@xopcai/xopc 0.0.313 → 0.0.314

package/dist/src/imports/runtime.js

@@ -3,12 +3,12 @@ import { init_paths, resolveBundledSkillsDir, resolveSkillsDir } from "../config
 import { ProjectService } from "../projects/project-service.js";
 import { resolveWorkspaceSkillsDir } from "../agent/skills/workspace-skills-dir.js";
 import { loadSkills } from "../agent/skills/index.js";
+import { ProjectTrustStore } from "../project-trust/trust-store.js";
 import { ImportError } from "./types.js";
 import { ImportRepository } from "../storage/sqlite/import-repository.js";
 import { canonicalTarget } from "./planner.js";
 import { ImportService } from "./importService.js";
 import { ImportSelectionRepository } from "../storage/sqlite/import-selection-repository.js";
-import { ProjectTrustStore } from "../project-trust/trust-store.js";
 import { existsSync, realpathSync } from "node:fs";
 //#region src/imports/runtime.ts
 init_paths();

package/dist/src/{tasks/task-outbox-dispatcher.d.ts → infra/domain-outbox-dispatcher.d.ts}

@@ -1,6 +1,6 @@
 import type { AutomationEvent } from '../automations/domain/types.js';
-export declare class TaskOutboxDispatcher {
+export declare class DomainOutboxDispatcher {
     private readonly publish;
     constructor(publish: (event: AutomationEvent) => void);
-    drain(limit?: number): number;
+    drain(limit?: number, subjectKind?: string): number;
 }

package/dist/src/{tasks/task-outbox-dispatcher.js → infra/domain-outbox-dispatcher.js}

@@ -1,23 +1,24 @@
 import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
-//#region src/tasks/task-outbox-dispatcher.ts
+//#region src/infra/domain-outbox-dispatcher.ts
 init_transaction();
-var TaskOutboxDispatcher = class {
+var DomainOutboxDispatcher = class {
 	constructor(publish) {
 		this.publish = publish;
 	}
-	drain(limit = 100) {
-		const rows = getSqliteDatabase().prepare(`SELECT event_id, event_type, payload_json, created_at
-       FROM domain_outbox WHERE published_at IS NULL
-       ORDER BY created_at, event_id LIMIT ?`).all(Math.max(1, Math.min(500, Math.floor(limit))));
+	drain(limit = 100, subjectKind) {
+		const rows = getSqliteDatabase().prepare(`SELECT event_id, event_type, payload_json, created_at, subject_kind, operation_id
+       FROM domain_outbox WHERE published_at IS NULL AND (? IS NULL OR subject_kind = ?)
+       ORDER BY created_at, event_id LIMIT ?`).all(subjectKind ?? null, subjectKind ?? null, Math.max(1, Math.min(500, Math.floor(limit))));
 		let published = 0;
 		for (const row of rows) try {
 			const payload = JSON.parse(row.payload_json);
 			this.publish({
 				type: row.event_type,
-				source: "tasks",
+				source: row.subject_kind === "note" ? "notes" : row.subject_kind === "project" ? "projects" : row.subject_kind === "scene" ? "scenes" : row.subject_kind === "local_app" ? "local_apps" : "tasks",
 				payload: {
 					...payload,
-					sourceEventId: row.event_id
+					sourceEventId: row.event_id,
+					...row.operation_id ? { operationId: row.operation_id } : {}
 				},
 				occurredAtMs: row.created_at
 			});
@@ -33,4 +34,4 @@ var TaskOutboxDispatcher = class {
 	}
 };
 //#endregion
-export { TaskOutboxDispatcher };
+export { DomainOutboxDispatcher };

package/dist/src/infra/gateway-processes.js

@@ -1,11 +1,11 @@
 import { listPortListeners } from "../gateway/ports.js";
 import { isGatewayArgv, parseProcCmdline } from "./gateway-process-argv.js";
-import fsSync from "node:fs";
+import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 //#region src/infra/gateway-processes.ts
 function readGatewayProcessArgsSync(pid) {
 	if (process.platform === "linux") try {
-		return parseProcCmdline(fsSync.readFileSync(`/proc/${pid}/cmdline`, "utf8"));
+		return parseProcCmdline(fs.readFileSync(`/proc/${pid}/cmdline`, "utf8"));
 	} catch {
 		return null;
 	}

package/dist/src/infra/operation-context.d.ts

@@ -0,0 +1,2 @@
+export declare function currentOperationId(): string | undefined;
+export declare function withOperation<T>(operationId: string, run: () => T): T;

