;
+            executionId: string;
+            manifestDigest: string;
+            permitIssuedAt: string | null;
+            commandStarted: boolean;
+            exitCode: number | null;
+            signal: string | null;
+            errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+        } | undefined;
+        terminationReconciliation?: {
+            status: "empty";
+            observedAt: string;
+        } | undefined;
+    }>;
+    reconcileSetupJob: (input: unknown) => Promise<{
+        message: string;
+        harness: "cursor" | "codex" | "claude";
+        startedAt: string | null;
+        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+        profileId: string | null;
+        command: string | null;
+        createdAt: string;
+        jobId: string;
+        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+        finishedAt: string | null;
+        action: "login";
+        guideUrl: string | null;
+        outcome?: {
+            reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        execution?: {
+            observedAt: string;
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    source: "procfs_stat" | "proc_pidinfo";
+                    pid: number;
+                    platform: "linux" | "darwin";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        deadlineAt?: string | undefined;
+        authCapability?: {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "disclosed";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "running";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            completedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "completed";
+            receipt: {
+                availability: "unknown" | "available" | "unavailable";
+                verification: "passed" | "failed" | "not_run";
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                receiptId: string;
+                attemptId: string;
+                effective: "local" | "vendor_native" | "managed_api_key" | null;
+                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                costKnowledge: "exact" | "unknown" | "estimated";
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                responseDigest: string;
+                streamDigest: string;
+                scratchBeforeDigest: string;
+                scratchAfterDigest: string;
+                stream: {
+                    aborted: boolean;
+                    startedEvents: number;
+                    completedEvents: number;
+                    errorEvents: number;
+                    unexpectedToolEvents: number;
+                    interactionEvents: number;
+                    sessionMismatchEvents: number;
+                    eventsAfterCompleted: number;
+                };
+                evidenceRefs: string[];
+                costUsd?: number | undefined;
+            };
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "interrupted_unknown";
+            interruptedAt: string;
+        } | undefined;
+        authorization?: {
+            args: string[];
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            executable: {
+                sha256: string;
+                mode: number;
+                realpath: string;
+                size: number;
+                device: string;
+                inode: string;
+            };
+        } | undefined;
+        nativeCommand?: {
+            commandDigest: string;
+            finishedAt: string;
+            executionId: string;
+            manifestDigest: string;
+            permitIssuedAt: string | null;
+            commandStarted: boolean;
+            exitCode: number | null;
+            signal: string | null;
+            errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+        } | undefined;
+        terminationReconciliation?: {
+            status: "empty";
+            observedAt: string;
+        } | undefined;
+    }>;
+    extendSetupJob: (input: unknown) => Promise<{
+        message: string;
+        harness: "cursor" | "codex" | "claude";
+        startedAt: string | null;
+        state: "failed" | "cancelled" | "running" | "interrupted_unknown" | "queued" | "succeeded" | "timed_out" | "waiting_for_input" | "not_supported";
+        profileId: string | null;
+        command: string | null;
+        createdAt: string;
+        jobId: string;
+        phase: "completed" | "preparing" | "launching" | "awaiting_user" | "verifying" | "cancelling";
+        finishedAt: string | null;
+        action: "login";
+        guideUrl: string | null;
+        outcome?: {
+            reason: "completed" | "interrupted_unknown" | "timed_out" | "not_supported" | "launch_failed" | "command_failed" | "auth_not_ready" | "capability_verification_failed" | "credential_route_mismatch" | "cancelled_by_user" | "cancelled_on_restart" | "interrupted" | "termination_unconfirmed";
