@quantiya/codevibe-core 2.0.5 → 2.0.7

package/dist/credential-broker/types.d.ts

@@ -1,3 +1,5 @@
+import type * as http from "node:http";
+import type { Readable } from "node:stream";
 /**
  * The vendor providers Rung 1 brokers. Claude + Codex (Anthropic +
  * OpenAI) only — Gemini stays out of the substrate (§6 Q4, agy is
@@ -13,13 +15,15 @@ export type BrokerRouteMethod = "POST" | "GET";
  */
 export interface BrokerRoute {
     method: BrokerRouteMethod;
-    path: "/v1/messages" | "/v1/responses" | "/healthz";
+    path: "/v1/messages" | "/v1/responses" | "/healthz" | "/models" | "/v1/models";
     /** Whether the route requires a valid agent→broker token. */
     auth: "broker_token" | "none";
 }
 /**
- * The broker's locked route table — exactly three routes (§3.2). Any
- * other method+path → 403.
+ * The broker's locked route table (§3.2). Any other method+path → 403.
+ * `/models` and `/v1/models` are local compatibility metadata endpoints for
+ * Codex CLI provider preflight; they never forward to upstream or require a
+ * vendor credential.
  */
 export declare const BROKER_ROUTES: readonly BrokerRoute[];
 /**
@@ -34,8 +38,8 @@ export type BrokerStatus = 200 | 400 | 401 | 403 | 502 | 503;
  * the §3.2 contract is "everything else → 403", so the type MUST be able
  * to represent a *disallowed* route for the W1 gateway's `handle()` to be
  * conformance-testable (send `/v1/admin` / `DELETE` → assert 403). Only
- * the three `(method, path)` pairs in `BROKER_ROUTES` are forwarded; every
- * other request fails closed at 403.
+ * the model POST `(method, path)` pairs in `BROKER_ROUTES` are forwarded;
+ * every other request fails closed at 403, except local metadata/health routes.
  */
 export interface BrokerRequest {
     method: string;
@@ -62,7 +66,31 @@ export interface BrokerResponse {
     status: BrokerStatus;
     /** Upstream model-bound JSON body on 200; an error envelope otherwise. */
     body?: unknown;
+    /**
+     * Discriminant guard (PHASE-643 §3.0): a buffered `BrokerResponse` NEVER
+     * carries `kind`. A streamed 200-SSE forward that already wrote to the sink
+     * returns {@link BrokerHandled} (`{kind:"handled"}`) instead, so `"kind" in
+     * result` narrows the two apart in `handleHttp` (strict-TS valid).
+     */
+    kind?: never;
+}
+/**
+ * PHASE-643 §3.0 — the sentinel a 200-SSE forward returns AFTER it has streamed
+ * the response into the caller-provided sink (headers written + body piped). The
+ * HTTP adapter must NOT then write a second response; `"kind" in result` narrows
+ * this from a {@link BrokerResponse}.
+ */
+export interface BrokerHandled {
+    readonly kind: "handled";
 }
+/**
+ * PHASE-643 §3.0 — the minimal response surface the broker streams a 200-SSE
+ * forward into. `handleHttp` passes the node `http.ServerResponse`; non-HTTP
+ * callers pass nothing (buffered fallback). Restricted to the members the
+ * streaming write uses (`writeHead`/`headersSent`/`destroy`) plus the writable-
+ * stream surface `pipeline()` drives to completion.
+ */
+export type ResponseSink = Pick<http.ServerResponse, "writeHead" | "headersSent" | "destroy"> & NodeJS.WritableStream;
 /**
  * The lifecycle surface of the per-session local broker daemon (§3.2).
  * The LE starts one broker per session on `127.0.0.1:<ephemeral>` and
@@ -77,14 +105,72 @@ export interface ModelGatewayBroker {
     healthz(): Promise<boolean>;
     /** Handle one model-gateway request (the §3.2 route surface). */
     handle(req: BrokerRequest): Promise<BrokerResponse>;
+    /**
+     * PHASE-643 §3.0 — the streaming overload: a 200 `text/event-stream` response
+     * is proxied incrementally into `sink` and resolves {@link BrokerHandled};
+     * every other disposition (and a 200-SSE WITHOUT a sink) resolves a buffered
+     * {@link BrokerResponse}.
+     */
+    handle(req: BrokerRequest, sink: ResponseSink): Promise<BrokerResponse | BrokerHandled>;
     /** Tear down; zeroize the in-process upstream credential (§3.3). */
     stop(): Promise<void>;
 }
+/**
+ * The C4 ChatGPT-subscription OAuth bundle (PHASE-626 §3/§5) — the token
+ * material copied out of Codex's `~/.codex/auth.json` `tokens` object plus
+ * `last_refresh`. Stored (as JSON) under the SEPARATE keychain account
