@hachej/boring-agent 0.1.111 → 0.2.0

package/dist/types-DcWoQMn8.d.ts

@@ -1,1377 +0,0 @@
-import { d as PiChatEvent, C as ChatModelSelection } from './piChatEvent-DpE0lIb9.js';
-import { v as SessionStreamIdentity, C as ToolReadinessRequirement, w as TelemetrySink, s as AgentTool, D as AgentHarnessFactory } from './harness-qHlMJhZo.js';
-import { FastifyRequest, FastifyPluginAsync } from 'fastify';
-import { F as FileSearch, g as AgentSkillResource, P as ProviderId, n as CredentialEnvelopeV1, K as WrappedWorkspaceDekV1, B as WorkspaceCredentialAuthorityVerifierV1, V as VerifiedWorkspaceCredentialAuthorityV1, t as WorkspaceAgentDirectRunInput, L as LeaseBoundWorkspaceAgent } from './file-search-BUgMSKZE.js';
-import { b as Workspace, h as RuntimeFilesystemCapability, j as WorkspaceRuntimeContext, c as Sandbox } from './sandbox-BMhut3kh.js';
-import { B as CredentialLifecycleStateV1, b as AgentSessionRef, V as VerifiedAgentScopeClaim, k as AgentGatewayErrorDTO, P as JsonValue, a as AuthorizedAgentScope, A as AgentGateway, m as AgentScopeVerifier, T as ResolveAgentAccess } from './admin-DORVQfLn.js';
-import { RuntimeHostOperations, RuntimeFilesystemBinding as RuntimeFilesystemBinding$1 } from '@hachej/boring-bash/agent';
-import { BwrapArgsOptions } from '@hachej/boring-sandbox/providers/bwrap';
-import { CreateNodeWorkspaceOptions, BoringAgentRuntimePaths } from '@hachej/boring-sandbox/providers/node-workspace';
-import { CredentialStore } from '@earendil-works/pi-ai';
-import { PackageSource, ExtensionFactory } from '@mariozechner/pi-coding-agent';
-
-interface EventStreamReadResult {
-    events: Array<{
-        data: unknown;
-        offset: string;
-    }>;
-    nextOffset: string;
-    upToDate: boolean;
-    closed: boolean;
-}
-interface EventStreamMeta {
-    nextOffset: string;
-    closed: boolean;
-}
-interface SessionStreamOwner {
-    readonly path: string;
-    readonly workspaceScopeId: string;
-    readonly sessionId: string;
-    readonly agentTypeId: string | null;
-    readonly authSubjectId: string | null;
-    readonly seatId: string | null;
-    readonly threadId: string | null;
-    readonly keyVersion: number;
-    readonly createdAt: number;
-}
-interface CreateSessionStreamAttributes {
-    readonly agentTypeId: string;
-    readonly authSubjectId?: string;
-}
-declare const ownedSessionStreamBrand: unique symbol;
-interface OwnedSessionStream {
-    readonly [ownedSessionStreamBrand]: true;
-    readonly path: string;
-    readonly identity: SessionStreamIdentity;
-}
-interface EventStreamStore {
-    createStream(path: string): Promise<void>;
-    createSessionStream(identity: SessionStreamIdentity, attrs: CreateSessionStreamAttributes): Promise<OwnedSessionStream>;
-    readStreamOwner(path: string): Promise<SessionStreamOwner | null>;
-    appendEvent(path: string, event: unknown): Promise<string>;
-    appendEventOnce(path: string, key: string, event: unknown): Promise<string>;
-    appendAgentEvent(stream: OwnedSessionStream, chunk: PiChatEvent, opts?: {
-        idempotencyKey?: string;
-    }): Promise<string>;
-    readEvents(path: string, opts?: {
-        offset?: string;
-        limit?: number;
-    }): Promise<EventStreamReadResult>;
-    closeStream(path: string): Promise<void>;
-    getStreamMeta(path: string): Promise<EventStreamMeta | null>;
-    subscribe(path: string, listener: () => void): () => void;
-}
-
-type SessionFileChangeOp = 'write' | 'edit' | 'unlink' | 'rename' | 'mkdir';
-interface SessionFileChange {
-    op: SessionFileChangeOp;
-    path: string;
-    oldPath?: string;
-    size?: number;
-    timestamp: string;
-}
-interface SessionChangesTracker {
-    record(scope: SessionChangesScope | string, change: SessionFileChange): void;
-    list(scope: SessionChangesScope | string): SessionFileChange[];
-    clear(scope: SessionChangesScope | string): void;
-}
-interface SessionChangesScope {
-    readonly workspaceScopeId?: string;
-    readonly agentTypeId?: string;
-    readonly sessionId: string;
-}
-
-interface AgentModelSelection {
-    provider: string;
-    id: string;
-}
-
-/**
- * GET /api/v1/agents/:agentTypeId/models
- *
- * Returns the list of models pi-coding-agent has auth for (i.e. where
- * the corresponding provider API key is present in the environment or
- * `~/.pi/agent/auth.json`). Consumers — including the shadcn example
- * ChatPanel — fetch this endpoint to populate the model-selector dropdown
- * instead of hardcoding a short alias list.
- *
- * Shape:
- *   {
- *     models: [
- *       { provider: "anthropic", id: "claude-sonnet-4-6", label: "Claude Sonnet 4.6", available: true },
- *       ...
- *     ]
- *   }
- *
- * Safe to call unauthenticated — we only report {provider, id, label,
- * available}, never any key material.
- */
-
-interface ModelSummary {
-    provider: string;
-    id: string;
-    label: string;
-    available: boolean;
-}
-interface ModelFilterContext {
-    request: FastifyRequest;
-    workspaceId?: string;
-}
-type ModelFilterResult = {
-    models: readonly ModelSummary[];
-    defaultModel?: AgentModelSelection;
-};
-interface ModelsRoutesOptions {
-    path?: string;
-    authorizeRequest?: (request: FastifyRequest) => void | Promise<void>;
-    filterModels?: (ctx: ModelFilterContext, models: readonly ModelSummary[], defaultModel: AgentModelSelection | undefined) => ModelFilterResult | Promise<ModelFilterResult>;
-}
-
-/**
- * Generic metering seam for hosts that bill native Pi usage.
- *
- * The agent package owns lifecycle correctness (when to reserve, record,
- * settle, release based on native Pi events); the host-provided sink owns
- * persistence and product policy (credits, pricing, currencies, hard stops).
- *
- * Lifecycle per accepted prompt/follow-up ("run", identified by `runId`):
- *
- *   reserveRun        before execution starts; throwing rejects the request
- *                     (fail closed) so hosts can enforce hard stops.
- *   recordUsage       once per native assistant message carrying usage.
- *                     `usageId` is a stable idempotency key.
- *   settleRun         when the run reaches a native terminal state and billable
- *                     usage or an authoritative all-zero usage row was recorded.
- *   releaseRun        when the run does not settle: rejected execution, cleared
- *                     queue, cancel/abort, error before usage, or a fail-closed
- *                     fallback charge.
- *
- * Every run terminates with exactly one settle or release from the
- * coordinator; sinks should still treat all four methods as idempotent
- * because process restarts and client retries can replay transitions.
