@fungi.computer/oyster 0.2.0 → 0.3.0

package/dist/boot-capability.js

@@ -0,0 +1,141 @@
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { parseArtifactRef, parseReleaseId, parseSha256Digest, } from "@fungi.computer/puffball";
+import { BOOT_DEADLINE_MS, BOOT_TRANSPORT_GRACE_MS, BootGateError, bootMountDiagnosticsSchema, } from "./boot-gate.js";
+import { defaultAssetPolicy } from "./release.js";
+export const BOOT_CAPABILITY_HEADER = "x-oyster-boot-capability";
+const bootCapabilityAssetSchema = z.strictObject({
+    path: z.string().min(1).max(4096),
+    contentType: z.string().min(1).max(256),
+    artifactRef: z.string().min(1).max(512).transform(parseArtifactRef),
+    digest: z.string().min(1).max(80).transform(parseSha256Digest),
+    byteLength: z
+        .number()
+        .int()
+        .nonnegative()
+        .max(defaultAssetPolicy.maxObjectBytes),
+});
+export const bootCapabilityLeaseSchema = z.strictObject({
+    id: z.string().min(1).max(128),
+    identity: z.strictObject({
+        appId: z.string().min(1).max(256),
+        releaseId: z.string().transform(parseReleaseId),
+        surfaceId: z.literal("host-boot"),
+    }),
+    base: z.string().min(1).max(2048),
+    expiresAt: z.number().int().positive(),
+    assets: z.array(bootCapabilityAssetSchema).max(defaultAssetPolicy.maxObjects),
+});
+export const bootCapabilityGrantSchema = z.strictObject({
+    lease: bootCapabilityLeaseSchema,
+    tokenDigest: z.string().regex(/^[0-9a-f]{64}$/),
+});
+/** Build metadata retained by the lease must exactly match the verified boot UI. */
+export function capabilityAssets(assets, byteLengths) {
+    if (assets.length !== byteLengths.length)
+        throw new Error("Boot capability asset metadata is incomplete");
+    return assets.map((asset, index) => {
+        const byteLength = byteLengths[index];
+        if (byteLength === undefined)
+            throw new Error("Boot capability asset metadata is incomplete");
+        return { ...asset, byteLength };
+    });
+}
+export function validateCapabilityAssetSet(lease) {
+    const total = lease.assets.reduce((sum, asset) => sum + asset.byteLength, 0);
+    if (total > defaultAssetPolicy.maxTotalBytes ||
+        new Set(lease.assets.map((asset) => asset.path)).size !==
+            lease.assets.length)
+        throw new Error("Boot capability asset set is invalid");
+}
+const bootCapabilityIds = defineIdFamily({
+    family: "oyster-boot-capability",
+    version: 1,
+    kinds: { lease: { prefix: "bcap" } },
+});
+/**
+ * Mint one boot capability for every host: a fresh 256-bit token for the
+ * caller's request header, only its SHA-256 digest in the store, and a lease
+ * whose asset sizes come from the bucket's own metadata. An asset the bucket
+ * does not hold, or one beyond the asset policy, refuses before anything is
+ * stored.
+ */
+export async function issueBootCapability(input) {
+    const byteLengths = [];
+    let totalBytes = 0;
+    for (const asset of input.ui.assets) {
+        const head = await input.bucket.head(asset.artifactRef);
+        if (head === null || head.size > defaultAssetPolicy.maxObjectBytes)
+            throw new BootGateError("ui_mount_failed");
+        totalBytes += head.size;
+        if (totalBytes > defaultAssetPolicy.maxTotalBytes)
+            throw new BootGateError("ui_mount_failed");
+        byteLengths.push(head.size);
+    }
+    const lease = {
+        id: bootCapabilityIds.lease.generate(),
+        identity: input.ui.identity,
+        base: input.ui.base,
+        expiresAt: input.expiresAt,
+        assets: capabilityAssets(input.ui.assets, byteLengths),
+    };
+    validateCapabilityAssetSet(lease);
+    const token = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32))))
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/u, "");
+    const tokenDigest = createHash("sha256").update(token, "utf8").digest("hex");
+    await input.capabilities.issue({ lease, tokenDigest });
+    return { token, leaseId: lease.id };
+}
+/**
+ * One UI page check for a Release, for every host, reading no UI bytes:
+ * issue a capability, open the pinned boot page, revoke the capability, and
+ * report in the boot gate's vocabulary. A page that did not mount fails,
+ * with diagnostics sanitized by the gate's schema; a timeout, unconfirmed
+ * cleanup, an unavailable runner, or no browser or origin is not checked.
