@roamcode.ai/server 1.4.5 → 2.1.0

package/dist/index.d.ts

@@ -1,7 +1,6 @@
 import * as better_sqlite3 from 'better-sqlite3';
-import { FastifyInstance } from 'fastify';
-import WebSocket from 'ws';
 import { z, ZodType } from 'zod';
+import { FastifyInstance } from 'fastify';
 import { spawn, ChildProcess, SpawnOptions } from 'node:child_process';
 import { EventEmitter } from 'node:events';
 
@@ -692,121 +691,31 @@ declare function resolveAccessToken(opts: ResolveAccessTokenOptions): {
 
 /** A pairing link is deliberately short-lived and can be claimed exactly once. */
 declare const PAIRING_TTL_MS: number;
-type DeviceScope = "direct" | "relay";
+type DeviceScope = "direct";
 interface DeviceInfo {
     id: string;
     name: string;
     createdAt: number;
     lastSeenAt: number;
     scopes: DeviceScope[];
-    /** Pinned E2E relay signing identity. Public material only; the private key never leaves the device. */
-    relayIdentityFingerprint?: string;
-}
-interface DeviceRelayIdentity {
-    publicKey: string;
-    fingerprint: string;
-}
-declare class DevicePairingError extends Error {
-    readonly code: "INVALID_RELAY_IDENTITY";
-    constructor(code: "INVALID_RELAY_IDENTITY", message: string);
 }
 interface PairingTicket {
     /** One-time capability carried by the pairing URL. Never persisted in plaintext. */
     secret: string;
     expiresAt: number;
-    /** Exact product surfaces the resulting device credential can reach. */
     scopes: DeviceScope[];
 }
-/**
- * Relay bootstrap pre-allocates both durable ids. The token is still inert until the one-use pairing
- * capability is claimed, but carrying it in the URL fragment makes a dropped final response recoverable:
- * the browser can reconnect with the same credential after the host committed the claim.
- */
-interface RelayPairingTicket extends PairingTicket {
-    deviceId: string;
-    token: string;
-}
-interface RelayPairingCancellationReservation {
-    deviceId: string;
-    reservationId: string;
-}
-type RelayPairingCancellationStart = {
-    status: "reserved";
-    reservation: RelayPairingCancellationReservation;
-} | {
-    status: "busy";
-} | {
-    status: "missing";
-};
 interface DeviceEnrollment {
     /** The per-device bearer credential. Returned once; only its SHA-256 digest is persisted. */
     token: string;
     device: DeviceInfo;
 }
-type CloudDeviceEnrollmentState = "prepared" | "local-finalized" | "cloud-report-pending" | "complete" | "revoked";
-interface CloudDeviceEnrollmentPrepareInput {
-    enrollmentId: string;
-    deviceId: string;
-    challenge: string;
-    name: string;
-    token: string;
-    relayIdentityPublicKey: string;
-    durableRelayCredentialHash: string;
-}
-interface CloudDeviceEnrollmentProgress {
-    enrollmentId: string;
-    deviceId: string;
-    state: CloudDeviceEnrollmentState;
-    durableRelayCredentialHash: string;
-    temporaryRelayCredentialHash?: string;
-    controlPlaneDeviceId?: string;
-    device?: DeviceInfo;
-}
-interface PendingCloudDevicePromotion {
-    enrollmentId: string;
-    deviceId: string;
-    expectedCredentialHash: string;
-    credentialHash: string;
-    controlPlaneDeviceId: string;
-    brokerPromoted: boolean;
-}
-declare class CloudDeviceEnrollmentConflictError extends Error {
-    constructor();
-}
 interface DeviceStore {
     readonly mode: "sqlite" | "memory-fallback";
-    issuePairing(now?: number, scopes?: DeviceScope[]): PairingTicket;
+    issuePairing(now?: number): PairingTicket;
     cancelPairing(secret: string): boolean;
-    claimPairing(secret: string, name: string, now?: number, relayIdentityPublicKey?: string): DeviceEnrollment | undefined;
-    issueRelayPairing(now?: number): RelayPairingTicket;
-    pendingRelayPairing(deviceId: string, now?: number): boolean;
-    /** Atomically prevents a relay claim from winning while broker revocation is in flight. */
-    beginRelayPairingCancellation(deviceId: string, now?: number): RelayPairingCancellationStart;
-    /** Release a failed broker-revocation attempt so the same expiry-bounded link can be retried. */
-    releaseRelayPairingCancellation(reservation: RelayPairingCancellationReservation): boolean;
-    /** Delete the local bootstrap only after broker revocation is authoritative. */
-    finishRelayPairingCancellation(reservation: RelayPairingCancellationReservation): boolean;
-    cancelRelayPairing(deviceId: string): boolean;
-    claimRelayPairing(secret: string, token: string, name: string, relayIdentityPublicKey: string, now?: number): DeviceEnrollment | undefined;
-    /** Resolve a per-device bearer credential and best-effort touch its last-seen time. */
+    claimPairing(secret: string, name: string, now?: number): DeviceEnrollment | undefined;
     authenticate(token: string, now?: number, requiredScope?: DeviceScope): DeviceInfo | undefined;
-    relayIdentity(id: string): DeviceRelayIdentity | undefined;
-    /** Persist only digests before contacting the control plane; exact replays resume the same saga. */
-    beginCloudDeviceEnrollment(input: CloudDeviceEnrollmentPrepareInput, now?: number): CloudDeviceEnrollmentProgress;
-    /** Atomically inserts the canonical relay actor and advances the saga after control-plane confirmation. */
-    finalizeCloudDeviceEnrollment(enrollmentId: string, temporaryRelayCredentialHash: string, controlPlaneDeviceId: string, now?: number): CloudDeviceEnrollmentProgress;
-    /** Persist the successful broker CAS before the control-plane completion report is attempted. */
-    markCloudDeviceEnrollmentPromoted(enrollmentId: string, expectedCredentialHash: string, credentialHash: string, now?: number): CloudDeviceEnrollmentProgress;
-    /** Marks activation durable only after the broker CAS and control-plane report both commit. */
-    completeCloudDeviceEnrollment(enrollmentId: string, expectedCredentialHash: string, credentialHash: string, now?: number): CloudDeviceEnrollmentProgress;
-    /** Tombstone a control-plane-revoked enrollment and remove its still-inert local actor. */
-    revokeCloudDeviceEnrollment(enrollmentId: string, controlPlaneDeviceId: string, expectedCredentialHash: string, credentialHash: string, now?: number): CloudDeviceEnrollmentProgress;
-    /** Pending local actors must not normal-auth until broker promotion and a fresh cloud grant both commit. */
-    cloudDeviceEnrollmentPending(deviceId: string): boolean;
-    /** Return a bounded, oldest-attempted-first recovery page without materializing the full queue. */
-    pendingCloudDevicePromotions(now?: number, limit?: number): PendingCloudDevicePromotion[];
-    /** Move an exact still-pending promotion behind other queued work after a failed recovery attempt. */
-    deferCloudDevicePromotion(enrollmentId: string, expectedCredentialHash: string, credentialHash: string, now?: number): boolean;
     list(): DeviceInfo[];
     rename(id: string, name: string): DeviceInfo | undefined;
     revoke(id: string): boolean;
@@ -814,21 +723,19 @@ interface DeviceStore {
     close(): void;
 }
 interface OpenDeviceStoreOptions {
-    /** SQLite file path. ":memory:" uses an in-process DB. */
     dbPath: string;
     generateSecret?: () => string;
     generateToken?: () => string;
     generateId?: () => string;
-    /** Test/portable hook; a loader failure selects the bounded in-memory fallback. */
     loadDatabase?: () => typeof better_sqlite3;
 }
-declare function normalizeDeviceScopes(value: unknown): DeviceScope[] | undefined;
 /** Keep device labels useful in UI while refusing control characters and unbounded payloads. */
 declare function normalizeDeviceName(value: unknown): string | undefined;
+declare function normalizeDeviceScopes(value: unknown): DeviceScope[] | undefined;
 declare function openDeviceStore(opts: OpenDeviceStoreOptions): DeviceStore;
 
 declare const INPUT_LEASE_TTL_MS = 30000;
-type InputLeaseActorType = "device" | "host" | "local" | "relay";
+type InputLeaseActorType = "device" | "host" | "local";
 interface InputLeasePrincipal {
     actorType: InputLeaseActorType;
     actorId: string;
@@ -916,7 +823,7 @@ type TeamMemberKind = "person" | "service";
 type TeamMemberStatus = "active" | "suspended" | "removed";
 type TeamRole = "viewer" | "operator" | "node-admin" | "workspace-manager" | "extension-manager" | "policy-admin" | "organization-admin";
 type TeamScopeType = "team" | "host" | "workspace";
-type TeamPrincipalType = "device" | "host" | "local" | "relay";
+type TeamPrincipalType = "device" | "host" | "local";
 type TeamPermission = "team:read" | "sessions:read" | "sessions:operate" | "attention:read" | "attention:manage" | "presence:read" | "presence:write" | "workspaces:manage" | "extensions:manage" | "policy:manage" | "members:manage" | "node-access:manage" | "audit:read" | "fleet:read";
 interface TeamRecord {
     id: string;
@@ -1098,1927 +1005,14 @@ declare class PresenceCoordinator {
     private emit;
 }
 
-declare const RELAY_PROTOCOL_VERSION: 1;
-declare const RELAY_HANDSHAKE_MAX_SKEW_MS: number;
-declare const RELAY_CHANNEL_MAX_AGE_MS: number;
-declare const RELAY_CHANNEL_MAX_FRAMES = 1000000;
-declare const RELAY_MAX_PLAINTEXT_BYTES: number;
-type RelayRole = "device" | "host";
-type RelayDirection = "device-to-host" | "host-to-device";
-type RelayFrameKind = "auth" | "rpc-request" | "rpc-response" | "stream-open" | "stream-data" | "stream-control" | "close";
-type RelayCryptoErrorCode = "INVALID_RELAY_IDENTITY" | "INVALID_RELAY_HELLO" | "RELAY_IDENTITY_MISMATCH" | "RELAY_SIGNATURE_INVALID" | "RELAY_HANDSHAKE_EXPIRED" | "RELAY_HANDSHAKE_MISMATCH" | "RELAY_FRAME_INVALID" | "RELAY_FRAME_OUT_OF_ORDER" | "RELAY_FRAME_AUTH_FAILED" | "RELAY_FRAME_TOO_LARGE" | "RELAY_KEY_ROTATION_REQUIRED" | "RELAY_CHANNEL_CLOSED";
-declare class RelayCryptoError extends Error {
-    readonly code: RelayCryptoErrorCode;
-    constructor(code: RelayCryptoErrorCode, message: string);
-}
-interface RelayIdentity {
-    /** Base64url-encoded SPKI DER public key. Safe to pin and exchange. */
-    publicKey: string;
-    /** Base64url-encoded PKCS#8 DER private key. Host persistence must use mode 0600. */
-    privateKey: string;
-    fingerprint: string;
-}
-interface RelayEphemeralKeyPair {
-    publicKey: string;
-    privateKey: string;
-}
-interface RelayHandshakeHello {
-    v: typeof RELAY_PROTOCOL_VERSION;
-    role: RelayRole;
-    routeId: string;
-    deviceId: string;
-    sessionId: string;
-    issuedAt: number;
-    nonce: string;
-    ephemeralPublicKey: string;
-    identityFingerprint: string;
-    signature: string;
-}
-interface RelayEncryptedFrame {
-    v: typeof RELAY_PROTOCOL_VERSION;
-    sessionId: string;
-    seq: string;
-    kind: RelayFrameKind;
-    ciphertext: string;
-}
-interface RelayChannelOptions {
-    role: RelayRole;
-    localEphemeral: RelayEphemeralKeyPair;
-    deviceHello: RelayHandshakeHello;
-    hostHello: RelayHandshakeHello;
-    deviceIdentityPublicKey: string;
-    hostIdentityPublicKey: string;
-    now?: () => number;
-    maxAgeMs?: number;
-    maxFrames?: number;
-}
-declare function relayIdentityFingerprint(publicKey: string): string;
-declare function generateRelayIdentity(): RelayIdentity;
-/** Validates both key encodings and proves that the persisted private key belongs to the advertised identity. */
-declare function validateRelayIdentity(value: unknown): RelayIdentity;
-declare function generateRelayEphemeralKeyPair(): RelayEphemeralKeyPair;
-declare function createRelayHandshakeHello(input: {
-    role: RelayRole;
-    routeId: string;
-    deviceId: string;
-    sessionId?: string;
-    identity: RelayIdentity;
-    ephemeral?: RelayEphemeralKeyPair;
-    nonce?: Uint8Array;
-    issuedAt?: number;
-}): {
-    hello: RelayHandshakeHello;
-    ephemeral: RelayEphemeralKeyPair;
-};
-declare function verifyRelayHandshakeHello(hello: RelayHandshakeHello, expected: {
-    role: RelayRole;
-    routeId: string;
-    deviceId: string;
-    sessionId: string;
-    identityPublicKey: string;
-    now?: number;
-    maxSkewMs?: number;
-}): void;
-/** Small exported primitive used to pin RFC 5869 test vectors independently of the handshake. */
-declare function hkdfSha256(input: Uint8Array, salt: Uint8Array, info: Uint8Array, length: number): Buffer;
-declare class RelayCipherState {
-    readonly sessionId: string;
-    readonly role: RelayRole;
-    private readonly sendKey;
-    private readonly receiveKey;
-    private readonly sendBaseNonce;
-    private readonly receiveBaseNonce;
-    private readonly now;
-    private readonly maxAgeMs;
-    private readonly maxFrames;
-    private sendSequence;
-    private receiveSequence;
-    private closed;
-    private readonly createdAt;
-    private readonly sendDirection;
-    private readonly receiveDirection;
-    constructor(sessionId: string, role: RelayRole, sendKey: Buffer, receiveKey: Buffer, sendBaseNonce: Buffer, receiveBaseNonce: Buffer, now: () => number, maxAgeMs: number, maxFrames: number);
-    encrypt(kind: RelayFrameKind, plaintext: Uint8Array): RelayEncryptedFrame;
-    decrypt(frame: RelayEncryptedFrame): Buffer;
-    needsRotation(): boolean;
-    sequences(): {
-        send: string;
-        receive: string;
-    };
-    close(): void;
-    private assertOpen;
-    private assertKind;
-}
-declare function establishRelayChannel(options: RelayChannelOptions): RelayCipherState;
-
-interface RelayIdentityStoreOptions {
-    dataDir: string;
-    generate?: () => RelayIdentity;
-    now?: () => number;
-}
-interface DurableRelayIdentity {
-    identity: RelayIdentity;
-    createdAt: number;
-    path: string;
-    generated: boolean;
-}
-/** Loads one stable host identity or creates it once without allowing concurrent processes to overwrite it. */
-declare function loadOrCreateRelayIdentity(options: RelayIdentityStoreOptions): DurableRelayIdentity;
-
-type RelayStoreMode = "sqlite" | "memory";
-interface RelayRouteRecord {
-    id: string;
-    label: string;
-    hostCredentialHash: string;
-    ownerAccountId?: string;
-    createdAt: number;
-    updatedAt: number;
-}
-interface RelayDeviceRouteRecord {
-    routeId: string;
-    deviceId: string;
-    credentialHash: string;
-    createdAt: number;
-    updatedAt: number;
-    /** Bootstrap credentials expire unless the host promotes the device after the E2E pairing claim. */
-    expiresAt?: number;
-}
-interface PublicRelayRouteRecord {
-    id: string;
-    label: string;
-    deviceCount: number;
-    createdAt: number;
-    updatedAt: number;
-}
-interface RelayRouteStore {
-    readonly mode: RelayStoreMode;
-    createRoute(input: {
-        id?: string;
-        label: string;
-        hostCredentialHash: string;
-        ownerAccountId?: string;
-    }, now?: number): RelayRouteRecord;
-    getRoute(id: string): RelayRouteRecord | undefined;
-    listRoutes(now?: number): PublicRelayRouteRecord[];
-    listRoutesByOwner(ownerAccountId: string, now?: number): PublicRelayRouteRecord[];
-    countDevices(routeId: string, now?: number): number;
