@folsom/fuse 0.37.1 → 0.41.0

package/dist/index.d.ts

@@ -1,51 +1,3 @@
-/** A minimal fetch signature, satisfied by the global fetch and most polyfills. */
-type FetchLike = (input: string | URL, init?: RequestInit) => Promise<Response>;
-/** Per-call options accepted by every service method. */
-interface CallOptions {
-    /** Abort the request (and, for events, the stream). */
-    signal?: AbortSignal;
-}
-interface TransportConfig {
-    baseUrl: string;
-    token?: string;
-    fetch?: FetchLike;
-    userAgent?: string;
-    requestId?: () => string;
-    timeoutMs?: number;
-    headers?: Record<string, string>;
-}
-type Query = Record<string, string | undefined>;
-interface RequestSpec {
-    query?: Query;
-    body?: unknown;
-    signal?: AbortSignal;
-}
-declare class Transport {
-    private readonly baseUrl;
-    private readonly token?;
-    private readonly fetchImpl;
-    private readonly userAgent?;
-    private readonly requestId?;
-    private readonly timeoutMs?;
-    private readonly defaultHeaders?;
-    constructor(cfg: TransportConfig);
-    /** Perform a request and decode a JSON response body. */
-    json<T>(method: string, path: string, spec?: RequestSpec): Promise<T>;
-    /** Perform a request that returns no body (e.g. 204 actions). */
-    noContent(method: string, path: string, spec?: RequestSpec): Promise<void>;
-    /**
-     * Open a long-lived stream (SSE). Applies NO timeout — only the caller's
-     * signal cancels it — and checks the status eagerly so connect-time errors
-     * (404/401/...) surface as a FuseApiError before any iteration.
-     */
-    stream(path: string, query: Query | undefined, signal?: AbortSignal): Promise<Response>;
-    private execute;
-    private buildUrl;
-    private buildHeaders;
-    private decodeJson;
-    private withTimeout;
-}
-
 /** Spec is the hardware/runtime spec for a microVM. */
 interface Spec {
     cpus?: number;
@@ -261,11 +213,16 @@ interface Health {
 interface EgressSpec {
     /** "direct" (the default) or "proxy". */
     mode?: string;
-    /** Proxy backend, required when mode is "proxy" (today "mock"; later
-     * "cloudflare-warp"). */
+    /** Proxy backend, required when mode is "proxy" ("cloudflare-warp",
+     * "wireguard", or "mock" for local development). */
     provider?: string;
     /** "socks5" (the default for proxy) or "http". */
     protocol?: string;
+    /** Name of an entry in the request's secrets holding the provider's
+     * credential, for a provider that takes one: "wireguard" reads a base64
+     * wg-quick config. The value goes to the host's egress backend only and is
+     * left out of the secrets the guest receives. */
+    secret?: string;
 }
 /**
  * EgressStatus is how the environment's outbound traffic is actually routed.
@@ -318,6 +275,9 @@ interface CreateRequest {
     /** Graphical session geometry. Omit it for an environment with no desktop,
      * in which case a desktop image keeps its baked default geometry. */
     desktop?: DesktopSpec;
+    /** Human-in-the-loop policy. Omit it for an environment that cannot raise
+     * interventions. */
+    hitl?: HitlSpec;
 }
 /** EnvironmentInfo is the server's view of a single microVM. */
 interface EnvironmentInfo {
@@ -386,6 +346,18 @@ interface ExecRequest {
      * default; the server clamps anything above its ceiling.
      */
     timeout_ms?: number;
+    /**
+     * Wait for a human when a hitl gate holds the exec (202), or when a
+     * human holds the environment (423, a takeover or a pending stall), then
+     * run (the default). false throws a PendingInterventionError or a
+     * LockedError at once instead. Not sent on the wire.
+     */
+    wait?: boolean;
+    /**
+     * Called with the pending intervention when a gate holds the exec, before
+     * waiting on it. It overrides the client's onHeld. Not sent on the wire.
+     */
+    onHeld?: (held: Intervention) => void;
 }
 /**
  * ExecResult is the outcome of a guest command.
@@ -493,7 +465,9 @@ interface Snapshot {
      * those bytes is intact, and nothing more: it is not a cross-build
      * identity, because two builds of the same recipe produce different rootfs
      * bytes (timestamps, inode ordering, package caches). It can never be used
-     * as a cache key. */
+     * as a cache key. The live snapshot a migrate takes in its final pause on
+     * an xfs or btrfs host is the exception: its digest is a sha256 of its
+     * per-block hash table, not of the rootfs file. */
     digest?: string;
     /** Whether this artifact is the rootfs alone (`"disk"`), or the rootfs plus
      * the guest's memory and vCPU state (`"live"`). Restoring a disk snapshot
@@ -527,6 +501,14 @@ interface HostCapacity {
     arch?: string;
     gpus?: number;
     gpu_kind?: string;
+    /** The firecracker release the host agent reports it runs ("v1.17.0").
+     * Probed at registration (a declared value is ignored) and only set on
+     * capacity. Live migration needs both hosts on the same release. Omitted
+     * on qemu hosts and older agents. */
+    firecracker?: string;
+    /** The firecracker release the host's fc-agent.py pins. Differs from
+     * firecracker when the host has not run fc-update since the pin moved. */
+    firecracker_pinned?: string;
     /** Fractional GPU capacity: MIG instance count by profile name (e.g.
      * {"1g.10gb": 4}). Like gpus, it requires backend "qemu". When the host
      * reports per-instance MIG inventory (mig_instances), this map is a derived
@@ -608,7 +590,31 @@ interface APIKey {
     created_at: string;
     last_used_at?: string;
     revoked_at?: string;
+    /** The hitl scopes the key holds. Absent for a full-access key. */
+    scopes?: string[];
+    /** The environment a scoped key is limited to (and its forks). */
+    env_id?: string;
+    /** RFC 3339 timestamp. Scoped keys always expire. */
+    expires_at?: string;
+    /** The actor the key is pinned to, if any. */
+    actor?: ActorLabel;
+    created_by?: string;
+}
+/** ActorLabel is an actor as a caller names it: an opaque id (at most 128
+ * bytes) and an optional display name. */
+interface ActorLabel {
+    id: string;
+    name?: string;
 }
+/** Hitl scopes a key can be minted with. */
+declare const HitlScope: {
+    readonly Read: "hitl:read";
+    readonly Decide: "hitl:decide";
+    readonly Secret: "hitl:secret";
+    readonly Takeover: "hitl:takeover";
+    readonly ActAs: "hitl:act-as";
+};
+type HitlScope = (typeof HitlScope)[keyof typeof HitlScope];
 /**
  * CreatedAPIKey is returned by apiKeys.create. `key` is the raw secret and is
  * unrecoverable after this response.