+ */
+export async function reportBootPage(input) {
+    const ui = await input.readUi();
+    if (ui === null)
+        return { kind: "passed" };
+    if (input.check === null || input.origin === null)
+        return { kind: "not_checked", code: "boot_browser_binding_missing" };
+    const deadlineAt = input.now() + BOOT_DEADLINE_MS;
+    let issued;
+    try {
+        issued = await issueBootCapability({
+            ui,
+            bucket: input.bucket,
+            capabilities: input.capabilities,
+            expiresAt: deadlineAt + BOOT_TRANSPORT_GRACE_MS,
+        });
+    }
+    catch (cause) {
+        if (cause instanceof BootGateError && cause.code === "ui_mount_failed")
+            return { kind: "failed", code: "ui_mount_failed" };
+        throw cause;
+    }
+    let result;
+    try {
+        result = await input.check({
+            origin: input.origin,
+            releaseId: ui.identity.releaseId,
+            capability: { header: BOOT_CAPABILITY_HEADER, token: issued.token },
+            deadlineAt,
+        });
+    }
+    finally {
+        await input.capabilities.revoke(issued.leaseId);
+    }
+    if (result.kind === "mounted")
+        return { kind: "passed" };
+    if (result.code === "ui_mount_failed")
+        return {
+            kind: "failed",
+            code: "ui_mount_failed",
+            diagnostics: bootMountDiagnosticsSchema.parse(result.diagnostics),
+        };
+    return { kind: "not_checked", code: result.code };
+}

package/dist/boot-construction.d.ts

@@ -0,0 +1,12 @@
+import type { Backend, Instance } from "./index.js";
+import type { AppInstanceContext, AppInstanceLoader } from "./cloudflare.js";
+import type { GuestLimits } from "./guest-policy.js";
+/** One bounded disposable sibling; it can never become the live App facet. */
+export declare const BACKEND_CONSTRUCTION_FACET = "candidate";
+/**
+ * The Instance owns the disposable facet and supplies its already-read prior
+ * state schema. Only initialized App storage is copied; supervisor state and
+ * authority are never copied. A unique Loader ID isolates candidate globals.
+ * No invocation frame or guestEnv factory is accepted.
+ */
+export declare function checkBackendConstruction<FacetClass>(ctx: Pick<AppInstanceContext<FacetClass>, "facets">, loader: AppInstanceLoader<FacetClass> | undefined, artifact: Backend, limits: GuestLimits, priorStateSchema: Instance["stateSchema"]): Promise<void>;

package/dist/boot-construction.js

@@ -0,0 +1,175 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import { rpcHandleSchema, rpcMethod } from "@fungi.computer/agar/rpc";
+import { z } from "zod";
+import * as Result from "effect/Result";
+import { correlationKey } from "@fungi.computer/cairn";
+import { BOOT_DEADLINE_MS, BootGateError } from "./boot-gate.js";
+const probeSchema = rpcHandleSchema({
+    construct: rpcMethod(z.undefined()).input(z.tuple([])),
+});
+/** One bounded disposable sibling; it can never become the live App facet. */
+export const BACKEND_CONSTRUCTION_FACET = "candidate";
+/**
+ * The Instance owns the disposable facet and supplies its already-read prior
+ * state schema. Only initialized App storage is copied; supervisor state and
+ * authority are never copied. A unique Loader ID isolates candidate globals.
+ * No invocation frame or guestEnv factory is accepted.
+ */
+export async function checkBackendConstruction(ctx, loader, artifact, limits, priorStateSchema) {
+    if (loader === undefined)
+        throw new BootGateError("boot_runner_unavailable");
+    const name = BACKEND_CONSTRUCTION_FACET;
+    const loaderId = `boot:${correlationKey()}`;
+    let stage = "backend_load_failed";
+    let timeout;
+    const result = await (async () => {
+        try {
+            const env_1 = { stack: [], error: void 0, hasError: false };
+            try {
+                const deadline = new Promise((_, reject) => {
+                    timeout = setTimeout(() => {
+                        reject(new BootGateError("boot_timeout"));
+                    }, BOOT_DEADLINE_MS);
+                });
+                if (priorStateSchema !== null) {
+                    if (ctx.facets.clone === undefined)
+                        throw new BootGateError("boot_clone_unavailable");
+                    ctx.facets.clone("app", name);
+                }
+                else {
+                    // A crash may have left the bounded sibling behind. Fresh means empty,
+                    // not a retry against storage written by an earlier constructor.
