@hachej/boring-agent 0.1.110 → 0.2.0

package/dist/server/index.d.ts

@@ -1,2278 +0,0 @@
-import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, C as CredentialVaultPersistenceV2, b as CredentialMaterialKindV1, c as WorkspaceCredentialLockOptionsV1, S as StoredCredentialRecordV1, d as StoredCredentialMetadataV1, R as RuntimeModeAdapter, e as RuntimeModeId, B as BuiltinRuntimeModeId, f as AgentRuntimeHostOperations, g as RuntimeBashStrategy, h as RuntimeFilesystemStrategy, M as ModeContext, i as WorkspaceProvisioningAdapter, j as AgentInstructionSource, k as ConfiguredAgentHostAgentSpec, l as AgentInstructionFileRef, m as AgentHostAgentSpec, n as RuntimeBundle, o as PiHarnessOptions, p as AgentMeteringSink, q as AgentHostCredentialOptionsV1, r as RuntimeFilesystemBinding, E as EventStreamStore, s as CreatedAgentHost, t as ResolvedPiHarnessOptions, u as ReadyStatusTracker, v as CreateAgentHostOptions, w as CompiledAgentHostAgentSpec, x as AgentRequestLedger, y as AgentEffectAdmission, z as AuthorizedEnvironmentIntent, D as AgentHostEnvironmentScope, F as ResolvedAgentRuntimeScope, G as AgentRequestKey, H as AcceptedWorkContext, I as AgentRequestLedgerPrepareResult, J as AgentRequestFailure, K as AgentRequestLedgerRecord, L as AgentFleetCompiler, N as AgentRequestTarget, O as RuntimeFilesystemAccessDecision } from '../types-DcWoQMn8.js';
-export { A as AgentGatewayEffect, Q as AgentHostDescription, T as AgentHostDirectProjectionOptions, U as AgentHostDispatcherRunInput, V as AgentHostEnvironmentLease, X as AgentHostHandle, Y as CredentialVaultPersistenceV1, Z as DEFAULT_AGENT_TYPE_ID, _ as MeteringErrorLogger, $ as MeteringReleaseInput, a0 as MeteringReleaseReason, a1 as MeteringReservationResult, a2 as MeteringReserveInput, a3 as MeteringRunKind, a4 as MeteringRunScope, a5 as MeteringRunStatus, a6 as MeteringSettleInput, a7 as MeteringUsage, a8 as MeteringUsageInput, a9 as PI_PACKAGE_RESOURCE_FILTERS, aa as PiExtensionFactory, ab as PluginSkillSource, ac as ResolvedEnvironmentScope, ad as RuntimeFilesystemBindingOperations, ae as RuntimeNodePackageSpec, af as RuntimeProvisioningContribution, ag as RuntimePythonSpec, ah as RuntimeTemplateContribution, ai as WorkspaceCredentialLifecycleV1, aj as WorkspaceProvisioningExecResult, ak as compactPiPackages, al as mergePiPackageSources, am as normalizeMeteringUsage, an as piPackageSourceKey } from '../types-DcWoQMn8.js';
-import { d as ExecOptions, a as ExecResult, W as WorkspaceChangeEvent, b as Workspace, c as Sandbox } from '../sandbox-BMhut3kh.js';
-export { h as RuntimeFilesystemCapability } from '../sandbox-BMhut3kh.js';
-import { b as RemoteWorkerHealthResponse, R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult, c as RemoteWorkerExecRequest } from '../middleware-CaAEXpi5.js';
-export { d as REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY, e as REMOTE_WORKER_PROVIDER, f as REMOTE_WORKER_RUNTIME_CWD, g as RemoteWorkerErrorPayload, h as RemoteWorkerExecResponse, i as RemoteWorkerFsEventEnvelope, W as WORKER_INTERNAL_TOKEN_HEADER, j as WORKER_REQUEST_ID_HEADER, k as WORKER_WORKSPACE_ID_HEADER, l as createAgentAuthMiddleware } from '../middleware-CaAEXpi5.js';
-import { SandboxProviderV1, WorkspaceSandboxPairV1 } from '@hachej/boring-sandbox/shared';
-import { BwrapSandboxProviderOptions } from '@hachej/boring-sandbox/providers/bwrap';
-import { r as ResolvedCredentialMaterialV1, k as CredentialConsumerBindingRegistryV1, W as WorkspaceCredentialResolverV1, t as SandboxHandleStore, C as CompiledAgentBundle, a as Sha256Digest, g as AgentDeployment, z as ShareEntryStore, P as ProviderCredentialRefV1, R as ResolvedCredentialLeaseV1 } from '../share-entry-CxS6UJ_L.js';
-import { H as ErrorCode, k as SessionCtx, O as OriginChannel, a as SessionListOptions, b as SessionSummary, U as SessionCreateInit, c as PiChatSnapshot, d as PiChatEvent, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt, S as SessionStore } from '../piChatEvent-DpE0lIb9.js';
-import { B as CredentialLifecycleStateV1, P as JsonValue, A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, g as AgentAccessOperation, f as AgentAccessDecision, k as AgentGatewayErrorDTO, r as AgentSessionSummary, q as AgentSessionStateSnapshot, n as AgentSessionConnection } from '../admin-DORVQfLn.js';
-export { T as ResolveAgentAccess, U as ResolveAgentAccessInput } from '../admin-DORVQfLn.js';
-import { d as AgentActor, j as AgentEvent, w as TelemetrySink, s as AgentTool, D as AgentHarnessFactory, A as AgentHarness } from '../harness-qHlMJhZo.js';
-export { u as AgentConfig, E as AgentHarnessFactoryInput } from '../harness-qHlMJhZo.js';
-import { IncomingMessage, ServerResponse } from 'node:http';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { FastifyRequest, FastifyInstance, FastifyPluginCallback } from 'fastify';
-import { i as PiSessionRequestContext, j as AgentPromptPayload, k as PiChatAttachmentResult } from '../piChatSessionService-CBct-hmz.js';
-import { P as ProviderId, I as WorkspaceKekProviderV1, a as CredentialFieldId, B as WorkspaceCredentialAuthorityVerifierV1, b as ProviderRegistryV1, t as WorkspaceAgentDirectRunInput, s as WorkspaceAgentDirectRunCallback, w as WorkspaceAgentDispatcherContext, v as WorkspaceAgentDispatcher, z as WorkspaceAgentGatewayBinding, C as CredentialConsumerBindingId, N as AgentInvocationFundingPolicyV1, A as AuthorizedWorkspaceCredentialScopeV1 } from '../file-search-BUgMSKZE.js';
-export { L as LeaseBoundWorkspaceAgent } from '../file-search-BUgMSKZE.js';
-import { CredentialStore, AuthPrompt } from '@earendil-works/pi-ai';
-import { SettingsManager, ModelRuntime } from '@mariozechner/pi-coding-agent';
-import postgres from 'postgres';
-import '@hachej/boring-bash/agent';
-import '@hachej/boring-sandbox/providers/node-workspace';
-import 'zod';
-
-interface SqlResult {
-    toArray(): Array<Record<string, unknown>>;
-}
-interface SqlStorage {
-    exec(query: string, ...bindings: unknown[]): SqlResult;
-}
-/**
- * `deferred` (SQLite's plain `BEGIN`) postpones acquiring any lock until the
- * first read or write inside the transaction. That is fine for read-only
- * transactions, but a transaction that reads THEN writes (e.g. a
- * check-then-insert) starts under a read lock and must upgrade to a write
- * lock mid-transaction — and SQLite refuses that upgrade with SQLITE_BUSY
- * immediately if another connection holds the write lock, WITHOUT honoring
- * `busy_timeout` (the busy handler only runs for the initial lock
- * acquisition, not a lock *upgrade*). `immediate` (`BEGIN IMMEDIATE`)
- * acquires the write lock up front, so `busy_timeout` applies normally and
- * a concurrent writer simply waits instead of erroring. Use `immediate` for
- * any transaction that writes — especially read-then-write — and reserve
- * `deferred` for genuinely read-only transactions.
- */
-type SqlTransactionMode = 'deferred' | 'immediate';
-type RunTransaction = <T>(fn: () => T, mode?: SqlTransactionMode) => T;
-
-declare function provisionWorkspaceRuntime(opts: ProvisionWorkspaceRuntimeOptions): Promise<WorkspaceProvisioningResult>;
-
-declare function createResourceSettingsManager(cwd: string, agentDir: string, piPackages: PiPackageSource[], options?: {
-    includePackage?: (source: PiPackageSource) => boolean;
-    includeConfiguredPackages?: boolean;
-}): SettingsManager;
-
-declare function createInMemoryCredentialVaultPersistenceV1(): CredentialVaultPersistenceV2;
-
-interface PostgresCredentialVaultPersistenceOptionsV1 {
-    /** Independently pooled connection used only to evict an uncertain lock holder. */
-    readonly evictionSql: postgres.Sql;
-    /** Default bound for advisory-lock acquisition. */
-    readonly lockAcquireTimeoutMs?: number;
-    /** Delay between non-blocking advisory-lock attempts. */
-    readonly lockPollIntervalMs?: number;
-    /** Bound for confirming advisory unlock before evicting the connection. */
-    readonly lockReleaseTimeoutMs?: number;
-}
-type Sql = postgres.Sql | postgres.TransactionSql;
-declare function createPostgresCredentialVaultPersistenceV1(sql: Sql, options: PostgresCredentialVaultPersistenceOptionsV1): CredentialVaultPersistenceV2;
-
-/** Deployment-owned schema registration for durable credential vault storage. */
-declare function runCredentialVaultPostgresMigrationsV1(sql: postgres.Sql): Promise<void>;
-
-interface WorkspaceCredentialVersionStateV1 {
-    readonly counter: number;
-    /** Monotonic irreversible fence; any positive value means the workspace was shredded. */
-    readonly cryptoShredGeneration: number;
-    /** Monotonic workspace-wide fence for replayed wrapped DEKs and records. */
-    readonly dekGeneration: number;
-    /** Authenticated idempotency receipts for completed DEK rotations. */
-    readonly dekRotationReceipts: Readonly<Record<string, number>>;
-    readonly credentialVersions: Readonly<Record<string, number>>;
-    readonly credentialMaterialKinds: Readonly<Record<string, CredentialMaterialKindV1>>;
-    readonly credentialFieldIds: Readonly<Record<string, readonly string[]>>;
-    readonly credentialLifecycleStates: Readonly<Record<string, CredentialLifecycleStateV1>>;
-    readonly credentialTypes: Readonly<Record<string, string>>;
-}
-interface PendingCredentialVersionMutationV1 {
-    readonly operationId: string;
-    readonly providerId: ProviderId;
-    readonly expectedStateDigest: string;
-    readonly nextStateDigest: string;
-    readonly nextCredentialVersion: number;
-    readonly nextCredentialMaterialKind: CredentialMaterialKindV1;
-    readonly nextCredentialFieldIds: readonly string[];
-    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
-    readonly nextCredentialType: string;
-    readonly nextDekGeneration: number;
-}
-interface CredentialVersionMutationStateV1 {
-    readonly nextCredentialVersion: number;
-    readonly nextCredentialMaterialKind: CredentialMaterialKindV1;
-    readonly nextCredentialFieldIds: readonly string[];
-    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
-    readonly nextCredentialType: string;
-    readonly nextDekGeneration: number;
-}
-interface CredentialVersionMutationResultV1<T> {
-    readonly nextCredentialVersion: number;
-    readonly nextCredentialMaterialKind: CredentialMaterialKindV1;
-    readonly nextCredentialFieldIds: readonly string[];
-    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
-    readonly nextCredentialType: string;
-    readonly nextDekGeneration: number;
-    readonly result: T;
-}
-/**
- * V2 write-ahead mutation contract. The anchor seals both authenticated digests
- * before invoking `commit`, then finalizes only after `commit` succeeds.
- */
-type CredentialVersionMutationResultV2<T> = CredentialVersionMutationStateV1 & {
-    readonly expectedStateDigest: string;
-    readonly nextStateDigest: string;
-    readonly commit: () => Promise<T>;
-};
-interface DekGenerationMutationResultV1<T> {
-    readonly nextDekGeneration: number;
-    readonly nextDekRotationOperationId: string;
-    readonly result: T;
-}
-interface CredentialLifecycleMutationResultV1<T> {
-    readonly nextCredentialLifecycleState: CredentialLifecycleStateV1;
-    readonly result: T;
-}
-interface CryptoShredMutationResultV1<T> {
-    readonly result: T;
-}
-interface CredentialVersionAnchorReadOptionsV1 {
-    /**
-     * A provider-list probe may treat a never-provisioned anchor file as empty
-     * only when persistence has no credential metadata. Existing malformed or
-     * unauthenticated anchor files still fail closed.
-     */
-    readonly allowUnprovisioned?: boolean;
-}
-type CredentialVersionAnchorReaderV1 = (options?: CredentialVersionAnchorReadOptionsV1) => Promise<WorkspaceCredentialVersionStateV1 | undefined>;
-interface WorkspaceCredentialVersionAnchorV1 {
-    read(workspaceId: string, options?: CredentialVersionAnchorReadOptionsV1): Promise<WorkspaceCredentialVersionStateV1 | undefined>;
-    /** Serializes a persistence inspection with anchor mutations. */
-    withReadLock<T>(workspaceId: string, inspect: (readLocked: CredentialVersionAnchorReaderV1) => Promise<T>): Promise<T>;
-    /**
-     * Holds the external workspace mutation lock through the supplied DB CAS.
-     * If the DB commit succeeds but advancing this external anchor fails, the
-     * mismatch deliberately fail-stops; accepting DB-ahead state would turn an
-     * attacker replay into an automatic rollback. S1 prefers security over
-     * availability here and does not claim cross-store crash atomicity.
-     */
-    withMutation<T>(workspaceId: string, providerId: ProviderId, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<CredentialVersionMutationResultV1<T>>): Promise<T>;
-    /** Authenticates a lifecycle-only state transition without minting a version. */
-    withLifecycleMutation<T>(workspaceId: string, providerId: ProviderId, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<CredentialLifecycleMutationResultV1<T>>): Promise<T>;
-    /**
-     * Irreversibly advances the authenticated external shred fence before
-     * destructive persistence finalization. Repeated calls retain the fence and
-     * re-run finalization so cleanup is recoverable and idempotent.
-     */
-    withCryptoShredMutation<T>(workspaceId: string, mutate: (current: WorkspaceCredentialVersionStateV1) => Promise<CryptoShredMutationResultV1<T>>): Promise<T>;
-    /** Advances the authenticated workspace DEK fence exactly one generation. */
-    withDekGenerationMutation<T>(workspaceId: string, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<DekGenerationMutationResultV1<T>>): Promise<T>;
-}
-/** Recovery-capable authority required by the durable vault backend. */
-interface WorkspaceCredentialVersionAnchorV2 extends WorkspaceCredentialVersionAnchorV1 {
-    readonly contractVersion: 'boring.workspace-credential-version-anchor.v2';
-    readPendingMutation(workspaceId: string, options?: CredentialVersionAnchorReadOptionsV1): Promise<PendingCredentialVersionMutationV1 | undefined>;
-    recoverPendingMutation(workspaceId: string, durableStateDigest: string): Promise<void>;
-    /**
-     * Holds the external workspace mutation lock through a write-ahead,
-     * KEK-authenticated intent, the supplied DB CAS, and anchor finalization.
