@hachej/boring-agent 0.1.109 → 0.1.110

package/dist/server/index.d.ts

@@ -1,34 +1,292 @@
-import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, R as RuntimeModeAdapter, b as RuntimeModeId, B as BuiltinRuntimeModeId, c as AgentRuntimeHostOperations, d as RuntimeBashStrategy, e as RuntimeFilesystemStrategy, M as ModeContext, f as WorkspaceProvisioningAdapter, g as AgentInstructionSource, C as ConfiguredAgentHostAgentSpec, h as AgentInstructionFileRef, i as AgentHostAgentSpec, j as RuntimeBundle, k as PiHarnessOptions, l as AgentMeteringSink, m as RuntimeFilesystemBinding, n as CreatedAgentHost, o as ResolvedPiHarnessOptions, p as ReadyStatusTracker, q as CreateAgentHostOptions, r as CompiledAgentHostAgentSpec, s as AgentRequestLedger, t as AgentEffectAdmission, u as AuthorizedEnvironmentIntent, v as AgentHostEnvironmentScope, w as ResolvedAgentRuntimeScope, x as AgentRequestKey, y as AgentRequestLedgerPrepareResult, z as AgentRequestFailure, D as AgentRequestLedgerRecord, E as AgentFleetCompiler, F as AgentRequestTarget, G as RuntimeFilesystemAccessDecision } from '../types-B7-PN5jV.js';
-export { A as AgentGatewayEffect, H as AgentHostDescription, I as AgentHostDirectProjectionOptions, J as AgentHostDispatcherRunInput, K as AgentHostEnvironmentLease, L as AgentHostHandle, N as DEFAULT_AGENT_TYPE_ID, O as MeteringErrorLogger, Q as MeteringReleaseInput, S as MeteringReleaseReason, T as MeteringReservationResult, U as MeteringReserveInput, V as MeteringRunKind, X as MeteringRunScope, Y as MeteringRunStatus, Z as MeteringSettleInput, _ as MeteringUsage, $ as MeteringUsageInput, a0 as PI_PACKAGE_RESOURCE_FILTERS, a1 as PiExtensionFactory, a2 as PluginSkillSource, a3 as ResolvedEnvironmentScope, a4 as RuntimeFilesystemBindingOperations, a5 as RuntimeNodePackageSpec, a6 as RuntimeProvisioningContribution, a7 as RuntimePythonSpec, a8 as RuntimeTemplateContribution, a9 as WorkspaceProvisioningExecResult, aa as compactPiPackages, ab as mergePiPackageSources, ac as normalizeMeteringUsage, ad as piPackageSourceKey } from '../types-B7-PN5jV.js';
+import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, C as CredentialVaultPersistenceV2, b as CredentialMaterialKindV1, c as WorkspaceCredentialLockOptionsV1, S as StoredCredentialRecordV1, d as StoredCredentialMetadataV1, R as RuntimeModeAdapter, e as RuntimeModeId, B as BuiltinRuntimeModeId, f as AgentRuntimeHostOperations, g as RuntimeBashStrategy, h as RuntimeFilesystemStrategy, M as ModeContext, i as WorkspaceProvisioningAdapter, j as AgentInstructionSource, k as ConfiguredAgentHostAgentSpec, l as AgentInstructionFileRef, m as AgentHostAgentSpec, n as RuntimeBundle, o as PiHarnessOptions, p as AgentMeteringSink, q as AgentHostCredentialOptionsV1, r as RuntimeFilesystemBinding, E as EventStreamStore, s as CreatedAgentHost, t as ResolvedPiHarnessOptions, u as ReadyStatusTracker, v as CreateAgentHostOptions, w as CompiledAgentHostAgentSpec, x as AgentRequestLedger, y as AgentEffectAdmission, z as AuthorizedEnvironmentIntent, D as AgentHostEnvironmentScope, F as ResolvedAgentRuntimeScope, G as AgentRequestKey, H as AcceptedWorkContext, I as AgentRequestLedgerPrepareResult, J as AgentRequestFailure, K as AgentRequestLedgerRecord, L as AgentFleetCompiler, N as AgentRequestTarget, O as RuntimeFilesystemAccessDecision } from '../types-DcWoQMn8.js';
+export { A as AgentGatewayEffect, Q as AgentHostDescription, T as AgentHostDirectProjectionOptions, U as AgentHostDispatcherRunInput, V as AgentHostEnvironmentLease, X as AgentHostHandle, Y as CredentialVaultPersistenceV1, Z as DEFAULT_AGENT_TYPE_ID, _ as MeteringErrorLogger, $ as MeteringReleaseInput, a0 as MeteringReleaseReason, a1 as MeteringReservationResult, a2 as MeteringReserveInput, a3 as MeteringRunKind, a4 as MeteringRunScope, a5 as MeteringRunStatus, a6 as MeteringSettleInput, a7 as MeteringUsage, a8 as MeteringUsageInput, a9 as PI_PACKAGE_RESOURCE_FILTERS, aa as PiExtensionFactory, ab as PluginSkillSource, ac as ResolvedEnvironmentScope, ad as RuntimeFilesystemBindingOperations, ae as RuntimeNodePackageSpec, af as RuntimeProvisioningContribution, ag as RuntimePythonSpec, ah as RuntimeTemplateContribution, ai as WorkspaceCredentialLifecycleV1, aj as WorkspaceProvisioningExecResult, ak as compactPiPackages, al as mergePiPackageSources, am as normalizeMeteringUsage, an as piPackageSourceKey } from '../types-DcWoQMn8.js';
 import { d as ExecOptions, a as ExecResult, W as WorkspaceChangeEvent, b as Workspace, c as Sandbox } from '../sandbox-BMhut3kh.js';
 export { h as RuntimeFilesystemCapability } from '../sandbox-BMhut3kh.js';
 import { b as RemoteWorkerHealthResponse, R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult, c as RemoteWorkerExecRequest } from '../middleware-CaAEXpi5.js';
 export { d as REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY, e as REMOTE_WORKER_PROVIDER, f as REMOTE_WORKER_RUNTIME_CWD, g as RemoteWorkerErrorPayload, h as RemoteWorkerExecResponse, i as RemoteWorkerFsEventEnvelope, W as WORKER_INTERNAL_TOKEN_HEADER, j as WORKER_REQUEST_ID_HEADER, k as WORKER_WORKSPACE_ID_HEADER, l as createAgentAuthMiddleware } from '../middleware-CaAEXpi5.js';
 import { SandboxProviderV1, WorkspaceSandboxPairV1 } from '@hachej/boring-sandbox/shared';
 import { BwrapSandboxProviderOptions } from '@hachej/boring-sandbox/providers/bwrap';
-import { F as SandboxHandleStore, k as CompiledAgentBundle, a as Sha256Digest, i as AgentDeployment, M as ShareEntryStore, y as ProviderId, c as CredentialFieldId, B as ResolvedCredentialMaterialV1, d as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, X as WorkspaceCredentialAuthorityVerifierV1, n as CredentialConsumerBindingRegistryV1, z as ProviderRegistryV1, Y as WorkspaceCredentialResolverV1, P as ProviderCredentialRefV1, R as ResolvedCredentialLeaseV1 } from '../lease-nASWv2tU.js';
-import { z as ErrorCode, o as SessionCtx, a as SessionListOptions, b as SessionSummary, c as PiChatSnapshot, d as PiChatEvent, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt, S as SessionStore } from '../piChatEvent-BUWIzw5l.js';
-import { B as JsonValue, A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, g as AgentAccessOperation, f as AgentAccessDecision, k as AgentGatewayErrorDTO, r as AgentSessionSummary, q as AgentSessionStateSnapshot, n as AgentSessionConnection } from '../errors-CEU4iujR.js';
-export { F as ResolveAgentAccess, G as ResolveAgentAccessInput } from '../errors-CEU4iujR.js';
-import { d as AgentActor, j as AgentEvent, w as TelemetrySink, s as AgentTool, D as AgentHarnessFactory, A as AgentHarness } from '../harness-Ct0e4RWc.js';
-export { u as AgentConfig, E as AgentHarnessFactoryInput } from '../harness-Ct0e4RWc.js';
+import { r as ResolvedCredentialMaterialV1, k as CredentialConsumerBindingRegistryV1, W as WorkspaceCredentialResolverV1, t as SandboxHandleStore, C as CompiledAgentBundle, a as Sha256Digest, g as AgentDeployment, z as ShareEntryStore, P as ProviderCredentialRefV1, R as ResolvedCredentialLeaseV1 } from '../share-entry-CxS6UJ_L.js';
+import { H as ErrorCode, k as SessionCtx, O as OriginChannel, a as SessionListOptions, b as SessionSummary, U as SessionCreateInit, c as PiChatSnapshot, d as PiChatEvent, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt, S as SessionStore } from '../piChatEvent-DpE0lIb9.js';
+import { B as CredentialLifecycleStateV1, P as JsonValue, A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, g as AgentAccessOperation, f as AgentAccessDecision, k as AgentGatewayErrorDTO, r as AgentSessionSummary, q as AgentSessionStateSnapshot, n as AgentSessionConnection } from '../admin-DORVQfLn.js';
+export { T as ResolveAgentAccess, U as ResolveAgentAccessInput } from '../admin-DORVQfLn.js';
+import { d as AgentActor, j as AgentEvent, w as TelemetrySink, s as AgentTool, D as AgentHarnessFactory, A as AgentHarness } from '../harness-qHlMJhZo.js';
+export { u as AgentConfig, E as AgentHarnessFactoryInput } from '../harness-qHlMJhZo.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { FastifyRequest, FastifyInstance, FastifyPluginCallback } from 'fastify';
-import { i as PiSessionRequestContext, j as AgentPromptPayload, k as PiChatAttachmentResult } from '../piChatSessionService-nvroRAVk.js';
-import { c as WorkspaceAgentDirectRunInput, W as WorkspaceAgentDirectRunCallback, f as WorkspaceAgentDispatcherContext, e as WorkspaceAgentDispatcher, i as WorkspaceAgentGatewayBinding } from '../file-search-BGUHnW9o.js';
-export { L as LeaseBoundWorkspaceAgent } from '../file-search-BGUHnW9o.js';
-import { SettingsManager } from '@mariozechner/pi-coding-agent';
+import { i as PiSessionRequestContext, j as AgentPromptPayload, k as PiChatAttachmentResult } from '../piChatSessionService-CBct-hmz.js';
+import { P as ProviderId, I as WorkspaceKekProviderV1, a as CredentialFieldId, B as WorkspaceCredentialAuthorityVerifierV1, b as ProviderRegistryV1, t as WorkspaceAgentDirectRunInput, s as WorkspaceAgentDirectRunCallback, w as WorkspaceAgentDispatcherContext, v as WorkspaceAgentDispatcher, z as WorkspaceAgentGatewayBinding, C as CredentialConsumerBindingId, N as AgentInvocationFundingPolicyV1, A as AuthorizedWorkspaceCredentialScopeV1 } from '../file-search-BUgMSKZE.js';
+export { L as LeaseBoundWorkspaceAgent } from '../file-search-BUgMSKZE.js';
+import { CredentialStore, AuthPrompt } from '@earendil-works/pi-ai';
+import { SettingsManager, ModelRuntime } from '@mariozechner/pi-coding-agent';
+import postgres from 'postgres';
 import '@hachej/boring-bash/agent';
 import '@hachej/boring-sandbox/providers/node-workspace';
 import 'zod';
 
