@consiliency/agent-board-cli 1.24.0 → 1.25.0

package/dist/assets.d.ts

@@ -0,0 +1,22 @@
+export interface BakedAssets {
+    /** `@consiliency/agent-board-mcp`'s version: the codex, grok and agy stanza pins it. */
+    mcpVersion: string;
+    piVersion: string;
+    opencodeVersion: string;
+    /** The train tag this build is released as (`v<x.y.z>`), from CHANGELOG.md's first heading. */
+    releaseTag: string;
+}
+export declare const BAKED_ASSET_KEYS: readonly ["mcpVersion", "piVersion", "opencodeVersion", "releaseTag"];
+/**
+ * A missing or malformed bake. Never defaulted: an unpinned version is a different install. It
+ * carries no `code`: it is not a cause-code site (fleet_diagnosability #403), and setup names it.
+ */
+export declare class BakedAssetsError extends Error {
+    constructor(message: string);
+}
+export declare const ASSETS_URL: URL;
+export declare const KEYSLOT_URL: URL;
+/** The build's baked versions and release tag, validated field by field. */
+export declare function bakedAssets(file?: string | URL): BakedAssets;
+/** The packaged keyslot directory (no trailing slash). Throws when the build did not copy it. */
+export declare function resolveKeyslotDir(url?: URL): string;

package/dist/assets.js

@@ -0,0 +1,61 @@
+// SETUP IF-0-SETUP-4 — what the cli build baked (`dist/assets.json`) and where the packaged keyslot
+// scripts are. Both are written by `scripts/lib/cli-assets.mjs --write`, which the cli `build` runs;
+// `cli-assets.mjs --check` holds them equal to the tree.
+//
+// Paths are resolved from this module's own URL, one level up, so the same spelling lands on the
+// package's `dist/` and `keyslot/` whether this runs as `dist/assets.js` (installed) or as
+// `src/assets.ts` (the test suite, after a build).
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+export const BAKED_ASSET_KEYS = Object.freeze(["mcpVersion", "piVersion", "opencodeVersion", "releaseTag"]);
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
+/**
+ * A missing or malformed bake. Never defaulted: an unpinned version is a different install. It
+ * carries no `code`: it is not a cause-code site (fleet_diagnosability #403), and setup names it.
+ */
+export class BakedAssetsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BakedAssetsError";
+    }
+}
+export const ASSETS_URL = new URL("../dist/assets.json", import.meta.url);
+export const KEYSLOT_URL = new URL("../keyslot/", import.meta.url);
+/** The build's baked versions and release tag, validated field by field. */
+export function bakedAssets(file = ASSETS_URL) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        throw new BakedAssetsError("dist/assets.json is absent or unreadable: the cli build did not run");
+    }
+    const record = raw;
+    if (!record || typeof record !== "object" || Array.isArray(record))
+        throw new BakedAssetsError("dist/assets.json is not an object");
+    const keys = Object.keys(record);
+    if (keys.length !== BAKED_ASSET_KEYS.length || !BAKED_ASSET_KEYS.every((key) => keys.includes(key))) {
+        throw new BakedAssetsError(`dist/assets.json must hold exactly ${BAKED_ASSET_KEYS.join(", ")}`);
+    }
+    for (const key of ["mcpVersion", "piVersion", "opencodeVersion"]) {
+        if (typeof record[key] !== "string" || !VERSION.test(record[key]))
+            throw new BakedAssetsError(`dist/assets.json ${key} is not a version`);
+    }
+    if (typeof record.releaseTag !== "string" || !RELEASE_TAG.test(record.releaseTag)) {
+        throw new BakedAssetsError("dist/assets.json releaseTag is not v<x.y.z>");
+    }
+    return {
+        mcpVersion: record.mcpVersion,
+        piVersion: record.piVersion,
+        opencodeVersion: record.opencodeVersion,
+        releaseTag: record.releaseTag,
+    };
+}
+/** The packaged keyslot directory (no trailing slash). Throws when the build did not copy it. */
+export function resolveKeyslotDir(url = KEYSLOT_URL) {
+    const dir = fileURLToPath(url).replace(/\/+$/, "");
+    if (!existsSync(`${dir}/status.sh`))
+        throw new BakedAssetsError("keyslot/ is absent: the cli build did not copy the keyslot scripts");
+    return dir;
+}