-     * This is recoverable deferred commit, not cross-store atomicity.
-     */
-    withRecoverableMutation<T>(workspaceId: string, providerId: ProviderId, mutate: (current: WorkspaceCredentialVersionStateV1 | undefined) => Promise<CredentialVersionMutationResultV2<T>>): Promise<T>;
-}
-/** Test/development anchor. Production local-KEK composition uses the sealed file adapter. */
-declare function createInMemoryCredentialVersionAnchorV1(): WorkspaceCredentialVersionAnchorV2;
-interface LocalCredentialVersionAnchorOptionsV1 {
-    readonly anchorFilePath: string;
-    readonly loadKek: () => Promise<Uint8Array>;
-}
-/** Explicit one-time provisioning; refuses to replace an existing anchor. */
-declare function initializeLocalFileCredentialVersionAnchorV1(options: LocalCredentialVersionAnchorOptionsV1): Promise<void>;
-/**
- * Local-KEK rollback anchor. The pre-provisioned file lives on the
- * operator-controlled durable mount beside the KEK, never in Postgres or a
- * workspace. One counter advances per workspace; authenticated provider
- * context is necessary because unchanged providers legitimately trail it.
- *
- * S1 rejects a replayed DB current-version pointer. It only narrows exposure:
- * S2 makes exfiltrated old ciphertext cryptographically dead by destroying the
- * superseded DEK generation.
- */
-declare function createLocalFileCredentialVersionAnchorV1(options: LocalCredentialVersionAnchorOptionsV1): WorkspaceCredentialVersionAnchorV2;
-
-/**
- * Convenience composition for self-host deployments. Returns `undefined` when
- * the local-KEK backend was not explicitly selected; the caller must then fail
- * closed rather than substitute a default.
- */
-declare function createLocalKekWorkspaceKekProviderFromEnvV1(env: Readonly<Record<string, string | undefined>>): WorkspaceKekProviderV1 | undefined;
-declare function createLocalCredentialVersionAnchorFromEnvV1(env: Readonly<Record<string, string | undefined>>): WorkspaceCredentialVersionAnchorV2 | undefined;
-
-interface CredentialStoreBackendV1 {
-    read(workspaceId: string, providerId: ProviderId, allowedFieldIds: readonly CredentialFieldId[]): Promise<ResolvedCredentialMaterialV1 & {
-        credentialVersion: number;
-    }>;
-}
-interface HostSideCredentialResolverOptionsV1 {
-    readonly authorityVerifier: WorkspaceCredentialAuthorityVerifierV1;
-    readonly bindingRegistry: CredentialConsumerBindingRegistryV1;
-    readonly providerRegistry: ProviderRegistryV1;
-    /**
-     * Storage boundary only. Vault/KmsBackend composition is deferred to bead
-     * 16f.2 and will implement this interface without changing the resolver.
-     */
-    readonly backend: CredentialStoreBackendV1;
-}
-interface InMemoryCredentialBackendEntryV1 {
-    readonly workspaceId: string;
-    readonly providerId: ProviderId;
-    readonly material: ResolvedCredentialMaterialV1;
-    readonly credentialVersion: number;
-}
-declare function createHostSideCredentialResolverV1(options: HostSideCredentialResolverOptionsV1): WorkspaceCredentialResolverV1;
-declare function createInMemoryCredentialBackendV1(entries: readonly InMemoryCredentialBackendEntryV1[]): CredentialStoreBackendV1;
-
-/**
- * Composes a `WorkspaceKekProviderV1` (KmsBackend) with AAD-bound AES-256-GCM
- * field crypto and an injectable persistence port into the
- * `CredentialStoreBackendV1` that `createHostSideCredentialResolverV1` already
- * consumes. The resolver contract is unchanged.
- *
- * Fail-closed rules: an unready backend, an unknown record, a wrong/absent
- * KEK, or any tampered ciphertext/nonce/tag/AAD component throws a stable
- * `CredentialResolutionError`. Nothing here ever returns "absent" in place of
- * an authentication failure, and nothing ever falls back to another backend or
- * to plaintext. Plaintext DEKs and field values are overwritten in `finally` on
- * a best-effort basis (Node/V8 cannot guarantee erasure).
- */
-interface VaultCredentialStoreOptionsV1$1 {
-    readonly kmsBackend: WorkspaceKekProviderV1;
-    readonly persistence: CredentialVaultPersistenceV2;
-    readonly versionAnchor: WorkspaceCredentialVersionAnchorV2;
-}
-interface WriteCredentialFieldsInputV1 {
-    readonly workspaceId: string;
-    readonly providerId: ProviderId;
-    readonly credentialId?: string;
-    readonly fields: ReadonlyMap<CredentialFieldId, Uint8Array>;
-    readonly metadata?: Readonly<{
-        displayLabel?: string;
-        credentialType?: string;
-        maskedLastFourSuffix?: string;
-    }>;
-}
-interface VaultCredentialStoreBackendV1 extends CredentialStoreBackendV1 {
-    read(workspaceId: string, providerId: ProviderId, allowedFieldIds: readonly CredentialFieldId[], options?: WorkspaceCredentialLockOptionsV1): Promise<ResolvedCredentialMaterialV1 & {
-        credentialVersion: number;
-    }>;
-    /** Cross-process workspace serialization for Pi CredentialStore.modify(). */
-    withWorkspaceLock<T>(workspaceId: string, mutate: (locked: VaultCredentialStoreBackendV1) => Promise<T>, options?: WorkspaceCredentialLockOptionsV1): Promise<T>;
-    /**
-     * Writes (or rotates to) a new credential version for a workspace/provider.
-     * Every write mints a fresh credential version; nonces are never reused.
-     */
-    writeCredentialFields(input: WriteCredentialFieldsInputV1): Promise<StoredCredentialRecordV1>;
-    /** Marks a workspace/provider credential as deliberately field-less. */
-    writeAbsentCredential(workspaceId: string, providerId: ProviderId, options?: WorkspaceCredentialLockOptionsV1): Promise<StoredCredentialRecordV1>;
-    getCredentialMetadata(workspaceId: string, providerId: ProviderId): Promise<StoredCredentialMetadataV1 | undefined>;
-    listCredentialMetadata(workspaceId: string): Promise<readonly StoredCredentialMetadataV1[]>;
-    setCredentialLifecycleState(workspaceId: string, providerId: ProviderId, state: CredentialLifecycleStateV1): Promise<StoredCredentialMetadataV1>;
-    /** Rotates the KEK wrapping for one workspace DEK generation in place. */
-    rewrapWorkspaceDek(workspaceId: string, dekGeneration: number): Promise<void>;
-    /** Re-encrypts all live workspace credentials under a fresh DEK generation. */
-    rotateWorkspaceDek(workspaceId: string, operationId: string): Promise<number>;
-    /** Irreversibly destroys workspace credential key access and fails closed thereafter. */
-    cryptoShredWorkspace(workspaceId: string): Promise<void>;
-}
-declare function createVaultCredentialStoreBackendV1(options: VaultCredentialStoreOptionsV1$1): VaultCredentialStoreBackendV1;
-
-/**
- * uv setup for Python-family runtimes (e.g. Vercel `python3.13`), which already
- * ship `pip` and usually `uv`. Verify-or-install via the on-PATH `uv`.
- */
-declare const UV_SETUP_COMMANDS: readonly ["command -v uv >/dev/null 2>&1 || python3 -m pip install --upgrade uv", "uv --version"];
-type DeploymentSnapshotStatus = 'skipped' | 'cache-hit' | 'baked' | 'failed';
-interface DeploymentSnapshotRecipe {
-    /** Provider runtime/image selector. Example: Vercel's python3.13 runtime. */
-    runtime?: string;
-    /** OS packages to bake into the reusable runtime layer. */
-    systemPackages?: readonly string[];
-    /** Python packages to bake into the reusable runtime layer. */
-    pythonPackages?: readonly string[];
-    /** Ordered setup commands for runtime primitives such as uv. */
-    setupCommands?: readonly string[];
-}
-interface DeploymentSnapshotResult {
-    status: DeploymentSnapshotStatus;
-    reason: string;
-    hash?: string;
-    snapshotId?: string;
-    error?: unknown;
-}
-interface DeploymentSnapshotProvider {
-    prepareDeploymentSnapshot(recipe: DeploymentSnapshotRecipe): Promise<DeploymentSnapshotResult>;
-}
-interface BuildDeploymentSnapshotRecipeOptions extends DeploymentSnapshotRecipe {
-    /** Defaults true: install/check uv at deploy-time so workspaces boot fast. */
-    includeUv?: boolean;
-}
-declare function buildDeploymentSnapshotRecipe(opts?: BuildDeploymentSnapshotRecipeOptions): DeploymentSnapshotRecipe;
-declare function prepareDeploymentSnapshot(provider: DeploymentSnapshotProvider, recipe: DeploymentSnapshotRecipe): Promise<DeploymentSnapshotResult>;
-
-declare function resolveWorkspaceRoot(defaultRoot?: string): string;
-
-interface RemoteWorkerClientOptions {
-    baseUrl: string;
-    token: string;
-    workspaceId: string;
-    requestId?: string;
-    fetchImpl?: typeof fetch;
-    requestTimeoutMs?: number;
-    execTimeoutMs?: number;
-    execRequestGraceMs?: number;
-}
-declare class RemoteWorkerClientError extends Error {
-    readonly statusCode: number;
-    readonly code: string;
-    readonly details?: unknown;
-    constructor(message: string, opts: {
-        statusCode: number;
-        code?: string;
-        details?: unknown;
-    });
-}
-declare class RemoteWorkerClient {
-    private readonly baseUrl;
-    private readonly token;
-    private readonly workspaceId;
-    private readonly requestId?;
-    private readonly fetchImpl;
-    private readonly requestTimeoutMs;
-    private readonly execTimeoutMs;
-    private readonly execRequestGraceMs;
-    constructor(opts: RemoteWorkerClientOptions);
-    private timeoutError;
-    private abortedError;
-    private fetchWithTimeout;
-    health(): Promise<RemoteWorkerHealthResponse>;
-    workspace(op: RemoteWorkerWorkspaceOp): Promise<RemoteWorkerWorkspaceResult>;
-    exec(input: RemoteWorkerExecRequest, opts?: Pick<ExecOptions, 'signal'>): Promise<ExecResult>;
-    watch(onEvent: (event: WorkspaceChangeEvent) => void, onError?: (error: Error) => void): {
-        close(): void;
-    };
-    private consumeEvents;
-    private handleSseFrame;
-}
-declare function encodeBytesForWorker(bytes: Uint8Array): string;
-declare function decodeBytesFromWorker(value: string): Uint8Array;
-declare function constantTimeTokenEqual(a: string, b: string): boolean;
-
-interface RemoteWorkerModeAdapterOptions {
-    baseUrl?: string;
-    token?: string;
-    fetchImpl?: RemoteWorkerClientOptions['fetchImpl'];
-}
-declare function createRemoteWorkerModeAdapter(opts?: RemoteWorkerModeAdapterOptions): RuntimeModeAdapter;
-
-declare function createRemoteWorkerWorkspace(client: RemoteWorkerClient, supportsExclusiveBinaryCreate?: boolean): Workspace;
-
-declare function createRemoteWorkerSandbox(client: RemoteWorkerClient): Sandbox;
-
-interface RuntimeTemplateContribution {
-    id: string;
-    path: string | URL;
-    target?: string;
-}
-interface RuntimePythonSpec {
-    id: string;
-    /** uv-compatible pyproject.toml. Console scripts declared here are exposed to the agent. */
-    projectFile: string | URL;
-    /** Extra workspace libraries to install into the same environment. */
-    extraLibs?: string[];
-    /** Env vars exported by command shims, e.g. plugin builtin paths. */
-    env?: Record<string, string | URL>;
-}
-interface RuntimeNodePackageSpec {
-    id: string;
-    /** Package name materialized under workspaceRoot/node_modules, e.g. @boring/workspace. */
-    packageName: string;
-    /** Source package root. The provisioner copies the built package payload into node_modules. */
-    packageRoot: string | URL;
-}
-interface RuntimeProvisioningContribution {
-    templateDirs?: RuntimeTemplateContribution[];
-    python?: RuntimePythonSpec[];
-    nodePackages?: RuntimeNodePackageSpec[];
-}
-interface ProvisionRuntimeWorkspaceOptions {
-    workspaceRoot: string;
-    contributions?: Array<{
-        id: string;
-        provisioning?: RuntimeProvisioningContribution;
-    }>;
-    force?: boolean;
-}
-interface RuntimeWorkspaceProvisioningResult {
-    fingerprint: string;
-    changed: boolean;
-    env: Record<string, string>;
-    binDir: string;
-}
-declare function provisionRuntimeWorkspace({ workspaceRoot, contributions, force, }: ProvisionRuntimeWorkspaceOptions): Promise<RuntimeWorkspaceProvisioningResult>;
-
-type ProvisioningArtifactKind = 'node' | 'python';
-/** What a per-mode packer receives to produce one artifact. `id`/`fingerprint`
- * are passed through (not used by the default packer, but part of the public
- * `prepareArtifact` contract — consumers key their own artifact paths off them). */
-interface ProvisioningArtifactRequest {
-    kind: ProvisioningArtifactKind;
-    id: string;
-    fingerprint: string;
-    source: string | URL;
-    outputPath: string;
-}
-
-declare function hasBwrap(): boolean;
-declare function autoDetectMode(): RuntimeModeId;
-interface ResolveModeOptions {
-    adapters?: Readonly<Record<BuiltinRuntimeModeId, RuntimeModeAdapter>>;
-}
-declare function resolveMode(mode?: RuntimeModeId, opts?: ResolveModeOptions): RuntimeModeAdapter;
-
-declare function createDirectModeAdapter(options: {
-    provider: SandboxProviderV1;
-    runtimeHost: AgentRuntimeHostOperations;
-}): RuntimeModeAdapter;
-
-declare function createLocalModeAdapter(options: {
-    provider: SandboxProviderV1;
-    runtimeHost: AgentRuntimeHostOperations;
-}): RuntimeModeAdapter;
-
-declare function createVercelSandboxModeAdapter(options: {
-    provider: SandboxProviderV1;
-    runtimeHost: AgentRuntimeHostOperations;
-    remoteRoot: string;
-    workspaceRoot: string;
-}): RuntimeModeAdapter;
-
-declare function createBlaxelSandboxModeAdapter(options: {
-    provider: SandboxProviderV1;
-    runtimeHost: AgentRuntimeHostOperations;
-}): RuntimeModeAdapter;
-
-interface ProviderRuntimeModeAdapterOptions {
-    id: RuntimeModeId;
-    provider: SandboxProviderV1;
-    runtimeHost: AgentRuntimeHostOperations;
-    workspaceFsCapability: 'strong' | 'best-effort';
-    bash: RuntimeBashStrategy;
-    filesystem: RuntimeFilesystemStrategy;
-    storageRoot?: (context: ModeContext) => string | undefined;
-    preflight?: (context: ModeContext) => void | Promise<void>;
-    prepare?: (context: ModeContext) => Promise<void>;
-    provisioningAdapter?: (context: ModeContext, pair: WorkspaceSandboxPairV1) => WorkspaceProvisioningAdapter | undefined;
-    healthCheckIntervalMs?: number;
-    readiness?: RuntimeModeAdapter['readiness'];
-}
-declare function createProviderRuntimeModeAdapter(options: ProviderRuntimeModeAdapterOptions): RuntimeModeAdapter;
-
-declare const sandboxRuntimeHostOperations: AgentRuntimeHostOperations;
-interface SandboxRuntimeModeOptions {
-    readonly sandboxHandleStore?: SandboxHandleStore;
-    readonly bwrap?: BwrapSandboxProviderOptions;
-}
-/** Built-in runtime layout root without exposing provider package constants to consumers. */
-declare function resolveBuiltinRuntimeLayoutRoot(mode: BuiltinRuntimeModeId, workspaceRoot: string): string;
-declare function createSandboxRuntimeModeAdapter(mode: RuntimeModeId, options?: SandboxRuntimeModeOptions): RuntimeModeAdapter;
-
-type AgentDirectoryCompilerErrorCode = 'AGENT_DIRECTORY_NOT_FOUND' | 'AGENT_DIRECTORY_NOT_DIRECTORY' | 'AGENT_MANIFEST_NOT_FOUND' | 'AGENT_MANIFEST_NOT_FILE' | 'AGENT_MANIFEST_INVALID_UTF8' | 'AGENT_MANIFEST_INVALID_JSON' | 'AGENT_MANIFEST_MISSING_BORING_AGENT' | 'AGENT_ASSET_NOT_FOUND' | 'AGENT_ASSET_NOT_FILE' | 'AGENT_ASSET_INVALID_UTF8' | 'AGENT_PATH_SYMLINK_ESCAPE' | 'AGENT_PATH_CHANGED_DURING_READ' | 'AGENT_DIRECTORY_IO_FAILED';
-type AgentDirectoryCompilerPublicErrorCode = Extract<ErrorCode, 'CONFIG_INVALID' | 'PATH_NOT_FOUND' | 'PATH_SYMLINK_ESCAPE'>;
-declare class AgentDirectoryCompilerError extends Error {
-    readonly code: AgentDirectoryCompilerPublicErrorCode;
-    readonly compilerCode: AgentDirectoryCompilerErrorCode;
-    readonly field: string;
-    constructor(input: {
-        code: AgentDirectoryCompilerPublicErrorCode;
-        compilerCode: AgentDirectoryCompilerErrorCode;
-        field: string;
-        message: string;
-        cause?: unknown;
-    });
-}
-declare function compileAgentDirectory(directory: string): Promise<CompiledAgentBundle>;
-/**
- * Compiles a persona authored as a plugin-shaped package: `package.json`'s
- * `boring.agent` block stands in for `agent.json`, `instructions.md` is
- * unchanged. Used for `.agents/personas/<seat>` fleet packages.