@@ -643,6 +649,477 @@ declare const HealthState: {
     readonly Failing: "failing";
 };
 type HealthState = (typeof HealthState)[keyof typeof HealthState];
+/** HitlSpec is the human-in-the-loop policy an environment is created with. */
+interface HitlSpec {
+    /** Default deadline for every intervention, 10 to 86400. Omitted means 600. */
+    timeout_seconds?: number;
+    /** "reject" (the default) or "allow". */
+    on_timeout?: string;
+    /** The request kinds the agent may raise. */
+    requests: HitlRequests;
+    /** Refuse decisions made without a pinned or asserted actor. */
+    require_actor?: boolean;
+    /** Webhooks told about every intervention and audit event. */
+    notify?: HitlWebhook[];
+    /** Gates hold, record or deny exec, lifecycle and computer actions, and
+     * raise stall and expiry signals. */
+    gates?: HitlGate[];
+    /** Allowlist mode for exec. */
+    exec?: HitlExecPolicy;
+}
+/** HitlGate is one enforced gate. */
+interface HitlGate {
+    name: string;
+    /** HitlKind.Exec, HitlKind.Lifecycle, HitlKind.Computer, HitlKind.Stall
+     * or HitlKind.Expiry. */
+    on: string;
+    match: HitlGateMatch;
+    /** One of GateMode; ask is the default. */
+    mode?: string;
+    /** The default reach of an approval: "once", "env" or "ttl:<duration>". */
+    grant?: string;
+    timeout_seconds?: number;
+    /** Returned on a deny and shown to the human on an ask. */
+    reason?: string;
+    /** A webhook asked allow, deny or ask before a human sees an ask gate's
+     * action. A failure or timeout means ask. */
+    decide?: HitlDecider;
+}
+/** HitlDecider is a gate's decider. secret names an entry in the create
+ * request's secrets; its value signs each call (Fuse-Signature). */
+interface HitlDecider {
+    url: string;
+    secret: string;
+}
+/** HitlGateMatch selects the actions a gate applies to. Every field set must
+ * match. */
+interface HitlGateMatch {
+    /** Matches the basename of argv[0] after env, sudo, nice, timeout, xargs,
+     * nohup and stdbuf are stripped. */
+    program?: string[];
+    /** Matches when these appear in argv in this order. */
+    args?: string[];
+    /** Matches any opaque shell exec. */
+    shell?: boolean;
+    /** Matches lifecycle actions (one of LifecycleAction) or, on a computer
+     * gate, computer action names ("type", "key", "left_click", ...). */
+    action?: string[];
+    /** Matches a computer "type" whose text contains any entry, ignoring
+     * case. */
+    text_contains?: string[];
+    /** Raises a stall after this many consecutive non-zero exec exits
+     * (on: "stall"). */
+    failures?: number;
+    /** Raises a stall after this long with no exec or computer call
+     * (on: "stall"). */
+    quiet_seconds?: number;
+    /** Raises an expiry this long before the idle_timeout or max_runtime reap
+     * (on: "expiry"). */
+    before_seconds?: number;
+}
+/** HitlExecPolicy is allowlist mode for exec: a program not in allow is held
+ * with default ("ask" or "deny"), interpreters and shells included. */
+interface HitlExecPolicy {
+    default: string;
+    allow: string[];
+}
+/** ExecPayload is a held exec. */
+interface ExecPayload {
+    argv: string[];
+    shell?: string;
+    timeout_ms?: number;
+}
+/** ComputerPayload is a held computer action. input is the body as sent. */
+interface ComputerPayload {
+    action: string;
+    text?: string;
+    input: unknown;
+}
+/** DeciderNote is what a gate's decider said when it sent an action on to a
+ * human: verdict "ask" with its reason, or the error fuse fell through on. */
+interface DeciderNote {
+    /** One of DeciderVerdict. */
+    verdict: string;
+    reason?: string;
+    error?: string;
+}
+/** InterventionReview is a review request. content is the file as fuse read
+ * it at request time when path is set. */
+interface InterventionReview {
+    path?: string;
+    content: string;
+    /** One of ReviewFormat. */
+    format: string;
+    message?: string;
+    truncated?: boolean;
+}
+/** LifecyclePayload is a held environment action. */
+interface LifecyclePayload {
+    /** One of LifecycleAction. */
+    action: string;
+}
+/** InterventionResult is what running an approved gated action produced. */
+interface InterventionResult {
+    exec?: ExecResult;
+    computer?: ComputerResult;
+    env_id?: string;
+    snapshot_id?: string;
+    error?: string;
+    /** RFC 3339 timestamp. */
+    finished_at: string;
+}
+/** HitlWebhook is one hitl.notify target. `secret` names an entry of the
+ * create request's secrets; its value signs each delivery with HMAC-SHA256
+ * in the Fuse-Signature header. */
+interface HitlWebhook {
+    url: string;
+    secret: string;
+}
+/** HitlRequests declares the allowed request kinds. Present means allowed;
+ * set ask (to {}) to allow asks. */
+interface HitlRequests {
+    ask?: HitlAskRequests;
+    secret?: HitlSecretRequests;
+    takeover?: HitlTakeoverRequests;
+    review?: HitlReviewRequests;
+}
+/** HitlReviewRequests configures review requests. Present means allowed. */
+type HitlReviewRequests = Record<string, never>;
+/** HitlSecretRequests declares where a secret may land. The agent names one
+ * of these targets; it can never choose a path or variable of its own. */
+interface HitlSecretRequests {
+    targets: HitlSecretTarget[];
+}
+/** HitlSecretTarget is one declared destination: exactly one of env (a
+ * variable later execs see) or file (an absolute guest path, written 0600).
