@phnx-labs/agents-cli 1.20.72 → 1.20.74

package/dist/lib/session/discover.js

@@ -14,7 +14,7 @@ import * as readline from 'readline';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import Database from '../sqlite.js';
-import { getAgentsDir, getHistoryDir } from '../state.js';
+import { getAgentsDir, getHistoryDir, getRunsDir } from '../state.js';
 const execFileAsync = promisify(execFile);
 import { AGENTS, agentConfigDirName, getCliVersion } from '../agents.js';
 import { walkForFiles } from '../fs-walk.js';
@@ -65,6 +65,7 @@ export async function discoverSessions(options) {
             // reads to behavioral EDR (CrowdStrike Falcon) as a ransomware-style bulk
             // file-enumeration sweep. Same dirs, same results — just not all at once.
             await scanAgentsBounded(agents, agent => dispatchAgentScan(agent, onProgress));
+            await scanAgentsBounded(agents, agent => scanRoutineArchivesIncremental(agent, onProgress));
             // Seed labels from `agents run --name` handles onto the freshly-scanned
             // rows by id. Runs AFTER the per-agent scans (which applied agent-generated
             // titles via syncLabels), so a real title always wins and the seed only
@@ -163,6 +164,7 @@ function buildQueryOptions(options, agents, opts) {
         limit: opts.includeLimit ? (options?.limit ?? 50) : undefined,
         excludeTeamOrigin: options?.excludeTeamOrigin,
         onlyTeamOrigin: options?.onlyTeamOrigin,
+        origin: options?.origin,
         sortBy: options?.sortBy,
     };
 }
@@ -180,10 +182,14 @@ function normalizeCwd(cwd) {
  */
 export function resolveSessionById(sessions, idQuery) {
     const query = idQuery.toLowerCase();
-    const exact = sessions.filter(s => s.id.toLowerCase() === query || s.shortId.toLowerCase() === query);
+    const exact = sessions.filter(s => s.id.toLowerCase() === query ||
+        s.shortId.toLowerCase() === query ||
+        s.routineRunId?.toLowerCase() === query);
     if (exact.length > 0)
         return exact;
-    return sessions.filter(s => s.id.toLowerCase().startsWith(query) || s.shortId.toLowerCase().startsWith(query));
+    return sessions.filter(s => s.id.toLowerCase().startsWith(query) ||
+        s.shortId.toLowerCase().startsWith(query) ||
+        s.routineRunId?.toLowerCase().startsWith(query));
 }
 // ---------------------------------------------------------------------------
 // Content-index search (FTS5-backed)
@@ -319,6 +325,9 @@ const SESSION_ROOT_SPECS = [
     { agent: 'droid', subdir: 'sessions' },
     { agent: 'kimi', subdir: 'sessions' },
 ];
+function sessionRootSubdir(agent) {
+    return SESSION_ROOT_SPECS.find((spec) => spec.agent === agent)?.subdir ?? null;
+}
 /**
  * The directories `agents sessions` scans for each on-disk session agent,
  * resolved to what exists on this machine. Emitted by `agents sessions --roots
@@ -329,11 +338,113 @@ export function getSessionRoots() {
     const out = [];
     for (const { agent, subdir } of SESSION_ROOT_SPECS) {
         const dirs = getAgentSessionDirs(agent, subdir);
+        dirs.push(...getRoutineArchiveSessionDirs(agent, subdir));
         if (dirs.length > 0)
             out.push({ agent, dirs });
     }
     return out;
 }
+function getRoutineArchiveSessionDirs(agent, subdir) {
+    const runsDir = getRunsDir();
+    if (!fs.existsSync(runsDir))
