@opengeni/contracts 0.50.0 → 1.0.0

package/dist/mcp-oauth.d.ts

@@ -0,0 +1,71 @@
+import { z } from "zod";
+export declare const MCP_OAUTH_SCOPE: "mcp:access";
+export declare const MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS: number;
+export declare const MCP_OAUTH_REFRESH_TOKEN_TTL_SECONDS: number;
+export declare const MCP_OAUTH_AUTHORIZATION_CODE_TTL_SECONDS: number;
+export declare const MCP_OAUTH_CONSENT_TTL_SECONDS: number;
+export declare const McpOAuthClientRegistrationRequest: z.ZodObject<{
+    redirect_uris: z.ZodArray<z.ZodString>;
+    client_name: z.ZodOptional<z.ZodString>;
+    application_type: z.ZodOptional<z.ZodEnum<{
+        native: "native";
+        web: "web";
+    }>>;
+    token_endpoint_auth_method: z.ZodDefault<z.ZodLiteral<"none">>;
+    scope: z.ZodOptional<z.ZodLiteral<"mcp:access">>;
+    grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>>;
+    response_types: z.ZodDefault<z.ZodArray<z.ZodLiteral<"code">>>;
+}, z.core.$strip>;
+export type McpOAuthClientRegistrationRequest = z.infer<typeof McpOAuthClientRegistrationRequest>;
+export declare const McpOAuthClientRegistrationResponse: z.ZodObject<{
+    redirect_uris: z.ZodArray<z.ZodString>;
+    client_name: z.ZodOptional<z.ZodString>;
+    application_type: z.ZodOptional<z.ZodEnum<{
+        native: "native";
+        web: "web";
+    }>>;
+    token_endpoint_auth_method: z.ZodDefault<z.ZodLiteral<"none">>;
+    scope: z.ZodOptional<z.ZodLiteral<"mcp:access">>;
+    grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>>;
+    response_types: z.ZodDefault<z.ZodArray<z.ZodLiteral<"code">>>;
+    client_id: z.ZodString;
+    client_id_issued_at: z.ZodNumber;
+}, z.core.$strip>;
+export type McpOAuthClientRegistrationResponse = z.infer<typeof McpOAuthClientRegistrationResponse>;
+export declare const McpOAuthTokenResponse: z.ZodObject<{
+    access_token: z.ZodString;
+    token_type: z.ZodLiteral<"Bearer">;
+    expires_in: z.ZodNumber;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    scope: z.ZodLiteral<"mcp:access">;
+}, z.core.$strip>;
+export type McpOAuthTokenResponse = z.infer<typeof McpOAuthTokenResponse>;
+export declare const McpOAuthProtectedResourceMetadata: z.ZodObject<{
+    resource: z.ZodString;
+    authorization_servers: z.ZodArray<z.ZodString>;
+    scopes_supported: z.ZodArray<z.ZodLiteral<"mcp:access">>;
+    bearer_methods_supported: z.ZodArray<z.ZodLiteral<"header">>;
+}, z.core.$strip>;
+export type McpOAuthProtectedResourceMetadata = z.infer<typeof McpOAuthProtectedResourceMetadata>;
+export declare const McpOAuthAuthorizationServerMetadata: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+    registration_endpoint: z.ZodString;
+    response_types_supported: z.ZodArray<z.ZodLiteral<"code">>;
+    grant_types_supported: z.ZodArray<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        refresh_token: "refresh_token";
+    }>>;
+    code_challenge_methods_supported: z.ZodArray<z.ZodLiteral<"S256">>;
+    token_endpoint_auth_methods_supported: z.ZodArray<z.ZodLiteral<"none">>;
+    scopes_supported: z.ZodArray<z.ZodLiteral<"mcp:access">>;
+    authorization_response_iss_parameter_supported: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type McpOAuthAuthorizationServerMetadata = z.infer<typeof McpOAuthAuthorizationServerMetadata>;

package/dist/modal-native-proof-v2.d.ts

@@ -0,0 +1,587 @@
+import { z } from "zod";
+/** Secret-free descriptions for the NEW native proof protocol. Parsing any
+ * value below establishes correlation ONLY. It does not authenticate a host,
+ * native response, grant, election, capture, Start, or semantic continuation.