package/dist/src/infra/operation-context.js

@@ -0,0 +1,16 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/infra/operation-context.ts
+function currentOperationId() {
+	return operations.getStore();
+}
+function withOperation(operationId, run) {
+	return operations.run(operationId, run);
+}
+var operations;
+var init_operation_context = __esmMin((() => {
+	operations = new AsyncLocalStorage();
+}));
+//#endregion
+init_operation_context();
+export { currentOperationId, init_operation_context, withOperation };

package/dist/src/infra/path-env.js

@@ -1,7 +1,7 @@
 import { resolveBrewPathDirs } from "./brew.js";
 import os from "node:os";
 import path from "node:path";
-import fsSync from "node:fs";
+import fs from "node:fs";
 //#region src/infra/path-env.ts
 function isTruthyEnvValue(value) {
 	if (!value) return false;
@@ -10,7 +10,7 @@ function isTruthyEnvValue(value) {
 }
 function isExecutable(filePath) {
 	try {
-		fsSync.accessSync(filePath, fsSync.constants.X_OK);
+		fs.accessSync(filePath, fs.constants.X_OK);
 		return true;
 	} catch {
 		return false;
@@ -18,7 +18,7 @@ function isExecutable(filePath) {
 }
 function isDirectory(dirPath) {
 	try {
-		return fsSync.statSync(dirPath).isDirectory();
+		return fs.statSync(dirPath).isDirectory();
 	} catch {
 		return false;
 	}

package/dist/src/infra/update-global.js

@@ -1,10 +1,10 @@
-import { resolveExecPathBinPrepend } from "./path-env.js";
 import { applyPathPrepend } from "./path-prepend.js";
+import { resolveExecPathBinPrepend } from "./path-env.js";
 import { readPackageVersion } from "./package-json.js";
 import { createDefaultCommandRunner } from "./run-command.js";
 import path from "node:path";
-import fsSync from "node:fs";
-import fs from "node:fs/promises";
+import fs from "node:fs";
+import fs$1 from "node:fs/promises";
 //#region src/infra/update-global.ts
 const XOPC_PACKAGE_NAME = "@xopcai/xopc";
 const GLOBAL_RENAME_PREFIX = ".";
@@ -18,7 +18,7 @@ const NPM_GLOBAL_INSTALL_OMIT_OPTIONAL_FLAGS = ["--omit=optional", ...NPM_GLOBAL
 const GLOBAL_DETECT_TIMEOUT_MS = 15e3;
 async function pathExists(targetPath) {
 	try {
-		await fs.access(targetPath);
+		await fs$1.access(targetPath);
 		return true;
 	} catch {
 		return false;
@@ -26,7 +26,7 @@ async function pathExists(targetPath) {
 }
 async function tryRealpath(targetPath) {
 	try {
-		return await fs.realpath(targetPath);
+		return await fs$1.realpath(targetPath);
 	} catch {
 		return path.resolve(targetPath);
 	}
@@ -49,14 +49,14 @@ function resolvePreferredNpmCommand(pkgRoot) {
 	const prefix = inferNpmPrefixFromPackageRoot(pkgRoot);
 	if (!prefix) return null;
 	const candidate = process.platform === "win32" ? path.join(prefix, "npm.cmd") : path.join(prefix, "bin", "npm");
-	return fsSync.existsSync(candidate) ? candidate : null;
+	return fs.existsSync(candidate) ? candidate : null;
 }
 function resolveNpmFromExecPath() {
 	const execPath = process.execPath?.trim();
 	if (!execPath) return null;
 	const binDir = path.dirname(execPath);
 	const candidate = process.platform === "win32" ? path.join(binDir, "npm.cmd") : path.join(binDir, "npm");
-	return fsSync.existsSync(candidate) ? candidate : null;
+	return fs.existsSync(candidate) ? candidate : null;
 }
 function resolvePreferredGlobalManagerCommand(manager, pkgRoot) {
 	if (manager !== "npm") return manager;
@@ -204,7 +204,7 @@ async function cleanupGlobalRenameDirs(params) {
 	const prefix = `${GLOBAL_RENAME_PREFIX}${name}-`;
 	let entries = [];
 	try {
-		entries = await fs.readdir(root);
+		entries = await fs$1.readdir(root);
 	} catch {
 		return { removed };
 	}
@@ -212,8 +212,8 @@ async function cleanupGlobalRenameDirs(params) {
 		if (!entry.startsWith(prefix)) continue;
 		const target = path.join(root, entry);
 		try {
-			if (!(await fs.lstat(target)).isDirectory()) continue;
-			await fs.rm(target, {
+			if (!(await fs$1.lstat(target)).isDirectory()) continue;
+			await fs$1.rm(target, {
 				recursive: true,
 				force: true
 			});

