@robota-sdk/agent-cli 3.0.0-beta.10 → 3.0.0-beta.101

package/dist/node/index.d.ts

@@ -1,49 +1,790 @@
-export { IQueryOptions, ISessionOptions, ISessionRecord, Session, SessionStore, TPermissionDecision, TPermissionHandler, TPermissionMode, TRUST_TO_MODE, TToolResult, TTrustLevel, query } from '@robota-sdk/agent-sdk';
-export { TToolArgs } from '@robota-sdk/agent-core';
-
-/**
- * CLI-specific types for terminal I/O abstraction.
- */
-/**
- * Spinner handle returned by ITerminalOutput.spinner()
- */
-interface ISpinner {
-    stop(): void;
-    update(message: string): void;
-}
-/**
- * Terminal output abstraction — injected into all components that need I/O
- */
-interface ITerminalOutput {
-    write(text: string): void;
-    writeLine(text: string): void;
-    writeMarkdown(md: string): void;
-    writeError(text: string): void;
-    prompt(question: string): Promise<string>;
-    /** Arrow-key selector. Returns the index of the chosen option. */
-    select(options: string[], initialIndex?: number): Promise<number>;
-    spinner(message: string): ISpinner;
-}
-
-/**
- * CLI entry point — parses arguments, loads config/context, and starts the
- * Ink TUI or runs in print mode.
- *
- * CLI flags:
- *   robota                         Interactive TUI mode
- *   robota "prompt"                TUI with initial prompt (future)
- *   robota -p "prompt"             Print mode (one-shot, exit after response)
- *   robota -c                      Continue last session
- *   robota -r <id>                 Resume session by ID
- *   robota --model <model>         Model override
- *   robota --permission-mode <m>   plan|default|acceptEdits|bypassPermissions
- *   robota --max-turns <n>         Limit agentic turns
- *   robota --version               Print package version and exit
- */
-/**
- * Main CLI orchestration function.
- * Called from bin.ts as the top-level entry.
- */
-declare function startCli(): Promise<void>;
-
-export { type ISpinner, type ITerminalOutput, startCli };
+import { t as IProductCliArtifact } from "./artifact-DrPhOb_v.js";
+import { _ as IEgressDeps, a as IHostedAdmissionOptions, c as IHostedRuntimeConfig, d as IHostedRuntimeInvocation, f as IHostedRuntimeUsage, g as ISandboxClient, h as THostedRuntimeExecutorFactory, i as IHostedAdmission, l as IHostedRuntimeControl, m as THostedBackendRole, n as createProductCliHost, o as IHostedAdmissionProof, p as IHostedSnapshot, r as IStartCliOptions, s as IHostedIdentity, t as IProductCliHost, u as IHostedRuntimeExecutor } from "./product-host-Cle0fPIc.js";
+import { IncomingMessage, Server, ServerResponse } from "node:http";
+import { PassThrough, Readable, Writable } from "node:stream";
+//#region src/cli.d.ts
+/** Full CLI entry: supplies its terminal presentation to the shared serve/bootstrap path. */
+declare function startCli(initialOptions?: IStartCliOptions): Promise<void>;
+//#endregion
+//#region src/cli-entry.d.ts
+/** Launch a host entry with binary diagnostics, crash policy, startup errors and worker dispatch. */
+declare function startCliEntry(options?: IStartCliOptions): Promise<void>;
+//#endregion
+//#region src/hosted/hosted-runtime-controller.d.ts
+interface IHostedRuntimeControllerOptions extends IHostedAdmissionOptions {
+  /** Own partial allocations until return; rejection must release them or report unresolved cleanup. */
+  readonly createExecutor: (admission: IHostedAdmission, signal: AbortSignal) => Promise<IHostedRuntimeExecutor>;
+}
+type THostedRuntimeState = 'idle' | 'admitting' | 'running' | 'stopping' | 'stopped' | 'failed';
+declare class HostedRuntimeController {
+  private readonly options;
+  private state;
+  private executor?;
+  private provisioning?;
+  private abort?;
+  private stopping?;
+  private limits?;
+  private usage;
+  constructor(options: IHostedRuntimeControllerOptions);
+  status(): {
+    state: THostedRuntimeState;
+    usage: IHostedRuntimeUsage;
+  };
+  private observe;
+  run(): Promise<void>;
+  /** Restart constructs a fresh controller and revalidates current identity, epoch and snapshot. */
+  restart(options: IHostedRuntimeControllerOptions): Promise<HostedRuntimeController>;
+  stop(reason: string): Promise<void>;
+  private cleanup;
+  private cleanupExecutor;
+  private boundedCleanup;
+}
+//#endregion
+//#region src/hosted/hosted-runtime-admission.d.ts
+/** Fixed typed tuple defines the UTF-8 signature domain; object order is not part of the protocol. */
+declare function hostedAdmissionBytes(proof: Omit<IHostedAdmissionProof, 'signature'>): Buffer;
+//#endregion
+//#region ../agent-organization/dist/node/index.d.ts
+//#endregion
+//#region src/types.d.ts
+interface IOrganizationUnits {
