/**
 * Computer-use payload types — wire format for `computer-use-v1.md`.
 *
 * A motebit with a desktop surface (Tauri) can observe and act on the user's
 * computer: screenshot, move, click, type, scroll. This spec pins the wire
 * format of each action and observation so the signed audit trail is
 * implementation-agnostic — a non-TypeScript verifier can validate payloads
 * against the committed JSON Schema rather than TypeScript's structural view.
 *
 * Shape: actions are a **nested discriminated union** (`action: { kind, ... }`)
 * not a flat envelope. Impossible states are structurally unrepresentable —
 * drag-only fields never appear on a click, type-only fields never appear on
 * a scroll. Cross-language SDKs (Rust enums, Python tagged unions) map
 * directly; JSON Schema emits clean `oneOf` branches; model output stays
 * rigorous.
 *
 * Observation results carry **artifact references** (`artifact_id +
 * artifact_sha256`) not inline bytes. The receipt artifact store (see
 * `spec/execution-ledger-v1.md`) holds the bytes; the observation payload
 * binds to them by hash. Keeps signed receipts O(bytes of metadata) instead
 * of O(bytes of image). Git / IPFS / S3+hash pattern.
 *
 * Every type named here is referenced by a `### X.Y — Name` section under a
 * `#### Wire format (foundation law)` block in `spec/computer-use-v1.md`,
 * so `check-spec-coverage` (invariant #9) keeps the spec and types in
 * lockstep.
 *
 * ── Release status ───────────────────────────────────────────────────
 *
 * Every export in this file carries `@alpha` — the wire format was revised
 * on 2026-04-22 in response to external principal review (commit 54158b11,
 * flat envelope → nested discriminated union) and has only soaked inside
 * the monorepo since. `@alpha` carves these types out of `@motebit/protocol`'s
 * SemVer contract for the 1.x series: the `check-api-surface` baseline still
 * tracks their shape so unintended drift is caught, but a shape reshape does
 * not force a major bump. Promote to `@beta` → `@public` once a second
 * producer (cloud-browser surface, federation peer replaying an audit log)
 * or a non-desktop-shim consumer exercises the format in anger.
 */
import type { ControlState } from "./co-browse.js";
/**
 * A point in primary-display logical pixel coordinates. `(0, 0)` = top-left.
 * @alpha
 */
export interface ComputerPoint {
    readonly x: number;
    readonly y: number;
}
/**
 * Optional semantic target information attached to pointer actions. When
 * available from the accessibility layer or DOM, it lets verifiers and
 * approval UX explain "motebit clicked the Send button" instead of only
 * "(512, 384)". Execution still happens at the pixel coordinates in
 * `target`; the hint is advisory.
 * @alpha
 */
export interface ComputerTargetHint {
    /** Role name. Examples: `"button"`, `"link"`, `"textbox"`, `"menuitem"`. */
    readonly role?: string;
    /** Accessible label or visible text. */
    readonly label?: string;
    /**
     * Where the hint came from. `"accessibility"` (OS AX API), `"dom"`
     * (browser inspection), `"vision"` (OCR/ML), `"user_annotation"` (user
     * labeled the region in-session).
     */
    readonly source: string;
}
/**
 * Capture the primary display's current frame.
 * @alpha
 */
export interface ScreenshotAction {
    readonly kind: "screenshot";
}
/**
 * Read the current cursor coordinates.
 * @alpha
 */
export interface CursorPositionAction {
    readonly kind: "cursor_position";
}
/**
 * Single mouse click at `target`.
 * @alpha
 */
export interface ClickAction {
    readonly kind: "click";
    readonly target: ComputerPoint;
    /** `"left" | "right" | "middle"`. Defaults to `"left"`. */
    readonly button?: string;
    /** Subset of `["cmd", "ctrl", "alt", "shift"]`. */
    readonly modifiers?: readonly string[];
    readonly target_hint?: ComputerTargetHint;
}
/**
 * Two clicks in rapid succession at `target`.
