@opengeni/core 5.0.1 → 5.0.5-canary.39992356589001

package/README.md

@@ -1,6 +1,6 @@
 # @opengeni/core
 
-`@opengeni/core` is the extracted OpenGeni server core: domain flows, access checks, billing/admission helpers, sandbox fleet/routing helpers, and the shared dependency types that HTTP routes and embedded hosts use.
+`@opengeni/core` is the extracted Opengeni server core: domain flows, access checks, billing/admission helpers, sandbox fleet/routing helpers, and the shared dependency types that HTTP routes and embedded hosts use.
 
 It owns code that is not intrinsically HTTP or Temporal process bootstrapping:
 
@@ -11,7 +11,7 @@ It owns code that is not intrinsically HTTP or Temporal process bootstrapping:
 
 `@opengeni/api-router` owns the Hono app, middleware, HTTP route adapters, MCP HTTP transport, and API-direct sandbox endpoints. `@opengeni/worker-bundle` owns Temporal worker construction, workflows, activities, and process lifecycle. Both consume `@opengeni/core`; core does not import either app.
 
-The package is used by standalone OpenGeni through those app runners and by embedded hosts that call core directly or mount the API router.
+The package is used by standalone Opengeni through those app runners and by embedded hosts that call core directly or mount the API router.
 
 ## Scope honesty: engine-core, not domain-core
 
@@ -19,5 +19,5 @@ This package is the **engine core** — the transport-mostly-neutral heart of th
 server, extracted so embedders can mount it. It still carries server-flavored
 dependencies (notably Hono's `HTTPException` as the domain error type and the
 full persistence/runtime closure). It is NOT a pure domain library and does not
-try to be one; if you need OpenGeni without any server runtime, you want the
+try to be one; if you need Opengeni without any server runtime, you want the
 REST API + `@opengeni/sdk` instead.

