hyperbrane 0.1.0

package/dist/upstreams/index.d.ts

@@ -0,0 +1,6 @@
+import type { UpstreamDefinition } from "../portal-gateway/upstream.ts";
+/**
+ * Registered on every gateway whose creator doesn't list its own: a gateway that doesn't know an
+ * upstream passes its tokens through to the dimension untouched.
+ */
+export declare const BUILTIN_UPSTREAMS: UpstreamDefinition[];

package/dist/upstreams/index.js

@@ -0,0 +1,7 @@
+import anthropic from "./anthropic.js";
+import openai from "./openai.js";
+/**
+ * Registered on every gateway whose creator doesn't list its own: a gateway that doesn't know an
+ * upstream passes its tokens through to the dimension untouched.
+ */
+export const BUILTIN_UPSTREAMS = [anthropic, openai];

package/dist/upstreams/openai.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Codex: a ChatGPT plan through `codex login --device-auth`, or an OpenAI API key. Once the gateway
+ * holds a sign-in, `codex login --device-auth` in any dimension completes without a browser: the
+ * gateway approves the device login and answers the exchange itself.
+ */
+declare const _default: import("../portal-gateway/upstream.ts").UpstreamDefinition;
+export default _default;

package/dist/upstreams/openai.js

@@ -0,0 +1,40 @@
+import { defineUpstream } from "../portal-gateway/upstream.js";
+/**
+ * Codex: a ChatGPT plan through `codex login --device-auth`, or an OpenAI API key. Once the gateway
+ * holds a sign-in, `codex login --device-auth` in any dimension completes without a browser: the
+ * gateway approves the device login and answers the exchange itself.
+ */
+export default defineUpstream({
+    name: "openai",
+    modes: {
+        oauth: {
+            // The API (HTTP and websocket) is on chatgpt.com; auth.openai.com is the token endpoint.
+            hosts: ["chatgpt.com", "auth.openai.com"],
+            present: { header: "authorization", scheme: "Bearer" },
+            // The sign-in exchange is form-encoded, the refresh JSON.
+            tokenUrl: "https://auth.openai.com/oauth/token",
+            // codex decodes both JWTs: the access token's exp decides when it refreshes, and the id
+            // token's claims give it the account and plan.
+            fakes: {
+                access: { jwt: true },
+                id: { jwt: true },
+                refresh: { prefix: "rt.1." },
+            },
+            // Another session token, in the body and again in a header; codex doesn't keep it.
+            strip: { fields: ["oai_is"], headers: ["x-oai-is-update"] },
+            // codex polls this until the device login is approved, then exchanges the code it returns
+            // (with the returned verifier, which it doesn't check) at tokenUrl, answered by the gateway.
+            answers: [
+                {
+                    url: "https://auth.openai.com/api/accounts/deviceauth/token",
+                    json: { status: "success", authorization_code: "gateway", code_challenge: "gateway", code_verifier: "gateway" },
+                },
+            ],
+        },
+        apiKey: {
+            hosts: ["api.openai.com"],
+            present: { header: "authorization", scheme: "Bearer" },
+            fake: { prefix: "sk-proj-" },
+        },
+    },
+});

package/dist/vendor-types/claude/agent-sdk/agentSdkTypes.d.ts

@@ -0,0 +1 @@
+export * from './sdk.js'

