OpenHealthSim

Complete public service reference

Generated from the actual public contracts in this build. Source locations refer to the SDK package layout in the author kit.

Read the reference boundaries and download the source definitions. A declared API is not a permission or an enabled provider.

Generated from the actual @i2l-sim/types barrel exports by node scripts/generate-service-reference.mjs. Do not edit this file directly.

These are type contracts, not permission grants or proof that a provider is enabled. Declare injected services; call them through the contributor context. Root-only/internal operations keep their documented authority limits. See plugin author guide and generated hooks.

Roots are exported *Service, *Api, *Adapter contracts (including aliases), plus public storage operations/transactions/blob storage, discovery, the simulated clinical bridge, legacy operator control, the authoring-context provider, paired-browser registry, trusted portable-workspace owner and correction verifier. Inherited members, nested operations and reachable return APIs are included. Callback/DTO contracts are not separate service roots; native/external library methods are excluded.

AiProviderInputAuthorizationService#

Internal readonly port. Only the actual AI owner can verify a canonical planned operation; a browser reference or caller DTO cannot grant consent.

Source: packages/types/src/ai-provider-input-api.ts:12.

OperationSignatureContractSource
generation(reviewId: string): object | undefinedCapture the actual source/review owner lifetime before asynchronous proof.packages/types/src/ai-provider-input-api.ts:14
verify(binding: AiProviderInputBinding): Promise<AiProviderInputAuthorization>Verify the exact approved copy, planned run/token hash, contract and source.packages/types/src/ai-provider-input-api.ts:16

AiProviderInputReviewsService#

Canonical owner's authenticated local review facade. Approval never starts a provider, accepts its output, edits the original source or grants deletion.

Source: packages/types/src/ai-provider-input-api.ts:35.

OperationSignatureContractSource
confirm(input: AiProviderInputReviewConfirmation): Promise<{ revision: number; duplicate: boolean; }>Record explicit authorized review atomically with metadata-only audit.packages/types/src/ai-provider-input-api.ts:41
prepare(scope: AiProviderInputReviewScope): Promise<AiProviderInputReviewDraft>Prepare a bounded editable provider copy from the current canonical source.packages/types/src/ai-provider-input-api.ts:37
read(input: { reviewId: string; scope: AiProviderInputReviewScope; }): Promise<AiProviderInputReviewDraft>Read one current review without a model call or implicit approval.packages/types/src/ai-provider-input-api.ts:39

AiService#

Source: packages/types/src/ai-api.ts:193.

OperationSignatureContractSource
audit(runId: string): Promise<AiCallAudit[]>Read the saved attempt audit metadata for this run; content is present only under its explicit capture policy.packages/types/src/ai-api.ts:258
budgetStatus(handle: AiBudgetHandle): AiBudgetSnapshotRead detached consumption/held synthesis for this exact caller-owned handle.packages/types/src/ai-api.ts:199
cancel(runId: string): Promise<void>Request cancellation of an existing run without accepting or applying its output.packages/types/src/ai-api.ts:255
cancelOwned(runId: string, ownerToken: string): Promise<void>Cancel only the exact matching owned generation; foreign/absent is a no-op.packages/types/src/ai-api.ts:234
createBudget(limits: AiRunBudget, options?: AiBudgetOptions): AiBudgetHandleSame-process owner-bound budget. Mandatory synthesis allowance is held before analysis; use the same handle for all chunks and internal retries.packages/types/src/ai-api.ts:197
disposeBudget(handle: AiBudgetHandle): voidRetire this caller's budget and abort its still-running provider attempts.packages/types/src/ai-api.ts:201
eraseOwnedThread(threadId: string, ownerToken: string): Promise<{ erasedRuns: number; }>Private terminal-only retention. The actual admission source or runtime root and the private token must match every run in this thread. Refuses active jobs/admissions. Atomically removes bodies/events, preserves audit metadata and fences reuse with hash-only identity. Repeated success is 0.packages/types/src/ai-api.ts:239
events(runId: string, options?: AiHistoryOptions): Promise<AiHistoryPage>Read bounded ordered run-event history after the supplied sequence cursor.packages/types/src/ai-api.ts:249
get(runId: string): Promise<AiRunSnapshot>Read a detached run snapshot without private owner credentials.packages/types/src/ai-api.ts:242
getOwned(runId: string, ownerToken: string): Promise<AiRunSnapshot>Read only the exact token-owned run; private ownership fields stay hidden.packages/types/src/ai-api.ts:232
getOwnedContract(runId: string, ownerToken: string, expected: AiOwnedContractReceipt): Promise<AiRunSnapshot>Read the exact receipt/generation and run together; rejects foreign or replaced runs.packages/types/src/ai-api.ts:225
getOwnedRejectedOutput(runId: string, ownerToken: string, expected: AiOwnedContractReceipt): Promise<string | null>Private owner-bound read of explicitly retained terminal output. Absent for old runs, other outcomes and outputs exceeding the one MiB retention cap.packages/types/src/ai-api.ts:230
getOwnedTerminalRejection(runId: string, ownerToken: string, expected: AiOwnedContractReceipt): Promise<AiOwnedTerminalRejection | null>Private owner-bound lookup; returns null for old runs or other outcomes.packages/types/src/ai-api.ts:227
provider(definition: AiProviderDefinition): () => voidRegister a provider under the calling plugin lifecycle; returns its owned disposer.packages/types/src/ai-api.ts:207
readPolicy(runId: string): Promise<{ readPermission?: AuthPermission; }>Metadata-only transport authorization projection: no input, state, model, source hashes or endpoints. Missing capability cannot establish a safe historical read policy. The registry validates durable policy values.packages/types/src/ai-api.ts:246
run(taskId: string, input: unknown, options: AiRunOptions): Promise<AiRunHandle>Resolves after durable RUN_STARTED; execution continues under owned lifecycle.packages/types/src/ai-api.ts:212
runOwned(taskId: string, input: unknown, options: AiOwnedRunOptions, ownerToken: string): Promise<AiRunHandle>Internal same-process admission. The caller persists a fresh 256-bit token before admission and keeps it private. Never expose this over HTTP.packages/types/src/ai-api.ts:215
runOwnedContract(taskId: string, input: unknown, options: AiOwnedRunOptions, ownerToken: string, expected: AiOwnedContractIdentity, retention?: { terminalRejectedOutput: true; }): Promise<AiOwnedContractReceipt>Internal owner-bound admission with independently expected exact contract. Optional retention stores up to 1 MiB of source-derived canonical final rejected output in the profile database and normal exports/backups. It is separate from captureContent. The receipt's final in-transaction lifecycle check also determines retention; later aborts cannot undo it, even before physical commit. Not a browser capability, user authentication, human decision or source-fidelity assertion.packages/types/src/ai-api.ts:223
subscribe(runId: string, listener: (event: AiRunEvent) => void | Promise<void>): () => voidA same-process owned listener; browser disconnect disposes the listener, not the durable run. Replay from seq closes subscription races.packages/types/src/ai-api.ts:252
task<I = unknown, O = unknown>(definition: AiTaskDefinition<I, O>): () => voidRegister a versioned task contract and its owned lifecycle disposer.packages/types/src/ai-api.ts:204
tasks(): Promise<AiTaskSummary[]>List active task metadata without starting a provider request.packages/types/src/ai-api.ts:210

AuditService#

Source: packages/types/src/audit-api.ts:53.

OperationSignatureContractSource
abandon(input: { operationId: string; intentId?: string; binding?: string; }): Promise<AuditAbandonReceipt>Seal a definitely uncommitted feature mutation, including a prepare with a lost acknowledgement. Only its actual owner can release the reservation. A recorded mutation remains immutable; abandonment creates no audit event and permanently refuses a late prepare for the same operation ID. A known change issuance supplies its binding; journal cleanup requires the matching durable binding acknowledgement, even after provider replacement.packages/types/src/audit-api.ts:87
abandonAi(input: { operationId: string; intentId?: string; }): Promise<AuditAiAbandonReceipt>Seal a definitely undispatched operation, even after an uncertain prepare acknowledgement. Only the same actual owner may release its reservation. An already recorded call is immutable; this never invents a call record.packages/types/src/audit-api.ts:72
prepare(input: AuditInput): Promise<AuditIntentReceipt>Capture caller owner and trusted ambient actor in a durable private intent. The owner commits intentId in its own atomic mutation/outbox transaction. A prepared intent alone is not a committed audit record.packages/types/src/audit-api.ts:80
prepareAi(input: AuditAiStart): Promise<AuditAiIntentReceipt>Capture the actual caller and ambient actor before a provider attempt. The private intent is not a completed record. Persist its ID atomically with the AI owner's dispatch admission before executing the provider.packages/types/src/audit-api.ts:68
prepareChange(input: AuditChangeStart): Promise<AuditChangeIntentReceipt>Durably capture the actual feature owner and trusted ambient actor before mutation. Persist preparation locally first, then its opaque issuance binding before dispatch. An intent is not a committed event. Abandoned operations cannot become prepared again and return a null binding.packages/types/src/audit-api.ts:58
query(options?: AuditQueryOptions): Promise<AuditPage>Read bounded sequence pages as actual root or a trusted audit.read invocation. Cursors bind filters and an append-only high-water mark.packages/types/src/audit-api.ts:94
record(input: AuditInput | { intentId: string; }): Promise<AuditReceipt>Append once from an owner-matching intent, or directly from metadata. Delete an owner outbox entry only after this durable receipt. Direct post-commit recording alone does not close the crash gap.packages/types/src/audit-api.ts:91
recordAi(input: { intentId: string; completion: AuditAiCompletion; }): Promise<AuditReceipt>Finalize a prepared AI intent once, preserving its original owner/actor. Only identical retries are accepted; restart recovery explicitly records unknown duration/usage rather than replaying the provider.packages/types/src/audit-api.ts:76
recordChange(input: { intentId: string; binding: string; completion: AuditChangeCompletion; }): Promise<AuditReceipt>Finalize only after the owner's mutation and metadata outbox committed atomically. Preserves the prepared actor; identical retries append once. The issuance binding must match the original intent, including on relay after owner replacement. Partial outcomes are immutable; later progress needs a distinct ticket.packages/types/src/audit-api.ts:64

AuthService#

Source: packages/types/src/auth-api.ts:48.

OperationSignatureContractSource
addUser(input: AuthAddUser, token?: string): Promise<AuthUser>Administrator/root-only account creation; the first account must be admin.packages/types/src/auth-api.ts:62
authenticate(token: string): Promise<AuthPrincipal | null>Read current stored account/session authority; invalid/revoked returns null.packages/types/src/auth-api.ts:52
authorize(permission: AuthPermission, token?: string): Promise<AuthAuthority>Missing token grants local-host authority ONLY to the actual kernel root context. HTTP ingress must reject missing credentials before calling this method through a root-resolved service. A principal DTO is not a credential.packages/types/src/auth-api.ts:56
listUsers(token?: string): Promise<AuthUser[]>Administrator/root-only bounded public account inventory, without hashes.packages/types/src/auth-api.ts:60
login(input: AuthLoginInput): Promise<AuthLogin>Verify a local account and issue one absolute-expiry opaque credential.packages/types/src/auth-api.ts:50
logout(token: string): Promise<void>Idempotently revoke this credential; no account changes or session renewal.packages/types/src/auth-api.ts:58
revokeUserSessions(userId: string, token?: string): Promise<void>Administrator/root-only durable generation rotation and session revocation.packages/types/src/auth-api.ts:67
updateUser(input: AuthUpdateUser, token?: string): Promise<AuthUser>Administrator/root-only optimistic edit; every edit revokes old sessions. The final enabled admin cannot be disabled/demoted, including by root.packages/types/src/auth-api.ts:65

BlobStore#

Source: packages/types/src/storage.ts:117.

OperationSignatureContractSource
delete(id: string): Promise<void>Remove a blob, idempotently.packages/types/src/storage.ts:123
get(id: string): Promise<ReadableStream<Uint8Array> | null>Stream a blob without loading it fully; a missing blob returns null.packages/types/src/storage.ts:121
list(prefix?: string): AsyncIterable<BlobInfo>List metadata in id order, optionally restricted to an id prefix.packages/types/src/storage.ts:125
put(id: string, input: BlobInput, metadata?: { mime?: string; }): Promise<BlobInfo>Persist the complete stream atomically; failed writes expose no partial blob.packages/types/src/storage.ts:119

CliApi#

Plugin CLI contribution registry.

Source: packages/types/src/host.ts:89.

OperationSignatureContractSource
command(def: CliCommand): () => voidRegister an owned namespaced command.packages/types/src/host.ts:91
list(): Promise<{ name: string; description: string; }[]>List registered commands.packages/types/src/host.ts:95
run(name: string, args: string[]): Promise<unknown>Execute a registered command through its contained handler.packages/types/src/host.ts:93

ClockService#

Source: packages/types/src/session-api.ts:63.

OperationSignatureContractSource
advance(sessionId: string, deltaMs: number, meta?: CommandMeta): Promise<SessionDispatchResult>Virtual advancement is a session command, not private provider state.packages/types/src/session-api.ts:69
read(sessionId: string, anchor: ClockAnchor, issuedAt?: string): Promise<EngineNow>Read this clock mode at the saved session anchor and optional issued wall time.packages/types/src/session-api.ts:67

ConsoleService#

FR-RUN: UI intents use the same ordered session command service as devices.

Source: packages/types/src/console-api.ts:17.

OperationSignatureContractSource
dispatch(command: SessionCommand): Promise<SessionDispatchResult>Forward the original console command through ordered session admission.packages/types/src/console-api.ts:23
sessions(): Promise<Session[]>List sessions available to the runner console.packages/types/src/console-api.ts:26
state(sessionId: string): Promise<ConsoleSnapshot>Read the session, durable events and derived console projection together.packages/types/src/console-api.ts:20

DebriefDraftDataService#

Canonical debrief-review delegates only; no peer namespace access.

Source: packages/types/src/debrief-retained-api.ts:50.