package/dist/access/index.d.ts

@@ -1,15 +1,114 @@
 import { type Settings } from "@opengeni/config";
 import { ExternalActorAttribution, type ExternalActorContinuation } from "@opengeni/contracts/external-identities";
-import { type AccountGrant, type AccessContext, type AccessGrant, type OrganizationApiKeyAccess, Permission, type Workspace } from "@opengeni/contracts";
+import { type AccountGrant, type AccessContext, type AccessGrant, type OrganizationApiKeyAccess, OrganizationWorkspaceScope, Permission, type Workspace } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import type { Context } from "hono";
+import { z } from "zod";
 import type { ManagedAuth } from "../managed-auth-type.js";
 import type { ManagedAuthSessionAdapter } from "../managed-auth-session-sets.js";
+import type { UserPresenceRecorder } from "../user-presence.js";
+/** Only canonical authentication can prove setup-key provenance. */
+export declare function isDeveloperSetupApiKeyContext(context: AccessContext): boolean;
+/** Provenance from canonical raw-key or verified restricted-token authentication. */
+export declare function isDeveloperSetupAuthorization(authorization: AccessGrantAuthorization | undefined): boolean;
+/** Exact grant objects resolved under authenticated setup-only provenance. */
+export declare function isDeveloperSetupGrant(grant: AccessGrant): boolean;
+/** Setup-derived credentials cannot carry literal organization or key authority. */
+export declare function isDeveloperSetupDelegatedPermissionAllowed(permission: Permission): boolean;
+/** Canonical authentication provenance, including the backing key of asUser. */
+export declare function requireApiKeyManagementContext(context: AccessContext): void;
+/** Membership is not an escape hatch for minting durable credentials. */
+export declare function requireApiKeyDelegationContext(context: AccessContext, permissions: Permission[]): void;
+/** Downstream legacy credentials cannot encode a partially selected admin. */
+export declare function requireExplicitPermissionDelegation(grant: Pick<AccessGrant, "permissions" | "permissionMode">, requested: Permission[]): void;
+export type DelegatedHumanAuthorization = Readonly<{
+    organizationId: string;
+    /** Exact native person subject, never an external identity or service. */
+    subjectId: string;
+    permissions: Permission[];
+    workspaceScope: OrganizationWorkspaceScope;
+}>;
+declare const delegatedHumanProfileSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodString;
+    emailVerified: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type VerifiedDelegatedHumanContext = Readonly<{
+    /** Native identity projection only, never a browser/auth session. Absence of
+     * emailVerified means the native lookup did not prove email verification. */
+    user: Readonly<z.infer<typeof delegatedHumanProfileSchema>>;
+    subjectId: string;
+    authorization: DelegatedHumanAuthorization;
+    context: AccessContext;
+}>;
+/**
+ * TRUSTED OAUTH VERIFIED DISPATCH ONLY. Before each stamp the in-process caller
+ * must validate the live OAuth grant, revocation, exact native person subject,
+ * organization, permission ceilings and workspace scope. This API does not
+ * verify OAuth and must NEVER be called with headers, metadata, token claims,
+ * a previous request's proof, or other unverified caller input.
+ *
+ * Stamp the exact raw Request that the actions dispatcher will pass to routes,
+ * before any access resolution. Cloning/wrapping a Request does not copy proof.
+ * The resolver reloads the real native person's live access on this request
+ * (and on fresh reauthorization); no session or cached grant is fabricated or
+ * transplanted. This proof never becomes managed-cookie/person-present proof.
+ */
+export declare function stampDelegatedHumanAuthorization(request: Request, input: DelegatedHumanAuthorization): void;
+/**
+ * Verified published-Site dispatch only: the caller has verified the signed
+ * gateway, served host and opaque viewer cookie. This is exact-workspace
+ * ownership for session routes, not a console login or a generic Site bearer.
+ * Native people use the existing delegated-human resolver; external owning
+ * users reload their existing membership without provisioning a new identity.
+ */
+export declare function stampSiteViewerSessionAuthorization(request: Request, input: {
+    organizationId: string;
+    workspaceId: string;
+    subjectId: string;
+    permissions: Permission[];
+}): void;
+/** Token prefix of personal API keys, which act as the person who made them. */
+export declare const PERSONAL_API_KEY_TOKEN_PREFIX = "ogp_";
+/**
+ * A personal API key acts as its owner. Call once per incoming request, after
+ * any middleware that may rebuild the Request and before access resolution:
+ * an active personal key stamps this exact raw Request with its owner and
+ * access setting, so the request resolves through the same live-access path as
+ * a person's signed-in agent (their current membership, role and workspaces,
+ * capped by the key) and routes treat it as that person. Anything else is left
+ * to the ordinary resolver, which refuses an unknown or revoked key.
+ */
+export declare function stampPersonalApiKeyRequest(request: Request, deps: Pick<AccessDeps, "db">): Promise<boolean>;
+/** Immutable verified dispatch bounds for this exact raw Request, not a grant. */
+export declare function verifiedDelegatedHumanAuthorizationForRequest(request: Request): DelegatedHumanAuthorization | null;
+/**
+ * Resolve the exact verified OAuth-dispatch person and constrained live native
+ * access for this raw Request. Unstamped requests (even browser cookies) fail
+ * closed; callers must not fall back to a service or subject-shaped identity.
+ * Uses the same request-local native resolution as requireAccessContext.
+ *
+ * No session, session id or managed-cookie proof is created. emailVerified is
+ * forwarded only when the native profile lookup supplies it; missing is not
+ * verified and must never be filled from OAuth claims, headers or metadata.
+ */
+export declare function requireVerifiedDelegatedHumanContext(c: Context, deps: AccessDeps): Promise<VerifiedDelegatedHumanContext>;
+/** Exact resolved owning-person authorization; clones and service claims fail.
+ * Supplying the raw Request additionally binds proof to that exact dispatch,
+ * not another request with the same native person and authorization bounds. */
+export declare function isVerifiedDelegatedHumanAuthorization(authorization: AccessGrantAuthorization, request?: Request): boolean;
+/**
+ * Default permissions for a membership created on an external user's first
+ * request. Keep equal to `CONVERSATION_PERMISSIONS` in
+ * `packages/sdk/src/tenant-workspaces.ts`: conversation use only, no admin.
+ */
+export declare const EXTERNAL_FIRST_USE_MEMBER_PERMISSIONS: readonly Permission[];
 /** Creation audit only, never an authentication or delegation token. Metadata
