@ricsam/r5d-worker 0.0.137 → 0.0.138

package/dist/types/personal/action-scheduler.d.ts

@@ -0,0 +1,23 @@
+export type PersonalQueuedAction = {
+    id: string;
+    requestHash: string;
+    request: {
+        kind?: string;
+        sessionId?: string;
+        command?: {
+            method?: string;
+            streamId?: string;
+        };
+    };
+};
+/** Native receipts own effects. This only admits bounded independent transport
+ * lanes; mutations keep their original global order and each TCP stream is serial. */
+export declare class PersonalActionScheduler {
+    private readonly execute;
+    private readonly failed;
+    private readonly limit;
+    private readonly active;
+    constructor(execute: (action: PersonalQueuedAction) => Promise<void>, failed: (error: unknown) => void, limit?: number);
+    accept(actions: PersonalQueuedAction[]): void;
+    drain(): Promise<void>;
+}

package/dist/types/personal/client.d.ts

@@ -0,0 +1,14 @@
+export type PersonalWorkerOptions = {
+    label: string;
+    baseUrl: string;
+    credential: string;
+    root: string;
+    cliEntrypoint?: string;
+};
+export declare function parsePersonalWorkerOptions(args: string[], environment?: Record<string, string | undefined>): PersonalWorkerOptions;
+/** HTTP reconnects never replace the local source/PTY keeper. */
+export declare function startPersonalWorker(options: PersonalWorkerOptions, version: string): Promise<{
+    resourceId: string;
+    root: string;
+    close(): Promise<void>;
+}>;

package/dist/types/personal/runtime.d.ts

@@ -0,0 +1,121 @@
+import { z } from "zod";
+import { WorkspaceAuthority } from "../runtime/workspace/authority";
+import { type StorageTransport } from "../runtime/workspace/storage-client";
+export declare const PersonalWorkerGrant: z.ZodObject<{
+    installationId: z.ZodString;
+    userId: z.ZodString;
+    resourceId: z.ZodString;
+    instanceId: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    workerFence: z.ZodObject<{
+        installationId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+        ownerId: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    workerHello: z.ZodObject<{
+        installationId: z.ZodString;
+        instanceId: z.ZodString;
+        releaseId: z.ZodString;
+        role: z.ZodEnum<{
+            web: "web";
+            scheduler: "scheduler";
+            runner: "runner";
+            gateway: "gateway";
+            "worker-adapter": "worker-adapter";
+            "browser-adapter": "browser-adapter";
+            executor: "executor";
+            keeper: "keeper";
+            storage: "storage";
+        }>;
+        protocol: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    leaseExpiresAt: z.ZodCoercedNumber<unknown>;
+}, z.core.$loose>;
+export declare const PersonalWorkspaceRequest: z.ZodObject<{
+    protocol: z.ZodLiteral<1>;
+    userId: z.ZodString;
+    sessionId: z.ZodString;
+    workbench: z.ZodObject<{
+        id: z.ZodString;
+        repositoryId: z.ZodString;
+        branch: z.ZodString;
+        sessionId: z.ZodString;
+        sharedSessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    sourceWorkbench: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        repositoryId: z.ZodString;
+        branch: z.ZodString;
+        sessionId: z.ZodString;
+        sharedSessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    sharedWorkbenches: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        repositoryId: z.ZodString;
+        branch: z.ZodString;
+        sessionId: z.ZodString;
+        sharedSessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    kind: z.ZodEnum<{
+        inspect: "inspect";
+        terminal: "terminal";
+        product: "product";
+        agent: "agent";
+        tcp: "tcp";
+    }>;
+    command: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    credentials: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        installationId: z.ZodString;
+        userId: z.ZodString;
+        generation: z.ZodNumber;
+        env: z.ZodRecord<z.ZodString, z.ZodString>;
+        files: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type PersonalWorkerRuntime = Awaited<ReturnType<typeof openPersonalWorkerRuntime>>;
+/** The host owns this keeper independently of every replaceable remote web/gateway generation. */
+export declare function openPersonalWorkerRuntime(options: {
+    root: string;
+    grant: z.infer<typeof PersonalWorkerGrant>;
+    storage: (sessionId: string) => StorageTransport;
+    cliEntrypoint?: string;
+}): Promise<{
+    grant: {
+        [x: string]: unknown;
+        installationId: string;
+        userId: string;
+        resourceId: string;
+        instanceId: string;
+        workerFence: {
+            installationId: string;
+            resourceType: string;
+            resourceId: string;
+            ownerId: string;
+            epoch: number;
+        };
+        workerHello: {
+            installationId: string;
+            instanceId: string;
+            releaseId: string;
+            role: "web" | "scheduler" | "runner" | "gateway" | "worker-adapter" | "browser-adapter" | "executor" | "keeper" | "storage";
+            protocol: {
+                min: number;
+                max: number;
+            };
+            capabilities: string[];
+        };
+        leaseExpiresAt: number;
+        label?: string | undefined;
+    };
+    renew: (value: unknown) => Promise<void>;
+    dispatch: (raw: unknown) => Promise<any>;
+    authority: WorkspaceAuthority;
+    close(): Promise<void>;
+}>;