+                    ctx.facets.delete(name);
+                }
+                const stub = __addDisposableResource(env_1, probeSchema.parse(ctx.facets.get(name, () => ({
+                    class: loader
+                        .get(loaderId, () => ({
+                        compatibilityDate: artifact.backend.compatibilityDate,
+                        mainModule: "boot.js",
+                        modules: {
+                            "backend.js": artifact.backend.code,
+                            "boot.js": constructionModule(artifact.backend.exportName),
+                        },
+                        env: {},
+                        globalOutbound: null,
+                        limits,
+                    }))
+                        .getDurableObjectClass("BootConstruction"),
+                }))), false);
+                stage = "backend_construction_failed";
+                await Promise.race([stub.construct(), deadline]);
+                return Result.succeed(undefined);
+            }
+            catch (e_1) {
+                env_1.error = e_1;
+                env_1.hasError = true;
+            }
+            finally {
+                __disposeResources(env_1);
+            }
+        }
+        catch (cause) {
+            return Result.fail(cause instanceof BootGateError
+                ? cause
+                : new BootGateError(stage, { cause }));
+        }
+        finally {
+            if (timeout !== undefined)
+                clearTimeout(timeout);
+        }
+    })();
+    // Cleanup uncertainty takes precedence over the captured probe result.
+    try {
+        try {
+            ctx.facets.abort(name, new Error("Candidate boot ended"));
+        }
+        finally {
+            ctx.facets.delete(name);
+        }
+    }
+    catch (cause) {
+        throw new BootGateError("boot_cleanup_failed", { cause });
+    }
+    if (Result.isFailure(result))
+        throw result.failure;
+}
+function constructionModule(exportName) {
+    return `import { DurableObject } from "cloudflare:workers";
+// Capture trusted operations BEFORE evaluating any candidate module.
+const construct = Reflect.construct;
+const freeze = Object.freeze;
+// These are host test bindings, not invocation loopbacks. They deny all
+// external operations. SQLite is the disposable facet's fresh or copied storage.
+const unavailable = () => { throw new Error("Host test binding unavailable"); };
+const env = freeze({
+  APP_STORAGE: freeze({
+    read: unavailable, write: unavailable, reset: unavailable
+  })
+});
+export class BootConstruction extends DurableObject {
+  constructor(ctx, bindings) {
+    super(ctx, bindings);
+    ctx.blockConcurrencyWhile(async () => {
+      const backend = await import("./backend.js");
+      construct(backend[${JSON.stringify(exportName)}], [ctx, env]);
+    });
+  }
+  // Native constructor blocking must finish before RPC dispatch. No App-mutated
+  // Promise methods or candidate-supplied completion value decide readiness.
+  construct() {}
+}
+// A candidate can import this module, but cannot patch the host check.
+freeze(BootConstruction.prototype);
+freeze(BootConstruction);`;
+}

package/dist/boot-gate.d.ts

@@ -0,0 +1,267 @@
+import { z } from "zod";
+import { type Release } from "@fungi.computer/puffball";
+import { type ArtifactStore } from "./release.js";
+/** Only the host can produce these outcomes; they are not an App build input. */
+export declare const bootFailureSchema: z.ZodEnum<{
+    backend_load_failed: "backend_load_failed";
+    backend_construction_failed: "backend_construction_failed";
+    ui_mount_failed: "ui_mount_failed";
+    boot_runner_unavailable: "boot_runner_unavailable";
+    boot_browser_binding_missing: "boot_browser_binding_missing";
+    boot_clone_unavailable: "boot_clone_unavailable";
+    boot_timeout: "boot_timeout";
+    boot_cleanup_failed: "boot_cleanup_failed";
+}>;
+export type BootFailure = z.output<typeof bootFailureSchema>;
+export declare const BOOT_MOUNT_DIAGNOSTIC_LIMITS: Readonly<{
+    maxEntriesPerKind: 20;
+    maxEntriesTotal: 48;
+    maxTextChars: 300;
+    maxPathChars: 2048;
+    maxDroppedCount: 1024;
+}>;
+export declare const bootMountFailurePredicateSchema: z.ZodEnum<{
+    unexpected_candidate_request: "unexpected_candidate_request";
+    response_status: "response_status";
+    request_failed: "request_failed";
+    page_error: "page_error";
+    candidate_not_mounted: "candidate_not_mounted";
+}>;
+export type BootMountFailurePredicate = z.output<typeof bootMountFailurePredicateSchema>;
+/** Closed, safe names for exceptions used in host-side mount diagnostics. */
+export declare const bootMountDiagnosticErrorNameSchema: z.ZodEnum<{
+    TypeError: "TypeError";
+    RangeError: "RangeError";
+    SyntaxError: "SyntaxError";
+    AbortError: "AbortError";
+    TimeoutError: "TimeoutError";
+    Other: "Other";
+    Error: "Error";
+}>;
+export type BootMountDiagnosticErrorName = z.output<typeof bootMountDiagnosticErrorNameSchema>;
