@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/reads/types.d.ts

@@ -1,4 +1,4 @@
-import type { ModelCallExportPage, ModelCallsPage, SandboxPage, SessionManifestView, SessionPage, SessionListItem, SessionUsageTotals } from "@nylorun/core/contracts";
+import type { ArtifactKind, ArtifactPage, ModelCallExportPage, ModelCallsPage, EnvironmentPage, ToolCallsPage, SessionManifestView, SessionPage, SessionListItem, SessionUsageTotals, LiveEvent } from "@nylorun/core/contracts";
 export type ReadAccess = {
     owner?: string;
     agents?: readonly string[];
@@ -6,20 +6,33 @@ export type ReadAccess = {
 export type SessionFilters = {
     agentId?: string;
     status?: SessionListItem["status"];
-    sandboxId?: string;
+    environmentId?: string;
     ownerUserId?: string;
 };
 export type PageOptions = {
     limit: number;
     cursor?: string;
 };
+export type ArtifactFilters = {
+    sessionId?: string;
+    kind?: ArtifactKind;
+    labels: Record<string, string>;
+};
 /** Public projections only. No execution-state methods or mutable transactions. */
 export interface ReadStore {
+    artifacts(filters: ArtifactFilters, page: PageOptions, access: ReadAccess): Promise<ArtifactPage>;
     sessions(filters: SessionFilters, page: PageOptions, access: ReadAccess): Promise<SessionPage>;
     manifest(id: string, access: ReadAccess): Promise<SessionManifestView>;
     usage(id: string, turnId: string | undefined, access: ReadAccess): Promise<SessionUsageTotals>;
     modelCalls(id: string, turnId: string | undefined, page: PageOptions, access: ReadAccess): Promise<ModelCallsPage>;
     exportModel(after: string | undefined, limit: number): Promise<ModelCallExportPage>;
-    sandboxes(labels: Record<string, string>, page: PageOptions, access: ReadAccess, grants?: readonly string[]): Promise<SandboxPage>;
+    /** A session's tool calls (R5.2), from the effect journal, in the order they were first sent. */
+    toolCalls(id: string, turnId: string | undefined, page: PageOptions, access: ReadAccess): Promise<ToolCallsPage>;
+    /**
+     * One turn's events (R7.5), in log order: the session's rows whose `turnId` is `turnId`. Empty
+     * for a turn the session never had.
+     */
+    turnEvents(id: string, turnId: string, access: ReadAccess): Promise<LiveEvent[]>;
+    environments(labels: Record<string, string>, page: PageOptions, access: ReadAccess, grants?: readonly string[]): Promise<EnvironmentPage>;
     close(): Promise<void>;
 }

package/dist/record/append.d.ts

@@ -10,7 +10,7 @@
  * transaction (`store/postgres/record-writer.ts`): the database driver stays behind
  * `store/postgres/` (session-store.md §3), and this module decides what is written.
  */
-import type { EventPayload, EventType, LiveEvent, SessionEventOf } from "@nylorun/core/contracts";
+import type { EventPayload, EventType, EventWriter, LiveEvent, SessionEventOf } from "@nylorun/core/contracts";
 /** The record's two statements, in the caller's transaction. */
 export interface RecordWriter {
     /**
@@ -40,6 +40,8 @@ export interface AppendInput<T extends EventType> {
     time: Date;
     type: T;
     payload: EventPayload<T>;
+    /** Who wrote it (R4.9). */
+    writer?: EventWriter;
 }
 /**
  * Appends one event through `writer`. An event the catalog does not describe throws

package/dist/record/append.js

@@ -14,6 +14,7 @@ export async function appendEvent(writer, input) {
         time: input.time,
         type: input.type,
         payload: input.payload,
+        ...(input.writer ? { writer: input.writer } : {}),
     });
     await writer.insert({ sessionId: input.sessionId, seq, generation, type: input.type, body: event });
     return { event, generation };