OperationSignatureContractSource
erase(operation: SessionDataOperation): Promise<SessionDataReceipt>Idempotently erase only the authorized scope after its durable fence. Recording expiry retains safe provenance needed by longer-lived text.packages/types/src/session-data-api.ts:51
freeze(operation: SessionDataOperation): Promise<void>Persist an operation fence before admitting any subsequent owner writes; drain its prior commit lane and revoke affected active readers/tasks.packages/types/src/session-data-api.ts:48
inventory(options?: { limit?: number; cursor?: string; }): Promise<SessionDataInventory>Bounded metadata inventory only; no recording bytes or personal text.packages/types/src/session-data-api.ts:45

DebriefErasureService#

Source: packages/types/src/debrief-retained-api.ts:43.

OperationSignatureContractSource
build(operation: SessionDataOperation): Promise<DebriefCore>Restricted to the actual debrief owner/root and exact admitted operation. Uses the complete fenced SessionLog source only for local sanitization; no ordinary preview, partial event substitute, edit or sharing permission.packages/types/src/debrief-retained-api.ts:47

DebriefExportDataService#

Fences pending in-memory exports and persists the session barrier.

Source: packages/types/src/debrief-retained-api.ts:52.

OperationSignatureContractSource
erase(operation: SessionDataOperation): Promise<SessionDataReceipt>Idempotently erase only the authorized scope after its durable fence. Recording expiry retains safe provenance needed by longer-lived text.packages/types/src/session-data-api.ts:51
freeze(operation: SessionDataOperation): Promise<void>Persist an operation fence before admitting any subsequent owner writes; drain its prior commit lane and revoke affected active readers/tasks.packages/types/src/session-data-api.ts:48
inventory(options?: { limit?: number; cursor?: string; }): Promise<SessionDataInventory>Bounded metadata inventory only; no recording bytes or personal text.packages/types/src/session-data-api.ts:45

DebriefExportService#

Source: packages/types/src/debrief-export-api.ts:13.

OperationSignatureContractSource
export(request: DebriefExportRequest): Promise<DebriefExportDownload>Export the requested reviewed audience/source revision; rejects stale or unavailable source bindings.packages/types/src/debrief-export-api.ts:16

DebriefModelsService#

Source: packages/types/src/debrief-models-api.ts:37.

OperationSignatureContractSource
arrange(scenario: Scenario, modelId?: string): Promise<DebriefPromptArrangement>Arrange the unchanged scenario question bank in the selected model without granting clinical approval.packages/types/src/debrief-models-api.ts:49
generation(): object | undefinedSynchronous opaque lifetime of current model contents. Registration, contribution removal and retirement invalidate captured source proofs.packages/types/src/debrief-models-api.ts:40
get(id: string): Promise<DebriefModel | null>Read one active model by ID, or null when unavailable.packages/types/src/debrief-models-api.ts:46
list(): Promise<DebriefModel[]>List active debrief models as detached metadata.packages/types/src/debrief-models-api.ts:43
register(model: DebriefModel): () => voidContributions retire with the calling plugin, without replacing another owner.packages/types/src/debrief-models-api.ts:51

DebriefPromptWorkflowService#

Source: packages/types/src/debrief-prompts-api.ts:16.

OperationSignatureContractSource
start(request: DebriefPromptRequest & { confirmed: true; allowAi: true; }): Promise<DebriefPromptRun>Admit one explicitly confirmed, policy-bound AI prompt request; suggestions remain unaccepted.packages/types/src/debrief-prompts-api.ts:19
status(request: DebriefPromptRequest): Promise<DebriefPromptRun>Read the exact saved operation status without admitting another provider request.packages/types/src/debrief-prompts-api.ts:22

DebriefReviewService#

Source: packages/types/src/debrief-review-api.ts:36.

OperationSignatureContractSource
change(command: DebriefReviewCommand): Promise<{ revision: number; duplicate: boolean; }>Apply one source-bound optimistic human review command; exact retries return their saved receipt.packages/types/src/debrief-review-api.ts:45
learner(sessionId: string, options?: { modelId?: string; }): Promise<DebriefLearnerSheet>Read the learner projection with facilitator-private notes excluded.packages/types/src/debrief-review-api.ts:42
open(sessionId: string, options?: { modelId?: string; }): Promise<DebriefReviewSheet>Read the ended-session facilitator sheet and current human review revision.packages/types/src/debrief-review-api.ts:39

DebriefService#

Source: packages/types/src/debrief-api.ts:39.

OperationSignatureContractSource
build(sessionId: string, options?: { modelId?: string; }): Promise<DebriefCore>modelId is a read-only preview override; it does not change session setup.packages/types/src/debrief-api.ts:47
models(): Promise<DebriefModel[]>List currently available model metadata without changing the session selection.packages/types/src/debrief-api.ts:45
sessions(): Promise<DebriefSessionSummary[]>List ended sessions eligible for a deterministic debrief preview.packages/types/src/debrief-api.ts:42

DiscoveryService#

Source: packages/types/src/discovery-api.ts:17.

OperationSignatureContractSource
advertise(input: HostDiscoveryAdvertisement): UiDisposerDeclare the owner's host advertisement and return its owned disposer. No mDNS/broadcast listener is provided by this interface.packages/types/src/discovery-api.ts:20
browse(input: DiscoveryQuery): Promise<readonly InterfaceDiscoveryCandidate[]>Browse within a future owner's validated deadline. Results require normal manual confirmation, destination policy and transport authentication. This declaration runs no discovery, BLE scan or network operation.packages/types/src/discovery-api.ts:24

DoctorService#

Source: packages/types/src/doctor-api.ts:23.

OperationSignatureContractSource
check(): Promise<DoctorReport>Read owner diagnostics and run bounded disposable local probes. Remote reachability and device trust remain explicitly unverified.packages/types/src/doctor-api.ts:26

DraftService#

Source: packages/types/src/draft-api.ts:311.

OperationSignatureContractSource
acceptCourseClaims(id: string, expectedRevision: number, expected: { view: PendingCourseReview; scenarioSha256: string; acceptedItemIds: string[]; }, actor: DraftActor): Promise<ScenarioDraft>Caller-attributed human decision; exact displayed view and current scenario digest are required.packages/types/src/draft-api.ts:446
acceptValue(id: string, expectedRevision: number, path: string, actor: DraftActor): Promise<ScenarioDraft>Explicitly accept a single suggested provenance path, without inventing values.packages/types/src/draft-api.ts:426
acknowledgeCorrectionWarnings(id: string, expectedRevision: number, expected: { source: VerifiedCorrectionSource; diagnostics: CurrentCorrectionReview; selected: CorrectionWarningSelection[]; }, actor: DraftActor): Promise<ScenarioDraft>Individually audit only the explicitly selected, currently displayed warnings.packages/types/src/draft-api.ts:466
acknowledgePendingCourseWarning(id: string, expectedRevision: number, expected: PendingCourseWarningView, rationale: string, actor: DraftActor): Promise<ScenarioDraft>Explicitly acknowledge one independently source-reconstructed warning.packages/types/src/draft-api.ts:456
addLocalPortableFirstOutcome(draftId: string, revision: number, text: string, actor: DraftActor): Promise<ScenarioDraft>Append the first explicit human learning outcome to the exact local portable draft revision.packages/types/src/draft-api.ts:400
appendExpectedAction(id: string, expectedRevision: number, input: import("./expected-action-append.js").ExpectedActionAppendInput, actor: DraftActor): Promise<ScenarioDraft>Append one explicit human manual action, preserving existing provenance.packages/types/src/draft-api.ts:325
approve(id: string, expectedRevision: number, actor: DraftActor): Promise<ScenarioDraft>Human-only decision: publish an immutable version and audit atomically.packages/types/src/draft-api.ts:476
approveLocalPortable(draftId: string, revision: number, actor: DraftActor): Promise<ScenarioDraft>Approve only the exact locally reviewed portable draft after its current approval checks pass.packages/types/src/draft-api.ts:415
assessLocalPortable(workspaceOperationId: string, workspaceRevision: number): Promise<{ supported: boolean; issues: { path: string; code: "shape" | "unsupported" | "reference"; }[]; truncated: boolean; }>Trusted same-process preparation only; no browser or MCP command invokes these until the full lifecycle is reviewed.packages/types/src/draft-api.ts:355
check(id: string): Promise<DraftApprovalCheck>Check graph, required authoring fields, gaps and outstanding suggestions.packages/types/src/draft-api.ts:474
checkLocalPortable(draftId: string, revision: number): Promise<DraftApprovalCheck>Read current local portable approval blockers without accepting source claims.packages/types/src/draft-api.ts:412
completeCourseReview(id: string, expectedRevision: number, actor: DraftActor): Promise<ScenarioDraft>Attest to the current course source and entire scenario, without approving it.packages/types/src/draft-api.ts:438
confirmCorrectionScale(id: string, expectedRevision: number, scale: 1 | 2, actor: DraftActor): Promise<ScenarioDraft>Explicit caller-attributed scale choice; preserves unknown provenance.packages/types/src/draft-api.ts:464
confirmInheritedGapValue(id: string, expectedRevision: number, gapIndex: number, expectedValue: string | number | boolean, actor: DraftActor, parameter?: string): Promise<ScenarioDraft>Record human confirmation of the exact inherited gap value at the expected draft revision.packages/types/src/draft-api.ts:434
confirmLocalPortableNarrative(id: string, revision: number, field: "title" | "summary", actor: DraftActor): Promise<ScenarioDraft>Record human confirmation of the current title or summary on the local portable draft.packages/types/src/draft-api.ts:373
confirmLocalPortableOutcomes(id: string, revision: number, actor: DraftActor): Promise<ScenarioDraft>Record human confirmation of the current local portable learning outcomes.packages/types/src/draft-api.ts:370
correctDetachedSafetyNote(id: string, expectedRevision: number, path: string, expectedValue: string, value: string, actor: DraftActor): Promise<ScenarioDraft>Explicitly replace one previously detached positional safety note.packages/types/src/draft-api.ts:313
correctionScenarioOrigin(scenarioId: string, version: number): Promise<"correction" | "not_correction" | "unavailable">Classify this exact scenario identity for protected correction origin. An unavailable answer must fail closed; this is not general import tracking.packages/types/src/draft-api.ts:340
create(scenario: Scenario, actor: DraftActor, source?: DraftCreateSource): Promise<ScenarioDraft>Reserve a fresh version; source objects and published versions stay intact.packages/types/src/draft-api.ts:330
createLocalPortable(requestId: string, actor: DraftActor): Promise<ScenarioDraft>Materialize the saved local portable request as a new unapproved draft.packages/types/src/draft-api.ts:361
createLocalPortableChild(requestId: string, actor: DraftActor): Promise<ScenarioDraft>Materialize the saved child-copy request without changing its approved parent.packages/types/src/draft-api.ts:367
createUnverifiedCorrection(operationId: string, secret: string): Promise<ScenarioDraft>Internal owner capability only; not a browser command or human approval.packages/types/src/draft-api.ts:332
decideCueScheduling(id: string, expectedRevision: number, cueId: string, viewSha256: string, choice: "manual" | "condition", actor: DraftActor): Promise<ScenarioDraft>Apply the explicit manual/condition choice bound to the displayed scheduling view hash.packages/types/src/draft-api.ts:347
declareMissingVitals(id: string, expectedRevision: number, input: { trackId: string; stateId: string; parameters: string[]; rationale: string; }, actor: DraftActor): Promise<ScenarioDraft>Human identifies missing parameters; this neither supplies values nor resolves the error.packages/types/src/draft-api.ts:436
detachCitation(id: string, expectedRevision: number, path: string, value: string | number | boolean | null, previous: Provenance, rationale: string, confirmed: boolean, actor: DraftActor): Promise<ScenarioDraft>Replace one cited value only with the expected previous provenance, rationale and explicit confirmation.packages/types/src/draft-api.ts:429
duplicateApprovedCorrection(parentDraftId: string, expectedRevision: number, requestId: string, actor: DraftActor): Promise<ScenarioDraft>Copy an exact approved correction. requestId is stable across uncertain retries.packages/types/src/draft-api.ts:334
editExpectedActionCriticality(id: string, expectedRevision: number, actionId: string, critical: boolean, actor: DraftActor, confirmItemAttributionRemoval?: boolean): Promise<ScenarioDraft>Edit one action criticality at the expected revision, explicitly confirming any attribution removal.packages/types/src/draft-api.ts:328
editLocalPortableAge(draftId: string, revision: number, value: number, actor: DraftActor): Promise<ScenarioDraft>Set the explicitly supplied age on the expected local portable draft revision.packages/types/src/draft-api.ts:394
editLocalPortableDuration(draftId: string, revision: number, value: number, actor: DraftActor): Promise<ScenarioDraft>Set the explicitly supplied duration on the expected local portable draft revision.packages/types/src/draft-api.ts:397
editLocalPortableNarrative(draftId: string, revision: number, field: "title" | "summary", value: string, actor: DraftActor): Promise<ScenarioDraft>Edit the selected local title or summary while invalidating affected review bindings.packages/types/src/draft-api.ts:391
findLocalPortableOperation(requestId: string): Promise<ScenarioDraft | null>Find the draft created for this exact local request, or null without creating another draft.packages/types/src/draft-api.ts:379
fullCorrectionReviewFreshness(id: string, expectedRevision: number): Promise<"current" | "stale" | "unavailable">Read-only freshness of the historical assertion; does not authorize approval.packages/types/src/draft-api.ts:462
get(id: string): Promise<ScenarioDraft | null>Read one draft and its current compare-and-swap revision.packages/types/src/draft-api.ts:420
getApprovedCorrectionReview(scenarioId: string, version: number): Promise<ApprovedCorrectionReviewSnapshot>Trusted same-process read of the exact, historical approved review.packages/types/src/draft-api.ts:470
getApprovedPendingCourseReport(draftId: string, revision: number): Promise<{ draft: ScenarioDraft; source: CourseEdgeReviewView["source"]; snapshotSha256: string; }>Internal, source-checked historical report material; not an interchange format.packages/types/src/draft-api.ts:321
getCorrectionReviewMaterial(id: string, expectedRevision: number): Promise<{ draft: ScenarioDraft; sidecar: UnverifiedCorrectionSidecar; copyOrigin?: { rootDraftId: string; rootOperationId: string; envelope: Record<string, unknown>; }; }>Trusted same-process extraction only: sensitive protected historical material. This is not a host/MCP response and does not authenticate its caller.packages/types/src/draft-api.ts:337
getLocalPortable(draftId: string): Promise<ScenarioDraft>Read the identified local portable draft without importing new source material.packages/types/src/draft-api.ts:385
getLocalPortableReview(draftId: string, revision: number): Promise<LocalPortableReviewView>Read the revision-bound comparison material for explicit local portable review.packages/types/src/draft-api.ts:388
getReviewedEmptyCourseTransfer(draftId: string, revision: number): Promise<{ draft: ScenarioDraft; source: EmptyCourseReviewView["source"]; }>Owner-verified zero-claim material for an explicitly untrusted transfer.packages/types/src/draft-api.ts:323
hasProtectedCourseEdge(scenarioId: string, version: number): Promise<boolean>Export protection for course decisions that ordinary scenario files cannot preserve; no lineage is disclosed.packages/types/src/draft-api.ts:342
list(): Promise<ScenarioDraft[]>List authoring drafts, including approved audit records.packages/types/src/draft-api.ts:422
listLocalPortable(cursor?: string): Promise<{ items: { draftId: string; revision: number; title: string; status: Scenario["status"]; }[]; unavailable: number; cursor?: string; }>Read a bounded page of local portable drafts and an unavailable-item count.packages/types/src/draft-api.ts:382
localPortableInheritance(id: string, revision: number): Promise<{ hasParent: boolean; titleUnchanged: boolean; summaryUnchanged: boolean; }>Report parent presence and unchanged title/summary flags for the exact draft revision.packages/types/src/draft-api.ts:376
materializeCorrectionCourse(id: string, expectedRevision: number, expected: CorrectionCourseMaterialization, actor: DraftActor): Promise<ScenarioDraft>Explicit caller-attributed edit using a freshly verified extraction-owner proposal; does not accept claims.packages/types/src/draft-api.ts:468
patch(id: string, expectedRevision: number, operations: DraftPatch[], actor: DraftActor): Promise<ScenarioDraft>Apply an atomic patch; content edits invalidate overlapping review decisions.packages/types/src/draft-api.ts:424
pendingCourseOrigin(id: string): Promise<string>Verify approved pending-copy lineage and return the original owned draft ID.packages/types/src/draft-api.ts:450
previewCourseEdge(id: string, expectedRevision: number, trackId: string, transitionId: string): Promise<CourseEdgeReviewView>Read the revision-bound source course comparison for one track transition.packages/types/src/draft-api.ts:350
previewCueScheduling(id: string, expectedRevision: number, cueId: string): Promise<CueSchedulingView>Source-bound preview and explicit scheduling decision; separate from gap and course review.packages/types/src/draft-api.ts:344
previewEmptyCourseReview(id: string, expectedRevision: number): Promise<EmptyCourseReviewView>Read the source-bound zero-claim course review material without recording a decision.packages/types/src/draft-api.ts:441
previewLocalPortable(workspaceOperationId: string, workspaceRevision: number, choice?: true | "medications" | "observations-and-medications"): Promise<LocalPortableProposal>Prepare a read-only proposal from the exact trusted workspace operation and revision.packages/types/src/draft-api.ts:358
previewLocalPortableChild(parentDraftId: string, parentRevision: number): Promise<LocalPortableChildProposal>Prepare a new child-copy proposal from the exact locally approved parent revision.packages/types/src/draft-api.ts:364
previewPendingCourseMaterialRecovery(id: string, expectedRevision: number): Promise<PendingCourseMaterialRecoveryView>Source-verified, complete comparison; only available for divergent pending material.packages/types/src/draft-api.ts:452
previewProvenanceGapReview(id: string, revision: number, gapIndex: number): Promise<ProvenanceGapReviewView>Read the source-bound view for one unresolved provenance gap at this revision.packages/types/src/draft-api.ts:316
rebindPendingCourseReview(id: string, expectedRevision: number, expected: { view: PendingCourseReview; scenarioSha256: string; }, actor: DraftActor): Promise<ScenarioDraft>Bind unchanged source claims to the edited material; this accepts nothing.packages/types/src/draft-api.ts:448
recordEmptyCourseReview(id: string, expectedRevision: number, viewSha256: string, rationale: string, originalReviewed: true, scenarioCompared: true, actor: DraftActor): Promise<ScenarioDraft>Record explicit original-source/scenario comparison assertions against the displayed view hash.packages/types/src/draft-api.ts:444
recordFullCorrectionReview(id: string, expectedRevision: number, view: FullCorrectionReviewView, actor: DraftActor): Promise<ScenarioDraft>Caller-attributed, source-bound review assertion; no approval or waiver.packages/types/src/draft-api.ts:460
recordPartialCorrectionReview(id: string, expectedRevision: number, view: PartialCorrectionReviewView, actor: DraftActor): Promise<ScenarioDraft>Record only the exact displayed partial source/main-graph view; no approval.packages/types/src/draft-api.ts:458
resolveGap(id: string, expectedRevision: number, gapIndex: number, decision: { resolution: "filled" | "hold_previous" | "accepted_as_is"; parameters?: string[]; }, actor: DraftActor): Promise<ScenarioDraft>Resolve a source gap; grouped holds name each absent parameter explicitly.packages/types/src/draft-api.ts:431
resolveLocalPortableGap(draftId: string, revision: number, gapIndex: number, resolution: "filled" | "accepted_as_is", actor: DraftActor): Promise<ScenarioDraft>Apply the explicit filled or accepted-as-is decision to one local portable gap.packages/types/src/draft-api.ts:403
restorePendingCourseMaterial(id: string, expectedRevision: number, viewSha256: string, actor: DraftActor): Promise<ScenarioDraft>Restore only the reviewed proposed material; no claims or approval are recorded.packages/types/src/draft-api.ts:454
reviewCourseEdge(id: string, expectedRevision: number, trackId: string, transitionId: string, viewSha256: string, claimIds: string[], actor: DraftActor): Promise<ScenarioDraft>Record the selected course claim IDs against the exact displayed transition review hash.packages/types/src/draft-api.ts:353
reviewLocalPortable(draftId: string, revision: number, materialSha256: string, actor: DraftActor, assertions: { complete: true; untrustedHistory: true; originalUnavailable: true; }): Promise<ScenarioDraft>Record local human review of the exact material with explicit untrusted-history/source-absence assertions.packages/types/src/draft-api.ts:409
reviewProvenanceGap(id: string, revision: number, gapIndex: number, viewSha256: string, rationale: string, confirmed: true, actor: DraftActor): Promise<ScenarioDraft>Record an explicitly confirmed human provenance-gap rationale bound to the displayed view hash.packages/types/src/draft-api.ts:319
submit(id: string, expectedRevision: number, actor: DraftActor): Promise<ScenarioDraft>Begin human review; publication remains separately gated.packages/types/src/draft-api.ts:472
submitLocalPortable(draftId: string, revision: number, actor: DraftActor): Promise<ScenarioDraft>Submit the expected local portable draft revision for review without approving it.packages/types/src/draft-api.ts:406
verifyLocalPortablePublication(scenario: Scenario): Promise<Scenario>Verify the stored local publication binding for this exact scenario identity.packages/types/src/draft-api.ts:418

