@ours.network/fleet 0.10.3 → 0.11.0

package/dist/web/server.js

@@ -0,0 +1,279 @@
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Fastify from 'fastify';
+import fastifyStatic from '@fastify/static';
+import fastifyWebsocket from '@fastify/websocket';
+import { createHmac, randomBytes } from 'node:crypto';
+import { FleetError, normalizeError } from '../application/errors.js';
+import { VERSION } from '../version.js';
+import { AuditSink } from './audit.js';
+import { WebAuth } from './auth.js';
+import { FleetEventBus } from './events.js';
+const statusFor = (code) => ({
+    role_not_found: 404, unauthorized: 401, forbidden: 403, conflict: 409,
+    idempotency_conflict: 409, stale_state: 409, rate_limited: 429,
+    invalid_request: 400, capability_unavailable: 409, prerequisite_unavailable: 503,
+}[code] ?? 500);
+export async function buildWebServer(services, boundary, options = {}) {
+    const app = Fastify({
+        trustProxy: false, bodyLimit: 64 * 1024, logger: false,
+        requestIdHeader: false, genReqId: () => cryptoRandomId(),
+    });
+    const auth = options.auth ?? new WebAuth(boundary.origin, boundary.host);
+    const audit = services.audit ?? new AuditSink();
+    const events = services.events ?? new FleetEventBus();
+    const digestKey = randomBytes(32);
+    await app.register(fastifyWebsocket, {
+        options: { maxPayload: 64 * 1024, perMessageDeflate: false },
+    });
+    app.addHook('onRequest', async (request, reply) => {
+        reply.header('X-Content-Type-Options', 'nosniff');
+        reply.header('Referrer-Policy', 'no-referrer');
+        reply.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
+        reply.header('X-Frame-Options', 'DENY');
+        reply.header('Content-Security-Policy', `default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; ` +
+            `connect-src 'self' ws://${auth.host}; object-src 'none'; base-uri 'none'; ` +
+            `frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'`);
+        if (request.url.startsWith('/api/'))
+            reply.header('Cache-Control', 'no-store');
+        if (request.headers.host !== auth.host)
+            throw new FleetError('forbidden', 'invalid Host header');
+    });
+    app.setErrorHandler(async (error, request, reply) => {
+        const fleetError = normalizeError(error, request.id);
+        await audit.record({
+            requestId: request.id, action: `${request.method} ${request.routeOptions.url ?? request.url}`,
+            result: 'rejected', errorCode: fleetError.code,
+        });
+        reply.code(statusFor(fleetError.code)).send({ error: fleetError.toJSON() });
+    });
+    app.post('/api/v1/auth/exchange', async (request, reply) => {
+        const { session, device } = auth.exchange(request);
+        setAuthCookies(reply, session.id, device.token);
+        await audit.record({ requestId: request.id, browser: session.id, action: 'auth.exchange', result: 'succeeded' });
+        return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
+    });
+    app.post('/api/v1/auth/resume', async (request, reply) => {
+        const { session, device } = auth.resume(request);
+        setAuthCookies(reply, session.id, device.token);
+        await audit.record({ requestId: request.id, browser: session.id, action: 'auth.resume', result: 'succeeded' });
+        return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
+    });
+    app.post('/api/v1/auth/logout', async (request, reply) => {
+        auth.logout(request);
+        clearAuthCookies(reply);
+        await audit.record({ requestId: request.id, action: 'auth.logout', result: 'succeeded' });
+        return { ok: true };
+    });
+    app.get('/api/v1/auth/session', async (request) => {
+        const session = auth.authenticate(request);
+        return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
+    });
+    app.get('/api/v1/meta', async (request) => {
+        auth.authenticate(request);
+        return {
+            version: VERSION, api: { major: 1, minor: 0 },
+            websocketProtocols: ['ours-fleet-events.v1', 'ours-fleet-terminal.v1'],
+            auditDegraded: audit.degraded,
+        };
+    });
+    app.get('/api/v1/creation-capabilities', async (request) => {
