@quantiya/codevibe-codex-plugin 2.0.64 → 2.0.65

package/node_modules/@quantiya/codevibe-core/dist/appsync/appsync-client.d.ts

@@ -1,5 +1,20 @@
 import WebSocket from 'ws';
 import { type Environment } from '../config';
+import { type CompanionSyncState } from './sync-state';
+import { type SyncSecurityPosture, type SyncSecurityPostureReceipt } from './sync-security-posture';
+import { type WorkspaceOutcomeReceipt, type WorkspaceOutcomeSubmissionOptions } from './sync-workspace-outcome';
+import { DurableDesktopSyncWriter, type DesktopSyncSessionScope } from './sync-operation-journal';
+import { DesktopSyncReadClient } from './sync-read-client';
+import { DesktopSyncLiveConnection } from './sync-live-connection';
+import { type DurableDesktopSyncReader } from './sync-desktop-registration';
+import type { PromptReRaiseDisposition } from './sync-prompt-retention';
+import { type ResolveDesktopSyncPromptInput, type SyncPromptResolutionReceipt } from './sync-prompt-resolution';
+import { type ConfirmDesktopSyncRetirementInput, type SyncSessionRetirementReceipt } from './sync-session-retirement';
+import { type ToolActivitySyncEncryption } from '../tool-activity/sync-transport';
+import type { ToolActivityTransport } from '../tool-activity/consolidator';
+import { ToolActivityOutbox } from '../tool-activity/outbox';
+import type { ToolActivityLedger } from '../tool-activity/ledger';
+import { type CreateDesktopSyncEventInput, type UpdateDesktopSyncEventInput, type SyncEventReceipt, type UpdateDesktopSyncStatusInput, type SyncStatusReceipt, type SyncPromptRetentionReceipt } from './sync-event-client';
 import { CreateEventInput, CreateSessionInput, UpdateSessionInput, UpdateEventStatusInput, Event, Session, EventSource, DeviceKey, GrantSessionKeyInput, UpdateReviewerPolicyInput, UserReviewerPolicySnapshot } from '../types';
 import type { PostDecisionAction } from '../orchestration-shell/types';
 import type { InvocationUsageSnapshot } from '../reviewer/token-usage';
@@ -317,6 +332,8 @@ export interface TaskReviewSummaryQuorum {
     seats: TaskReviewSummaryQuorumSeat[];
     roundCount: number;
     revisionCount: number;
+    approvalRule?: string;
+    autoRevisionLimit?: number;
 }
 export interface TaskReviewSummaryMergeGate {
     applicable: boolean;
@@ -418,6 +435,7 @@ export interface DownloadUrlResponse {
  * the message is unchanged ("GraphQL error: <message>").
  */
 export declare class AppSyncGraphQLError extends Error {
+    readonly responseMessage: string;
     readonly errorType?: string;
     readonly extensions?: unknown;
     readonly path?: unknown;
@@ -529,15 +547,27 @@ export declare function isRecognizedNonProductionEnvironment(env?: NodeJS.Proces
  * Any invalid, out-of-bounds, non-integer, or non-finite value safely defaults to DEFAULT_HEARTBEAT_INTERVAL_MS.