- */
-declare function compilePersonaPackageDirectory(directory: string): Promise<CompiledAgentBundle>;
-
-type AuthoredAgentMaterializationErrorCode = Extract<ErrorCode, 'AUTHORED_AGENT_ID_INVALID' | 'AUTHORED_AGENT_TYPE_MISMATCH' | 'AUTHORED_AGENT_REFERENCE_UNSUPPORTED'>;
-type AuthoredAgentSourceV1 = Readonly<{
-    schemaVersion: 1;
-    agentTypeId: string;
-    version: string;
-    label?: string;
-    description?: string;
-    instructions: string;
-    /**
-     * Computed identity of the compiled definition (instructions + knowledge
-     * bytes). The digest, not the version string, is the definition identity.
-     */
-    definitionDigest?: string;
-    /** Host path of the package's optional `knowledge/` folder, when present. */
-    knowledgeDir?: string;
-}>;
-interface MaterializeAgentDirectoryInput {
-    directory: string;
-    expectedAgentTypeId?: string;
-    /**
-     * Manifest shape to compile. Defaults to `agent.json` for backward
-     * compatibility. `package.json` reads the `boring.agent` block, used by
-     * plugin-shaped personas (`.agents/personas/<seat>`).
-     */
-    manifest?: 'agent.json' | 'package.json';
-}
-declare class AuthoredAgentMaterializationError extends Error {
-    readonly code: AuthoredAgentMaterializationErrorCode;
-    readonly field?: string;
-    constructor(input: {
-        code: AuthoredAgentMaterializationErrorCode;
-        field?: string;
-        message: string;
-    });
-}
-/**
- * Loads declarative authored identity, safe metadata, and instructions.
- * Executable behavior is selected only by trusted host/plugin policy.
- */
-declare function materializeAgentDirectory(input: MaterializeAgentDirectoryInput): Promise<AuthoredAgentSourceV1>;
-
-interface TrustedAgentInstructionAppendix {
-    readonly name: string;
-    readonly content: string;
-    readonly digest: Sha256Digest;
-}
-interface TrustedAuthoredAgentPolicy {
-    readonly fallbackLabel?: string;
-    /**
-     * Authored instruction sources for this agent as host absolute paths,
-     * supplied by the trusted composer that actually knows where they live.
-     * Addressing them against a served workspace root is a per-request concern.
-     */
-    readonly instructionSources?: readonly AgentInstructionSource[];
-    readonly instructionAppendices?: readonly TrustedAgentInstructionAppendix[];
-    readonly plugins?: readonly {
-        readonly name: string;
-        readonly config?: JsonValue;
-    }[];
-    readonly preferredModel?: string;
-}
-interface CreateConfiguredAgentHostAgentSpecInput {
-    readonly source: AuthoredAgentSourceV1;
-    readonly policy?: TrustedAuthoredAgentPolicy;
-}
-declare class TrustedAgentCompositionError extends Error {
-    readonly code: "CONFIG_INVALID";
-    readonly field: string;
-    constructor(field: string, message: string);
-}
-/**
- * Maps identity-only authored data into AgentHost configuration. Every behavior
- * input is supplied separately by trusted host composition.
- */
-declare function createConfiguredAgentHostAgentSpec(input: CreateConfiguredAgentHostAgentSpecInput): Promise<ConfiguredAgentHostAgentSpec>;
-
-interface ModelTierCandidate {
-    readonly provider: string;
-    readonly id: string;
-    readonly envVar: string;
-}
-interface FleetSkillBinding {
-    readonly name: string;
-    readonly digest: Sha256Digest;
-}
-interface FleetSeatBinding {
-    readonly seat: string;
-    readonly agentTypeId: string;
-    readonly skills: readonly FleetSkillBinding[];
-}
-interface DiscoveredAgentPackageDescriptor {
-    readonly rootDir: string;
-    readonly manifest: {
-        readonly boring: {
-            readonly agent: {
-                readonly definitionId: string;
-                readonly version: string;
-                readonly label?: string;
-                readonly description?: string;
-                readonly instructionsRef: string;
-            };
-        };
-        readonly pi?: {
-            readonly skills?: readonly string[];
-        };
-    };
-    readonly preflight: {
-        readonly ok: boolean;
-        readonly errors?: readonly {
-            readonly code: string;
-            readonly message: string;
-        }[];
-    };
-}
-interface LoadConfiguredAgentFleetOptions {
-    /** Plugin-manager scan descriptors injected by the workspace/CLI boot layer. */
-    readonly discoveredPackages: readonly DiscoveredAgentPackageDescriptor[];
-    /** Path to `.agents/factory/fleet.yaml`. */
-    readonly fleetConfigPath: string;
-    /** Path to `.agents/factory/policy.yaml` (read for `models.seats` tiers). */
-    readonly policyPath: string;
-    /**
-     * Directory containing `<skill>/SKILL.md` canonical skill sources.
-     * This root is host-owned because shared skill names are not package paths.
-     */
-    readonly skillsRoot: string;
-    /** Overridable for tests; defaults to `process.env`. */
-    readonly env?: NodeJS.ProcessEnv;
-}
-type FleetLoaderDiagnosticCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_PERSONA_INVALID' | 'AGENT_FLEET_SEAT_SKILL_DIGEST_MISMATCH' | 'AGENT_DEFINITION_ID_CONFLICT' | 'AGENT_DEFINITION_UNSEATED'>;
-interface FleetLoaderDiagnostic {
-    readonly seat?: string;
-    readonly agentTypeId: string;
-    readonly code: FleetLoaderDiagnosticCode;
-    readonly message: string;
-}
-interface LoadConfiguredAgentFleetResult {
-    readonly agents: readonly ConfiguredAgentHostAgentSpec[];
-    readonly diagnostics: readonly FleetLoaderDiagnostic[];
-}
-type FleetConfigErrorCode = Extract<ErrorCode, 'AGENT_FLEET_CONFIG_FILE_INVALID'>;
-/** Thrown for whole-fleet configuration failures (not per-seat, fail-closed). */
-declare class FleetConfigError extends Error {
-    readonly code: FleetConfigErrorCode;
-    readonly field: string;
-    constructor(input: {
-        field: string;
-        message: string;
-        cause?: unknown;
-    });
-}
-/**
- * Loads the config-driven production/CLI agent fleet: `.agents/factory/fleet.yaml`
- * seat → skill-digest bindings, boot-injected plugin-shaped persona package
- * descriptors, `.agents/factory/policy.yaml` `models.seats` tiers, and the
- * priority-ordered `models.tiers` candidates declared in fleet.yaml.
- *
- * Excludes an individual package when a configured seat cannot materialize or
- * verify, allowing valid sibling seats to boot. Whole-fleet config errors
- * (including unreadable/malformed fleet or policy YAML) throw `FleetConfigError`.
- */
-declare function loadConfiguredAgentFleet(options: LoadConfiguredAgentFleetOptions): Promise<LoadConfiguredAgentFleetResult>;
-
-type InstructionRefWithholdingCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE'>;
-interface WithheldInstructionRef {
-    readonly code: InstructionRefWithholdingCode;
-    /** Host absolute path of the authored source that could not be addressed. */
-    readonly absolutePath: string;
-    readonly message: string;
-}
-interface ResolvedInstructionFileRefs {
-    readonly refs: readonly AgentInstructionFileRef[];
-    readonly withheld: readonly WithheldInstructionRef[];
-}
-/**
- * Addresses authored instruction sources against the workspace root a SINGLE
- * request is served from, which is the only moment a multi-workspace host
- * (the CLI hub, core) knows one — composition time sees a fleet shared by
- * every workspace (gh-1189).
- *
- * Publication is deterministic and fails closed: a ref is emitted only when
- * the source canonically resolves inside the served root AND composes a path
- * the client-side openable-resource guard accepts. Anything else is withheld
- * with the stable `AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE` code, so
- * the invariant from #1176 holds: a rendered link always resolves.
- *
- * Canonicalization (not lexical containment) on BOTH sides is the point:
- * dotfile managers make a symlinked `.agents` ordinary, and a lexical check
- * would call `~/project/.agents -> ~/dotfiles/agents` "inside the workspace"
- * and publish a link the `user` filesystem cannot open.
- */
-declare function resolveAgentInstructionFileRefs(input: {
-    readonly sources: readonly AgentInstructionSource[] | undefined;
-    /** Root the `user` filesystem serves for THIS request, when the host resolved one. */
-    readonly workspaceRoot: string | null | undefined;
-}): Promise<ResolvedInstructionFileRefs>;
-
-/**
- * A real, regular Agent used by hosts that do not opt into authored fleet
- * discovery. Platform host adapters preserve the established `default` ID's
- * plugin, skill, and transcript behavior without a separate pseudo-Agent type.
- */
-declare const DEFAULT_AGENT_FLEET: readonly AgentHostAgentSpec[];
-interface ResolveDefaultAgentFleetOptions {
-    /** Repository root used to resolve `.agents/{factory,skills}`. Defaults to `process.cwd()`. */
-    readonly repositoryRoot?: string;
-    /** Asset-manager scan results supplied by the workspace/CLI boot layer. */
-    readonly discoveredPackages?: readonly DiscoveredAgentPackageDescriptor[];
-    /** Overridable for tests; defaults to `process.env`. */
-    readonly env?: NodeJS.ProcessEnv;
-}
-/**
- * Resolves one deployment-static fleet for Core, Workspace, and CLI hosts.
- *
- * The built-in default is a regular configured Agent. When authored fleet
- * discovery is enabled it remains available alongside valid discovered seats
- * so old `default` session references stay routable. Missing fleet config and
- * individual package failures degrade to that valid subset; malformed whole-
- * fleet configuration still rejects boot.
