gh-inari 0.15.0 → 0.17.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "inari",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Governed GitHub Issue/PR/template workflows via the inari CLI. Prefer inari over raw gh for operations it owns; use inari skill for operational playbooks.",
   "skills": "skills/inari"
 }

package/README.md

@@ -52,6 +52,14 @@ Setup stores only a repository-scoped, secret-free Runtime profile. It never
 commits, pushes, approves, or merges Runtime Authority trust; `ready` is
 reported only after canonical protected-ref readiness succeeds.
 
+The local setup state is shared by the CLI and a loopback browser console:
+
+```bash
+inari setup status          # canonical state and the one next action
+inari setup next            # perform exactly that action through its owner
+inari setup console         # owned loopback setup host; works before any key or trust
+```
+
 ## The governed path
 
 ```text

package/dist/admission/authorization.d.ts

@@ -0,0 +1,31 @@
+import type { LocalSessionBinding } from "../local-control/session-binding.js";
+import type { LocalExecutorEvidenceRequest } from "../local-control/executor-http.js";
+import { type ExecutionIntent } from "../local-control/execution-intent.js";
+import { type Delegator } from "../agent-authority/delegator.js";
+import { type AuthorizedExecution } from "../authorized-execution.js";
+import { type ObserveLocalBranchInput } from "../cli/runtime/branch-observation.js";
+/** Reads current Executor evidence through the neutral Executor client protocol. */
+export type AdmissionEvidenceReader = (request: LocalExecutorEvidenceRequest) => Promise<unknown>;
+export interface AdmissionAuthorizationOptions {
+    readonly runtimeAuthority: Delegator;
+    readonly readEvidence: AdmissionEvidenceReader;
+    readonly environment?: NodeJS.ProcessEnv;
+    readonly now?: () => Date;
+    /** Public owner-port observation supplied by the caller, without provider credentials. */
+    readonly branchObservation?: ObserveLocalBranchInput;
+}
+export interface AdmittedSession {
+    readonly id: string;
+    readonly status: string;
+    readonly exp: number;
+}
+/** Admits a validated Session binding against current Executor trust evidence. */
+export declare function admitSession(binding: LocalSessionBinding, options: AdmissionAuthorizationOptions): Promise<AdmittedSession>;
+/** Closes a validated Session binding against current Executor trust evidence. */
+export declare function closeSession(binding: LocalSessionBinding, options: AdmissionAuthorizationOptions): Promise<Omit<AdmittedSession, "exp">>;
+/**
+ * Produces an `AuthorizedExecution` for a validated ExecutionIntent on an
+ * active Session, after every current-evidence, Implementation and capability
+ * check. It never dispatches the execution.
+ */
+export declare function authorizeExecutionIntent(intent: ExecutionIntent, sessionId: string, options: AdmissionAuthorizationOptions): Promise<AuthorizedExecution>;

package/dist/admission/authorization.js

@@ -0,0 +1,329 @@
+/**
+ * Admission authorization (#1107). Private Admission module: it admits and
+ * closes Sessions against current Executor trust evidence and produces an
+ * `AuthorizedExecution` only after the existing Session, repository, task,
+ * Implementation, capability, expiry and replay checks. It reuses the pure
+ * Session, Delegator and capability validators, reaches the Executor only
+ * through the evidence reader it is given, and holds no provider credential or
+ * private signing key. Every failure throws; the server maps it to a bounded
+ * denial.