+ * label is what the human is shown first. */
+interface HitlSecretTarget {
+    env?: string;
+    file?: string;
+    label: string;
+}
+/** HitlTakeoverRequests declares the ways a human may take over: "terminal"
+ * and "desktop" (which needs a desktop block). Empty means terminal. */
+interface HitlTakeoverRequests {
+    via?: string[];
+}
+/** HitlAskRequests configures ask requests. Present means allowed. */
+type HitlAskRequests = Record<string, never>;
+/** Actor is who raised or decided an intervention: "master", "key:<id>", or
+ * "system" for fuse itself (expiry, cancel on destroy). */
+interface Actor {
+    id: string;
+    name?: string;
+    /** "key", "system" or "decider". */
+    source: string;
+    key_id?: string;
+}
+/** InterventionPayload is what was asked, attempted or noticed: a question
+ * for an ask, the held exec or lifecycle action for a gate, a secret or
+ * takeover request, or a signal. */
+interface InterventionPayload {
+    question?: string;
+    choices?: string[];
+    exec?: ExecPayload;
+    lifecycle?: LifecyclePayload;
+    /** Set for a secret request only. */
+    secret?: InterventionSecret;
+    /** Set for a takeover only. */
+    takeover?: InterventionTakeover;
+    /** What fuse saw, for a stall or expiry. */
+    signal?: InterventionSignal;
+    /** The held computer action. */
+    computer?: ComputerPayload;
+    /** What is up for review. */
+    review?: InterventionReview;
+    /** The gate decider's note on an action it escalated. */
+    decider?: DeciderNote;
+}
+/** InterventionSecret is a secret request. label comes from the Fusefile and
+ * is what a human should read first; message is the agent's own text. The
+ * value is never part of any intervention. */
+interface InterventionSecret {
+    target: string;
+    label: string;
+    message?: string;
+}
+/** InterventionTakeover is a takeover. holder and started_at are set while a
+ * human holds the environment, which is also when the agent's exec and
+ * computer calls get 423. */
+interface InterventionTakeover {
+    via: string;
+    reason?: string;
+    holder?: Actor;
+    /** RFC 3339 timestamp. */
+    started_at?: string;
+}
+/** InterventionSignal is what fuse noticed on its own. A stall carries the
+ * failure run or the quiet time; an expiry carries the reaper due and when,
+ * and once approved the time the environment is kept until. */
+interface InterventionSignal {
+    failures?: number;
+    last_exit_code?: number;
+    quiet_seconds?: number;
+    /** "idle_timeout" or "max_runtime". */
+    reaper?: string;
+    /** RFC 3339 timestamp. */
+    reap_at?: string;
+    /** RFC 3339 timestamp. */
+    extended_until?: string;
+}
+/** InterventionDecision is how an intervention resolved. An expired one
+ * carries the on_timeout outcome and a cancelled one a reject. */
+interface InterventionDecision {
+    /** "approve" or "reject". */
+    outcome: string;
+    answer?: string;
+    reason?: string;
+    decided_by: Actor;
+    decided_at: string;
+    /** The argv the approver replaced a held exec's with. */
+    edited_argv?: string[];
+    /** The text the approver replaced a held type's with. */
+    edited_text?: string;
+    /** How far an approval of a gated action reaches. */
+    grant?: string;
+}
+/** Intervention is one request for a human. */
+interface Intervention {
+    id: string;
+    env_id: string;
+    kind: string;
+    /** Names the gate that raised it; absent for a request. */
+    gate?: string;
+    /** The gate's mode (one of GateMode). notify and deny records are born
+     * terminal. */
+    mode?: string;
+    /** One of InterventionState. */
+    state: string;
+    payload: InterventionPayload;
+    triggered_by: Actor;
+    /** RFC 3339 timestamp. */
+    deadline: string;
+    on_timeout: string;
+    /** Set on every terminal intervention. */
+    decision?: InterventionDecision;
+    /** Set once an approved gated action has been performed. */
+    result?: InterventionResult;
+    created_at: string;
+    updated_at: string;
+}
+/** AuditEntry is one row of the hash-chained hitl audit log. It holds who
+ * did what and when, never intervention content. Hashes are hex. */
+interface AuditEntry {
+    seq: number;
+    /** One of AuditEvent. */
+    event: string;
+    intervention_id?: string;
+    env_id?: string;
+    actor: Actor;
+    remote_addr?: string;
+    /** Links a takeover_session row to its cast; fetch it with
+     * interventions.getRecording. */
+    recording_id?: string;
+    /** RFC 3339 timestamp. */
+    at: string;
+    prev_hash: string;
+    hash: string;
+}
+/** Audit log events. */
+declare const AuditEvent: {
+    readonly Raised: "raised";
+    readonly Decided: "decided";
+    readonly Expired: "expired";
+    readonly Cancelled: "cancelled";
+    readonly InviteMinted: "invite_minted";
+    readonly InviteUsed: "invite_used";
+    readonly GrantCreated: "grant_created";
+    readonly GrantUsed: "grant_used";
+    readonly SecretAnswered: "secret_answered";
+    readonly TakeoverStarted: "takeover_started";
+    readonly TakeoverEnded: "takeover_ended";
+    readonly TakeoverSession: "takeover_session";
+};
+type AuditEvent = (typeof AuditEvent)[keyof typeof AuditEvent];
+/** Intervention kinds: ask is a request, exec and lifecycle are the gate
+ * surfaces. */
+declare const HitlKind: {
+    readonly Ask: "ask";
+    readonly Exec: "exec";
+    readonly Lifecycle: "lifecycle";
+    readonly Computer: "computer";
+    readonly Review: "review";
+    readonly Secret: "secret";
+    readonly Takeover: "takeover";
