@hraness/xcb 0.9.1

package/dist/judge.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Provider-neutral judgment port ("jev-style"): one fast request answers a
+ * batch of typed questions against one state object. A `Judge` is a routing,
+ * classification, and continuation helper — never an execution or custody
+ * boundary. Every consumer keeps a deterministic path when no judge is
+ * configured or a call fails, and bounds what it sends.
+ *
+ * Question kinds mirror the System One wire shape so additional backends can
+ * implement the same port: `noul` (yes/no probability), `choice` (pick one of
+ * labelled options with confidence), and `score` (score against criteria).
+ */
+export type JudgeState = string | object;
+export interface NoulQuestion {
+    type: "noul";
+    instructions: string;
+    criteria?: {
+        true?: string;
+        false?: string;
+    };
+}
+export interface ChoiceQuestion {
+    type: "choice";
+    instructions: string;
+    criteria: Record<string, string | null>;
+}
+export interface ScoreQuestion {
+    type: "score";
+    instructions: string;
+    criteria: string[];
+}
+export type JudgeQuestion = NoulQuestion | ChoiceQuestion | ScoreQuestion;
+export type JudgeQuestions = Record<string, JudgeQuestion>;
+export interface NoulAnswer {
+    type: "noul";
+    noul: number;
+}
+export interface ChoiceAnswer {
+    type: "choice";
+    choice: string;
+    confidence: number;
+    probabilities: Record<string, number>;
+}
+export interface ScoreAnswer {
+    type: "score";
+    score: number;
+    confidence: number;
+    probabilities: Record<string, number>;
+}
+export type JudgeAnswer = NoulAnswer | ChoiceAnswer | ScoreAnswer;
+export interface JudgeAnswers {
+    answers: Record<string, JudgeAnswer>;
+    model?: string;
+    usage?: {
+        input_tokens?: number;
+        output_tokens?: number;
+    };
+}
+/** Anything that can answer a batch of judgment questions. */
+export interface Judge {
+    ask(state: JudgeState, questions: JudgeQuestions): Promise<JudgeAnswers>;
+}
+export declare const SYSTEM_ONE_URL = "https://api.typesafe.ai/v1/systemone";
+export declare const DEFAULT_JUDGE_MODEL = "jev-latest";
+export declare const JUDGE_TOKEN_FILE = "jev-api-token";
+export declare const JUDGE_KEY_ENV = "XCB_JEV_API_KEY";
+export declare const JUDGE_KEY_VENDOR_ENV = "TYPESAFE_API_KEY";
+export declare const JUDGE_URL_ENV = "XCB_JEV_URL";
+export declare const JUDGE_MODEL_ENV = "XCB_JEV_MODEL";
+export declare const MAX_JUDGE_STATE_BYTES: number;
+export declare const MAX_JUDGE_QUESTIONS = 64;
+export declare const MAX_JUDGE_INSTRUCTION_BYTES: number;
+/** Validates a question batch before it reaches any backend. */
+export declare function checkJudgeQuestions(questions: JudgeQuestions): JudgeQuestions;
+/** Validates the serialized state before it reaches any backend. */
+export declare function checkJudgeState(state: JudgeState): JudgeState;
+/** Validates a System One response body; throws on anything malformed. */
+export declare function parseJudgeResponse(status: number, body: string): JudgeAnswers;
+/** Validates a complete response against the exact questions that were sent. */
+export declare function checkJudgeAnswers(questions: JudgeQuestions, response: JudgeAnswers): JudgeAnswers;
+/** Where a resolved judge key came from; `status` reports it, secrets never print. */
+export type JudgeKeySource = "env" | "vault";
+/** One HTTPS endpoint the judge may call; only `https` with a clean authority. */
+export declare function parseJudgeEndpoint(url: string): URL;
+export interface SystemOneOptions {
+    /** The API key. Never logged or persisted by the client. */
+    token: string;