- */
-declare function resolveDefaultAgentFleet(options: ResolveDefaultAgentFleetOptions): Promise<readonly AgentHostAgentSpec[]>;
-
-interface ResolvedAgentDigestInput {
-    readonly workspaceId: string;
-    readonly defaultDeploymentId: string;
-    readonly workspaceCompositionDigest: Sha256Digest;
-    readonly definitionDigest: Sha256Digest;
-    readonly deploymentDigest: Sha256Digest;
-}
-declare function createResolvedAgentDigest(input: ResolvedAgentDigestInput): Promise<Sha256Digest>;
-interface ResolvedAgent {
-    readonly workspace: Readonly<{
-        workspaceId: string;
-        defaultDeploymentId: string;
-        compositionDigest: Sha256Digest;
-    }>;
-    readonly deployment: Readonly<{
-        deploymentId: string;
-        version: string;
-        agentId: string;
-        digest: Sha256Digest;
-    }>;
-    readonly definition: Readonly<{
-        definitionId: string;
-        version: string;
-        digest: Sha256Digest;
-        instructionsRef: string;
-    }>;
-    readonly instructions: Readonly<{
-        ref: string;
-        content: string;
-    }>;
-    readonly resolvedDigest: Sha256Digest;
-}
-declare function resolveAgentDeployment(bundle: CompiledAgentBundle, deployment: AgentDeployment, authorizedBinding: unknown): Promise<ResolvedAgent>;
-
-declare const MANAGED_AGENT_MCP_ORIGIN_SURFACE = "mcp-managed-agent";
-declare const MANAGED_AGENT_MCP_DELIVERY_RULE = "M1 DELIVERY v0: delegate_task returns bounded final assistant text and at most one complete authorized inline Markdown artifact; no artifact paths, truncation, or share-link delivery.";
-type ManagedAgentDelegationStatus = 'running' | 'completed' | 'error';
-type ManagedAgentDelegateStatus = ManagedAgentDelegationStatus;
-interface ManagedAgentArtifactCandidate {
-    path: string;
-    mediaType?: string;
-    title?: string;
-    content?: unknown;
-    truncated?: unknown;
-}
-/** @deprecated Use ManagedAgentArtifactCandidate for internal artifact path candidates. */
-type ManagedAgentArtifactRef = ManagedAgentArtifactCandidate;
-interface ManagedAgentArtifact {
-    content: string;
-    sha256: `sha256:${string}`;
-    byteSize: number;
-    mediaType?: string;
-    title?: string;
-}
-interface ManagedAgentWorkspaceResolutionInput {
-    brief: string;
-    ctx: SessionCtx;
-    request: ManagedAgentDelegateRequestContext;
-}
-interface ManagedAgentDelegateRunInput {
-    brief: string;
-    ctx: SessionCtx;
-    request: ManagedAgentDelegateRequestContext;
-    actor: AgentActor;
-    signal?: AbortSignal;
-    onSessionStarted?: (sessionId: string) => void;
-}
-interface ManagedAgentDelegateRunner {
-    run(input: ManagedAgentDelegateRunInput): AsyncIterable<AgentEvent>;
-    stop?(sessionId: string, ctx: SessionCtx): Promise<void> | void;
-}
-interface ManagedAgentBoundRunnerWorkspace {
-    runner: ManagedAgentDelegateRunner;
-    workspace: Workspace;
-}
-interface ManagedAgentDelegateProgress {
-    at: string;
-    eventIndex: number;
-    kind: string;
-    message: string;
-}
-interface ManagedAgentDelegateResult {
-    delegationId: string;
-    status: 'completed';
-    finalAssistantText: string;
-    artifact?: ManagedAgentArtifact;
-    deliveryRule: typeof MANAGED_AGENT_MCP_DELIVERY_RULE;
-}
-interface ManagedAgentDelegateStatusResult {
-    delegationId: string;
-    status: ManagedAgentDelegationStatus;
-    progress: ManagedAgentDelegateProgress[];
-    lastEventIndex?: number;
-    eventCount: number;
-    result?: ManagedAgentDelegateResult;
-    error?: ManagedAgentSafeError;
-}
-interface ManagedAgentSafeError {
-    code: ErrorCode;
-    message: string;
-}
-interface ManagedAgentDelegateRequestContext {
-    sessionId?: string;
-    authInfo?: unknown;
-}
-interface ManagedAgentDelegateInput {
-    brief: string;
-    request?: ManagedAgentDelegateRequestContext;
-    onDelegationCreated?: (status: ManagedAgentDelegateStatusResult) => void | Promise<void>;
-    onProgress?: (progress: ManagedAgentDelegateProgress) => void | Promise<void>;
-    signal?: AbortSignal;
-}
-interface ManagedAgentCollectArtifactsInput {
-    delegationId: string;
-    sessionId: string;
-    ctx: SessionCtx;
-    request: ManagedAgentDelegateRequestContext;
-    finalAssistantText: string;
-    events: readonly AgentEvent[];
-}
-interface ManagedAgentMcpDelegateOptions {
-    gateway?: AgentGateway;
-    agentTypeId: string;
-    resolveGatewayScope?(input: {
-        brief: string;
-        ctx: SessionCtx;
-        request: ManagedAgentDelegateRequestContext;
-    }): AuthorizedAgentScope | Promise<AuthorizedAgentScope>;
-    resolveSessionCtx(input: {
-        brief: string;
-        request: ManagedAgentDelegateRequestContext;
-    }): SessionCtx | Promise<SessionCtx>;
-    resolveWorkspace?(input: ManagedAgentWorkspaceResolutionInput): Workspace | Promise<Workspace>;
-    resolveRunnerWorkspace?(input: ManagedAgentWorkspaceResolutionInput & {
-        actor: AgentActor;
-    }): ManagedAgentBoundRunnerWorkspace | Promise<ManagedAgentBoundRunnerWorkspace>;
-    resolveActor?(input: {
-        brief: string;
-        ctx: SessionCtx;
-        request: ManagedAgentDelegateRequestContext;
-    }): AgentActor | Promise<AgentActor>;
-    collectArtifacts?(input: ManagedAgentCollectArtifactsInput): ManagedAgentArtifactCandidate[] | Promise<ManagedAgentArtifactCandidate[]>;
-    createDelegationId?: () => string;
-    now?: () => Date;
-    maxBriefBytes?: number;
-    /** Optional additional character cap retained for host compatibility. */
-    maxBriefChars?: number;
-    terminalRetentionMs?: number;
-    maxDelegations?: number;
-    redactionCanaries?: readonly string[];
-}
-declare class ManagedAgentMcpError extends Error {
-    readonly code: ErrorCode;
-    constructor(code: ErrorCode, message: string);
-}
-declare class ManagedAgentMcpDelegateController {
-    private readonly options;
-    private readonly delegations;
-    private readonly createDelegationId;
-    private readonly now;
-    private readonly maxBriefBytes;
-    private readonly maxBriefChars?;
-    private readonly terminalRetentionMs;
-    private readonly maxDelegations;
-    private readonly redactionCanaries;
-    constructor(options: ManagedAgentMcpDelegateOptions);
-    delegateTask(input: ManagedAgentDelegateInput): Promise<ManagedAgentDelegateResult>;
-    getStatusForRequest(delegationId: string, request: ManagedAgentDelegateRequestContext): Promise<ManagedAgentDelegateStatusResult>;
-    getStatus(delegationId: string, ctx: SessionCtx): ManagedAgentDelegateStatusResult;
-    private createRecord;
-    private markTerminal;
-    private pruneDelegations;
-    private parseBrief;
-    private resolveSessionCtx;
-    private resolveWorkspace;
-    private resolveRunnerWorkspace;
-    private createGatewayDelegateRunner;
-    private assertNotAborted;
-    private stopDelegatedSession;
-    private resolveActor;
-    private observeEvent;
-    private pushProgress;
-    private validateFinalAssistantText;
-    private collectArtifacts;
-    private toSafeError;
-    private assertPublicPayloadSafe;
-    private containsSecret;
-    private timestamp;
-}
-declare function createManagedAgentMcpDelegateController(options: ManagedAgentMcpDelegateOptions): ManagedAgentMcpDelegateController;
-
-interface ManagedAgentMcpPresentationOptions {
-    name?: string;
-    version?: string;
-    maxBriefChars?: number;
-    /**
-     * Optional Lane W (AR1-002/AR1-004) share-entry store. When supplied
-     * together with `resolveShareSessionCtx`/`resolveShareWorkspace`, the
-     * server exposes `listResources`/`readResource` scoped to the
-     * authenticated workspace's share entries, on this SAME MCP server
-     * process (no second MCP runtime owner). Hosts that omit any of the
-     * three leave Lane W unmounted — no widening.
-     */
-    shareEntryStore?: ShareEntryStore;
-    /** Resolves the authenticated SessionCtx for a share resource request. */
-    resolveShareSessionCtx?: (request: ManagedAgentDelegateRequestContext) => SessionCtx | Promise<SessionCtx>;
-    /** Resolves the authorized Workspace to read share targets from, for a given SessionCtx. */
-    resolveShareWorkspace?: (ctx: SessionCtx) => Workspace | Promise<Workspace>;
-}
-interface ManagedAgentMcpServerOptions extends ManagedAgentMcpDelegateOptions, ManagedAgentMcpPresentationOptions {
-}
-type ManagedAgentMcpHttpHandlerOptions = (ManagedAgentMcpPresentationOptions & {
-    controller: ManagedAgentMcpDelegateController;
-}) | (ManagedAgentMcpServerOptions & {
-    controller?: undefined;
-});
-declare function createManagedAgentMcpServer(options: ManagedAgentMcpServerOptions): McpServer;
-declare function createManagedAgentMcpHttpHandler(options: ManagedAgentMcpHttpHandlerOptions): (req: IncomingMessage, res: ServerResponse, parsedBody?: unknown) => Promise<void>;
-
-interface ShareEntryMcpResourceOptions {
-    /** Lane W (AR1-002) opaque share-entry store — the single source of truth for entries. */
-    store: ShareEntryStore;
-    /** Resolves the authenticated SessionCtx for a resource request (list or read). */
-    resolveSessionCtx(request: ManagedAgentDelegateRequestContext): SessionCtx | Promise<SessionCtx>;
-    /** Resolves the authorized Workspace to read share targets from, for a given SessionCtx. */
-    resolveWorkspace(ctx: SessionCtx): Workspace | Promise<Workspace>;
-}
-/** Builds the opaque share resource URI for a given share-entry id. */
-declare function shareResourceUri(id: string): string;
-/**
- * Registers `listResources`/`readResource` for Lane W share entries on an
- * already-constructed managed-agent `McpServer`. A no-op call site (host
- * omits `shareEntryStore`) leaves Lane W unmounted — see
- * `managedAgentMcpServer.ts`'s optional wiring.
- */
-declare function registerShareEntryResources(server: McpServer, options: ShareEntryMcpResourceOptions): void;
-
-interface RuntimeEnvContributionContext {
-    workspaceId: string;
-    workspaceRoot: string;
-    runtimeMode: RuntimeModeId;
-    runtimeBundle: RuntimeBundle;
-}
-interface RuntimeEnvContribution {
-    id: string;
-    getEnv(ctx: RuntimeEnvContributionContext): Record<string, string> | Promise<Record<string, string>>;
-}
-declare function withRuntimeEnvContributions(runtimeBundle: RuntimeBundle, baseContext: RuntimeEnvContributionContext, contributions: RuntimeEnvContribution[], telemetry?: TelemetrySink): RuntimeBundle;
-
-interface AuthorizedSessionRunDetails {
-    runId: string;
-    terminalEntryId: string;
-    state: 'success' | 'error' | 'aborted' | 'interrupted';
-    createdAt?: string;
-    details: readonly unknown[];
-}
-/** Redact a session snapshot to terminal run identity and allowlisted structured details. */
-declare function projectAuthorizedSessionRunDetails(messages: readonly unknown[], detailKinds: readonly string[]): AuthorizedSessionRunDetails[];
-
-interface WorkspaceAgentDispatcherResolveOptions {
-    request?: FastifyRequest;
-}
-interface PiSessionVisibleUserTurnTarget {
-    /** Advisory snapshot; sendIfIdle is the authoritative atomic admission. */
-    isIdle(): Promise<boolean>;
-    sendIfIdle(input: {
-        /** Stable across busy/transient retries; also used as the Pi client nonce. */
-        requestId: string;
-        message: string;
-        displayMessage?: string;
-    }): Promise<{
-        status: 'accepted';
-        cursor: number;
-        duplicate?: boolean;
-    } | {
-        status: 'busy';
-    } | {
-        status: 'gone';
-    }>;
-}
-interface BoundPiSession {
-    /** Trusted target closed over one exact logical Pi session. */
-    visibleUserMessageTarget: PiSessionVisibleUserTurnTarget;
-}
-interface WorkspaceAgentDispatcherBinding {
-    dispatcher: WorkspaceAgentDispatcher;
-    workspace: Workspace;
-    /**
-     * Trusted host seam used by local integrations that must bind durable work
-     * to the exact logical Pi session before accepting it.
-     */
-    bindPiSession?(sessionId: string, sessionCtx?: {
-        workspaceId?: string;
-        userId?: string;
-    }): Promise<BoundPiSession>;
-}
-interface WorkspaceAgentDispatcherResolver {
-    /** Callback-scoped canonical Host operation; no dispatcher or Workspace escapes. */
-    runWithWorkspaceAgent(input: WorkspaceAgentDirectRunInput & {
-        request?: FastifyRequest;
-    }, run: WorkspaceAgentDirectRunCallback): Promise<void>;
-    resolve(ctx: WorkspaceAgentDispatcherContext, options?: WorkspaceAgentDispatcherResolveOptions): Promise<WorkspaceAgentDispatcher>;
-    resolveWithWorkspace?(ctx: WorkspaceAgentDispatcherContext, options?: WorkspaceAgentDispatcherResolveOptions): Promise<WorkspaceAgentDispatcherBinding>;
-    /** Authorize one exact addressed native session without exposing transcript data. */
-    authorizeSession?(ctx: WorkspaceAgentDispatcherContext, ref: AgentSessionRef, options?: WorkspaceAgentDispatcherResolveOptions): Promise<void>;
-    /** Authorized transcript-redacted projection of allowlisted structured run details. */
-    readSessionRunDetails?(ctx: WorkspaceAgentDispatcherContext, ref: AgentSessionRef, detailKinds: readonly string[], options?: WorkspaceAgentDispatcherResolveOptions): Promise<readonly AuthorizedSessionRunDetails[]>;
-}
-/**
- * Bind the compatibility dispatcher surface to one addressed AgentGateway
- * capability. The gateway, scope, and agent type are supplied only by the
- * trusted composition root.
- */
-declare function createBoundWorkspaceAgentDispatcher(binding: WorkspaceAgentGatewayBinding, ctx: WorkspaceAgentDispatcherContext): WorkspaceAgentDispatcher;
-
-interface CreateStandaloneAgentHostAppOptions {
-    workspaceRoot?: string;
-    sessionId?: string;
-    templatePath?: string;
-    mode?: RuntimeModeId;
-    runtimeModeAdapter?: RuntimeModeAdapter;
-    runtimeHost?: AgentRuntimeHostOperations;
-    authToken?: string;
-    version?: string;
-    logger?: boolean;
-    /** Standalone defaults to a warm runtime; readiness smokes may keep binding lazy. */
-    initializeRuntime?: boolean;
-    extraTools?: AgentTool[];
-    disableDefaultFileTools?: boolean;
-    systemPromptAppend?: string;
-    harnessFactory?: AgentHarnessFactory;
-    pi?: PiHarnessOptions;
-    /** Additional host roots allowed to contribute local Pi resource bytes. */
-    piResourceAuthorizedRoots?: string[];
-    runtimeProvisioning?: WorkspaceProvisioningResult;
-    getRuntimeProvisioning?: () => WorkspaceProvisioningResult | undefined;
-    sessionNamespace?: string;
-    telemetry?: TelemetrySink;
-    metering?: AgentMeteringSink;
-    credentials?: AgentHostCredentialOptionsV1;
-    getFilesystemBindings?: (ctx: {
-        request?: FastifyRequest;
-        sessionId?: string;
-        workspaceId: string;
-        workspaceRoot: string;
-        userId?: string;
-        userEmail?: string;
-        userEmailVerified?: boolean;
-        requestId?: string;
-    }) => RuntimeFilesystemBinding[] | undefined | Promise<RuntimeFilesystemBinding[] | undefined>;
-    resolvePiSessionRequestContext?: (request: FastifyRequest, defaultContext: PiSessionRequestContext) => PiSessionRequestContext | Promise<PiSessionRequestContext>;
-    runtimeEnvContributions?: RuntimeEnvContribution[];
-    runtimeProvisioner?: (ctx: {
-        workspaceRoot: string;
-        runtimeMode: RuntimeModeId;
-        runtimeBundle: RuntimeBundle;
-    }) => Promise<void>;
-    sessionDir?: string;
-    sessionRoot?: string;
-    /**
-     * Durable request ledger file. Host application state, not workspace content:
-     * point it at host-owned storage. Defaults per
-     * {@link resolveRequestLedgerPath}.