package/dist/record/envelope.d.ts

@@ -1,10 +1,14 @@
-import { type EventPayload, type EventType, type SessionEventOf } from "@nylorun/core/contracts";
+import { type EventPayload, type EventType, type EventWriter, type SessionEventOf } from "@nylorun/core/contracts";
+/** Core's own writes: what an event says when its writer says nothing (R4.9). */
+export declare const CORE: EventWriter;
 /** A write of an event the catalog does not describe: a bug in the writer. */
 export declare class InvalidEventError extends Error {
     readonly eventType: string;
     constructor(eventType: string, detail: string);
 }
 export interface EventInput<T extends EventType> {
+    /** Who wrote it (R4.9); absent, core, observed. */
+    writer?: EventWriter;
     tenantId: string;
     sessionId: string;
     turnId: string | null;

package/dist/record/envelope.js

@@ -7,6 +7,8 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { EVENT_CATALOG, EVENT_SCHEMA, EVENT_SCHEMAS, isEventType, } from "@nylorun/core/contracts";
 import { encodeCursor } from "./cursor.js";
+/** Core's own writes: what an event says when its writer says nothing (R4.9). */
+export const CORE = { source: { kind: "core", id: "runtime" } };
 /** A write of an event the catalog does not describe: a bug in the writer. */
 export class InvalidEventError extends Error {
     eventType;
@@ -22,12 +24,13 @@ export function buildEvent(input) {
     if (!isEventType(type))
         throw new InvalidEventError(type, "unknown type");
     const entry = EVENT_CATALOG[type];
+    const writer = input.writer ?? CORE;
     const event = JSON.parse(JSON.stringify({
         schema: EVENT_SCHEMA,
         eventId: randomUUID(),
         tenantId: input.tenantId,
         sessionId: input.sessionId,
-        runId: null,
+        runId: writer.runId ?? null,
         turnId: input.turnId,
         incarnation: 0,
         epoch: input.epoch,
@@ -35,8 +38,9 @@ export function buildEvent(input) {
         cursor: encodeCursor(input.sessionId, input.seq),
         time: input.time.toISOString(),
         schemaVersion: entry.version,
-        source: { kind: entry.source, id: "runtime" },
-        evidence: "observed",
+        source: writer.source,
+        evidence: writer.evidence ?? "observed",
+        ...(writer.principal ? { principal: writer.principal } : {}),
         visibility: entry.visibility ?? "public",
         retention: "full",
         type,

package/dist/record/environment.d.ts

@@ -0,0 +1,25 @@
+import { type EnvironmentEvent, type EnvironmentEventPayload, type EnvironmentEventType } from "@nylorun/core/contracts";
+/** The Environment stream's two statements, in the caller's transaction. */
+export interface EnvironmentRecordWriter {
+    /** The seq the Environment's next event takes: one past its last, or 0. */
+    nextSeq(environmentId: string): Promise<number>;
+    insert(row: {
+        environmentId: string;
+        seq: number;
+        type: string;
+        body: EnvironmentEvent;
+    }): Promise<void>;
+}
+export interface EnvironmentAppendInput<T extends EnvironmentEventType> {
+    tenantId: string;
+    environmentId: string;
+    time: Date;
+    type: T;
+    payload: EnvironmentEventPayload<T>;
+}
+/** Builds the event and checks it against the Environment event catalog. */
+export declare function buildEnvironmentEvent<T extends EnvironmentEventType>(input: EnvironmentAppendInput<T> & {
+    seq: number;
+}): EnvironmentEvent;
+/** Appends one event to the Environment's stream through `writer`. */
+export declare function appendEnvironmentEvent<T extends EnvironmentEventType>(writer: EnvironmentRecordWriter, input: EnvironmentAppendInput<T>): Promise<EnvironmentEvent>;