package/dist/src/local-apps/capabilities/contracts.d.ts

@@ -0,0 +1,2 @@
+/** Validate release bindings against the same production definitions without executing a domain service. */
+export declare function validateLocalAppCapabilityContracts(value: unknown): void;

package/dist/src/local-apps/capabilities/contracts.js

@@ -0,0 +1,32 @@
+import { ExtensionCapabilityBindingsSchema } from "../../../packages/gateway-contract/src/extension-capabilities.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
+import { CapabilityDispatcher } from "../../capabilities/runtime/dispatcher.js";
+import { registerNoteReadCapabilities } from "../../notes/capabilities/read.js";
+import { registerNoteWriteCapabilities } from "../../notes/capabilities/write.js";
+import { registerTaskReadCapabilities } from "../../tasks/capabilities/read.js";
+//#region src/local-apps/capabilities/contracts.ts
+init_src();
+/** Validate release bindings against the same production definitions without executing a domain service. */
+function validateLocalAppCapabilityContracts(value) {
+	const bindings = ExtensionCapabilityBindingsSchema.parse(value ?? []);
+	if (!bindings.length) return;
+	const dispatcher = new CapabilityDispatcher();
+	const unavailable = () => {
+		throw new Error("Contract validation must not execute a domain service");
+	};
+	registerNoteReadCapabilities(dispatcher, unavailable);
+	registerNoteWriteCapabilities(dispatcher, { getNotes: unavailable });
+	registerTaskReadCapabilities(dispatcher);
+	const context = {
+		principalId: "release-validator",
+		surface: "extension",
+		scopes: ["gateway.admin"],
+		authorize: () => false
+	};
+	for (const binding of bindings) {
+		const descriptor = dispatcher.describe(binding.id, context);
+		if (descriptor.majorVersion !== binding.majorVersion || descriptor.descriptorDigest !== binding.descriptorDigest) throw new Error(`Capability contract changed: ${binding.id}; update the binding and rerun acceptance`);
+	}
+}
+//#endregion
+export { validateLocalAppCapabilityContracts };

package/dist/src/local-apps/capabilities/read.d.ts

@@ -0,0 +1,3 @@
+import { type CapabilityDispatcher } from '../../capabilities/runtime/dispatcher.js';
+import type { LocalAppService } from '../service.js';
+export declare function registerLocalAppReadCapabilities(dispatcher: CapabilityDispatcher, service: LocalAppService): void;

package/dist/src/local-apps/capabilities/read.js

@@ -0,0 +1,48 @@
+import { ProductReadContracts } from "../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../capabilities/runtime/errors.js";
+import { defineReadCapability } from "../../capabilities/runtime/dispatcher.js";
+//#region src/local-apps/capabilities/read.ts
+init_src();
+function registerLocalAppReadCapabilities(dispatcher, service) {
+	const policy = {
+		majorVersion: 1,
+		effect: "read",
+		surfaces: ["http", "agent"],
+		scopes: ["gateway.admin"]
+	};
+	dispatcher.register(defineReadCapability({
+		...policy,
+		id: "xopc.local_apps.validate",
+		description: "Inspect local application files and validation issues without modifying the package or acceptance records.",
+		...ProductReadContracts["xopc.local_apps.validate"],
+		execute({ id }) {
+			if (!service.get(id)) throw new CapabilityError("NOT_FOUND", "Local app not found");
+			return { validation: service.validate(id) };
+		}
+	}));
+	dispatcher.register(defineReadCapability({
+		...policy,
+		id: "xopc.local_apps.list",
+		description: "List managed local applications.",
+		...ProductReadContracts["xopc.local_apps.list"],
+		execute: () => ({ apps: service.list().map((app) => ({ ...app })) })
+	}));
+	dispatcher.register(defineReadCapability({
+		...policy,
+		id: "xopc.local_apps.get",
+		description: "Read a local application, its preview and release history.",
+		...ProductReadContracts["xopc.local_apps.get"],
+		execute({ id }) {
+			const app = service.get(id);
+			if (!app) throw new CapabilityError("NOT_FOUND", "Local app not found");
+			return { app: {
+				...app,
+				releases: app.releases.map((release) => ({ ...release })),
+				acceptanceRuns: app.acceptanceRuns.map((run) => ({ ...run }))
+			} };
+		}
+	}));
+}
+//#endregion
+export { registerLocalAppReadCapabilities };

