@hasna/machines 0.0.45 → 0.0.46

package/dist/cli-utils.d.ts

@@ -4,4 +4,3 @@ export declare function parseIntegerOption(value: string, label: string, constra
 }): number;
 export declare function renderKeyValueTable(entries: Array<[string, string]>): string;
 export declare function renderList(title: string, items: string[]): string;
-//# sourceMappingURL=cli-utils.d.ts.map

package/dist/commands/apps.d.ts

@@ -5,10 +5,12 @@ export declare function listApps(machineId?: string): {
     apps: ManifestAppSpec[];
 };
 export declare function buildAppsPlan(machineId?: string): SetupResult;
-export declare function getAppsStatus(machineId?: string, runner?: MachineCommandRunner): AppsStatusResult;
-export declare function diffApps(machineId?: string, runner?: MachineCommandRunner): AppsDiffResult;
-export declare function runAppsInstall(machineId?: string, options?: {
+export interface RunAppsInstallOptions {
     apply?: boolean;
     yes?: boolean;
-}, runner?: MachineCommandRunner): SetupResult;
-//# sourceMappingURL=apps.d.ts.map
+    expectedPlanDigest?: string;
+}
+export declare function getAppsStatus(machineId?: string, runner?: MachineCommandRunner): AppsStatusResult;
+export declare function diffApps(machineId?: string, runner?: MachineCommandRunner): AppsDiffResult;
+export declare function runAppsInstall(machineId?: string, options?: RunAppsInstallOptions, runner?: MachineCommandRunner): SetupResult;
+export declare function runAppsPlan(plan: SetupResult, options?: RunAppsInstallOptions, runner?: MachineCommandRunner): SetupResult;

package/dist/commands/backup.d.ts

@@ -19,4 +19,3 @@ export declare function runBackup(bucket?: string, prefix?: string, options?: {
     apply?: boolean;
     yes?: boolean;
 }): SetupResult;
-//# sourceMappingURL=backup.d.ts.map

package/dist/commands/cert.d.ts

@@ -4,4 +4,3 @@ export declare function runCertPlan(domains: string[], options?: {
     apply?: boolean;
     yes?: boolean;
 }): SetupResult;
-//# sourceMappingURL=cert.d.ts.map

package/dist/commands/clipboard-daemon.d.ts

@@ -3,4 +3,3 @@ export declare function stopClipboardDaemon(): {
     pid: number | null;
 };
 export declare function startClipboardDaemon(port?: number): void;
-//# sourceMappingURL=clipboard-daemon.d.ts.map

package/dist/commands/clipboard-server.d.ts

@@ -16,4 +16,3 @@ export declare function pushClipboardToPeer(host: string, port: number, token: s
     sent: boolean;
     reason?: string;
 }>;
-//# sourceMappingURL=clipboard-server.d.ts.map

package/dist/commands/clipboard.d.ts

@@ -16,4 +16,3 @@ export declare function readClipboardHistory(historyPath?: string): ClipboardEnt
 export declare function addClipboardEntry(entry: ClipboardEntry, historyPath?: string): void;
 export declare function clearClipboardHistory(historyPath?: string): void;
 export declare function getClipboardStatus(historyPath?: string): ClipboardStatus;
-//# sourceMappingURL=clipboard.d.ts.map

package/dist/commands/daemon.d.ts

@@ -73,4 +73,3 @@ export declare function buildDaemonStatusPlan(options?: Omit<DaemonServiceOption
 export declare function buildDaemonLogsPlan(options?: Omit<DaemonServiceOptions, "action">): DaemonServicePlan;
 export declare function renderLaunchdPlist(options?: Omit<DaemonServiceOptions, "action">): string;
 export declare function renderSystemdUnit(options?: Omit<DaemonServiceOptions, "action">): string;
-//# sourceMappingURL=daemon.d.ts.map