-    rotateHostCredential(routeId: string, credentialHash: string, now?: number): boolean;
-    deleteRoute(id: string): boolean;
-    authenticateHost(routeId: string, credential: string): boolean;
-    putDevice(input: {
-        routeId: string;
-        deviceId: string;
-        credentialHash: string;
-        expiresAt?: number;
-    }, now?: number): RelayDeviceRouteRecord;
-    getDevice(routeId: string, deviceId: string, now?: number): RelayDeviceRouteRecord | undefined;
-    authenticateDevice(routeId: string, deviceId: string, credential: string, now?: number): boolean;
-    revokeDevice(routeId: string, deviceId: string): boolean;
-    close(): void;
-}
-interface OpenRelayRouteStoreOptions {
-    dbPath: string;
-    generateRouteId?: () => string;
-    loadDatabase?: () => typeof better_sqlite3;
-}
-declare function relayCredentialHash(credential: string): string;
-declare function generateRelayCredential(prefix?: "rrh" | "rrd" | "rrp"): string;
-declare function openRelayRouteStore(options: OpenRelayRouteStoreOptions): RelayRouteStore;
-
-type RelayAccountStoreMode = "sqlite" | "memory";
-type RelayAccountStatus = "active" | "suspended" | "deleted";
-type RelayAccountPlan = "free" | "team" | "enterprise";
-interface RelayAccountRecord {
-    id: string;
-    label: string;
-    status: RelayAccountStatus;
-    plan: RelayAccountPlan;
-    maxRoutes: number;
-    maxDevicesPerRoute: number;
-    revision: number;
-    createdAt: number;
-    updatedAt: number;
-}
-interface RelayAccountFields {
-    /** Stable control-plane identity. Omit for the legacy server-generated account flow. */
-    id?: string;
-    label: string;
-    plan?: RelayAccountPlan;
-    maxRoutes?: number;
-    maxDevicesPerRoute?: number;
-}
-interface RelayAccountCredentialMaterial {
-    credentialHash: string;
-    credentialLookup: string;
-}
-type CreateRelayAccountInput = RelayAccountFields & (({
-    credential: string;
-} & Partial<Record<keyof RelayAccountCredentialMaterial, never>>) | ({
-    credential?: never;
-} & RelayAccountCredentialMaterial));
-type RelayAccountCredentialInput = string | RelayAccountCredentialMaterial;
-interface UpdateRelayAccountInput {
-    label?: string;
-    status?: RelayAccountStatus;
-    plan?: RelayAccountPlan;
-    maxRoutes?: number;
-    maxDevicesPerRoute?: number;
-}
-interface RelayAccountStore {
-    readonly mode: RelayAccountStoreMode;
-    createAccount(input: CreateRelayAccountInput, now?: number): RelayAccountRecord;
-    getAccount(id: string): RelayAccountRecord | undefined;
-    listAccounts(options?: {
-        includeDeleted?: boolean;
-    }): RelayAccountRecord[];
-    /** Verify ownership for recovery without granting a suspended account route access. */
-    verifyCredential(credential: string): RelayAccountRecord | undefined;
-    authenticate(credential: string): RelayAccountRecord | undefined;
-    /** Constant-time comparison for idempotent control-plane provisioning and credential rotation. */
-    credentialMatches(id: string, credential: RelayAccountCredentialInput): boolean;
-    updateAccount(id: string, input: UpdateRelayAccountInput, expectedRevision: number, now?: number): RelayAccountRecord | undefined;
-    rotateCredential(id: string, credential: RelayAccountCredentialInput, expectedRevision: number, now?: number): RelayAccountRecord | undefined;
-    close(): void;
-}
-interface OpenRelayAccountStoreOptions {
-    dbPath: string;
-    generateAccountId?: () => string;
-    loadDatabase?: () => typeof better_sqlite3;
-}
-declare class RelayAccountRevisionConflictError extends Error {
-    readonly current: RelayAccountRecord;
-    constructor(current: RelayAccountRecord);
-}
-declare function relayAccountCredentialHash(credential: string): string;
-declare function relayAccountCredentialLookup(credential: string): string;
-declare function generateRelayAccountCredential(): string;
-declare function openRelayAccountStore(options: OpenRelayAccountStoreOptions): RelayAccountStore;
-
-interface RelayDeviceProvisioner {
-    putDevice(deviceId: string, credentialHash: string, expiresAt?: number): Promise<void>;
-    promoteDevice(deviceId: string, expectedCredentialHash: string, credentialHash: string): Promise<void>;
-    revokeDevice(deviceId: string, expectedCredentialHash?: string): Promise<void>;
-}
-interface RelayDeviceProvisionerOptions {
-    relayUrl: string;
-    routeId: string;
-    hostCredential: string;
-    request?: typeof globalThis.fetch;
-    timeoutMs?: number;
-}
-/** Host-authenticated provisioning uses HTTPS; routing credentials never appear in URLs or logs. */
-declare function createRelayDeviceProvisioner(options: RelayDeviceProvisionerOptions): RelayDeviceProvisioner;
-
-interface RelayPairingPackage {
-    v: 1;
-    label: string;
-    relayUrl: string;
-    routeId: string;
-    deviceId: string;
-    deviceCredential: string;
-    deviceToken: string;
-    pairingSecret: string;
-    expiresAt: number;
-    hostIdentityPublicKey: string;
-    hostIdentityFingerprint: string;
-}
-interface RelayPairingBootstrap {
-    appUrl: string;
-    label: string;
-    relayUrl: string;
-    routeId: string;
-    hostIdentityPublicKey: string;
-    hostIdentityFingerprint: string;
-    provisioner: RelayDeviceProvisioner;
-    generateDeviceCredential?: () => string;
-}
-declare function normalizeRelayAppUrl(value: string): string;
-declare function buildRelayPairingUrl(appUrl: string, pairing: RelayPairingPackage, options?: {
-    hostedApp?: boolean;
-}): string;
-
-declare const BLIND_RELAY_PROTOCOL_VERSION: 1;
-declare const BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES = 1500000;
-declare const BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES = 4000000;
-declare const BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS = 1024;
-declare const BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 64;
-declare const BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE: number;
-declare const BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE = 12000;
-interface CreateBlindRelayOptions {
-    rootToken: string;
-    /** Previous provisioning capabilities accepted only during an explicit, bounded zero-downtime rotation window. */
-    previousRootTokens?: string[];
-    store?: RelayRouteStore;
-    /** Optional hosted control plane. Self-hosted root-only routing remains available without it. */
-    accountStore?: RelayAccountStore;
-    allowedOrigins?: string[];
-    handshakeTimeoutMs?: number;
-    idleTimeoutMs?: number;
-    maxFrameBytes?: number;
-    maxQueueBytes?: number;
-    maxTotalConnections?: number;
-    maxConnectionsPerRoute?: number;
-    maxBytesPerMinute?: number;
-    maxMessagesPerMinute?: number;
-    now?: () => number;
-    generateChannelId?: () => string;
-}
-interface BlindRelayMetrics {
-    activeConnections: number;
-    activeHosts: number;
-    activeDevices: number;
-    acceptedConnections: number;
-    rejectedConnections: number;
-    forwardedFrames: number;
-    forwardedBytes: number;
-    droppedFrames: number;
-}
-interface BlindRelayServer {
-    app: FastifyInstance;
-    store: RelayRouteStore;
-    accountStore?: RelayAccountStore;
-    metrics(): BlindRelayMetrics;
-}
-declare function createBlindRelayServer(options: CreateBlindRelayOptions): BlindRelayServer;
-
-interface StartedBlindRelay extends BlindRelayServer {
-    url: string;
-}
-declare function startBlindRelay(env?: NodeJS.ProcessEnv): Promise<StartedBlindRelay>;
-declare function isRelayDirectExecution(moduleUrl: string, argv1: string | undefined, embeddedContainerBuild?: boolean): boolean;
-
-/** RPC uses JSON inside an encrypted frame inside a base64 relay envelope. Larger data uses chunked streams. */
-declare const RELAY_RPC_MAX_BODY_BYTES: number;
-declare const RELAY_RPC_MAX_PATH_BYTES = 4096;
-type RelayRpcMethod = "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE";
-interface RelayRpcRequest {
-    id: string;
-    method: RelayRpcMethod;
-    path: string;
-    headers: Record<string, string>;
-    body?: Buffer;
-}
-interface RelayRpcResponse {
-    id: string;
-    status: number;
-    headers: Record<string, string>;
-    body?: string;
-}
-declare function parseRelayRpcRequest(value: unknown): RelayRpcRequest;
-declare function relayRpcResponse(input: {
-    id: string;
-    status: number;
-    headers: Record<string, string | string[] | number | undefined>;
-    body?: Uint8Array;
-}): RelayRpcResponse;
-
-declare const CLOUD_CONTRACT_VERSION: 1;
-declare const CLOUD_AUTHORIZATION_CONTRACT_VERSION: 2;
-declare const CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM: "Ed25519";
-declare const CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM_V2: "Ed25519-SHA256";
-declare const CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN = "roamcode-cloud-authorization-snapshot-v1";
-declare const CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN_V2 = "roamcode-cloud-authorization-snapshot-v2";
-declare const CLOUD_AUTHORIZATION_PERMISSIONS: readonly ["team:read", "sessions:read", "sessions:operate", "attention:read", "attention:manage", "presence:read", "presence:write", "workspaces:manage", "extensions:manage", "policy:manage", "members:manage", "node-access:manage", "audit:read", "fleet:read"];
-declare const CloudRelayHostIdentitySchema: z.ZodObject<{
-    publicKey: z.ZodString;
-    fingerprint: z.ZodString;
-}, z.core.$strict>;
-declare const CloudAuthorizationPermissionSchema: z.ZodEnum<{
-    "team:read": "team:read";
-    "sessions:read": "sessions:read";
-    "sessions:operate": "sessions:operate";
-    "attention:read": "attention:read";
-    "attention:manage": "attention:manage";
-    "presence:read": "presence:read";
-    "presence:write": "presence:write";
-    "workspaces:manage": "workspaces:manage";
-    "extensions:manage": "extensions:manage";
-    "policy:manage": "policy:manage";
-    "members:manage": "members:manage";
-    "node-access:manage": "node-access:manage";
-    "audit:read": "audit:read";
-    "fleet:read": "fleet:read";
-}>;
-declare const CloudHostHeartbeatV1Schema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"host-heartbeat">;
-    organizationId: z.ZodString;
-    hostId: z.ZodString;
-    instanceId: z.ZodString;
-    sentAt: z.ZodNumber;
-    sequence: z.ZodNumber;
-    softwareVersion: z.ZodString;
-    state: z.ZodEnum<{
-        ready: "ready";
-        draining: "draining";
-    }>;
-    authorizationRevision: z.ZodNullable<z.ZodNumber>;
-    relayHostIdentity: z.ZodOptional<z.ZodObject<{
-        publicKey: z.ZodString;
-        fingerprint: z.ZodString;
-    }, z.core.$strict>>;
-    capabilities: z.ZodArray<z.ZodString>;
-}, z.core.$strict>;
-declare const CloudAutomationWebhookRegistrationSchema: z.ZodObject<{
-    hookId: z.ZodString;
-    automationId: z.ZodString;
-    triggerId: z.ZodString;
-    secretHash: z.ZodString;
-    enabled: z.ZodBoolean;
-}, z.core.$strict>;
-declare const CloudAutomationInvocationSchema: z.ZodObject<{
-    id: z.ZodUUID;
-    automationId: z.ZodString;
-    triggerId: z.ZodString;
-    hookId: z.ZodString;
-    createdAt: z.ZodNumber;
-}, z.core.$strict>;
-type CloudAutomationWebhookRegistration = z.infer<typeof CloudAutomationWebhookRegistrationSchema>;
-type CloudAutomationInvocation = z.infer<typeof CloudAutomationInvocationSchema>;
-declare const CloudAuthorizationScopeV1Schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    type: z.ZodLiteral<"organization">;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"host">;
-    id: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"workspace">;
-    id: z.ZodString;
-}, z.core.$strict>], "type">;
-declare const CloudAuthorizationGrantV1Schema: z.ZodObject<{
-    principalType: z.ZodEnum<{
-        device: "device";
-        relay: "relay";
-    }>;
-    principalId: z.ZodString;
-    permissions: z.ZodArray<z.ZodEnum<{
-        "team:read": "team:read";
-        "sessions:read": "sessions:read";
-        "sessions:operate": "sessions:operate";
-        "attention:read": "attention:read";
-        "attention:manage": "attention:manage";
-        "presence:read": "presence:read";
-        "presence:write": "presence:write";
-        "workspaces:manage": "workspaces:manage";
-        "extensions:manage": "extensions:manage";
-        "policy:manage": "policy:manage";
-        "members:manage": "members:manage";
-        "node-access:manage": "node-access:manage";
-        "audit:read": "audit:read";
-        "fleet:read": "fleet:read";
-    }>>;
-    scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        type: z.ZodLiteral<"organization">;
-    }, z.core.$strict>, z.ZodObject<{
-        type: z.ZodLiteral<"host">;
-        id: z.ZodString;
-    }, z.core.$strict>, z.ZodObject<{
-        type: z.ZodLiteral<"workspace">;
-        id: z.ZodString;
-    }, z.core.$strict>], "type">;
-}, z.core.$strict>;
-declare const CloudAuthorizationSnapshotV1Schema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"authorization-snapshot">;
-    organizationId: z.ZodString;
-    hostId: z.ZodString;
-    revision: z.ZodNumber;
-    issuedAt: z.ZodNumber;
-    notBefore: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    grants: z.ZodArray<z.ZodObject<{
-        principalType: z.ZodEnum<{
-            device: "device";
-            relay: "relay";
-        }>;
-        principalId: z.ZodString;
-        permissions: z.ZodArray<z.ZodEnum<{
-            "team:read": "team:read";
-            "sessions:read": "sessions:read";
-            "sessions:operate": "sessions:operate";
-            "attention:read": "attention:read";
-            "attention:manage": "attention:manage";
-            "presence:read": "presence:read";
-            "presence:write": "presence:write";
-            "workspaces:manage": "workspaces:manage";
-            "extensions:manage": "extensions:manage";
-            "policy:manage": "policy:manage";
-            "members:manage": "members:manage";
-            "node-access:manage": "node-access:manage";
-            "audit:read": "audit:read";
-            "fleet:read": "fleet:read";
-        }>>;
-        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"organization">;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"host">;
-            id: z.ZodString;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"workspace">;
-            id: z.ZodString;
-        }, z.core.$strict>], "type">;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-declare const CloudAuthorizationSnapshotV2Schema: z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"authorization-snapshot">;
-    organizationId: z.ZodString;
-    hostId: z.ZodString;
-    revision: z.ZodNumber;
-    issuedAt: z.ZodNumber;
-    notBefore: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    grants: z.ZodArray<z.ZodObject<{
-        principalType: z.ZodEnum<{
-            device: "device";
-            relay: "relay";
-        }>;
-        principalId: z.ZodString;
-        permissions: z.ZodArray<z.ZodEnum<{