+    /** Defaults to `jev-latest`. */
+    model?: string;
+    /** Defaults to the System One endpoint. */
+    endpoint?: string;
+    /** Injectable transport for tests; defaults to global `fetch`. */
+    fetch?: typeof fetch;
+    /** Request timeout in ms; defaults to 15000. */
+    timeoutMs?: number;
+}
+/** The TypeSafe System One backend: a `Judge` over one bounded HTTPS POST. */
+export declare function createSystemOneJudge(options: SystemOneOptions): Judge;
+/** Stores a judge key in the private state root; refuses to clobber. */
+export declare function storeJudgeKey(stateRoot: string, key: string | Uint8Array): Promise<void>;
+/** Removes the vaulted judge key; returns whether a file was removed. */
+export declare function removeJudgeKey(stateRoot: string): Promise<boolean>;
+export declare function hasJudgeKey(stateRoot: string): Promise<boolean>;
+/** Resolves the effective judge key: environment first, then the vault file. */
+export declare function resolveJudgeKey(stateRoot: string, env?: (name: string) => string | undefined): Promise<{
+    token: string;
+    source: JudgeKeySource;
+} | null>;
+export interface ResolveJudgeOptions {
+    /** Private state root holding the vault file. */
+    stateRoot: string;
+    /** The judge extension gate; resolution returns null when false. */
+    enabled: boolean;
+    model?: string;
+    endpoint?: string;
+    env?: (name: string) => string | undefined;
+    fetch?: typeof fetch;
+}
+/** Prevents the vaulted System One key from being redirected to another origin. */
+export declare function checkJudgeKeyTarget(source: JudgeKeySource, endpoint?: string): void;
+/** Resolves a ready judge when enabled and keyed; null for either absence. */
+export declare function resolveJudge(options: ResolveJudgeOptions): Promise<Judge | null>;

package/dist/loopback-server.d.ts

@@ -0,0 +1,17 @@
+export interface LoopbackServer {
+    readonly port: number;
+    readonly pendingRequests: number;
+    stop(immediate?: boolean): Promise<void>;
+}
+export type LoopbackServerOptions = Readonly<{
+    hostname: string;
+    /** When set, listen on this unix socket path instead of a TCP port —
+     * the host-side half of an in-namespace service forward. `port` reports
+     * 0; the caller owns the advertised reachability story. */
+    unixSocket?: string;
+    idleTimeoutMs?: number;
+    maxRequestBodyBytes?: number;
+    fetch(request: Request): Response | Promise<Response>;
+    error(error: unknown): Response;
+}>;
+export declare function createLoopbackServer(options: LoopbackServerOptions): Promise<LoopbackServer>;

package/dist/managed-account.d.ts

@@ -0,0 +1,176 @@
+import type { AccountLeaseStore } from "./accounts.ts";
+import type { BrowserSessionBinding } from "./browser-session.ts";
+import { type AgentProvider } from "./validation.ts";
+/**
+ * Provider-neutral managed-account custody. This module owns the custody
+ * discipline every provider controller shares — the account lease, the exact
+ * binding (`provider`, `accountId`, `owner`, lease and process generations),
+ * the serialized state machine, unresolved-login recovery and the joined-close
+ * barrier. It is not an execution or authentication qualification: admitting a
+ * provider's runtime, its login transport and its usage surface remain
+ * separate host evidence.
+ *
+ * Provider-owned semantics stay behind `ManagedAccountSemantics`: the neutral
+ * controller never parses a provider account payload, chooses plan labels or
+ * guesses challenge shapes. The transport is a closed port — account reads,
+ * login lifecycle, logout and close only; no raw RPC, token export or turn
+ * method exists here.