package/dist/types/personal/tcp.d.ts

@@ -0,0 +1,14 @@
+export declare class PersonalTcpError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+/** The local worker owns sockets; replaceable web processes relay immutable bytes only. */
+export declare class PersonalTcpManager {
+    private readonly authorizeConnect?;
+    private readonly db;
+    private readonly sockets;
+    constructor(directory: string, authorizeConnect?: ((sessionId: string, port: number) => Promise<void>) | undefined);
+    private stream;
+    dispatch(sessionId: string, raw: unknown): Promise<Record<string, unknown>>;
+    close(): Promise<void>;
+}

package/dist/types/runtime/client.d.ts

@@ -1,11 +1,13 @@
 import type { OperationEnvelope, OwnershipFence } from "@ricsam/r5d-api/runtime-protocol";
-import { AdapterConfig, type ActionReceipt, type ExecutorCommand, type PollResult, type RunIdentity, type RunReceipt } from "./protocol";
+import { AdapterConfig, type ActionReceipt, type AdapterGrant, type AdapterRegistration, type ExecutorCommand, type PollResult, type RunIdentity, type RunReceipt } from "./protocol";
 /** Stateless one-request connections: disconnect/timeout never implies the operation did not happen. */
 export declare class HostExecutorClient {
     readonly config: ReturnType<typeof AdapterConfig.parse>;
     constructor(config: AdapterConfig);
     request<T = unknown>(command: ExecutorCommand): Promise<T>;
     status(): Promise<unknown>;
+    registerAdapter(grant: AdapterGrant): Promise<AdapterRegistration>;
+    retireAdapter(principalId: string): Promise<AdapterRegistration>;
     setAuthority(fence: OwnershipFence, validUntil: number): Promise<unknown>;
     start(operation: OperationEnvelope): Promise<RunReceipt>;
     poll(run: RunIdentity, stdoutOffset?: number, stderrOffset?: number, maxBytes?: number): Promise<PollResult>;

package/dist/types/runtime/executor.d.ts

@@ -8,6 +8,7 @@ export declare class HostExecutor {
     private readonly nativePty?;
     readonly config: ResolvedConfig;
     readonly store: ExecutorStore;
+    private readonly adapters;
     readonly hello: RuntimeHello;
     private readonly active;
     private readonly leaseTimer;
@@ -15,12 +16,16 @@ export declare class HostExecutor {
     private poisoned;
     private serial;
     constructor(config: ExecutorConfig, nativePty?: PtyModule | undefined);
-    /** Single serialized command boundary, including controller promotions and dedupe checks. */
+    /** Authority is synchronous and authenticated; never queue lease renewal behind a blocked OS write.
+     * Resource commands retain one ordered admission/action boundary. Commands already admitted may
+     * complete after promotion; queued commands and yielded admission hashes must recheck the fence.
+     */
     handle(input: unknown): Promise<unknown>;
     private authenticate;
     private authority;
     private workerFence;
     private authorize;
+    private authorizeAdmission;
     private receipt;
     private dispatch;
     private output;