- */
-interface AgentMeteringSink {
-    /** False means the sink is installed but policy is disabled/no-op. Omitted means active for fail-closed callers. */
-    isEnabled?: () => boolean;
-    reserveRun(input: MeteringReserveInput): Promise<MeteringReservationResult>;
-    /** Records the usage and returns the credit micros it was actually billed. The
-     * coordinator counts a usage as billable from this charged amount (not raw provider
-     * fields). A complete, internally consistent all-zero report settles at zero;
-     * potentially billable usage priced to 0 retains fail-closed fallback. */
-    recordUsage(input: MeteringUsageInput): Promise<MeteringUsageResult>;
-    settleRun(input: MeteringSettleInput): Promise<void>;
-    releaseRun(input: MeteringReleaseInput): Promise<void>;
-}
-interface MeteringUsageResult {
-    /** Credit micros this usage row was billed (0 = no real debit). */
-    billedMicros: number;
-}
-interface MeteringRunScope {
-    workspaceId?: string;
-    userId?: string;
-    userEmail?: string;
-    userEmailVerified?: boolean;
-    sessionId: string;
-    /** Stable id for one accepted prompt/follow-up run. */
-    runId: string;
-    source: 'pi-chat';
-}
-type MeteringRunKind = 'prompt' | 'followup';
-interface MeteringReserveInput extends MeteringRunScope {
-    kind: MeteringRunKind;
-    message: string;
-    model?: ChatModelSelection;
-}
-/** Sinks without reservation rows can return an empty object. */
-interface MeteringReservationResult {
-    reservationId?: string;
-}
-interface MeteringUsage {
-    input: number;
-    output: number;
-    cacheRead: number;
-    cacheWrite: number;
-    cost: {
-        input: number;
-        output: number;
-        cacheRead: number;
-        cacheWrite: number;
-        total: number;
-    };
-}
-interface MeteringUsageInput extends MeteringRunScope {
-    reservationId?: string;
-    /** Stable idempotency key for this usage row. */
-    usageId: string;
-    messageId?: string;
-    model?: {
-        provider?: string;
-        id?: string;
-    };
-    usage: MeteringUsage;
-    stopReason?: string;
-    metadata?: Record<string, unknown>;
-}
-type MeteringRunStatus = 'ok' | 'error' | 'aborted';
-interface MeteringSettleInput extends MeteringRunScope {
-    reservationId?: string;
-    status: MeteringRunStatus;
-}
-type MeteringReleaseReason = 'run-rejected' | 'queue-cleared' | 'cancelled' | 'error-before-usage' | 'usage-write-failed' | 'fallback-hold-charge';
-interface MeteringReleaseInput extends MeteringRunScope {
-    reservationId?: string;
-    reason: MeteringReleaseReason;
-}
-type MeteringErrorLogger = (message: string, error: unknown) => void;
-/** Native Pi usage objects always carry token + cost breakdowns; normalize
- * defensively (zero-filling gaps and clamping negatives) so a partial object
- * from an unexpected provider still meters as zeros instead of NaN. */
-declare function normalizeMeteringUsage(value: unknown): MeteringUsage | undefined;
-
-type ReadyState = 'provisioning' | 'ready' | 'degraded';
-type CapabilityState = 'not-started' | 'preparing' | 'ready' | 'failed';
-interface CapabilityReadinessDetail {
-    state: CapabilityState;
-    requirement?: ToolReadinessRequirement;
-    startedAt?: string;
-    completedAt?: string;
-    errorCode?: string;
-    causeCode?: string;
-    retryable?: boolean;
-    message?: string;
-}
-interface AgentCapabilityReadiness {
-    chat: CapabilityReadinessDetail;
-    workspace: CapabilityReadinessDetail;
-    runtimeDependencies: CapabilityReadinessDetail;
-}
-interface ReadyStatusEvent {
-    state: ReadyState;
-    sandboxReady: boolean;
-    harnessReady: boolean;
-    capabilities: AgentCapabilityReadiness;
-    message?: string;
-    timestamp: string;
-}
-interface ReadinessSnapshot {
-    sandboxReady: boolean;
-    harnessReady: boolean;
-    capabilities: AgentCapabilityReadiness;
-    degradedReason?: string;
-}
-type StatusHandler = (event: ReadyStatusEvent) => void;
-declare class ReadyStatusTracker {
-    private _sandboxReady;
-    private _harnessReady;
-    private _degradedReason?;
-    private _capabilities;
-    private subscribers;
-    constructor(opts?: {
-        sandboxReady?: boolean;
-        harnessReady?: boolean;
-        capabilities?: Partial<AgentCapabilityReadiness>;
-    });
-    get state(): ReadyState;
-    isReady(): boolean;
-    getReadiness(): ReadinessSnapshot;
-    getCapabilities(): AgentCapabilityReadiness;
-    updateCapability(name: keyof AgentCapabilityReadiness, detail: CapabilityReadinessDetail): void;
-    updateRuntimeDependencies(detail: CapabilityReadinessDetail): void;
-    markSandboxReady(): void;
-    markHarnessReady(): void;
-    markDegraded(reason: string): void;
-    clearDegraded(): void;
-    subscribe(handler: StatusHandler): () => void;
-    private emit;
-    private snapshot;
-}
-
-/**
- * Host-owned values used by Agent's provider-neutral runtime composition.
- *
- * Built-in concrete operations live in `sandboxRuntimeHost.ts`; custom hosts
- * may inject an equivalent implementation with their Workspace + Sandbox pair.
- */
-interface AgentRuntimeHostOperations extends RuntimeHostOperations {
-    /**
-     * Agent legally depends on the provider package, so the injected builder is
-     * typed with the canonical options here rather than the narrowed slice
-     * boring-bash declares.
-     */
-    buildBwrapArgs(workspaceRoot: string, options?: BwrapArgsOptions): string[];
-    createNodeWorkspace(root: string, options?: CreateNodeWorkspaceOptions): Workspace;
-    getNodeWorkspaceHostRoot(workspace: Workspace): string | undefined;
-    getBoringAgentRuntimePaths(workspaceRoot: string): BoringAgentRuntimePaths;
-    getBoringAgentRuntimeEnv(paths: BoringAgentRuntimePaths, cacheRoot?: string): Record<string, string>;
-    getBoringAgentPathEntries(paths: BoringAgentRuntimePaths): string[];
-    readonly runtimeLayout: Readonly<{
-        agentDir: string;
-        runtimeDirNames: readonly string[];
-        gitignoreContent: string;
-    }>;
-    validatePath(root: string, requestedPath: string): string;
-    assertRealPathWithinWorkspace(root: string, targetPath: string): Promise<void>;
-    resolveRealWorkspacePath(root: string, targetPath: string): Promise<string>;
-    isIgnoredDirName(name: string): boolean;
-    /** Host-owned confined projection for package resources outside the workspace. */
-    createAgentResourceFilesystemBinding(filesystem: string, mounts: readonly {
-        readonly logicalRoot: string;
-        readonly sourceRoot: string;
-    }[]): Promise<RuntimeFilesystemBinding$1>;
-}
-
-interface ProvisioningLogger {
-    info?(message: string, fields?: Record<string, unknown>): void;
-    warn?(message: string, fields?: Record<string, unknown>): void;
-    error?(message: string, fields?: Record<string, unknown>): void;
-}
-
-interface PluginSkillSource {
-    name: string;
-    source: string | URL;
-}
-interface RuntimeTemplateContribution {
-    id: string;
-    path: string | URL;
-    target?: string;
-}
-interface RuntimePythonSpec {
-    id: string;
-    projectFile: string | URL;
-    packageName?: string;
-    packageRoot?: string | URL;
-    version?: string;
-    extraLibs?: string[];
-    env?: Record<string, string | URL>;
-    expectedBins?: string[];
-}
-interface RuntimeNodePackageSpec {
-    id: string;
-    packageName: string;
-    packageRoot?: string | URL;
-    version?: string;
-    expectedBins?: string[];
-}
-interface RuntimeProvisioningContribution {
-    templateDirs?: RuntimeTemplateContribution[];
-    python?: RuntimePythonSpec[];
-    nodePackages?: RuntimeNodePackageSpec[];
-}
-interface WorkspaceProvisioningResult {
-    changed: boolean;
-    env: Record<string, string>;
-    pathEntries: string[];
-    skillPaths: string[];
-}
-interface WorkspaceProvisioningExecResult {
-    stdout?: string;
-    stderr?: string;
-}
-interface ResolveInstallSourceOpts {
-    kind: 'node' | 'python';
-    id: string;
-    fingerprint: string;
-}
-interface WorkspaceProvisioningAdapter {
-    /** Application-owned runtime ID; provisioning does not select builtin adapters. */
-    mode: string;
-    exec(command: string, args: string[], opts?: {
-        cwd?: string;
-        env?: Record<string, string>;
-        timeoutMs?: number;
-    }): Promise<WorkspaceProvisioningExecResult | void>;
-    resolveInstallSource(source: string | URL, opts: ResolveInstallSourceOpts): Promise<string>;
-    workspaceFs: {
-        exists(workspaceRelativePath: string): Promise<boolean>;
-        /** Remove a workspace-relative generated path. Missing path is success. */
-        rm(workspaceRelativePath: string): Promise<void>;
-        /** Create a workspace-relative directory recursively. */
-        mkdir(workspaceRelativePath: string): Promise<void>;
-        writeText(workspaceRelativePath: string, content: string): Promise<void>;
