import { ControllerCodexConnectionStore } from './classes.codexconnectionstore.js'; import * as plugins from './plugins.js'; import { type ICodexCreationRuntime, type IControllerCodexCreationDocument } from './classes.codexcreationmodels.js'; import type { ICodexCreationScope, IBeginCodexCreationInput } from './classes.codexcreationstore.js'; import { type IAuthStore, type IConsumeCeremonyOptions, type IControllerAuditEvent, type IControllerAuthDocument, type IRecordAuditEventInput, type IMintedTempPassword, type ISetupAuthority, type IStoredPasskeyCredential, type TWebAuthnCeremonyKind, type IWebAuthnCeremonyDocument, type IWebAuthnSetupCeremonyDocument } from './interfaces.auth.js'; import type { IControllerRuntimeConfig } from './interfaces.config.js'; import type { IControllerIssuerIdentity } from './interfaces.identity.js'; import { type IControllerFlexCleanupEntry } from './classes.managedsessionmodels.js'; import { ControllerSessionIdentityService, type IAdmitControllerManagedSessionInput, type IBeginControllerManagedSessionCreationInput, type IBeginControllerManagedSessionDeletionInput, type ICancelControllerManagedSessionDeletionInput, type ICompleteControllerManagedSessionCreationAdmissionInput, type ICompleteControllerManagedSessionDeletionInput, type IControllerManagedSessionDeletionObligation, type IControllerSessionManagedObservation, type IControllerSessionCreationObligation, type IGetControllerSessionCreationObligationInput, type IListControllerManagedSessionDeletionObligationsInput, type IListControllerFlexManagedCleanupRootsInput, type IListControllerSessionCreationObligationsInput, type IMarkControllerManagedSessionCreationDispatchedInput, type IMarkControllerManagedSessionDeletionDispatchedInput, type IRequireControllerManagedSessionInput, type IRetireControllerManagedSessionCreationInput, type IRetireControllerProjectManagedSessionsInput, type IResolveControllerFlexHostSessionAuthorityInput, type IResolveControllerFlexProjectManagementRegistrationLoadAuthorityInput, type IResolveControllerPendingFlexProjectManagementLoadAuthorityInput, type IResolveControllerSessionLayoutAuthorityInput, type IResolveRetiredManagedSessionIdentityInput, type TControllerFlexHostSessionAuthority, type TControllerFlexProjectManagementRegistrationLoadAuthority, type TControllerPendingFlexProjectManagementLoadAuthority, type TControllerSessionLayoutAuthority } from './classes.sessionidentityservice.js'; import { authStoreSessionIdentityCapability, type IAuthStoreSessionIdentityCapability } from './classes.sessionidentityintegration.js'; import { type IControllerTrackedConversationDocument, type IControllerProjectFilesystemIdentity, type IControllerProjectDocument, type IControllerResourceDocument, type IControllerResourceAttachmentEntryDocument, type IControllerSessionState, type IControllerIntelligenceAdmission, type IControllerInterruptedIntelligenceRecovery, type IControllerSettingsDocument } from './interfaces.projects.js'; import type { TControllerModelChoice, IControllerSystemMetrics, IControllerSystemMetricsHistoryPoint, IControllerRuntimeId, IControllerSessionGroup, IControllerSessionLayout, TControllerResourceKind, TControllerTerminalAgentDesiredState, TControllerTerminalAgentLaunchMode, TControllerTerminalAgentFailure, TControllerSessionId, TControllerSessionHarnessId, TControllerConversationOrigin, TControllerScratchpadUpdater, TControllerProjectRemovalBlockedCode } from '../dist_ts_interfaces/index.js'; import { type IControllerLegacyManagedSessionMigrationResult } from '../dist_ts_migration/v26_legacymanagedsessionmigration.js'; import { type TControllerLegacyManagedSessionMigrationRunnerInput } from '../dist_ts_migration/classes.managedsessionmigrationrunner.js'; import type { IFlexDatabaseDescriptor } from './interfaces.flexipc.js'; export