EncryptedSiteTransferService#

Source: packages/types/src/site-transfer-api.ts:9.

OperationSignatureContractSource
exportEncrypted(passphrase: string): Promise<EncryptedSiteEnvelope>A future owner obtains the current credential-stripped SiteService.export projection itself, then encrypts it. The ephemeral passphrase is never persisted, logged or returned. No encryption implementation exists here.packages/types/src/site-transfer-api.ts:13
readEncrypted(envelope: EncryptedSiteEnvelope, passphrase: string): Promise<SiteProfile>Decode and validate a portable profile without applying it. Normal human Site import/expected-revision authorization remains a separate operation; decrypted credentials must not be restored or returned.packages/types/src/site-transfer-api.ts:17

EprChartsService#

Source: packages/types/src/ui-api.ts:47.

OperationSignatureContractSource
find(id: string): EprChartEntry | undefinedFind an active learner-chart declaration and owner by ID, or undefined.packages/types/src/ui-api.ts:53
register(declaration: EprChartDeclaration): UiDisposerRegister a caller-owned learner-chart declaration and return its disposer.packages/types/src/ui-api.ts:50

EprLearnerMutationsService#

Source: packages/types/src/learner-extension-api.ts:32.

OperationSignatureContractSource
register<I extends object>(definition: EprLearnerMutationDeclaration<I>): UiDisposerDeclare one caller-owned, schema-bound future mutation and its disposer. No implementation is registered today; the live learner command union and authorization routes are unchanged.packages/types/src/learner-extension-api.ts:36

EprLearnerRoutesService#

Source: packages/types/src/ui-api.ts:73.

OperationSignatureContractSource
register(declaration: EprLearnerRouteDeclaration): UiDisposerRegister a caller-owned learner read route; the host supplies trusted learner context.packages/types/src/ui-api.ts:75

EprObservationFieldsService#

Source: packages/types/src/ui-api.ts:57.

OperationSignatureContractSource
entries(): EprObservationFieldEntry[]List active contributed observation-field declarations and their owners.packages/types/src/ui-api.ts:66
find(id: string): EprObservationFieldEntry | undefinedFind an active observation-field declaration by ID, or undefined.packages/types/src/ui-api.ts:63
register(declaration: EprObservationFieldDeclaration): UiDisposerRegister a caller-owned observation field and return its disposer.packages/types/src/ui-api.ts:60

ExportersService#

Source: packages/types/src/export-api.ts:77.

OperationSignatureContractSource
download(id: string): Promise<ScenarioExportDownload | null>Read stored artifact bytes and metadata, or null when the artifact is unavailable.packages/types/src/export-api.ts:92
export(input: ScenarioExportRequest): Promise<ScenarioExportArtifact>Create an artifact from the explicitly selected scenario/draft source and document kind.packages/types/src/export-api.ts:86
formats(): Promise<{ format: ExportFormat; documentKinds: ExportDocumentKind[]; portableCorrection?: true; portableCourse?: true; portableEmptyCourse?: true; }[]>List active renderer format/kind capabilities without generating an artifact.packages/types/src/export-api.ts:83
get(id: string): Promise<ScenarioExportArtifact | null>Read saved artifact metadata without its binary bytes, or null.packages/types/src/export-api.ts:89
register(renderer: ExportRenderer): () => voidRegister a renderer under the contributor lifecycle and return its disposer.packages/types/src/export-api.ts:80

ExtractionService#

Source: packages/types/src/extraction-api.ts:174.

OperationSignatureContractSource
adviseSourceRole(workflowId: string, itemId: string, previewToken: string): Promise<import("./extraction-workflow.js").SourceRoleAdvice>Request advice only for the source item and exact previously issued preview token.packages/types/src/extraction-api.ts:179
cancelWorkflow(workflowId: string): Promise<ExtractionWorkflowSnapshot>Cancel the identified owned workflow without creating or approving a draft.packages/types/src/extraction-workflow.ts:128
createCourseWorkflowDraft(workflowId: string, expected: { revision: number; candidateSha256: string; view: PendingCourseReview; acceptedItemIds: string[]; }, actor: DraftActor): Promise<ScenarioDraft>A facilitator explicitly reviews each displayed course claim before an unapproved draft is created.packages/types/src/extraction-workflow.ts:139
createDraft(documentId: string, runId: string): Promise<ScenarioDraft>Saves a fresh AI-attributed draft, never approves or edits the source.packages/types/src/extraction-api.ts:195
createWorkflowDraft(workflowId: string, expected: { revision: number; candidateSha256: string; }): Promise<ScenarioDraft>Create a fresh unapproved draft only from the exact saved candidate revision and digest.packages/types/src/extraction-workflow.ts:137
dialogue(draftId: string, nodeIds: string[], options: AiRunOptions): Promise<AiRunHandle>Request dialogue suggestions for the explicitly selected nodes; source and approval remain unchanged.packages/types/src/extraction-api.ts:191
getApprovedCorrectionCopyProposal(draftId: string, revision: number): Promise<{ version: 1; draftId: string; draftRevision: number; snapshotSha256: string; envelope: Record<string, unknown>; }>Internal owner-verified proposal only; does not create or approve a draft.packages/types/src/extraction-workflow.ts:153
getCorrectionCourseMaterialization(draftId: string, revision: number): Promise<CorrectionCourseMaterialization>Same-process source-derived proposal; no decision, approval or write.packages/types/src/extraction-workflow.ts:155
getCorrectionReviewChecklist(draftId: string, revision: number): Promise<CorrectionReviewChecklist>Read-only, source-bound and revision-bound; no review decision or approval.packages/types/src/extraction-workflow.ts:159
getCurrentCorrectionReview(draftId: string, revision: number): Promise<CurrentCorrectionReview>Source-bound diagnostic snapshot; no source, finding or approval decision.packages/types/src/extraction-workflow.ts:151
getRetainedRejectedCourseOutput(workflowId: string, expected: { revision: number; }): Promise<string | null>Same-process trusted-plugin read, not user authentication or RBAC. Returns only a specifically opted-in, source-bound failed course response.packages/types/src/extraction-workflow.ts:168
getVerifiedCorrectionSource(draftId: string, revision: number): Promise<VerifiedCorrectionSource>Read-only verified source projection; unavailable on uncertain or changed ownership.packages/types/src/extraction-workflow.ts:149
getWorkflow(workflowId: string): Promise<ExtractionWorkflowSnapshot>Read the saved workflow snapshot by identity.packages/types/src/extraction-workflow.ts:122
listWorkflows(documentId: string): Promise<ExtractionWorkflowSnapshot[]>List workflows bound to the identified imported document.packages/types/src/extraction-workflow.ts:125
prepare(documentId: string, options: ExtractionOptions): Promise<ExtractionPreparedRun>Reserves a new source/thread/input binding before standard browser POST. Preparation neither runs AI nor creates/approves a draft.packages/types/src/extraction-api.ts:182
previewPartialCorrectionReview(draftId: string, revision: number, blockIds: string[]): Promise<PartialCorrectionReviewView>Bounded selected-source/main-graph view; all other material remains unreviewed.packages/types/src/extraction-workflow.ts:157
previewPendingCourseWarning(draftId: string, revision: number, issueIndex: number): Promise<PendingCourseWarningView>Read one current source-bound pending-course warning by issue index.packages/types/src/extraction-workflow.ts:134
previewSourceRole(workflowId: string, itemId: string): Promise<import("./extraction-workflow.js").SourceRolePreview>Explicitly requested, read-only Jev judgments for one source-bound item.packages/types/src/extraction-api.ts:176
recheckRejectedCourse(workflowId: string, expected: { revision: number; originalJson: string; correctedJson: string; }, actor: DraftActor): Promise<RejectedCourseCheck>The same-process caller supplies an unverified actor label. No identity/RBAC assertion, provider call, draft creation, approval or content retention.packages/types/src/extraction-workflow.ts:147
reconcileUnverifiedCorrection(draftId: string, revision: number): Promise<void>Reconcile an existing uncertain draft using positive owner/source proof; never creates a draft.packages/types/src/extraction-workflow.ts:161
review(documentId: string, runId: string): Promise<ExtractionReview>Completed extract runs only; rechecks the stored source and graph.packages/types/src/extraction-api.ts:193
reviewCorrectedCourse(workflowId: string, expected: { revision: number; originalJson: string; correctedJson: string; }): Promise<CorrectedCourseReview>Same-process read-only preview; no decision, draft or approval.packages/types/src/extraction-workflow.ts:165
reviewWorkflow(workflowId: string): Promise<ExtractionWorkflowReview>Read the completed workflow review material without recording human acceptance.packages/types/src/extraction-workflow.ts:131
saveEmptyCourseDraft(workflowId: string, expected: { revision: number; candidateSha256: string; }): Promise<ScenarioDraft>Saves an owned zero-claim course candidate for inspection only; approval stays blocked.packages/types/src/extraction-workflow.ts:144
savePendingCourseDraft(workflowId: string, expected: { revision: number; candidateSha256: string; }): Promise<ScenarioDraft>Save an owned completed candidate with its course and quality review still pending. This records no human decision and does not approve the draft.packages/types/src/extraction-workflow.ts:142
saveUnverifiedCorrectedCourse(workflowId: string, expected: { revision: number; originalJson: string; correctedJson: string; }): Promise<ScenarioDraft>Internal trusted-host action; no review, approval or provider call.packages/types/src/extraction-workflow.ts:163
start(documentId: string, options: ExtractionOptions): Promise<AiRunHandle>Admit an extraction run for the explicitly selected imported document and run options.packages/types/src/extraction-api.ts:185
startWorkflow(documentId: string, options: ExtractionWorkflowOptions): Promise<ExtractionWorkflowSnapshot>Start the document-bound staged extraction workflow using explicit run options.packages/types/src/extraction-workflow.ts:119
suggest(draftId: string, options: AiRunOptions): Promise<AiRunHandle>Request suggestions for an existing draft; suggested content requires later review.packages/types/src/extraction-api.ts:188