-        readText(workspaceRelativePath: string): Promise<string | null>;
-        /** Copy a host file or directory into the workspace; directory copies are recursive. */
-        copyFromHost(hostSourcePath: string | URL, workspaceRelativeTarget: string): Promise<void>;
-    };
-    getRuntimeCacheRoot(): string;
-}
-interface ProvisioningTelemetryContext {
-    workspaceId?: string;
-    sessionId?: string;
-    requestId?: string;
-    runtimeMode?: string;
-}
-interface ProvisionWorkspaceRuntimeOptions {
-    plugins: Array<{
-        id: string;
-        skills?: PluginSkillSource[];
-        provisioning?: RuntimeProvisioningContribution;
-    }>;
-    adapter: WorkspaceProvisioningAdapter;
-    runtimeLayout: BoringAgentRuntimePaths;
-    runtimeHost: AgentRuntimeHostOperations;
-    logger?: ProvisioningLogger;
-    telemetry?: TelemetrySink;
-    telemetryContext?: ProvisioningTelemetryContext;
-}
-
-type BuiltinRuntimeModeId = 'direct' | 'local' | 'blaxel' | 'vercel-sandbox';
-type RuntimeModeId = BuiltinRuntimeModeId | (string & {});
-interface RuntimeModeReadinessHooks {
-    initialSandboxReady?: boolean;
-    initialWorkspaceReadiness?: CapabilityReadinessDetail;
-    onTrackerCreated?: (tracker: ReadyStatusTracker) => void;
-}
-type RuntimeCachedBindingHealthCheckResult = {
-    state: 'ok';
-} | {
-    state: 'recreate';
-    message?: string;
-    error?: unknown;
-};
-interface RuntimeCachedBindingHealthCheck {
-    intervalMs?: number;
-    check(ctx: {
-        runtimeBundle: RuntimeBundle;
-        workspaceId: string;
-    }): Promise<RuntimeCachedBindingHealthCheckResult>;
-}
-type RuntimeBashStrategy = {
-    kind: 'host';
-    preserveHostHome?: boolean;
-} | {
-    kind: 'local-sandbox';
-    sandboxRoot: string;
-} | {
-    kind: 'remote';
-    defaultPath?: string;
-};
-interface RuntimeRemoteWorkspacePathOptions {
-    rootAliases?: string[];
-    toRemotePath?: (value: string) => string;
-    toRuntimePath?: (value: string) => string;
-    sanitizeErrorText?: (value: string) => string;
-}
-type RuntimeFilesystemStrategy = {
-    kind: 'host';
-} | {
-    kind: 'remote-workspace';
-    pathOptions?: RuntimeRemoteWorkspacePathOptions;
-};
-interface RuntimeProjectionRequest {
-    /** Server-private endpoint coordinates. Never expose this request to plugin/front/model code. */
-    port: number;
-    path?: string;
-}
-interface RuntimeProjectionLease {
-    /** Sealed upstream consumed only by the Host projection broker. */
-    readonly url: string;
-    readonly expiresAt: string;
-    revoke(): Promise<void>;
-}
-type RuntimeTrustedServiceOperation = 'start' | 'observe' | 'act' | 'takeover' | 'return-control' | 'stop';
-interface RuntimeTrustedServiceQualificationV1 {
-    readonly serviceRef: 'trusted-service-v1';
-    readonly protocolDigest: string;
-    readonly imageDigest: string;
-    readonly isolation: 'dedicated-uid-private-channel';
-}
-interface RuntimeTrustedServiceLeaseV1 {
-    readonly qualification: RuntimeTrustedServiceQualificationV1;
-    invoke(input: {
-        readonly operation: RuntimeTrustedServiceOperation;
-        readonly payload?: Uint8Array;
-        readonly timeoutMs: number;
-        readonly signal: AbortSignal;
-    }): Promise<{
-        readonly status: 'ok' | 'rejected' | 'unknown-outcome';
-        readonly payload?: Uint8Array;
-    }>;
-    /** Host-only fixed endpoint lookup. No host, port, URL, or provider identity crosses this seam. */
-    createProjection(input: {
-        readonly mode: 'observe' | 'control';
-        readonly expiresAt: Date;
-    }): Promise<RuntimeProjectionLease>;
-    close(): Promise<void>;
-}
-interface RuntimeTrustedServiceMechanismV1 {
-    readonly qualification: RuntimeTrustedServiceQualificationV1;
-    acquire(input: {
-        readonly leaseId: string;
-        readonly idleTtlMs: number;
-        readonly absoluteTtlMs: number;
-        readonly signal: AbortSignal;
-    }): Promise<RuntimeTrustedServiceLeaseV1>;
-}
-interface RuntimeModeAdapter {
-    readonly id: RuntimeModeId;
-    readonly runtimeHost?: AgentRuntimeHostOperations;
-    /**
-     * Declares whether the workspace files are strongly available on the host
-     * path before create() runs. Composition layers use this to decide whether
-     * host-side fs checks/prompts are safe without hard-coding sandbox IDs.
-     */
-    readonly workspaceFsCapability?: Workspace['fsCapability'];
-    readonly readiness?: RuntimeModeReadinessHooks;
-    readonly cachedBindingHealthCheck?: RuntimeCachedBindingHealthCheck;
-    create(ctx: ModeContext): Promise<RuntimeBundle>;
-    /** Resolves the provider-owned workspace root in runtime coordinates. */
-    getRuntimeLayoutRoot(ctx: ModeContext): string;
-    evictCachedRuntime?(ctx: {
-        workspaceId: string;
-    }): void | Promise<void>;
-    dispose?(): Promise<void>;
-}
-interface ModeContext {
-    workspaceRoot: string;
-    sessionId: string;
-    workspaceId?: string;
-    templatePath?: string;
-    requestId?: string;
-    telemetry?: TelemetrySink;
-}
-interface RuntimeFilesystemAccessDecision {
-    readonly filesystem: string;
-    readonly normalizedPath: string;
-    readonly access: 'readonly' | 'readwrite';
-    readonly capabilities: Readonly<Record<RuntimeFilesystemCapability, boolean>>;
-}
-interface RuntimeFilesystemBindingOperations {
-    read(descriptor: {
-        filesystem: string;
-        path: string;
-    }): Promise<{
-        content: string;
-        mtimeMs?: number;
-        metadata?: unknown;
-    }>;
-    list(descriptor: {
-        filesystem: string;
-        path: string;
-    }): Promise<{
-        entries: string[];
-        metadata?: unknown;
-    }>;
-    find(descriptor: {
-        filesystem: string;
-        path: string;
-    }, pattern: string, options?: {
-        limit?: number;
-        offset?: number;
-    }): Promise<{
-        paths: string[];
-        metadata?: unknown;
-    }>;
-    grep(descriptor: {
-        filesystem: string;
-        path: string;
-    }, pattern: string, options?: {
-        limit?: number;
-        offset?: number;
-    }): Promise<{
-        matches: Array<{
-            path: string;
-            line: number;
-            text: string;
-        }>;
-        metadata?: unknown;
-    }>;
-    stat(descriptor: {
-        filesystem: string;
-        path: string;
-    }): Promise<{
-        isDirectory: boolean;
-        metadata?: unknown;
-    }>;
-    write?(descriptor: {
-        filesystem: string;
-        path: string;
-        content: string;
-        expectedMtimeMs?: number;
-    }): Promise<{
-        mtimeMs?: number;
-        metadata?: unknown;
-    }>;
-    writeBinary?(descriptor: {
-        filesystem: string;
-        path: string;
-        content: Uint8Array;
-    }): Promise<{
-        mtimeMs?: number;
-        metadata?: unknown;
-    }>;
-    createBinary?(descriptor: {
-        filesystem: string;
-        path: string;
-        content: Uint8Array;
-    }): Promise<{
-        mtimeMs?: number;
-        metadata?: unknown;
-    }>;
-    delete?(descriptor: {
-        filesystem: string;
-        path: string;
-    }): Promise<{
-        metadata?: unknown;
-    }>;
-    move?(descriptor: {
-        filesystem: string;
-        from: string;
-        to: string;
-    }): Promise<{
-        metadata?: unknown;
-    }>;
-    mkdir?(descriptor: {
-        filesystem: string;
-        path: string;
-        recursive?: boolean;
-    }): Promise<{
-        metadata?: unknown;
-    }>;
-    resolveAccess?(descriptor: {
-        filesystem: string;
-        path: string;
-    }): Promise<RuntimeFilesystemAccessDecision>;
-    rejectMutation(operation: string, descriptor: {
-        filesystem: string;
-        path: string;
-    }): never;
-}
-interface RuntimeFilesystemCatalogPresentation {
-    readonly visible?: boolean;
-    readonly label?: string;
-    readonly rootDir?: '.' | `/${string}`;
-}
-interface RuntimeFilesystemBinding {
-    readonly filesystem: string;
-    readonly access: 'readonly' | 'readwrite';
-    readonly operations: RuntimeFilesystemBindingOperations;
-    /** User-facing catalog projection; internal routing continues to use filesystem. */
-    readonly catalog?: RuntimeFilesystemCatalogPresentation;
-    /** When present, only these addressed Agents receive this user-visible binding. */
-    readonly agentTypeIds?: readonly string[];
-}
-interface RuntimeBundle {
-    runtimeContext?: WorkspaceRuntimeContext;
-    /**
-     * Server-private host/storage root for host-side filesystem work. Required
-     * when runtime-coordinate workspace resources have an explicit host mirror;
-     * absence means composition must not infer or project a host path. Do not use
-     * this as the agent-visible cwd; Workspace.root remains the public runtime
-     * namespace shown to tools/model.
