@struktoai/mirage-node 0.0.4 → 0.0.5-alpha.1

package/dist/index.d.ts

@@ -1,19 +1,30 @@
-import { Resource, MountMode, CommandSafeguard, WorkspaceOptions, Workspace as Workspace$1, MountSpec, ExecuteOptions, ExecuteResult, ProvisionResult, Accessor, BaseResource, RegisteredOp, RegisteredCommand, PathSpec, FileStat, FindOptions, ObserverStore, NamespaceStore, NodeFields, SessionStore, SessionFields, WorkspaceStateStore, WorkspaceStateStoreOverrides, WorkspaceFields, REDACTED_SECRET, CommandOpts, FileCache, Session, OpRecord, S3Config as S3Config$1, S3ConfigRedacted as S3ConfigRedacted$1, S3Accessor, DatabricksVolumeConfig, DatabricksVolumeAccessor, DatabricksVolumeConfigRedacted, ResourceName, PgDriver, PostgresConfigResolved, PgQueryResult, PostgresAccessor, PostgresConfig, MongoDriver, EntityKind, MongoCollectionSpec, MongoFindOptions, MongoIterOptions, MongoIndexAccess, MongoDBConfigResolved, MongoDBAccessor, MongoDBConfig, LanceDriver, LanceDBConfigResolved, LanceRow, LanceDBAccessor, LanceDBConfig, SlackAccessor, DiscordAccessor, TrelloAccessor, LinearAccessor, NotionAccessor, LangfuseAccessor, GitHubAccessor, GitHubCIAccessor, GDocsAccessor, GSheetsAccessor, GSlidesAccessor, GDriveAccessor, DropboxAccessor, BoxAccessor, GoogleConfig, GmailAccessor, GoogleConfigRedacted } from '@struktoai/mirage-core';
+import * as _struktoai_mirage_core from '@struktoai/mirage-core';
+import { Resource, MountMode, MountBackend, Limit, SandboxConfig, RemoteSandbox, RuntimeOptions, RunResult, WorkspaceOptions, Workspace as Workspace$1, MountSpec, ExecuteOptions, ExecuteResult, ProvisionResult, Accessor, BaseResource, CapacityResult, RegisteredOp, RegisteredCommand, PathSpec, FileStat, FindOptions, ObserverStoreBase, ConsoleStore, Channel, ConsoleChunk, ReadResult, NamespaceStore, NodeFields, SessionStore, SessionFields, WorkspaceStateStore, WorkspaceStateStoreOverrides, ObserverStore, WorkspaceFields, REDACTED_SECRET, CommandOpts, FileCache, Session, Ops, FileTable, OpRecord, S3Config as S3Config$1, RedactedConfig, ConfigOf, z, S3Accessor, DatabricksVolumeConfig, DatabricksVolumeAccessor, DatabricksVolumeConfigRedacted, ResourceName, PgDriver, PostgresConfigResolved, PgQueryResult, PostgresAccessor, PostgresConfig, MongoDriver, EntityKind, MongoCollectionSpec, MongoFindOptions, MongoIterOptions, MongoIndexAccess, MongoDBConfigResolved, MongoDBAccessor, MongoDBConfig, LanceDriver, LanceDBConfigResolved, LanceRow, LanceDBAccessor, LanceDBConfig, SlackConfig, SlackAccessor, SlackConfigRedacted, DeltaHook, WalkEntry, DiscordConfig, DiscordAccessor, DiscordConfigRedacted, TrelloAccessor, LinearConfig, LinearAccessor, LinearConfigRedacted, NotionConfig, NotionAccessor, NotionConfigRedacted, LangfuseAccessor, JaegerAccessor, GitHubAccessor, GitHubCIAccessor, GoogleConfig, GDocsAccessor, GoogleConfigRedacted, GSheetsAccessor, GSlidesAccessor, GDriveAccessor, DropboxAccessor, BoxAccessor, GmailAccessor, GCalAccessor, CLISpec, PythonRuntime, RunArgs } from '@struktoai/mirage-core';
 export * from '@struktoai/mirage-core';
-export { GoogleConfig as GmailConfig, GoogleConfigRedacted as GmailConfigRedacted, normalizeGoogleConfig as normalizeGmailConfig, redactGoogleConfig as redactGmailConfig } from '@struktoai/mirage-core';
+export { DiscordConfig, DiscordConfigRedacted, GoogleConfig as GCalConfig, GoogleConfigRedacted as GCalConfigRedacted, GoogleConfig as GDocsConfig, GoogleConfigRedacted as GDocsConfigRedacted, GoogleConfig as GDriveConfig, GoogleConfigRedacted as GDriveConfigRedacted, GoogleConfig as GSheetsConfig, GoogleConfigRedacted as GSheetsConfigRedacted, GoogleConfig as GSlidesConfig, GoogleConfigRedacted as GSlidesConfigRedacted, GoogleConfig as GmailConfig, GoogleConfigRedacted as GmailConfigRedacted, LinearConfig, LinearConfigRedacted, Mem0Config, Mem0Resource, NotionConfig, NotionConfigRedacted, OneDriveConfig, OneDriveResource, SharePointConfig, SharePointResource, SlackConfig, SlackConfigRedacted, normalizeDiscordConfig, normalizeGoogleConfig as normalizeGCalConfig, normalizeGoogleConfig as normalizeGDocsConfig, normalizeGoogleConfig as normalizeGDriveConfig, normalizeGoogleConfig as normalizeGSheetsConfig, normalizeGoogleConfig as normalizeGSlidesConfig, normalizeGoogleConfig as normalizeGmailConfig, normalizeLinearConfig, normalizeNotionConfig, normalizeSlackConfig, redactDiscordConfig, redactGoogleConfig as redactGCalConfig, redactGoogleConfig as redactGDocsConfig, redactGoogleConfig as redactGDriveConfig, redactGoogleConfig as redactGSheetsConfig, redactGoogleConfig as redactGSlidesConfig, redactGoogleConfig as redactGmailConfig, redactLinearConfig, redactNotionConfig, redactSlackConfig } from '@struktoai/mirage-core';
 import { FileHandle } from 'node:fs/promises';
 import { RedisClientType } from 'redis';
 import { MongoClient, Db } from 'mongodb';
 import { Operator } from 'opendal';
 import { SFTPWrapper } from 'ssh2';
 import { ImapFlow } from 'imapflow';
+import * as daytonaSdk from '@daytonaio/sdk';
+import * as e2bSdk from 'e2b';
 
 interface MountSpecOptions {
     /** Per-mount mode override; falls back to the workspace default when unset. */
     mode?: MountMode;
-    /** `true` mounts at a temp dir; a string pins the mountpoint to that path. */
-    fuse?: boolean | string;
-    commandSafeguards?: Record<string, CommandSafeguard>;
+    /**
+     * How the mount is exposed. `vfs` (the default) keeps it inside mirage's
+     * own filesystem; `fuse` and `fskit` also register a real mountpoint.
+     */
+    backend?: MountBackend;
+    /**
+     * Where to mount, for the kernel backends. Omitted picks a temporary
+     * directory appropriate for the backend. Ignored when backend is `vfs`.
+     */
+    mountpoint?: string;
+    commandLimits?: Record<string, Limit>;
 }
 declare class Mount {
     readonly resource: Resource;
@@ -21,6 +32,43 @@ declare class Mount {
     constructor(resource: Resource, options?: MountSpecOptions);
 }
 
+/** How to reach the user's live Daytona sandbox. */
+interface DaytonaConfig extends SandboxConfig {
+    /**
+     * Id of a sandbox you created (dashboard, `daytona sandbox create`,
+     * or the SDK). Boot it from an image or snapshot with fuse3 and
+     * mirage installed.
+     */
+    sandboxId: string;
+    /** Daytona credential; absent reads DAYTONA_API_KEY. */
+    apiKey?: string;
+}
+declare const DAYTONA_CONFIG_KEYS: readonly string[];
+
+type DaytonaSdk = typeof daytonaSdk;
+/**
+ * A Daytona sandbox the user runs as a whole-line runtime.
+ *
+ * You create the sandbox yourself (dashboard, `daytona sandbox
+ * create`, or the SDK); mirage only connects by `sandboxId` and execs
+ * lines. `apiKey` falls back to DAYTONA_API_KEY. Daytona's exec has
+ * no stdin and reports combined output, so piped bytes are uploaded
+ * and redirected in, and stderr comes back null. close() releases the
+ * SDK client and never touches the sandbox.
+ */
+declare class DaytonaRuntime extends RemoteSandbox<DaytonaConfig> {
+    readonly name = "daytona";
+    private client;
+    private sandbox;
+    constructor(options?: RuntimeOptions<DaytonaConfig> | Record<string, unknown>);
+    protected loadSdk(): Promise<DaytonaSdk>;
+    connect(): Promise<void>;
+    execLine(line: string, stdin: Uint8Array | null, env: Record<string, string>, cwd: string): Promise<RunResult>;
+    private upload;
+    /** Release the SDK client; the sandbox itself is the user's. */
+    close(): Promise<void>;
+}
+
 type NodeWorkspaceOptions = WorkspaceOptions;
 declare class Workspace extends Workspace$1 {
     private fuseSetupPromise;
@@ -39,7 +87,7 @@ declare class Workspace extends Workspace$1 {
      * into a container and the narrowing travels with it); it is keyed
      * separately so the same prefix can also be exposed unbound.
      */
-    addFuseMount(prefix: string, mountpoint?: string, sessionId?: string): Promise<string>;
+    addFuseMount(prefix: string, mountpoint?: string, sessionId?: string, backend?: MountBackend): Promise<string>;
     removeFuseMount(prefix: string, sessionId?: string): Promise<void>;
     get fuseMountpoints(): Record<string, string>;
     get fuseMountpoint(): string | null;
@@ -71,14 +119,16 @@ interface DiskResourceState {
 declare class DiskResource extends BaseResource implements Resource {
     readonly kind: "disk";
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt = "{prefix}\n  Local disk filesystem. Mirrors the configured root directory.\n  Standard commands: ls, cat, head, tail, grep, wc, find, tree, mkdir, touch, cp, mv, rm, tee.";
     readonly root: string;
     readonly accessor: DiskAccessor;
     readonly opsMap: Record<string, unknown>;
     constructor(options: DiskResourceOptions);
+    storageId(): string;
     open(): Promise<void>;
-    close(): Promise<void>;
+    statfs(): Promise<CapacityResult>;
     ops(): readonly RegisteredOp[];
     commands(): readonly RegisteredCommand[];
     streamPath(p: PathSpec): AsyncIterable<Uint8Array>;
@@ -112,16 +162,15 @@ declare const DISK_OPS: readonly RegisteredOp[];
  * ObserverStore backed by a directory of JSONL files. Created lazily on
  * first append. Mirrors the Python DiskObserverStore.
  */
-declare class DiskObserverStore implements ObserverStore {
+declare class DiskObserverStore extends ObserverStoreBase {
     private readonly root;
     constructor(root: string);
     private abs;
     append(key: string, data: Uint8Array): Promise<void>;
     write(key: string, data: Uint8Array): Promise<void>;
-    readAll(): Promise<Map<string, Uint8Array>>;
     readMatching(suffix: string): Promise<Map<string, Uint8Array>>;
     clear(): Promise<void>;
-    close(): Promise<void>;
+    private rootIsDir;
     private walk;
 }
 
@@ -136,7 +185,7 @@ interface RedisObserverStoreOptions {
  * file keys exist so readAll needs no SCAN. Mirrors the Python
  * RedisObserverStore.
  */
-declare class RedisObserverStore implements ObserverStore {
+declare class RedisObserverStore extends ObserverStoreBase {
     readonly url: string;
     private readonly prefix;
     private readonly indexKey;
@@ -145,7 +194,6 @@ declare class RedisObserverStore implements ObserverStore {
     private client;
     append(key: string, data: Uint8Array): Promise<void>;
     write(key: string, data: Uint8Array): Promise<void>;
-    readAll(): Promise<Map<string, Uint8Array>>;
     readMatching(suffix: string): Promise<Map<string, Uint8Array>>;
     private indexedPaths;
     private readPaths;
@@ -153,6 +201,71 @@ declare class RedisObserverStore implements ObserverStore {
     close(): Promise<void>;
 }
 