package/dist/vendor-types/claude/agent-sdk/bridge.d.ts

@@ -0,0 +1,388 @@
+/**
+ * API surface definition for @anthropic-ai/claude-agent-sdk/bridge.
+ *
+ * This file is the source of truth for the /bridge export's public types.
+ * It imports ONLY from agentSdkTypes.ts so the compiled .d.ts has exactly
+ * one import to rewrite (./agentSdkTypes → ./sdk) for the flat package layout.
+ *
+ * Compiled by scripts/build-ant-sdk-typings.sh; see build-agent-sdk.sh for the
+ * copy into the package. Runtime code is in agentSdkBridge.ts (separate file,
+ * bun-built to bridge.mjs).
+ *
+ * The two type definitions below are copied from src/bridge/sessionHandle.ts.
+ * Keep in sync — sessionHandle.ts is the implementation source of truth;
+ * this file exists to produce a clean .d.ts without walking the implementation
+ * import graph.
+ */
+import type { PermissionMode, SDKControlRequest, SDKControlResponse, SDKMessage } from './agentSdkTypes.js';
+/**
+ * Session state reported to the CCR /worker endpoint.
+ * @alpha
+ */
+export type SessionState = 'idle' | 'running' | 'requires_action';
+/**
+ * Per-session bridge transport handle.
+ *
+ * Auth is instance-scoped — the JWT lives in this handle's closure, not a
+ * process-wide env var, so multiple handles can coexist without stomping
+ * each other.
+ * @alpha
+ */
+export type BridgeSessionHandle = {
+    readonly sessionId: string;
+    /**
+     * Live SSE event-stream high-water mark. Updates as the underlying
+     * transport receives frames. Persist this and pass back as
+     * `initialSequenceNum` on re-attach so the server resumes instead of
+     * replaying full history.
+     */
+    getSequenceNum(): number;
+    /**
+     * Worker epoch the current transport is writing as. Callers that
+     * reconnect for a token refresh (not a cold re-attach) pass this back
+     * via `reconnectTransport({epoch})` so the handle reuses the epoch
+     * instead of calling registerWorker again.
+     */
+    getEpoch(): number | undefined;
+    /** True once the write path (CCRClient initialize) is ready. */
+    isConnected(): boolean;
+    /** Write a single SDKMessage. `session_id` is injected automatically. */
+    write(msg: SDKMessage): void;
+    /** Signal turn boundary — claude.ai stops the "working" spinner. */
+    sendResult(): void;
+    /** Forward a permission request (`can_use_tool`) to claude.ai. */
+    sendControlRequest(req: SDKControlRequest): void;
+    /** Forward a permission response back through the bridge. */
+    sendControlResponse(res: SDKControlResponse): void;
+    /**
+     * Tell claude.ai to dismiss a pending permission prompt (e.g. caller
+     * aborted the turn locally before the user answered).
+     */
+    sendControlCancelRequest(requestId: string): void;
+    /**
+     * Swap the underlying transport in place with a fresh JWT (and epoch).
+     * Carries the SSE sequence number so the server resumes the stream.
+     * Call this when the poll loop re-dispatches work for the same session
+     * with a fresh secret (JWT is 4h; backend mints a new one every dispatch).
+     *
+     * Throws if `createV2ReplTransport` fails (registerWorker error, etc).
+     * Caller should treat that as a close and drop this handle.
+     */
+    reconnectTransport(opts: {
+        ingressToken: string;
+        apiBaseUrl: string;
+        /** Omit to reuse the current transport's epoch (token-refresh reconnect); provide to override. */
+        epoch?: number;
+    }): Promise<void>;
+    /**
+     * PUT /worker state. Multi-session workers: `running` on turn start,
+     * `requires_action` on permission prompt, `idle` on turn end. Daemon
+     * callers don't need this — user watches the REPL locally.
+     */
+    reportState(state: SessionState): void;
+    /** PUT /worker external_metadata (branch, dir shown on claude.ai). */
+    reportMetadata(metadata: Record<string, unknown>): void;
+    /**
+     * POST /worker/events/{id}/delivery. Populates CCR's processing_at /
+     * processed_at columns. `received` is auto-fired internally; this
+     * surfaces `processing` (turn start) and `processed` (turn end).
+     */
+    reportDelivery(eventId: string, status: 'processing' | 'processed'): void;
+    /** Drain the write queue. Call before close() when delivery matters. */
+    flush(): Promise<void>;
+    close(): void;
+};
+/** @alpha */
+export type AttachBridgeSessionOptions = {