package/dist/assets.json

@@ -0,0 +1,6 @@
+{
+  "mcpVersion": "1.31.1",
+  "piVersion": "0.4.1",
+  "opencodeVersion": "0.2.1",
+  "releaseTag": "v1.53.0"
+}

package/dist/cli.d.ts

@@ -1,6 +1,7 @@
 import { Command } from "commander";
-import { type EnrollKeystore, type EnrollmentIntent, type FleetOnboardingIntent, type PendingEnrollmentStore, type OAuthFetchLike, type FetchLike, type AgentJoinDeployment, type AgentJoinInstructions, type DeviceAuthorizationPrompt } from "@consiliency/agent-board-client";
+import { createAgentBoardClient, type EnrollKeystore, type EnrollmentIntent, type FleetOnboardingIntent, type PendingEnrollmentStore, type OAuthFetchLike, type FetchLike, type AgentJoinDeployment, type AgentJoinInstructions, type DeviceAuthorizationPrompt, resolveCredentials } from "@consiliency/agent-board-client";
 import { type DoctorOptions, type DoctorReport } from "./doctor.js";
+import { type SetupEnroller, type SetupRunner } from "./setup.js";
 import { DevicePendingEnrollmentStore } from "./enroll_runtime.js";
 type JsonObject = Record<string, unknown>;
 export interface CliIo {
@@ -208,6 +209,11 @@ export interface DefaultEnrollmentRunnerDeps {
     sessionUrl?: string;
     /** Anon apikey for the post-enroll board RPCs. Default: resolveEnrollPublishableKey(env). */
     publishableKey?: string;
+    /**
+     * SETUP: the key reference the `key` step produced, handed over directly (never an env var the
+     * user must set). Wins over `MESSAGE_BOARD_ENROLL_KEY_REFERENCE`. Default: env.
+     */
+    keyReference?: string;
     /** Clock (tests). Default: wall clock. */
     now?: () => number;
     /**
@@ -224,6 +230,11 @@ export interface DefaultEnrollmentRunnerDeps {
     };
 }
 export declare function defaultEnrollmentRunner(env?: NodeJS.ProcessEnv, deps?: DefaultEnrollmentRunnerDeps): EnrollmentCommandRunner;
+/**
+ * SETUP — the enrollment `agent-board setup` runs: this runner's device flow, built from setup's
+ * env with the `key` step's reference injected (never an env var the user must set).
+ */
+export declare const setupEnroller: SetupEnroller;
 /**
  * How each field of a `FleetOnboardingIntent` is turned from an argv string into the value
  * that goes on the wire and into the template (Consiliency/message-board#254).
@@ -306,6 +317,29 @@ type FleetTupleField = StringFieldsOf<FleetOnboardingIntent>;
 export declare const FLEET_TUPLE_DISPOSITION: Readonly<Record<FleetTupleField, FleetTupleDisposition>>;
 /** `runDoctor`'s shape; a seam so the exit-code wiring is testable without a live board. */
 export type DoctorRunner = (options: DoctorOptions) => Promise<DoctorReport>;
-export declare function createProgram(client: ClientLike, io: CliIo, enrollment?: EnrollmentCommandRunner, doctor?: DoctorRunner): Command;
-export declare function runCli(argv: string[], io?: CliIo, client?: ClientLike, enrollment?: EnrollmentCommandRunner, doctor?: DoctorRunner): Promise<void>;
+/**
+ * SETUP IF-0-SETUP-1 — the global `--as <harness>`: which harness's identity FILE every command's
+ * credentials come from. The client is constructed before argv is parsed, so the choice is a
+ * holder the parse fills and the client's credential resolver reads at FIRST USE (see
+ * `fileAwareCredentials`). Unset, the resolver is today's env chain, unchanged.
+ */
+export interface CredentialSelection {
+    as?: string;
+}
+/**
+ * The lazy credential source. With `--as <h>`: `<h>`'s identity file through the client's trusted
+ * open, and ONLY the file — `fileIdentityEnv` strips every ambient identity and generic name, as
+ * doctor does, because `--as` is an explicit choice of the file. The runtime descriptor is ignored
+ * for the same reason. Without it: `resolveCredentials(descriptor, env)`, exactly as before.
+ */
+export declare function fileAwareCredentials(selection: CredentialSelection, env?: NodeJS.ProcessEnv): (descriptor?: Parameters<typeof resolveCredentials>[0]) => Promise<import("@consiliency/agent-board-client").ResolvedCredentials>;
+export declare function createProgram(client: ClientLike, io: CliIo, enrollment?: EnrollmentCommandRunner, doctor?: DoctorRunner, selection?: CredentialSelection, setup?: SetupRunner): Command;
+export interface RunCliOptions {
+    /** The env the default client's credential resolver reads. Default `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /** Extra options for the DEFAULT client (tests: a `dataSourceFactory`); never its resolver. */
+    clientOptions?: Omit<NonNullable<Parameters<typeof createAgentBoardClient>[0]>, "resolveCredentials">;
+    setup?: SetupRunner;
+}
+export declare function runCli(argv: string[], io?: CliIo, client?: ClientLike, enrollment?: EnrollmentCommandRunner, doctor?: DoctorRunner, options?: RunCliOptions): Promise<void>;
 export {};