+ * Frozen reservation/journal v1 values are never adopted into this protocol. */
+export declare const MODAL_NATIVE_PROOF_PROTOCOL_VERSION: 2;
+export declare const MODAL_NATIVE_FRESH_COMPILER_FINGERPRINT: "db6d33c8a1142e5ffe3d1a130d8b9f9d819e46832ad0417d41d5606b7fe25ab1";
+/** This entire profile is declared BEFORE even namespace lookup. It is a
+ * reviewed literal, not caller-selected defaults or an arbitrary self-hash. */
+export declare const ModalNativeFreshNormalizationV1: z.ZodObject<{
+    recipeId: z.ZodLiteral<"modal-native-fresh-v1">;
+    recipeRevision: z.ZodLiteral<1>;
+    schema: z.ZodLiteral<"modal.client.ModalClient/SandboxCreate">;
+    encoding: z.ZodLiteral<"modal-create-json-v1">;
+    sdkVersion: z.ZodLiteral<"0.9.0">;
+    sdkSourceSha256: z.ZodLiteral<"bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599">;
+    entrypoint: z.ZodTuple<[z.ZodLiteral<"sleep">, z.ZodLiteral<"infinity">], null>;
+    createWorkdir: z.ZodLiteral<"/tmp">;
+    env: z.ZodObject<{}, z.core.$strict>;
+    mounts: z.ZodTuple<[], null>;
+    restore: z.ZodNull;
+    idleTimeout: z.ZodLiteral<"unset">;
+    gpu: z.ZodLiteral<"unset">;
+    gpuProto: z.ZodObject<{
+        type: z.ZodLiteral<0>;
+        count: z.ZodLiteral<0>;
+        gpuType: z.ZodLiteral<"">;
+    }, z.core.$strict>;
+    cpuLimit: z.ZodLiteral<"unset">;
+    memoryLimit: z.ZodLiteral<"unset">;
+    pty: z.ZodLiteral<"unset">;
+    regions: z.ZodLiteral<"unset">;
+    proxy: z.ZodLiteral<"unset">;
+    readinessProbe: z.ZodLiteral<"unset">;
+    environmentVariables: z.ZodLiteral<"unset">;
+    network: z.ZodObject<{
+        access: z.ZodLiteral<"OPEN">;
+        outboundCidrs: z.ZodTuple<[], null>;
+        outboundDomains: z.ZodTuple<[], null>;
+        inboundCidrs: z.ZodTuple<[], null>;
+        i6pn: z.ZodLiteral<false>;
+    }, z.core.$strict>;
+    volumes: z.ZodTuple<[], null>;
+    cloudBucketMounts: z.ZodTuple<[], null>;
+    secrets: z.ZodTuple<[], null>;
+    ports: z.ZodTuple<[], null>;
+    cloud: z.ZodLiteral<"">;
+    verbose: z.ZodLiteral<false>;
+    includeOidcIdentityToken: z.ZodLiteral<false>;
+    experimentalOptions: z.ZodObject<{}, z.core.$strict>;
+    experimentalOptionsV2: z.ZodObject<{}, z.core.$strict>;
+    customDomain: z.ZodLiteral<"">;
+}, z.core.$strict>;
+export type ModalNativeFreshNormalizationV1 = z.infer<typeof ModalNativeFreshNormalizationV1>;
+/** Public, credential-free recipe data. The host must normatively select this
+ * literal before I/O; possessing a copy supplies no issuance provenance. */
+export declare const MODAL_NATIVE_FRESH_NORMALIZATION_V1: {
+    recipeId: "modal-native-fresh-v1";
+    recipeRevision: 1;
+    schema: "modal.client.ModalClient/SandboxCreate";
+    encoding: "modal-create-json-v1";
+    sdkVersion: "0.9.0";
+    sdkSourceSha256: "bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599";
+    entrypoint: ["sleep", "infinity"];
+    createWorkdir: "/tmp";
+    env: Record<string, never>;
+    mounts: [];
+    restore: null;
+    idleTimeout: "unset";
+    gpu: "unset";
+    gpuProto: {
+        type: 0;
+        count: 0;
+        gpuType: "";
+    };
+    cpuLimit: "unset";
+    memoryLimit: "unset";
+    pty: "unset";
+    regions: "unset";
+    proxy: "unset";
+    readinessProbe: "unset";
+    environmentVariables: "unset";
+    network: {