+ */
+import { closeAdmissionSession, createAdmissionSession, readAdmissionSession } from "../local-control/session-store.js";
+import { executionIntentIssue } from "../local-control/execution-intent.js";
+import { validateDelegator } from "../agent-authority/delegator.js";
+import { delegatorPublicKeyFingerprint } from "../agent-authority/delegator-key.js";
+import { admitAuthenticatedSessionCapability, } from "../agent-authority/capability-admission.js";
+import { authorizeBranchAdvance } from "../agent-authority/branch-advance.js";
+import { createCapabilityExecutionProvenance, } from "../agent-authority/capability-provenance.js";
+import { canonicalJsonString } from "../agent-authority/codec.js";
+import { createAuthorizedExecution } from "../authorized-execution.js";
+import { changeReadRequest } from "../change-execution-port.js";
+import { validateChangeProjectionResult } from "../change.js";
+import { tryAuthorizeImplementation } from "../implementation-authorization.js";
+import { projectImplementationSessionAuthorizationBinding } from "../implementation-session-binding.js";
+import { tryProjectImplementationScope } from "../implementation-scope-projection.js";
+import { assertTrustedExecution, validateIssuerRepositoryIdentity, } from "../github/effect-authorizer.js";
+import { observeLocalBranch } from "../cli/runtime/branch-observation.js";
+function requireCurrentBranchObservation(binding, options) {
+    if (binding.branchObservation === undefined)
+        return;
+    if (options.branchObservation === undefined)
+        throw new Error("Current repository branch observation is missing.");
+    let current;
+    try {
+        current = observeLocalBranch(options.branchObservation);
+    }
+    catch {
+        throw new Error("Current repository branch observation is invalid or stale.");
+    }
+    if (canonicalJsonString(current) !==
+        canonicalJsonString(binding.branchObservation))
+        throw new Error("Current repository branch observation contradicts Session binding.");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.includes(key));
+}
+function pinnedRuntimeAuthority(value) {
+    const result = validateDelegator(value);
+    if (!result.valid || result.value === undefined)
+        throw new Error("Public Runtime Authority trust is invalid.");
+    return result.value;
+}
+function sameRepository(left, right) {
+    if (!isRecord(left))
+        return false;
+    return (left.repositoryHost === "github.com" &&
+        left.repositoryId === right.id &&
+        (left.nameWithOwner === undefined ||
+            (typeof left.nameWithOwner === "string" && left.nameWithOwner.toLowerCase() === right.name.toLowerCase())));
+}
+function evidenceRepository(repository) {
+    return { id: repository.id, name: repository.name };
+}
+function intentRepositoryMatchesBinding(intent, binding) {
+    return (intent.repositoryHost === "github.com" &&
+        intent.repositoryId === binding.id &&
+        (intent.repositoryNameWithOwner === undefined ||
+            intent.repositoryNameWithOwner.toLocaleLowerCase("en-US") === binding.name.toLocaleLowerCase("en-US")));
+}
+function makeContext(binding, repository, authority, intent, operation, nowSeconds) {
+    const request = Object.freeze({
+        requestId: intent.requestId,
+        operation,
+        issuedAt: nowSeconds,
+        expiresAt: nowSeconds + 60,
+    });
+    return Object.freeze({
+        repository,
+        runtimeAuthority: Object.freeze({ id: binding.authority.id, kid: binding.authority.id }),
+        session: Object.freeze({ id: binding.sessionId, certificateJti: binding.signature }),
+        task: binding.task,
+        capabilities: binding.capabilities,
+        authority,
+        request,
+        semanticRequest: intent.request,
+    });
+}
+function capabilityOperation(intent) {
+    return intent.operation === "pullRequest.publish" ? "pullRequest.create" : intent.operation;
+}
+function intentSubject(intent) {
+    const issue = executionIntentIssue(intent);
+    if (issue === undefined)
+        throw new Error("ExecutionIntent has no task Issue.");
+    if (intent.operation === "branch.advance") {
+        const request = intent.request;
+        return { kind: "branch", issue, branch: request.branch };
+    }
+    if (intent.operation === "pullRequest.publish") {
+        const request = intent.request;
+        if (typeof request.expectedHead !== "string" || typeof request.expectedBase !== "string")
+            throw new Error("Pull request publication route is unavailable.");
+        return { kind: "pullRequest", issue, head: request.expectedHead, base: request.expectedBase };
+    }
+    return { kind: "change", issue };
+}
+function readTreeDelta(intent) {
+    if (intent.operation !== "branch.advance")
+        return undefined;
+    const request = intent.request;
+    return {
+        changes: request.changes.map((change) => ({ operation: "modify", path: change.path })),
+    };
+}
+function validateEvidence(value, binding, pinnedAuthority) {
+    if (!isRecord(value) ||
+        !exactKeys(value, ["repository", "authority", "runtimeAuthority", "change", "implementation", "reviewEvidence"]))
+        throw new Error("Executor evidence response is malformed.");
+    const repositoryResult = validateIssuerRepositoryIdentity(value.repository);
+    if (!repositoryResult.valid ||
+        repositoryResult.value === undefined ||
+        !sameRepository(repositoryResult.value, binding.repository))