ExtractionWorkflowService#

Source: packages/types/src/extraction-workflow.ts:116.

OperationSignatureContractSource
cancelWorkflow(workflowId: string): Promise<ExtractionWorkflowSnapshot>Cancel the identified owned workflow without creating or approving a draft.packages/types/src/extraction-workflow.ts:128
createCourseWorkflowDraft(workflowId: string, expected: { revision: number; candidateSha256: string; view: PendingCourseReview; acceptedItemIds: string[]; }, actor: DraftActor): Promise<ScenarioDraft>A facilitator explicitly reviews each displayed course claim before an unapproved draft is created.packages/types/src/extraction-workflow.ts:139
createWorkflowDraft(workflowId: string, expected: { revision: number; candidateSha256: string; }): Promise<ScenarioDraft>Create a fresh unapproved draft only from the exact saved candidate revision and digest.packages/types/src/extraction-workflow.ts:137
getApprovedCorrectionCopyProposal(draftId: string, revision: number): Promise<{ version: 1; draftId: string; draftRevision: number; snapshotSha256: string; envelope: Record<string, unknown>; }>Internal owner-verified proposal only; does not create or approve a draft.packages/types/src/extraction-workflow.ts:153
getCorrectionCourseMaterialization(draftId: string, revision: number): Promise<CorrectionCourseMaterialization>Same-process source-derived proposal; no decision, approval or write.packages/types/src/extraction-workflow.ts:155
getCorrectionReviewChecklist(draftId: string, revision: number): Promise<CorrectionReviewChecklist>Read-only, source-bound and revision-bound; no review decision or approval.packages/types/src/extraction-workflow.ts:159
getCurrentCorrectionReview(draftId: string, revision: number): Promise<CurrentCorrectionReview>Source-bound diagnostic snapshot; no source, finding or approval decision.packages/types/src/extraction-workflow.ts:151
getRetainedRejectedCourseOutput(workflowId: string, expected: { revision: number; }): Promise<string | null>Same-process trusted-plugin read, not user authentication or RBAC. Returns only a specifically opted-in, source-bound failed course response.packages/types/src/extraction-workflow.ts:168
getVerifiedCorrectionSource(draftId: string, revision: number): Promise<VerifiedCorrectionSource>Read-only verified source projection; unavailable on uncertain or changed ownership.packages/types/src/extraction-workflow.ts:149
getWorkflow(workflowId: string): Promise<ExtractionWorkflowSnapshot>Read the saved workflow snapshot by identity.packages/types/src/extraction-workflow.ts:122
listWorkflows(documentId: string): Promise<ExtractionWorkflowSnapshot[]>List workflows bound to the identified imported document.packages/types/src/extraction-workflow.ts:125
previewPartialCorrectionReview(draftId: string, revision: number, blockIds: string[]): Promise<PartialCorrectionReviewView>Bounded selected-source/main-graph view; all other material remains unreviewed.packages/types/src/extraction-workflow.ts:157
previewPendingCourseWarning(draftId: string, revision: number, issueIndex: number): Promise<PendingCourseWarningView>Read one current source-bound pending-course warning by issue index.packages/types/src/extraction-workflow.ts:134
recheckRejectedCourse(workflowId: string, expected: { revision: number; originalJson: string; correctedJson: string; }, actor: DraftActor): Promise<RejectedCourseCheck>The same-process caller supplies an unverified actor label. No identity/RBAC assertion, provider call, draft creation, approval or content retention.packages/types/src/extraction-workflow.ts:147
reconcileUnverifiedCorrection(draftId: string, revision: number): Promise<void>Reconcile an existing uncertain draft using positive owner/source proof; never creates a draft.packages/types/src/extraction-workflow.ts:161
reviewCorrectedCourse(workflowId: string, expected: { revision: number; originalJson: string; correctedJson: string; }): Promise<CorrectedCourseReview>Same-process read-only preview; no decision, draft or approval.packages/types/src/extraction-workflow.ts:165
reviewWorkflow(workflowId: string): Promise<ExtractionWorkflowReview>Read the completed workflow review material without recording human acceptance.packages/types/src/extraction-workflow.ts:131
saveEmptyCourseDraft(workflowId: string, expected: { revision: number; candidateSha256: string; }): Promise<ScenarioDraft>Saves an owned zero-claim course candidate for inspection only; approval stays blocked.packages/types/src/extraction-workflow.ts:144
savePendingCourseDraft(workflowId: string, expected: { revision: number; candidateSha256: string; }): Promise<ScenarioDraft>Save an owned completed candidate with its course and quality review still pending. This records no human decision and does not approve the draft.packages/types/src/extraction-workflow.ts:142
saveUnverifiedCorrectedCourse(workflowId: string, expected: { revision: number; originalJson: string; correctedJson: string; }): Promise<ScenarioDraft>Internal trusted-host action; no review, approval or provider call.packages/types/src/extraction-workflow.ts:163
startWorkflow(documentId: string, options: ExtractionWorkflowOptions): Promise<ExtractionWorkflowSnapshot>Start the document-bound staged extraction workflow using explicit run options.packages/types/src/extraction-workflow.ts:119

HostPackagesService#

Source: packages/types/src/store-host-api.ts:56.

OperationSignatureContractSource
mutate<T>(run: (mutation: HostPackageMutation) => Promise<T>): Promise<T>Hold shared start/mutation admission, reject existing running/paused sessions, then enter the host mutation queue. Callback methods are valid only until it settles; re-entrancy fails rather than waiting on itself.packages/types/src/store-host-api.ts:67
selected(runtimeId: string): Promise<HostSelectedPackage | null>Read the current generic selection pointer, including disabled/pending.packages/types/src/store-host-api.ts:63
snapshot(requiredServices?: string[]): Promise<HostPackageSnapshot>Snapshot compatibility facts; only requested currently available server service names are returned, not provider objects or credential/config data.packages/types/src/store-host-api.ts:61

HttpApi#

Dynamic HTTP route port; infrastructure access is separate from plugin routes.

Source: packages/types/src/host.ts:37.

OperationSignatureContractSource
adminRoute(def: HttpRoute): () => voidOwned administration route under /api/admin/<actual plugin id>. The host ingress scope remains responsible for operator authority and same-origin.packages/types/src/host.ts:45
aiStreamRoute(def: HttpStreamRoute): () => voidAR-AI-4: only ai-http may register the two exact standard AG-UI paths.packages/types/src/host.ts:53
bindingRoute(def: HttpRoute): () => voidOwned protocol endpoint, confined to /ingest/ or /api/interop/v1/.packages/types/src/host.ts:49
diagnostics(): Promise<{ routes: number; listening: boolean; }>Inspect route counts for cleanup tests.packages/types/src/host.ts:58
endpoint(): Promise<{ host: string; port: number; url: string; }>Read the actual listener host, assigned port and URL, including an ephemeral bound port.packages/types/src/host.ts:56
eventStream(def: HttpStreamRoute): () => voidOwned SSE producer confined to the calling plugin's ordinary namespace.packages/types/src/host.ts:51
requestScope(scope: (request: HttpRequest, next: () => Promise<unknown>) => Promise<unknown>): () => voidActual runtime root installs one reversible async request scope. It wraps handler and stream startup; feature plugins cannot establish authority.packages/types/src/host.ts:40
route(def: HttpRoute): () => voidRegister a reversible route in the calling plugin's namespace.packages/types/src/host.ts:42
systemRoute(def: HttpRoute): () => voidRegister a server/shell infrastructure route.packages/types/src/host.ts:47

ImportLayoutAiService#

Automatic source recovery still leaves all scenario approval gates intact.

Source: packages/types/src/import-layout-ai-api.ts:18.

OperationSignatureContractSource
cancelBoundRun(documentId: string, handle: AiRunHandle): Promise<void>Cancel the matching source-bound run even when its provider selection changed; this does not expose or authorize its output.packages/types/src/import-layout-ai-api.ts:28
complete(documentId: string, runId: string): Promise<ImportRecord>Verify the completed bound provider run and create/replay its derived import.packages/types/src/import-layout-ai-api.ts:30
getBoundRun(documentId: string, handle: AiRunHandle): Promise<AiRunSnapshot>Read the run only when the durable admission binds it to this original PDF. This does not assert that the current blob or parser is available.packages/types/src/import-layout-ai-api.ts:25
prepare(documentId: string, options: ImportLayoutAiOptions): Promise<PreparedImportLayoutAiRun>Persist an immutable source/run binding before admitting a new AI run.packages/types/src/import-layout-ai-api.ts:20
start(documentId: string, options: ImportLayoutAiOptions): Promise<AiRunHandle>Prepare and admit exactly one registered task run; the registry owns retry.packages/types/src/import-layout-ai-api.ts:22

ImportPresetAdapter#

FR-IMP-6 (N): presets contribute through a future adapter, with no preset UI.

Source: packages/types/src/import-api.ts:252.

OperationSignatureContractSource
parse(input: { dataBase64: string; filename: string; }): Promise<ImportParseResult>Parse the supplied preset bytes into literal import blocks; this does not approve a scenario.packages/types/src/import-api.ts:257

ImportersService#

Source: packages/types/src/import-api.ts:147.

OperationSignatureContractSource
formats(): Promise<ImportFormat[]>List formats supported by currently active parser owners.packages/types/src/import-api.ts:153
get(id: string): Promise<ImportRecord | null>Read one saved import record, or null when absent.packages/types/src/import-api.ts:159
import(input: ImportInput): Promise<ImportRecord>Parse and save the supplied document through its active format owner.packages/types/src/import-api.ts:156
inspectLayout(id: string): Promise<ImportLayoutSource>Read the saved native PDF text/geometry and source digest for layout review.packages/types/src/import-api.ts:168
list(): Promise<ImportRecord[]>List saved import records without returning original binary bytes.packages/types/src/import-api.ts:162
original(id: string): Promise<ImportDownload | null>Read the saved original document bytes/metadata, or null when unavailable.packages/types/src/import-api.ts:165
recoverLayout(id: string, recipe: ImportLayoutRecipe, provenance: ImportLayoutProvenance): Promise<ImportRecord>Save a derived import from the explicitly reviewed source-bound layout recipe and provenance.packages/types/src/import-api.ts:173
register(parser: ImportParser): () => voidRegister a parser as a caller-owned format contribution; returns its disposer.packages/types/src/import-api.ts:150
validateLayout(id: string, recipe: ImportLayoutRecipe): Promise<void>Runs the same parser admission without creating a derived import.packages/types/src/import-api.ts:170

InterfaceDiscovery#

N/L extensions are declarations only; no discovery or clinical bridge UI.

Source: packages/types/src/interface-api.ts:203.

OperationSignatureContractSource
discover(options: { transport?: string; timeoutMs?: number; }): Promise<DeviceDescriptor[]>Return descriptors from the requested bounded discovery attempt; this declaration grants no automatic device connection.packages/types/src/interface-api.ts:206

InterfaceService#

Source: packages/types/src/interface-api.ts:110.