+        access: "OPEN";
+        outboundCidrs: [];
+        outboundDomains: [];
+        inboundCidrs: [];
+        i6pn: false;
+    };
+    volumes: [];
+    cloudBucketMounts: [];
+    secrets: [];
+    ports: [];
+    cloud: "";
+    verbose: false;
+    includeOidcIdentityToken: false;
+    experimentalOptions: Record<string, never>;
+    experimentalOptionsV2: Record<string, never>;
+    customDomain: "";
+};
+export declare const ModalNativePreparationRecipeV2: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    recipeId: z.ZodLiteral<"modal-native-fresh-v1">;
+    recipeRevision: z.ZodLiteral<1>;
+    createWorkdir: z.ZodLiteral<"/tmp">;
+    entrypoint: z.ZodTuple<[z.ZodLiteral<"sleep">, z.ZodLiteral<"infinity">], null>;
+    normalization: z.ZodObject<{
+        recipeId: z.ZodLiteral<"modal-native-fresh-v1">;
+        recipeRevision: z.ZodLiteral<1>;
+        schema: z.ZodLiteral<"modal.client.ModalClient/SandboxCreate">;
+        encoding: z.ZodLiteral<"modal-create-json-v1">;
+        sdkVersion: z.ZodLiteral<"0.9.0">;
+        sdkSourceSha256: z.ZodLiteral<"bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599">;
+        entrypoint: z.ZodTuple<[z.ZodLiteral<"sleep">, z.ZodLiteral<"infinity">], null>;
+        createWorkdir: z.ZodLiteral<"/tmp">;
+        env: z.ZodObject<{}, z.core.$strict>;
+        mounts: z.ZodTuple<[], null>;
+        restore: z.ZodNull;
+        idleTimeout: z.ZodLiteral<"unset">;
+        gpu: z.ZodLiteral<"unset">;
+        gpuProto: z.ZodObject<{
+            type: z.ZodLiteral<0>;
+            count: z.ZodLiteral<0>;
+            gpuType: z.ZodLiteral<"">;
+        }, z.core.$strict>;
+        cpuLimit: z.ZodLiteral<"unset">;
+        memoryLimit: z.ZodLiteral<"unset">;
+        pty: z.ZodLiteral<"unset">;
+        regions: z.ZodLiteral<"unset">;
+        proxy: z.ZodLiteral<"unset">;
+        readinessProbe: z.ZodLiteral<"unset">;
+        environmentVariables: z.ZodLiteral<"unset">;
+        network: z.ZodObject<{
+            access: z.ZodLiteral<"OPEN">;
+            outboundCidrs: z.ZodTuple<[], null>;
+            outboundDomains: z.ZodTuple<[], null>;
+            inboundCidrs: z.ZodTuple<[], null>;
+            i6pn: z.ZodLiteral<false>;
+        }, z.core.$strict>;
+        volumes: z.ZodTuple<[], null>;
+        cloudBucketMounts: z.ZodTuple<[], null>;
+        secrets: z.ZodTuple<[], null>;
+        ports: z.ZodTuple<[], null>;
+        cloud: z.ZodLiteral<"">;
+        verbose: z.ZodLiteral<false>;
+        includeOidcIdentityToken: z.ZodLiteral<false>;
+        experimentalOptions: z.ZodObject<{}, z.core.$strict>;
+        experimentalOptionsV2: z.ZodObject<{}, z.core.$strict>;
+        customDomain: z.ZodLiteral<"">;
+    }, z.core.$strict>;
+    compilerFingerprint: z.ZodLiteral<"db6d33c8a1142e5ffe3d1a130d8b9f9d819e46832ad0417d41d5606b7fe25ab1">;
+}, z.core.$strict>;
+export type ModalNativePreparationRecipeV2 = z.infer<typeof ModalNativePreparationRecipeV2>;
+export declare const MODAL_NATIVE_PREPARATION_RECIPE_V2: {
+    version: 1;
+    recipeId: "modal-native-fresh-v1";
+    recipeRevision: 1;
+    createWorkdir: "/tmp";
+    entrypoint: ["sleep", "infinity"];
+    normalization: {
+        recipeId: "modal-native-fresh-v1";
+        recipeRevision: 1;
+        schema: "modal.client.ModalClient/SandboxCreate";