+ * `vendor-oauth-openai`, deliberately distinct from the `vendor-key-openai`
+ * (C3) account. Structure pinned against Codex CLI 0.144.4 (§13 OQ-2):
+ * `{auth_mode, tokens:{id_token, access_token, refresh_token, account_id}, last_refresh}`.
+ */
+export interface VendorOAuthBundle {
+    /** OAuth access token — `Authorization: Bearer <access_token>` upstream. */
+    access_token: string;
+    /** OAuth refresh token — the refresh-engine input; a SECOND secret (§5). */
+    refresh_token: string;
+    /** ChatGPT account id — the `ChatGPT-Account-Id` header (§13 OQ-1). */
+    account_id: string;
+    /**
+     * RFC3339 timestamp of the last successful refresh (advances on EVERY
+     * refresh success — §5 write-through merge rule). Gates the proactive-age
+     * threshold. NOT a secret.
+     */
+    last_refresh: string;
+    /** Optional id_token (carried through refreshes; not credential-bearing upstream). */
+    id_token?: string;
+}
+/**
+ * The credential class resolved by the broker's precedence engine (§5).
+ * The raw-string assumption of C1/C2/C3 does NOT extend to C4 — the bundle
+ * is a structured secret — so the resolved credential is DISCRIMINATED so
+ * every consumer (header builder, self-cred guard, fingerprint, upstream
+ * override) is class-aware (§5 "every consumer is class-aware").
+ *
+ * - `api_key`           — C1 `sk-ant-api…` / C3 `sk-…` (raw string).
+ * - `subscription_token`— C2 `sk-ant-oat…` (raw string; Bearer-only + C2 beta).
+ * - `oauth_bundle`      — C4 ChatGPT-subscription bundle (structured).
+ */
+export type ResolvedCredential = {
+    readonly class: "api_key";
+    readonly material: string;
+} | {
+    readonly class: "subscription_token";
+    readonly material: string;
+} | {
+    readonly class: "oauth_bundle";
+    readonly material: VendorOAuthBundle;
+};
 /**
  * The provider-scoped vendor-key storage API (§3.3) — [NEW], owner W1.
  * Reuses the existing keychain backend (OS keyring + file fallback).
  * Signatures only in W0; the implementation (keychain accounts
  * `vendor-key-<provider>`) lands in W1.
+ *
+ * PHASE-626 §5 widens this interface with the C4 OAuth-bundle methods +
+ * `clearVendorKey` (Stage-2 R1 Codex M-8 / R2 agy M-1). ALL apply the SAME
+ * keychain-only fail-closed gate as `get/setVendorKey`, factored through one
+ * shared gate helper so the two accounts (`vendor-key-*` / `vendor-oauth-*`)
+ * cannot drift.
  */
 export interface VendorKeyStore {
     /**
@@ -96,6 +182,25 @@ export interface VendorKeyStore {
     getVendorKey(provider: VendorProvider): Promise<string | null>;
     /** Persist the user's vendor key for `provider` (one-time setup step). */
     setVendorKey(provider: VendorProvider, key: string): Promise<void>;
+    /**
+     * Delete the user's C3-class vendor key for `provider` (Stage-2 R1 Codex
+     * M-8). Behind the SAME keychain-only gate as `setVendorKey` so `clear
+     * --class api-key` has a store-owned, gate-respecting deletion rather than
+     * a CLI-side keychain reach-around. Returns true iff a key was removed.
+     */
+    clearVendorKey(provider: VendorProvider): Promise<boolean>;
+    /**
+     * Read the C4 OAuth bundle for `provider` (§5). Same keychain-only gate as
+     * `getVendorKey`: `null` on the file backend (fail closed, no plaintext read).
+     */
+    getVendorOAuthBundle(provider: VendorProvider): Promise<VendorOAuthBundle | null>;
+    /**
+     * Persist the C4 OAuth bundle for `provider` as ONE atomic whole-bundle
+     * `setPassword` (§7 no torn tuple). Same keychain-only gate as `setVendorKey`.
+     */
+    setVendorOAuthBundle(provider: VendorProvider, bundle: VendorOAuthBundle): Promise<void>;
+    /** Delete the C4 OAuth bundle for `provider`. Returns true iff one was removed. */
+    clearVendorOAuthBundle(provider: VendorProvider): Promise<boolean>;
 }
 /**
  * The agent→broker token (§3.3): per-session, broker-minted, opaque,
@@ -109,17 +214,47 @@ export interface BrokerToken {
     readonly expiresAtMs: number;
 }
 /**
- * The result of a broker→vendor upstream call. The broker maps upstream
- * status to the agent-facing `BrokerStatus` (§3.2): an upstream 401/403
- * (bad/expired vendor key) → 502 (NOT a pass-through), every other status
