@quantiya/codevibe-core 2.0.7 → 2.0.9

package/dist/orchestration-shell/context-items.d.ts

@@ -81,6 +81,8 @@ export interface ContextItem {
     prev_hash: string | null;
     /** Typed payload per kind. */
     body: unknown;
+    /** Non-rendered counters/locator metadata; excluded from semantic content ids. */
+    telemetry?: unknown;
     /** ISO timestamp the item was authored (corpus-ready, §4.1). */
     authored_at: string;
 }
@@ -91,6 +93,7 @@ export interface ContextItemDraft {
     sensitivity: ContextItemSensitivity;
     visible_to: ContextItemProjectionRole[];
     body: unknown;
+    telemetry?: unknown;
     task_id?: string;
     track_id?: string;
     refs?: string[];

package/dist/orchestration-shell/declared-test-runner.d.ts

@@ -1,6 +1,8 @@
 import type { Dirent, Stats } from 'node:fs';
 import type { runShellCommand } from '../local-executor/verification-gates/shell-runner';
 import type { ShadowDiffFile } from '../local-executor/workspace-shadow';
+import type { ProcessCleanupOwner } from '../local-executor/process-tree';
+import { type WorkspaceRootAuthority } from '../local-executor/workspace-authority';
 /** Default per-file wall-clock budget for a declared-test `node` run. */
 export declare const DECLARED_TEST_TIMEOUT_MS = 300000;
 /**
@@ -20,6 +22,9 @@ export interface DeclaredTestResult {
     ranCount: number;
     /** Never-written declared file / empty-or-JS-less declared dir (§3.D, VISIBLE). */
     skipped: string[];
+    /** False means the caller must retain the test cwd. */
+    workspaceCleanupSafe?: false;
+    workspaceCleanupOwner?: ProcessCleanupOwner;
 }
 export interface RunDeclaredTestSurfacesArgs {
     /** cwd holding the agent's changes (the shadow root). */
@@ -37,8 +42,8 @@ export interface RunDeclaredTestSurfacesArgs {
     realpath: (p: string) => Promise<string>;
     /** Injected — file/dir discriminate on the resolved target. */
     stat: (p: string) => Promise<Stats>;
-    /** Injected — directory expansion. */
-    readdir: (p: string) => Promise<Dirent[]>;
+    /** @internal test-only directory expansion seam; production streams via opendir. */
+    readdir?: (p: string) => Promise<Dirent[]>;
     /**
      * Injected (#609) — read a file's UTF-8 contents (nearest-`package.json` framework detection).
      * A throw (ENOENT / EISDIR / unreadable) is TOTAL-handled by `detectFramework` (→ keep walking up,
@@ -47,6 +52,20 @@ export interface RunDeclaredTestSurfacesArgs {
     readFile: (p: string) => Promise<string>;
     /** Default `DECLARED_TEST_TIMEOUT_MS`. */
     timeoutMs?: number;
+    /** Cooperative session-shutdown cancellation for spawned test processes. */
+    signal?: AbortSignal;
+    /** Exact snapshot incarnation selected before declared-test discovery. */
+    shadowRootAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic root-replacement seam after initial validation. */
+    afterAuthorityCheck?: () => Promise<void> | void;
+    /** @internal deterministic A→B→A restoration before the final check. */
+    beforeAuthorityCompletion?: () => Promise<void> | void;
+    /** @internal deterministic root replacement immediately before framework discovery. */
+    beforeFrameworkDiscovery?: () => Promise<void> | void;
+    /** @internal helper-held missing-intermediate authority seam. */
+    beforeClassificationMissing?: () => Promise<void> | void;
+    /** @internal helper-held missing-leaf completion seam. */
+    beforeClassificationCompletion?: () => Promise<void> | void;
 }
 /**
  * Canonicalize a declared scope / diff path for comparison: collapse backslashes to