+  readonly tokens: number;
+  readonly timeMs: number;
+  readonly costMicros: number;
+}
+interface IOrganizationBudget extends IOrganizationUnits {
+  readonly concurrency: number;
+}
+//#endregion
+//#region ../agent-organization-host/dist/node/index.d.ts
+//#region src/types.d.ts
+type TOrganizationJson = null | boolean | number | string | TOrganizationJson[] | {
+  [key: string]: TOrganizationJson;
+};
+interface IOrganizationScope {
+  readonly resource: string;
+  readonly operations: readonly string[];
+}
+/** Signed by the external workload issuer; its private key is never accepted by this package. */
+interface IOrganizationGrant {
+  readonly version: 1;
+  readonly id: string;
+  readonly tenant: string;
+  readonly task: string;
+  readonly actor: string;
+  readonly role: string;
+  readonly audience: string;
+  readonly parent: string | null;
+  readonly epoch: number;
+  readonly notBefore: number;
+  readonly expiresAt: number;
+  readonly publicKey: string;
+  readonly scopes: readonly IOrganizationScope[];
+  readonly budget: IOrganizationBudget;
+}
+interface IOrganizationOperation {
+  readonly idempotencyKey: string;
+  readonly resource: string;
+  readonly operation: string;
+  readonly environment: string;
+  readonly parameters: TOrganizationJson;
+}
+/** Proof of possession by the worker key named in the issued workload grant. */
+interface IOrganizationRequest {
+  readonly version: 1;
+  readonly grantId: string;
+  readonly tenant: string;
+  readonly task: string;
+  readonly actor: string;
+  readonly audience: string;
+  readonly epoch: number;
+  readonly nonce: string;
+  readonly notBefore: number;
+  readonly expiresAt: number;
+  readonly operation: IOrganizationOperation;
+}
+/** Minted through a separate operator channel, not a worker/model/ordinary tool approval. */
+interface IOrganizationApproval {
+  readonly version: 1;
+  readonly id: string;
+  readonly tenant: string;
+  readonly task: string;
+  readonly actor: string;
+  readonly audience: string;
+  readonly epoch: number;
+  readonly environment: string;
+  readonly operationDigest: string;
+  readonly notBefore: number;
+  readonly expiresAt: number;
+}
+interface IOrganizationEnvelope<T> {
+  readonly claims: T;
+  readonly signature: string;
+}
+interface IOrganizationCall {
+  readonly request: IOrganizationEnvelope<IOrganizationRequest>;
+  readonly approval: IOrganizationEnvelope<IOrganizationApproval> | null;
+}
+interface IOrganizationReceipt {
+  readonly value: TOrganizationJson;
+  /** Trusted instrumentation; the action owner must bound effects to its reservation. */
+  readonly usage: IOrganizationUnits;
+}
+interface IOrganizationAction {
+  readonly resource: string;
+  readonly operation: string;
+  readonly roles: readonly string[];
+  readonly requiresApproval: boolean;
+  /** Trusted server-side validation and upper bound; never accept a worker-selected quota. */
+  reserve(operation: IOrganizationOperation): IOrganizationUnits;
+  execute(operation: IOrganizationOperation, context: {
+    readonly signal: AbortSignal;
+    readonly proof: IOrganizationEnvelope<IOrganizationRequest>;
+    readonly operationDigest: string;
+    readonly identity: IOrganizationGrant;
+    readonly reservation: IOrganizationUnits;
+  }): Promise<IOrganizationReceipt>;
+}
+//#endregion
+//#region src/audit.d.ts
+type TOrganizationAuditPhase = 'dispatch' | 'complete' | 'refused' | 'unknown';
+interface IOrganizationAuditEvent {
+  readonly phase: TOrganizationAuditPhase;
+  readonly operationDigest: string;
+  readonly tenantDigest: string;
+  readonly taskDigest: string;
+  readonly actorDigest: string;
+  readonly grantDigest: string;
+  readonly epoch: number;
+}
+interface IOrganizationAuditHead {
+  readonly version: 1;
+  readonly stream: string;
+  readonly sequence: number;
+  readonly hash: string;
+}
+interface IOrganizationAuditEntry {
+  readonly stream: string;
+  readonly sequence: number;
+  readonly previous: string;
+  readonly event: IOrganizationAuditEvent;
+  readonly hash: string;
+}
+interface IOrganizationAuditPage {
+  readonly entries: readonly IOrganizationAuditEntry[];
+  readonly head: IOrganizationEnvelope<IOrganizationAuditHead>;
+}
+/** Owner-installed external storage; read is consistent and append is an atomic expected-head CAS. */
+interface IOrganizationAuditSink {
+  read(after: IOrganizationAuditHead, signal: AbortSignal): Promise<IOrganizationAuditPage>;
+  append(expected: IOrganizationAuditHead, event: IOrganizationAuditEvent, signal: AbortSignal): Promise<{
+    readonly entry: IOrganizationAuditEntry;
+    readonly head: IOrganizationEnvelope<IOrganizationAuditHead>;