+interface RedisConsoleStoreOptions {
+    url?: string;
+    keyPrefix?: string;
+    /** Expire the keys this long after the last append; absent keeps them. */
+    ttlSeconds?: number;
+}
+/**
+ * Console storage on a Redis stream, for readers in other processes.
+ *
+ * One stream per job: chunk seq maps to stream id `(seq+1)-0`, with the
+ * channel, payload and timestamp as entry fields (`c`/`d`/`t`). The
+ * job's process appends through its store instance; a reader anywhere
+ * else attaches its own instance on the same keyPrefix and follows
+ * live, which is what RAM cannot offer. The schema matches the Python
+ * RedisConsoleStore byte for byte, so the reader does not have to be
+ * the writer's language.
+ *
+ * The job owns its keys: a factory must hand every job a prefix nothing
+ * else has written, because a reused stream replays the previous job's
+ * chunks, ending chunk included. `keyPrefix` stays public because it is
+ * the console's address: an embedder reads it off a job's store and
+ * hands it to the process that should attach.
+ *
+ * The ending chunk is terminal in the store itself, not only in this
+ * process: the append script refuses any append once a CONTROL chunk
+ * landed, so an emit that raced a kill past `JobConsole`'s local guard
+ * is dropped server-side instead of landing after the ending.
+ *
+ * `wait` polls the seq counter rather than blocking server-side the way
+ * Python's XREAD BLOCK does: node-redis serializes commands on one
+ * connection, so a blocking read would wedge the job's own appends
+ * behind it, and a second connection costs more than a short poll.
+ * There is no retention trim, so readFrom never reports a truncated
+ * cursor; retention is bounded by `ttlSeconds` instead, refreshed on
+ * every append, so a console expires that long after its job's last
+ * write.
+ */
+declare class RedisConsoleStore implements ConsoleStore {
+    readonly url: string;
+    readonly keyPrefix: string;
+    private readonly streamKey;
+    private readonly counterKey;
+    private readonly endedKey;
+    private readonly ttlSeconds;
+    private clientPromise;
+    private isClosed;
+    constructor(options?: RedisConsoleStoreOptions);
+    get closed(): boolean;
+    private client;
+    /**
+     * Append one chunk, atomically against the console's ending.
+     *
+     * A dropped append (the console already ended) reports the last real
+     * chunk's seq; `JobConsole.emit` ignores the return and the drop is
+     * exactly its documented after-the-ending semantics.
+     */
+    append(channel: Channel, data: Uint8Array): Promise<ConsoleChunk>;
+    readFrom(seq: number, limit?: number): Promise<ReadResult>;
+    wait(seq: number): Promise<void>;
+    close(): Promise<void>;
+    /** Delete the console's keys (test and integ teardown only). */
+    clear(): Promise<void>;
+    private chunk;
+}
+
 /**
  * NamespaceStore backed by one `namespace.json` per workspace.
  *
@@ -253,6 +366,7 @@ declare class DiskRecordClient {
     private releaseLock;
     private writeRecord;
 }
+
 /**
  * SessionStore backed by per-session files under one directory.
  *
@@ -459,6 +573,7 @@ interface RedisResourceState {
 declare class RedisResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly url: string;
@@ -467,6 +582,7 @@ declare class RedisResource extends BaseResource implements Resource {
     readonly accessor: RedisAccessor;
     readonly opsMap: Record<string, unknown>;
     constructor(options?: RedisResourceOptions);
+    storageId(): string;
     open(): Promise<void>;
     close(): Promise<void>;
     client(): Promise<RedisClientType>;
@@ -536,6 +652,8 @@ declare class RedisFileCacheStore extends RedisResource implements FileCache {
     remove(key: string): Promise<void>;
     exists(key: string | PathSpec): Promise<boolean>;
     isFresh(key: string, remoteFingerprint: string): Promise<boolean>;
+    evictPrefix(prefix: string): Promise<void>;
+    evictPaths(_paths: Iterable<string>): void;
     clear(): Promise<void>;
     allCached(keys: readonly string[]): Promise<boolean>;
     multiGet(keys: readonly string[]): Promise<(Uint8Array | null)[]>;
@@ -568,6 +686,13 @@ interface MountOptions {
      * Mirage appends by default (see appendDirectIO).
      */
     fuseOptions?: Record<string, unknown>;
+    /**
+     * Which kernel interface serves the mount: 'fuse' (default) or 'fskit'.
+     * 'fskit' routes through macFUSE 5.x's FSKit backend (no kernel
+     * extension); macOS-only, mounts under /Volumes, and every mounted
+     * resource must report exact sizes. See backend.ts for the guards.
+     */
+    backend?: MountBackend;
 }
 declare function mount(ws: Workspace$1, options?: MountOptions): Promise<FuseHandle>;
 declare function mountBackground(ws: Workspace$1, options?: MountOptions): Promise<FuseHandle>;
@@ -591,65 +716,149 @@ interface FuseAttr {
     uid: number;
     gid: number;
 }
-interface MirageFSOptions {
+interface Handle {
+    path: string;
+    data?: Uint8Array;
+    writeBuf?: [number, Uint8Array][];
+}
+interface PrefetchEntry {
+    data: Uint8Array;
+    expires: number;
+}
+interface MountCoreOptions {
     rootPrefix?: string;
     /**
-     * Bind every FUSE op to this session's mount grants. The kernel-tier
+     * Bind every op to this session's mount grants. The kernel-tier
      * primitive: bind-mount the tree into a container and the narrowing
      * travels with it. Enforcement happens inside dispatch/Ops via the
      * session context, so binding at the op entry point is sufficient.
      */
     session?: Session;
 }
-declare class MirageFS {
-    private readonly ws;
+/**
+ * Protocol-neutral mount logic shared by every kernel adapter.
+ *
+ * Everything here is expressed in POSIX terms (attribute records, ordinary
+ * thrown errors) and imports nothing from `@zkochan/fuse-native`, so it is
+ * reusable by a non-FUSE adapter and unit-testable without a kernel.
+ *
+ * The division of labour: this class decides *what* the filesystem
+ * contains, an adapter decides *how* to say it to a particular kernel
+ * interface. Adapters translate the errors thrown here into their own
+ * error codes with `classifyErrno`. Mirrors Python's `MountCore`.
+ *
+ * Every op goes through `ws.fs`, which delegates to the dispatcher, so
+ * a mount walks the same door as a shell line (mount modes, policies,
+ * cache, invalidation) and every op it runs lands in `ws.records` for
+ * `drainOps`. Reaching `ws.dispatch` from here instead would skip the
+ * record; reaching a backend directly would skip the door.
+ */
+declare class MountCore {
+    readonly ops: Ops;
+    readonly session: Session | null;
     private readonly now;
     private readonly root;
-    private readonly prefixes;
-    private readonly handles;
-    private readonly xattrs;
-    private readonly prefetchCache;
+    readonly handles: FileTable<Handle>;
+    readonly xattrs: Map<string, Map<string, Buffer<ArrayBufferLike>>>;
+    readonly prefetchCache: Map<string, PrefetchEntry>;
     private readonly prefetchInflight;
-    private nextFh;
     private readonly uid;
     private readonly gid;
-    private readonly session;
-    constructor(ws: Workspace$1, options?: MirageFSOptions);
-    private resolve;
-    private dirStat;
-    private fileStat;
+    constructor(ops: Ops, options?: MountCoreOptions);
+    resolve(path: string): string;
+    dirStat(): FuseAttr;
+    fileStat(size: number): FuseAttr;
     /**
-     * Fold merged stat attributes into a FUSE attr. The workspace stat
+     * Fold merged stat attributes into an attr record. The workspace stat
      * already carries the namespace overlay (chmod bits, chown ids, touched
      * mtime), so honoring these fields here is what makes metadata ops
-     * visible over FUSE. String uid/gid (names) are skipped: FUSE wants
-     * numeric ids and there is no user db to map against.
+     * visible through a mount. String uid/gid (names) are skipped: the kernel
+     * wants numeric ids and there is no user db to map against.
      */
-    private applyStatAttrs;
+    applyStatAttrs(entry: FuseAttr, s: FileStat): FuseAttr;
     /**
-     * The target to present for a namespace link at a FUSE path, or null
+     * The target to present for a namespace link at a mount path, or null
      * when not a link. Relative targets are stored verbatim and returned
      * as-is. Absolute targets name virtual paths, so they are rewritten
      * relative to the link's directory: returned raw, the kernel would
      * resolve them against the host root and escape the mountpoint.
      */
-    private linkTarget;
-    private linkStat;
-    private isVirtualDir;
-    private virtualChildren;
-    private cachedSize;
-    private cachedData;
+    linkTarget(path: string): string | null;
+    linkStat(target: string): FuseAttr;
+    cachedSize(path: string): number | null;
+    cachedData(path: string): Uint8Array | null;
     /**
      * Fetch bytes for a size-unknown file and cache them so the open → read →
      * fstat burst (and subsequent stats within the TTL) reuse the same fetch.
      * With getattr reporting 0 pre-open, this hydration is what lets fgetattr
      * answer with the real byte length after open (mirrors Python's
-     * `_prefetch_read`).
+     * `prefetch_read`).
      */
-    private prefetch;
-    /** Drain and return accumulated op records (mirrors Python's drain_ops). */
+    prefetch(path: string): Promise<Uint8Array | null>;
+    /** Drain and return accumulated op records (mirrors Python's drainOps). */
     drainOps(): OpRecord[];
     private writeFile;
+    /**
+     * Merge buffered writes over the raw base and persist the result.
+     * The base is read raw so a flush never stores a rendered view back
+     * into the mount.
+     */
+    private applyWrites;
+    getattr(path: string): Promise<FuseAttr>;
+    /** Attributes through an open handle, or path-based when not hydrated. */
+    fgetattr(path: string, fd: number): Promise<FuseAttr>;
+    readdir(path: string): Promise<string[]>;
+    read(path: string, fd: number, pos: number, len: number): Promise<Uint8Array>;
+    /** Buffer a write on its handle, or apply it directly when there is none. */
+    write(path: string, fd: number, data: Uint8Array, pos: number): Promise<void>;
+    create(path: string): Promise<number>;
+    mkdir(path: string): Promise<void>;
+    readlink(path: string): string;
+    /**
+     * Create namespace link `dest -> src` (ln -s src dest; libfuse passes
+     * the pointee first). Relative sources are stored verbatim (resolved
+     * at follow time, exactly like the shell `ln -s`); absolute sources
+     * are mapped into virtual space so a scoped mount stores the path it
+     * will later follow.
+     */
+    symlink(src: string, dest: string): Promise<void>;
+    unlink(path: string): Promise<void>;
+    rename(src: string, dst: string): Promise<void>;
+    rmdir(path: string): Promise<void>;
+    truncate(path: string, size: number): Promise<void>;
+    statfs(): Record<string, number>;
+    setxattr(path: string, name: string, value: Buffer): void;
+    getxattr(path: string, name: string): Buffer | undefined;
+    listxattr(path: string): string[];
+    removexattr(path: string, name: string): void;
+    open(path: string): Promise<number>;
+    release(fd: number): Promise<void>;
+    flush(path: string, fd: number): Promise<void>;
+}
+
+interface MirageFSOptions {
+    rootPrefix?: string;
+    /**
+     * Bind every FUSE op to this session's mount grants. The kernel-tier
+     * primitive: bind-mount the tree into a container and the narrowing
+     * travels with it. Enforcement happens inside dispatch/Ops via the
+     * session context, so binding at the op entry point is sufficient.
+     */
+    session?: Session;
+}
+/**
+ * libfuse adapter over MountCore.
+ *
+ * Owns exactly the FUSE-specific concerns: the `@zkochan/fuse-native`
+ * callback signatures and the translation of mirage-native errors into
+ * negative errno codes. All filesystem semantics live in MountCore, so a
+ * non-FUSE adapter can reuse them unchanged. Mirrors Python's `MirageFS`.
+ */
+declare class MirageFS {
+    readonly core: MountCore;
+    constructor(ops: Ops, options?: MirageFSOptions);
+    /** Drain and return accumulated op records (mirrors Python's drainOps). */
+    drainOps(): OpRecord[];
     ops(): Record<string, unknown>;
     private getattr;
     private fgetattr;
@@ -659,13 +868,6 @@ declare class MirageFS {
     private create;
     private mkdir;
     private readlink;
-    /**
-     * Create namespace link `dest -> src` (ln -s src dest; libfuse passes
-     * the pointee first). Relative sources are stored verbatim (resolved
-     * at follow time, exactly like the shell `ln -s`); absolute sources
-     * are mapped into virtual space so a scoped mount stores the path it
-     * will later follow.
-     */
     private symlink;
     private unlink;
     private rename;
@@ -680,22 +882,123 @@ declare class MirageFS {
     private getxattr;
     private listxattr;
     private removexattr;
-    private getattrValidate;
+    private validate;
     private open;
     private release;
     private flush;
     private fsync;
 }
 