-            "team:read": "team:read";
-            "sessions:read": "sessions:read";
-            "sessions:operate": "sessions:operate";
-            "attention:read": "attention:read";
-            "attention:manage": "attention:manage";
-            "presence:read": "presence:read";
-            "presence:write": "presence:write";
-            "workspaces:manage": "workspaces:manage";
-            "extensions:manage": "extensions:manage";
-            "policy:manage": "policy:manage";
-            "members:manage": "members:manage";
-            "node-access:manage": "node-access:manage";
-            "audit:read": "audit:read";
-            "fleet:read": "fleet:read";
-        }>>;
-        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"organization">;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"host">;
-            id: z.ZodString;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"workspace">;
-            id: z.ZodString;
-        }, z.core.$strict>], "type">;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-declare const CloudAuthorizationSnapshotSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"authorization-snapshot">;
-    organizationId: z.ZodString;
-    hostId: z.ZodString;
-    revision: z.ZodNumber;
-    issuedAt: z.ZodNumber;
-    notBefore: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    grants: z.ZodArray<z.ZodObject<{
-        principalType: z.ZodEnum<{
-            device: "device";
-            relay: "relay";
-        }>;
-        principalId: z.ZodString;
-        permissions: z.ZodArray<z.ZodEnum<{
-            "team:read": "team:read";
-            "sessions:read": "sessions:read";
-            "sessions:operate": "sessions:operate";
-            "attention:read": "attention:read";
-            "attention:manage": "attention:manage";
-            "presence:read": "presence:read";
-            "presence:write": "presence:write";
-            "workspaces:manage": "workspaces:manage";
-            "extensions:manage": "extensions:manage";
-            "policy:manage": "policy:manage";
-            "members:manage": "members:manage";
-            "node-access:manage": "node-access:manage";
-            "audit:read": "audit:read";
-            "fleet:read": "fleet:read";
-        }>>;
-        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"organization">;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"host">;
-            id: z.ZodString;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"workspace">;
-            id: z.ZodString;
-        }, z.core.$strict>], "type">;
-    }, z.core.$strict>>;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"authorization-snapshot">;
-    organizationId: z.ZodString;
-    hostId: z.ZodString;
-    revision: z.ZodNumber;
-    issuedAt: z.ZodNumber;
-    notBefore: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    grants: z.ZodArray<z.ZodObject<{
-        principalType: z.ZodEnum<{
-            device: "device";
-            relay: "relay";
-        }>;
-        principalId: z.ZodString;
-        permissions: z.ZodArray<z.ZodEnum<{
-            "team:read": "team:read";
-            "sessions:read": "sessions:read";
-            "sessions:operate": "sessions:operate";
-            "attention:read": "attention:read";
-            "attention:manage": "attention:manage";
-            "presence:read": "presence:read";
-            "presence:write": "presence:write";
-            "workspaces:manage": "workspaces:manage";
-            "extensions:manage": "extensions:manage";
-            "policy:manage": "policy:manage";
-            "members:manage": "members:manage";
-            "node-access:manage": "node-access:manage";
-            "audit:read": "audit:read";
-            "fleet:read": "fleet:read";
-        }>>;
-        scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"organization">;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"host">;
-            id: z.ZodString;
-        }, z.core.$strict>, z.ZodObject<{
-            type: z.ZodLiteral<"workspace">;
-            id: z.ZodString;
-        }, z.core.$strict>], "type">;
-    }, z.core.$strict>>;
-}, z.core.$strict>], "v">;
-declare const SignedCloudAuthorizationSnapshotV1Schema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"signed-authorization-snapshot">;
-    algorithm: z.ZodLiteral<"Ed25519">;
-    keyId: z.ZodString;
-    snapshot: z.ZodObject<{
-        v: z.ZodLiteral<1>;
-        kind: z.ZodLiteral<"authorization-snapshot">;
-        organizationId: z.ZodString;
-        hostId: z.ZodString;
-        revision: z.ZodNumber;
-        issuedAt: z.ZodNumber;
-        notBefore: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        grants: z.ZodArray<z.ZodObject<{
-            principalType: z.ZodEnum<{
-                device: "device";
-                relay: "relay";
-            }>;
-            principalId: z.ZodString;
-            permissions: z.ZodArray<z.ZodEnum<{
-                "team:read": "team:read";
-                "sessions:read": "sessions:read";
-                "sessions:operate": "sessions:operate";
-                "attention:read": "attention:read";
-                "attention:manage": "attention:manage";
-                "presence:read": "presence:read";
-                "presence:write": "presence:write";
-                "workspaces:manage": "workspaces:manage";
-                "extensions:manage": "extensions:manage";
-                "policy:manage": "policy:manage";
-                "members:manage": "members:manage";
-                "node-access:manage": "node-access:manage";
-                "audit:read": "audit:read";
-                "fleet:read": "fleet:read";
-            }>>;
-            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"organization">;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"host">;
-                id: z.ZodString;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"workspace">;
-                id: z.ZodString;
-            }, z.core.$strict>], "type">;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signature: z.ZodString;
-}, z.core.$strict>;
-declare const SignedCloudAuthorizationSnapshotV2Schema: z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"signed-authorization-snapshot">;
-    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-    keyId: z.ZodString;
-    snapshot: z.ZodObject<{
-        v: z.ZodLiteral<2>;
-        kind: z.ZodLiteral<"authorization-snapshot">;
-        organizationId: z.ZodString;
-        hostId: z.ZodString;
-        revision: z.ZodNumber;
-        issuedAt: z.ZodNumber;
-        notBefore: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        grants: z.ZodArray<z.ZodObject<{
-            principalType: z.ZodEnum<{
-                device: "device";
-                relay: "relay";
-            }>;
-            principalId: z.ZodString;
-            permissions: z.ZodArray<z.ZodEnum<{
-                "team:read": "team:read";
-                "sessions:read": "sessions:read";
-                "sessions:operate": "sessions:operate";
-                "attention:read": "attention:read";
-                "attention:manage": "attention:manage";
-                "presence:read": "presence:read";
-                "presence:write": "presence:write";
-                "workspaces:manage": "workspaces:manage";
-                "extensions:manage": "extensions:manage";
-                "policy:manage": "policy:manage";
-                "members:manage": "members:manage";
-                "node-access:manage": "node-access:manage";
-                "audit:read": "audit:read";
-                "fleet:read": "fleet:read";
-            }>>;
-            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"organization">;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"host">;
-                id: z.ZodString;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"workspace">;
-                id: z.ZodString;
-            }, z.core.$strict>], "type">;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signature: z.ZodString;
-}, z.core.$strict>;
-declare const SignedCloudAuthorizationSnapshotSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"signed-authorization-snapshot">;
-    algorithm: z.ZodLiteral<"Ed25519">;
-    keyId: z.ZodString;
-    snapshot: z.ZodObject<{
-        v: z.ZodLiteral<1>;
-        kind: z.ZodLiteral<"authorization-snapshot">;
-        organizationId: z.ZodString;
-        hostId: z.ZodString;
-        revision: z.ZodNumber;
-        issuedAt: z.ZodNumber;
-        notBefore: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        grants: z.ZodArray<z.ZodObject<{
-            principalType: z.ZodEnum<{
-                device: "device";
-                relay: "relay";
-            }>;
-            principalId: z.ZodString;
-            permissions: z.ZodArray<z.ZodEnum<{
-                "team:read": "team:read";
-                "sessions:read": "sessions:read";
-                "sessions:operate": "sessions:operate";
-                "attention:read": "attention:read";
-                "attention:manage": "attention:manage";
-                "presence:read": "presence:read";
-                "presence:write": "presence:write";
-                "workspaces:manage": "workspaces:manage";
-                "extensions:manage": "extensions:manage";
-                "policy:manage": "policy:manage";
-                "members:manage": "members:manage";
-                "node-access:manage": "node-access:manage";
-                "audit:read": "audit:read";
-                "fleet:read": "fleet:read";
-            }>>;
-            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"organization">;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"host">;
-                id: z.ZodString;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"workspace">;
-                id: z.ZodString;
-            }, z.core.$strict>], "type">;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signature: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"signed-authorization-snapshot">;
-    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-    keyId: z.ZodString;
-    snapshot: z.ZodObject<{
-        v: z.ZodLiteral<2>;
-        kind: z.ZodLiteral<"authorization-snapshot">;
-        organizationId: z.ZodString;
-        hostId: z.ZodString;
-        revision: z.ZodNumber;
-        issuedAt: z.ZodNumber;
-        notBefore: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        grants: z.ZodArray<z.ZodObject<{
-            principalType: z.ZodEnum<{
-                device: "device";
-                relay: "relay";
-            }>;
-            principalId: z.ZodString;
-            permissions: z.ZodArray<z.ZodEnum<{
-                "team:read": "team:read";
-                "sessions:read": "sessions:read";
-                "sessions:operate": "sessions:operate";
-                "attention:read": "attention:read";
-                "attention:manage": "attention:manage";
-                "presence:read": "presence:read";
-                "presence:write": "presence:write";
-                "workspaces:manage": "workspaces:manage";
-                "extensions:manage": "extensions:manage";
-                "policy:manage": "policy:manage";
-                "members:manage": "members:manage";
-                "node-access:manage": "node-access:manage";
-                "audit:read": "audit:read";
-                "fleet:read": "fleet:read";
-            }>>;
-            scope: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"organization">;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"host">;
-                id: z.ZodString;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"workspace">;
-                id: z.ZodString;
-            }, z.core.$strict>], "type">;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signature: z.ZodString;
-}, z.core.$strict>], "v">;
-declare const CloudAuthorizationTrustedKeySchema: z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519">;
-    publicKey: z.ZodString;
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>;
-declare const CloudAuthorizationTrustedKeyV2Schema: z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-    publicKey: z.ZodString;
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>;
-declare const CloudAuthorizationTrustedKeyAnySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519">;
-    publicKey: z.ZodString;
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>, z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-    publicKey: z.ZodString;
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    trustExpiresAt: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>], "algorithm">;
-type CloudAuthorizationPermission = z.infer<typeof CloudAuthorizationPermissionSchema>;
-type CloudRelayHostIdentity = z.infer<typeof CloudRelayHostIdentitySchema>;
-type CloudHostHeartbeatV1 = z.infer<typeof CloudHostHeartbeatV1Schema>;
-type CloudAuthorizationScopeV1 = z.infer<typeof CloudAuthorizationScopeV1Schema>;
-type CloudAuthorizationGrantV1 = z.infer<typeof CloudAuthorizationGrantV1Schema>;
-type CloudAuthorizationSnapshotV1 = z.infer<typeof CloudAuthorizationSnapshotV1Schema>;
-type CloudAuthorizationSnapshotV2 = z.infer<typeof CloudAuthorizationSnapshotV2Schema>;
-type CloudAuthorizationSnapshot = z.infer<typeof CloudAuthorizationSnapshotSchema>;
-type SignedCloudAuthorizationSnapshotV1 = z.infer<typeof SignedCloudAuthorizationSnapshotV1Schema>;
-type SignedCloudAuthorizationSnapshotV2 = z.infer<typeof SignedCloudAuthorizationSnapshotV2Schema>;
-type SignedCloudAuthorizationSnapshot = z.infer<typeof SignedCloudAuthorizationSnapshotSchema>;
-type CloudAuthorizationTrustedKeyV1 = z.infer<typeof CloudAuthorizationTrustedKeySchema>;
-type CloudAuthorizationTrustedKeyV2 = z.infer<typeof CloudAuthorizationTrustedKeyV2Schema>;
-type CloudAuthorizationTrustedKey = z.infer<typeof CloudAuthorizationTrustedKeyAnySchema>;
-type CloudAuthorizationVerificationErrorCode = "INVALID_ENVELOPE" | "INVALID_KEYRING" | "UNKNOWN_KEY" | "KEY_NOT_ACTIVE" | "TRUST_EXPIRED" | "ALGORITHM_MISMATCH" | "INVALID_PUBLIC_KEY" | "INVALID_SIGNATURE";
-declare class CloudAuthorizationVerificationError extends Error {
-    readonly code: CloudAuthorizationVerificationErrorCode;
-    constructor(code: CloudAuthorizationVerificationErrorCode, message: string);
-}
-declare function canonicalCloudJson(value: unknown): string;
-declare function parseCloudHostHeartbeat(value: unknown): CloudHostHeartbeatV1;
-declare function parseCloudAuthorizationSnapshot(value: unknown): CloudAuthorizationSnapshot;
-declare function parseSignedCloudAuthorizationSnapshot(value: unknown): SignedCloudAuthorizationSnapshot;
-/**
- * Exact, domain-separated bytes that the cloud control plane signs and the host verifies.
- *
- * V1 signs the raw protected envelope for self-host compatibility. V2 signs exactly the SHA-256 digest of the
- * protected envelope so hardware signers never receive attacker-amplifiable snapshot bytes.