 * @alpha
 */
export interface DoubleClickAction {
    readonly kind: "double_click";
    readonly target: ComputerPoint;
    readonly button?: string;
    readonly modifiers?: readonly string[];
    readonly target_hint?: ComputerTargetHint;
}
/**
 * Move cursor to `target` without clicking.
 * @alpha
 */
export interface MouseMoveAction {
    readonly kind: "mouse_move";
    readonly target: ComputerPoint;
    readonly target_hint?: ComputerTargetHint;
}
/**
 * Press at `from`, move to `to`, release.
 * @alpha
 */
export interface DragAction {
    readonly kind: "drag";
    readonly from: ComputerPoint;
    readonly to: ComputerPoint;
    readonly button?: string;
    readonly modifiers?: readonly string[];
    /** Total drag duration in ms. Implementation may interpolate intermediate points. */
    readonly duration_ms?: number;
    readonly target_hint?: ComputerTargetHint;
}
/**
 * Keyboard text input.
 * @alpha
 */
export interface TypeAction {
    readonly kind: "type";
    readonly text: string;
    /**
     * Per-character delay in ms. Omitted = implementation default. Set to a
     * stable value for deterministic replay of typing cadence.
     */
    readonly per_char_delay_ms?: number;
}
/**
 * Keyboard combination. Example: `"cmd+c"`, `"ctrl+shift+t"`, `"escape"`.
 * @alpha
 */
export interface KeyAction {
    readonly kind: "key";
    readonly key: string;
}
/**
 * Scroll at `target` by `(dx, dy)` wheel deltas.
 * @alpha
 */
export interface ScrollAction {
    readonly kind: "scroll";
    readonly target: ComputerPoint;
    readonly dx: number;
    readonly dy: number;
}
/**
 * Navigate the active browser context to `url`. Cloud-browser-only in
 * v1: the headless Playwright runtime in `services/browser-sandbox`
 * has no address-bar UI for `key`/`type` to drive, so the spec
 * promotion path
 * (`spec/computer-use-v1.md` §"No new wire-format actions… real-usage-
 * driven, not speculative") fired when the AI hit "navigate to
 * tesla.com" against the cloud-browser dispatcher.
 *
 * Desktop dispatcher (`apps/desktop/src-tauri/src/computer_use.rs`)
 * does NOT implement this action — OS-level computer-use has no
 * notion of "the active browser context"; the user is in control of
 * which app is focused. The dispatcher-parity check at
 * `scripts/check-computer-use-dispatcher-parity.ts` carries an
 * ALLOWLIST entry naming desktop as deferred until an OS-level
 * navigation use-case proves itself.
 * @alpha
 */
export interface NavigateAction {
    readonly kind: "navigate";
    /**
     * Target URL. Implementations SHOULD normalize relative-looking
     * inputs (`example.com` → `https://example.com`) but MAY reject
     * malformed inputs with a `not_supported` failure.
     */
    readonly url: string;
}
/**
 * element-1 — click on a structurally-addressed element. Server
 * resolves `element_id` (issued by a prior `read_page` extraction
 * via the stamped `data-motebit-id` attribute), scrolls into view,
 * clicks the center of the element's bounding rect.
 *
 * Prefer this over coordinate-based `click` when the target was
 * discovered via `read_page` — durable against viewport, zoom, and
 * layout shifts. Coordinate `click` remains for purely-visual tasks
 * (clicking on a position seen in pixels).
 *
 * On staleness (page navigated since read_page, page reloaded,
 * element removed by JS) the result fails with `element_not_found`
 * and the AI re-reads to refresh the id space.
 * @alpha
 */
export interface ClickElementAction {
    readonly kind: "click_element";
    readonly element_id: string;
}
/**
 * element-1 — focus a structurally-addressed element without
 * clicking. Useful for setting up `type` calls without the side-
 * effects of a click (some fields open dropdowns / dialogs on
 * click; focus-only avoids them).
