@rynx-ai/server 0.1.10 → 0.1.11-beta.10

package/dist/server.js

@@ -3,7 +3,6 @@ import Koa from "koa";
 import Router from "@koa/router";
 import { loadConfig, listAgentSpecs, loadAgentSpec, resolveSessionExecution, resolveRuntimeModel, ConversationRuntime, InMemorySessionBus, persistSessionEvent, } from "@rynx-ai/core";
 import { RunnerManager, FileCodexSessionStore, resolveCodexSessionStorePath, } from "@rynx-ai/runtime";
-import { ChannelManager } from "./channel-manager.js";
 import { createControlRouter, } from "./control-api.js";
 import { attachEmulatorTouchWs } from "./emulator-touch-ws.js";
 import { attachTerminalWs } from "./terminal-ws.js";
@@ -11,10 +10,11 @@ import { attachBrowserSurfaceWs } from "./browser-surface-ws.js";
 import { attachEmulatorSurfaceWs } from "./emulator-surface-ws.js";
 import { attachDesktopBrowserHostServer, } from "./desktop-browser-host.js";
 import { resolveControlWebDist, sendSpaFile } from "./control-web-dist.js";
+import { startSessionPortal, } from "./session-portal.js";
+export { createSessionPortalApp, startSessionPortal } from "./session-portal.js";
 import { SessionRuntimeIndex } from "./session-runtime-index.js";
 import { createRunnerSessionTerminalHost, } from "./session-terminal-host.js";
 import { runtimeWebAccessPolicyForBindHost, } from "./runtime-web-auth.js";
-export { ChannelManager } from "./channel-manager.js";
 export { MachineSessionService, MachineSessionServiceFailure, MachineSessionServiceInputError, synthesizeSessionTitle, } from "./machine-session-service.js";
 export { SessionBrowserHostError, SessionBrowserService, SessionBrowserServiceError, SessionBrowserSurfaceUnsupportedError, } from "./session-browser-service.js";
 export { SessionEmulatorBindingConflictError, SessionEmulatorService, SessionEmulatorServiceError, } from "./session-emulator-service.js";
@@ -26,6 +26,7 @@ export { attachDirectRuntimeBrowserSurfaceServer, DirectRuntimeBrowserSurfaceHos
 export { attachDirectRuntimeBrowserInspectServer, DirectRuntimeBrowserInspectHostError, } from "./direct-runtime-browser-inspect-server.js";
 export { RemoteRuntimeDispatcher } from "./remote-runtime-dispatcher.js";
 export { createRunnerSessionTerminalHost, SessionTerminalOpenError, SessionTerminalStreamError, } from "./session-terminal-host.js";
+export { listRuntimeModels } from "@rynx-ai/runtime";
 /** Preserve one session's mirror order without serializing unrelated sessions. */
 export class SessionMirrorQueue {
     persist;
@@ -60,18 +61,24 @@ export function createSessionRuntimeServices(input) {
         ...(input.sessionContextProvider
             ? { sessionContextProvider: input.sessionContextProvider }
             : {}),
+        ...(input.admissionOpen ? { admissionOpen: input.admissionOpen } : {}),
+        ...(input.admissionReserve ? { admissionReserve: input.admissionReserve } : {}),
     });
     const sessionBus = new InMemorySessionBus();
     const sessionRuntimeIndex = new SessionRuntimeIndex();
+    const sessionMirrorQueue = new SessionMirrorQueue((sessionId, event) => persistSessionEvent(sessionId, event, { sessionLog: input.sessionLog, sessionBus }));
+    const mirrorSessionEvent = (sessionId, event) => {
+        sessionRuntimeIndex.observe(sessionId, event);
+        return sessionMirrorQueue.enqueue(sessionId, event);
+    };
     const conversationRuntime = new ConversationRuntime({
         config: input.config,
         executor: runnerManager,
         sessionBus,
+        sessionEventSink: mirrorSessionEvent,
     });
-    const sessionMirrorQueue = new SessionMirrorQueue((sessionId, event) => persistSessionEvent(sessionId, event, { sessionLog: input.sessionLog, sessionBus }));
     runnerManager.onMirror((sessionId, event) => {
-        sessionRuntimeIndex.observe(sessionId, event);
-        void sessionMirrorQueue.enqueue(sessionId, event).catch((error) => {
+        void mirrorSessionEvent(sessionId, event).catch((error) => {
             input.onMirrorError?.(error, sessionId);
         });
     });
@@ -81,6 +88,7 @@ export function createSessionRuntimeServices(input) {
         sessionBus,
         sessionRuntimeIndex,
         conversationRuntime,
+        publishSessionEvent: mirrorSessionEvent,
     };
 }
 /**
@@ -131,7 +139,7 @@ export function createApp({ config = loadConfig(), control } = {}) {
     }
     return app;
 }