- */
-declare function cloudAuthorizationSnapshotSigningPayload(snapshot: unknown, keyId: string): Buffer;
-/** Verifies one envelope against any active key id, allowing safe overlap during signing-key rotation. */
-declare function verifySignedCloudAuthorizationSnapshot(value: unknown, trustedKeys: readonly CloudAuthorizationTrustedKey[], verificationTime?: number): SignedCloudAuthorizationSnapshot;
-
-declare const CLOUD_AUTHORIZATION_FILE = "cloud-authorization.json";
-declare const CLOUD_AUTHORIZATION_LAST_GOOD_FILE = "cloud-authorization.last-good.json";
-declare const CLOUD_AUTHORIZATION_CLOCK_SKEW_MS: number;
-type CloudAuthorizationSnapshotStatus = "unavailable" | "pending" | "active" | "expired";
-type CloudAuthorizationPrincipalType = "device" | "relay";
-type CloudAuthorizationStoreErrorCode = "TARGET_MISMATCH" | "CONTRACT_MISMATCH" | "REPLAY" | "TEMPORAL_REGRESSION" | "ISSUED_IN_FUTURE" | "ISSUED_TOO_OLD" | "NOT_YET_VALID" | "EXPIRED" | "PERSISTENCE_CORRUPT" | "PERSISTENCE_UNSAFE" | "REVISION_CONFLICT";
-declare class CloudAuthorizationStoreError extends Error {
-    readonly code: CloudAuthorizationStoreErrorCode;
-    constructor(code: CloudAuthorizationStoreErrorCode, message: string);
-}
-interface StoredCloudAuthorizationSnapshot {
-    acceptedAt: number;
-    envelope: SignedCloudAuthorizationSnapshot;
-    snapshot: CloudAuthorizationSnapshot;
-}
-interface CloudAuthorizationState {
-    status: CloudAuthorizationSnapshotStatus;
-    revision?: number;
-    notBefore?: number;
-    expiresAt?: number;
-}
-interface CloudAuthorizationDecision {
-    allowed: boolean;
-    reason: "cloud-grant" | "cloud-authorization-unavailable" | "cloud-authorization-pending" | "cloud-authorization-expired" | "cloud-principal-unbound" | "cloud-missing-permission" | "cloud-host-mismatch";
-    revision?: number;
-}
-interface OpenCloudAuthorizationStoreOptions {
-    dataDir: string;
-    organizationId: string;
-    hostId: string;
-    trustedKeys: readonly CloudAuthorizationTrustedKey[] | (() => readonly CloudAuthorizationTrustedKey[]);
-    /** Provisioned authorization contract. An envelope from another version is never accepted as a downgrade. */
-    authorizationVersion?: 1 | 2;
-    now?: () => number;
-    clockSkewMs?: number;
-}
-interface CloudAuthorizationStore {
-    readonly path: string;
-    readonly backupPath: string;
-    getLastKnownGood(): StoredCloudAuthorizationSnapshot | undefined;
-    getState(now?: number): CloudAuthorizationState;
-    getActiveSnapshot(now?: number): CloudAuthorizationSnapshot | undefined;
-    apply(value: unknown, now?: number): StoredCloudAuthorizationSnapshot;
-    reload(): StoredCloudAuthorizationSnapshot | undefined;
-    authorize(actorType: CloudAuthorizationPrincipalType, actorId: string, permission: CloudAuthorizationPermission, resource?: TeamAuthorizationResource, now?: number): CloudAuthorizationDecision;
-}
-declare function openCloudAuthorizationStore(options: OpenCloudAuthorizationStoreOptions): CloudAuthorizationStore;
-
-declare const DEFAULT_CLOUD_CONTROL_PLANE_URL = "https://roamcode.ai";
-declare const CLOUD_DEVICE_ENROLLMENT_CONFIRM_PATH = "/api/v1/hosts/device-enrollments/confirm";
-declare const CLOUD_DEVICE_ENROLLMENT_COMPLETE_PATH = "/api/v1/hosts/device-enrollments/complete";
-declare const CLOUD_DEVICE_ENROLLMENT_HOST_ROUTE = "/api/v1/cloud/device-enrollments/confirm";
-declare const CloudDeviceEnrollmentRequestSchema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    enrollmentId: z.ZodUUID;
-    challenge: z.ZodString;
-}, z.core.$strict>;
-declare const CloudHostDeviceEnrollmentConfirmationSchema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"host-device-enrollment-confirmation">;
-    enrollmentId: z.ZodUUID;
-    challenge: z.ZodString;
-    actorId: z.ZodString;
-    deviceIdentityPublicKey: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-declare const CloudHostDeviceEnrollmentCompletionSchema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"host-device-enrollment-completion">;
-    enrollmentId: z.ZodUUID;
-    actorId: z.ZodString;
-    temporaryRelayCredentialHash: z.ZodString;
-    durableRelayCredentialHash: z.ZodString;
-}, z.core.$strict>;
-declare const CloudRelayDeviceEnrollmentPayloadSchema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"cloud-device-enrollment">;
-    enrollmentId: z.ZodUUID;
-    challenge: z.ZodString;
-    name: z.ZodString;
-    localDeviceToken: z.ZodString;
-    durableRelayCredential: z.ZodString;
-}, z.core.$strict>;
-declare const CloudRelayDeviceEnrollmentAuthSchema: z.ZodObject<{
-    token: z.ZodString;
-    relayCredential: z.ZodString;
-    cloudEnrollment: z.ZodObject<{
-        v: z.ZodLiteral<1>;
-        kind: z.ZodLiteral<"cloud-device-enrollment">;
-        enrollmentId: z.ZodUUID;
-        challenge: z.ZodString;
-        name: z.ZodString;
-        localDeviceToken: z.ZodString;
-        durableRelayCredential: z.ZodString;
-    }, z.core.$strict>;
-}, z.core.$strict>;
-declare const CloudHostDeviceEnrollmentCompletionResponseSchema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    state: z.ZodEnum<{
-        revoked: "revoked";
-        active: "active";
-    }>;
-    deviceId: z.ZodUUID;
-}, z.core.$strict>;
-type CloudDeviceEnrollmentRequest = z.infer<typeof CloudDeviceEnrollmentRequestSchema>;
-type CloudHostDeviceEnrollmentConfirmation = z.infer<typeof CloudHostDeviceEnrollmentConfirmationSchema>;
-type CloudHostDeviceEnrollmentCompletion = z.infer<typeof CloudHostDeviceEnrollmentCompletionSchema>;
-type CloudHostDeviceEnrollmentCompletionResult = z.infer<typeof CloudHostDeviceEnrollmentCompletionResponseSchema>;
-type CloudRelayDeviceEnrollmentPayload = z.infer<typeof CloudRelayDeviceEnrollmentPayloadSchema>;
-type CloudRelayDeviceEnrollmentAuth = z.infer<typeof CloudRelayDeviceEnrollmentAuthSchema>;
-interface CloudDeviceEnrollmentConfirmationResult {
-    actorId: string;
-    deviceId: string;
-    temporaryRelayCredentialHash?: string;
-    deviceIdentity?: {
-        publicKey: string;
-        fingerprint: string;
-    };
-}
-interface CloudRelayDeviceEnrollmentSaga {
-    enroll(input: {
-        actorId: string;
-        deviceIdentityPublicKey: string;
-        cloudEnrollment: unknown;
-    }): Promise<{
-        device: DeviceInfo;
-        token: string;
-    }>;
-    recover(): Promise<{
-        completed: number;
-        failed: number;
-    }>;
-}
-interface CloudDeviceEnrollmentConfirmer {
-    confirm(input: CloudHostDeviceEnrollmentConfirmation): Promise<CloudDeviceEnrollmentConfirmationResult>;
-    complete(input: CloudHostDeviceEnrollmentCompletion): Promise<CloudHostDeviceEnrollmentCompletionResult>;
-}
-interface CloudDeviceEnrollmentRuntimeConfig {
-    controlPlaneOrigin: string;
-    hostCredential: string;
-}
-type CloudDeviceEnrollmentErrorCode = "REJECTED" | "UNAVAILABLE" | "INVALID_RESPONSE";
-declare class CloudDeviceEnrollmentError extends Error {
-    readonly code: CloudDeviceEnrollmentErrorCode;
-    readonly retryable: boolean;
-    constructor(code: CloudDeviceEnrollmentErrorCode, retryable: boolean);
-}
-interface CreateCloudDeviceEnrollmentConfirmerOptions extends CloudDeviceEnrollmentRuntimeConfig {
-    fetch?: typeof globalThis.fetch;
-    timeoutMs?: number;
-}
-/** Normalize an origin once so a client payload can never choose where the host credential is sent. */
-declare function normalizeCloudControlPlaneOrigin(value: string): string;
-/** Read a host capability without following links or accepting permissions that expose it to other users. */
-declare function readCloudHostCredentialFile(path: string): string;
-/** URL-only configuration is harmless; cloud host enrollment is enabled only when its credential file is set. */
-declare function resolveCloudDeviceEnrollmentConfig(env: NodeJS.ProcessEnv): CloudDeviceEnrollmentRuntimeConfig | undefined;
-declare function createCloudDeviceEnrollmentConfirmer(options: CreateCloudDeviceEnrollmentConfirmerOptions): CloudDeviceEnrollmentConfirmer;
-interface CreateCloudRelayDeviceEnrollmentSagaOptions {
-    devices: DeviceStore;
-    confirmer: CloudDeviceEnrollmentConfirmer;
-    provisioner: RelayDeviceProvisioner;
-    refreshAuthorization?: () => Promise<unknown>;
-    /** Managed Nodes must observe the newly confirmed relay actor in a fresh signed snapshot before activation. */
-    authorizationReady?: (actorId: string) => boolean;
-    now?: () => number;
-}
-/** The control plane has one canonical identity namespace for both direct and relay-connected browsers. */
-declare function cloudDeviceEnrollmentAuthorizationReady(authorizationStore: Pick<CloudAuthorizationStore, "getActiveSnapshot">, actorId: string): boolean;
-/**
- * Commits a browser enrollment in three durable phases. The control plane sees only the signed device public key;
- * local and relay bearer credentials stay inside the encrypted browser-to-Node channel and are persisted as hashes.
- */
-declare function createCloudRelayDeviceEnrollmentSaga(options: CreateCloudRelayDeviceEnrollmentSagaOptions): CloudRelayDeviceEnrollmentSaga;
-interface CloudDeviceEnrollmentRecoveryLoop {
-    start(): void;
-    stop(): Promise<void>;
-}
-interface CreateCloudDeviceEnrollmentRecoveryLoopOptions {
-    saga: Pick<CloudRelayDeviceEnrollmentSaga, "recover">;
-    intervalMs?: number;
-    onResult?: (result: {
-        completed: number;
-        failed: number;
-    }) => void;
-}
-/**
- * Starts one recovery attempt immediately and retries on a fixed cadence without ever overlapping attempts.
- * The saga itself caps each pass and every network client it calls has a request timeout.
- */
-declare function createCloudDeviceEnrollmentRecoveryLoop(options: CreateCloudDeviceEnrollmentRecoveryLoopOptions): CloudDeviceEnrollmentRecoveryLoop;
-
-type RelayHostStatus = "idle" | "connecting" | "online" | "reconnecting" | "stopped";
-interface RelayHostMetrics {
-    status: RelayHostStatus;
-    activeChannels: number;
-    acceptedChannels: number;
-    rejectedChannels: number;
-    completedRequests: number;
-    failedRequests: number;
-    reconnects: number;
-    activeTransfers: number;
-    completedTransfers: number;
-    failedTransfers: number;
-    streamedRequestBytes: number;
-    streamedResponseBytes: number;
-}
-interface RelayHostConnectorOptions {
-    relayUrl: string;
-    routeId: string;
-    hostCredential: string;
-    hostIdentity: RelayIdentity;
-    devices: DeviceStore;
-    dispatchRequest(token: string, request: RelayRpcRequest): Promise<RelayRpcResponse>;
-    openTerminal?: RelayTerminalOpener;
-    openHttp?: RelayHttpOpener;
-    WebSocketClass?: typeof WebSocket;
-    now?: () => number;
-    random?: () => number;
-    handshakeTimeoutMs?: number;
-    requestTimeoutMs?: number;
-    maxStreamRequestBytes?: number;
-    onStatus?: (status: RelayHostStatus) => void;
-    /** Promotes a five-minute broker bootstrap credential after the E2E pairing claim commits. */
-    promoteDevice?: (deviceId: string, credentialHash: string) => Promise<void>;
-    /** Account-driven browser enrollment over the already encrypted relay auth channel. */
-    cloudDeviceEnrollment?: CloudRelayDeviceEnrollmentSaga;
-}
-interface RelayTerminalOpenRequest {
-    streamId: string;
-    sessionId: string;
-    cols?: number;
-    rows?: number;
-    respawn?: "continue" | "fresh";
-}
-interface RelayTerminalHandlers {
-    onBinary(data: Uint8Array): void;
-    onControl(data: string): void;
-    onClose(code: number): void;
-}
-interface RelayTerminalBridge {
-    send(data: string): void;
-    close(): void;
-}
-type RelayTerminalOpener = (token: string, request: RelayTerminalOpenRequest, handlers: RelayTerminalHandlers) => Promise<RelayTerminalBridge>;
-interface RelayHttpOpenRequest {
-    streamId: string;
-    method: RelayRpcRequest["method"];
-    path: string;
-    headers: Record<string, string>;
-}
-interface RelayHttpResponseHead {
-    status: number;
-    headers: Record<string, string>;
-}
-interface RelayHttpHandlers {
-    onResponse(response: RelayHttpResponseHead): void | Promise<void>;
-    onData(data: Uint8Array): void | Promise<void>;
-    onEnd(): void | Promise<void>;
-    onError(error: Error): void;
-}
-interface RelayHttpBridge {
-    write(data: Uint8Array): Promise<void>;
-    end(): void;
-    close(): void;
-}
-type RelayHttpOpener = (token: string, request: RelayHttpOpenRequest, handlers: RelayHttpHandlers) => Promise<RelayHttpBridge>;
-interface RelayHostConnector {
-    start(): void;
-    stop(): Promise<void>;
-    waitUntilReady(timeoutMs?: number): Promise<void>;
-    closeDevice(deviceId: string): void;
-    metrics(): RelayHostMetrics;
-}
-declare function relayConnectUrl(raw: string): string;
-declare function createRelayHostConnector(options: RelayHostConnectorOptions): RelayHostConnector;
-
-interface RelayHostRuntimeConfig {
-    relayUrl: string;
-    routeId: string;
-    hostCredential: string;
-    hostIdentity: RelayIdentity;
-    /** Static PWA origin used only for one-use remote pairing links. */
-    appUrl?: string;
-    hostLabel: string;
-}
-interface PersistedRelayHostConfig {
-    version: 1;
-    relayUrl: string;
-    routeId: string;
-    hostCredential: string;
-    appUrl?: string;
-    hostLabel: string;
-}
-type RelayHostConfigInput = Omit<PersistedRelayHostConfig, "version">;
-declare function relayHostConfigPath(dataDir: string): string;
-declare function readRelayHostConfig(dataDir: string): PersistedRelayHostConfig | undefined;
-declare function writeRelayHostConfig(dataDir: string, input: RelayHostConfigInput): PersistedRelayHostConfig;
-declare function removeRelayHostConfig(dataDir: string): boolean;
-declare function resolveRelayHostConfig(env: NodeJS.ProcessEnv, dataDir: string): RelayHostRuntimeConfig | undefined;
-
-declare const CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN = "roamcode-cloud-authorization-keyset-v1";
-declare const CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN_V2 = "roamcode-cloud-authorization-keyset-v2";
-declare const CLOUD_AUTHORIZATION_KEYSET_PATH = "/api/v1/meta/authorization-keyset";
-declare const CLOUD_KEYSET_CLOCK_SKEW_MS: number;
-declare const CloudAuthorizationKeysetKeyV1Schema: z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519">;
-    publicKey: z.ZodString;
-    notBefore: z.ZodNumber;
-    notAfter: z.ZodNullable<z.ZodNumber>;
-    status: z.ZodEnum<{
-        current: "current";
-        previous: "previous";
-    }>;
-}, z.core.$strict>;
-declare const CloudAuthorizationKeysetKeyV2Schema: z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-    publicKey: z.ZodString;
-    notBefore: z.ZodNumber;
-    notAfter: z.ZodNullable<z.ZodNumber>;
-    status: z.ZodEnum<{
-        current: "current";
-        previous: "previous";
-    }>;
-}, z.core.$strict>;
-declare const CloudAuthorizationKeysetV1Schema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"authorization-keyset">;
-    issuedAt: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    keys: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519">;
-        publicKey: z.ZodString;
-        notBefore: z.ZodNumber;
-        notAfter: z.ZodNullable<z.ZodNumber>;
-        status: z.ZodEnum<{
-            current: "current";
-            previous: "previous";
-        }>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-declare const CloudAuthorizationKeysetV2Schema: z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"authorization-keyset">;
-    issuedAt: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    keys: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-        publicKey: z.ZodString;
-        notBefore: z.ZodNumber;
-        notAfter: z.ZodNullable<z.ZodNumber>;
-        status: z.ZodEnum<{
-            current: "current";
-            previous: "previous";
-        }>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-declare const CloudAuthorizationKeysetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"authorization-keyset">;
-    issuedAt: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    keys: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519">;
-        publicKey: z.ZodString;
-        notBefore: z.ZodNumber;
-        notAfter: z.ZodNullable<z.ZodNumber>;
-        status: z.ZodEnum<{
-            current: "current";
-            previous: "previous";
-        }>;
-    }, z.core.$strict>>;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"authorization-keyset">;
-    issuedAt: z.ZodNumber;
-    expiresAt: z.ZodNumber;
-    keys: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-        publicKey: z.ZodString;
-        notBefore: z.ZodNumber;
-        notAfter: z.ZodNullable<z.ZodNumber>;
-        status: z.ZodEnum<{
-            current: "current";
-            previous: "previous";
-        }>;
-    }, z.core.$strict>>;
-}, z.core.$strict>], "v">;
-declare const SignedCloudAuthorizationKeysetSignatureV1Schema: z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519">;
-    signature: z.ZodString;
-}, z.core.$strict>;
-declare const SignedCloudAuthorizationKeysetSignatureV2Schema: z.ZodObject<{
-    keyId: z.ZodString;
-    algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-    signature: z.ZodString;
-}, z.core.$strict>;
-declare const SignedCloudAuthorizationKeysetV1Schema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"signed-authorization-keyset">;
-    keyset: z.ZodObject<{
-        v: z.ZodLiteral<1>;
-        kind: z.ZodLiteral<"authorization-keyset">;
-        issuedAt: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        keys: z.ZodArray<z.ZodObject<{
-            keyId: z.ZodString;
-            algorithm: z.ZodLiteral<"Ed25519">;