OperationSignatureContractSource
bind(id: string, sessionId: string): Promise<void>Bind this configured instance to the identified session under its sharing rules.packages/types/src/interface-api.ts:158
codec(definition: RuntimeCodec): () => voidRegister a caller-owned codec and return its lifecycle disposer.packages/types/src/interface-api.ts:116
codecs(): Promise<string[]>List currently active codec IDs.packages/types/src/interface-api.ts:125
configure(instance: InterfaceInstance, options?: InstanceOptions): Promise<InterfaceSnapshot>Validate and configure one instance and its explicit session/binding options.packages/types/src/interface-api.ts:131
deliver(id: string, message: OutputMessage): Promise<DeliveryReport>Deliver a canonical output through the configured instance and return its actual delivery report.packages/types/src/interface-api.ts:170
endpoint(id: string): Promise<{ host: string; port: number; url?: string; } | null>Read credential-free actual endpoint diagnostics, or null when unavailable.packages/types/src/interface-api.ts:140
get(id: string): Promise<InterfaceSnapshot | null>Read one configured instance snapshot, or null when absent.packages/types/src/interface-api.ts:137
ingest(id: string, frame: AddressedFrame): Promise<InterfaceIngressResult>Admit one addressed frame through the configured codec and ordered session boundary.packages/types/src/interface-api.ts:167
list(): Promise<InterfaceSnapshot[]>List configured instance snapshots and runtime status.packages/types/src/interface-api.ts:134
recentFrames(id: string): Promise<InterfaceFrameDiagnostic[]>Read bounded redacted frame diagnostics; these are not historical replay evidence.packages/types/src/interface-api.ts:143
remove(id: string): Promise<void>Stop and remove the configured instance without deleting unrelated contributors.packages/types/src/interface-api.ts:155
restart(id: string): Promise<InterfaceSnapshot>Restart the configured instance through its owned transport lifecycle.packages/types/src/interface-api.ts:152
sendFrame(id: string, frame: OutgoingFrame): Promise<{ acked: boolean | "n/a"; }>Send an explicit outgoing frame through the configured transport and report transport acknowledgement.packages/types/src/interface-api.ts:173
start(id: string): Promise<InterfaceSnapshot>Start an enabled configured instance and return the resulting status snapshot.packages/types/src/interface-api.ts:146
stop(id: string): Promise<InterfaceSnapshot>Stop this instance and retire its active transport work.packages/types/src/interface-api.ts:149
test(id: string): Promise<{ ok: boolean; detail: string; }>Run this configured instance test; connectivity success alone does not prove clinical mapping correctness.packages/types/src/interface-api.ts:164
transport(definition: TransportDef): () => voidRegister a caller-owned transport implementation and return its disposer.packages/types/src/interface-api.ts:113
transports(): Promise<Omit<TransportDef, "open">[]>List transport metadata without exposing the open implementation callback.packages/types/src/interface-api.ts:122
type(definition: InterfaceType): () => voidRegister a caller-owned interface type and return its disposer.packages/types/src/interface-api.ts:119
types(): Promise<Omit<InterfaceType, "test">[]>List active interface type metadata without executable test callbacks.packages/types/src/interface-api.ts:128
unbind(id: string, sessionId?: string): Promise<void>Remove the named session binding, or every binding when sessionId is omitted.packages/types/src/interface-api.ts:161

LearnerEprPresentationApi#

Source: packages/types/src/ui-api.ts:102.

OperationSignatureContractSource
i18n.language(): "en" | "fr"Read the current supported learner interface language.packages/types/src/ui-api.ts:105
i18n.translate(text: LearnerEprText): stringTranslate supplied learner text using the current presentation language.packages/types/src/ui-api.ts:107
theme.tokens(): LearnerEprThemeTokensRead the current detached learner presentation theme tokens.packages/types/src/ui-api.ts:110
toast(text: LearnerEprText, kind?: "info" | "success" | "error"): voidShow a learner presentation message with the explicitly selected notification kind.packages/types/src/ui-api.ts:113

LearnerEprProjectionApi#

Each read is a detached snapshot; callers unsubscribe on unmount.

Source: packages/types/src/ui-api.ts:90.

OperationSignatureContractSource
projection(): LearnerEprProjectionRead a detached role-bound learner projection without facilitator-private data.packages/types/src/ui-api.ts:93
subscribeProjection(listener: () => void): UiDisposerSubscribe to learner projection changes and return the owned unsubscribe function.packages/types/src/ui-api.ts:96

LibraryService#

Source: packages/types/src/library-api.ts:46.

OperationSignatureContractSource
facets(): Promise<LibraryFacets>Read available library filter facets from current saved items.packages/types/src/library-api.ts:51
list(query?: LibraryQuery): Promise<LibraryItem[]>Latest saved scenarios plus unapproved authoring drafts; no source writes.packages/types/src/library-api.ts:48
makeDraft(seedId: LibrarySeedSummary["id"], actor: DraftActor): Promise<ScenarioDraft>Explicit trusted local human action. Fresh draft/version, never publication.packages/types/src/library-api.ts:62
metadata(scenarioId: string, version: number): Promise<LibraryMetadata>Read metadata for the exact scenario identity and version.packages/types/src/library-api.ts:54
seeds(): Promise<LibrarySeedSummary[]>List available example seed identities and their qualification metadata.packages/types/src/library-api.ts:60
setMetadata(scenarioId: string, version: number, value: { specialties: string[]; tags: string[]; }, expectedRevision: number, actor: DraftActor): Promise<LibraryMetadata>Optimistically update only the supplied tags/specialties with explicit actor attribution.packages/types/src/library-api.ts:57

LibraryVersionsService#

Source: packages/types/src/library-api.ts:76.

OperationSignatureContractSource
compare(before: LibraryVersionRef, after: LibraryVersionRef): Promise<LibraryComparison>Read differences between the two exact version identities without modifying either.packages/types/src/library-api.ts:82
duplicate(source: LibraryVersionRef, actor: DraftActor & { kind: "human"; }): Promise<ScenarioDraft>Human explicit action creates a new unapproved identity.packages/types/src/library-api.ts:84
versions(scenarioId: string): Promise<LibraryVersionRef[]>List saved version references for the scenario identity.packages/types/src/library-api.ts:79

LocalCertificateService#

Source: packages/types/src/certificate-api.ts:20.

OperationSignatureContractSource
binding(): Promise<LocalCertificateBinding>Actual root context only. Revalidate files/keys and return the leaf binding; no automatic live-listener restart or system trust modification occurs.packages/types/src/certificate-api.ts:30
ensure(input: EnsureLocalCertificate): Promise<LocalCertificateSnapshot>Actual root context only. Create/reuse this installation's CA and issue a leaf; an unhealthy existing CA fails closed and is never silently rotated.packages/types/src/certificate-api.ts:25
inspect(): Promise<LocalCertificateSnapshot>Read bounded public validity/protection metadata without generating files.packages/types/src/certificate-api.ts:22
publicCa(format: PublicCaFormat): Promise<PublicCaDownload>Read only the current public root certificate or unsigned trust profile.packages/types/src/certificate-api.ts:27

LocaleService#

Source: packages/types/src/locale-api.ts:10.

OperationSignatureContractSource
change(language: string): Promise<void>Change the shared shell locale to the requested supported language.packages/types/src/locale-api.ts:20
register(namespace: string, resources: LocaleResources): () => voidRegister locally bundled catalogs; disposer removes only this contribution.packages/types/src/locale-api.ts:17
snapshot(): LocaleSnapshotRead the current language, direction, Intl locale and time zone.packages/types/src/locale-api.ts:15
subscribe(listener: () => void): () => voidSubscribe to locale changes and return an unsubscribe function.packages/types/src/locale-api.ts:23
translate(namespace: string, key: string, values?: Record<string, string | number>): stringResolve a namespaced translation with explicitly supplied interpolation values.packages/types/src/locale-api.ts:26

MaintenanceAdaptersService#

Source: packages/types/src/maintenance-api.ts:21.

OperationSignatureContractSource
open(endpoint: MaintenanceEndpoint): Promise<MaintenanceAdapterLease>Actual root identity only. Each call owns a separate adapter runtime.packages/types/src/maintenance-api.ts:23
open().adapter.close(): Promise<void>Flush persisted work and release provider resources.packages/types/src/storage.ts:91
open().adapter.docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
open().adapter.docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
open().adapter.docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
open().adapter.docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
open().adapter.events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
open().adapter.events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
open().adapter.events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
open().adapter.exportAll(): AsyncIterable<ExportRecord>Export every event, document revision and key without interpreting plugin data.packages/types/src/storage.ts:100
open().adapter.health(): Promise<{ status: "ready" | "unavailable"; checkedAt: string; }>M8 AR-DIST-2: bounded read-only provider health, without returning rows, connection credentials, SQL or raw driver errors. Optional for older adapters.packages/types/src/storage.ts:96
open().adapter.importAll(records: AsyncIterable<ExportRecord>, options?: { requireEmpty?: boolean; }): Promise<void>Atomically restore records, preserving exact revisions and unknown data. requireEmpty checks all exported-data tables inside the same transaction, preventing a migration from overwriting a concurrent writer.packages/types/src/storage.ts:104
open().adapter.kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
open().adapter.kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
open().adapter.kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
open().adapter.migrate(): Promise<void>Apply idempotent provider migrations before use.packages/types/src/storage.ts:93
open().adapter.ns(pluginId: string): NamespacedStorageBind plugin-owned data; the result cannot select another plugin namespace.packages/types/src/storage.ts:98
open().adapter.ns().docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
open().adapter.ns().docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
open().adapter.ns().docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
open().adapter.ns().docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
open().adapter.ns().events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
open().adapter.ns().events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
open().adapter.ns().events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
open().adapter.ns().kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
open().adapter.ns().kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
open().adapter.ns().kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
open().adapter.ns().tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79
open().adapter.open(config?: unknown): Promise<void>Open the provider. Default PGlite config takes an optional dataDir.packages/types/src/storage.ts:89
open().adapter.tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79
open().close(): Promise<void>Close this isolated adapter runtime and release its owned resources.packages/types/src/maintenance-api.ts:19
open().importEmpty(records: AsyncIterable<ExportRecord>): Promise<void>Atomic emptiness check and restore, enforced inside the storage adapter.packages/types/src/maintenance-api.ts:14
open().portableSite(): Promise<SiteProfile>Actual site provider export; uses its existing credential redaction.packages/types/src/maintenance-api.ts:16

MaintenanceService#

Source: packages/types/src/maintenance-api.ts:83.

OperationSignatureContractSource
backup(options: MaintenanceBackupOptions): Promise<MaintenanceBackupReceipt>Back up the stopped installation records/media into a new bounded integrity archive; root authority is required.packages/types/src/maintenance-api.ts:88
migrate(options: MaintenanceMigrationOptions): Promise<MaintenanceMigrationReceipt>Trusted local host/root calls only; never exposed as a general HTTP grant.packages/types/src/maintenance-api.ts:85
restore(options: MaintenanceRestoreOptions): Promise<MaintenanceRestoreReceipt>Validate an archive into a private stage and publish only to an absent destination; root authority is required.packages/types/src/maintenance-api.ts:91

MappingTesterService#

Source: packages/types/src/interface-api.ts:105.

OperationSignatureContractSource
test(input: { mapping: string; sample: string; instance: InterfaceInstance; receivedAt?: string; }): Promise<{ mappingId: string; inputs: CanonicalInput[]; }>Decode one bounded authoring sample with the supplied mapping without opening an interface or dispatching a session command.packages/types/src/interface-api.ts:108

McpService#

Source: packages/types/src/mcp-api.ts:28.

OperationSignatureContractSource
prompt<I extends McpStructuredContent>(definition: McpPromptDefinition<I>): UiDisposerRegister a caller-owned future prompt with its schema and version.packages/types/src/mcp-api.ts:35
resource(definition: McpResourceDefinition): UiDisposerRegister a caller-owned future resource; not a filesystem root grant.packages/types/src/mcp-api.ts:33
tool<I extends McpStructuredContent, O extends McpStructuredContent>(definition: McpToolDefinition<I, O>): UiDisposerRegister a caller-owned future tool and dispose it with that owner. No approval, run-session or delete capability is introduced.packages/types/src/mcp-api.ts:31

MockDescriptorService#

AR-IF-11: instantiated mock metadata, without changing targets or sessions.

Source: packages/types/src/interface-api.ts:93.

OperationSignatureContractSource
describe(instance: InterfaceInstance): Promise<DeviceDescriptor[]>Read simulated mock device descriptors for this instance without changing session targets.packages/types/src/interface-api.ts:95

NamespacedStorage#

Source: packages/types/src/storage.ts:77.

OperationSignatureContractSource
docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79

NetworkPolicyService#

Source: packages/types/src/network-api.ts:29.

OperationSignatureContractSource
begin(request: NetworkRequest): Promise<NetworkLease>Resolve once, validate all answers, and reserve one caller-owned literal destination.packages/types/src/network-api.ts:31
beginManaged(input: { operation: "plugin-install" | "plugin-search"; }): Promise<NetworkManagedOperation>Actual host only: conservatively account opaque package-manager activity before spawning npm/Git. This does not claim pinned dependency endpoints. Finish only after owned children and cleanup have completed.packages/types/src/network-api.ts:39
beginManaged().finish(): Promise<void>Acknowledge completed native work and cleanup, releasing its activity.packages/types/src/network-api.ts:27
beginStorage(request: NetworkRequest, signal?: AbortSignal): Promise<NetworkLease>Required-storage admission reads only the installation-local authority, allowing LAN persistence during a coordinated Site transition. Only the actual root or selected storage owner may use it. No destination exemption.packages/types/src/network-api.ts:35
check(id: string): Promise<NetworkLease>Recheck a caller-owned admission against the current defined site policy.packages/types/src/network-api.ts:41
finish(id: string): Promise<void>Idempotently finish the caller's operation; another caller cannot finish it.packages/types/src/network-api.ts:43
snapshot(): Promise<NetworkSnapshot>Read bounded credential-free activity metadata for the host indicator.packages/types/src/network-api.ts:45

NetworkPolicyStateService#

Source: packages/types/src/network-state-api.ts:19.