+interface SqlResult {
+    toArray(): Array<Record<string, unknown>>;
+}
+interface SqlStorage {
+    exec(query: string, ...bindings: unknown[]): SqlResult;
+}
+/**
+ * `deferred` (SQLite's plain `BEGIN`) postpones acquiring any lock until the
+ * first read or write inside the transaction. That is fine for read-only
+ * transactions, but a transaction that reads THEN writes (e.g. a
+ * check-then-insert) starts under a read lock and must upgrade to a write
+ * lock mid-transaction — and SQLite refuses that upgrade with SQLITE_BUSY
+ * immediately if another connection holds the write lock, WITHOUT honoring
+ * `busy_timeout` (the busy handler only runs for the initial lock
+ * acquisition, not a lock *upgrade*). `immediate` (`BEGIN IMMEDIATE`)
+ * acquires the write lock up front, so `busy_timeout` applies normally and
+ * a concurrent writer simply waits instead of erroring. Use `immediate` for
+ * any transaction that writes — especially read-then-write — and reserve
+ * `deferred` for genuinely read-only transactions.
+ */
+type SqlTransactionMode = 'deferred' | 'immediate';
+type RunTransaction = <T>(fn: () => T, mode?: SqlTransactionMode) => T;
+
 declare function provisionWorkspaceRuntime(opts: ProvisionWorkspaceRuntimeOptions): Promise<WorkspaceProvisioningResult>;
 
 declare function createResourceSettingsManager(cwd: string, agentDir: string, piPackages: PiPackageSource[], options?: {
     includePackage?: (source: PiPackageSource) => boolean;
+    includeConfiguredPackages?: boolean;
 }): SettingsManager;
 