 * @alpha
 */
export interface FocusElementAction {
    readonly kind: "focus_element";
    readonly element_id: string;
}
/**
 * element-1 — semantic-intent type. Server focuses the addressed
 * element first (so keystrokes can't be swallowed by the page's
 * focus state), optionally clears existing value, then types. The
 * result envelope carries `text_appeared` truth-feedback so the AI
 * doesn't confabulate "I typed it" when the keystrokes went
 * nowhere.
 *
 * Composes the two-step click+type workflow into one semantic
 * action — closes the action-truth gap from the witnessed
 * 2026-05-08 smoke (AI typed without focus → keystrokes
 * swallowed → AI claimed success).
 * @alpha
 */
export interface TypeIntoAction {
    readonly kind: "type_into";
    readonly element_id: string;
    readonly text: string;
    /** Per-character delay in ms; same shape as the lower-level `type` action. */
    readonly per_char_delay_ms?: number;
    /**
     * If true (default), the field's current value is cleared before
     * typing. Mirrors the human "type fresh into this box" intent. Set
     * to false to append to existing text.
     */
    readonly clear_first?: boolean;
}
/**
 * Full action taxonomy. Every concrete action the motebit can request is
 * one of these. Exhaustive discriminated union on `kind`.
 * @alpha
 */
export type ComputerAction = ScreenshotAction | CursorPositionAction | ClickAction | DoubleClickAction | MouseMoveAction | DragAction | TypeAction | KeyAction | ScrollAction | NavigateAction | ClickElementAction | FocusElementAction | TypeIntoAction;
/**
 * Discriminator values — useful for JSON Schema enum and runtime validation.
 * @alpha
 */
export declare const COMPUTER_ACTION_KINDS: readonly ["screenshot", "cursor_position", "click", "double_click", "mouse_move", "drag", "type", "key", "scroll", "navigate", "click_element", "focus_element", "type_into"];
/** @alpha */
export type ComputerActionKind = (typeof COMPUTER_ACTION_KINDS)[number];
/**
 * One invocation of the `computer` tool. The `action` field holds a nested
 * discriminated variant; all action-specific fields live inside that
 * object. Impossible states are structurally unrepresentable.
 * @alpha
 */
export interface ComputerActionRequest {
    /** Open session the action belongs to. */
    readonly session_id: string;
    readonly action: ComputerAction;
}
/**
 * Outcome of a successful observation action's execution. Returned as the
 * `data` field of a `ToolResult`. Discriminated by `kind`.
 * @alpha
 */
export type ComputerObservationResult = ScreenshotObservation | CursorPositionObservation;
/**
 * Structured redaction metadata. Replaces a bare boolean — a verifier can
 * now prove *what* was redacted, under *which* policy version, and whether
 * the bytes the AI saw are raw or a projection.
 * @alpha
 */
export interface ComputerRedaction {
    /** `true` iff any region was classified as sensitive and masked. */
    readonly applied: boolean;
    /**
     * Projection shape of the bytes the AI consumed. `"raw"` = unmodified
     * capture, `"masked"` = regions replaced with solid fill,
     * `"blurred"` = regions convolved, `"cropped"` = sensitive regions
     * removed from frame. Surfaces MAY add projection kinds in v1.1.
     */
    readonly projection_kind: string;
    /** Version string of the sensitivity-classification policy that ran. */
    readonly policy_version?: string;
    /** Number of regions classified as sensitive in the raw frame. */
    readonly classified_regions_count?: number;
    /**
     * SHA-256 digest of a canonical JSON array of classified regions
     * (each region: `{ x, y, w, h, classification }`). Lets a verifier
     * replay what was masked without exposing the region list in the
     * receipt if policy dictates.