+/**
+ * Map a mirage-native error onto a positive POSIX errno.
+ *
+ * Mirrors Python's `mirage.fuse.errors.classify_error` so both languages
+ * report the same errno for the same backend failure. The naming lives in
+ * core's `classify` (shared with the wasi shim and the monty encoders);
+ * this adapter only renders the condition in host numbers. A stamped code
+ * outside the vocabulary is passed through in the host's own numbering
+ * (Python's raw OSError.errno passthrough), and the message needles are a
+ * last resort for unstamped errors, not a classification channel.
+ */
+declare function classifyErrno(err: unknown): number;
+/** Same classification, negated for `@zkochan/fuse-native` callbacks. */
+declare function classifyError(err: unknown): number;
+
+/**
+ * FSKit mounts only under /Volumes. Anywhere else the mount fails with an
+ * opaque driver error, so the rule is enforced up front rather than
+ * discovered at run time (github.com/strukto-ai/mirage#82).
+ */
+declare const FSKIT_MOUNT_ROOT = "/Volumes";
+/**
+ * Coerce a user-supplied backend name into a MountBackend.
+ *
+ * Missing means vfs, everywhere: an absent `backend` in YAML, `undefined`
+ * here, and the `MountSpecOptions` default all resolve to the same thing.
+ * Callers that need a kernel mount say so explicitly rather than relying on
+ * this function to reinterpret an absent value.
+ */
+declare function resolveBackend(value?: string | null): MountBackend;
+/** Reject a backend that registers nothing with the kernel. */
+declare function requireKernelBackend(backend: MountBackend): void;
+/**
+ * Reject a backend the current platform cannot serve.
+ *
+ * FSKit works from TypeScript: `fuse.node` links `/usr/local/lib/
+ * libfuse.2.dylib` by absolute path (the `libosxfuse.2.dylib` it ships is a
+ * stub with that install name), so on a machine with macFUSE 5.x the
+ * `backend=fskit` option reaches the same libfuse Python uses. Verified
+ * with a live mount; see examples/typescript/fuse/fskit.ts.
+ */
+declare function checkPlatform(backend: MountBackend): void;
+/** Reject a mountpoint the backend cannot mount on. */
+declare function checkMountpoint(backend: MountBackend, mountpoint: string): void;
+/**
+ * Mounts under `rootPrefix` whose files cannot be sized without reading
+ * them. Mirrors Python's `Ops.unsized_mounts`.
+ */
+declare function unsizedMounts(ws: Workspace$1, rootPrefix?: string): [string, string][];
+/**
+ * Warn when an fskit mount will serve size-unknown files as empty.
+ *
+ * FSKit drives reads from the size the filesystem reports and has no
+ * `direct_io` escape hatch, so a resource that cannot size a file without
+ * fetching it reports 0, the kernel issues no reads, and every such file
+ * comes back empty with exit code 0 (verified on a live fskit mount: the
+ * read clamp is pinned at lookup-time size and never refreshed). The mount
+ * proceeds anyway: per-backend size push-down is closing this gap, so the
+ * degraded mounts are named loudly here rather than refused.
+ */
+declare function checkSizes(backend: MountBackend, ws: Workspace$1, rootPrefix?: string): void;
+/**
+ * Resolve a backend for a kernel mount and run every guard it implies.
+ *
+ * One entry point, so a new mount path cannot pick up fskit support while
+ * silently skipping the macOS, /Volumes, or size checks.
+ */
+declare function prepareBackend(value: string | undefined, ws?: Workspace$1, mountpoint?: string, rootPrefix?: string): MountBackend;
+
 declare function isMacosMetadata(name: string): boolean;
 
 interface S3Config extends S3Config$1 {
     profile?: string;
-}
-interface S3ConfigRedacted extends S3ConfigRedacted$1 {
-    profile?: string;
-}
+    proxy?: string;
+}
+declare const S3ConfigSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    region: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodOptional<z.ZodString>;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    presignedUrlProvider: z.ZodOptional<z.ZodCustom<_struktoai_mirage_core.S3BrowserPresignedUrlProvider, _struktoai_mirage_core.S3BrowserPresignedUrlProvider>>;
+    httpAgentProvider: z.ZodOptional<z.ZodCustom<_struktoai_mirage_core.S3HttpAgentProvider, _struktoai_mirage_core.S3HttpAgentProvider>>;
+    defaultContentType: z.ZodOptional<z.ZodString>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodString>;
+    proxy: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type S3ConfigRedacted = RedactedConfig<ConfigOf<typeof S3ConfigSchema>, 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'presignedUrlProvider' | 'httpAgentProvider' | 'proxy'>;
 declare function redactConfig(config: S3Config): S3ConfigRedacted;
+/**
+ * Translate Python-style snake_case keys (as used in YAML configs and the
+ * Python `S3Config`) to the TS-idiomatic camelCase fields. Already-camelCase
+ * keys pass through unchanged so user code that constructs `S3Config`
+ * directly keeps working.
+ *
+ * Python ↔ TS mapping:
+ *   aws_access_key_id     ↔ accessKeyId
+ *   aws_secret_access_key ↔ secretAccessKey
+ *   aws_session_token     ↔ sessionToken
+ *   aws_profile           ↔ profile
+ *   endpoint_url          ↔ endpoint
+ *   path_style            ↔ forcePathStyle
+ *   timeout (sec, int)    ↔ timeoutMs (ms, number — converted ×1000)
+ *   proxy                 ↔ proxy
+ */
+declare function normalizeS3Config(input: Record<string, unknown>): S3Config;
 
 interface S3ResourceState {
     type: string;
@@ -705,14 +1008,15 @@ declare class S3Resource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
     readonly supportsSnapshot: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly config: S3Config;
     readonly accessor: S3Accessor;
     readonly opsMap: Record<string, unknown>;
     constructor(config: S3Config);
+    storageId(): string;
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     streamPath(p: PathSpec): AsyncIterable<Uint8Array>;
@@ -736,16 +1040,15 @@ declare class S3Resource extends BaseResource implements Resource {
     loadState(_state: S3ResourceState): Promise<void>;
 }
 
-interface GridFSConfig {
-    uri: string;
-    database: string;
-    bucket?: string;
-    keyPrefix?: string;
-    chunkSizeBytes?: number;
-}
-interface GridFSConfigRedacted extends Omit<GridFSConfig, 'uri'> {
-    uri?: string;
-}
+declare const GridFSConfigSchema: z.ZodObject<{
+    uri: z.ZodString;
+    database: z.ZodString;
+    bucket: z.ZodOptional<z.ZodString>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    chunkSizeBytes: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+type GridFSConfig = ConfigOf<typeof GridFSConfigSchema>;
+type GridFSConfigRedacted = RedactedConfig<GridFSConfig, 'uri'>;
 /**
  * Translate Python-style snake_case keys (as used in YAML configs and the
  * Python `GridFSConfig`) to the TS-idiomatic camelCase fields, and
@@ -771,6 +1074,7 @@ declare class GridFSResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
     readonly supportsSnapshot: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly config: GridFSConfig;
@@ -809,6 +1113,7 @@ interface DatabricksVolumeResourceState {
 declare class DatabricksVolumeResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly config: DatabricksVolumeConfig;
@@ -817,7 +1122,6 @@ declare class DatabricksVolumeResource extends BaseResource implements Resource
     private constructor();
     static create(config: DatabricksVolumeConfig): Promise<DatabricksVolumeResource>;
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     streamPath(p: PathSpec): AsyncIterable<Uint8Array>;
@@ -849,24 +1153,31 @@ declare function loadDatabricksProfile(profile: string): Promise<DatabricksProfi
 declare const GCS_ENDPOINT = "https://storage.googleapis.com";
 interface GCSConfig {
     bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    profile?: string;
     endpoint?: string;
     region?: string;
     timeoutMs?: number;
     forcePathStyle?: boolean;
     keyPrefix?: string;
-}
-interface GCSConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    endpoint: string;
-    region: string;
-    timeoutMs?: number;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-}
+    proxy?: string;
+}
+declare const GCSConfigSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodString;
+    region: z.ZodString;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    proxy: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type GCSConfigRedacted = RedactedConfig<ConfigOf<typeof GCSConfigSchema>, 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'proxy'>;
 declare function redactGcsConfig(config: GCSConfig): GCSConfigRedacted;
 
 interface GCSResourceState {
@@ -886,28 +1197,35 @@ declare class GCSResource extends S3Resource {
     loadState(_state: GCSResourceState): Promise<void>;
 }
 
-declare const GCS_PROMPT = "{prefix}\n  Remote Google Cloud Storage bucket.\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const GCS_PROMPT = "{prefix}\n  Remote Google Cloud Storage bucket.\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
 interface OCIConfig {
     bucket: string;
     namespace: string;
     region: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    profile?: string;
     endpoint?: string;
     keyPrefix?: string;
     timeoutMs?: number;
-}
-interface OCIConfigRedacted {
-    bucket: string;
-    namespace: string;
-    region: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    endpoint: string;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
+    proxy?: string;
+}
+declare const OCIConfigSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    namespace: z.ZodString;
+    region: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodString;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    proxy: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type OCIConfigRedacted = RedactedConfig<ConfigOf<typeof OCIConfigSchema>, 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'proxy'>;
 declare function redactOciConfig(config: OCIConfig): OCIConfigRedacted;
 
 interface OCIResourceState {
@@ -931,8 +1249,9 @@ declare const OCI_PROMPT = "{prefix}\n  Remote Oracle Cloud Object Storage.\n  I
 
 interface R2Config {
     bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
     accountId?: string;
     endpoint?: string;
     region?: string;
@@ -940,19 +1259,23 @@ interface R2Config {
     forcePathStyle?: boolean;
     keyPrefix?: string;
     timeoutMs?: number;
-}
-interface R2ConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    accountId?: string;
-    endpoint: string;
-    region: string;
-    profile?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
+    proxy?: string;
+}
+declare const R2ConfigSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodString;
+    region: z.ZodString;
+    profile: z.ZodOptional<z.ZodString>;
+    forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    proxy: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type R2ConfigRedacted = RedactedConfig<ConfigOf<typeof R2ConfigSchema>, 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'proxy'>;
 declare function redactR2Config(config: R2Config): R2ConfigRedacted;
 
 interface R2ResourceState {
@@ -972,30 +1295,35 @@ declare class R2Resource extends S3Resource {
     loadState(_state: R2ResourceState): Promise<void>;
 }
 
-declare const R2_PROMPT = "{prefix}\n  Remote Cloudflare R2 bucket.\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const R2_PROMPT = "{prefix}\n  Remote Cloudflare R2 bucket.\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
 interface SupabaseConfig {
     bucket: string;
     region: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
     projectRef?: string;
     endpoint?: string;
     sessionToken?: string;
+    profile?: string;
     keyPrefix?: string;
     timeoutMs?: number;
-}
-interface SupabaseConfigRedacted {
-    bucket: string;
-    region: string;
-    projectRef?: string;
-    endpoint: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken?: string;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
+    proxy?: string;
+}
+declare const SupabaseConfigSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    region: z.ZodString;
+    projectRef: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodString>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    proxy: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type SupabaseConfigRedacted = RedactedConfig<ConfigOf<typeof SupabaseConfigSchema>, 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'proxy'>;
 declare function resolvedSupabaseEndpoint(config: SupabaseConfig): string;
 declare function redactSupabaseConfig(config: SupabaseConfig): SupabaseConfigRedacted;
 
@@ -1027,13 +1355,14 @@ interface HfBucketsConfig {
     timeoutMs?: number;
     keyPrefix?: string;
 }
-interface HfBucketsConfigRedacted {
-    bucket: string;
-    token?: string;
-    endpoint: string;
-    timeoutMs?: number;
-    keyPrefix?: string;
-}
+declare const HfBucketsConfigSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodString;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type HfBucketsConfigRedacted = RedactedConfig<ConfigOf<typeof HfBucketsConfigSchema>, 'token'>;
 declare function redactHfBucketsConfig(config: HfBucketsConfig): HfBucketsConfigRedacted;
 declare function normalizeHfBucketsConfig(input: Record<string, unknown>): HfBucketsConfig;
 interface HfRepoConfig {
@@ -1044,14 +1373,15 @@ interface HfRepoConfig {
     keyPrefix?: string;
     revision?: string;
 }
-interface HfRepoConfigRedacted {
-    repoId: string;
-    token?: string;
-    endpoint: string;
-    timeoutMs?: number;
-    keyPrefix?: string;
-    revision?: string;
-}
+declare const HfRepoConfigSchema: z.ZodObject<{
+    repoId: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+    endpoint: z.ZodString;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    revision: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type HfRepoConfigRedacted = RedactedConfig<ConfigOf<typeof HfRepoConfigSchema>, 'token'>;
 declare function redactHfRepoConfig(config: HfRepoConfig): HfRepoConfigRedacted;
 declare function normalizeHfRepoConfig(input: Record<string, unknown>): HfRepoConfig;
 
@@ -1094,10 +1424,10 @@ declare abstract class HfResource extends BaseResource implements Resource {
     abstract readonly prompt: string;
     abstract readonly accessor: HfAccessor;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly supportsSnapshot: boolean;
     readonly opsMap: Record<string, unknown>;
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     streamPath(p: PathSpec): AsyncIterable<Uint8Array>;
@@ -1183,27 +1513,56 @@ declare const HF_COMMANDS: readonly RegisteredCommand[];
 
 declare const HF_OPS: readonly RegisteredOp[];
 