+    readonly Stall: "stall";
+    readonly Expiry: "expiry";
+};
+type HitlKind = (typeof HitlKind)[keyof typeof HitlKind];
+/** Gate modes. */
+declare const GateMode: {
+    readonly Ask: "ask";
+    readonly Notify: "notify";
+    readonly Deny: "deny";
+};
+type GateMode = (typeof GateMode)[keyof typeof GateMode];
+/** Decider verdicts. */
+declare const DeciderVerdict: {
+    readonly Allow: "allow";
+    readonly Deny: "deny";
+    readonly Ask: "ask";
+};
+type DeciderVerdict = (typeof DeciderVerdict)[keyof typeof DeciderVerdict];
+/** The actor source a decider's decision records. */
+declare const ACTOR_SOURCE_DECIDER = "decider";
+/** Review formats. */
+declare const ReviewFormat: {
+    readonly Text: "text";
+    readonly Diff: "diff";
+};
+type ReviewFormat = (typeof ReviewFormat)[keyof typeof ReviewFormat];
+/** Takeover modes: terminal gives the human a shell, desktop the live
+ * desktop view (it needs a desktop block). */
+declare const TakeoverVia: {
+    readonly Terminal: "terminal";
+    readonly Desktop: "desktop";
+};
+type TakeoverVia = (typeof TakeoverVia)[keyof typeof TakeoverVia];
+/** Lifecycle actions a gate can hold. */
+declare const LifecycleAction: {
+    readonly Destroy: "destroy";
+    readonly Fork: "fork";
+    readonly Migrate: "migrate";
+    readonly Drain: "drain";
+    readonly Snapshot: "snapshot";
+    readonly RotateToken: "rotate-token";
+};
+type LifecycleAction = (typeof LifecycleAction)[keyof typeof LifecycleAction];
+/** The gate name the exec allowlist reports. */
+declare const ALLOWLIST_GATE = "exec.allowlist";
+/** Intervention states. pending is the only non-terminal one. */
+declare const InterventionState: {
+    readonly Pending: "pending";
+    readonly Approved: "approved";
+    readonly Rejected: "rejected";
+    readonly Expired: "expired";
+    readonly Cancelled: "cancelled";
+};
+type InterventionState = (typeof InterventionState)[keyof typeof InterventionState];
+/** Intervention outcomes. Every terminal intervention carries one. */
+declare const InterventionOutcome: {
+    readonly Approve: "approve";
+    readonly Reject: "reject";
+};
+type InterventionOutcome = (typeof InterventionOutcome)[keyof typeof InterventionOutcome];
+/** isInterventionTerminal reports whether the intervention is resolved. */
+declare function isInterventionTerminal(i: Intervention | undefined): boolean;
+/** isInterventionApproved reports whether the intervention resolved as
+ * approve, which includes an expiry under on_timeout: allow. */
+declare function isInterventionApproved(i: Intervention | undefined): boolean;
+/** isInterventionSettled reports whether a caller has its final answer:
+ * resolved, and for an approved gated action that fuse performs, performed
+ * (with the outcome on result). */
+declare function isInterventionSettled(i: Intervention | undefined): boolean;
+
+/** A minimal fetch signature, satisfied by the global fetch and most polyfills. */
+type FetchLike = (input: string | URL, init?: RequestInit) => Promise<Response>;
+/** Per-call options accepted by every service method. */
+interface CallOptions {
+    /** Abort the request (and, for events, the stream). */
+    signal?: AbortSignal;
+}
+interface TransportConfig {
+    baseUrl: string;
+    token?: string;
+    fetch?: FetchLike;
+    userAgent?: string;
+    requestId?: () => string;
+    timeoutMs?: number;
+    headers?: Record<string, string>;
+    actor?: ActorLabel;
+    hitlNoWait?: boolean;
+    onHeld?: (held: Intervention) => void;
+}
+/** Gated is the answer to a call a hitl gate may hold: the action's own
+ * response body, or the held intervention of a 202. */
+type Gated<T> = {
+    held: Intervention;
+} | {
+    held?: undefined;
+    value: T;
+};
+type Query = Record<string, string | undefined>;
+interface RequestSpec {
+    query?: Query;
+    body?: unknown;
+    signal?: AbortSignal;
+}
+declare class Transport {
+    private readonly baseUrl;
+    private readonly token?;
+    private readonly fetchImpl;
+    private readonly userAgent?;
+    private readonly requestId?;
+    private readonly timeoutMs?;
+    private readonly defaultHeaders?;
+    private readonly actor?;
+    /** The client's hitl wait options. */
+    readonly hitlNoWait: boolean;
+    readonly onHeld?: (held: Intervention) => void;
+    constructor(cfg: TransportConfig);
+    /** Perform a request and decode a JSON response body. */
+    json<T>(method: string, path: string, spec?: RequestSpec): Promise<T>;
+    /**
+     * Perform a call a hitl gate may hold. A 202 answers with the held
+     * intervention; anything else 2xx with the action's own (possibly empty)
+     * body.
+     */
+    gated<T>(method: string, path: string, spec?: RequestSpec): Promise<Gated<T>>;
+    /** Like noContent for a call a hitl gate may hold: it resolves to the held
+     * intervention of a 202, or undefined when the action itself answered. */
+    gatedNoContent(method: string, path: string, spec?: RequestSpec): Promise<Intervention | undefined>;
+    /** Perform a request and return the response body as text. */
+    text(method: string, path: string, spec?: RequestSpec): Promise<string>;
+    private decodeHeld;
+    /** Perform a request that returns no body (e.g. 204 actions). */
+    noContent(method: string, path: string, spec?: RequestSpec): Promise<void>;
+    /**
+     * Open a long-lived stream (SSE). Applies NO timeout — only the caller's
+     * signal cancels it — and checks the status eagerly so connect-time errors
+     * (404/401/...) surface as a FuseApiError before any iteration.