-export async function startServer({ config = loadConfig(), channelInstances, loadInstances, control, sessionLog, sessionRegistry, pluginRuntime, daemonManagement, remoteRuntime, remoteRuntimeAdmin, runtimeTargetControl, runtimeConnectionResolver, localSessionResources, sessionEmulators, sessionRuntimeServices, sessionLifecycle, sessionTerminals, runtimeLocalBrowser, providerClis, desktopBrowserHost, } = {}) {
+export async function startServer({ config = loadConfig(), control, sessionLog, sessionRegistry, pluginRuntime, daemonManagement, remoteRuntime, remoteRuntimeAdmin, runtimeTargetControl, runtimeConnectionResolver, localSessionResources, localMachineSessions, sessionEmulators, sessionRuntimeServices, sessionLifecycle, sessionTerminals, runtimeLocalBrowser, providerClis, desktopBrowserHost, sessionPortalAuthorization, } = {}) {
     const runtimeWebAccess = runtimeWebAccessPolicyForBindHost(config.HOST);
     const desktopBrowserManagementToken = desktopBrowserHost
         ? requireDaemonManagementToken(daemonManagement)
@@ -148,12 +156,52 @@ export async function startServer({ config = loadConfig(), channelInstances, loa
         createRunnerSessionTerminalHost({
             runnerManager,
             resolveLiveSession: async (sessionId) => {
-                const session = await sessionStore.get(sessionId);
+                const session = sessionRegistry?.get(sessionId);
                 if (!session || !runnerManager.hasLiveSession(sessionId))
                     return undefined;
-                return { cwd: session.cwd };
+                return { cwd: session.workspace.cwd };
             },
         });
+    const controlShutdown = new AbortController();
+    const controlSurface = control
+        ? {
+            deps: control,
+            runtime: conversationRuntime,
+            sessionBus,
+            sessionLog,
+            runnerManager,
+            sessionStore,
+            pluginRuntimeStatus: pluginRuntime
+                ? () => pluginRuntime.statusSnapshot()
+                : undefined,
+            daemonManagement,
+            remoteRuntime,
+            remoteRuntimeAdmin,
+            runtimeTargetControl,
+            runtimeConnectionResolver,
+            localSessionResources,
+            localMachineSessions,
+            sessionEmulators,
+            shutdownSignal: controlShutdown.signal,
+            sessionRuntimeIndex,
+            sessionLifecycle,
+            runtimeLocalBrowser,
+            providerClis,
+        }
+        : undefined;
+    const sessionPortalConfig = config.RYNX_SESSION_PORTAL_PORT !== undefined
+        ? (() => {
+            if (runtimeWebAccess.mode !== "loopback") {
+                throw new Error("Session Portal requires the ordinary Control listener to bind loopback only");
+            }
+            const controlWebDist = resolveControlWebDist();
+            if (!sessionPortalAuthorization || !controlSurface || !controlWebDist) {
+                throw new Error("Session Portal requires authorization, Control services, and the native Control Web build");
+            }
+            return { authorization: sessionPortalAuthorization, controlWebDist };
+        })()
+        : undefined;
+    let sessionPortalServer;
     if (pluginRuntime) {
         if (!sessionRegistry)
             throw new Error("plugin runtime requires a machine session registry");
@@ -175,165 +223,132 @@ export async function startServer({ config = loadConfig(), channelInstances, loa
                 }),
             },
             interruptSession: (sessionId) => runnerManager.interruptLiveSession(sessionId),
+            terminateSession: (sessionId) => runnerManager.terminateLiveSession(sessionId),
             resolveSessionInteraction: (sessionId, interactionId, resolution) => runnerManager.resolveInteraction(sessionId, interactionId, resolution),
+            ...(sessionPortalConfig
+                ? {
+                    sessionPortal: {
+                        scheme: "http",
+                        bindHost: config.RYNX_SESSION_PORTAL_HOST,
+                        port: config.RYNX_SESSION_PORTAL_PORT,
+                    },
+                }
+                : {}),
         });
     }
-    // claude `/clear`·`/fork` rotates to a fresh machine-session; record its meta so
-    // the console list shows it with the carried-over launch target/model + a source tag.