package/dist/record/environment.js

@@ -0,0 +1,44 @@
+/**
+ * A environment's lifecycle stream (blueprint D39, F7.1): `environment.created`, `environment.attached`,
+ * `environment.detached` and `environment.deleted` (and the rest of `ENVIRONMENT_EVENT_TYPES`, egress-gate's
+ * `environment.egress` for every connection among them, D67), on the `nylorun.environment-event/1` envelope, numbered
+ * from 0 per environment id in `nylorun_streams.environment_events`. The record module is its only
+ * writer, as for session events; the store runs the two statements through
+ * `EnvironmentRecordWriter` in the caller's transaction, under the environment row's lock (or, for a
+ * environment being created, its new row).
+ *
+ * The stream lives in the record only: it is not published to the stream relay, so no S2
+ * stream follows it yet. Clients read it with `GET /v1/environmentes/{id}/events`.
+ */
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import { ENVIRONMENT_EVENT_PAYLOADS, ENVIRONMENT_EVENT_SCHEMA, EnvironmentEventSchema, } from "@nylorun/core/contracts";
+import { InvalidEventError } from "./envelope.js";
+/** Builds the event and checks it against the Environment event catalog. */
+export function buildEnvironmentEvent(input) {
+    const payload = ENVIRONMENT_EVENT_PAYLOADS[input.type];
+    const checkedPayload = payload.safeParse(input.payload);
+    if (!checkedPayload.success)
+        throw new InvalidEventError(input.type, z.prettifyError(checkedPayload.error));
+    const event = JSON.parse(JSON.stringify({
+        schema: ENVIRONMENT_EVENT_SCHEMA,
+        eventId: randomUUID(),
+        tenantId: input.tenantId,
+        environmentId: input.environmentId,
+        seq: input.seq,
+        time: input.time.toISOString(),
+        type: input.type,
+        payload: input.payload,
+    }));
+    const checked = EnvironmentEventSchema.safeParse(event);
+    if (!checked.success)
+        throw new InvalidEventError(input.type, z.prettifyError(checked.error));
+    return event;
+}
+/** Appends one event to the Environment's stream through `writer`. */
+export async function appendEnvironmentEvent(writer, input) {
+    const seq = await writer.nextSeq(input.environmentId);
+    const event = buildEnvironmentEvent({ ...input, seq });
+    await writer.insert({ environmentId: input.environmentId, seq, type: input.type, body: event });
+    return event;
+}

package/dist/record/index.d.ts

@@ -9,4 +9,4 @@
 export { buildEvent, InvalidEventError, type EventInput } from "./envelope.js";
 export { decodeCursor, encodeCursor } from "./cursor.js";
 export { appendEvent, type AppendInput, type RecordWriter } from "./append.js";
-export { appendSandboxEvent, buildSandboxEvent, type SandboxAppendInput, type SandboxRecordWriter, } from "./sandbox.js";
+export { appendEnvironmentEvent, buildEnvironmentEvent, type EnvironmentAppendInput, type EnvironmentRecordWriter, } from "./environment.js";

package/dist/record/index.js

@@ -9,4 +9,4 @@
 export { buildEvent, InvalidEventError } from "./envelope.js";
 export { decodeCursor, encodeCursor } from "./cursor.js";
 export { appendEvent } from "./append.js";
-export { appendSandboxEvent, buildSandboxEvent, } from "./sandbox.js";
+export { appendEnvironmentEvent, buildEnvironmentEvent, } from "./environment.js";

