@sealant/api-contracts-next 0.0.0-next.0 → 0.39.0-next.682

package/dist/core-api/packages.js

@@ -0,0 +1,60 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi";
+const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
+export const packageTargetOsSchema = Schema.Literals(["arch", "fedora", "nix", "ubuntu"]);
+export const packageResolutionStatusSchema = Schema.Literals([
+    "resolved",
+    "ambiguous",
+    "unsupported",
+    "not-found",
+    "invalid",
+]);
+export const packageResolutionSourceSchema = Schema.Literals(["cache", "repology", "override"]);
+export const packageOsSupportSchema = Schema.Struct({
+    supported: Schema.Boolean,
+    repo: Schema.optional(NonEmptyString),
+    packageName: Schema.optional(NonEmptyString),
+    projectName: Schema.optional(NonEmptyString),
+    version: Schema.optional(NonEmptyString),
+    status: Schema.optional(NonEmptyString),
+});
+export const packageResolutionAlternativeSchema = Schema.Struct({
+    projectName: NonEmptyString,
+});
+export const packageResolutionSchema = Schema.Struct({
+    requested: NonEmptyString,
+    normalized: NonEmptyString,
+    status: packageResolutionStatusSchema,
+    source: packageResolutionSourceSchema,
+    canonicalId: Schema.optional(NonEmptyString),
+    selectedProject: Schema.optional(NonEmptyString),
+    osSupport: Schema.Struct({
+        arch: packageOsSupportSchema,
+        fedora: packageOsSupportSchema,
+        nix: packageOsSupportSchema,
+        ubuntu: packageOsSupportSchema,
+    }),
+    alternatives: Schema.Array(packageResolutionAlternativeSchema),
+    fetchedAt: Schema.String,
+    expiresAt: Schema.String,
+});
+export const resolvePackageQuerySchema = Schema.Struct({
+    query: NonEmptyString,
+    targetOs: Schema.optional(packageTargetOsSchema),
+});
+export const resolvePackageResponseSchema = packageResolutionSchema;
+export class PackagesBadGatewayError extends Schema.TaggedErrorClass()("PackagesBadGatewayError", {
+    message: Schema.String,
+}, { httpApiStatus: 502 }) {
+}
+export class PackagesInternalServerError extends Schema.TaggedErrorClass()("PackagesInternalServerError", {
+    message: Schema.String,
+}, { httpApiStatus: 500 }) {
+}
+export const PackagesGroup = HttpApiGroup.make("packages")
+    .add(HttpApiEndpoint.get("resolvePackage", "/resolve", {
+    query: resolvePackageQuerySchema,
+    success: resolvePackageResponseSchema,
+    error: [PackagesBadGatewayError, PackagesInternalServerError],
+}))
+    .annotate(OpenApi.Description, "Package normalization and distro resolution operations.");

package/dist/core-api/profiles.d.ts

@@ -0,0 +1,188 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+export declare const profileStatusSchema: Schema.Literals<readonly ["active", "archived"]>;
+export type ProfileStatus = typeof profileStatusSchema.Type;
+export declare const profileSummarySchema: Schema.Struct<{
+    readonly profileId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly slug: Schema.String;
+    readonly name: Schema.String;
+    readonly description: Schema.NullOr<Schema.String>;
+    readonly status: Schema.Literals<readonly ["active", "archived"]>;
+    readonly activeRevisionId: Schema.NullOr<Schema.String>;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+}>;
+export type ProfileSummary = typeof profileSummarySchema.Type;
+export declare const listProfilesQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type ListProfilesQuery = typeof listProfilesQuerySchema.Type;
+export declare const listProfilesResponseSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly profileId: Schema.String;
+        readonly ownerUserId: Schema.String;
+        readonly slug: Schema.String;
+        readonly name: Schema.String;
+        readonly description: Schema.NullOr<Schema.String>;
+        readonly status: Schema.Literals<readonly ["active", "archived"]>;
+        readonly activeRevisionId: Schema.NullOr<Schema.String>;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+    }>>;
+}>;
+export type ListProfilesResponse = typeof listProfilesResponseSchema.Type;
+export declare const profileCredentialBindingWithAccountSchema: Schema.Struct<{
+    readonly profileId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly connectedAccountId: Schema.String;
+    readonly account: Schema.Struct<{
+        readonly connectedAccountId: Schema.String;
+        readonly ownerUserId: Schema.String;
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+        readonly name: Schema.String;
+        readonly kind: Schema.String;
+        readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+        readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+        readonly connectedAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly lastUsedAt: Schema.NullOr<Schema.String>;
+        readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+        readonly credential: Schema.Struct<{