package/dist/orchestration-shell/direct-file-delete.d.ts

@@ -0,0 +1,22 @@
+export interface DirectFileDeleteRequest {
+    paths: string[];
+}
+export interface DirectFileDeleteResult {
+    deleted: string[];
+}
+/**
+ * Recognize only a closed, deterministic delete request. Anything ambiguous
+ * remains on the ordinary planner/implementor path.
+ *
+ * Supported examples:
+ *   Delete only a.txt.
+ *   Please delete only `a file.txt` and `b.txt`.
+ *   Delete only a.txt. Do not create, modify, or delete any other file.
+ */
+export declare function parseDirectFileDeleteRequest(text: string): DirectFileDeleteRequest | null;
+/**
+ * Delete only the explicitly named regular files. All targets are validated
+ * before the first mutation; each unlink is bound to the captured parent and
+ * file incarnation and directory-fsynced by the anchored helper.
+ */
+export declare function executeDirectFileDelete(cwd: string, request: DirectFileDeleteRequest): Promise<DirectFileDeleteResult>;

package/dist/orchestration-shell/emit-shell-event.d.ts

@@ -1,5 +1,6 @@
 import { AppSyncClient } from '../appsync';
 import { type Session } from '../types';
+import type { E1ProducerKind } from '../e1';
 /**
  * §3 LOCK lines 173-181. Names + per-type metadata shapes are part of
  * the Stage A contract. CP-1.a ships the union; CP-1.b/c/d add call
@@ -34,6 +35,12 @@ export interface ShellEventEmit {
     writerEventNonce?: string;
     /** Proven local key mismatch: emit the safe legacy joined fallback. */
     disableWriterAttestation?: boolean;
+    ownerToken?: string;
+    promptId?: string;
+    producerKind?: E1ProducerKind;
+    mobileActionable?: boolean;
+    resolvedPromptId?: string;
+    resolutionAt?: string;
 }
 /**
  * Test seam — allows the unit tests to swap the AppSync client without

package/dist/orchestration-shell/explicit-tty-exit.d.ts

@@ -1,6 +1,5 @@
 export interface ExplicitTtyExitDeps {
-    runPlannerTeardown: () => Promise<void>;
-    retireSession: () => Promise<void>;
+    runTeardown: () => Promise<void>;
     unmount: () => void;
 }
 export interface ExplicitTtyExitCoordinator {

package/dist/orchestration-shell/flag-command.d.ts

@@ -0,0 +1,81 @@
+import type { AppSyncClient } from '../appsync';
+import { type AuditBrowserModel } from './audit-browser';
+import type { AuditFlagIndex } from './types';
+/**
+ * Build the session-scoped flag index from a just-rendered `/audit` browser
+ * model. Called at the `/audit <task-id>` dispatch site on a successful
+ * render; the entrypoint retains the result via `AUDIT_FLAG_INDEX_RETAINED`
+ * (last render wins — the reducer carries the `flagged` set forward).
+ * Shape-only: coordinates + wire kind + the precomputed flaggable bit; the
+ * decrypted payload never leaves the render.
+ */
+export declare function buildAuditFlagIndex(taskId: string, model: AuditBrowserModel): AuditFlagIndex;
+/**
+ * The minimal AppSync surface `/flag` needs — the existing
+ * `recordExecutionEvent` Class-A method (D4: the full plumbing below it
+ * already exists). Narrowed so tests inject a stub without the full client.
+ */
+export type FlagAppSyncClient = Pick<AppSyncClient, 'recordExecutionEvent'>;
+export interface RunFlagCommandDeps {
+    /** The authenticated AppSync client. */
+    appsyncClient: FlagAppSyncClient;
+    /** The retained last-rendered `/audit` index (null → never rendered). */
+    index: AuditFlagIndex | null;
+    /** The `/flag <entry-id>` argument. */
+    entryId: string;
+    /** Optional free-text note (encrypted into the flag payload; never logged). */
+    note?: string;
+    /** The shell session (locator/emit scoping + session-key lookup). */
+    sessionId: string;
+    /** Test seam — defaults to `keychainManager.getSessionKey(sessionId)`. */
+    getSessionKeyFn?: (sessionId: string) => Promise<string | null>;
+}
+/**
+ * The outcome of a `/flag` run. Every arm carries a ready-to-render `line`;
+ * `runFlagCommand` NEVER throws (mirrors `runAuditBrowser`).
+ */
+export type RunFlagCommandResult = {
+    kind: 'no_index';
+    line: string;
+} | {
+    kind: 'unknown_entry';
+    line: string;
+} | {
+    kind: 'not_flaggable';
+    line: string;
+} | {
+    kind: 'missing_seq';
+    line: string;
+} | {
+    kind: 'already_flagged';
+    line: string;
+} | {
+    kind: 'no_session_key';
+    line: string;
+} | {
+    kind: 'flagged';
+    entryId: string;
+    line: string;
+} | {
+    kind: 'server_rejected';
+    line: string;
+    reason: string;
+} | {
+    kind: 'error';
+    line: string;
+    reason: string;
+};
+/** `/flag` before any `/audit <task-id>` render — nothing to resolve against. */
+export declare const FLAG_NO_INDEX_LINE: string;
+/**
+ * Run `/flag <entry-id>`: retained-index resolve → client approve-subset
+ * check → locator + dedup-key construction → Class-A `FLAG_BAD_APPROVAL`
+ * emit with locator forwarding. Returns a discriminated result the shell
+ * renders; the CALLER dispatches `AUDIT_FLAG_RECORDED` on the `flagged` arm
+ * (the runner stays store-free, like `runAuditBrowser`).
+ */
+export declare function runFlagCommand(deps: RunFlagCommandDeps): Promise<RunFlagCommandResult>;
+/**
+ * Render a `RunFlagCommandResult` as the inline `/flag` shell output line.
+ */
+export declare function renderFlagResultText(result: RunFlagCommandResult): string;

