@gajae-code/coding-agent 0.17.4 → 0.17.6

package/dist/types/sdk/broker/managed-task-dag.d.ts

@@ -0,0 +1,1335 @@
+import { z } from "zod";
+export declare const ManagedPathResourceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"path">;
+    path: z.ZodString;
+    mode: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
+    recursive: z.ZodBoolean;
+    namespace: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const ManagedNamedResourceSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        database: "database";
+        integration: "integration";
+    }>;
+    identity: z.ZodString;
+    mode: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
+}, z.core.$strict>;
+export declare const ManagedPortResourceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"port">;
+    protocol: z.ZodEnum<{
+        tcp: "tcp";
+        udp: "udp";
+    }>;
+    address: z.ZodEnum<{
+        "*": "*";
+        "0.0.0.0": "0.0.0.0";
+        "127.0.0.1": "127.0.0.1";
+        "::": "::";
+        "::1": "::1";
+    }>;
+    port: z.ZodNumber;
+    mode: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
+}, z.core.$strict>;
+export declare const ManagedResourceSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"path">;
+    path: z.ZodString;
+    mode: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
+    recursive: z.ZodBoolean;
+    namespace: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodEnum<{
+        database: "database";
+        integration: "integration";
+    }>;
+    identity: z.ZodString;
+    mode: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"port">;
+    protocol: z.ZodEnum<{
+        tcp: "tcp";
+        udp: "udp";
+    }>;
+    address: z.ZodEnum<{
+        "*": "*";
+        "0.0.0.0": "0.0.0.0";
+        "127.0.0.1": "127.0.0.1";
+        "::": "::";
+        "::1": "::1";
+    }>;
+    port: z.ZodNumber;
+    mode: z.ZodEnum<{
+        read: "read";
+        write: "write";
+    }>;
+}, z.core.$strict>]>;
+export type ManagedResource = z.infer<typeof ManagedResourceSchema>;
+export declare const ManagedArtifactSchema: z.ZodObject<{
+    path: z.ZodString;
+    role: z.ZodEnum<{
+        input: "input";
+        output: "output";
+        "read-write": "read-write";
+        "validation-output": "validation-output";
+    }>;
+    presence: z.ZodEnum<{
+        absent: "absent";
+        optional: "optional";
+        required: "required";
+    }>;
+}, z.core.$strict>;
+export type ManagedArtifact = z.infer<typeof ManagedArtifactSchema>;
+export declare const ManagedTaskDefinitionSchema: z.ZodObject<{
+    id: z.ZodString;
+    task: z.ZodString;
+    workspace: z.ZodString;
+    predecessors: z.ZodArray<z.ZodString>;
+    criteriaIdentity: z.ZodString;
+    validations: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodString;
+    }, z.core.$strict>>;
+    resources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"path">;
+        path: z.ZodString;
+        mode: z.ZodEnum<{
+            read: "read";
+            write: "write";
+        }>;
+        recursive: z.ZodBoolean;
+        namespace: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodEnum<{
+            database: "database";
+            integration: "integration";
+        }>;
+        identity: z.ZodString;
+        mode: z.ZodEnum<{
+            read: "read";
+            write: "write";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"port">;
+        protocol: z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+        }>;
+        address: z.ZodEnum<{
+            "*": "*";
+            "0.0.0.0": "0.0.0.0";
+            "127.0.0.1": "127.0.0.1";
+            "::": "::";
+            "::1": "::1";
+        }>;
+        port: z.ZodNumber;
+        mode: z.ZodEnum<{
+            read: "read";
+            write: "write";
+        }>;
+    }, z.core.$strict>]>>;
+    artifacts: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        role: z.ZodEnum<{
+            input: "input";
+            output: "output";
+            "read-write": "read-write";
+            "validation-output": "validation-output";
+        }>;
+        presence: z.ZodEnum<{
+            absent: "absent";
+            optional: "optional";
+            required: "required";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ManagedTaskDefinition = z.infer<typeof ManagedTaskDefinitionSchema>;
+export declare const ManagedDefinitionRecordSchema: z.ZodObject<{
+    revision: z.ZodNumber;
+    hash: z.ZodString;
+    definition: z.ZodObject<{
+        id: z.ZodString;
+        task: z.ZodString;
+        workspace: z.ZodString;
+        predecessors: z.ZodArray<z.ZodString>;
+        criteriaIdentity: z.ZodString;
+        validations: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            command: z.ZodString;
+        }, z.core.$strict>>;
+        resources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"path">;
+            path: z.ZodString;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+            recursive: z.ZodBoolean;
+            namespace: z.ZodBoolean;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodEnum<{
+                database: "database";
+                integration: "integration";
+            }>;
+            identity: z.ZodString;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"port">;
+            protocol: z.ZodEnum<{
+                tcp: "tcp";
+                udp: "udp";
+            }>;
+            address: z.ZodEnum<{
+                "*": "*";
+                "0.0.0.0": "0.0.0.0";
+                "127.0.0.1": "127.0.0.1";
+                "::": "::";
+                "::1": "::1";
+            }>;
+            port: z.ZodNumber;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+        }, z.core.$strict>]>>;
+        artifacts: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            role: z.ZodEnum<{
+                input: "input";