+  }>;
+}
+/** Independently retained checkpoint: consistent reads, monotonic CAS, no reset/delete worker capability. */
+interface IOrganizationAuditAnchor {
+  load(signal: AbortSignal): Promise<IOrganizationEnvelope<IOrganizationAuditHead>>;
+  compareAndSet(expected: IOrganizationAuditHead, next: IOrganizationEnvelope<IOrganizationAuditHead>, signal: AbortSignal): Promise<boolean>;
+}
+interface IOrganizationAuditWriter {
+  record(event: IOrganizationAuditEvent, signal?: AbortSignal): Promise<void>;
+}
+interface IOrganizationAuditOptions {
+  readonly stream: string;
+  readonly publicKey: string;
+  readonly sink: IOrganizationAuditSink;
+  readonly anchor: IOrganizationAuditAnchor;
+  readonly timeoutMs?: number;
+}
+/** Dispatch can proceed only after an exact event and its independently retained checkpoint are confirmed. */
+declare class OrganizationAudit implements IOrganizationAuditWriter {
+  private readonly stream;
+  private readonly key;
+  private readonly sink;
+  private readonly anchor;
+  private readonly timeout;
+  constructor(options: IOrganizationAuditOptions);
+  private bounded;
+  record(value: IOrganizationAuditEvent, signal?: AbortSignal): Promise<void>;
+  /** Owner-only recovery of a valid already-written tail. Does not reset history, refund or retry any effect. */
+  recover(signal?: AbortSignal): Promise<IOrganizationAuditHead>;
+  /** Readiness verifies retained evidence without adopting an unconfirmed tail or resetting history. */
+  verify(signal?: AbortSignal): Promise<IOrganizationAuditHead>;
+}
+//#endregion
+//#region src/git-asset.d.ts
+interface IOrganizationGitIntent {
+  readonly asset: string;
+  readonly digest: string;
+  readonly expectedRevision: number;
+  readonly fence: number;
+  readonly expectedOid: string;
+  readonly candidateOid: string;
+  readonly publishedOid: string;
+}
+interface IOrganizationGitAssetOptions {
+  /** Owner-provisioned private bare repository; workers must not mount or write this directory. */
+  readonly path: string;
+  readonly ref: string;
+  /** Absolute owner-pinned executable. No worker parameters reach the command or environment. */
+  readonly gitPath: string;
+  /** Aggregate subprocess deadline per phase, not a physical worker/OS containment guarantee. */
+  readonly phaseTimeoutMs?: number;
+}
+declare function gitParameters(value: unknown): {
+  expectedRevision: number;
+  fence: number;
+  expectedOid: string;
+  candidateOid: string;
+};
+/** Trusted asset-owner plumbing only. This class never clones/fetches, checks out, merges or runs user code. */
+declare class OrganizationGitAsset {
+  readonly identity: string;
+  readonly phaseTimeoutMs: number;
+  private readonly path;
+  private readonly ino;
+  private readonly dev;
+  private readonly ref;
+  private readonly gitPath;
+  constructor(options: IOrganizationGitAssetOptions);
+  private verify;
+  private phase;
+  private tip;
+  prepare(digest: string, parameters: ReturnType<typeof gitParameters>): IOrganizationGitIntent;
+  publish(intent: IOrganizationGitIntent): void;
+  wasPublished(intent: IOrganizationGitIntent): boolean;
+}
+//#endregion
+//#region src/ledger-anchor.d.ts
+interface IOrganizationLedgerHead {
+  readonly version: 1;
+  readonly ledger: string;
+  readonly revision: number;
+  readonly digest: string;
+}
+/** Trusted owner capability outside the mutable policy store and every worker checkpoint. */
+interface IOrganizationLedgerAnchor {
+  readonly ledger: string;
+  /** Consistent authenticated read of independently retained authority state. */
+  read(): IOrganizationLedgerHead | undefined;
+  /** Atomic, durable CAS; confirmation must be readable before this call returns. */
+  compareAndSet(expected: IOrganizationLedgerHead | undefined, next: IOrganizationLedgerHead): void;
+}
+//#endregion
+//#region src/shared-state.d.ts
+interface IOrganizationStateLease {
+  readonly revision: number;
+  readonly fence: number;
+  readonly expiresAt: number;
+}
+interface IOrganizationStateValue {
+  readonly revision: number;
+  readonly value: TOrganizationJson;
+}
+//#endregion
+//#region src/no-effect.d.ts
+declare const NO_EFFECT_REASONS: readonly ["budget-exhausted", "not-authorized", "invalid-schema", "expired", "revoked", "operation-conflict", "operation-pending"];
+type TOrganizationNoEffectReason = (typeof NO_EFFECT_REASONS)[number];
+//#endregion
+//#region src/sqlite-ledger.d.ts
+interface IOrganizationLedgerOptions {
+  readonly path: string;
+  /** Explicit first-time bootstrap. Reopen/missing/corrupt policy never initializes empty authority. */
+  readonly create?: boolean;