package/dist/orchestration-shell/gate-decision-submit.d.ts

@@ -152,6 +152,11 @@ export interface GroupDecisionSubmitDeps {
      * after an accept-family COMMIT. ABSENT → no-op (tests).
      */
     markAccepted?: (taskGroupId: string) => Promise<void>;
+    /**
+     * Accept-family finalizer: retire PREPARED/APPLIED authority by exact base or
+     * post-image proof before marking accepted or clearing reviewed bundles.
+     */
+    finalizeAcceptedGroup: (taskGroupId: string) => Promise<void>;
     /**
      * HIGH-1 / LOCK #589-J — persist the CLAIMED-but-not-COMMITted decision to the
      * durable record, called IMMEDIATELY after the CLAIM phase mints `claimToken`
@@ -170,6 +175,12 @@ export interface GroupDecisionSubmitDeps {
      * (so a later reconcile never re-drives it). ABSENT → no-op (tests).
      */
     clearPendingDecision?: (taskGroupId: string) => Promise<void>;
+    /**
+     * Reclaim terminal durable group bytes after COMMIT, convergence, lifecycle
+     * transition, reissue (when requested), and pending-decision removal. The
+     * durable store rechecks every crash-authority predicate before deleting.
+     */
+    gcTerminalGroup?: (taskGroupId: string) => Promise<void>;
     /**
      * Drive the per-track render flip through the SAME `emitGroupConvergence`
      * chokepoint (D2): accept-family → tracks stay/flip `Passed`; reject-family →