+                output: "output";
+                "read-write": "read-write";
+                "validation-output": "validation-output";
+            }>;
+            presence: z.ZodEnum<{
+                absent: "absent";
+                optional: "optional";
+                required: "required";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ManagedDefinitionRecord = z.infer<typeof ManagedDefinitionRecordSchema>;
+export declare const ManagedManifestEntrySchema: z.ZodObject<{
+    path: z.ZodString;
+    object: z.ZodNullable<z.ZodString>;
+    kind: z.ZodEnum<{
+        absent: "absent";
+        directory: "directory";
+        file: "file";
+    }>;
+    hash: z.ZodNullable<z.ZodString>;
+    mode: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;
+export type ManagedManifestEntry = z.infer<typeof ManagedManifestEntrySchema>;
+export type ManagedManifest = ManagedManifestEntry[];
+export declare const ManagedPredecessorSchema: z.ZodObject<{
+    nodeId: z.ZodString;
+    taskRevision: z.ZodNumber;
+    attemptId: z.ZodString;
+    verificationId: z.ZodString;
+    verificationHash: z.ZodString;
+    produced: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        object: z.ZodNullable<z.ZodString>;
+        kind: z.ZodEnum<{
+            absent: "absent";
+            directory: "directory";
+            file: "file";
+        }>;
+        hash: z.ZodNullable<z.ZodString>;
+        mode: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ManagedPredecessor = z.infer<typeof ManagedPredecessorSchema>;
+export declare const ManagedCanonicalResourceSchema: z.ZodObject<{
+    declaration: z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"path">;
+        path: z.ZodString;
+        mode: z.ZodEnum<{
+            read: "read";
+            write: "write";
+        }>;
+        recursive: z.ZodBoolean;
+        namespace: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodEnum<{
+            database: "database";
+            integration: "integration";
+        }>;
+        identity: z.ZodString;
+        mode: z.ZodEnum<{
+            read: "read";
+            write: "write";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"port">;
+        protocol: z.ZodEnum<{
+            tcp: "tcp";
+            udp: "udp";
+        }>;
+        address: z.ZodEnum<{
+            "*": "*";
+            "0.0.0.0": "0.0.0.0";
+            "127.0.0.1": "127.0.0.1";
+            "::": "::";
+            "::1": "::1";
+        }>;
+        port: z.ZodNumber;
+        mode: z.ZodEnum<{
+            read: "read";
+            write: "write";
+        }>;
+    }, z.core.$strict>]>;
+    path: z.ZodNullable<z.ZodString>;
+    object: z.ZodNullable<z.ZodString>;
+    ancestor: z.ZodNullable<z.ZodString>;
+    suffix: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ManagedCanonicalResource = z.infer<typeof ManagedCanonicalResourceSchema>;
+export declare const ManagedNativeIdentitySchema: z.ZodObject<{
+    key: z.ZodString;
+    identity: z.ZodString;
+    requestHash: z.ZodString;
+}, z.core.$strict>;
+export type ManagedNativeIdentity = z.infer<typeof ManagedNativeIdentitySchema>;
+export declare const ManagedVerificationObservationSchema: z.ZodObject<{
+    name: z.ZodString;
+    command: z.ZodString;
+    cwd: z.ZodString;
+    exitStatus: z.ZodNumber;
+    pass: z.ZodBoolean;
+}, z.core.$strict>;
+export type ManagedVerificationObservation = z.infer<typeof ManagedVerificationObservationSchema>;
+export declare const ManagedVerificationReceiptSchema: z.ZodObject<{
+    id: z.ZodString;
+    hash: z.ZodString;
+    envelope: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+export type ManagedVerificationReceipt = z.infer<typeof ManagedVerificationReceiptSchema>;
+export declare const ManagedVerificationExecutionSchema: z.ZodObject<{
+    executionId: z.ZodString;
+    workspace: z.ZodString;
+    commands: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodString;
+    }, z.core.$strict>>;
+    observations: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        command: z.ZodString;
+        cwd: z.ZodString;
+        exitStatus: z.ZodNumber;
+        pass: z.ZodBoolean;
+    }, z.core.$strict>>;
+    receipts: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        hash: z.ZodString;
+        envelope: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ManagedVerificationExecution = z.infer<typeof ManagedVerificationExecutionSchema>;
+export declare const ManagedTaskAttemptSchema: z.ZodObject<{
+    id: z.ZodString;
+    nodeId: z.ZodString;
+    taskRevision: z.ZodNumber;
+    graphRevision: z.ZodNumber;
+    definitionHash: z.ZodString;
+    definition: z.ZodObject<{
+        id: z.ZodString;
+        task: z.ZodString;
+        workspace: z.ZodString;
+        predecessors: z.ZodArray<z.ZodString>;
+        criteriaIdentity: z.ZodString;
+        validations: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            command: z.ZodString;
+        }, z.core.$strict>>;
+        resources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"path">;
+            path: z.ZodString;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+            recursive: z.ZodBoolean;
+            namespace: z.ZodBoolean;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodEnum<{
+                database: "database";
+                integration: "integration";
+            }>;
+            identity: z.ZodString;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"port">;
+            protocol: z.ZodEnum<{
+                tcp: "tcp";
+                udp: "udp";
+            }>;
+            address: z.ZodEnum<{
+                "*": "*";
+                "0.0.0.0": "0.0.0.0";
+                "127.0.0.1": "127.0.0.1";
+                "::": "::";
+                "::1": "::1";
+            }>;
+            port: z.ZodNumber;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+        }, z.core.$strict>]>>;