+    /**
+     * Session ID (`cse_*` form). Comes from `WorkResponse.data.id` in the
+     * poll-loop path, or from whatever created the session.
+     */
+    sessionId: string;
+    /** Worker JWT. Comes from `decodeWorkSecret(work.secret).session_ingress_token`. */
+    ingressToken: string;
+    /** `WorkSecret.api_base_url` or wherever the session ingress lives. */
+    apiBaseUrl: string;
+    /**
+     * Worker epoch if already known (e.g. from a `/bridge` call that bumps
+     * epoch server-side). Omit to have `createV2ReplTransport` call
+     * `registerWorker` itself — correct for poll-loop callers where the
+     * work secret doesn't carry epoch.
+     */
+    epoch?: number;
+    /**
+     * SSE sequence-number high-water mark from a prior handle or persisted
+     * state. Seeds the first SSE connect's `from_sequence_num` so the server
+     * resumes instead of replaying full history. Omit (→ 0) for genuinely
+     * fresh attach.
+     */
+    initialSequenceNum?: number;
+    /**
+     * CCRClient heartbeat interval seed. Defaults to 20s. The server-advised
+     * interval (ccr_heartbeat_policy) overrides this after the first heartbeat.
+     */
+    heartbeatIntervalMs?: number;
+    /**
+     * When true, the bridge only forwards events outbound (local → CCR). The
+     * SSE read stream is not opened — no inbound events are received. Control
+     * requests that arrive via the write-path ACK channel reply with an error
+     * instead of false-success. onInboundMessage is never called. Use for
+     * mirror-mode attachments where the remote UI should see the session but
+     * not be able to drive it.
+     */
+    outboundOnly?: boolean;
+    /**
+     * User message typed on claude.ai. Echoes of outbound writes and
+     * re-deliveries of prompts already forwarded are filtered before this
+     * fires. May be async (e.g. attachment resolution).
+     */
+    onInboundMessage?: (msg: SDKMessage) => void | Promise<void>;
+    /**
+     * `control_response` from claude.ai — the user answered a `can_use_tool`
+     * prompt sent via `sendControlRequest`. Caller correlates by `request_id`.
+     * Return `false` when the response is rejected (malformed/forged) so the
+     * prompt stays eligible for initialize re-delivery; void = accepted.
+     */
+    onPermissionResponse?: (res: SDKControlResponse) => boolean | void;
+    /** `interrupt` control_request from claude.ai. Already auto-replied-to. */
+    onInterrupt?: () => void;
+    /**
+     * `stop_task` control_request from claude.ai — per-task Stop from the
+     * client's tasks panel. Resolve = stopped (hosts should treat a task the
+     * process no longer tracks or that already finished as stopped and
+     * resolve, so the client prunes the stale row — but NOT a live paused or
+     * pending task, nor an ambiguous name matching several live tasks: those
+     * should reject so the user sees an accurate
+     * refusal); reject = error control_response with the
+     * rejection's message. Omit if the host has no task registry — the CLI
+     * then answers with a "not supported in this context" error.
+     */
+    onStopTask?: (taskId: string) => Promise<void>;
+    /**
+     * `background_tasks` from claude.ai — the client's Ctrl+B. With a
+     * toolUseId, background the single foreground task that tool_use block
+     * started and return whether one was found; without, background every
+     * foreground task and return true. May answer asynchronously (e.g. by
+     * delegating to `Query.backgroundTasks()`); a rejection is sent as an
+     * error reply. Omit if the host has no task registry — the CLI then
+     * answers with a "not supported in this context" error.
+     */
+    onBackgroundTasks?: (toolUseId: string | undefined) => boolean | Promise<boolean>;
+    onSetModel?: (model: string | undefined) => {
+        ok: true;
+        notices?: string[];
+    } | {
+        ok: false;
+        error: string;
+    } | void | Promise<{
+        ok: true;
+        notices?: string[];
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    onSetMaxThinkingTokens?: (tokens: number | null | undefined, thinkingDisplay?: 'summarized' | 'omitted' | 'highlights' | null) => {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    } | void | Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    } | void>;
+    /**
+     * `set_permission_mode` from claude.ai. Return an error verdict to send