+     */
+    stream(path: string, query: Query | undefined, signal?: AbortSignal): Promise<Response>;
+    private execute;
+    private buildUrl;
+    private buildHeaders;
+    private decodeJson;
+    private withTimeout;
+}
+
+/** Per-call options for calls a takeover can lock or a gate can hold
+ * (computer actions). */
+interface LockedCallOptions extends CallOptions {
+    /** Wait out a takeover or a pending stall, and a gate's hold (the
+     * default). false throws a LockedError or a PendingInterventionError at
+     * once instead. */
+    wait?: boolean;
+    /** Called with the pending intervention when a gate holds the action,
+     * before waiting on it. It overrides the client's onHeld. */
+    onHeld?: (held: Intervention) => void;
+}
+/** Body for environments.takeover. */
+interface TakeoverOptions {
+    /** How to take over: TakeoverVia.Terminal (the default) or
+     * TakeoverVia.Desktop. */
+    via?: string;
+    /** Recorded when no agent request is pending to claim. */
+    reason?: string;
+}
+/** Body for environments.release. */
+interface ReleaseOptions {
+    /** Handed back to the agent as the takeover's answer. */
+    note?: string;
+}
 
 /** Filters (and pagination) for environments.list / environments.listPage. */
 interface ListEnvironmentsOptions {
@@ -662,6 +1139,57 @@ interface EnvironmentPage {
     /** Empty/undefined once there are no more results. */
     nextCursor?: string;
 }
+/** What environments.requestHuman sends. */
+interface HumanRequest {
+    /** The request kind: "ask" (the default), "secret", "takeover" or
+     * "review". */
+    kind?: string;
+    /** What the human is asked (ask). */
+    question?: string;
+    /** Restricts the answer to one of these (ask). */
+    choices?: string[];
+    /** A declared secret target: its env name or file path (secret). */
+    target?: string;
+    /** The agent's text shown under the target's label (secret), or with the
+     * content up for review (review). */
+    message?: string;
+    /** How the human takes over: "terminal" or "desktop" (takeover). */
+    via?: string;
+    /** Why the agent wants a human to take over (takeover). */
+    reason?: string;
+    /** An absolute guest file to review; exclusive with content (review). */
+    path?: string;
+    /** Inline text or a diff to review (review). */
+    content?: string;
+    /** ReviewFormat.Text or ReviewFormat.Diff; unset guesses (review). */
+    format?: string;
+    /** Shortens the policy's deadline. It can never extend it. */
+    timeoutSeconds?: number;
+    /** Wait for a decision (the default). false returns the pending
+     * intervention at once; wait on it later with interventions.wait. */
+    wait?: boolean;
+}
+/** What environments.requestReview sends: exactly one of path and content. */
+interface ReviewRequest {
+    /** An absolute guest file; fuse reads it at request time. */
+    path?: string;
+    /** Inline text or a diff. */
+    content?: string;
+    /** ReviewFormat.Text or ReviewFormat.Diff; unset guesses. */
+    format?: string;
+    message?: string;
+    timeoutSeconds?: number;
+    /** Wait for the verdict (the default). false returns at once with the
+     * pending intervention and approved false. */
+    wait?: boolean;
+}
+/** ReviewResult is a finished review. comments are the reviewer's, on
+ * either outcome. */
+interface ReviewResult {
+    approved: boolean;
+    comments: string;
+    intervention: Intervention;
+}
 /** EnvironmentsService manages microVM lifecycle. */
 declare class EnvironmentsService {
     private readonly t;
@@ -676,13 +1204,18 @@ declare class EnvironmentsService {
     get(vmId: string, opts?: CallOptions): Promise<EnvironmentInfo>;
     /** Provision a new environment. Blocks until running or creation fails. */
     create(body: CreateRequest, opts?: CallOptions): Promise<EnvironmentInfo>;
-    /** Fork an environment into a new one; returns the new environment. */
+    /** Fork an environment into a new one; returns the new environment. When a
+     * hitl gate holds the fork, it waits for the decision and returns the
+     * environment the orchestrator then forked. */
     fork(vmId: string, body?: ForkOptions, opts?: CallOptions): Promise<EnvironmentInfo>;
     /**
      * Migrate an environment to another host; returns the new environment. The
      * source is drained and destroyed once the new one is running.
      */
     migrate(vmId: string, body?: MigrateOptions, opts?: CallOptions): Promise<EnvironmentInfo>;
+    /** heldEnvironment waits out a held fork or migrate and returns the
+     * environment it produced. */
+    private heldEnvironment;
     /**
      * Run a command inside a running environment's guest and return its exit code
      * with stdout and stderr kept separate.
@@ -692,6 +1225,16 @@ declare class EnvironmentsService {
      *
      * Exec requires the master token.
      *
+     * When a hitl gate holds the exec, exec waits for the decision (bounded
+     * only by `opts.signal`); the orchestrator runs the approved (possibly
+     * edited) argv and exec returns its result. A rejection throws an
+     * InterventionRejectedError, a deny gate an error isHitlDenied matches.
+     * `wait: false` throws a PendingInterventionError at once instead.
+     *
+     * While a human holds a takeover (or an ask-mode stall is pending) the
+     * server answers 423; exec waits for that intervention to settle and runs
+     * the command then. `wait: false` throws a LockedError at once instead.
+     *
      * @example
      * const out = await client.environments.exec(id, { cmd: ["ls", "-l"] });
      * if (out.exit_code !== 0) console.error(out.stderr);
@@ -703,13 +1246,20 @@ declare class EnvironmentsService {
      * booted from a desktop image; on any other image the server answers 503
      * with a reason.
      *
+     * Like exec, it waits out a takeover or a pending stall (a 423) and then
+     * acts; `opts.wait: false` throws a LockedError at once instead. When a
+     * computer gate holds the action (a 202), it waits for the decision and
+     * returns what the orchestrator got performing it (with the human's edited
+     * text, if any); a rejection throws an InterventionRejectedError, and
+     * `opts.wait: false` throws a PendingInterventionError at once instead.
+     *
      * @example
      * const res = await client.environments.computer(id, {
      *   action: "left_click",
      *   coordinate: [512, 384],
      * });
      */
-    computer(vmId: string, action: ComputerAction, opts?: CallOptions): Promise<ComputerResult>;
+    computer(vmId: string, action: ComputerAction, opts?: LockedCallOptions): Promise<ComputerResult>;
     /**
      * Execute one computer tool_use against the environment and shape the
      * answer for the Messages API: the tool_use block's `input` goes in
@@ -719,7 +1269,7 @@ declare class EnvironmentsService {
      * An action the environment refuses (a malformed coordinate, a display
      * that is not up) resolves to `is_error` content rather than throwing: the
      * agent loop should feed it to the model, which is the party that can
-     * correct it. A throw is reserved for failures the model cannot fix —
+     * correct it. So does a hitl deny gate or a human rejecting a held action. A throw is reserved for failures the model cannot fix —
      * transport, auth, an unknown environment.
      *
      * @example
@@ -730,20 +1280,66 @@ declare class EnvironmentsService {
      *   }
      * }
      */
-    computerToolResult(vmId: string, input: unknown, opts?: CallOptions): Promise<ComputerToolResult>;
+    computerToolResult(vmId: string, input: unknown, opts?: LockedCallOptions): Promise<ComputerToolResult>;
+    private postComputer;
+    /**
+     * Ask a human for something the environment's hitl policy declares. By
+     * default it waits (by long-polling) until the intervention resolves
+     * (answered, rejected, expired or cancelled); read the result off the
+     * returned intervention's decision. Pass `wait: false` to get the pending
+     * handle instead. Pass `opts.signal` to stop waiting early.
+     *
+     * @example
+     * const res = await client.environments.requestHuman(id, {
+     *   question: "deploy to prod?",
+     *   choices: ["yes", "no"],
+     * });
+     * if (isInterventionApproved(res)) console.log(res.decision?.answer);
+     */
+    requestHuman(vmId: string, req: HumanRequest, opts?: CallOptions): Promise<Intervention>;
+    /**
+     * Submit a guest file or a text/diff blob for a human to approve or reject
+     * with comments, and wait for the verdict. Needs hitl.requests.review.