OperationSignatureContractSource
begin(input: { operationId: string; localOnly: boolean; expectedSiteRevision: number; sourceStoreId?: string; }): Promise<NetworkPolicyTransition>Stage an owner-authorized setting change before its Site transaction. Actual root or the configured canonical Site context only.packages/types/src/network-state-api.ts:24
commit(ticket: NetworkPolicyTransition, receipt: { operationId: string; localOnly: boolean; siteRevision: number; }): Promise<void>Activate only after the canonical Site owner verifies its own durable operation receipt written atomically with the matching profile revision.packages/types/src/network-state-api.ts:27
configureHost(input: { operationId: string; localOnly: boolean; }): Promise<void>Explicit host-side bootstrap before a remote database can be opened. Actual root only; never derived from an unauthenticated database mirror.packages/types/src/network-state-api.ts:35
externalOperation(): { readonly signal: AbortSignal; release(): void; }Hold a conservative opaque npm/Git operation before first child spawn. Only the actual root or canonical network owner. Release acknowledges completed native cleanup; an unresolved operation blocks strict changes.packages/types/src/network-state-api.ts:42
externalOperation().release(): voidAcknowledge native operation closure; abort alone never releases it.packages/types/src/network-state-api.ts:45
pending(): NetworkPolicyTransition | nullRead the exact pending ticket for canonical owner reconciliation on boot.packages/types/src/network-state-api.ts:32
rollback(ticket: NetworkPolicyTransition): Promise<void>Abort only after authoritative storage confirms the Site mutation did not commit. Unknown/lost acknowledgements must remain restrictive.packages/types/src/network-state-api.ts:30
snapshot(): NetworkPolicyStateSnapshotRead the current detached in-memory authority without storage or DNS I/O.packages/types/src/network-state-api.ts:21
storage(): NetworkStorageFootprintRegister a required pool before first destination resolution. Actual root or a configured storage provider only; the returned capability is private.packages/types/src/network-state-api.ts:38
storage().release(): voidAcknowledge physical pool/socket closure; cancellation alone is not closure.packages/types/src/network-state-api.ts:17
storage().update(outsideLan: boolean | null): voidUpdate the aggregate required destination footprint before connecting.packages/types/src/network-state-api.ts:15

OperatorControl#

Server ingress guard. Runtime providers are asynchronous; boolean remains accepted for existing isolated test/development control providers.

Source: packages/types/src/auth-api.ts:22.

OperationSignatureContractSource
authorized(headers: Record<string, string | string[] | undefined>, permission?: AuthPermission): boolean | Promise<boolean>Check the actual ingress credentials for the requested permission; a supplied identity DTO is not authority.packages/types/src/auth-api.ts:25

OperatorInvocationService#

Read-only identity of the already authorized host request. The host alone establishes this async scope; caller-provided principal DTOs cannot set it.

Source: packages/types/src/auth-api.ts:29.

OperationSignatureContractSource
current(): Promise<OperatorInvocationAuthority | null>Read the host-established async invocation authority, or null outside an authorized request scope.packages/types/src/auth-api.ts:32

PairingService#

Source: packages/types/src/pairing-api.ts:21.

OperationSignatureContractSource
claim(code: string): Promise<PairingCredential>Exchange a valid one-time pairing code for the claiming browser credential.packages/types/src/pairing-api.ts:27
deliver(instanceId: string, message: OutputMessage): Promise<DeliveryReport>Send an output to the currently paired instance and return its acknowledgement/delivery report.packages/types/src/pairing-api.ts:33
offer(instanceId: string): Promise<PairingOffer>Create a time-bounded pairing offer for the chosen output instance.packages/types/src/pairing-api.ts:24
resume(token: string): Promise<PairingCredential>Resume the exact valid paired-browser credential without creating a new audience.packages/types/src/pairing-api.ts:30
revoke(instanceId: string): Promise<void>Revoke the paired instance credential and retire its connected client.packages/types/src/pairing-api.ts:39
status(instanceId: string): Promise<PairingStatus>Read credential-free paired/connected status for the instance.packages/types/src/pairing-api.ts:36

PairingViews#

Source: packages/types/src/pairing-api.ts:59.

OperationSignatureContractSource
register(typeId: PairedOutputType, mount: (element: HTMLElement, config: PairingViewConfig) => PairingView | Promise<PairingView>): () => voidRegister an owned paired-browser renderer for the declared output type and return its disposer.packages/types/src/pairing-api.ts:62

ParamsService#

Source: packages/types/src/params-api.ts:48.

OperationSignatureContractSource
convert(id: string, value: number, fromUnit: string, toUnit: string): Promise<number>Finite affine conversion, without rounding, clamping or modifying registry data.packages/types/src/params-api.ts:62
get(id: string): Promise<ParameterDefinition | null>Read one active parameter definition, or null when absent.packages/types/src/params-api.ts:57
list(): Promise<ParameterDefinition[]>Read detached active parameter definitions and their configured unit contracts.packages/types/src/params-api.ts:60
normalize(id: string, value: CanonicalObservation["value"], unit?: string): Promise<NormalizedParameter>Missing unit uses the default. Explicit unknown units are errors; values are never coerced.packages/types/src/params-api.ts:64
readGeneration(): symbolSynchronous, read-only opaque generation. Every supported insertion or actual removal uses a fresh symbol never reused during this provider lifetime. Providers without it cannot certify a multi-await registry snapshot.packages/types/src/params-api.ts:52
register(definition: ParameterDefinition): () => voidReversible contribution owned by the calling plugin. Duplicate IDs are refused.packages/types/src/params-api.ts:54

PdfDocumentsService#

Bounded debrief document rendering only. The debrief export owner remains responsible for source/revision/privacy checks before invoking this port.

Source: packages/types/src/export-api.ts:58.

OperationSignatureContractSource
render(input: ExportRenderInput): Promise<ExportRenderResult>Render the bounded supplied debrief document projection; the caller retains audience/source authorization responsibility.packages/types/src/export-api.ts:61

PeerReviewService#

Source: packages/types/src/peer-review-api.ts:18.

OperationSignatureContractSource
add(target: PeerReviewTarget, fieldPath: string, text: string, actor: DraftActor & { kind: "human"; }): Promise<PeerReviewComment>Append an explicitly human-attributed field comment to the exact review target.packages/types/src/peer-review-api.ts:24
comments(target: PeerReviewTarget): Promise<PeerReviewComment[]>Read peer comments for the exact draft/scenario review target.packages/types/src/peer-review-api.ts:21
record(target: PeerReviewTarget, commentIds: string[], actor: DraftActor & { kind: "human"; }): Promise<PeerReviewRecord>Record a human review against the selected comment IDs; this grants no scenario or clinical approval.packages/types/src/peer-review-api.ts:30
records(target: PeerReviewTarget): Promise<PeerReviewRecord[]>Read saved human peer-review records for the exact target.packages/types/src/peer-review-api.ts:33
resolve(id: string, expectedRevision: number, actor: DraftActor & { kind: "human"; }): Promise<PeerReviewComment>Optimistically resolve one peer comment with explicit human attribution.packages/types/src/peer-review-api.ts:27

PluginSignatureVerifier#

Source: packages/types/src/plugin-signature-api.ts:11.

OperationSignatureContractSource
verify(input: { manifestHash: string; signature: PluginSignature | null; }): Promise<PluginSignatureResult>Verify exact manifest metadata using the future owner's trust policy. Input contains no trusted/verified flag or caller-provided trust store. Unavailable/unsigned must never be treated as verified. This declaration does not alter current explicit unsigned-package admin approval.packages/types/src/plugin-signature-api.ts:16

PortableWorkspaceOwner#

Trusted same-process capability only; the result contains private archive bytes and must not be forwarded to a public route or model provider.

Source: packages/types/src/portable-adoption.ts:12.

OperationSignatureContractSource
adoptionSnapshot(operationId: string, revision: number): Promise<PortableWorkspaceSnapshot>Read a trusted same-process workspace snapshot containing sensitive archive/history bytes; never forward it to public routes or models.packages/types/src/portable-adoption.ts:15

PreparedMediaService#

Source: packages/types/src/pairing-api.ts:46.

OperationSignatureContractSource
resolve(message: OutputMessage): Promise<PreparedMediaResource>Resolve only the exact currently pending paired media message into a scoped browser resource.packages/types/src/pairing-api.ts:48
resolve().release(): voidRelease this prepared browser media resource when rendering or ownership ends.packages/types/src/pairing-api.ts:45

ProgramReportService#

Source: packages/types/src/program-report-api.ts:21.

OperationSignatureContractSource
query(input: ProgramReportQuery): Promise<ProgramReportResult>Query explicitly selected scenario sessions for nonpersonal aggregate facts. A future owner validates bounds/access and retained-data eligibility; this declaration performs no reads and grants no cross-session permission.packages/types/src/program-report-api.ts:25

ProjectionService#

Source: packages/types/src/session-api.ts:158.

OperationSignatureContractSource
define(name: string, reducer: ProjectionReducer, initial?: unknown): () => voidRegister a caller-owned event reducer and its initial value; returns its disposer.packages/types/src/session-api.ts:161
names(): Promise<string[]>List active named projection reducers.packages/types/src/session-api.ts:167
read(sessionId: string, name: string): Promise<unknown>Read the named projection derived from the identified session history.packages/types/src/session-api.ts:164

PublicClientsService#

Source: packages/types/src/ui-api.ts:39.

OperationSignatureContractSource
list(slot: "screen.layouts" | "epr.tabs" | "epr.obsFields"): Promise<PublicLayoutClient[]>List only explicitly public generation-bound browser entries for the selected supported slot.packages/types/src/ui-api.ts:42

RealtimeApi#

Broadcast service used by browser projections and plugin lifecycles.

Source: packages/types/src/host.ts:69.

OperationSignatureContractSource
diagnostics(): Promise<{ clients: number; }>Inspect active clients for cleanup tests.packages/types/src/host.ts:84
disconnect(peerId: string): Promise<void>Close the identified connected peer through the realtime owner.packages/types/src/host.ts:79
endpoint(): Promise<{ host: string; port: number; url: string; }>Read the realtime listener actual host, assigned port and URL.packages/types/src/host.ts:82
publish(topic: string, value: unknown): Promise<void>Send a serializable update to connected clients.packages/types/src/host.ts:71
sendTo(peerId: string, packet: RealtimeStreamPacket): Promise<void>Send the supplied raw packet only to the identified connected peer.packages/types/src/host.ts:76
stream(definition: RealtimeStreamDefinition): () => voidOwned raw stream; its codec performs device authentication.packages/types/src/host.ts:73

RecordingReadService#

Source: packages/types/src/capture-read-api.ts:21.

OperationSignatureContractSource
list(sessionId: string, cursor?: string): Promise<{ sessionId: string; items: RecordingReadSummary[]; cursor?: string; }>Closed takes only, at most100 entries; cursor is opaque and at most4096 characters.packages/types/src/capture-read-api.ts:23
readPlayback(input: { sessionId: string; recordingId: string; sourceHash: string; eventIds: string[]; }): Promise<RecordingPlaybackRead>Exact hash from list; at most10000 distinct event IDs, including any event type.packages/types/src/capture-read-api.ts:25

RetainedDebriefPdfService#

Source: packages/types/src/debrief-retained-api.ts:53.

OperationSignatureContractSource
render(input: { sheet: RetainedDebriefSheet; paperSize?: PdfPaperSize; uiLocale?: "en" | "fr"; sectionOrder?: string[]; }): Promise<ExportRenderResult>Render only the validated closed retained DTO with explicit privacy and simulation notices. No scenario ID/version/approval status is invented.packages/types/src/debrief-retained-api.ts:56

RetainedDebriefsService#

Source: packages/types/src/debrief-retained-api.ts:36.

OperationSignatureContractSource
get(sessionId: string, options?: { view?: "runner" | "learner"; }): Promise<RetainedDebriefSheet | null>Read a validated detached factual sheet without touching erased sources. Learner selection omits runner topology and alternative/ideal walks.packages/types/src/debrief-retained-api.ts:39
list(options?: { limit?: number; cursor?: string; }): Promise<RetainedDebriefPage>List bounded retained metadata independently of the removed SessionLog.packages/types/src/debrief-retained-api.ts:41

ReviewedQuotesService#

Source: packages/types/src/quotes-api.ts:12.

OperationSignatureContractSource
generation(sessionId: string): object | undefinedSynchronous opaque session evidence lifetime. A pending edit or permanent erasure invalidates captured proofs without exposing quote content.packages/types/src/quotes-api.ts:15
reviewedSession(sessionId: string): Promise<ReviewedSessionQuotes>Read source-verified human-reviewed quotes and utterance decisions; unavailable sources do not imply absent speech.packages/types/src/quotes-api.ts:18

RoomChecklistService#

A future plugin may provide this asynchronous, serializable derivation port.

Source: packages/types/src/room-checklist-api.ts:28.

OperationSignatureContractSource
generate(source: RoomChecklistSource): Promise<RoomChecklistResult>Derive the optional future checklist from explicit source material; availability remains provider-dependent.packages/types/src/room-checklist-api.ts:31

RouterService#

Source: packages/types/src/session-api.ts:138.

OperationSignatureContractSource
console(sessionId?: string): Promise<OutputMessage[]>Read retained manual-fallback outputs, optionally restricted to one session.packages/types/src/session-api.ts:152
fenceInstance<T>(instanceId: string, callback: () => Promise<T>): Promise<T>Reserve an instance's delivery lane after earlier router preparations and before later ones. The callback must not await another send to that lane.packages/types/src/session-api.ts:149
kind(name: string, schema: SessionValueSchema): () => voidRegister a caller-owned custom output kind. The schema validates its full body at live preparation/delivery; historical replay retains opaque data.packages/types/src/session-api.ts:141
prepare(message: OutputMessage): Promise<OutputMessage | null>Live hook transformation before output_sent is committed.packages/types/src/session-api.ts:143
send(message: OutputMessage, options?: { prepared?: boolean; }): Promise<DeliveryReport[]>Route the supplied prepared/live output and return actual per-destination delivery reports.packages/types/src/session-api.ts:146
subscribe(handler: (message: OutputMessage) => void | Promise<void>): () => voidSubscribe an owned observer to routed output messages and return its disposer.packages/types/src/session-api.ts:155

RoutingService#

Source: packages/types/src/interface-api.ts:191.