+     * an error control_response (vs silently false-succeeding). Omit if
+     * the caller doesn't support permission modes — the shared handler
+     * returns a "not supported in this context" error.
+     */
+    onSetPermissionMode?: (mode: PermissionMode) => {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    };
+    /** `rename_session` from claude.ai. Return an error verdict to reject. */
+    onRenameSession?: (title: string) => {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    };
+    /**
+     * Transport died permanently. 401 = JWT expired (re-attach with fresh
+     * secret), 4090 = epoch superseded (no longer the active worker),
+     * 4091 = CCRClient init failed, 4092 = codeless close (defensive
+     * fallback — cause unknown), 4093 = presence heartbeats kept failing
+     * while the SSE stream stayed healthy (transport self-heal candidate),
+     * 4094 = worker credential expired or rejected on the request path
+     * (heartbeat/write auth exhaustion — re-attach with a fresh secret,
+     * like 401), 403/404 = permanent SSE HTTP rejection. Transient
+     * disconnects (503, network blips) retry indefinitely inside
+     * SSETransport and do NOT fire this.
+     */
+    onClose?: (code?: number) => void;
+};
+/**
+ * Attach to an existing bridge session. Creates the v2 transport
+ * (SSETransport + CCRClient), wires ingress routing and control dispatch,
+ * returns a handle scoped to this one session.
+ *
+ * Throws if `createV2ReplTransport` fails (registerWorker error, etc).
+ *
+ * ALPHA STABILITY. This is a separate versioning universe from the main
+ * `query()` surface: breaking changes here do NOT bump the package major.
+ * @alpha
+ */
+export declare function attachBridgeSession(opts: AttachBridgeSessionOptions): Promise<BridgeSessionHandle>;
+/**
+ * Worker credentials from `POST /v1/code/sessions/{id}/bridge`.
+ * Each call bumps `worker_epoch` server-side — the call IS the worker register.
+ * @alpha
+ */
+export type RemoteCredentials = {
+    worker_jwt: string;
+    api_base_url: string;
+    expires_in: number;
+    worker_epoch: number;
+};
+/**
+ * Terminal failure from `fetchRemoteCredentials` — retrying with the same
+ * inputs is guaranteed to fail. Server-minted reasons arrive as 403 with
+ * `error.resource` set to `"untrusted_device"` (token missing/revoked —
+ * enroll) or `"session_stale_relogin"` (OAuth session older than the
+ * freshness window — re-authenticate). `"invalid_session_id"` is
+ * client-minted: the session id failed validation (`/^[a-zA-Z0-9_-]+$/`)
+ * before any request was sent. `"request_rejected"` is any other
+ * authoritative non-retryable 4xx (the server answered; neither time nor a
+ * new credential changes the request). `"malformed_response"` is a 2xx this
+ * client could not parse — the mint SUCCEEDED server-side (each call bumps
+ * `worker_epoch`), so retrying epoch-bumps per attempt; not transient, not
+ * an authoritative denial.
+ * @alpha
+ */
+export type CredentialsFailure = {
+    terminal: true;
+    reason: 'untrusted_device' | 'session_stale_relogin' | 'invalid_session_id';
+} | {
+    terminal: true;
+    reason: 'request_rejected';
+    /** HTTP status, for the debug trail and user-facing hints. */
+    status: number;
+    /**
+     * 403 only: who wrote the rejection, from response headers — the
+     * origin (`request-id: req_…`), a Cloudflare edge before it, or a hop
+     * that never reached Anthropic. Attribution for telemetry/copy; not a
+     * verdict on ownership.
+     */
+    source?: 'origin' | 'nonorigin_cf' | 'nonorigin_other';
+} | {
+    terminal: true;
+    reason: 'malformed_response';
+    /** HTTP status, for the debug trail and user-facing hints. */
+    status: number;
+};
+/**
+ * Non-terminal classified rejection: the OAuth bearer itself was rejected
+ * (401). Retrying with the SAME credential is pointless, but a DIFFERENT
+ * credential can succeed (post-re-authentication) — distinct from
+ * `CredentialsFailure` (`terminal: true`) and from null, which is reserved
+ * for transient transport-shaped failures (network error / timeout / 5xx).
+ * @alpha
+ */
+export type CredentialsRejection = {
+    terminal: false;
+    reason: 'oauth_rejected';
+};
+/**
+ * Type guard for `fetchRemoteCredentials` results.
+ * @alpha
+ */
+export declare function isCredentialsFailure(r: RemoteCredentials | CredentialsFailure | CredentialsRejection | null): r is CredentialsFailure;