-     */
-    storageRoot?: string;
-    workspace: Workspace;
-    sandbox: Sandbox;
-    fileSearch: FileSearch;
-    /** Host-owned provider utilities injected at the application boundary. */
-    runtimeHost?: AgentRuntimeHostOperations;
-    /** Optional per-execution runtime env provider for local/direct operations that do not call Sandbox.exec. */
-    getRuntimeEnv?: () => Promise<Record<string, string>>;
-    /** Runtime-owned bash execution strategy, consumed by the agent bash tool builder. */
-    bash?: RuntimeBashStrategy;
-    /** Runtime-owned filesystem strategy, consumed by the agent filesystem tool builder. */
-    filesystem?: RuntimeFilesystemStrategy;
-    /** Optional filesystem bindings prepared for this runtime/session. */
-    filesystemBindings?: RuntimeFilesystemBinding[];
-    /** Pair-local projection authority captured with this exact RuntimeBundle generation. */
-    createRuntimeProjection?: (request: RuntimeProjectionRequest) => Promise<RuntimeProjectionLease>;
-    /** Qualified fixed service channel. Ordinary Agent tools never receive this field. */
-    trustedServiceV1?: RuntimeTrustedServiceMechanismV1;
-    /**
-     * Workspace-relative prefixes the host protects from mutation. Carried on the
-     * bundle so shell/provisioning enforcement uses the same policy as the
-     * Operations bindings instead of re-deriving it.
-     */
-    readonlyWorkspacePaths?: readonly string[];
-    /** Provisioning operations derived from this bundle's acquired Workspace + Sandbox pair. */
-    provisioningAdapter?: WorkspaceProvisioningAdapter;
-    /** Idempotently releases the acquired Workspace + Sandbox pair. */
-    disposeRuntime?: () => Promise<void>;
-}
-
-type PiPackageSource = PackageSource;
-declare const PI_PACKAGE_RESOURCE_FILTERS: readonly ["extensions", "skills", "prompts", "themes"];
-declare function piPackageSourceKey(source: PiPackageSource): string;
-declare function compactPiPackages(sources: Array<PiPackageSource | undefined>): PiPackageSource[];
-declare function mergePiPackageSources(base?: PiPackageSource[], additional?: PiPackageSource[]): PiPackageSource[];
-
-interface PiHarnessOptions {
-    noContextFiles?: boolean;
-    /** Projects server-internal skill files to model-visible resource locators. */
-    locateSkillResource?: (filePath: string) => {
-        filesystem: string;
-        path: string;
-    } | undefined;
-    noSkills?: boolean;
-    /** Disable ambient Pi extensions (required when tools execute in a remote runtime). */
-    noExtensions?: boolean;
-    /** Ignore packages from user/project Pi settings while preserving explicit host package grants. */
-    noAmbientPackages?: boolean;
-    additionalSkillPaths?: string[];
-    defaultModel?: {
-        provider: string;
-        id: string;
-    };
-    /**
-     * Additional native Pi package sources to enable for this agent runtime.
-     * These are applied as in-memory SettingsManager overrides, so host/plugin
-     * declarations do not mutate .pi/settings.json.
-     */
-    packages?: PiPackageSource[];
-    /**
-     * Additional native pi extension entrypoints. Pi loads these through jiti and
-     * re-imports them on ctx.reload(), which is required for hot-reloadable
-     * boring agent plugins.
-     */
-    extensionPaths?: string[];
-    /** In-process host extensions. Use only for trusted built-ins; hot plugin code should use paths. */
-    extensionFactories?: ExtensionFactory[];
-    /**
-     * Optional source of hot-reloadable Pi resources. Pi calls it on every
-     * reloadSession() (and once at session build) and merges the result with
-     * the static fields above. Lets the workspace plugin layer refresh
-     * package.json-discovered skills/packages/extensions without mutating
-     * arrays that the harness already captured.
-     */
-    getHotReloadableResources?: () => HotReloadablePiResources;
-    /** Reject an explicit unavailable/unknown model instead of silently falling back. */
-    strictModelResolution?: boolean;
-    /** Host-owned, actor-bound credential source. Never projected into the runtime workspace. */
-    credentialStore?: CredentialStore;
-}
-/** Pi harness options with the discovery flags resolved to definite booleans. */
-type ResolvedPiHarnessOptions = PiHarnessOptions & {
-    noContextFiles: boolean;
-    noSkills: boolean;
-};
-interface HotReloadablePiResources {
-    additionalSkillPaths?: string[];
-    packages?: PiPackageSource[];
-    extensionPaths?: string[];
-}
-type PiExtensionFactory = ExtensionFactory;
-
-/**
- * GET /api/v1/agents/:agentTypeId/skills
- *
- * Returns the list of PI skills discovered for the current workspace —
- * global skills (~/.pi/agent/skills) plus any project-local SKILL.md files.
- * The front-end uses this to populate the slash-command picker without
- * host apps having to hardcode skill names in extraCommands.
- *
- * Shape:
- *   { skills: [{ name: string, description: string }] }
- */
-
-interface SkillSummary {
-    name: string;
-    description: string;
-    /** Browser-safe locator for opening a supported skill source. */
-    resource?: AgentSkillResource;
-    /** False for management-only rows that Pi did not retain as invocable. */
-    invocable?: boolean;
-    /** Human-readable source/scope label for diagnostics and disabled rows. */
-    source?: string;
-}
-interface AgentSkillResourceSnapshot {
-    readonly generation: string;
-    readonly managedSkills: readonly SkillSummary[];
-    locateSkill(filePath: string): AgentSkillResource | undefined;
-}
-
-/**
- * Injectable persistence port for the credential vault.
- *
- * The ratified persistence model (docs/issues/820/byok-secret-vault-plan.md,
- * "Proposed persistence model") maps one-to-one onto these methods:
- * `workspace_provider_credentials` -> credential record,
- * `workspace_credential_keys` -> wrapped DEK,
- * `workspace_provider_credential_fields` -> field envelope.
- *
- * S1 supplies both in-memory and Postgres implementations. Only ciphertext,
- * nonce, tag, persisted AAD, and metadata-only tombstones cross this port —
- * never plaintext, never a KEK.