+            exitCode?: number | null | undefined;
+            signal?: string | null | undefined;
+        } | undefined;
+        execution?: {
+            observedAt: string;
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            processGroup: {
+                schemaVersion: 1;
+                pgid: number;
+                leader: {
+                    status: "known";
+                    source: "procfs_stat" | "proc_pidinfo";
+                    pid: number;
+                    platform: "linux" | "darwin";
+                    startToken: string;
+                    processGroupId: number;
+                };
+            };
+            permitIssuedAt?: string | undefined;
+        } | undefined;
+        deadlineAt?: string | undefined;
+        authCapability?: {
+            attemptId: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "disclosed";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "running";
+        } | {
+            attemptId: string;
+            startedAt: string;
+            completedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "completed";
+            receipt: {
+                availability: "unknown" | "available" | "unavailable";
+                verification: "passed" | "failed" | "not_run";
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                receiptId: string;
+                attemptId: string;
+                effective: "local" | "vendor_native" | "managed_api_key" | null;
+                effectiveSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none" | null;
+                selectionReason: "harness_error" | "exact_requested_route" | "adapter_unavailable" | "request_mismatch" | "route_missing" | "route_mismatch" | "source_missing" | "source_mismatch" | "adapter_error" | "missing_completion" | "response_mismatch" | "scratch_mutated" | "protocol_violation" | "adapter_identity_mismatch" | "cancelled";
+                costKnowledge: "exact" | "unknown" | "estimated";
+                startedAt: string;
+                completedAt: string;
+                challengeDigest: string;
+                requestDigest: string;
+                responseDigest: string;
+                streamDigest: string;
+                scratchBeforeDigest: string;
+                scratchAfterDigest: string;
+                stream: {
+                    aborted: boolean;
+                    startedEvents: number;
+                    completedEvents: number;
+                    errorEvents: number;
+                    unexpectedToolEvents: number;
+                    interactionEvents: number;
+                    sessionMismatchEvents: number;
+                    eventsAfterCompleted: number;
+                };
+                evidenceRefs: string[];
+                costUsd?: number | undefined;
+            };
+        } | {
+            attemptId: string;
+            startedAt: string;
+            challengeDigest: string;
+            requestDigest: string;
+            disclosure: {
+                schemaVersion: 1;
+                protocolVersion: 1;
+                harness: string;
+                requested: "auto" | "subscription" | "api_key";
+                requiredRoute: "local" | "vendor_native" | "managed_api_key";
+                requiredSource: "native_session" | "oauth_token_env" | "api_key_env" | "api_key_flag" | "provider_auth_file" | "none";
+                networkScope: "selected_harness_only";
+                billingKnowledge: "unknown" | "proven_zero" | "subscription_entitlement" | "metered";
+                incrementalCostKnowledge: "exact" | "unknown" | "estimated";
+                mayConsumeQuota: boolean;
+                generatedAt: string;
+            };
+            state: "interrupted_unknown";
+            interruptedAt: string;
+        } | undefined;
+        authorization?: {
+            args: string[];
+            commandDigest: string;
+            executionId: string;
+            manifestDigest: string;
+            executable: {
+                sha256: string;
+                mode: number;
+                realpath: string;
+                size: number;
+                device: string;
+                inode: string;
+            };
+        } | undefined;
+        nativeCommand?: {
+            commandDigest: string;
+            finishedAt: string;
+            executionId: string;
+            manifestDigest: string;
+            permitIssuedAt: string | null;
+            commandStarted: boolean;
+            exitCode: number | null;
+            signal: string | null;
+            errorCode?: "permit_timeout" | "spawn_failed" | undefined;
+        } | undefined;
+        terminationReconciliation?: {
+            status: "empty";
+            observedAt: string;
+        } | undefined;
+    }>;
+    journalEvents: (partition: string, afterCursor?: string) => Promise<{
+        type: string;
+        cursor: string;
