@byok-sdk/client 0.2.0 → 0.3.0

package/dist/adapters/pi/pi-adapter.d.ts

@@ -2,15 +2,37 @@ import type { TaskOfferPayload } from '@byok-sdk/protocol';
 import { type RuntimeAdapter, type RuntimeCapabilities, type RuntimeDetectResult, type RuntimeEnvironmentRequirements, type Session, type TaskContext } from '../../types';
 import { type ResolvedBin } from './resolve-bin';
 import { type SpawnFn } from './rpc-client';
+/**
+ * Known provider credential env var *names* (never values) — see the
+ * credential-isolation rule on `RuntimeAdapter`. `detect()` only checks
+ * whether one of these names is set; it never reads pi's own auth storage
+ * (`~/.pi/...`) or any file contents. Not exhaustive (pi supports ~30
+ * providers); covers the common ones for a useful `authPresent` signal.
+ */
 export interface PiAdapterOptions {
     /** Override bin resolution — tests substitute the fake-pi fixture script. */
     resolveBin?: () => ResolvedBin;
     /** Override process spawning — tests substitute a fake spawn. */
     spawnFn?: SpawnFn;
+    /**
+     * Separate-process BYOK credential boundary. The launcher receives only
+     * non-secret selection/config paths, resolves the OS credential itself,
+     * and transparently proxies the pinned Pi RPC process.
+     */
+    byokLauncher?: PiByokLauncherConfig;
+}
+export interface PiByokLauncherConfig {
+    command: string;
+    /** Optional fixed launcher arguments, before BYOK's required arguments. */
+    args?: string[];
+    profileDbPath: string;
+    sessionDir: string;
+    secretServicePrefix?: string;
 }
 export declare class PiAdapter implements RuntimeAdapter {
     private readonly options;
     readonly id = "pi";
+    readonly supportsDispatchSelection = true;
     constructor(options?: PiAdapterOptions);
     detect(): Promise<RuntimeDetectResult>;
     capabilities(): RuntimeCapabilities;

package/dist/adapters/provider-credential-environment.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Provider credential names that the daemon may explicitly admit for the
+ * legacy direct-Pi path. Subscription runtimes and the BYOK custody launcher
+ * must not inherit them.
+ *
+ * This list contains names only. Credential values remain owned by the
+ * caller's environment or by the separate keys launcher.
+ */
+export declare const PROVIDER_CREDENTIAL_ENV_NAMES: readonly ['ANTHROPIC_API_KEY', 'ANTHROPIC_OAUTH_TOKEN', 'OPENAI_API_KEY', 'GEMINI_API_KEY', 'AZURE_OPENAI_API_KEY', 'DEEPSEEK_API_KEY', 'GROQ_API_KEY', 'MISTRAL_API_KEY', 'OPENROUTER_API_KEY', 'XAI_API_KEY', 'ZAI_API_KEY'];
+/**
+ * Credential-shaped names stripped at subscription/BYOK custody boundaries.
+ * This is intentionally a superset of the small legacy-Pi allowlist above:
+ * denying a credential is safe, while allowing every cloud credential Pi
+ * could consume would regress the daemon's ambient-environment isolation.
+ */
+export declare const PROVIDER_CREDENTIAL_ENV_DENY_NAMES: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "OPENAI_API_KEY", "GEMINI_API_KEY", "AZURE_OPENAI_API_KEY", "DEEPSEEK_API_KEY", "GROQ_API_KEY", "MISTRAL_API_KEY", "OPENROUTER_API_KEY", "XAI_API_KEY", "ZAI_API_KEY", "ANT_LING_API_KEY", "NVIDIA_API_KEY", "CEREBRAS_API_KEY", "CLOUDFLARE_API_KEY", "AI_GATEWAY_API_KEY", "ZAI_CODING_CN_API_KEY", "OPENCODE_API_KEY", "RADIUS_API_KEY", "FIREWORKS_API_KEY", "TOGETHER_API_KEY", "BASETEN_API_KEY", "KIMI_API_KEY", "MINIMAX_API_KEY", "MINIMAX_CN_API_KEY", "QWEN_TOKEN_PLAN_API_KEY", "QWEN_TOKEN_PLAN_CN_API_KEY", "XIAOMI_API_KEY", "XIAOMI_TOKEN_PLAN_CN_API_KEY", "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_SGP_API_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "GOOGLE_APPLICATION_CREDENTIALS", "PI_PROVIDER_API_KEY"];
+/** Return a copy that cannot pass ambient provider credentials to a child. */
+export declare function withoutProviderCredentials(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;