-            publicKey: z.ZodString;
-            notBefore: z.ZodNumber;
-            notAfter: z.ZodNullable<z.ZodNumber>;
-            status: z.ZodEnum<{
-                current: "current";
-                previous: "previous";
-            }>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signatures: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519">;
-        signature: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-declare const SignedCloudAuthorizationKeysetV2Schema: z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"signed-authorization-keyset">;
-    keyset: z.ZodObject<{
-        v: z.ZodLiteral<2>;
-        kind: z.ZodLiteral<"authorization-keyset">;
-        issuedAt: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        keys: z.ZodArray<z.ZodObject<{
-            keyId: z.ZodString;
-            algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-            publicKey: z.ZodString;
-            notBefore: z.ZodNumber;
-            notAfter: z.ZodNullable<z.ZodNumber>;
-            status: z.ZodEnum<{
-                current: "current";
-                previous: "previous";
-            }>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signatures: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-        signature: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-declare const SignedCloudAuthorizationKeysetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"signed-authorization-keyset">;
-    keyset: z.ZodObject<{
-        v: z.ZodLiteral<1>;
-        kind: z.ZodLiteral<"authorization-keyset">;
-        issuedAt: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        keys: z.ZodArray<z.ZodObject<{
-            keyId: z.ZodString;
-            algorithm: z.ZodLiteral<"Ed25519">;
-            publicKey: z.ZodString;
-            notBefore: z.ZodNumber;
-            notAfter: z.ZodNullable<z.ZodNumber>;
-            status: z.ZodEnum<{
-                current: "current";
-                previous: "previous";
-            }>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signatures: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519">;
-        signature: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"signed-authorization-keyset">;
-    keyset: z.ZodObject<{
-        v: z.ZodLiteral<2>;
-        kind: z.ZodLiteral<"authorization-keyset">;
-        issuedAt: z.ZodNumber;
-        expiresAt: z.ZodNumber;
-        keys: z.ZodArray<z.ZodObject<{
-            keyId: z.ZodString;
-            algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-            publicKey: z.ZodString;
-            notBefore: z.ZodNumber;
-            notAfter: z.ZodNullable<z.ZodNumber>;
-            status: z.ZodEnum<{
-                current: "current";
-                previous: "previous";
-            }>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>;
-    signatures: z.ZodArray<z.ZodObject<{
-        keyId: z.ZodString;
-        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-        signature: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>], "v">;
-type CloudAuthorizationKeysetKeyV1 = z.infer<typeof CloudAuthorizationKeysetKeyV1Schema>;
-type CloudAuthorizationKeysetKeyV2 = z.infer<typeof CloudAuthorizationKeysetKeyV2Schema>;
-type CloudAuthorizationKeysetKey = CloudAuthorizationKeysetKeyV1 | CloudAuthorizationKeysetKeyV2;
-type CloudAuthorizationKeysetV1 = z.infer<typeof CloudAuthorizationKeysetV1Schema>;
-type CloudAuthorizationKeysetV2 = z.infer<typeof CloudAuthorizationKeysetV2Schema>;
-type CloudAuthorizationKeyset = z.infer<typeof CloudAuthorizationKeysetSchema>;
-type SignedCloudAuthorizationKeysetV1 = z.infer<typeof SignedCloudAuthorizationKeysetV1Schema>;
-type SignedCloudAuthorizationKeysetV2 = z.infer<typeof SignedCloudAuthorizationKeysetV2Schema>;
-type SignedCloudAuthorizationKeyset = z.infer<typeof SignedCloudAuthorizationKeysetSchema>;
-type CloudKeysetVerificationErrorCode = "INVALID_KEYSET" | "INVALID_PINNED_KEY" | "ISSUED_IN_FUTURE" | "EXPIRED" | "PIN_EXPIRED" | "UNTRUSTED_ROTATION" | "KEYSET_ROLLBACK";
-declare class CloudKeysetVerificationError extends Error {
-    readonly code: CloudKeysetVerificationErrorCode;
-    constructor(code: CloudKeysetVerificationErrorCode);
-}
-declare function parseCloudAuthorizationKeyset(value: unknown): CloudAuthorizationKeyset;
-declare function cloudAuthorizationKeysetSigningPayload(keyset: unknown): Buffer;
-declare function cloudAuthorizationTrustedKeysFromKeyset(value: unknown): readonly CloudAuthorizationTrustedKey[];
-declare function verifySignedCloudAuthorizationKeyset(value: unknown, pinnedKeysetValue: unknown, now?: number, clockSkewMs?: number): SignedCloudAuthorizationKeyset;
-
-declare const CLOUD_HOST_CONFIG_FILE = "cloud-host.json";
-declare const CloudHostConfigV1Schema: z.ZodPipe<z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
-    organizationId: z.ZodUUID;
-    hostId: z.ZodUUID;
-    controlPlaneOrigin: z.ZodString;
-    hostCredential: z.ZodString;
-    authorization: z.ZodObject<{
-        algorithm: z.ZodLiteral<"Ed25519">;
-        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v1">;
-        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v1">;
-        keyset: z.ZodObject<{
-            v: z.ZodLiteral<1>;
-            kind: z.ZodLiteral<"authorization-keyset">;
-            issuedAt: z.ZodNumber;
-            expiresAt: z.ZodNumber;
-            keys: z.ZodArray<z.ZodObject<{
-                keyId: z.ZodString;
-                algorithm: z.ZodLiteral<"Ed25519">;
-                publicKey: z.ZodString;
-                notBefore: z.ZodNumber;
-                notAfter: z.ZodNullable<z.ZodNumber>;
-                status: z.ZodEnum<{
-                    current: "current";
-                    previous: "previous";
-                }>;
-            }, z.core.$strict>>;
-        }, z.core.$strict>;
-    }, z.core.$strict>;
-    heartbeatIntervalSeconds: z.ZodNumber;
-    authorizationRefreshIntervalSeconds: z.ZodNumber;
-}, z.core.$strict>, z.ZodTransform<{
-    controlPlaneOrigin: string;
-    v: 1;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
-        keyset: {
-            v: 1;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}, {
-    v: 1;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    controlPlaneOrigin: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
-        keyset: {
-            v: 1;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}>>;
-declare const CloudHostConfigV2Schema: z.ZodPipe<z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
-    organizationId: z.ZodUUID;
-    hostId: z.ZodUUID;
-    controlPlaneOrigin: z.ZodString;
-    hostCredential: z.ZodString;
-    authorization: z.ZodObject<{
-        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v2">;
-        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v2">;
-        keyset: z.ZodObject<{
-            v: z.ZodLiteral<2>;
-            kind: z.ZodLiteral<"authorization-keyset">;
-            issuedAt: z.ZodNumber;
-            expiresAt: z.ZodNumber;
-            keys: z.ZodArray<z.ZodObject<{
-                keyId: z.ZodString;
-                algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-                publicKey: z.ZodString;
-                notBefore: z.ZodNumber;
-                notAfter: z.ZodNullable<z.ZodNumber>;
-                status: z.ZodEnum<{
-                    current: "current";
-                    previous: "previous";
-                }>;
-            }, z.core.$strict>>;
-        }, z.core.$strict>;
-    }, z.core.$strict>;
-    heartbeatIntervalSeconds: z.ZodNumber;
-    authorizationRefreshIntervalSeconds: z.ZodNumber;
-}, z.core.$strict>, z.ZodTransform<{
-    controlPlaneOrigin: string;
-    v: 2;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519-SHA256";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
-        keyset: {
-            v: 2;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519-SHA256";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}, {
-    v: 2;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    controlPlaneOrigin: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519-SHA256";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
-        keyset: {
-            v: 2;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519-SHA256";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}>>;
-declare const CloudHostConfigSchema: z.ZodUnion<readonly [z.ZodPipe<z.ZodObject<{
-    v: z.ZodLiteral<1>;
-    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
-    organizationId: z.ZodUUID;
-    hostId: z.ZodUUID;
-    controlPlaneOrigin: z.ZodString;
-    hostCredential: z.ZodString;
-    authorization: z.ZodObject<{
-        algorithm: z.ZodLiteral<"Ed25519">;
-        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v1">;
-        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v1">;
-        keyset: z.ZodObject<{
-            v: z.ZodLiteral<1>;
-            kind: z.ZodLiteral<"authorization-keyset">;
-            issuedAt: z.ZodNumber;
-            expiresAt: z.ZodNumber;
-            keys: z.ZodArray<z.ZodObject<{
-                keyId: z.ZodString;
-                algorithm: z.ZodLiteral<"Ed25519">;
-                publicKey: z.ZodString;
-                notBefore: z.ZodNumber;
-                notAfter: z.ZodNullable<z.ZodNumber>;
-                status: z.ZodEnum<{
-                    current: "current";
-                    previous: "previous";
-                }>;
-            }, z.core.$strict>>;
-        }, z.core.$strict>;
-    }, z.core.$strict>;
-    heartbeatIntervalSeconds: z.ZodNumber;
-    authorizationRefreshIntervalSeconds: z.ZodNumber;
-}, z.core.$strict>, z.ZodTransform<{
-    controlPlaneOrigin: string;
-    v: 1;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
-        keyset: {
-            v: 1;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}, {
-    v: 1;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    controlPlaneOrigin: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v1";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v1";
-        keyset: {
-            v: 1;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}>>, z.ZodPipe<z.ZodObject<{
-    v: z.ZodLiteral<2>;
-    kind: z.ZodLiteral<"roamcode-cloud-host-config">;
-    organizationId: z.ZodUUID;
-    hostId: z.ZodUUID;
-    controlPlaneOrigin: z.ZodString;
-    hostCredential: z.ZodString;
-    authorization: z.ZodObject<{
-        algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-        signatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-snapshot-v2">;
-        keysetSignatureDomain: z.ZodLiteral<"roamcode-cloud-authorization-keyset-v2">;
-        keyset: z.ZodObject<{
-            v: z.ZodLiteral<2>;
-            kind: z.ZodLiteral<"authorization-keyset">;
-            issuedAt: z.ZodNumber;
-            expiresAt: z.ZodNumber;
-            keys: z.ZodArray<z.ZodObject<{
-                keyId: z.ZodString;
-                algorithm: z.ZodLiteral<"Ed25519-SHA256">;
-                publicKey: z.ZodString;
-                notBefore: z.ZodNumber;
-                notAfter: z.ZodNullable<z.ZodNumber>;
-                status: z.ZodEnum<{
-                    current: "current";
-                    previous: "previous";
-                }>;
-            }, z.core.$strict>>;
-        }, z.core.$strict>;
-    }, z.core.$strict>;
-    heartbeatIntervalSeconds: z.ZodNumber;
-    authorizationRefreshIntervalSeconds: z.ZodNumber;
-}, z.core.$strict>, z.ZodTransform<{
-    controlPlaneOrigin: string;
-    v: 2;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519-SHA256";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
-        keyset: {
-            v: 2;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519-SHA256";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}, {
-    v: 2;
-    kind: "roamcode-cloud-host-config";
-    organizationId: string;
-    hostId: string;
-    controlPlaneOrigin: string;
-    hostCredential: string;
-    authorization: {
-        algorithm: "Ed25519-SHA256";
-        signatureDomain: "roamcode-cloud-authorization-snapshot-v2";
-        keysetSignatureDomain: "roamcode-cloud-authorization-keyset-v2";
-        keyset: {
-            v: 2;
-            kind: "authorization-keyset";
-            issuedAt: number;
-            expiresAt: number;
-            keys: {
-                keyId: string;
-                algorithm: "Ed25519-SHA256";
-                publicKey: string;
-                notBefore: number;
-                notAfter: number | null;
-                status: "current" | "previous";
-            }[];
-        };
-    };
-    heartbeatIntervalSeconds: number;
-    authorizationRefreshIntervalSeconds: number;
-}>>]>;
-type CloudHostConfigV1 = z.output<typeof CloudHostConfigV1Schema>;
-type CloudHostConfigV2 = z.output<typeof CloudHostConfigV2Schema>;
-type CloudHostConfig = z.output<typeof CloudHostConfigSchema>;
-interface ResolvedCloudHostConfig {
-    path: string;
-    config: CloudHostConfig;
-}
-declare function cloudHostConfigPath(dataDir: string): string;
-declare function readCloudHostConfig(path: string): CloudHostConfig | undefined;
-declare function writeCloudHostConfig(path: string, value: unknown): CloudHostConfig;
-/** Remove a managed host configuration without following links or deleting an unowned file. */
-declare function removeCloudHostConfig(path: string): boolean;
-declare function replaceCloudHostAuthorizationKeyset(path: string, current: CloudHostConfig, keyset: CloudAuthorizationKeyset): CloudHostConfig;
-declare function resolveCloudHostConfig(env: NodeJS.ProcessEnv, dataDir: string): ResolvedCloudHostConfig | undefined;
-
-declare const CLOUD_HOST_HEARTBEAT_PATH = "/api/v1/hosts/heartbeat";
-declare const CLOUD_HOST_AUTOMATION_SYNC_PATH = "/api/v1/hosts/automation-sync";
-declare const CLOUD_HOST_AUTHORIZATION_SNAPSHOT_PATH = "/api/v1/hosts/authorization-snapshot";
-declare const CLOUD_HOST_MAX_SIGNED_RESPONSE_BYTES: number;
-interface CloudHostRuntimeStatus {
-    running: boolean;
-    heartbeatFailures: number;
-    authorizationFailures: number;
-    automationFailures: number;
-    authorizationIssue?: CloudHostAuthorizationIssue;
-    lastHeartbeatAt?: number;
-    lastAuthorizationAt?: number;
-    authorization: CloudAuthorizationState;
-}
-type CloudHostAuthorizationIssue = "connectivity" | "credential-rejected" | "invalid-control-plane-response" | "authorization-verification-failed" | "trust-expired";
-interface CloudHostRuntime {
-    start(): void;
-    stop(): Promise<void>;
-    sendHeartbeat(state?: "ready" | "draining"): Promise<void>;
-    refreshAuthorizationKeyset(): Promise<boolean>;
-    refreshAuthorizationSnapshot(): Promise<number>;
-    syncAuthorization(): Promise<number>;
-    /** Waits out an older in-flight poll, then starts a snapshot request from the resulting durable revision. */
-    syncAuthorizationFresh(): Promise<number>;
-    status(): CloudHostRuntimeStatus;
-}
-interface CreateCloudHostRuntimeOptions {
-    config: CloudHostConfig;
-    authorizationStore: CloudAuthorizationStore;
-    instanceId: string;
-    softwareVersion: string;
-    capabilities: readonly string[] | (() => readonly string[]);
-    automationWebhooks?: readonly CloudAutomationWebhookRegistration[] | (() => readonly CloudAutomationWebhookRegistration[]);
-    onAutomationInvocation?: (invocation: CloudAutomationInvocation) => Promise<void>;
-    /** Stable P-256 host identity advertised for browser enrollment pinning; private key never leaves this Node. */
-    relayHostIdentity?: CloudRelayHostIdentity;
-    /** Called only after a signed rotation verifies against the currently pinned keyset. Must persist atomically. */
-    replaceAuthorizationKeyset: (keyset: CloudAuthorizationKeyset) => void;
-    fetch?: typeof globalThis.fetch;
-    now?: () => number;
-    random?: () => number;
-    requestTimeoutMs?: number;
-    setTimeout?: typeof globalThis.setTimeout;
-    clearTimeout?: typeof globalThis.clearTimeout;
-}
-type CloudHostRuntimeErrorCode = "UNAVAILABLE" | "REJECTED" | "INVALID_RESPONSE" | "KEYSET_REPLAY";
-declare class CloudHostRuntimeError extends Error {
-    readonly code: CloudHostRuntimeErrorCode;
-    readonly retryable: boolean;
-    constructor(code: CloudHostRuntimeErrorCode, retryable: boolean);
-}
-declare function createCloudHostRuntime(options: CreateCloudHostRuntimeOptions): CloudHostRuntime;
-
-type CompositeAuthorizationReason = TeamAuthorizationDecision["reason"] | CloudAuthorizationDecision["reason"];
-interface CompositeAuthorizationDecision {
-    allowed: boolean;
-    reason: CompositeAuthorizationReason;
-    source: "local" | "team" | "cloud";
-    roles: TeamRole[];
-    member?: TeamMember;
-    cloudRevision?: number;
-}
-interface CompositeAuthorizer {
-    authorize(actorType: TeamPrincipalType, actorId: string, permission: TeamPermission, resource?: TeamAuthorizationResource): CompositeAuthorizationDecision;
-}
-interface CreateCompositeAuthorizerOptions {
-    teamStore: TeamStore;
-    /** Omit for self-hosted mode; presence makes a valid cloud grant an additional requirement for remote actors. */
-    cloudStore?: CloudAuthorizationStore;
-    /**
-     * The managed control plane may assign the same physical Node a cloud Host id that differs from the
-     * command-center store's local Host id. TeamStore must continue authorizing against the local id while the
-     * signed cloud snapshot must see its own target id, so translate only the cloud layer at this composition
-     * boundary instead of leaking a connection alias into every local resource.