+        return [];
+    const dirs = [];
+    let jobDirs;
+    try {
+        jobDirs = fs.readdirSync(runsDir, { withFileTypes: true });
+    }
+    catch {
+        return dirs;
+    }
+    for (const jobDir of jobDirs) {
+        if (!jobDir.isDirectory())
+            continue;
+        const jobRunsDir = path.join(runsDir, jobDir.name);
+        let runDirs;
+        try {
+            runDirs = fs.readdirSync(jobRunsDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const runDir of runDirs) {
+            if (!runDir.isDirectory())
+                continue;
+            const dir = path.join(jobRunsDir, runDir.name, 'sessions', agent, subdir);
+            if (fs.existsSync(dir))
+                dirs.push(dir);
+        }
+    }
+    return dirs;
+}
+function routineArchiveInfo(filePath) {
+    const rel = path.relative(getRunsDir(), filePath);
+    if (rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    const parts = rel.split(path.sep);
+    if (parts.length < 6 || parts[2] !== 'sessions')
+        return null;
+    return { jobName: parts[0], runId: parts[1] };
+}
+function decorateRoutineSession(meta, info) {
+    return {
+        ...meta,
+        origin: 'routine',
+        routineName: info.jobName,
+        routineRunId: info.runId,
+        project: info.jobName,
+        label: info.jobName,
+    };
+}
+async function readRoutineArchiveMeta(agent, filePath) {
+    const info = routineArchiveInfo(filePath);
+    if (!info)
+        return null;
+    if (agent === 'claude') {
+        const sessionId = path.basename(filePath).replace(/\.jsonl$/, '');
+        const result = await readClaudeMeta(filePath, sessionId);
+        return result ? { ...result, meta: decorateRoutineSession(result.meta, info) } : null;
+    }
+    if (agent === 'codex') {
+        const result = await readCodexMeta(filePath);
+        return result ? { ...result, meta: decorateRoutineSession(result.meta, info) } : null;
+    }
+    return null;
+}
+async function scanRoutineArchivesIncremental(agent, onProgress) {
+    const subdir = sessionRootSubdir(agent);
+    if (!subdir)
+        return;
+    const ext = agent === 'gemini' ? '.json' : '.jsonl';
+    const filePaths = [];
+    for (const sessionsDir of getRoutineArchiveSessionDirs(agent, subdir)) {
+        for (const fp of walkForFiles(sessionsDir, ext, 100_000))
+            filePaths.push(fp);
+    }
+    const changed = filterChangedFiles(filePaths);
+    if (changed.length === 0)
+        return;
+    onProgress?.({ agent, parsed: 0, total: changed.length });
+    const entries = [];
+    const touched = [];
+    let parsed = 0;
+    for (const { filePath, scan } of changed) {
+        try {
+            const result = await readRoutineArchiveMeta(agent, filePath);
+            if (result)
+                entries.push({ meta: result.meta, content: result.content, scan });
+            else
+                touched.push({ filePath, scan });
+        }
+        catch {
+            touched.push({ filePath, scan });
+        }
+        parsed++;
+        onProgress?.({ agent, parsed, total: changed.length });
+    }
+    upsertSessionsBatch(entries);
+    recordScans(touched);
+}
 // ---------------------------------------------------------------------------
 // Claude account info
 // ---------------------------------------------------------------------------

