@loompad/cli 0.1.0 → 1.1.2

package/dist/hub/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/hub/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAkB;IACvC,IAAI;IACJ,YAAY;IACZ,OAAO;IACP,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,WAAW;IACX,OAAO;IACP,WAAW;IACX,eAAe;IACf,UAAU;IACV,YAAY;IACZ,MAAM;IACN,YAAY;IACZ,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,eAAe;IACf,QAAQ;IACR,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,WAAW;IACX,UAAU;IACV,cAAc;IACd,WAAW;IACX,WAAW;IACX,MAAM;IACN,eAAe;CAChB,CAAC,CAAC;AAUH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB,EAAE;IAK9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,+EAA+E;IAC/E,+EAA+E;IAC/E,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChG,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC3C,qEAAqE;YACrE,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;YAC/C,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpG,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4EAA4E,EAAE,CAAC,CAAC;YAC5H,CAAC;YACD,IAAI,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAExC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwD,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAoB,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,MAAM,GAAG,EAAE,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACjF,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAE,GAAG,CAAC,IAA6B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnH,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAqD,CAAC;gBAC9E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACpE,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAa,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;aAC9D,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/E,IAAI,WAAW,GAAwB,IAAI,CAAC;QAC5C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;oBAC1D,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,IAAI;wBAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,CAAC,CAAC,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,KAAK,CAAC,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAG,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC9E,OAAO;QACL,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,IAAI,WAAW,IAAI,IAAI,EAAE;QACjD,GAAG;QACH,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO;gBAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hub/supabase-client.d.ts

@@ -0,0 +1,220 @@
+/**
+ * SupabaseHubClient — a daemon's connection to the hosted Loom Team Hub.
+ *
+ * Same `HubClient` contract as MemoryHub (the reference) and HttpHubClient
+ * (a self-hosted `loom hub`), against the Supabase schema in
+ * supabase/migrations/0002–0007: reads are RLS-guarded selects, writes are the
+ * SECURITY DEFINER rule functions called through `rpc`, and live events are
+ * Realtime `postgres_changes` (RLS decides who hears what).
+ *
+ * Sessions: the client holds a Supabase session (access + refresh token) and
+ * supabase-js refreshes it on its own. Refresh tokens rotate — the one that
+ * was just used is dead — so whoever persists the session (Team Link, in
+ * team.json) must listen with `onSession` and store every new one.
+ *
+ * Sign-in (D65) is GitHub OAuth through Supabase, PKCE with a loopback
+ * redirect: `hostedSignIn`.
+ */
+import { HubError, type ClaimResult, type FeedEvent, type FeedIn, type HubClient, type HubDevice, type HubEvent, type HubUser, type Job, type JobIn, type Lease, type LeaseClaim, type MemberView, type Presence, type PresenceIn, type Runner, type Team, type TeamMemory, type TeamMemoryIn, type TeamRole } from "../core/team-hub.js";
+import type { Sealed } from "../core/team-crypto.js";
+import type { LeaseScope } from "../core/team-leases.js";
+/** What a caller needs to keep to come back later — the refresh token is the one that matters. */
+export interface HostedSession {
+    accessToken: string;
+    refreshToken: string;
+    /** Access-token expiry, epoch ms. */
+    expiresAt: number;
+    userId: string;
+}
+interface PgError {
+    message?: string;
+    code?: string;
+    details?: string | null;
+    hint?: string | null;
+}
+/** A Postgres / PostgREST error as the HubError MemoryHub would have thrown. */