  * claiming to be external is insufficient; the exact resolver proof is needed. */
 export declare function externalAttributionForAuthorization(authorization: AccessGrantAuthorization | undefined, grant: AccessGrant): ExternalActorAttribution | null;
 export declare function externalActorContinuationForAuthorization(authorization: AccessGrantAuthorization): ExternalActorContinuation | null;
-/** Dedicated owning-user proof. External admission never sets the native
+/** Dedicated owning-user proof. External/OAuth admission never sets the native
  * cookie stamp. The resource/session layer still checks the exact owner. */
 export declare function hasVerifiedOwningUserAuthorization(authorization: AccessGrantAuthorization): boolean;
 /** Request-local organization service-key proof, not a principal-kind claim. */
@@ -17,14 +116,17 @@ export declare function isVerifiedOrganizationServiceAuthorization(authorization
 export type AccountScopedApiKeyWorkspaceAuthority = Readonly<{
     accountId: string;
     permissions: Permission[];
+    workspaceScope: OrganizationWorkspaceScope;
+    permissionMode: "legacy" | "explicit";
 }>;
+export declare function organizationWorkspaceInScope(scope: OrganizationWorkspaceScope, workspaceId: string): boolean;
 /**
  * Return account-scoped API-key workspace authority only for the exact
  * AccessContext object stamped by successful API-key authentication. Subject
  * shape alone is deliberately insufficient.
  */
 export declare function accountScopedApiKeyWorkspaceAuthority(context: AccessContext): AccountScopedApiKeyWorkspaceAuthority | null;
-/** The organization access tier is derived from the stored workspace-admin wildcard. */
+/** Classify stored scopes without changing the legacy full/read permission sets. */
 export declare function organizationApiKeyAccess(permissions: Permission[]): OrganizationApiKeyAccess;
 /**
  * Opaque, request-local proof that the canonical access resolver authorized the
@@ -43,6 +145,8 @@ export type AccessDeps = {
     settings: Settings;
     managedAuth?: ManagedAuth | null;
     managedAuthSessionAdapter?: ManagedAuthSessionAdapter | null;
+    /** Analytics only: notes canonical managed-cookie activity, never authority. */
+    userPresence?: UserPresenceRecorder | null;
 };
 /** null means this is not an authenticated external lane; [] means that lane
  * has no readable inventory. Callers must not fall back from [] to service or
@@ -64,8 +168,9 @@ export type AccessGrantAuthorization = {
     contextIntegrity: boolean;
     /**
      * Did this request authenticate as the canonical managed-cookie (Better Auth)
-     * session that OWNS this grant's subject? The single input to the owner-only
-     * managed personal-workspace exception; see `isCanonicalManagedHumanSession`.
+     * session that OWNS this grant's subject? Cookie/person-present ceremonies
+     * retain this strict gate; owning-user boundaries use
+     * `hasVerifiedOwningUserAuthorization` instead.
      * False for every bearer, API-key, delegated, service, local, and configured
      * principal, and for any future path that does not verify a cookie.
      */
@@ -109,11 +214,44 @@ export declare function requireCanonicalLocalAccountAdministrator(c: Context, de
 export declare function requireAccessGrantAuthorization(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrantAuthorization>;
 /**
  * Settings administration is narrower than workspace administration. The
- * canonical managed-cookie owner may configure their Personal workspace, but
+ * verified owning user may configure their Personal workspace, but
  * never acquires the admin wildcard (and its membership/delegation powers).
+ * Delegated owners also need workspace:admin in their verified dispatch/key
+ * ceiling: a read-only delegation cannot turn ownership into a settings write.
  * Only use this boundary for workspace configuration, not access management.
  */
 export declare function requireWorkspaceSettingsGrant(c: Context, deps: AccessDeps, workspaceId: string): Promise<AccessGrant>;
+/**
+ * Authority for a shared workspace's own Members surface (list, candidates,
+ * add, change, remove). A holder of the requested workspace permission keeps
+ * the ordinary grant. Otherwise an active organization owner or administrator,
+ * authenticated by the canonical managed cookie, manages any shared workspace
+ * in their organization exactly as through the organization control plane,
+ * with or without an operational membership row there. Every other principal
+ * (API keys, delegated bearers, agents, services, local/configured access)
+ * and every Personal workspace keeps the original refusal. The database
+ * functions re-derive the organization role under the organization fence.
+ */
+export declare function requireWorkspaceMemberManagementAuthority(c: Context, deps: AccessDeps, workspaceId: string, permission: "members:manage" | "workspace:read"): Promise<{
+    grant: AccessGrant;
+    organizationAdministrator: boolean;
+}>;
+/**
+ * The subject whose inbox this request may read, or null when it has none.
+ * A signed-in person (`user:`, no key) requires verified managed-human
+ * provenance, including approved native app credentials. The local
+ * install's human qualifies only when the in-process local bootstrap produced
+ * this context (so a delegated bearer naming `dev` cannot borrow it), with the
+ * human-session, non-delegated, non-service, keyless shape of
+ * {@link accessContextHasInbox}. An agent acting as a person (verified
+ * in-process dispatch) reads that person's inbox within its organization and
+ * workspaces: the inbox routes check each item's workspace on this context.
+ * An external user (`external_user:`) reads their own inbox only through the
+ * organization key that resolved them as an external actor, within that
+ * organization; a linked native identity acts as its `user:` person, whose
+ * inbox is read by signing in to Opengeni, not through a product's key.
+ */
+export declare function inboxSubjectForContext(context: AccessContext): string | null;
 export declare function requirePermission(grant: AccessGrant, permission: Permission): void;
 /**
  * Require a permission to be present literally on the grant. This deliberately
@@ -122,5 +260,6 @@ export declare function requirePermission(grant: AccessGrant, permission: Permis
  * acquire implicitly.
  */
 export declare function requireLiteralPermission(grant: AccessGrant, permission: Permission): void;
-export declare function hasLiteralPermission(permissions: Permission[], permission: Permission): boolean;
-export declare function hasPermission(permissions: Permission[], permission: Permission): boolean;
+export declare function hasLiteralPermission(permissions: readonly Permission[], permission: Permission): boolean;
+export declare function hasPermission(permissions: readonly Permission[], permission: Permission, permissionMode?: AccessGrant["permissionMode"]): boolean;
+export {};