- */
-type CredentialMaterialKindV1 = 'field-set' | 'none';
-/** Metadata-only projection. Secret envelopes are deliberately unreachable here. */
-interface StoredCredentialMetadataV1 {
-    readonly providerId: ProviderId;
-    readonly displayLabel: string;
-    readonly credentialType: string;
-    readonly state: CredentialLifecycleStateV1;
-    readonly credentialVersion: number;
-    readonly maskedLastFourSuffix?: string;
-    readonly createdAt: string;
-    readonly updatedAt: string;
-}
-interface StoredCredentialRecordV1 {
-    /** Stable per-(workspace, provider) credential identity, bound into AAD. */
-    readonly credentialId: string;
-    readonly credentialVersion: number;
-    readonly dekGeneration: number;
-    readonly materialKind: CredentialMaterialKindV1;
-}
-interface CredentialFieldKeyV1 {
-    readonly workspaceId: string;
-    readonly providerId: ProviderId;
-    readonly credentialVersion: number;
-    /** Required when persisting a live envelope; omitted for keyed reads. */
-    readonly dekGeneration?: number;
-    readonly fieldId: string;
-}
-type CredentialFieldDeletionReasonV1 = 'superseded-version' | 'credential-tombstone' | 'crypto-shred';
-interface WorkspaceDekRotationStateV1 {
-    /** Caller-stable idempotency key. A retry must present the same operation id. */
-    readonly operationId: string;
-    readonly sourceGeneration: number;
-    readonly targetGeneration: number;
-    readonly phase: 'reencrypting' | 'verified' | 'anchor-advanced';
-}
-interface WorkspaceDekRotationReceiptV1 {
-    readonly operationId: string;
-    readonly sourceGeneration: number;
-    readonly targetGeneration: number;
-}
-interface WorkspaceCredentialRecordV1 {
-    readonly providerId: ProviderId;
-    readonly record: StoredCredentialRecordV1;
-}
-interface CommitDekRotationRecordInputV1 {
-    readonly workspaceId: string;
-    readonly providerId: ProviderId;
-    readonly expectedCredentialVersion: number;
-    readonly sourceGeneration: number;
-    readonly targetGeneration: number;
-    readonly fields: ReadonlyMap<string, CredentialEnvelopeV1>;
-}
-interface CredentialFieldTombstoneV1 {
-    readonly deletedAt: string;
-    readonly reason: CredentialFieldDeletionReasonV1;
-}
-interface CommitCredentialVersionInputV1 {
-    readonly workspaceId: string;
-    readonly providerId: ProviderId;
-    readonly expectedCredentialVersion: number;
-    readonly record: StoredCredentialRecordV1;
-    readonly fields: ReadonlyMap<string, CredentialEnvelopeV1>;
-    readonly supersededFieldsTombstone?: CredentialFieldTombstoneV1;
-}
-interface CommitCredentialVersionInputV2 extends CommitCredentialVersionInputV1 {
-    /** Applied in the same durable transaction as the record/version CAS. */
-    readonly metadataUpdate: Readonly<{
-        state: CredentialLifecycleStateV1;
-        displayLabel?: string;
-        credentialType?: string;
-        maskedLastFourSuffix?: string | null;
-    }>;
-}
-interface WorkspaceCredentialLockOptionsV1 {
-    /** Cancels only while waiting to acquire the lock; a running mutation is never interrupted. */
-    readonly signal?: AbortSignal;
-    /** Absolute Unix timestamp in milliseconds by which lock acquisition must finish. */
-    readonly deadlineMs?: number;
-    /** Relative acquisition bound. The earliest of this and deadlineMs wins. */
-    readonly timeoutMs?: number;
-}
-interface CredentialVaultPersistenceV1 {
-    /** Serializes workspace-wide lifecycle mutations and supplies a scoped adapter. */
-    withWorkspaceLock<T>(workspaceId: string, mutate: (locked: CredentialVaultPersistenceV1) => Promise<T>, options?: WorkspaceCredentialLockOptionsV1): Promise<T>;
-    getCredentialMetadata(workspaceId: string, providerId: ProviderId): Promise<StoredCredentialMetadataV1 | undefined>;
-    listCredentialMetadata(workspaceId: string): Promise<readonly StoredCredentialMetadataV1[]>;
-    /** True when any credential row, key, field/tombstone, rotation, or shred fence remains. */
-    hasWorkspaceCredentialArtifacts(workspaceId: string): Promise<boolean>;
-    updateCredentialMetadata(workspaceId: string, providerId: ProviderId, update: Readonly<{
-        state: CredentialLifecycleStateV1;
-        displayLabel?: string;
-        credentialType?: string;
-        maskedLastFourSuffix?: string | null;
-    }>): Promise<StoredCredentialMetadataV1>;
-    getCredentialRecord(workspaceId: string, providerId: ProviderId): Promise<StoredCredentialRecordV1 | undefined>;
-    putCredentialRecord(workspaceId: string, providerId: ProviderId, record: StoredCredentialRecordV1): Promise<void>;
-    /** Atomically CASes the record, fields, and superseded-version tombstones. */
-    commitCredentialVersion(input: CommitCredentialVersionInputV1): Promise<void>;
-    getWrappedDek(workspaceId: string, dekGeneration: number): Promise<WrappedWorkspaceDekV1 | undefined>;
-    putWrappedDek(workspaceId: string, dekGeneration: number, wrapped: WrappedWorkspaceDekV1): Promise<void>;
-    deleteWrappedDek(workspaceId: string, dekGeneration: number): Promise<void>;
-    listCredentialRecords(workspaceId: string): Promise<readonly WorkspaceCredentialRecordV1[]>;
-    listFields(workspaceId: string, providerId: ProviderId, credentialVersion: number): Promise<ReadonlyMap<string, CredentialEnvelopeV1>>;
-    /** Atomically replaces one current record's envelopes during DEK rotation. */
-    commitDekRotationRecord(input: CommitDekRotationRecordInputV1): Promise<void>;
-    getDekRotationState(workspaceId: string): Promise<WorkspaceDekRotationStateV1 | undefined>;
-    putDekRotationState(workspaceId: string, state: WorkspaceDekRotationStateV1): Promise<void>;
-    getDekRotationReceipt(workspaceId: string, operationId: string): Promise<WorkspaceDekRotationReceiptV1 | undefined>;
-    /** Atomically destroys N, clears the active marker, and records the idempotency receipt. */
-    finalizeDekRotation(workspaceId: string, state: WorkspaceDekRotationStateV1): Promise<void>;
-    clearDekRotationState(workspaceId: string): Promise<void>;
-    isWorkspaceCryptoShredded(workspaceId: string): Promise<boolean>;
-    /** Atomically tombstones ciphertext, destroys wrapped DEKs, and records the shred fence. */
-    cryptoShredWorkspace(workspaceId: string, shreddedAt: string): Promise<void>;
-    getField(key: CredentialFieldKeyV1): Promise<CredentialEnvelopeV1 | undefined>;
-    putField(key: CredentialFieldKeyV1, envelope: CredentialEnvelopeV1): Promise<void>;
-    /** Deletes ciphertext and retains metadata-only tombstones for every field. */
-    tombstoneCredentialVersionFields(workspaceId: string, providerId: ProviderId, credentialVersion: number, tombstone: CredentialFieldTombstoneV1): Promise<void>;
-    getFieldTombstone(key: CredentialFieldKeyV1): Promise<CredentialFieldTombstoneV1 | undefined>;
-}
-/** Persistence capability required by the V2 recoverable vault protocol. */
-interface CredentialVaultPersistenceV2 extends CredentialVaultPersistenceV1 {
-    readonly contractVersion: 'boring.credential-vault-persistence.v2';
-    /** Preserves the V2 capability on the transaction-scoped adapter. */
-    withWorkspaceLock<T>(workspaceId: string, mutate: (locked: CredentialVaultPersistenceV2) => Promise<T>, options?: WorkspaceCredentialLockOptionsV1): Promise<T>;
-    /** Atomically CASes record, fields, tombstones, and authenticated metadata. */
-    commitCredentialVersionV2(input: CommitCredentialVersionInputV2): Promise<void>;
-}
-