-     */
-    cloudHostId?: string;
-    /** Persisted managed ownership without a usable cloud store remains fail-closed for every remote actor. */
-    requireCloud?: boolean;
-    now?: () => number;
-}
-/**
- * Composes cloud grants with the existing local TeamStore policy. Self-hosted callers keep TeamStore behavior
- * exactly; cloud-managed callers must pass both layers. Host and local recovery principals never depend on cloud
- * availability, so an expired or unreachable control plane cannot lock an operator out of their own machine.
- */
-declare function createCompositeAuthorizer(options: CreateCompositeAuthorizerOptions): CompositeAuthorizer;
-
-interface LoopbackRelayTerminalOptions {
-    baseUrl(): string | undefined;
-    issueTicket(token: string): Promise<string>;
-    WebSocketClass?: typeof WebSocket;
-    openTimeoutMs?: number;
+interface AuthorizationDecision extends TeamAuthorizationDecision {
+    source: "local" | "team";
 }
-declare function createLoopbackRelayTerminalOpener(options: LoopbackRelayTerminalOptions): RelayTerminalOpener;
-
-interface LoopbackRelayHttpOptions {
-    baseUrl(): string | undefined;
-    headers(token: string, requestHeaders: Record<string, string>): Record<string, string>;
-    idleTimeoutMs?: number;
+interface Authorizer {
+    authorize(actorType: TeamPrincipalType, actorId: string, permission: TeamPermission, resource?: TeamAuthorizationResource): AuthorizationDecision;
 }
-/**
- * Streams an authenticated relay request through the real loopback HTTP server. This deliberately traverses
- * the normal auth, RBAC, rate-limit, idempotency, audit, multipart, and route hooks instead of calling file
- * services out of band.
- */
-declare function createLoopbackRelayHttpOpener(options: LoopbackRelayHttpOptions): RelayHttpOpener;
-
-declare const RELAY_WIRE_PROTOCOL_VERSION: 1;
-declare const RELAY_WIRE_MAX_ENVELOPE_BYTES = 1400000;
-type RelayWireEnvelope = {
-    v: 1;
-    t: "device-hello";
-    hello: RelayHandshakeHello;
-    identityPublicKey?: string;
-} | {
-    v: 1;
-    t: "host-hello";
-    hello: RelayHandshakeHello;
-} | {
-    v: 1;
-    t: "cipher";
-    frame: RelayEncryptedFrame;
-};
-declare function encodeRelayWireEnvelope(envelope: RelayWireEnvelope): string;
-declare function decodeRelayWireEnvelope(payload: unknown): RelayWireEnvelope;
+/** Standalone authorization is owned entirely by the local durable TeamStore. */
+declare function createTeamAuthorizer(teamStore: TeamStore): Authorizer;
 
 type PolicyStoreMode = "sqlite" | "memory-fallback";
 type ExtensionPolicyMode = "allow-integrity" | "signed-only" | "deny";
@@ -3031,7 +1025,6 @@ interface EnterprisePolicy {
     allowDangerousProviderModes: boolean;
     allowFileTransfer: boolean;
     extensionMode: ExtensionPolicyMode;
-    allowRelay: boolean;
     updateMode: UpdatePolicyMode;
     revision: number;
     createdAt: number;
@@ -3045,10 +1038,9 @@ interface EnterprisePolicyUpdate {
     allowDangerousProviderModes?: boolean;
     allowFileTransfer?: boolean;
     extensionMode?: ExtensionPolicyMode;
-    allowRelay?: boolean;
     updateMode?: UpdatePolicyMode;
 }
-type EnterprisePolicyAction = "access" | "session.launch" | "file.transfer" | "extension.mutate" | "relay.access" | "update.mutate";
+type EnterprisePolicyAction = "access" | "session.launch" | "file.transfer" | "extension.mutate" | "update.mutate";
 interface EnterprisePolicyContext {
     hostId: string;
     workspaceId?: string;
@@ -3059,7 +1051,7 @@ interface EnterprisePolicyContext {
 }
 interface EnterprisePolicyDecision {
     allowed: boolean;
-    reason: "not-enforced" | "allowed" | "host-denied" | "workspace-denied" | "provider-denied" | "dangerous-mode-denied" | "file-transfer-denied" | "extension-denied" | "extension-signature-required" | "relay-denied" | "updates-denied" | "update-channel-denied";
+    reason: "not-enforced" | "allowed" | "host-denied" | "workspace-denied" | "provider-denied" | "dangerous-mode-denied" | "file-transfer-denied" | "extension-denied" | "extension-signature-required" | "updates-denied" | "update-channel-denied";
 }
 interface PolicyStore {
     readonly mode: PolicyStoreMode;
@@ -3883,7 +1875,7 @@ interface ProductContext {
     name: string;
 }
 interface NodeAlias {
-    kind: "command-host" | "cloud-host" | "peer-host" | "direct-host" | "relay-route";
+    kind: "command-host" | "peer-host" | "direct-host";
     id: string;
 }
 interface NodeRecord {
@@ -4083,7 +2075,7 @@ interface WsTicketStoreOptions {
     generate?: () => string;
 }
 interface WsTicketContext {
-    actorType: "device" | "host" | "local" | "relay";
+    actorType: "device" | "host" | "local";
     actorId: string;
     label: string;
 }
@@ -5652,16 +3644,14 @@ interface CreateServerDeps {
     wsTickets?: WsTicketStore;
     /** One-writer/many-observer terminal input coordinator. Injectable for deterministic multi-client tests. */
     inputLeases?: InputLeaseCoordinator;
-    /** Managed-cloud terminal authorization poll cadence. Injectable only so socket revocation tests stay fast. */
-    terminalAuthorizationRecheckMs?: number;
     /** Team policy seam: direct local mode permits confirmed takeover; enterprise policy can deny it here. */
     authorizeInputTakeover?: (principal: InputLeasePrincipal, sessionId: string) => boolean;
     /** Optional policy seam for acquiring/writing input. Team RBAC is applied in addition when enabled. */
     authorizeInputWrite?: (principal: InputLeasePrincipal, sessionId: string) => boolean;
     /** Durable team membership and role assignments. start.ts supplies SQLite; tests may inject memory. */
     teamStore?: TeamStore;
-    /** Additive local-team + signed-cloud authorization. Omit to preserve exact self-hosted TeamStore behavior. */
-    authorizer?: CompositeAuthorizer;
+    /** Local durable team authorization. */
+    authorizer?: Authorizer;
     /** Durable organization policy. Disabled by default; enforced uniformly when explicitly enabled. */
     policyStore?: PolicyStore;
     /** Durable, explicitly scoped host-to-host API connections. Raw peer credentials never leave this store. */
@@ -5670,70 +3660,16 @@ interface CreateServerDeps {
     peerFetch?: typeof globalThis.fetch;
     /** Ephemeral, bounded presence heartbeats. */
     presence?: PresenceCoordinator;
-    /** Advertises and enforces that this host has an outbound blind-relay transport configured. */
-    relayEnabled?: boolean;
-    /** Privacy-bounded connector health for the authenticated settings UI. */
-    relayStatus?: () => {
-        status: "idle" | "connecting" | "online" | "reconnecting" | "stopped";
-        activeChannels: number;
-        reconnects: number;
-    };
-    /** Privacy-safe managed-host sync status. Presence means cloud management is configured. */
-    cloudStatus?: () => CloudHostRuntimeStatus;
-    /** Signed managed-cloud authorization authority, used only for read-only Node grant projection. */
-    cloudAuthorizationStore?: CloudAuthorizationStore;
-    /** Managed ownership remains read-only/fail-closed even if its signed cloud store is temporarily unavailable. */
-    managedAuthorization?: boolean;
-    /** Canonical product ownership for this Node. Local installs default to the Personal context. */
-    nodeOwner?: OwnerRef;
-    /** Non-authoritative connection identifiers that resolve to this persistent command-host Node. */
-    nodeAliases?: readonly NodeAlias[];
-    /** Product context label; never used as an authorization decision. */
-    nodeOwnerName?: string;
-    /** Optional hosted/self-hosted bootstrap; absent means relay works for already-provisioned devices only. */
-    relayPairing?: RelayPairingBootstrap;
-    /**
-     * Optional hosted control-plane bridge. The request actor always comes from DeviceStore authentication;
-     * clients can supply only their one-use enrollment challenge.
-     */
-    cloudDeviceEnrollmentConfirmer?: CloudDeviceEnrollmentConfirmer;
-    /** Late-bound host connector hook so device revocation closes relay channels immediately. */
-    onDeviceRevoked?: (deviceId: string) => void;
-}
-type CloudStatusSyncState = "not-configured" | "syncing" | "healthy" | "pending" | "degraded" | "expired";
-type CloudStatusRecoveryAction = "none" | "wait-for-cloud-sync" | "wait-for-authorization-activation" | "check-host-connectivity" | "reauthorize-host" | "contact-organization-admin";
-interface CloudStatusResponse {
-    v: 1;
-    mode: "self-hosted" | "managed";
-    configured: boolean;
-    sync: {
-        state: CloudStatusSyncState;
-        lastSuccessfulAt: number | null;
-    };
-    authorization: {
-        status: "not-configured" | CloudHostRuntimeStatus["authorization"]["status"];
-        revision: number | null;
-        expiresAt: number | null;
-        expired: boolean;
-    };
-    action: CloudStatusRecoveryAction;
 }
-declare function cloudStatusResponse(status?: CloudHostRuntimeStatus): CloudStatusResponse;
 interface CreateServerResult {
     app: FastifyInstance;
     authGate: AuthGate;
     /** Issue a five-minute, one-use pairing capability without exposing the host's master token. */
     issuePairing(): PairingTicket;
-    /** Internal E2E-relay bridge. It authenticates relay-scoped devices through the exact normal route hooks. */
-    dispatchRelayRequest(token: string, request: RelayRpcRequest): Promise<RelayRpcResponse>;
-    /** Issues a relay-principal terminal ticket without exposing the bridge's process-local capability. */
-    issueRelayTerminalTicket(token: string): Promise<string>;
-    /** Process-local loopback headers for streamed relay HTTP. Never expose these outside this server process. */
-    relayLoopbackHeaders(token: string, headers?: Record<string, string>): Record<string, string>;
     /** Exposed so startServer can late-bind the MCP attach config (after listen() resolves the port) —
      *  this is what gives the terminal's claude send_image/send_file. */
     terminalManager: TerminalManager;
-    /** Exposed for relay/team composition and isolated ownership tests. */
+    /** Exposed for team composition and isolated ownership tests. */
     inputLeases: InputLeaseCoordinator;
     teamStore: TeamStore;
     policyStore: PolicyStore;
@@ -5741,17 +3677,13 @@ interface CreateServerResult {
     presence: PresenceCoordinator;
     /** False when tmux/node-pty is unavailable → terminal sessions are disabled (startServer warns loudly). */
     terminalAvailable: boolean;
-    /** Privacy-bounded webhook routing records synchronized to an optional managed control plane. */
-    automationWebhookRegistrations(): CloudAutomationWebhookRegistration[];
-    /** Durably accepts one control-plane signal; the invocation id makes redelivery idempotent. */
-    acceptCloudAutomationInvocation(invocation: CloudAutomationInvocation): Promise<void>;
 }
 declare function createServer(config: ServerRuntimeConfig, deps?: CreateServerDeps): CreateServerResult;
 
 /** Hash of the intentionally inline boot-recovery watchdog in packages/web/index.html. */
 declare const PWA_BOOT_WATCHDOG_SHA256 = "sha256-tcgQYptaPeNGqJtts8Ft/5H4tf+s+jfSWQSguIhTp8k=";
 /**
- * Static-shell policy shared by direct hosts and mirrored by packaging/relay/Caddyfile.
+ * Static-shell policy shared by standalone hosts.
  * Inline component styles remain necessary; executable inline code is restricted to the reviewed watchdog hash.
  */
 declare const PWA_CONTENT_SECURITY_POLICY: string;
@@ -5874,22 +3806,10 @@ declare function claudePreflightWarning(availability: ClaudeAvailability): strin
  * (the probe is short-timeout-guarded). Injectable probe + log sink so it's testable without a spawn.