+declare const bootMountRequestFailureKindSchema: z.ZodEnum<{
+    unexpected_candidate_request: "unexpected_candidate_request";
+    response_status: "response_status";
+    request_failed: "request_failed";
+}>;
+export type BootMountRequestFailureKind = z.output<typeof bootMountRequestFailureKindSchema>;
+/** Bounded, URL-redacted observations from one failed candidate mount. */
+export declare const bootMountDiagnosticsSchema: z.ZodObject<{
+    failedPredicate: z.ZodEnum<{
+        unexpected_candidate_request: "unexpected_candidate_request";
+        response_status: "response_status";
+        request_failed: "request_failed";
+        page_error: "page_error";
+        candidate_not_mounted: "candidate_not_mounted";
+    }>;
+    errorName: z.ZodOptional<z.ZodEnum<{
+        TypeError: "TypeError";
+        RangeError: "RangeError";
+        SyntaxError: "SyntaxError";
+        AbortError: "AbortError";
+        TimeoutError: "TimeoutError";
+        Other: "Other";
+        Error: "Error";
+    }>>;
+    finalUrlPath: z.ZodString;
+    consoleErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+    pageErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+    failedRequests: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        status: z.ZodOptional<z.ZodNumber>;
+        failureKind: z.ZodOptional<z.ZodEnum<{
+            unexpected_candidate_request: "unexpected_candidate_request";
+            response_status: "response_status";
+            request_failed: "request_failed";
+        }>>;
+    }, z.core.$strict>>;
+    droppedCount: z.ZodNumber;
+}, z.core.$strict>;
+export type BootMountDiagnostics = z.output<typeof bootMountDiagnosticsSchema>;
+/** Safe host-authored reason; never reflects guest logs, exceptions or credentials. */
+export declare class BootGateError extends Error {
+    readonly code: BootFailure;
+    readonly name = "BootGateError";
+    readonly diagnostics?: BootMountDiagnostics;
+    constructor(code: BootFailure, options?: ErrorOptions & {
+        diagnostics?: BootMountDiagnostics;
+    });
+}
+/** A finite host policy, not a candidate-configurable health check. */
+export declare const BOOT_DEADLINE_MS = 10000;
+/** The original outer-request allowance, reserved for transport and cleanup. */
+export declare const BOOT_TRANSPORT_GRACE_MS = 2000;
+/** Immutable artifact references only; bytes use the private native data plane. */
+export declare const bootUiSchema: z.ZodObject<{
+    identity: z.ZodObject<{
+        appId: z.ZodString;
+        releaseId: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").ReleaseId, string>>;
+        surfaceId: z.ZodLiteral<"host-boot">;
+    }, z.core.$strict>;
+    base: z.ZodString;
+    assets: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        contentType: z.ZodString;
+        artifactRef: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").ArtifactRef, string>>;
+        digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").Sha256Digest, string>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type BootUi = z.output<typeof bootUiSchema>;
+/** Captures the same no-grant UI representation as a private candidate preview. */
+export declare function readBootUi(store: ArtifactStore, release: Release): Promise<BootUi | null>;
+export declare const bootCheckResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"passed">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"not_checked">;
+    code: z.ZodEnum<{
+        boot_runner_unavailable: "boot_runner_unavailable";
+        boot_browser_binding_missing: "boot_browser_binding_missing";
+        boot_clone_unavailable: "boot_clone_unavailable";
+        boot_timeout: "boot_timeout";
+        boot_cleanup_failed: "boot_cleanup_failed";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"refused">;
+    code: z.ZodEnum<{
+        backend_load_failed: "backend_load_failed";
+        backend_construction_failed: "backend_construction_failed";
+        ui_mount_failed: "ui_mount_failed";
+        boot_runner_unavailable: "boot_runner_unavailable";
+        boot_browser_binding_missing: "boot_browser_binding_missing";
+        boot_clone_unavailable: "boot_clone_unavailable";
+        boot_timeout: "boot_timeout";
+        boot_cleanup_failed: "boot_cleanup_failed";
+    }>;
+    diagnostics: z.ZodOptional<z.ZodObject<{
+        failedPredicate: z.ZodEnum<{
+            unexpected_candidate_request: "unexpected_candidate_request";
+            response_status: "response_status";
+            request_failed: "request_failed";
+            page_error: "page_error";
+            candidate_not_mounted: "candidate_not_mounted";
+        }>;
+        errorName: z.ZodOptional<z.ZodEnum<{
+            TypeError: "TypeError";
+            RangeError: "RangeError";
+            SyntaxError: "SyntaxError";
+            AbortError: "AbortError";
+            TimeoutError: "TimeoutError";
+            Other: "Other";
+            Error: "Error";