-interface MinIOConfig {
+/**
+ * Shared shape for the S3-compatible providers.
+ *
+ * Every alias is the same credentials plus one endpoint rule, so the
+ * fields, the zod schema that drives redaction, the snake_case mapping and
+ * the conversion to S3Config live here once. A provider declares only its
+ * endpoint rule and whatever it genuinely adds. Mirrors Python's
+ * `mirage/resource/s3_alias.py`.
+ *
+ * Only `bucket` and whatever the endpoint genuinely needs are required.
+ * Credentials are optional because `S3Config` leaves them optional too, so
+ * omitting them falls through to the usual AWS resolution order: `profile`,
+ * then the `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` environment
+ * variables, then the shared credentials file, then an instance role.
+ * `sessionToken` and `profile` live here rather than on the one provider
+ * that first needed them, so every alias accepts them.
+ */
+interface S3AliasConfig {
     bucket: string;
-    endpoint: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    profile?: string;
     region?: string;
+    endpoint?: string;
     forcePathStyle?: boolean;
     keyPrefix?: string;
     timeoutMs?: number;
-}
-interface MinIOConfigRedacted {
-    bucket: string;
+    proxy?: string;
+}
+declare const ALIAS_SCHEMA: z.ZodObject<{
+    bucket: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodString>;
+    region: z.ZodString;
+    endpoint: z.ZodString;
+    forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    proxy: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type S3AliasConfigRedacted = RedactedConfig<ConfigOf<typeof ALIAS_SCHEMA>, 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'proxy'>;
+
+interface MinIOConfig extends S3AliasConfig {
     endpoint: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    forcePathStyle: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-declare function redactMinIOConfig(config: MinIOConfig): MinIOConfigRedacted;
+type MinIOConfigRedacted = S3AliasConfigRedacted;
+declare const redactMinIOConfig: (config: MinIOConfig) => S3AliasConfigRedacted;
 
 interface MinIOResourceState {
     type: string;
@@ -1222,29 +1581,13 @@ declare class MinIOResource extends S3Resource {
     loadState(_state: MinIOResourceState): Promise<void>;
 }
 
-declare const MINIO_PROMPT = "{prefix}\n  Remote MinIO bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const MINIO_PROMPT = "{prefix}\n  Remote MinIO bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface SeaweedFSConfig {
-    bucket: string;
+interface SeaweedFSConfig extends S3AliasConfig {
     endpoint: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-interface SeaweedFSConfigRedacted {
-    bucket: string;
-    endpoint: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    forcePathStyle: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-declare function redactSeaweedFSConfig(config: SeaweedFSConfig): SeaweedFSConfigRedacted;
+type SeaweedFSConfigRedacted = S3AliasConfigRedacted;
+declare const redactSeaweedFSConfig: (config: SeaweedFSConfig) => S3AliasConfigRedacted;
 
 interface SeaweedFSResourceState {
     type: string;
@@ -1263,29 +1606,13 @@ declare class SeaweedFSResource extends S3Resource {
     loadState(_state: SeaweedFSResourceState): Promise<void>;
 }
 
-declare const SEAWEEDFS_PROMPT = "{prefix}\n  Remote SeaweedFS bucket (S3-compatible gateway).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.feather returns a formatted table.";
+declare const SEAWEEDFS_PROMPT = "{prefix}\n  Remote SeaweedFS bucket (S3-compatible gateway).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface CephConfig {
-    bucket: string;
-    endpoint: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-interface CephConfigRedacted {
-    bucket: string;
+interface CephConfig extends S3AliasConfig {
     endpoint: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    forcePathStyle: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-declare function redactCephConfig(config: CephConfig): CephConfigRedacted;
+type CephConfigRedacted = S3AliasConfigRedacted;
+declare const redactCephConfig: (config: CephConfig) => S3AliasConfigRedacted;
 
 interface CephResourceState {
     type: string;
@@ -1304,28 +1631,35 @@ declare class CephResource extends S3Resource {
     loadState(_state: CephResourceState): Promise<void>;
 }
 
-declare const CEPH_PROMPT = "{prefix}\n  Remote Ceph Rados Gateway bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const CEPH_PROMPT = "{prefix}\n  Remote Ceph Rados Gateway bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
 interface WasabiConfig {
     bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    profile?: string;
     region?: string;
     endpoint?: string;
     forcePathStyle?: boolean;
     keyPrefix?: string;
     timeoutMs?: number;
-}
-interface WasabiConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    endpoint: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
+    proxy?: string;
+}
+declare const WasabiConfigSchema: z.ZodObject<{
+    bucket: z.ZodString;
+    accessKeyId: z.ZodOptional<z.ZodString>;
+    secretAccessKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    profile: z.ZodOptional<z.ZodString>;
+    region: z.ZodString;
+    endpoint: z.ZodString;
+    forcePathStyle: z.ZodOptional<z.ZodBoolean>;
+    keyPrefix: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    proxy: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type WasabiConfigRedacted = RedactedConfig<ConfigOf<typeof WasabiConfigSchema>, 'accessKeyId' | 'secretAccessKey' | 'sessionToken' | 'proxy'>;
 declare function resolvedWasabiEndpoint(config: WasabiConfig): string;
 declare function redactWasabiConfig(config: WasabiConfig): WasabiConfigRedacted;
 
@@ -1346,30 +1680,14 @@ declare class WasabiResource extends S3Resource {
     loadState(_state: WasabiResourceState): Promise<void>;
 }
 
-declare const WASABI_PROMPT = "{prefix}\n  Remote Wasabi bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const WASABI_PROMPT = "{prefix}\n  Remote Wasabi bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface BackblazeConfig {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+interface BackblazeConfig extends S3AliasConfig {
     region: string;
-    endpoint?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-interface BackblazeConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    endpoint: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-declare function resolvedBackblazeEndpoint(config: BackblazeConfig): string;
-declare function redactBackblazeConfig(config: BackblazeConfig): BackblazeConfigRedacted;
+type BackblazeConfigRedacted = S3AliasConfigRedacted;
+declare const resolvedBackblazeEndpoint: (config: BackblazeConfig) => string;
+declare const redactBackblazeConfig: (config: BackblazeConfig) => S3AliasConfigRedacted;
 
 interface BackblazeResourceState {
     type: string;
@@ -1388,30 +1706,14 @@ declare class BackblazeResource extends S3Resource {
     loadState(_state: BackblazeResourceState): Promise<void>;
 }
 
-declare const BACKBLAZE_PROMPT = "{prefix}\n  Remote Backblaze B2 bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const BACKBLAZE_PROMPT = "{prefix}\n  Remote Backblaze B2 bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface DigitalOceanConfig {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+interface DigitalOceanConfig extends S3AliasConfig {
     region: string;
-    endpoint?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-interface DigitalOceanConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    endpoint: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-declare function resolvedDigitalOceanEndpoint(config: DigitalOceanConfig): string;
-declare function redactDigitalOceanConfig(config: DigitalOceanConfig): DigitalOceanConfigRedacted;
+type DigitalOceanConfigRedacted = S3AliasConfigRedacted;
+declare const resolvedDigitalOceanEndpoint: (config: DigitalOceanConfig) => string;
+declare const redactDigitalOceanConfig: (config: DigitalOceanConfig) => S3AliasConfigRedacted;
 
 interface DigitalOceanResourceState {
     type: string;
@@ -1430,30 +1732,14 @@ declare class DigitalOceanResource extends S3Resource {
     loadState(_state: DigitalOceanResourceState): Promise<void>;
 }
 
-declare const DIGITALOCEAN_PROMPT = "{prefix}\n  Remote DigitalOcean Spaces bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const DIGITALOCEAN_PROMPT = "{prefix}\n  Remote DigitalOcean Spaces bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface TencentConfig {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    endpoint?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-interface TencentConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+interface TencentConfig extends S3AliasConfig {
     region: string;
-    endpoint: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-declare function resolvedTencentEndpoint(config: TencentConfig): string;
-declare function redactTencentConfig(config: TencentConfig): TencentConfigRedacted;
+type TencentConfigRedacted = S3AliasConfigRedacted;
+declare const resolvedTencentEndpoint: (config: TencentConfig) => string;
+declare const redactTencentConfig: (config: TencentConfig) => S3AliasConfigRedacted;
 
 interface TencentResourceState {
     type: string;
@@ -1472,30 +1758,14 @@ declare class TencentResource extends S3Resource {
     loadState(_state: TencentResourceState): Promise<void>;
 }
 
-declare const TENCENT_PROMPT = "{prefix}\n  Remote Tencent Cloud COS bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const TENCENT_PROMPT = "{prefix}\n  Remote Tencent Cloud COS bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface AliyunConfig {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+interface AliyunConfig extends S3AliasConfig {
     region: string;
-    endpoint?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-interface AliyunConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    endpoint: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-declare function resolvedAliyunEndpoint(config: AliyunConfig): string;
-declare function redactAliyunConfig(config: AliyunConfig): AliyunConfigRedacted;
+type AliyunConfigRedacted = S3AliasConfigRedacted;
+declare const resolvedAliyunEndpoint: (config: AliyunConfig) => string;
+declare const redactAliyunConfig: (config: AliyunConfig) => S3AliasConfigRedacted;
 
 interface AliyunResourceState {
     type: string;
@@ -1514,30 +1784,14 @@ declare class AliyunResource extends S3Resource {
     loadState(_state: AliyunResourceState): Promise<void>;
 }
 
-declare const ALIYUN_PROMPT = "{prefix}\n  Remote Alibaba Cloud OSS bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const ALIYUN_PROMPT = "{prefix}\n  Remote Alibaba Cloud OSS bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface ScalewayConfig {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+interface ScalewayConfig extends S3AliasConfig {
     region: string;
-    endpoint?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-interface ScalewayConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    endpoint: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-declare function resolvedScalewayEndpoint(config: ScalewayConfig): string;
-declare function redactScalewayConfig(config: ScalewayConfig): ScalewayConfigRedacted;
+type ScalewayConfigRedacted = S3AliasConfigRedacted;
+declare const resolvedScalewayEndpoint: (config: ScalewayConfig) => string;
+declare const redactScalewayConfig: (config: ScalewayConfig) => S3AliasConfigRedacted;
 
 interface ScalewayResourceState {
     type: string;
@@ -1556,30 +1810,14 @@ declare class ScalewayResource extends S3Resource {
     loadState(_state: ScalewayResourceState): Promise<void>;
 }
 
-declare const SCALEWAY_PROMPT = "{prefix}\n  Remote Scaleway Object Storage bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const SCALEWAY_PROMPT = "{prefix}\n  Remote Scaleway Object Storage bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
-interface QingStorConfig {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
+interface QingStorConfig extends S3AliasConfig {
     region: string;
-    endpoint?: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
-}
-interface QingStorConfigRedacted {
-    bucket: string;
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    endpoint: string;
-    forcePathStyle?: boolean;
-    keyPrefix?: string;
-    timeoutMs?: number;
 }
-declare function resolvedQingStorEndpoint(config: QingStorConfig): string;
-declare function redactQingStorConfig(config: QingStorConfig): QingStorConfigRedacted;
+type QingStorConfigRedacted = S3AliasConfigRedacted;
+declare const resolvedQingStorEndpoint: (config: QingStorConfig) => string;
+declare const redactQingStorConfig: (config: QingStorConfig) => S3AliasConfigRedacted;
 
 interface QingStorResourceState {
     type: string;
@@ -1598,7 +1836,7 @@ declare class QingStorResource extends S3Resource {
     loadState(_state: QingStorResourceState): Promise<void>;
 }
 
-declare const QINGSTOR_PROMPT = "{prefix}\n  Remote QingStor bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.\n  cat on .parquet/.orc/.feather returns a formatted table.";
+declare const QINGSTOR_PROMPT = "{prefix}\n  Remote QingStor bucket (S3-compatible).\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, jq, stat.";
 
 interface PgPoolLike {
     query: (sql: string, params?: readonly unknown[]) => Promise<{
@@ -1741,6 +1979,7 @@ declare class LanceDBStore implements LanceDriver {
     private table;
     listTables(): Promise<string[]>;
     distinct(table: string, column: string, filters: Record<string, string>, limit: number): Promise<string[]>;
+    tableColumns(table: string): Promise<string[]>;
     rowsMatching(table: string, filters: Record<string, string>, columns: string[], limit: number): Promise<LanceRow[]>;
     rowRecord(table: string, idColumn: string, rowId: string): Promise<LanceRow | null>;
     search(table: string, query: string, limit: number): Promise<LanceRow[]>;
@@ -1753,6 +1992,7 @@ interface LanceDBResourceOptions {
 declare class LanceDBResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly config: LanceDBConfigResolved;
@@ -1768,19 +2008,6 @@ declare class LanceDBResource extends BaseResource implements Resource {
     stat(p: PathSpec): Promise<FileStat>;
 }
 