  */
 export declare function resolveHeartbeatIntervalMs(override?: number, env?: NodeJS.ProcessEnv): number;
-/**
- * AppSync GraphQL client with WebSocket subscriptions
- */
+/** Programmatic producer result, not a fabricated Event. Only ACCEPTED has an
+ * actual event identity; a V2 acceptance also carries its canonical receipt. */
+export type CompanionEventPublication = {
+    status: 'ACCEPTED';
+    eventId: string;
+    receipt?: SyncEventReceipt;
+} | {
+    status: 'OMITTED' | 'PENDING' | 'DROPPED' | 'SETTLED';
+};
+/** AppSync GraphQL client with WebSocket subscriptions. */
 export declare class AppSyncClient {
     #private;
     private authenticated;
     private currentUserId;
     private currentEmail;
     private tokens;
+    private syncDisplayEpoch;
+    private syncDisplaySequence;
+    private syncDisplayAppliedSequence;
+    private syncDisplay;
+    private syncDisplayListeners;
     private activeSubscriptions;
     /**
      * Set by `authenticateWithStoredTokens()` on every false-return path
@@ -709,6 +739,251 @@ export declare class AppSyncClient {
      * Make a GraphQL request
      */
     private graphqlRequest;
+    /** Small control receipts cannot turn an untrusted response into an
+     * unbounded allocation. Applied only to explicitly bounded query callers. */
+    private boundedGraphQLJson;
+    private assertSyncAccount;
+    /** Bounded cloud routing/usage read, pinned to the current account. No fallback. */
+    getCompanionSyncState(signal?: AbortSignal): Promise<CompanionSyncState>;
+    /** Subscribe to validated reads already performed by this client. No new
+     * request, persistent journal, producer grant or retry is created here. */
+    subscribeCompanionSyncState(userId: string, listener: (state: CompanionSyncState | null) => void): () => void;
+    /** Synchronous display snapshot for local /status. Never starts cloud I/O,
+     * grants admission, or exposes another account's last observation. */
+    companionSyncStatusSnapshot(userId: string): CompanionSyncState | null;
+    /** Existing socket maintenance recovers idle status after its cloud cache
+     * expires. This is display-only; admissions never use the cached result. */
+    private refreshCompanionSyncDisplayOnMaintenance;
+    private notifyCompanionSyncDisplay;
+    private resetCompanionSyncDisplay;
+    private publishCompanionSyncDisplay;
+    /** Signed closed safety fact, independent of customer event quota. Only an
+     * affirmative cloud LEGACY selection permits the caller's legacy sink.
+     * Success confirms canonical persistence, never phone/render delivery. */
+    reportSecurityPostureIfSelected(sessionScope: {
+        sessionId: string;
+        sessionGenerationId?: string | null;
+        sessionKeyGen?: string;
+    }, posture: SyncSecurityPosture, signal?: AbortSignal): Promise<SyncSecurityPostureReceipt | null>;
+    /** Explicit bounded read plane. No registration, paging or legacy fallback
+     * occurs at construction; lifecycle owners persist and supply credentials. */
+    desktopSyncReadClient(sessionScope: DesktopSyncSessionScope, signal?: AbortSignal): Promise<DesktopSyncReadClient>;
+    /** Session owners keep this object, close/join it before hosted retirement,
+     * then retire its exact registration. No in-memory-only credential shortcut. */
+    desktopSyncReadSession(options: DesktopSyncSessionScope & {
+        root?: string;
+    }, signal?: AbortSignal): Promise<DurableDesktopSyncReader>;
+    /** One signed data-plane socket, with caller-owned close/join. The default
+     * subscribeToEvents path below uses this same factory for all providers. */
+    desktopSyncLiveSession(options: DesktopSyncSessionScope & {
+        root?: string;
+    }, onEvent: (event: Event) => Promise<void> | void, onError: (error: Error) => void, signal?: AbortSignal): Promise<DesktopSyncLiveConnection>;
+    private syncEventForConsumer;
+    retireDesktopSyncRegistration(options: DesktopSyncSessionScope & {
+        root?: string;
+    }, retired: Session): Promise<boolean>;
+    /** Explicit metered route; no legacy fallback, synthetic Event or local quota authority. */
+    desktopSyncWriter(options?: {
+        root?: string;
+        sessionScope?: DesktopSyncSessionScope;
+    }): DurableDesktopSyncWriter;
+    /** Closed metered tool producer; native source settlement owns journal acknowledgment. */
+    toolActivitySyncTransport(options: {
+        root?: string;
+        sessionScope: DesktopSyncSessionScope;
+        getEncryptionContext(): Promise<ToolActivitySyncEncryption>;
+    }): ToolActivityTransport;
+    private readonly companionNoticeOwners;
+    private companionNoticeOwner;
+    private closeCompanionNoticeOwners;
+    /** One invocation is one NEW synthetic notice, not a native-record retry.
+     * Callers must not re-invoke after PENDING: the encrypted prepared source now
+     * owns retry/settlement. No Event is fabricated for pending or quota omission.
+     * Retryable native/domain producers use their existing occurrence owners.