package/dist/cli.js

@@ -3,8 +3,9 @@ import { createHash, randomUUID } from "node:crypto";
 import * as nodeFs from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { createAgentBoardClient, toOperationFailure, beginEnrollment, completeEnrollment, beginDeviceEnrollment, completeDeviceEnrollment, runEnrollment, runDeviceEnrollment, resolveEnrollmentDescriptor, EnrollmentDescriptorError, EnrollmentCommandError, resolveEnrollEndpoint, resolveEnrollSessionUrl, resolveEnrollPublishableKey, resolveJoinDeployment, buildFleetHarnessTemplate, finalizeFleetHarnessTemplate, normalizePublishableKeyFieldReference, normalizeFleetTupleValue, normalizeKeyReference, enrollCommitMarker, assertPresentationSafe, FLEET_TEMPLATE_FAILURE_MESSAGE, PROHIBITED_PRESENTATION_REMOVE_CLASS, buildAgentJoinInstructions, nodeFetchAdapter, buildEnrollKeystore, AUTHORED_CAUSE_CODES, codeProvenance, markAuthoredCode, assertIdentityHarness, identityFilePath, resolveHostSegment, identityConfigRoot, walkTrustedDirectory, IDENTITY_HARNESSES, CredentialResolutionError, } from "@consiliency/agent-board-client";
-import { formatDoctorReport, runDoctor } from "./doctor.js";
+import { createAgentBoardClient, toOperationFailure, beginEnrollment, completeEnrollment, beginDeviceEnrollment, completeDeviceEnrollment, runEnrollment, runDeviceEnrollment, resolveEnrollmentDescriptor, EnrollmentDescriptorError, EnrollmentCommandError, resolveEnrollEndpoint, resolveEnrollSessionUrl, resolveEnrollPublishableKey, resolveJoinDeployment, buildFleetHarnessTemplate, finalizeFleetHarnessTemplate, normalizePublishableKeyFieldReference, normalizeFleetTupleValue, normalizeKeyReference, enrollCommitMarker, assertPresentationSafe, FLEET_TEMPLATE_FAILURE_MESSAGE, PROHIBITED_PRESENTATION_REMOVE_CLASS, buildAgentJoinInstructions, nodeFetchAdapter, buildEnrollKeystore, AUTHORED_CAUSE_CODES, codeProvenance, markAuthoredCode, assertIdentityHarness, identityFilePath, resolveHostSegment, identityConfigRoot, walkTrustedDirectory, IDENTITY_HARNESSES, CredentialResolutionError, readIdentityFile, resolveCredentials, } from "@consiliency/agent-board-client";
+import { fileIdentityEnv, formatDoctorReport, runDoctor } from "./doctor.js";
+import { addSetupCommand, runSetup } from "./setup.js";
 import { identityValuesFromEnrollment, resolveIdentityDeployment, writeIdentityFile, } from "./identity_writer.js";
 import { DevicePendingEnrollmentStore, FilePendingEnrollmentStore, FleetDeviceContinuationStore, makeBrowserOpener, prepareFleetRuntimeOutput, publishFinalizedFleetTemplate, } from "./enroll_runtime.js";
 function isRuntimeStatus(value) {
@@ -1628,11 +1629,15 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
     const boardFetch = deps.boardFetch ?? nodeFetchAdapter;
     // Post-enroll board-op wiring (raw Supabase domain): explicit /session URL + anon
     // apikey. Optional — absent preserves the ${boardUrl}/session default + no apikey.
-    const sessionUrl = deps.sessionUrl ?? resolveEnrollSessionUrl(env);
-    const publishableKey = deps.publishableKey ?? resolveEnrollPublishableKey(env);
+    // LAZY (SETUP): the runner is built before parsing, for every command, so constructing it
+    // reads nothing from env; each flow method resolves these when enrollment actually runs.
+    const sessionUrl = () => deps.sessionUrl ?? resolveEnrollSessionUrl(env);
+    const publishableKey = () => deps.publishableKey ?? resolveEnrollPublishableKey(env);
+    // SETUP: the `key` step's reference is injected, and wins over env.
+    const descriptorOf = () => resolveEnrollmentDescriptor(env, deps.keyReference === undefined ? {} : { keyReference: deps.keyReference });
     return {
         async run(input) {
-            const descriptor = resolveEnrollmentDescriptor(env);
+            const descriptor = descriptorOf();
             const enrollEndpoint = deps.enrollEndpoint ?? resolveEnrollEndpoint(env);
             const keystore = deps.keystore ?? buildEnrollKeystore(descriptor, env, {
                 ...(input.intent.kind === "fleet_onboarding" ? { fleetOnboarding: input.intent } : {}),
@@ -1649,14 +1654,14 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
                 keystore,
                 boardFetch,
                 keystoreBackends: keystore.backends,
-                sessionUrl,
-                publishableKey,
+                sessionUrl: sessionUrl(),
+                publishableKey: publishableKey(),
                 openAuthorization,
                 now: deps.now,
             });
         },
         async device(input) {
-            const descriptor = resolveEnrollmentDescriptor(env);
+            const descriptor = descriptorOf();