package/dist/commands/diff.d.ts

@@ -1,3 +1,2 @@
 import type { MachineDiff } from "../types.js";
 export declare function diffMachines(leftMachineId: string, rightMachineId?: string): MachineDiff;
-//# sourceMappingURL=diff.d.ts.map

package/dist/commands/dns.d.ts

@@ -11,4 +11,3 @@ export declare function renderDomainMapping(domain: string): {
     certPath: string;
     keyPath: string;
 };
-//# sourceMappingURL=dns.d.ts.map

package/dist/commands/doctor.d.ts

@@ -21,4 +21,3 @@ export interface DoctorOptions {
     includeOptionalAdapters?: boolean;
 }
 export declare function runDoctor(machineId?: string, options?: DoctorOptions): DoctorReport;
-//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/heal-daemon.d.ts

@@ -33,4 +33,3 @@ export declare function healServiceStatus(): {
     active: boolean;
     enabled: boolean;
 };
-//# sourceMappingURL=heal-daemon.d.ts.map

package/dist/commands/heal.d.ts

@@ -119,4 +119,3 @@ export declare function discoverAnchors(): string[];
 export declare function probeHealth(config: HealConfig): HealthProbe;
 /** Apply the action's side effects. Returns a human-readable description. */
 export declare function executeAction(action: HealAction, config: HealConfig): string;
-//# sourceMappingURL=heal.d.ts.map

package/dist/commands/install-claude.d.ts

@@ -9,9 +9,11 @@ export type AiCliTool = keyof typeof AI_CLI_PACKAGES;
 export declare function buildClaudeInstallPlan(machineId?: string, tools?: string[]): SetupResult;
 export declare function getClaudeCliStatus(machineId?: string, tools?: string[], runner?: MachineCommandRunner): ClaudeCliStatusResult;
 export declare function diffClaudeCli(machineId?: string, tools?: string[], runner?: MachineCommandRunner): ClaudeCliDiffResult;
-export declare function runClaudeInstall(machineId?: string, tools?: string[], options?: {
+export interface RunClaudeInstallOptions {
     apply?: boolean;
     yes?: boolean;
-}, runner?: MachineCommandRunner): SetupResult;
+    expectedPlanDigest?: string;
+}
+export declare function runClaudeInstall(machineId?: string, tools?: string[], options?: RunClaudeInstallOptions, runner?: MachineCommandRunner): SetupResult;
+export declare function runClaudeInstallPlan(plan: SetupResult, options?: RunClaudeInstallOptions, runner?: MachineCommandRunner): SetupResult;
 export {};
-//# sourceMappingURL=install-claude.d.ts.map

package/dist/commands/install-tailscale.d.ts

@@ -1,8 +1,10 @@
 import { type MachineCommandRunner } from "../remote.js";
 import type { SetupResult } from "../types.js";
 export declare function buildTailscaleInstallPlan(machineId?: string): SetupResult;
-export declare function runTailscaleInstall(machineId?: string, options?: {
+export interface RunTailscaleInstallOptions {
     apply?: boolean;
     yes?: boolean;
-}, runner?: MachineCommandRunner): SetupResult;
-//# sourceMappingURL=install-tailscale.d.ts.map
+    expectedPlanDigest?: string;
+}
+export declare function runTailscaleInstall(machineId?: string, options?: RunTailscaleInstallOptions, runner?: MachineCommandRunner): SetupResult;
+export declare function runTailscaleInstallPlan(plan: SetupResult, options?: RunTailscaleInstallOptions, runner?: MachineCommandRunner): SetupResult;

package/dist/commands/manifest.d.ts

@@ -6,4 +6,3 @@ export declare function manifestBootstrapCurrentMachine(): FleetManifest;
 export declare function manifestGet(machineId: string): MachineManifest | null;
 export declare function manifestRemove(machineId: string): FleetManifest;
 export declare function manifestValidate(): FleetManifest;
-//# sourceMappingURL=manifest.d.ts.map