package/dist/types/runtime/protocol.d.ts

@@ -2,18 +2,18 @@ import { z } from "zod";
 export declare const EXECUTOR_CAPABILITY = "host-executor-v1";
 export declare const MAX_FRAME_BYTES: number;
 export declare const Lane: z.ZodEnum<{
-    control: "control";
     general: "general";
     utility: "utility";
+    control: "control";
 }>;
 export declare const ShellPayload: z.ZodObject<{
     argv: z.ZodArray<z.ZodString>;
     cwd: z.ZodString;
     env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     lane: z.ZodDefault<z.ZodEnum<{
-        control: "control";
         general: "general";
         utility: "utility";
+        control: "control";
     }>>;
     interactive: z.ZodDefault<z.ZodBoolean>;
     pty: z.ZodOptional<z.ZodObject<{
@@ -40,7 +40,119 @@ export declare const RunIdentity: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type RunIdentity = z.infer<typeof RunIdentity>;
+export declare const Principal: z.ZodObject<{
+    id: z.ZodString;
+    tokenHash: z.ZodString;
+    role: z.ZodEnum<{
+        controller: "controller";
+        adapter: "adapter";
+    }>;
+    ownerId: z.ZodString;
+    userIds: z.ZodArray<z.ZodString>;
+    cwdRoots: z.ZodArray<z.ZodString>;
+    lanes: z.ZodArray<z.ZodEnum<{
+        general: "general";
+        utility: "utility";
+        control: "control";
+    }>>;
+    credentialIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** Only an authenticated controller may install this immutable generation grant. */
+export declare const AdapterGrant: z.ZodObject<{
+    installationId: z.ZodString;
+    workerId: z.ZodString;
+    principal: z.ZodObject<{
+        id: z.ZodString;
+        tokenHash: z.ZodString;
+        ownerId: z.ZodString;
+        userIds: z.ZodArray<z.ZodString>;
+        cwdRoots: z.ZodArray<z.ZodString>;
+        lanes: z.ZodArray<z.ZodEnum<{
+            general: "general";
+            utility: "utility";
+            control: "control";
+        }>>;
+        credentialIds: z.ZodArray<z.ZodString>;
+        role: z.ZodLiteral<"adapter">;
+    }, z.core.$strict>;
+    hello: z.ZodObject<{
+        installationId: z.ZodString;
+        instanceId: z.ZodString;
+        releaseId: z.ZodString;
+        role: z.ZodEnum<{
+            web: "web";
+            scheduler: "scheduler";
+            runner: "runner";
+            gateway: "gateway";
+            "worker-adapter": "worker-adapter";
+            "browser-adapter": "browser-adapter";
+            executor: "executor";
+            keeper: "keeper";
+            storage: "storage";
+        }>;
+        protocol: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    artifactDigest: z.ZodString;
+}, z.core.$strict>;
+export type AdapterGrant = z.infer<typeof AdapterGrant>;
+export type AdapterRegistration = {
+    principalId: string;
+    ownerId: string;
+    releaseId: string;
+    artifactDigest: string;
+    grantDigest: string;
+    state: "registered" | "retired";
+};
 export declare const ExecutorCommand: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"adapter.register">;
+    grant: z.ZodObject<{
+        installationId: z.ZodString;
+        workerId: z.ZodString;
+        principal: z.ZodObject<{
+            id: z.ZodString;
+            tokenHash: z.ZodString;
+            ownerId: z.ZodString;
+            userIds: z.ZodArray<z.ZodString>;
+            cwdRoots: z.ZodArray<z.ZodString>;
+            lanes: z.ZodArray<z.ZodEnum<{
+                general: "general";
+                utility: "utility";
+                control: "control";
+            }>>;
+            credentialIds: z.ZodArray<z.ZodString>;
+            role: z.ZodLiteral<"adapter">;
+        }, z.core.$strict>;
+        hello: z.ZodObject<{
+            installationId: z.ZodString;
+            instanceId: z.ZodString;
+            releaseId: z.ZodString;
+            role: z.ZodEnum<{
+                web: "web";
+                scheduler: "scheduler";
+                runner: "runner";
+                gateway: "gateway";
+                "worker-adapter": "worker-adapter";
+                "browser-adapter": "browser-adapter";
+                executor: "executor";
+                keeper: "keeper";
+                storage: "storage";
+            }>;
+            protocol: z.ZodObject<{
+                min: z.ZodNumber;
+                max: z.ZodNumber;
+            }, z.core.$strict>;