+     * With `wait: false` it returns at once with the pending intervention and
+     * approved false.
+     *
+     * @example
+     * const r = await client.environments.requestReview(id, {
+     *   content: diff,
+     *   format: ReviewFormat.Diff,
+     * });
+     * if (!r.approved) console.log(r.comments);
+     */
+    requestReview(vmId: string, req: ReviewRequest, opts?: CallOptions): Promise<ReviewResult>;
+    /**
+     * Take over the environment as a human: claims the agent's pending
+     * takeover request if there is one, else opens a new one. While held, the
+     * agent's exec and computer calls wait. Returns the held intervention.
+     * Needs the hitl:takeover scope; a conflict when someone else holds it.
+     */
+    takeover(vmId: string, body?: TakeoverOptions, opts?: CallOptions): Promise<Intervention>;
+    /**
+     * End a takeover and hand the environment back to the agent. The note is
+     * the takeover's answer. Returns the approved intervention; a conflict when
+     * nothing is held.
+     */
+    release(vmId: string, body?: ReleaseOptions, opts?: CallOptions): Promise<Intervention>;
     /** Report whether the environment has a live display and at what geometry.
      * up is false with a reason on an image with no desktop. */
     computerDisplay(vmId: string, opts?: CallOptions): Promise<ComputerDisplay>;
     /**
      * Phase-1 only: quiesces the guest workload and moves the environment to
      * "draining" so you can inspect its output, but does not destroy it. Call
-     * destroy() afterward to remove it - a drained environment left
-     * undestroyed keeps running (and billing) forever.
+     * destroy() afterward to remove it. A drained environment left
+     * undestroyed keeps running (and billing) until the orchestrator's
+     * draining timeout (5m30s by default) passes, and then the orchestrator
+     * destroys it.
      */
     drain(vmId: string, opts?: CallOptions): Promise<EnvironmentInfo>;
     /** Rotate the per-VM credentials and push them to the guest. */
     rotateToken(vmId: string, opts?: CallOptions): Promise<void>;
-    /** Forcefully destroy an environment. Idempotent. */
+    /** Forcefully destroy an environment. Idempotent. When a hitl gate holds
+     * the destroy, it waits for the decision. */
     destroy(vmId: string, opts?: CallOptions): Promise<void>;
     /**
      * Open the SSE event stream for an environment. The returned promise rejects
@@ -801,7 +1397,10 @@ declare class SnapshotsService {
      * be `"disk"` even for a `live: true` request that reached a host too old to
      * honour it. A caller that depends on the memory being there should check
      * it. `live: true` against a backend with no live-snapshot support throws a
-     * 501 `unimplemented`, not a conflict. */
+     * 501 `unimplemented`, not a conflict.
+     *
+     * When a hitl gate holds the snapshot, create waits for the decision and
+     * returns the snapshot the orchestrator then took. */
     create(vmId: string, body?: SnapshotRequest, opts?: CallOptions): Promise<Snapshot>;
     /** List snapshots, optionally filtered. Transparently walks every result
      * page. For explicit single-page control (e.g. a cursor from a previous
@@ -869,6 +1468,19 @@ declare class HostsService {
     private action;
 }
 
+/** Options for apiKeys.create. Naming scopes mints a key limited to the hitl
+ * routes; it must expire (ttlSeconds, at most 86400). */
+interface CreateApiKeyOptions {
+    label?: string;
+    /** One or more of HitlScope. Omit for a full-access key. */
+    scopes?: string[];
+    /** Limit a scoped key to this environment and its forks. */
+    envId?: string;
+    /** Lifetime in seconds. */
+    ttlSeconds?: number;
+    /** Pin the key to this actor. */
+    actor?: ActorLabel;
+}
 /**
  * ApiKeysService manages revocable API keys. These endpoints require the
  * master token; the server enforces this.
@@ -877,16 +1489,121 @@ declare class ApiKeysService {
     private readonly t;
     constructor(t: Transport);
     /**
-     * Issue a new API key. The raw secret is returned once in `key` and is
-     * unrecoverable afterward.
+     * Issue a new API key. Pass a label, or options for a scoped key. The raw
+     * secret is returned once in `key` and is unrecoverable afterward.
      */
-    create(label?: string, opts?: CallOptions): Promise<CreatedAPIKey>;
+    create(labelOrOptions?: string | CreateApiKeyOptions, opts?: CallOptions): Promise<CreatedAPIKey>;
     /** List API key metadata. */
     list(opts?: CallOptions): Promise<APIKey[]>;
     /** Revoke the API key with the given id. */
     revoke(id: string, opts?: CallOptions): Promise<void>;
 }
 
+/** Filters (and pagination) for interventions.list / interventions.listPage. */
+interface ListInterventionsOptions {
+    /** Only interventions raised by this environment. */
+    envId?: string;
+    /** One of InterventionState. */
+    state?: string;
+    /** Only interventions raised or decided by this actor id. */
+    actor?: string;
+    /** Page size. Only consulted by listPage; list() always walks every page. */
+    limit?: number;
+    /** Opaque cursor from a previous listPage() call's nextCursor. */
+    cursor?: string;
+}
+/** One page of interventions.listPage, plus the cursor to fetch the next one. */
+interface InterventionPage {
+    interventions: Intervention[];
+    /** Empty/undefined once there are no more results. */
+    nextCursor?: string;
+}
+/** Filters (and pagination) for interventions.audit / interventions.auditPage. */
+interface AuditOptions {
+    /** Only rows for this environment. */
+    envId?: string;
+    /** Only rows for this actor id. */
+    actor?: string;
+    /** An RFC 3339 time, or a duration like "24h" meaning that long ago. */
+    since?: string;
+    /** Page size. Only consulted by auditPage; audit() always walks every page. */
+    limit?: number;
+    /** Opaque cursor from a previous auditPage() call's nextCursor. */
+    cursor?: string;
+}
+/** One page of interventions.auditPage, plus the cursor to fetch the next one. */
+interface AuditPage {
+    entries: AuditEntry[];
+    /** Empty/undefined once there are no more results. */
+    nextCursor?: string;
+}
+/** Body for interventions.approve: an answer to an ask, or an approval of a
+ * held exec or lifecycle action. */
+interface ApproveOptions {
+    /** An ask needs an answer (one of its choices, when it has any). */