+  /** Owner-controlled v1/v2-to-v3 schema upgrade; close existing brokers first. Preserves all authority/accounting. */
+  readonly upgrade?: boolean;
+  readonly audience: string;
+  readonly workloadPublicKey: string;
+  readonly approvalPublicKey: string;
+  readonly now?: () => number;
+  readonly maxGrantTtlMs?: number;
+  readonly maxRequestTtlMs?: number;
+  /** Independently retained owner checkpoint; hosted organization composition requires it. */
+  readonly anchor?: IOrganizationLedgerAnchor;
+}
+type TOrganizationReservation = {
+  readonly kind: 'reserved';
+  readonly digest: string;
+  readonly grant: IOrganizationGrant;
+  readonly reservation: IOrganizationUnits;
+} | {
+  readonly kind: 'complete';
+  readonly digest: string;
+  readonly receipt: IOrganizationReceipt;
+} | {
+  readonly kind: 'refused';
+  readonly digest: string;
+  readonly reason: TOrganizationNoEffectReason;
+};
+/** Durable policy/budgets live in the operator's domain, never in a worker checkpoint. */
+declare class OrganizationLedger {
+  private readonly db;
+  private readonly state;
+  private readonly path;
+  private readonly inode;
+  private closed;
+  private readonly now;
+  private readonly workloadKey;
+  private readonly approvalKey;
+  private readonly integrity?;
+  readonly audience: string;
+  readonly maxGrantTtlMs: number;
+  readonly maxRequestTtlMs: number;
+  constructor(options: IOrganizationLedgerOptions);
+  private initializeGit;
+  private verifyFile;
+  private transaction;
+  private metadata;
+  private newBudget;
+  /** Trusted administration only; these methods are not present on the HTTP broker ingress. */
+  createGlobalBudget(limits: IOrganizationBudget): void;
+  createTenant(tenant: string, limits: IOrganizationBudget): void;
+  createTask(tenant: string, task: string, limits: IOrganizationBudget): void;
+  registerGrant(envelope: IOrganizationEnvelope<IOrganizationGrant>): void;
+  private chain;
+  currentGrant(grantId: string): IOrganizationGrant;
+  /** Owner inventory inspection, including expired/revoked grants; never grants execution authority. */
+  registeredGrant(grantId: string): IOrganizationGrant;
+  /** Trusted supervisory accounting for an owner-installed single-purpose workload grant. */
+  grantOperationCount(grantId: string): number;
+  /** Owner composition can require integrity rather than silently accepting legacy SDK mode. */
+  verifyAnchoredAuthority(): void;
+  private authenticateInside;
+  authenticate(envelope: IOrganizationEnvelope<IOrganizationRequest>): {
+    request: IOrganizationRequest;
+    grant: IOrganizationGrant;
+  };
+  /** Owner administration only; state creation cannot overwrite an existing resource or its fence. */
+  createStateResource(tenant: string, task: string, resource: string, value: TOrganizationJson): void;
+  private activeOperation;
+  private stateOperation;
+  leaseState(envelope: IOrganizationEnvelope<IOrganizationRequest>): IOrganizationStateLease;
+  readState(envelope: IOrganizationEnvelope<IOrganizationRequest>): IOrganizationStateValue;
+  writeState(envelope: IOrganizationEnvelope<IOrganizationRequest>): IOrganizationStateValue;
+  /** Trusted Git owner only. Persist an unreachable receipt intent before any target ref can change. */
+  prepareGitPublication(envelope: IOrganizationEnvelope<IOrganizationRequest>, asset: OrganizationGitAsset): IOrganizationGitIntent;
+  private gitIntent;
+  /** SQL locking serializes policy/fence checks with dispatch. External Git and SQL are NOT an atomic store. */
+  commitGitPublication(envelope: IOrganizationEnvelope<IOrganizationRequest>, asset: OrganizationGitAsset): IOrganizationStateValue;
+  /** Owner-only proof of a past branch publication. No absent effect is refunded, no workload authority is restored. */
+  reconcileGitPublication(value: IOrganizationRequest, asset: OrganizationGitAsset): IOrganizationReceipt;
+  /** Trusted asset-owner reconciliation only. The atomic state outcome proves this specific effect; no worker route exposes it. */
+  reconcileStateOperation(value: IOrganizationRequest): IOrganizationReceipt;
+  private liveBudget;
+  private storedBudget;
+  private operation;
+  reserve(envelope: IOrganizationEnvelope<IOrganizationRequest>, reservation: IOrganizationUnits, approval: IOrganizationEnvelope<IOrganizationApproval> | null, requiresApproval: boolean): TOrganizationReservation;
+  private key;
+  /** A crash/unknown effect keeps every reservation. No request route can refund or retry it. */
+  markUnknown(request: IOrganizationRequest): void;
+  settle(request: IOrganizationRequest, receipt: IOrganizationReceipt): void;
+  /** External asset owner only: confirm an exact unknown effect, charge its retained bound, never restore authority. */