+            readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+            readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+            readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+            readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+        }>;
+    }>;
+}>;
+export type ProfileCredentialBindingWithAccount = typeof profileCredentialBindingWithAccountSchema.Type;
+export declare const listProfileCredentialBindingsResponseSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly profileId: Schema.String;
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+        readonly connectedAccountId: Schema.String;
+        readonly account: Schema.Struct<{
+            readonly connectedAccountId: Schema.String;
+            readonly ownerUserId: Schema.String;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+            readonly name: Schema.String;
+            readonly kind: Schema.String;
+            readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+            readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+            readonly connectedAt: Schema.String;
+            readonly updatedAt: Schema.String;
+            readonly lastUsedAt: Schema.NullOr<Schema.String>;
+            readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+            readonly credential: Schema.Struct<{
+                readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+                readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+                readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+                readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+            }>;
+        }>;
+    }>>;
+}>;
+export type ListProfileCredentialBindingsResponse = typeof listProfileCredentialBindingsResponseSchema.Type;
+export declare const setProfileCredentialBindingRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly connectedAccountId: Schema.NullOr<Schema.String>;
+}>;
+export type SetProfileCredentialBindingRequest = typeof setProfileCredentialBindingRequestSchema.Type;
+declare const ProfileBadRequestError_base: Schema.Class<ProfileBadRequestError, Schema.TaggedStruct<"ProfileBadRequestError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ProfileBadRequestError extends ProfileBadRequestError_base {
+}
+declare const ProfileNotFoundError_base: Schema.Class<ProfileNotFoundError, Schema.TaggedStruct<"ProfileNotFoundError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ProfileNotFoundError extends ProfileNotFoundError_base {
+}
+declare const ProfileConflictError_base: Schema.Class<ProfileConflictError, Schema.TaggedStruct<"ProfileConflictError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ProfileConflictError extends ProfileConflictError_base {
+}
+declare const ProfileInternalServerError_base: Schema.Class<ProfileInternalServerError, Schema.TaggedStruct<"ProfileInternalServerError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ProfileInternalServerError extends ProfileInternalServerError_base {
+}
+export declare const ProfilesGroup: HttpApiGroup.HttpApiGroup<"profiles", HttpApiEndpoint.HttpApiEndpoint<"listProfileCredentialBindings", "GET", "/:profileId/credential-bindings", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly profileId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly profileId: Schema.String;
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+        readonly connectedAccountId: Schema.String;
+        readonly account: Schema.Struct<{
+            readonly connectedAccountId: Schema.String;
+            readonly ownerUserId: Schema.String;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+            readonly name: Schema.String;
+            readonly kind: Schema.String;
+            readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+            readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+            readonly connectedAt: Schema.String;
+            readonly updatedAt: Schema.String;
+            readonly lastUsedAt: Schema.NullOr<Schema.String>;
+            readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+            readonly credential: Schema.Struct<{
+                readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+                readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+                readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+                readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+            }>;
+        }>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof ProfileNotFoundError | typeof ProfileInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listProfiles", "GET", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly profileId: Schema.String;
+        readonly ownerUserId: Schema.String;
+        readonly slug: Schema.String;
+        readonly name: Schema.String;
+        readonly description: Schema.NullOr<Schema.String>;
+        readonly status: Schema.Literals<readonly ["active", "archived"]>;