+export declare function hubErrorFrom(err: PgError | null | undefined, httpStatus?: number): HubError;
+type Row = Record<string, unknown>;
+/** Postgres timestamps (PostgREST's ISO, or the text form Realtime sends) → epoch ms. */
+export declare function ms(v: unknown): number;
+export declare function mapTeam(r: Row): Team;
+export declare function mapDevice(r: Row): HubDevice;
+export declare function mapPresence(r: Row, github: string): Presence;
+export declare function mapLease(r: Row, github: string, now?: number): Lease;
+export declare function mapMemory(r: Row): TeamMemory;
+export declare function mapFeed(r: Row, github: string | null): FeedEvent;
+/** A `jobs` row (PostgREST or Realtime) → the Job MemoryHub returns. */
+export declare function mapJob(r: Row): Job;
+/** team_runners / register_runner JSON (already camelCase) → Runner. */
+export declare function mapRunner(r: Row): Runner;
+export interface SupabaseHubOptions {
+    supabaseUrl: string;
+    publishableKey: string;
+    /** A session fresh from `hostedSignIn`… */
+    session?: HostedSession;
+    /** …or a refresh token kept from an earlier one (team.json). */
+    refreshToken?: string;
+    /** Called with every new session (sign-in, each refresh). Persist its refreshToken. */
+    onSession?: (s: HostedSession) => void;
+}
+type SessionListener = (s: HostedSession) => void;
+export declare class SupabaseHubClient implements HubClient {
+    private opts;
+    private sbP;
+    private current;
+    private listeners;
+    private githubs;
+    private closed;
+    constructor(opts: SupabaseHubOptions);
+    /** Hear every new session (refreshes rotate the refresh token). Returns an unsubscribe. */
+    onSession(cb: SessionListener): () => void;
+    /** The session in effect right now (null until the first call has restored it). */
+    session(): HostedSession | null;
+    get supabaseUrl(): string;
+    /** Stop refreshing and drop every live subscription. */
+    close(): Promise<void>;
+    private emitSession;
+    /** The supabase-js client, with the session restored (once). */
+    private sb;
+    private uid;
+    private rpc;
+    private select;
+    /** GitHub logins for user ids, cached (profiles are readable for self and teammates). */
+    private logins;
+    private login;
+    private leasesOf;
+    private claimResult;
+    me(): Promise<HubUser>;
+    createTeam(name: string): Promise<Team>;
+    teams(): Promise<Array<Team & {
+        role: TeamRole;
+    }>>;
+    registerDevice(input: {
+        label: string;
+        sealPub: string;
+        signPub: string;
+    }): Promise<HubDevice>;
+    createInvite(teamId: string, ttlMs?: number): Promise<{
+        invite: string;
+        expiresAt: number;
+    }>;
+    redeemInvite(invite: string): Promise<{
+        team: Team;
+        role: TeamRole;
+    }>;
+    members(teamId: string): Promise<MemberView[]>;
+    removeMember(teamId: string, userId: string): Promise<void>;
+    putKeyEnvelopes(teamId: string, version: number, envelopes: Array<{
+        deviceId: string;
+        box: string;
+    }>): Promise<void>;
+    keyEnvelopes(teamId: string, deviceId: string): Promise<Array<{
+        version: number;
+        box: string;
+    }>>;
+    shareRepo(teamId: string, repo: string): Promise<void>;
+    repos(teamId: string): Promise<string[]>;
+    heartbeat(teamId: string, p: PresenceIn): Promise<void>;
+    clearPresence(teamId: string, key: {
+        deviceId: string;
+        agent: string;
+        repo: string;
+    }): Promise<void>;
+    presence(teamId: string): Promise<Presence[]>;
+    appendFeed(teamId: string, e: FeedIn): Promise<FeedEvent | null>;
+    feed(teamId: string, opts?: {
+        since?: number;
+        limit?: number;
+    }): Promise<FeedEvent[]>;
+    claimLease(teamId: string, c: LeaseClaim): Promise<ClaimResult>;
+    extendLease(teamId: string, leaseId: string, scope: LeaseScope, hardZones: string[]): Promise<ClaimResult>;
+    renewLeases(teamId: string, deviceId: string): Promise<number>;
+    setRunLeaseState(teamId: string, runId: string, state: "active" | "landing"): Promise<number>;