+/**
+ * Type guard for the non-terminal classified 401 rejection. Accepts
+ * `unknown`: callers hand it unions whose success arm is a plain string
+ * (session ids), and it narrows structurally.
+ * @alpha
+ */
+export declare function isCredentialsRejection(r: unknown): r is CredentialsRejection;
+/**
+ * Git source/outcome context attached to a v2 code session on create.
+ * @alpha
+ */
+export type CodeSessionGitContext = {
+    gitRepoUrl: string;
+    branch: string;
+    /**
+     * The repo's default branch, when authoritatively known. LOAD-BEARING
+     * for branch continuity: when absent, `branch` is omitted from
+     * `outcomes.branches` entirely (the classification never acts on a
+     * guess), so the remote session works on a runner-generated branch
+     * instead of `branch`, with only a debug-level signal. Callers that
+     * want the session to check out AND push to `branch` must supply
+     * this — read `git symbolic-ref refs/remotes/origin/HEAD`, or run
+     * `git remote set-head origin -a` to repair a missing symref.
+     */
+    defaultBranch?: string;
+};
+/**
+ * Caller-owned dedupe state for createCodeSession's branch-drop debug
+ * signal: create one object per logical create (outside your retry
+ * loop) and pass it to every attempt so the drop logs once per
+ * decision. Omit it to log on every attempt.
+ * @alpha
+ */
+export declare type BranchDropLogDedup = {
+    lastKey?: string | null;
+};
+/**
+ * Terminal failure from `POST /v1/code/sessions` — retrying with the same
+ * inputs fails identically. `reason` distinguishes the recognized
+ * `session_grouping_id` rejection family (`"grouping_rejected"` — the
+ * caller may retry without the grouping) from any other authoritative
+ * non-retryable 4xx (`"request_rejected"`) and from a 2xx this client
+ * could not parse (`"malformed_response"` — the create SUCCEEDED
+ * server-side, so a retry would orphan one session per attempt).
+ * @alpha
+ */
+export type CreateSessionFailure = {
+    terminal: true;
+    reason: 'grouping_rejected' | 'request_rejected' | 'malformed_response';
+    status: number;
+    detail: string | undefined;
+};
+/**
+ * Type guard for `createCodeSession` results. Matches only `terminal: true`
+ * failures — a `CredentialsRejection` (`terminal: false`) does not match.
+ * @alpha
+ */
+export declare function isCreateSessionFailure(r: string | CreateSessionFailure | CredentialsRejection | null): r is CreateSessionFailure;
+/**
+ * `POST /v1/code/sessions` — create a fresh CCR session. Returns the `cse_*`
+ * session id on success, a classified `CreateSessionFailure` (terminal —
+ * don't retry; see its `reason`), a `CredentialsRejection` when the OAuth
+ * bearer was rejected (retry only with a NEW credential), or null on
+ * transient transport-shaped failures (network error / timeout / 5xx).
+ *
+ * Callers supply their own OAuth token — this is a thin HTTP wrapper with no
+ * implicit auth, so it works from any process (not just the CLI).
+ * @alpha
+ */
+export declare function createCodeSession(baseUrl: string, accessToken: string, title: string, timeoutMs: number, tags?: string[], gitContext?: CodeSessionGitContext, cwd?: string, model?: string, sessionGroupingId?: string, dropLogDedup?: BranchDropLogDedup): Promise<string | CreateSessionFailure | CredentialsRejection | null>;
+/**
+ * `POST /v1/code/sessions/{id}/bridge` — mint a worker JWT for the session.
+ * Returns credentials, a `CredentialsFailure` for terminal failures (don't
+ * retry — see `CredentialsFailure.reason` for remediation), a
+ * `CredentialsRejection` when the OAuth bearer was rejected (retry only
+ * with a NEW credential), or null on transient transport-shaped failure. The call IS the worker register (bumps epoch
+ * server-side), so pass `epoch: creds.worker_epoch` to `attachBridgeSession`
+ * to skip a redundant register.
+ *
+ * `trustedDeviceToken` sets the `X-Trusted-Device-Token` header. Required
+ * when the server's `sessions_elevated_auth_enforcement` flag is on
+ * (bridge sessions are SecurityTier=ELEVATED). See anthropics/anthropic#274559.
+ * @alpha
+ */
+export declare function fetchRemoteCredentials(sessionId: string, baseUrl: string, accessToken: string, timeoutMs: number, trustedDeviceToken?: string): Promise<RemoteCredentials | CredentialsFailure | CredentialsRejection | null>;