-    // (It also surfaces via the log-merge once its first turn mirrors.)
+    // Provider TUI `/clear`·`/fork` uses the same publication boundary as an
+    // explicit Rynx fork. The manager exposes the transferred terminal only after
+    // this resolves, so no target can appear with missing history or metadata.
     runnerManager.onRotate((r) => {
-        const source = control?.getSessionMeta(r.from);
-        control?.createSessionMeta({
-            id: r.to,
-            source: r.kind === "fork" ? "fork" : "clear",
-            ...(r.agent
-                ? { agent: r.agent }
-                : source?.provider
-                    ? { provider: source.provider }
-                    : {}),
-            ...(r.model ? { model: r.model } : {}),
-            createdAt: new Date().toISOString(),
+        if (!localMachineSessions) {
+            throw new Error("native Session rotation requires the machine Session service");
+        }
+        return localMachineSessions.recordNativeRotation({
+            sourceSessionId: r.from,
+            targetSessionId: r.to,
+            kind: r.kind,
         });
     });
-    // New path: per-instance contexts via the ChannelManager (the daemon supplies
-    // `loadInstances`; the control plane drives live start/stop/reload).
-    const resolveInstances = loadInstances ?? (channelInstances ? async () => channelInstances : null);
-    if (resolveInstances) {
-        const controlShutdown = new AbortController();
-        const manager = new ChannelManager({
-            config,
-            conversationRuntime,
-            capabilities: runnerManager,
-            sessionStore,
-            sessionLog,
-            sessionBus,
-            sessionRegistry,
-            loadInstances: resolveInstances,
-        });
-        const app = createApp({
-            config,
-            control: control
-                ? {
-                    manager,
-                    deps: control,
-                    runtime: conversationRuntime,
-                    sessionBus,
-                    sessionLog,
-                    runnerManager,
-                    sessionStore,
-                    pluginRuntimeStatus: pluginRuntime
-                        ? () => pluginRuntime.statusSnapshot()
-                        : undefined,
-                    pluginRuntimeReload: pluginRuntime
-                        ? (pluginId) => pluginRuntime.reloadPluginRuntime(pluginId)
-                        : undefined,
-                    pluginRuntimeEnsure: pluginRuntime
-                        ? (pluginId) => pluginRuntime.ensurePluginRuntime(pluginId)
-                        : undefined,
-                    daemonManagement,
-                    remoteRuntime,
-                    remoteRuntimeAdmin,
-                    runtimeTargetControl,
-                    runtimeConnectionResolver,
-                    localSessionResources,
-                    sessionEmulators,
-                    shutdownSignal: controlShutdown.signal,
-                    sessionRuntimeIndex,
-                    sessionLifecycle,
-                    runtimeLocalBrowser,
-                    providerClis,
-                }
-                : undefined,
-        });
-        return new Promise((resolve) => {
-            const server = app.listen(config.PORT, config.HOST, () => {
-                console.log(JSON.stringify({
-                    level: config.LOG_LEVEL,
-                    msg: "Harness agent server listening",
-                    host: config.HOST,
-                    port: config.PORT,
-                    runtime: config.AGENT_RUNTIME,
-                    model: resolveRuntimeModel(config, config.AGENT_RUNTIME),
-                }));
-                const startup = (async () => {
-                    await pluginRuntime?.startPluginRuntimes();
-                    await manager.startAll();
-                })();
-                void startup.catch((error) => {
-                    console.error(JSON.stringify({
-                        level: "error",
-                        type: "plugin-runtime",
-                        event: "startup_failed",
-                        error: error instanceof Error ? error.message : String(error),
-                    }));
-                });
-                // Live WS bridges share this http.Server (no second port).