+        artifacts: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            role: z.ZodEnum<{
+                input: "input";
+                output: "output";
+                "read-write": "read-write";
+                "validation-output": "validation-output";
+            }>;
+            presence: z.ZodEnum<{
+                absent: "absent";
+                optional: "optional";
+                required: "required";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    native: z.ZodObject<{
+        key: z.ZodString;
+        identity: z.ZodString;
+        requestHash: z.ZodString;
+    }, z.core.$strict>;
+    inputs: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        object: z.ZodNullable<z.ZodString>;
+        kind: z.ZodEnum<{
+            absent: "absent";
+            directory: "directory";
+            file: "file";
+        }>;
+        hash: z.ZodNullable<z.ZodString>;
+        mode: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>;
+    predecessors: z.ZodArray<z.ZodObject<{
+        nodeId: z.ZodString;
+        taskRevision: z.ZodNumber;
+        attemptId: z.ZodString;
+        verificationId: z.ZodString;
+        verificationHash: z.ZodString;
+        produced: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            object: z.ZodNullable<z.ZodString>;
+            kind: z.ZodEnum<{
+                absent: "absent";
+                directory: "directory";
+                file: "file";
+            }>;
+            hash: z.ZodNullable<z.ZodString>;
+            mode: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    resources: z.ZodArray<z.ZodObject<{
+        declaration: z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"path">;
+            path: z.ZodString;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+            recursive: z.ZodBoolean;
+            namespace: z.ZodBoolean;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodEnum<{
+                database: "database";
+                integration: "integration";
+            }>;
+            identity: z.ZodString;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"port">;
+            protocol: z.ZodEnum<{
+                tcp: "tcp";
+                udp: "udp";
+            }>;
+            address: z.ZodEnum<{
+                "*": "*";
+                "0.0.0.0": "0.0.0.0";
+                "127.0.0.1": "127.0.0.1";
+                "::": "::";
+                "::1": "::1";
+            }>;
+            port: z.ZodNumber;
+            mode: z.ZodEnum<{
+                read: "read";
+                write: "write";
+            }>;
+        }, z.core.$strict>]>;
+        path: z.ZodNullable<z.ZodString>;
+        object: z.ZodNullable<z.ZodString>;
+        ancestor: z.ZodNullable<z.ZodString>;
+        suffix: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    produced: z.ZodNullable<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        object: z.ZodNullable<z.ZodString>;
+        kind: z.ZodEnum<{
+            absent: "absent";
+            directory: "directory";
+            file: "file";
+        }>;
+        hash: z.ZodNullable<z.ZodString>;
+        mode: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    validationImmutable: z.ZodNullable<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        object: z.ZodNullable<z.ZodString>;
+        kind: z.ZodEnum<{
+            absent: "absent";
+            directory: "directory";
+            file: "file";
+        }>;
+        hash: z.ZodNullable<z.ZodString>;
+        mode: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    validationOutputs: z.ZodNullable<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        object: z.ZodNullable<z.ZodString>;
+        kind: z.ZodEnum<{
+            absent: "absent";
+            directory: "directory";
+            file: "file";
+        }>;
+        hash: z.ZodNullable<z.ZodString>;
+        mode: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    worker: z.ZodEnum<{
+        authorized: "authorized";
+        closed: "closed";
+        "no-effect": "no-effect";
+        reserved: "reserved";
+        unknown: "unknown";
+    }>;
+    validation: z.ZodEnum<{
+        finished: "finished";
+        "not-started": "not-started";
+        running: "running";
+        unknown: "unknown";
+    }>;
+    fence: z.ZodEnum<{
+        canceled: "canceled";
+        current: "current";
+        failed: "failed";
+        superseded: "superseded";
+    }>;
+    retired: z.ZodBoolean;
+    accepted: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        hash: z.ZodString;
+    }, z.core.$strict>>;
+    verificationExecution: z.ZodNullable<z.ZodObject<{
+        executionId: z.ZodString;
+        workspace: z.ZodString;
+        commands: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            command: z.ZodString;
+        }, z.core.$strict>>;
+        observations: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            command: z.ZodString;
+            cwd: z.ZodString;
+            exitStatus: z.ZodNumber;
+            pass: z.ZodBoolean;
+        }, z.core.$strict>>;
+        receipts: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            hash: z.ZodString;
+            envelope: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ManagedTaskAttempt = z.infer<typeof ManagedTaskAttemptSchema>;
+export declare const ManagedTaskGraphSchema: z.ZodObject<{
+    id: z.ZodString;
+    owner: z.ZodString;
+    revision: z.ZodNumber;
+    nodes: z.ZodArray<z.ZodObject<{
+        revision: z.ZodNumber;
+        hash: z.ZodString;
+        definition: z.ZodObject<{
+            id: z.ZodString;
+            task: z.ZodString;
+            workspace: z.ZodString;
+            predecessors: z.ZodArray<z.ZodString>;
+            criteriaIdentity: z.ZodString;
+            validations: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                command: z.ZodString;