+  reconcileExternalOperation(value: IOrganizationRequest, confirmedValue: TOrganizationJson): IOrganizationReceipt;
+  /** Trusted asset owner only: a proved no-effect outcome, never a worker-provided refund assertion. */
+  confirmNoEffect(request: IOrganizationRequest, reason: TOrganizationNoEffectReason, usage: IOrganizationUnits): void;
+  private recordReceipt;
+  revokeGrant(grantId: string): void;
+  stopTask(tenant: string, task: string): void;
+  stopTenant(tenant: string): void;
+  emergencyStop(): void;
+  advanceEpoch(epoch: number): void;
+  budgetState(kind: 'global' | 'tenant' | 'task' | 'grant', ...identity: string[]): {
+    limits: IOrganizationBudget;
+    spent: IOrganizationUnits;
+    held: IOrganizationUnits;
+    active: number;
+    stopped: boolean;
+  };
+  close(): void;
+}
+//#endregion
+//#region src/hosted/hosted-organization-control.d.ts
+interface IHostedOrganizationWorker {
+  readonly resource: string;
+  readonly grantId: string;
+  readonly identity: IHostedIdentity;
+  readonly epoch: number;
+}
+/** Owner provider inventory must survive broker restart and exclude resources outside its custody. */
+interface IHostedOrganizationInventory {
+  list(signal: AbortSignal): Promise<readonly IHostedOrganizationWorker[]>;
+  /** Revalidate owner metadata before termination; return only after the provider acknowledges cleanup. */
+  terminate(worker: IHostedOrganizationWorker, signal: AbortSignal): Promise<void>;
+}
+interface IHostedOrganizationIncidentOwners {
+  readonly detection: string;
+  readonly containment: string;
+  readonly assessment: string;
+  readonly recovery: string;
+  /** Owner-installed incident channel; metadata only, no provider errors, credentials or request bodies. */
+  report(event: {
+    readonly kind: 'authority-unavailable' | 'cleanup-unresolved' | 'unknown-effect';
+    readonly resources: readonly string[];
+    readonly operationDigest?: string;
+  }): Promise<void>;
+}
+interface IHostedOrganizationControlOptions {
+  readonly ledger: OrganizationLedger;
+  readonly audit: OrganizationAudit;
+  readonly actions: readonly IOrganizationAction[];
+  readonly inventory: IHostedOrganizationInventory;
+  readonly incidentOwners: IHostedOrganizationIncidentOwners;
+  readonly policyIntervalMs?: number;
+  readonly providerTimeoutMs?: number;
+}
+/** Owner-side company composition. No administrator operations are exposed to workers or model tools. */
+declare class HostedOrganizationControl {
+  private readonly ledger;
+  private readonly audit;
+  private readonly broker;
+  private readonly inventory;
+  private readonly incidents;
+  private readonly timeout;
+  private readonly timer;
+  private readonly calls;
+  private sweepPending?;
+  private closed;
+  private quarantined;
+  constructor(options: IHostedOrganizationControlOptions);
+  private identity;
+  /** Admission uses current policy and retained audit evidence, never checkpoint authority. */
+  admit(worker: IHostedOrganizationWorker, signal?: AbortSignal): Promise<IOrganizationGrant>;
+  apply(call: IOrganizationCall, signal?: AbortSignal, onWithdrawal?: () => void): Promise<IOrganizationReceipt>;
+  /** Owner commands persist policy withdrawal before terminating every affected provider worker. */
+  private afterWithdrawal;
+  stopGrant(grantId: string): Promise<void>;
+  stopTask(tenant: string, task: string): Promise<void>;
+  stopTenant(tenant: string): Promise<void>;
+  emergencyStop(): Promise<void>;
+  /** Owner recovery channel only. A worker cannot supply the asset-owner confirmation capability. */
+  reconcileExternalOperation(request: IOrganizationRequest, assetOwner: {
+    confirm(operationDigest: string, signal?: AbortSignal): Promise<TOrganizationJson>;
+  }, signal?: AbortSignal): Promise<IOrganizationReceipt>;
+  sweep(): Promise<void>;
+  private sweepOnce;
+  close(): Promise<void>;
+}
+//#endregion
+//#region src/hosted/e2b-organization-inventory.d.ts
+/** Provider-backed inventory, including paused workers. Its management capability stays outside every worker. */
+declare function createE2BOrganizationInventory(options: {
+  readonly apiKey: string;
+  readonly controlPlane: string;
+  readonly tenant: string;
+  readonly requestTimeoutMs?: number;
+}): IHostedOrganizationInventory;
+//#endregion
+//#region src/hosted/hosted-organization-payloads.d.ts
+/** Private owner content storage for model wire bytes; the bounded authority journal keeps only digests. */
+declare class HostedOrganizationPayloads {
+  private readonly directory;
+  private constructor();
+  static open(directory: string): Promise<HostedOrganizationPayloads>;