+ */
+export type ManagedAccountState = "unchecked" | "signed-out" | "signing-in" | "signed-in" | "unavailable" | "recovery-required" | "closed";
+export type ManagedAccountBinding = Readonly<{
+    provider: AgentProvider;
+    accountId: string;
+    owner: string;
+    leaseGeneration: number;
+    processGeneration: number;
+}>;
+/** How a login is driven. `provider-native` selects a provider-owned variant
+ * (Codex `chatgpt`/`chatgptDeviceCode`, Devin web login); `browser-session`
+ * drives sign-in inside the caller's per-account browser custody session —
+ * the session binding must equal the account's provider, accountId and owner
+ * so one account's cookie jar can never authenticate another. */
+export type ManagedAccountLoginMethod = Readonly<{
+    type: "provider-native";
+    method: string;
+}> | Readonly<{
+    type: "browser-session";
+    session: BrowserSessionBinding;
+}>;
+export type ManagedAccountLoginChallenge = Readonly<{
+    type: "provider-native";
+    method: string;
+    loginId: string;
+    fields: Readonly<Record<string, string>>;
+}> | Readonly<{
+    type: "browser-session";
+    loginId: string;
+    session: BrowserSessionBinding;
+    navigationUrl: string;
+}>;
+/** Neutral projection the provider semantics maps its account payload onto.
+ * `state` is the only claim the controller interprets; `planLabel`/`detail`
+ * are bounded display text and never authority. */
+export type ManagedAccountProjection = Readonly<{
+    state: "signed-out" | "signing-in" | "signed-in" | "unavailable";
+    planLabel?: string;
+    detail?: string;
+}>;
+export type ManagedAccountSnapshot = Readonly<{
+    provider: AgentProvider;
+    accountId: string;
+    state: ManagedAccountState;
+    accountGeneration: number;
+    processGeneration: number;
+    pendingLoginId: string | null;
+    planLabel?: string;
+    detail?: string;
+}>;
+export type ManagedAccountRequest = Readonly<{
+    binding: ManagedAccountBinding;
+    accountGeneration: number;
+    signal: AbortSignal;
+    deadlineMs: number;
+}>;
+export type ManagedAccountResponse = Readonly<{
+    binding: ManagedAccountBinding;
+    accountGeneration: number;
+    value: unknown;
+}>;
+export type ManagedAccountEvent = Readonly<{
+    binding: ManagedAccountBinding;
+    type: "account-updated" | "login-completed" | "disconnected";
+    loginId?: string | null;
+    success?: boolean;
+}>;
+export type ManagedAccountCloseReceipt = Readonly<{
+    binding: ManagedAccountBinding;
+    processExited: boolean;
+    processGroupStopped: boolean;
+    stdoutEnded: boolean;
+    stderrEnded: boolean;
+    writesSettled: boolean;
+    requestsSettled: boolean;
+    notificationsSettled: boolean;
+}>;
+/** Trusted implementation owns initialize, runtime/schema admission,
+ * credential custody and process custody. There is deliberately no raw RPC,
+ * token export or turn method. Return the handle before asynchronous launch,
+ * so close can join failed launches. A transport may implement extra
+ * provider-owned reads internally; they still run inside this fence. */
+export interface ManagedAccountTransport {
+    accountRead(request: ManagedAccountRequest): Promise<ManagedAccountResponse>;
+    startLogin(request: ManagedAccountRequest & {
+        method: ManagedAccountLoginMethod;
+    }): Promise<ManagedAccountResponse>;
+    cancelLogin(request: ManagedAccountRequest & {
+        loginId: string;
+    }): Promise<ManagedAccountResponse>;
+    logout(request: ManagedAccountRequest): Promise<ManagedAccountResponse>;
+    close(request: {
+        binding: ManagedAccountBinding;
+        deadlineMs: number;
+    }): Promise<ManagedAccountCloseReceipt>;
+}
+/** Provider-owned interpretation. Runs inside the controller's serialized,
+ * generation-fenced operation; must throw on any payload it does not fully
+ * admit rather than coerce. The controller itself owns the closed challenge
+ * envelope and cancel-status enum — the only provider-specific
+ * interpretation is the account payload's projection onto the neutral
+ * readiness state. */
+export interface ManagedAccountSemantics {
+    /** Map the transport's accountRead payload to a neutral projection. May