     */
    readonly classified_regions_digest?: string;
}
/**
 * Screenshot observation. Bytes live in the receipt artifact store keyed
 * by `artifact_id` and bound by `artifact_sha256`. When redaction produces
 * a distinct projection (e.g. masked image), both the raw and projection
 * artifact IDs are referenced so a verifier can fetch either depending on
 * authorization.
 * @alpha
 */
export interface ScreenshotObservation {
    readonly kind: "screenshot";
    readonly session_id: string;
    /** Artifact ID of the raw capture in the artifact store. */
    readonly artifact_id: string;
    /** SHA-256 of the raw capture's bytes. */
    readonly artifact_sha256: string;
    /** `"png" | "jpeg"`. */
    readonly image_format: string;
    /** Image width in logical pixels. */
    readonly width: number;
    /** Image height in logical pixels. */
    readonly height: number;
    /** Unix ms of the capture. */
    readonly captured_at: number;
    readonly redaction: ComputerRedaction;
    /**
     * Artifact ID of the redacted projection, when `redaction.applied` and
     * the projection differs from the raw capture. When absent, the AI saw
     * the raw bytes (redaction.projection_kind === "raw").
     */
    readonly projection_artifact_id?: string;
    /** SHA-256 of the projection bytes. Paired with `projection_artifact_id`. */
    readonly projection_artifact_sha256?: string;
}
/**
 * Cursor-position observation — single coordinate pair.
 * @alpha
 */
export interface CursorPositionObservation {
    readonly kind: "cursor_position";
    readonly session_id: string;
    readonly x: number;
    readonly y: number;
    readonly captured_at: number;
}
/**
 * A single heading extracted from the page's DOM. `level` is the
 * HTML heading level 1-6; `text` is the visible text content. The
 * server returns headings in document order so the AI can rebuild
 * the page's outline without parsing markup.
 * @alpha
 */
export interface ReadPageHeading {
    readonly level: number;
    readonly text: string;
}
/**
 * A single visible link extracted from the page's DOM. `text` is
 * the anchor's visible label (innerText); `href` is the absolute
 * URL the link points to. Server skips empty-label links and
 * `javascript:` / fragment-only hrefs.
 * @alpha
 */
export interface ReadPageLink {
    readonly text: string;
    readonly href: string;
}
/**
 * A single typeable input extracted from the page's DOM —
 * `<input>` (text-shaped types: text, search, email, url, tel,
 * number, password) and `<textarea>`. Server stamps a
 * `data-motebit-id="motebit-N"` attribute during extraction so
 * subsequent `type_into` / `focus_element` actions can address
 * the element by `element_id` instead of coordinates.
 *
 * **Why element-addressing over coordinates.** Coordinates are
 * fragile against viewport size, zoom, layout shifts, dynamic
 * loading. Structural identity is stable for the lifetime of the
 * page. Production browser-agent platforms (Browserbase, the
 * Playwright codegen flow, Anthropic's computer-use cookbook)
 * converge on the same primitive — the AI says "type into this
 * input" referring to a thing it discovered via read_page, not
 * "type at (612, 348)."
 *
 * The element_id is opaque to the AI — server-issued, server-
 * resolved. Stamps are scoped to the read_page response that
 * returned them; a subsequent read_page may issue different ids
 * for the same elements (the prior stamps are cleared and re-
 * stamped). Cross-read stability is a future slice.
 *
 * Stamps don't survive page navigation; an `element_not_found`
 * result tells the AI to re-read.
 * @alpha
 */
export interface ReadPageInput {
    /** Server-issued opaque identifier for subsequent typed actions. */
    readonly element_id: string;
    /** DOM tag — `input` or `textarea`. */
    readonly tag: "input" | "textarea";
    /**
     * For `<input>`, the `type` attribute (text, search, email, url,
     * tel, number, password, …). For `<textarea>`, always `"textarea"`.
     * Useful to the AI for choosing what to type and whether the
     * field is sensitive.