+  private path;
+  put(grantId: string, bytes: Uint8Array): Promise<string>;
+  private persist;
+  /** Owner outbox manifest. Digest addressing survives a broker crash without putting request claims in audit. */
+  recordOperation(request: IOrganizationRequest): Promise<void>;
+  operation(grantId: string, digest: string): Promise<IOrganizationRequest>;
+  get(grantId: string, digest: string): Promise<Buffer>;
+}
+//#endregion
+//#region src/hosted/hosted-organization-gateway.d.ts
+interface IHostedOrganizationBinding {
+  readonly config: IHostedRuntimeConfig;
+  readonly grantId: string;
+  readonly token: string;
+  readonly expiresAt: number;
+  /** External issuer capabilities installed by the owner, never supplied by an HTTP caller. */
+  signAdmission(role: THostedBackendRole, bytes: Uint8Array): string;
+  signRequest(bytes: Uint8Array): string;
+}
+/** Actual stock CLI admission and OpenAI-wire ingress over durable company effects. No owner routes. */
+declare function createHostedOrganizationGateway(options: {
+  readonly control: HostedOrganizationControl;
+  readonly ledger: OrganizationLedger;
+  readonly payloads: HostedOrganizationPayloads;
+  readonly bindings: readonly IHostedOrganizationBinding[];
+  readonly modelResource: string;
+}): (request: IncomingMessage, response: ServerResponse) => void;
+//#endregion
+//#region src/hosted/hosted-organization-model.d.ts
+interface IHostedOrganizationModelOptions {
+  readonly payloads: HostedOrganizationPayloads;
+  readonly endpoint: string;
+  readonly apiKey: string;
+  readonly model: string;
+  readonly roles: readonly string[];
+  readonly resource: string;
+  readonly reservation: IOrganizationUnits;
+  readonly maxInputBytes: number;
+  readonly maxOutputTokens: number;
+  readonly costMicrosPerToken: number;
+  /** Declare only an upstream contract actually supported by the owner-selected provider. */
+  readonly providerIdempotency: boolean;
+  /** Owner-selected pure input counter for the exact immutable provider request, including tools/media. */
+  countInputTokens(surface: 'responses' | 'chat-completions', request: Readonly<Record<string, unknown>>, signal: AbortSignal): Promise<number>;
+}
+/** Actual fixed-provider HTTP effect. No automatic retry; ambiguous outcomes retain the broker hold. */
+declare function createHostedOrganizationModelAction(options: IHostedOrganizationModelOptions): IOrganizationAction;
+//#endregion
+//#region src/hosted/hosted-organization-token-counter.d.ts
+/** Fixed owner counter transport. The owner encoder must preserve the provider's full input-token contract. */
+declare function createHostedOrganizationInputTokenCounter(options: {
+  readonly endpoint: string;
+  readonly apiKey: string;
+  /** Explicit provider mapping: Responses counting accepts input/model/tools, while Chat needs its own verified counter. */
+  encode(surface: 'responses' | 'chat-completions', request: Readonly<Record<string, unknown>>): unknown;
+}): IHostedOrganizationModelOptions['countInputTokens'];
+//#endregion
+//#region src/hosted/e2b-worker-process.d.ts
+interface IE2BWorkerProcessOptions {
+  readonly command: string;
+  readonly cwd: string;
+  readonly environment: Readonly<Record<string, string>>;
+  readonly timeoutMs: number;
+  readonly pty?: {
+    readonly cols: number;
+    readonly rows: number;
+  };
+  readonly onStdout: (data: string | Uint8Array) => void;
+  readonly onStderr: (data: string) => void;
+}
+interface IE2BWorkerProcess {
+  wait(): Promise<number>;
+  sendInput(data: string | Uint8Array): Promise<void>;
+  closeInput(): Promise<void>;
+  resize(cols: number, rows: number): Promise<void>;
+  disconnect(): Promise<void>;
+}
+//#endregion
+//#region src/hosted/e2b-task-worker.d.ts
+/** Control-plane-only inputs. Neither the SDK credential nor its client enters a worker environment. */
+interface IE2BTaskWorkerOptions {
+  readonly admission: IHostedAdmission;
+  readonly templateId: string;
+  readonly apiKey: string;
+  readonly signal: AbortSignal;
+  /** Only the admitted company broker host may be added to the default closed egress policy. */
+  readonly allowBrokerEgress?: boolean;
+}
+interface IE2BOwnedTaskWorker {
+  readonly client: ISandboxClient;
+  startProcess(options: IE2BWorkerProcessOptions): Promise<IE2BWorkerProcess>;
+  /** Withdraw access immediately, then delete the admitted task's provider resource. */
+  release(): Promise<void>;
+}
+/** Connect only the admitted resource after checking its operator-provisioned ownership and network posture. */
+declare function connectE2BTaskWorker(options: IE2BTaskWorkerOptions): Promise<IE2BOwnedTaskWorker>;