- * carries through.
+ * The result of a broker→vendor upstream call (PHASE-643 §3.1). The client
+ * resolves at HEADERS — `status` + lowercased `headers` are known before the
+ * body is read — and the body is then consumed EXACTLY ONCE: either incrementally
+ * as a stream (the 200-SSE forward, §3.3) OR fully-buffered as text (every other
+ * disposition, §3.2). Both consumers are abortable by `stop()` (LOCK #643-2). The
+ * broker maps upstream status to the agent-facing `BrokerStatus` (§3.2): an
+ * upstream 401/403 (bad/expired vendor key) → 502 (NOT a pass-through), every
+ * other status carries through.
+ *
+ * LOCK #643-1 — one-shot body: `bodyStream()` and `readText()` are mutually
+ * exclusive AND single-use; a second or mixed call THROWS. This eliminates the
+ * dual-model ambiguity (a buffered `.body` alongside a stream) the phase closes.
  */
-export interface UpstreamResponse {
-    /** Raw upstream HTTP status. */
+export interface UpstreamResult {
+    /** Raw upstream HTTP status (known at headers, before the body is read). */
     status: number;
-    /** Parsed JSON body (model-bound). */
-    body?: unknown;
+    /** Upstream response headers with LOWERCASED keys (e.g. `content-type`). */
+    headers: Readonly<Record<string, string>>;
+    /**
+     * Consume the body ONCE as a Node stream — the 200-SSE incremental-forward
+     * path (§3.3). Destroying the returned stream cancels the upstream fetch. XOR
+     * with {@link readText} (LOCK #643-1).
+     */
+    bodyStream(): Readable;
+    /**
+     * Consume the body ONCE as fully-buffered text — every non-streamed
+     * disposition (non-SSE 200, any non-200, a 401 drain; §3.2). Has its OWN
+     * full-read timeout AND composes the broker abort signal, so a stalled read
+     * cancels immediately. XOR with {@link bodyStream} (LOCK #643-1).
+     */
+    readText(): Promise<string>;
 }
+/**
+ * @deprecated PHASE-643 renamed `UpstreamResponse` → {@link UpstreamResult}. The
+ * alias preserves the exported SYMBOL for type importers, but NOT the legacy
+ * `{status, body?}` SHAPE — implementors of {@link UpstreamClient.post} MUST
+ * migrate to the one-shot body surface (a TS implementor of the old shape fails
+ * to compile; a declared SemVer-major break — core 2.0 ships on the `@next`
+ * channel and every implementor is in-repo).
+ */
+export type UpstreamResponse = UpstreamResult;
 /**
  * The broker→vendor upstream HTTP client (§3.3/§3.4). INJECTED so W1 tests
  * use a stub (no real network). The real fetch-backed client lands when
@@ -129,13 +264,26 @@ export interface UpstreamClient {
     /**
      * POST the canonical request upstream. `headers` already includes the
      * synthesized vendor/version headers AND the injected upstream
-     * credential (the caller adds the credential header). Resolves with the
-     * upstream status + body; rejects only on a transport/network error
-     * (which the broker maps to its forward-error path).
+     * credential (the caller adds the credential header). Resolves at HEADERS
+     * with the upstream status + lowercased headers; the body is consumed ONCE
+     * via {@link UpstreamResult.bodyStream}/{@link UpstreamResult.readText}
+     * (PHASE-643 §3.1). Rejects only on a transport/network error (which the
+     * broker maps to its forward-error path).
+     *
+     * PHASE-626 §5 stop-lifecycle (Stage-2 R4 Codex #1): `signal` is the
+     * SECOND pinned-interface widening (alongside the new `VendorKeyStore`
+     * methods). The broker owns the outer credential-bearing frame, so it
+     * MUST be able to abort the in-flight model-forward on `stop()` drain-
+     * timeout — registering only `FetchUpstreamClient`'s PRIVATE timeout
+     * controller is unreachable from the broker. `FetchUpstreamClient`
+     * composes this broker signal with its internal timeout controller so
+     * either can abort the request. Optional so the W1 stub + older callers
+     * still satisfy the interface.
      */
     post(args: {
         url: string;
         headers: Readonly<Record<string, string>>;
         body: unknown;
-    }): Promise<UpstreamResponse>;
+        signal?: AbortSignal;
+    }): Promise<UpstreamResult>;
 }