+        observedAt: string;
+        schemaVersion: 1;
+        partition: string;
+        payload?: unknown;
+    }[]>;
+    recoveryInspectPartition: (partition: string) => Promise<{
+        status: "ready" | "recovery_required";
+        observedAt: string;
+        schemaVersion: 1;
+        evidenceRefs: string[];
+        recovery: {
+            status: "ready";
+            discardedTailBytes: number;
+        } | {
+            status: "recovery_required";
+            reason: string;
+            discardedTailBytes: number;
+            location: {
+                kind: "byte";
+                byteOffset: number;
+            } | {
+                kind: "cursor";
+                seq: number;
+                epoch: string;
+            };
+        };
+        partition: string;
+        generation: number;
+        fingerprint: string;
+    }>;
+    recoveryValidatePartition: (partition: string) => Promise<{
+        status: "ready" | "recovery_required";
+        observedAt: string;
+        schemaVersion: 1;
+        evidenceRefs: string[];
+        recovery: {
+            status: "ready";
+            discardedTailBytes: number;
+        } | {
+            status: "recovery_required";
+            reason: string;
+            discardedTailBytes: number;
+            location: {
+                kind: "byte";
+                byteOffset: number;
+            } | {
+                kind: "cursor";
+                seq: number;
+                epoch: string;
+            };
+        };
+        partition: string;
+        generation: number;
+        fingerprint: string;
+        projectionStatus: {
+            status: "valid" | "invalid";
+            detail: string | null;
+            name: string;
+        }[];
+    }>;
+    recoveryExportPartition: (partition: string) => Promise<{
+        schemaVersion: 1;
+        createdAt: string;
+        partition: string;
+        fingerprint: string;
+        exportId: string;
+        bundlePath: string;
+        manifestSha256: string;
+    }>;
+    recoveryQuarantinePartition: (partition: string, input: unknown) => Promise<{
+        schemaVersion: 1;
+        completedAt: string;
+        partition: string;
+        operationId: string;
+        previousFingerprint: string;
+        quarantineArtifactId: string;
+        quarantinePath: string;
+        newEpoch: string;
+    } | null>;
+    settings: () => Promise<{
+        sources: string[];
+        interactionTimeoutMs: number;
+        routing: {
+            defaultPolicy: "auto" | "primary";
+            primaryHarness: string | null;
+            eligibleHarnesses: string[];
+            envInheritance: "mirror_native" | "clean";
+            authPreference: "auto" | "api_key" | "subscription";
+            goal: "auto" | "quality" | "economy";
+            paidFallback: "never" | "when_unavailable" | "allowed_within_cap";
+            qualityTiers: Partial<Record<"synthesize" | "plan" | "audit" | "orchestrate" | "spec" | "review" | "implement" | "create_from_scratch" | "repair" | "verify" | "explain", {
+                harness: string;
+                model: string;
+                effort: "low" | "medium" | "high" | "xhigh" | "max";
+            }[][]>>;
+        };
+        budget: {
+            paidBudgetPerRun: {
+                kind: "unlimited";
+            } | {
+                kind: "finite";
+                maxUsd: number;
+            };
+        };
+        runtime: {
+            reviewerTimeoutMs: number;
+            harnessInactivityTimeoutMs: number;
+            transientRetry: {
+                maxRetries: number;
+                initialDelayMs: number;
+                maxDelayMs: number;
+            };
+        };
+        harnesses: {
+            [k: string]: {
+                enabled: boolean;
+                defaultModel: string | null;
+                effort: "low" | "medium" | "high" | "xhigh" | "max" | null;
+                maxTurns: number | null;
+                maxRounds: number | null;
+                toolsAllow: string[];
+                toolsDeny: string[];
+                fallbackModel: string | null;
+                web: "auto" | "live" | "off" | "cached";
+                authPreference: "auto" | "api_key" | "subscription";
+                profileLimitAction: "ask" | "fail" | "rotate";
+            };
+        };
+    }>;
+    quota: () => Promise<{
+        snapshots: {
+            source: "codex_app_server" | "codex_rollout" | "claude_statusline" | "claude_api_retry" | "claude_oauth_usage";
+            subject: {
+                harness: string;
+                credential_route: "local" | "vendor_native" | "managed_api_key";
+                plan_label: string | null;
+                subject_id: string | null;
+            };
+            constraints: {
+                id: string;
+                label: string;
+                used_ratio: number | null;