package/dist/application/composer-submit.d.ts

@@ -18,7 +18,7 @@ export type SubmitComposerDraftForRequestOptions = {
  * This is the application boundary shared by the stock HTTP adapter and an
  * in-process embedding host. A host may prepare its own durable business state
  * before calling this function and project the returned receipt afterward, but
- * OpenGeni remains the sole authority for draft validation/rotation, event
+ * Opengeni remains the sole authority for draft validation/rotation, event
  * append, turn creation, routing, and idempotent replay.
  */
 export declare function submitComposerDraftForRequest(deps: AcceptSessionUserMessageDependencies, grant: AccessGrant, workspaceId: string, sessionId: string, input: SubmitComposerDraftRequest, options?: SubmitComposerDraftForRequestOptions): Promise<SubmitComposerDraftResponse>;

package/dist/application/connect-operation.d.ts

@@ -26,6 +26,9 @@ export declare function executeConnectOperation(input: {
     /** Trusted server adapter classification, never derived from request data.
      * Cancellation releases pending setup; it acquires no integration authority. */
     purpose?: "acquisition" | "cancellation";
+    /** Trusted adapter's exact attempt fence, inside the organization policy
+     * prefix and before Connect row locks, for both claim and final commit. */
+    beforeOperation?: ((tx: Database) => Promise<void>) | undefined;
     authorize: ConnectOperationAuthorization;
     execute: (attempt: ConnectAttempt) => Promise<PreparedConnectOperation>;
 }): Promise<ConnectAttempt>;

package/dist/application/draft-model-preparation.d.ts

@@ -0,0 +1,21 @@
+import { type Settings } from "@opengeni/config";
+import { type Database } from "@opengeni/db";
+import { refreshCoreCodexModelEntitlements } from "../codex-model-availability.js";
+/**
+ * A committed, debounced draft save is a hint, never turn admission. Prepare
+ * only reusable shared catalog facts. No workflow, lease, model, MCP or
+ * sandbox is started, and Send still makes every authority decision itself.
+ * React and React Native durable composers already share this save path.
+ */
+export declare function prepareDraftModel(deps: {
+    db: Database;
+    settings: Settings;
+}, context: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}, draft: {
+    text: string;
+    resources: readonly unknown[];
+    model: string;
+}, refresh?: typeof refreshCoreCodexModelEntitlements): void;