package/dist/credential-broker/upstream-client.d.ts

@@ -1,4 +1,4 @@
-import type { UpstreamClient, UpstreamResponse } from "./types";
+import type { UpstreamClient, UpstreamResult } from "./types";
 /**
  * The production fetch-backed {@link UpstreamClient}. Constructed once per
  * broker session by the LE and injected into `LocalModelGatewayBroker`
@@ -16,5 +16,6 @@ export declare class FetchUpstreamClient implements UpstreamClient {
         url: string;
         headers: Readonly<Record<string, string>>;
         body: unknown;
-    }): Promise<UpstreamResponse>;
+        signal?: AbortSignal;
+    }): Promise<UpstreamResult>;
 }

package/dist/credential-broker/vendor-key-store.d.ts

@@ -1,4 +1,4 @@
-import type { VendorKeyStore, VendorProvider } from "./types";
+import type { VendorKeyStore, VendorOAuthBundle, VendorProvider } from "./types";
 /**
  * Keychain-backed implementation of {@link VendorKeyStore} (§3.3). Reads
  * the same keychain service the rest of CodeVibe uses (`getConfig()
@@ -51,4 +51,35 @@ export declare class KeychainVendorKeyStore implements VendorKeyStore {
      * per-session into broker memory.
      */
     setVendorKey(provider: VendorProvider, key: string): Promise<void>;
+    /**
+     * Delete the C3-class vendor key (Stage-2 R1 Codex M-8). Behind the SAME
+     * keychain-only gate as `setVendorKey`: on the file backend it FAILS CLOSED
+     * (throws, does NOT delete from `~/.codevibe`) rather than silently touching
+     * the plaintext store. Returns true iff a key was actually removed.
+     */
+    clearVendorKey(provider: VendorProvider): Promise<boolean>;
+    /**
+     * Read the C4 OAuth bundle (§5). KEYCHAIN-ONLY on the read side exactly like
+     * `getVendorKey`: on the file backend returns `null` (fail closed, no
+     * plaintext read) so a legacy / manually-placed bundle is never sourced.
+     * A corrupted (non-JSON) stored value is treated as absent (`null`) — the
+     * broker then fails closed rather than trusting a torn value.
+     */
+    getVendorOAuthBundle(provider: VendorProvider): Promise<VendorOAuthBundle | null>;
+    /**
+     * Persist the C4 OAuth bundle as ONE atomic whole-bundle `setPassword`
+     * (§7 — no torn tuple: access/refresh/account_id/last_refresh are written
+     * together or not at all). Same keychain-only gate as `setVendorKey`: FAILS
+     * CLOSED on the file backend. The token material is never logged.
+     */
+    setVendorOAuthBundle(provider: VendorProvider, bundle: VendorOAuthBundle): Promise<void>;
+    /**
+     * Delete the C4 OAuth bundle. Behind the SAME keychain-only gate: on the
+     * file backend it FAILS CLOSED (throws). Returns true iff one was removed.
+     * Clearing the bundle is a revocation — the broker must hold the §5 cross-
+     * process OAuth-account lock around this call so a concurrent refresh can
+     * not resurrect it (revocation wins); the store method itself is the