package/dist/sandbox/disk-fs.d.ts

@@ -0,0 +1,95 @@
+/** One entry of a disk listing, its path relative to the volume. */
+export interface DiskEntry {
+    readonly path: string;
+    readonly type: "file" | "dir" | "link";
+    readonly size: number;
+    readonly mode: number;
+    readonly mtimeMs: number;
+    readonly target?: string;
+}
+export interface DiskListing {
+    readonly entries: readonly DiskEntry[];
+    /** More than `maxEntries` entries: `entries` holds `maxEntries + 1` of them. */
+    readonly truncated: boolean;
+}
+/** One entry to write: a file's bytes (or a range to append), a directory or a link. */
+export interface DiskPut {
+    readonly path: string;
+    readonly type: "file" | "dir" | "link";
+    readonly mode?: number;
+    readonly mtimeMs?: number;
+    /** A file's bytes, or the next range of them with `append`. */
+    readonly bytes?: Uint8Array;
+    /** Appends `bytes` to what the file holds (a large file moves in ranges). */
+    readonly append?: boolean;
+    /** A link's target. */
+    readonly target?: string;
+}
+/** The disk's roots: `workspace`, and in a pod `harness`, as absolute directories. */
+export type DiskRoots = Readonly<Partial<Record<"workspace" | "harness", string>>>;
+/** The engine's own files under `harness/`, which a disk version never holds. */
+export declare const ENGINE_FILES: ReadonlySet<string>;
+/** The absolute path of `path` (relative to the volume), refused when it leaves its root. */
+export declare function diskPath(roots: DiskRoots, path: string): string;
+/** The disk's entries, in path order, at most `maxEntries + 1`. */
+export declare function listDisk(roots: DiskRoots, maxEntries: number): Promise<DiskListing>;
+/** `length` bytes of file `path` from `offset`, and whether that reached its end; undefined when gone. */
+export declare function readDisk(roots: DiskRoots, path: string, offset: number, length: number): Promise<{
+    bytes: Uint8Array;
+    eof: boolean;
+} | undefined>;
+/** Empties every root, keeping the engine's own files. */
+export declare function clearDisk(roots: DiskRoots): Promise<void>;
+/** Writes `puts` in order: directories, files (or their next range) and links. */
+export declare function putDisk(roots: DiskRoots, puts: readonly DiskPut[]): Promise<void>;
+/** One disk operation, as core asks it of the workspace that holds the disk. */
+export type DiskOp = {
+    readonly list: {
+        readonly maxEntries: number;
+    };
+} | {
+    readonly read: {
+        readonly path: string;
+        readonly offset: number;
+        readonly length: number;
+    };
+} | {
+    readonly clear: true;
+} | {
+    readonly put: readonly DiskPut[];
+};
+/** Its answer. */
+export type DiskAnswer = ({
+    readonly kind: "listed";
+} & DiskListing) | {
+    readonly kind: "read";
+    readonly bytes: Uint8Array;
+    readonly eof: boolean;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "done";
+};
+export declare function runDiskOp(roots: DiskRoots, op: DiskOp): Promise<DiskAnswer>;
+/** A disk operation as it crosses the Harness API: bytes as base64. */
+export type WireDiskOp = {
+    readonly list: {
+        readonly maxEntries: number;
+    };
+} | {
+    readonly read: {
+        readonly path: string;
+        readonly offset: number;
+        readonly length: number;
+    };
+} | {
+    readonly clear: true;
+} | {
+    readonly put: readonly (Omit<DiskPut, "bytes"> & {
+        readonly base64?: string;
+    })[];
+};
+export declare function toWireOp(op: DiskOp): WireDiskOp;
+export declare function fromWireOp(op: WireDiskOp): DiskOp;
+export declare function toWireAnswer(answer: DiskAnswer): Record<string, unknown>;
+export declare function fromWireAnswer(answer: Record<string, unknown>): DiskAnswer;