+     * issue further provider reads through the same fenced transport (paged
+     * model catalogs, quota detail) before returning. */
+    projectAccount(value: unknown, request: ManagedAccountRequest, transport: ManagedAccountTransport): Promise<ManagedAccountProjection>;
+}
+/** Bounded, read-only usage/quota observation. Windows are provider-named
+ * labels with optional utilization; `rawSha256` binds the provider's exact
+ * response as evidence without carrying it — quota bytes never enter custody
+ * journals, receipts or logs. A missing reader means the provider has no
+ * admitted usage surface; it is not a zero-usage claim. */
+export type ManagedAccountUsageWindow = Readonly<{
+    label: string;
+    usedPercent: number | null;
+    resetsAt: number | null;
+}>;
+export type ManagedAccountUsage = Readonly<{
+    binding: ManagedAccountBinding;
+    observedAt: number;
+    planLabel: string | null;
+    windows: readonly ManagedAccountUsageWindow[];
+    rawSha256: string;
+}>;
+export interface ManagedAccountUsageReader {
+    readUsage(request: ManagedAccountRequest): Promise<ManagedAccountUsage>;
+}
+export type ManagedAccountOptions = Readonly<{
+    provider: AgentProvider;
+    accountId: string;
+    owner: string;
+    processGeneration: number;
+    leases: AccountLeaseStore;
+    transportFactory: (binding: ManagedAccountBinding, onEvent: (event: ManagedAccountEvent) => void) => ManagedAccountTransport;
+    semantics: ManagedAccountSemantics;
+    usageReader?: ManagedAccountUsageReader;
+    now?: () => number;
+    operationTimeoutMs?: number;
+    closeTimeoutMs?: number;
+}>;
+export interface ManagedAccountController {
+    readonly binding: () => ManagedAccountBinding | undefined;
+    snapshot(): ManagedAccountSnapshot;
+    check(signal?: AbortSignal): Promise<ManagedAccountSnapshot>;
+    startLogin(method: ManagedAccountLoginMethod, signal?: AbortSignal): Promise<ManagedAccountLoginChallenge>;
+    cancelLogin(loginId: string, signal?: AbortSignal): Promise<Readonly<{
+        status: "canceled" | "notFound";
+    }>>;
+    logout(signal?: AbortSignal): Promise<ManagedAccountSnapshot>;
+    /** Bounded quota observation through the admitted reader; `null` when the
+     * provider has none. Never extends custody or refreshes credentials. */
+    readUsage(signal?: AbortSignal): Promise<ManagedAccountUsage | null>;
+    close(): Promise<Readonly<{
+        released: boolean;
+        state: "closed" | "recovery-required";
+    }>>;
+}
+export declare function createManagedAccountController(options: ManagedAccountOptions): ManagedAccountController;

package/dist/models.d.ts

@@ -0,0 +1,23 @@
+import { type AgentProvider } from "./validation.ts";
+export type ModelEntry = Readonly<{
+    id: string;
+    inputUsdPerMillion: number;
+    outputUsdPerMillion: number;
+    supportsStructuredOutput: boolean;
+    available: boolean;
+    classifierEligible: boolean;
+}>;
+export type ModelCatalog = Readonly<{
+    provider: AgentProvider;
+    observedAt: number;
+    models: readonly ModelEntry[];
+}>;
+/** Host-supplied catalog; no invented model identifiers or unobserved availability. */
+export declare function selectClassifierModel(value: unknown, now: number, maxAgeMs?: number): ModelEntry;
+export type Classification = Readonly<{
+    respond: boolean;
+    confidence: number;
+    reason: "requested" | "helpful" | "human_active" | "not_needed" | "uncertain";
+}>;
+/** Strict JSON only: prose, fenced JSON, unknown fields and contradictory decisions fail closed. */
+export declare function parseClassification(value: unknown): Classification;

package/dist/os-sandbox.d.ts

@@ -0,0 +1,168 @@
+import { type BoundedProviderProcessFactory } from "./provider-process.ts";
+/**
+ * OS-confinement port for provider processes. A backend turns a closed launch
+ * spec into a plan: a canonical policy artifact, its digest, the wrapper
+ * executable the child actually spawns, and a pure `wrap()` that rewrites one
+ * invocation onto the admitted policy. Planning is asynchronous so backends
+ * can re-verify their own admitted artifacts; wrapping is synchronous so it
+ * can run inside provider SDKs that spawn from a sync callback.