package/dist/application/external-workspace-members.d.ts

@@ -1,7 +1,9 @@
 import type { Context } from "hono";
 import { type ExternalIdentity } from "@opengeni/contracts/external-identities";
 import { type AccessDeps } from "../access/index.js";
-/** Explicit host onboarding. Ordinary asUser reads never call this operation.
+/** Explicit host onboarding. Ordinary asUser requests never call this
+ * operation; their first-use membership is `provisionExternalMemberOnFirstUse`
+ * in `../access`, under the same key authority and lifecycle fence.
  * Existing memberships are not overwritten, including reduced permissions. */
 export declare function addExternalWorkspaceMemberForRequest(c: Context, deps: AccessDeps, workspaceId: string, input: unknown): Promise<ExternalIdentity>;
 export declare function lookupExternalIdentityForRequest(c: Context, deps: AccessDeps, organizationId: string, input: unknown): Promise<{
@@ -26,7 +28,7 @@ export declare function cancelExternalWorkspaceMemberGrantForRequest(c: Context,
 export declare function updateExternalWorkspaceMemberForRequest(c: Context, deps: AccessDeps, organizationId: string, workspaceId: string, membershipId: string, input: unknown): Promise<{
     subjectId: string;
     organizationMembershipId: string;
-    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
     narrowed: boolean;
     replay: boolean;
 }>;

package/dist/application/modal-native-live-declaration-join.d.ts

@@ -0,0 +1,37 @@
+import type { Settings } from "@opengeni/config";
+import { ModalNativePreparationDeclarationV2 } from "@opengeni/contracts/modal-native-proof-v2";
+import { type Database, type ModalNativeLiveOriginProjection, type ModalNativeLiveOriginResult } from "@opengeni/db";
+import { type NativeOriginalConfigurationSample } from "./modal-native-original-configuration.js";
+type JoinSettings = Pick<Settings, "delegationSecret" | "modalTokenId" | "modalTokenSecret" | "modalEnvironment" | "environmentsEncryptionKey">;
+/** Sensitive request-local data only. Do not publish/log/cache across commit.
+ * The sample contains immutable credential strings which disposal cannot erase.
+ * This result has no native-I/O, replay, custody or effect authority. */
+export type NativeLiveDeclarationJoin = Readonly<{
+    requestId: string;
+    declaration: ModalNativePreparationDeclarationV2;
+    projection: ModalNativeLiveOriginProjection;
+    configuration: NativeOriginalConfigurationSample;
+}>;
+export type NativeLiveDeclarationJoinResult = {
+    kind: "joined_data";
+    data: NativeLiveDeclarationJoin;
+} | {
+    kind: "off";
+} | {
+    kind: "refused";
+} | Exclude<ModalNativeLiveOriginResult, {
+    kind: "live";
+}>;
+/** Own bytes BEFORE either verifying or parsing. After the blocking SQL join,
+ * re-read the explicit CURRENT deployment root/profile and reverify current
+ * expiry over those SAME owned bytes. A historical MAC witness is insufficient.
+ * No tenant/subject GUC change, general access-token resolver, provider await,
+ * fallback, registration or error-to-success conversion occurs here.
+ *
+ * Input execution/human fields are signed CORRELATION, not caller authority:
+ * compare them to the exact DB-derived accepted original projection. This does
+ * NOT independently prove that the canonical worker produced the request.
+ * Enter an existing scoped transaction before any tenancy/control/row lock;
+ * consume the result in that transaction and dispose its sample afterward. */
+export declare function lockNativeLiveDeclarationJoinTx(scopedTx: Database, settings: JoinSettings, envelope: string, inputBody: Uint8Array): Promise<NativeLiveDeclarationJoinResult>;
+export {};