+//#endregion
+//#region src/hosted/hosted-worker-execution-config.d.ts
+/** Issued by the admitted broker, never inferred from a provider API key or a worker claim. */
+interface IHostedWorkerAccess {
+  readonly version: 1;
+  readonly identity: IHostedIdentity;
+  readonly worker: string;
+  readonly broker: string;
+  readonly epoch: number;
+  readonly endpoint: string;
+  readonly token: string;
+  readonly issuedAt: number;
+  readonly expiresAt: number;
+  readonly signature: string;
+}
+interface IHostedWorkerResumeSession {
+  readonly id: string;
+  readonly path: string;
+  readonly digest: string;
+}
+/** Private runtime ingress; the worker gets a different, per-launch credential. */
+interface IHostedWorkerServe {
+  readonly port: number;
+  readonly workerPort: number;
+  readonly token: string;
+}
+declare function hostedWorkerAccessBytes(access: Omit<IHostedWorkerAccess, 'signature'>): Buffer;
+//#endregion
+//#region src/hosted/e2b-worker-provisioning.d.ts
+/** Owner-side input. Sign admission only after this operation returns a verified resource receipt. */
+interface IE2BWorkerProvisioningOptions {
+  readonly identity: IHostedIdentity;
+  readonly epoch: number;
+  readonly templateId: string;
+  readonly apiKey: string;
+  readonly brokerEndpoint: string;
+  readonly lifetimeMs: number;
+  readonly requestTimeoutMs: number;
+  readonly signal: AbortSignal;
+  readonly snapshot: IHostedSnapshot | null;
+  /** Owner-issued organization binding retained in the provider inventory across broker restarts. */
+  readonly organization?: {
+    readonly controlPlane: string;
+    readonly grantId: string;
+  };
+  /** Bytes fetched from the owner's checkpoint store; never an E2B memory snapshot/template. */
+  readonly checkpoint?: Uint8Array;
+}
+interface IE2BProvisionedWorker {
+  readonly resource: string;
+  readonly workspaceRoot: string;
+  readonly operationId: string;
+  readonly resumeSession?: IHostedWorkerResumeSession;
+  readonly snapshot: IHostedSnapshot | null;
+  release(): Promise<void>;
+}
+/** Reconciliation identifiers, without provider error text or credentials. */
+declare class E2BWorkerProvisioningError extends Error {
+  readonly outcome: 'allocation-unknown' | 'cleanup-unresolved';
+  readonly operationId: string;
+  readonly resource?: string | undefined;
+  constructor(outcome: 'allocation-unknown' | 'cleanup-unresolved', operationId: string, resource?: string | undefined);
+}
+/** Create from a pinned clean baseline, restoring only bounded task files before issuing any authority. */
+declare function provisionE2BTaskWorker(options: IE2BWorkerProvisioningOptions): Promise<IE2BProvisionedWorker>;
+//#endregion
+//#region ../agent-transport/dist/node/node.d.ts
+//#endregion
+//#region src/node/access-token-verifier.d.ts
+/** What the verifier reaches outward through. Injected in tests; defaults to the real network. */
+interface IAccessTokenVerifierDeps {
+  readonly fetch?: IEgressDeps['fetch'];
+  readonly lookup?: IEgressDeps['lookup'];
+  /** Wall-clock milliseconds since the epoch, for `exp`/`nbf`. Defaults to `Date.now`. */
+  readonly now?: () => number;
+  /** Monotonic milliseconds, for cache age and refetch intervals. Defaults to `performance.now`. */
+  readonly monotonicNow?: () => number;
+}
+//#endregion
+//#region src/hosted/desktop/authorization.d.ts
+interface IDesktopBinding {
+  readonly id: string;
+  readonly user: string;
+  readonly client: string;
+  readonly session: string;
+  readonly worker: IHostedOrganizationWorker;
+}
+interface IDesktopProof {
+  readonly binding: IDesktopBinding;
+  readonly jti: string;
+  readonly expiresAt: number;
+  readonly credentialExpiresAt: number;
+}
+interface IDesktopAuthorizationOptions {
+  readonly publicUrl: string;
+  readonly issuer: string;
+  readonly control: HostedOrganizationControl;
+  /** Owner-selected identities and sessions, never a caller's registry. */
+  readonly bindings: readonly IDesktopBinding[];
+  readonly verifierDeps?: IAccessTokenVerifierDeps;
+  readonly now?: () => number;
+}
+/** A freshly verified issuer credential still needs current company authority and exact session ownership. */
+declare class HostedDesktopAuthorization {
+  private readonly options;
+  readonly url: URL;
+  private readonly now;
+  private readonly bindings;
+  constructor(options: IDesktopAuthorizationOptions);
+  binding(id: string): IDesktopBinding;
+  verify(token: string, binding: IDesktopBinding, operator?: boolean, signal?: AbortSignal): Promise<IDesktopProof>;
+  current(binding: IDesktopBinding, signal?: AbortSignal): Promise<void>;
+}
+//#endregion
+//#region src/hosted/desktop/authority-store.d.ts