+ *
+ * Custody stays with the caller: bounded stdio, detached process groups,
+ * SIGTERM/SIGKILL escalation and join evidence are unchanged underneath every
+ * backend. A plan proves policy construction and artifact admission only — it
+ * is not proof that the kernel enforced the policy. Kernel-boundary evidence
+ * belongs to `qualification/` probes, and every receipt keeps
+ * `productionQualified: false` until a host supplies it.
+ *
+ * - `seatbelt` (darwin): the caller supplies reviewed SBPL policy text through
+ *   `generateProfile`; the plan wraps argv as `/usr/bin/sandbox-exec -f
+ *   <policyPath> <executable> <args...>` byte-identically to the launchers this
+ *   port replaces. Environment passes through — callers already close it.
+ * - `bwrap` (linux): bubblewrap builds a private rootfs from per-file
+ *   `--ro-bind` entries, `--bind` for the writable scratch/account roots,
+ *   `--unshare-all`, `--new-session`, `--die-with-parent`, `--clearenv` +
+ *   `--setenv`. Only `network: "denied"` is plannable: bwrap cannot express
+ *   per-destination egress, and a unix-socket proxy bridge is a separate
+ *   qualification. The wrapper binary is itself an admitted artifact whose
+ *   SHA-256 is re-verified from a checked descriptor at plan time.
+ *   `--setenv` values are visible in the wrapper's own command line, so a
+ *   forwarder plan may instead declare `envFile`: `wrap()` then persists
+ *   the closed env into the writable scratch (mode 0600) and emits no
+ *   `--setenv` at all — the forwarder reads, deletes, and injects the
+ *   pairs only into the supervised child's environment.
+ */
+export type OsSandboxNetworkPolicy = "denied" | "loopback" | "provider-tcp443-dns";
+export type OsSandboxBackendName = "seatbelt" | "bwrap";
+/** The platform the *admitted runtime* targets — host admission evidence, not
+ * `process.platform`. A backend refuses a spec whose platform it cannot
+ * enforce; synthetic custody tests exercise the real launch path on any host. */
+export type OsSandboxPlatform = "darwin" | "linux";
+export type OsSandboxSpec = Readonly<{
+    platform: OsSandboxPlatform;
+    /** Absolute canonical path of the in-sandbox executable (the admitted run
+     * snapshot), bound read-only and executable. */
+    executable: string;
+    /** Per-run private writable root (home/tmp/work). */
+    scratch: string;
+    /** Persistent private writable root holding account credentials. */
+    accountHome?: string;
+    /** Extra absolute file literals admitted read-only inside the sandbox
+     * (admitted library closure, fixed config). Never directories unless the
+     * backend documents subpath semantics. */
+    readOnlyPaths?: readonly string[];
+    /** Extra absolute paths admitted read-write inside the sandbox beyond
+     * scratch/accountHome — e.g. the consumer workspace for providers whose own
+     * filesystem tools write directly rather than through a host broker. Paths
+     * must not contain or enclose the executable (unless a `protectedPaths`
+     * entry re-covers it), each other, scratch, accountHome, policyPath, the
+     * egress socket, or forwarder artifacts. */
+    readWritePaths?: readonly string[];
+    /** Read-only re-covers mounted *after* the writable binds, so a path nested
+     * inside a writable root stays immutable (e.g. a provider's install tree
+     * inside its writable state root). On seatbelt these emit deny-write
+     * rules; on bwrap they are later ro binds that shadow the rw parent. Every
+     * entry must sit inside a writable root. */