+            }, z.core.$strict>>;
+            resources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"path">;
+                path: z.ZodString;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+                recursive: z.ZodBoolean;
+                namespace: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodEnum<{
+                    database: "database";
+                    integration: "integration";
+                }>;
+                identity: z.ZodString;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"port">;
+                protocol: z.ZodEnum<{
+                    tcp: "tcp";
+                    udp: "udp";
+                }>;
+                address: z.ZodEnum<{
+                    "*": "*";
+                    "0.0.0.0": "0.0.0.0";
+                    "127.0.0.1": "127.0.0.1";
+                    "::": "::";
+                    "::1": "::1";
+                }>;
+                port: z.ZodNumber;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+            }, z.core.$strict>]>>;
+            artifacts: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                role: z.ZodEnum<{
+                    input: "input";
+                    output: "output";
+                    "read-write": "read-write";
+                    "validation-output": "validation-output";
+                }>;
+                presence: z.ZodEnum<{
+                    absent: "absent";
+                    optional: "optional";
+                    required: "required";
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    attempts: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        nodeId: z.ZodString;
+        taskRevision: z.ZodNumber;
+        graphRevision: z.ZodNumber;
+        definitionHash: z.ZodString;
+        definition: z.ZodObject<{
+            id: z.ZodString;
+            task: z.ZodString;
+            workspace: z.ZodString;
+            predecessors: z.ZodArray<z.ZodString>;
+            criteriaIdentity: z.ZodString;
+            validations: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                command: z.ZodString;
+            }, z.core.$strict>>;
+            resources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"path">;
+                path: z.ZodString;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+                recursive: z.ZodBoolean;
+                namespace: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodEnum<{
+                    database: "database";
+                    integration: "integration";
+                }>;
+                identity: z.ZodString;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"port">;
+                protocol: z.ZodEnum<{
+                    tcp: "tcp";
+                    udp: "udp";
+                }>;
+                address: z.ZodEnum<{
+                    "*": "*";
+                    "0.0.0.0": "0.0.0.0";
+                    "127.0.0.1": "127.0.0.1";
+                    "::": "::";
+                    "::1": "::1";
+                }>;
+                port: z.ZodNumber;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+            }, z.core.$strict>]>>;
+            artifacts: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                role: z.ZodEnum<{
+                    input: "input";
+                    output: "output";
+                    "read-write": "read-write";
+                    "validation-output": "validation-output";
+                }>;
+                presence: z.ZodEnum<{
+                    absent: "absent";
+                    optional: "optional";
+                    required: "required";
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        native: z.ZodObject<{
+            key: z.ZodString;
+            identity: z.ZodString;
+            requestHash: z.ZodString;
+        }, z.core.$strict>;
+        inputs: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            object: z.ZodNullable<z.ZodString>;
+            kind: z.ZodEnum<{
+                absent: "absent";
+                directory: "directory";
+                file: "file";
+            }>;
+            hash: z.ZodNullable<z.ZodString>;
+            mode: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strict>>;
+        predecessors: z.ZodArray<z.ZodObject<{
+            nodeId: z.ZodString;
+            taskRevision: z.ZodNumber;
+            attemptId: z.ZodString;
+            verificationId: z.ZodString;
+            verificationHash: z.ZodString;
+            produced: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                object: z.ZodNullable<z.ZodString>;
+                kind: z.ZodEnum<{
+                    absent: "absent";
+                    directory: "directory";
+                    file: "file";
+                }>;
+                hash: z.ZodNullable<z.ZodString>;
+                mode: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        resources: z.ZodArray<z.ZodObject<{
+            declaration: z.ZodUnion<readonly [z.ZodObject<{
+                kind: z.ZodLiteral<"path">;
+                path: z.ZodString;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+                recursive: z.ZodBoolean;
+                namespace: z.ZodBoolean;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodEnum<{
+                    database: "database";
+                    integration: "integration";
+                }>;
+                identity: z.ZodString;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"port">;
+                protocol: z.ZodEnum<{
+                    tcp: "tcp";
+                    udp: "udp";
+                }>;
+                address: z.ZodEnum<{
+                    "*": "*";
+                    "0.0.0.0": "0.0.0.0";
+                    "127.0.0.1": "127.0.0.1";
+                    "::": "::";
+                    "::1": "::1";