package/dist/lib/session/stream-render.d.ts

@@ -0,0 +1,3 @@
+import type { SessionAgentId } from './types.js';
+export type StreamLineRenderer = (line: string) => string | null;
+export declare function makeStreamRenderer(agent: SessionAgentId, cwd?: string): StreamLineRenderer;

package/dist/lib/session/stream-render.js

@@ -0,0 +1,130 @@
+import chalk from 'chalk';
+import { truncate } from '../format.js';
+import { parseClaudeContent, parseCodexContent, sanitizeEvents, summarizeToolUse } from './parse.js';
+import { linkPath, relativeToCwd } from './render.js';
+const LINE_MAX = 120;
+function timeOf(event) {
+    const d = new Date(event.timestamp);
+    if (Number.isNaN(d.getTime()))
+        return '00:00:00';
+    return d.toTimeString().slice(0, 8);
+}
+function paintTool(tool) {
+    const label = tool.padEnd(10);
+    if (tool === 'Bash' || tool === 'exec_command')
+        return chalk.yellow(label);
+    if (tool === 'Edit' || tool === 'Write' || tool === 'Read')
+        return chalk.cyan(label);
+    if (tool === 'Agent')
+        return chalk.magenta(label);
+    return chalk.cyan(label);
+}
+function formatPath(absPath, cwd) {
+    const label = relativeToCwd(absPath, cwd);
+    return absPath.startsWith('/') ? linkPath(absPath, label) : label;
+}
+function splitToolSummary(tool, summary, event, cwd) {
+    if (event.path)
+        return formatPath(event.path, cwd);
+    const prefix = `${tool}: `;
+    if (summary.startsWith(prefix))
+        return summary.slice(prefix.length);
+    const spacedPrefix = `${tool} `;
+    if (summary.startsWith(spacedPrefix))
+        return summary.slice(spacedPrefix.length);
+    return summary === tool ? '' : summary;
+}
+function lineCount(text) {
+    if (!text)
+        return 0;
+    return text.split(/\r?\n/).length;
+}
+function plural(n, word) {
+    return `${n} ${word}${n === 1 ? '' : 's'}`;
+}
+function claudeToolResultLines(raw) {
+    if (raw?.type !== 'user' || !Array.isArray(raw?.message?.content))
+        return undefined;
+    const block = raw.message.content.find((b) => b?.type === 'tool_result');
+    if (!block)
+        return undefined;
+    if (typeof block.content === 'string')
+        return lineCount(block.content);
+    if (Array.isArray(block.content)) {
+        const text = block.content
+            .filter((c) => c?.type === 'text')
+            .map((c) => c.text || '')
+            .join('\n');
+        return lineCount(text);
+    }
+    return 0;
+}
+function codexToolResultLines(raw) {
+    if (raw?.type !== 'response_item')
+        return undefined;
+    const ptype = raw?.payload?.type;
+    if (ptype !== 'function_call_output' && ptype !== 'custom_tool_call_output')
+        return undefined;
+    return lineCount(String(raw.payload.output || ''));
+}
+function rawToolResultLines(line, agent) {
+    try {
+        const raw = JSON.parse(line);
+        return agent === 'codex' ? codexToolResultLines(raw) : claudeToolResultLines(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+function renderEvent(event, cwd, lastTool, resultLines) {
+    const prefix = chalk.dim(`${timeOf(event)}  `);
+    switch (event.type) {
+        case 'message': {
+            const marker = event.role === 'user' ? chalk.blue('» you       ') : chalk.green(`· ${event.agent.padEnd(9)}`);
+            return prefix + marker + truncate((event.content || '').replace(/\s+/g, ' ').trim(), LINE_MAX);
+        }
+        case 'tool_use': {
+            const tool = event.tool || 'unknown';
+            const summary = summarizeToolUse(tool, event.args);
+            const detail = splitToolSummary(tool, summary, event, cwd);
+            return prefix + chalk.yellow('→ ') + paintTool(tool) + chalk.gray(truncate(detail.replace(/\s+/g, ' ').trim(), LINE_MAX));
+        }
+        case 'tool_result': {
+            const tool = event.tool || lastTool || 'tool';
+            const count = resultLines ?? lineCount(event.output || '');
+            const status = event.success === false ? chalk.red('✗ ') : chalk.green('✓ ');
+            return prefix + status + paintTool(tool) + chalk.dim(`(result elided — ${plural(count, 'line')})`);
+        }
+        case 'error': {
+            const label = event.tool ? `${event.tool}: ` : '';
+            return prefix + chalk.red('✗ Error     ') + chalk.gray(truncate((label + (event.content || '')).replace(/\s+/g, ' ').trim(), LINE_MAX));
+        }
+        case 'thinking':
+        case 'usage':
+        case 'init':
+        case 'result':
+            return null;
+        default:
+            return null;
+    }
+}
+export function makeStreamRenderer(agent, cwd) {
+    const parse = agent === 'codex' ? parseCodexContent : parseClaudeContent;
+    let lastTool;
+    return (line) => {
+        const events = parse(line);
+        sanitizeEvents(events);
+        if (events.length === 0)
+            return null;
+        const resultLines = rawToolResultLines(line, agent);
+        const rendered = [];
+        for (const event of events) {
+            const out = renderEvent(event, cwd, lastTool, resultLines);
+            if (event.type === 'tool_use' && event.tool)
+                lastTool = event.tool;
+            if (out)
+                rendered.push(out);
+        }
+        return rendered.length ? rendered.join('\n') : null;
+    };
+}

package/dist/lib/session/types.d.ts

@@ -76,6 +76,12 @@ export interface SessionMeta {
     id: string;
     shortId: string;
     agent: SessionAgentId;
+    /** Where the indexed transcript came from. Routine rows are archived from a run directory. */
+    origin?: 'cli' | 'routine';
+    /** Routine name for transcripts archived from ~/.agents/.history/runs/<name>/<runId>/. */
+    routineName?: string;
+    /** Routine run id for transcripts archived from ~/.agents/.history/runs/<name>/<runId>/. */
+    routineRunId?: string;
     timestamp: string;
     /**
      * Last-activity time (ISO): the last message timestamp when a parser computed

package/dist/lib/share/analytics.d.ts

@@ -0,0 +1,13 @@
+/** Cloudflare Web Analytics snippet for a given zone token. */
+export declare function renderBeacon(token: string): string;
+/**
+ * Inject the CF Web Analytics beacon into an HTML page. Idempotent: any existing
+ * agents-share analytics block is removed first. The snippet is appended before
+ * `</body>` when present, otherwise before `</head>`, otherwise prepended to the
+ * document so it still loads.
+ */
+export declare function injectAnalyticsBeacon(html: string, token: string): string;
+/** True if the share config has a non-empty analytics token. */
+export declare function analyticsEnabled(cfg: {
+    analyticsToken?: string;
+} | undefined | null): boolean;

package/dist/lib/share/analytics.js

@@ -0,0 +1,45 @@
+// Cloudflare Web Analytics injection for `agents share`.
+//
+// The beacon is cookieless and privacy-first, which matters because a lot of shared
+// content (games, kid-facing pages) should avoid GA4-style tracking. The token is
+// stored in the synced share config and injected into every published HTML page at
+// publish time, so analytics work with zero user effort once setup is complete.
+const BEACON_OPEN = '<!-- agents-share:analytics -->';
+const BEACON_CLOSE = '<!-- /agents-share:analytics -->';
+/** Cloudflare Web Analytics snippet for a given zone token. */
+export function renderBeacon(token) {
+    const payload = JSON.stringify({ token });
+    return (`${BEACON_OPEN}\n` +
+        '<script defer ' +
+        'src="https://static.cloudflareinsights.com/beacon.min.js" ' +
+        `data-cf-beacon='${payload}'></script>\n` +
+        `${BEACON_CLOSE}\n`);
+}
+/** Strip a previously-injected analytics block so re-publishing doesn't duplicate it. */
+function stripPrevious(html) {
+    const re = new RegExp(`${BEACON_OPEN}[\\s\\S]*?${BEACON_CLOSE}\\n?`, 'g');
+    return html.replace(re, '');
+}
+/**
+ * Inject the CF Web Analytics beacon into an HTML page. Idempotent: any existing
+ * agents-share analytics block is removed first. The snippet is appended before
+ * `</body>` when present, otherwise before `</head>`, otherwise prepended to the
+ * document so it still loads.
+ */
+export function injectAnalyticsBeacon(html, token) {
+    if (!token)
+        return html;
+    const cleaned = stripPrevious(html);
+    const block = renderBeacon(token);
+    const bodyClose = cleaned.search(/<\/body>/i);
+    if (bodyClose !== -1)
+        return cleaned.slice(0, bodyClose) + block + cleaned.slice(bodyClose);
+    const headClose = cleaned.search(/<\/head>/i);
+    if (headClose !== -1)
+        return cleaned.slice(0, headClose) + block + cleaned.slice(headClose);
+    return block + cleaned;
+}
+/** True if the share config has a non-empty analytics token. */
+export function analyticsEnabled(cfg) {
+    return Boolean(cfg?.analyticsToken && cfg.analyticsToken.trim().length > 0);
+}

package/dist/lib/share/config.d.ts

@@ -6,12 +6,18 @@ export interface ShareConfig {
     bucketName: string;
     /** Custom domain when mapped (e.g. `share.agents-cli.sh`). */
     domain?: string;
+    /** Cloudflare Web Analytics token injected into published HTML pages. */
+    analyticsToken?: string;
 }
 export declare const SHARE_BUNDLE = "share";
-export declare const SHARE_TOKEN_KEY = "SHARE_WRITE_TOKEN";
-export declare const DEFAULT_CF_BUNDLE = "cloudflare.com";
+export declare const SHARE_TOKEN_KEY = "WRITE_TOKEN";
+export declare const SHARE_TOKEN_ENV_KEY = "SHARE_WRITE_TOKEN";
+export declare const DEFAULT_CF_BUNDLE = "cloudflare";
 export declare const DEFAULT_WORKER_NAME = "agents-share";
 export declare const DEFAULT_BUCKET_NAME = "agents-share";
+export declare const DEFAULT_SHARE_DOMAIN = "share.agents-cli.sh";
+/** The write token may be injected ephemerally into fleet/cloud agents. */
+export declare function readWriteTokenEnv(env?: NodeJS.ProcessEnv): string | null;
 /** Read the persisted endpoint config, or null if `agents share setup`/`join` never ran. */
 export declare function readShareConfig(): ShareConfig | null;
 /** Persist the endpoint config to `agents.yaml` (syncs across the fleet). */
@@ -21,10 +27,18 @@ export declare function generateWriteToken(): string;
 /** Persist the raw write token into the `share` secrets bundle (keychain-backed,
  * fleet-injectable). Mirrors the add-key sequence in `commands/secrets.ts`. */
 export declare function storeWriteToken(token: string): void;
-/** Read the raw write token from the `share` secrets bundle. Throws with an
- * actionable message if absent (run setup/join first). */
+/** Read the raw write token from the `share` secrets bundle. */
+export declare function readWriteTokenFromBundle(): string;
+/** Read the raw write token from injected env first, then the local bundle.
+ * Throws with an actionable message if absent (run setup/join first). */
 export declare function readWriteToken(): string;
-/** Cloudflare API credentials for provisioning, read from `cloudflare.com` (or a
+/** Best-effort runtime env for spawned agents. Never throws: a missing/locked
+ * bundle should not block unrelated agent runs, but an already-unlocked bundle
+ * or injected token lets ephemeral agents publish with no local setup. */
+export declare function shareRuntimeEnv(opts?: {
+    agentOnly?: boolean;
+}): Record<string, string> | undefined;
+/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
  * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
 export declare function readCloudflareCreds(bundle?: string, override?: {
     apiToken?: string;

package/dist/lib/share/config.js

@@ -6,16 +6,23 @@
 // - The raw write token lives in the `share` secrets bundle (keychain-backed,
 //   fleet-injectable) — never on disk in plaintext.
 // - The Cloudflare API token (for provisioning) is read from the user's existing
-//   `cloudflare.com` bundle.
+//   `cloudflare` bundle.
 import { randomBytes } from 'node:crypto';
 import { readMeta, updateMeta } from '../state.js';
-import { bundleItemStore, bundlePolicy, isHeadlessSecretsContext, keychainRef, readAndResolveBundleEnv, readBundle, writeBundle, } from '../secrets/bundles.js';
+import { bundleExists, bundleItemStore, bundlePolicy, isHeadlessSecretsContext, keychainRef, readAndResolveBundleEnv, readBundle, writeBundle, } from '../secrets/bundles.js';
 import { secretsKeychainItem } from '../secrets/index.js';
 export const SHARE_BUNDLE = 'share';
-export const SHARE_TOKEN_KEY = 'SHARE_WRITE_TOKEN';
-export const DEFAULT_CF_BUNDLE = 'cloudflare.com';
+export const SHARE_TOKEN_KEY = 'WRITE_TOKEN';
+export const SHARE_TOKEN_ENV_KEY = 'SHARE_WRITE_TOKEN';
+export const DEFAULT_CF_BUNDLE = 'cloudflare';
 export const DEFAULT_WORKER_NAME = 'agents-share';
 export const DEFAULT_BUCKET_NAME = 'agents-share';
+export const DEFAULT_SHARE_DOMAIN = 'share.agents-cli.sh';
+/** The write token may be injected ephemerally into fleet/cloud agents. */
+export function readWriteTokenEnv(env = process.env) {
+    const token = env[SHARE_TOKEN_ENV_KEY]?.trim();
+    return token ? token : null;
+}
 /** Read the persisted endpoint config, or null if `agents share setup`/`join` never ran. */
 export function readShareConfig() {
     const s = readMeta().share;
@@ -27,6 +34,7 @@ export function readShareConfig() {
         workerName: s.workerName,
         bucketName: s.bucketName,
         domain: s.domain,
+        analyticsToken: s.analyticsToken,
     };
 }
 /** Persist the endpoint config to `agents.yaml` (syncs across the fleet). */
@@ -56,9 +64,8 @@ export function storeWriteToken(token) {
     bundle.vars[SHARE_TOKEN_KEY] = keychainRef(SHARE_TOKEN_KEY);
     writeBundle(bundle);
 }
-/** Read the raw write token from the `share` secrets bundle. Throws with an
- * actionable message if absent (run setup/join first). */
-export function readWriteToken() {
+/** Read the raw write token from the `share` secrets bundle. */
+export function readWriteTokenFromBundle() {
     const { env } = readAndResolveBundleEnv(SHARE_BUNDLE, {
         caller: 'share',
         agentOnly: isHeadlessSecretsContext(),
@@ -70,7 +77,36 @@ export function readWriteToken() {
     }
     return token;
 }
-/** Cloudflare API credentials for provisioning, read from `cloudflare.com` (or a
+/** Read the raw write token from injected env first, then the local bundle.
+ * Throws with an actionable message if absent (run setup/join first). */
+export function readWriteToken() {
+    return readWriteTokenEnv() ?? readWriteTokenFromBundle();
+}
+/** Best-effort runtime env for spawned agents. Never throws: a missing/locked
+ * bundle should not block unrelated agent runs, but an already-unlocked bundle
+ * or injected token lets ephemeral agents publish with no local setup. */
+export function shareRuntimeEnv(opts = {}) {
+    if (!readShareConfig())
+        return undefined;
+    const fromEnv = readWriteTokenEnv();
+    if (fromEnv)
+        return { [SHARE_TOKEN_ENV_KEY]: fromEnv };
+    try {
+        if (!bundleExists(SHARE_BUNDLE))
+            return undefined;
+        const { env } = readAndResolveBundleEnv(SHARE_BUNDLE, {
+            caller: 'share',
+            keys: [SHARE_TOKEN_KEY],
+            agentOnly: opts.agentOnly,
+        });
+        const token = env[SHARE_TOKEN_KEY];
+        return token ? { [SHARE_TOKEN_ENV_KEY]: token } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Cloudflare API credentials for provisioning, read from `cloudflare` (or a
  * user-named bundle). Fuzzy-matches key names so it works across bundle layouts. */
 export function readCloudflareCreds(bundle = DEFAULT_CF_BUNDLE, override) {
     // Explicit --token/--account bypass the bundle entirely (robust escape hatch).

package/dist/lib/share/provision.d.ts

@@ -1,10 +1,62 @@
+export declare const SHARE_LIFECYCLE_RULE_ID = "agents-share-expire-objects";
+export declare const SHARE_LIFECYCLE_RETENTION_DAYS = 366;
+interface R2LifecycleRule {
+    id: string;
+    enabled: boolean;
+    conditions: {
+        prefix: string;
+    };
+    deleteObjectsTransition?: {
+        condition: {
+            type: 'Age';
+            maxAge: number;
+        } | {
+            type: 'Date';
+            date: string;
+        };
+    };
+    abortMultipartUploadsTransition?: {
+        condition?: {
+            type: 'Age';
+            maxAge: number;
+        };
+    };
+    storageClassTransitions?: Array<{
+        condition: {
+            type: 'Age';
+            maxAge: number;
+        } | {
+            type: 'Date';
+            date: string;
+        };
+        storageClass: 'InfrequentAccess';
+    }>;
+}
+export interface CloudflareRequest {
+    apiToken: string;
+    method: string;
+    pathname: string;
+    body?: unknown;
+    form?: FormData;
+}
+export type CloudflareRequester = <T = unknown>(request: CloudflareRequest) => Promise<T>;
+interface ProvisionOptions {
+    request?: CloudflareRequester;
+}
 /** Create the R2 bucket (idempotent). */
-export declare function createBucket(apiToken: string, accountId: string, name: string): Promise<void>;
-/** Upload the module Worker with an R2 binding (`BUCKET`) + inline `WRITE_TOKEN` secret. */
-export declare function deployWorker(apiToken: string, accountId: string, workerName: string, script: string, bucketName: string, writeToken: string): Promise<void>;
+export declare function createBucket(apiToken: string, accountId: string, name: string, opts?: ProvisionOptions): Promise<void>;
+export declare function buildShareLifecycleRule(days?: number): R2LifecycleRule;
+export declare function mergeShareLifecycleRule(existing?: R2LifecycleRule[], rule?: R2LifecycleRule): R2LifecycleRule[];
+/** Ensure the share bucket self-cleans old objects. Exact per-link expiry is enforced by the Worker. */
+export declare function configureBucketLifecycle(apiToken: string, accountId: string, bucketName: string, opts?: ProvisionOptions): Promise<void>;
+/** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
+export declare function deployWorker(apiToken: string, accountId: string, workerName: string, script: string, bucketName: string, opts?: ProvisionOptions): Promise<void>;
+/** Add/update the WRITE_TOKEN binding using Cloudflare's Workers Secrets API. */
+export declare function setWorkerSecret(apiToken: string, accountId: string, workerName: string, writeToken: string, opts?: ProvisionOptions): Promise<void>;
 /** Enable the free `*.workers.dev` route for the script, and return the account subdomain. */
-export declare function enableWorkersDev(apiToken: string, accountId: string, workerName: string): Promise<string>;
+export declare function enableWorkersDev(apiToken: string, accountId: string, workerName: string, opts?: ProvisionOptions): Promise<string>;
 /** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
-export declare function findZoneId(apiToken: string, domain: string): Promise<string | null>;
+export declare function findZoneId(apiToken: string, domain: string, opts?: ProvisionOptions): Promise<string | null>;
 /** Map a custom hostname (e.g. `share.agents-cli.sh`) to the Worker via Workers Custom Domains. */
-export declare function addCustomDomain(apiToken: string, accountId: string, workerName: string, zoneId: string, hostname: string): Promise<void>;
+export declare function addCustomDomain(apiToken: string, accountId: string, workerName: string, zoneId: string, hostname: string, opts?: ProvisionOptions): Promise<void>;
+export {};