OperationSignatureContractSource
configure(configuration: RouterConfiguration): Promise<void>Replace this router configuration with the explicitly supplied channel routes.packages/types/src/interface-api.ts:194
routes(): Promise<Route[]>Read the current configured route list.packages/types/src/interface-api.ts:197
unrouted(channels: string[]): Promise<string[]>Return the supplied channels that currently have no configured destination route.packages/types/src/interface-api.ts:200

RunnerService#

Source: packages/types/src/session-api.ts:72.

OperationSignatureContractSource
capabilities(): Promise<{ predicates: string[]; effects: string[]; detections: string[]; }>Active owned extension IDs only; validation never executes capabilities.packages/types/src/session-api.ts:74
detect(input: EngineInput, context: CommandContext): Promise<string[]>Run active detection contributors against the supplied input and trusted command context.packages/types/src/session-api.ts:107
detection(name: string, handler: (input: EngineInput, context: CommandContext) => string[] | Promise<string[]>): () => voidRegister a caller-owned input detection contributor and return its disposer.packages/types/src/session-api.ts:101
effect(name: string, handler: (request: PluginEffectRequest) => void | SessionCommand[] | Promise<void | SessionCommand[]>): () => voidRegister a caller-owned effect handler; returned session commands still require ordinary dispatch.packages/types/src/session-api.ts:98
evaluate(scenario: Scenario, events: SessionEvent[], now: EngineNow, options: RunnerOptions): Promise<EngineResult>Evaluate the scenario against the supplied event prefix, clock sample and runner options.packages/types/src/session-api.ts:79
inspect(scenario: Scenario, projection: EngineProjection): Promise<{ track: string; transitionId: string; met: boolean; }[]>Read transition guard results for this scenario/projection without firing transitions.packages/types/src/session-api.ts:92
outcomeMap(scenario: Scenario, options?: { maxPaths?: number; maxDepth?: number; }): Promise<OutcomeMap>Bounded pure graph paths and loop regions, shared with authoring views.packages/types/src/session-api.ts:76
predicate(name: string, handler: (args: unknown, projection: Readonly<EngineProjection>) => boolean): () => voidRegister a caller-owned named guard predicate and return its disposer.packages/types/src/session-api.ts:95
recentReading(events: SessionEvent[], param: string, stationId: string, now: EngineNow, bindings: Session["stationBindings"], unit: string, tolerance: number): Promise<{ value: number; unit: string; ageMs: number; } | null>Internal shared selector; callers must supply trusted saved bindings and registry data.packages/types/src/session-api.ts:81
replay(scenario: Scenario, events: SessionEvent[], sessionId: string): Promise<EngineProjection>Rebuild a session projection from the supplied scenario and ordered events without dispatching commands.packages/types/src/session-api.ts:84
runEffects(requests: PluginEffectRequest[]): Promise<SessionCommand[]>Run the supplied owned effect requests and collect proposed session commands.packages/types/src/session-api.ts:104
sampleTargets(scenario: Scenario, events: SessionEvent[], sessionId: string, times: number[]): Promise<import("./engine.js").TargetHistorySample[]>Pure bounded history sampling: no guards, effects, outputs or commands.packages/types/src/session-api.ts:86
validate(scenario: Scenario): Promise<ValidationResult>Validate the supplied scenario structure and supported runner capabilities.packages/types/src/session-api.ts:89

SavedTranscriptReadService#

Source: packages/types/src/capture-read-api.ts:37.

OperationSignatureContractSource
listSaved(sessionId: string, cursor?: string): Promise<{ sessionId: string; items: SavedTranscriptReadSummary[]; cursor?: string; }>Saved namespace only, at most100 entries. No provider enumeration or inference.packages/types/src/capture-read-api.ts:39
readSegments(input: { sessionId: string; recordingId: string; providerId: string; sourceHash: string; cursor?: string; }): Promise<{ sessionId: string; recordingId: string; providerId: string; sourceHash: string; coverage: "unknown"; sessionOffsetMs: number; timing?: SavedTranscriptReadTiming; processing?: SavedTranscriptReadProcessing; segments: TranscriptSegment[]; cursor?: string; }>One exact saved word per segment; at most1000 segments /256KiB text per page.packages/types/src/capture-read-api.ts:41

ScenarioAuthoringContextProvider#

Read a same-process authoring capability snapshot for the supplied scenario/options; the result is plain JSON.

Source: packages/types/src/authoring-api.ts:17.

OperationSignatureContractSource
(call)(scenario: Scenario, options: ScenarioValidationOptions): Promise<ScenarioAuthoringContext>Read a same-process authoring capability snapshot for the supplied scenario/options; the result is plain JSON.packages/types/src/authoring-api.ts:17

ScenarioService#

Source: packages/types/src/session-api.ts:109.

OperationSignatureContractSource
extension(schema: SessionValueSchema): () => voidRegister an owned schema for additional scenario event/effect values and return its disposer.packages/types/src/session-api.ts:136
get(id: string, version?: number): Promise<Scenario | null>Read the requested scenario version, or the current version when omitted; absent returns null.packages/types/src/session-api.ts:112
list(): Promise<Scenario[]>List current saved scenario identities and versions.packages/types/src/session-api.ts:115
load(path: string): Promise<Scenario>Load and validate a scenario from the explicitly supplied local file path.packages/types/src/session-api.ts:130
put(scenario: Scenario): Promise<Scenario>Persist the supplied validated scenario version without creating a human review assertion.packages/types/src/session-api.ts:127
register(scenario: Scenario): () => voidRegister a caller-owned scenario contribution and return its disposer.packages/types/src/session-api.ts:133
validate(scenario: unknown, options?: ScenarioValidationOptions): Promise<ValidationResult>Validate unknown scenario data for the explicitly selected runtime/authoring purpose.packages/types/src/session-api.ts:121
validationContext(provider: ScenarioAuthoringContextProvider): () => voidOne reversible context provider for authoring-only reference checks. Its absence blocks approval, without blocking ordinary scenario loading.packages/types/src/session-api.ts:124
versions(id: string): Promise<Scenario[]>Read every saved version of the identified scenario.packages/types/src/session-api.ts:118

ScoringService#

Source: packages/types/src/scoring-api.ts:40.

OperationSignatureContractSource
compute(tableId: string | null, vitals: VitalSet, options?: ScoringOptions): Promise<ScoringResult>Evaluate the selected editable table and options; pending clinical approval blocks learner-purpose use.packages/types/src/scoring-api.ts:48
list(): Promise<ScoringDefinition[]>List detached active scoring definitions and their source/approval metadata.packages/types/src/scoring-api.ts:45
register(definition: ScoringDefinition): () => voidContribution registration is owned by the calling plugin, as are hooks and slots.packages/types/src/scoring-api.ts:42

SecretsManagementService#

Optional write-only administrator management. Values never enter profile JSON.

Source: packages/types/src/secrets-api.ts:8.

OperationSignatureContractSource
configured(): Promise<string[]>List configured reference names without returning secret values.packages/types/src/secrets-api.ts:19
get(reference: string): Promise<string | null>Resolve a configured secret reference; null means unavailable.packages/types/src/secrets-api.ts:5
remove(reference: string): Promise<void>Remove the named managed secret through the administrator-owned credential provider.packages/types/src/secrets-api.ts:16
set(reference: string, value: string): Promise<void>Store the supplied secret value behind its reference without writing it to profile JSON.packages/types/src/secrets-api.ts:13

SecretsService#

Server-only credential port. Consumers receive only explicitly configured refs; public run snapshots, scenario/site exports and audit never contain values.

Source: packages/types/src/secrets-api.ts:3.

OperationSignatureContractSource
get(reference: string): Promise<string | null>Resolve a configured secret reference; null means unavailable.packages/types/src/secrets-api.ts:5

SessionAiRunReferencesService#

Source: packages/types/src/session-data-api.ts:22.

OperationSignatureContractSource
index(): Promise<SessionAiRunAttributedReference[]>Actual AI owner/root only: bounded private attribution metadata for legacy run reconciliation. No transcript, prompt, output or public API projection. Capabilities are used only to verify the AI owner's existing run hash.packages/types/src/session-data-api.ts:26
list(operation: SessionDataOperation): Promise<SessionAiRunReference[]>Actual AI owner only, under the exact admitted delete operation. Include planned owned run IDs before dispatch. The AI owner persists its own fenced plan before these source owners erase their private credentials.packages/types/src/session-data-api.ts:30

SessionDataAuthorityService#

Source: packages/types/src/session-data-api.ts:9.

OperationSignatureContractSource
authorized(operation: SessionDataOperation): Promise<boolean>Verify the exact immutable operation against its durable admission. This read operation cannot create a grant from caller-supplied claims.packages/types/src/session-data-api.ts:12

SessionDataOwnerService#

Owner-bound operations. A grant or actual root context is required for mutations. Every owner retains its own namespace and irreversible fence.

Source: packages/types/src/session-data-api.ts:43.

OperationSignatureContractSource
erase(operation: SessionDataOperation): Promise<SessionDataReceipt>Idempotently erase only the authorized scope after its durable fence. Recording expiry retains safe provenance needed by longer-lived text.packages/types/src/session-data-api.ts:51
freeze(operation: SessionDataOperation): Promise<void>Persist an operation fence before admitting any subsequent owner writes; drain its prior commit lane and revoke affected active readers/tasks.packages/types/src/session-data-api.ts:48
inventory(options?: { limit?: number; cursor?: string; }): Promise<SessionDataInventory>Bounded metadata inventory only; no recording bytes or personal text.packages/types/src/session-data-api.ts:45

SessionErasureSourceService#

Source: packages/types/src/session-data-api.ts:14.

OperationSignatureContractSource
snapshot(operation: SessionDataOperation): Promise<SessionReplay>Read the fenced source only for the exact admitted delete operation and actual canonical debrief owner/delegate. Ordinary session APIs stay closed. This snapshot exists only until final raw-session erasure.packages/types/src/session-data-api.ts:18

SessionPrivacyService#

Source: packages/types/src/session-data-api.ts:60.

OperationSignatureContractSource
deleteSession(input: { operationId: string; sessionId: string; }): Promise<SessionPrivacyStatus>Admit/retry one durable, idempotent ended-session deletion with actual root or ambient privacy.manage authority. Fence every owner before erasure.packages/types/src/session-data-api.ts:63
status(operationId: string): Promise<SessionPrivacyStatus | null>Read one metadata-only operation status with the same privacy authority.packages/types/src/session-data-api.ts:65
sweep(): Promise<SessionPrivacySweep>Run bounded recording/transcript expiry using current site day settings, immutable host timestamps and legacy first-observation anchors.packages/types/src/session-data-api.ts:68

SessionService#

Source: packages/types/src/session-api.ts:26.

OperationSignatureContractSource
advance(sessionId: string, deltaMs: number, meta?: CommandMeta): Promise<SessionDispatchResult>Advance virtual session time through the ordinary ordered command path.packages/types/src/session-api.ts:48
command(name: string, schema: SessionValueSchema | undefined, handler: CommandHandler): () => voidRegister an owned namespaced command schema/handler and return its disposer.packages/types/src/session-api.ts:57
create(input: SessionCreate): Promise<Session>Create a session from the exact scenario identity and explicit setup/scoring purpose.packages/types/src/session-api.ts:29
dispatch(command: SessionCommand): Promise<SessionDispatchResult>Admit one idempotent session command, commit its ordered events and return its resulting projection.packages/types/src/session-api.ts:45
eventType(name: string, schema: SessionValueSchema): () => voidRegister a caller-owned event value schema and return its disposer.packages/types/src/session-api.ts:60
events(sessionId: string): Promise<SessionEvent[]>Read the durable ordered session event history.packages/types/src/session-api.ts:51
get(sessionId: string): Promise<SessionSnapshot>Read the current session metadata, projection and queue depth.packages/types/src/session-api.ts:32
list(): Promise<Session[]>List saved sessions without dispatching a command.packages/types/src/session-api.ts:38
recentReading(sessionId: string, role: string, param: string): Promise<{ value: number; unit: string; ageMs: number; } | null>FR-EPR-4: role-bound, authorized station reading; null means comparison unavailable.packages/types/src/session-api.ts:42
replay(sessionId: string): Promise<SessionReplay>Read the scenario, session, ordered events and replayed projection together.packages/types/src/session-api.ts:54
sampleClock(sessionId: string): Promise<SessionClockSample>Read the active clock owner sample for this session without advancing it.packages/types/src/session-api.ts:35
scoringPurpose(sessionId: string): Promise<"authoring" | "learner" | "unknown">FR-EPR-1: unknown legacy records must not be admitted to learner views.packages/types/src/session-api.ts:40

SessionSetupService#

Source: packages/types/src/setup-api.ts:14.

OperationSignatureContractSource
check(input: SessionSetupInput): Promise<SiteCompatibility>Check the exact setup input against the active room/interface/route capabilities.packages/types/src/setup-api.ts:23
create(input: SessionSetupInput): Promise<Session>Create a session from the explicitly selected approved scenario version and room setup.packages/types/src/setup-api.ts:26
options(): Promise<SetupOptions>Read available approved scenarios, site rooms and configured interfaces for setup.packages/types/src/setup-api.ts:20
sendBrief(sessionId: string, channel: string, meta: { commandId: string; issuedAt: string; }): Promise<SessionDispatchResult>Send the chosen session prebrief through its declared output channel and ordered command metadata.packages/types/src/setup-api.ts:29
sessions(): Promise<Session[]>Read saved sessions for selection without creating or starting a session.packages/types/src/setup-api.ts:17

SimulatedClinicalBridge#

Source: packages/types/src/interface-api.ts:208.