+        }>>;
+        finalUrlPath: z.ZodString;
+        consoleErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        pageErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        failedRequests: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            status: z.ZodOptional<z.ZodNumber>;
+            failureKind: z.ZodOptional<z.ZodEnum<{
+                unexpected_candidate_request: "unexpected_candidate_request";
+                response_status: "response_status";
+                request_failed: "request_failed";
+            }>>;
+        }, z.core.$strict>>;
+        droppedCount: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "kind">;
+export type BootCheckResult = z.output<typeof bootCheckResultSchema>;
+/** A UI check recorded on an installation operation, never installation authority. */
+export declare const uiBootCheckOutcomeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"passed">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"failed">;
+    code: z.ZodLiteral<"ui_mount_failed">;
+    diagnostics: z.ZodOptional<z.ZodObject<{
+        failedPredicate: z.ZodEnum<{
+            unexpected_candidate_request: "unexpected_candidate_request";
+            response_status: "response_status";
+            request_failed: "request_failed";
+            page_error: "page_error";
+            candidate_not_mounted: "candidate_not_mounted";
+        }>;
+        errorName: z.ZodOptional<z.ZodEnum<{
+            TypeError: "TypeError";
+            RangeError: "RangeError";
+            SyntaxError: "SyntaxError";
+            AbortError: "AbortError";
+            TimeoutError: "TimeoutError";
+            Other: "Other";
+            Error: "Error";
+        }>>;
+        finalUrlPath: z.ZodString;
+        consoleErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        pageErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        failedRequests: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            status: z.ZodOptional<z.ZodNumber>;
+            failureKind: z.ZodOptional<z.ZodEnum<{
+                unexpected_candidate_request: "unexpected_candidate_request";
+                response_status: "response_status";
+                request_failed: "request_failed";
+            }>>;
+        }, z.core.$strict>>;
+        droppedCount: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"not_checked">;
+    code: z.ZodEnum<{
+        boot_runner_unavailable: "boot_runner_unavailable";
+        boot_browser_binding_missing: "boot_browser_binding_missing";
+        boot_clone_unavailable: "boot_clone_unavailable";
+        boot_timeout: "boot_timeout";
+        boot_cleanup_failed: "boot_cleanup_failed";
+        ui_check_not_run_on_host: "ui_check_not_run_on_host";
+    }>;
+}, z.core.$strict>], "kind">;
+/**
+ * A UI check result recorded on an installation operation, never installation authority.
+ *
+ * @inline
+ */
+export type UiBootCheckOutcome = z.output<typeof uiBootCheckOutcomeSchema>;
+/** Owner-facing 422 body; diagnostics are never copied into other failures. */
+export declare const bootRefusalSchema: z.ZodObject<{
+    error: z.ZodEnum<{
+        backend_load_failed: "backend_load_failed";
+        backend_construction_failed: "backend_construction_failed";
+        ui_mount_failed: "ui_mount_failed";
+        boot_runner_unavailable: "boot_runner_unavailable";
+        boot_browser_binding_missing: "boot_browser_binding_missing";
+        boot_clone_unavailable: "boot_clone_unavailable";
+        boot_timeout: "boot_timeout";
+        boot_cleanup_failed: "boot_cleanup_failed";
+    }>;
+    message: z.ZodString;
+    diagnostics: z.ZodOptional<z.ZodObject<{
+        failedPredicate: z.ZodEnum<{
+            unexpected_candidate_request: "unexpected_candidate_request";
+            response_status: "response_status";
+            request_failed: "request_failed";
+            page_error: "page_error";
+            candidate_not_mounted: "candidate_not_mounted";
+        }>;
+        errorName: z.ZodOptional<z.ZodEnum<{
+            TypeError: "TypeError";
+            RangeError: "RangeError";
+            SyntaxError: "SyntaxError";
+            AbortError: "AbortError";
+            TimeoutError: "TimeoutError";
+            Other: "Other";
+            Error: "Error";
+        }>>;
+        finalUrlPath: z.ZodString;
+        consoleErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        pageErrors: z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        failedRequests: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            status: z.ZodOptional<z.ZodNumber>;
+            failureKind: z.ZodOptional<z.ZodEnum<{
+                unexpected_candidate_request: "unexpected_candidate_request";
+                response_status: "response_status";
+                request_failed: "request_failed";
+            }>>;
+        }, z.core.$strict>>;
+        droppedCount: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export {};