interface ISmartDataAuthStoreOptions { /** external server URL; absent = embedded smartdb engine */ mongoDbUrl?: string; mongoDbName: string; /** storage directory for the embedded engine; required without mongoDbUrl */ embeddedDataDirectory?: string; /** previous installed default that may be logically migrated */ legacyEmbeddedDataDirectory?: string; } export declare const assertProvidedSetupCode: (setupCodeArg: string) => string; type TFlexProjectManagementRecord = plugins.flexharness.TFlexProjectManagementRecord; type TFlexProjectManagementSnapshot = plugins.flexharness.IFlexProjectManagementSnapshot; type TFlexProjectManagementTombstone = plugins.flexharness.IFlexProjectManagementTombstone; type TFlexProjectManagementWriteContext = plugins.flexharness.IFlexProjectManagementWriteContext; type TFlexSessionGeneration = plugins.flexharness.IFlexSessionGeneration; type TFlexProjectManagementSessionContext = plugins.flexharness.IFlexProjectManagementSessionContext; export declare const assertControllerResourceCreationCapacity: (projectResourceCountArg: number, controllerResourceCountArg: number) => void; export declare class SmartDataAuthStore implements IAuthStore, IAuthStoreSessionIdentityCapability { private readonly options; private database?; private embeddedDatabase?; private readonly smartDataManager; private initialized; private initPromise?; private initializationDataRoot?; private initializedDataRoot?; private issuerIdentity?; private sessionIdentityService?; private codexConnectionStore?; private readonly modelOwner; private releaseModelOwnership?; private controllerId?; private resolvedMongoDbUrl?; private closePromise?; private closeStarted; private projectMutationAdmissionOpen; private projectMutationTail; private sessionStateMutationTail; private auditPruneTimer?; private auditPrunePromise?; private runSessionStateMutation; constructor(options: ISmartDataAuthStoreOptions); private get db(); init(): Promise; initForController(dataRootDirectoryArg: string): Promise; recordSystemMetricsHistory(metricsArg: IControllerSystemMetrics): Promise; listSystemMetricsHistory(): Promise; pruneSystemMetricsHistory(): Promise; private initialize; private initOnce; private startAuditPrune; private pruneAuditHistory; private stopEmbeddedDatabase; private closeSessionIdentityService; private releaseModelOwnershipIfResourcesClosed; close(): Promise; getRuntimeConfig(controllerPortArg: number): Promise; /** Process-private connection data for the isolated Flex child and projection reader. */ getDatabaseDescriptor(): IFlexDatabaseDescriptor; resolveOrCreateRuntimeConfig(runtimeConfigArg: IControllerRuntimeConfig): Promise; private finalizeRuntimeConfigDocument; rotateSetupAuthority(providedCodeArg?: string): Promise; getState(): Promise; assertSetupAuthority(setupCodeArg: string, ceremonyArg?: IWebAuthnSetupCeremonyDocument, nowArg?: Date): Promise; countActiveCeremonies(kindArg: TWebAuthnCeremonyKind, nowArg: Date): Promise; createCeremony(ceremonyArg: IWebAuthnCeremonyDocument): Promise; consumeCeremony(optionsArg: IConsumeCeremonyOptions): Promise; assertPendingCeremony(optionsArg: IConsumeCeremonyOptions): Promise; private findPendingCeremony; commitFirstCredential(ceremonyArg: IWebAuthnSetupCeremonyDocument, credentialArg: IStoredPasskeyCredential): Promise; updateCounter(credentialIdArg: string, expectedCounterArg: number, newCounterArg: number): Promise; recordAuditEvent(eventArg: IRecordAuditEventInput): Promise; private assertInitialized; private requireSessionIdentityServiceForActiveProject; private requireSessionIdentityServiceForPendingProjectRemoval; private withActiveProjectSessionIdentityMutation; private withPendingProjectRemovalSessionIdentityMutation; admitManagedSession(inputArg: IAdmitControllerManagedSessionInput): Promise; requireCodexConnections(): ControllerCodexConnectionStore; listCodexMemberships(projectIdArg: string, signalArg?: AbortSignal): ReturnType; listCodexMembershipsForProjectRemoval(projectIdArg: string, signalArg?: AbortSignal): ReturnType; getCodexOrigin(projectIdArg: string, nativeIdArg: string, signalArg?: AbortSignal): ReturnType; beginCodexCreation(inputArg: IBeginCodexCreationInput): Promise; observeManagedCodexSession(inputArg: Parameters[0]): ReturnType; getCodexCreation(scopeArg: ICodexCreationScope): Promise; listCodexCreations(projectIdArg: string, signalArg?: AbortSignal): Promise; listCodexCreationsForProjectRemoval(projectIdArg: string, signalArg?: AbortSignal): Promise; admitCodexCreationForProjectRemoval(scopeArg: ICodexCreationScope, generationArg: string): Promise; retireCodexCreationForProjectRemoval(scopeArg: ICodexCreationScope, assertRuntimeTerminatedArg: (runtimeArg: ICodexCreationRuntime) => Promise): Promise; dispatchCodexCreation(scopeArg: ICodexCreationScope, runtimeArg: ICodexCreationRuntime): Promise; bindCodexCreation(scopeArg: ICodexCreationScope, generationArg: string, nativeIdArg: string, createdAtArg: number): Promise; admitCodexCreation(scopeArg: ICodexCreationScope, generationArg: string): Promise; findUnmaterializedCodexCreation(projectIdArg: string, nativeIdArg: string): Promise; finalizeCodexCreationMetadata(scopeArg: ICodexCreationScope): Promise; prepareCodexTurn(projectIdArg: string, nativeIdArg: string): Promise; cancelUndispatchedCodexTurn(projectIdArg: string, nativeIdArg: string): Promise; markCodexMaterialized(projectIdArg: string, nativeIdArg: string): Promise; completeCodexCreationDeletion(projectIdArg: string, nativeIdArg: string, projectRemovalArg?: boolean): Promise; retireCodexCreation(scopeArg: ICodexCreationScope, assertRuntimeTerminatedArg: (runtimeArg: ICodexCreationRuntime) => Promise): Promise; migrateLegacyManagedSessions(inputArg: TControllerLegacyManagedSessionMigrationRunnerInput): Promise; requireManagedSession(inputArg: IRequireControllerManagedSessionInput): Promise; resolveManagedSession(inputArg: IRequireControllerManagedSessionInput): Promise; resolveSessionLayoutAuthority(inputArg: IResolveControllerSessionLayoutAuthorityInput): Promise; pruneDefinitivelyUnmanagedSessionLayoutEntries(projectIdentityIdArg: string, sessionIdsArg: readonly IControllerRuntimeId[], signalArg?: AbortSignal): Promise<{ changed: boolean; sessionIds: IControllerRuntimeId[]; }>; resolveRetiredManagedSessionIdentity(inputArg: IResolveRetiredManagedSessionIdentityInput): Promise; resolveFlexHostSessionAuthority(inputArg: IResolveControllerFlexHostSessionAuthorityInput): Promise; resolvePendingFlexProjectManagementLoadAuthority(inputArg: IResolveControllerPendingFlexProjectManagementLoadAuthorityInput): Promise; resolveFlexProjectManagementRegistrationLoadAuthority(inputArg: IResolveControllerFlexProjectManagementRegistrationLoadAuthorityInput): Promise; beginManagedSessionDeletion(inputArg: IBeginControllerManagedSessionDeletionInput): Promise; markManagedSessionDeletionDispatched(inputArg: IMarkControllerManagedSessionDeletionDispatchedInput): Promise; cancelManagedSessionDeletion(inputArg: ICancelControllerManagedSessionDeletionInput): Promise; completeManagedSessionDeletion(inputArg: ICompleteControllerManagedSessionDeletionInput): Promise; listManagedSessionDeletionObligations(inputArg: IListControllerManagedSessionDeletionObligationsInput): Promise; listFlexManagedCleanupRoots(inputArg: IListControllerFlexManagedCleanupRootsInput): Promise; retireProjectManagedSessions(inputArg: IRetireControllerProjectManagedSessionsInput): Promise; beginManagedSessionCreation(inputArg: IBeginControllerManagedSessionCreationInput): Promise; markManagedSessionCreationDispatched(inputArg: IMarkControllerManagedSessionCreationDispatchedInput): Promise; completeManagedSessionCreationAdmission(inputArg: ICompleteControllerManagedSessionCreationAdmissionInput): Promise; retireManagedSessionCreation(inputArg: IRetireControllerManagedSessionCreationInput): Promise; listPendingSessionCreationObligations(inputArg: IListControllerSessionCreationObligationsInput): Promise; getSessionCreationObligation(inputArg: IGetControllerSessionCreationObligationInput): Promise; /** Internal recovery path: normal callers must use the active-project wrapper. */ listManagedSessionDeletionObligationsForProjectRemoval(inputArg: IListControllerManagedSessionDeletionObligationsInput): Promise; /** Internal recovery path: normal callers must use the active-project wrapper. */ markManagedSessionDeletionDispatchedForProjectRemoval(inputArg: IMarkControllerManagedSessionDeletionDispatchedInput): Promise; /** Internal recovery path: normal callers must use the active-project wrapper. */ completeManagedSessionDeletionForProjectRemoval(inputArg: ICompleteControllerManagedSessionDeletionInput): Promise; /** Internal recovery path: normal callers must use the active-project wrapper. */ retireProjectManagedSessionsForProjectRemoval(inputArg: IRetireControllerProjectManagedSessionsInput): Promise; /** Internal recovery path: normal callers must use the active-project wrapper. */ listPendingSessionCreationObligationsForProjectRemoval(inputArg: IListControllerSessionCreationObligationsInput): Promise; /** Internal recovery path: caller must prove the provider session exists. */ completeManagedSessionCreationAdmissionForProjectRemoval(inputArg: ICompleteControllerManagedSessionCreationAdmissionInput): Promise; /** Internal recovery path: caller must first prove the provider session absent. */ retireManagedSessionCreationForProjectRemoval(inputArg: IRetireControllerManagedSessionCreationInput): Promise; [authStoreSessionIdentityCapability](inputArg: Parameters[0]): ReturnType; private findStoredState; private requireControllerId; listProjects(): Promise; createProject(nameArg: string, directoryArg: string, identityArg: IControllerProjectFilesystemIdentity): Promise<{ project: IControllerProjectDocument; created: boolean; }>; removeProject(projectIdArg: string, operationIdArg: string): Promise; beginProjectRemoval(projectIdArg: string, operationIdArg: string, flexCleanupCohortArg: readonly IControllerFlexCleanupEntry[]): Promise; /** * Records why a pending removal stopped being retried. Only the removal operation that owns the * project may block it, so a stale attempt can never label a removal it no longer drives. */ blockProjectRemoval(projectIdArg: string, operationIdArg: string, codeArg: TControllerProjectRemovalBlockedCode, reasonArg: string): Promise; /** * Clears a recorded removal block so the pending removal can be attempted again. The removal * itself is never discarded; the returned document is the still-pending project. */ clearProjectRemovalBlock(projectIdArg: string): Promise; listPendingProjectRemovals(): Promise; private withProjectMutation; private insertResourceDocument; private transitionResourceDocument; getProject(projectIdArg: string): Promise; getPendingProjectRemoval(projectIdArg: string): Promise; listResources(projectIdArg: string, optionsArg?: { includeRetired?: boolean; signal?: AbortSignal; }): Promise; listRecoverableResources(): Promise; getResource(projectIdArg: string, resourceIdArg: string, optionsArg?: { includeRetired?: boolean; }): Promise; createResource(inputArg: { projectId: string; kind: TControllerResourceKind; title: string; terminal?: IControllerResourceDocument['terminal']; }): Promise; renameResource(projectIdArg: string, resourceIdArg: string, titleArg: string): Promise; /** * Opens the single in-flight attachment obligation. `add` installs