             // Fail CLEAN and actionable when the host descriptor carries no device
             // endpoint — otherwise the shared flow throws a bare `no_device_endpoint`.
             // The endpoint is optional in resolveEnrollmentDescriptor (it is not required
@@ -1684,15 +1689,15 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
                 keystore,
                 boardFetch,
                 keystoreBackends: keystore.backends,
-                sessionUrl,
-                publishableKey,
+                sessionUrl: sessionUrl(),
+                publishableKey: publishableKey(),
                 onDeviceAuthorization: input.onDeviceAuthorization,
                 sleep: deps.sleep,
                 now: deps.now,
             });
         },
         async deviceBegin(input) {
-            const descriptor = resolveEnrollmentDescriptor(env);
+            const descriptor = descriptorOf();
             if (!descriptor.issuer.deviceAuthorizationEndpoint) {
                 throw new EnrollmentDescriptorError("missing_device_endpoint", "device enrollment needs a device authorization endpoint (set MESSAGE_BOARD_ENROLL_DEVICE_AUTHORIZATION_ENDPOINT)");
             }
@@ -1703,8 +1708,8 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
                     ...(input.intent.kind === "fleet_onboarding" ? { fleetOnboarding: input.intent } : {}),
                 }),
                 boardFetch,
-                sessionUrl,
-                publishableKey,
+                sessionUrl: sessionUrl(),
+                publishableKey: publishableKey(),
                 onDeviceAuthorization: async () => { },
                 now: deps.now,
             });
@@ -1776,12 +1781,12 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
                 if (pending.slug !== input.expectedFleet.slug) {
                     throw new EnrollmentCommandError("fleet_device_slug_mismatch", "device enrollment agent slug does not match");
                 }
-                const currentReference = normalizeKeyReference(resolveEnrollmentDescriptor(env).keyReference);
+                const currentReference = normalizeKeyReference(descriptorOf().keyReference);
                 if (`${currentReference.resolver}:${currentReference.handle}` !== input.expectedFleet.keyReference) {
                     throw new EnrollmentCommandError("fleet_device_key_reference_mismatch", "device enrollment key reference does not match current configuration");
                 }
             }
-            const descriptor = resolveEnrollmentDescriptor(env);
+            const descriptor = descriptorOf();
             if (!descriptor.issuer.deviceAuthorizationEndpoint) {
                 throw new EnrollmentDescriptorError("missing_device_endpoint", "device enrollment needs a device authorization endpoint (set MESSAGE_BOARD_ENROLL_DEVICE_AUTHORIZATION_ENDPOINT)");
             }
@@ -1809,8 +1814,8 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
                 keystore,
                 boardFetch,
                 keystoreBackends: keystore.backends,
-                sessionUrl,
-                publishableKey,
+                sessionUrl: sessionUrl(),
+                publishableKey: publishableKey(),
                 onDeviceAuthorization: async () => { },
                 sleep: deps.sleep,
                 now: deps.now,
@@ -1846,7 +1851,7 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
         async begin(input) {
             // Force OOB: a loopback receiver cannot bridge two separate CLI processes, so
             // the two-step path is always out-of-band paste (no redirectUri ⇒ OOB).
-            const descriptor = resolveEnrollmentDescriptor(env);
+            const descriptor = descriptorOf();
             const store = deps.store ?? new FilePendingEnrollmentStore(env);
             return beginEnrollment({
                 descriptor,
@@ -1861,13 +1866,13 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
                 clientId: descriptor.issuer.clientId,
                 // #173 — pass the provisioning config so begin refuses a doomed raw-Supabase
                 // enrollment BEFORE the human is asked to approve anything.
-                sessionUrl,
-                publishableKey,
+                sessionUrl: sessionUrl(),
+                publishableKey: publishableKey(),
                 now: deps.now,
             });
         },
         async complete(input) {
-            const descriptor = resolveEnrollmentDescriptor(env);
+            const descriptor = descriptorOf();
             const enrollEndpoint = deps.enrollEndpoint ?? resolveEnrollEndpoint(env);