+                window_seconds: number | null;
+                resets_at: string | null;
+                cooldown_until: string | null;
+            }[];
+            observed_at: string;
+            freshness: "unknown" | "fresh" | "stale";
+        }[];
+        refreshed_at: string | null;
+    }>;
+    refreshQuota: () => Promise<{
+        snapshots: {
+            source: "codex_app_server" | "codex_rollout" | "claude_statusline" | "claude_api_retry" | "claude_oauth_usage";
+            subject: {
+                harness: string;
+                credential_route: "local" | "vendor_native" | "managed_api_key";
+                plan_label: string | null;
+                subject_id: string | null;
+            };
+            constraints: {
+                id: string;
+                label: string;
+                used_ratio: number | null;
+                window_seconds: number | null;
+                resets_at: string | null;
+                cooldown_until: string | null;
+            }[];
+            observed_at: string;
+            freshness: "unknown" | "fresh" | "stale";
+        }[];
+        refreshed_at: string | null;
+    }>;
+    credentialProfiles: () => Promise<{
+        profiles: {
+            profile: {
+                profile_id: string;
+                harness_id: string;
+                display_name: string;
+                credential_kind: "api_key" | "config_dir_login" | "oauth_token";
+                isolation_locator: string | null;
+                secret_ref: string | null;
+                enabled: boolean;
+                created_at: string | null;
+            };
+            status: {
+                availability: "unknown" | "available" | "unavailable";
+                verification: "passed" | "failed" | "not_run";
+                profile_id: string;
+                harness_id: string;
+                last_verified_at: string | null;
+                detail?: string | undefined;
+            };
+        }[];
+    }>;
+    deleteCredentialProfile: (input: unknown) => Promise<{
+        cleanupWarning?: string | undefined;
+        profile: {
+            profile_id: string;
+            harness_id: string;
+            display_name: string;
+            credential_kind: "api_key" | "config_dir_login" | "oauth_token";
+            isolation_locator: string | null;
+            secret_ref: string | null;
+            enabled: boolean;
+            created_at: string | null;
+        };
+        removed: boolean;
+        credentialCleanup: "none" | "config_dir_removed" | "secret_deleted";
+    }>;
+    createCredentialProfile: (input: unknown) => Promise<{
+        profile: {
+            profile_id: string;
+            harness_id: string;
+            display_name: string;
+            credential_kind: "api_key" | "config_dir_login" | "oauth_token";
+            isolation_locator: string | null;
+            secret_ref: string | null;
+            enabled: boolean;
+            created_at: string | null;
+        };
+        status: {
+            availability: "unknown" | "available" | "unavailable";
+            verification: "passed" | "failed" | "not_run";
+            profile_id: string;
+            harness_id: string;
+            last_verified_at: string | null;
+            detail?: string | undefined;
+        };
+    }>;
+    updateSettings: (patch: unknown) => Promise<{
+        sources: string[];
+        interactionTimeoutMs: number;
+        routing: {
+            defaultPolicy: "auto" | "primary";
+            primaryHarness: string | null;
+            eligibleHarnesses: string[];
+            envInheritance: "mirror_native" | "clean";
+            authPreference: "auto" | "api_key" | "subscription";
+            goal: "auto" | "quality" | "economy";
+            paidFallback: "never" | "when_unavailable" | "allowed_within_cap";
+            qualityTiers: Partial<Record<"synthesize" | "plan" | "audit" | "orchestrate" | "spec" | "review" | "implement" | "create_from_scratch" | "repair" | "verify" | "explain", {
+                harness: string;
+                model: string;
+                effort: "low" | "medium" | "high" | "xhigh" | "max";
+            }[][]>>;
+        };
+        budget: {
+            paidBudgetPerRun: {
+                kind: "unlimited";
+            } | {
+                kind: "finite";
+                maxUsd: number;
+            };
+        };
+        runtime: {
+            reviewerTimeoutMs: number;
+            harnessInactivityTimeoutMs: number;
+            transientRetry: {
+                maxRetries: number;
+                initialDelayMs: number;
+                maxDelayMs: number;
+            };
+        };
+        harnesses: {
+            [k: string]: {
+                enabled: boolean;
+                defaultModel: string | null;
+                effort: "low" | "medium" | "high" | "xhigh" | "max" | null;
+                maxTurns: number | null;