+     * gate-respecting primitive the locked caller uses.
+     */
+    clearVendorOAuthBundle(provider: VendorProvider): Promise<boolean>;
 }

package/dist/crypto/__tests__/encrypt-for-emit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto/encrypt-for-emit.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The on-wire shape a companion emits to AppSync `createEvent`.
+ */
+export interface EncryptedEmitPayload {
+    content: string;
+    metadata: any;
+    isEncrypted: boolean;
+}
+/**
+ * (#638) Decide how a mobile-visible event should be emitted.
+ *
+ * Returns the on-wire `{ content, metadata, isEncrypted }`:
+ *  - encryption state UNRESOLVED (`encryptionResolved === false`) → returns `null`:
+ *    the caller MUST drop the event (FAIL-CLOSED). Until resumeOrCreateSession has
+ *    set the session's encryption state we do NOT yet know whether the session is
+ *    encrypted, and `sessionKey` may still be a STALE prior-session key — so
+ *    treat unknown as encrypted and never emit plaintext. (#638 F1: closes the
+ *    plaintext-for-encrypted RACE where a hook event landing during the bootstrap
+ *    await, or a transient/generic resume error, left `sessionIsEncrypted=false`
+ *    and leaked cleartext.)
+ *  - `sessionKey` present → AES-256-GCM ciphertext + `{ encrypted: <meta> }`
+ *    (isEncrypted=true). A `null`/`undefined` `plainMetadata` passes through
+ *    untouched (some hook events carry none) — matching the shape mobile expects.
+ *  - CONFIRMED unencrypted/legacy session (resolved, no key AND `sessionIsEncrypted`
+ *    false) → plaintext (isEncrypted=false).
+ *  - session IS encrypted but keyless (`sessionIsEncrypted && !sessionKey`) →
+ *    returns `null`: the caller MUST drop the event (FAIL-CLOSED). Emitting
+ *    cleartext for an encrypted session is the confidentiality regression #638
+ *    exists to close. Routing every emit site through this ONE chokepoint means a
+ *    newly-added site cannot silently regress it.
+ *
+ * `encryptionResolved` defaults to `true` so existing 4-arg call sites (and every
+ * emit path whose session identity is already resolved) behave exactly as before;
+ * only a caller that can emit DURING session bootstrap needs to thread the flag.
+ *
+ * Pure: no logging, no I/O, no side effects. Callers own the drop log so the
+ * fail-closed decision is never silent.
+ */
+export declare function encryptForEmit(sessionKey: string | null, sessionIsEncrypted: boolean, plaintext: string, plainMetadata: any, encryptionResolved?: boolean): EncryptedEmitPayload | null;

package/dist/crypto/index.d.ts

@@ -1 +1,3 @@
 export { CryptoService, cryptoService, CryptoError, ENCRYPTION_VERSION } from './crypto-service';
+export { encryptForEmit } from './encrypt-for-emit';
+export type { EncryptedEmitPayload } from './encrypt-for-emit';

package/dist/daemon/__tests__/process-guards.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/daemon/index.d.ts