     */
    readonly input_type: string;
    /** `name` attribute when present. */
    readonly name?: string;
    /** `placeholder` attribute when present. */
    readonly placeholder?: string;
    /** `aria-label` when present (or the closest `<label>` text). */
    readonly aria_label?: string;
    /**
     * Current value of the field at extraction time, capped at 256
     * characters. Lets the AI reason about whether to clear before
     * typing, and verify intent across turns.
     */
    readonly value?: string;
}
/**
 * A single button-shaped clickable element — `<button>`,
 * `<input type="submit">`, `<input type="button">`,
 * `<input type="reset">`, plus `<a>` tags styled as buttons (when
 * the element has `role="button"` or carries a button-shaped
 * accessible name without an href). Server stamps the same
 * `data-motebit-id` so `click_element({element_id})` resolves
 * unambiguously.
 *
 * `<a>` tags WITH a navigation href stay in `ReadPageLink`. A
 * single element MAY appear in both `links` and `buttons` if it
 * has both a navigation href and a button-shaped role; the AI
 * picks the addressing it needs.
 * @alpha
 */
export interface ReadPageButton {
    readonly element_id: string;
    /** DOM tag — `button`, `input`, or `a`. */
    readonly tag: "button" | "input" | "a";
    /** Visible label text (innerText or `aria-label` when innerText is empty). */
    readonly text: string;
    /**
     * For `<input>` button variants, the `type` attribute
     * (`submit` / `button` / `reset`). Absent for `<button>` and
     * `<a role="button">`.
     */
    readonly input_type?: string;
}
/**
 * Wire format for the `read_page` tool's result. Returned by
 * `services/browser-sandbox`'s `POST /sessions/:id/read-page` and
 * read unchanged by `CloudBrowserDispatcher.readPage()`. Lands in
 * the AI loop as the tool result; passes through `projectForAi`
 * unchanged (no `bytes_base64` field to strip).
 *
 * Sizes are bounded server-side to keep the AI context tractable:
 *   - `text` truncated at 8KB; `text_truncated` set when the cut
 *     fired so the AI knows it's reading a prefix.
 *   - `headings` capped at 100 entries.
 *   - `links` capped at 100 entries.
 *
 * The bounds are conservative defaults the surface MAY tune in
 * future. Beyond a soft cap, `text_truncated: true` tells the AI
 * to ask for a more targeted observation rather than scrolling
 * through a 50KB blob.
 * @alpha
 */
export interface ReadPageResult {
    readonly kind: "read_page";
    readonly session_id: string;
    readonly url: string;
    readonly title: string;
    readonly text: string;
    readonly text_truncated: boolean;
    readonly headings: ReadonlyArray<ReadPageHeading>;
    readonly links: ReadonlyArray<ReadPageLink>;
    /**
     * element-1 — typeable input fields with server-issued
     * `element_id` for `focus_element` / `type_into` actions. Capped
     * at 100 entries server-side. Empty when the page has no
     * typeable fields.
     */
    readonly inputs: ReadonlyArray<ReadPageInput>;
    /**
     * element-1 — button-shaped clickable elements with server-
     * issued `element_id` for `click_element` actions. Capped at
     * 100 entries server-side. Empty when the page has no button-
     * shaped elements (text-content pages, document viewers).
     */
    readonly buttons: ReadonlyArray<ReadPageButton>;
    /**
     * Typed-truth hint naming the page's primary submit button by
     * `element_id` — present when `buttons[]` contains a discoverable
     * submit-class element. The runtime detects it via two signals in
     * order:
     *
     *   1. **HTML semantic**: any button with `input_type === "submit"`
     *      (`<input type="submit">`). Most reliable; this is the
     *      browser's own statement that the element submits a form.
     *   2. **Label heuristic** (fallback): a `<button>` whose visible
     *      label matches a submit-class word — `Search` / `Submit` /
     *      `Send` / `Sign in` / `Log in` / `Continue` / `Go` /
     *      `Subscribe` / `Next` / `Save` / `Post`. Case-insensitive,
     *      whole-label-or-prefix match. The label heuristic produces
     *      false positives on rare pages with non-submit buttons
     *      labeled "Send" (a contact-icon UI); the AI's reading still
     *      benefits from the hint because `click_element` on a
     *      non-submit button is a no-op rather than a wrong action.