+        auth.authenticate(request);
+        return services.creation.capabilities();
+    });
+    app.post('/api/v1/roles/preview', async (request) => {
+        auth.authenticate(request, true);
+        return services.creation.preview(request.body);
+    });
+    app.post('/api/v1/roles', async (request, reply) => {
+        const session = auth.authenticate(request, true);
+        const body = request.body;
+        const idempotencyKey = String(request.headers['idempotency-key'] ?? '');
+        if (!body?.request || !body.previewHash)
+            throw new FleetError('invalid_request', 'request and previewHash are required');
+        const action = await services.creation.create(body.request, body.previewHash, idempotencyKey, session.id);
+        events.publish('creation.changed', action, action.roleId);
+        reply.header('Location', `/api/v1/creation-actions/${encodeURIComponent(action.actionId)}`);
+        reply.code(202);
+        return action;
+    });
+    app.get('/api/v1/roles', async (request) => {
+        auth.authenticate(request);
+        return { roles: await services.query.list() };
+    });
+    app.get('/api/v1/roles/:id', async (request) => {
+        auth.authenticate(request);
+        return services.query.detail(request.params.id);
+    });
+    app.get('/api/v1/roles/:id/output', async (request) => {
+        auth.authenticate(request);
+        const control = await services.session(request.params.id);
+        return control.recentOutput({
+            since: request.query.since ? Number(request.query.since) : undefined,
+            limit: request.query.limit ? Number(request.query.limit) : undefined,
+        });
+    });
+    app.post('/api/v1/roles/:id/input', async (request) => {
+        const session = auth.authenticate(request, true);
+        const text = String(request.body?.text ?? '');
+        const control = await services.session(request.params.id);
+        const receipt = await control.sendText(text);
+        await audit.record({
+            requestId: request.id, browser: session.id, roleId: request.params.id,
+            action: 'session.send_text', result: receipt.accepted ? 'accepted' : 'failed',
+            bytes: Buffer.byteLength(text),
+            digest: createHmac('sha256', digestKey).update(text).digest('hex').slice(0, 24),
+        });
+        return receipt;
+    });
+    app.post('/api/v1/roles/:id/interrupt', async (request) => {
+        auth.authenticate(request, true);
+        const control = await services.session(request.params.id);
+        if (!control.interrupt)
+            throw new FleetError('capability_unavailable', 'interrupt is unavailable');
+        return control.interrupt();
+    });
+    app.post('/api/v1/roles/:id/permissions/:permissionId', async (request) => {
+        auth.authenticate(request, true);
+        const control = await services.session(request.params.id);
+        if (!control.respondPermission)
+            throw new FleetError('capability_unavailable', 'permission response is unavailable');
+        return control.respondPermission({
+            permissionId: request.params.permissionId,
+            optionId: String(request.body?.optionId ?? ''),
+        });
+    });
+    app.get('/api/v1/roles/:id/logs', async (request) => {
+        auth.authenticate(request);
+        return services.logs.source(request.params.id)
+            .tail(Number(request.query.limit ?? 200), request.query.cursor);
+    });
+    app.post('/api/v1/roles/:id/actions', async (request, reply) => {
+        auth.authenticate(request, true);
+        const body = request.body;
+        if (!body.action || !['start', 'stop', 'restart_resume', 'restart_fresh'].includes(body.action))
+            throw new FleetError('invalid_request', 'invalid lifecycle action');
+        const receipt = await services.commands.execute({
+            roleId: request.params.id, action: body.action,
+            actionId: body.actionId, confirmation: body.confirmation,
+        });
+        events.publish('action.changed', receipt, request.params.id);
+        reply.code(202);
+        return receipt;
+    });
+    app.get('/api/v1/actions/:actionId', async (request) => {
+        auth.authenticate(request);