-     */
-    requestLedgerPath?: string;
-    externalPlugins?: boolean;
-    beforeReload?: () => void | {
-        readonly diagnostics?: ReadonlyArray<{
-            source: string;
-            message: string;
-            pluginId?: string;
-        }>;
-        readonly restart_warnings?: ReadonlyArray<{
-            id: string;
-            surfaces: readonly string[];
-            message: string;
-        }>;
-    } | undefined | Promise<void | {
-        readonly diagnostics?: ReadonlyArray<{
-            source: string;
-            message: string;
-            pluginId?: string;
-        }>;
-        readonly restart_warnings?: ReadonlyArray<{
-            id: string;
-            surfaces: readonly string[];
-            message: string;
-        }>;
-    } | undefined>;
-    systemPromptDynamic?: () => string | undefined | Promise<string | undefined>;
-    getPluginDiagnostics?: (args: {
-        workspaceId: string;
-        workspaceRoot: string;
-    }) => Promise<Array<{
-        source: string;
-        message: string;
-        pluginId?: string;
-    }>>;
-    onWorkspaceAgentDispatcher?: (resolver: WorkspaceAgentDispatcherResolver) => void;
-}
-/** Thin standalone HTTP shell over one directly composed CreatedAgentHost. */
-declare function createStandaloneAgentHostApp(options?: CreateStandaloneAgentHostAppOptions): Promise<FastifyInstance>;
-
-type ChannelBindingStatus = 'active' | 'revoked';
-type ChannelInboundStatus = 'pending' | 'processing' | 'processed' | 'parked';
-type ChannelOutboundStatus = 'active' | 'parked';
-interface ChannelBinding {
-    readonly channel: string;
-    readonly conversationKey: string;
-    readonly agentTypeId: string;
-    readonly workspaceId: string;
-    readonly authSubjectId: string;
-    readonly bindingVersion: number;
-    readonly status: ChannelBindingStatus;
-    readonly sessionKey?: string;
-    readonly lastInboundAt?: number;
-    readonly outboundCursor: string;
-    readonly outboundStatus: ChannelOutboundStatus;
-    readonly sessionResetPending: boolean;
-    readonly templateSentForInboundAt?: number;
-}
-interface ProvisionChannelBindingInput extends Omit<ChannelBinding, 'bindingVersion' | 'status' | 'lastInboundAt' | 'outboundCursor' | 'outboundStatus' | 'sessionResetPending' | 'templateSentForInboundAt'> {
-    readonly status?: ChannelBindingStatus;
-    /** Tail of an existing target stream; omitted only for a new/empty session. */
-    readonly outboundCursor?: string;
-}
-interface InboundChannelMessage {
-    readonly channel: string;
-    readonly conversationKey: string;
-    readonly providerMessageId: string;
-    readonly text: string;
-    readonly receivedAt: number;
-}
-interface QueuedChannelInbound extends InboundChannelMessage {
-    readonly id: number;
-    readonly agentTypeId: string;
-    readonly workspaceId: string;
-    readonly authSubjectId: string;
-    readonly bindingVersion: number;
-    readonly claimOwner: string;
-    readonly attempts: number;
-    readonly status: ChannelInboundStatus;
-    readonly errorCode?: string;
-}
-type EnqueueInboundResult = {
-    readonly disposition: 'enqueued';
-    readonly binding: ChannelBinding;
-    readonly queueId: number;
-} | {
-    readonly disposition: 'duplicate';
-    readonly binding?: ChannelBinding;
-} | {
-    readonly disposition: 'unknown_binding';
-};
-interface ChannelIntentionRecord {
-    readonly questionId: string;
-    readonly sessionId: string;
-    readonly channel: string;
-    readonly conversationKey: string;
-    readonly agentTypeId: string;
-    readonly bindingVersion: number;
-    readonly fieldName: string;
-    readonly options: readonly {
-        value: string;
-        label: string;
-        description?: string;
-    }[];
-    readonly title?: string;
-    readonly context?: string;
-    readonly status: 'pending' | 'projecting' | 'window-held' | 'projected' | 'answering' | 'answered' | 'closed';
-    readonly answerValues?: Readonly<Record<string, unknown>>;
-    readonly answerProviderMessageId?: string;
-}
-type ClaimIntentionReplyResult = {
-    readonly disposition: 'claimed';
-    readonly intention: ChannelIntentionRecord;
-} | {
-    readonly disposition: 'duplicate';
-} | {
-    readonly disposition: 'no_intention';
-};
-type ClaimInvalidIntentionReplyResult = {
-    readonly disposition: 'claimed';
-} | {
-    readonly disposition: 'duplicate';
-} | {
-    readonly disposition: 'no_intention';
-};
-type NextInboundResult = {
-    readonly disposition: 'claimed';
-    readonly inbound: QueuedChannelInbound;
-} | {
-    readonly disposition: 'blocked';
-    readonly retryAt: number;
-} | {
-    readonly disposition: 'empty';
-};
-interface EnsureSessionOptions {
-    readonly reservationTtlMs?: number;
-    readonly maxReservationCycles?: number;
-    readonly initialBackoffMs?: number;
-    readonly allocate: () => Promise<string>;
-    readonly admit: (sessionKey: string) => Promise<void>;
-}
-declare class ChannelSessionCreateTimeoutError extends Error {
-    readonly code: "SESSION_CREATE_TIMEOUT";
-    constructor(channel: string, conversationKey: string, agentTypeId: string);
-}
-declare class ChannelBindingStore {
-    private readonly sql;
-    private readonly runTransaction;
-    constructor(sql: SqlStorage, runTransaction: RunTransaction);
-    private migrate;
-    private ensureColumn;
-    provision(input: ProvisionChannelBindingInput): ChannelBinding;
-    getBinding(channel: string, conversationKey: string, agentTypeId: string): ChannelBinding | undefined;
-    enqueueInbound(message: InboundChannelMessage, agentTypeId: string): EnqueueInboundResult;
-    recordIntentionInboundActivity(binding: Pick<ChannelBinding, 'channel' | 'conversationKey' | 'agentTypeId' | 'bindingVersion'>, receivedAt: number): ChannelBinding | undefined;
-    activeBindings(): ChannelBinding[];
-    bindingForSession(sessionId: string, workspaceId: string): ChannelBinding | undefined;
-    recordIntention(input: Omit<ChannelIntentionRecord, 'status'>): boolean;
-    openIntentions(): ChannelIntentionRecord[];
-    terminalIntention(channel: string, conversationKey: string, agentTypeId: string): ChannelIntentionRecord | undefined;
-    activeIntention(channel: string, conversationKey: string, agentTypeId: string): ChannelIntentionRecord | undefined;
-    claimIntentionProjection(questionId: string, owner: string, ttlMs?: number): ChannelIntentionRecord | undefined;
-    holdIntentionForWindow(questionId: string, owner: string): boolean;
-    releaseWindowHeldIntentions(binding: Pick<ChannelBinding, 'channel' | 'conversationKey' | 'agentTypeId' | 'bindingVersion'>): void;
-    ownsIntentionClaim(questionId: string, owner: string): boolean;
-    renewIntentionClaim(questionId: string, owner: string, ttlMs?: number): boolean;
-    completeIntentionProjection(questionId: string, owner: string): boolean;
-    claimIntentionReply(intention: ChannelIntentionRecord, providerMessageId: string, values: Readonly<Record<string, unknown>>, owner: string, ttlMs?: number): ClaimIntentionReplyResult;
-    claimRecoverableIntentionAnswer(questionId: string, owner: string, ttlMs?: number): ChannelIntentionRecord | undefined;
-    completeIntentionAnswer(questionId: string, owner: string): boolean;
-    reconcileIntentionAnswered(questionId: string): void;
-    reconcileIntentionClosed(questionId: string): void;
-    claimInvalidIntentionReply(intention: ChannelIntentionRecord, providerMessageId: string, owner: string, ttlMs?: number): ClaimInvalidIntentionReplyResult;
-    completeInvalidIntentionReply(channel: string, providerMessageId: string, owner: string): boolean;
-    pendingInvalidIntentionReplies(): Array<{
-        intention: ChannelIntentionRecord;
-        providerMessageId: string;
-        retryAt: number;
-    }>;
-    hasIntentionReply(channel: string, providerMessageId: string): boolean;
-    claimOutbound(binding: ChannelBinding, owner: string, claimTtlMs?: number): boolean;
-    outboundClaimRetryAt(binding: ChannelBinding): number | undefined;
-    ownsOutboundClaim(owner: string): boolean;
-    renewOutbound(owner: string, claimTtlMs?: number): boolean;
-    releaseOutbound(owner: string): void;
-    parkOutboundBinding(binding: ChannelBinding, claimOwner: string, errorCode: string): boolean;
-    compareAndSetOutboundCursor(binding: ChannelBinding, claimOwner: string, nextCursor: string): boolean;
-    markTemplateSent(binding: ChannelBinding, claimOwner: string): boolean;
-    parkOutbound(binding: ChannelBinding, claimOwner: string, terminalOffset: string, errorCode: string): boolean;
-    acknowledgeSessionReset(binding: ChannelBinding, claimOwner: string): boolean;
-    markSessionGone(binding: ChannelBinding, claimOwner: string): boolean;
-    pendingBindings(): ChannelBinding[];
-    nextPending(channel: string, conversationKey: string, agentTypeId: string, claimOwner: string, claimTtlMs?: number): NextInboundResult;
-    renewInbound(id: number, claimOwner: string, claimTtlMs?: number): boolean;
-    completeInbound(id: number, claimOwner: string): boolean;
-    retryInbound(id: number, claimOwner: string, errorCode: string): void;
-    parkInbound(id: number, errorCode: string, claimOwner?: string): void;
-    getInbound(id: number): QueuedChannelInbound | undefined;
-    ensureSession(binding: ChannelBinding, options: EnsureSessionOptions): Promise<{
-        sessionKey: string;
-        created: boolean;
-    }>;
-    private readCreation;
-    private claimCreation;
-    private transitionCreation;
-    private finishCreation;
-    private recoverAdmitting;
-}
-
-declare const CHANNEL_UNKNOWN_BINDING: "CHANNEL_UNKNOWN_BINDING";
-declare const CHANNEL_INBOUND_PARKED: "CHANNEL_INBOUND_PARKED";
-interface ChannelAdapter {
-    readonly channelId: string;
-    parseInbound(request: Request): Promise<readonly InboundChannelMessage[]>;
-    renderOutbound(turn: unknown): readonly unknown[];
-    send(message: unknown): Promise<void>;
-}
-/**
- * Trusted, host-injected seam. Implementations resolve workspace membership
- * from the binding and never receive the adapter-owned conversation key.
- */
-interface ChannelAgentInvoker {
-    createSession(input: {
-        readonly workspaceId: string;
-        readonly authSubjectId: string;
-        readonly agentTypeId: string;
-        readonly originChannel: OriginChannel;
-        /** Stable opaque id for replaying this binding generation's allocation. */
-        readonly requestId: string;
-    }): Promise<string>;
-    isSessionBusy(input: {
-        readonly workspaceId: string;
-        readonly authSubjectId: string;
-        readonly agentTypeId: string;
-        readonly sessionKey: string;
-    }): Promise<boolean>;
-    /**
-     * Implementations MUST durably deduplicate requestId and serialize
-     * deliverySequence for a session before resolving. This is the downstream
-     * fence that makes an expired queue lease safe to replay.
-     */
-    prompt(input: ChannelAgentInvocation): Promise<void>;
-    /** Same durable idempotency and sequence contract as prompt. */
-    followUp(input: ChannelAgentInvocation): Promise<void>;
-}
-interface ChannelAgentInvocation {
-    readonly workspaceId: string;
-    readonly authSubjectId: string;
-    readonly agentTypeId: string;
-    readonly sessionKey: string;
-    readonly requestId: string;
-    /** Monotonic durable queue id; stale/lower deliveries must be a no-op. */
-    readonly deliverySequence: number;
-    readonly text: string;
-}
-type ChannelInboundAck = {
-    readonly accepted: true;
-    readonly duplicate: boolean;
-    readonly code: typeof ErrorCode.enum.CHANNEL_INBOUND_ACCEPTED;
-} | {
-    readonly accepted: false;
-    readonly duplicate: boolean;
-    readonly code: typeof CHANNEL_UNKNOWN_BINDING;
-};
-declare class ChannelInboundService {
-    private readonly store;
-    private readonly invoker;
-    private readonly options;
-    private readonly drains;
-    private readonly retryTimers;
-    private readonly claimOwner;
-    private disposed;
-    constructor(store: ChannelBindingStore, invoker: ChannelAgentInvoker, options?: {
-        readonly maxAttempts?: number;
-        readonly inboundClaimTtlMs?: number;
-        readonly drainRetryMs?: number;
-        /** Called after durable completion, including work resumed at startup. */
-        readonly onInboundDelivered?: (binding: ChannelBinding) => void;
-    });
-    /** Durable enqueue is the acknowledgement boundary; agent work stays async. */
-    accept(message: InboundChannelMessage, agentTypeId: string): ChannelInboundAck;
-    waitForIdle(): Promise<void>;
-    dispose(): Promise<void>;
-    resume(binding: ChannelBinding): void;
-    private scheduleDrain;
-    private drain;
-}
-
-interface ChannelIntentionOption {
-    readonly value: string;
-    readonly label: string;
-    readonly description?: string;
-}
-interface ChannelIntentionQuestion {
-    readonly questionId: string;
-    readonly sessionId: string;
-    readonly ownerPrincipalId: string;
-    readonly status: 'ready' | 'answered' | 'cancelled' | 'abandoned';
-    readonly title?: string;
-    readonly context?: string;
-    readonly schema?: {
-        readonly wireVersion: 1;
-        readonly fields: readonly ChannelIntentionField[];
-    };
-}
-type ChannelIntentionField = {
-    readonly type: string;
-    readonly name: string;
-    readonly label: string;
-    readonly options?: readonly ChannelIntentionOption[];
-};
-interface ChannelIntentionRuntime {
-    /** Trusted workspace scope owning this ask_user store. */
-    readonly workspaceId: string;
-    listPending(): Promise<readonly ChannelIntentionQuestion[]>;
-    getByQuestionId(questionId: string): Promise<ChannelIntentionQuestion | null>;
-    submitAnswer(questionId: string, sessionId: string, values: Readonly<Record<string, string>>): Promise<unknown>;
-    subscribe(listener: () => void): () => void;
-}
-interface ChannelIntentionSource {
-    listPending(): Promise<readonly ChannelIntentionQuestion[]>;
-    getByQuestionId(questionId: string): Promise<ChannelIntentionQuestion | null>;
-    subscribe(listener: (...args: readonly unknown[]) => void): () => void;
-}
-/** Adapts the real ask_user store/runtime pair without introducing a package cycle. */
-declare function createChannelIntentionRuntime(workspaceId: string, source: ChannelIntentionSource, answers: Pick<ChannelIntentionRuntime, 'submitAnswer'>): ChannelIntentionRuntime;
-interface ChannelIntentionAdapter {
-    readonly serviceWindowMs?: number;
-    send(input: {
-        readonly conversationKey: string;
-        readonly text: string;
-    }): Promise<void>;
-    sendWindowTemplate?(input: {
-        readonly conversationKey: string;
-    }): Promise<void>;
-}
-type ChannelIntentionAck = {
-    readonly handled: false;
-} | {
-    readonly handled: true;
-    readonly accepted: boolean;
-    readonly duplicate: boolean;
-    readonly questionId?: string;
-};
-type ChannelMessageAck = {
-    readonly kind: 'intention';
-    readonly ack: Exclude<ChannelIntentionAck, {
-        handled: false;
-    }>;
-} | {
-    readonly kind: 'agent';
-    readonly ack: ChannelInboundAck;
-};
-interface ChannelIntentionServiceOptions {
-    readonly claimTtlMs?: number;
-    readonly retryDelayMs?: number;
-}
-/**
- * Projects answerable ask_user questions to a bound channel and routes one
- * reply back into the same durable Human Intention. The runtime is an injected
- * seam so the channel core does not depend on the ask-user plugin package.