-interface SlackConfig {
-    token: string;
-    searchToken?: string;
-    baseUrl?: string;
-}
-interface SlackConfigRedacted {
-    token: '<REDACTED>';
-    searchToken?: '<REDACTED>';
-    baseUrl?: string;
-}
-declare function redactSlackConfig(config: SlackConfig): SlackConfigRedacted;
-declare function normalizeSlackConfig(input: Record<string, unknown>): SlackConfig;
-
 interface SlackResourceState {
     type: string;
     config: SlackConfigRedacted;
@@ -1788,6 +2015,7 @@ interface SlackResourceState {
 declare class SlackResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly writePrompt: string;
@@ -1795,7 +2023,6 @@ declare class SlackResource extends BaseResource implements Resource {
     readonly accessor: SlackAccessor;
     constructor(config: SlackConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -1806,30 +2033,20 @@ declare class SlackResource extends BaseResource implements Resource {
     loadState(_state: SlackResourceState): Promise<void>;
 }
 
-interface SSHConfig {
-    host: string;
-    hostname?: string;
-    port?: number;
-    username?: string;
-    password?: string;
-    identityFile?: string;
-    passphrase?: string;
-    root?: string;
-    timeout?: number;
-    knownHosts?: string;
-}
-interface SSHConfigRedacted {
-    host: string;
-    hostname?: string;
-    port?: number;
-    username?: string;
-    password?: '<REDACTED>';
-    identityFile?: string;
-    passphrase?: '<REDACTED>';
-    root?: string;
-    timeout?: number;
-    knownHosts?: string;
-}
+declare const SSHConfigSchema: z.ZodObject<{
+    host: z.ZodString;
+    hostname: z.ZodOptional<z.ZodString>;
+    port: z.ZodOptional<z.ZodNumber>;
+    username: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+    identityFile: z.ZodOptional<z.ZodString>;
+    passphrase: z.ZodOptional<z.ZodString>;
+    root: z.ZodOptional<z.ZodString>;
+    timeout: z.ZodOptional<z.ZodNumber>;
+    knownHosts: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type SSHConfig = ConfigOf<typeof SSHConfigSchema>;
+type SSHConfigRedacted = RedactedConfig<SSHConfig, 'password' | 'passphrase'>;
 declare function redactSshConfig(config: SSHConfig): SSHConfigRedacted;
 declare function normalizeSshConfig(input: Record<string, unknown>): SSHConfig;
 
@@ -1851,6 +2068,7 @@ interface SSHResourceState {
 declare class SSHResource extends BaseResource implements Resource {
     readonly kind: "ssh";
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt = "{prefix}\n  Remote filesystem via SSH/SFTP.\n  IMPORTANT: This is a remote mount. Prefer targeted reads over full scans.\n  Supports: ls, cat, head, tail, grep, rg, wc, find, tree, stat, mkdir, touch, cp, mv, rm, tee.";
     readonly config: SSHConfig;
@@ -1897,9 +2115,7 @@ interface NextcloudConfig {
     verifySsl?: boolean;
     timeout?: number;
 }
-interface NextcloudConfigRedacted extends Omit<NextcloudConfig, 'password'> {
-    password?: '<REDACTED>';
-}
+type NextcloudConfigRedacted = RedactedConfig<NextcloudConfig, 'password'>;
 declare function normalizeNextcloudConfig(config: Record<string, unknown>): NextcloudConfig;
 declare function redactNextcloudConfig(config: NextcloudConfig): NextcloudConfigRedacted;
 
@@ -1920,13 +2136,13 @@ declare class NextcloudResource extends BaseResource implements Resource {
     readonly config: NextcloudConfig;
     readonly kind: "nextcloud";
     readonly cachesReads = true;
+    readonly sizesAlwaysKnown: boolean;
     readonly supportsSnapshot = true;
     readonly prompt = "You have access to files stored in Nextcloud.";
     readonly accessor: NextcloudAccessor;
     readonly opsMap: Record<string, unknown>;
     constructor(config: NextcloudConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     streamPath(path: PathSpec): AsyncIterable<Uint8Array>;
@@ -1946,6 +2162,7 @@ declare class NextcloudResource extends BaseResource implements Resource {
     du(path: PathSpec): Promise<number>;
     find(path: PathSpec, options?: FindOptions): Promise<string[]>;
     glob(paths: readonly PathSpec[], prefix?: string): Promise<PathSpec[]>;
+    deltaHook(): DeltaHook;
     getState(): Promise<NextcloudResourceState>;
     loadState(_state: NextcloudResourceState): Promise<void>;
 }
@@ -1956,14 +2173,12 @@ declare const NEXTCLOUD_COMMANDS: readonly RegisteredCommand[];
 
 declare const NEXTCLOUD_OPS: readonly RegisteredOp[];
 
-interface DiscordConfig {
-    token: string;
-}
-interface DiscordConfigRedacted {
-    token: '<REDACTED>';
+declare class NextcloudWalk {
+    private readonly accessor;
+    constructor(accessor: NextcloudAccessor);
+    walk(root: PathSpec): AsyncGenerator<WalkEntry>;
 }
-declare function redactDiscordConfig(config: DiscordConfig): DiscordConfigRedacted;
-declare function normalizeDiscordConfig(input: Record<string, unknown>): DiscordConfig;
+declare function buildDeltaHook(accessor: NextcloudAccessor): DeltaHook;
 
 interface DiscordResourceState {
     type: string;
@@ -1972,6 +2187,7 @@ interface DiscordResourceState {
 declare class DiscordResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly writePrompt: string;
@@ -1979,7 +2195,6 @@ declare class DiscordResource extends BaseResource implements Resource {
     readonly accessor: DiscordAccessor;
     constructor(config: DiscordConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -1990,20 +2205,15 @@ declare class DiscordResource extends BaseResource implements Resource {
     loadState(_state: DiscordResourceState): Promise<void>;
 }
 
-interface TrelloConfig {
-    apiKey: string;
-    apiToken: string;
-    workspaceId?: string;
-    boardIds?: readonly string[];
-    baseUrl?: string;
-}
-interface TrelloConfigRedacted {
-    apiKey: '<REDACTED>';
-    apiToken: '<REDACTED>';
-    workspaceId?: string;
-    boardIds?: readonly string[];
-    baseUrl?: string;
-}
+declare const TrelloConfigSchema: z.ZodObject<{
+    apiKey: z.ZodString;
+    apiToken: z.ZodString;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    boardIds: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type TrelloConfig = ConfigOf<typeof TrelloConfigSchema>;
+type TrelloConfigRedacted = RedactedConfig<TrelloConfig, 'apiKey' | 'apiToken'>;
 declare function redactTrelloConfig(config: TrelloConfig): TrelloConfigRedacted;
 declare function normalizeTrelloConfig(input: Record<string, unknown>): TrelloConfig;
 
@@ -2021,7 +2231,6 @@ declare class TrelloResource extends BaseResource implements Resource {
     readonly accessor: TrelloAccessor;
     constructor(config: TrelloConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     private filter;
@@ -2033,21 +2242,6 @@ declare class TrelloResource extends BaseResource implements Resource {
     loadState(_state: TrelloResourceState): Promise<void>;
 }
 
-interface LinearConfig {
-    apiKey: string;
-    workspace?: string;
-    teamIds?: readonly string[];
-    baseUrl?: string;
-}
-interface LinearConfigRedacted {
-    apiKey: '<REDACTED>';
-    workspace?: string;
-    teamIds?: readonly string[];
-    baseUrl?: string;
-}
-declare function redactLinearConfig(config: LinearConfig): LinearConfigRedacted;
-declare function normalizeLinearConfig(input: Record<string, unknown>): LinearConfig;
-
 interface LinearResourceState {
     type: string;
     config: LinearConfigRedacted;
@@ -2055,6 +2249,7 @@ interface LinearResourceState {
 declare class LinearResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly writePrompt: string;
@@ -2062,7 +2257,6 @@ declare class LinearResource extends BaseResource implements Resource {
     readonly accessor: LinearAccessor;
     constructor(config: LinearConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     private filter;
@@ -2074,17 +2268,6 @@ declare class LinearResource extends BaseResource implements Resource {
     loadState(_state: LinearResourceState): Promise<void>;
 }
 
-interface NotionConfig {
-    apiKey: string;
-    baseUrl?: string;
-}
-interface NotionConfigRedacted {
-    apiKey: '<REDACTED>';
-    baseUrl?: string;
-}
-declare function redactNotionConfig(config: NotionConfig): NotionConfigRedacted;
-declare function normalizeNotionConfig(input: Record<string, unknown>): NotionConfig;
-
 interface NotionResourceState {
     type: string;
     config: NotionConfigRedacted;
@@ -2099,7 +2282,6 @@ declare class NotionResource extends BaseResource implements Resource {
     readonly accessor: NotionAccessor;
     constructor(config: NotionConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2110,22 +2292,16 @@ declare class NotionResource extends BaseResource implements Resource {
     loadState(_state: NotionResourceState): Promise<void>;
 }
 
-interface LangfuseConfig {
-    publicKey: string;
-    secretKey: string;
-    host?: string;
-    defaultTraceLimit?: number;
-    defaultSearchLimit?: number;
-    defaultFromTimestamp?: string;
-}
-interface LangfuseConfigRedacted {
-    publicKey: string;
-    secretKey: '<REDACTED>';
-    host?: string;
-    defaultTraceLimit?: number;
-    defaultSearchLimit?: number;
-    defaultFromTimestamp?: string;
-}
+declare const LangfuseConfigSchema: z.ZodObject<{
+    publicKey: z.ZodString;
+    secretKey: z.ZodString;
+    host: z.ZodOptional<z.ZodString>;
+    defaultTraceLimit: z.ZodOptional<z.ZodNumber>;
+    defaultSearchLimit: z.ZodOptional<z.ZodNumber>;
+    defaultFromTimestamp: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type LangfuseConfig = ConfigOf<typeof LangfuseConfigSchema>;
+type LangfuseConfigRedacted = RedactedConfig<LangfuseConfig, 'secretKey'>;
 declare function redactLangfuseConfig(config: LangfuseConfig): LangfuseConfigRedacted;
 declare function normalizeLangfuseConfig(input: Record<string, unknown>): LangfuseConfig;
 
@@ -2142,7 +2318,6 @@ declare class LangfuseResource extends BaseResource implements Resource {
     readonly accessor: LangfuseAccessor;
     constructor(config: LangfuseConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2153,20 +2328,49 @@ declare class LangfuseResource extends BaseResource implements Resource {
     loadState(_state: LangfuseResourceState): Promise<void>;
 }
 
-interface GitHubConfig {
-    token: string;
-    owner: string;
-    repo: string;
-    ref?: string;
-    baseUrl?: string;
-}
-interface GitHubConfigRedacted {
-    token: '<REDACTED>';
-    owner: string;
-    repo: string;
-    ref?: string;
-    baseUrl?: string;
+declare const JaegerConfigSchema: z.ZodObject<{
+    host: z.ZodOptional<z.ZodString>;
+    defaultTraceLimit: z.ZodOptional<z.ZodNumber>;
+    defaultFromTimestamp: z.ZodOptional<z.ZodString>;
+    defaultToTimestamp: z.ZodOptional<z.ZodString>;
+    requestTimeout: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+type JaegerConfig = ConfigOf<typeof JaegerConfigSchema>;
+type JaegerConfigRedacted = JaegerConfig;
+
+interface JaegerResourceState {
+    type: string;
+    config: JaegerConfigRedacted;
 }
+declare class JaegerResource extends BaseResource implements Resource {
+    readonly kind: string;
+    readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
+    readonly indexTtl: number;
+    readonly prompt: string;
+    readonly config: JaegerConfig;
+    readonly accessor: JaegerAccessor;
+    constructor(config: JaegerConfig);
+    open(): Promise<void>;
+    commands(): readonly RegisteredCommand[];
+    ops(): readonly RegisteredOp[];
+    readFile(p: PathSpec): Promise<Uint8Array>;
+    readdir(p: PathSpec): Promise<string[]>;
+    stat(p: PathSpec): Promise<FileStat>;
+    glob(paths: readonly PathSpec[], prefix?: string): Promise<PathSpec[]>;
+    getState(): Promise<JaegerResourceState>;
+    loadState(_state: JaegerResourceState): Promise<void>;
+}
+
+declare const GitHubConfigSchema: z.ZodObject<{
+    token: z.ZodString;
+    owner: z.ZodString;
+    repo: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type GitHubConfig = ConfigOf<typeof GitHubConfigSchema>;
+type GitHubConfigRedacted = RedactedConfig<GitHubConfig, 'token'>;
 declare function redactGitHubConfig(config: GitHubConfig): GitHubConfigRedacted;
 declare function normalizeGitHubConfig(input: Record<string, unknown>): GitHubConfig;
 
@@ -2179,6 +2383,7 @@ interface GitHubResourceState {
 declare class GitHubResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly supportsSnapshot: boolean;
     readonly indexTtl: number;
     readonly config: GitHubConfig;
@@ -2186,7 +2391,6 @@ declare class GitHubResource extends BaseResource implements Resource {
     private constructor();
     static create(config: GitHubConfig): Promise<GitHubResource>;
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2197,22 +2401,16 @@ declare class GitHubResource extends BaseResource implements Resource {
     loadState(_state: GitHubResourceState): Promise<void>;
 }
 