+        encoding: "modal-create-json-v1";
+        sdkVersion: "0.9.0";
+        sdkSourceSha256: "bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599";
+        entrypoint: ["sleep", "infinity"];
+        createWorkdir: "/tmp";
+        env: Record<string, never>;
+        mounts: [];
+        restore: null;
+        idleTimeout: "unset";
+        gpu: "unset";
+        gpuProto: {
+            type: 0;
+            count: 0;
+            gpuType: "";
+        };
+        cpuLimit: "unset";
+        memoryLimit: "unset";
+        pty: "unset";
+        regions: "unset";
+        proxy: "unset";
+        readinessProbe: "unset";
+        environmentVariables: "unset";
+        network: {
+            access: "OPEN";
+            outboundCidrs: [];
+            outboundDomains: [];
+            inboundCidrs: [];
+            i6pn: false;
+        };
+        volumes: [];
+        cloudBucketMounts: [];
+        secrets: [];
+        ports: [];
+        cloud: "";
+        verbose: false;
+        includeOidcIdentityToken: false;
+        experimentalOptions: Record<string, never>;
+        experimentalOptionsV2: Record<string, never>;
+        customDomain: "";
+    };
+    compilerFingerprint: "db6d33c8a1142e5ffe3d1a130d8b9f9d819e46832ad0417d41d5606b7fe25ab1";
+};
+/** Exactly the old reservation vocabulary, NOT an extension to its keys. */
+export declare const ModalNativeFreshBlueprintV1: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    adapterId: z.ZodLiteral<"modal-native-fresh-creator-reservation-v1">;
+    create: z.ZodObject<{
+        operationId: z.ZodString;
+        appId: z.ZodString;
+        imageId: z.ZodString;
+        cpu: z.ZodNumber;
+        memoryMiB: z.ZodNumber;
+        timeoutSeconds: z.ZodNumber;
+        env: z.ZodObject<{}, z.core.$strict>;
+        mounts: z.ZodTuple<[], null>;
+    }, z.core.$strict>;
+    restore: z.ZodNull;
+    readiness: z.ZodObject<{
+        operationId: z.ZodString;
+        execId: z.ZodPipe<z.ZodString, z.ZodString>;
+        commandArgs: z.ZodTuple<[z.ZodLiteral<"/bin/true">], null>;
+        workdir: z.ZodLiteral<"/tmp">;
+        env: z.ZodObject<{}, z.core.$strict>;
+    }, z.core.$strict>;
+    publishOperationId: z.ZodString;
+    cleanup: z.ZodObject<{
+        operationId: z.ZodString;
+        requires: z.ZodLiteral<"physical-terminal-proof">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ModalNativeFreshBlueprintV1 = z.infer<typeof ModalNativeFreshBlueprintV1>;
+/** Full pre-election identity. routeEpoch is NOT the physical lease epoch;
+ * creatorId is NOT an elected owner or a replacement accepted attempt. */
+export declare const ModalNativeOriginalScopeV2: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    declarationId: z.ZodString;
+    planId: z.ZodString;
+    creatorId: z.ZodString;
+    accountId: z.ZodString;
+    workspaceId: z.ZodString;
+    sessionId: z.ZodString;
+    turnId: z.ZodString;
+    attemptId: z.ZodString;
+    executionGeneration: z.ZodNumber;
+    triggerEventId: z.ZodString;
+    sandboxGroupId: z.ZodString;
+    routeKind: z.ZodLiteral<"home">;
+    routeTargetId: z.ZodNull;
+    routeEpoch: z.ZodNumber;
+}, z.core.$strict>;
+export type ModalNativeOriginalScopeV2 = z.infer<typeof ModalNativeOriginalScopeV2>;
+/** References must resolve through the complete protected scope/config join.