package/dist/vendor-types/claude/agent-sdk/browser-sdk.d.ts

@@ -0,0 +1,184 @@
+/**
+ * API surface definition for @anthropic-ai/claude-agent-sdk/browser.
+ *
+ * This file is the source of truth for the browser export's public types.
+ * It imports ONLY from agentSdkTypes.ts so the compiled .d.ts has exactly
+ * one import to rewrite (./agentSdkTypes → ./sdk) for the flat package layout.
+ *
+ * Compiled by scripts/build-ant-sdk-typings.sh; see build-agent-sdk.sh for the
+ * path rewrite and copy into the package.
+ */
+import type { CanUseTool, HookCallbackMatcher, HookEvent, McpServerConfig, OnElicitation, OnUserDialog, Query, SDKMessage, SDKUserMessage } from './agentSdkTypes.js';
+export type { CanUseTool, ElicitationRequest, ElicitationResult, HookCallbackMatcher, HookEvent, McpSdkServerConfigWithInstance, McpServerConfig, OnElicitation, OnUserDialog, Query, SDKAssistantMessage, SDKMessage, SDKResultMessage, SDKSystemMessage, SDKUserMessage, UserDialogRequest, UserDialogResult, } from './agentSdkTypes.js';
+export { createSdkMcpServer, tool } from './agentSdkTypes.js';
+export type OAuthCredential = {
+    type: 'oauth';
+    token: string;
+};
+export type AuthMessage = {
+    type: 'auth';
+    credential: OAuthCredential;
+};
+export type WebSocketOptions = {
+    url: string;
+    headers?: Record<string, string>;
+    authMessage?: AuthMessage;
+};
+export type SSEOptions = {
+    /** SSE read endpoint, e.g. `…/v1/code/sessions/{id}/events/stream`. */
+    streamUrl: string;
+    /** POST write endpoint, e.g. `…/v1/code/sessions/{id}/events`. */
+    sendUrl: string;
+    /**
+     * The CCR session ID — required to build the `AddClientEventFromClient`
+     * request body that `sendUrl` expects.
+     */
+    sessionId: string;
+    /**
+     * Headers sent on both the SSE GET and every POST. Set `Authorization` and
+     * `anthropic-client-platform` here — the SDK cannot determine the host
+     * surface (web / iOS / Android / desktop) itself.
+     */
+    headers?: Record<string, string>;
+    /**
+     * Resume cursor for the first connect: the stream delivers only events
+     * whose `sequence_num` is greater. For a consumer that seeded its
+     * transcript from the REST event list — pass the highest `sequence_num` it
+     * has already applied (for a query replacing an earlier one,
+     * `getSseLastSequenceNum()` of that query, which only ever covers messages
+     * it actually yielded). Omitted or 0 starts from the beginning of the
+     * retained stream.
+     */
+    fromSequenceNum?: number;
+    /**
+     * Called when the server reports (`catch_up_truncated`) that it could not
+     * replay every event after the resume cursor — the stream continues from a
+     * later point, so re-fetch the gap from the REST event list and reseed.
+     * Each occurrence is also counted in `getSseDropCounts()` under
+     * `catch_up_truncated`. Exceptions thrown by the handler are contained.
+     */
+    onCatchUpTruncated?: () => void;
+    /**
+     * Called for each `delivery_update` frame: the worker's acknowledgement of
+     * one event this session was sent (`event_id` — matches the `event_id` of
