@hydraharness/harness-client-runtime 0.0.0-stage → 0.1.1-rc.7

package/lib/types/client/sessions/session.d.ts

@@ -0,0 +1,287 @@
+import type { Context } from '@hydraharness/cordis';
+import type { AttachmentIdType, ImageAttachmentRef, VideoAttachmentRef } from '@hydraharness/harness-attachment';
+import type { IApiClient, MessageId, MuxFrame, PromptContentPart, QueueAction, RpcId, RpcResult, SessionId, SubagentAddress } from '@hydraharness/harness-api-remotes/client';
+import type { SessionFace } from '../contract/session.ts';
+import type { ConversationRuntime } from './conversation-assembler.ts';
+import type { ConversationSnapshot } from './conversation.ts';
+import type { RemoteResult } from '@hydraharness/harness-typert-protocol';
+import type { SessionRemotes } from './remotes.ts';
+import { ProjectionValueStore } from './projection-store.ts';
+/** Messages requested per history page. */
+export declare const PAGE_MESSAGES = 50;
+/** Manager-owned observers of a Session object's local state edges. */
+export interface SessionOptions {
+    /** Catalog-discovered address selecting non-activating subagent transport. */
+    address?: SubagentAddress;
+    /** Whether the exact direct parent Agent was live at the latest catalog read. */
+    parentAvailable?: boolean;
+    /**
+     * First ACCEPTED prompt on a blank session (fires at most once, on the
+     * prompt RPC's success response): the manager mirrors the blank→false flip
+     * into its list row so the session surfaces without waiting for a host
+     * frame. Acceptance is the flip point because it proves the user message
+     * is in the host log; a rejected first prompt keeps the session blank
+     * (hidden, still reusable by connectWorkspace).
+     */
+    onEngaged?(session: Session): void;
+    /**
+     * Manager-owned projection value store to adopt (frames route through the
+     * manager and values outlive instantiation); omitted, the Session owns a
+     * private store (bare object-layer construction).
+     */
+    projections?: ProjectionValueStore;
+    /** Runtime registries used by this Session-owned Conversation assembler. */
+    conversation?: ConversationRuntime;
+}
+/**
+ * Owns a session's event window, derived conversation state, and observable
+ * snapshot. React bindings remain outside this data layer. Features see only
+ * the {@link SessionFace} slice (ISession verbs + the snapshot source); the
+ * remaining public members are manager/runtime entry points.
+ */
+export declare class Session implements SessionFace {
+    readonly sessionId: SessionId;
+    private readonly api;
+    private readonly remote;
+    private readonly options;
+    private events;
+    /** Wire views aligned with `events` by index (envelope-level annotations; undefined = no view).
+     *  Kept parallel rather than merged so `events` stays the raw log slice (model-visible ⟺ logged). */
+    private views;
+    private baseSeq;
+    private versioned;
+    private hasMore;
+    private openState;
+    private openError;
+    private openPromise;
+    /** Bumped by resync to invalidate an in-flight doOpen: a reconnect must rebuild, never adopt
+     *  a pre-disconnect open whose history request is already doomed. Stale doOpen
+     *  passes drop all writes once the generation moves on. */
+    private openGeneration;
+    private loadingOlder;
+    private pending;
+    private pendingRev;
+    private pendingCache;
+    /** Authoritative stream-only inbox snapshot; pending work never hits history. */
+    private readonly queueMirror;
+    /** Session-owned business Context engine over the contiguous raw window. */
+    private readonly conversation;
+    private running;
+    private address;
+    private parentAvailable;
+    /**
+     * Sticky send marker, private input of the composerPhase derivation: set
+     * synchronously before prompt()'s first await, never reset — the blank →
+     * engaging edge of the phase machine (see ComposerPhase).