+                }>;
+                port: z.ZodNumber;
+                mode: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                }>;
+            }, z.core.$strict>]>;
+            path: z.ZodNullable<z.ZodString>;
+            object: z.ZodNullable<z.ZodString>;
+            ancestor: z.ZodNullable<z.ZodString>;
+            suffix: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        produced: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            object: z.ZodNullable<z.ZodString>;
+            kind: z.ZodEnum<{
+                absent: "absent";
+                directory: "directory";
+                file: "file";
+            }>;
+            hash: z.ZodNullable<z.ZodString>;
+            mode: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strict>>>;
+        validationImmutable: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            object: z.ZodNullable<z.ZodString>;
+            kind: z.ZodEnum<{
+                absent: "absent";
+                directory: "directory";
+                file: "file";
+            }>;
+            hash: z.ZodNullable<z.ZodString>;
+            mode: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strict>>>;
+        validationOutputs: z.ZodNullable<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            object: z.ZodNullable<z.ZodString>;
+            kind: z.ZodEnum<{
+                absent: "absent";
+                directory: "directory";
+                file: "file";
+            }>;
+            hash: z.ZodNullable<z.ZodString>;
+            mode: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strict>>>;
+        worker: z.ZodEnum<{
+            authorized: "authorized";
+            closed: "closed";
+            "no-effect": "no-effect";
+            reserved: "reserved";
+            unknown: "unknown";
+        }>;
+        validation: z.ZodEnum<{
+            finished: "finished";
+            "not-started": "not-started";
+            running: "running";
+            unknown: "unknown";
+        }>;
+        fence: z.ZodEnum<{
+            canceled: "canceled";
+            current: "current";
+            failed: "failed";
+            superseded: "superseded";
+        }>;
+        retired: z.ZodBoolean;
+        accepted: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            hash: z.ZodString;
+        }, z.core.$strict>>;
+        verificationExecution: z.ZodNullable<z.ZodObject<{
+            executionId: z.ZodString;
+            workspace: z.ZodString;
+            commands: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                command: z.ZodString;
+            }, z.core.$strict>>;
+            observations: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                command: z.ZodString;
+                cwd: z.ZodString;
+                exitStatus: z.ZodNumber;
+                pass: z.ZodBoolean;
+            }, z.core.$strict>>;
+            receipts: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                hash: z.ZodString;
+                envelope: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    canceled: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ManagedTaskGraph = z.infer<typeof ManagedTaskGraphSchema>;
+export declare const ManagedDomainBindingSchema: z.ZodObject<{
+    controlRoot: z.ZodString;
+    rootIdentity: z.ZodString;
+    agentDir: z.ZodString;
+    agentDirIdentity: z.ZodString;
+    enrollmentId: z.ZodString;
+    worktrees: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        identity: z.ZodString;
+    }, z.core.$strict>>;
+    aliases: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        target: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ManagedDomainBinding = z.infer<typeof ManagedDomainBindingSchema>;
+export declare const ManagedTaskDomainSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    state_revision: z.ZodNumber;
+    binding: z.ZodObject<{
+        controlRoot: z.ZodString;
+        rootIdentity: z.ZodString;
+        agentDir: z.ZodString;
+        agentDirIdentity: z.ZodString;
+        enrollmentId: z.ZodString;
+        worktrees: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            identity: z.ZodString;
+        }, z.core.$strict>>;
+        aliases: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            target: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    graphs: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        owner: z.ZodString;
+        revision: z.ZodNumber;
+        nodes: z.ZodArray<z.ZodObject<{
+            revision: z.ZodNumber;
+            hash: z.ZodString;
+            definition: z.ZodObject<{
+                id: z.ZodString;
+                task: z.ZodString;
+                workspace: z.ZodString;
+                predecessors: z.ZodArray<z.ZodString>;
+                criteriaIdentity: z.ZodString;
+                validations: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    command: z.ZodString;
+                }, z.core.$strict>>;
+                resources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                    kind: z.ZodLiteral<"path">;
+                    path: z.ZodString;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                    recursive: z.ZodBoolean;
+                    namespace: z.ZodBoolean;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodEnum<{
+                        database: "database";
+                        integration: "integration";
+                    }>;
+                    identity: z.ZodString;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"port">;
+                    protocol: z.ZodEnum<{
+                        tcp: "tcp";
+                        udp: "udp";
+                    }>;
+                    address: z.ZodEnum<{
+                        "*": "*";
+                        "0.0.0.0": "0.0.0.0";