package/dist/orchestration-shell/gate-prompts.d.ts

@@ -429,12 +429,72 @@ export interface ReviewSummaryRoundModel {
     /** Aggregated REVISE seat findings (the auto-revision driver), or null. */
     readonly reviseNotes: string | null;
 }
+export interface ReviewSummaryTerminalModel {
+    readonly schemaVersion: number;
+    readonly requirements: {
+        readonly problem: string;
+        readonly expectedOutputs: ReadonlyArray<string>;
+    };
+    readonly implementors: ReadonlyArray<{
+        readonly agent: string;
+        readonly trackIndex: number | null;
+        readonly taskId: string;
+    }>;
+    readonly reviewQuorum: {
+        readonly seats: ReadonlyArray<{
+            readonly seatId: number;
+            readonly role: string;
+            readonly agent: string;
+        }>;
+        readonly roundCount: number;
+        readonly revisionCount: number;
+    };
+    readonly mergeGate: {
+        readonly applicable: boolean;
+        readonly outcome: string;
+        readonly resolution: string | null;
+    };
+    readonly durations: {
+        readonly taskElapsedMs: number | null;
+        readonly reviewerElapsedMs: number | null;
+        readonly availability: string;
+    };
+    readonly tokenUsage: {
+        readonly knownTotal: number | null;
+        readonly knownInput: number | null;
+        readonly knownOutput: number | null;
+        readonly knownCachedInput: number | null;
+        readonly availability: string;
+        readonly unavailableRoles: ReadonlyArray<string>;
+        readonly invocations: ReadonlyArray<ReviewSummaryTokenInvocationModel>;
+    };
+    readonly residualRisks: ReadonlyArray<string>;
+}
+export interface ReviewSummaryTokenInvocationModel {
+    readonly role: string;
+    readonly agent: string;
+    readonly taskId: string | null;
+    readonly trackIndex: number | null;
+    readonly round: number | null;
+    readonly gateId: string | null;
+    readonly seatId: number | null;
+    readonly reviewerRole: string | null;
+    readonly inputTokens: number | null;
+    readonly outputTokens: number | null;
+    readonly cachedInputTokens: number | null;
+    readonly totalTokens: number | null;
+    readonly elapsedMs: number | null;
+    readonly availability: string;
+    readonly unavailableReason: string | null;
+}
 /**
  * The fully-extracted, render-ready per-round review summary model. PURE
  * function of the decrypted summary. `null`-attached (entry has no
  * `reviewSummary`) → the panel renders nothing extra (fail-open base prompt).
  */
 export interface ReviewSummaryPanelModel {
+    /** Additive P15 schema-v2 terminal header; null for legacy schema v1. */
+    readonly terminal: ReviewSummaryTerminalModel | null;
     readonly rounds: ReadonlyArray<ReviewSummaryRoundModel>;
     /** finalOutcome display value (proceed | auto_revise | escalate). */
     readonly finalOutcome: string;
@@ -448,6 +508,61 @@ export interface ReviewSummaryPanelModel {
  * object degrades to an empty/safe model, never throws.
  */
 export interface DecryptedReviewSummaryInput {
+    readonly schemaVersion?: number;
+    readonly requirements?: {
+        readonly problem?: string;
+        readonly expectedOutputs?: ReadonlyArray<string>;
+    };
+    readonly implementors?: ReadonlyArray<{
+        readonly agent?: string;
+        readonly trackIndex?: number;
+        readonly taskId?: string;
+    }>;
+    readonly reviewQuorum?: {
+        readonly seats?: ReadonlyArray<{
+            readonly seatId?: number;
+            readonly role?: string;
+            readonly agent?: string;
+        }>;
+        readonly roundCount?: number;
+        readonly revisionCount?: number;
+    };
+    readonly mergeGate?: {
+        readonly applicable?: boolean;
+        readonly outcome?: string;
+        readonly resolution?: string;
+    };
+    readonly durations?: {
+        readonly taskElapsedMs?: number;
+        readonly reviewerElapsedMs?: number;
+        readonly availability?: string;
+    };
+    readonly tokenUsage?: {
+        readonly knownTotal?: number;
+        readonly knownInput?: number;
+        readonly knownOutput?: number;
+        readonly knownCachedInput?: number;
+        readonly availability?: string;
+        readonly unavailableRoles?: ReadonlyArray<string>;
+        readonly invocations?: ReadonlyArray<{
+            readonly role?: string;
+            readonly agent?: string;
+            readonly taskId?: string;
+            readonly trackIndex?: number;
+            readonly round?: number;
+            readonly gateId?: string;
+            readonly seatId?: number;
+            readonly reviewerRole?: string;
+            readonly inputTokens?: number;
+            readonly outputTokens?: number;
+            readonly cachedInputTokens?: number;
+            readonly totalTokens?: number;
+            readonly elapsedMs?: number;
+            readonly availability?: string;
+            readonly unavailableReason?: string;
+        }>;
+    };
+    readonly residualRisks?: ReadonlyArray<string>;
     readonly rounds?: ReadonlyArray<{
         readonly round?: number;
         readonly proposal?: string;
@@ -458,6 +573,7 @@ export interface DecryptedReviewSummaryInput {
             readonly decision?: string;
             readonly reasoning?: string;
             readonly suggestedChanges?: ReadonlyArray<string>;
+            readonly residualObservations?: ReadonlyArray<string>;
         }>;
         readonly outcome?: string;
         readonly reviseNotes?: string;