+     */
+    private promptAttempted;
+    /** A first accepted prompt stays in the engaging phase until its turn is observable. */
+    private firstPromptPendingTurn;
+    /** Empty-log mirror (see ConversationSnapshot.blank); unknown bare sessions begin conservatively blank. */
+    private blankBit;
+    private removed;
+    private promptError;
+    private lastAgentError;
+    /** Live events buffered during open/resync and stitched by sequence once history lands. */
+    private liveBuffer;
+    /** Gap repair in flight; live events detour to the buffer until the tail page lands. */
+    private stitching;
+    /** subscribed.lastSeq baseline (gap detection; null when no subscribed frame arrived — degrade to the liveBuffer dedup path). */
+    private subscribedLastSeq;
+    /**
+     * Per-session projection value store (push model; see the session-projection
+     * subsystem page, docs/subsystems/session-projection.md): finished whole
+     * values computed on the host, seeded by the tail page's
+     * projections block and updated by `session/projection` frames under the
+     * one higher-seq-wins rule. Keys are read via `projections.faceOf(key)`
+     * (the useProjection resolution face); the conversation snapshot never
+     * carries projection values, and no client-side domain folding exists.
+     * Manager-owned when constructed through SessionManager (frames route and
+     * the store outlives instantiation, the title-snapshot precedent); a bare
+     * construction gets a private store.
+     */
+    readonly projections: ProjectionValueStore;
+    private snapshotCache;
+    private readonly notifier;
+    /**
+     * Agent-scoped cordis context, bound once by SessionRuntime when it
+     * mints the scope (the client mirror of the host Agent's loopCtx). The
+     * Session dispatches its own scoped events through it; undefined means
+     * unbound (bare object-layer construction) or already pruned — both skip
+     * dispatch-dependent behavior rather than fail.
+     */
+    private actx;
+    /**
+     * @param sessionId - Host session identity (client sessions are always Host-born).
+     * @param api - shared wire client.
+     * @param remote - generated Remote namespaces this session calls.
+     * @param options - optional manager-owned state observers.
+     */
+    constructor(sessionId: SessionId, api: IApiClient, remote: SessionRemotes, options?: SessionOptions);
+    /**
+     * Bind the Agent-scoped context minted by SessionRuntime (single write;
+     * a second bind is a wiring error and throws). Direction stays one-way at
+     * this binding boundary: consumers still reach the Session via `sessions.sessionOf`,
+     * while the Session holds its own dispatch point (host Agent.loopCtx
+     * mirror).
+     * @param actx - the agent's scoped context.
+     */
+    bindScope(actx: Context): void;
+    /** Release the bound scope at prune time (a later rebind accompanies a freshly minted scope). */
+    unbindScope(): void;
+    /**
+     * Send (queue/steer passed through 1:1); failures land in the snapshot's promptError.
+     * @param content - text plus browser-owned temporary image uploads.
+     * @param mode - queue appends after the current turn; steer interrupts it.
+     * @returns the prompt result (also mirrored into promptError on failure).
+     */
+    prompt(content: PromptContentPart[], mode: 'queue' | 'steer', signal?: AbortSignal): Promise<RpcResult<{
+        accepted: true;
+    }>>;
+    /**
+     * Resolve image or video bytes referenced by this session.
+     * @param attachmentId - opaque id found in the folded session log.
+     * @returns the authenticated reference and decoded bytes.
+     */
+    readAttachment(attachmentId: AttachmentIdType): Promise<RpcResult<{
+        attachment: ImageAttachmentRef | VideoAttachmentRef;
+        data: Uint8Array;
+    }>>;
+    /** Apply one operation to a still-pending queue occurrence. */
+    updateQueue(itemId: MessageId, action: QueueAction): Promise<RpcResult<{
+        accepted: true;
+    }>>;
+    /**
+     * Stop the active turn while the Host preserves pending inbox work; failures
+     * land in promptError (same error-strip display slot). A continuable
+     * subagent address routes through `subagent.interrupt`, whose durable
+     * parent-address authority works without a live parent Agent; a one-shot
+     * address stays uncancellable (the UI offers no stop action, so this arm is
+     * defensive).
+     * @returns the cancel result.