package/dist/src/local-apps/capabilities/runtime.d.ts

@@ -0,0 +1,16 @@
+import type { CapabilityCall } from '@xopcai/gateway-contract';
+import { type CapabilityContext, type CapabilityDispatcher } from '../../capabilities/runtime/dispatcher.js';
+import type { LocalAppService } from '../service.js';
+/** Shared UI/Agent execution boundary; callers cannot manufacture grants or release identity. */
+export declare function localAppCapabilities(apps: Pick<LocalAppService, 'getCapabilityAccess'>, dispatcher: CapabilityDispatcher, extensionId: string, manifestDigest: string, caller: CapabilityContext): {
+    list(): {
+        releaseId: string;
+        manifestDigest: string;
+        capabilities: import("@xopcai/gateway-contract").CapabilityDescriptor[];
+    };
+    call(id: string, call: CapabilityCall): Promise<{
+        status: "succeeded";
+        releaseId: string;
+        data: unknown;
+    }>;
+};

package/dist/src/local-apps/capabilities/runtime.js

@@ -0,0 +1,66 @@
+import { CapabilityError } from "../../capabilities/runtime/errors.js";
+import "../../capabilities/runtime/dispatcher.js";
+import { createHash } from "node:crypto";
+//#region src/local-apps/capabilities/runtime.ts
+/** Shared UI/Agent execution boundary; callers cannot manufacture grants or release identity. */
+function localAppCapabilities(apps, dispatcher, extensionId, manifestDigest, caller) {
+	const access = apps.getCapabilityAccess(extensionId, manifestDigest);
+	const current = () => {
+		if (apps.getCapabilityAccess(extensionId, manifestDigest).releaseId !== access.releaseId) throw new CapabilityError("CONTRACT_CHANGED", "Local app release changed");
+	};
+	const context = {
+		...caller,
+		surface: "extension",
+		allowedCapabilities: access.bindings.map((binding) => binding.id).filter((id) => !caller.allowedCapabilities || caller.allowedCapabilities.includes(id)),
+		assertCurrent: () => {
+			caller.assertCurrent?.();
+			current();
+		},
+		authorize: async (id, input) => {
+			const allowed = await caller.authorize(id, input);
+			current();
+			return allowed;
+		}
+	};
+	return {
+		list() {
+			current();
+			return {
+				releaseId: access.releaseId,
+				manifestDigest,
+				capabilities: dispatcher.list(context).filter((item) => access.bindings.some((binding) => binding.id === item.id && binding.majorVersion === item.majorVersion && binding.descriptorDigest === item.descriptorDigest))
+			};
+		},
+		async call(id, call) {
+			current();
+			const binding = access.bindings.find((item) => item.id === id);
+			if (!binding) throw new CapabilityError("FORBIDDEN", "Capability is not declared by this release");
+			if (binding.majorVersion !== call.majorVersion || binding.descriptorDigest !== call.descriptorDigest) throw new CapabilityError("CONTRACT_CHANGED", "Capability differs from the installed binding");
+			const write = dispatcher.describe(id, context).effect !== "read";
+			if (write && !call.idempotencyKey?.trim()) throw new CapabilityError("INVALID_INPUT", "A stable idempotencyKey is required");
+			const key = call.idempotencyKey ? createHash("sha256").update(JSON.stringify([
+				caller.principalId,
+				extensionId,
+				access.releaseId,
+				call.idempotencyKey
+			])).digest("hex") : void 0;
+			const result = await dispatcher.call(id, call.input, context, {
+				...call,
+				idempotencyKey: key
+			});
+			try {
+				current();
+			} catch (error) {
+				if (write) throw new CapabilityError("OUTCOME_UNKNOWN", "Write may have committed; retain the original idempotencyKey and reconcile after restoring access");
+				throw error;
+			}
+			return {
+				status: "succeeded",
+				releaseId: access.releaseId,
+				data: result
+			};
+		}
+	};
+}
+//#endregion
+export { localAppCapabilities };