             const store = deps.store ?? new FilePendingEnrollmentStore(env);
             const pending = await store.get(input.enrollmentId);
@@ -1885,13 +1890,21 @@ export function defaultEnrollmentRunner(env = process.env, deps = {}) {
                 keystore,
                 boardFetch,
                 keystoreBackends: keystore.backends,
-                sessionUrl,
-                publishableKey,
+                sessionUrl: sessionUrl(),
+                publishableKey: publishableKey(),
                 now: deps.now,
             });
         },
     };
 }
+/**
+ * SETUP — the enrollment `agent-board setup` runs: this runner's device flow, built from setup's
+ * env with the `key` step's reference injected (never an env var the user must set).
+ */
+export const setupEnroller = async (input) => {
+    const runner = defaultEnrollmentRunner(input.env, { keyReference: input.keyReference });
+    return (await runner.device({ slug: input.slug, intent: input.intent, onDeviceAuthorization: input.onDeviceAuthorization }));
+};
 function intentFromOptions(options) {
     if (options.board === false) {
         return { kind: "none" };
@@ -3199,11 +3212,33 @@ function addDoctorCommand(program, io, doctor) {
         process.exitCode = report.exit;
     });
 }
-export function createProgram(client, io, enrollment = defaultEnrollmentRunner(), doctor = runDoctor) {
+/**
+ * The lazy credential source. With `--as <h>`: `<h>`'s identity file through the client's trusted
+ * open, and ONLY the file — `fileIdentityEnv` strips every ambient identity and generic name, as
+ * doctor does, because `--as` is an explicit choice of the file. The runtime descriptor is ignored
+ * for the same reason. Without it: `resolveCredentials(descriptor, env)`, exactly as before.
+ */
+export function fileAwareCredentials(selection, env = process.env) {
+    return async (descriptor) => {
+        const harness = selection.as;
+        if (harness === undefined)
+            return resolveCredentials(descriptor, env);
+        assertIdentityHarness(harness);
+        const { values } = await readIdentityFile({ harness, env });
+        return resolveCredentials(undefined, fileIdentityEnv(env, values));
+    };
+}
+export function createProgram(client, io, enrollment = defaultEnrollmentRunner(), doctor = runDoctor, selection = {}, setup) {
     const program = new Command()
         .name("agent-board")
         .description("Thin CLI surface for the agent_board RPC and canonical read contracts")
+        .option("--as <harness>", "take credentials from this harness's identity file (agy, claude, codex, grok, opencode, pi), ignoring any identity in the environment")
         .addHelpText("after", "\nAuth: user-scoped agent sessions are the default. Service-role execution is reserved for callback workers and vetted operational scripts through explicit client configuration, not the normal agent CLI path. Signing configuration is inherited from metadata-safe descriptors; raw private-key arguments are not accepted.\n");
+    // Filled at parse time, read by the client's resolver at first use.
+    program.hook("preAction", () => {
+        const chosen = program.opts().as;
+        selection.as = chosen;
+    });
     program
         .command("signing-status")
         .description("Print metadata-safe signing descriptor status; raw private-key arguments are not accepted")
@@ -3224,12 +3259,19 @@ export function createProgram(client, io, enrollment = defaultEnrollmentRunner()
     addInviteCommands(program, client, io);
     addEnrollCommands(program, io, enrollment);
     addDoctorCommand(program, io, doctor);
+    addSetupCommand(program, io, setup ?? ((options) => runSetup(options, { enroll: setupEnroller })));
     return program;
 }
 export async function runCli(argv, io = {
     writeStdout: (message) => process.stdout.write(message),
     writeStderr: (message) => process.stderr.write(message),
-}, client = createAgentBoardClient(), enrollment = defaultEnrollmentRunner(), doctor = runDoctor) {
-    const program = createProgram(client, io, enrollment, doctor);
+}, client, enrollment = defaultEnrollmentRunner(), doctor = runDoctor, options = {}) {
+    const selection = {};
+    // Built BEFORE parsing, as always; `--as` reaches it through `selection` at first use.
+    const resolved = client ?? createAgentBoardClient({
+        ...options.clientOptions,
+        resolveCredentials: fileAwareCredentials(selection, options.env ?? process.env),
+    });
+    const program = createProgram(resolved, io, enrollment, doctor, selection, options.setup);
     await program.parseAsync(argv, { from: "user" });
 }