-interface GitHubCIConfig {
-    token: string;
-    owner: string;
-    repo: string;
-    days?: number;
-    maxRuns?: number;
-    baseUrl?: string;
-}
-interface GitHubCIConfigRedacted {
-    token: '<REDACTED>';
-    owner: string;
-    repo: string;
-    days?: number;
-    maxRuns?: number;
-    baseUrl?: string;
-}
+declare const GitHubCIConfigSchema: z.ZodObject<{
+    token: z.ZodString;
+    owner: z.ZodString;
+    repo: z.ZodString;
+    days: z.ZodOptional<z.ZodNumber>;
+    maxRuns: z.ZodOptional<z.ZodNumber>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type GitHubCIConfig = ConfigOf<typeof GitHubCIConfigSchema>;
+type GitHubCIConfigRedacted = RedactedConfig<GitHubCIConfig, 'token'>;
 declare function redactGitHubCIConfig(config: GitHubCIConfig): GitHubCIConfigRedacted;
 declare function normalizeGitHubCIConfig(input: Record<string, unknown>): GitHubCIConfig;
 
@@ -2229,7 +2427,6 @@ declare class GitHubCIResource extends BaseResource implements Resource {
     readonly accessor: GitHubCIAccessor;
     constructor(config: GitHubCIConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2240,26 +2437,9 @@ declare class GitHubCIResource extends BaseResource implements Resource {
     loadState(_state: GitHubCIResourceState): Promise<void>;
 }
 
-interface GDocsConfig {
-    clientId: string;
-    clientSecret: string;
-    refreshToken: string;
-    refreshFn?: (refreshToken: string) => Promise<{
-        accessToken: string;
-        expiresIn: number;
-    }>;
-}
-interface GDocsConfigRedacted {
-    clientId: string;
-    clientSecret: '<REDACTED>';
-    refreshToken: '<REDACTED>';
-}
-declare function redactGDocsConfig(config: GDocsConfig): GDocsConfigRedacted;
-declare function normalizeGDocsConfig(input: Record<string, unknown>): GDocsConfig;
-
 interface GDocsResourceState {
     type: string;
-    config: GDocsConfigRedacted;
+    config: GoogleConfigRedacted;
 }
 declare class GDocsResource extends BaseResource implements Resource {
     readonly kind: string;
@@ -2267,11 +2447,10 @@ declare class GDocsResource extends BaseResource implements Resource {
     readonly indexTtl: number;
     readonly prompt: string;
     readonly writePrompt: string;
-    readonly config: GDocsConfig;
+    readonly config: GoogleConfig;
     readonly accessor: GDocsAccessor;
-    constructor(config: GDocsConfig);
+    constructor(config: GoogleConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2282,26 +2461,9 @@ declare class GDocsResource extends BaseResource implements Resource {
     loadState(_state: GDocsResourceState): Promise<void>;
 }
 
-interface GSheetsConfig {
-    clientId: string;
-    clientSecret: string;
-    refreshToken: string;
-    refreshFn?: (refreshToken: string) => Promise<{
-        accessToken: string;
-        expiresIn: number;
-    }>;
-}
-interface GSheetsConfigRedacted {
-    clientId: string;
-    clientSecret: '<REDACTED>';
-    refreshToken: '<REDACTED>';
-}
-declare function redactGSheetsConfig(config: GSheetsConfig): GSheetsConfigRedacted;
-declare function normalizeGSheetsConfig(input: Record<string, unknown>): GSheetsConfig;
-
 interface GSheetsResourceState {
     type: string;
-    config: GSheetsConfigRedacted;
+    config: GoogleConfigRedacted;
 }
 declare class GSheetsResource extends BaseResource implements Resource {
     readonly kind: string;
@@ -2309,11 +2471,10 @@ declare class GSheetsResource extends BaseResource implements Resource {
     readonly indexTtl: number;
     readonly prompt: string;
     readonly writePrompt: string;
-    readonly config: GSheetsConfig;
+    readonly config: GoogleConfig;
     readonly accessor: GSheetsAccessor;
-    constructor(config: GSheetsConfig);
+    constructor(config: GoogleConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2324,26 +2485,9 @@ declare class GSheetsResource extends BaseResource implements Resource {
     loadState(_state: GSheetsResourceState): Promise<void>;
 }
 
-interface GSlidesConfig {
-    clientId: string;
-    clientSecret: string;
-    refreshToken: string;
-    refreshFn?: (refreshToken: string) => Promise<{
-        accessToken: string;
-        expiresIn: number;
-    }>;
-}
-interface GSlidesConfigRedacted {
-    clientId: string;
-    clientSecret: '<REDACTED>';
-    refreshToken: '<REDACTED>';
-}
-declare function redactGSlidesConfig(config: GSlidesConfig): GSlidesConfigRedacted;
-declare function normalizeGSlidesConfig(input: Record<string, unknown>): GSlidesConfig;
-
 interface GSlidesResourceState {
     type: string;
-    config: GSlidesConfigRedacted;
+    config: GoogleConfigRedacted;
 }
 declare class GSlidesResource extends BaseResource implements Resource {
     readonly kind: string;
@@ -2351,11 +2495,10 @@ declare class GSlidesResource extends BaseResource implements Resource {
     readonly indexTtl: number;
     readonly prompt: string;
     readonly writePrompt: string;
-    readonly config: GSlidesConfig;
+    readonly config: GoogleConfig;
     readonly accessor: GSlidesAccessor;
-    constructor(config: GSlidesConfig);
+    constructor(config: GoogleConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2366,27 +2509,9 @@ declare class GSlidesResource extends BaseResource implements Resource {
     loadState(_state: GSlidesResourceState): Promise<void>;
 }
 
-interface GDriveConfig {
-    clientId: string;
-    clientSecret: string;
-    refreshToken: string;
-    refreshFn?: (refreshToken: string) => Promise<{
-        accessToken: string;
-        expiresIn: number;
-    }>;
-    folderId?: string;
-}
-interface GDriveConfigRedacted {
-    clientId: string;
-    clientSecret: '<REDACTED>';
-    refreshToken: '<REDACTED>';
-}
-declare function redactGDriveConfig(config: GDriveConfig): GDriveConfigRedacted;
-declare function normalizeGDriveConfig(input: Record<string, unknown>): GDriveConfig;
-
 interface GDriveResourceState {
     type: string;
-    config: GDriveConfigRedacted;
+    config: GoogleConfigRedacted;
 }
 declare class GDriveResource extends BaseResource implements Resource {
     readonly kind: string;
@@ -2394,11 +2519,10 @@ declare class GDriveResource extends BaseResource implements Resource {
     readonly supportsSnapshot: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
-    readonly config: GDriveConfig;
+    readonly config: GoogleConfig;
     readonly accessor: GDriveAccessor;
-    constructor(config: GDriveConfig);
+    constructor(config: GoogleConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2421,14 +2545,15 @@ interface DropboxConfig {
         expiresIn: number;
     }>;
 }
-interface DropboxConfigRedacted {
-    clientId: string;
-    clientSecret: '<REDACTED>';
-    refreshToken: '<REDACTED>';
-    rootPath?: string;
-    contentSearch?: boolean;
-    endpoint?: string;
-}
+declare const DropboxConfigSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    refreshToken: z.ZodString;
+    rootPath: z.ZodOptional<z.ZodString>;
+    contentSearch: z.ZodOptional<z.ZodBoolean>;
+    endpoint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type DropboxConfigRedacted = RedactedConfig<ConfigOf<typeof DropboxConfigSchema>, 'clientSecret' | 'refreshToken'>;
 declare function redactDropboxConfig(config: DropboxConfig): DropboxConfigRedacted;
 declare function normalizeDropboxConfig(input: Record<string, unknown>): DropboxConfig;
 
@@ -2439,13 +2564,13 @@ interface DropboxResourceState {
 declare class DropboxResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly config: DropboxConfig;
     readonly accessor: DropboxAccessor;
     constructor(config: DropboxConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2472,15 +2597,17 @@ interface BoxConfig {
     }>;
     onRefreshTokenRotated?: (newRefreshToken: string) => void | Promise<void>;
 }
-interface BoxConfigRedacted {
-    endpoint?: string;
-    rootFolderId?: string;
-    clientId?: string;
-    clientSecret?: '<REDACTED>';
-    refreshToken?: '<REDACTED>';
-    enterpriseId?: string;
-    accessToken?: '<REDACTED>';
-}
+declare const BoxConfigSchema: z.ZodObject<{
+    endpoint: z.ZodOptional<z.ZodString>;
+    rootFolderId: z.ZodOptional<z.ZodString>;
+    contentSearch: z.ZodOptional<z.ZodBoolean>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    enterpriseId: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type BoxConfigRedacted = RedactedConfig<ConfigOf<typeof BoxConfigSchema>, 'clientSecret' | 'refreshToken' | 'accessToken'>;
 declare function redactBoxConfig(config: BoxConfig): BoxConfigRedacted;
 declare function normalizeBoxConfig(input: Record<string, unknown>): BoxConfig;
 
@@ -2491,13 +2618,13 @@ interface BoxResourceState {
 declare class BoxResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly config: BoxConfig;
     readonly accessor: BoxAccessor;
     constructor(config: BoxConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2515,6 +2642,7 @@ interface GmailResourceState {
 declare class GmailResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly writePrompt: string;
@@ -2522,7 +2650,6 @@ declare class GmailResource extends BaseResource implements Resource {
     readonly accessor: GmailAccessor;
     constructor(config: GoogleConfig);
     open(): Promise<void>;
-    close(): Promise<void>;
     commands(): readonly RegisteredCommand[];
     ops(): readonly RegisteredOp[];
     readFile(p: PathSpec): Promise<Uint8Array>;
@@ -2533,30 +2660,46 @@ declare class GmailResource extends BaseResource implements Resource {
     loadState(_state: GmailResourceState): Promise<void>;
 }
 
-interface EmailConfig {
-    imapHost: string;
-    imapPort: number;
-    smtpHost: string;
-    smtpPort: number;
-    username: string;
-    password: string;
-    useSsl: boolean;
-    maxMessages: number;
-}
-interface EmailConfigRedacted extends Omit<EmailConfig, 'password'> {
-    password: '<REDACTED>';
+interface GCalResourceState {
+    type: string;
+    config: GoogleConfigRedacted;
 }
+declare class GCalResource extends BaseResource implements Resource {
+    readonly kind: string;
+    readonly cachesReads: boolean;
+    readonly indexTtl: number;
+    readonly prompt: string;
+    readonly writePrompt: string;
+    readonly config: GoogleConfig;
+    readonly accessor: GCalAccessor;
+    constructor(config: GoogleConfig);
+    open(): Promise<void>;
+    commands(): readonly RegisteredCommand[];
+    ops(): readonly RegisteredOp[];
+    readFile(p: PathSpec): Promise<Uint8Array>;
+    readdir(p: PathSpec): Promise<string[]>;
+    stat(p: PathSpec): Promise<FileStat>;
+    glob(paths: readonly PathSpec[], prefix?: string): Promise<PathSpec[]>;
+    getState(): Promise<GCalResourceState>;
+    loadState(_state: GCalResourceState): Promise<void>;
+}
+
+declare const EmailConfigSchema: z.ZodObject<{
+    imapHost: z.ZodString;
+    imapPort: z.ZodDefault<z.ZodNumber>;
+    smtpHost: z.ZodString;
+    smtpPort: z.ZodDefault<z.ZodNumber>;
+    username: z.ZodString;
+    password: z.ZodString;
+    useSsl: z.ZodDefault<z.ZodBoolean>;
+    maxMessages: z.ZodDefault<z.ZodNumber>;
+    saveCopy: z.ZodDefault<z.ZodBoolean>;
+    sentFolder: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+type EmailConfig = ConfigOf<typeof EmailConfigSchema>;
+type EmailConfigRedacted = RedactedConfig<EmailConfig, 'password'>;
 declare function redactEmailConfig(config: EmailConfig): EmailConfigRedacted;
-interface EmailConfigInput {
-    imapHost: string;
-    imapPort?: number;
-    smtpHost: string;
-    smtpPort?: number;
-    username: string;
-    password: string;
-    useSsl?: boolean;
-    maxMessages?: number;
-}
+type EmailConfigInput = z.input<typeof EmailConfigSchema>;
 declare function buildEmailConfig(input: EmailConfigInput): EmailConfig;
 declare function normalizeEmailConfig(input: Record<string, unknown>): EmailConfig;
 
@@ -2575,6 +2718,7 @@ interface EmailResourceState {
 declare class EmailResource extends BaseResource implements Resource {
     readonly kind: string;
     readonly cachesReads: boolean;
+    readonly sizesAlwaysKnown: boolean;
     readonly indexTtl: number;
     readonly prompt: string;
     readonly config: EmailConfig;
@@ -2592,13 +2736,106 @@ declare class EmailResource extends BaseResource implements Resource {
     loadState(_state: EmailResourceState): Promise<void>;
 }
 