package/dist/orchestration-shell/index.d.ts

@@ -2,14 +2,16 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import { AppSyncClient } from '../appsync';
 import { Session } from '../types';
 import { OrchestrationStore } from './store';
+import { AdvisoryAttachmentJournal } from './advisory-attachment-journal';
 import type { ImageAttachment } from './types';
-import { type GroupDecisionSubmitDeps } from './gate-decision-submit';
+import { type GateDecisionSubmitDeps, type GroupDecisionSubmitDeps } from './gate-decision-submit';
 import { type ContinuationCliResult, type ContinuationCliDeps } from './slash-routes/continuation';
 import { loadReviewerWizardData } from './slash-routes/reviewers';
 import { createShellEventEmitter } from './emit-shell-event';
 import { type AgentMentionIntent, type CommandIntentTarget } from './command-intent';
 import { type BrainstormPanelActiveAgent } from './brainstorm-quorum';
 import { type RunAuditBrowserResult } from './audit-runner';
+import { type RunFlagCommandResult } from './flag-command';
 import { Tier } from './types';
 import type { ConversationEntry, PendingClarification } from './types';
 import { type GatePromptEnvelope, type DecryptedReviewSummaryInput } from './gate-prompts';
@@ -22,6 +24,7 @@ import type { LocalGemmaAdvisoryRunner } from '../planner/local-advisory';
 import type { LocalExecutor } from '../local-executor';
 import type { WorkItemInput, DisjointnessRejection, RevertManifestStore } from '../local-executor';
 import type { QuorumLoop } from './quorum-loop';
+import { type InvocationUsageSnapshot } from '../reviewer/token-usage';
 import { ensureFreshContextStore } from './context-store';
 import type { EnsureFreshResult } from './context-store';
 import { contextItemOccurrence, type ContextDurabilityReceipt } from './context-items';
@@ -43,6 +46,8 @@ export interface RunOrchestrationShellArgs {
      * teardown `finally` is armed; until then the admitting CLI owns retirement.
      */
     acceptSessionLifecycleOwnership?: () => void;
+    /** @internal isolated durable advisory-attachment authority for tests. */
+    advisoryAttachmentJournal?: AdvisoryAttachmentJournal;
     /**
      * CP-1.b IMPL r2 H-3 — Optional planner adapter. When supplied,
      * `runOrchestrationShell` binds the active session via
@@ -228,6 +233,7 @@ export { compactSessionContext, maybeFireCompactionSafetyValve, rehydrateSession
 export { routeSlashCommand, applySlashOutput, type SlashOutput, type ShellAction, } from './slash-router';
 export { buildAuditBrowserModel, routeAuditEntry, auditKindLabel, auditKindCopy, renderAuditBrowserText, renderAuditEntryText, ENTRY_DETAILS_UNAVAILABLE, NO_AUDIT_ENTRIES, AUDIT_LOG_TOO_LARGE, AUDIT_LOG_TITLE, AUDIT_BROWSER_MAX_HEADLINE, WIRE_PUBLIC_PLAINTEXT_KINDS, type AuditBrowserModel, type AuditEntryModel, type AuditReviewerVerdictModel, type AuditTaskAuthorizedModel, type DecryptContentFn, } from './audit-browser';
 export { runAuditBrowser, renderAuditResultText, AUDIT_BROWSER_UPGRADE_HINT, type RunAuditBrowserResult, type RunAuditBrowserDeps, } from './audit-runner';
+export { buildAuditFlagIndex, runFlagCommand, renderFlagResultText, FLAG_NO_INDEX_LINE, type RunFlagCommandResult, type RunFlagCommandDeps, type FlagAppSyncClient, } from './flag-command';
 export { AuditLogPanel } from './components/AuditLogPanel';
 export { reducer } from './reducer';
 export { createOrchestrationStore, type OrchestrationStore } from './store';
@@ -382,7 +388,18 @@ export declare function handleSubscribedEvent(event: Event, store: Orchestration
  * and DROPS (never crashes the shell, never submits ciphertext). Async — the sync
  * subscription callback fires-and-forgets via `void`; every throw is caught here.
  */