+        throw new Error("Executor repository evidence does not match Session.");
+    const authority = value.authority;
+    if (!isRecord(authority) ||
+        !exactKeys(authority, ["ref", "sha"]) ||
+        typeof authority.ref !== "string" ||
+        !/^refs\/heads\/[A-Za-z0-9._/-]+$/u.test(authority.ref) ||
+        typeof authority.sha !== "string" ||
+        !/^[a-f0-9]{40}$/u.test(authority.sha))
+        throw new Error("Executor Authority evidence is malformed.");
+    const runtime = pinnedRuntimeAuthority(value.runtimeAuthority);
+    if (runtime.id !== binding.authority.id ||
+        delegatorPublicKeyFingerprint(runtime.key) !== binding.authority.publicKeyFingerprint ||
+        canonicalJsonString(runtime) !==
+            canonicalJsonString(pinnedAuthority))
+        throw new Error("Current Runtime Authority trust does not match Admission configuration.");
+    const projection = validateChangeProjectionResult(value.change);
+    if (!projection.valid || projection.projection === undefined)
+        throw new Error("Current Change evidence is malformed.");
+    if (!isRecord(value.implementation) ||
+        !exactKeys(value.implementation, [
+            "implementation",
+            "issue",
+            "repository",
+            "base",
+            "readiness",
+            "change",
+            "pullRequest",
+        ]))
+        throw new Error("Current Implementation evidence is malformed.");
+    return {
+        repository: repositoryResult.value,
+        authority: { ref: authority.ref, sha: authority.sha },
+        change: projection.projection,
+        implementation: value.implementation,
+        ...(value.reviewEvidence === undefined ? {} : { reviewEvidence: value.reviewEvidence }),
+    };
+}
+function validateTrustEvidence(value, binding, pinnedAuthority) {
+    if (!isRecord(value) || !exactKeys(value, ["repository", "authority", "runtimeAuthority"]))
+        throw new Error("Executor Runtime Authority evidence is malformed.");
+    if (!sameRepository(value.repository, binding.repository))
+        throw new Error("Executor repository evidence does not match Session.");
+    const authority = value.authority;
+    if (!isRecord(authority) ||
+        !exactKeys(authority, ["ref", "sha"]) ||
+        typeof authority.ref !== "string" ||
+        !/^refs\/heads\/[A-Za-z0-9._/-]+$/u.test(authority.ref) ||
+        typeof authority.sha !== "string" ||
+        !/^[a-f0-9]{40}$/u.test(authority.sha))
+        throw new Error("Executor Authority evidence is malformed.");
+    const current = pinnedRuntimeAuthority(value.runtimeAuthority);
+    if (current.id !== binding.authority.id ||
+        delegatorPublicKeyFingerprint(current.key) !== binding.authority.publicKeyFingerprint ||
+        canonicalJsonString(current) !==
+            canonicalJsonString(pinnedAuthority))
+        throw new Error("Current Runtime Authority trust does not match Admission configuration.");
+    return current;
+}
+function currentImplementationAuthorization(evidence, binding) {
+    const implementationEvidence = evidence.implementation;
+    const authorizationInput = {
+        implementation: implementationEvidence.implementation,
+        issue: implementationEvidence.issue,
+        repository: implementationEvidence.repository,
+        base: implementationEvidence.base,
+        readiness: implementationEvidence.readiness,
+    };
+    const authorization = tryAuthorizeImplementation(authorizationInput);
+    if (!authorization.valid || authorization.status !== "authorized" || authorization.authorization === undefined)
+        throw new Error("Current Implementation is not authorized.");
+    const currentInput = { ...authorizationInput, authorization: authorization.authorization };
+    const bindingProjection = projectImplementationSessionAuthorizationBinding({
+        ...currentInput,
+        task: binding.task,
+    });
+    const scope = tryProjectImplementationScope(currentInput);
+    if (!scope.valid || scope.projection === undefined)
+        throw new Error("Current Implementation scope is unavailable.");
+    return { binding: bindingProjection, scope: scope.projection };
+}
+async function currentTrust(binding, options) {
+    const evidence = await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(binding.repository),
+        authorityId: binding.authority.id,
+    });
+    return validateTrustEvidence(evidence, binding, options.runtimeAuthority);
+}
+/** Admits a validated Session binding against current Executor trust evidence. */
+export async function admitSession(binding, options) {
+    requireCurrentBranchObservation(binding, options);
+    const current = await currentTrust(binding, options);
+    const snapshot = createAdmissionSession(binding, current, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    return { id: snapshot.record.binding.sessionId, status: snapshot.status, exp: snapshot.record.binding.exp };
+}
+/** Closes a validated Session binding against current Executor trust evidence. */
+export async function closeSession(binding, options) {
+    const current = await currentTrust(binding, options);
+    const snapshot = closeAdmissionSession(binding, current, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    return { id: snapshot.record.binding.sessionId, status: snapshot.status };
+}
+/**
+ * Produces an `AuthorizedExecution` for a validated ExecutionIntent on an
+ * active Session, after every current-evidence, Implementation and capability
+ * check. It never dispatches the execution.