+        const receipt = services.commands.get(request.params.actionId);
+        if (!receipt)
+            throw new FleetError('role_not_found', 'action not found');
+        return receipt;
+    });
+    app.get('/api/v1/creation-actions/:actionId', async (request) => {
+        auth.authenticate(request);
+        const action = services.creation.get(request.params.actionId);
+        if (!action)
+            throw new FleetError('role_not_found', 'creation action not found');
+        return action;
+    });
+    app.post('/api/v1/ws-tickets', async (request) => {
+        const body = request.body;
+        if (!body?.purpose || !['events', 'terminal'].includes(body.purpose))
+            throw new FleetError('invalid_request', 'ticket purpose is required');
+        return auth.mintTicket(request, body.purpose, body.roleId);
+    });
+    app.get('/api/v1/audit', async (request) => {
+        auth.authenticate(request);
+        return { records: audit.list() };
+    });
+    app.get('/api/v1/watchdogs', async (request) => {
+        auth.authenticate(request);
+        if (!services.watchdogs)
+            throw new FleetError('capability_unavailable', 'watchdogs are unavailable');
+        return services.watchdogs.list();
+    });
+    app.get('/api/v1/watchdogs/:name/reports', async (request) => {
+        auth.authenticate(request);
+        if (!services.watchdogs)
+            throw new FleetError('capability_unavailable', 'watchdogs are unavailable');
+        return services.watchdogs.reports(request.params.name, request.query.limit ? Number(request.query.limit) : undefined);
+    });
+    app.get('/api/v1/watchdogs/:name/reports/:runId', async (request) => {
+        auth.authenticate(request);
+        if (!services.watchdogs)
+            throw new FleetError('capability_unavailable', 'watchdogs are unavailable');
+        return services.watchdogs.report(request.params.name, request.params.runId);
+    });
+    app.get('/api/v1/events', { websocket: true }, (socket, request) => {
+        requireSubprotocol(request, 'ours-fleet-events.v1');
+        authorizeSocket(socket, request, async (hello) => {
+            const session = auth.consumeTicket(request, String(hello.ticket ?? ''), 'events');
+            auth.bindSocket(session.id, socket);
+            const detach = events.attach(socket, typeof hello.lastEventId === 'string' ? hello.lastEventId : undefined);
+            socket.on('close', detach);
+            socket.send(JSON.stringify({ kind: 'ready', at: new Date().toISOString() }));
+        });
+    });
+    app.get('/api/v1/roles/:id/terminal', { websocket: true }, (socket, request) => {
+        requireSubprotocol(request, 'ours-fleet-terminal.v1');
+        authorizeSocket(socket, request, async (hello) => {
+            const ticket = String(hello.ticket ?? '');
+            const session = auth.consumeTicket(request, ticket, 'terminal', request.params.id);
+            auth.bindSocket(session.id, socket);
+            if (!services.terminalUpgrade)
+                throw new FleetError('capability_unavailable', 'terminal PTY support is unavailable');
+            await services.terminalUpgrade(socket, request, request.params.id, ticket, hello);
+        });
+    });
+    const staticRoot = join(dirname(fileURLToPath(import.meta.url)), '..', 'web-app');
+    if (existsSync(staticRoot)) {
+        await app.register(fastifyStatic, { root: staticRoot, prefix: '/' });
+        app.setNotFoundHandler((request, reply) => {
+            if (request.url.startsWith('/api/'))
+                return reply.code(404).send({ error: 'not found' });
+            return reply.sendFile('index.html');
+        });
+    }
+    return {
+        app, auth, audit, events,
+        async close() {
+            auth.shutdown();
+            events.close();
+            await app.close();
+        },
+    };
+}
+function setAuthCookies(reply, session, device) {
+    reply.header('Set-Cookie', [
+        `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=28800`,
+        `ofs_device=${encodeURIComponent(device)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=2592000`,
+    ]);
+}
+function clearAuthCookies(reply) {
+    reply.header('Set-Cookie', [
+        'ofs_session=; HttpOnly; SameSite=Strict; Path=/api; Max-Age=0',