+    answer?: string;
+    reason?: string;
+    /** Replaces a held exec's argv. It is re-checked against the deny gates,
+     * and cannot be combined with grant. */
+    editedArgv?: string[];
+    /** Replaces a held computer "type" action's text. It is re-checked against
+     * the deny gates, and cannot be combined with grant. */
+    editedText?: string;
+    /** "once", "env" or "ttl:<duration>"; unset takes the gate's default. */
+    grant?: string;
+    /** How long approving an expiry keeps the environment alive. Zero or unset
+     * is one more full window of the reaper that was due. */
+    extendSeconds?: number;
+}
+/** Body for interventions.reject. */
+interface RejectOptions {
+    /** Fed back to the agent; the server fills one in when empty. */
+    reason?: string;
+}
+/** InterventionsService reads and decides hitl interventions. */
+declare class InterventionsService {
+    private readonly t;
+    constructor(t: Transport);
+    /** List every intervention matching options, oldest first, walking every
+     * page. */
+    list(options?: ListInterventionsOptions, opts?: CallOptions): Promise<Intervention[]>;
+    /** List one page of interventions matching options. */
+    listPage(options?: ListInterventionsOptions, opts?: CallOptions): Promise<InterventionPage>;
+    /** List every hitl audit row matching options, oldest first, walking every
+     * page. */
+    audit(options?: AuditOptions, opts?: CallOptions): Promise<AuditEntry[]>;
+    /** List one page of the hitl audit log matching options. */
+    auditPage(options?: AuditOptions, opts?: CallOptions): Promise<AuditPage>;
+    /** Fetch a takeover session's recording (an AuditEntry's recording_id):
+     * asciinema v2 cast text for a terminal session, json (an input-action log
+     * plus screenshots) for a desktop one. Needs the hitl:read scope. */
+    getRecording(recordingId: string, opts?: CallOptions): Promise<string>;
+    /** Fetch one intervention without waiting. */
+    get(id: string, opts?: CallOptions): Promise<Intervention>;
+    /**
+     * Block until the intervention settles: resolved, and for an approved gated
+     * action, performed, with the outcome on result. Every intervention has a deadline,
+     * so this always returns eventually. A dropped connection or an
+     * orchestrator restart is survived by polling again; the server, not the
+     * connection, holds the state. Pass `opts.signal` to stop early.
+     */
+    wait(id: string, opts?: CallOptions): Promise<Intervention>;
+    /** Resolve a pending intervention as approved. For a held exec or
+     * lifecycle action, the orchestrator then performs it (optionally with
+     * body.editedArgv, or granting repeats with body.grant); wait on the id for
+     * its result. Requires the master token. */
+    approve(id: string, body?: ApproveOptions, opts?: CallOptions): Promise<Intervention>;
+    /** Resolve a pending intervention as rejected. Requires the master token. */
+    reject(id: string, body?: RejectOptions, opts?: CallOptions): Promise<Intervention>;
+    /**
+     * Answer a pending secret request. The value is written into the guest at
+     * the declared target and dropped; fuse never stores, logs or returns it.
+     * Needs the hitl:secret scope.
+     */
+    answerSecret(id: string, value: string, opts?: CallOptions): Promise<Intervention>;
+    private decide;
+}
+
 /** Options for constructing a FuseClient. */
 interface FuseClientOptions {
     /** Base URL of the Fuse control plane, e.g. "https://fuse.example.com". Required. */
@@ -903,6 +1620,16 @@ interface FuseClientOptions {
     timeoutMs?: number;
     /** Extra default headers merged into every request. */
     headers?: Record<string, string>;
+    /** The human this client acts for, sent as the Fuse-Actor and
+     * Fuse-Actor-Name headers on every request. */
+    actor?: ActorLabel;
+    /** Make every hitl-gated call throw a PendingInterventionError at once
+     * instead of waiting for the human. exec's `wait: false` does the same for
+     * one exec. */
+    hitlNoWait?: boolean;
+    /** Called with the pending intervention whenever a gate holds a call,
+     * before the call waits on it. exec's `onHeld` overrides it. */
+    onHeld?: (held: Intervention) => void;
 }
 /**
  * FuseClient is the entry point for the Fuse API. It groups the resource
@@ -917,10 +1644,17 @@ declare class FuseClient {
     readonly snapshots: SnapshotsService;
     readonly hosts: HostsService;
     readonly apiKeys: ApiKeysService;
+    readonly interventions: InterventionsService;
+    private readonly options;
     constructor(options: FuseClientOptions);
+    /**
+     * withActor returns a copy of this client, with the same options otherwise,
+     * that sends `actor` as the Fuse-Actor headers. This client is unchanged.
+     */
+    withActor(actor: ActorLabel): FuseClient;
 }
 
-declare const VERSION = "0.37.1";
+declare const VERSION = "0.41.0";
 
 /** Stable, machine-readable error codes returned by the server. */
 declare const ErrorCode: {
@@ -930,6 +1664,8 @@ declare const ErrorCode: {
     readonly Unavailable: "unavailable";
     readonly Internal: "internal";
     readonly Unauthorized: "unauthorized";
+    readonly Forbidden: "forbidden";
+    readonly Locked: "locked";
 };
 type ErrorCode = (typeof ErrorCode)[keyof typeof ErrorCode];
 interface FuseApiErrorInit {
@@ -950,12 +1686,74 @@ declare class FuseApiError extends Error {
     readonly body?: string;
     constructor(init: FuseApiErrorInit);
 }
+/** Reasons a forbidden error carries in details.reason. */
+declare const ForbiddenReason: {
+    readonly MissingScope: "missing_scope";
+    readonly EnvScope: "env_scope";
+    readonly SelfApproval: "self_approval";
+    readonly ActorRequired: "actor_required";
+    readonly ActorMismatch: "actor_mismatch";
+    readonly ActorNotAllowed: "actor_not_allowed";
+    readonly MintEscalation: "mint_escalation";
+    /** A hitl deny gate (or the exec allowlist in deny mode) refused the
+     * action. The message is the gate's reason; details.gate names the gate. */
+    readonly HitlDenied: "hitl_denied";
+};
+type ForbiddenReason = (typeof ForbiddenReason)[keyof typeof ForbiddenReason];
+/**
+ * ForbiddenError is a 403 forbidden response: the caller is authenticated
+ * but not allowed. `reason` is one of ForbiddenReason (empty when the server
+ * sent none) and `scope` names the missing scope for missing_scope.