+interface IDesktopAccess {
+  readonly key: string;
+  readonly generation: number;
+  readonly token: string;
+  readonly approvalToken: string | null;
+  readonly expiresAt: number;
+}
+/** Replay and connection replacement survive restart; independent custody rejects restored authority. */
+declare class HostedDesktopAuthorityStore {
+  private readonly now;
+  private readonly directory;
+  private readonly file;
+  private readonly lock;
+  constructor(options: {
+    directory: string;
+    anchor: IOrganizationLedgerAnchor;
+    create?: boolean;
+  }, now?: () => number);
+  private readonly anchor;
+  private head;
+  private read;
+  private locked;
+  private write;
+  private change;
+  pair(key: string, proofs: readonly {
+    readonly id: string;
+    readonly expiresAt: number;
+  }[], expiresAt: number, operator: boolean): IDesktopAccess;
+  authorize(key: string, generation: number, token: string, operator?: boolean): void;
+  connect(key: string, generation: number, token: string): void;
+  approveOnce(key: string, generation: number, token: string, prompt: string): void;
+  revoke(key: string): void;
+}
+//#endregion
+//#region src/hosted/desktop/worker-port.d.ts
+/** One owner-held carrier connection pins the worker's session across desktop reconnects. */
+declare class HostedDesktopWorkerPort {
+  private readonly socket;
+  readonly worker: IHostedOrganizationWorker;
+  readonly session: string;
+  private readonly listeners;
+  private readonly ended;
+  private readonly pending;
+  private constructor();
+  static connect(options: {
+    readonly endpoint: string;
+    readonly token: string;
+    readonly worker: IHostedOrganizationWorker;
+    readonly control: HostedOrganizationControl;
+    readonly session?: string;
+    readonly signal?: AbortSignal;
+  }): Promise<HostedDesktopWorkerPort>;
+  onFrame(listener: (frame: Record<string, unknown>) => void): () => void;
+  onClose(listener: () => void): () => void;
+  ready(): void;
+  send(frame: Record<string, unknown>): Record<string, unknown> | undefined;
+  prompt(id: string, digest: string): void;
+  approve(id: string, digest: string, allow: boolean): void;
+  close(): void;
+}
+//#endregion
+//#region src/hosted/desktop/gateway.d.ts
+/** Outside workers: owns scoped ingress and a separate operator channel to one pinned task session. */
+declare class HostedDesktopGateway {
+  private readonly options;
+  private readonly wss;
+  private readonly paired;
+  private readonly active;
+  private readonly names;
+  private readonly proxies;
+  private readonly interval;
+  private closed;
+  private readonly upgrades;
+  constructor(options: {
+    readonly server: Server;
+    readonly authorization: HostedDesktopAuthorization;
+    readonly store: HostedDesktopAuthorityStore;
+    readonly ports: ReadonlyMap<string, HostedDesktopWorkerPort>;
+    readonly trustedProxies?: readonly string[];
+    readonly policyIntervalMs?: number;
+  });
+  private boundary;
+  private bounded;
+  private body;
+  private readonly request;
+  private handle;
+  private readonly upgrade;
+  private connect;
+  private attach;
+  /** Owner-only withdrawal; no administrator route is exposed. */
+  revoke(binding: string): void;
+  close(): Promise<void>;
+}
+//#endregion
+export { E2BWorkerProvisioningError, HostedDesktopAuthorityStore, HostedDesktopAuthorization, HostedDesktopGateway, HostedDesktopWorkerPort, HostedOrganizationControl, HostedOrganizationPayloads, HostedRuntimeController, type IDesktopAuthorizationOptions, type IDesktopBinding, type IE2BOwnedTaskWorker, type IE2BProvisionedWorker, type IE2BTaskWorkerOptions, type IE2BWorkerProvisioningOptions, type IHostedAdmission, type IHostedAdmissionProof, type IHostedOrganizationBinding, type IHostedOrganizationControlOptions, type IHostedOrganizationIncidentOwners, type IHostedOrganizationInventory, type IHostedOrganizationModelOptions, type IHostedOrganizationWorker, type IHostedRuntimeConfig, type IHostedRuntimeControl, type IHostedRuntimeControllerOptions, type IHostedRuntimeExecutor, type IHostedRuntimeInvocation, type IHostedRuntimeUsage, type IHostedWorkerAccess, type IHostedWorkerResumeSession, type IHostedWorkerServe, type IProductCliArtifact, type IProductCliHost, type IStartCliOptions, type THostedRuntimeExecutorFactory, type THostedRuntimeState, connectE2BTaskWorker, createE2BOrganizationInventory, createHostedOrganizationGateway, createHostedOrganizationInputTokenCounter, createHostedOrganizationModelAction, createProductCliHost, hostedAdmissionBytes, hostedWorkerAccessBytes, provisionE2BTaskWorker, startCli, startCliEntry };
+//# sourceMappingURL=index.d.ts.map