+        readonly activeRevisionId: Schema.NullOr<Schema.String>;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof ProfileInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"setProfileCredentialBinding", "PUT", "/:profileId/credential-bindings", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly profileId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+    readonly connectedAccountId: Schema.NullOr<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly profileId: Schema.String;
+        readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+        readonly connectedAccountId: Schema.String;
+        readonly account: Schema.Struct<{
+            readonly connectedAccountId: Schema.String;
+            readonly ownerUserId: Schema.String;
+            readonly provider: Schema.Literals<readonly ["claude", "codex", "github"]>;
+            readonly name: Schema.String;
+            readonly kind: Schema.String;
+            readonly status: Schema.Literals<readonly ["active", "invalid", "archived"]>;
+            readonly metadata: Schema.$Record<Schema.String, Schema.Unknown>;
+            readonly connectedAt: Schema.String;
+            readonly updatedAt: Schema.String;
+            readonly lastUsedAt: Schema.NullOr<Schema.String>;
+            readonly lastSyncedAt: Schema.NullOr<Schema.String>;
+            readonly credential: Schema.Struct<{
+                readonly accessExpiresAt: Schema.NullOr<Schema.String>;
+                readonly refreshExpiresAt: Schema.NullOr<Schema.String>;
+                readonly lastRefreshAt: Schema.NullOr<Schema.String>;
+                readonly lastRefreshOutcome: Schema.NullOr<Schema.Literals<readonly ["refreshed", "fresh", "failed"]>>;
+            }>;
+        }>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof ProfileBadRequestError | typeof ProfileNotFoundError | typeof ProfileConflictError | typeof ProfileInternalServerError>, never, never>, false>;
+export {};

package/dist/core-api/profiles.js

@@ -0,0 +1,88 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi";
+import { connectedAccountProviderSchema, connectedAccountSummarySchema, } from "./connected-accounts.js";
+const NonEmptyString = Schema.String.check(Schema.isNonEmpty(), Schema.isTrimmed());
+/*
+Minimal profiles surface: list a user's profiles and manage the per-provider connected-account
+bindings that bundle credentials into a profile. Same trust model as ssh-keys/connected-accounts:
+the internal API trusts the caller-supplied `ownerUserId` (web tRPC proxy and CLI inject it).
+Bindings embed account summaries only — never secret material.
+*/
+export const profileStatusSchema = Schema.Literals(["active", "archived"]);
+export const profileSummarySchema = Schema.Struct({
+    profileId: NonEmptyString,
+    ownerUserId: NonEmptyString,
+    slug: NonEmptyString,
+    name: NonEmptyString,
+    description: Schema.NullOr(Schema.String),
+    status: profileStatusSchema,
+    activeRevisionId: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+    updatedAt: Schema.String,
+});
+export const listProfilesQuerySchema = Schema.Struct({
+    ownerUserId: NonEmptyString,
+});
+export const listProfilesResponseSchema = Schema.Struct({
+    items: Schema.Array(profileSummarySchema),
+});
+export const profileCredentialBindingWithAccountSchema = Schema.Struct({
+    profileId: NonEmptyString,
+    provider: connectedAccountProviderSchema,
+    connectedAccountId: NonEmptyString,
+    account: connectedAccountSummarySchema,
+});
+export const listProfileCredentialBindingsResponseSchema = Schema.Struct({
+    items: Schema.Array(profileCredentialBindingWithAccountSchema),
+});
+export const setProfileCredentialBindingRequestSchema = Schema.Struct({
+    ownerUserId: NonEmptyString,
+    provider: connectedAccountProviderSchema,
+    // null clears the binding for that provider; the profile id travels in the URL.
+    connectedAccountId: Schema.NullOr(NonEmptyString),
+});
+export class ProfileBadRequestError extends Schema.TaggedErrorClass()("ProfileBadRequestError", {
+    message: Schema.String,
+}, { httpApiStatus: 400 }) {
+}
+export class ProfileNotFoundError extends Schema.TaggedErrorClass()("ProfileNotFoundError", {
+    message: Schema.String,
+}, { httpApiStatus: 404 }) {
+}
+export class ProfileConflictError extends Schema.TaggedErrorClass()("ProfileConflictError", {
+    message: Schema.String,
+}, { httpApiStatus: 409 }) {
+}
+export class ProfileInternalServerError extends Schema.TaggedErrorClass()("ProfileInternalServerError", {
+    message: Schema.String,
+}, { httpApiStatus: 500 }) {
+}
+const profileIdParams = Schema.Struct({ profileId: NonEmptyString });
+export const ProfilesGroup = HttpApiGroup.make("profiles")
+    .add(HttpApiEndpoint.get("listProfiles", "/", {
+    query: listProfilesQuerySchema,
+    success: listProfilesResponseSchema,
+    error: [ProfileInternalServerError],
+}))
+    .add(
+// Uniform 404 for "profile does not exist" and "profile is not yours".