@@ -0,0 +1,2 @@
+export { installDaemonProcessGuards, isNetworkClass, } from './process-guards';
+export type { DaemonGuardLogger, DaemonProcessGuardOptions, } from './process-guards';

package/dist/daemon/process-guards.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Minimal structural logger — every plugin's `createLogger(...)` Logger satisfies
+ * it, and so does any object with an `error(message, data?)` method.
+ */
+export interface DaemonGuardLogger {
+    error(message: string, data?: any): void;
+}
+export interface DaemonProcessGuardOptions {
+    /**
+     * Invoked for a genuinely fatal (non-network-class) `uncaughtException`. A
+     * plugin passes its existing graceful-shutdown fn here. When omitted, the guard
+     * falls back to `process.exit(1)` so a fatal fault still terminates the daemon.
+     */
+    onFatal?: (error: Error) => void;
+}
+/**
+ * True when `err`'s `code` or `message` matches a known transient network-class
+ * signature.
+ */
+export declare function isNetworkClass(err: unknown): boolean;
+/**
+ * Install the shared daemon process guards.
+ *
+ * Both handlers are SYMMETRIC (#638 F6): a network-class fault is transient — the
+ * AppSync two-phase reconnect heals it — so log and CONTINUE; anything else is a
+ * genuinely-unexpected (programmer/app) fault that could leave a corrupted daemon
+ * lying ACTIVE (a2's heartbeat re-asserts `status: ACTIVE`), so treat it as fatal
+ * and hand off to `opts.onFatal` (a clean shutdown incl. INACTIVE) or `process.exit(1)`.
+ *
+ * - `unhandledRejection` → network-class → log + CONTINUE; otherwise fatal. EXPECTED
+ *   transient app/GraphQL rejections are handled AT their emit source with `.catch()`
+ *   (audited across the plugins), so they never reach here — only a truly-unhandled
+ *   programmer-bug rejection is fatal. This is intentionally symmetric with
+ *   `uncaughtException`: before #638 an unhandledRejection was ALWAYS non-fatal, which
+ *   masked a corrupted daemon that kept advertising connected.
+ * - `uncaughtException` → network-class → log + CONTINUE; otherwise fatal.
+ */
+export declare function installDaemonProcessGuards(logger: DaemonGuardLogger, opts?: DaemonProcessGuardOptions): void;