+    releaseLeases(teamId: string, runId: string, reason: string): Promise<number>;
+    leases(teamId: string, repo?: string): Promise<Lease[]>;
+    publishMemory(teamId: string, m: TeamMemoryIn): Promise<{
+        memory: TeamMemory;
+        merged: boolean;
+    }>;
+    updateTeamMemory(teamId: string, id: string, patch: {
+        hmac: string;
+        sealed: Sealed;
+    }): Promise<TeamMemory>;
+    forgetTeamMemory(teamId: string, id: string, reason: string): Promise<void>;
+    resolveMemories(teamId: string, winnerId: string, loserId: string, reason: string): Promise<TeamMemory>;
+    teamMemories(teamId: string, repo: string, opts?: {
+        history?: boolean;
+    }): Promise<TeamMemory[]>;
+    registerRunner(input: {
+        deviceId: string;
+        kinds: string[];
+        shared: boolean;
+        capacity?: number;
+    }): Promise<Runner>;
+    runners(teamId: string): Promise<Runner[]>;
+    revokeDevice(deviceId: string): Promise<void>;
+    createJob(teamId: string, j: JobIn): Promise<Job>;
+    claimJob(teamId: string, runnerDeviceId: string, instantOnly?: boolean): Promise<Job | null>;
+    heartbeatJob(teamId: string, jobId: string, runnerDeviceId: string, progress?: Sealed): Promise<Job>;
+    finishJob(teamId: string, jobId: string, runnerDeviceId: string, outcome: {
+        state: "done" | "failed";
+        result?: Sealed;
+        error?: string;
+    }): Promise<Job>;
+    cancelJob(teamId: string, jobId: string): Promise<Job>;
+    jobs(teamId: string, opts?: {
+        active?: boolean;
+    }): Promise<Job[]>;
+    /** Owners only (0009_phase6.sql); the Edge Function verifies deliveries with it (D83). */
+    webhookSecret(teamId: string, rotate?: boolean): Promise<{
+        secret: string;
+    }>;
+    /**
+     * Realtime `postgres_changes` on feed, presence, leases, team_memories and jobs,
+     * as the HubEvents MemoryHub emits. Inserts and updates are filtered to the
+     * team and RLS-checked per member. Deletes can't be filtered and carry only
+     * the primary key, so: presence's key includes the team, and lease ids are
+     * matched against the leases this subscription has seen.
+     */
+    subscribe(teamId: string, cb: (e: HubEvent) => void): Promise<() => void>;
+}
+export declare const SIGN_IN_TIMEOUT_MS: number;
+/**
+ * The loopback half of an OAuth sign-in: listen on 127.0.0.1 (random port),
+ * hand the redirect URL to `start` (build the authorize URL, open a browser),
+ * wait for `/callback?code=…`, trade the code with `exchange`, and tell the
+ * browser tab it can close. Rejects on an OAuth error, or after `timeoutMs`.
+ */
+export declare function loopbackSignIn<T>(opts: {
+    start: (redirectTo: string) => Promise<void> | void;
+    exchange: (code: string) => Promise<T>;
+    timeoutMs?: number;
+}): Promise<T>;
+/** Open a URL in the user's browser. */
+export declare function openInBrowser(url: string): void;
+/**
+ * Sign in to the hosted hub with GitHub: PKCE through Supabase Auth, the
+ * redirect landing on a loopback listener. Returns the new session.
+ */
+export declare function hostedSignIn(opts: {
+    supabaseUrl: string;
+    publishableKey: string;
+    openBrowser?: (url: string) => void | Promise<void>;
+    timeoutMs?: number;
+}): Promise<HostedSession>;
+/** The authorization code in whatever the user pasted: a full URL, a query string, or the bare code. */
+export declare function codeFromPasted(pasted: string): string | null;
+/**
+ * Hosted sign-in on a machine with no browser — a runner box over SSH (Loom
+ * Teams D74). Same PKCE flow as hostedSignIn, but the redirect goes to a
+ * loopback address nothing listens on: the user opens the URL anywhere, signs
+ * in with GitHub, lands on an error page, and pastes that page's address back.
+ * The code is useless without this process's verifier, so pasting it is safe.
+ */
+export declare function pasteSignIn(opts: {
+    supabaseUrl: string;
+    publishableKey: string;
+    /** Show the URL, return what the user pasted. */
+    ask(url: string): Promise<string>;
+}): Promise<HostedSession>;
+export {};