+                        "127.0.0.1": "127.0.0.1";
+                        "::": "::";
+                        "::1": "::1";
+                    }>;
+                    port: z.ZodNumber;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                }, z.core.$strict>]>>;
+                artifacts: z.ZodArray<z.ZodObject<{
+                    path: z.ZodString;
+                    role: z.ZodEnum<{
+                        input: "input";
+                        output: "output";
+                        "read-write": "read-write";
+                        "validation-output": "validation-output";
+                    }>;
+                    presence: z.ZodEnum<{
+                        absent: "absent";
+                        optional: "optional";
+                        required: "required";
+                    }>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+        attempts: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            nodeId: z.ZodString;
+            taskRevision: z.ZodNumber;
+            graphRevision: z.ZodNumber;
+            definitionHash: z.ZodString;
+            definition: z.ZodObject<{
+                id: z.ZodString;
+                task: z.ZodString;
+                workspace: z.ZodString;
+                predecessors: z.ZodArray<z.ZodString>;
+                criteriaIdentity: z.ZodString;
+                validations: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    command: z.ZodString;
+                }, z.core.$strict>>;
+                resources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                    kind: z.ZodLiteral<"path">;
+                    path: z.ZodString;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                    recursive: z.ZodBoolean;
+                    namespace: z.ZodBoolean;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodEnum<{
+                        database: "database";
+                        integration: "integration";
+                    }>;
+                    identity: z.ZodString;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"port">;
+                    protocol: z.ZodEnum<{
+                        tcp: "tcp";
+                        udp: "udp";
+                    }>;
+                    address: z.ZodEnum<{
+                        "*": "*";
+                        "0.0.0.0": "0.0.0.0";
+                        "127.0.0.1": "127.0.0.1";
+                        "::": "::";
+                        "::1": "::1";
+                    }>;
+                    port: z.ZodNumber;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                }, z.core.$strict>]>>;
+                artifacts: z.ZodArray<z.ZodObject<{
+                    path: z.ZodString;
+                    role: z.ZodEnum<{
+                        input: "input";
+                        output: "output";
+                        "read-write": "read-write";
+                        "validation-output": "validation-output";
+                    }>;
+                    presence: z.ZodEnum<{
+                        absent: "absent";
+                        optional: "optional";
+                        required: "required";
+                    }>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            native: z.ZodObject<{
+                key: z.ZodString;
+                identity: z.ZodString;
+                requestHash: z.ZodString;
+            }, z.core.$strict>;
+            inputs: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                object: z.ZodNullable<z.ZodString>;
+                kind: z.ZodEnum<{
+                    absent: "absent";
+                    directory: "directory";
+                    file: "file";
+                }>;
+                hash: z.ZodNullable<z.ZodString>;
+                mode: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strict>>;
+            predecessors: z.ZodArray<z.ZodObject<{
+                nodeId: z.ZodString;
+                taskRevision: z.ZodNumber;
+                attemptId: z.ZodString;
+                verificationId: z.ZodString;
+                verificationHash: z.ZodString;
+                produced: z.ZodArray<z.ZodObject<{
+                    path: z.ZodString;
+                    object: z.ZodNullable<z.ZodString>;
+                    kind: z.ZodEnum<{
+                        absent: "absent";
+                        directory: "directory";
+                        file: "file";
+                    }>;
+                    hash: z.ZodNullable<z.ZodString>;
+                    mode: z.ZodNullable<z.ZodNumber>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            resources: z.ZodArray<z.ZodObject<{
+                declaration: z.ZodUnion<readonly [z.ZodObject<{
+                    kind: z.ZodLiteral<"path">;
+                    path: z.ZodString;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                    recursive: z.ZodBoolean;
+                    namespace: z.ZodBoolean;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodEnum<{
+                        database: "database";
+                        integration: "integration";
+                    }>;
+                    identity: z.ZodString;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"port">;
+                    protocol: z.ZodEnum<{
+                        tcp: "tcp";
+                        udp: "udp";
+                    }>;
+                    address: z.ZodEnum<{
+                        "*": "*";
+                        "0.0.0.0": "0.0.0.0";
+                        "127.0.0.1": "127.0.0.1";
+                        "::": "::";
+                        "::1": "::1";
+                    }>;
+                    port: z.ZodNumber;
+                    mode: z.ZodEnum<{
+                        read: "read";
+                        write: "write";
+                    }>;
+                }, z.core.$strict>]>;