+HttpApiEndpoint.get("listProfileCredentialBindings", "/:profileId/credential-bindings", {
+    params: profileIdParams,
+    query: listProfilesQuerySchema,
+    success: listProfileCredentialBindingsResponseSchema,
+    error: [ProfileNotFoundError, ProfileInternalServerError],
+}))
+    .add(
+// Upserts the (profile, provider) binding (null clears it) and returns the updated list.
+HttpApiEndpoint.put("setProfileCredentialBinding", "/:profileId/credential-bindings", {
+    params: profileIdParams,
+    payload: setProfileCredentialBindingRequestSchema,
+    success: listProfileCredentialBindingsResponseSchema,
+    error: [
+        ProfileBadRequestError,
+        ProfileNotFoundError,
+        ProfileConflictError,
+        ProfileInternalServerError,
+    ],
+}))
+    .annotate(OpenApi.Description, "Profiles and their per-provider connected-account credential bindings.");

package/dist/core-api/record-events.d.ts

@@ -0,0 +1,209 @@
+/**
+ * Record-event taxonomy — the TYPED payload schemas behind `TimelineEntry.kind`/`ref` and
+ * `RunEvent.payloadCase`/`payload`.
+ *
+ * The execution record's event kinds come from the sealantd protocol (`@sealant/runtime-protocol`
+ * `EventEnvelope.payload` oneof); ingest stores each payload as jsonb with the oneof case name as
+ * the `kind`. These schemas describe that STORED/SERVED shape exactly:
+ *
+ *   - uint64/int64 protobuf fields are DECIMAL STRINGS (bigints are stringified at ingest so values
+ *     past 2^53 survive jsonb);
+ *   - protobuf enum fields are NUMBERS (`RuntimeState`, `ExitReason`, `StreamKind`, `FileChangeKind`,
+ *     `FileType`, `NetworkScheme`, `EventPriority` — same convention as the envelope's
+ *     `captureMethod`/`confidence`);
+ *   - proto3 `optional` fields are absent when unset; implicit scalars are always present;
+ *   - decode strips ingest artifacts (e.g. the protobuf `$typeName` marker).
+ *
+ * `decodeRecordEventPayload` folds a `(kind, ref)` pair into the discriminated union, degrading to
+ * the `unknown` case (with the raw kind + payload preserved) for kinds this contract version does
+ * not model or payloads that fail their schema — forward compatibility is a case, not an error.
+ *
+ * The kind list deliberately mirrors `payloadCaseValues` in `@sealant/telemetry` (guarded by a test
+ * there); this contract does not depend on the telemetry package.
+ */
+import { Schema } from "effect";
+/** Every event kind the platform records today, plus `unknown` for an unmodeled/absent oneof. */
+export declare const recordEventKindValues: readonly ["runtimeStateChanged", "runtimeHeartbeat", "processStarted", "processExited", "ioChunk", "telemetryDropped", "fileChange", "fileWatchOverflow", "fileSnapshotCompleted", "fileDiffAvailable", "networkRequest", "networkSourceObserved", "unknown"];
+export declare const recordEventKindSchema: Schema.Literals<readonly ["runtimeStateChanged", "runtimeHeartbeat", "processStarted", "processExited", "ioChunk", "telemetryDropped", "fileChange", "fileWatchOverflow", "fileSnapshotCompleted", "fileDiffAvailable", "networkRequest", "networkSourceObserved", "unknown"]>;
+export type RecordEventKind = typeof recordEventKindSchema.Type;
+/** `sealant.v1.RuntimeStateChanged` — `state` is a numeric `RuntimeState`. */
+export declare const runtimeStateChangedEventSchema: Schema.Struct<{
+    readonly state: Schema.Number;
+    readonly reason: Schema.optional<Schema.String>;
+}>;
+export type RuntimeStateChangedEvent = typeof runtimeStateChangedEventSchema.Type;
+/** `sealant.v1.RuntimeHeartbeat` — `state` is a numeric `RuntimeState`. */
+export declare const runtimeHeartbeatEventSchema: Schema.Struct<{
+    readonly state: Schema.Number;
+}>;
+export type RuntimeHeartbeatEvent = typeof runtimeHeartbeatEventSchema.Type;