package/dist/config_edit.d.ts

@@ -0,0 +1,37 @@
+/** What an edit found and produced. `text` equals the input when `prior` is `exact`. */
+export interface ConfigEdit {
+    prior: "absent" | "exact" | "differs";
+    text: string;
+}
+/** A refusal: the reason is an authored code, never file content. */
+export declare class ConfigEditRefused extends Error {
+    readonly reason: "config_unparseable" | "config_layout_unrecognised" | "config_not_an_object" | "config_inline_table" | "config_array_table";
+    constructor(reason: "config_unparseable" | "config_layout_unrecognised" | "config_not_an_object" | "config_inline_table" | "config_array_table");
+}
+/** A value an entry may carry: what setup writes, plus whatever a user kept in the entry. */
+export type ConfigValue = string | number | boolean | readonly ConfigValue[] | {
+    readonly [key: string]: ConfigValue;
+};
+export type ConfigEntry = {
+    readonly [key: string]: ConfigValue;
+};
+export declare function deepEqual(a: unknown, b: unknown): boolean;
+/** The block setup writes for `path` (a table header plus one line per key, in the entry's order). */
+export declare function renderTomlTable(path: readonly string[], entry: ConfigEntry): string;
+/**
+ * Put `entry` at the table `path` (e.g. `["mcp_servers", "agent-board"]`) of a TOML document.
+ * Absent → appended as its own block; equal → the text unchanged; different → the table's own
+ * block(s) (its header, its sub-tables' headers, and their keys) replaced in place by the rendered
+ * block. Keys defined for it any other way (a dotted key under a parent table, an inline table)
+ * are a layout this edit does not own: refused, never appended beside.
+ */
+export declare function upsertTomlTable(text: string, path: readonly string[], entry: ConfigEntry): ConfigEdit;
+/**
+ * Put `entry` at `path` of a JSON/JSONC object document. Empty text is an empty object. Missing
+ * intermediate objects are created; an existing member is replaced in its span; a new member is
+ * inserted before its object's closing brace. `strict` also requires the input to be plain JSON,
+ * for a harness whose reader is strict (an edit never makes a file unreadable to its harness).
+ */
+export declare function upsertJsonMember(text: string, path: readonly string[], entry: ConfigEntry, options?: {
+    strict?: boolean;
+}): ConfigEdit;