+ * They are neither credentials nor canonical/native authentication receipts. */
+export declare const ModalNativeConfigurationCaptureRefV2: z.ZodObject<{
+    id: z.ZodString;
+    revision: z.ZodNumber;
+}, z.core.$strict>;
+export type ModalNativeConfigurationCaptureRefV2 = z.infer<typeof ModalNativeConfigurationCaptureRefV2>;
+export declare const ModalNativeProofGrantRefV2: z.ZodObject<{
+    id: z.ZodString;
+    epoch: z.ZodNumber;
+}, z.core.$strict>;
+export type ModalNativeProofGrantRefV2 = z.infer<typeof ModalNativeProofGrantRefV2>;
+export declare const ModalNativeReservedLeaseRefV2: z.ZodObject<{
+    id: z.ZodString;
+    epoch: z.ZodNumber;
+}, z.core.$strict>;
+export type ModalNativeReservedLeaseRefV2 = z.infer<typeof ModalNativeReservedLeaseRefV2>;
+export declare const ModalNativePreparationDeclarationV2: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    blueprint: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        adapterId: z.ZodLiteral<"modal-native-fresh-creator-reservation-v1">;
+        create: z.ZodObject<{
+            operationId: z.ZodString;
+            appId: z.ZodString;
+            imageId: z.ZodString;
+            cpu: z.ZodNumber;
+            memoryMiB: z.ZodNumber;
+            timeoutSeconds: z.ZodNumber;
+            env: z.ZodObject<{}, z.core.$strict>;
+            mounts: z.ZodTuple<[], null>;
+        }, z.core.$strict>;
+        restore: z.ZodNull;
+        readiness: z.ZodObject<{
+            operationId: z.ZodString;
+            execId: z.ZodPipe<z.ZodString, z.ZodString>;
+            commandArgs: z.ZodTuple<[z.ZodLiteral<"/bin/true">], null>;
+            workdir: z.ZodLiteral<"/tmp">;
+            env: z.ZodObject<{}, z.core.$strict>;
+        }, z.core.$strict>;
+        publishOperationId: z.ZodString;
+        cleanup: z.ZodObject<{
+            operationId: z.ZodString;
+            requires: z.ZodLiteral<"physical-terminal-proof">;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    preparationRecipe: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        recipeId: z.ZodLiteral<"modal-native-fresh-v1">;
+        recipeRevision: z.ZodLiteral<1>;
+        createWorkdir: z.ZodLiteral<"/tmp">;
+        entrypoint: z.ZodTuple<[z.ZodLiteral<"sleep">, z.ZodLiteral<"infinity">], null>;
+        normalization: z.ZodObject<{
+            recipeId: z.ZodLiteral<"modal-native-fresh-v1">;
+            recipeRevision: z.ZodLiteral<1>;
+            schema: z.ZodLiteral<"modal.client.ModalClient/SandboxCreate">;
+            encoding: z.ZodLiteral<"modal-create-json-v1">;
+            sdkVersion: z.ZodLiteral<"0.9.0">;
+            sdkSourceSha256: z.ZodLiteral<"bb830ded1925e1d927d1fc221b2329d961f9a57eafdd9a85bf13fb7cfc982599">;
+            entrypoint: z.ZodTuple<[z.ZodLiteral<"sleep">, z.ZodLiteral<"infinity">], null>;
+            createWorkdir: z.ZodLiteral<"/tmp">;
+            env: z.ZodObject<{}, z.core.$strict>;
+            mounts: z.ZodTuple<[], null>;
+            restore: z.ZodNull;
+            idleTimeout: z.ZodLiteral<"unset">;
+            gpu: z.ZodLiteral<"unset">;
+            gpuProto: z.ZodObject<{
+                type: z.ZodLiteral<0>;
+                count: z.ZodLiteral<0>;
+                gpuType: z.ZodLiteral<"">;
+            }, z.core.$strict>;
+            cpuLimit: z.ZodLiteral<"unset">;
+            memoryLimit: z.ZodLiteral<"unset">;