-                const webSocketServers = [
-                    attachTerminalWs(server, {
-                        runtimeConnectionResolver,
-                        legacyLocalTerminalHost,
-                        runtimeWebAccess,
-                    }),
-                    attachBrowserSurfaceWs(server, { runtimeConnectionResolver, runtimeWebAccess }),
-                    attachEmulatorSurfaceWs(server, { runtimeConnectionResolver, runtimeWebAccess }),
-                ];
-                if (desktopBrowserHost && desktopBrowserManagementToken) {
-                    webSocketServers.push(attachDesktopBrowserHostServer(server, {
-                        ...desktopBrowserHost,
-                        managementToken: desktopBrowserManagementToken,
-                    }));
-                }
-                if (control?.emulator) {
-                    webSocketServers.push(attachEmulatorTouchWs(server, { emulator: control.emulator }));
-                }
-                resolve(bindServerLifecycle(server, {
-                    fence: () => {
-                        controlShutdown.abort(new Error("Rynx server is shutting down"));
-                    },
-                    closeUpgrades: async () => {
-                        await closeWebSocketServers(webSocketServers);
-                    },
-                    cleanup: async () => {
-                        await runCleanupSteps([
-                            () => startup.catch(() => undefined),
-                            () => manager.stopAll(),
-                            () => Promise.resolve(daemonManagement?.pluginManagement?.dispose?.()),
-                            () => pluginRuntime?.dispose() ?? Promise.resolve(),
-                            () => runnerManager.stop(),
-                        ]);
-                    },
-                }));
+    const app = createApp({
+        config,
+        control: controlSurface,
+    });
+    return new Promise((resolve, reject) => {
+        let startupWebSocketServers = [];
+        const rejectBeforeListening = (error) => reject(error);
+        const server = app.listen(config.PORT, config.HOST, () => {
+            server.off("error", rejectBeforeListening);
+            void finishStartup(server).catch(async (error) => {
+                controlShutdown.abort(asError(error));
+                sessionPortalServer?.stopAccepting();
+                server.closeAllConnections?.();
+                await Promise.allSettled([
+                    closeWebSocketServers(startupWebSocketServers),
+                    sessionPortalServer?.shutdown() ?? Promise.resolve(),
+                    new Promise((done) => server.close(() => done())),
+                    Promise.resolve(daemonManagement?.pluginManagement?.dispose?.()),
+                    Promise.resolve(pluginRuntime?.dispose()),
+                    runnerManager.stop(),
+                ]);
+                reject(error);
             });
         });
-    }
-    // Core-only mode: no chat instances and no plugin code are required.
-    const app = createApp();
-    return new Promise((resolve) => {
-        const server = app.listen(config.PORT, config.HOST, () => {
+        server.once("error", rejectBeforeListening);
+        const finishStartup = async (server) => {
             console.log(JSON.stringify({
                 level: config.LOG_LEVEL,
                 msg: "Harness agent server listening",
                 host: config.HOST,
                 port: config.PORT,
-                runtime: config.AGENT_RUNTIME,
-                model: resolveRuntimeModel(config, config.AGENT_RUNTIME),
+                runtime: config.DEFAULT_RUNTIME,
+                model: resolveRuntimeModel(config, config.DEFAULT_RUNTIME),
             }));
-            const webSocketServers = [];
+            const webSocketServers = [
+                attachTerminalWs(server, {
+                    runtimeConnectionResolver,
+                    legacyLocalTerminalHost,
+                    runtimeWebAccess,
+                }),
+                attachBrowserSurfaceWs(server, { runtimeConnectionResolver, runtimeWebAccess }),
+                attachEmulatorSurfaceWs(server, { runtimeConnectionResolver, runtimeWebAccess }),
+            ];
             if (desktopBrowserHost && desktopBrowserManagementToken) {
                 webSocketServers.push(attachDesktopBrowserHostServer(server, {
                     ...desktopBrowserHost,
                     managementToken: desktopBrowserManagementToken,
                 }));
             }
+            if (control?.emulator) {
+                webSocketServers.push(attachEmulatorTouchWs(server, { emulator: control.emulator }));
+            }
+            startupWebSocketServers = webSocketServers;
+            if (sessionPortalConfig) {
+                sessionPortalServer = await startSessionPortal({
+                    host: config.RYNX_SESSION_PORTAL_HOST,
+                    port: config.RYNX_SESSION_PORTAL_PORT,
+                    scheme: "http",
+                    authorization: sessionPortalConfig.authorization,
+                    controlOrigin: listeningHttpOrigin(server),
+                    controlWebDist: sessionPortalConfig.controlWebDist,
+                    shutdownSignal: controlShutdown.signal,
+                });
+            }
+            const startup = pluginRuntime?.startPluginRuntimes() ?? Promise.resolve();
+            void startup.catch((error) => {
+                console.error(JSON.stringify({
+                    level: "error",
+                    type: "plugin-runtime",
+                    event: "startup_failed",
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+            });
             resolve(bindServerLifecycle(server, {