+            capabilities: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        artifactDigest: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"adapter.retire">;
+    principalId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
     method: z.ZodLiteral<"status">;
 }, z.core.$strict>, z.ZodObject<{
     method: z.ZodLiteral<"authority">;
@@ -167,6 +279,51 @@ export declare const ExecutorRequest: z.ZodObject<{
         capabilities: z.ZodArray<z.ZodString>;
     }, z.core.$strict>;
     command: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        method: z.ZodLiteral<"adapter.register">;
+        grant: z.ZodObject<{
+            installationId: z.ZodString;
+            workerId: z.ZodString;
+            principal: z.ZodObject<{
+                id: z.ZodString;
+                tokenHash: z.ZodString;
+                ownerId: z.ZodString;
+                userIds: z.ZodArray<z.ZodString>;
+                cwdRoots: z.ZodArray<z.ZodString>;
+                lanes: z.ZodArray<z.ZodEnum<{
+                    general: "general";
+                    utility: "utility";
+                    control: "control";
+                }>>;
+                credentialIds: z.ZodArray<z.ZodString>;
+                role: z.ZodLiteral<"adapter">;
+            }, z.core.$strict>;
+            hello: z.ZodObject<{
+                installationId: z.ZodString;
+                instanceId: z.ZodString;
+                releaseId: z.ZodString;
+                role: z.ZodEnum<{
+                    web: "web";
+                    scheduler: "scheduler";
+                    runner: "runner";
+                    gateway: "gateway";
+                    "worker-adapter": "worker-adapter";
+                    "browser-adapter": "browser-adapter";
+                    executor: "executor";
+                    keeper: "keeper";
+                    storage: "storage";
+                }>;
+                protocol: z.ZodObject<{
+                    min: z.ZodNumber;
+                    max: z.ZodNumber;
+                }, z.core.$strict>;
+                capabilities: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>;
+            artifactDigest: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"adapter.retire">;
+        principalId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
         method: z.ZodLiteral<"status">;
     }, z.core.$strict>, z.ZodObject<{
         method: z.ZodLiteral<"authority">;
@@ -264,12 +421,21 @@ export declare const ExecutorRequest: z.ZodObject<{
         actionId: z.ZodString;
     }, z.core.$strict>], "method">;
 }, z.core.$strict>;
+export declare const ExecutorCredential: z.ZodObject<{
+    id: z.ZodString;
+    installationId: z.ZodString;
+    userId: z.ZodString;
+    generation: z.ZodNumber;
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+    files: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>;
 export declare const ExecutorConfig: z.ZodObject<{
     installationId: z.ZodString;
     workerId: z.ZodString;
     instanceId: z.ZodString;
     releaseId: z.ZodString;
     stateDir: z.ZodString;
+    productCredentialDirectory: z.ZodOptional<z.ZodString>;
     capacity: z.ZodObject<{
         general: z.ZodNumber;
         utility: z.ZodNumber;
@@ -289,9 +455,9 @@ export declare const ExecutorConfig: z.ZodObject<{
         userIds: z.ZodArray<z.ZodString>;
         cwdRoots: z.ZodArray<z.ZodString>;
         lanes: z.ZodArray<z.ZodEnum<{
-            control: "control";
             general: "general";
             utility: "utility";
+            control: "control";
         }>>;
         credentialIds: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
@@ -368,5 +534,11 @@ export type PollResult = {
 };
 export declare class ExecutorError extends Error {
     readonly code: string;
-    constructor(code: string, message?: string);
+    /** Authenticated start rejection only: stale_fence may retry same ID; capacity_busy must not auto-retry. */
+    readonly rejectedBeforeAdmission: boolean;
+    constructor(code: string, message?: string, 
+    /** Authenticated start rejection only: stale_fence may retry same ID; capacity_busy must not auto-retry. */
+    rejectedBeforeAdmission?: boolean);
 }
+export declare function isStartNonAdmissionCode(code: unknown): code is "stale_fence" | "capacity_busy";
+export declare function isDefiniteStartRejection(error: unknown): error is ExecutorError;