package/dist/application/modal-native-original-configuration.d.ts

@@ -0,0 +1,79 @@
+import type { Settings } from "@opengeni/config";
+import { ModalNativePreparationDeclarationV2 } from "@opengeni/contracts/modal-native-proof-v2";
+declare const SUBKEY_DOMAIN = "opengeni:modal-native:configuration-equality:subkey:v2";
+declare const MESSAGE_DOMAIN = "opengeni:modal-native:configuration-equality:framed:v2\0";
+type ConfigurationSettings = Pick<Settings, "modalTokenId" | "modalTokenSecret" | "modalEnvironment" | "environmentsEncryptionKey">;
+export type NativeOriginalConfigurationSnapshot = Readonly<{
+    serverUrl: string;
+    tokenId: string;
+    tokenSecret: string;
+    environment: string;
+}>;
+declare function readProfile(environment: string): Readonly<{
+    protocol: "modal-direct-original-read-grpc-v1";
+    version: 1;
+    sourceGitBlob: "7599f5b80cf111a25f78f427cfb2616d7e24b36c";
+    serverUrl: "https://api.modal.com:443";
+    serverSelection: "host-pinned-modal-0.9-default";
+    credentialSelection: "explicit-deployment-settings-pair-only";
+    environmentSelection: "explicit-own-settings-no-default";
+    environment: string;
+    environmentTransmittedByCpReads: false;
+    namespaceSelection: "unbound-until-authenticated-once-capture";
+    modalProjectionVersion: "0.9.0";
+    grpcJsVersion: "1.14.4";
+    protobufJsVersion: "7.6.5";
+    rpcPrefix: "/modal.client.ModalClient/";
+    methods: readonly ["AuthTokenGet", "WorkspaceNameLookup", "TaskGetCommandRouterAccess"];
+    authHeaders: {
+        readonly clientType: "8";
+        readonly clientVersion: "1.0.0";
+        readonly libmodalVersion: "modal-js/0.9.0";
+    };
+    tlsPolicy: "explicit-node-tls-rootCertificates-v1";
+    tlsRootsSha256: string;
+    retries: 0;
+    nativeChainDeadlineMs: 30000;
+    maxWireBytes: 1048576;
+}>;
+type PrivateDescription = Readonly<{
+    protocol: "opengeni-modal-native-configuration-equality";
+    version: 2;
+    purpose: "original-native-custody-proof";
+    configurationCaptureRef: ModalNativePreparationDeclarationV2["configurationCaptureRef"];
+    proofGrantRef: ModalNativePreparationDeclarationV2["proofGrantRef"];
+    declarationJson: string;
+    declarationSha256: string;
+    profile: ReturnType<typeof readProfile>;
+    keySelection: "existing-environments-encryption-root-current-only";
+    algorithm: "hmac-sha256";
+    subkeyDomain: typeof SUBKEY_DOMAIN;
+    messageDomain: typeof MESSAGE_DOMAIN;
+}>;
+/** Sensitive PRIVATE storage draft, not proof that any row or grant committed. */
+export type NativeOriginalConfigurationDraftV2 = Readonly<{
+    description: PrivateDescription;
+    equality: Uint8Array;
+}>;
+declare const sampleBrand: unique symbol;
+export type NativeOriginalConfigurationSample = Readonly<{
+    [sampleBrand]: true;
+}>;
+/** Samples ONLY explicit own settings, without environment/profile/SDK lookup.
+ * A parsed declaration merely supplies correlation. Genuine known app/image
+ * provenance and same-transaction host/grant/admission checks remain external.
+ */
+export declare function sampleNativeOriginalConfiguration(settings: ConfigurationSettings, declarationBytes: Uint8Array): NativeOriginalConfigurationSample | null;
+/** Private draft extraction for protected storage only; never a status DTO. */
+export declare function privateNativeOriginalConfigurationDraft(sample: NativeOriginalConfigurationSample): NativeOriginalConfigurationDraftV2 | null;
+/** Same sampled strings for a future authenticated native caller; NOT a grant. */
+export declare function nativeOriginalConfigurationSnapshot(sample: NativeOriginalConfigurationSample): NativeOriginalConfigurationSnapshot | null;
+/** PRIVATE equality check only. No public oracle, grant renewal or key fallback.
+ * Restart reconstruction still requires an authenticated protected original row.
+ */
+export declare function currentNativeOriginalConfigurationMatches(sample: NativeOriginalConfigurationSample, settings: ConfigurationSettings): boolean;
+/** Wipes owned mutable copies, not JS immutable strings or native I/O/custody.
+ * A future owning native caller must join its real callbacks separately.
+ */
+export declare function disposeNativeOriginalConfigurationSample(sample: NativeOriginalConfigurationSample): void;
+export {};