-                ...(webSocketServers.length > 0
-                    ? { closeUpgrades: () => closeWebSocketServers(webSocketServers) }
-                    : {}),
-                cleanup: () => runnerManager.stop(),
+                fence: () => {
+                    controlShutdown.abort(new Error("Rynx server is shutting down"));
+                    sessionPortalServer?.stopAccepting();
+                },
+                closeUpgrades: () => Promise.all([
+                    closeWebSocketServers(webSocketServers),
+                    sessionPortalServer?.shutdown() ?? Promise.resolve(),
+                ]).then(() => undefined),
+                cleanup: async () => runCleanupSteps([
+                    () => startup.catch(() => undefined),
+                    () => Promise.resolve(daemonManagement?.pluginManagement?.dispose?.()),
+                    () => pluginRuntime?.dispose() ?? Promise.resolve(),
+                    () => runnerManager.stop(),
+                ]),
             }));
-        });
+        };
     });
 }
+function listeningHttpOrigin(server) {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Control listener did not expose an HTTP address");
+    }
+    const host = address.address.includes(":") ? `[${address.address}]` : address.address;
+    return `http://${host}:${address.port}`;
+}
 function requireDaemonManagementToken(host) {
     const token = host?.managementToken;
     const bytes = typeof token === "string" ? Buffer.byteLength(token, "utf8") : 0;

package/dist/session-browser-service.d.ts

@@ -1,3 +1,4 @@
+import type { AdmissionReservation } from "@rynx-ai/core";
 import { type RuntimeBrowserCloseParams, type RuntimeBrowserCloseResult, type RuntimeBrowserExecutionBackend, type RuntimeBrowserOpenParams, type RuntimeBrowserPageCreateParams, type RuntimeBrowserPageMutationParams, type RuntimeBrowserPageNavigateParams, type RuntimeBrowserState, type RuntimeBrowserStateGetParams } from "@rynx-ai/protocol/runtime-browser";
 import type { RuntimeBrowserSurfaceFormat, RuntimeBrowserSurfaceInputEvent } from "@rynx-ai/protocol/runtime-browser-surface";
 import { type RuntimeBrowserEndpointDescriptor } from "@rynx-ai/protocol/runtime-browser-bootstrap";
@@ -155,6 +156,11 @@ export interface SessionBrowserServiceOptions {
     pageIdFactory?: () => string;
     /** Injectable boot nonce; production randomization fences stale pre-restart mutations. */
     bootGenerationSeed?: number;
+    /**
+     * Synchronous daemon admission fence. A successful reservation is held until
+     * Browser open has either failed or registered the physical Host handle.
+     */
+    admissionReserve?: () => AdmissionReservation | undefined;
 }
 export type SessionBrowserHostErrorCode = "unavailable" | "page_not_found" | "capacity" | "outcome_unknown";
 /** Expected failure reported by a Browser Host implementation. */
@@ -181,6 +187,7 @@ export declare class SessionBrowserService {
     private readonly observers;
     private readonly pageIdFactory;
     private readonly bootGenerationSeed;
+    private readonly admissionReserve?;
     private shuttingDown;
     private closeAllPromise?;
     constructor(ports: SessionBrowserServicePorts, options?: SessionBrowserServiceOptions);
@@ -225,6 +232,7 @@ export declare class SessionBrowserService {
     closeAll(): Promise<void>;
     private closeEveryRecord;
     private createBrowser;
+    private reserveOpenAdmission;
     private closeUnavailableForRecreate;
     private pageMutation;
     private pageMutationParsed;

package/dist/session-browser-service.js

@@ -42,12 +42,14 @@ export class SessionBrowserService {
     observers = new Set();
     pageIdFactory;
     bootGenerationSeed;
+    admissionReserve;
     shuttingDown = false;
     closeAllPromise;
     constructor(ports, options = {}) {
         this.ports = ports;
         this.pageIdFactory = options.pageIdFactory ?? (() => `page_${randomUUID()}`);
         this.bootGenerationSeed = options.bootGenerationSeed ?? randomBootGenerationSeed();
+        this.admissionReserve = options.admissionReserve;
         if (!Number.isSafeInteger(this.bootGenerationSeed) ||
             this.bootGenerationSeed < 0 ||
             this.bootGenerationSeed >= Number.MAX_SAFE_INTEGER) {
@@ -224,29 +226,35 @@ export class SessionBrowserService {
         });
     }
     async open(input) {
-        const params = parseInput(() => parseRuntimeBrowserOpenParams(input), "Browser open request is invalid");
-        return this.exclusive(params.sessionId, async () => {
-            this.ensureRunning();
-            await this.ensureSessionExists(params.sessionId);
-            const existing = this.records.get(params.sessionId);
-            if (existing?.status === "opening") {
-                return this.project(existing);
-            }
-            if (existing?.status === "ready") {
-                try {
-                    await this.reconcileForRead(existing);
+        const admission = this.reserveOpenAdmission();
+        try {
+            const params = parseInput(() => parseRuntimeBrowserOpenParams(input), "Browser open request is invalid");
+            return await this.exclusive(params.sessionId, async () => {
+                this.ensureRunning();
+                await this.ensureSessionExists(params.sessionId);
+                const existing = this.records.get(params.sessionId);
+                if (existing?.status === "opening") {
                     return this.project(existing);
                 }
-                catch {
-                    // An App Host may have gone away immediately before this open. The
-                    // failed reconciliation marks the old generation unavailable, so an
-                    // idempotent open can recreate it on the current preferred Host.