package/dist/sandbox/disk-fs.js

@@ -0,0 +1,206 @@
+/**
+ * An Environment's disk as files (R2d step 3): what a version holds and how it is put back. A
+ * disk is one or two roots, named by the first segment of every path: `workspace/…` (the
+ * sandbox's `/workspace`) and, in a pod, `harness/…` (the engine's `/harness`, where a vendor
+ * harness keeps its state). Both backends use this over their own directories: the pod's volume
+ * (`adapters/sandbox/local.ts`) and the virtual workspace's host directory
+ * (`adapters/sandbox/virtual.ts`).
+ *
+ * A listing has regular files (size, mode, modification time), symbolic links (their target as
+ * stored) and empty directories; sockets, FIFOs and devices are skipped, and hard links are listed
+ * as separate files. The engine's own files are never listed or cleared (`ENGINE_FILES`): a
+ * restored volume keeps its own identity (`volume-id`), trust bundle and setup marker.
+ *
+ * Writes go to a temporary name and are renamed into place; a link replaces what is at its path.
+ * Times are whole milliseconds, rounded: a time written back with `utimes` can read back a hair
+ * under the millisecond it was, which rounding keeps and flooring would not.
+ */
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, open, readdir, readlink, rename, rm, symlink, utimes, chmod, appendFile, writeFile } from "node:fs/promises";
+import { posix } from "node:path";
+/** The engine's own files under `harness/`, which a disk version never holds. */
+export const ENGINE_FILES = new Set([
+    "volume-id",
+    "egress-ca-bundle.pem",
+    "setup.json",
+    "sandboxes",
+]);
+/** The absolute path of `path` (relative to the volume), refused when it leaves its root. */
+export function diskPath(roots, path) {
+    const [root, ...rest] = path.split("/");
+    const base = roots[root];
+    if (!base)
+        throw new Error(`${path} is not under a root of this disk`);
+    if (rest.some((segment) => segment === "" || segment === "." || segment === ".."))
+        throw new Error(`${path} is not a plain relative path`);
+    if (root === "harness" && ENGINE_FILES.has(rest[0] ?? ""))
+        throw new Error(`${path} is the engine's own`);
+    return rest.length === 0 ? base : posix.join(base, ...rest);
+}
+const missing = (error) => error?.code === "ENOENT" || error?.code === "ENOTDIR";
+/** The disk's entries, in path order, at most `maxEntries + 1`. */
+export async function listDisk(roots, maxEntries) {
+    const entries = [];
+    const full = () => entries.length > maxEntries;
+    const walk = async (absolute, relative, top) => {
+        let names;
+        try {
+            names = (await readdir(absolute)).sort();
+        }
+        catch (error) {
+            if (missing(error))
+                return;
+            throw error;
+        }
+        if (names.length === 0 && !top) {
+            const info = await lstat(absolute);
+            entries.push({ path: relative, type: "dir", size: 0, mode: info.mode & 0o7777, mtimeMs: Math.round(info.mtimeMs) });
+            return;
+        }
+        for (const name of names) {
+            if (full())
+                return;
+            if (relative === "harness" && ENGINE_FILES.has(name))
+                continue;
+            const path = `${relative}/${name}`;
+            const child = posix.join(absolute, name);
+            let info;
+            try {
+                info = await lstat(child);
+            }
+            catch (error) {
+                if (missing(error))
+                    continue;
+                throw error;
+            }
+            const mode = info.mode & 0o7777;
+            const mtimeMs = Math.round(info.mtimeMs);
+            if (info.isSymbolicLink())
+                entries.push({ path, type: "link", size: 0, mode, mtimeMs, target: await readlink(child) });
+            else if (info.isDirectory())
+                await walk(child, path, false);
+            else if (info.isFile())
+                entries.push({ path, type: "file", size: info.size, mode, mtimeMs });
+        }
+    };
+    for (const [name, base] of Object.entries(roots))
+        if (base && !full())
+            await walk(base, name, true);
+    entries.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return { entries: entries.slice(0, maxEntries + 1), truncated: full() };
+}
+/** `length` bytes of file `path` from `offset`, and whether that reached its end; undefined when gone. */
+export async function readDisk(roots, path, offset, length) {
+    let handle;
+    try {
+        handle = await open(diskPath(roots, path), "r");
+    }
+    catch (error) {
+        if (missing(error))
+            return undefined;
+        throw error;
+    }
+    try {
+        const size = (await handle.stat()).size;
+        const want = Math.max(0, Math.min(length, size - offset));
+        const buffer = Buffer.alloc(want);
+        let read = 0;
+        while (read < want) {
+            const { bytesRead } = await handle.read(buffer, read, want - read, offset + read);
+            if (bytesRead === 0)
+                break;
+            read += bytesRead;
+        }
+        return { bytes: new Uint8Array(buffer.subarray(0, read)), eof: offset + read >= size };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Empties every root, keeping the engine's own files. */
+export async function clearDisk(roots) {
+    for (const [name, base] of Object.entries(roots)) {
+        if (!base)
+            continue;
+        await mkdir(base, { recursive: true });
+        for (const child of await readdir(base)) {
+            if (name === "harness" && ENGINE_FILES.has(child))
+                continue;
+            await rm(posix.join(base, child), { recursive: true, force: true });
+        }
+    }
+}
+/** Writes `puts` in order: directories, files (or their next range) and links. */
+export async function putDisk(roots, puts) {
+    for (const put of puts) {
+        const target = diskPath(roots, put.path);
+        if (put.type === "dir") {
+            await mkdir(target, { recursive: true });
+            if (put.mode !== undefined)
+                await chmod(target, put.mode);
+            continue;
+        }
+        await mkdir(posix.dirname(target), { recursive: true });
+        if (put.type === "link") {
+            await rm(target, { force: true, recursive: true });
+            await symlink(put.target ?? "", target);
+            continue;
+        }
+        const bytes = put.bytes ?? new Uint8Array();
+        if (put.append)
+            await appendFile(target, bytes);
+        else {
+            const next = `${target}.${randomUUID()}.part`;
+            await writeFile(next, bytes);
+            await rm(target, { force: true, recursive: true });
+            await rename(next, target);
+        }
+        if (put.mode !== undefined)
+            await chmod(target, put.mode);
+        if (put.mtimeMs !== undefined)
+            await utimes(target, new Date(put.mtimeMs), new Date(put.mtimeMs));
+    }
+}
+export async function runDiskOp(roots, op) {
+    if ("list" in op)
+        return { kind: "listed", ...(await listDisk(roots, op.list.maxEntries)) };
+    if ("read" in op) {
+        const read = await readDisk(roots, op.read.path, op.read.offset, op.read.length);
+        return read === undefined ? { kind: "missing" } : { kind: "read", ...read };
+    }
+    if ("clear" in op)
+        await clearDisk(roots);
+    else
+        await putDisk(roots, op.put);
+    return { kind: "done" };
+}
+export function toWireOp(op) {
+    if (!("put" in op))
+        return op;
+    return {
+        put: op.put.map(({ bytes, ...rest }) => ({
+            ...rest,
+            ...(bytes === undefined ? {} : { base64: Buffer.from(bytes).toString("base64") }),
+        })),
+    };
+}
+export function fromWireOp(op) {
+    if (!("put" in op))
+        return op;
+    return {
+        put: op.put.map(({ base64, ...rest }) => ({
+            ...rest,
+            ...(base64 === undefined ? {} : { bytes: new Uint8Array(Buffer.from(base64, "base64")) }),
+        })),
+    };
+}
+export function toWireAnswer(answer) {
+    return answer.kind === "read"
+        ? { kind: "read", base64: Buffer.from(answer.bytes).toString("base64"), eof: answer.eof }
+        : { ...answer };
+}
+export function fromWireAnswer(answer) {
+    if (answer.kind === "read")
+        return { kind: "read", bytes: new Uint8Array(Buffer.from(String(answer.base64), "base64")), eof: answer.eof === true };
+    return answer;
+}