+ */
+declare class ForbiddenError extends FuseApiError {
+    readonly reason: string;
+    readonly scope?: string;
+    constructor(init: FuseApiErrorInit);
+}
+/**
+ * LockedError is a 423 locked response: a human holds the environment (a
+ * takeover) or an ask-mode stall is pending, so agent exec and computer calls
+ * are refused. exec and computer wait it out by default; this surfaces only
+ * when waiting is off. Wait on `interventionId` with interventions.wait.
+ */
+declare class LockedError extends FuseApiError {
+    readonly interventionId: string;
+    /** "takeover" or "stall". */
+    readonly kind: string;
+    constructor(init: FuseApiErrorInit);
+}
+/** isLocked reports whether err is a 423 locked api error. */
+declare function isLocked(err: unknown): err is LockedError;
 /** FuseError is a transport, configuration, or decoding failure (not an API error). */
 declare class FuseError extends Error {
     constructor(message: string, options?: {
         cause?: unknown;
     });
 }
+/**
+ * PendingInterventionError is thrown instead of waiting when a hitl gate held
+ * the call and waiting is off (exec's `wait: false` or the client's
+ * `hitlNoWait`). Wait on `intervention.id` with interventions.wait; the
+ * outcome is on its result.
+ */
+declare class PendingInterventionError extends Error {
+    readonly intervention: Intervention;
+    constructor(intervention: Intervention);
+}
+/**
+ * InterventionRejectedError is a held call a human rejected, or that expired
+ * or was cancelled without approval. `intervention.decision.reason` is for
+ * the agent to read and replan on.
+ */
+declare class InterventionRejectedError extends Error {
+    readonly intervention: Intervention;
+    constructor(intervention: Intervention);
+}
+/** HeldActionError is an approved held action fuse could not perform. */
+declare class HeldActionError extends Error {
+    readonly intervention: Intervention;
+    constructor(intervention: Intervention);
+}
 /** isFuseApiError is a type guard for FuseApiError. */
 declare function isFuseApiError(err: unknown): err is FuseApiError;
 /** isNotFound reports whether err is a not_found api error. */
@@ -964,9 +1762,13 @@ declare function isNotFound(err: unknown): boolean;
 declare function isConflict(err: unknown): boolean;
 /** isUnauthorized reports whether err is an unauthorized api error. */
 declare function isUnauthorized(err: unknown): boolean;
+/** isForbidden reports whether err is a forbidden api error. */
+declare function isForbidden(err: unknown): err is ForbiddenError;
+/** isHitlDenied reports whether err is an action a hitl gate denied. */
+declare function isHitlDenied(err: unknown): err is ForbiddenError;
 /** isInvalidArgument reports whether err is an invalid_argument api error. */
 declare function isInvalidArgument(err: unknown): boolean;
 /** isUnavailable reports whether err is an unavailable api error. */
 declare function isUnavailable(err: unknown): boolean;
 
-export { type APIKey, ApiKeysService, type CallOptions, type ComputerAction, type ComputerDisplay, type ComputerResult, type ComputerToolResult, type CreateRequest, type CreatedAPIKey, type DesktopSpec, type EgressHealth, type EgressSpec, type EgressStatus, type Endpoint, type EnvironmentInfo, EnvironmentsService, ErrorCode, type Event, type ExecRequest, type ExecResult, type ExposeSpec, type FetchLike, type ForkOptions, FuseApiError, type FuseApiErrorInit, FuseClient, type FuseClientOptions, FuseError, type GPUDevice, type Health, HealthState, type HealthcheckHttp, type HealthcheckSpec, type Host, type HostCapacity, HostsService, type ListEnvironmentsOptions, type ListSnapshotsOptions, type MIGInstance, type MigrateOptions, type RegisterHostRequest, type Snapshot, type SnapshotExport, type SnapshotRequest, SnapshotsService, type Spec, State, type ToolResultBlock, type ToolResultImageSource, VERSION, isConflict, isFuseApiError, isInvalidArgument, isNotFound, isTerminalState, isUnauthorized, isUnavailable };
+export { ACTOR_SOURCE_DECIDER, ALLOWLIST_GATE, type APIKey, type Actor, type ActorLabel, ApiKeysService, type ApproveOptions, type AuditEntry, AuditEvent, type AuditOptions, type AuditPage, type CallOptions, type ComputerAction, type ComputerDisplay, type ComputerPayload, type ComputerResult, type ComputerToolResult, type CreateApiKeyOptions, type CreateRequest, type CreatedAPIKey, type DeciderNote, DeciderVerdict, type DesktopSpec, type EgressHealth, type EgressSpec, type EgressStatus, type Endpoint, type EnvironmentInfo, EnvironmentsService, ErrorCode, type Event, type ExecPayload, type ExecRequest, type ExecResult, type ExposeSpec, type FetchLike, ForbiddenError, ForbiddenReason, type ForkOptions, FuseApiError, type FuseApiErrorInit, FuseClient, type FuseClientOptions, FuseError, type GPUDevice, GateMode, type Health, HealthState, type HealthcheckHttp, type HealthcheckSpec, HeldActionError, type HitlAskRequests, type HitlDecider, type HitlExecPolicy, type HitlGate, type HitlGateMatch, HitlKind, type HitlRequests, type HitlReviewRequests, HitlScope, type HitlSecretRequests, type HitlSecretTarget, type HitlSpec, type HitlTakeoverRequests, type HitlWebhook, type Host, type HostCapacity, HostsService, type HumanRequest, type Intervention, type InterventionDecision, InterventionOutcome, type InterventionPage, type InterventionPayload, InterventionRejectedError, type InterventionResult, type InterventionReview, type InterventionSecret, type InterventionSignal, InterventionState, type InterventionTakeover, InterventionsService, LifecycleAction, type LifecyclePayload, type ListEnvironmentsOptions, type ListInterventionsOptions, type ListSnapshotsOptions, type LockedCallOptions, LockedError, type MIGInstance, type MigrateOptions, PendingInterventionError, type RegisterHostRequest, type RejectOptions, type ReleaseOptions, ReviewFormat, type ReviewRequest, type ReviewResult, type Snapshot, type SnapshotExport, type SnapshotRequest, SnapshotsService, type Spec, State, type TakeoverOptions, TakeoverVia, type ToolResultBlock, type ToolResultImageSource, VERSION, isConflict, isForbidden, isFuseApiError, isHitlDenied, isInterventionApproved, isInterventionSettled, isInterventionTerminal, isInvalidArgument, isLocked, isNotFound, isTerminalState, isUnauthorized, isUnavailable };