  */
 declare function runClaudePreflight(probe: ClaudeVersionProbe, warn?: (msg: string) => void): Promise<void>;
-interface StartServerOptions {
-    /** Shared control-plane transport seam for isolated embedding and startup tests. */
-    fetch?: typeof globalThis.fetch;
-}
-declare function cloudHostCapabilities(input: {
-    authorizationVersion: number;
-    terminalAvailable: boolean;
-    relayEnabled: boolean;
-    managedDeviceEnrollmentEnabled: boolean;
-}): string[];
-declare function startServer(env?: NodeJS.ProcessEnv, options?: StartServerOptions): Promise<CreateServerResult & {
+declare function startServer(env?: NodeJS.ProcessEnv): Promise<CreateServerResult & {
     url: string;
     token?: string;
     tokenGenerated: boolean;
-    relayHost?: RelayHostConnector;
-    cloudHostRuntime?: CloudHostRuntime;
 }>;
 
 interface ProcessLifecycleTarget {
@@ -6097,4 +4017,4 @@ declare function codexClassifierVersionWarning(codexVersion: string | undefined)
 
 declare const SERVER_PACKAGE = "@roamcode.ai/server";
 
-export { ADAPTER_CONTRACT_VERSION, API_PATH_DENYLIST, type AdapterCapabilityName, AdapterManifestError, type AdapterManifestV1, type AdapterPackageManifestV1, type AdapterRuntimeV1, type AdapterStateAuthority, type AgentActivity, type AgentProvider, type AgentRecord, type AgentRuntimeAuthState, type AgentRuntimeRecord, type AttachSpawnOptions, type AttentionItem, type AttentionKind, type AttentionState, type AuditActorType, type AuditRecord, type AuditResult, type AuthCheckResult, AuthGate, type AuthGateOptions, type AutomationAction, type AutomationDefinition, type AutomationRun, type AutomationTrigger, BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE, BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE, BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES, BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE, BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES, BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS, BLIND_RELAY_PROTOCOL_VERSION, type Bar, type BlindRelayMetrics, type BlindRelayServer, CHECK_CACHE_MS, CLASSIFIER_TESTED_UP_TO, CLAUDE_LATEST_CACHE_MS, CLAUDE_VERSION_CACHE_MS, CLAUDE_VERSION_TIMEOUT_MS, CLOUD_AUTHORIZATION_CLOCK_SKEW_MS, CLOUD_AUTHORIZATION_CONTRACT_VERSION, CLOUD_AUTHORIZATION_FILE, CLOUD_AUTHORIZATION_KEYSET_PATH, CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN, CLOUD_AUTHORIZATION_KEYSET_SIGNATURE_DOMAIN_V2, CLOUD_AUTHORIZATION_LAST_GOOD_FILE, CLOUD_AUTHORIZATION_PERMISSIONS, CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM, CLOUD_AUTHORIZATION_SIGNATURE_ALGORITHM_V2, CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN, CLOUD_AUTHORIZATION_SIGNATURE_DOMAIN_V2, CLOUD_CONTRACT_VERSION, CLOUD_DEVICE_ENROLLMENT_COMPLETE_PATH, CLOUD_DEVICE_ENROLLMENT_CONFIRM_PATH, CLOUD_DEVICE_ENROLLMENT_HOST_ROUTE, CLOUD_HOST_AUTHORIZATION_SNAPSHOT_PATH, CLOUD_HOST_AUTOMATION_SYNC_PATH, CLOUD_HOST_CONFIG_FILE, CLOUD_HOST_HEARTBEAT_PATH, CLOUD_HOST_MAX_SIGNED_RESPONSE_BYTES, CLOUD_KEYSET_CLOCK_SKEW_MS, CODEX_CLASSIFIER_TESTED_UP_TO, CODEX_EXECUTABLE_PROBE_TIMEOUT_MS, CODEX_OSC_MAX_CARRY, CONTROL_IDEMPOTENCY_TTL_MS, type CaptureOptions, type ChangelogEntry, type ClaudeAuthDeps, ClaudeAuthService, type ClaudeAuthStatus, type ClaudeAvailability, type ClaudeLatestDeps, ClaudeLatestService, type ClaudeMetadataRunner, ClaudeMetadataService, type ClaudeModelCatalogItem, type ClaudeSessionOptions, type ClaudeVersionProbe, type CloudAuthorizationDecision, type CloudAuthorizationGrantV1, CloudAuthorizationGrantV1Schema, type CloudAuthorizationKeyset, type CloudAuthorizationKeysetKey, type CloudAuthorizationKeysetKeyV1, CloudAuthorizationKeysetKeyV1Schema, type CloudAuthorizationKeysetKeyV2, CloudAuthorizationKeysetKeyV2Schema, CloudAuthorizationKeysetSchema, type CloudAuthorizationKeysetV1, CloudAuthorizationKeysetV1Schema, type CloudAuthorizationKeysetV2, CloudAuthorizationKeysetV2Schema, type CloudAuthorizationPermission, CloudAuthorizationPermissionSchema, type CloudAuthorizationPrincipalType, type CloudAuthorizationScopeV1, CloudAuthorizationScopeV1Schema, type CloudAuthorizationSnapshot, CloudAuthorizationSnapshotSchema, type CloudAuthorizationSnapshotStatus, type CloudAuthorizationSnapshotV1, CloudAuthorizationSnapshotV1Schema, type CloudAuthorizationSnapshotV2, CloudAuthorizationSnapshotV2Schema, type CloudAuthorizationState, type CloudAuthorizationStore, CloudAuthorizationStoreError, type CloudAuthorizationStoreErrorCode, type CloudAuthorizationTrustedKey, CloudAuthorizationTrustedKeyAnySchema, CloudAuthorizationTrustedKeySchema, type CloudAuthorizationTrustedKeyV1, type CloudAuthorizationTrustedKeyV2, CloudAuthorizationTrustedKeyV2Schema, CloudAuthorizationVerificationError, type CloudAuthorizationVerificationErrorCode, type CloudDeviceEnrollmentConfirmationResult, type CloudDeviceEnrollmentConfirmer, CloudDeviceEnrollmentConflictError, CloudDeviceEnrollmentError, type CloudDeviceEnrollmentErrorCode, type CloudDeviceEnrollmentPrepareInput, type CloudDeviceEnrollmentProgress, type CloudDeviceEnrollmentRecoveryLoop, type CloudDeviceEnrollmentRequest, CloudDeviceEnrollmentRequestSchema, type CloudDeviceEnrollmentRuntimeConfig, type CloudDeviceEnrollmentState, type CloudHostAuthorizationIssue, type CloudHostConfig, CloudHostConfigSchema, type CloudHostConfigV1, CloudHostConfigV1Schema, type CloudHostConfigV2, CloudHostConfigV2Schema, type CloudHostDeviceEnrollmentCompletion, type CloudHostDeviceEnrollmentCompletionResult, CloudHostDeviceEnrollmentCompletionSchema, type CloudHostDeviceEnrollmentConfirmation, CloudHostDeviceEnrollmentConfirmationSchema, type CloudHostHeartbeatV1, CloudHostHeartbeatV1Schema, type CloudHostRuntime, CloudHostRuntimeError, type CloudHostRuntimeErrorCode, type CloudHostRuntimeStatus, CloudKeysetVerificationError, type CloudKeysetVerificationErrorCode, type CloudRelayDeviceEnrollmentAuth, CloudRelayDeviceEnrollmentAuthSchema, type CloudRelayDeviceEnrollmentPayload, CloudRelayDeviceEnrollmentPayloadSchema, type CloudRelayDeviceEnrollmentSaga, type CloudStatusRecoveryAction, type CloudStatusResponse, type CloudStatusSyncState, type CodexAccount, CodexAppServerClient, type CodexAppServerClientOptions, type CodexDeviceLogin, type CodexExecutableDeps, type CodexExecutableProbe, type CodexExecutableResolution, type CodexInstallProvenance, CodexLatestService, type CodexLoginCompletion, type CodexLoginStatus, type CodexMetadataDiagnostics, type CodexMetadataRpc, CodexMetadataService, type CodexMetadataServiceOptions, type CodexModel, type CodexOscParser, type CodexProfileClientLifecycle, type CodexSessionOptions, type CodexSpawnLease, type CodexThreadInventoryEntry, type CodexThreadPersistence, CodexThreadResolver, type CodexThreadResolverOptions, type CodexUsage, type CodexVersionInfo, CommandCenterRevisionConflictError, type CommandCenterStore, type CommandCenterStoreMode, type CommandEvent, type CommandLayoutEnvelope, type CompositeAuthorizationDecision, type CompositeAuthorizationReason, type CompositeAuthorizer, type ControlStore, type ControlStoreMode, type CreateAutomationInput, type CreateBlindRelayOptions, type CreateClaudeProviderOptions, type CreateCloudDeviceEnrollmentConfirmerOptions, type CreateCloudDeviceEnrollmentRecoveryLoopOptions, type CreateCloudHostRuntimeOptions, type CreateCloudRelayDeviceEnrollmentSagaOptions, type CreateCodexProfileClientLifecycleOptions, type CreateCodexProviderOptions, type CreateCompositeAuthorizerOptions, type CreateInstalledAdapterProviderOptions, type CreatePeerInput, type CreatePluginRuntimeOptions, type CreatePushDispatcherDeps, type CreateRelayAccountInput, type CreateServerDeps, type CreateServerResult, type CreateSessionAutomationInput, type CreateSessionAutomationRunInput, type CreateWebPushSendOptions, type CreateWorktreeInput, type CreateWorktreeResult, type CreateWorktreeServiceOptions, DEFAULT_CLOUD_CONTROL_PLANE_URL, type DeviceEnrollment, type DeviceInfo, DevicePairingError, type DeviceRelayIdentity, type DeviceScope, type DeviceStore, type DirEntry, type DirListing, type DirSearchResult, type DurableRelayIdentity, type EnterprisePolicy, type EnterprisePolicyAction, type EnterprisePolicyContext, type EnterprisePolicyDecision, EnterprisePolicyRevisionConflictError, type EnterprisePolicyUpdate, ExtensionError, type ExtensionKind, type ExtensionManager, type ExtensionManifestV1, type ExtensionPolicyMode, type ExtensionTrust, type ExtensionVersionRecord, FETCH_TIMEOUT_MS, type FetchLatest, type FetchManifest, type FetchReleases, FsError, type FsErrorCode, FsService, type FsServiceOptions, type GitHubRelease, type HooksSettingsDocument, type HostRecord, INPUT_LEASE_TTL_MS, type IPty, type IdempotencyRecord, type InputLease, type InputLeaseAcquireResult, type InputLeaseActorType, InputLeaseCoordinator, type InputLeaseCoordinatorOptions, type InputLeaseEvent, type InputLeasePrincipal, type InstallExtensionInput, type InstallServiceContext, type InstallServiceResult, type InstallationKind, type InstalledExtension, type LaunchIntent, type LoopbackRelayHttpOptions, type LoopbackRelayTerminalOptions, type ManagedInstallOptions, type ManagedInstallResult, type ManagedInstallStatus, type ManagedPaths, type MarketplaceEntry, type McpConfigDocument, type ModelWeekBar, type NodeAlias, type NodeRecord, OPENAI_CODE_SIGNING_TEAM_ID, type OpenApiBuildOptions, type OpenCloudAuthorizationStoreOptions, type OpenCommandCenterStoreOptions, type OpenControlStoreOptions, type OpenDeviceStoreOptions, type OpenExtensionManagerOptions, type OpenPeerStoreOptions, type OpenPolicyStoreOptions, type OpenPushStoreOptions, type OpenRelayAccountStoreOptions, type OpenRelayRouteStoreOptions, type OpenSessionAutomationStoreOptions, type OpenSessionStoreOptions, type OpenTeamStoreOptions, type OriginCheckOptions, type OwnerRef, PAIRING_TTL_MS, PRESENCE_HEARTBEAT_MS, PRESENCE_TTL_MS, PWA_BOOT_WATCHDOG_SHA256, PWA_CONTENT_SECURITY_POLICY, type PairingTicket, type PaneStatus, type PeerAction, type PeerConnection, type PeerJsonResponse, type PeerRecord, PeerRequestError, PeerRevisionConflictError, type PeerStatus, type PeerStore, type PeerStoreMode, type PendingCloudDevicePromotion, type PersistedRelayHostConfig, type PluginAuditEvent, type PluginManifestV1, type PluginPermission, type PluginRunInput, type PluginRunResult, type PluginRuntime, PluginRuntimeError, type PolicyStore, type PolicyStoreMode, PresenceCoordinator, type PresenceCoordinatorOptions, type PresenceEvent, type PresenceHeartbeatInput, type PresenceMode, type PresenceRecord, type PresenceTarget, type ProcessLifecycleHandle, type ProcessLifecycleOptions, type ProcessLifecycleTarget, type ProcessSpec, type ProductContext, type ProviderAdapterV1, type ProviderAvailability, ProviderError, type ProviderId, ProviderOptionsError, type ProviderProcessContext, ProviderRegistry, type ProviderRuntimeSignal, type ProviderRuntimeSignalParser, type ProviderSessionOptions, type PtySpawn, type PublicRelayRouteRecord, type PushDispatcher, type PushEvent, type PushEventKind, type PushPayload, type PushRecipient, type PushSendFn, type PushStore, type PushSubscriptionRecord, RELAY_CHANNEL_MAX_AGE_MS, RELAY_CHANNEL_MAX_FRAMES, RELAY_HANDSHAKE_MAX_SKEW_MS, RELAY_MAX_PLAINTEXT_BYTES, RELAY_PROTOCOL_VERSION, RELAY_RPC_MAX_BODY_BYTES, RELAY_RPC_MAX_PATH_BYTES, RELAY_WIRE_MAX_ENVELOPE_BYTES, RELAY_WIRE_PROTOCOL_VERSION, RUNNING_BUILD, RUNNING_VERSION, type RateLimitDecision, RateLimiter, type RateLimiterOptions, type RegisterStaticOptions, type RelayAccountCredentialInput, type RelayAccountCredentialMaterial, type RelayAccountPlan, type RelayAccountRecord, RelayAccountRevisionConflictError, type RelayAccountStatus, type RelayAccountStore, type RelayAccountStoreMode, type RelayChannelOptions, RelayCipherState, RelayCryptoError, type RelayCryptoErrorCode, type RelayDeviceProvisioner, type RelayDeviceProvisionerOptions, type RelayDeviceRouteRecord, type RelayDirection, type RelayEncryptedFrame, type RelayEphemeralKeyPair, type RelayFrameKind, type RelayHandshakeHello, type RelayHostConfigInput, type RelayHostConnector, type RelayHostConnectorOptions, type RelayHostMetrics, type RelayHostRuntimeConfig, type RelayHostStatus, type RelayHttpBridge, type RelayHttpHandlers, type RelayHttpOpenRequest, type RelayHttpOpener, type RelayHttpResponseHead, type RelayIdentity, type RelayIdentityStoreOptions, type RelayPairingBootstrap, type RelayPairingPackage, type RelayRole, type RelayRouteRecord, type RelayRouteStore, type RelayRpcMethod, type RelayRpcRequest, type RelayRpcResponse, type RelayStoreMode, type RelayTerminalBridge, type RelayTerminalHandlers, type RelayTerminalOpenRequest, type RelayTerminalOpener, type RelayWireEnvelope, type ReleaseRecord, type RenderLaunchdOptions, type RenderSystemdOptions, type ResolveAccessTokenOptions, type ResolveCodexExecutableOptions, type ResolveCodexThreadOptions, type ResolveVapidKeysOptions, type ResolvedCloudHostConfig, type ReturnTypeOfDescriptors, type RunClaudeVersion, type RunUsage, SEARCH_MAX_DEPTH, SEARCH_MAX_DIRS, SEARCH_MAX_RESULTS, SERVER_PACKAGE, SHELL_PATH_ALLOWLIST, type ServerConfig, type ServerRuntimeConfig, type ServiceRecord, type SessionAutomationDefinition, SessionAutomationRevisionConflictError, type SessionAutomationRun, type SessionAutomationRunStatus, type SessionAutomationStore, type SessionAutomationStoreMode, type SessionAutomationTrigger, type SessionDefaults, SessionDefaultsConflictError, type SessionFileDirection, type SessionFileKind, type SessionFileStorage, type SessionPlacement, type SessionStore, type SignedCloudAuthorizationKeyset, SignedCloudAuthorizationKeysetSchema, SignedCloudAuthorizationKeysetSignatureV1Schema, SignedCloudAuthorizationKeysetSignatureV2Schema, type SignedCloudAuthorizationKeysetV1, SignedCloudAuthorizationKeysetV1Schema, type SignedCloudAuthorizationKeysetV2, SignedCloudAuthorizationKeysetV2Schema, type SignedCloudAuthorizationSnapshot, SignedCloudAuthorizationSnapshotSchema, type SignedCloudAuthorizationSnapshotV1, SignedCloudAuthorizationSnapshotV1Schema, type SignedCloudAuthorizationSnapshotV2, SignedCloudAuthorizationSnapshotV2Schema, type StartServerOptions, type StartedBlindRelay, type StoreMode, type StoredCloudAuthorizationSnapshot, type StoredExternalSession, type StoredSession, type StoredSessionDefaults, type StoredSessionFile, type StoredStatus, type TeamAuthorizationDecision, type TeamAuthorizationResource, type TeamMember, type TeamMemberKind, type TeamMemberStatus, type TeamPermission, type TeamPrincipalBinding, type TeamPrincipalType, type TeamRecord, TeamRevisionConflictError, type TeamRole, type TeamRoleBinding, type TeamScopeType, type TeamStore, type TeamStoreMode, TerminalManager, type TerminalManagerDeps, type TerminalMeta, TerminalProcess, type TerminalProcessOptions, type TerminalSub, USAGE_CACHE_MS, USAGE_TIMEOUT_MS, type UpdateAction, type UpdateAutomationInput, type UpdatePeerInput, type UpdatePolicyMode, type UpdateRelayAccountInput, type UpdateSessionAutomationInput, type UpdateState, type UpdateStatus, Updater, type UpdaterDeps, type UpdaterFs, type UsageInfo, UsageService, type UsageServiceDeps, type VapidKeys, type VerifiedPeerIdentity, type VersionInfo, WS_TICKET_TTL_MS, type WorkspaceKind, type WorkspaceRecord, WorktreeError, type WorktreeErrorCode, type WorktreeRecord, type WorktreeService, type WsTicketContext, WsTicketStore, type