+                maxRounds: number | null;
+                toolsAllow: string[];
+                toolsDeny: string[];
+                fallbackModel: string | null;
+                web: "auto" | "live" | "off" | "cached";
+                authPreference: "auto" | "api_key" | "subscription";
+                profileLimitAction: "ask" | "fail" | "rotate";
+            };
+        };
+    }>;
+    listSecrets: () => Promise<{
+        backend: "file";
+        secrets: {
+            name: string;
+            backend: "file";
+            present: true;
+        }[];
+    }>;
+    setSecret: (input: unknown) => Promise<{
+        warning?: string | undefined;
+        name: string;
+        backend: "file";
+        stored: boolean;
+    }>;
+    deleteSecret: (name: string) => Promise<{
+        name: string;
+        deleted: boolean;
+    }>;
+    createSpecSession: (input: {
+        request: ControlSpecQuestionsRequest;
+        idempotencyKey: string;
+        clientId: string;
+    }) => Promise<{
+        state: "failed" | "cancelled" | "interrupted_unknown" | "questions" | "frozen" | "grounding" | "answered" | "freezing";
+        error: string | null;
+        createdAt: string;
+        prompt: string;
+        questions: {
+            options: {
+                id: string;
+                label: string;
+            }[];
+            kind: "text" | "single" | "multi";
+            id: string;
+            prompt: string;
+            tier: number;
+            allow_text: boolean;
+            rationale?: string | undefined;
+        }[];
+        answers: {
+            question_id: string;
+            text: string | null;
+            option_ids: string[];
+        }[];
+        planRunId: string | null;
+        scope: {
+            kind: "project";
+            root: string;
+            context: "auto";
+        };
+        specPath: string | null;
+        specId: string | null;
+        specHash: string | null;
+        threadId: string | null;
+        sessionId: string;
+        updatedAt: string;
+        priorDecisions: {
+            question: string;
+            answer: string;
+        }[];
+        specDir: string | null;
+    }>;
+    listSpecSessions: () => Promise<{
+        sessions: {
+            state: "failed" | "cancelled" | "interrupted_unknown" | "questions" | "frozen" | "grounding" | "answered" | "freezing";
+            error: string | null;
+            createdAt: string;
+            prompt: string;
+            questions: {
+                options: {
+                    id: string;
+                    label: string;
+                }[];
+                kind: "text" | "single" | "multi";
+                id: string;
+                prompt: string;
+                tier: number;
+                allow_text: boolean;
+                rationale?: string | undefined;
+            }[];
+            answers: {
+                question_id: string;
+                text: string | null;
+                option_ids: string[];
+            }[];
+            planRunId: string | null;
+            scope: {
+                kind: "project";
+                root: string;
+                context: "auto";
+            };
+            specPath: string | null;
+            specId: string | null;
+            specHash: string | null;
+            threadId: string | null;
+            sessionId: string;
+            updatedAt: string;
+            priorDecisions: {
+                question: string;
+                answer: string;
+            }[];
+            specDir: string | null;
+        }[];
+    }>;
+    getSpecSession: (id: string) => Promise<{
+        state: "failed" | "cancelled" | "interrupted_unknown" | "questions" | "frozen" | "grounding" | "answered" | "freezing";
+        error: string | null;
+        createdAt: string;
+        prompt: string;
+        questions: {
+            options: {
+                id: string;
+                label: string;
+            }[];
+            kind: "text" | "single" | "multi";
+            id: string;
+            prompt: string;
+            tier: number;
+            allow_text: boolean;
+            rationale?: string | undefined;
+        }[];
+        answers: {
+            question_id: string;
+            text: string | null;
+            option_ids: string[];
+        }[];
+        planRunId: string | null;
+        scope: {
+            kind: "project";
+            root: string;
+            context: "auto";
+        };
+        specPath: string | null;
+        specId: string | null;
+        specHash: string | null;
+        threadId: string | null;
+        sessionId: string;
+        updatedAt: string;
+        priorDecisions: {
+            question: string;
+            answer: string;
+        }[];
+        specDir: string | null;
+    } | undefined>;
+    answerSpecSession: (id: string, input: ControlSpecAnswersRequest) => Promise<{