+                if (existing?.status === "ready") {
+                    try {
+                        await this.reconcileForRead(existing);
+                        return this.project(existing);
+                    }
+                    catch {
+                        // An App Host may have gone away immediately before this open. The
+                        // failed reconciliation marks the old generation unavailable, so an
+                        // idempotent open can recreate it on the current preferred Host.
+                    }
                 }
-            }
-            if (existing)
-                await this.closeUnavailableForRecreate(existing);
-            return this.createBrowser(params);
-        });
+                if (existing)
+                    await this.closeUnavailableForRecreate(existing);
+                return this.createBrowser(params);
+            });
+        }
+        finally {
+            admission?.release();
+        }
     }
     async close(input) {
         const params = parseInput(() => parseRuntimeBrowserCloseParams(input), "Browser close request is invalid");
@@ -438,6 +446,15 @@ export class SessionBrowserService {
             throw new SessionBrowserServiceError("host_failure", "Browser Host state could not be initialized", { cause: error });
         }
     }
+    reserveOpenAdmission() {
+        if (!this.admissionReserve)
+            return undefined;
+        const admission = this.admissionReserve();
+        if (!admission) {
+            throw new SessionBrowserServiceError("shutting_down", "Browser service is shutting down");
+        }
+        return admission;
+    }
     async closeUnavailableForRecreate(record) {
         record.status = "closing";
         try {

package/dist/session-portal.d.ts

@@ -0,0 +1,42 @@
+import { type IncomingMessage, type Server as HttpServer } from "node:http";
+import type { Duplex } from "node:stream";
+import Koa from "koa";
+export declare const SESSION_PORTAL_HEADER = "x-rynx-session-portal";
+export declare const SESSION_PORTAL_QUERY = "portal";
+export interface SessionPortalAuthorization {
+    portalId: string;
+    pluginId: string;
+    scope: "plugin_sessions" | "single_session";
+    access: "read_only" | "read_write";
+    sessionId?: string;
+    expiresAt: string;
+}
+export interface SessionPortalAuthorizationPorts {
+    redeem(ticket: string): (SessionPortalAuthorization & {
+        secret: string;
+    }) | undefined;
+    authorize(portalId: string, secret: string): SessionPortalAuthorization | undefined;
+    ownsSession(pluginId: string, sessionId: string): boolean;
+}
+export interface SessionPortalOptions {
+    host: string;
+    port: number;
+    scheme: "http" | "https";
+    authorization: SessionPortalAuthorizationPorts;
+    controlOrigin: string;
+    controlWebDist: string;
+    shutdownSignal?: AbortSignal;
+}
+export interface SessionPortalServer {
+    server: HttpServer;
+    stopAccepting(): void;
+    shutdown(): Promise<void>;
+}
+/** Session Portal is a narrow adapter in front of the one Control service. It
+ * serves the native SPA, validates Portal grants, and forwards only authorized
+ * Session HTTP calls to Control; it owns no Session or Runtime handlers. */
+export declare function createSessionPortalApp(options: SessionPortalOptions): Koa;
+export declare function startSessionPortal(options: SessionPortalOptions): Promise<SessionPortalServer>;
+export declare function authorizeSessionPortalWebSocket(request: IncomingMessage, ports: SessionPortalAuthorizationPorts, runtimeSelector: string, sessionId: string): SessionPortalAuthorization | undefined;
+export declare function rejectSessionPortalUpgrade(socket: Duplex): void;
+export declare function scheduleSessionPortalExpiry(expiresAt: string, onExpire: () => void): () => void;