- */
-declare class ChannelIntentionService {
-    private readonly store;
-    private readonly runtime;
-    private readonly adapters;
-    private readonly options;
-    private readonly owner;
-    private scan?;
-    private rescan;
-    private timer?;
-    private unsubscribe?;
-    private disposed;
-    constructor(store: ChannelBindingStore, runtime: ChannelIntentionRuntime, adapters: ReadonlyMap<string, ChannelIntentionAdapter>, options?: ChannelIntentionServiceOptions);
-    start(): void;
-    waitForIdle(): Promise<void>;
-    dispose(): Promise<void>;
-    notifyInbound(binding: {
-        channel: string;
-        conversationKey: string;
-        agentTypeId: string;
-        bindingVersion: number;
-    }): void;
-    accept(message: InboundChannelMessage, agentTypeId: string): Promise<ChannelIntentionAck>;
-    private schedule;
-    private scanOnce;
-    private consumeAnswer;
-    private armRetry;
-}
-/** Canonical ingress composition: approval replies never fall through to the agent prompt queue. */
-declare class ChannelMessageRouter {
-    private readonly intentions;
-    private readonly inbound;
-    constructor(intentions: ChannelIntentionService, inbound: ChannelInboundService);
-    accept(message: InboundChannelMessage, agentTypeId: string): Promise<ChannelMessageAck>;
-}
-
-declare const CHANNEL_OUTBOUND_PARKED: "CHANNEL_OUTBOUND_PARKED";
-declare const CHANNEL_TURN_STALLED: "CHANNEL_TURN_STALLED";
-interface ChannelOutboundTurn {
-    readonly turnId: string;
-    readonly status: 'ok' | 'aborted' | 'error' | 'stalled';
-    readonly text: string;
-}
-interface ChannelOutboundAdapter<Message = unknown> {
-    /** Adapter-owned delivery constraint; omit for channels without a service window. */
-    readonly serviceWindowMs?: number;
-    renderOutbound(turn: ChannelOutboundTurn): readonly Message[];
-    send(input: {
-        readonly conversationKey: string;
-        readonly message: Message;
-    }): Promise<void>;
-    sendWindowTemplate?(input: {
-        readonly conversationKey: string;
-    }): Promise<void>;
-}
-interface ChannelOutboundRuntime {
-    /** Returns undefined only when the persisted session no longer exists. */
-    resolveStreamPath(binding: ChannelBinding): Promise<string | undefined>;
-    createSession(binding: ChannelBinding): Promise<string>;
-}
-interface ChannelOutboundServiceOptions {
-    readonly maxSendAttempts?: number;
-    readonly retryDelayMs?: number;
-    readonly stallTimeoutMs?: number;
-    readonly outboundClaimTtlMs?: number;
-    readonly now?: () => number;
-}
-interface AssembledTurn {
-    readonly turn: ChannelOutboundTurn;
-    readonly terminalOffset: string;
-}
-declare class ChannelOutboundService<Message = unknown> {
-    private readonly store;
-    private readonly events;
-    private readonly runtime;
-    private readonly adapters;
-    private readonly options;
-    private readonly drains;
-    private readonly pendingDrains;
-    private readonly subscriptions;
-    private readonly stallTimers;
-    private readonly claimTimers;
-    private disposed;
-    constructor(store: ChannelBindingStore, events: EventStreamStore, runtime: ChannelOutboundRuntime, adapters: ReadonlyMap<string, ChannelOutboundAdapter<Message>>, options?: ChannelOutboundServiceOptions);
-    start(): void;
-    notifyInbound(binding: ChannelBinding): void;
-    waitForIdle(): Promise<void>;
-    dispose(): Promise<void>;
-    private schedule;
-    private drain;
-    private readUnreadEvents;
-    private scheduleClaimRetry;
-    private ensureSubscription;
-    private scheduleStall;
-    private clearStall;
-    private sendWindowTemplate;
-    private sendWithRetry;
-    private resolveStreamPath;
-    private current;
-    private isInsideServiceWindow;
-    private stallTimeoutMs;
-    private now;
-}
-declare function assembleNextTurn(entries: ReadonlyArray<{
-    data: unknown;
-    offset: string;
-}>, now?: number, stallTimeoutMs?: number): AssembledTurn | undefined;
-declare function shapeChannelText(text: string, dialect: string, maxLength?: number): string[];
-
-declare const CHANNELS_ENV_FLAG = "BORING_AGENT_CHANNELS";
-declare const CHANNEL_DURABLE_STREAM_REQUIRED: "CHANNEL_DURABLE_STREAM_REQUIRED";
-declare function areChannelsEnabled(): boolean;
-declare function assertChannelDurability(durableStreamEnabled: boolean): void;
-
-interface AgentHostEnvironmentHttpProjectionOptions {
-    readonly created: CreatedAgentHost;
-    readonly authorizeAgentRequest: (request: FastifyRequest) => Promise<AuthorizedAgentScope>;
-    readonly runtimeHost?: AgentRuntimeHostOperations;
-    readonly getWorkspaceHostRoot?: (request: FastifyRequest) => string | undefined | Promise<string | undefined>;
-}
-/**
- * Mount application-owned filesystem routes over finite Host Environment leases.
- * The FS event stream explicitly retains its lease until the transport closes.
- */
-declare function registerAgentHostEnvironmentRoutes(app: FastifyInstance, options: AgentHostEnvironmentHttpProjectionOptions): Promise<void>;
-
-interface EnvironmentProvisioningSnapshot {
-    readonly changed: boolean;
-    readonly env: Readonly<Record<string, string>>;
-    readonly pathEntries: readonly string[];
-    readonly skillPaths: readonly string[];
-}
-interface EnvironmentLease {
-    /** Opaque immutable identity for this exact provider/provisioning generation. */
-    readonly generationId: string;
-    readonly bundle: RuntimeBundle;
-    /** One immutable Environment-owned snapshot shared by every compatible Agent binding. */
-    readonly provisioning?: EnvironmentProvisioningSnapshot;
-    readonly signal: AbortSignal;
-    /** Retains this exact generation; never resolves the workspace's current generation. */
-    retain(): EnvironmentLease;
-    release(): void;
-    retire(): Promise<void>;
-}
-
-/** Workspace-scoped addressing. Pi-native identities remain adapter-private. */
-interface HarnessSessionAddress {
-    readonly workspaceScopeId: string;
-    readonly ref: AgentSessionRef;
-}
-interface HarnessAgentScope {
-    readonly workspaceScopeId: string;
-    readonly agentTypeId: string;
-}
-/** Attribution only: authSubjectId is never session-storage ownership. */
-interface HarnessRequestContext {
-    readonly requestId: string;
-    readonly authSubjectId: string;
-}
-type HarnessWatchResult = {
-    readonly type: 'ok';
-    unsubscribe(): void;
-    readonly closed?: Promise<void>;
-} | {
-    readonly type: 'replay_gap' | 'cursor_ahead';
-    readonly latestSeq: number;
-    readonly minReplaySeq: number;
-};
-/**
- * Private D29 runtime seam. The Gateway ledger is the sole idempotency
- * authority; callers may retry only after ledger admission.
- */
-interface AgentHarnessBackend {
-    listSessions(scope: HarnessAgentScope, ctx: HarnessRequestContext, options?: SessionListOptions): Promise<SessionSummary[]>;
-    createSession(scope: HarnessAgentScope, ctx: HarnessRequestContext, init?: SessionCreateInit): Promise<SessionSummary>;
-    readSnapshot(address: HarnessSessionAddress, ctx: HarnessRequestContext): Promise<PiChatSnapshot>;
-    watchEvents(address: HarnessSessionAddress, ctx: HarnessRequestContext, cursor: number, subscriber: (event: PiChatEvent) => void): Promise<HarnessWatchResult>;
-    submitPrompt(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: AgentPromptPayload): Promise<PromptReceipt>;
-    submitFollowUp(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: FollowUpPayload): Promise<FollowUpReceipt>;
-    clearQueue(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: QueueClearPayload): Promise<QueueClearReceipt>;
-    interrupt(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: InterruptPayload): Promise<CommandReceipt>;
-    stop(address: HarnessSessionAddress, ctx: HarnessRequestContext, payload: StopPayload): Promise<StopReceipt>;
-    renameSession(address: HarnessSessionAddress, ctx: HarnessRequestContext, title: string): Promise<SessionSummary>;
-    deleteSession(address: HarnessSessionAddress, ctx: HarnessRequestContext): Promise<void>;
-    readAttachment(address: HarnessSessionAddress, ctx: HarnessRequestContext, messageId: string, index: number): Promise<PiChatAttachmentResult>;
-    close(): Promise<void>;
-}
-
-type PiLlmAuthKindV1 = 'api-key' | 'oauth';
-interface PiDerivedLlmProviderV1 {
-    readonly providerId: ProviderId;
-    readonly displayName: string;
-    /** Auth kinds pi supports for this provider; metadata for later slices. */
-    readonly authKinds: readonly PiLlmAuthKindV1[];
-    readonly egressOrigins: readonly `https://${string}`[];
-    readonly bindingId: CredentialConsumerBindingId;
-}
-/**
- * Narrowed per-binding surface. Runtime bindings only ever see registries and
- * the pre-bound resolver; the raw vault backend (plaintext write path) and
- * resolver minting stay host-scope-only on the full composition.
- */
-interface WorkspaceCredentialRuntimeViewV1 {
-    readonly providerRegistry: ProviderRegistryV1;
-    readonly bindingRegistry: CredentialConsumerBindingRegistryV1;
-    readonly catalog: readonly PiDerivedLlmProviderV1[];
-    readonly skippedProviderIds: readonly string[];
-    /** Present when an authority verifier was supplied at composition time. */
-    readonly resolver?: WorkspaceCredentialResolverV1;
-    /** Actor-bound Pi credential store; workspace identity is fixed at construction. */
-    createPiCredentialStore(workspaceId: string, userId: string | undefined, options: {
-        readonly allowSubscriptionOAuth: boolean;
-        readonly revokedOAuthReplacementVersion?: number;
-    }): CredentialStore;
-}
-
-interface BuiltAgentComposition {
-    readonly harness: AgentHarness;
-    readonly sessionStore: SessionStore;
-    readonly backend: AgentHarnessBackend;
-    readonly tools: readonly AgentTool[];
-    readonly pi: ResolvedPiHarnessOptions;
-    readonly runtimeBundle: RuntimeBundle;
-    readonly readyTracker: ReadyStatusTracker;
-    readonly getFilesystemBindings?: (ctx: {
-        sessionId?: string;
-        userId?: string;
-        requestId?: string;
-    }) => Promise<readonly RuntimeFilesystemBinding[]>;
-    /**
-     * [1082 slice B] Narrowed per-binding credential view (registries + the
-     * pre-bound resolver). Present only when `BORING_CREDENTIAL_KMS_BACKEND`
-     * selected a backend at host startup. The raw vault backend and resolver
-     * minting stay on the host-scope composition and are deliberately not
-     * exposed here.
-     */
-    readonly credentials?: WorkspaceCredentialRuntimeViewV1;
-    dispose(): Promise<void>;
-}
-
-interface AgentSessionActivityUpdate {
-    readonly ref: AgentSessionRef;
-    readonly status: AgentSessionActivity;
-}
-/** Process-lifetime live-turn projection. Reads never create activity rows. */
-declare class AgentSessionActivityIndex {
-    private readonly activity;
-    private readonly subscribers;
-    get(workspaceScopeId: string, ref: AgentSessionRef): AgentSessionActivity;
-    set(workspaceScopeId: string, ref: AgentSessionRef, status: AgentSessionActivity): void;
-    snapshot(workspaceScopeId: string): AgentSessionActivityUpdate[];
-    subscribe(workspaceScopeId: string, subscriber: (update: AgentSessionActivityUpdate) => void): () => void;
-    delete(workspaceScopeId: string, ref: AgentSessionRef): void;
-    observe(workspaceScopeId: string, ref: AgentSessionRef, event: PiChatEvent): void;
-}
-
-interface RuntimeBinding {
-    readonly key: string;
-    readonly agentTypeId: string;
-    readonly workspaceScopeId: string;
-    readonly authSubjectId: string;
-    readonly fundingPolicy: AgentInvocationFundingPolicyV1;
-    readonly generation: number;
-    readonly scope: ResolvedAgentRuntimeScope;
-    readonly environmentLease: EnvironmentLease;
-    readonly composition: BuiltAgentComposition;
-}
-interface AgentHostRuntime {
-    readonly options: CreateAgentHostOptions;
-    readonly compiledAgents: readonly CompiledAgentHostAgentSpec[];
-    readonly compiledById: ReadonlyMap<string, CompiledAgentHostAgentSpec>;
-    readonly ledger: AgentRequestLedger;
-    readonly effectAdmission: AgentEffectAdmission;
-    readonly activity: AgentSessionActivityIndex;
-    readonly shutdownGraceMs: number;
-    listSessionSummaries(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, options?: SessionListOptions): Promise<readonly SessionSummary[]>;
-    setSessionArchived?(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, sessionId: string, archived: boolean): Promise<SessionSummary>;
-    isDraining(): boolean;
-    assertOpen(): void;
-    verify(scope: AuthorizedAgentScope): Promise<VerifiedAgentScopeClaim>;
-    resolveAgentAccess?(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, operation: AgentAccessOperation): Promise<AgentAccessDecision>;
-    assertAgentAccess?(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, operation: AgentAccessOperation): Promise<void>;
-    resolveEnvironmentScope(scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, intent: AuthorizedEnvironmentIntent): Promise<AgentHostEnvironmentScope>;
-    acquireEnvironment(scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, intent: AuthorizedEnvironmentIntent): Promise<EnvironmentLease>;
-    acquireResolvedEnvironment(workspaceScopeId: string, environment: AgentHostEnvironmentScope): Promise<EnvironmentLease>;
-    resolveSessionRuntime(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, sessionId: string): Promise<ResolvedAgentRuntimeScope | undefined>;
-    resolveAgentRuntimeScope(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, operation: 'new-binding' | 'existing-session' | 'reload', requestId: string, sessionId?: string): Promise<ResolvedAgentRuntimeScope>;
-    resolveBinding(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, resolvedRuntimeScope?: ResolvedAgentRuntimeScope, fundingPolicy?: AgentInvocationFundingPolicyV1): Promise<RuntimeBinding>;
-    findPublishedCurrentBinding(agentTypeId: string, workspaceScopeId: string, authSubjectId: string, physicalBindingIdentity: string, bindingIdentity?: string, provisioningFingerprint?: string, fundingPolicy?: AgentInvocationFundingPolicyV1): RuntimeBinding | undefined;
-    startDrain(): void;
-    drainRuntime(): Promise<void>;
-    registerSubscription(close: () => void | Promise<void>): () => void;
-    startPreparedEffect<T>(key: AgentRequestKey, effect: () => Promise<T>): Promise<T>;
-    runBindingOperation<T>(bindingKey: string, operation: () => Promise<T>): Promise<T>;
-    closeRuntime(): Promise<void>;
-}
-declare function createAgentHost(options: CreateAgentHostOptions): Promise<CreatedAgentHost>;
-
-declare const CHANNEL_RUNTIME_FILE_NAME = ".agent-channel-runtime.sqlite";
-interface AgentHostChannelStorage {
-    readonly bindings: ChannelBindingStore;
-    readonly events: EventStreamStore;
-    close(): void;
-}
-/**
- * Opens the host-owned durable state shared by Agent Host event production and
- * channel delivery. App hosts pass `events` to their Agent Host composition and
- * the complete storage handle to {@link createAgentHostChannelRuntime}.