+            pty: z.ZodLiteral<"unset">;
+            regions: z.ZodLiteral<"unset">;
+            proxy: z.ZodLiteral<"unset">;
+            readinessProbe: z.ZodLiteral<"unset">;
+            environmentVariables: z.ZodLiteral<"unset">;
+            network: z.ZodObject<{
+                access: z.ZodLiteral<"OPEN">;
+                outboundCidrs: z.ZodTuple<[], null>;
+                outboundDomains: z.ZodTuple<[], null>;
+                inboundCidrs: z.ZodTuple<[], null>;
+                i6pn: z.ZodLiteral<false>;
+            }, z.core.$strict>;
+            volumes: z.ZodTuple<[], null>;
+            cloudBucketMounts: z.ZodTuple<[], null>;
+            secrets: z.ZodTuple<[], null>;
+            ports: z.ZodTuple<[], null>;
+            cloud: z.ZodLiteral<"">;
+            verbose: z.ZodLiteral<false>;
+            includeOidcIdentityToken: z.ZodLiteral<false>;
+            experimentalOptions: z.ZodObject<{}, z.core.$strict>;
+            experimentalOptionsV2: z.ZodObject<{}, z.core.$strict>;
+            customDomain: z.ZodLiteral<"">;
+        }, z.core.$strict>;
+        compilerFingerprint: z.ZodLiteral<"db6d33c8a1142e5ffe3d1a130d8b9f9d819e46832ad0417d41d5606b7fe25ab1">;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    providerRecoveryCount: z.ZodUnion<readonly [z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>]>;
+    namespaceState: z.ZodLiteral<"unbound">;
+}, z.core.$strict>;
+export type ModalNativePreparationDeclarationV2 = z.infer<typeof ModalNativePreparationDeclarationV2>;
+/** Separate bind-once append, linked to the SAME captured configuration and
+ * claim. This deliberately has no invented immutable provider-principal ID.
+ * Only a trusted native issuer + authenticated host ingress can attest it. */
+export declare const ModalNativeNamespaceEvidenceV2: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    claimId: z.ZodString;
+    nonce: z.ZodString;
+    claimRevision: z.ZodNumber;
+    recordRevision: z.ZodNumber;
+    captureId: z.ZodString;
+    purpose: z.ZodLiteral<"original-namespace-read">;
+    reservation: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    source: z.ZodLiteral<"modal-client-workspace-name-lookup-v1">;
+    responseField: z.ZodEnum<{
+        username: "username";
+        workspaceName: "workspaceName";
+    }>;
+    binding: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        serverUrl: z.ZodString;
+        workspaceName: z.ZodString;
+        environment: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ModalNativeNamespaceEvidenceV2 = z.infer<typeof ModalNativeNamespaceEvidenceV2>;
+/** Scheduling custody ONLY. No lease/task grant is fabricated to authorize
+ * this prerequisite lookup. A reserved lease supplies exclusion, not effects. */
+export declare const ModalNativeNamespaceReadClaimV2: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    claimId: z.ZodString;
+    nonce: z.ZodString;
+    claimRevision: z.ZodNumber;
+    recordRevision: z.ZodNumber;
+    captureId: z.ZodString;
+    expiresAt: z.ZodString;
+    purpose: z.ZodLiteral<"original-namespace-read">;
+    reservation: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ModalNativeNamespaceReadClaimV2 = z.infer<typeof ModalNativeNamespaceReadClaimV2>;
+/** Exact original router command and authoritative prior cursors; no retarget,