-declare const EMAIL_PROMPT = "{prefix}\n  <folder>/\n    <yyyy-mm-dd>/\n      <subject>__<uid>.email.json\n      <subject>__<uid>/           # if attachments exist\n        <attachment-filename>\n  Folders include: INBOX, Sent, Drafts, etc. cat shows email as JSON.\n\n  Read commands:\n    himalaya envelope list --folder INBOX --unseen        # id/from/subject/date\n    himalaya message read --folder INBOX --uid <uid>     # one message as JSON";
-declare const EMAIL_WRITE_PROMPT = "  Write commands:\n    himalaya message send --to \"to@email.com\" --subject \"Hi\" --body \"...\"\n    himalaya message reply --folder INBOX --uid <uid> --body \"...\" [--all]\n    himalaya message forward --folder INBOX --uid <uid> --to \"to@email.com\"";
+declare const EMAIL_PROMPT = "{prefix}\n  <folder>/\n    <yyyy-mm-dd>/\n      <subject>__<uid>.email.json\n      <subject>__<uid>/           # if attachments exist\n        <attachment-filename>\n  Folders include: INBOX, Sent, Drafts, etc. cat shows email as JSON.\n\n  To act on mail (list/read/send/reply/forward), use the himalaya CLI\n  if installed: himalaya --help";
+declare const EMAIL_WRITE_PROMPT = "  Sending mail goes through the himalaya CLI if installed:\n    himalaya message send --to \"to@email.com\" --subject \"Hi\" --body \"...\"";
 
 declare const EMAIL_COMMANDS: readonly RegisteredCommand[];
 
+declare const HIMALAYA: CLISpec;
+
 declare const EMAIL_OPS: readonly RegisteredOp[];
 
+/**
+ * Run Python code on a host interpreter as a subprocess.
+ *
+ * Each run spawns `<interpreter> -c <code>`; the code sees the host
+ * filesystem and environment, not the workspace mounts. Mirrors the
+ * python LocalRuntime: the interpreter defaults to `python3` on PATH
+ * (node has no embedded python, unlike the python package which
+ * defaults to its own interpreter); point the config `home` or the
+ * MIRAGE_LOCAL_HOME environment variable at another binary, e.g. a
+ * project venv whose packages the code needs.
+ */
+declare class LocalRuntime extends PythonRuntime {
+    readonly name = "local";
+    readonly reach = "process";
+    private readonly python;
+    private readonly children;
+    constructor(options?: RuntimeOptions);
+    run(args: RunArgs): Promise<RunResult>;
+    close(): Promise<void>;
+}
+
+/** How to reach the user's live E2B sandbox. */
+interface E2BConfig extends SandboxConfig {
+    /**
+     * Id of a sandbox you created (`e2b sandbox spawn` or the SDK),
+     * booted from a template with fuse3 and mirage installed.
+     */
+    sandboxId: string;
+    /** E2B credential; absent reads E2B_API_KEY. */
+    apiKey?: string;
+}
+declare const E2B_CONFIG_KEYS: readonly string[];
+
+type E2bSdk = typeof e2bSdk;
+/**
+ * An E2B sandbox the user runs as a whole-line runtime.
+ *
+ * You create the sandbox yourself (`e2b sandbox spawn` or the SDK);
+ * mirage only connects by `sandboxId` and execs lines. `apiKey` falls
+ * back to E2B_API_KEY. E2B's exec reports stdout and stderr
+ * separately, so both stream back real; it takes no stdin, so piped
+ * bytes are uploaded and redirected in.
+ */
+declare class E2BRuntime extends RemoteSandbox<E2BConfig> {
+    readonly name = "e2b";
+    private sdk;
+    private sandbox;
+    constructor(options?: RuntimeOptions<E2BConfig> | Record<string, unknown>);
+    protected loadSdk(): Promise<E2bSdk>;
+    private ensureSdk;
+    private apiParams;
+    connect(): Promise<void>;
+    execLine(line: string, stdin: Uint8Array | null, env: Record<string, string>, cwd: string): Promise<RunResult>;
+    private upload;
+}
+
+/** How to reach the user's running container. */
+interface DockerConfig extends SandboxConfig {
+    /**
+     * Id or name of a running container. You start it yourself
+     * (`docker run -d ... sleep infinity`); live FUSE mounts need
+     * `--cap-add SYS_ADMIN --device /dev/fuse` and an image with mirage
+     * installed.
+     */
+    container: string;
+}
+declare const DOCKER_CONFIG_KEYS: readonly string[];
+
+interface DockerResult {
+    stdout: Uint8Array;
+    stderr: Uint8Array;
+    code: number;
+}
+/**
+ * A container the user runs as a whole-line runtime.
+ *
+ * You start the container yourself; mirage only connects to it and
+ * execs lines. The docker CLI is the transport (Docker Desktop,
+ * colima, or a podman alias all work), so there is no SDK dependency
+ * and no daemon socket wiring; each line is one `docker exec -i` with
+ * the merged environment, the rebased cwd, real stdin, and separated
+ * stderr.
+ */
+declare class DockerRuntime extends RemoteSandbox<DockerConfig> {
+    readonly name = "docker";
+    constructor(options?: RuntimeOptions<DockerConfig> | Record<string, unknown>);
+    protected docker(args: string[], stdin?: Uint8Array | null): Promise<DockerResult>;
+    connect(): Promise<void>;
+    execLine(line: string, stdin: Uint8Array | null, env: Record<string, string>, cwd: string): Promise<RunResult>;
+}
+
 /**
  * Construct a resource by registry name. Mirrors Python's
  * `mirage.resource.registry.build_resource`.
@@ -2614,23 +2851,74 @@ declare const EMAIL_OPS: readonly RegisteredOp[];
  */
 type ResourceFactory = (config: Record<string, unknown>) => Promise<Resource>;
 /**
- * Look up the registered names. Lazily-mutated by `register()` so users
- * can extend the registry with custom resources.
+ * Look up every constructible name: builtins plus whatever `register()`
+ * has added.
  */
 declare function knownResources(): string[];
 /**
- * Register a custom resource factory under `name`. Existing entries
- * are overwritten, mirroring Python's mutable REGISTRY dict.
+ * Register a custom resource factory under `name`. Builtin names cannot
+ * be shadowed; re-registering a custom name replaces it. Mirrors
+ * Python's `mirage.resource.registry.register_resource`, which keeps
+ * builtins in REGISTRY and custom entries in a separate _CUSTOM dict so
+ * a plugin cannot replace the builtin `s3` factory.
  */
 declare function register(name: string, factory: ResourceFactory): void;
 /**
- * Build a resource instance by registry name. Throws if the name is
- * unknown.
+ * Build a resource instance by registry name. Builtins win over custom
+ * registrations. Throws if the name is unknown.
  */
 declare function buildResource(name: string, config?: Record<string, unknown>): Promise<Resource>;
 
+/**
+ * Extensions Node will import from disk. Python's twin tests for a
+ * single one (`.py`) because it has one module language; here `.ts` and
+ * `.mts` ride on Node's own type stripping, which is strip-only: a file
+ * using `enum`, a parameter property, a runtime `namespace` or a legacy
+ * decorator is refused at load with ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX.
+ * `.mjs` is the spelling with no caveats.
+ */
+declare const MODULE_SUFFIXES: string[];
+/**
+ * True when a ref's source is a file on disk rather than a package
+ * specifier Node resolves for itself.
+ *
+ * This is Node's own rule, deliberately NOT Python's. Python's twin asks
+ * `"/" in source`, which is sound there because a module dotpath is
+ * dotted, so a slash can only mean a path. In Node a bare specifier
+ * carries slashes all the time (`@scope/pkg`, `pkg/subpath`), so the
+ * same test would rebase an installed package under the config
+ * directory and then report it as a missing file. A path is what Node
+ * calls a path: relative (`./`, `../`) or absolute. The one addition is
+ * a bare filename carrying a module suffix (`tool.mjs`), which mirrors
+ * the convenience Python allows for `tool.py`; it is restricted to
+ * sources with no slash so that `pkg/dist/index.js` stays a subpath
+ * export, and `./dist/index.js` says path by saying so.
+ *
+ * The config loader's `absolutizeCliRef` calls this same function, so
+ * the two cannot disagree about what a path is.
+ */
+declare function isModulePath(source: string): boolean;
+/** Split a `source:exportName` ref on its last colon. */
+declare function splitRef(spec: string): [string, string];
+/**
+ * Load a module export from a `source:exportName` reference.
+ *
+ * Two forms, auto-detected the way Python's `load_attr` detects them:
+ * a file (`"./my_cli.mjs:TALLY"`) or a package specifier
+ * (`"my-package/clis:JIRA"`). Only a missing file is reworded; every
+ * other load failure propagates with Node's own diagnostic, because a
+ * syntax error in the user's file is the message they need to read.
+ *
+ * A CommonJS file resolves through `default` as well as through named
+ * exports, since cjs-module-lexer only detects some assignment shapes
+ * and `module.exports = { TALLY }` is one it can miss.
+ */
+declare function loadAttr(spec: string): Promise<unknown>;
+
 declare const DISK_COMMANDS: readonly RegisteredCommand[];
 
 declare const REDIS_COMMANDS: readonly RegisteredCommand[];
 