+     * that event's own durable echo, see `getCcrEvent()`), with the raw server
+     * status string — `"DELIVERY_STATUS_RECEIVED"`, `"DELIVERY_STATUS_PROCESSING"`
+     * (the worker began the turn) or `"DELIVERY_STATUS_PROCESSED"` (that turn
+     * ended); treat unknown values as informational — and the server
+     * `timestamp` when present. Not durable: a reconnect does not replay
+     * earlier updates. Malformed frames are counted in `getSseDropCounts()`
+     * under `malformed_delivery_update`; handler exceptions are contained.
+     */
+    onDeliveryUpdate?: (update: {
+        event_id: string;
+        status: string;
+        timestamp?: string;
+    }) => void;
+};
+type BrowserQueryOptionsBase = {
+    prompt: AsyncIterable<SDKUserMessage>;
+    abortController?: AbortController;
+    canUseTool?: CanUseTool;
+    hooks?: Partial<Record<HookEvent, HookCallbackMatcher[]>>;
+    mcpServers?: Record<string, McpServerConfig>;
+    jsonSchema?: Record<string, unknown>;
+    onElicitation?: OnElicitation;
+    onUserDialog?: OnUserDialog;
+    /**
+     * When enabled, the remote CLI emits a `prompt_suggestion` message after
+     * each turn's result. At most one per turn.
+     */
+    promptSuggestions?: boolean;
+};
+/**
+ * Exactly one of `websocket` | `sse` must be provided. `sse` is the v1alpha2
+ * path and is preferred for new integrations; `websocket` remains for
+ * existing callers during the migration.
+ */
+export type BrowserQueryOptions = BrowserQueryOptionsBase & ({
+    websocket: WebSocketOptions;
+    sse?: never;
+} | {
+    sse: SSEOptions;
+    websocket?: never;
+});
+/**
+ * Create a Claude Code query in the browser over either SSE (preferred) or
+ * WebSocket.
+ *
+ * @example
+ * ```typescript
+ * import { query } from './browser-sdk.js'
+ *
+ * const messages = query({
+ *   prompt: messageStream,
+ *   sse: {
+ *     streamUrl: 'https://api.example.com/v1/code/sessions/ID/events/stream',
+ *     sendUrl: 'https://api.example.com/v1/code/sessions/ID/events',
+ *     headers: { Authorization: `Bearer ${token}` },
+ *   },
+ * })
+ * for await (const message of messages) {
+ *   console.log(message)
+ * }
+ * ```
+ */
+export declare function query(options: BrowserQueryOptions): Query;
+/**
+ * Readiness sentinel for the peer-frame text-envelope guard
+ * (userFrameRequiresWorkerSource): `true` means the SSE transport enforces
+ * the full predicate on peer-authored `user` frames. The change enabling
+ * `ccr_v2_subscribe_sse_web` in a consumer repo must assert this reads
+ * `true` before flipping the flag.
+ */
+export declare const G4_TEXT_ENVELOPE_ARM_PORTED: boolean;
+/**
+ * Cumulative per-category dropped-frame counts for a query() created with
+ * the `sse` transport — the aggregated receipt for the
+ * `ccr_v2_subscribe_sse_web` enablement review (category → count only,
+ * never frame contents). Returns undefined for WebSocket-transport queries.
+ */
+export declare function getSseDropCounts(query: Query): Readonly<Record<string, number>> | undefined;
+/**
+ * Resume cursor of a query() created with the `sse` transport: the highest