package/dist/src/local-apps/capabilities/write.d.ts

@@ -0,0 +1,3 @@
+import { type CapabilityDispatcher } from '../../capabilities/runtime/dispatcher.js';
+import { type LocalAppService } from '../service.js';
+export declare function registerLocalAppWriteCapabilities(dispatcher: CapabilityDispatcher, service: LocalAppService): void;

package/dist/src/local-apps/capabilities/write.js

@@ -0,0 +1,35 @@
+import { LocalAppAcceptanceInputSchema, LocalAppAcceptanceOutputSchema } from "../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../capabilities/runtime/errors.js";
+import { defineAtomicCapability } from "../../capabilities/runtime/dispatcher.js";
+import { LocalAppAcceptanceValidationError, LocalAppRevisionConflictError } from "../service.js";
+import { z } from "zod";
+//#region src/local-apps/capabilities/write.ts
+init_src();
+function registerLocalAppWriteCapabilities(dispatcher, service) {
+	dispatcher.register(defineAtomicCapability({
+		id: "xopc.local_apps.record_acceptance",
+		majorVersion: 1,
+		effect: "local-write",
+		description: "Record supplied acceptance checks against the exact local source digest; this does not execute the checks.",
+		surfaces: ["http", "agent"],
+		scopes: ["gateway.admin"],
+		input: LocalAppAcceptanceInputSchema.extend({ id: z.string().min(1).max(512) }),
+		output: z.object({ acceptance: LocalAppAcceptanceOutputSchema }),
+		execute({ id, ...input }) {
+			if (!service.get(id)) throw new CapabilityError("NOT_FOUND", "Local app not found");
+			try {
+				return { acceptance: service.recordAcceptance(id, input) };
+			} catch (error) {
+				if (error instanceof LocalAppRevisionConflictError) throw new CapabilityError("REVISION_CONFLICT", error.message);
+				if (error instanceof LocalAppAcceptanceValidationError) throw new CapabilityError("INVALID_INPUT", error.message);
+				throw error;
+			}
+		},
+		afterCommit() {
+			service.flushAcceptanceEvents();
+		}
+	}));
+}
+//#endregion
+export { registerLocalAppWriteCapabilities };

package/dist/src/local-apps/release-lock.d.ts

@@ -0,0 +1,2 @@
+/** Serialize release mutations sharing an extension directory, including across service instances. */
+export declare function withLocalAppReleaseLock<T>(root: string, action: () => Promise<T>): Promise<T>;

package/dist/src/local-apps/release-lock.js

@@ -0,0 +1,20 @@
+//#region src/local-apps/release-lock.ts
+const pending = /* @__PURE__ */ new Map();
+/** Serialize release mutations sharing an extension directory, including across service instances. */
+async function withLocalAppReleaseLock(root, action) {
+	const previous = pending.get(root) ?? Promise.resolve();
+	let release;
+	const next = new Promise((resolve) => {
+		release = resolve;
+	});
+	pending.set(root, next);
+	await previous;
+	try {
+		return await action();
+	} finally {
+		release();
+		if (pending.get(root) === next) pending.delete(root);
+	}
+}
+//#endregion
+export { withLocalAppReleaseLock };

package/dist/src/local-apps/runtime-entry.d.ts

@@ -4,5 +4,3 @@ export declare const LOCAL_APP_RUNTIME_ENTRY = ".xopc/runtime/local-ui.js";
  * arbitrary Node.js in the gateway process through the extension `main` entry.
  */
 export declare const LOCAL_APP_RUNTIME_SOURCE = "export default Object.freeze({});\n";
-/** Exact legacy scaffold bytes accepted only to keep existing Phase 1 drafts upgradeable. */
-export declare function legacyLocalAppRuntimeSource(extensionId: string, name: string): string;

package/dist/src/local-apps/runtime-entry.js

@@ -6,18 +6,5 @@ const LOCAL_APP_RUNTIME_ENTRY = ".xopc/runtime/local-ui.js";
 */
 const LOCAL_APP_RUNTIME_SOURCE = `export default Object.freeze({});
 `;
-/** Exact legacy scaffold bytes accepted only to keep existing Phase 1 drafts upgradeable. */
-function legacyLocalAppRuntimeSource(extensionId, name) {
-	return `export default {
-  id: ${JSON.stringify(extensionId)},
-  name: ${JSON.stringify(name)},
-  version: '0.1.0',
-  kind: 'utility',
-  register(api) {
-    api.logger.info('Local app registered');
-  },
-};
-`;
-}
 //#endregion
-export { LOCAL_APP_RUNTIME_ENTRY, LOCAL_APP_RUNTIME_SOURCE, legacyLocalAppRuntimeSource };
+export { LOCAL_APP_RUNTIME_ENTRY, LOCAL_APP_RUNTIME_SOURCE };