package/dist/index.d.ts

@@ -1,7 +1,13 @@
 export { KeychainManager, keychainManager, KeychainError } from './keychain';
 export { CryptoService, cryptoService, CryptoError, ENCRYPTION_VERSION } from './crypto';
+export { encryptForEmit } from './crypto';
+export type { EncryptedEmitPayload } from './crypto';
+export { installDaemonProcessGuards, isNetworkClass } from './daemon';
+export type { DaemonGuardLogger, DaemonProcessGuardOptions } from './daemon';
 export { AppSyncClient, AppSyncGraphQLError, DownloadUrlResponse } from './appsync';
 export { queries, mutations, subscriptions } from './appsync';
+export { isPersistedEventResult } from './appsync';
+export type { PutContextItemInput } from './appsync';
 export { AuthService, authService } from './auth';
 export { bindOAuthServer, PRIMARY_PORT, PORT_RANGE_SIZE } from './auth';
 export { runAuthCli } from './auth';
@@ -14,7 +20,7 @@ export { parseInteractivePrompt, normalizeSnapshot, } from './prompt-parser';
 export type { ParsedInteractivePrompt, PromptKind, InteractivePromptOption, } from './prompt-parser';
 export { resumeOrCreateSession, prepareSessionEncryption, rekeySessionForNewDevices, startDeviceKeyWatcher, registerDeviceEncryptionKey, prepareEventTimestamp, _resetPrepareEventTimestampForTesting, } from './session';
 export type { ResumeOrCreateSessionInput, ResumeOrCreateSessionResult } from './session';
-export { detectInstalledAgents, pushDetectedAgents, applyPerSessionOrchestrationOverride, runOrchestrationCli, V1_ORCHESTRATION_PROMPT_KIND, V1_ORCHESTRATION_OPTIONS, mapOptionNumberToUserDecisionKind, mapOptionToUserDecisionKind, } from './orchestration';
+export { detectInstalledAgents, pushDetectedAgents, V1_ORCHESTRATION_PROMPT_KIND, V1_ORCHESTRATION_OPTIONS, mapOptionNumberToUserDecisionKind, mapOptionToUserDecisionKind, } from './orchestration';
 export type { DetectableAgent, V1OrchestrationOption, V1UserDecisionKind, } from './orchestration';
 export * as Reviewer from './reviewer';
 export * as AuditKeys from './audit-keys';
@@ -27,7 +33,16 @@ export * as Continuation from './continuation';
 export * as StructuralSummary from './structural-summary';
 export { runOrchestrationShell } from './orchestration-shell';
 export { runCompanionMode } from './companion-mode';
-export { pickMode, TierError } from './orchestration-shell';
+export { pickMode } from './orchestration-shell';
 export { emitShellEvent, createShellEventEmitter } from './orchestration-shell';
 export { processMarkers, withRoleMarker } from './orchestration-shell';
+export { ToolActivityOutbox, type ToolActivityOutboxOptions, type ListPendingResult, } from './tool-activity';
+export { ToolActivityLedger, LedgerEntrySchema, LedgerFileSchema, LegacyOwnedFileSchema, type LedgerEntry, type LedgerFile, type LegacyOwnedFile, type OccurrenceRef, type ToolActivityLedgerOptions, } from './tool-activity';
+export { ToolReplayCursor, ReplayCursorStateSchema, type ReplayCursorState, type ReplayFrame, type ReadFramesResult, type ToolReplayCursorOptions, } from './tool-activity';
+export { ToolActivitySessionMap, InProcessRolloutLock, SessionMapRecordSchema, type RolloutLock, type RolloutOwnership, type SessionMapRecord, type ToolActivitySessionMapOptions, } from './tool-activity';
+export { ToolActivityConsolidator, isSessionKeyStaleError, type ObservedOccurrence, type ObserveDisposition, type ToolActivityTransport, type ToolActivityConsolidatorOptions, } from './tool-activity';
+export { SocketRolloutLock, type SocketRolloutLockOptions, FlockRolloutLock, type FlockRolloutLockOptions, type FlockSyncFn, type FlockFlag, createRolloutLock, type CreateRolloutLockOptions, } from './tool-activity';
+export { ToolActivityOccurrenceSchema, ToolActivityDetailSchema, ToolActivityGroupSchema, ToolActivityManifestSchema, ToolActivityOutboxEnvelopeSchema, type ToolActivityOccurrence, type ToolActivityDetail, type ToolActivityGroup, type ToolActivityManifest, type ToolActivityOutboxEnvelope, } from './tool-activity';
+export { digestOf, stableStringify } from './tool-activity';
+export { CONTEXT_SESSION_PSEUDO_TASK_NAMESPACE, deriveSessionPseudoTaskId, auditPartitionTaskIdFor, buildContextItemWireRow, decryptContextItemWireRow, type ContextItem, type ContextItemWireRow, } from './orchestration-shell';
 export type { Mode, Tier, PlannerDecision, AgentKind, PlannerHealthState, OrchestrationState, OrchestrationAction, ConversationEntry, RunningTaskState, ReviewerSeatState, GateState, ExecutionEventEntry, RefusalEventEntry, BypassEventEntry, MobileEventEntry, EventStreamEntry, QueuedTask, PendingClarification, LastModeFile, } from './orchestration-shell';