+/** `sealant.v1.ProcessStarted` — a supervised process began executing. */
+export declare const processStartedEventSchema: Schema.Struct<{
+    readonly pid: Schema.Number;
+    readonly pgid: Schema.Number;
+    readonly pidfd: Schema.Boolean;
+    readonly executable: Schema.String;
+    readonly args: Schema.$Array<Schema.String>;
+    readonly cwd: Schema.String;
+    /** Wall clock at start, microseconds (decimal-string int64). */
+    readonly startedAt: Schema.String;
+}>;
+export type ProcessStartedEvent = typeof processStartedEventSchema.Type;
+/** `sealant.v1.ProcessExited` — `reason` is a numeric `ExitReason`. */
+export declare const processExitedEventSchema: Schema.Struct<{
+    readonly exitCode: Schema.optional<Schema.Number>;
+    readonly signal: Schema.optional<Schema.Number>;
+    readonly reason: Schema.Number;
+    /** Wall-clock duration, microseconds (decimal-string uint64). */
+    readonly durationMicros: Schema.String;
+}>;
+export type ProcessExitedEvent = typeof processExitedEventSchema.Type;
+/**
+ * `sealant.v1.IoChunk`, as ingest stores it: raw bytes are offloaded to the artifact store and
+ * replaced by a content hash; byte-exact text is served by the scrollback endpoint, not the record.
+ * `stream` is a numeric `StreamKind` (stdout = 2, stderr = 3).
+ */
+export declare const ioChunkEventSchema: Schema.Struct<{
+    readonly stream: Schema.Number;
+    readonly byteCount: Schema.String;
+    readonly streamOffset: Schema.String;
+    readonly contentAlgo: Schema.optional<Schema.String>;
+    readonly contentHash: Schema.optional<Schema.String>;
+    readonly transform: Schema.optional<Schema.Struct<{
+        readonly redacted: Schema.Boolean;
+        readonly truncated: Schema.Boolean;
+        readonly coalesced: Schema.Boolean;
+        readonly originalByteCount: Schema.optional<Schema.String>;
+    }>>;
+}>;
+export type IoChunkEvent = typeof ioChunkEventSchema.Type;
+/** `sealant.v1.TelemetryDropped` — `priority` is a numeric `EventPriority`. */
+export declare const telemetryDroppedEventSchema: Schema.Struct<{
+    readonly reason: Schema.String;
+    readonly count: Schema.String;
+    readonly priority: Schema.Number;
+}>;
+export type TelemetryDroppedEvent = typeof telemetryDroppedEventSchema.Type;
+/** `sealant.v1.FileEntry` — `fileType` is a numeric `FileType`. */
+export declare const fileEntrySchema: Schema.Struct<{
+    readonly path: Schema.String;
+    readonly fileType: Schema.Number;
+    readonly size: Schema.String;
+    readonly mtimeMicros: Schema.String;
+    readonly mode: Schema.Number;
+    readonly hash: Schema.optional<Schema.String>;
+    readonly symlinkTarget: Schema.optional<Schema.String>;
+}>;
+export type FileEntryRef = typeof fileEntrySchema.Type;
+/** `sealant.v1.FileChange` — `kind` is a numeric `FileChangeKind`. */
+export declare const fileChangeEventSchema: Schema.Struct<{
+    readonly kind: Schema.Number;
+    readonly path: Schema.String;
+    readonly renameFrom: Schema.optional<Schema.String>;
+    readonly entry: Schema.optional<Schema.Struct<{
+        readonly path: Schema.String;
+        readonly fileType: Schema.Number;
+        readonly size: Schema.String;
+        readonly mtimeMicros: Schema.String;
+        readonly mode: Schema.Number;
+        readonly hash: Schema.optional<Schema.String>;
+        readonly symlinkTarget: Schema.optional<Schema.String>;
+    }>>;
+    readonly certain: Schema.Boolean;
+}>;
+export type FileChangeEvent = typeof fileChangeEventSchema.Type;
+/** `sealant.v1.FileWatchOverflow` — changes under `root` may have been missed. */
+export declare const fileWatchOverflowEventSchema: Schema.Struct<{
+    readonly root: Schema.String;
+}>;
+export type FileWatchOverflowEvent = typeof fileWatchOverflowEventSchema.Type;