package/dist/types/runtime/pty.d.ts

@@ -1,3 +1,4 @@
+export declare function preflightNativePty(): void;
 /** Node native FD keeper is a daemon child; replacing adapters cannot signal it. */
 export declare class PtySession {
     pid: number;

package/dist/types/runtime/releases/artifacts.d.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+export declare const AdapterManifest: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    installationId: z.ZodString;
+    workerId: z.ZodString;
+    hello: z.ZodObject<{
+        installationId: z.ZodString;
+        instanceId: z.ZodString;
+        releaseId: z.ZodString;
+        role: z.ZodEnum<{
+            web: "web";
+            scheduler: "scheduler";
+            runner: "runner";
+            gateway: "gateway";
+            "worker-adapter": "worker-adapter";
+            "browser-adapter": "browser-adapter";
+            executor: "executor";
+            keeper: "keeper";
+            storage: "storage";
+        }>;
+        protocol: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    entrypoint: z.ZodString;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+        size: z.ZodNumber;
+        executable: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AdapterManifest = z.infer<typeof AdapterManifest>;
+export declare const bytesHash: (bytes: Uint8Array) => string;
+export declare function within(root: string, path: string): boolean;
+/** Check every ancestor, not just a leaf. World-writable sticky /tmp is allowed, symlink ancestors are not. */
+export declare function canonicalDirectory(path: string): string;
+export declare function outsideWorkspaces(path: string, workspaceRoots: string[]): void;
+/** No network, package manager, archive extraction, shell commands or in-place overwrite. */
+export declare class ImmutableAdapterArtifacts {
+    readonly root: string;
+    private readonly installationId;
+    private readonly workerId;
+    private readonly workspaceRoots;
+    constructor(root: string, installationId: string, workerId: string, workspaceRoots: string[]);
+    private approved;
+    stage(source: string, input: AdapterManifest, approvalDigest: string): string;
+    verify(input: AdapterManifest, approvalDigest: string): string;
+}

package/dist/types/runtime/releases/grants.d.ts

@@ -0,0 +1,16 @@
+import type { Database } from "bun:sqlite";
+import { type RuntimeHello } from "@ricsam/r5d-api/runtime-protocol";
+import { AdapterGrant, type AdapterRegistration, type Principal, type ResolvedConfig } from "../protocol";
+export declare const digest: (value: unknown) => string;
+/** Keeper-owned registry. Durable tombstones prevent token/owner/release rebinding after retirement. */
+export declare class AdapterGrantRegistry {
+    private readonly db;
+    private readonly config;
+    constructor(db: Database, config: ResolvedConfig);
+    private rows;
+    find(id: string): AdapterGrant | undefined;
+    hasOwner(owner: string): boolean;
+    list(): AdapterRegistration[];
+    register(controller: Principal, input: AdapterGrant, keeperHello: RuntimeHello): AdapterRegistration;
+    retire(controller: Principal, id: string, authoritativeOwner?: string): AdapterRegistration;
+}