+        'ofs_device=; HttpOnly; SameSite=Strict; Path=/api; Max-Age=0',
+    ]);
+}
+function cryptoRandomId() { return randomBytes(12).toString('hex'); }
+function requireSubprotocol(request, expected) {
+    const protocols = String(request.headers['sec-websocket-protocol'] ?? '')
+        .split(',').map(value => value.trim());
+    if (!protocols.includes(expected))
+        throw new FleetError('forbidden', `required subprotocol ${expected}`);
+}
+function authorizeSocket(socket, request, authorize) {
+    const timer = setTimeout(() => socket.close(4401, 'authorization timeout'), 5_000);
+    socket.once('message', data => {
+        clearTimeout(timer);
+        void (async () => {
+            try {
+                const hello = JSON.parse(data.toString());
+                await authorize(hello);
+            }
+            catch (error) {
+                socket.close(4403, normalizeError(error).message.slice(0, 120));
+            }
+        })();
+    });
+}

package/dist/web/service.d.ts

@@ -0,0 +1,42 @@
+import { type Exec } from '../exec.js';
+export declare const WEB_SYSTEMD_UNIT = "ours-fleet-web.service";
+export declare const WEB_LAUNCHD_LABEL = "network.ours.fleet.web";
+interface ServiceMetadata {
+    version: 2;
+    platform: 'linux' | 'darwin';
+    runtime: string;
+    script: string;
+    port: number;
+    configuration?: string;
+}
+export interface WebServiceOptions {
+    platform?: NodeJS.Platform;
+    exec?: Exec;
+    homeDir?: string;
+    stateDir?: string;
+    uid?: number;
+    runtimeExecutable?: string;
+}
+export declare class WebServiceManager {
+    private readonly platform;
+    private readonly exec;
+    private readonly homeDir;
+    private readonly stateDir;
+    private readonly uid;
+    private readonly runtimeExecutable;
+    constructor(options?: WebServiceOptions);
+    get metadataPath(): string;
+    get definitionPath(): string;
+    install(script: string, port?: number, configuration?: string): Promise<string[]>;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    restart(): Promise<void>;
+    status(): Promise<string>;
+    uninstall(): Promise<string>;
+    readMetadata(): ServiceMetadata | undefined;
+    private requireInstalled;
+    private must;
+}
+export declare function systemdUnit(runtime: string, script: string, port: number, configuration?: string): string;
+export declare function launchdPlist(runtime: string, script: string, port: number, configuration?: string): string;
+export {};

package/dist/web/service.js

@@ -0,0 +1,180 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync } from 'node:fs';
+import { userInfo } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { FleetError } from '../application/errors.js';
+import { realExec } from '../exec.js';
+import { home, stateRoot } from '../paths.js';
+const VERSION = 2;
+export const WEB_SYSTEMD_UNIT = 'ours-fleet-web.service';
+export const WEB_LAUNCHD_LABEL = 'network.ours.fleet.web';
+export class WebServiceManager {
+    platform;
+    exec;
+    homeDir;
+    stateDir;
+    uid;
+    runtimeExecutable;
+    constructor(options = {}) {
+        const platform = options.platform ?? process.platform;
+        if (platform !== 'linux' && platform !== 'darwin')
+            throw new FleetError('capability_unavailable', `web service is unsupported on ${platform}`);
+        this.platform = platform;
+        this.exec = options.exec ?? realExec;
+        this.homeDir = options.homeDir ?? home();
+        this.stateDir = options.stateDir ?? join(stateRoot(), 'web');
+        this.uid = options.uid ?? process.getuid?.() ?? 501;
+        this.runtimeExecutable = options.runtimeExecutable ?? process.execPath;
+    }
+    get metadataPath() { return join(this.stateDir, 'service.json'); }
+    get definitionPath() {
+        return this.platform === 'linux'
+            ? join(this.homeDir, '.config', 'systemd', 'user', WEB_SYSTEMD_UNIT)
+            : join(this.homeDir, 'Library', 'LaunchAgents', `${WEB_LAUNCHD_LABEL}.plist`);
+    }
+    async install(script, port = 49_271, configuration) {
+        validatePort(port);
+        const resolvedScript = resolveExecutable(script, 'web CLI script');
+        const runtime = resolveExecutable(this.runtimeExecutable, 'Node runtime');
+        mkdirSync(dirname(this.definitionPath), { recursive: true, mode: 0o700 });
+        mkdirSync(this.stateDir, { recursive: true, mode: 0o700 });
+        chmodSync(this.stateDir, 0o700);
+        const config = configuration ? resolve(configuration) : undefined;
+        const metadata = {
+            version: VERSION, platform: this.platform, runtime, script: resolvedScript, port,
+            ...(config ? { configuration: config } : {}),
+        };
+        replaceFileAtomically(this.definitionPath, this.platform === 'linux'
+            ? systemdUnit(runtime, resolvedScript, port, config)
+            : launchdPlist(runtime, resolvedScript, port, config), 0o600);
+        replaceFileAtomically(this.metadataPath, JSON.stringify(metadata, null, 2) + '\n', 0o600);
+        if (this.platform === 'linux') {
+            await this.must('systemctl', ['--user', 'daemon-reload']);
+            await this.must('systemctl', ['--user', 'enable', WEB_SYSTEMD_UNIT]);
+            const linger = await this.exec('loginctl', ['show-user', userInfo().username, '-p', 'Linger', '--value']);
+            return [
+                `installed ${this.definitionPath}`,
+                linger.stdout.trim() === 'yes'
+                    ? 'login persistence available (linger enabled)'
+                    : `warning: login persistence requires linger; run: sudo loginctl enable-linger ${userInfo().username}`,
+            ];
+        }
+        return [`installed ${this.definitionPath}`, 'launchd service starts at login'];
+    }
+    async start() {
+        this.requireInstalled();
+        if (this.platform === 'linux') {
+            await this.must('systemctl', ['--user', 'start', WEB_SYSTEMD_UNIT]);
+            return;
+        }
+        const domain = `gui/${this.uid}`;
+        const loaded = await this.exec('launchctl', ['print', `${domain}/${WEB_LAUNCHD_LABEL}`]);
+        if (loaded.code === 0)
+            await this.must('launchctl', ['kickstart', `${domain}/${WEB_LAUNCHD_LABEL}`]);
+        else
+            await this.must('launchctl', ['bootstrap', domain, this.definitionPath]);
+    }
+    async stop() {
+        if (this.platform === 'linux') {
+            await this.must('systemctl', ['--user', 'stop', WEB_SYSTEMD_UNIT]);
+            return;
+        }
+        const result = await this.exec('launchctl', ['bootout', `gui/${this.uid}/${WEB_LAUNCHD_LABEL}`]);
+        if (result.code !== 0 && !/could not find service|no such process/i.test(`${result.stdout}\n${result.stderr}`))
+            throw new FleetError('control_unavailable', `launchctl bootout failed: ${result.stderr.trim()}`);
+    }
+    async restart() {
+        this.requireInstalled();
+        if (this.platform === 'linux') {
+            await this.must('systemctl', ['--user', 'restart', WEB_SYSTEMD_UNIT]);
+            return;
+        }
+        const result = await this.exec('launchctl', ['kickstart', '-k', `gui/${this.uid}/${WEB_LAUNCHD_LABEL}`]);
+        if (result.code !== 0) {
+            await this.stop();
+            await this.start();
+        }
+    }
+    async status() {
+        if (this.platform === 'linux') {
+            const result = await this.exec('systemctl', [
+                '--user', 'show', WEB_SYSTEMD_UNIT, '-p', 'LoadState', '-p', 'ActiveState',
+                '-p', 'SubState', '-p', 'ExecMainPID', '--no-pager',
+            ]);
+            return result.stdout.trim() || result.stderr.trim() || `exit ${result.code}`;
+        }
+        const result = await this.exec('launchctl', ['print', `gui/${this.uid}/${WEB_LAUNCHD_LABEL}`]);
+        return result.code === 0 ? result.stdout.trim() : `not loaded (${WEB_LAUNCHD_LABEL})`;
+    }
+    async uninstall() {
+        if (this.platform === 'linux') {
+            await this.exec('systemctl', ['--user', 'disable', '--now', WEB_SYSTEMD_UNIT]);
+            rmSync(this.definitionPath, { force: true });
+            rmSync(this.metadataPath, { force: true });
+            await this.exec('systemctl', ['--user', 'daemon-reload']);
+        }
+        else {
+            await this.stop();
+            rmSync(this.definitionPath, { force: true });
+            rmSync(this.metadataPath, { force: true });
+        }
+        return `uninstalled ${this.platform === 'linux' ? WEB_SYSTEMD_UNIT : WEB_LAUNCHD_LABEL}`;
+    }
+    readMetadata() {
+        try {
+            const parsed = JSON.parse(readFileSync(this.metadataPath, 'utf8'));
+            return parsed.version === VERSION && parsed.platform === this.platform
+                && typeof parsed.runtime === 'string' && typeof parsed.script === 'string'
+                && Number.isInteger(parsed.port) ? parsed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    requireInstalled() {
+        if (!existsSync(this.definitionPath) || !this.readMetadata())
+            throw new FleetError('prerequisite_unavailable', 'web service is not installed; run `ours-fleet web install`');
+    }
+    async must(command, args) {
+        const result = await this.exec(command, args);
+        if (result.code !== 0)
+            throw new FleetError('control_unavailable', `${command} ${args.join(' ')} failed: ${result.stderr.trim() || `exit ${result.code}`}`);
+    }
+}
+function resolveExecutable(executable, label) {
+    const absolute = isAbsolute(executable) ? executable : resolve(executable);
+    try {
+        return realpathSync(absolute);
+    }
+    catch {
+        throw new FleetError('prerequisite_unavailable', `${label} does not exist: ${absolute}`);
+    }
+}
+function validatePort(port) {
+    if (!Number.isInteger(port) || port < 1 || port > 65_535)
+        throw new FleetError('invalid_request', 'service port must be between 1 and 65535');
+}
+function systemdQuote(value) {
+    return `"${value.replace(/[%\\"]/g, char => char === '%' ? '%%' : `\\${char}`)}"`;
+}
+export function systemdUnit(runtime, script, port, configuration) {
+    const config = configuration ? ` --configuration ${systemdQuote(configuration)}` : '';
+    return `[Unit]\nDescription=ours-fleet localhost web console\nAfter=default.target\n\n`
+        + `[Service]\nType=simple\nExecStart=${systemdQuote(runtime)} ${systemdQuote(script)} web serve --port ${port} --no-open${config}\n`
+        + `Restart=on-failure\nRestartSec=5\nTimeoutStopSec=15\n\n`
+        + `[Install]\nWantedBy=default.target\n`;
+}
+const xml = (value) => value.replace(/[&<>"']/g, char => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;',
+}[char]));
+export function launchdPlist(runtime, script, port, configuration) {
+    const config = configuration
+        ? `<string>--configuration</string><string>${xml(configuration)}</string>` : '';
+    return `<?xml version="1.0" encoding="UTF-8"?>\n`
+        + `<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n`
+        + `<plist version="1.0"><dict>\n<key>Label</key><string>${WEB_LAUNCHD_LABEL}</string>\n`
+        + `<key>ProgramArguments</key><array><string>${xml(runtime)}</string><string>${xml(script)}</string><string>web</string>`
+        + `<string>serve</string><string>--port</string><string>${port}</string><string>--no-open</string>${config}</array>\n`
+        + `<key>RunAtLoad</key><true/><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>\n`
+        + `<key>ProcessType</key><string>Background</string>\n</dict></plist>\n`;
+}

package/dist/web/terminal/bridge.d.ts

@@ -0,0 +1,27 @@
+import type { WebSocket } from 'ws';
+import { Tmux } from '../../tmux.js';
+import type { RoleRepository } from '../../application/role-repository.js';
+import type { AuditSink } from '../audit.js';
+type Constructor<T> = new (...args: any[]) => T;
+/** Node exposes these CommonJS xterm packages under `default`; Vite may expose named exports. */
+export declare function resolveModuleConstructor<T>(module: unknown, name: string): Constructor<T>;
+export interface TerminalBridgeManagerOptions {
+    repository: RoleRepository;
+    audit: AuditSink;
+    tmux?: Tmux;
+    maxBridges?: number;
+    graceMs?: number;
+    loadPty?: () => Promise<typeof import('node-pty')>;
+}
+export declare class TerminalBridgeManager {
+    private readonly options;
+    private readonly bridges;
+    private ptyModule?;
+    private ptyError?;
+    constructor(options: TerminalBridgeManagerOptions);
+    available(): Promise<boolean>;
+    diagnostic(): string | undefined;
+    connect(socket: WebSocket, roleId: string, hello: Record<string, unknown>): Promise<void>;
+    close(): Promise<void>;
+}
+export {};