- */
-declare function createAgentHostChannelStorage(input: {
-    readonly sessionRoot: string;
-    readonly fileName?: string;
-}): AgentHostChannelStorage;
-interface CreateAgentHostChannelRuntimeOptions<Message> {
-    readonly gateway: AgentGateway;
-    readonly storage: AgentHostChannelStorage;
-    /** Reissues an app-owned capability after validating the durable binding. */
-    readonly resolveAuthorizedScope: (binding: Pick<ChannelBinding, 'workspaceId' | 'authSubjectId' | 'agentTypeId'>) => Promise<AuthorizedAgentScope>;
-    readonly outboundAdapters: ReadonlyMap<string, ChannelOutboundAdapter<Message>>;
-    /** Workspace-scoped ask_user source/answer seam; omit only when channels cannot ask owners. */
-    readonly intentionRuntime?: ChannelIntentionRuntime;
-    readonly outbound?: ChannelOutboundServiceOptions;
-}
-interface AgentHostChannelRuntime<Message> {
-    readonly bindings: ChannelBindingStore;
-    readonly events: EventStreamStore;
-    readonly outboundAdapters: ReadonlyMap<string, ChannelOutboundAdapter<Message>>;
-    provision(input: ProvisionChannelBindingInput): ChannelBinding;
-    /** Durable enqueue is the acknowledgement boundary; delivery continues asynchronously. */
-    acceptInbound(message: InboundChannelMessage, agentTypeId: string): ReturnType<ChannelInboundService['accept']> | ReturnType<ChannelMessageRouter['accept']>;
-    waitForIdle(): Promise<void>;
-    close(): Promise<void>;
-}
-/**
- * Concrete, provider-neutral app-host composition for channel state, session
- * invocation, durable event tails, outbound adapter lookup, restart recovery,
- * and lifecycle disposal. Provider packages only supply adapters and webhook
- * parsing; they never own workspace authority or durable state.
- */
-declare function createAgentHostChannelRuntime<Message>(options: CreateAgentHostChannelRuntimeOptions<Message>): AgentHostChannelRuntime<Message>;
-
-declare const MIN_REQUEST_RETENTION_MS: number;
-interface SqliteAgentRequestLedgerOptions {
-    /** Terminal payload retention. Values below 24 hours are raised to the minimum. */
-    readonly retentionMs?: number;
-    /** Injectable clock for deterministic storage tests. */
-    readonly now?: () => number;
-}
-/** SQLite-backed atomic ownership/CAS ledger for direct and production projections. */
-declare class SqliteAgentRequestLedger implements AgentRequestLedger {
-    readonly durability: "durable-transactional";
-    private readonly database;
-    private readonly now;
-    private readonly retentionMs;
-    constructor(path: string, options?: SqliteAgentRequestLedgerOptions);
-    prepare(key: AgentRequestKey, digest: string, acceptedWork: AcceptedWorkContext): Promise<AgentRequestLedgerPrepareResult>;
-    markAdmissionRetryable(key: AgentRequestKey): Promise<void>;
-    acceptAdmission(key: AgentRequestKey, admissionReceipt: string): Promise<void>;
-    beginEffect(key: AgentRequestKey): Promise<void>;
-    reject(key: AgentRequestKey, failure: AgentRequestFailure): Promise<void>;
-    complete(key: AgentRequestKey, receipt: JsonValue): Promise<void>;
-    markOutcomeUnknown(key: AgentRequestKey, error: AgentGatewayErrorDTO): Promise<void>;
-    read(key: AgentRequestKey): Promise<AgentRequestLedgerRecord | undefined>;
-    close(): void;
-    private migrateLegacyAcceptedWork;
-    private readSync;
-    private readActiveSync;
-    private readTombstoneSync;
-    private pruneExpiredTerminalRows;
-    private immediateTransaction;
-    private transition;
-}
-
-/**
- * Compatibility location a host falls back to when it has neither an explicit
- * ledger path nor a host-owned session root.
- *
- * Hosts historically disagreed on this tail, so it is the *only* part of the
- * chain that is parameterized. Everything before it is identical for every
- * host and is owned solely by {@link resolveRequestLedgerPath}.
- */
-type LegacyRequestLedgerLocation = 
-/** `<workspaceRoot>/.boring/agent-request-ledger.sqlite` (standalone + workspace hosts). */
-{
-    readonly layout: 'workspace-boring-dir';
-    readonly workspaceRoot: string;
-}
-/** `<workspaceRoot>/.agent-request-ledger.sqlite` (core workspace host). */
- | {
-    readonly layout: 'workspace-host-file';
-    readonly workspaceRoot: string;
-};
-interface ResolveRequestLedgerPathInput {
-    /** Explicit host-configured ledger file. Wins over every fallback. */
-    readonly requestLedgerPath?: string;
-    /** Host-owned session root supplied by the caller, if any. */
-    readonly sessionRoot?: string;
-    /**
-     * Also accept `BORING_AGENT_SESSION_ROOT` as a host-owned root when the
-     * caller supplied no `sessionRoot`. Hosts that already fold that env var
-     * into their own session-root chain omit this.
-     */
-    readonly acceptSessionRootEnv?: boolean;
-    /**
-     * Last-resort compatibility location. Omit for hosts that must fail closed
-     * instead of inventing an in-workspace ledger; they get `undefined`.
-     */
-    readonly legacy?: LegacyRequestLedgerLocation;
-}
-/**
-  * Resolve the durable request ledger file for an agent host.
- *
- * **Ledger cutover note:** adopting BORING_AGENT_SESSION_ROOT (or an
- * explicit requestLedgerPath) after running with the legacy in-workspace
- * location RELOCATES the sqlite ledger. Effect-idempotency keys recorded
- * at the legacy path are stranded there; retries that span the upgrade
- * may be re-admitted once against the new ledger. Copy or drain the
- * legacy file as part of the cutover if exactly-once effects must
- * survive it.
- *
- * The request ledger is host application state, not workspace content, so the
- * chain prefers host-owned storage: explicit option, then the caller's
- * `sessionRoot` (optionally `BORING_AGENT_SESSION_ROOT`), and only then the
- * host's legacy in-workspace location.
- *
- * This is the sole owner of that chain: no host may re-encode any part of it.
- */
-declare function resolveRequestLedgerPath(input: ResolveRequestLedgerPathInput & {
-    readonly legacy: LegacyRequestLedgerLocation;
-}): string;
-declare function resolveRequestLedgerPath(input: ResolveRequestLedgerPathInput): string | undefined;
-
-declare const AgentFleetCompilationErrorCode: {
-    readonly AGENT_FLEET_PLUGIN_UNKNOWN: "AGENT_FLEET_PLUGIN_UNKNOWN";
-    readonly AGENT_FLEET_CONFIG_BINDING_UNKNOWN: "AGENT_FLEET_CONFIG_BINDING_UNKNOWN";
-    readonly AGENT_FLEET_MODEL_POLICY_UNCOMPILED: "AGENT_FLEET_MODEL_POLICY_UNCOMPILED";
-};
-type AgentFleetCompilationErrorCode = (typeof AgentFleetCompilationErrorCode)[keyof typeof AgentFleetCompilationErrorCode];
-declare class AgentFleetCompilationError extends Error {
-    readonly code: AgentFleetCompilationErrorCode;
-    readonly details: Readonly<Record<string, string>>;
-    constructor(code: AgentFleetCompilationErrorCode, message: string, details: Readonly<Record<string, string>>);
-}
-interface AgentFleetPluginBindingContract {
-    readonly id: string;
-    readonly configKeys?: readonly string[];
-}
-interface CreateValidatingAgentFleetCompilerOptions {
-    readonly plugins: readonly AgentFleetPluginBindingContract[];
-    readonly compiler?: AgentFleetCompiler;
-    /**
-     * Keeps Core's existing fail-closed policy when it has no app compiler.
-     * This is not model allowlist validation.
-     */
-    readonly requireCompilerForModelPolicy?: boolean;
-}
-/**
- * The one reusable fleet binding-validation funnel. Apps supply only their
- * already-resolved plugin contracts and optional stricter policy compiler.
- */
-declare function createValidatingAgentFleetCompiler(options: CreateValidatingAgentFleetCompilerOptions): AgentFleetCompiler;
-
-declare class EmbeddedAgentGateway implements AgentGateway {
-    private readonly runtime;
-    private readonly sessionInventoryPager;
-    private readonly connections;
-    private readonly writerTails;
-    private readonly knownSessions;
-    private closed;
-    constructor(runtime: AgentHostRuntime);
-    /** Host-owned addressed runtime-capability effect seam. */
-    runHostEffect(input: {
-        readonly scope: AuthorizedAgentScope;
-        readonly operation: 'agent.reload' | 'session.command.execute';
-        readonly target: AgentRequestTarget;
-        readonly requestId: string;
-        readonly payload: JsonValue;
-        readonly action: () => Promise<JsonValue>;
-        readonly classify?: () => Promise<{
-            readonly kind: 'execute';
-        } | {
-            readonly kind: 'reject';
-            readonly error: AgentGatewayErrorDTO;
-        }>;
-    }): Promise<JsonValue>;
-    /** Host-internal resolver shared by every session-bearing capability route. */
-    resolveHostSessionBinding(scope: AuthorizedAgentScope, ref: AgentSessionRef): Promise<{
-        claim: VerifiedAgentScopeClaim;
-        binding: RuntimeBinding;
-    }>;
-    /** Side-effect-free reload lookup: validates session access and requires the current binding to be published. */
-    inspectPublishedSessionBinding(scope: AuthorizedAgentScope, ref: AgentSessionRef): Promise<{
-        claim: VerifiedAgentScopeClaim;
-        binding: RuntimeBinding;
-    }>;
-    /** Test-only activity seam used by the shared implementation conformance. */
-    setActivityForTesting(workspaceScopeId: string, ref: AgentSessionRef, activity: AgentSessionActivity): void;
-    private assertOpen;
-    private verify;
-    private resolveAgentAccess;
-    private throwForAgentAccessDecision;
-    private assertAgentAccess;
-    authorizeAgentAccess(input: {
-        readonly scope: AuthorizedAgentScope;
-        readonly agentTypeId: string;
-        readonly operation: AgentAccessOperation;
-    }): Promise<void>;
-    listAgents(input: {
-        readonly scope: AuthorizedAgentScope;
-    }): Promise<{
-        definition?: {
-            digest?: string | undefined;
-            version: string;
-        } | undefined;
-        pluginIds?: string[] | undefined;
-        agentTypeId: string;
-        label: string;
-    }[]>;
-    listSessions(input: Parameters<AgentGateway['listSessions']>[0]): Promise<{
-        sessions: AgentSessionSummary[];
-        nextCursor?: string;
-    }>;
-    createSession(input: Parameters<AgentGateway['createSession']>[0]): Promise<AgentSessionRef>;
-    readSessionState(input: Parameters<AgentGateway['readSessionState']>[0]): Promise<AgentSessionStateSnapshot>;
-    connectSession(input: Parameters<AgentGateway['connectSession']>[0]): Promise<AgentSessionConnection>;
-    private send;
-    renameSession(input: Parameters<AgentGateway['renameSession']>[0]): Promise<AgentSessionSummary>;
-    /**
-     * Visibility only. This never reaches the delete path: the session
-     * repository records the flag beside the transcript and hands back the same
-     * summary, so `archived: false` restores the row untouched.
-     */
-    setSessionArchived(input: Parameters<AgentGateway['setSessionArchived']>[0]): Promise<AgentSessionSummary>;
-    deleteSession(input: Parameters<AgentGateway['deleteSession']>[0]): Promise<void>;
-    private authorizedEvents;
-    close(): Promise<void>;
-    private bindingForSession;
-    private loadSummary;
-    private sessionEffect;
-    private effect;
-    private applyClassification;
-    private replayReceipt;
-    private failure;
-    private promptAdmission;
-    private queueClearAdmission;
-    private withWriter;
-}
-
-/** Process-lifetime Level-B ledger with the exact published state machine. */
-declare class InMemoryAgentRequestLedger implements AgentRequestLedger {
-    readonly durability: "in-memory";
-    private readonly records;
-    prepare(key: AgentRequestKey, digest: string, acceptedWork: AcceptedWorkContext): Promise<AgentRequestLedgerPrepareResult>;
-    markAdmissionRetryable(key: AgentRequestKey): Promise<void>;
-    acceptAdmission(key: AgentRequestKey, admissionReceipt: string): Promise<void>;
-    beginEffect(key: AgentRequestKey): Promise<void>;
-    reject(key: AgentRequestKey, failure: AgentRequestFailure): Promise<void>;
-    complete(key: AgentRequestKey, receipt: JsonValue): Promise<void>;
-    markOutcomeUnknown(key: AgentRequestKey, error: AgentGatewayErrorDTO): Promise<void>;
-    read(key: AgentRequestKey): Promise<AgentRequestLedgerRecord | undefined>;
-    private transition;
-}
-
-/** Canonical, collision-safe projection. The complete request key is the run identity. */
-declare function projectAgentRequestRunId(key: AgentRequestKey): string;
-
-interface RuntimeScopeIdentityInput {
-    readonly artifacts: readonly {
-        readonly pluginId: string;
-        readonly digest: string;
-    }[];
-    readonly validatedConfig: JsonValue;
-    readonly grants: readonly string[];
-    /** Stable semantic placement class; never an absolute root or lease key. */
-    readonly placementClassIdentity: string;
-    readonly isolationMode: string;
-    readonly toolContractDigests: readonly string[];
-    /** Stable semantic provisioning contract. */
-    readonly provisioningIdentity: string;
-    readonly bindingInputs?: JsonValue;
-}
-interface EnvironmentProvisioningIdentityInput {
-    readonly placementIdentity: string;
-    readonly providerDigest: string;
-    readonly provisioningArtifactDigests: readonly string[];
-    readonly provisioningGeneration: string;
-    readonly templateDigest?: string;
-}
-/**
- * Produces the complete Agent-binding identity. Grants intentionally
- * participate here even though they do not participate in Environment
- * provisioning identity.