+     */
+    publishCompanionNotice(value: CreateEventInput, legacy: () => Promise<boolean>, options?: {
+        root?: string;
+    }): Promise<'ACCEPTED' | 'OMITTED' | 'PENDING' | 'DROPPED' | 'SETTLED'>;
+    /** One call admits one NEW ordinary desktop event. The source retains its
+     * operation through cloud retry/restart. PENDING/SETTLED are not permission
+     * for the caller to submit the payload again as another occurrence.
+     * E1/domain controls and consolidated tool windows use their own producers. */
+    publishCompanionEvent(value: CreateEventInput, legacy: () => Promise<{
+        eventId: string;
+    } | null>, options?: {
+        root?: string;
+        assertOwner?: () => void;
+    }): Promise<CompanionEventPublication>;
+    private publishCompanionOccurrence;
+    /** Recover native-source operations without a current Session, key-generation
+     * lookup or protocol selection. The saved cursor supplies the exact original
+     * incarnation; recovery cannot re-encrypt or migrate it to a replacement.
+     */
+    recoverCompanionSyncSources(options: {
+        sessionId: string;
+        root?: string;
+    }, signal?: AbortSignal): Promise<number>;
+    /** Recover the shell's prepared source in its ORIGINAL session generation.
+     * No live Session/key/protocol lookup may reinterpret an already sealed event.
+     * The source owns settlement/ack; ordinary journal inventory is never swept.
+     */
+    recoverShellSyncSources(options: {
+        sessionId: string;
+        root?: string;
+    }, signal?: AbortSignal): Promise<number>;
+    /** Shared shell/notice payload recovery; no live route or key selection. */
+    private recoverPreparedCompanionEvents;
+    /** The caller supplies the actual updateSession(INACTIVE) result only after
+     * its local producers are quiescent. A missing/foreign/generationless result
+     * is not deletion authority. Empty source only; unresolved writes survive. */
+    retireEmptyShellSyncSource(options: DesktopSyncSessionScope & {
+        root?: string;
+    }, retired: Session): Promise<boolean>;
+    /** Recover only previously sealed operations before live protocol selection. */
+    recoverToolActivityWindows(options: {
+        sessionId: string;
+        root?: string;
+        outbox: ToolActivityOutbox;
+        ledger: ToolActivityLedger;
+    }): Promise<void>;
+    /**
+     * Provider startup uses cloud routing, never a local tier/flag or an error
+     * fallback. A transport is generation-bound for its entire lifetime. Cutover
+     * and rollback must drain/restart the producer; they cannot reinterpret its
+     * sealed source windows as a different protocol.
+     */
+    selectToolActivityTransport(options: {
+        sessionId: string;
+        root?: string;
+        legacyTransport: ToolActivityTransport;
+    }): Promise<ToolActivityTransport>;
+    /** Shared cloud-selected authority for tools and ordinary native sources. */
+    selectCompanionSourceTransport(options: {
+        sessionId: string;
+        root?: string;
+    }): Promise<{
+        protocol: 'LEGACY';
+    } | {
+        protocol: 'SYNC_V2';
+        sessionScope: Readonly<DesktopSyncSessionScope>;
+        writer: DurableDesktopSyncWriter;
+        getEncryptionContext(): Promise<ToolActivitySyncEncryption>;
+        prepareEvent(input: CreateEventInput, operationId: string): Promise<CreateDesktopSyncEventInput>;
+    }>;
+    /** Shared E1 producer adapter. The legacy encryption factory runs only after
+     * affirmative cloud LEGACY selection. V2 encrypts inside the durable source
+     * factory and never maps a quota omission to a successful cloud publication. */
+    publishCompanionPrompt(value: CreateEventInput, legacy: () => Promise<boolean>, options?: {
+        root?: string;
+        reRaiseToken?: string;
+    }): Promise<PromptReRaiseDisposition>;
+    /** Caller first stops this prompt's local producer and joins its publications.
+     * Recover the exact saved episode before the owner-token delete, including a
+     * lost ACK whose marker already exists. Settlement needs no route/key lookup;
+     * cloud routing selects the resolution protocol without a current Session.