+ */
+export async function authorizeExecutionIntent(intent, sessionId, options) {
+    const stored = readAdmissionSession(sessionId, options.runtimeAuthority, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    if (stored === undefined || stored.status !== "active")
+        throw new Error("Session is unavailable.");
+    const binding = stored.record.binding;
+    requireCurrentBranchObservation(binding, options);
+    if (binding.branchObservation !== undefined &&
+        intent.operation === "branch.advance" &&
+        intent.request.branch !== binding.branchObservation.expectedBranch)
+        throw new Error("Branch advance does not match the Session policy branch.");
+    if (!intentRepositoryMatchesBinding(intent.repository, binding.repository))
+        throw new Error("Execution repository does not match Session.");
+    const issue = executionIntentIssue(intent);
+    if (issue === undefined || binding.task.kind !== "issue" || binding.task.number !== issue)
+        throw new Error("Execution task does not match Session.");
+    const evidenceValue = await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(binding.repository),
+        authorityId: binding.authority.id,
+        issue,
+        implementationIssue: binding.task.number,
+    });
+    const evidence = validateEvidence(evidenceValue, binding, options.runtimeAuthority);
+    const current = currentImplementationAuthorization(evidence, binding);
+    const operation = capabilityOperation(intent);
+    const nowSeconds = Math.floor((options.now?.() ?? new Date()).getTime() / 1000);
+    const context = {
+        ...makeContext(binding, evidence.repository, evidence.authority, intent, operation, nowSeconds),
+        implementationBinding: current.binding,
+        implementationScope: current.scope,
+    };
+    const admission = admitAuthenticatedSessionCapability({
+        context,
+        operation,
+        subject: intentSubject(intent),
+        projection: evidence.change,
+        ...(readTreeDelta(intent) === undefined ? {} : { treeDelta: readTreeDelta(intent) }),
+        ...(evidence.reviewEvidence === undefined ? {} : { reviewEvidence: evidence.reviewEvidence }),
+    });
+    let branchAuthorization;
+    if (intent.operation === "branch.advance") {
+        const authorized = authorizeBranchAdvance({ context, admission, request: intent.request });
+        if (!authorized.valid)
+            throw new Error("Branch advance is outside the current authorized scope.");
+        branchAuthorization = authorized.authorization;
+    }
+    const provenanceRequest = {
+        ...context.request,
+        operation: intent.operation,
+    };
+    const provenance = createCapabilityExecutionProvenance({
+        version: 1,
+        stage: "authorized",
+        repository: evidence.repository,
+        runtimeAuthority: context.runtimeAuthority,
+        session: context.session,
+        authority: context.authority,
+        request: provenanceRequest,
+        subject: admission.subject,
+        capability: admission.capability,
+    });
+    const localAdmissionExecution = assertTrustedExecution({
+        version: 1,
+        runtime: "inari-local-admission",
+        event: "authorized-session-execution",
+        repository: evidence.repository,
+        requestId: intent.requestId,
+        sessionId: binding.sessionId,
+        sessionBindingSignature: binding.signature,
+        requester: `session:${binding.sessionId}`,
+    });
+    const executionInput = {
+        version: 1,
+        operation: intent.operation,
+        repository: evidence.repository,
+        task: binding.task,
+        subject: admission.subject,
+        capability: admission.capability,
+        provenance,
+        request: intent.operation === "change.show" ? changeReadRequest(issue) : intent.request,
+    };
+    if (intent.operation === "change.show")
+        executionInput.initialProjection = evidence.change;
+    else if (intent.operation === "branch.advance")
+        executionInput.branchAuthorization = branchAuthorization;
+    else
+        executionInput.execution = localAdmissionExecution;
+    return createAuthorizedExecution(executionInput);
+}
+//# sourceMappingURL=authorization.js.map