+declare function createInMemoryCredentialVaultPersistenceV1(): CredentialVaultPersistenceV2;
+
+interface PostgresCredentialVaultPersistenceOptionsV1 {
+    /** Independently pooled connection used only to evict an uncertain lock holder. */
+    readonly evictionSql: postgres.Sql;
+    /** Default bound for advisory-lock acquisition. */
+    readonly lockAcquireTimeoutMs?: number;
+    /** Delay between non-blocking advisory-lock attempts. */
+    readonly lockPollIntervalMs?: number;
+    /** Bound for confirming advisory unlock before evicting the connection. */
+    readonly lockReleaseTimeoutMs?: number;
+}
+type Sql = postgres.Sql | postgres.TransactionSql;
+declare function createPostgresCredentialVaultPersistenceV1(sql: Sql, options: PostgresCredentialVaultPersistenceOptionsV1): CredentialVaultPersistenceV2;
+
+/** Deployment-owned schema registration for durable credential vault storage. */
+declare function runCredentialVaultPostgresMigrationsV1(sql: postgres.Sql): Promise<void>;
+
+interface WorkspaceCredentialVersionStateV1 {
+    readonly counter: number;
+    /** Monotonic irreversible fence; any positive value means the workspace was shredded. */
+    readonly cryptoShredGeneration: number;
+    /** Monotonic workspace-wide fence for replayed wrapped DEKs and records. */
+    readonly dekGeneration: number;
+    /** Authenticated idempotency receipts for completed DEK rotations. */
+    readonly dekRotationReceipts: Readonly<Record<string, number>>;
+    readonly credentialVersions: Readonly<Record<string, number>>;
+    readonly credentialMaterialKinds: Readonly<Record<string, CredentialMaterialKindV1>>;
+    readonly credentialFieldIds: Readonly<Record<string, readonly string[]>>;
+    readonly credentialLifecycleStates: Readonly<Record<string, CredentialLifecycleStateV1>>;
+    readonly credentialTypes: Readonly<Record<string, string>>;
+}
+interface PendingCredentialVersionMutationV1 {
+    readonly operationId: string;
+    readonly providerId: ProviderId;
+    readonly expectedStateDigest: string;
+    readonly nextStateDigest: string;
+    readonly nextCredentialVersion: number;
+    readonly nextCredentialMaterialKind: CredentialMaterialKindV1;
+    readonly nextCredentialFieldIds: readonly string[];
+    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
+    readonly nextCredentialType: string;
+    readonly nextDekGeneration: number;
+}
+interface CredentialVersionMutationStateV1 {
+    readonly nextCredentialVersion: number;
+    readonly nextCredentialMaterialKind: CredentialMaterialKindV1;
+    readonly nextCredentialFieldIds: readonly string[];
+    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
+    readonly nextCredentialType: string;
+    readonly nextDekGeneration: number;
+}
+interface CredentialVersionMutationResultV1<T> {
+    readonly nextCredentialVersion: number;
+    readonly nextCredentialMaterialKind: CredentialMaterialKindV1;
+    readonly nextCredentialFieldIds: readonly string[];
+    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
+    readonly nextCredentialType: string;
+    readonly nextDekGeneration: number;
+    readonly result: T;
+}
+/**
+ * V2 write-ahead mutation contract. The anchor seals both authenticated digests
+ * before invoking `commit`, then finalizes only after `commit` succeeds.
+ */
+type CredentialVersionMutationResultV2<T> = CredentialVersionMutationStateV1 & {
+    readonly expectedStateDigest: string;
+    readonly nextStateDigest: string;
+    readonly commit: () => Promise<T>;
+};
+interface DekGenerationMutationResultV1<T> {
+    readonly nextDekGeneration: number;
+    readonly nextDekRotationOperationId: string;
+    readonly result: T;
+}
+interface CredentialLifecycleMutationResultV1<T> {
+    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
+    readonly result: T;
+}
+interface CryptoShredMutationResultV1<T> {
+    readonly result: T;
+}
+interface CredentialVersionAnchorReadOptionsV1 {
+    /**
+     * A provider-list probe may treat a never-provisioned anchor file as empty
+     * only when persistence has no credential metadata. Existing malformed or
+     * unauthenticated anchor files still fail closed.
+     */
+    readonly allowUnprovisioned?: boolean;
+}
+type CredentialVersionAnchorReaderV1 = (options?: CredentialVersionAnchorReadOptionsV1) => Promise<WorkspaceCredentialVersionStateV1 | undefined>;
+interface WorkspaceCredentialVersionAnchorV1 {
+    read(workspaceId: string, options?: CredentialVersionAnchorReadOptionsV1): Promise<WorkspaceCredentialVersionStateV1 | undefined>;
+    /** Serializes a persistence inspection with anchor mutations. */
+    withReadLock<T>(workspaceId: string, inspect: (readLocked: CredentialVersionAnchorReaderV1) => Promise<T>): Promise<T>;
+    /**
+     * Holds the external workspace mutation lock through the supplied DB CAS.
+     * If the DB commit succeeds but advancing this external anchor fails, the
+     * mismatch deliberately fail-stops; accepting DB-ahead state would turn an
+     * attacker replay into an automatic rollback. S1 prefers security over
+     * availability here and does not claim cross-store crash atomicity.
+     */
+    withMutation<T>(workspaceId: string, providerId: ProviderId, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<CredentialVersionMutationResultV1<T>>): Promise<T>;
+    /** Authenticates a lifecycle-only state transition without minting a version. */
+    withLifecycleMutation<T>(workspaceId: string, providerId: ProviderId, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<CredentialLifecycleMutationResultV1<T>>): Promise<T>;
+    /**
+     * Irreversibly advances the authenticated external shred fence before
+     * destructive persistence finalization. Repeated calls retain the fence and
+     * re-run finalization so cleanup is recoverable and idempotent.
+     */
+    withCryptoShredMutation<T>(workspaceId: string, mutate: (current: WorkspaceCredentialVersionStateV1) => Promise<CryptoShredMutationResultV1<T>>): Promise<T>;
+    /** Advances the authenticated workspace DEK fence exactly one generation. */
+    withDekGenerationMutation<T>(workspaceId: string, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<DekGenerationMutationResultV1<T>>): Promise<T>;
+}
+/** Recovery-capable authority required by the durable vault backend. */
+interface WorkspaceCredentialVersionAnchorV2 extends WorkspaceCredentialVersionAnchorV1 {
+    readonly contractVersion: 'boring.workspace-credential-version-anchor.v2';
+    readPendingMutation(workspaceId: string, options?: CredentialVersionAnchorReadOptionsV1): Promise<PendingCredentialVersionMutationV1 | undefined>;
+    recoverPendingMutation(workspaceId: string, durableStateDigest: string): Promise<void>;
+    /**
+     * Holds the external workspace mutation lock through a write-ahead,
+     * KEK-authenticated intent, the supplied DB CAS, and anchor finalization.
+     * This is recoverable deferred commit, not cross-store atomicity.
+     */
+    withRecoverableMutation<T>(workspaceId: string, providerId: ProviderId, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<CredentialVersionMutationResultV2<T>>): Promise<T>;
+}
+/** Test/development anchor. Production local-KEK composition uses the sealed file adapter. */
+declare function createInMemoryCredentialVersionAnchorV1(): WorkspaceCredentialVersionAnchorV2;
+interface LocalCredentialVersionAnchorOptionsV1 {
+    readonly anchorFilePath: string;
+    readonly loadKek: () => Promise<Uint8Array>;
+}
+/** Explicit one-time provisioning; refuses to replace an existing anchor. */
+declare function initializeLocalFileCredentialVersionAnchorV1(options: LocalCredentialVersionAnchorOptionsV1): Promise<void>;
+/**
+ * Local-KEK rollback anchor. The pre-provisioned file lives on the
+ * operator-controlled durable mount beside the KEK, never in Postgres or a
+ * workspace. One counter advances per workspace; authenticated provider
+ * context is necessary because unchanged providers legitimately trail it.
+ *
+ * S1 rejects a replayed DB current-version pointer. It only narrows exposure:
+ * S2 makes exfiltrated old ciphertext cryptographically dead by destroying the
+ * superseded DEK generation.
+ */
+declare function createLocalFileCredentialVersionAnchorV1(options: LocalCredentialVersionAnchorOptionsV1): WorkspaceCredentialVersionAnchorV2;
+
+/**
+ * Convenience composition for self-host deployments. Returns `undefined` when
+ * the local-KEK backend was not explicitly selected; the caller must then fail
+ * closed rather than substitute a default.
+ */
+declare function createLocalKekWorkspaceKekProviderFromEnvV1(env: Readonly<Record<string, string | undefined>>): WorkspaceKekProviderV1 | undefined;
+declare function createLocalCredentialVersionAnchorFromEnvV1(env: Readonly<Record<string, string | undefined>>): WorkspaceCredentialVersionAnchorV2 | undefined;
+
+interface CredentialStoreBackendV1 {
+    read(workspaceId: string, providerId: ProviderId, allowedFieldIds: readonly CredentialFieldId[]): Promise<ResolvedCredentialMaterialV1 & {
+        credentialVersion: number;
+    }>;
+}
+interface HostSideCredentialResolverOptionsV1 {
+    readonly authorityVerifier: WorkspaceCredentialAuthorityVerifierV1;
+    readonly bindingRegistry: CredentialConsumerBindingRegistryV1;
+    readonly providerRegistry: ProviderRegistryV1;
+    /**
+     * Storage boundary only. Vault/KmsBackend composition is deferred to bead
+     * 16f.2 and will implement this interface without changing the resolver.
+     */
+    readonly backend: CredentialStoreBackendV1;
+}
+interface InMemoryCredentialBackendEntryV1 {
+    readonly workspaceId: string;
+    readonly providerId: ProviderId;
+    readonly material: ResolvedCredentialMaterialV1;
+    readonly credentialVersion: number;
+}
+declare function createHostSideCredentialResolverV1(options: HostSideCredentialResolverOptionsV1): WorkspaceCredentialResolverV1;
+declare function createInMemoryCredentialBackendV1(entries: readonly InMemoryCredentialBackendEntryV1[]): CredentialStoreBackendV1;
+
+/**
+ * Composes a `WorkspaceKekProviderV1` (KmsBackend) with AAD-bound AES-256-GCM
+ * field crypto and an injectable persistence port into the
+ * `CredentialStoreBackendV1` that `createHostSideCredentialResolverV1` already
+ * consumes. The resolver contract is unchanged.
+ *
+ * Fail-closed rules: an unready backend, an unknown record, a wrong/absent
+ * KEK, or any tampered ciphertext/nonce/tag/AAD component throws a stable
+ * `CredentialResolutionError`. Nothing here ever returns "absent" in place of
+ * an authentication failure, and nothing ever falls back to another backend or
+ * to plaintext. Plaintext DEKs and field values are overwritten in `finally` on
+ * a best-effort basis (Node/V8 cannot guarantee erasure).
+ */
+interface VaultCredentialStoreOptionsV1$1 {
+    readonly kmsBackend: WorkspaceKekProviderV1;
+    readonly persistence: CredentialVaultPersistenceV2;
+    readonly versionAnchor: WorkspaceCredentialVersionAnchorV2;
+}
+interface WriteCredentialFieldsInputV1 {
+    readonly workspaceId: string;
+    readonly providerId: ProviderId;
+    readonly credentialId?: string;
+    readonly fields: ReadonlyMap<CredentialFieldId, Uint8Array>;
+    readonly metadata?: Readonly<{
+        displayLabel?: string;
+        credentialType?: string;
+        maskedLastFourSuffix?: string;
+    }>;
+}
+interface VaultCredentialStoreBackendV1 extends CredentialStoreBackendV1 {
+    read(workspaceId: string, providerId: ProviderId, allowedFieldIds: readonly CredentialFieldId[], options?: WorkspaceCredentialLockOptionsV1): Promise<ResolvedCredentialMaterialV1 & {
+        credentialVersion: number;
+    }>;
+    /** Cross-process workspace serialization for Pi CredentialStore.modify(). */
+    withWorkspaceLock<T>(workspaceId: string, mutate: (locked: VaultCredentialStoreBackendV1) => Promise<T>, options?: WorkspaceCredentialLockOptionsV1): Promise<T>;
+    /**
+     * Writes (or rotates to) a new credential version for a workspace/provider.
+     * Every write mints a fresh credential version; nonces are never reused.
+     */
+    writeCredentialFields(input: WriteCredentialFieldsInputV1): Promise<StoredCredentialRecordV1>;
+    /** Marks a workspace/provider credential as deliberately field-less. */
+    writeAbsentCredential(workspaceId: string, providerId: ProviderId, options?: WorkspaceCredentialLockOptionsV1): Promise<StoredCredentialRecordV1>;
+    getCredentialMetadata(workspaceId: string, providerId: ProviderId): Promise<StoredCredentialMetadataV1 | undefined>;
+    listCredentialMetadata(workspaceId: string): Promise<readonly StoredCredentialMetadataV1[]>;
+    setCredentialLifecycleState(workspaceId: string, providerId: ProviderId, state: CredentialLifecycleStateV1): Promise<StoredCredentialMetadataV1>;
+    /** Rotates the KEK wrapping for one workspace DEK generation in place. */
+    rewrapWorkspaceDek(workspaceId: string, dekGeneration: number): Promise<void>;
+    /** Re-encrypts all live workspace credentials under a fresh DEK generation. */
+    rotateWorkspaceDek(workspaceId: string, operationId: string): Promise<number>;
+    /** Irreversibly destroys workspace credential key access and fails closed thereafter. */
+    cryptoShredWorkspace(workspaceId: string): Promise<void>;
+}
+declare function createVaultCredentialStoreBackendV1(options: VaultCredentialStoreOptionsV1$1): VaultCredentialStoreBackendV1;
+
 /**
  * uv setup for Python-family runtimes (e.g. Vercel `python3.13`), which already
  * ship `pip` and usually `uv`. Verify-or-install via the on-PATH `uv`.
@@ -408,10 +666,9 @@ declare class FleetConfigError extends Error {
  * descriptors, `.agents/factory/policy.yaml` `models.seats` tiers, and the
  * priority-ordered `models.tiers` candidates declared in fleet.yaml.
  *
- * Fails startup when any configured seat cannot materialize or verify. Only
- * genuinely unseated discovered packages remain nonfatal diagnostics. Whole-
- * fleet config errors (including unreadable/malformed fleet or policy YAML)
- * throw `FleetConfigError`.
+ * Excludes an individual package when a configured seat cannot materialize or
+ * verify, allowing valid sibling seats to boot. Whole-fleet config errors
+ * (including unreadable/malformed fleet or policy YAML) throw `FleetConfigError`.
  */
 declare function loadConfiguredAgentFleet(options: LoadConfiguredAgentFleetOptions): Promise<LoadConfiguredAgentFleetResult>;
 