+                path: z.ZodNullable<z.ZodString>;
+                object: z.ZodNullable<z.ZodString>;
+                ancestor: z.ZodNullable<z.ZodString>;
+                suffix: z.ZodNullable<z.ZodString>;
+            }, z.core.$strict>>;
+            produced: z.ZodNullable<z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                object: z.ZodNullable<z.ZodString>;
+                kind: z.ZodEnum<{
+                    absent: "absent";
+                    directory: "directory";
+                    file: "file";
+                }>;
+                hash: z.ZodNullable<z.ZodString>;
+                mode: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strict>>>;
+            validationImmutable: z.ZodNullable<z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                object: z.ZodNullable<z.ZodString>;
+                kind: z.ZodEnum<{
+                    absent: "absent";
+                    directory: "directory";
+                    file: "file";
+                }>;
+                hash: z.ZodNullable<z.ZodString>;
+                mode: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strict>>>;
+            validationOutputs: z.ZodNullable<z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                object: z.ZodNullable<z.ZodString>;
+                kind: z.ZodEnum<{
+                    absent: "absent";
+                    directory: "directory";
+                    file: "file";
+                }>;
+                hash: z.ZodNullable<z.ZodString>;
+                mode: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strict>>>;
+            worker: z.ZodEnum<{
+                authorized: "authorized";
+                closed: "closed";
+                "no-effect": "no-effect";
+                reserved: "reserved";
+                unknown: "unknown";
+            }>;
+            validation: z.ZodEnum<{
+                finished: "finished";
+                "not-started": "not-started";
+                running: "running";
+                unknown: "unknown";
+            }>;
+            fence: z.ZodEnum<{
+                canceled: "canceled";
+                current: "current";
+                failed: "failed";
+                superseded: "superseded";
+            }>;
+            retired: z.ZodBoolean;
+            accepted: z.ZodNullable<z.ZodObject<{
+                id: z.ZodString;
+                hash: z.ZodString;
+            }, z.core.$strict>>;
+            verificationExecution: z.ZodNullable<z.ZodObject<{
+                executionId: z.ZodString;
+                workspace: z.ZodString;
+                commands: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    command: z.ZodString;
+                }, z.core.$strict>>;
+                observations: z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    command: z.ZodString;
+                    cwd: z.ZodString;
+                    exitStatus: z.ZodNumber;
+                    pass: z.ZodBoolean;
+                }, z.core.$strict>>;
+                receipts: z.ZodArray<z.ZodObject<{
+                    id: z.ZodString;
+                    hash: z.ZodString;
+                    envelope: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        canceled: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ManagedTaskDomain = z.infer<typeof ManagedTaskDomainSchema>;
+/**
+ * Internal M2 handoff object. It is returned only after a durable M1
+ * reservation; M2 must keep it private after verified Broker admission.
+ */
+export interface ManagedAttemptRef {
+    readonly controlRoot: string;
+    readonly enrollmentId: string;
+    readonly agentDirIdentity: string;
+    readonly graphId: string;
+    readonly graphRevision: number;
+    readonly nodeId: string;
+    readonly taskRevision: number;
+    readonly attemptId: string;
+    readonly definitionHash: string;
+    readonly criteriaIdentity: string;
+    readonly inputIdentity: string;
+    readonly predecessorIdentity: string;
+    readonly resourceIdentity: string;
+    readonly native: ManagedNativeIdentity;
+    readonly nativeIdentity: string;
+}
+export declare function managedIdentity(value: unknown): string;
+export type ManagedEnrollmentRecord = {
+    controlRoots: string[];
+    establishedRoots: string[];
+    publishingRoots: string[];
+    nativeIdentities: string[];
+    byRoot: Record<string, string[]>;
+};
+export declare function within(parent: string, child: string): boolean;
+export interface ManagedDomainBindingInput {
+    controlRoot: string;
+    agentDir: string;
+    enrollmentId: string;
+    worktrees: string[];
+    aliases?: string[];
+}
+/** Explicit aliases are accepted only while their real target remains the enrolled target. */
+export declare function createManagedDomainBinding(input: ManagedDomainBindingInput): Promise<ManagedDomainBinding>;
+export declare function canonicalizeManagedResources(binding: ManagedDomainBinding, declarations: ManagedResource[]): Promise<ManagedCanonicalResource[]>;
+export declare function managedResourcesOverlap(a: ManagedCanonicalResource, b: ManagedCanonicalResource): boolean;
+export declare function managedResourcesConflict(a: ManagedCanonicalResource, b: ManagedCanonicalResource): boolean;
+export declare function parseManagedTaskDefinitions(value: unknown): ManagedTaskDefinition[];
+export declare function resourceCoversPath(resource: ManagedCanonicalResource, targetPath: string, needed: "read" | "write"): boolean;
+export declare function captureManagedManifest(binding: ManagedDomainBinding, paths: string[]): Promise<ManagedManifest>;
+export declare function assertManagedManifestCurrent(binding: ManagedDomainBinding, manifest: ManagedManifest): Promise<void>;
+export declare function managedTaskDomainPath(controlRoot: string): string;
+export declare function managedEnrollmentIndexPath(agentDir: string): string;