+     */
+    cancel(): Promise<RpcResult<{
+        accepted: true;
+    }>>;
+    /**
+     * Rename: contract session.rename 1:1. On success settle the 'title'
+     * projection cell from the response's `{title, seq}` under the store's
+     * higher-seq-wins rule (the push frame arriving later is a no-op replay),
+     * so the list row and any useProjection('title') reader update without
+     * waiting for the mux frame.
+     * @param title - raw title text (the host normalizes acceptance).
+     * @returns the rename result (normalized accepted title + title event seq).
+     */
+    rename(title: string): Promise<RpcResult<{
+        title: string;
+        seq: number;
+    }>>;
+    /**
+     * Execute one slash-command line against this session's agent — pure
+     * admission semantics (the host executor durably logs the lifecycle;
+     * outcomes render as flow nodes, never as a response echo).
+     * @param line - the full command line, leading slash included.
+     * @returns the admission result, or the error branch on transport failure.
+     */
+    command(line: string): Promise<RemoteResult<{
+        matched: boolean;
+    }>>;
+    /** First open: pull the tail page (idempotent — in-flight/already-open returns the existing promise). */
+    open(): Promise<void>;
+    /** Page up: pull one earlier page with the window's first seq as beforeSeq and prepend. */
+    loadOlder(): Promise<void>;
+    /** Reconnect rebuild (manager calls this on onConnected for instances that were opened):
+     *  reset the window and rerun open; pending waits for the baseline replay. Invalidates any
+     *  in-flight open first — its history request rode the dead connection and must not settle
+     *  the fresh generation into 'error'. */
+    resync(): Promise<void>;
+    /**
+     * uSES subscription entry.
+     * @param listener - change callback.
+     * @returns the unsubscribe function.
+     */
+    subscribe(listener: () => void): () => void;
+    /**
+     * Cached conversation snapshot (rebuilt lazily when dirty with no listeners).
+     * @returns the cached reference (stable until the next flush).
+     */
+    getSnapshot(): ConversationSnapshot;
+    /**
+     * Mux frame arrival (the dispatch switch).
+     * @param rpcId - the frame envelope id (the respond backfill key for requested frames).
+     * @param frame - the routed frame.
+     */
+    handleMuxEnvelope(rpcId: RpcId, frame: MuxFrame): void;
+    /**
+     * Running-bit relay from the host stream (list entry and snapshot stay consistent).
+     * @param running - the new running state.
+     */
+    handleRunning(running: boolean): void;
+    /**
+     * Install or clear the catalog-discovered transport address. A changed
+     * address rebuilds an already-open window through its new history route.
+     * @param address - direct parent/child address, or undefined for ordinary transport.
+     * @param parentAvailable - latest exact-parent availability hint.
+     */
+    configureSubagent(address: SubagentAddress | undefined, parentAvailable?: boolean): void;
+    /**
+     * Update only the parent availability hint from a catalog refresh.
+     * @param available - whether the exact direct parent is live.
+     */
+    handleSubagentParentAvailable(available: boolean): void;
+    /**
+     * Blank-bit relay from the authoritative summary source (list baseline and
+     * the session-added frame). Monotone: once any signal (local first send,
+     * running flip, an earlier summary) cleared it, a stale true never
+     * re-blanks.
+     * @param blank - the summary's derived empty-log bit.
+     */
+    handleBlank(blank: boolean): void;
+    /** host/session-removed relay: flag the snapshot (instance survives — resident-instance rule). */
+    handleRemoved(): void;
+    /**
+     * host/agent-error relay: the only outlet for live failures with no turn position.
+     * @param message - the stringified error.
+     */
+    handleAgentError(message: string): void;
+    /** No-op because session instances remain resident. */
+    dispose(): void;
+    /** Rebuild the current window after a low-frequency Definition or view registration change. */
+    rebuildConversationRegistry(): void;
+    /** Requested-frame arrival: the wait enters the pending map under its own key. */
+    private mint;
+    /** Authoritative resolved-frame settlement: mark, then drop from the pending map. */
+    private settle;
+    /** @param generation - openGeneration at launch; every await re-checks it and a stale pass
+     *  drops all writes (resync superseded this open — its outcome belongs to a dead connection). */
+    private doOpen;
+    /** Install the history window + stitch the liveBuffer (seq is the sole dedup key).
+     *  Stitching MUST NOT route through acceptLiveEvent: openState is still 'loading' here
+     *  (doOpen flips it after install), so recursing would push every buffered event straight
+     *  back into liveBuffer where nothing ever drains it — a silent drop loop.
+     *  A carried projections block seeds the value store (higher seq wins, so a stale
+     *  baseline cannot overwrite a newer push frame); the window events themselves are
+     *  never folded — the host is the only computation site. */
+    private installWindow;
+    /** Seq-guarded append shared by stitching and the open-state live path. */
+    private appendLive;
+    /** Land a live session/event (open/repair in flight -> buffer; overlapping seq -> drop;
+     *  a seq gap -> buffer + tail-page repull instead of appending a hole (a gap is an
+     *  expected reconnect-window artifact, repaired by refetch). The window stays one contiguous
+     *  raw range, which lets Conversation Definitions correlate every recorded event between its
+     *  ends and lets a compaction checkpoint resolve its cited summary event. */
+    private acceptLiveEvent;
+    /** Route assembler cadence into the Session's existing microtask/RAF notifier. */
+    private scheduleConversation;
+    /** Resync-lite: repull the tail page and stitch the liveBuffer through the shared
+     *  installWindow path. No openState transition — the UI keeps the current window (no loading
+     *  flash); events arriving meanwhile detour to liveBuffer via the stitching flag. */
+    private repairGap;
+    private windowTailSeq;
+    /** A control received after the history cut requires a newer selected transcript. */
+    private currentHistory;
+    private buildSnapshot;
+    /** Select ordinary or addressed history transport from the stored browser fact. */
+    private history;
+}
+//# sourceMappingURL=session.d.ts.map

package/lib/types/client/sessions/steering-history.d.ts

@@ -0,0 +1,23 @@
+/** Reconstruct durable steering identity from the event-sourced agent inbox. */
+import type { SessionEvent } from '@hydraharness/harness-session/types';
+/**
+ * Incrementally identifies `user/message` events claimed from the next-step
+ * inbox. The agent loop records all admitted input as `user/message`; the
+ * preceding `agent/inbox/spliced` events preserve whether it came from the
+ * queued-turn list or the next-step list.
+ */
+export declare class SteeringHistory {
+    private readonly inbox;
+    private readonly claimedNextStep;
+    /** Clear all replay state before rebuilding a history window. */
+    reset(): void;
+    /**
+     * Apply one event and report whether it is a durable human steering message.
+     * @param event - next raw session event in sequence order.
+     * @returns true only for a user-origin message previously claimed from `next-step`.
+     */
+    apply(event: SessionEvent): boolean;
+    /** Replay one host-validated inbox splice. */
+    private applySplice;
+}
+//# sourceMappingURL=steering-history.d.ts.map

package/lib/types/client/sessions/subagent-lineage.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Pure subagent-lineage aggregation over the retained session-list mirror.
+ * Ordinary forks terminate propagation so each visible session owns only its
+ * uninterrupted subagent subtree.
+ * @module @hydraharness/harness-client-runtime/client/sessions/subagent-lineage
+ */
+import type { SessionId } from '@hydraharness/harness-api-remotes/client';
+import type { SessionSummary } from './service.ts';
+/** Descendant counts projected for one possible parent session. */
+export interface SubagentDescendantSummary {
+    /** All descendants connected through uninterrupted subagent-origin lineage. */
+    readonly count: number;
+    /** Descendants whose exact session summary is currently running. */
+    readonly runningCount: number;
+}
+/**
+ * Index every subagent descendant under each ancestor it reaches through an
+ * uninterrupted subagent-origin chain. Cycles fail soft and orphan owners
+ * remain harmless map keys until their summaries arrive.
+ * @param summaries - retained session summaries keyed by id.
+ * @returns descendant totals and running totals keyed by possible parent id.
+ */
+export declare function indexSubagentDescendants(summaries: Readonly<Record<SessionId, SessionSummary>>): ReadonlyMap<SessionId, SubagentDescendantSummary>;
+//# sourceMappingURL=subagent-lineage.d.ts.map

package/lib/types/client/sessions/tool-call-tree.d.ts

@@ -0,0 +1,45 @@
+import type { SessionEvent } from '@hydraharness/harness-session/types';
+import type { ConversationNode, RunningToolCall } from './conversation.ts';
+/** Fixed wire-safety ceiling for every recursive Tool call consumer. */
+export declare const MAX_TOOL_CALL_TREE_DEPTH = 256;
+/**
+ * Owns Code Dispatch pairing and projects its private parent index into the
+ * recursive Tool call contract exposed by conversation snapshots.
+ */
+export declare class ToolCallTree {
+    private readonly childrenByParent;
+    private readonly depthByCall;
+    private readonly projectedByCall;
+    private revision;
+    private nodesCache;
+    private runningCache;
+    /** Forget all event-derived child calls before replaying a new window. */
+    reset(): void;
+    /**
+     * Fold one event when it belongs to the Code Dispatch lifecycle.
+     * @param event - Session event from the current live or history window.
+     * @returns Whether the event was consumed as a child-call lifecycle event.
+     */
+    apply(event: SessionEvent): boolean;
+    /**
+     * Attach recursively projected children to all settled roots in a node list.
+     * @param nodes - Cache-stable base conversation nodes.
+     * @returns The original list when no root changed, otherwise a structurally shared list.
+     */
+    projectNodes(nodes: readonly ConversationNode[]): readonly ConversationNode[];
+    /**
+     * Attach recursively projected children to all running root calls.
+     * @param calls - Cache-stable base running calls.
+     * @returns The original list when no root changed, otherwise a structurally shared list.
+     */
+    projectRunningCalls(calls: readonly RunningToolCall[]): readonly RunningToolCall[];
+    private projectBlock;
+    /**
+     * Accept an edge only when every recursive consumer can traverse it safely.
+     * Host-minted ids exclude cycles and current bindings emit one level; a
+     * malformed wire/history edge is consumed without hiding the rest of the session.
+     */
+    private acceptEdge;
+    private wouldCreateCycle;
+}
+//# sourceMappingURL=tool-call-tree.d.ts.map

package/lib/types/client/slots.d.ts

@@ -0,0 +1,191 @@
+/**
+ * SlotRegistry: the cordis Service layer of the slot system over the pure
+ * SlotCore (ui-slots owns registration semantics, the declaration ledger,
+ * the load-time validations, and the unload cascade). This layer owns what
+ * needs the runtime: the 'slots/changed' event bridge, register and
+ * declaration injection through the caller's ctx.effect (fiber unload
+ * collects both), the renderer installation contract (install()/renderSlot('root') +
+ * the SlotRendererHost face), and the store INSTANCE axis — handle x scope
+ * key -> create/cache, dropped with the last holding entry, session instances
+ * cleared (with persisted state) on scope death.
+ */
+import { Service } from '@hydraharness/cordis';
+import type { Context } from '@hydraharness/cordis';
+import { SlotCore } from '@hydraharness/harness-client-ui-slots';
+import type { LiveSlotNode, LocaleFace, OwnerOf, SlotMap, SlotRenderer, SlotSpec, StoredEntry } from '@hydraharness/harness-client-ui-slots';
+declare module '@hydraharness/harness-client-ui-slots' {
+    interface SlotMap {
+        /**
+         * The built-in render-tree root hole (seeded by SlotCore): the one slot the
+         * shell itself renders, and the ancestor of every other seat. OCCUPIED by
+         * ui-layout's AppFrame, which declares the sidebar, conversation, details,
+         * and shell.overlay seats inside it.
+         *
+         * DO NOT register here. This is a single slot, so a second entry does not
+         * sit beside the frame — it shadows it, and a dynamically registered entry
+         * is assigned a lower priority than the shipped one, which makes it the
+         * winner: the page would render your component alone, with every seat the
+         * frame declares gone. For a surface of your own that floats over the whole
+         * app, register into `shell.overlay` instead (a list slot: additive, and
+         * click-through until your entry opts into pointer events).
+         */
+        'root': {
+            kind: 'single';
+            scope: 'root';
+            owner: RootOwnerProps;
+        };
+    }
+}
+/** Root owner share: the shell supplies nothing — the frame is inject-assembled. */
+export interface RootOwnerProps {
+    children?: never;
+}
+/** One synchronous effect installed while an injected slot declaration is live. */
+type SlotInjectionEffect = (() => void) | Iterable<() => void, void, void>;
+/** cordis Service layer of the slot system; see the module doc for the split with SlotCore. */
+export declare class SlotRegistry extends Service {
+    private readonly _core;
+    /** Store-instance axis: handle -> mounted scope, refcount, resolved instances. */
+    private readonly _stores;
+    private _renderer;
+    private _locale;
+    private _host;
+    /**
+     * @param ctx - owning root context.
+     */
+    constructor(ctx: Context);
+    /**
+     * The single registration API. The typed face IS the core's register
+     * (both overloads reused verbatim — one authority, no structural copy;
+     * see SlotCore.register for children declaration, store seat, inject
+     * face, load-time validation, and the unload cascade). This layer adds:
+     * disposal through the caller's ctx.effect (fiber unload = cascade),
+     * exclusive-factory minting (`store: createXxxStore` becomes a per-entry
+     * handle), the registrant diagnostics stamp, and store-instance lifecycle
+     * on the entry axis.
+     *
+     * Declared here, implemented by prototype assignment below the class: it
+     * MUST stay a prototype method (never an instance arrow) — the cordis
+     * service proxy binds `this.ctx` to the CALLER's context at call time,
+     * which is what routes the effect (and the unload cascade) into the
+     * caller's fiber. An arrow property would freeze `this` to the service's
+     * own root ctx and silently break per-plugin disposal.
+     */
+    readonly register: SlotCore['register'];
+    /**
+     * Install an effect for each declaration lifetime of a slot. The callback
+     * runs synchronously when the declaration already exists; otherwise it runs
+     * inside the declaring `register()` call after the declaration is committed.
+     * Collapse disposes the effect and a later declaration runs it again.
+     * Callback effects are synchronous disposers; iterable effects install
+     * transactionally and dispose in reverse order. The controller belongs to
+     * the caller's fiber, so plugin unload cancels a pending wait and removes any
+     * active contribution.
+     *
+     * @param key - declared SlotMap key to depend on.
+     * @param callback - creates one disposer or an iterable of disposers.
+     * @returns idempotent disposer for the wait and active effect.
+     * @throws callback setup failures synchronously when the slot is already declared.
+     */
+    inject(key: keyof SlotMap & string, callback: () => SlotInjectionEffect): () => void;
+    /**
+     * Install the shell's renderer (ui-renderer's createSlotRenderer product).
+     * Boot-once: a second install throws. Runs through the caller's ctx.effect,
+     * so shell fiber unload uninstalls the renderer.
+     * @param renderer - the outlet machinery implementing SlotRenderer.
+     */
+    install(renderer: SlotRenderer): void;
+    /**
+     * Install the locale face backing the `t` standard seat (the locale
+     * plugin's product; same boot-once discipline as the renderer install).
+     * Runs through the caller's ctx.effect, so the installing fiber's unload
+     * uninstalls the face.
+     * @param face - namespace binder + revision observable.
+     */
+    installLocale(face: LocaleFace): void;
+    /**
+     * The single ctx-level render entry: the shell renders 'root'; every other
+     * key renders inside components through the props renderSlot face. All
+     * three guards are fail-loud boot-order checks, no fallback.
+     * @param key - must be 'root' (runtime-enforced for dynamically composed callers).
+     * @param owner - owner share for the root entry (the shell supplies {}).
+     * @returns the rendered root tree.
+     */
+    renderSlot<K extends keyof SlotMap & string>(key: K, owner: OwnerOf<K>): ReturnType<SlotRenderer['renderRoot']>;
+    /**
+     * Drop the per-session store instances of a dead session (the sessions
+     * service calls this on scope teardown; root-scoped records are untouched).
+     * Persisted state goes with the session — a never-rendered dead session can
+     * still own keys from an earlier page load, so the instance is materialized
+     * transiently just to clear storage (no-op for unpersisted stores).
+     * @param sessionId - the torn-down session.
+     */
+    pruneStoreScope(sessionId: string): void;
+    /**
+     * Snapshot entries for a key (render-erased view; stable reference between mutations).
+     * @param key - SlotMap key.
+     * @returns registered entries.
+     */
+    entries(key: keyof SlotMap & string): readonly StoredEntry[];
+    /**
+     * Shadowing winners per cell for a key: the first live (non-abdicated)
+     * entry of each cell in priority order — what outlets render; chain keys
+     * pass through unchanged (election consumes every entry). The raw
+     * {@link SlotsService.entries} view stays the inspection surface. Fresh
+     * array per call, not a uSES getSnapshot source.
+     * @param key - SlotMap key.
+     * @returns the winning entry per occupied cell.
+     */
+    entriesOfSlot(key: keyof SlotMap & string): readonly StoredEntry[];
+    /**
+     * Export the current JSON-safe Slot declaration tree for read-only inspection.
+     * @param root - exact live Slot root; omitted returns all roots.
+     * @returns selected Slot trees.
+     */
+    snapshot(root?: string): LiveSlotNode[];
+    /**
+     * Observe entry boundary crashes (every render-time entry failure the
+     * boundaries contain, abdicating or not) — the supervision seam for
+     * plugins mirroring contribution health. Fires synchronously per report,
+     * after the registry mutated for abdicating crashes. Callers own the
+     * disposer (wire it through ctx.effect for fiber-lifetime cleanup, as with
+     * {@link SlotsService.subscribe}).
+     * @param fn - called with the slot key, the crashed entry, the crash
+     * cause, and `abdicated`: whether the crash retired the entry from its cell.
+     * @returns unsubscribe.
+     */
+    onEntryError(fn: (key: string, entry: StoredEntry, error: unknown, info: {
+        abdicated: boolean;
+    }) => void): () => void;
+    /**
+     * Look up a declared spec (register-declared or the built-in 'root').
+     * @param key - SlotMap key.
+     * @returns spec or undefined.
+     */
+    spec<K extends keyof SlotMap & string>(key: K): SlotSpec<SlotMap[K]> | undefined;
+    /**
+     * Subscribe to a key's registration changes (microtask-batched).
+     * @param key - SlotMap key.
+     * @param fn - change callback.
+     * @returns unsubscribe.
+     */
+    subscribe(key: keyof SlotMap & string, fn: () => void): () => void;
+    /**
+     * Version counter for uSES pairing.
+     * @param key - SlotMap key.
+     * @returns current version.
+     */
+    getVersion(key: keyof SlotMap & string): number;
+    /** Delegating registration path: factory minting + registrant stamp + core write + instance-axis bookkeeping. */
+    private _register;
+    /** Build once after both object-layer services mount; per-session provide bundles still resolve lazily. */
+    private hostFace;
+    /** Resolve (create or reuse) the store instance for a registered handle under a scope key. */
+    private resolveStore;
+    /** Bind (or re-reference) a handle on the axis; cross-scope conflicts already threw in the core. */
+    private _acquire;
+    /** Drop one reference; the last holder's unload drops the record (instances go with it — engine stores need no explicit dispose). */
+    private _release;
+}
+export {};
+//# sourceMappingURL=slots.d.ts.map

package/lib/types/client/time-zone.d.ts

@@ -0,0 +1,8 @@
+/** Browser-owned time-zone sampling for prompt RPC provenance. */
+/**
+ * Resolve the current browser IANA zone for one outbound operation.
+ * @returns The browser-provided canonical zone.
+ * @throws when the runtime cannot provide a non-empty zone.
+ */
+export declare function resolvedClientTimeZone(): string;
+//# sourceMappingURL=time-zone.d.ts.map