-export declare function routeMobileUserPrompt(event: Event, sessionKeyResolver: ((sessionId: string) => Promise<string | null>) | undefined, submit: (text: string, images?: string[], options?: ShellSubmitOptions) => Promise<void>, updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>): Promise<void>;
+export declare function routeMobileUserPrompt(event: Event, sessionKeyResolver: ((sessionId: string) => Promise<string | null>) | undefined, submit: (text: string, images?: string[], options?: ShellSubmitOptions) => Promise<void>, updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>): Promise<boolean>;
+/**
+ * Route a mobile composer reply through the desktop's canonical gate state
+ * machine. Mobile always transports the text as an encrypted `USER_PROMPT`;
+ * only the desktop that owns the live prompt interprets it as a numbered
+ * option, a required note, `/cancel`, or ordinary free text.
+ *
+ * Returns `true` only when the active gate consumed the input. A non-numeric
+ * line against an awaiting-number gate remains an ordinary prompt and returns
+ * `false`, matching the desktop TTY behavior.
+ */
+export declare function routeMobileGatePromptInput(deps: GateDecisionSubmitDeps, text: string): Promise<boolean>;
 /**
  * Build the single `(event) => void` callback the AppSync events subscription
  * invokes. Routes each delivered event to exactly ONE handler:
@@ -787,6 +804,14 @@ export interface HandleShellUserInputDeps extends StructuralSummaryRunDeps {
      * rewrite without live fetch / decrypt.
      */
     runAuditBrowserFn?: (taskId: string) => Promise<RunAuditBrowserResult>;
+    /**
+     * O1 C1 (#652) — Test seam for the async `/flag <entry-id>` dispatch.
+     * Defaults to `runFlagCommand` over `args.appsyncClient` + the retained
+     * `store` flag index + `args.session.sessionId`. Tests inject a stub to
+     * drive the PENDING-marker rewrite (+ the `AUDIT_FLAG_RECORDED` dispatch
+     * on the `flagged` arm) without live emit / keychain I/O.
+     */
+    runFlagCommandFn?: (entryId: string, note?: string) => Promise<RunFlagCommandResult>;
     /**
      * CP-4 §4.2 — Test seam for the pre-classify context-store refresh. Defaults
      * to the real `ensureFreshContextStore` (probe → recompute-if-stale → persist
@@ -840,10 +865,12 @@ export interface HandleShellUserInputDeps extends StructuralSummaryRunDeps {
  * could overlap and interleave the clarification state machine
  * (USER_INPUT bookkeeping + classify + PLANNER_DECISION), corrupting it.
  *
- * Slash commands (`text.startsWith('/')`, matching `handleShellUserInput`'s own
- * routing) bypass the queue: they're fast, never trigger a planner classify,
- * never touch clarification state, and include `/quit` — so they must stay
- * responsive instead of waiting behind a slow/hung planner turn.
+ * Slash commands (`text.trimStart().startsWith('/')`, matching
+ * `handleShellUserInput`'s own routing) bypass the queue: they're fast, never
+ * trigger a planner classify, never touch clarification state, and include
+ * `/quit` — so they must stay responsive instead of waiting behind a slow/hung
+ * planner turn. Leading paste whitespace is presentation noise, not permission
+ * to reinterpret an explicit command as natural language.
  *
  * The returned function preserves the caller-visible contract: it returns the
  * promise for THIS submission's processing (so an awaiting caller still gets the
@@ -933,6 +960,7 @@ export interface BrainstormTurnOwnership {
             authorAgent: BrainstormPanelActiveAgent;
             status: 'completed' | 'quota_walled' | 'failed';
             boundedBody: string;
+            usage: InvocationUsageSnapshot;
         }>;
         prompt: {
             kind: 'legacy_joined';