     *
     * AI usage: when this field is present, prefer
     * `click_element(submit_button_id)` over `key("Enter")` for form
     * submission. The runtime invariant is the doctrine's preferred
     * mechanism (no focus race, no global-keystroke ambiguity) — the
     * wire field carries the "right tool for this page" signal that
     * the AI's selection would otherwise have to derive from
     * unstructured prompt teaching. Doctrine:
     * `docs/doctrine/runtime-invariants-over-prompt-rules.md` —
     * exemplar of B→A graduation via typed-truth conversion.
     *
     * Absent when:
     *   - The page has no `buttons[]` at all (text-content pages).
     *   - `buttons[]` contains no submit-class element (a search
     *     results page with only navigation chips, e.g.).
     *   - The page uses non-button submit affordances (custom widgets,
     *     `<a>` tags posting via JS) — the heuristic stays conservative
     *     to avoid false-confident hints.
     *
     * When absent, the AI falls back to its existing reasoning over
     * `buttons[]` directly. This is additive, not replacing.
     */
    readonly submit_button_id?: string;
    readonly extracted_at: number;
}
/**
 * Signed event emitted when a computer-use session begins. Carries the
 * primary display's dimensions and scaling factor so the AI knows the
 * coordinate space subsequent actions will operate in.
 *
 * `display_width` and `display_height` are logical pixels (the dimensions
 * action coordinates live in). `scaling_factor` is the logical-to-physical
 * ratio (Retina = 2.0). Screenshot dimensions returned in observations
 * match the logical dimensions, not the physical raster.
 * @alpha
 */
export interface ComputerSessionOpened {
    readonly session_id: string;
    readonly motebit_id: string;
    readonly display_width: number;
    readonly display_height: number;
    readonly scaling_factor: number;
    readonly opened_at: number;
}
/**
 * Signed event emitted when a computer-use session ends.
 * @alpha
 */
export interface ComputerSessionClosed {
    readonly session_id: string;
    readonly closed_at: number;
    /** Free-text code. Examples: `"user_closed"`, `"timeout"`, `"error"`. */
    readonly reason?: string;
}
/**
 * Structured failure reasons a computer-use action may return. Every
 * implementation MUST emit one of these (or a v1.1-extended value) on
 * failure so the motebit's reasoning loop and the governance audit can
 * discriminate cases deterministically.
 *
 *   policy_denied      — governance classified the action as deny
 *   approval_required  — governance classified as require_approval; no consent yet
 *   approval_expired   — consent was obtained but its window elapsed
 *   permission_denied  — OS refused (e.g. no Screen Recording permission on macOS)
 *   session_closed     — action fired outside an open session
 *   target_not_found   — element at `target` coords no longer exists (accessibility-verified fail)
 *   target_obscured    — element exists but is covered (menu over it, etc.)
 *   user_preempted     — physical user input interrupted mid-dispatch
 *   platform_blocked   — OS blocked synthetic input (secure password field, elevation boundary)
 *   not_supported      — surface cannot execute computer use at all
 *   frame_stale        — the page navigated underneath the action; the
 *                        executor's frame reference is no longer valid.
 *                        Distinct from session_closed (the session is
 *                        still open; only the frame changed). The
 *                        cloud executor retries once before surfacing
 *                        this so transient redirects (Google's
 *                        anti-cache `?zx=…` redirect, OAuth round-
 *                        trips, AJAX-driven URL rewrites) don't reach
 *                        the AI as failure. When the AI sees this
 *                        reason, the page has moved twice and a
 *                        re-read is required.