package/dist/admission/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/admission/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGxH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAkB,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,mCAAmC,GAGpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAqC,MAAM,sCAAsC,CAAC;AACjH,OAAO,EACL,mCAAmC,GAEpC,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAA2B,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAA4B,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,8BAA8B,EAA+B,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAyC,MAAM,oCAAoC,CAAC;AACvH,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,gCAAgC,GAEjC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAgC,MAAM,sCAAsC,CAAC;AAcxG,SAAS,+BAA+B,CAAC,OAA4B,EAAE,OAAsC;IAC3G,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IACpD,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAClH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IACE,mBAAmB,CAAC,OAAwC,CAAC;QAC7D,mBAAmB,CAAC,OAAO,CAAC,iBAAkD,CAAC;QAE/E,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;AAC1F,CAAC;AAQD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,OAA0B;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,KAAmC;IACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CACL,IAAI,CAAC,cAAc,KAAK,YAAY;QACpC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,EAAE;QAC9B,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAC7G,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAwC;IAClE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAqC,EACrC,OAAqC;IAErC,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,YAAY;QACtC,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE;QAClC,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC3C,MAAM,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,OAA4B,EAC5B,UAA8B,EAC9B,SAAyD,EACzD,MAAuB,EACvB,SAAuC,EACvC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS;QACT,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,UAAU,GAAG,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACxF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACpF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS;QACT,OAAO;QACP,eAAe,EAAE,MAAM,CAAC,OAAkE;KAC3F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAA+B,CAAC;QACvD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACtF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;IAC/D,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,OAA4B,EAC5B,eAA0B;IAQ1B,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAEhH,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,IACE,CAAC,gBAAgB,CAAC,KAAK;QACvB,gBAAgB,CAAC,KAAK,KAAK,SAAS;QACpC,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;QAE3D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAEtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE;QACnC,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,oBAAoB;QACrF,mBAAmB,CAAC,OAAwC,CAAC;YAC3D,mBAAmB,CAAC,eAAgD,CAAC;QAEvE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAC1D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/B,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE;YAC/B,gBAAgB;YAChB,OAAO;YACP,YAAY;YACZ,MAAM;YACN,WAAW;YACX,QAAQ;YACR,aAAa;SACd,CAAC;QAEF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,KAAK;QAClC,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;QACrD,MAAM,EAAE,UAAU,CAAC,UAAU;QAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,OAA4B,EAAE,eAA0B;IACrG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAEtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE;QACnC,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,oBAAoB;QACrF,mBAAmB,CAAC,OAAwC,CAAC;YAC3D,mBAAmB,CAAC,eAAgD,CAAC;QAEvE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kCAAkC,CACzC,QAA6C,EAC7C,OAA4B;IAE5B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvD,MAAM,kBAAkB,GAAqC;QAC3D,cAAc,EAAE,sBAAsB,CAAC,cAAoE;QAC3G,KAAK,EAAE,sBAAsB,CAAC,KAAkD;QAChF,UAAU,EAAE,sBAAsB,CAAC,UAA4D;QAC/F,IAAI,EAAE,sBAAsB,CAAC,IAAgD;QAC7E,SAAS,EAAE,sBAAsB,CAAC,SAAS;KAC5C,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,YAAY,IAAI,aAAa,CAAC,aAAa,KAAK,SAAS;QAC5G,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,EAAE,GAAG,kBAAkB,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC;IAC3F,MAAM,iBAAiB,GAAG,gDAAgD,CAAC;QACzE,GAAG,YAAY;QACf,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpH,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE,OAAsC;IAC9F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;KAClC,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,+BAA+B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE;QACxD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9G,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAuB,EACvB,SAAiB,EACjB,OAAsC;IAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;QACvE