package/dist/src/local-apps/scaffold.js

@@ -1,7 +1,10 @@
+import { ExtensionCapabilityBindingsSchema, extensionCapabilityPermissions } from "../../packages/gateway-contract/src/extension-capabilities.js";
+import { init_src } from "../../packages/gateway-contract/src/index.js";
 import { LOCAL_APP_RUNTIME_ENTRY, LOCAL_APP_RUNTIME_SOURCE } from "./runtime-entry.js";
 import { dirname, join } from "node:path";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/local-apps/scaffold.ts
+init_src();
 const LOCAL_APP_PERMISSIONS = ["theme", "storage"];
 function writeText(root, relativePath, content) {
 	const target = join(root, relativePath);
@@ -111,7 +114,7 @@ button?.addEventListener('click', () => {
 function readLocalAppPermissions(workspaceRoot) {
 	try {
 		const raw = JSON.parse(readFileSync(join(workspaceRoot, "xopc.extension.json"), "utf8"));
-		return Array.isArray(raw.ui?.permissions) ? raw.ui.permissions.filter((permission) => typeof permission === "string") : [];
+		return [...Array.isArray(raw.ui?.permissions) ? raw.ui.permissions.filter((permission) => typeof permission === "string") : [], ...extensionCapabilityPermissions(ExtensionCapabilityBindingsSchema.parse(raw.ui?.capabilities ?? []))];
 	} catch {
 		return [];
 	}

package/dist/src/local-apps/service.d.ts

@@ -3,6 +3,10 @@ import type { ExtensionLoader } from '../extensions/index.js';
 import type { ProjectService } from '../projects/index.js';
 import { LocalAppStore } from './store.js';
 import type { CreateLocalAppInput, LocalApp, LocalAppAcceptanceRun, LocalAppDetail, LocalAppPreviewTarget, LocalAppValidationResult, LocalAppUiGrant, RecordLocalAppAcceptanceInput } from './types.js';
+export declare class LocalAppRevisionConflictError extends Error {
+}
+export declare class LocalAppAcceptanceValidationError extends Error {
+}
 export interface LocalAppServiceOptions {
     projects: ProjectService;
     workspaceRoot: string;
@@ -18,20 +22,39 @@ export declare class LocalAppService {
     private readonly options;
     private readonly store;
     constructor(options: LocalAppServiceOptions, store?: LocalAppStore);
+    private recoveryRoot;
+    private recoveryMarker;
+    /** Reconcile interrupted mutations before any extension code or request can run. */
+    recoverPendingReleases(): Promise<void>;
+    private recoverReleases;
+    private mutateRelease;
     list(): LocalApp[];
     get(id: string): LocalAppDetail | null;
     getUiGrant(extensionId: string): LocalAppUiGrant;
-    grantUiPermissions(extensionId: string): LocalAppUiGrant;
+    getCapabilityAccess(extensionId: string, expectedManifestDigest: string): {
+        releaseId: string;
+        bindings: {
+            id: "xopc.notes.get" | "xopc.notes.list" | "xopc.tasks.get" | "xopc.tasks.list" | "xopc.notes.create" | "xopc.notes.update" | "xopc.notes.append";
+            majorVersion: number;
+            descriptorDigest: string;
+        }[];
+    };
+    grantUiPermissions(extensionId: string, expectedManifestDigest: string): LocalAppUiGrant;
     create(input: CreateLocalAppInput): LocalAppDetail;
     resolvePreview(previewToken: string): LocalAppPreviewTarget | null;
     validate(id: string): LocalAppValidationResult;
     recordAcceptance(id: string, input: RecordLocalAppAcceptanceInput): LocalAppAcceptanceRun;
+    flushAcceptanceEvents(): void;
     private releaseRoot;
     private refreshExtensions;
     private assertInstalledRuntime;
     private activateArtifact;
     install(id: string): Promise<LocalAppDetail>;
+    private installRelease;
     rollback(id: string, releaseId: string): Promise<LocalAppDetail>;
+    private rollbackRelease;
     setEnabled(id: string, enabled: boolean): Promise<LocalAppDetail>;
+    private setReleaseEnabled;
     uninstall(id: string): Promise<LocalAppDetail>;
+    private uninstallRelease;
 }