+ * new TaskGet adoption, legacy locator, PTY, Start, stdin or process-cancel API. */
+export declare const ModalNativeOriginalCommandReadClaimV2: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    claimId: z.ZodString;
+    nonce: z.ZodString;
+    claimRevision: z.ZodNumber;
+    recordRevision: z.ZodNumber;
+    captureId: z.ZodString;
+    expiresAt: z.ZodString;
+    purpose: z.ZodLiteral<"original-readiness-read">;
+    reservation: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    physicalOwnerGeneration: z.ZodNumber;
+    operationId: z.ZodString;
+    providerBindingKey: z.ZodString;
+    command: z.ZodObject<{
+        kind: z.ZodLiteral<"modal-router-v1">;
+        sandboxId: z.ZodString;
+        taskId: z.ZodString;
+        execId: z.ZodString;
+        pty: z.ZodOptional<z.ZodBoolean>;
+        supervision: z.ZodOptional<z.ZodObject<{
+            protocol: z.ZodLiteral<"native-subreaper-v1">;
+            invocationId: z.ZodString;
+            nonce: z.ZodString;
+            controlPath: z.ZodString;
+        }, z.core.$strict>>;
+        streams: z.ZodObject<{
+            stdout: z.ZodObject<{
+                byteOffset: z.ZodNumber;
+                utf8Remainder: z.ZodString;
+                eof: z.ZodBoolean;
+                exitCode: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strict>;
+            stderr: z.ZodObject<{
+                byteOffset: z.ZodNumber;
+                utf8Remainder: z.ZodString;
+                eof: z.ZodBoolean;
+                exitCode: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ModalNativeOriginalCommandReadClaimV2 = z.infer<typeof ModalNativeOriginalCommandReadClaimV2>;
+/** Preserve the actual runtime descriptor's encoding/fingerprint domain. This
+ * is passive protobuf PREFLIGHT, not the RPC's transmitted bytes or permission. */
+export declare const ModalNativePreparedStartDescriptionV1: z.ZodObject<{
+    taskId: z.ZodString;
+    execId: z.ZodPipe<z.ZodString, z.ZodString>;
+    descriptorProtocol: z.ZodLiteral<"modal-prepared-start-descriptor">;
+    descriptorVersion: z.ZodLiteral<1>;
+    readinessRecipe: z.ZodLiteral<"modal-exec-readiness-bin-true-v1">;
+    readinessRecipeVersion: z.ZodLiteral<1>;
+    startMessage: z.ZodLiteral<"Start">;
+    rpcMethod: z.ZodLiteral<"/modal.task_command_router.TaskCommandRouter/TaskExecStart">;
+    encoderVersion: z.ZodLiteral<"protobufjs@7.6.5">;
+    preflight: z.ZodObject<{
+        encoding: z.ZodLiteral<"modal-start-protobuf-preflight-v1">;
+        sha256: z.ZodString;
+        byteLength: z.ZodNumber;
+        encoderFingerprint: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ModalNativePreparedStartDescriptionV1 = z.infer<typeof ModalNativePreparedStartDescriptionV1>;
+/** Host/native acquisition objects are intentionally NOT constructed here.
+ * Raw DTOs, copied refs and any schema-success result cannot mint those objects.
+ * Capture needs issuer-authenticated OWN bytes, the exact original claim and a
+ * durable capture key; unknown ACK reconciles that same key/acquisition. */
+export type ModalNativeProofCaptureStatusV2 = {
+    status: "committed";
+    captureId: string;
+    receiptId: string;
+    recordRevision: number;
+} | {
+    status: "absent_fenced";
+    captureId: string;
+} | {
+    status: "conflict";
+    captureId: string;
+} | {
+    status: "unresolved";
+    captureId: string;
+};