package/dist/sandbox/join.d.ts

@@ -1,23 +1,13 @@
+import type { HostJoinAnswer as PublishedJoinAnswer, HostJoinRequest } from "@nylorun/core/harness-api";
 import type { TenantContext } from "../tenant/context.js";
+import { type SetupFile, type SetupPlan, type SetupReport } from "./setup.js";
 import { type HostClaims } from "../tenant/host-token.js";
-export interface HostJoinRequest {
-    readonly sandboxId: string;
-    readonly podUid: string;
-    readonly joinToken: string;
-    /** The id the engine keeps on the volume (`/harness/volume-id`). */
-    readonly volumeId?: string;
-}
-/** What `join` and `renew` answer. */
-export interface HostJoinAnswer {
-    readonly hostToken: string;
-    readonly egressToken: string;
-    readonly sandboxId: string;
-    readonly epoch: number;
-    /** ISO time the tokens expire. */
-    readonly expiresAt: string;
-    /** The egress CA certificate (PEM) the sandbox trusts (R2c). */
-    readonly caCertificate: string;
-}
+export type { HostJoinRequest } from "@nylorun/core/harness-api";
+/** What `join` and `renew` answer: the published answer, with our engine's setup plan typed. */
+export type HostJoinAnswer = Omit<PublishedJoinAnswer, "setup"> & {
+    /** What to run and copy on a new disk before taking turns (`sandbox/setup.ts`); join only. */
+    readonly setup?: SetupPlan;
+};
 /** A refused join, renewal or host connection. */
 export declare class HostAuthError extends Error {
     readonly status: 400 | 401 | 503;
@@ -34,6 +24,15 @@ export interface HostAuthority {
     renew(hostToken: string): Promise<HostJoinAnswer>;
     /** The claims of a current host's token, for a connection; refuses a stale one. */
     verify(hostToken: string): Promise<HostClaims>;
+    /** Whether to run the setup again, with the plan to run (`GET host/setup`). */
+    setup(hostToken: string): Promise<{
+        retry: boolean;
+        setup?: SetupPlan;
+    }>;
+    /** Records the setup's outcome (`POST host/setup`). */
+    reportSetup(hostToken: string, report: SetupReport): Promise<void>;
+    /** Input file `index` of the host's recipe, or one file of it (`GET host/files/{index}[/{path}]`). */
+    setupFile(hostToken: string, index: number, path: string | undefined): Promise<SetupFile | undefined>;
 }
 export declare function sha256Hex(value: string): string;
 export declare function hostAuthority(ctx: TenantContext): HostAuthority;