package/dist/commands/mutation-approval.d.ts

@@ -0,0 +1,54 @@
+export declare const MUTATION_APPROVAL_FLAG_ENV = "HASNA_MACHINES_ALLOW_MUTATIONS";
+export declare const LEGACY_MUTATION_APPROVAL_FLAG_ENV = "HASNA_MACHINES_MUTATION_APPROVAL";
+export declare const MUTATION_APPROVAL_TOKEN_ENV = "HASNA_MACHINES_MUTATION_TOKEN";
+export declare const MUTATION_APPROVAL_CALLER_ENV = "HASNA_MACHINES_MUTATION_CALLER_ID";
+export declare const MUTATION_APPROVAL_RUN_ENV = "HASNA_MACHINES_MUTATION_RUN_ID";
+export declare const MUTATION_APPROVAL_REPLAY_PATH_ENV = "HASNA_MACHINES_MUTATION_REPLAY_PATH";
+type Env = Record<string, string | undefined>;
+export interface MutationApprovalScope {
+    surface: string;
+    operation: string;
+    machineId?: string;
+    resourceId?: string;
+    callerId?: string;
+    runId?: string;
+    transport?: string;
+    args?: unknown;
+    argsSha256?: string;
+}
+export interface MutationApprovalOptions extends MutationApprovalScope {
+    approvalToken?: string;
+    env?: Env;
+    now?: number | Date;
+}
+export interface MutationApprovalClaims extends MutationApprovalScope {
+    version: 1;
+    issuedAt: number;
+    expiresAt: number;
+    nonce?: string;
+    args_sha256?: string;
+}
+export interface CreateMutationApprovalTokenOptions {
+    env?: Env;
+    secret?: string;
+    now?: number | Date;
+    ttlMs?: number;
+    nonce?: string;
+}
+export interface MutationApprovalDecision {
+    approved: boolean;
+    reason?: string;
+    claims?: MutationApprovalClaims;
+}
+export declare function canonicalMutationArgs(value: unknown): string;
+export declare function mutationArgsSha256(value: unknown): string;
+export declare function mutationPlanDigest(plan: unknown): string;
+export declare function attachMutationPlanDigest<T extends object>(plan: T): T & {
+    planDigest: string;
+};
+export declare function assertMutationPlanDigest(plan: unknown, expectedPlanDigest?: string): void;
+export declare function createMutationApprovalToken(scope: MutationApprovalScope, options?: CreateMutationApprovalTokenOptions): string;
+export declare function verifyMutationApprovalToken(options: MutationApprovalOptions): MutationApprovalDecision;
+export declare function isMutationApproved(options?: Partial<MutationApprovalOptions>): boolean;
+export declare function assertMutationApproved(options: MutationApprovalOptions): void;
+export {};

package/dist/commands/notifications.d.ts

@@ -1,15 +1,27 @@
 import type { NotificationChannel, NotificationConfig, NotificationDispatchSummary, NotificationTestResult } from "../types.js";
+declare const trustedNotificationApproval: unique symbol;
+export type TrustedNotificationApproval = {
+    readonly [trustedNotificationApproval]: true;
+};
+export declare function createTrustedNotificationApproval(): TrustedNotificationApproval;
 export declare function getDefaultNotificationConfig(): NotificationConfig;
 export declare function readNotificationConfig(path?: string): NotificationConfig;
 export declare function writeNotificationConfig(config: NotificationConfig, path?: string): NotificationConfig;
 export declare function listNotificationChannels(): NotificationConfig;
-export declare function addNotificationChannel(channel: NotificationChannel): NotificationConfig;
+export declare function addNotificationChannel(channel: NotificationChannel, options?: {
+    approvalToken?: string;
+    trustedApproval?: TrustedNotificationApproval;
+}): NotificationConfig;
 export declare function removeNotificationChannel(channelId: string): NotificationConfig;
 export declare function dispatchNotificationEvent(event: string, message: string, options?: {
     channelId?: string;
+    approvalToken?: string;
+    trustedApproval?: TrustedNotificationApproval;
 }): Promise<NotificationDispatchSummary>;
 export declare function testNotificationChannel(channelId: string, event?: string, message?: string, options?: {
     apply?: boolean;
     yes?: boolean;
+    approvalToken?: string;
+    trustedApproval?: TrustedNotificationApproval;
 }): Promise<NotificationTestResult>;
-//# sourceMappingURL=notifications.d.ts.map
+export {};

package/dist/commands/ports.d.ts

@@ -10,4 +10,3 @@ export interface PortsResult {
 }
 export declare function parsePortOutput(output: string, format: "ss" | "lsof"): ListeningPort[];
 export declare function listPorts(machineId?: string): PortsResult;
-//# sourceMappingURL=ports.d.ts.map

package/dist/commands/runtime.d.ts

@@ -27,6 +27,20 @@ export interface TmuxWatchResult {
     lastProbe: TmuxPaneProbeResult;
     emitted?: EmitResult;
 }
+export interface TmuxPaneDiedHookPlan {
+    tmuxCommand: string;
+    args: string[];
+    shellCommand: string;
+    eventType: "machines.tmux.pane_died";
+    deliver: boolean;
+    trustedLocalMutation: boolean;
+}
+export declare function buildTmuxPaneDiedHookPlan(options?: {
+    tmuxCommand?: string;
+    machinesCommand?: string;
+    deliver?: boolean;
+    approvalToken?: string;
+    trustedLocalMutation?: boolean;
+}): TmuxPaneDiedHookPlan;
 export declare function probeTmuxPane(target: string, tmuxCommand?: string): TmuxPaneProbeResult;
 export declare function watchTmuxPane(options: TmuxWatchOptions): Promise<TmuxWatchResult>;
-//# sourceMappingURL=runtime.d.ts.map

package/dist/commands/screen.d.ts

@@ -22,6 +22,10 @@ export interface ScreenEnableCommandPlan {
     user: string;
     passwordSecretKey: string;
     remoteCommand: string;
+    secretsCommand: string;
+    secretsCommandArgs: string[];
+    sshCommand: string;
+    sshCommandArgs: string[];
     command: string;
 }
 export interface ScreenCredentialOptions extends MachineRouteOptions {
@@ -64,4 +68,3 @@ export declare function buildScreenEnableRemoteCommand(user: string, vncPassword
  */
 export declare function buildScreenEnableRemoteCommandFromStdin(user: string): string;
 export declare function buildScreenEnableCommand(machineId: string, options?: ScreenEnableCommandOptions): ScreenEnableCommandPlan;
-//# sourceMappingURL=screen.d.ts.map

package/dist/commands/self-test.d.ts

@@ -1,3 +1,2 @@
 import type { SelfTestResult } from "../types.js";
 export declare function runSelfTest(): SelfTestResult;
-//# sourceMappingURL=self-test.d.ts.map

package/dist/commands/serve.d.ts

@@ -11,4 +11,3 @@ export interface ServeInfo {
 export declare function getServeInfo(options?: ServeOptions): ServeInfo;
 export declare function renderDashboardHtml(): string;
 export declare function startDashboardServer(options?: ServeOptions): ReturnType<typeof Bun.serve>;
-//# sourceMappingURL=serve.d.ts.map

package/dist/commands/setup.d.ts

@@ -1,8 +1,10 @@
 import { type MachineCommandRunner } from "../remote.js";
 import type { SetupResult } from "../types.js";
 export declare function buildSetupPlan(machineId?: string): SetupResult;
-export declare function runSetup(machineId?: string, options?: {
+export interface RunSetupOptions {
     apply?: boolean;
     yes?: boolean;
-}, runner?: MachineCommandRunner): SetupResult;
-//# sourceMappingURL=setup.d.ts.map
+    expectedPlanDigest?: string;
+}
+export declare function runSetup(machineId?: string, options?: RunSetupOptions, runner?: MachineCommandRunner): SetupResult;
+export declare function runSetupPlan(plan: SetupResult, options?: RunSetupOptions, runner?: MachineCommandRunner): SetupResult;

package/dist/commands/ssh.d.ts

@@ -6,6 +6,13 @@ export interface ResolvedSshTarget {
     confidence: "exact" | "high" | "medium" | "low" | "none";
     warnings: string[];
 }
+export interface SshCommandPlan extends ResolvedSshTarget {
+    command: "ssh";
+    args: string[];
+    shellCommand: string;
+}
+export declare function validateSshTarget(target: string): string;
 export declare function resolveSshTarget(machineId: string, options?: MachineRouteOptions): ResolvedSshTarget;
 export declare function buildSshCommand(machineId: string, remoteCommand?: string, options?: MachineRouteOptions): string;
-//# sourceMappingURL=ssh.d.ts.map
+export declare function buildSshCommandArgs(machineId: string, remoteCommand?: string, options?: MachineRouteOptions): string[];
+export declare function buildSshCommandPlan(machineId: string, remoteCommand?: string, options?: MachineRouteOptions): SshCommandPlan;

package/dist/commands/status.d.ts

@@ -3,4 +3,3 @@ export interface FleetStatusOptions {
     privateMetadata?: boolean;
 }
 export declare function getStatus(options?: FleetStatusOptions): FleetStatus;
-//# sourceMappingURL=status.d.ts.map

package/dist/commands/sync.d.ts

@@ -1,8 +1,10 @@
 import { type MachineCommandRunner } from "../remote.js";
 import type { SyncResult } from "../types.js";
 export declare function buildSyncPlan(machineId?: string, runner?: MachineCommandRunner): SyncResult;
-export declare function runSync(machineId?: string, options?: {
+export interface RunSyncOptions {
     apply?: boolean;
     yes?: boolean;
-}, runner?: MachineCommandRunner): SyncResult;
-//# sourceMappingURL=sync.d.ts.map
+    expectedPlanDigest?: string;
+}
+export declare function runSync(machineId?: string, options?: RunSyncOptions, runner?: MachineCommandRunner): SyncResult;
+export declare function runSyncPlan(plan: SyncResult, options?: RunSyncOptions, runner?: MachineCommandRunner): SyncResult;

package/dist/commands/workspace.d.ts

@@ -34,4 +34,3 @@ export interface WorkspaceManifestRepairResult {
     warnings: string[];
 }
 export declare function repairWorkspaceManifestMappings(options: WorkspaceManifestRepairOptions): WorkspaceManifestRepairResult;
-//# sourceMappingURL=workspace.d.ts.map

package/dist/compatibility.d.ts

@@ -56,4 +56,3 @@ export interface MachineCompatibilityOptions {
     now?: Date;
 }
 export declare function checkMachineCompatibility(options?: MachineCompatibilityOptions): MachineCompatibilityReport;
-//# sourceMappingURL=compatibility.d.ts.map

package/dist/consumer-schema.d.ts

@@ -18,4 +18,3 @@ export declare const MACHINES_CONSUMER_SCHEMA_BUNDLE: MachinesConsumerSchemaBund
 export declare function getMachinesConsumerSchemaBundle(): MachinesConsumerSchemaBundle;
 export declare function validateMachinesConsumerEnvelope(envelope: MachinesConsumerSchemaEnvelope, value: unknown): MachinesConsumerValidationResult;
 export type MachinesConsumerEnvelopeValue = MachineTopology | MachineRouteResolution | MachineWorkspaceResolution | MachineCompatibilityReport | MachineResolverSnapshot;
-//# sourceMappingURL=consumer-schema.d.ts.map

package/dist/consumer.d.ts

@@ -9,4 +9,3 @@ export type { MachineCommandResult, } from "./remote.js";
 export { buildSshCommand, resolveSshTarget, } from "./commands/ssh.js";
 export type { ResolvedSshTarget, } from "./commands/ssh.js";
 export { getPackageVersion, } from "./version.js";
-//# sourceMappingURL=consumer.d.ts.map