OperationSignatureContractSource
decode(input: unknown): Promise<CanonicalObservation[]>Translate explicitly simulated clinical input into canonical simulated observations.packages/types/src/interface-api.ts:212
encode(input: CanonicalObservation): Promise<unknown>Translate a canonical simulated observation into the declared optional bridge standard.packages/types/src/interface-api.ts:215

SiteRuntimeService#

Source: packages/types/src/site-api.ts:48.

OperationSignatureContractSource
bind(sessionId: string): Promise<SiteRuntimeStatus>Apply this session room/interface bindings through the active site runtime.packages/types/src/site-api.ts:54
refresh(): Promise<SiteRuntimeStatus>Reconcile configured site instances through their current interface owners without starting a session.packages/types/src/site-api.ts:51

SiteService#

AR-SITE-1..3: durable installation configuration; session routing is scoped separately and never edits the portable scenario.

Source: packages/types/src/site-api.ts:15.

OperationSignatureContractSource
aiContentCapture(): Promise<{ enabled: boolean; }>Read the private durable admin/root content-capture consent. Legacy or imported profile flags alone cannot enable capture; absent support means off. Consumers must recheck the same active site owner and its defined policy generation before committing any safely projected audit content.packages/types/src/site-api.ts:30
clear(expectedRevision?: number): Promise<void>Optimistically replace installation configuration with the empty site while retaining its document revision.packages/types/src/site-api.ts:36
compatibility(scenario: Scenario, roomId: string, overrides?: Route[]): Promise<SiteCompatibility>Read missing input, routing and device-capability requirements for the selected scenario and room.packages/types/src/site-api.ts:45
export(): Promise<SiteProfile>Read a portable site projection with credentials removed by the site owner.packages/types/src/site-api.ts:39
get(): Promise<SiteSnapshot>Read the installation profile and current compare-and-swap revision.packages/types/src/site-api.ts:24
import(profile: SiteProfile, expectedRevision?: number): Promise<SiteSnapshot>Validate and save the portable site projection, enforcing the supplied expected revision.packages/types/src/site-api.ts:42
policyGeneration(): object | undefinedSynchronous, process-local identity for detecting supported policy changes. Undefined means a save, clear or import is queued or in flight; callers must fail closed rather than compare two undefined values. Require the same provider identity and the same defined token after every awaited check. This is not a durable revision or a cross-process transaction.packages/types/src/site-api.ts:21
save(profile: SiteProfile, expectedRevision?: number): Promise<SiteSnapshot>Validate and optimistically save the installation profile, then notify site observers.packages/types/src/site-api.ts:33

SoundsService#

Source: packages/types/src/sound-api.ts:21.

OperationSignatureContractSource
download(id: string): Promise<SoundDownload | null>Verify actual stored bytes before native browser audition.packages/types/src/sound-api.ts:31
get(id: string): Promise<SoundAsset | null>Read saved sound metadata by identity, or null when absent.packages/types/src/sound-api.ts:27
list(): Promise<SoundAsset[]>List available sound metadata without returning binary bytes.packages/types/src/sound-api.ts:24
upload(input: SoundUpload, actor: DraftActor & { kind: "human"; }): Promise<SoundAsset>Trusted local human action; byte upload grants no clinical verification.packages/types/src/sound-api.ts:29

StorageAdapter#

Source: packages/types/src/storage.ts:85.

OperationSignatureContractSource
close(): Promise<void>Flush persisted work and release provider resources.packages/types/src/storage.ts:91
docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
exportAll(): AsyncIterable<ExportRecord>Export every event, document revision and key without interpreting plugin data.packages/types/src/storage.ts:100
health(): Promise<{ status: "ready" | "unavailable"; checkedAt: string; }>M8 AR-DIST-2: bounded read-only provider health, without returning rows, connection credentials, SQL or raw driver errors. Optional for older adapters.packages/types/src/storage.ts:96
importAll(records: AsyncIterable<ExportRecord>, options?: { requireEmpty?: boolean; }): Promise<void>Atomically restore records, preserving exact revisions and unknown data. requireEmpty checks all exported-data tables inside the same transaction, preventing a migration from overwriting a concurrent writer.packages/types/src/storage.ts:104
kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
migrate(): Promise<void>Apply idempotent provider migrations before use.packages/types/src/storage.ts:93
ns(pluginId: string): NamespacedStorageBind plugin-owned data; the result cannot select another plugin namespace.packages/types/src/storage.ts:98
ns().docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
ns().docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
ns().docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
ns().docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
ns().events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
ns().events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
ns().events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
ns().kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
ns().kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
ns().kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
ns().tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79
open(config?: unknown): Promise<void>Open the provider. Default PGlite config takes an optional dataDir.packages/types/src/storage.ts:89
tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79

StorageAdministrationService#

Source: packages/types/src/storage.ts:71.

OperationSignatureContractSource
adapter(): StorageAdapterHost-only access for migrations/backup; injected plugin callers are rejected.packages/types/src/storage.ts:73
adapter().close(): Promise<void>Flush persisted work and release provider resources.packages/types/src/storage.ts:91
adapter().docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
adapter().docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
adapter().docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
adapter().docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
adapter().events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
adapter().events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
adapter().events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
adapter().exportAll(): AsyncIterable<ExportRecord>Export every event, document revision and key without interpreting plugin data.packages/types/src/storage.ts:100
adapter().health(): Promise<{ status: "ready" | "unavailable"; checkedAt: string; }>M8 AR-DIST-2: bounded read-only provider health, without returning rows, connection credentials, SQL or raw driver errors. Optional for older adapters.packages/types/src/storage.ts:96
adapter().importAll(records: AsyncIterable<ExportRecord>, options?: { requireEmpty?: boolean; }): Promise<void>Atomically restore records, preserving exact revisions and unknown data. requireEmpty checks all exported-data tables inside the same transaction, preventing a migration from overwriting a concurrent writer.packages/types/src/storage.ts:104
adapter().kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
adapter().kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
adapter().kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
adapter().migrate(): Promise<void>Apply idempotent provider migrations before use.packages/types/src/storage.ts:93
adapter().ns(pluginId: string): NamespacedStorageBind plugin-owned data; the result cannot select another plugin namespace.packages/types/src/storage.ts:98
adapter().ns().docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
adapter().ns().docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
adapter().ns().docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
adapter().ns().docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
adapter().ns().events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
adapter().ns().events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
adapter().ns().events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
adapter().ns().kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
adapter().ns().kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
adapter().ns().kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
adapter().ns().tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79
adapter().open(config?: unknown): Promise<void>Open the provider. Default PGlite config takes an optional dataDir.packages/types/src/storage.ts:89
adapter().tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79
purgeNamespace(pluginId: string): Promise<void>Host-only --purge: remove this plugin's private data while retaining global session history.packages/types/src/storage.ts:75

StorageOperations#

Source: packages/types/src/storage.ts:27.

OperationSignatureContractSource
docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57

StorageService#

Source: packages/types/src/storage.ts:64.

OperationSignatureContractSource
health(): Promise<{ status: "ready" | "unavailable"; checkedAt: string; }>Bounded read-only availability probe. No rows, SQL, adapter access or credentials are exposed. Older third-party providers may omit this.packages/types/src/storage.ts:69
ns(pluginId: string): NamespacedStorageBind only the calling plugin's id; other plugin namespaces are rejected.packages/types/src/storage.ts:66
ns().docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
ns().docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
ns().docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
ns().docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
ns().events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
ns().events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
ns().events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
ns().kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
ns().kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
ns().kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57
ns().tx<T>(fn: (storage: StorageTx) => Promise<T>): Promise<T>All operations on the supplied transaction share one atomic commit.packages/types/src/storage.ts:79

StorageTx#

Source: packages/types/src/storage.ts:63.

OperationSignatureContractSource
docs.delete(collection: string, id: string, expectedRev?: number): Promise<void>Delete the identified document, enforcing expectedRev when supplied.packages/types/src/storage.ts:50
docs.get(collection: string, id: string): Promise<DocumentRecord | null>Read the exact stored document and revision, or null when absent.packages/types/src/storage.ts:44
docs.list(collection: string, query: DocumentQuery): Promise<{ items: DocumentItem[]; cursor?: string; }>Read a bounded query page with a provider cursor and exact document revisions.packages/types/src/storage.ts:47
docs.put(collection: string, id: string, doc: unknown, expectedRev?: number): Promise<{ rev: number; }>expectedRev 0 means absent; omission permits an unconditional versioned update.packages/types/src/storage.ts:41
events.append(sessionId: string, events: StoredEvent[], expectedSeq: number): Promise<{ seq: number; }>Atomically append the whole batch, or reject without changing the log.packages/types/src/storage.ts:35
events.erase(sessionId: string, expectedSeq: number): Promise<{ removed: number; }>Explicit privacy erasure inside this caller-owned namespace. The exact committed head must match; ordinary writes remain append-only. Owners persist their authorization fence and receipt in the same transaction. Unsupported third-party providers must leave erasure unavailable.packages/types/src/storage.ts:33
events.read(sessionId: string, fromSeq?: number): AsyncIterable<StoredEvent>Read in sequence order, including fromSeq (default 1).packages/types/src/storage.ts:37
kv.delete(namespace: string, key: string): Promise<void>Remove the named key, idempotently, inside the selected namespace.packages/types/src/storage.ts:60
kv.get(namespace: string, key: string): Promise<unknown>Missing keys return undefined, distinct from a stored JSON null.packages/types/src/storage.ts:54
kv.set(namespace: string, key: string, value: unknown): Promise<void>Persist the supplied JSON value for the exact namespace/key.packages/types/src/storage.ts:57

StoreLocalDataService#

PST-20..24: narrow first-party data projection, not a cross-namespace store handle. Credentials, configuration, source and learner records are absent.

Source: packages/types/src/store-local-data-api.ts:5.

OperationSignatureContractSource
localReport(reportId: string): Promise<ReviewReport | null>Resolve one canonical report only under current trusted local admin scope.packages/types/src/store-local-data-api.ts:7
snapshotEntries(): Promise<SnapshotEntry[]>Return the complete bounded installation projection across canonical profile bindings. Deduplicate releases, enabled wins; fail on overflow.packages/types/src/store-local-data-api.ts:10

StoreReviewsService#

Source: packages/types/src/store-review-api.ts:16.

OperationSignatureContractSource
byReportId(reportId: string): Promise<ReviewReport | null>Resolve a persisted report's public local identity without namespace access.packages/types/src/store-review-api.ts:24
cancel(runId: string): Promise<void>Abort only this local review and retain its cancelled, incomplete ledger.packages/types/src/store-review-api.ts:26
disclosure(subject: StoreReviewSubject): Promise<StoreReviewDisclosure>Read exact selected-file/provider disclosure without making a model call.packages/types/src/store-review-api.ts:18
forget(planId: string): Promise<{ forgotten: true; reports: number; }>Trusted installer/root retention only. Fence a plan, drain its producer, erase local report/owned AI content and keep a bounded body-free summary.packages/types/src/store-review-api.ts:29
report(runId: string): Promise<ReviewReport | null>Read a terminal host-computed report, or null while that run is unfinished.packages/types/src/store-review-api.ts:22
start(subject: StoreReviewSubject, request: { providerConfigDigest: string; limits: ReviewLimits; consent: "send-package-code"; }): Promise<{ runId: string; threadId: string; }>Start one fresh package-only thread after exact provider disclosure consent.packages/types/src/store-review-api.ts:20

UiService#

Source: packages/types/src/ui-api.ts:26.

OperationSignatureContractSource
entries(name: string): UiEntry[]Read active entries for the named UI slot without mounting them.packages/types/src/ui-api.ts:32
entries()[].mount(element: HTMLElement, api?: unknown, props?: unknown): Promise<UiMount>Mount this owned contribution with its declared API/props and return its cleanup/controller.packages/types/src/ui-api.ts:24
entries()[].mount().dispose(): void | Promise<void>Release the mounted controller DOM, subscriptions and other owned resources.packages/types/src/ui-api.ts:10
entries()[].mount().render(message: OutputMessage): void | Promise<void>Render an admitted output message through the mounted controller.packages/types/src/ui-api.ts:7
slot(name: string, contribution: UiContribution): UiDisposerRegister a caller-owned UI slot contribution and return its disposer.packages/types/src/ui-api.ts:29
subscribe(name: string, listener: () => void): UiDisposerSubscribe to active-entry changes for the named slot and return its disposer.packages/types/src/ui-api.ts:35

UnverifiedCorrectionCapabilityVerifier#

Extraction owns reservation and capability verification; same-process trust applies.

Source: packages/types/src/draft-api.ts:221.

OperationSignatureContractSource
verifyUnverifiedCorrectionCapability(operationId: string, secret: string): Promise<UnverifiedCorrectionAdmissionLease>Verify the exact private operation capability and return an ephemeral same-process admission lease.packages/types/src/draft-api.ts:224
verifyUnverifiedCorrectionCapability().isCurrent(): booleanSynchronously verify that this exact ephemeral correction capability generation is still active.packages/types/src/draft-api.ts:218

Other exported callable contracts#

These exported callback/DTO contracts are not standalone service roots. Their operations appear above when reachable through a service result: AiExecutionContext, AiProviderDefinition, AiTaskDefinition, AsyncCodec, CliCommand, Codec, CommandHandler, EprLearnerMutationDeclaration, EprLearnerPluginActions, EprLearnerRouteDeclaration, ExportRenderer, HostPackageMutation, HttpBindingContext, HttpEventStream, HttpProtocolBinding, HttpRoute, HttpStreamResult, HttpStreamRoute, ImportParser, InspectableTransportHandle, InterfaceType, Logger, MaintenanceAdapterLease, McpPromptDefinition, McpResourceDefinition, McpToolDefinition, NetworkManagedOperation, NetworkStorageFootprint, PairingView, PreparedMediaResource, ProjectionReducer, ProtocolCodec, ProtocolTransportIO, PureEngine, RealtimeStreamDefinition, RuntimeCodec, SessionValueSchema, TransportDef, TransportHandle, TransportIO, UiContribution, UiController, UiDisposer, UiEntry, UiMount, UnverifiedCorrectionAdmissionLease.