-/** Single runtime and type-level source of truth for gateway operations persisted in request keys. */
-declare const AGENT_GATEWAY_EFFECTS: readonly ["session.create", "session.rename", "session.archive", "session.delete", "session.prompt", "session.followup", "session.interrupt", "session.stop", "session.queue.clear", "agent.reload", "session.command.execute"];
-type AgentGatewayEffect = typeof AGENT_GATEWAY_EFFECTS[number];
-type AgentRequestTarget = {
-    readonly kind: 'agent';
-    readonly agentTypeId: string;
-} | {
-    readonly kind: 'session';
-    readonly ref: AgentSessionRef;
-};
-interface AgentRequestKey {
-    readonly workspaceScopeId: string;
-    readonly authSubjectId: string;
-    readonly operation: AgentGatewayEffect;
-    readonly target: AgentRequestTarget;
-    readonly requestId: string;
-}
-type RunId = string;
-interface VerifiedSeatParticipation {
-    readonly seatId: string;
-}
-/** Admission-time identity and provenance reference; never a live authorization grant. */
-interface AcceptedWorkContext {
-    readonly version: 1;
-    readonly identity: {
-        readonly runId: RunId;
-        readonly requestKey: AgentRequestKey;
-        readonly agent: {
-            readonly agentTypeId: string;
-        };
-        readonly participation?: VerifiedSeatParticipation;
-    };
-    readonly operation: AgentGatewayEffect;
-    readonly target: AgentRequestTarget;
-    readonly authority: {
-        readonly workspaceScopeId: string;
-        readonly authSubjectId: string;
-    };
-    readonly delegation: {
-        readonly lineage: readonly RunId[];
-    };
-}
-interface AgentStableServiceErrorDTO {
-    readonly statusCode: number;
-    readonly error: {
-        readonly code: string;
-        readonly message: string;
-        readonly retryable?: boolean;
-    };
-}
-type AgentRequestFailure = {
-    readonly kind: 'gateway';
-    readonly error: AgentGatewayErrorDTO;
-} | {
-    readonly kind: 'service';
-    readonly error: AgentStableServiceErrorDTO;
-};
-interface AgentRequestLedgerRecordBase {
-    readonly key: AgentRequestKey;
-    readonly acceptedWork: AcceptedWorkContext;
-    readonly digest: string;
-    readonly updatedAt: number;
-}
-type AgentRequestLedgerRecord = (AgentRequestLedgerRecordBase & {
-    readonly state: 'pending-admission';
-    /** The last owner stopped before ledger admission acceptance or effect dispatch. */
-    readonly retryable?: true;
-}) | (AgentRequestLedgerRecordBase & {
-    readonly state: 'admission-accepted';
-    /** Append-only admission provenance, separate from current authority. */
-    readonly admissionReceipt: string;
-}) | (AgentRequestLedgerRecordBase & {
-    readonly state: 'in-flight';
-}) | (AgentRequestLedgerRecordBase & {
-    readonly state: 'rejected';
-    readonly failure: AgentRequestFailure;
-}) | (AgentRequestLedgerRecordBase & {
-    readonly state: 'completed';
-    readonly receipt: JsonValue;
-}) | (AgentRequestLedgerRecordBase & {
-    readonly state: 'outcome-unknown';
-    readonly error: AgentGatewayErrorDTO;
-});
-interface AgentRequestLedger {
-    /** Direct production projections require transactional durable ownership. */
-    readonly durability: 'durable-transactional' | 'in-memory';
-    /** Atomically create or reclaim explicitly retryable admission across all store users. */
-    prepare(key: AgentRequestKey, digest: string, acceptedWork: AcceptedWorkContext): Promise<AgentRequestLedgerPrepareResult>;
-    /** Release only a pending claim whose owner has stopped before any effect. */
-    markAdmissionRetryable(key: AgentRequestKey): Promise<void>;
-    /** All transitions are compare-and-swap against the exact allowed prior state. */
-    acceptAdmission(key: AgentRequestKey, admissionReceipt: string): Promise<void>;
-    beginEffect(key: AgentRequestKey): Promise<void>;
-    reject(key: AgentRequestKey, failure: AgentRequestFailure): Promise<void>;
-    complete(key: AgentRequestKey, receipt: JsonValue): Promise<void>;
-    markOutcomeUnknown(key: AgentRequestKey, error: AgentGatewayErrorDTO): Promise<void>;
-    read(key: AgentRequestKey): Promise<AgentRequestLedgerRecord | undefined>;
-    close?(): void | Promise<void>;
-}
-interface AgentRequestLedgerPrepareResult {
-    readonly ownership: 'created' | 'reclaimed' | 'existing';
-    readonly record: AgentRequestLedgerRecord;
-}
-type AgentEffectAdmissionResult = {
-    readonly type: 'accepted';
-    readonly admissionReceipt: string;
-} | {
-    readonly type: 'rejected';
-    readonly error: AgentGatewayErrorDTO;
-} | {
-    readonly type: 'retryable';
-    readonly error: AgentGatewayErrorDTO;
-};
-interface AgentEffectAdmission {
-    /** Must be idempotent and reconcilable on the complete ledger key. */
-    admit(input: {
-        readonly key: AgentRequestKey;
-        readonly digest: string;
-        readonly scope: VerifiedAgentScopeClaim;
-        readonly operation: AgentGatewayEffect;
-        readonly target: AgentRequestTarget;
-    }): Promise<AgentEffectAdmissionResult>;
-}
-/**
- * An authored file that contributes to this agent's instructions, addressed
- * exactly like every other openable resource (`{filesystem, path}`) so the
- * client can route it through the same safety guard as skills.
- *
- * The Host knows these locations from fleet configuration; clients must never
- * re-derive them from the agent id (seat and agentTypeId are unrelated
- * fleet.yaml fields). `role` is a DISCRIMINATOR, not a display string — the
- * words shown to the user are the client's business.
- */
-interface AgentInstructionFileRef {
-    readonly filesystem: string;
-    /** Workspace-relative path, e.g. `.agents/personas/concierge/instructions.md`. */
-    readonly path: string;
-    readonly role: 'persona';
-}
-/**
- * An authored instruction file as the fleet composer knows it: a canonical
- * HOST absolute path, not yet addressed against any workspace.
- *
- * The two shapes are deliberately distinct. A multi-workspace host (the CLI
- * hub, core) serves a DIFFERENT root per request, so composition cannot know
- * which root a ref should be relative to; only the request can. The spec
- * therefore carries sources, and `describe` publishes the subset that is
- * reachable through the root actually being served (gh-1189).
- */
-interface AgentInstructionSource {
-    /** Canonical absolute path on the host filesystem. */
-    readonly absolutePath: string;
-    readonly role: 'persona';
-}
-declare const DEFAULT_AGENT_TYPE_ID = "default";
-interface AgentHostAgentSpec {
-    readonly agentTypeId: string;
-    readonly definition: {
-        readonly instructions: string;
-        readonly label: string;
-        readonly version?: string;
-        /**
-         * Computed identity of the compiled definition (instructions + knowledge
-         * bytes). The digest, not the version string, is the definition identity.
-         */
-        readonly digest?: string;
-    };
-    /**
-     * Optional agent-carried knowledge shipped inside the definition package.
-     * Composition mounts it as a readonly, agent-scoped filesystem binding;
-     * absent = no binding.
-     */
-    readonly knowledge?: {
-        /** Host path of the package's `knowledge/` folder. */
-        readonly rootDir: string;
-    };
-    /**
-     * Authored instruction sources behind `definition.instructions`, as host
-     * absolute paths. Addressed against a served workspace root per request by
-     * `describe`, never at composition time.