an entry (idempotent when * the same entry is already present), `remove` takes one out or clears the set when no entry is * named, and `replace` does both atomically for a Move. */ beginResourceAttachmentTransition(projectIdArg: string, resourceIdArg: string, intentArg: { op: 'add' | 'remove' | 'replace'; entry?: IControllerResourceAttachmentEntryDocument; replaces?: IControllerResourceAttachmentEntryDocument; }, expectedAttachmentRevisionArg: number): Promise; commitResourceAttachmentTransition(projectIdArg: string, resourceIdArg: string, operationIdArg: string): Promise; cancelResourceAttachmentTransition(projectIdArg: string, resourceIdArg: string, operationIdArg: string): Promise; beginResourceRetirement(projectIdArg: string, resourceIdArg: string): Promise; completeResourceRetirement(projectIdArg: string, resourceIdArg: string): Promise; markTerminalResourceStopped(projectIdArg: string, resourceIdArg: string, outcomeArg?: { stoppedAt?: Date; lastExitCode?: number; /** * Absent preserves the recorded intent, which is the controller-shutdown case: the chat was * closed underneath the user and must come back on the next start. */ desiredState?: TControllerTerminalAgentDesiredState; failure?: { code: TControllerTerminalAgentFailure; message: string; }; }): Promise; markTerminalResourceRunning(projectIdArg: string, resourceIdArg: string, outcomeArg?: { launchMode?: TControllerTerminalAgentLaunchMode; }): Promise; getSettings(): Promise; updateSettings(patchArg: { defaultModels?: TControllerModelChoice[]; autoAcceptPermissions?: boolean; browserVideoBackend?: 'chromium' | 'native'; selectedOpenCodeProviderConnectionId?: string | null; /** Full replacement; an empty list clears the key. */ standardProjectDirectories?: string[]; lastSessionHarnessId?: TControllerSessionHarnessId; }): Promise; private trackedConversationDocumentId; /** * Every conversation AGL tracks, newest first per page scan. Pass project IDs to scope the * read; the complete set is bounded so one cross-project sidebar read can never be unbounded. */ listTrackedConversations(projectIdsArg?: readonly string[], signalArg?: AbortSignal): Promise; getTrackedConversation(projectIdArg: string, runtimeIdArg: TControllerSessionId): Promise; /** * Idempotent. An explicit `opened` intent also returns an AGL-archived conversation to the * active list, because opening it again is exactly the user asking for it back. */ trackConversation(inputArg: { projectId: string; runtimeId: TControllerSessionId; sessionIdentityId: string; origin: TControllerConversationOrigin; title?: string; }): Promise; /** AGL-level archive state only. The harness conversation is never touched here. */ setTrackedConversationArchived(projectIdArg: string, runtimeIdArg: TControllerSessionId, archivedArg: boolean): Promise; /** Cache the newest observed title so the archive view needs no harness read. */ cacheTrackedConversationTitle(projectIdArg: string, runtimeIdArg: TControllerSessionId, titleArg: string): Promise; untrackConversation(projectIdArg: string, runtimeIdArg: TControllerSessionId): Promise; /** Project removal takes its tracked conversations with it. */ untrackProjectConversations(projectIdArg: string): Promise; getSessionLayout(): Promise; updateSessionLayout(groupsArg: IControllerSessionGroup[], ungroupedItemIdsArg?: IControllerSessionGroup['itemIds'], expectedRevisionArg?: number): Promise; removeSessionFromLayout(projectIdArg: string, sessionIdArg: IControllerRuntimeId): Promise; /** A retired resource must not leave a dangling layout member behind. */ removeResourceFromLayout(projectIdArg: string, resourceIdArg: string): Promise; /** A deregistered project must not leave its conversations and resources in the layout. */ removeProjectFromLayout(projectIdArg: string): Promise; pruneArchivedSessionLayoutEntries(projectIdArg: string, archivedSessionIdsArg: readonly IControllerRuntimeId[]): Promise; private filterSessionLayout; private sessionStateIdentity; private createEmptySessionStateDocument; private findStoredSessionState; private insertSessionState; private transitionSessionState; getSessionState(projectIdArg: string, sessionIdArg: IControllerRuntimeId): Promise; readFlexProjectTasks(projectIdArg: string, sessionIdArg: string, sessionGenerationArg: Readonly): Promise; loadFlexProjectManagement(projectIdArg: string, sessionIdArg: string, sessionGenerationArg: Readonly): Promise; saveFlexProjectManagement(projectIdArg: string, sessionIdArg: string, snapshotArg: TFlexProjectManagementSnapshot, expectedRevisionArg: number, writeContextArg: TFlexProjectManagementWriteContext): Promise; tombstoneFlexProjectManagement(projectIdArg: string, sessionIdArg: string, tombstoneArg: TFlexProjectManagementTombstone, expectedRevisionArg: number, sessionContextArg: Readonly): Promise; purgeFlexProjectManagementNamespace(projectIdArg: string): Promise; setSessionModelChoice(projectIdArg: string, sessionIdArg: IControllerRuntimeId, modelChoiceArg: TControllerModelChoice, providerConnectionIdArg?: string): Promise; private clearStoredSessionProviderConnection; clearSessionProviderConnectionsForConnection(providerConnectionIdArg: string, signalArg?: AbortSignal): Promise; saveSessionScratchpad(projectIdArg: string, sessionIdArg: IControllerRuntimeId, textArg: string, expectedRevisionArg: number, updatedByArg?: TControllerScratchpadUpdater): Promise; private saveSessionScratchpadUnqueued; admitSessionIntelligence(projectIdArg: string, sessionIdArg: IControllerRuntimeId, questionArg: string): Promise; private admitSessionIntelligenceUnqueued; attachSessionIntelligenceTemporarySession(projectIdArg: string, sessionIdArg: IControllerRuntimeId, exchangeIdArg: string, temporarySessionIdArg: string): Promise; private attachSessionIntelligenceTemporarySessionUnqueued; completeSessionIntelligence(projectIdArg: string, sessionIdArg: IControllerRuntimeId, exchangeIdArg: string, answerArg: string, scratchpadTextArg: string, modelArg: string): Promise; private completeSessionIntelligenceUnqueued; failSessionIntelligence(projectIdArg: string, sessionIdArg: IControllerRuntimeId, exchangeIdArg: string, errorArg: string, modelArg?: string): Promise; private failSessionIntelligenceUnqueued; recoverInterruptedSessionIntelligence(): Promise; private recoverInterruptedSessionIntelligenceUnqueued; listProjectSessionIntelligenceCleanupObligations(projectIdArg: string): Promise; getSessionIntelligenceCleanupObligations(projectIdArg: string, sessionIdArg: IControllerRuntimeId): Promise; findProjectSessionIntelligenceTemporarySessionIds(projectIdArg: string, candidateIdsArg: string[], signalArg?: AbortSignal): Promise>; isSessionStateTombstoned(projectIdArg: string, sessionIdArg: IControllerRuntimeId): Promise; retireProjectSessionStates(projectIdArg: string, cleanupTemporarySessionArg: (temporarySessionIdArg: string) => Promise, signalArg?: AbortSignal): Promise<{ retiredCount: number; temporarySessionIds: string[]; }>; clearSessionIntelligenceTemporarySession(projectIdArg: string, sessionIdArg: IControllerRuntimeId, exchangeIdArg: string, temporarySessionIdArg: string): Promise; private clearSessionIntelligenceTemporarySessionUnqueued; tombstoneSessionState(projectIdArg: string, sessionIdArg: IControllerRuntimeId): Promise; private tombstoneSessionStateUnqueued; private applyFlexProjectManagementScratchpad; private applySessionStateTombstone; createTempPassword(ttlMsArg: number): Promise; verifyTempPassword(passwordArg: string): Promise<{ credentialId: string; expiresAt: Date; } | undefined>; private assertRuntimeConfigMatches; private auditEventsEqual; } export {};