package/dist/orchestration-shell/planner-offer-e1.d.ts

@@ -0,0 +1,97 @@
+import type { ShellEventEmit, ShellEventEmitResult } from './emit-shell-event';
+/** The run-scoped shell emitter (`createShellEventEmitter(...)`). */
+export type ShellEmitter = (args: ShellEventEmit) => Promise<ShellEventEmitResult>;
+/** The run-scoped `openPrompts` TTL co-refresh transport (§3.1). */
+export type OpenPromptTtlRefresher = (promptIds: string[]) => Promise<string[]>;
+/** Everything the ledger needs to (re-)emit an offer raise. */
+export interface PlannerOfferRaiseContext {
+    sessionId: string;
+    /** The offer question — the INTERACTIVE_PROMPT content (re-raised verbatim). */
+    content: string;
+    /** The offer payload — the INTERACTIVE_PROMPT metadata (re-raised verbatim). */
+    metadata: Record<string, unknown>;
+    agentType?: string;
+    title?: string;
+}
+/**
+ * The core CORE_OFFER producer ledger + durable-ledger refresh loop. A single
+ * instance lives per process (one orchestration shell per process); `beginRun`
+ * re-binds the transports + resets state for a fresh run.
+ */
+export declare class PlannerOfferE1Ledger {
+    /** Open offers, keyed by the offer's stable `conversationEntryId` (§6a-4). */
+    private readonly raises;
+    /** promptIds whose raise emit is un-acked → retry-until-ack (mirrors the plugins'
+     * `e1NeedsReRaise`). */
+    private readonly needsReRaise;
+    /** promptIds whose resolution emit is un-acked → retry-until-ack (F-C4). */
+    private readonly pendingResolutions;
+    private timer;
+    private emit;
+    private refreshTtl;
+    private readonly refreshMs;
+    private draining;
+    constructor(opts?: {
+        refreshMs?: number;
+    });
+    /**
+     * Install the run-scoped TTL-refresh transport and RESET all per-run state. Call
+     * once at shell start; a re-run (tests) gets a clean ledger + no stale timer.
+     */
+    beginRun(refreshTtl: OpenPromptTtlRefresher): void;
+    /**
+     * F-C1 — raise (or re-present) a planner offer and INSPECT the emit result. On a
+     * transient failure (`{emitted:false}` or a throw) PARK the promptId for
+     * retry-until-ack. First presentation mints a fresh secret + committed promptId;
+     * a re-present across turns reuses it (stable id → the backend re-raises on the
+     * `ownerToken=:token` branch, no duplicate row). Never throws.
+     */
+    raiseOffer(emit: ShellEmitter, conversationEntryId: string, ctx: PlannerOfferRaiseContext): Promise<void>;
+    /**
+     * F-C4 — resolve an offer: emit the SIGNED resolution NOTIFICATION so its
+     * `openPrompts` row exact-clears, retried-until-ack. The ledger identity is moved
+     * OUT of the open-offer set (stops refresh/re-raise) INTO the pending-resolution
+     * set and is NOT dropped until the clear is backend-acknowledged (or is proven
+     * un-attestable → over-nag to TTL). A no-op if the offer never raised a row (a
+     * pre-E1 in-flight offer). Never throws.
+     */
+    resolveOffer(emit: ShellEmitter, conversationEntryId: string, sessionId: string): Promise<void>;
+    /** Stop the refresh timer (shell teardown). Idempotent. */
+    stopTimer(): void;
+    /** Is there a LIVE open-offer ledger entry for this entryId? (content-key floor) */
+    hasOpenOffer(conversationEntryId: string): boolean;
+    /** The committed promptId for an open offer (undefined once resolved/absent). */
+    promptIdFor(conversationEntryId: string): string | undefined;
+    isParkedForReRaise(promptId: string): boolean;
+    hasPendingResolution(promptId: string): boolean;
+    /** Run ONE refresh tick synchronously (the interval calls this; exposed for tests). */
+    runTick(): Promise<void>;
+    private getOrCreateEntry;
+    private buildRaiseEmit;
+    /**
+     * Emit ONE offer raise + park on failure (F-C1). ACK (`{emitted:true}`) clears any
+     * retry flag; `{emitted:false}` or a throw parks the promptId so a later tick
+     * re-emits until the backend writes the row.
+     */
+    private emitRaise;
+    /**
+     * Emit ONE resolution + retry-until-ack (F-C4). ACK (`{emitted:true}`) drops the
+     * identity (the row exact-cleared, or the conditional Delete no-op'd for an
+     * already-gone row — both acknowledged). A transient `{emitted:false}` keeps the
+     * identity for the next tick; a terminal/un-attestable reason (or the retry cap)
+     * gives up → the row over-nags to its own TTL.
+     */
+    private emitResolution;
+    /** Retry every parked raise whose ledger entry is still open (F-C1 drain). */
+    private drainReRaises;
+    /** Retry every un-acked resolution; give up past the attempt cap (F-C4 drain). */
+    private drainResolutions;
+    /**
+     * §3.1 — co-refresh the OPEN offers' `openPrompts` row TTLs; FULL-re-raise any
+     * promptId the backend reports as already aged-out (return-driven re-raise, §6a-4).
+     */
+    private refreshOpenTtls;
+    private findOpenEntryByPromptId;
+    private ensureTimer;
+    private maybeStopTimer;
+}