+     * A failed/ambiguous step retains every source record.
+     * This is control-only and remains usable after new-sync admission closes. */
+    resolveCompanionPrompt(value: {
+        sessionId: string;
+        promptId: string;
+        ownerToken: string;
+        resolutionAt?: string;
+    }, options?: {
+        root?: string;
+    }): Promise<boolean>;
+    /** Core resolution carries the generation already bound to the session
+     * owner. Never fetch a newer Session/key to clear an older offer. */
+    resolveCoreOfferPrompt(value: {
+        sessionId: string;
+        promptId: string;
+        sessionGenerationId?: string | null;
+        sessionKeyGen?: string | null;
+    }, legacy: () => Promise<boolean>, options?: {
+        root?: string;
+    }): Promise<boolean>;
+    private resolvePromptByProtocol;
+    private finishPromptResolution;
+    /** Explicit session-owned restart recovery. Inventory is bounded by the
+     * account store's 256-file cap; empty inventory does no cloud I/O. Reuses
+     * original ownership/generation, not current Session or encryption state.
+     * No failure/age/quota condition deletes an outstanding intent. */
+    recoverPromptResolutions(options: {
+        sessionId: string;
+        root?: string;
+    }, signal?: AbortSignal): Promise<number>;
+    /** Local recovery ordering shared by owner-token plugin and signed core-offer
+     * resolution. The caller quiesces this exact prompt before entry, then uses
+     * its existing domain authority to obtain a validated resolution ACK. This
+     * method grants no backend authority and creates no new visible occurrence.
+     * False, thrown or account-switched acknowledgements retain the source. */
+    resolvePromptPublication(value: {
+        sessionId: string;
+        promptId: string;
+    }, resolve: (hasV2Publication: boolean) => Promise<boolean>, options?: {
+        root?: string;
+        signal?: AbortSignal;
+    }): Promise<boolean>;
+    /** Wire-only primitive. Durable producers use desktopSyncWriter(). */
+    createDesktopSyncEvent(input: CreateDesktopSyncEventInput, signal?: AbortSignal): Promise<SyncEventReceipt>;
+    updateDesktopSyncEvent(input: UpdateDesktopSyncEventInput, signal?: AbortSignal): Promise<SyncEventReceipt>;
+    /** Explicit cloud proof of permanent generation closure. No current Session
+     * or session encryption-key lookup, journal deletion or delivery inference. */
+    confirmDesktopSyncRetirement(input: ConfirmDesktopSyncRetirementInput, signal?: AbortSignal): Promise<SyncSessionRetirementReceipt>;
+    /** Explicit terminal owner boundary. quiesce must stop AND join native,
+     * shell, prompt and source-recovery producers; a daemon handoff is not a
+     * terminal retirement. Missing/failed cloud proof retains every source.
+     * This does not retire hosted state or sweep tool/control journals. */
+    retireDesktopSyncSources(options: DesktopSyncSessionScope & {
+        expectedSessionKeyGen: string;
+        root?: string;
+    }, quiesce: () => Promise<void>, signal?: AbortSignal): Promise<{
+        sourcesRemoved: number;
+        operationsRemoved: number;
+    }>;
+    private quiesceDesktopSyncSession;
+    /** Called only by a terminal owner after its actual INACTIVE mutation. A
+     * heartbeat, mobile-end notification, bootstrap cancellation or handoff does
+     * not by itself establish local producer quiescence. Old source links are
+     * collected before control-intent ACKs, so resolution never replays retired
+     * Events. A lost control ACK keeps the independent intent for retry. */
+    completeDesktopSyncRetirement(options: {
+        sessionId: string;
+        root?: string;
+        toolOutbox?: ToolActivityOutbox;
+    }, retired: Session, quiesce: () => Promise<void>, signal?: AbortSignal): Promise<{
+        sourcesRemoved: number;
+        operationsRemoved: number;
+    }>;
+    /** No Session fetch, live key lookup, native-process operation or re-homing.
+     * The encrypted intent records a completed producer join; fresh cloud proof
+     * still gates each payload cleanup. Independent failed intents remain local. */
+    recoverSessionRetirements(options?: {
+        root?: string;
+    }, signal?: AbortSignal): Promise<{
+        completed: number;
+        deferred: number;
+    }>;
+    private readonly sessionRetirementRecoveryPasses;
+    private recoverSessionRetirementsOnce;
+    private finishRecordedSessionRetirement;
+    /** Wire-only PROMPT_OWNERSHIP transition. It cannot create an Event. Plugin
+     * preimage authority does not require the retired Session's encryption key;
+     * core authority signs the exact bound generation with the device key. */
+    resolveDesktopSyncPrompt(input: ResolveDesktopSyncPromptInput, signal?: AbortSignal): Promise<SyncPromptResolutionReceipt>;
+    /** Monotonic control transition; safe retry means re-read canonical status,
+     * not retrying the provider input or manufacturing a full Event response. */
+    updateDesktopSyncEventStatus(input: UpdateDesktopSyncStatusInput, signal?: AbortSignal): Promise<SyncStatusReceipt>;
+    /** One budgeted liveness operation, never a legacy fallback. The producer
+     * must persist each receipt/progress before advancing its refresh batch. */
+    refreshDesktopSyncPrompt(promptId: string, signal?: AbortSignal): Promise<SyncPromptRetentionReceipt>;
+    /** Producer-facing batch: V2 keeps exact per-incarnation progress; the
+     * legacy protocol retains its existing chunked endpoint until cutover. */
+    refreshSessionOpenPromptTtl(options: {
+        sessionId: string;
+        promptIds: readonly string[];
+        root?: string;
+    }, reRaise: (promptId: string, reRaiseToken?: string) => Promise<PromptReRaiseDisposition>): Promise<void>;
+    private mutateDesktopSyncEvent;
     /**
      * Create a session
      */
@@ -737,6 +1012,11 @@ export declare class AppSyncClient {
      * Get a session
      */
     getSession(sessionId: string): Promise<Session | null>;
+    /** The workspace owner retains its existing durable outbox. Never put a
+     * second journal around it, re-encrypt it, or choose the current generation.
+     * Quota omission is a canonical ACK, not a synthetic Event or a retry queue.
+     */
+    submitWorkspaceOutcome(value: CreateEventInput, options?: WorkspaceOutcomeSubmissionOptions): Promise<WorkspaceOutcomeReceipt>;
     /**
      * Create an event
      */
@@ -754,7 +1034,7 @@ export declare class AppSyncClient {
     /**
      * Update event status
      */
-    updateEventStatus(input: UpdateEventStatusInput): Promise<Event>;
+    updateEventStatus(value: UpdateEventStatusInput, requiredInput?: Pick<SyncStatusReceipt, 'sessionGenerationId'> & Partial<Pick<SyncStatusReceipt, 'type'>>, signal?: AbortSignal): Promise<Event | SyncStatusReceipt>;
     /**
      * List events for a session
      */
@@ -903,13 +1183,13 @@ export declare class AppSyncClient {
     /**
      * Fetch the user's subscription tier + status. Used by the Phase 3.a
      * setup wizard (#190) at bootstrap to gate Free → upgrade interstitial
-     * and to size the seat budget (Pro=2, Max=3).
+     * and to bound the panel (Pro=1, Max=1–2; Max defaults to 2).
      *
      * Backend resolver returns a default FREE row when the user has no
      * Users-table entry yet (Lambda resolver — lambda/subscription/index.ts).
      * Network failure / auth expiry surface as graphqlRequest exceptions.
      */
-    getSubscriptionStatus(): Promise<{
+    getSubscriptionStatus(signal?: AbortSignal): Promise<{
         tier: 'FREE' | 'PRO' | 'MAX';
         status: 'ACTIVE' | 'EXPIRED' | 'GRACE_PERIOD' | 'BILLING_RETRY';
         expiresAt: string | null;
@@ -1090,10 +1370,12 @@ export declare class AppSyncClient {
         promptId: string;
         decisionAttemptId: string;
     }): Promise<DecisionAttemptResult>;
-    /** Owner-scoped durable resolution point read for receipt recovery. */
+    /** Cloud-selected recovery protocol. V2 requires the session owner's known
+     * generation and never falls back to a live Session lookup or legacy Event. */
     getGateResolution(input: {
         sessionId: string;
         promptId: string;
+        sessionGenerationId?: string;
     }): Promise<unknown>;
     applyUserDecision(input: {
         gateId: string;
@@ -1457,10 +1739,21 @@ export declare class AppSyncClient {
     }): Promise<{
         rows: Array<Record<string, unknown>>;
     }>;
+    private readonly syncSubscriptionClosures;
+    private readonly syncReadOwners;
+    private syncReadEpoch;
+    private readonly syncRetiringSessions;
+    private readonly syncRegistrations;
+    private assertSyncReadAdmission;
+    private rememberSyncRegistration;
+    private ownSyncReader;
+    private trackSyncClosure;
+    private joinSyncSubscriptionClosures;
+    private syncHistoryForSession;
     /**
      * Subscribe to events for a session
      */
-    subscribeToEvents(sessionId: string, onEvent: (event: Event) => void, onError?: (error: Error) => void, options?: {
+    subscribeToEvents(sessionId: string, onEvent: (event: Event) => Promise<void> | void, onError?: (error: Error) => void, options?: {
         receiveDesktopEvents?: boolean;
         onSupervisionEvent?: (event: Event) => void;
         onSubscribed?: (isReconnect: boolean) => void;
@@ -1493,6 +1786,7 @@ export declare class AppSyncClient {
      * Create WebSocket subscription
      */
     private createSubscription;
+    private createLegacySubscription;
     private handleSubscriptionStartAck;
     /**
      * Send subscription start message

package/node_modules/@quantiya/codevibe-core/dist/appsync/index.d.ts

@@ -1,7 +1,31 @@
 export { AppSyncClient, AppSyncAuthenticationError, AppSyncGraphQLError, DownloadUrlResponse, resolveHeartbeatIntervalMs, DEFAULT_HEARTBEAT_INTERVAL_MS, MIN_HEARTBEAT_INTERVAL_MS, MAX_HEARTBEAT_INTERVAL_MS, isRecognizedNonProductionEnvironment, RECOGNIZED_NON_PRODUCTION_ENVIRONMENTS, CREDENTIAL_STORAGE_UNAVAILABLE_EXIT_CODE, describeStoredAuthFailure, } from './appsync-client';
 export type { AuthFailureKind, StoredAuthFailureReport } from './appsync-client';
 export { coerceAwsJsonObject } from './appsync-client';
-export type { ClassBPacketEnvelopeMeta } from './appsync-client';
+export type { ClassBPacketEnvelopeMeta, CompanionEventPublication } from './appsync-client';
 export type { TaskReviewSummary, TaskReviewSummaryRound, TaskReviewSummaryReviewer, TaskGroupStatusResult, PutContextItemInput, } from './appsync-client';
 export { queries, mutations, subscriptions } from './queries';
 export { isPersistedEventResult } from './event-throttle';
+export { SyncEventClientError, PLAIN_DESKTOP_SYNC_TYPES } from './sync-event-client';
+export type { PromptPublicationJournal } from './sync-prompt-publication';
+export type { PromptReRaiseDisposition } from './sync-prompt-retention';
+export type { ResolveDesktopSyncPromptInput, SyncPromptResolutionReceipt } from './sync-prompt-resolution';
+export type { ConfirmDesktopSyncRetirementInput, SyncSessionRetirementReceipt } from './sync-session-retirement';
+export { acknowledgeMobileInputDelivery, acknowledgeMobileInputExecution, requiresSyncInputDeliveryReceipt } from './sync-input-delivery';
+export type { MobileInputStatusUpdater } from './sync-input-delivery';
+export type { CreateDesktopSyncEventInput, UpdateDesktopSyncEventInput, UpdateDesktopSyncStatusInput, SyncStatusReceipt, SyncPromptRetentionReceipt, SyncEventReceipt, SyncJson } from './sync-event-client';
+export type { CompanionSyncState } from './sync-state';
+export { readStandaloneCompanionStatus } from './standalone-companion-status';
+export { DurableDesktopSyncWriter, SyncJournalError } from './sync-operation-journal';
+export { desktopDeferredInputSha256 } from './sync-deferred-inputs';
+export type { DesktopDeferredInput, DesktopDeferredInputStore, DesktopDeferredNoticeState } from './sync-deferred-inputs';
+export type { DesktopMobileEchoJournal, DesktopMobileEchoTarget, DesktopMobileEchoFrame } from './sync-mobile-echo';
+export type { ShellSyncSource, ShellSyncTicket, ShellSyncSourceInventory } from './sync-shell-source';
+export type { DurableSyncResult, DurableDesktopSyncWriterOptions, DesktopSyncSessionScope, DesktopSyncSourceIdentity } from './sync-operation-journal';
+export { MAX_SYNC_SOURCE_ANCHOR_BYTES } from './sync-source-cursor';
+export type { DesktopSyncSourceStream, DesktopSyncSourceFrame, DesktopSyncSourceCursor, DesktopSyncSourceJournal, DesktopSyncSourceInventory, DesktopSyncSourceAnchor, DesktopSyncSourcePosition, DesktopSyncSourceGap } from './sync-source-cursor';
+export type { DesktopSyncSourcePair } from './sync-source-pair';
+export { readDesktopSyncFile } from './sync-source-file';
+export type { DesktopSyncFileIdentity, DesktopSyncFileFrame, DesktopSyncFileAdmission } from './sync-source-file';
+export { DesktopSyncReadClient, SyncReadClientError } from './sync-read-client';
+export type { DesktopSyncRegistrationAttempt, DesktopSyncReadCredential, SyncReadEvent, SyncHistoryPage } from './sync-read-client';
+export type { DesktopSyncRegistrationStore, DurableDesktopSyncReader } from './sync-desktop-registration';

package/node_modules/@quantiya/codevibe-core/dist/appsync/queries.d.ts

@@ -1,8 +1,10 @@
 export declare const queries: {
+    getCompanionSyncState: string;
     getSession: string;
     listEvents: string;
     listSupervisionEvents: string;
     getDecisionAttempt: string;
+    getGateResolutionV2: string;
     getGateResolution: string;
     listOpenPrompts: string;
     listUserDeviceKeys: string;
@@ -33,9 +35,17 @@ export declare const mutations: {
     putContextItem: string;
     createSession: string;
     updateSession: string;
+    createEventV2: string;
+    recordWorkspaceOutcomeV2: string;
+    updateEventV2: string;
     createEvent: string;
     refreshOpenPromptTtl: string;
+    refreshOpenPromptTtlV2: string;
+    resolveOpenPromptV2: string;
+    reportSecurityPostureV2: string;
+    confirmSessionRetirementV2: string;
     updateEventStatus: string;
+    updateEventStatusV2: string;
     registerDeviceKey: string;
     grantSessionKey: string;
     getAttachmentDownloadUrl: string;

package/node_modules/@quantiya/codevibe-core/dist/appsync/standalone-companion-status.d.ts

@@ -0,0 +1,6 @@
+import type { AppSyncClient } from './appsync-client';
+type StatusClient = Pick<AppSyncClient, 'getCurrentUserId' | 'getSubscriptionStatus' | 'getCompanionSyncState'>;
+/** Read-only status for a provider companion without an Orchestration shell.
+ * This never grants a tier or authorizes a send; cloud writes remain authoritative. */
+export declare function readStandaloneCompanionStatus(client: StatusClient, signal?: AbortSignal): Promise<string[]>;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-deferred-inputs.d.ts

@@ -0,0 +1,104 @@
+import { z } from 'zod';
+import type { DesktopSyncSessionScope } from './sync-operation-journal';
+import { type CreateDesktopSyncEventInput } from './sync-event-client';
+export type DesktopDeferredNoticeState = {
+    state: 'STAGED';
+    input: CreateDesktopSyncEventInput;
+} | {
+    state: 'SETTLED';
+    operationId: string;
+    status: 'ACCEPTED' | 'OMITTED';
+};
+declare const item: z.ZodObject<{
+    eventId: z.ZodString;
+    timestamp: z.ZodEffects<z.ZodString, string, string>;
+    type: z.ZodEnum<["USER_PROMPT", "PROMPT_RESPONSE"]>;
+    payloadJson: z.ZodEffects<z.ZodString, string, string>;
+    notice: z.ZodOptional<z.ZodType<DesktopDeferredNoticeState, z.ZodTypeDef, unknown>>;
+}, "strict", z.ZodTypeAny, {
+    eventId: string;
+    type: "USER_PROMPT" | "PROMPT_RESPONSE";
+    timestamp: string;
+    payloadJson: string;
+    notice?: DesktopDeferredNoticeState | undefined;
+}, {
+    eventId: string;
+    type: "USER_PROMPT" | "PROMPT_RESPONSE";
+    timestamp: string;
+    payloadJson: string;
+    notice?: unknown;
+}>;
+declare const row: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"DEFERRED_INPUTS">;
+    operationId: z.ZodString;
+    sessionId: z.ZodString;
+    sessionGenerationId: z.ZodString;
+    provider: z.ZodEnum<["codex", "claude", "agy"]>;
+    nativeSessionSha256: z.ZodString;
+    entries: z.ZodArray<z.ZodObject<{
+        eventId: z.ZodString;
+        timestamp: z.ZodEffects<z.ZodString, string, string>;
+        type: z.ZodEnum<["USER_PROMPT", "PROMPT_RESPONSE"]>;
+        payloadJson: z.ZodEffects<z.ZodString, string, string>;
+        notice: z.ZodOptional<z.ZodType<DesktopDeferredNoticeState, z.ZodTypeDef, unknown>>;
+    }, "strict", z.ZodTypeAny, {
+        eventId: string;
+        type: "USER_PROMPT" | "PROMPT_RESPONSE";
+        timestamp: string;
+        payloadJson: string;
+        notice?: DesktopDeferredNoticeState | undefined;
+    }, {
+        eventId: string;
+        type: "USER_PROMPT" | "PROMPT_RESPONSE";
+        timestamp: string;
+        payloadJson: string;
+        notice?: unknown;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    kind: "DEFERRED_INPUTS";
+    entries: {
+        eventId: string;
+        type: "USER_PROMPT" | "PROMPT_RESPONSE";
+        timestamp: string;
+        payloadJson: string;
+        notice?: DesktopDeferredNoticeState | undefined;
+    }[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    provider: "agy" | "claude" | "codex";
+    operationId: string;
+    nativeSessionSha256: string;
+}, {
+    kind: "DEFERRED_INPUTS";
+    entries: {
+        eventId: string;
+        type: "USER_PROMPT" | "PROMPT_RESPONSE";
+        timestamp: string;
+        payloadJson: string;
+        notice?: unknown;
+    }[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    provider: "agy" | "claude" | "codex";
+    operationId: string;
+    nativeSessionSha256: string;
+}>;
+export type DesktopDeferredInput = z.infer<typeof item>;
+export type DesktopDeferredInputRecord = z.infer<typeof row>;
+export interface DesktopDeferredInputStore {
+    read(): Promise<readonly DesktopDeferredInput[]>;
+    /** Missing expected hash means create-only. Use desktopDeferredInputSha256 on the last read. */
+    put(input: DesktopDeferredInput, expectedPayloadSha256?: string): Promise<void>;
+    remove(target: Pick<DesktopDeferredInput, 'eventId' | 'timestamp' | 'type'>, expectedPayloadSha256?: string): Promise<void>;
+    /** Serialize terminal handoff/recovery across processes. Read fresh inside. */
+    runExclusive<T>(callback: (assertOwnership: () => Promise<void>) => Promise<T>): Promise<T>;
+}
+export declare function decodeDeferredInputs(value: unknown): DesktopDeferredInputRecord;
+/** Preserve the existing payload-only token for entries without a notice. */
+export declare function desktopDeferredInputSha256(input: DesktopDeferredInput): string;
+export declare function snapshotDeferredInput(value: DesktopDeferredInput): DesktopDeferredInput;
+export declare function deferredScopeMatches(row: DesktopDeferredInputRecord, scope: DesktopSyncSessionScope): boolean;
+export {};