+export declare function validateManagedTaskDomain(value: unknown): ManagedTaskDomain;
+export interface ManagedDomainTransactionOptions {
+    binding: ManagedDomainBinding;
+    expectedRevision?: number;
+    /** Only for first enrollment; caller checks its authoritative registration/native journal under this lock. */
+    assertNoManagedEvidence?: () => Promise<void>;
+    /** Publish a fail-closed marker after definition validation but before the first state write. */
+    beforeFirstPublication?: () => Promise<void>;
+    /** Runs under the domain lock after the first state is durable, serialized with stale-index reclamation. */
+    onFirstPublication?: () => Promise<void>;
+    /** Restore pending only when the state writer proves it failed before rename. */
+    onFirstPublicationAborted?: () => Promise<void>;
+    /** Trusted native/internal observation: reload under the lock and CAS against the live revision. */
+    internal?: boolean;
+}
+/** Trusted internal policy boundary, NOT a public wire parser or receipt/PASS submission API. */
+export declare function transactManagedTaskDomain<T>(options: ManagedDomainTransactionOptions, mutation: (state: ManagedTaskDomain) => Promise<T>): Promise<{
+    state: ManagedTaskDomain;
+    result: T;
+}>;
+export declare function defineManagedTaskGraph(state: ManagedTaskDomain, input: {
+    id: string;
+    owner: string;
+    nodes: unknown;
+}): Promise<ManagedTaskGraph>;
+export declare function readyManagedTasks(graph: ManagedTaskGraph): string[];
+/** Exact same-key retry observes the original reservation; otherwise admits a new one. */
+export declare function observeOrAdmitManagedTask(state: ManagedTaskDomain, input: {
+    graphId: string;
+    owner: string;
+    nodeId: string;
+    attemptId: string;
+    native: ManagedNativeIdentity;
+}): Promise<ManagedAttemptRef>;
+/** Caller supplies native deriveIdempotencyIdentity result only after authenticated admission. No native effect here. */
+export declare function admitManagedTask(state: ManagedTaskDomain, input: {
+    graphId: string;
+    owner: string;
+    nodeId: string;
+    attemptId: string;
+    native: ManagedNativeIdentity;
+}): Promise<ManagedAttemptRef>;
+export declare function canRetireManagedAttempt(attempt: ManagedTaskAttempt): boolean;
+export declare function retireManagedAttempt(attempt: ManagedTaskAttempt): void;
+/** Invalidation never releases reservations or rewrites old immutable attempts. */
+export declare function cancelManagedTasks(graph: ManagedTaskGraph, ids: string[]): string[];
+export declare function reviseManagedTaskGraph(state: ManagedTaskDomain, graph: ManagedTaskGraph, value: unknown): Promise<string[]>;
+export declare function reducedWorkroomManagedDefinitions(workspace: string, criteriaIdentity: string): ManagedTaskDefinition[];
+export type ManagedNativeEffectFence = "launch" | "seed";
+export declare function managedNativeVector(attempt: ManagedTaskAttempt): string;
+export declare function lookupManagedAttemptByNativeIdentity(state: ManagedTaskDomain, nativeIdentity: string): ManagedTaskAttempt | undefined;
+/** Trusted read of one attempt under the domain lock. Does not mint ManagedAttemptRef. */
+export declare function inspectManagedAttemptByNativeIdentity(binding: ManagedDomainBinding, nativeIdentity: string): Promise<ManagedTaskAttempt | undefined>;
+/**
+ * Recheck current fence and immutable native vector, then run the native
+ * transition before releasing the domain lock. Callers must not enter this
+ * from a nested native serialization callback.
+ */
+export declare function withManagedNativeEffectAuthorized<T>(binding: ManagedDomainBinding, nativeIdentity: string, expectedVector: string, fence: ManagedNativeEffectFence, effect: () => Promise<T>): Promise<T>;
+export declare function assertManagedNativeEffectAuthorized(binding: ManagedDomainBinding, nativeIdentity: string, expectedVector: string, fence: ManagedNativeEffectFence): Promise<void>;
+export declare function managedAttemptRefMatches(ref: ManagedAttemptRef, attempt: ManagedTaskAttempt, binding: ManagedDomainBinding): boolean;
+export type ManagedNativeObservation = "no-effect" | "authorized" | "unknown" | "closed";
+export declare function managedAttemptRefFromState(state: ManagedTaskDomain, attempt: ManagedTaskAttempt, graphId: string): ManagedAttemptRef;
+export declare function loadManagedEnrollmentIndex(agentDir: string): Promise<string[]>;
+export declare function loadManagedEnrollmentRecord(agentDir: string): Promise<ManagedEnrollmentRecord>;
+export declare function recordManagedEnrollment(agentDir: string, controlRoot: string, nativeIdentity?: string): Promise<void>;
+/** Mark a first domain publication in progress before its state rename. */
+export declare function markManagedEnrollmentPublishing(agentDir: string, controlRoot: string): Promise<void>;
+/** A valid domain snapshot is authoritative even if the marker update was interrupted. */
+export declare function markManagedEnrollmentEstablished(agentDir: string, controlRoot: string): Promise<void>;
+/** Only a proven pre-rename state-write failure may return publication to pending. */
+export declare function markManagedEnrollmentPending(agentDir: string, controlRoot: string): Promise<void>;
+export declare function currentManagedRevision(binding: ManagedDomainBinding): Promise<number>;
+export declare function recordManagedNativeObservation(binding: ManagedDomainBinding, nativeIdentity: string, worker: ManagedNativeObservation, authorize?: {
+    fence: ManagedNativeEffectFence;
+    expectedVector: string;
+}): Promise<void>;
+export type RestoredManagedAttemptRefs = {
+    refs: ManagedAttemptRef[];
+    failedRoots: string[];
+};
+export declare function restoreManagedAttemptRefs(agentDir: string): Promise<RestoredManagedAttemptRefs>;
+export declare function loadManagedDomainBinding(controlRoot: string): Promise<ManagedDomainBinding | undefined>;