+        state: "failed" | "cancelled" | "interrupted_unknown" | "questions" | "frozen" | "grounding" | "answered" | "freezing";
+        error: string | null;
+        createdAt: string;
+        prompt: string;
+        questions: {
+            options: {
+                id: string;
+                label: string;
+            }[];
+            kind: "text" | "single" | "multi";
+            id: string;
+            prompt: string;
+            tier: number;
+            allow_text: boolean;
+            rationale?: string | undefined;
+        }[];
+        answers: {
+            question_id: string;
+            text: string | null;
+            option_ids: string[];
+        }[];
+        planRunId: string | null;
+        scope: {
+            kind: "project";
+            root: string;
+            context: "auto";
+        };
+        specPath: string | null;
+        specId: string | null;
+        specHash: string | null;
+        threadId: string | null;
+        sessionId: string;
+        updatedAt: string;
+        priorDecisions: {
+            question: string;
+            answer: string;
+        }[];
+        specDir: string | null;
+    }>;
+    freezeSpecSession: (id: string) => Promise<{
+        state: "failed" | "cancelled" | "interrupted_unknown" | "questions" | "frozen" | "grounding" | "answered" | "freezing";
+        error: string | null;
+        createdAt: string;
+        prompt: string;
+        questions: {
+            options: {
+                id: string;
+                label: string;
+            }[];
+            kind: "text" | "single" | "multi";
+            id: string;
+            prompt: string;
+            tier: number;
+            allow_text: boolean;
+            rationale?: string | undefined;
+        }[];
+        answers: {
+            question_id: string;
+            text: string | null;
+            option_ids: string[];
+        }[];
+        planRunId: string | null;
+        scope: {
+            kind: "project";
+            root: string;
+            context: "auto";
+        };
+        specPath: string | null;
+        specId: string | null;
+        specHash: string | null;
+        threadId: string | null;
+        sessionId: string;
+        updatedAt: string;
+        priorDecisions: {
+            question: string;
+            answer: string;
+        }[];
+        specDir: string | null;
+    }>;
+    cancelSpecSession: (id: string) => Promise<{
+        state: "failed" | "cancelled" | "interrupted_unknown" | "questions" | "frozen" | "grounding" | "answered" | "freezing";
+        error: string | null;
+        createdAt: string;
+        prompt: string;
+        questions: {
+            options: {
+                id: string;
+                label: string;
+            }[];
+            kind: "text" | "single" | "multi";
+            id: string;
+            prompt: string;
+            tier: number;
+            allow_text: boolean;
+            rationale?: string | undefined;
+        }[];
+        answers: {
+            question_id: string;
+            text: string | null;
+            option_ids: string[];
+        }[];
+        planRunId: string | null;
+        scope: {
+            kind: "project";
+            root: string;
+            context: "auto";
+        };
+        specPath: string | null;
+        specId: string | null;
+        specHash: string | null;
+        threadId: string | null;
+        sessionId: string;
+        updatedAt: string;
+        priorDecisions: {
+            question: string;
+            answer: string;
+        }[];
+        specDir: string | null;
+    }>;
+    resumeSpecSession: (id: string) => Promise<{
+        state: "failed" | "cancelled" | "interrupted_unknown" | "questions" | "frozen" | "grounding" | "answered" | "freezing";
+        error: string | null;
+        createdAt: string;
+        prompt: string;
+        questions: {
+            options: {
+                id: string;
+                label: string;
+            }[];
+            kind: "text" | "single" | "multi";
+            id: string;
+            prompt: string;
+            tier: number;
+            allow_text: boolean;
+            rationale?: string | undefined;
+        }[];
+        answers: {
+            question_id: string;
+            text: string | null;
+            option_ids: string[];
+        }[];
+        planRunId: string | null;
+        scope: {
+            kind: "project";
+            root: string;
+            context: "auto";
+        };
+        specPath: string | null;
+        specId: string | null;
+        specHash: string | null;
+        threadId: string | null;
+        sessionId: string;
+        updatedAt: string;
+        priorDecisions: {
+            question: string;
+            answer: string;
+        }[];
+        specDir: string | null;
+    }>;
+};
+export {};
+//# sourceMappingURL=control-services.d.ts.map