-export { ALIYUN_PROMPT, type AliyunConfig, type AliyunConfigRedacted, AliyunResource, type AliyunResourceState, BACKBLAZE_PROMPT, type BackblazeConfig, type BackblazeConfigRedacted, BackblazeResource, type BackblazeResourceState, type BoxConfig, type BoxConfigRedacted, BoxResource, type BoxResourceState, CEPH_PROMPT, type CephConfig, type CephConfigRedacted, CephResource, type CephResourceState, DEFAULT_STATE_ROOT, DIGITALOCEAN_PROMPT, DISK_COMMANDS, DISK_OPS, DISK_PROMPT, type DatabricksProfile, DatabricksVolumeResource, type DatabricksVolumeResourceState, type DigitalOceanConfig, type DigitalOceanConfigRedacted, DigitalOceanResource, type DigitalOceanResourceState, type DiscordConfig, type DiscordConfigRedacted, DiscordResource, type DiscordResourceState, DiskNamespaceStore, DiskObserverStore, DiskRecordClient, DiskResource, type DiskResourceOptions, type DiskResourceState, DiskSessionStore, DiskWorkspaceStateStore, type DiskWorkspaceStateStoreOptions, type DropboxConfig, type DropboxConfigRedacted, DropboxResource, type DropboxResourceState, EMAIL_COMMANDS, EMAIL_OPS, EMAIL_PROMPT, EMAIL_WRITE_PROMPT, EmailAccessor, type EmailConfig, type EmailConfigInput, type EmailConfigRedacted, EmailResource, type EmailResourceState, type FuseAttr, type FuseHandle, FuseManager, type MountOptions as FuseMountOptions, type GCSConfig, type GCSConfigRedacted, GCSResource, type GCSResourceState, GCS_ENDPOINT, GCS_PROMPT, type GDocsConfig, type GDocsConfigRedacted, GDocsResource, type GDocsResourceState, type GDriveConfig, type GDriveConfigRedacted, GDriveResource, type GDriveResourceState, type GSheetsConfig, type GSheetsConfigRedacted, GSheetsResource, type GSheetsResourceState, type GSlidesConfig, type GSlidesConfigRedacted, GSlidesResource, type GSlidesResourceState, type GitHubCIConfig, type GitHubCIConfigRedacted, GitHubCIResource, type GitHubCIResourceState, type GitHubConfig, type GitHubConfigRedacted, GitHubResource, type GitHubResourceState, GmailResource, type GmailResourceState, GridFSAccessor, type GridFSConfig, type GridFSConfigRedacted, GridFSResource, type GridFSResourceState, HF_BUCKETS_PROMPT, HF_COMMANDS, HF_DATASETS_PROMPT, HF_ENDPOINT, HF_MODELS_PROMPT, HF_OPS, HF_RESOURCES, HF_SPACES_PROMPT, HfAccessor, HfBucketsAccessor, type HfBucketsConfig, type HfBucketsConfigRedacted, HfBucketsResource, type HfBucketsResourceState, HfDatasetsAccessor, HfDatasetsResource, type HfDatasetsResourceState, HfModelsAccessor, type HfModelsConfig, type HfModelsConfigRedacted, HfModelsResource, type HfModelsResourceState, type HfRepoConfig, type HfRepoConfigRedacted, HfSpacesAccessor, HfSpacesResource, type HfSpacesResourceState, LanceDBResource, type LanceDBResourceOptions, LanceDBStore, type LangfuseConfig, type LangfuseConfigRedacted, LangfuseResource, type LangfuseResourceState, type LinearConfig, type LinearConfigRedacted, LinearResource, type LinearResourceState, MINIO_PROMPT, type MinIOConfig, type MinIOConfigRedacted, MinIOResource, type MinIOResourceState, MirageFS, type MirageFSOptions, MongoDBResource, type MongoDBResourceOptions, MongoDBStore, Mount, type MountSpecOptions, NEXTCLOUD_COMMANDS, NEXTCLOUD_OPS, NEXTCLOUD_PROMPT, NextcloudAccessor, type NextcloudConfig, type NextcloudConfigRedacted, NextcloudResource, type NextcloudResourceState, type NodeWorkspaceOptions, type NotionConfig, type NotionConfigRedacted, NotionResource, type NotionResourceState, type OCIConfig, type OCIConfigRedacted, OCIResource, type OCIResourceState, OCI_PROMPT, PostgresResource, type PostgresResourceOptions, PostgresStore, QINGSTOR_PROMPT, type QingStorConfig, type QingStorConfigRedacted, QingStorResource, type QingStorResourceState, type R2Config, type R2ConfigRedacted, R2Resource, type R2ResourceState, R2_PROMPT, REDIS_COMMANDS, REDIS_OPS, REDIS_PROMPT, RedisAccessor, type RedisFileCacheOptions, RedisFileCacheStore, RedisNamespaceStore, type RedisNamespaceStoreOptions, RedisObserverStore, type RedisObserverStoreOptions, RedisResource, type RedisResourceLike, type RedisResourceOptions, type RedisResourceState, RedisSessionStore, type RedisSessionStoreOptions, RedisStore, type RedisStoreOptions, RedisWorkspaceStateStore, type RedisWorkspaceStateStoreOptions, type ResourceFactory, type S3Config, type S3ConfigRedacted, S3Resource, type S3ResourceState, SCALEWAY_PROMPT, SEAWEEDFS_PROMPT, SSHAccessor, type SSHConfig, type SSHConfigRedacted, SSHResource, type SSHResourceState, SSH_COMMANDS, SSH_OPS, SSH_PROMPT, SUPABASE_PROMPT, type ScalewayConfig, type ScalewayConfigRedacted, ScalewayResource, type ScalewayResourceState, type SeaweedFSConfig, type SeaweedFSConfigRedacted, SeaweedFSResource, type SeaweedFSResourceState, type SlackConfig, type SlackConfigRedacted, SlackResource, type SlackResourceState, type SupabaseConfig, type SupabaseConfigRedacted, SupabaseResource, type SupabaseResourceState, TENCENT_PROMPT, type TencentConfig, type TencentConfigRedacted, TencentResource, type TencentResourceState, type TrelloConfig, type TrelloConfigRedacted, TrelloResource, type TrelloResourceState, WASABI_PROMPT, type WasabiConfig, type WasabiConfigRedacted, WasabiResource, type WasabiResourceState, Workspace, assertHfRepoId, buildEmailConfig, buildResource, fileReadProvision, mount as fuseMount, mountBackground as fuseMountBackground, headTailProvision, isMacosMetadata, knownResources, loadDatabricksProfile, metadataProvision, normalizeBoxConfig, normalizeDiscordConfig, normalizeDropboxConfig, normalizeEmailConfig, normalizeGDocsConfig, normalizeGDriveConfig, normalizeGSheetsConfig, normalizeGSlidesConfig, normalizeGitHubCIConfig, normalizeGitHubConfig, normalizeGridFSConfig, normalizeHfBucketsConfig, normalizeHfModelsConfig, normalizeHfRepoConfig, normalizeLangfuseConfig, normalizeLinearConfig, normalizeNextcloudConfig, normalizeNotionConfig, normalizeSlackConfig, normalizeSshConfig, normalizeTrelloConfig, parseDatabricksCfg, patchNodeFs, redactAliyunConfig, redactBackblazeConfig, redactBoxConfig, redactCephConfig, redactDigitalOceanConfig, redactDiscordConfig, redactDropboxConfig, redactEmailConfig, redactGDocsConfig, redactGDriveConfig, redactGSheetsConfig, redactGSlidesConfig, redactGcsConfig, redactGitHubCIConfig, redactGitHubConfig, redactHfBucketsConfig, redactHfModelsConfig, redactHfRepoConfig, redactLangfuseConfig, redactLinearConfig, redactMinIOConfig, redactNextcloudConfig, redactNotionConfig, redactOciConfig, redactQingStorConfig, redactR2Config, redactConfig as redactS3Config, redactScalewayConfig, redactSeaweedFSConfig, redactSlackConfig, redactSshConfig, redactSupabaseConfig, redactTencentConfig, redactTrelloConfig, redactWasabiConfig, register as registerResourceFactory, resolvedAliyunEndpoint, resolvedBackblazeEndpoint, resolvedDigitalOceanEndpoint, resolvedQingStorEndpoint, resolvedScalewayEndpoint, resolvedSupabaseEndpoint, resolvedTencentEndpoint, resolvedWasabiEndpoint };
+declare const GRIDFS_COMMANDS: readonly RegisteredCommand[];
+
+export { ALIYUN_PROMPT, type AliyunConfig, type AliyunConfigRedacted, AliyunResource, type AliyunResourceState, BACKBLAZE_PROMPT, type BackblazeConfig, type BackblazeConfigRedacted, BackblazeResource, type BackblazeResourceState, type BoxConfig, type BoxConfigRedacted, BoxResource, type BoxResourceState, CEPH_PROMPT, type CephConfig, type CephConfigRedacted, CephResource, type CephResourceState, DAYTONA_CONFIG_KEYS, DEFAULT_STATE_ROOT, DIGITALOCEAN_PROMPT, DISK_COMMANDS, DISK_OPS, DISK_PROMPT, DOCKER_CONFIG_KEYS, type DatabricksProfile, DatabricksVolumeResource, type DatabricksVolumeResourceState, type DaytonaConfig, DaytonaRuntime, type DigitalOceanConfig, type DigitalOceanConfigRedacted, DigitalOceanResource, type DigitalOceanResourceState, DiscordResource, type DiscordResourceState, DiskNamespaceStore, DiskObserverStore, DiskRecordClient, DiskResource, type DiskResourceOptions, type DiskResourceState, DiskSessionStore, DiskWorkspaceStateStore, type DiskWorkspaceStateStoreOptions, type DockerConfig, DockerRuntime, type DropboxConfig, type DropboxConfigRedacted, DropboxResource, type DropboxResourceState, type E2BConfig, E2BRuntime, E2B_CONFIG_KEYS, EMAIL_COMMANDS, EMAIL_OPS, EMAIL_PROMPT, EMAIL_WRITE_PROMPT, EmailAccessor, type EmailConfig, type EmailConfigInput, type EmailConfigRedacted, EmailResource, type EmailResourceState, FSKIT_MOUNT_ROOT, type FuseAttr, type FuseHandle, FuseManager, type MountOptions as FuseMountOptions, type GCSConfig, type GCSConfigRedacted, GCSResource, type GCSResourceState, GCS_ENDPOINT, GCS_PROMPT, GCalResource, type GCalResourceState, GDocsResource, type GDocsResourceState, GDriveResource, type GDriveResourceState, GRIDFS_COMMANDS, GSheetsResource, type GSheetsResourceState, GSlidesResource, type GSlidesResourceState, type GitHubCIConfig, type GitHubCIConfigRedacted, GitHubCIResource, type GitHubCIResourceState, type GitHubConfig, type GitHubConfigRedacted, GitHubResource, type GitHubResourceState, GmailResource, type GmailResourceState, GridFSAccessor, type GridFSConfig, type GridFSConfigRedacted, GridFSResource, type GridFSResourceState, HF_BUCKETS_PROMPT, HF_COMMANDS, HF_DATASETS_PROMPT, HF_ENDPOINT, HF_MODELS_PROMPT, HF_OPS, HF_RESOURCES, HF_SPACES_PROMPT, HIMALAYA, HfAccessor, HfBucketsAccessor, type HfBucketsConfig, type HfBucketsConfigRedacted, HfBucketsResource, type HfBucketsResourceState, HfDatasetsAccessor, HfDatasetsResource, type HfDatasetsResourceState, HfModelsAccessor, type HfModelsConfig, type HfModelsConfigRedacted, HfModelsResource, type HfModelsResourceState, type HfRepoConfig, type HfRepoConfigRedacted, HfSpacesAccessor, HfSpacesResource, type HfSpacesResourceState, JaegerResource, type JaegerResourceState, LanceDBResource, type LanceDBResourceOptions, LanceDBStore, type LangfuseConfig, type LangfuseConfigRedacted, LangfuseResource, type LangfuseResourceState, LinearResource, type LinearResourceState, LocalRuntime, MINIO_PROMPT, MODULE_SUFFIXES, type MinIOConfig, type MinIOConfigRedacted, MinIOResource, type MinIOResourceState, MirageFS, type MirageFSOptions, MongoDBResource, type MongoDBResourceOptions, MongoDBStore, Mount, MountCore, type MountCoreOptions, type MountSpecOptions, NEXTCLOUD_COMMANDS, NEXTCLOUD_OPS, NEXTCLOUD_PROMPT, NextcloudAccessor, type NextcloudConfig, type NextcloudConfigRedacted, NextcloudResource, type NextcloudResourceState, NextcloudWalk, type NodeWorkspaceOptions, NotionResource, type NotionResourceState, type OCIConfig, type OCIConfigRedacted, OCIResource, type OCIResourceState, OCI_PROMPT, PostgresResource, type PostgresResourceOptions, PostgresStore, QINGSTOR_PROMPT, type QingStorConfig, type QingStorConfigRedacted, QingStorResource, type QingStorResourceState, type R2Config, type R2ConfigRedacted, R2Resource, type R2ResourceState, R2_PROMPT, REDIS_COMMANDS, REDIS_OPS, REDIS_PROMPT, RedisAccessor, RedisConsoleStore, type RedisConsoleStoreOptions, type RedisFileCacheOptions, RedisFileCacheStore, RedisNamespaceStore, type RedisNamespaceStoreOptions, RedisObserverStore, type RedisObserverStoreOptions, RedisResource, type RedisResourceLike, type RedisResourceOptions, type RedisResourceState, RedisSessionStore, type RedisSessionStoreOptions, RedisStore, type RedisStoreOptions, RedisWorkspaceStateStore, type RedisWorkspaceStateStoreOptions, type ResourceFactory, type S3Config, type S3ConfigRedacted, S3Resource, type S3ResourceState, SCALEWAY_PROMPT, SEAWEEDFS_PROMPT, SSHAccessor, type SSHConfig, type SSHConfigRedacted, SSHResource, type SSHResourceState, SSH_COMMANDS, SSH_OPS, SSH_PROMPT, SUPABASE_PROMPT, type ScalewayConfig, type ScalewayConfigRedacted, ScalewayResource, type ScalewayResourceState, type SeaweedFSConfig, type SeaweedFSConfigRedacted, SeaweedFSResource, type SeaweedFSResourceState, SlackResource, type SlackResourceState, type SupabaseConfig, type SupabaseConfigRedacted, SupabaseResource, type SupabaseResourceState, TENCENT_PROMPT, type TencentConfig, type TencentConfigRedacted, TencentResource, type TencentResourceState, type TrelloConfig, type TrelloConfigRedacted, TrelloResource, type TrelloResourceState, WASABI_PROMPT, type WasabiConfig, type WasabiConfigRedacted, WasabiResource, type WasabiResourceState, Workspace, assertHfRepoId, buildEmailConfig, buildDeltaHook as buildNextcloudDeltaHook, buildResource, checkMountpoint, checkPlatform, checkSizes, classifyErrno, classifyError, fileReadProvision, mount as fuseMount, mountBackground as fuseMountBackground, headTailProvision, isMacosMetadata, isModulePath, knownResources, loadAttr, loadDatabricksProfile, metadataProvision, normalizeBoxConfig, normalizeDropboxConfig, normalizeEmailConfig, normalizeGitHubCIConfig, normalizeGitHubConfig, normalizeGridFSConfig, normalizeHfBucketsConfig, normalizeHfModelsConfig, normalizeHfRepoConfig, normalizeLangfuseConfig, normalizeNextcloudConfig, normalizeS3Config, normalizeSshConfig, normalizeTrelloConfig, parseDatabricksCfg, patchNodeFs, prepareBackend, redactAliyunConfig, redactBackblazeConfig, redactBoxConfig, redactCephConfig, redactDigitalOceanConfig, redactDropboxConfig, redactEmailConfig, redactGcsConfig, redactGitHubCIConfig, redactGitHubConfig, redactHfBucketsConfig, redactHfModelsConfig, redactHfRepoConfig, redactLangfuseConfig, redactMinIOConfig, redactNextcloudConfig, redactOciConfig, redactQingStorConfig, redactR2Config, redactConfig as redactS3Config, redactScalewayConfig, redactSeaweedFSConfig, redactSshConfig, redactSupabaseConfig, redactTencentConfig, redactTrelloConfig, redactWasabiConfig, register as registerResourceFactory, requireKernelBackend, resolveBackend, resolvedAliyunEndpoint, resolvedBackblazeEndpoint, resolvedDigitalOceanEndpoint, resolvedQingStorEndpoint, resolvedScalewayEndpoint, resolvedSupabaseEndpoint, resolvedTencentEndpoint, resolvedWasabiEndpoint, splitRef, unsizedMounts };