 * @alpha
 */
export declare const COMPUTER_FAILURE_REASONS: readonly ["policy_denied", "approval_required", "approval_expired", "permission_denied", "session_closed", "target_not_found", "target_obscured", "user_preempted", "platform_blocked", "not_supported", "not_in_control", "frame_stale"];
/** @alpha */
export type ComputerFailureReason = (typeof COMPUTER_FAILURE_REASONS)[number];
/**
 * One CDP-decoded screencast frame as it lands on the wire.
 *
 * `jpeg_base64` — the image payload, base64-encoded JPEG. Quality is
 * tuned by the service (60% at v1.3) for slab register, not fidelity.
 *
 * `timestamp` — wall-clock ms from CDP's frame metadata (normalized;
 * CDP returns seconds). Frames may arrive slightly out of order
 * under load; consumers should latest-wins on `timestamp`.
 *
 * `device_width` / `device_height` — logical-pixel dimensions of the
 * captured viewport. The slab uses these to compute the right
 * aspect ratio when rendering into a `<canvas>` or `<img>`.
 * @alpha
 */
export interface ScreencastFrame {
    readonly jpeg_base64: string;
    readonly timestamp: number;
    readonly device_width: number;
    readonly device_height: number;
}
/**
 * Subscribe-shape source of `ScreencastFrame`s. Producers (apps) own
 * the publish path (dispatcher → bus); consumers (the slab's live-
 * browser renderer) subscribe via `subscribe(cb)` and dispose via the
 * returned unsubscribe.
 *
 * Why subscribe-shape rather than push-callback in payload. A slab
 * item's `payload` is signed-eligible state; embedding a closure
 * makes the payload non-serializable. `ScreencastFrameSource` is a
 * minimal observer interface — easy to fake in tests, easy to
 * implement (one Set + iterate). The frame stream itself is in-
 * memory only and never goes through the audit log.
 * @alpha
 */
export interface ScreencastFrameSource {
    subscribe(callback: (frame: ScreencastFrame) => void): () => void;
}
/**
 * Per-action structural roll-up entry. The runtime appends one of these
 * to the in-session log on every `executeAction` call, regardless of
 * outcome. The canonical JSON of the array (in dispatch order) is
 * hashed into `ComputerSessionReceipt.actions_hash` at session close.
 *
 * Carries kind + timing + outcome only — never targets, args, screenshot
 * bytes, OCR text, or any payload that could leak content. The
 * `failure_reason` is present iff `outcome === "failure"`.
 *
 * Why a separate type rather than reusing `ComputerActionRequest`:
 * the request type carries action-specific payloads (target points,
 * type strings, drag deltas). The receipt commits to *structure*, not
 * *intent* — the per-action ToolInvocationReceipt already commits to
 * the args via `args_hash`. Splitting the two keeps the session
 * receipt's privacy invariant (no leak surface) compositional with
 * the per-action receipt's audit invariant.
 * @alpha
 */
export interface ComputerSessionActionRecord {
    readonly kind: ComputerActionKind;
    readonly started_at: number;
    readonly completed_at: number;
    readonly outcome: "success" | "failure";
    readonly failure_reason?: ComputerFailureReason;
    /**
     * Co-browse Slice 1 — when `failure_reason === "not_in_control"`,
     * this field carries the literal `ControlState` at dispatch time
     * (e.g. `{kind: "user"}` or `{kind: "paused", previousDriver:
     * "motebit"}`). The runtime stamps it on the action ledger; the
     * field flows into `actions_hash` so any retroactive edit to the
     * recorded state breaks the session-receipt signature.
     *
     * Present iff `failure_reason === "not_in_control"` — control
     * state at non-control denials would be category noise. Absent on
     * success and on every other failure mode.
     *
     * @alpha
     */
    readonly control_state_at_denial?: ControlState;
}
/**
 * Body of a `ComputerSessionReceipt` *before* it is signed. The signer
 * stamps `suite` and `signature`. Embedded as the input shape of the
 * runtime's session summarizer; the signer (`@motebit/crypto`'s
 * `signComputerSessionReceipt`) consumes this and emits a
 * `ComputerSessionReceipt`.