package/dist/types/runtime/releases/manager.d.ts

@@ -0,0 +1,145 @@
+import { z } from "zod";
+import { OwnershipFence, RuntimeHello } from "@ricsam/r5d-api/runtime-protocol";
+import { HostExecutorClient } from "../client";
+import { AdapterConfig, AdapterGrant, ExecutorCommand, type AdapterRegistration } from "../protocol";
+import { AdapterManifest, ImmutableAdapterArtifacts } from "./artifacts";
+import { AdapterRetirementCompletion } from "./retirement";
+import type { DeliveryReceipt } from "./rpc-protocol";
+export declare const ReleaseManagerConfig: z.ZodObject<{
+    installationId: z.ZodString;
+    workerId: z.ZodString;
+    stateDir: z.ZodString;
+    artifactsDir: z.ZodString;
+    workspaceRoots: z.ZodArray<z.ZodString>;
+    runtimePath: z.ZodString;
+    runtimeSha256: z.ZodString;
+    controller: z.ZodObject<{
+        socketPath: z.ZodString;
+        principalId: z.ZodString;
+        token: z.ZodString;
+        hello: z.ZodObject<{
+            installationId: z.ZodString;
+            instanceId: z.ZodString;
+            releaseId: z.ZodString;
+            role: z.ZodEnum<{
+                web: "web";
+                scheduler: "scheduler";
+                runner: "runner";
+                gateway: "gateway";
+                "worker-adapter": "worker-adapter";
+                "browser-adapter": "browser-adapter";
+                executor: "executor";
+                keeper: "keeper";
+                storage: "storage";
+            }>;
+            protocol: z.ZodObject<{
+                min: z.ZodNumber;
+                max: z.ZodNumber;
+            }, z.core.$strict>;
+            capabilities: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ReleaseManagerConfig = z.input<typeof ReleaseManagerConfig>;
+export type ReleaseRecord = {
+    principalId: string;
+    manifest: AdapterManifest;
+    artifactDigest: string;
+    grant: AdapterGrant;
+    phase: "staged" | "ready" | "active" | "retained" | "retired";
+    retirementCompletion?: AdapterRetirementCompletion;
+};
+type KeeperStatus = {
+    hello: RuntimeHello;
+    workerId: string;
+    authority: {
+        fence: OwnershipFence;
+        validUntil: number;
+    } | null;
+    degraded: boolean;
+    adapters: AdapterRegistration[];
+};
+type Call = {
+    id: string;
+    principal: string;
+    hash: string;
+    state: "pending" | "completed" | "unknown";
+    acknowledged: number;
+};
+/** Local installation agent, independently supervised from the keeper. Its controller token is never passed to adapters. */
+export declare class WorkerAdapterReleases {
+    readonly invocation: `${string}-${string}-${string}-${string}-${string}`;
+    readonly config: z.output<typeof ReleaseManagerConfig>;
+    readonly artifacts: ImmutableAdapterArtifacts;
+    readonly controller: HostExecutorClient;
+    private readonly db;
+    private readonly lock;
+    private readonly ackKey;
+    private readonly children;
+    private readonly deliveries;
+    private probes;
+    private readonly retiring;
+    private serial;
+    private closing;
+    private closed?;
+    constructor(input: ReleaseManagerConfig);
+    private verifyRuntime;
+    private exclusive;
+    list(): ReleaseRecord[];
+    calls(): Call[];
+    transitions(): unknown[];
+    private get;
+    private put;
+    private configPath;
+    private keeper;
+    /** Approval digest must come from the authenticated release ledger, not the source directory itself. */
+    stage(input: {
+        source: string;
+        manifest: AdapterManifest;
+        approvalDigest: string;
+        grant: AdapterGrant;
+        adapter: AdapterConfig;
+    }): Promise<ReleaseRecord>;
+    launch(id: string): Promise<{
+        pid: number;
+    }>;
+    /** Fence/lease are the committed DB grant from the separately authenticated controller, not a locally invented epoch. */
+    promote(id: string, inputFence: OwnershipFence, validUntil: number): Promise<void>;
+    private recordAuthority;
+    /** Recovery reads the keeper, never replays a promotion or kills a remembered PID. */
+    reconcile(): Promise<KeeperStatus>;
+    bindRpcPrincipals(principals: unknown): void;
+    /** Actual child request, independent of the delivery/admin queues; never substitutes direct executor status. */
+    probe(id: string, hello: RuntimeHello): Promise<KeeperStatus & {
+        adapterPid: number;
+    }>;
+    delivery(callId: string): DeliveryReceipt | null;
+    private ackToken;
+    private saveDelivery;
+    /** Stable transport ID: persisted completed outcomes replay exactly; unknown never redispatches. */
+    deliver(callId: string, id: string, hello: RuntimeHello, requesterId: string, command: ExecutorCommand): Promise<DeliveryReceipt>;
+    observe(id: string, hello: RuntimeHello, requesterId: string, command: ExecutorCommand): Promise<DeliveryReceipt>;
+    private dispatchDelivery;
+    acknowledgeDelivery(callId: string, responseDigest: string, ackToken: string, requesterId: string): {
+        callId: string;
+        responseDigest: string;
+        acknowledged: true;
+    };
+    /** Admin-only attestation to independently durable reconciliation. Never replays or changes the unknown outcome. */
+    settleUnknownDelivery(callId: string, evidenceDigest: string): DeliveryReceipt;
+    deliveryDrain(id: string): {
+        unsettled: number;
+        unknown: number;
+    };
+    /** Stable callId journals delivery; reusing it never dispatches twice. Explicit retry uses reconcileCall. */
+    request<T = unknown>(callId: string, id: string, command: ExecutorCommand): Promise<T>;
+    reconcileCall<T = unknown>(callId: string, id: string, command: ExecutorCommand): Promise<T>;
+    private dispatch;
+    /** Called only after the controller's durable inbox/outbox has recorded the result OR explicit unknown reconciliation. */
+    acknowledge(callId: string): Promise<void>;
+    retire(id: string, retirementIntentDigest?: string): Promise<void>;
+    stopAdapter(id: string): Promise<void>;
+    close(): Promise<void>;
+}
+export {};