-     */
-    readonly instructionSources?: readonly AgentInstructionSource[];
-    readonly plugins?: readonly {
-        /** Canonical app-preflighted plugin ID. */
-        readonly name: string;
-        readonly config?: JsonValue;
-    }[];
-    readonly model?: {
-        readonly preferred?: string;
-        /** RESERVED / NOT ENFORCED. Per-turn token-limit enforcement is future work. */
-        readonly maxTokensPerTurn?: number;
-    };
-    /** Trusted host-owned provisioning grants; absent means no inherited resources. */
-    readonly provisioning?: {
-        readonly inheritSkillPaths?: boolean;
-    };
-}
-type ConfiguredAgentHostAgentSpec = AgentHostAgentSpec;
-/**
- * Server-only compiler output. App-specific validated handles may be attached,
- * but the Host revalidates the complete agent ID set before freezing it.
- */
-type CompiledAgentHostAgentSpec = AgentHostAgentSpec & {
-    readonly resolvedPolicy?: Readonly<Record<string, unknown>>;
-    /** Required when resolvedPolicy contains opaque/non-JSON runtime handles. */
-    readonly resolvedPolicyDigest?: string;
-};
-interface AgentFleetCompiler {
-    compile(input: {
-        readonly agents: readonly AgentHostAgentSpec[];
-    }): Promise<readonly CompiledAgentHostAgentSpec[]>;
-}
-interface ResolvedEnvironmentScope {
-    readonly placementIdentity: string;
-    readonly workspaceRoot: string;
-    /** Physical provider workspace identifier; defaults to the verified storage scope. */
-    readonly runtimeWorkspaceId?: string;
-    readonly templatePath?: string;
-    readonly provisioningFingerprint: string;
-    readonly provisionRuntime?: (input: {
-        readonly runtimeBundle: Awaited<ReturnType<RuntimeModeAdapter['create']>>;
-        readonly signal: AbortSignal;
-    }) => Promise<WorkspaceProvisioningResult | undefined>;
-}
-interface ResolvedAgentRuntimeScope {
-    /** Persisted semantic compatibility identity. */
-    readonly identity: string;
-    /** Stable physical binding slot, independent of semantic resource revisions. */
-    readonly physicalBindingIdentity?: string;
-    /** Canonical digest of the immutable plugin/resource inputs used by reload. */
-    readonly resourceInputDigest?: string;
-    /**
-     * Side-effect-free fence for path-backed reload resources. The Host invokes
-     * it after classification, immediately before the effect, and after every
-     * awaited apply/load stage so a successful receipt always matches the
-     * resourceInputDigest recorded in the ledger.
-     */
-    readonly revalidateResourceInputs?: () => Promise<void>;
-    readonly environment: ResolvedEnvironmentScope;
-    readonly sessionNamespace: string;
-    readonly pi?: PiHarnessOptions;
-    readonly extraTools?: readonly AgentTool[];
-    /** Joined trusted-plugin cleanup invoked after backend session deletion succeeds. */
-    readonly onSessionDelete?: (input: {
-        readonly workspaceScopeId: string;
-        readonly agentTypeId: string;
-        readonly sessionId: string;
-    }) => Promise<void>;
-    readonly includeFilesystemTools?: boolean;
-    readonly includeUploadTools?: boolean;
-    readonly sessionDir?: string;
-    readonly reloadMetadata?: {
-        readonly diagnostics?: ReadonlyArray<{
-            readonly source: string;
-            readonly message: string;
-            readonly pluginId?: string;
-        }>;
-        readonly restartWarnings?: ReadonlyArray<{
-            readonly id: string;
-            readonly surfaces: readonly string[];
-            readonly message: string;
-        }>;
-    };
-    /**
-     * Host-internal reload mutation. Candidate identity fields above must be
-     * resolved without mutating plugin, backend, or runtime resource state.
-     * The Host invokes this callback only after durable ownership, admission,
-     * immutable identity classification, and the binding operation fence.
-     */
-    readonly applyReload?: (input: {
-        readonly runtimeBundle: RuntimeBundle;
-    }) => Promise<{
-        readonly diagnostics?: ReadonlyArray<{
-            readonly source: string;
-            readonly message: string;
-            readonly pluginId?: string;
-        }>;
-        readonly restartWarnings?: ReadonlyArray<{
-            readonly id: string;
-            readonly surfaces: readonly string[];
-            readonly message: string;
-        }>;
-    } | undefined>;
-    readonly getFilesystemBindings?: (input: {
-        readonly scope: VerifiedAgentScopeClaim;
-        readonly sessionId?: string;
-        readonly requestId: string;
-    }) => Promise<readonly RuntimeFilesystemBinding[] | undefined>;
-    /**
-     * Skill-resource locator/catalog snapshot for the current reload
-     * generation. Threaded through the capability-projection layer so
-     * `/skills` can resolve package-managed skill locators without going
-     * through the legacy path-shaped `additionalSkillPaths` hot-reload API.
-     */
-    readonly getSkillResourceSnapshot?: (input: {
-        readonly scope: VerifiedAgentScopeClaim;
-        readonly sessionId?: string;
-        readonly requestId: string;
-    }) => Promise<AgentSkillResourceSnapshot | undefined>;
-    readonly systemPromptAppend?: string;
-    readonly loadSystemPromptAppend?: () => Promise<string | undefined>;
-}
-interface AuthorizedEnvironmentIntent {
-    readonly kind: 'http-route' | 'dispatcher' | 'agent-binding';
-    readonly requestId: string;
-}
-interface AgentHostEnvironmentScope extends ResolvedEnvironmentScope {
-    /** App-owned environment decoration applied once to the canonical provider generation. */
-    readonly transformRuntimeBundle?: (runtimeBundle: RuntimeBundle) => RuntimeBundle | Promise<RuntimeBundle>;
-    /** Evaluated for every authorized operation; never cached as placement authority. */
-    readonly resolveFilesystemBindings?: (input: {
-        readonly verifiedClaim: VerifiedAgentScopeClaim;
-        readonly requestId: string;
-    }) => Promise<readonly RuntimeFilesystemBinding[] | undefined>;
-}
-interface AgentHostSessionEnvironmentLease {
-    readonly environmentGenerationId: string;
-    readonly bindingGeneration: number;
-    readonly signal: AbortSignal;
-    acquireTrustedService(input: {
-        readonly leaseId: string;
-        readonly idleTtlMs: number;
-        readonly absoluteTtlMs: number;
-    }): Promise<RuntimeTrustedServiceLeaseV1>;
-    release(): void;
-}
-interface AgentHostEnvironmentLease {
-    readonly workspace: Workspace;
-    /** Process execution paired with this exact runtime-owned workspace generation. */
-    readonly sandbox: Sandbox;
-    readonly gitWorkspace: Workspace;
-    readonly fileSearch: FileSearch;
-    readonly filesystemBindings?: readonly RuntimeFilesystemBinding[];
-    readonly readiness: Readonly<AgentCapabilityReadiness>;
-    readonly signal: AbortSignal;
-    release(): void;
-}
-interface AgentHostDispatcherRunInput extends WorkspaceAgentDirectRunInput {
-    readonly authorizedScope: AuthorizedAgentScope;
-    readonly request?: FastifyRequest;
-}
-interface AgentHostDirectProjectionOptions {
-    readonly authorizeAgentRequest: (request: FastifyRequest) => Promise<AuthorizedAgentScope>;
-    readonly filterModels?: ModelsRoutesOptions['filterModels'];
-    readonly sessionChangesTracker?: SessionChangesTracker;
-    readonly defaultSessionId?: string;
-}
-interface AgentHostDescription {
-    readonly hostId: string;
-    readonly agents: readonly {
-        readonly agentTypeId: string;
-        readonly label: string;
-        /** Exact package-declared version, when this is a configured Agent. */
-        readonly definitionVersion?: string;
-        /** Computed definition identity digest (instructions + knowledge bytes), when the spec carries one. */
-        readonly definitionDigest?: string;
-    }[];
-    readonly draining: boolean;
-}
-interface AgentHostHandle {
-    readonly hostId: string;
-    describe(): Promise<AgentHostDescription>;
-    drain(): Promise<void>;
-    close(): Promise<void>;
-}
-interface CreateAgentHostOptions {
-    readonly agents: readonly AgentHostAgentSpec[];
-    readonly fleetCompiler: AgentFleetCompiler;
-    readonly hostId?: string;
-    readonly scopeVerifier: AgentScopeVerifier;
-    /** Optional product-owned Seat/entitlement policy; omission preserves legacy fleet-wide access. */
-    readonly resolveAgentAccess?: ResolveAgentAccess;
-    readonly runtimeModeAdapter: RuntimeModeAdapter;
-    readonly runtimeHost?: AgentRuntimeHostOperations;
-    readonly sessionRoot?: string;
-    readonly resolveAuthorizedEnvironmentScope?: (input: {
-        readonly authorizedScope: AuthorizedAgentScope;
-        readonly verifiedClaim: VerifiedAgentScopeClaim;
-        readonly intent: AuthorizedEnvironmentIntent;
-    }) => Promise<AgentHostEnvironmentScope>;
-    readonly resolveAuthorizedAgentRuntimeScope?: (input: {
-        readonly authorizedScope: AuthorizedAgentScope;
-        readonly verifiedClaim: VerifiedAgentScopeClaim;
-        readonly agentTypeId: string;
-        readonly intent: AuthorizedEnvironmentIntent & {
-            readonly kind: 'agent-binding';
-            readonly operation: 'new-binding' | 'existing-session' | 'reload';
-            readonly sessionId?: string;
-        };
-        readonly environment: AgentHostEnvironmentScope;
-    }) => Promise<Omit<ResolvedAgentRuntimeScope, 'environment'>>;
-    readonly telemetry?: TelemetrySink;
-    readonly metering?: AgentMeteringSink;
-    readonly requestLedger?: AgentRequestLedger;
-    /** Durable effect ledger path, independent of transcript/session storage. */
-    readonly requestLedgerPath?: string;
-    /** App-host-owned durable event store, shared with channel outbound tails. */
-    readonly eventStore?: EventStreamStore;
-    /** Explicit test/dev opt-in for an in-memory ledger. */
-    readonly inMemoryRequestLedgerMode?: 'test' | 'development';
-    /**
-     * Built-in SQLite terminal-payload retention. Values below 24 hours are
-     * raised to 24 hours; omitted retention keeps terminal payloads indefinitely.