- */
-declare function createResolvedRuntimeScopeIdentity(input: RuntimeScopeIdentityInput): string;
-/**
- * Produces only the Environment-mutating identity. Contribution grants and
- * tool contracts are deliberately absent, so grant-only changes share the
- * same canonical Environment lease.
- */
-declare function createEnvironmentProvisioningFingerprint(input: EnvironmentProvisioningIdentityInput): string;
-
-interface HeaderLike {
-    setHeader(name: string, value: string): void;
-}
-declare function applyCspHeaders(response: HeaderLike, opts?: {
-    dev?: boolean;
-}): void;
-
-interface DeepLinkRoutesOptions {
-    /** Workspace-agnostic store: entries carry their own `workspaceId`. */
-    store: ShareEntryStore;
-    workspace?: Workspace;
-    /**
-     * Resolves the `Workspace` already authorized for the request's scoped
-     * workspace (the same `getWorkspace` shape used by fileRoutes/treeRoutes —
-     * membership for this workspace is enforced upstream, before this route's
-     * handler runs, by the host's existing `onRequest` seam).
-     */
-    getWorkspace?: (request: FastifyRequest) => Workspace | Promise<Workspace>;
-}
-declare const deepLinkRoutes: FastifyPluginCallback<DeepLinkRoutesOptions>;
-
-interface SkillMetadataFrontmatter {
-    readonly name?: string;
-    readonly description?: string;
-}
-declare function parseSkillMetadataFrontmatter(content: string): SkillMetadataFrontmatter;
-
-interface PiResourceDigestLimits {
-    readonly maxDepth: number;
-    readonly maxFiles: number;
-    readonly maxFileBytes: number;
-    readonly maxTotalBytes: number;
-}
-declare const DEFAULT_PI_RESOURCE_DIGEST_LIMITS: PiResourceDigestLimits;
-interface PiResourceDigestInput {
-    /** Cwd passed to Pi. Explicit skills/extensions resolve from here. */
-    readonly piCwd: string;
-    /** Pi user agent directory. User settings/package sources resolve from here. */
-    readonly piAgentDir: string;
-    /** User home Pi uses for ~/.agents skill discovery. */
-    readonly piUserHome: string;
-    /** Mirrors Pi's noSkills resource-loader option. */
-    readonly noSkills: boolean;
-    /** Mirrors Pi's noContextFiles resource-loader option; omitted stays sealed. */
-    readonly noContextFiles?: boolean;
-    readonly promptParts?: readonly (string | undefined)[];
-    readonly additionalSkillPaths?: readonly string[];
-    readonly packages?: readonly PiPackageSource[];
-    readonly extensionPaths?: readonly string[];
-    /** Lexical roots explicitly authorized by the embedding Workspace/CLI. */
-    readonly authorizedRoots: readonly string[];
-    readonly limits?: Partial<PiResourceDigestLimits>;
-}
-interface PiResourceSet {
-    readonly promptParts?: readonly (string | undefined)[];
-    readonly additionalSkillPaths?: readonly string[];
-    readonly packages?: readonly PiPackageSource[];
-    readonly extensionPaths?: readonly string[];
-}
-/** Canonical normalization shared by Workspace and CLI resource resolvers. */
-declare function createPiResourceDigestInput(input: {
-    readonly piCwd: string;
-    readonly piAgentDir?: string;
-    readonly piUserHome?: string;
-    readonly noSkills?: boolean;
-    readonly noContextFiles?: boolean;
-    readonly resourceSets: readonly PiResourceSet[];
-    readonly authorizedRoots: readonly string[];
-    readonly limits?: Partial<PiResourceDigestLimits>;
-}): PiResourceDigestInput;
-/** Bounded asynchronous content identity for the exact Pi resources considered by a reload candidate. */
-declare function digestPiResourceInputs(input: PiResourceDigestInput): Promise<string>;
-/** Immutable digest plus the reload fences that defend that exact snapshot. */
-declare function createPiResourceDigestFence(resolveInput: () => PiResourceDigestInput | Promise<PiResourceDigestInput>): Promise<{
-    readonly resourceInputDigest: string;
-    readonly revalidateResourceInputs: () => Promise<void>;
-}>;
-
-/**
- * `plugin_diagnostics` built-in agent tool.
- *
- * Surfaces current plugin/skill loading errors to the agent so it can iterate
- * on them without the failures being silently swallowed. It merges three
- * sources:
- *
- *  - `lastReloadDiagnostics`: diagnostics captured by the most recent
- *    /api/v1/agents/:agentTypeId/reload (hook + harness resource diagnostics).
- *  - `resourceDiagnostics`: live Pi skill/extension load diagnostics for the
- *    current session, read straight from the harness.
- *  - `pluginErrors`: host-provided plugin load/preflight errors for the
- *    workspace (wired by the embedding host).
- *
- * The tool is informational: it returns the diagnostics as data and never
- * reports `isError`, even when diagnostics exist.
- */
-
-interface PluginDiagnostic {
-    source: string;
-    message: string;
-    pluginId?: string;
-}
-interface PluginDiagnosticsToolDeps {
-    /** Diagnostics stashed by the last /reload. Read via a thunk because the
-     * runtime binding is assigned after the tool catalog is built. */
-    getLastReloadDiagnostics: () => ReadonlyArray<PluginDiagnostic>;
-    /** Live harness, used to read per-session resource diagnostics. */
-    getHarness: () => AgentHarness | undefined;
-    /** Optional host callback returning workspace plugin load/preflight errors. */
-    getPluginErrors?: () => Promise<ReadonlyArray<PluginDiagnostic>>;
-}
-declare function createPluginDiagnosticsTool(deps: PluginDiagnosticsToolDeps): AgentTool;
-
-declare const RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE: "RUNTIME_FILESYSTEM_BINDING_DUPLICATE";
-declare class RuntimeFilesystemBindingConfigurationError extends Error {
-    readonly code: "RUNTIME_FILESYSTEM_BINDING_DUPLICATE";
-    readonly filesystem: string;
-    constructor(filesystem: string);
-}
-/**
- * Canonical final merge seam for runtime-owned and request-scoped bindings.
- * Duplicates *within* either list stay configuration errors; a host/request
- * collision on the same id composes as an intersection of both capabilities.
- */
-declare function mergeRuntimeFilesystemBindings<T extends RuntimeFilesystemBinding>(runtimeBindings: readonly T[] | undefined, requestBindings: readonly T[] | undefined): readonly RuntimeFilesystemBinding[] | undefined;
-
-declare const RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE: "RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID";
-declare class RuntimeReadonlyFilesystemPolicyError extends Error {
-    readonly code: "RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID";
-    constructor();
-}
-/**
- * Default protected prefixes applied when a host does not configure its own.
- * `.agents` holds agent governance/skill definitions: agents may read them but
- * must never rewrite the rules they run under. Hosts opt out with an explicit
- * empty array.
- */
-declare const DEFAULT_READONLY_WORKSPACE_PATHS: readonly string[];
-interface RuntimeReadonlyFilesystemPolicy {
-    readonly readonlyPaths: readonly string[];
-    readonly revision: string;
-}
-declare function normalizeRuntimeReadonlyFilesystemPolicy(paths: readonly string[]): RuntimeReadonlyFilesystemPolicy;
-/** Resolve policy after the Workspace adapter has normalized/confined the path. */
-declare function resolveRuntimeReadonlyFilesystemAccess(policy: RuntimeReadonlyFilesystemPolicy, descriptor: {
-    readonly filesystem: string;
-    readonly normalizedPath: string;
-}): RuntimeFilesystemAccessDecision;
-
-/** Primary-user Operations adapter shared by HTTP and Pi filesystem tools. */
-declare function createUserFilesystemBinding(workspace: Workspace, policy: RuntimeReadonlyFilesystemPolicy, resolvePolicyPath: (path: string) => Promise<string>): RuntimeFilesystemBinding;
-
-declare function withResolvedCredential<T>(resolver: WorkspaceCredentialResolverV1, workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1, fn: (lease: ResolvedCredentialLeaseV1) => T | Promise<T>): Promise<T>;
-
-/** Opaque, encrypted vault field containing Pi's canonical OAuth credential. */
-declare const PI_OAUTH_CREDENTIAL_FIELD_ID_V1: CredentialFieldId;
-interface VaultCredentialStoreOptionsV1 {
-    readonly workspaceId: string;
-    /** Verified actor identity. Required whenever subscription OAuth is enabled. */
-    readonly userId?: string;
-    readonly vaultBackend: VaultCredentialStoreBackendV1;
-    /** Subscription OAuth is interactive-only; unattended seats set this false. */
-    readonly allowSubscriptionOAuth: boolean;
-    /** Login-only store's durable version fence for replacing a revoked OAuth tombstone. */
-    readonly revokedOAuthReplacementVersion?: number;
-    readonly allowedOAuthProviderIds?: readonly string[];
-}
-/**
- * Adapts Pi's async CredentialStore to one authorized workspace's encrypted
- * vault. The adapter is actor-bound at construction and never accepts a
- * workspace id from callers. Pi remains the sole owner of login and refresh.
- */
-declare function createVaultCredentialStoreV1(options: VaultCredentialStoreOptionsV1): CredentialStore;
-
-type SafeOAuthEventV1 = {
-    readonly type: 'auth_url';
-    readonly url: string;
-} | {
-    readonly type: 'device_code';
-    readonly userCode: string;
-    readonly verificationUri: string;
-    readonly expiresInSeconds?: number;
-} | {
-    readonly type: 'progress';
-};
-interface SafeOAuthPromptV1 {
-    readonly type: AuthPrompt['type'];
-    readonly options?: readonly {
-        readonly id: string;
-        readonly label: string;
-    }[];
-}
-interface OAuthFlowSnapshotV1 {
-    readonly flowId: string;
-    readonly providerId: 'openai-codex';
-    readonly status: 'pending' | 'succeeded' | 'failed' | 'cancelled';
-    readonly events: readonly SafeOAuthEventV1[];
-    readonly prompt?: SafeOAuthPromptV1;
-    readonly createdAt: string;
-    readonly completedAt?: string;
-}
-interface CodexDisconnectResultV1 {
-    /** Pi logout is local credential orchestration; it does not currently attest upstream revocation. */
-    readonly logoutStatus: 'completed' | 'failed';
-    readonly upstreamStatus: 'pending';
-}
-interface OpenAiCodexOAuthBrokerV1 {
-    start(workspaceId: string, userId: string): Promise<OAuthFlowSnapshotV1>;
-    get(workspaceId: string, userId: string, flowId: string): OAuthFlowSnapshotV1 | undefined;
-    respond(workspaceId: string, userId: string, flowId: string, value: string): Promise<OAuthFlowSnapshotV1>;
-    cancel(workspaceId: string, userId: string, flowId: string): Promise<void>;
-    disconnect(workspaceId: string, userId: string): Promise<CodexDisconnectResultV1>;
-}
-interface OpenAiCodexOAuthBrokerOptionsV1 {
-    readonly credentialStoreForActor: (workspaceId: string, userId: string) => CredentialStore | Promise<CredentialStore>;
-    readonly createRuntime?: (credentials: CredentialStore) => Promise<Pick<ModelRuntime, 'login' | 'logout'>>;
-    readonly now?: () => number;
-}
-declare function createOpenAiCodexOAuthBrokerV1(options: OpenAiCodexOAuthBrokerOptionsV1): OpenAiCodexOAuthBrokerV1;
-
-export { AgentAccessDecision, AgentAccessOperation, AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostChannelRuntime, type AgentHostChannelStorage, AgentHostCredentialOptionsV1, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentInstructionSource, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CHANNELS_ENV_FLAG, CHANNEL_DURABLE_STREAM_REQUIRED, CHANNEL_INBOUND_PARKED, CHANNEL_OUTBOUND_PARKED, CHANNEL_RUNTIME_FILE_NAME, CHANNEL_TURN_STALLED, CHANNEL_UNKNOWN_BINDING, type ChannelAdapter, type ChannelAgentInvocation, type ChannelAgentInvoker, type ChannelBinding, ChannelBindingStore, type ChannelInboundAck, ChannelInboundService, type ChannelIntentionAck, type ChannelIntentionAdapter, type ChannelIntentionField, type ChannelIntentionOption, type ChannelIntentionQuestion, type ChannelIntentionRecord, type ChannelIntentionRuntime, ChannelIntentionService, type ChannelIntentionServiceOptions, type ChannelIntentionSource, type ChannelMessageAck, ChannelMessageRouter, type ChannelOutboundAdapter, type ChannelOutboundRuntime, ChannelOutboundService, type ChannelOutboundServiceOptions, type ChannelOutboundTurn, ChannelSessionCreateTimeoutError, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, type CreateAgentHostChannelRuntimeOptions, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, CredentialVaultPersistenceV2, DEFAULT_AGENT_FLEET, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, type InboundChannelMessage, type LegacyRequestLedgerLocation, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, type LocalCredentialVersionAnchorOptionsV1, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, MIN_REQUEST_RETENTION_MS, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, ModeContext, type ModelTierCandidate, type OpenAiCodexOAuthBrokerV1, PI_OAUTH_CREDENTIAL_FIELD_ID_V1, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionChannelBindingInput, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, type QueuedChannelInbound, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolveRequestLedgerPathInput, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, type ResolvedInstructionFileRefs, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, StoredCredentialRecordV1, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, type VaultCredentialStoreBackendV1, type VaultCredentialStoreOptionsV1, VerifiedAgentScopeClaim, type WithheldInstructionRef, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, type WorkspaceCredentialVersionAnchorV1, type WorkspaceCredentialVersionAnchorV2, type WorkspaceCredentialVersionStateV1, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, areChannelsEnabled, assembleNextTurn, assertChannelDurability, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createAgentHostChannelRuntime, createAgentHostChannelStorage, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createChannelIntentionRuntime, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createInMemoryCredentialVaultPersistenceV1, createInMemoryCredentialVersionAnchorV1, createLocalCredentialVersionAnchorFromEnvV1, createLocalFileCredentialVersionAnchorV1, createLocalKekWorkspaceKekProviderFromEnvV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createOpenAiCodexOAuthBrokerV1, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createPostgresCredentialVaultPersistenceV1, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVaultCredentialStoreBackendV1, createVaultCredentialStoreV1, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, initializeLocalFileCredentialVersionAnchorV1, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAgentRequestRunId, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveAgentInstructionFileRefs, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRequestLedgerPath, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, runCredentialVaultPostgresMigrationsV1, sandboxRuntimeHostOperations, shapeChannelText, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };