@quantiya/codevibe-codex-plugin 2.0.64 → 2.0.66

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-mobile-echo.d.ts

@@ -0,0 +1,289 @@
+import { z } from 'zod';
+declare const coordinate: z.ZodObject<{
+    eventId: z.ZodString;
+    timestamp: z.ZodString;
+    type: z.ZodEnum<["USER_PROMPT", "PROMPT_RESPONSE"]>;
+    lane: z.ZodEnum<["primary", "follow_up", "free_form"]>;
+}, "strict", z.ZodTypeAny, {
+    eventId: string;
+    type: "USER_PROMPT" | "PROMPT_RESPONSE";
+    timestamp: string;
+    lane: "primary" | "follow_up" | "free_form";
+}, {
+    eventId: string;
+    type: "USER_PROMPT" | "PROMPT_RESPONSE";
+    timestamp: string;
+    lane: "primary" | "follow_up" | "free_form";
+}>;
+declare const frame: z.ZodEffects<z.ZodObject<{
+    streamSha256: z.ZodString;
+    occurrence: z.ZodString;
+    sourceSha256: z.ZodString;
+    startOffset: z.ZodNumber;
+    endOffset: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    streamSha256: string;
+    occurrence: string;
+    sourceSha256: string;
+    startOffset: number;
+    endOffset: number;
+}, {
+    streamSha256: string;
+    occurrence: string;
+    sourceSha256: string;
+    startOffset: number;
+    endOffset: number;
+}>, {
+    streamSha256: string;
+    occurrence: string;
+    sourceSha256: string;
+    startOffset: number;
+    endOffset: number;
+}, {
+    streamSha256: string;
+    occurrence: string;
+    sourceSha256: string;
+    startOffset: number;
+    endOffset: number;
+}>;
+declare const row: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"MOBILE_ECHOES">;
+    operationId: z.ZodString;
+    sessionId: z.ZodString;
+    sessionGenerationId: z.ZodString;
+    provider: z.ZodEnum<["codex", "claude", "agy"]>;
+    entries: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        token: z.ZodString;
+        target: z.ZodObject<{
+            eventId: z.ZodString;
+            timestamp: z.ZodString;
+            type: z.ZodEnum<["USER_PROMPT", "PROMPT_RESPONSE"]>;
+            lane: z.ZodEnum<["primary", "follow_up", "free_form"]>;
+        }, "strict", z.ZodTypeAny, {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        }, {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        }>;
+        normalized: z.ZodString;
+        armedAt: z.ZodNumber;
+        expiresAt: z.ZodNumber;
+        clockPrecisionMs: z.ZodUnion<[z.ZodLiteral<1>, z.ZodLiteral<1000>]>;
+        normalization: z.ZodEnum<["trim", "whitespace"]>;
+        allowSuffix: z.ZodBoolean;
+        claim: z.ZodNullable<z.ZodEffects<z.ZodObject<{
+            streamSha256: z.ZodString;
+            occurrence: z.ZodString;
+            sourceSha256: z.ZodString;
+            startOffset: z.ZodNumber;
+            endOffset: z.ZodNumber;
+        }, "strict", z.ZodTypeAny, {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        }, {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        }>, {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        }, {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        }>>;
+        claimedEchoSha256: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        expiresAt: number;
+        token: string;
+        target: {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        };
+        claim: {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        } | null;
+        normalized: string;
+        armedAt: number;
+        clockPrecisionMs: 1 | 1000;
+        normalization: "trim" | "whitespace";
+        allowSuffix: boolean;
+        claimedEchoSha256: string | null;
+    }, {
+        expiresAt: number;
+        token: string;
+        target: {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        };
+        claim: {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        } | null;
+        normalized: string;
+        armedAt: number;
+        clockPrecisionMs: 1 | 1000;
+        normalization: "trim" | "whitespace";
+        allowSuffix: boolean;
+        claimedEchoSha256: string | null;
+    }>, {
+        expiresAt: number;
+        token: string;
+        target: {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        };
+        claim: {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        } | null;
+        normalized: string;
+        armedAt: number;
+        clockPrecisionMs: 1 | 1000;
+        normalization: "trim" | "whitespace";
+        allowSuffix: boolean;
+        claimedEchoSha256: string | null;
+    }, {
+        expiresAt: number;
+        token: string;
+        target: {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        };
+        claim: {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        } | null;
+        normalized: string;
+        armedAt: number;
+        clockPrecisionMs: 1 | 1000;
+        normalization: "trim" | "whitespace";
+        allowSuffix: boolean;
+        claimedEchoSha256: string | null;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    kind: "MOBILE_ECHOES";
+    entries: {
+        expiresAt: number;
+        token: string;
+        target: {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        };
+        claim: {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        } | null;
+        normalized: string;
+        armedAt: number;
+        clockPrecisionMs: 1 | 1000;
+        normalization: "trim" | "whitespace";
+        allowSuffix: boolean;
+        claimedEchoSha256: string | null;
+    }[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    provider: "agy" | "claude" | "codex";
+    operationId: string;
+}, {
+    kind: "MOBILE_ECHOES";
+    entries: {
+        expiresAt: number;
+        token: string;
+        target: {
+            eventId: string;
+            type: "USER_PROMPT" | "PROMPT_RESPONSE";
+            timestamp: string;
+            lane: "primary" | "follow_up" | "free_form";
+        };
+        claim: {
+            streamSha256: string;
+            occurrence: string;
+            sourceSha256: string;
+            startOffset: number;
+            endOffset: number;
+        } | null;
+        normalized: string;
+        armedAt: number;
+        clockPrecisionMs: 1 | 1000;
+        normalization: "trim" | "whitespace";
+        allowSuffix: boolean;
+        claimedEchoSha256: string | null;
+    }[];
+    sessionId: string;
+    sessionGenerationId: string;
+    schemaVersion: 1;
+    provider: "agy" | "claude" | "codex";
+    operationId: string;
+}>;
+export type DesktopMobileEchoRecord = z.infer<typeof row>;
+export type DesktopMobileEchoTarget = z.infer<typeof coordinate>;
+export type DesktopMobileEchoFrame = z.infer<typeof frame>;
+export declare function decodeMobileEcho(value: unknown): DesktopMobileEchoRecord;
+export interface DesktopMobileEchoJournal {
+    /** Before terminal input. A full or unavailable journal must prevent typing. */
+    arm(target: DesktopMobileEchoTarget, content: string, options: {
+        nowMs: number;
+        windowMs: number;
+        clockPrecisionMs?: 1 | 1000;
+        allowSuffix: boolean;
+        normalization: 'trim' | 'whitespace';
+    }): Promise<void>;
+    /** Uses native record time, not replay time; reserves one exact byte occurrence. */
+    claim(frame: DesktopMobileEchoFrame, content: string, nativeTimestamp: string): Promise<boolean>;
+    /** Call only after the real native cursor is durably at/past this position. */
+    reconcile(streamSha256: string, committedByteOffset: number): Promise<number>;
+}
+/** Device-key encrypted storage is supplied by the account journal. Unmatched
+ * entries are bounded and retained, not age-evicted before a delayed replay.
+ * Exact session retirement removes them. No customer content is returned. */
+export declare function createMobileEchoJournal(options: {
+    mutate<T>(fn: (row: DesktopMobileEchoRecord, save: () => Promise<void>) => Promise<T>): Promise<T>;
+    assertAdmission(): void;
+    full(): never;
+    collision(): never;
+}): DesktopMobileEchoJournal;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-operation-journal.d.ts

@@ -0,0 +1,236 @@
+import { type CreateDesktopSyncEventInput, type UpdateDesktopSyncEventInput, type SyncEventReceipt } from './sync-event-client';
+import { type DesktopSyncSourceStream, type DesktopSyncSourceJournal, type DesktopSyncSourceInventory } from './sync-source-cursor';
+import { type DesktopSyncSourcePair } from './sync-source-pair';
+import { type ShellSyncSource, type ShellSyncSourceInventory } from './sync-shell-source';
+import { type DesktopSyncRegistrationStore } from './sync-desktop-registration';
+import type { DesktopSyncRegistrationAttempt, DesktopSyncReadCredential } from './sync-read-client';
+import { type DesktopInboundJournal } from './sync-inbound-journal';
+import { type DesktopDeferredInputStore } from './sync-deferred-inputs';
+import { type DesktopMobileEchoJournal } from './sync-mobile-echo';
+import { type PromptRetentionJournal } from './sync-prompt-retention';
+import { type PromptPublicationJournal } from './sync-prompt-publication';
+import { type ResolveDesktopSyncPromptInput } from './sync-prompt-resolution';
+import { type ConfirmDesktopSyncRetirementInput, type SyncSessionRetirementReceipt, type SessionRetirementRecord, type ToolSyncRetirementLocation } from './sync-session-retirement';
+type Action = 'CREATE_EVENT' | 'UPDATE_EVENT';
+type Input = CreateDesktopSyncEventInput | UpdateDesktopSyncEventInput;
+export type DurableSyncResult = {
+    status: 'ACCEPTED';
+    receipt: SyncEventReceipt;
+} | {
+    status: 'OMITTED';
+    reason: 'SYNC_QUOTA_EXHAUSTED';
+};
+export declare class SyncJournalError extends Error {
+    readonly code: 'SYNC_JOURNAL_INVALID' | 'SYNC_JOURNAL_FULL' | 'SYNC_JOURNAL_MISSING' | 'SYNC_OPERATION_COLLISION' | 'SYNC_OPERATION_PENDING' | 'SYNC_JOURNAL_IDENTITY_UNAVAILABLE' | 'SYNC_JOURNAL_LOCK_LOST';
+    constructor(code: 'SYNC_JOURNAL_INVALID' | 'SYNC_JOURNAL_FULL' | 'SYNC_JOURNAL_MISSING' | 'SYNC_OPERATION_COLLISION' | 'SYNC_OPERATION_PENDING' | 'SYNC_JOURNAL_IDENTITY_UNAVAILABLE' | 'SYNC_JOURNAL_LOCK_LOST');
+}
+export interface DesktopSyncSessionScope {
+    sessionId: string;
+    sessionGenerationId: string;
+}
+/** A stable native occurrence, supplied by the source reader, never the cloud. */
+export interface DesktopSyncSourceIdentity {
+    provider: 'codex' | 'claude' | 'agy';
+    /** Hash of the native stream identity; no filesystem path or customer text. */
+    streamSha256: string;
+    /** Native record UUID, or descriptor-derived byte span for a framed stream. */
+    occurrence: string;
+    /** Exact source bytes before randomized encryption, stable on a restart. */
+    sourceSha256: string;
+}
+interface RecordBase extends DesktopSyncSessionScope {
+    schemaVersion: 1;
+    operationId: string;
+    fingerprint: string;
+    createdAt: number;
+    action: Action;
+}
+type RecordRow = RecordBase & ({
+    state: 'PENDING';
+    input: Input;
+} | {
+    state: 'ACCEPTED';
+    receipt: SyncEventReceipt;
+} | {
+    state: 'OMITTED';
+    reason: 'SYNC_QUOTA_EXHAUSTED';
+});
+export interface DurableDesktopSyncWriterOptions {
+    userId: string;
+    environment: 'development' | 'production';
+    /** Dedicated durable root; a caller override supports private installations. */
+    root?: string;
+    /** Restrict this producer to its exact session incarnation, including recovery/ack. */
+    sessionScope?: DesktopSyncSessionScope;
+    /** Existing device private key only. This callback must never mint an identity. */
+    readPrivateKey(): Promise<string | null>;
+    /** Must fence the current authenticated account before and after awaits. */
+    assertAccount(): void;
+    /** Session owner fences new deferred writes once its input lifetime closes. */
+    assertDeferredAdmission?(): void;
+    send(action: Action, input: Input, signal?: AbortSignal): Promise<SyncEventReceipt>;
+    /** Recognize a typed backend quota error, never an error-message substring. */
+    isQuotaDenial(error: unknown): boolean;
+    /** Fresh cloud pause observation for NEW ordinary payloads only. Never
+     * classify an existing operation which may have committed remotely. */
+    omitNewPayload?(signal?: AbortSignal): Promise<boolean>;
+}
+/**
+ * Bounded encrypted transactional outbox for ordinary desktop sync writes.
+ * A producer must persist its own cursor BEFORE acknowledge(). Until then a
+ * terminal receipt/tombstone survives restart. No age-based eviction, remint,
+ * auto-replay or quota-reset replay is permitted. Full/corrupt storage stops
+ * Companion admission only; callers must keep the local desktop running.
+ *
+ * The existing portable mkdir lock serializes local records; per-operation
+ * locks serialize the network attempt without blocking other sessions' I/O.
+ * Ownerless lock stealing is disabled: a stranded ownerless/reclaim guard
+ * fails closed and needs quiescent repair, not an unsafe online removal.
+ */
+export declare class DurableDesktopSyncWriter {
+    private readonly options;
+    private readonly directory;
+    private readonly scope;
+    private readonly sessionScope?;
+    constructor(options: DurableDesktopSyncWriterOptions);
+    create(input: CreateDesktopSyncEventInput, signal?: AbortSignal): Promise<DurableSyncResult>;
+    update(input: UpdateDesktopSyncEventInput, signal?: AbortSignal): Promise<DurableSyncResult>;
+    /** Seal exact bytes without sending; the producer can checkpoint its source before retry(id). */
+    prepareCreate(input: CreateDesktopSyncEventInput, signal?: AbortSignal): Promise<string>;
+    prepareUpdate(input: UpdateDesktopSyncEventInput, signal?: AbortSignal): Promise<string>;
+    /**
+     * Source-reader admission: prepare, but NEVER dispatch. Re-reading the same
+     * native occurrence recovers its already-sealed bytes without invoking the
+     * encryption factory again. The producer still owns its durable cursor and
+     * must advance it before acknowledging a terminal result. This is not a
+     * substitute for that cursor, nor an inner-attested orchestration writer.
+     */
+    prepareSourceCreate(source: DesktopSyncSourceIdentity, prepare: (operationId: string) => Promise<CreateDesktopSyncEventInput>, signal?: AbortSignal): Promise<string>;
+    /** Encrypted cursor + owned-operation linkage in the same bounded account store. */
+    sourceStream(value: DesktopSyncSourceStream): DesktopSyncSourceJournal;
+    /** Fixed two-output source; both durable lanes must admit before reader advancement. */
+    sourcePair(value: DesktopSyncSourceStream): DesktopSyncSourcePair;
+    /** Shell events have no native transcript. Their already-signed encrypted
+     * source is admitted durably before entering the shared operation journal.
+     * No network loop/timer is created here; the session owner drives recovery.
+     */
+    shellSource(): ShellSyncSource;
+    shellSources(): Promise<ShellSyncSourceInventory[]>;
+    /** One encrypted intent/credential record per original desktop incarnation.
+     * This uses the account journal's existing 256-file / 32-MiB total bound. */
+    desktopRegistration(register: (attempt: DesktopSyncRegistrationAttempt, signal?: AbortSignal) => Promise<DesktopSyncReadCredential>, now?: () => number): DesktopSyncRegistrationStore;
+    /** Exact local retirement only after the owner has joined read/registration
+     * requests and obtained canonical INACTIVE authority. No hosted mutation. */
+    removeDesktopRegistration(): Promise<boolean>;
+    /** Provider queues share the existing encrypted/account-fenced capacity.
+     * Native identity and generation are immutable: no automatic re-homing. */
+    deferredInputs(provider: DesktopSyncSourceIdentity['provider'], nativeSessionSha256: string): DesktopDeferredInputStore;
+    mobileEchoes(provider: DesktopSyncSourceIdentity['provider']): DesktopMobileEchoJournal;
+    promptPublication(promptId: string): PromptPublicationJournal;
+    /** Persist exact ownership before recovery/control I/O. The per-intent lock
+     * serializes original callers and restarted owners without holding the
+     * account store lock across network awaits. Only an exact ACK permits removal.
+     * Admission closure/PAUSED does not authorize dropping pending control work. */
+    runPromptResolution(value: ResolveDesktopSyncPromptInput, resolve: (input: ResolveDesktopSyncPromptInput, fence: () => Promise<void>) => Promise<boolean>, options?: {
+        existingOnly?: boolean;
+    }): Promise<boolean>;
+    /** Account-fenced, encrypted ownership inventory. Contains secret owner tokens;
+     * only the recovery caller may use it, never logs or cloud-visible metadata.
+     * A bound writer filters core generations; plugin tokens are SID-bound. */
+    promptResolutions(): Promise<readonly ResolveDesktopSyncPromptInput[]>;
+    private matchesPromptResolutionScope;
+    /** Bounded metadata inventory for producer recovery and rollback fences.
+     * Never expose retained ciphertext or owner tokens to a caller. */
+    promptPublications(): Promise<Array<DesktopSyncSessionScope & {
+        promptId: string;
+        state: 'STAGED' | 'SETTLED';
+    }>>;
+    promptRetention(): PromptRetentionJournal;
+    /** Canonical INACTIVE proof and joined publication owners are prerequisites.
+     * Validate the complete exact-incarnation target set before deleting anything;
+     * uncertain publications remain recoverable and prevent terminal cleanup. */
+    removeSettledPromptPublications(): Promise<number>;
+    /** Canonical terminal proof and joined source/input owners are prerequisites. */
+    removeMobileEchoes(): Promise<number>;
+    /** Only after canonical INACTIVE proof and joined provider input owners.
+     * Remove payload for this exact incarnation, never another generation. */
+    removeDeferredInputs(): Promise<number>;
+    /** One small encrypted row for unresolved inbound inputs. Completed cloud
+     * acknowledgements remove entries; it is not a lifetime transcript. */
+    inbound(): DesktopInboundJournal;
+    /** Caller must join subscription/provider dispatch and prove canonical
+     * INACTIVE first; no closed generation may execute these inputs again. */
+    removeInbound(): Promise<boolean>;
+    /** Exact empty-source GC only after the owner has joined all its emitters
+     * and received canonical terminal-session proof. Pending payload or receipts
+     * are never discarded here. Admission/drain locks serialize the empty check
+     * and unlink against every other instance using this account directory. */
+    removeEmptyShellSource(): Promise<boolean>;
+    /** Bounded account-wide discovery. Only terminal owners create these records;
+     * merely missing/old source files or a new session ID never create an intent. */
+    sessionRetirements(): Promise<readonly SessionRetirementRecord[]>;
+    hasSessionRetirementWork(expectedSessionKeyGen: string): Promise<boolean>;
+    /** Durable stop/join intent -> confirmed source cleanup -> control ACKs ->
+     * intent removal. Network I/O never holds the account-store lock. */
+    runSessionRetirement<T>(input: ConfirmDesktopSyncRetirementInput, toolOutbox: ToolSyncRetirementLocation | null, cleanup: (record: SessionRetirementRecord, fence: () => Promise<void>) => Promise<T>, options?: {
+        existingOnly?: boolean;
+    }): Promise<T | null>;
+    /** Terminal GC, not delivery settlement. The session owner MUST first stop
+     * admission and join its native readers, shell emitters and prompt producers.
+     * Only a fresh, exact permanent-retirement ACK authorizes removing these
+     * sources, including ambiguous writes. No Event outcome is invented.
+     *
+     * Only operations linked from a validated source are collected. Standalone
+     * operations (including the tool-activity outbox), control intents, other
+     * generations and other accounts remain owned by their respective lifecycles.
+     * Source records are removed LAST: an interrupted unlink can be retried by
+     * a new owner using the remaining source links and a new cloud confirmation.
+     */
+    removeRetiredSources(expectedSessionKeyGen: string, confirm: (input: ConfirmDesktopSyncRetirementInput) => Promise<SyncSessionRetirementReceipt>): Promise<{
+        sourcesRemoved: number;
+        operationsRemoved: number;
+    }>;
+    /** Outbox-owned tool GC. The caller holds its quiescent source ownership and
+     * supplies the exact deterministic window IDs. Persist replay suppression
+     * before unlink; release every send lock before pruning the source links. */
+    removeRetiredToolOperations(values: readonly string[], expectedSessionKeyGen: string, confirm: (input: ConfirmDesktopSyncRetirementInput) => Promise<SyncSessionRetirementReceipt>, sources: {
+        markRetired(): Promise<void>;
+        prune(): Promise<void>;
+    }): Promise<number>;
+    private retiredSourcePlan;
+    private readShellSource;
+    private sourceOperationId;
+    private matchesScope;
+    private requireScope;
+    private prepare;
+    /** Retry stored immutable bytes, never re-encrypt/reconstruct from a transcript. */
+    retry(value: string, signal?: AbortSignal): Promise<DurableSyncResult>;
+    /** Bounded recovery inventory, containing no customer payload. Never sends. */
+    pending(): Promise<Array<{
+        operationId: string;
+        createdAt: number;
+        state: RecordRow['state'];
+    }>>;
+    /** Bounded, account-fenced inventory for recovery in the ORIGINAL generation.
+     * Contains coordinates only, never native text or pending ciphertext. Loading
+     * validates every cursor before any caller starts a recovery mutation.
+     */
+    sourceStreams(): Promise<DesktopSyncSourceInventory[]>;
+    private readSourceCursor;
+    /** Only after the producer's own cursor/result is durable. Never discards pending work. */
+    acknowledge(value: string): Promise<void>;
+    private file;
+    private lock;
+    private withStore;
+    private seal;
+    private required;
+    private read;
+    private readValue;
+    private validateRecord;
+    private write;
+    private recordNames;
+    private checkCapacity;
+    private ensureDirectory;
+    private syncDirectory;
+}
+export {};

package/node_modules/@quantiya/codevibe-core/dist/appsync/sync-prompt-publication.d.ts

@@ -0,0 +1,153 @@
+import { z } from 'zod';
+import { type CreateDesktopSyncEventInput } from './sync-event-client';
+import type { DesktopSyncSessionScope, DurableSyncResult } from './sync-operation-journal';
+declare const schema: z.ZodDiscriminatedUnion<"state", [z.ZodObject<{
+    state: z.ZodLiteral<"STAGED">;
+    input: z.ZodUnknown;
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"PROMPT_PUBLICATION">;
+    operationId: z.ZodString;
+    sessionId: z.ZodString;
+    sessionGenerationId: z.ZodString;
+    promptId: z.ZodString;
+    sourceSha256: z.ZodString;
+    eventType: z.ZodEnum<["INTERACTIVE_PROMPT", "NOTIFICATION"]>;
+    writeId: z.ZodString;
+    reRaiseToken: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    kind: "PROMPT_PUBLICATION";
+    sessionId: string;
+    sessionGenerationId: string;
+    promptId: string;
+    schemaVersion: 1;
+    state: "STAGED";
+    sourceSha256: string;
+    operationId: string;
+    reRaiseToken: string | null;
+    eventType: "NOTIFICATION" | "INTERACTIVE_PROMPT";
+    writeId: string;
+    input?: unknown;
+}, {
+    kind: "PROMPT_PUBLICATION";
+    sessionId: string;
+    sessionGenerationId: string;
+    promptId: string;
+    schemaVersion: 1;
+    state: "STAGED";
+    sourceSha256: string;
+    operationId: string;
+    reRaiseToken: string | null;
+    eventType: "NOTIFICATION" | "INTERACTIVE_PROMPT";
+    writeId: string;
+    input?: unknown;
+}>, z.ZodObject<{
+    state: z.ZodLiteral<"SETTLED">;
+    result: z.ZodDiscriminatedUnion<"status", [z.ZodObject<{
+        status: z.ZodLiteral<"ACCEPTED">;
+        receipt: z.ZodUnknown;
+    }, "strict", z.ZodTypeAny, {
+        status: "ACCEPTED";
+        receipt?: unknown;
+    }, {
+        status: "ACCEPTED";
+        receipt?: unknown;
+    }>, z.ZodObject<{
+        status: z.ZodLiteral<"OMITTED">;
+        reason: z.ZodLiteral<"SYNC_QUOTA_EXHAUSTED">;
+    }, "strict", z.ZodTypeAny, {
+        reason: "SYNC_QUOTA_EXHAUSTED";
+        status: "OMITTED";
+    }, {
+        reason: "SYNC_QUOTA_EXHAUSTED";
+        status: "OMITTED";
+    }>]>;
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"PROMPT_PUBLICATION">;
+    operationId: z.ZodString;
+    sessionId: z.ZodString;
+    sessionGenerationId: z.ZodString;
+    promptId: z.ZodString;
+    sourceSha256: z.ZodString;
+    eventType: z.ZodEnum<["INTERACTIVE_PROMPT", "NOTIFICATION"]>;
+    writeId: z.ZodString;
+    reRaiseToken: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    kind: "PROMPT_PUBLICATION";
+    sessionId: string;
+    sessionGenerationId: string;
+    promptId: string;
+    schemaVersion: 1;
+    state: "SETTLED";
+    result: {
+        status: "ACCEPTED";
+        receipt?: unknown;
+    } | {
+        reason: "SYNC_QUOTA_EXHAUSTED";
+        status: "OMITTED";
+    };
+    sourceSha256: string;
+    operationId: string;
+    reRaiseToken: string | null;
+    eventType: "NOTIFICATION" | "INTERACTIVE_PROMPT";
+    writeId: string;
+}, {
+    kind: "PROMPT_PUBLICATION";
+    sessionId: string;
+    sessionGenerationId: string;
+    promptId: string;
+    schemaVersion: 1;
+    state: "SETTLED";
+    result: {
+        status: "ACCEPTED";
+        receipt?: unknown;
+    } | {
+        reason: "SYNC_QUOTA_EXHAUSTED";
+        status: "OMITTED";
+    };
+    sourceSha256: string;
+    operationId: string;
+    reRaiseToken: string | null;
+    eventType: "NOTIFICATION" | "INTERACTIVE_PROMPT";
+    writeId: string;
+}>]>;
+export type PromptPublicationRecord = z.infer<typeof schema>;
+export interface PromptPublicationJournal {
+    /** Hash the immutable plaintext occurrence, excluding retry timestamps.
+     * A reRaiseToken is supplied only from one durably recorded canonical absence.
+     * Repeated callbacks reuse it; a later absence obtains a different token. */
+    publish(sourceSha256: string, prepare: (operationId: string) => Promise<CreateDesktopSyncEventInput>, options?: {
+        reRaiseToken?: string;
+        signal?: AbortSignal;
+    }): Promise<DurableSyncResult>;
+    /** Settle only an already-persisted episode, without a factory, current
+     * session key, or new-admission permission. Never creates a new occurrence. */
+    settle(signal?: AbortSignal): Promise<DurableSyncResult | null>;
+    /** Caller has joined this prompt's publications and confirmed local closure.
+     * An uncertain operation is never discarded by this cleanup method. */
+    close(): Promise<boolean>;
+}
+export declare function decodePromptPublication(value: unknown, invalid: () => never): PromptPublicationRecord;
+/** One encrypted source per live prompt. A STAGED input is durable before the
+ * operation can send; retry never invokes the encryption factory again.
+ * Settlement strips payload BEFORE acknowledging/removing the generic outbox.
+ * A quota omission is terminal for that plaintext occurrence, including TTL
+ * recovery after reset. It is not represented as a successful cloud Event.
+ */
+export declare function createPromptPublicationJournal(store: {
+    id: string;
+    scope: Readonly<DesktopSyncSessionScope>;
+    promptId: string;
+    assertAdmission(): void;
+    assertOpen(): Promise<void>;
+    invalid(): never;
+    collision(): never;
+    pending(): never;
+    locked<T>(fn: (fence: () => Promise<void>) => Promise<T>): Promise<T>;
+    read(): Promise<PromptPublicationRecord | null>;
+    write(row: PromptPublicationRecord): Promise<void>;
+    remove(): Promise<void>;
+    prepare(input: CreateDesktopSyncEventInput): Promise<string>;
+    retry(id: string, signal?: AbortSignal): Promise<DurableSyncResult>;
+    acknowledge(id: string): Promise<void>;
+}): PromptPublicationJournal;
+export {};