WsTicketStoreOptions, adapterCapabilityNames, agentRuntimeId, assertConfigAllowsStart, buildCodexArgs, buildHooksSettingsDocument, buildMcpConfigDocument, buildOpenApiDocument, buildPushPayload, buildRelayPairingUrl, buildServicePath, canonicalCloudJson, capturePane, classifierVersionWarning, classifyCodexPane, classifyPaneStatus, claudePreflightWarning, cloudAuthorizationKeysetSigningPayload, cloudAuthorizationSnapshotSigningPayload, cloudAuthorizationTrustedKeysFromKeyset, cloudDeviceEnrollmentAuthorizationReady, cloudHostCapabilities, cloudHostConfigPath, cloudStatusResponse, codexClassifierVersionWarning, compareVersions, computeBuildDrift, computeInstallDrift, createBlindRelayServer, createClaudeAuthService, createClaudeLatestService, createClaudeMetadataRunner, createClaudeProvider, createClaudeVersionProbe, createCloudDeviceEnrollmentConfirmer, createCloudDeviceEnrollmentRecoveryLoop, createCloudHostRuntime, createCloudRelayDeviceEnrollmentSaga, createCodexOscParser, createCodexProfileClientLifecycle, createCodexProvider, createCodexThreadInventory, createCodexThreadPersistence, createCompositeAuthorizer, createInstalledAdapterProvider, createLoopbackRelayHttpOpener, createLoopbackRelayTerminalOpener, createPluginRuntime, createPushDispatcher, createRelayDeviceProvisioner, createRelayHandshakeHello, createRelayHostConnector, createServer, createUpdater, createUsageRunner, createUsageService, createWebPushSend, createWorktreeService, currentAgentIdForSession, decodeRelayWireEnvelope, defaultFetchManifest, defaultFetchReleases, defaultProbeCodexExecutable, defaultRunClaudeVersion, defaultUpdaterFs, defineAdapterManifest, detectTerminalSupport, enableService, encodeRelayWireEnvelope, ensureDataDir, establishRelayChannel, evaluateEnterprisePolicy, extractBearerToken, extractLoginUrl, generateAccessToken, generateRelayAccountCredential, generateRelayCredential, generateRelayEphemeralKeyPair, generateRelayIdentity, hasEncodedSep, hkdfSha256, hookAuthFileContent, hookAuthPathFor, hooksSettingsPathFor, inspectExtensionPackage, installManagedRelease, installProcessLifecycle, installService, isCodexProfileClientLifecycle, isLoopbackAddress, isNewerMajorMinor, isOriginAllowed, isPublicForRequest, isPublicPath, isRelayDirectExecution, isShellPath, isStableVersion, isTeamRole, isTeamScopeType, listTmuxSessions, loadConfig, loadOrCreateRelayIdentity, loadServerConfig, looksLikeAssetRequest, managedPaths, mcpConfigPathFor, migrateServiceToLauncher, normalizeAutomationAction, normalizeAutomationInput, normalizeAutomationTrigger, normalizeCloudControlPlaneOrigin, normalizeCommandCenterLabel, normalizeDeviceName, normalizeDeviceScopes, normalizeOrigin, normalizePeerBaseUrl, normalizeProviderAvailability, normalizeRelayAppUrl, normalizeRelease, normalizeSessionDefaults, openCloudAuthorizationStore, openCommandCenterStore, openControlStore, openDeviceStore, openExtensionManager, openPeerStore, openPolicyStore, openPushStore, openRelayAccountStore, openRelayRouteStore, openSessionAutomationStore, openSessionStore, openTeamStore, ownerFromProductContext, parseAllowedOrigins, parseAuthStatus, parseClaudeVersion, parseCloudAuthorizationKeyset, parseCloudAuthorizationSnapshot, parseCloudHostHeartbeat, parseCodexOscNotifications, parseCodexVersion, parseLegacyClaudeArgs, parseMarketplaceIndex, parseNpmLatest, parseProviderOptions, parseRelayRpcRequest, parseReleaseNotes, parseSignedCloudAuthorizationSnapshot, parseUsage, pathForGate, persistAccessToken, privacySafeAuditMetadata, productContextFromOwner, projectAgentRuntimeRecords, projectNodeRecord, providerPreflightWarning, publicAdapterDescriptor, readActiveVersion, readCloudHostConfig, readCloudHostCredentialFile, readPreviousVersion, readRelayHostConfig, readServiceRecord, registerStatic, relativeWhen, relayAccountCredentialHash, relayAccountCredentialLookup, relayConnectUrl, relayCredentialHash, relayHostConfigPath, relayIdentityFingerprint, relayRpcResponse, removeCloudHostConfig, removeRelayHostConfig, renderLaunchdPlist, renderManagedLauncher, renderSystemdUnit, replaceCloudHostAuthorizationKeyset, requestPeerJson, resetCodexThreadResolutionCoordinatorForTests, resolveAccessToken, resolveCloudDeviceEnrollmentConfig, resolveCloudHostConfig, resolveCodexExecutable, resolveDataDir, resolveInstallRoot, resolveRelayHostConfig, resolveVapidKeys, restartService, runClaudePreflight, runProviderPreflight, safeProcessErrorSummary, searchMarketplace, stableReleases, startBlindRelay, startServer, teamRolePermissions, tmuxSessionName, validateAdapterManifest, validateAdapterOptionSchema, validateRelayIdentity, verifyPeerConnection, verifyRelayHandshakeHello, verifySignedCloudAuthorizationKeyset, verifySignedCloudAuthorizationSnapshot, writeCloudHostConfig, writeManagedLauncher, writeRelayHostConfig };
+export { ADAPTER_CONTRACT_VERSION, API_PATH_DENYLIST, type AdapterCapabilityName, AdapterManifestError, type AdapterManifestV1, type AdapterPackageManifestV1, type AdapterRuntimeV1, type AdapterStateAuthority, type AgentActivity, type AgentProvider, type AgentRecord, type AgentRuntimeAuthState, type AgentRuntimeRecord, type AttachSpawnOptions, type AttentionItem, type AttentionKind, type AttentionState, type AuditActorType, type AuditRecord, type AuditResult, type AuthCheckResult, AuthGate, type AuthGateOptions, type AuthorizationDecision, type Authorizer, type AutomationAction, type AutomationDefinition, type AutomationRun, type AutomationTrigger, type Bar, CHECK_CACHE_MS, CLASSIFIER_TESTED_UP_TO, CLAUDE_LATEST_CACHE_MS, CLAUDE_VERSION_CACHE_MS, CLAUDE_VERSION_TIMEOUT_MS, CODEX_CLASSIFIER_TESTED_UP_TO, CODEX_EXECUTABLE_PROBE_TIMEOUT_MS, CODEX_OSC_MAX_CARRY, CONTROL_IDEMPOTENCY_TTL_MS, type CaptureOptions, type ChangelogEntry, type ClaudeAuthDeps, ClaudeAuthService, type ClaudeAuthStatus, type ClaudeAvailability, type ClaudeLatestDeps, ClaudeLatestService, type ClaudeMetadataRunner, ClaudeMetadataService, type ClaudeModelCatalogItem, type ClaudeSessionOptions, type ClaudeVersionProbe, type CodexAccount, CodexAppServerClient, type CodexAppServerClientOptions, type CodexDeviceLogin, type CodexExecutableDeps, type CodexExecutableProbe, type CodexExecutableResolution, type CodexInstallProvenance, CodexLatestService, type CodexLoginCompletion, type CodexLoginStatus, type CodexMetadataDiagnostics, type CodexMetadataRpc, CodexMetadataService, type CodexMetadataServiceOptions, type CodexModel, type CodexOscParser, type CodexProfileClientLifecycle, type CodexSessionOptions, type CodexSpawnLease, type CodexThreadInventoryEntry, type CodexThreadPersistence, CodexThreadResolver, type CodexThreadResolverOptions, type CodexUsage, type CodexVersionInfo, CommandCenterRevisionConflictError, type CommandCenterStore, type CommandCenterStoreMode, type CommandEvent, type CommandLayoutEnvelope, type ControlStore, type ControlStoreMode, type CreateAutomationInput, type CreateClaudeProviderOptions, type CreateCodexProfileClientLifecycleOptions, type CreateCodexProviderOptions, type CreateInstalledAdapterProviderOptions, type CreatePeerInput, type CreatePluginRuntimeOptions, type CreatePushDispatcherDeps, type CreateServerDeps, type CreateServerResult, type CreateSessionAutomationInput, type CreateSessionAutomationRunInput, type CreateWebPushSendOptions, type CreateWorktreeInput, type CreateWorktreeResult, type CreateWorktreeServiceOptions, type DeviceEnrollment, type DeviceInfo, type DeviceScope, type DeviceStore, type DirEntry, type DirListing, type DirSearchResult, type EnterprisePolicy, type EnterprisePolicyAction, type EnterprisePolicyContext, type EnterprisePolicyDecision, EnterprisePolicyRevisionConflictError, type EnterprisePolicyUpdate, ExtensionError, type ExtensionKind, type ExtensionManager, type ExtensionManifestV1, type ExtensionPolicyMode, type ExtensionTrust, type ExtensionVersionRecord, FETCH_TIMEOUT_MS, type FetchLatest, type FetchManifest, type FetchReleases, FsError, type FsErrorCode, FsService, type FsServiceOptions, type GitHubRelease, type HooksSettingsDocument, type HostRecord, INPUT_LEASE_TTL_MS, type IPty, type IdempotencyRecord, type InputLease, type InputLeaseAcquireResult, type InputLeaseActorType, InputLeaseCoordinator, type InputLeaseCoordinatorOptions, type InputLeaseEvent, type InputLeasePrincipal, type InstallExtensionInput, type InstallServiceContext, type InstallServiceResult, type InstallationKind, type InstalledExtension, type LaunchIntent, type ManagedInstallOptions, type ManagedInstallResult, type ManagedInstallStatus, type ManagedPaths, type MarketplaceEntry, type McpConfigDocument, type ModelWeekBar, type NodeAlias, type NodeRecord, OPENAI_CODE_SIGNING_TEAM_ID, type OpenApiBuildOptions, type OpenCommandCenterStoreOptions, type OpenControlStoreOptions, type OpenDeviceStoreOptions, type OpenExtensionManagerOptions, type OpenPeerStoreOptions, type OpenPolicyStoreOptions, type OpenPushStoreOptions, type OpenSessionAutomationStoreOptions, type OpenSessionStoreOptions, type OpenTeamStoreOptions, type OriginCheckOptions, type OwnerRef, PAIRING_TTL_MS, PRESENCE_HEARTBEAT_MS, PRESENCE_TTL_MS, PWA_BOOT_WATCHDOG_SHA256, PWA_CONTENT_SECURITY_POLICY, type PairingTicket, type PaneStatus, type PeerAction, type PeerConnection, type PeerJsonResponse, type PeerRecord, PeerRequestError, PeerRevisionConflictError, type PeerStatus, type PeerStore, type PeerStoreMode, type PluginAuditEvent, type PluginManifestV1, type PluginPermission, type PluginRunInput, type PluginRunResult, type PluginRuntime, PluginRuntimeError, type PolicyStore, type PolicyStoreMode, PresenceCoordinator, type PresenceCoordinatorOptions, type PresenceEvent, type PresenceHeartbeatInput, type PresenceMode, type PresenceRecord, type PresenceTarget, type ProcessLifecycleHandle, type ProcessLifecycleOptions, type ProcessLifecycleTarget, type ProcessSpec, type ProductContext, type ProviderAdapterV1, type ProviderAvailability, ProviderError, type ProviderId, ProviderOptionsError, type ProviderProcessContext, ProviderRegistry, type ProviderRuntimeSignal, type ProviderRuntimeSignalParser, type ProviderSessionOptions, type PtySpawn, type PushDispatcher, type PushEvent, type PushEventKind, type PushPayload, type PushRecipient, type PushSendFn, type PushStore, type PushSubscriptionRecord, RUNNING_BUILD, RUNNING_VERSION, type RateLimitDecision, RateLimiter, type RateLimiterOptions, type RegisterStaticOptions, type ReleaseRecord, type RenderLaunchdOptions, type RenderSystemdOptions, type ResolveAccessTokenOptions, type ResolveCodexExecutableOptions, type ResolveCodexThreadOptions, type ResolveVapidKeysOptions, type ReturnTypeOfDescriptors, type RunClaudeVersion, type RunUsage, SEARCH_MAX_DEPTH, SEARCH_MAX_DIRS, SEARCH_MAX_RESULTS, SERVER_PACKAGE, SHELL_PATH_ALLOWLIST, type ServerConfig, type ServerRuntimeConfig, type ServiceRecord, type SessionAutomationDefinition, SessionAutomationRevisionConflictError, type SessionAutomationRun, type SessionAutomationRunStatus, type SessionAutomationStore, type SessionAutomationStoreMode, type SessionAutomationTrigger, type SessionDefaults, SessionDefaultsConflictError, type SessionFileDirection, type SessionFileKind, type SessionFileStorage, type SessionPlacement, type SessionStore, type StoreMode, type StoredExternalSession, type StoredSession, type StoredSessionDefaults, type StoredSessionFile, type StoredStatus, type TeamAuthorizationDecision, type TeamAuthorizationResource, type TeamMember, type TeamMemberKind, type TeamMemberStatus, type TeamPermission, type TeamPrincipalBinding, type TeamPrincipalType, type TeamRecord, TeamRevisionConflictError, type TeamRole, type TeamRoleBinding, type TeamScopeType, type TeamStore, type TeamStoreMode, TerminalManager, type TerminalManagerDeps, type TerminalMeta, TerminalProcess, type TerminalProcessOptions, type TerminalSub, USAGE_CACHE_MS, USAGE_TIMEOUT_MS, type UpdateAction, type UpdateAutomationInput, type UpdatePeerInput, type UpdatePolicyMode, type UpdateSessionAutomationInput, type UpdateState, type UpdateStatus, Updater, type UpdaterDeps, type UpdaterFs, type UsageInfo, UsageService, type UsageServiceDeps, type VapidKeys, type VerifiedPeerIdentity, type VersionInfo, WS_TICKET_TTL_MS, type WorkspaceKind, type WorkspaceRecord, WorktreeError, type WorktreeErrorCode, type WorktreeRecord, type WorktreeService, type WsTicketContext, WsTicketStore, type WsTicketStoreOptions, adapterCapabilityNames, agentRuntimeId, assertConfigAllowsStart, buildCodexArgs, buildHooksSettingsDocument, buildMcpConfigDocument, buildOpenApiDocument, buildPushPayload, buildServicePath, capturePane, classifierVersionWarning, classifyCodexPane, classifyPaneStatus, claudePreflightWarning, codexClassifierVersionWarning, compareVersions, computeBuildDrift, computeInstallDrift, createClaudeAuthService, createClaudeLatestService, createClaudeMetadataRunner, createClaudeProvider, createClaudeVersionProbe, createCodexOscParser, createCodexProfileClientLifecycle, createCodexProvider, createCodexThreadInventory, createCodexThreadPersistence, createInstalledAdapterProvider, createPluginRuntime, createPushDispatcher, createServer, createTeamAuthorizer, createUpdater, createUsageRunner, createUsageService, createWebPushSend, createWorktreeService, currentAgentIdForSession, defaultFetchManifest, defaultFetchReleases, defaultProbeCodexExecutable, defaultRunClaudeVersion, defaultUpdaterFs, defineAdapterManifest, detectTerminalSupport, enableService, ensureDataDir, evaluateEnterprisePolicy, extractBearerToken, extractLoginUrl, generateAccessToken, hasEncodedSep, hookAuthFileContent, hookAuthPathFor, hooksSettingsPathFor, inspectExtensionPackage, installManagedRelease, installProcessLifecycle, installService, isCodexProfileClientLifecycle, isLoopbackAddress, isNewerMajorMinor, isOriginAllowed, isPublicForRequest, isPublicPath, isShellPath, isStableVersion, isTeamRole, isTeamScopeType, listTmuxSessions, loadConfig, loadServerConfig, looksLikeAssetRequest, managedPaths, mcpConfigPathFor, migrateServiceToLauncher, normalizeAutomationAction, normalizeAutomationInput, normalizeAutomationTrigger, normalizeCommandCenterLabel, normalizeDeviceName, normalizeDeviceScopes, normalizeOrigin, normalizePeerBaseUrl, normalizeProviderAvailability, normalizeRelease, normalizeSessionDefaults, openCommandCenterStore, openControlStore, openDeviceStore, openExtensionManager, openPeerStore, openPolicyStore, openPushStore, openSessionAutomationStore, openSessionStore, openTeamStore, ownerFromProductContext, parseAllowedOrigins, parseAuthStatus, parseClaudeVersion, parseCodexOscNotifications, parseCodexVersion, parseLegacyClaudeArgs, parseMarketplaceIndex, parseNpmLatest, parseProviderOptions, parseReleaseNotes, parseUsage, pathForGate, persistAccessToken, privacySafeAuditMetadata, productContextFromOwner, projectAgentRuntimeRecords, projectNodeRecord, providerPreflightWarning, publicAdapterDescriptor, readActiveVersion, readPreviousVersion, readServiceRecord, registerStatic, relativeWhen, renderLaunchdPlist, renderManagedLauncher, renderSystemdUnit, requestPeerJson, resetCodexThreadResolutionCoordinatorForTests, resolveAccessToken, resolveCodexExecutable, resolveDataDir, resolveInstallRoot, resolveVapidKeys, restartService, runClaudePreflight, runProviderPreflight, safeProcessErrorSummary, searchMarketplace, stableReleases, startServer, teamRolePermissions, tmuxSessionName, validateAdapterManifest, validateAdapterOptionSchema, verifyPeerConnection, writeManagedLauncher };