+/** `sealant.v1.FileSnapshotCompleted` */
+export declare const fileSnapshotCompletedEventSchema: Schema.Struct<{
+    readonly root: Schema.String;
+    readonly fileCount: Schema.String;
+}>;
+export type FileSnapshotCompletedEvent = typeof fileSnapshotCompletedEventSchema.Type;
+/** `sealant.v1.FileDiffAvailable` — per-kind counts as decimal-string uint64. */
+export declare const fileDiffAvailableEventSchema: Schema.Struct<{
+    readonly added: Schema.String;
+    readonly modified: Schema.String;
+    readonly deleted: Schema.String;
+    readonly renamed: Schema.String;
+}>;
+export type FileDiffAvailableEvent = typeof fileDiffAvailableEventSchema.Type;
+/** `sealant.v1.NetworkRequest` — `scheme` is a numeric `NetworkScheme`. */
+export declare const networkRequestEventSchema: Schema.Struct<{
+    readonly scheme: Schema.Number;
+    readonly method: Schema.optional<Schema.String>;
+    readonly host: Schema.String;
+    readonly port: Schema.Number;
+    readonly path: Schema.optional<Schema.String>;
+    readonly status: Schema.optional<Schema.Number>;
+    readonly bytesSent: Schema.String;
+    readonly bytesReceived: Schema.String;
+    readonly durationMicros: Schema.String;
+}>;
+export type NetworkRequestEvent = typeof networkRequestEventSchema.Type;
+/** `sealant.v1.NetworkSourceObserved` — a network source the run touched (the "sources" trail). */
+export declare const networkSourceObservedEventSchema: Schema.Struct<{
+    readonly host: Schema.String;
+    readonly resolvedIps: Schema.$Array<Schema.String>;
+    readonly port: Schema.Number;
+    readonly scheme: Schema.optional<Schema.Number>;
+    readonly method: Schema.optional<Schema.String>;
+    readonly path: Schema.optional<Schema.String>;
+    readonly status: Schema.optional<Schema.Number>;
+}>;
+export type NetworkSourceObservedEvent = typeof networkSourceObservedEventSchema.Type;
+/**
+ * A record-event payload discriminated by `kind`. The `unknown` case carries the raw kind and
+ * payload verbatim — it is the forward-compatibility path for kinds newer than this contract AND
+ * the honest path for payloads that fail their schema.
+ */
+export type RecordEventPayload = {
+    readonly kind: "runtimeStateChanged";
+    readonly data: RuntimeStateChangedEvent;
+} | {
+    readonly kind: "runtimeHeartbeat";
+    readonly data: RuntimeHeartbeatEvent;
+} | {
+    readonly kind: "processStarted";
+    readonly data: ProcessStartedEvent;
+} | {
+    readonly kind: "processExited";
+    readonly data: ProcessExitedEvent;
+} | {
+    readonly kind: "ioChunk";
+    readonly data: IoChunkEvent;
+} | {
+    readonly kind: "telemetryDropped";
+    readonly data: TelemetryDroppedEvent;
+} | {
+    readonly kind: "fileChange";
+    readonly data: FileChangeEvent;
+} | {
+    readonly kind: "fileWatchOverflow";
+    readonly data: FileWatchOverflowEvent;
+} | {
+    readonly kind: "fileSnapshotCompleted";
+    readonly data: FileSnapshotCompletedEvent;
+} | {
+    readonly kind: "fileDiffAvailable";
+    readonly data: FileDiffAvailableEvent;
+} | {
+    readonly kind: "networkRequest";
+    readonly data: NetworkRequestEvent;
+} | {
+    readonly kind: "networkSourceObserved";
+    readonly data: NetworkSourceObservedEvent;
+} | {
+    readonly kind: "unknown";
+    readonly rawKind: string;
+    readonly data: unknown;
+};
+/**
+ * Folds a wire `(kind, ref)` pair — `TimelineEntry.kind`/`ref` or `RunEvent.payloadCase`/`payload` —
+ * into the discriminated {@link RecordEventPayload}. NEVER throws: unmodeled kinds and non-conforming
+ * payloads come back as the `unknown` case with the raw data preserved.
+ */
+export declare const decodeRecordEventPayload: (kind: string, ref: unknown) => RecordEventPayload;