-     * Injected ledgers retain ownership of their own storage policy.
-     */
-    readonly requestRetentionMs?: number;
-    readonly effectAdmission?: AgentEffectAdmission;
-    readonly shutdownGraceMs?: number;
-    readonly harnessFactory?: AgentHarnessFactory;
-    /**
-     * [1082 slice B] BYOK credential-vault composition inputs. Enablement is
-     * env-driven (`BORING_CREDENTIAL_KMS_BACKEND`); when enabled the host embeds
-     * durable persistence (#1145) and the Core-owned authority verifier here.
-     * The composition is resolved exactly once, at `createAgentHost` startup:
-     * misconfigured env fails host creation with a stable `CREDENTIAL_*` error,
-     * and all runtime bindings share the single host-scope vault composition.
-     * Absent env → composition absent, behavior identical to env-key-only auth.
-     */
-    readonly credentials?: AgentHostCredentialOptionsV1;
-}
-interface WorkspaceCredentialLifecycleV1 {
-    /** Irreversibly fences and destroys credential key access for one workspace. */
-    cryptoShredWorkspace(workspaceId: string): Promise<void>;
-}
-interface AgentHostCredentialOptionsV1 {
-    /** Env-shaped record override; defaults to `process.env`. */
-    readonly env?: Readonly<Record<string, string | undefined>>;
-    /** Durable vault persistence (#1145 Postgres in production). */
-    readonly vaultPersistence?: CredentialVaultPersistenceV2;
-    /** Core-owned authority verifier; pre-binds the credential resolver. */
-    readonly authorityVerifier?: WorkspaceCredentialAuthorityVerifierV1;
-    /** Host authentication adapter for owner-only credential HTTP routes. */
-    readonly authorizeOwnerRequest?: (request: FastifyRequest) => VerifiedWorkspaceCredentialAuthorityV1 | Promise<VerifiedWorkspaceCredentialAuthorityV1>;
-    /** Core deletion composition receives only the narrow irreversible lifecycle seam. */
-    readonly onLifecycleReady?: (lifecycle: WorkspaceCredentialLifecycleV1) => void;
-}
-interface CreatedAgentHost {
-    readonly host: AgentHostHandle;
-    readonly gateway: AgentGateway;
-    registerDirectRoutes(options: AgentHostDirectProjectionOptions): FastifyPluginAsync;
-    acquireEnvironment(input: {
-        readonly authorizedScope: AuthorizedAgentScope;
-        readonly intent: AuthorizedEnvironmentIntent;
-    }): Promise<AgentHostEnvironmentLease>;
-    /** Trusted composition-only acquisition of the addressed session's exact Environment generation. */
-    acquireSessionEnvironment(input: {
-        readonly authorizedScope: AuthorizedAgentScope;
-        readonly ref: AgentSessionRef;
-        readonly requestId: string;
-    }): Promise<AgentHostSessionEnvironmentLease>;
-    runWithWorkspaceAgent(input: AgentHostDispatcherRunInput, run: (binding: LeaseBoundWorkspaceAgent) => Promise<void>): Promise<void>;
-}
-
-export { type MeteringReleaseInput as $, type AgentGatewayEffect as A, type BuiltinRuntimeModeId as B, type CredentialVaultPersistenceV2 as C, type AgentHostEnvironmentScope as D, type EventStreamStore as E, type ResolvedAgentRuntimeScope as F, type AgentRequestKey as G, type AcceptedWorkContext as H, type AgentRequestLedgerPrepareResult as I, type AgentRequestFailure as J, type AgentRequestLedgerRecord as K, type AgentFleetCompiler as L, type ModeContext as M, type AgentRequestTarget as N, type RuntimeFilesystemAccessDecision as O, type ProvisionWorkspaceRuntimeOptions as P, type AgentHostDescription as Q, type RuntimeModeAdapter as R, type StoredCredentialRecordV1 as S, type AgentHostDirectProjectionOptions as T, type AgentHostDispatcherRunInput as U, type AgentHostEnvironmentLease as V, type WorkspaceProvisioningResult as W, type AgentHostHandle as X, type CredentialVaultPersistenceV1 as Y, DEFAULT_AGENT_TYPE_ID as Z, type MeteringErrorLogger as _, type PiPackageSource as a, type MeteringReleaseReason as a0, type MeteringReservationResult as a1, type MeteringReserveInput as a2, type MeteringRunKind as a3, type MeteringRunScope as a4, type MeteringRunStatus as a5, type MeteringSettleInput as a6, type MeteringUsage as a7, type MeteringUsageInput as a8, PI_PACKAGE_RESOURCE_FILTERS as a9, type PiExtensionFactory as aa, type PluginSkillSource as ab, type ResolvedEnvironmentScope as ac, type RuntimeFilesystemBindingOperations as ad, type RuntimeNodePackageSpec as ae, type RuntimeProvisioningContribution as af, type RuntimePythonSpec as ag, type RuntimeTemplateContribution as ah, type WorkspaceCredentialLifecycleV1 as ai, type WorkspaceProvisioningExecResult as aj, compactPiPackages as ak, mergePiPackageSources as al, normalizeMeteringUsage as am, piPackageSourceKey as an, type CredentialMaterialKindV1 as b, type WorkspaceCredentialLockOptionsV1 as c, type StoredCredentialMetadataV1 as d, type RuntimeModeId as e, type AgentRuntimeHostOperations as f, type RuntimeBashStrategy as g, type RuntimeFilesystemStrategy as h, type WorkspaceProvisioningAdapter as i, type AgentInstructionSource as j, type ConfiguredAgentHostAgentSpec as k, type AgentInstructionFileRef as l, type AgentHostAgentSpec as m, type RuntimeBundle as n, type PiHarnessOptions as o, type AgentMeteringSink as p, type AgentHostCredentialOptionsV1 as q, type RuntimeFilesystemBinding as r, type CreatedAgentHost as s, type ResolvedPiHarnessOptions as t, ReadyStatusTracker as u, type CreateAgentHostOptions as v, type CompiledAgentHostAgentSpec as w, type AgentRequestLedger as x, type AgentEffectAdmission as y, type AuthorizedEnvironmentIntent as z };