@@ -467,9 +724,10 @@ interface ResolveDefaultAgentFleetOptions {
  * Resolves one deployment-static fleet for Core, Workspace, and CLI hosts.
  *
  * The built-in default is a regular configured Agent. When authored fleet
- * discovery is enabled it remains available alongside discovered seats so old
- * `default` session references stay routable. Invalid enabled fleet
- * composition fails boot; it never degrades to a pseudo-Agent.
+ * discovery is enabled it remains available alongside valid discovered seats
+ * so old `default` session references stay routable. Missing fleet config and
+ * individual package failures degrade to that valid subset; malformed whole-
+ * fleet configuration still rejects boot.
  */
 declare function resolveDefaultAgentFleet(options: ResolveDefaultAgentFleetOptions): Promise<readonly AgentHostAgentSpec[]>;
 
@@ -812,6 +1070,7 @@ interface CreateStandaloneAgentHostAppOptions {
     sessionNamespace?: string;
     telemetry?: TelemetrySink;
     metering?: AgentMeteringSink;
+    credentials?: AgentHostCredentialOptionsV1;
     getFilesystemBindings?: (ctx: {
         request?: FastifyRequest;
         sessionId?: string;
@@ -875,6 +1134,441 @@ interface CreateStandaloneAgentHostAppOptions {
 /** Thin standalone HTTP shell over one directly composed CreatedAgentHost. */
 declare function createStandaloneAgentHostApp(options?: CreateStandaloneAgentHostAppOptions): Promise<FastifyInstance>;
 
+type ChannelBindingStatus = 'active' | 'revoked';
+type ChannelInboundStatus = 'pending' | 'processing' | 'processed' | 'parked';
+type ChannelOutboundStatus = 'active' | 'parked';
+interface ChannelBinding {
+    readonly channel: string;
+    readonly conversationKey: string;
+    readonly agentTypeId: string;
+    readonly workspaceId: string;
+    readonly authSubjectId: string;
+    readonly bindingVersion: number;
+    readonly status: ChannelBindingStatus;
+    readonly sessionKey?: string;
+    readonly lastInboundAt?: number;
+    readonly outboundCursor: string;
+    readonly outboundStatus: ChannelOutboundStatus;
+    readonly sessionResetPending: boolean;
+    readonly templateSentForInboundAt?: number;
+}
+interface ProvisionChannelBindingInput extends Omit<ChannelBinding, 'bindingVersion' | 'status' | 'lastInboundAt' | 'outboundCursor' | 'outboundStatus' | 'sessionResetPending' | 'templateSentForInboundAt'> {
+    readonly status?: ChannelBindingStatus;
+    /** Tail of an existing target stream; omitted only for a new/empty session. */
+    readonly outboundCursor?: string;
+}
+interface InboundChannelMessage {
+    readonly channel: string;
+    readonly conversationKey: string;
+    readonly providerMessageId: string;
+    readonly text: string;
+    readonly receivedAt: number;
+}
+interface QueuedChannelInbound extends InboundChannelMessage {
+    readonly id: number;
+    readonly agentTypeId: string;
+    readonly workspaceId: string;
+    readonly authSubjectId: string;
+    readonly bindingVersion: number;
+    readonly claimOwner: string;
+    readonly attempts: number;
+    readonly status: ChannelInboundStatus;
+    readonly errorCode?: string;
+}
+type EnqueueInboundResult = {
+    readonly disposition: 'enqueued';
+    readonly binding: ChannelBinding;
+    readonly queueId: number;
+} | {
+    readonly disposition: 'duplicate';
+    readonly binding?: ChannelBinding;
+} | {
+    readonly disposition: 'unknown_binding';
+};
+interface ChannelIntentionRecord {
+    readonly questionId: string;
+    readonly sessionId: string;
+    readonly channel: string;
+    readonly conversationKey: string;
+    readonly agentTypeId: string;
+    readonly bindingVersion: number;
+    readonly fieldName: string;
+    readonly options: readonly {
+        value: string;
+        label: string;
+        description?: string;
+    }[];
+    readonly title?: string;
+    readonly context?: string;
+    readonly status: 'pending' | 'projecting' | 'window-held' | 'projected' | 'answering' | 'answered' | 'closed';
+    readonly answerValues?: Readonly<Record<string, unknown>>;
+    readonly answerProviderMessageId?: string;
+}
+type ClaimIntentionReplyResult = {
+    readonly disposition: 'claimed';
+    readonly intention: ChannelIntentionRecord;
+} | {
+    readonly disposition: 'duplicate';
+} | {
+    readonly disposition: 'no_intention';
+};
+type ClaimInvalidIntentionReplyResult = {
+    readonly disposition: 'claimed';
+} | {
+    readonly disposition: 'duplicate';
+} | {
+    readonly disposition: 'no_intention';
+};
+type NextInboundResult = {
+    readonly disposition: 'claimed';
+    readonly inbound: QueuedChannelInbound;
+} | {
+    readonly disposition: 'blocked';
+    readonly retryAt: number;
+} | {
+    readonly disposition: 'empty';
+};
+interface EnsureSessionOptions {
+    readonly reservationTtlMs?: number;
+    readonly maxReservationCycles?: number;
+    readonly initialBackoffMs?: number;
+    readonly allocate: () => Promise<string>;
+    readonly admit: (sessionKey: string) => Promise<void>;
+}
+declare class ChannelSessionCreateTimeoutError extends Error {
+    readonly code: "SESSION_CREATE_TIMEOUT";
+    constructor(channel: string, conversationKey: string, agentTypeId: string);
+}
+declare class ChannelBindingStore {
+    private readonly sql;
+    private readonly runTransaction;
+    constructor(sql: SqlStorage, runTransaction: RunTransaction);
+    private migrate;
+    private ensureColumn;
+    provision(input: ProvisionChannelBindingInput): ChannelBinding;
+    getBinding(channel: string, conversationKey: string, agentTypeId: string): ChannelBinding | undefined;
+    enqueueInbound(message: InboundChannelMessage, agentTypeId: string): EnqueueInboundResult;
+    recordIntentionInboundActivity(binding: Pick<ChannelBinding, 'channel' | 'conversationKey' | 'agentTypeId' | 'bindingVersion'>, receivedAt: number): ChannelBinding | undefined;
+    activeBindings(): ChannelBinding[];
+    bindingForSession(sessionId: string, workspaceId: string): ChannelBinding | undefined;
+    recordIntention(input: Omit<ChannelIntentionRecord, 'status'>): boolean;
+    openIntentions(): ChannelIntentionRecord[];
+    terminalIntention(channel: string, conversationKey: string, agentTypeId: string): ChannelIntentionRecord | undefined;
+    activeIntention(channel: string, conversationKey: string, agentTypeId: string): ChannelIntentionRecord | undefined;
+    claimIntentionProjection(questionId: string, owner: string, ttlMs?: number): ChannelIntentionRecord | undefined;
+    holdIntentionForWindow(questionId: string, owner: string): boolean;
+    releaseWindowHeldIntentions(binding: Pick<ChannelBinding, 'channel' | 'conversationKey' | 'agentTypeId' | 'bindingVersion'>): void;
+    ownsIntentionClaim(questionId: string, owner: string): boolean;
+    renewIntentionClaim(questionId: string, owner: string, ttlMs?: number): boolean;
+    completeIntentionProjection(questionId: string, owner: string): boolean;
+    claimIntentionReply(intention: ChannelIntentionRecord, providerMessageId: string, values: Readonly<Record<string, unknown>>, owner: string, ttlMs?: number): ClaimIntentionReplyResult;
+    claimRecoverableIntentionAnswer(questionId: string, owner: string, ttlMs?: number): ChannelIntentionRecord | undefined;
+    completeIntentionAnswer(questionId: string, owner: string): boolean;
+    reconcileIntentionAnswered(questionId: string): void;
+    reconcileIntentionClosed(questionId: string): void;
+    claimInvalidIntentionReply(intention: ChannelIntentionRecord, providerMessageId: string, owner: string, ttlMs?: number): ClaimInvalidIntentionReplyResult;
+    completeInvalidIntentionReply(channel: string, providerMessageId: string, owner: string): boolean;
+    pendingInvalidIntentionReplies(): Array<{
+        intention: ChannelIntentionRecord;
+        providerMessageId: string;
+        retryAt: number;
+    }>;
+    hasIntentionReply(channel: string, providerMessageId: string): boolean;
+    claimOutbound(binding: ChannelBinding, owner: string, claimTtlMs?: number): boolean;
+    outboundClaimRetryAt(binding: ChannelBinding): number | undefined;
+    ownsOutboundClaim(owner: string): boolean;
+    renewOutbound(owner: string, claimTtlMs?: number): boolean;
+    releaseOutbound(owner: string): void;
+    parkOutboundBinding(binding: ChannelBinding, claimOwner: string, errorCode: string): boolean;
+    compareAndSetOutboundCursor(binding: ChannelBinding, claimOwner: string, nextCursor: string): boolean;
+    markTemplateSent(binding: ChannelBinding, claimOwner: string): boolean;
+    parkOutbound(binding: ChannelBinding, claimOwner: string, terminalOffset: string, errorCode: string): boolean;
+    acknowledgeSessionReset(binding: ChannelBinding, claimOwner: string): boolean;
+    markSessionGone(binding: ChannelBinding, claimOwner: string): boolean;
+    pendingBindings(): ChannelBinding[];
+    nextPending(channel: string, conversationKey: string, agentTypeId: string, claimOwner: string, claimTtlMs?: number): NextInboundResult;
+    renewInbound(id: number, claimOwner: string, claimTtlMs?: number): boolean;
+    completeInbound(id: number, claimOwner: string): boolean;
+    retryInbound(id: number, claimOwner: string, errorCode: string): void;
+    parkInbound(id: number, errorCode: string, claimOwner?: string): void;
+    getInbound(id: number): QueuedChannelInbound | undefined;
+    ensureSession(binding: ChannelBinding, options: EnsureSessionOptions): Promise<{
+        sessionKey: string;
+        created: boolean;
+    }>;
+    private readCreation;
+    private claimCreation;
+    private transitionCreation;
+    private finishCreation;
+    private recoverAdmitting;
+}
+
+declare const CHANNEL_UNKNOWN_BINDING: "CHANNEL_UNKNOWN_BINDING";
+declare const CHANNEL_INBOUND_PARKED: "CHANNEL_INBOUND_PARKED";
+interface ChannelAdapter {
+    readonly channelId: string;
+    parseInbound(request: Request): Promise<readonly InboundChannelMessage[]>;
+    renderOutbound(turn: unknown): readonly unknown[];
+    send(message: unknown): Promise<void>;
+}
+/**
+ * Trusted, host-injected seam. Implementations resolve workspace membership
+ * from the binding and never receive the adapter-owned conversation key.
+ */
+interface ChannelAgentInvoker {
+    createSession(input: {
+        readonly workspaceId: string;
+        readonly authSubjectId: string;
+        readonly agentTypeId: string;
+        readonly originChannel: OriginChannel;
+        /** Stable opaque id for replaying this binding generation's allocation. */
+        readonly requestId: string;
+    }): Promise<string>;
+    isSessionBusy(input: {
+        readonly workspaceId: string;
+        readonly authSubjectId: string;
+        readonly agentTypeId: string;
+        readonly sessionKey: string;
+    }): Promise<boolean>;
+    /**
+     * Implementations MUST durably deduplicate requestId and serialize
+     * deliverySequence for a session before resolving. This is the downstream
+     * fence that makes an expired queue lease safe to replay.
+     */
+    prompt(input: ChannelAgentInvocation): Promise<void>;
+    /** Same durable idempotency and sequence contract as prompt. */
+    followUp(input: ChannelAgentInvocation): Promise<void>;
+}
+interface ChannelAgentInvocation {
+    readonly workspaceId: string;
+    readonly authSubjectId: string;
+    readonly agentTypeId: string;
+    readonly sessionKey: string;
+    readonly requestId: string;
+    /** Monotonic durable queue id; stale/lower deliveries must be a no-op. */
+    readonly deliverySequence: number;
+    readonly text: string;
+}
+type ChannelInboundAck = {
+    readonly accepted: true;
+    readonly duplicate: boolean;
+    readonly code: typeof ErrorCode.enum.CHANNEL_INBOUND_ACCEPTED;
+} | {
+    readonly accepted: false;
+    readonly duplicate: boolean;
+    readonly code: typeof CHANNEL_UNKNOWN_BINDING;
+};
+declare class ChannelInboundService {
+    private readonly store;
+    private readonly invoker;
+    private readonly options;
+    private readonly drains;
+    private readonly retryTimers;
+    private readonly claimOwner;
+    private disposed;
+    constructor(store: ChannelBindingStore, invoker: ChannelAgentInvoker, options?: {
+        readonly maxAttempts?: number;
+        readonly inboundClaimTtlMs?: number;
+        readonly drainRetryMs?: number;
+        /** Called after durable completion, including work resumed at startup. */
+        readonly onInboundDelivered?: (binding: ChannelBinding) => void;
+    });
+    /** Durable enqueue is the acknowledgement boundary; agent work stays async. */
+    accept(message: InboundChannelMessage, agentTypeId: string): ChannelInboundAck;
+    waitForIdle(): Promise<void>;
+    dispose(): Promise<void>;
+    resume(binding: ChannelBinding): void;
+    private scheduleDrain;
+    private drain;
+}
+
+interface ChannelIntentionOption {
+    readonly value: string;
+    readonly label: string;
+    readonly description?: string;
+}
+interface ChannelIntentionQuestion {
+    readonly questionId: string;
+    readonly sessionId: string;
+    readonly ownerPrincipalId: string;
+    readonly status: 'ready' | 'answered' | 'cancelled' | 'abandoned';
+    readonly title?: string;
+    readonly context?: string;
+    readonly schema?: {
+        readonly wireVersion: 1;
+        readonly fields: readonly ChannelIntentionField[];
+    };
+}
+type ChannelIntentionField = {
+    readonly type: string;
+    readonly name: string;
+    readonly label: string;
+    readonly options?: readonly ChannelIntentionOption[];
+};
+interface ChannelIntentionRuntime {
+    /** Trusted workspace scope owning this ask_user store. */
+    readonly workspaceId: string;
+    listPending(): Promise<readonly ChannelIntentionQuestion[]>;
+    getByQuestionId(questionId: string): Promise<ChannelIntentionQuestion | null>;
+    submitAnswer(questionId: string, sessionId: string, values: Readonly<Record<string, string>>): Promise<unknown>;
+    subscribe(listener: () => void): () => void;
+}
+interface ChannelIntentionSource {
+    listPending(): Promise<readonly ChannelIntentionQuestion[]>;
+    getByQuestionId(questionId: string): Promise<ChannelIntentionQuestion | null>;
+    subscribe(listener: (...args: readonly unknown[]) => void): () => void;
+}
+/** Adapts the real ask_user store/runtime pair without introducing a package cycle. */
+declare function createChannelIntentionRuntime(workspaceId: string, source: ChannelIntentionSource, answers: Pick<ChannelIntentionRuntime, 'submitAnswer'>): ChannelIntentionRuntime;
+interface ChannelIntentionAdapter {
+    readonly serviceWindowMs?: number;
+    send(input: {
+        readonly conversationKey: string;
+        readonly text: string;
+    }): Promise<void>;
+    sendWindowTemplate?(input: {
+        readonly conversationKey: string;
+    }): Promise<void>;
+}
+type ChannelIntentionAck = {
+    readonly handled: false;
+} | {
+    readonly handled: true;
+    readonly accepted: boolean;
+    readonly duplicate: boolean;
+    readonly questionId?: string;
+};
+type ChannelMessageAck = {
+    readonly kind: 'intention';
+    readonly ack: Exclude<ChannelIntentionAck, {
+        handled: false;
+    }>;
+} | {
+    readonly kind: 'agent';
+    readonly ack: ChannelInboundAck;
+};
+interface ChannelIntentionServiceOptions {
+    readonly claimTtlMs?: number;
+    readonly retryDelayMs?: number;
+}
+/**
+ * Projects answerable ask_user questions to a bound channel and routes one
+ * reply back into the same durable Human Intention. The runtime is an injected
+ * seam so the channel core does not depend on the ask-user plugin package.
+ */
+declare class ChannelIntentionService {
+    private readonly store;
+    private readonly runtime;
+    private readonly adapters;
+    private readonly options;
+    private readonly owner;
+    private scan?;
+    private rescan;
+    private timer?;
+    private unsubscribe?;
+    private disposed;
+    constructor(store: ChannelBindingStore, runtime: ChannelIntentionRuntime, adapters: ReadonlyMap<string, ChannelIntentionAdapter>, options?: ChannelIntentionServiceOptions);
+    start(): void;
+    waitForIdle(): Promise<void>;
+    dispose(): Promise<void>;
+    notifyInbound(binding: {
+        channel: string;
+        conversationKey: string;
+        agentTypeId: string;
+        bindingVersion: number;
+    }): void;
+    accept(message: InboundChannelMessage, agentTypeId: string): Promise<ChannelIntentionAck>;
+    private schedule;
+    private scanOnce;
+    private consumeAnswer;
+    private armRetry;
+}
+/** Canonical ingress composition: approval replies never fall through to the agent prompt queue. */
+declare class ChannelMessageRouter {
+    private readonly intentions;
+    private readonly inbound;
+    constructor(intentions: ChannelIntentionService, inbound: ChannelInboundService);
+    accept(message: InboundChannelMessage, agentTypeId: string): Promise<ChannelMessageAck>;
+}
+
+declare const CHANNEL_OUTBOUND_PARKED: "CHANNEL_OUTBOUND_PARKED";
+declare const CHANNEL_TURN_STALLED: "CHANNEL_TURN_STALLED";
+interface ChannelOutboundTurn {
+    readonly turnId: string;
+    readonly status: 'ok' | 'aborted' | 'error' | 'stalled';
+    readonly text: string;
+}
+interface ChannelOutboundAdapter<Message = unknown> {
+    /** Adapter-owned delivery constraint; omit for channels without a service window. */
+    readonly serviceWindowMs?: number;
+    renderOutbound(turn: ChannelOutboundTurn): readonly Message[];
+    send(input: {
+        readonly conversationKey: string;
+        readonly message: Message;
+    }): Promise<void>;
+    sendWindowTemplate?(input: {
+        readonly conversationKey: string;
+    }): Promise<void>;
+}
+interface ChannelOutboundRuntime {
+    /** Returns undefined only when the persisted session no longer exists. */
+    resolveStreamPath(binding: ChannelBinding): Promise<string | undefined>;
+    createSession(binding: ChannelBinding): Promise<string>;
+}
+interface ChannelOutboundServiceOptions {
+    readonly maxSendAttempts?: number;
+    readonly retryDelayMs?: number;
+    readonly stallTimeoutMs?: number;
+    readonly outboundClaimTtlMs?: number;
+    readonly now?: () => number;
+}
+interface AssembledTurn {
+    readonly turn: ChannelOutboundTurn;
+    readonly terminalOffset: string;
+}
+declare class ChannelOutboundService<Message = unknown> {
+    private readonly store;
+    private readonly events;
+    private readonly runtime;
+    private readonly adapters;
+    private readonly options;
+    private readonly drains;
+    private readonly pendingDrains;
+    private readonly subscriptions;
+    private readonly stallTimers;
+    private readonly claimTimers;
+    private disposed;
+    constructor(store: ChannelBindingStore, events: EventStreamStore, runtime: ChannelOutboundRuntime, adapters: ReadonlyMap<string, ChannelOutboundAdapter<Message>>, options?: ChannelOutboundServiceOptions);
+    start(): void;
+    notifyInbound(binding: ChannelBinding): void;
+    waitForIdle(): Promise<void>;
+    dispose(): Promise<void>;
+    private schedule;
+    private drain;
+    private readUnreadEvents;
+    private scheduleClaimRetry;
+    private ensureSubscription;
+    private scheduleStall;
+    private clearStall;
+    private sendWindowTemplate;
+    private sendWithRetry;
+    private resolveStreamPath;
+    private current;
+    private isInsideServiceWindow;
+    private stallTimeoutMs;
+    private now;
+}
+declare function assembleNextTurn(entries: ReadonlyArray<{
+    data: unknown;
+    offset: string;
+}>, now?: number, stallTimeoutMs?: number): AssembledTurn | undefined;
+declare function shapeChannelText(text: string, dialect: string, maxLength?: number): string[];
+
+declare const CHANNELS_ENV_FLAG = "BORING_AGENT_CHANNELS";
+declare const CHANNEL_DURABLE_STREAM_REQUIRED: "CHANNEL_DURABLE_STREAM_REQUIRED";
+declare function areChannelsEnabled(): boolean;
+declare function assertChannelDurability(durableStreamEnabled: boolean): void;
+
 interface AgentHostEnvironmentHttpProjectionOptions {
     readonly created: CreatedAgentHost;
     readonly authorizeAgentRequest: (request: FastifyRequest) => Promise<AuthorizedAgentScope>;
@@ -894,9 +1588,14 @@ interface EnvironmentProvisioningSnapshot {
     readonly skillPaths: readonly string[];
 }
 interface EnvironmentLease {
+    /** Opaque immutable identity for this exact provider/provisioning generation. */
+    readonly generationId: string;
     readonly bundle: RuntimeBundle;
     /** One immutable Environment-owned snapshot shared by every compatible Agent binding. */
     readonly provisioning?: EnvironmentProvisioningSnapshot;
+    readonly signal: AbortSignal;
+    /** Retains this exact generation; never resolves the workspace's current generation. */
+    retain(): EnvironmentLease;
     release(): void;
     retire(): Promise<void>;
 }
@@ -930,9 +1629,7 @@ type HarnessWatchResult = {
  */
 interface AgentHarnessBackend {
     listSessions(scope: HarnessAgentScope, ctx: HarnessRequestContext, options?: SessionListOptions): Promise<SessionSummary[]>;
-    createSession(scope: HarnessAgentScope, ctx: HarnessRequestContext, init?: {
-        title?: string;
-    }): Promise<SessionSummary>;
+    createSession(scope: HarnessAgentScope, ctx: HarnessRequestContext, init?: SessionCreateInit): Promise<SessionSummary>;
     readSnapshot(address: HarnessSessionAddress, ctx: HarnessRequestContext): Promise<PiChatSnapshot>;
     watchEvents(address: HarnessSessionAddress, ctx: HarnessRequestContext, cursor: number, subscriber: (event: PiChatEvent) => void): Promise<HarnessWatchResult>;
     submitPrompt(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: AgentPromptPayload): Promise<PromptReceipt>;
@@ -946,6 +1643,34 @@ interface AgentHarnessBackend {
     close(): Promise<void>;
 }
 
+type PiLlmAuthKindV1 = 'api-key' | 'oauth';
+interface PiDerivedLlmProviderV1 {
+    readonly providerId: ProviderId;
+    readonly displayName: string;
+    /** Auth kinds pi supports for this provider; metadata for later slices. */
+    readonly authKinds: readonly PiLlmAuthKindV1[];
+    readonly egressOrigins: readonly `https://${string}`[];
+    readonly bindingId: CredentialConsumerBindingId;
+}
+/**
+ * Narrowed per-binding surface. Runtime bindings only ever see registries and
+ * the pre-bound resolver; the raw vault backend (plaintext write path) and
+ * resolver minting stay host-scope-only on the full composition.
+ */
+interface WorkspaceCredentialRuntimeViewV1 {
+    readonly providerRegistry: ProviderRegistryV1;
+    readonly bindingRegistry: CredentialConsumerBindingRegistryV1;
+    readonly catalog: readonly PiDerivedLlmProviderV1[];
+    readonly skippedProviderIds: readonly string[];
+    /** Present when an authority verifier was supplied at composition time. */
+    readonly resolver?: WorkspaceCredentialResolverV1;
+    /** Actor-bound Pi credential store; workspace identity is fixed at construction. */
+    createPiCredentialStore(workspaceId: string, userId: string | undefined, options: {
+        readonly allowSubscriptionOAuth: boolean;
+        readonly revokedOAuthReplacementVersion?: number;
+    }): CredentialStore;
+}
+
 interface BuiltAgentComposition {
     readonly harness: AgentHarness;
     readonly sessionStore: SessionStore;
@@ -959,6 +1684,14 @@ interface BuiltAgentComposition {
         userId?: string;
         requestId?: string;
     }) => Promise<readonly RuntimeFilesystemBinding[]>;
+    /**
+     * [1082 slice B] Narrowed per-binding credential view (registries + the
+     * pre-bound resolver). Present only when `BORING_CREDENTIAL_KMS_BACKEND`
+     * selected a backend at host startup. The raw vault backend and resolver
+     * minting stay on the host-scope composition and are deliberately not
+     * exposed here.
+     */
+    readonly credentials?: WorkspaceCredentialRuntimeViewV1;
     dispose(): Promise<void>;
 }
 
@@ -982,6 +1715,8 @@ interface RuntimeBinding {
     readonly key: string;
     readonly agentTypeId: string;
     readonly workspaceScopeId: string;
+    readonly authSubjectId: string;
+    readonly fundingPolicy: AgentInvocationFundingPolicyV1;
     readonly generation: number;
     readonly scope: ResolvedAgentRuntimeScope;
     readonly environmentLease: EnvironmentLease;
@@ -1007,8 +1742,8 @@ interface AgentHostRuntime {
     acquireResolvedEnvironment(workspaceScopeId: string, environment: AgentHostEnvironmentScope): Promise<EnvironmentLease>;
     resolveSessionRuntime(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, sessionId: string): Promise<ResolvedAgentRuntimeScope | undefined>;
     resolveAgentRuntimeScope(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, operation: 'new-binding' | 'existing-session' | 'reload', requestId: string, sessionId?: string): Promise<ResolvedAgentRuntimeScope>;
-    resolveBinding(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, resolvedRuntimeScope?: ResolvedAgentRuntimeScope): Promise<RuntimeBinding>;
-    findPublishedCurrentBinding(agentTypeId: string, workspaceScopeId: string, physicalBindingIdentity: string, bindingIdentity?: string, provisioningFingerprint?: string): RuntimeBinding | undefined;
+    resolveBinding(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, resolvedRuntimeScope?: ResolvedAgentRuntimeScope, fundingPolicy?: AgentInvocationFundingPolicyV1): Promise<RuntimeBinding>;
+    findPublishedCurrentBinding(agentTypeId: string, workspaceScopeId: string, authSubjectId: string, physicalBindingIdentity: string, bindingIdentity?: string, provisioningFingerprint?: string, fundingPolicy?: AgentInvocationFundingPolicyV1): RuntimeBinding | undefined;
     startDrain(): void;
     drainRuntime(): Promise<void>;
     registerSubscription(close: () => void | Promise<void>): () => void;
@@ -1018,12 +1753,65 @@ interface AgentHostRuntime {
 }
 declare function createAgentHost(options: CreateAgentHostOptions): Promise<CreatedAgentHost>;
 
+declare const CHANNEL_RUNTIME_FILE_NAME = ".agent-channel-runtime.sqlite";
+interface AgentHostChannelStorage {
+    readonly bindings: ChannelBindingStore;
+    readonly events: EventStreamStore;
+    close(): void;
+}
+/**
+ * Opens the host-owned durable state shared by Agent Host event production and
+ * channel delivery. App hosts pass `events` to their Agent Host composition and
+ * the complete storage handle to {@link createAgentHostChannelRuntime}.
+ */
+declare function createAgentHostChannelStorage(input: {
+    readonly sessionRoot: string;
+    readonly fileName?: string;
+}): AgentHostChannelStorage;
+interface CreateAgentHostChannelRuntimeOptions<Message> {
+    readonly gateway: AgentGateway;
+    readonly storage: AgentHostChannelStorage;
+    /** Reissues an app-owned capability after validating the durable binding. */
+    readonly resolveAuthorizedScope: (binding: Pick<ChannelBinding, 'workspaceId' | 'authSubjectId' | 'agentTypeId'>) => Promise<AuthorizedAgentScope>;
+    readonly outboundAdapters: ReadonlyMap<string, ChannelOutboundAdapter<Message>>;
+    /** Workspace-scoped ask_user source/answer seam; omit only when channels cannot ask owners. */
+    readonly intentionRuntime?: ChannelIntentionRuntime;
+    readonly outbound?: ChannelOutboundServiceOptions;
+}
+interface AgentHostChannelRuntime<Message> {
+    readonly bindings: ChannelBindingStore;
+    readonly events: EventStreamStore;
+    readonly outboundAdapters: ReadonlyMap<string, ChannelOutboundAdapter<Message>>;
+    provision(input: ProvisionChannelBindingInput): ChannelBinding;
+    /** Durable enqueue is the acknowledgement boundary; delivery continues asynchronously. */
+    acceptInbound(message: InboundChannelMessage, agentTypeId: string): ReturnType<ChannelInboundService['accept']> | ReturnType<ChannelMessageRouter['accept']>;
+    waitForIdle(): Promise<void>;
+    close(): Promise<void>;
+}
+/**
+ * Concrete, provider-neutral app-host composition for channel state, session
+ * invocation, durable event tails, outbound adapter lookup, restart recovery,
+ * and lifecycle disposal. Provider packages only supply adapters and webhook
+ * parsing; they never own workspace authority or durable state.
+ */
+declare function createAgentHostChannelRuntime<Message>(options: CreateAgentHostChannelRuntimeOptions<Message>): AgentHostChannelRuntime<Message>;
+
+declare const MIN_REQUEST_RETENTION_MS: number;
+interface SqliteAgentRequestLedgerOptions {
+    /** Terminal payload retention. Values below 24 hours are raised to the minimum. */
+    readonly retentionMs?: number;
+    /** Injectable clock for deterministic storage tests. */
+    readonly now?: () => number;
+}
 /** SQLite-backed atomic ownership/CAS ledger for direct and production projections. */
 declare class SqliteAgentRequestLedger implements AgentRequestLedger {
     readonly durability: "durable-transactional";
     private readonly database;
-    constructor(path: string);
-    prepare(key: AgentRequestKey, digest: string): Promise<AgentRequestLedgerPrepareResult>;
+    private readonly now;
+    private readonly retentionMs;
+    constructor(path: string, options?: SqliteAgentRequestLedgerOptions);
+    prepare(key: AgentRequestKey, digest: string, acceptedWork: AcceptedWorkContext): Promise<AgentRequestLedgerPrepareResult>;
+    markAdmissionRetryable(key: AgentRequestKey): Promise<void>;
     acceptAdmission(key: AgentRequestKey, admissionReceipt: string): Promise<void>;
     beginEffect(key: AgentRequestKey): Promise<void>;
     reject(key: AgentRequestKey, failure: AgentRequestFailure): Promise<void>;
@@ -1031,7 +1819,12 @@ declare class SqliteAgentRequestLedger implements AgentRequestLedger {
     markOutcomeUnknown(key: AgentRequestKey, error: AgentGatewayErrorDTO): Promise<void>;
     read(key: AgentRequestKey): Promise<AgentRequestLedgerRecord | undefined>;
     close(): void;
+    private migrateLegacyAcceptedWork;
     private readSync;
+    private readActiveSync;
+    private readTombstoneSync;
+    private pruneExpiredTerminalRows;
+    private immediateTransaction;
     private transition;
 }
 
@@ -1173,8 +1966,8 @@ declare class EmbeddedAgentGateway implements AgentGateway {
         readonly scope: AuthorizedAgentScope;
     }): Promise<{
         definition?: {
+            digest?: string | undefined;
             version: string;
-            digest: string;
         } | undefined;
         pluginIds?: string[] | undefined;
         agentTypeId: string;
@@ -1214,7 +2007,8 @@ declare class EmbeddedAgentGateway implements AgentGateway {
 declare class InMemoryAgentRequestLedger implements AgentRequestLedger {
     readonly durability: "in-memory";
     private readonly records;
-    prepare(key: AgentRequestKey, digest: string): Promise<AgentRequestLedgerPrepareResult>;
+    prepare(key: AgentRequestKey, digest: string, acceptedWork: AcceptedWorkContext): Promise<AgentRequestLedgerPrepareResult>;
+    markAdmissionRetryable(key: AgentRequestKey): Promise<void>;
     acceptAdmission(key: AgentRequestKey, admissionReceipt: string): Promise<void>;
     beginEffect(key: AgentRequestKey): Promise<void>;
     reject(key: AgentRequestKey, failure: AgentRequestFailure): Promise<void>;
@@ -1224,6 +2018,9 @@ declare class InMemoryAgentRequestLedger implements AgentRequestLedger {
     private transition;
 }
 
+/** Canonical, collision-safe projection. The complete request key is the run identity. */
+declare function projectAgentRequestRunId(key: AgentRequestKey): string;
+
 interface RuntimeScopeIdentityInput {
     readonly artifacts: readonly {
         readonly pluginId: string;
@@ -1410,35 +2207,72 @@ declare function resolveRuntimeReadonlyFilesystemAccess(policy: RuntimeReadonlyF
 /** Primary-user Operations adapter shared by HTTP and Pi filesystem tools. */
 declare function createUserFilesystemBinding(workspace: Workspace, policy: RuntimeReadonlyFilesystemPolicy, resolvePolicyPath: (path: string) => Promise<string>): RuntimeFilesystemBinding;
 
-interface CredentialStoreBackendV1 {
-    read(workspaceId: string, providerId: ProviderId, allowedFieldIds: readonly CredentialFieldId[]): Promise<ResolvedCredentialMaterialV1 & {
-        credentialVersion: number;
-    }>;
-}
-interface HostSideCredentialResolverOptionsV1 {
-    readonly authorityVerifier: WorkspaceCredentialAuthorityVerifierV1;
-    readonly bindingRegistry: CredentialConsumerBindingRegistryV1;
-    readonly providerRegistry: ProviderRegistryV1;
-    /**
-     * Storage boundary only. Vault/KmsBackend composition is deferred to bead
-     * 16f.2 and will implement this interface without changing the resolver.
-     */
-    readonly backend: CredentialStoreBackendV1;
-}
-interface InMemoryCredentialBackendEntryV1 {
+declare function withResolvedCredential<T>(resolver: WorkspaceCredentialResolverV1, workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1, fn: (lease: ResolvedCredentialLeaseV1) => T | Promise<T>): Promise<T>;
+
+/** Opaque, encrypted vault field containing Pi's canonical OAuth credential. */
+declare const PI_OAUTH_CREDENTIAL_FIELD_ID_V1: CredentialFieldId;
+interface VaultCredentialStoreOptionsV1 {
     readonly workspaceId: string;
-    readonly providerId: ProviderId;
-    readonly material: ResolvedCredentialMaterialV1;
-    readonly credentialVersion: number;
-}
-interface FakeAuthorityVerifierGrantV1 {
-    readonly scope: AuthorizedWorkspaceCredentialScopeV1;
-    readonly authority: VerifiedWorkspaceCredentialAuthorityV1;
+    /** Verified actor identity. Required whenever subscription OAuth is enabled. */
+    readonly userId?: string;
+    readonly vaultBackend: VaultCredentialStoreBackendV1;
+    /** Subscription OAuth is interactive-only; unattended seats set this false. */
+    readonly allowSubscriptionOAuth: boolean;
+    /** Login-only store's durable version fence for replacing a revoked OAuth tombstone. */
+    readonly revokedOAuthReplacementVersion?: number;
+    readonly allowedOAuthProviderIds?: readonly string[];
 }
-declare function createHostSideCredentialResolverV1(options: HostSideCredentialResolverOptionsV1): WorkspaceCredentialResolverV1;
-declare function createFakeAuthorityVerifierV1(grants: readonly FakeAuthorityVerifierGrantV1[]): WorkspaceCredentialAuthorityVerifierV1;
-declare function createInMemoryCredentialBackendV1(entries: readonly InMemoryCredentialBackendEntryV1[]): CredentialStoreBackendV1;
+/**
+ * Adapts Pi's async CredentialStore to one authorized workspace's encrypted
+ * vault. The adapter is actor-bound at construction and never accepts a
+ * workspace id from callers. Pi remains the sole owner of login and refresh.
+ */
+declare function createVaultCredentialStoreV1(options: VaultCredentialStoreOptionsV1): CredentialStore;
 
-declare function withResolvedCredential<T>(resolver: WorkspaceCredentialResolverV1, workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1, fn: (lease: ResolvedCredentialLeaseV1) => T | Promise<T>): Promise<T>;
+type SafeOAuthEventV1 = {
+    readonly type: 'auth_url';
+    readonly url: string;
+} | {
+    readonly type: 'device_code';
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly expiresInSeconds?: number;
+} | {
+    readonly type: 'progress';
+};
+interface SafeOAuthPromptV1 {
+    readonly type: AuthPrompt['type'];
+    readonly options?: readonly {
+        readonly id: string;
+        readonly label: string;
+    }[];
+}
+interface OAuthFlowSnapshotV1 {
+    readonly flowId: string;
+    readonly providerId: 'openai-codex';
+    readonly status: 'pending' | 'succeeded' | 'failed' | 'cancelled';
+    readonly events: readonly SafeOAuthEventV1[];
+    readonly prompt?: SafeOAuthPromptV1;
+    readonly createdAt: string;
+    readonly completedAt?: string;
+}
+interface CodexDisconnectResultV1 {
+    /** Pi logout is local credential orchestration; it does not currently attest upstream revocation. */
+    readonly logoutStatus: 'completed' | 'failed';
+    readonly upstreamStatus: 'pending';
+}
+interface OpenAiCodexOAuthBrokerV1 {
+    start(workspaceId: string, userId: string): Promise<OAuthFlowSnapshotV1>;
+    get(workspaceId: string, userId: string, flowId: string): OAuthFlowSnapshotV1 | undefined;
+    respond(workspaceId: string, userId: string, flowId: string, value: string): Promise<OAuthFlowSnapshotV1>;
+    cancel(workspaceId: string, userId: string, flowId: string): Promise<void>;
+    disconnect(workspaceId: string, userId: string): Promise<CodexDisconnectResultV1>;
+}
+interface OpenAiCodexOAuthBrokerOptionsV1 {
+    readonly credentialStoreForActor: (workspaceId: string, userId: string) => CredentialStore | Promise<CredentialStore>;
+    readonly createRuntime?: (credentials: CredentialStore) => Promise<Pick<ModelRuntime, 'login' | 'logout'>>;
+    readonly now?: () => number;
+}
+declare function createOpenAiCodexOAuthBrokerV1(options: OpenAiCodexOAuthBrokerOptionsV1): OpenAiCodexOAuthBrokerV1;
 
-export { AgentAccessDecision, AgentAccessOperation, AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentInstructionSource, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, DEFAULT_AGENT_FLEET, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, type FakeAuthorityVerifierGrantV1, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, type LegacyRequestLedgerLocation, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, ModeContext, type ModelTierCandidate, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolveRequestLedgerPathInput, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, type ResolvedInstructionFileRefs, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, VerifiedAgentScopeClaim, type WithheldInstructionRef, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createFakeAuthorityVerifierV1, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveAgentInstructionFileRefs, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRequestLedgerPath, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, sandboxRuntimeHostOperations, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };
+export { AgentAccessDecision, AgentAccessOperation, AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostChannelRuntime, type AgentHostChannelStorage, AgentHostCredentialOptionsV1, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentInstructionSource, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CHANNELS_ENV_FLAG, CHANNEL_DURABLE_STREAM_REQUIRED, CHANNEL_INBOUND_PARKED, CHANNEL_OUTBOUND_PARKED, CHANNEL_RUNTIME_FILE_NAME, CHANNEL_TURN_STALLED, CHANNEL_UNKNOWN_BINDING, type ChannelAdapter, type ChannelAgentInvocation, type ChannelAgentInvoker, type ChannelBinding, ChannelBindingStore, type ChannelInboundAck, ChannelInboundService, type ChannelIntentionAck, type ChannelIntentionAdapter, type ChannelIntentionField, type ChannelIntentionOption, type ChannelIntentionQuestion, type ChannelIntentionRecord, type ChannelIntentionRuntime, ChannelIntentionService, type ChannelIntentionServiceOptions, type ChannelIntentionSource, type ChannelMessageAck, ChannelMessageRouter, type ChannelOutboundAdapter, type ChannelOutboundRuntime, ChannelOutboundService, type ChannelOutboundServiceOptions, type ChannelOutboundTurn, ChannelSessionCreateTimeoutError, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, type CreateAgentHostChannelRuntimeOptions, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, CredentialVaultPersistenceV2, DEFAULT_AGENT_FLEET, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, type InboundChannelMessage, type LegacyRequestLedgerLocation, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, type LocalCredentialVersionAnchorOptionsV1, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, MIN_REQUEST_RETENTION_MS, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, ModeContext, type ModelTierCandidate, type OpenAiCodexOAuthBrokerV1, PI_OAUTH_CREDENTIAL_FIELD_ID_V1, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionChannelBindingInput, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, type QueuedChannelInbound, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolveRequestLedgerPathInput, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, type ResolvedInstructionFileRefs, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, StoredCredentialRecordV1, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, type VaultCredentialStoreBackendV1, type VaultCredentialStoreOptionsV1, VerifiedAgentScopeClaim, type WithheldInstructionRef, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, type WorkspaceCredentialVersionAnchorV1, type WorkspaceCredentialVersionAnchorV2, type WorkspaceCredentialVersionStateV1, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, areChannelsEnabled, assembleNextTurn, assertChannelDurability, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createAgentHostChannelRuntime, createAgentHostChannelStorage, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createChannelIntentionRuntime, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createInMemoryCredentialVaultPersistenceV1, createInMemoryCredentialVersionAnchorV1, createLocalCredentialVersionAnchorFromEnvV1, createLocalFileCredentialVersionAnchorV1, createLocalKekWorkspaceKekProviderFromEnvV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createOpenAiCodexOAuthBrokerV1, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createPostgresCredentialVaultPersistenceV1, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVaultCredentialStoreBackendV1, createVaultCredentialStoreV1, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, initializeLocalFileCredentialVersionAnchorV1, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAgentRequestRunId, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveAgentInstructionFileRefs, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRequestLedgerPath, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, runCredentialVaultPostgresMigrationsV1, sandboxRuntimeHostOperations, shapeChannelText, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };