@kodax-ai/kodax 0.7.77 → 0.7.79

package/dist/types-chunks/{integration-config.d-ojG4swOP.d.ts → integration-config.d-BNowXE8k.d.ts}

@@ -1,7 +1,7 @@
 import { b as McpServersConfig } from './config.d-CJy1WENT.js';
 
-type IntegrationDomain = 'mcp' | 'a2a' | 'extensions';
-type IntegrationConfigSource = 'user' | 'legacy-user' | 'default';
+type IntegrationDomain = "mcp" | "a2a" | "extensions";
+type IntegrationConfigSource = "user" | "legacy-user" | "default";
 interface McpIntegrationDocument {
     readonly version: 1;
     readonly servers: McpServersConfig;
@@ -19,7 +19,7 @@ interface IntegrationConfigSnapshot<T extends object> {
     readonly loadedAt: string;
 }
 interface IntegrationConfigDiagnostic {
-    readonly code: 'invalid-config' | 'activation-failed' | 'watcher-degraded';
+    readonly code: "invalid-config" | "activation-failed" | "watcher-degraded";
     readonly message: string;
     readonly time: string;
 }
@@ -33,7 +33,7 @@ interface IntegrationConfigStatus {
     readonly watching: boolean;
 }
 interface LegacyIntegrationMigrationDomainPlan {
-    readonly action: 'create' | 'none';
+    readonly action: "create" | "none";
     readonly entries: number;
     readonly destination: string;
     readonly reason?: string;
@@ -44,9 +44,12 @@ interface LegacyIntegrationMigrationPlan {
     readonly warnings: readonly string[];
 }
 interface LegacyIntegrationMigrationResult extends LegacyIntegrationMigrationPlan {
-    readonly applied: readonly ('mcp' | 'extensions')[];
+    readonly applied: readonly ("mcp" | "extensions")[];
     readonly cleanedLegacy: boolean;
 }
+declare class IntegrationConfigConflictError extends Error {
+    constructor(file: string, expected: string | undefined, actual: string | undefined);
+}
 type IntegrationDocumentValidator<T extends object> = (value: unknown) => T;
 type IntegrationConfigListener<T extends object> = (snapshot: IntegrationConfigSnapshot<T>, previous: IntegrationConfigSnapshot<T> | undefined) => Promise<void> | void;
 type IntegrationReloadResult<T extends object> = {
@@ -71,7 +74,8 @@ declare function writeIntegrationDocument<T extends object>(input: {
     readonly configHome: string;
     readonly document: T;
     readonly validate: IntegrationDocumentValidator<T>;
-    readonly expectedRevision?: string;
+    /** `null` means the destination must still be absent when committed. */
+    readonly expectedRevision?: string | null;
 }): IntegrationConfigSnapshot<T>;
 declare class IntegrationConfigController<T extends object> {
     #private;
@@ -80,6 +84,17 @@ declare class IntegrationConfigController<T extends object> {
         readonly configHome: string;
         readonly validate: IntegrationDocumentValidator<T>;
         readonly read: () => IntegrationConfigSnapshot<T>;
+        /**
+         * Optional legacy source consulted only while the split domain file is
+         * absent. It participates in both filesystem watching and polling.
+         */
+        readonly fallbackPath?: string;
+        /**
+         * Explicit fail-closed document used only when the first disk read is
+         * invalid. The diagnostic remains visible and a later valid file replaces
+         * this snapshot through the normal reload path.
+         */
+        readonly coldStartDefault?: T;
     });
     initialize(): Promise<IntegrationConfigSnapshot<T>>;
     snapshot(): IntegrationConfigSnapshot<T> | undefined;
@@ -91,5 +106,5 @@ declare class IntegrationConfigController<T extends object> {
     close(): void;
 }
 
-export { IntegrationConfigController as I, parseMcpIntegrationDocument as j, planLegacyIntegrationMigration as k, readMcpIntegration as l, migrateLegacyIntegrationConfig as m, resolveIntegrationConfigPath as n, parseExtensionsIntegrationDocument as p, readExtensionsIntegration as r, writeIntegrationDocument as w };
-export type { ExtensionsIntegrationDocument as E, LegacyIntegrationMigrationDomainPlan as L, McpIntegrationDocument as M, IntegrationConfigDiagnostic as a, IntegrationConfigListener as b, IntegrationConfigSnapshot as c, IntegrationConfigSource as d, IntegrationConfigStatus as e, IntegrationDocumentValidator as f, IntegrationDomain as g, LegacyIntegrationMigrationPlan as h, LegacyIntegrationMigrationResult as i };
+export { IntegrationConfigConflictError as I, IntegrationConfigController as a, parseMcpIntegrationDocument as k, planLegacyIntegrationMigration as l, migrateLegacyIntegrationConfig as m, readMcpIntegration as n, resolveIntegrationConfigPath as o, parseExtensionsIntegrationDocument as p, readExtensionsIntegration as r, writeIntegrationDocument as w };
+export type { ExtensionsIntegrationDocument as E, LegacyIntegrationMigrationDomainPlan as L, McpIntegrationDocument as M, IntegrationConfigDiagnostic as b, IntegrationConfigListener as c, IntegrationConfigSnapshot as d, IntegrationConfigSource as e, IntegrationConfigStatus as f, IntegrationDocumentValidator as g, IntegrationDomain as h, LegacyIntegrationMigrationPlan as i, LegacyIntegrationMigrationResult as j };

package/dist/types-chunks/{oauth-login.d-Bgb4rdLN.d.ts → oauth-login.d-6i-vidxv.d.ts}

@@ -30,6 +30,10 @@ declare class McpAuthRequiredError extends Error {
     constructor(status: number, wwwAuthenticate?: string | undefined);
 }
 type StdioFraming = 'content-length' | 'ndjson';
+declare class McpTransportCleanupIncompleteError extends Error {
+    readonly code: "mcp_cleanup_incomplete";
+    constructor();
+}
 interface McpTransportOptions {
     stdioFraming?: StdioFraming;
     httpResolvedTransport?: 'streamable-http' | 'sse';
@@ -170,5 +174,5 @@ declare function performOAuthLogin(options: PerformOAuthLoginOptions): Promise<O
  */
 declare function loadValidToken(serverId: string): Promise<OAuthToken | undefined>;
 
-export { McpAuthRequiredError as M, McpExpiredSessionError as a, createMcpTransport as f, discoverAuthorizationServerMetadata as g, discoverOAuthEndpoints as h, discoverProtectedResourceMetadata as i, extractInsufficientScope as j, extractResourceMetadataUrl as k, loadValidToken as l, performOAuthLogin as p, registerOAuthClient as r };
-export type { AuthorizationServerMetadata as A, DiscoveredOAuthEndpoints as D, OAuthClientInfo as O, PerformOAuthLoginOptions as P, WwwAuthenticateChallenge as W, McpTransport as b, McpTransportEvents as c, OAuthLoginConsent as d, ProtectedResourceMetadata as e };
+export { McpAuthRequiredError as M, McpExpiredSessionError as a, McpTransportCleanupIncompleteError as c, createMcpTransport as g, discoverAuthorizationServerMetadata as h, discoverOAuthEndpoints as i, discoverProtectedResourceMetadata as j, extractInsufficientScope as k, extractResourceMetadataUrl as l, loadValidToken as m, performOAuthLogin as p, registerOAuthClient as r };
+export type { AuthorizationServerMetadata as A, DiscoveredOAuthEndpoints as D, OAuthClientInfo as O, PerformOAuthLoginOptions as P, WwwAuthenticateChallenge as W, McpTransport as b, McpTransportEvents as d, OAuthLoginConsent as e, ProtectedResourceMetadata as f };

package/dist/types-chunks/{public-api.d--fF88JrC.d.ts → public-api.d-BpJhHoa7.d.ts}

@@ -1,7 +1,6 @@
-import { a as BashPrefixExtractor, t as KodaXAgentMode } from './bash-prefix-extractor.d-pZdu6qt7.js';
-import { F as KodaXReasoningMode, k as KodaXMessage, S as KodaXTaskResultMetadata } from './types.d-DIpZJKUl.js';
-import { p as LearningSurfaceSnapshot$1, n as LearningQuery, m as LearningPage, b as LearnedCapabilityRecord, j as LearningEvent, o as LearningSubscribeOptions } from './center-types.d-BBT122uJ.js';
-import { bH as KodaXSessionData, bM as KodaXSessionLineage, bR as KodaXSessionNavigationOptions, bT as KodaXSessionRuntimeInfo, bV as KodaXSessionStorage, i as AgentActorSnapshot, aQ as CompactionReport, by as KodaXJsonValue } from './types.d-RdWRfUEs.js';
+import { a as BashPrefixExtractor, t as KodaXAgentMode } from './bash-prefix-extractor.d-CNSidpmv.js';
+import { G as KodaXReasoningMode, k as KodaXMessage, T as KodaXTaskResultMetadata } from './types.d-CgrXrFrq.js';
+import { cY as LearningSurfaceSnapshot$1, cT as LearningQuery, cS as LearningPage, cv as LearnedCapabilityRecord, cO as LearningEvent, cX as LearningSubscribeOptions, bY as KodaXSessionData, c1 as KodaXSessionLineage, c6 as KodaXSessionNavigationOptions, c8 as KodaXSessionRuntimeInfo, ca as KodaXSessionStorage, bZ as KodaXSessionEntry, bU as KodaXSessionArtifactLedgerEntry, bC as KodaXExtensionSessionRecord, cc as KodaXSessionUiHistoryItem, c9 as KodaXSessionScope, k as AgentActorSnapshot, aX as CompactionReport, bO as KodaXJsonValue } from './controller.d-RGV7Pjv9.js';
 
 /**
  * TextBuffer - Text buffer management class - 文本缓冲区管理类
@@ -898,12 +897,182 @@ declare class MemorySessionStorage implements SessionStorage {
 }
 declare function createMemorySessionStorage(): SessionStorage;
 
+type SessionConversationHistoryStatus = 'resolved' | 'partial' | 'ambiguous';
+type SessionConversationHistoryIssueCode = 'active_entry_missing' | 'compaction_boundary_invalid' | 'compaction_predecessor_ambiguous' | 'compaction_predecessor_missing' | 'legacy_overlap_ambiguous' | 'lineage_path_incomplete' | 'lineage_unavailable' | 'logical_identity_conflict';
+interface SessionConversationHistoryIssue {
+    readonly code: SessionConversationHistoryIssueCode;
+    readonly message: string;
+    /** Number of diagnostics of this code represented by this bounded summary. */
+    readonly occurrenceCount: number;
+    /** Total evidence references before `entryIds` was bounded. */
+    readonly entryCount: number;
+    readonly entryIds: readonly string[];
+}
+/**
+ * One SDK-resolved conversation item. `auditEntryIds` names every proven
+ * physical copy represented by it; raw bodies remain in the audit API.
+ */
+interface SessionConversationHistoryEntry {
+    readonly boundaryId?: string;
+    readonly auditEntryIds: readonly string[];
+    readonly message: KodaXMessage;
+}
+interface SessionConversationHistoryData {
+    readonly sourceRevision: string;
+    readonly status: SessionConversationHistoryStatus;
+    readonly entries: readonly SessionConversationHistoryEntry[];
+    readonly issues: readonly SessionConversationHistoryIssue[];
+}
+declare function emptyConversationEntryChain(): string;
+declare function extendConversationEntryChain(previous: string, entries: readonly SessionConversationHistoryEntry[]): string;
+declare function createConversationEntryChain(entries: readonly SessionConversationHistoryEntry[]): string;
+declare function createSessionConversationHistoryRevision(history: SessionConversationHistoryData, entryChain?: string): string;
+
+type SessionSourceFileKind = 'main' | 'islands' | 'legacy_archive';
+interface SessionSourceFileRevisionState {
+    readonly kind: SessionSourceFileKind;
+    readonly relativePath: string;
+    readonly byteLength: number;
+    readonly chunkCount: number;
+    readonly chain: string;
+    /** Canonical base64 for the final incomplete source chunk. */
+    readonly tail: string;
+}
+interface SessionSourceRevisionState {
+    readonly version: 1;
+    readonly files: readonly SessionSourceFileRevisionState[];
+}
+
+interface ConversationPageCacheAdmission {
+    readonly surface?: string;
+    readonly profileId?: string;
+}
+interface ConversationPageCacheInput {
+    readonly expectedRevision?: string;
+    readonly end?: number;
+    readonly limit: number;
+    readonly maxPageBytes: number;
+    readonly maxInlineEntryBytes: number;
+    readonly reservedBytes: number;
+    readonly authorize?: (admission: ConversationPageCacheAdmission) => void | Promise<void>;
+    readonly signal?: AbortSignal;
+}
+interface ConversationPageCacheEntry {
+    readonly index: number;
+    readonly boundaryId?: string;
+    readonly byteLength: number;
+    readonly oversized: boolean;
+    readonly entry?: SessionConversationHistoryEntry;
+}
+interface ConversationPageCachePage {
+    readonly revision: string;
+    readonly sourceRevision: string;
+    readonly status: SessionConversationHistoryStatus;
+    readonly issues: readonly SessionConversationHistoryIssue[];
+    readonly entries: readonly ConversationPageCacheEntry[];
+    readonly hasMore: boolean;
+    readonly nextEnd?: number;
+}
+interface ConversationPageCacheChunkInput {
+    readonly revision: string;
+    readonly entryIndex: number;
+    readonly offset: number;
+    readonly authorize?: (admission: ConversationPageCacheAdmission) => void | Promise<void>;
+    readonly signal?: AbortSignal;
+}
+interface ConversationPageCacheChunk {
+    readonly revision: string;
+    readonly entryIndex: number;
+    readonly boundaryId?: string;
+    readonly data: Buffer;
+    readonly nextOffset?: number;
+}
+declare class ConversationPageCacheCapacityError extends Error {
+    constructor();
+}
+
 /**
  * KodaX session storage - filesystem implementation.
  */
 
+/**
+ * Opaque process-local boundary for a prepared, append-only Session write.
+ * Obtain a fresh value from {@link FileSessionStorage.prepareSessionAppend};
+ * a committed append consumes the boundary. It returns a reusable successor
+ * when that successor can be witnessed safely, or `null` when the caller must
+ * reload before another append.
+ */
+interface PreparedSessionAppendBaseline {
+    readonly sessionId: string;
+    readonly revision: string;
+    readonly lineageCount: number;
+    readonly artifactCount: number;
+    readonly extensionCount: number;
+    readonly activeEntryId: string | null;
+    readonly tag?: string;
+}
+/**
+ * An explicit append-only delta. Historical arrays are intentionally absent:
+ * callers that need to rewrite existing Session data must use
+ * {@link FileSessionStorage.appendSessionDelta}, which performs an exact merge.
+ */
+interface PreparedSessionTailDelta {
+    readonly baseline: PreparedSessionAppendBaseline;
+    readonly title: string;
+    readonly activeEntryId: string | null;
+    readonly lineageEntries: readonly KodaXSessionEntry[];
+    readonly artifactEntries?: readonly KodaXSessionArtifactLedgerEntry[];
+    readonly extensionRecords?: readonly KodaXExtensionSessionRecord[];
+    readonly uiHistory?: readonly KodaXSessionUiHistoryItem[];
+    readonly scope?: KodaXSessionScope;
+}
+type SessionReadErrorCode = 'data_corrupt' | 'data_changed' | 'version_incompatible' | 'read_timeout' | 'read_cancelled';
+declare class SessionReadError extends Error {
+    readonly code: SessionReadErrorCode;
+    constructor(code: SessionReadErrorCode, message: string);
+}
+interface SessionReadOptions {
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+/** Immutable read boundary used by conversation-history fork/rewind. */
+interface SessionHistoryBoundary {
+    readonly sourceRevision: string;
+}
+interface SessionReadSnapshot {
+    readonly data: SessionData;
+    readonly lineage: KodaXSessionLineage | null;
+    /** Exact identity of the immutable persisted bundle used for this capture. */
+    readonly sourceRevision: string;
+    /** Incrementally extendable witness for the exact persisted bundle revision. */
+    readonly sourceRevisionState: SessionSourceRevisionState;
+    /** Stat-derived witness for prepared-page validation at this exact capture. */
+    readonly boundaryRevision: string;
+}
+type StableFileIdentity = {
+    readonly dev: bigint;
+    readonly ino: bigint;
+    readonly size: bigint;
+    readonly mtimeNs: bigint;
+    readonly ctimeNs: bigint;
+};
+type SessionTopologyIdentity = {
+    readonly root: StableFileIdentity;
+    readonly epoch: string | null;
+    readonly writerScope: 'session' | 'global';
+    readonly writerIdentity: StableFileIdentity | null;
+    readonly activeWriterIdentity: StableFileIdentity | null;
+};
+type SessionLocationTraversalBoundary = {
+    readonly topologyBefore?: SessionTopologyIdentity;
+    readonly writerTopologyDigestBefore?: string;
+    readonly topologyMutationBefore: boolean;
+};
 declare class FileSessionStorage implements KodaXSessionStorage {
     private readonly sessionsDir;
+    private readonly configHome;
+    private readonly sessionLocations;
+    private readonly verifiedLocationMisses;
     /**
      * v0.7.46 — optional explicit project cwd for in-process embedders
      * (KodaX Space) serving multiple projects from a single runtime.
@@ -927,25 +1096,56 @@ declare class FileSessionStorage implements KodaXSessionStorage {
     private readonly emitMismatchWarnings;
     constructor(opts?: {
         sessionsDir?: string;
+        configHome?: string;
         cwd?: string;
         emitMismatchWarnings?: boolean;
     });
     /** Absolute session root used by this storage instance. */
     getSessionsDir(): string;
+    /**
+     * Return the current one-shot boundary for an explicit tail-only append.
+     * A full save/load initializes this boundary; every successful write rotates
+     * it so stale or concurrent deltas fail with `data_changed`.
+     */
+    private currentPreparedSessionAppend;
+    /**
+     * Prepare an authenticated one-shot boundary for a bounded tail append.
+     * Returns `null` when no canonical cache witness is available; callers must
+     * then load/rebuild or use the exact full-snapshot append path.
+     */
+    prepareSessionAppend(id: string): Promise<PreparedSessionAppendBaseline | null>;
+    /** @internal Register main paths found by one list traversal. */
+    indexSessionLocations(filePaths: readonly string[], globallyVerified: boolean, topologyIdentity?: SessionTopologyIdentity): void;
+    /** @internal Start an authoritative all-project locator traversal. */
+    beginSessionLocationTraversal(): SessionLocationTraversalBoundary;
+    /** @internal Commit locator hints only when the whole traversal was stable. */
+    completeSessionLocationTraversal(boundary: SessionLocationTraversalBoundary, filePaths: readonly string[], traversalComplete: boolean): void;
     private writeQueues;
     private serializedWrite;
+    private refreshSelfVerifiedLocationTopology;
+    private sessionWriteLockPath;
+    private persistSessionLocationHint;
+    private resolveSessionLocationHint;
     private appendState;
-    private sessionDirCache;
+    private lineageIdentityFilterHashes;
     private projectJsonWritten;
     private migrationPromise?;
     private ensureMigrated;
-    /** Update watermarks. Only overwrites fields the caller actually provided. */
+    /** Update watermarks without retaining or serializing the full Session graph. */
     private syncAppendState;
+    private syncAppendStateFromFile;
     private legacyFlatPath;
     private legacyFlatArchivePath;
     private projectDir;
     /** Resolve (and cache) the project directory a write for `id` should land in. */
     private resolveWriteDir;
+    private isLocationGloballyVerified;
+    private verifiedLocationTopology;
+    private verifiedMissingLocationTopology;
+    private assertLocationTopologyUnchanged;
+    private readSessionTopologyIdentitySync;
+    private advanceSessionLocationTopology;
+    private withSessionLocationTopologyChange;
     private writeFilePath;
     /**
      * id-only locator (ADR-038 §7). Resolution order:
@@ -958,30 +1158,66 @@ declare class FileSessionStorage implements KodaXSessionStorage {
      * returns null with a warning rather than guessing.
      */
     private resolveSessionLocation;
+    private resolveAmbiguousSessionLocation;
     private readSession;
     private readArchivedEntries;
+    private completeConversationLineage;
     private appendIslandArchive;
     /** Write `<dir>/project.json` once per process per directory (best-effort). */
     private ensureProjectJson;
+    private rebuildConversationCache;
+    private updateConversationCacheAfterAppend;
     private writeSessionInternal;
     private mergeAndWriteInternal;
     appendSessionDelta(id: string, data: SessionData): Promise<void>;
-    private shouldRunMaintenance;
-    private runMaintenance;
+    /**
+     * Append an explicit new tail without accepting any historical prefix.
+     * A fulfilled non-null value means the append committed and its successor
+     * boundary is reusable. A fulfilled `null` also means the append committed,
+     * but the successor could not be witnessed: reload and do not retry the same
+     * tail. Pre-commit validation conflicts reject with `data_changed`.
+     */
+    appendPreparedSessionTail(id: string, delta: PreparedSessionTailDelta): Promise<PreparedSessionAppendBaseline | null>;
     save(id: string, data: SessionData): Promise<void>;
+    /**
+     * Fast creation path for IDs produced by KodaX's timestamp + random-bit
+     * generator. The per-ID cross-process lock and exact target check preserve
+     * atomic creation without an all-project negative lookup. Caller-supplied
+     * IDs must continue through the ordinary global conflict check.
+    */
+    createGenerated(id: string, data: SessionData): Promise<void>;
+    mutateLineage(id: string, mutation: (lineage: KodaXSessionLineage) => KodaXSessionLineage): Promise<boolean>;
     /** F270/F269 owner mutation: CAS-update only the Actor section of a session snapshot. */
     saveActorSnapshot(id: string, snapshot: AgentActorSnapshot, expectedRevision: number): Promise<void>;
+    /** Read Session data without recovery writes or append-watermark mutation. */
+    peek(id: string): Promise<SessionData | null>;
+    /** Strict read-only Session load. It never migrates or repairs persisted data. */
+    read(id: string, options?: SessionReadOptions): Promise<SessionData | null>;
+    readConversationPageCache(id: string, input: ConversationPageCacheInput, options?: SessionReadOptions): Promise<ConversationPageCachePage | null>;
+    readConversationPageBoundary(id: string, options?: SessionReadOptions): Promise<{
+        readonly boundaryRevision: string;
+        readonly admission: ConversationPageCacheAdmission;
+    } | null>;
+    prepareConversationPageCache(id: string, history: SessionConversationHistoryData, lineage: KodaXSessionLineage, runtimeInfo: KodaXSessionRuntimeInfo | undefined, boundaryRevision: string, sourceRevisionState: SessionSourceRevisionState, options?: SessionReadOptions): Promise<void>;
+    readConversationPageCacheChunk(id: string, input: ConversationPageCacheChunkInput, options?: SessionReadOptions): Promise<ConversationPageCacheChunk | null>;
+    /** Stable read-only main + sidecar snapshot with no lock or migration writes. */
+    readFullSnapshot(id: string, options?: SessionReadOptions): Promise<SessionReadSnapshot | null>;
+    private readFullSnapshotAtPath;
     load(id: string): Promise<SessionData | null>;
+    isArchived(id: string): Promise<boolean>;
     getLineage(id: string): Promise<KodaXSessionLineage | null>;
     loadFullLineage(id: string): Promise<KodaXSessionLineage | null>;
     setActiveEntry(id: string, selector: string, options?: {
         summarizeCurrentBranch?: boolean;
     }): Promise<SessionData | null>;
-    rewind(id: string, selector?: string): Promise<SessionData | null>;
+    rewind(id: string, selector?: string, options?: {
+        historyBoundary?: SessionHistoryBoundary;
+    }): Promise<SessionData | null>;
     setLabel(id: string, selector: string, label?: string): Promise<SessionData | null>;
     fork(id: string, selector?: string, options?: {
         sessionId?: string;
         title?: string;
+        historyBoundary?: SessionHistoryBoundary;
     }): Promise<{
         sessionId: string;
         data: SessionData;
@@ -1016,26 +1252,46 @@ declare class FileSessionStorage implements KodaXSessionStorage {
      * (never orphans the sidecar). No-op + returns false for a missing session.
      */
     archive(id: string): Promise<boolean>;
+    archiveOwned(id: string, ownerId: string): Promise<boolean>;
+    private sessionConversationCacheMainPaths;
+    private removeSessionConversationCaches;
+    private archiveWithActorOwner;
     /** Restore an archived session back into its project directory. */
     unarchive(id: string): Promise<boolean>;
+    unarchiveOwned(id: string, ownerId: string): Promise<boolean>;
+    private unarchiveWithActorOwner;
     /**
-     * Move a session + its island sidecar between two directories. Propagates a
+     * Move a session + modern and legacy island sidecars between two directories. Propagates a
      * non-ENOENT rename error (e.g. Windows file-in-use) so a partial move is
      * surfaced as a failure instead of silently splitting main + sidecar.
      */
     private movePair;
+    /**
+     * Remove a complete Session file set without exposing a partial failure.
+     * Every canonical path is first renamed to an ignored tombstone. A staging
+     * failure rolls all prior renames back; only after the full set is hidden do
+     * we unlink tombstones. A locked tombstone is recoverable and no longer
+     * represents a live Session, so cleanup failure is diagnostic rather than a
+     * failed logical deletion.
+     */
+    private removeFileSetAtomically;
+    private assertActorFileOwner;
     delete(id: string): Promise<void>;
+    /** Strict deletion path for the Runtime that already owns the Actor tree. */
+    deleteOwned(id: string, ownerId: string): Promise<void>;
+    private deleteWithActorOwner;
     deleteAll(gitRoot?: string): Promise<void>;
     /**
-     * Auto-retention: delete session files (`.jsonl` + `.archive.jsonl`) whose
+     * Auto-retention: delete a complete Session file set when its main file
      * mtime is older than `retentionDays`. Modeled on claudecode's
      * `cleanup.ts` (`unlinkIfOld`). Bounds the sessions directory so it never
      * accumulates unboundedly — which is what keeps `list()`'s head-read pass
      * fast (its cost scales with file COUNT, not size). A non-positive /
-     * non-finite `retentionDays` disables cleanup (no-op). Best-effort: per-file
-     * errors are swallowed so a single locked/racing file never aborts the
-     * sweep. Returns the number of files removed. mtime-based, so the session
-     * currently being written/resumed (fresh mtime) is never eligible.
+     * non-finite `retentionDays` disables cleanup (no-op). The sweep continues
+     * after individual failures, then reports them together so cleanup is
+     * observable and retryable. Durable Actor owners and non-terminal turns are
+     * never eligible.
+     * Returns the number of files removed.
      */
     cleanupOldSessions(retentionDays: number): Promise<number>;
 }
@@ -1154,10 +1410,54 @@ interface SessionTranscriptEntry {
     readonly taskResults?: readonly KodaXTaskResultMetadata[];
 }
 interface FullTranscriptSessionData extends Omit<SessionData, 'messages'> {
+    /** Legacy flattened projection. Rewind markers are excluded. */
     readonly messages: KodaXMessage[];
+    /** Messages on the active branch that are eligible for model context. */
     readonly activeMessages: KodaXMessage[];
+    /**
+     * Authoritative raw append-order audit entries, including archived islands
+     * and inactive branches. The host owns visibility, folding, and presentation.
+     */
     readonly transcriptEntries: SessionTranscriptEntry[];
 }
+/** One immutable storage boundary shared by Runtime admission and history. */
+interface SessionReadCapture {
+    readonly data: SessionData;
+    readonly transcript: FullTranscriptSessionData;
+    readonly sourceRevision: string;
+    /** Internal exact-revision witness used to extend prepared page caches. */
+    readonly sourceRevisionState: SessionSourceRevisionState;
+    /** Bounded persisted-file witness corresponding to sourceRevision. */
+    readonly boundaryRevision: string;
+}
+type SessionBundleExportStatus = 'ok' | 'partial' | 'unsupported' | 'corrupt' | 'ambiguous' | 'missing';
+interface SessionBundleExportFile {
+    readonly kind: 'main' | 'islands' | 'legacy_archive';
+    readonly path: string;
+    readonly byteLength: number;
+    readonly sha256: string;
+    readonly modifiedAt: string;
+    /** Best-effort UTF-8 projection for inspection and JSONL diagnostics. */
+    readonly content: string;
+    /** Canonical byte-preserving representation. */
+    readonly contentBase64: string;
+}
+interface SessionBundleExportDiagnostic {
+    readonly code: 'partial_tail' | 'malformed_record' | 'unsupported_record' | 'unsupported_version';
+    readonly file: string;
+    readonly line?: number;
+    readonly message: string;
+}
+interface SessionBundleExportResult {
+    readonly sessionId: string;
+    readonly status: SessionBundleExportStatus;
+    readonly files: readonly SessionBundleExportFile[];
+    readonly candidates?: readonly string[];
+    readonly diagnostics: readonly SessionBundleExportDiagnostic[];
+}
+interface SessionBundleExportOptions extends SessionReadOptions {
+    readonly sessionsDir?: string;
+}
 interface AppendClientNoticeOptions {
     readonly source?: string;
     readonly content: string;
@@ -1206,6 +1506,9 @@ interface SessionManager {
     listSessions: typeof listSessions;
     loadSession: typeof loadSession;
     loadFullTranscript: typeof loadFullTranscript;
+    readFullTranscript: typeof readFullTranscript;
+    readConversationHistory: typeof readConversationHistory;
+    readSessionCapture(id: string, options?: SessionReadOptions): Promise<SessionReadCapture | null>;
     appendClientNotice: typeof appendClientNotice;
     forkSession: typeof forkSession;
     rewindSession: typeof rewindSession;
@@ -1242,11 +1545,32 @@ declare function loadSession(id: string): Promise<SessionData | null>;
 /**
  * Load append-order transcript data by ID.
  *
- * `loadSession` remains the active model-context API. This helper is for UI
- * scrollback: it returns every persisted transcript-bearing lineage entry in
- * append order and keeps the active branch in `activeMessages`.
+ * `loadSession` remains the active model-context API. This helper returns raw
+ * host-facing scrollback/audit data, including archived islands and inactive
+ * branches, in append order. Hosts decide what to show or fold.
  */
 declare function loadFullTranscript(id: string): Promise<FullTranscriptSessionData | null>;
+/**
+ * Strict, boundary-consistent history read.
+ *
+ * Unlike the legacy null-on-error helper, this never migrates or repairs the
+ * Session and preserves structured read errors for the host.
+ */
+declare function readFullTranscript(id: string, options?: SessionReadOptions): Promise<FullTranscriptSessionData | null>;
+/**
+ * Read the SDK-resolved ordinary conversation view at one immutable boundary.
+ * Raw append-order audit data remains available through `readFullTranscript`.
+ */
+declare function readConversationHistory(id: string, options?: SessionReadOptions): Promise<SessionConversationHistoryData | null>;
+/** Build the conversation projection from an already captured read boundary. */
+declare function conversationHistoryFromCapture(capture: SessionReadCapture, checkpoint?: () => void): SessionConversationHistoryData;
+declare function readSessionCapture(id: string, options?: SessionReadOptions): Promise<SessionReadCapture | null>;
+/**
+ * Export the exact persisted Session bundle without migration, recovery, or
+ * schema rewriting. Unknown and malformed records remain byte-for-byte intact
+ * and are described by diagnostics instead of being discarded.
+ */
+declare function exportSessionBundle(id: string, options?: SessionBundleExportOptions): Promise<SessionBundleExportResult>;
 /**
  * Append a host-owned transcript notice that never enters model context.
  *
@@ -1255,15 +1579,25 @@ declare function loadFullTranscript(id: string): Promise<FullTranscriptSessionDa
  * `loadSession()` keeps returning only the active model messages.
  */
 declare function appendClientNotice(id: string, options: AppendClientNoticeOptions): Promise<SessionTranscriptEntry | null>;
+interface SessionConversationMutationBoundary {
+    readonly boundaryId: string;
+    readonly sourceRevision: string;
+}
+interface ForkSessionOptions {
+    readonly selector?: string;
+    readonly sessionId?: string;
+    readonly title?: string;
+    readonly historyBoundary?: SessionConversationMutationBoundary;
+}
+interface RewindSessionOptions {
+    readonly selector?: string;
+    readonly historyBoundary?: SessionConversationMutationBoundary;
+}
 /**
  * Fork a session at an optional selector.
  * Returns null for a missing session. NEVER throws.
  */
-declare function forkSession(id: string, opts?: {
-    selector?: string;
-    sessionId?: string;
-    title?: string;
-}): Promise<{
+declare function forkSession(id: string, opts?: ForkSessionOptions): Promise<{
     sessionId: string;
     data: SessionData;
 } | null>;
@@ -1271,9 +1605,7 @@ declare function forkSession(id: string, opts?: {
  * Rewind a session to a previous user entry.
  * Returns null for a missing session. NEVER throws.
  */
-declare function rewindSession(id: string, opts?: {
-    selector?: string;
-}): Promise<SessionData | null>;
+declare function rewindSession(id: string, opts?: RewindSessionOptions): Promise<SessionData | null>;
 /**
  * Set the active lineage entry by selector.
  * Returns null for a missing session. NEVER throws.
@@ -1308,6 +1640,10 @@ type DeleteSessionResult = {
             startedAt: number;
         };
     };
+} | {
+    error: {
+        code: 'delete_failed';
+    };
 };
 /**
  * Delete a session by ID.
@@ -1347,10 +1683,12 @@ declare function watchSessions(cb: WatchSessionsCallback): {
  * that directory instead of the module-load-frozen `KODAX_SESSIONS_DIR`.
  * `listRunningSessions` still consults the agent-config-home instances
  * directory (sibling-process awareness is not scoped per sessions dir).
+ * `configHome` binds rewind/setActive review fencing to the same Runtime owner.
  */
 declare function createSessionManager(opts?: {
     sessionsDir?: string;
+    configHome?: string;
 }): SessionManager;
 
-export { KeypressHandlerPriority as B, DEFAULT_UI_STATE as D, FILE_MODIFICATION_TOOLS as F, MemorySessionStorage as M, PERMISSION_MODES as P, StreamingState as a0, TOOL_STATUS_ICONS as a2, TextBuffer as a3, ToolCallStatus as a9, appendClientNotice as ag, archiveSession as ah, compactSession as ai, computeConfirmTools as aj, createMemorySessionStorage as ak, createSessionManager as al, deleteSession as am, forkSession as an, isPermissionMode as ao, listRunningSessions as ap, listSessions as aq, loadFullTranscript as ar, loadSession as as, normalizePermissionMode as at, permissionModeDisplayName as au, rewindSession as av, setActiveEntry as aw, unarchiveSession as ax, watchSessions as ay, FileSessionStorage as j };
-export type { StatusBarProps as $, AppProps as A, CompactSessionOptions as C, LearningSurfaceSnapshot as E, LegacyMessageListProps as G, HistoryEntry as H, InputPromptProps as I, ListSessionsOptions as J, KeyInfo as K, LearningBinding as L, Message as N, PastedContent as O, PermissionContext as Q, PermissionMode as R, PromptEditingMode as S, PromptSubmitPayload as T, RunningSessionInfo as U, SessionData as V, SessionManager as W, SessionStorage as X, SessionSummary as Y, SessionTranscriptEntry as Z, SessionTranscriptEntryType as _, AppState as a, Suggestion as a1, TextBufferOptions as a4, Theme as a5, ThemeColors as a6, ThemeSymbols as a7, ToolCall as a8, UIActions as aa, UIState as ab, UseTextBufferReturn as ac, VisualCursor as ad, VisualLayout as ae, WatchSessionsCallback as af, AppendClientNoticeOptions as b, CompactSessionResult as c, Completer as d, Completion as e, ConfirmResult as f, CreatableHistoryItem as g, CursorPosition as h, DeleteSessionResult as i, FullTranscriptSessionData as k, HistoryItem as l, HistoryItemAssistant as m, HistoryItemBase as n, HistoryItemError as o, HistoryItemEvent as p, HistoryItemHint as q, HistoryItemInfo as r, HistoryItemSidecar as s, HistoryItemSystem as t, HistoryItemThinking as u, HistoryItemToolGroup as v, HistoryItemType as w, HistoryItemUser as x, KeypressEvent as y, KeypressHandler as z };
+export { DEFAULT_UI_STATE as D, FILE_MODIFICATION_TOOLS as F, KeypressHandlerPriority as G, MemorySessionStorage as O, PERMISSION_MODES as Q, watchSessions as a$, appendClientNotice as aA, archiveSession as aB, compactSession as aC, computeConfirmTools as aD, conversationHistoryFromCapture as aE, createConversationEntryChain as aF, createMemorySessionStorage as aG, createSessionConversationHistoryRevision as aH, createSessionManager as aI, deleteSession as aJ, emptyConversationEntryChain as aK, exportSessionBundle as aL, extendConversationEntryChain as aM, forkSession as aN, isPermissionMode as aO, listRunningSessions as aP, listSessions as aQ, loadFullTranscript as aR, loadSession as aS, normalizePermissionMode as aT, permissionModeDisplayName as aU, readConversationHistory as aV, readFullTranscript as aW, readSessionCapture as aX, rewindSession as aY, setActiveEntry as aZ, unarchiveSession as a_, SessionReadError as ac, StreamingState as ak, TOOL_STATUS_ICONS as am, TextBuffer as an, ToolCallStatus as at, ConversationPageCacheCapacityError as g, FileSessionStorage as k };
+export type { SessionBundleExportFile as $, AppProps as A, KeypressEvent as B, CompactSessionOptions as C, KeypressHandler as E, HistoryEntry as H, InputPromptProps as I, LearningSurfaceSnapshot as J, KeyInfo as K, LearningBinding as L, LegacyMessageListProps as M, ListSessionsOptions as N, Message as P, PastedContent as R, PermissionContext as S, PermissionMode as T, PreparedSessionAppendBaseline as U, PreparedSessionTailDelta as V, PromptEditingMode as W, PromptSubmitPayload as X, RewindSessionOptions as Y, RunningSessionInfo as Z, SessionBundleExportDiagnostic as _, AppState as a, SessionBundleExportOptions as a0, SessionBundleExportResult as a1, SessionBundleExportStatus as a2, SessionConversationHistoryData as a3, SessionConversationHistoryEntry as a4, SessionConversationHistoryIssue as a5, SessionConversationHistoryIssueCode as a6, SessionConversationHistoryStatus as a7, SessionConversationMutationBoundary as a8, SessionData as a9, SessionManager as aa, SessionReadCapture as ab, SessionReadErrorCode as ad, SessionReadOptions as ae, SessionStorage as af, SessionSummary as ag, SessionTranscriptEntry as ah, SessionTranscriptEntryType as ai, StatusBarProps as aj, Suggestion as al, TextBufferOptions as ao, Theme as ap, ThemeColors as aq, ThemeSymbols as ar, ToolCall as as, UIActions as au, UIState as av, UseTextBufferReturn as aw, VisualCursor as ax, VisualLayout as ay, WatchSessionsCallback as az, AppendClientNoticeOptions as b, CompactSessionResult as c, Completer as d, Completion as e, ConfirmResult as f, CreatableHistoryItem as h, CursorPosition as i, DeleteSessionResult as j, ForkSessionOptions as l, FullTranscriptSessionData as m, HistoryItem as n, HistoryItemAssistant as o, HistoryItemBase as p, HistoryItemError as q, HistoryItemEvent as r, HistoryItemHint as s, HistoryItemInfo as t, HistoryItemSidecar as u, HistoryItemSystem as v, HistoryItemThinking as w, HistoryItemToolGroup as x, HistoryItemType as y, HistoryItemUser as z };