 * @alpha
 */
export interface SignableComputerSessionReceipt {
    readonly receipt_id: string;
    readonly session_id: string;
    readonly motebit_id: string;
    readonly public_key?: string;
    /**
     * Embodiment mode the session ran under (`"virtual_browser"`,
     * `"desktop_drive"`, etc.). Free-typed string here for the same
     * reason `ToolDefinition.embodimentMode` is — the canonical
     * `EmbodimentMode` union lives in `@motebit/render-engine` and
     * promoting it into the protocol layer is a separate slice.
     * Production callers always pass a member of `EMBODIMENT_MODES`;
     * verifiers should treat unknown strings as opaque-but-valid.
     */
    readonly embodiment_mode: string;
    readonly display_width: number;
    readonly display_height: number;
    readonly scaling_factor: number;
    readonly opened_at: number;
    readonly closed_at: number;
    /** Free-text closure code from `ComputerSessionClosed.reason`. */
    readonly close_reason?: string;
    /** Total actions dispatched during the session. */
    readonly action_count: number;
    /** Action outcome counts. `success + failure === action_count`. */
    readonly outcomes_summary: {
        readonly success: number;
        readonly failure: number;
    };
    /**
     * Per-failure-reason counts. Closed key set
     * (`ComputerFailureReason`); absent keys mean zero. Sum of values
     * equals `outcomes_summary.failure`.
     */
    readonly failure_breakdown: {
        readonly [K in ComputerFailureReason]?: number;
    };
    /**
     * True if `ComputerSessionManager.halt()` fired during this session
     * (spec §3.3 user-floor primitive). A halted session that resumed
     * and continued still has `was_halted: true` — the flag commits to
     * "the user paused at least once," not to terminal state.
     */
    readonly was_halted: boolean;
    /**
     * Highest sensitivity tier observed across all action observations
     * during the session. Closed `SensitivityLevel` union by
     * convention — encoded as the string value (e.g. `"financial"`).
     * The runtime's observation classifier sets this; absence implies
     * `"none"` (no observation rose above the floor).
     */
    readonly max_sensitivity: string;
    /**
     * SHA-256 hex digest of JCS-canonicalized
     * `ReadonlyArray<ComputerSessionActionRecord>` in dispatch order.
     * Verifiers with the per-action records recompute and match;
     * verifiers without the records still get the signature's commit
     * to the digest itself.
     */
    readonly actions_hash: string;
}
/**
 * Signed proof that a computer-use session ran with this exact
 * shape. Sibling of `ExecutionReceipt` and `ToolInvocationReceipt`.
 *
 *   - Self-verifiable: a third party with the signer's public key
 *     can verify without contacting any relay.
 *   - Structural-only: never carries observation bytes, OCR text,
 *     action targets, or any content that could leak. The
 *     `actions_hash` binds to a roll-up; per-action
 *     `ToolInvocationReceipt`s carry the args/result hashes.
 *   - Issued at session close. The runtime emits one per
 *     `closeSession()` call (including idempotent replays of an
 *     already-closed session).
 *   - Composes with delegation: a session whose outer task was
 *     delegated produces a `ComputerSessionReceipt` AND a
 *     `DelegationReceipt`. Verifiers can chain the two by
 *     `motebit_id` + timeframe.
 * @alpha
 */
export interface ComputerSessionReceipt extends SignableComputerSessionReceipt {
    /**
     * Cryptosuite discriminator. Always `"motebit-jcs-ed25519-b64-v1"`
     * today. Widening requires a registry change in `SuiteId` + a new
     * dispatch arm in `@motebit/crypto`, not a wire-format break.
     */
    readonly suite: "motebit-jcs-ed25519-b64-v1";
    readonly signature: string;
}
//# sourceMappingURL=computer-use.d.ts.map