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACtC,+BAA+B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,IACE,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACvC,MAAM,CAAC,SAAS,KAAK,gBAAgB;QACpC,MAAM,CAAC,OAAwC,CAAC,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,cAAc;QAEpG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;QACvF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC/C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,KAAK;QACL,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;QAC/F,qBAAqB,EAAE,OAAO,CAAC,OAAO;QACtC,mBAAmB,EAAE,OAAO,CAAC,KAAK;KACK,CAAC;IAC1C,MAAM,SAAS,GAAG,mCAAmC,CAAC;QACpD,OAAO;QACP,SAAS;QACT,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;QAC9B,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;KAC9F,CAAC,CAAC;IACH,IAAI,mBAA4B,CAAC;IACjC,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAClG,mBAAmB,GAAG,UAAU,CAAC,aAAa,CAAC;IACjD,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,GAAG,OAAO,CAAC,OAAO;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,UAAU,GAAkC,mCAAmC,CAAC;QACpF,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;QACrD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,uBAAuB;QAChC,KAAK,EAAE,8BAA8B;QACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,uBAAuB,EAAE,OAAO,CAAC,SAAS;QAC1C,SAAS,EAAE,WAAW,OAAO,CAAC,SAAS,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,cAAc,GAA4B;QAC9C,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU;QACV,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;KACxF,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa;QAAE,cAAc,CAAC,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC;SACtF,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,cAAc,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;;QACpG,cAAc,CAAC,SAAS,GAAG,uBAAuB,CAAC;IACxD,OAAO,yBAAyB,CAAC,cAAc,CAAC,CAAC;AACnD,CAAC"}

package/dist/admission/server.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Admission server (#1107). Public Admission role entry for serving: the
+ * bounded local Admission HTTP wire, mTLS enforcement and process startup.
+ * Session admission and execution authorization are delegated to the private
+ * authorization module; the Executor is reached only through the neutral
+ * `LocalExecutorClient` protocol client. The server holds no provider
+ * credential and no private signing key.
+ */
+import { type Server } from "node:http";
+import type { Delegator } from "../agent-authority/delegator.js";
+import type { AuthorizedExecution } from "../authorized-execution.js";
+import { type RepositoryIdentity } from "../github/effect-authorizer.js";
+import type { LocalAdmissionConfig } from "../local-control/config.js";
+import type { LocalExecutorEvidenceRequest } from "../local-control/executor-http.js";
+import { type LocalRuntimeEndpoint } from "../local-control/runtime-discovery.js";
+import { type LocalMtlsIdentity } from "../local-control/transport-security.js";
+export declare const LOCAL_ADMISSION_STATUS_PATH: "/status";
+export declare const LOCAL_ADMISSION_PROTOCOL_VERSION: 1;
+export declare const LOCAL_ADMISSION_HEALTH_PATH: "/health";
+export declare const LOCAL_ADMISSION_SESSIONS_PATH: "/v1/sessions";
+export declare const LOCAL_ADMISSION_REPOSITORY_PATH: "/v1/repository";
+export declare const LOCAL_ADMISSION_EXECUTIONS_PATH: "/v1/executions";
+export declare const LOCAL_ADMISSION_SESSION_ID_HEADER: "x-inari-session-id";
+export declare const MAX_LOCAL_ADMISSION_BODY_BYTES = 1048576;
+/**
+ * Executor surface Admission consumes. `LocalExecutorClient` (the neutral
+ * client of the Executor wire protocol) implements it; Admission never loads
+ * Executor internals.
+ */
+export interface AdmissionExecutorClient {
+    verifyReady(): Promise<unknown>;
+    resolveRepository?(repositoryNameWithOwner: string): Promise<RepositoryIdentity>;
+    readEvidence(request: LocalExecutorEvidenceRequest): Promise<unknown>;
+    execute(execution: AuthorizedExecution): Promise<unknown>;
+}
+export declare function createLocalAdmissionHttpServer(config: LocalAdmissionConfig, version: string, runtimeAuthority: Delegator, executor: AdmissionExecutorClient, options?: {
+    readonly environment?: NodeJS.ProcessEnv;
+    readonly now?: () => Date;
+    readonly transport?: LocalMtlsIdentity;
+}): Server;
+export declare function startConfiguredLocalAdmission(version: string, environment?: NodeJS.ProcessEnv): Promise<{
+    readonly server: Server;
+    readonly config: LocalAdmissionConfig;
+    readonly announcement: LocalRuntimeEndpoint;
+}>;