+ * `sequence_num` of a durable message this query has yielded (or the
+ * `fromSequenceNum` seed before any was). It is advanced immediately before
+ * each message is yielded, so while the consumer handles message `m` it is
+ * already `>= getCcrEvent(query, m).sequence_num`, and it never covers a
+ * message the consumer was not handed — frames still buffered when the
+ * consumer stops iterating, and durable events the SDK dropped or consumed
+ * internally, do not advance it. So at any point — mid-stream, after a
+ * `break`, or once the iterator has finished — it is where a REST catch-up
+ * fetch or a replacement query()'s `fromSequenceNum` should resume (the
+ * transport's own transparent reconnects use a separate internal wire
+ * cursor). Per-message ordering still reads `getCcrEvent(query, message)`.
+ * Returns undefined for WebSocket-transport queries and before any sequence
+ * number is known.
+ */
+export declare function getSseLastSequenceNum(query: Query): number | undefined;
+/**
+ * The wire envelope of the durable CCR event (SSE `client_event` frame) that
+ * delivered `message` on the `sse` query `query`: `sequence_num` is the
+ * session-wide order the server assigned, `event_id` is unique per event,
+ * `created_at` (RFC 3339 store time) and `source` (server-assigned channel,
+ * e.g. `worker`) appear when the frame carries them. Provenance contract:
+ * the transport records the envelope from the delivering frame, keyed by the
+ * exact message object it yields, and never writes it onto the message; a
+ * `ccr_event` field arriving inside any payload is a sender-authored claim
+ * and is stripped, so this accessor is the only way to read an envelope.
+ * Looked up by object identity — pass the message exactly as the query
+ * yielded it. Returns undefined for anything that transport did not itself
+ * yield from a durable frame: unsequenced ephemerals (`stream_event`,
+ * `sources_changed`, live-only `system` status frames), messages of a
+ * WebSocket-transport query, copies, and caller-constructed objects,
+ * regardless of the fields they carry. `sequence_num` is dense over ALL of
+ * the session's events, including control frames the SDK consumes
+ * internally and frames it drops, so consecutive yielded messages need not
+ * carry consecutive numbers.
+ */
+export declare function getCcrEvent(query: Query, message: SDKMessage): {
+    event_id: string;
+    sequence_num: number;
+    created_at?: string;
+    source?: string;
+} | undefined;

package/dist/vendor-types/claude/agent-sdk/core.d.ts

@@ -0,0 +1,20 @@
+export {
+  AbortError,
+  createSdkMcpServer,
+  deleteSession,
+  EXIT_REASONS,
+  filterEscalatingDefaultMode,
+  HOOK_EVENTS,
+  ORG_POLICY_LIMIT_PREFIXES,
+  query,
+  renameSession,
+  resolveSettings,
+  startup,
+  SYSTEM_PROMPT_DYNAMIC_BOUNDARY,
+  tagSession,
+  tool,
+  USAGE_LIMIT_ERROR_PREFIXES,
+  USAGE_TRANSITION_PREFIXES,
+  USAGE_WARNING_PREFIXES,
+} from './sdk.js'
+export type * from './sdk.js'

package/dist/vendor-types/claude/agent-sdk/extractFromBunfs.d.ts

@@ -0,0 +1 @@
+export function extractFromBunfs(embeddedPath: string): string