+    protectedPaths?: readonly string[];
+    /** Masked subtrees nested inside a writable root: contents stay reachable
+     * on the host but are invisible inside the sandbox (e.g. credential stores
+     * that happen to sit under a workspace bound read-write). On seatbelt
+     * these emit deny read+write rules; on bwrap they are tmpfs mounts that
+     * shadow the bound subtree. Every entry must sit inside a writable root
+     * and must never cover the executable. */
+    hiddenPaths?: readonly string[];
+    network: OsSandboxNetworkPolicy;
+    /** Canonical absolute path of a host-side egress-bridge unix socket,
+     * bind-mounted read-write. Required iff `network` is
+     * `"provider-tcp443-dns"` on a bwrap plan; refused by seatbelt, whose
+     * profile carries egress internally. */
+    egressSocket?: string;
+    /** Optional in-namespace CONNECT forwarder for stock binaries that do not
+     * consume the bridge socket natively: an admitted JS runtime plus the
+     * admitted forwarder script are bound read-only and become the namespace
+     * entry point — `runtime script <socket> <port> <lo|- > <env|- > <svc|- > -- <executable> <args>`.
+     * The forwarder binds `127.0.0.1:<port>` and launches the child with
+     * standard proxy variables, so the plan env needs no proxy keys. Requires
+     * `egressSocket`; refused by seatbelt.
+     * `envFile` is an optional absolute path inside the writable scratch or
+     * account root: when set, `wrap()` writes the invocation env there
+     * (mode 0600) and the forwarder injects it into the child, keeping every
+     * value — secret or not — out of the wrapper's command line.
+     * `service` is an optional second listener: the forwarder binds
+     * `127.0.0.1:<service.port>` inside the namespace and pipes each accepted
+     * connection to `service.socket`, a host-side unix socket bound into the
+     * namespace — the in-namespace consumption path for host services (the
+     * tool relay) that are not CONNECT egress. */
+    egressForward?: Readonly<{
+        runtime: string;
+        script: string;
+        port: number;
+        envFile?: string;
+        service?: Readonly<{
+            socket: string;
+            port: number;
+        }>;
+    }>;
+    /** Absolute path of the durable policy artifact the caller persists
+     * (`sandbox.sb`, `sandbox.json`). Identity flows into custody journals. */
+    policyPath: string;
+}>;
+export type OsSandboxWrapInput = Readonly<{
+    args: readonly string[];
+    env: Readonly<Record<string, string>>;
+    cwd: string;
+}>;
+export type OsSandboxPlan = Readonly<{
+    backend: OsSandboxBackendName;
+    /** Canonical policy bytes: SBPL text on seatbelt, canonical plan JSON on
+     * bwrap. The caller persists this verbatim at `spec.policyPath`. */
+    policy: string;
+    policySha256: string;
+    /** The wrapper executable the child process spawns. */
+    executable: string;
+    wrap(input: OsSandboxWrapInput): {
+        args: readonly string[];
+        env: Readonly<Record<string, string>>;
+    };
+}>;
+export interface OsSandboxBackend {
+    readonly name: OsSandboxBackendName;
+    plan(spec: OsSandboxSpec): Promise<OsSandboxPlan>;
+}
+/** Re-verifies an admitted executable from a checked descriptor: owner,
+ * file identity, size bound, no-follow canonical path, and exact SHA-256.
+ * The owner may be the current user or root — a root-owned system tool like
+ * a distribution `bwrap` is at least as tamper-evident as a user-owned file.
+ * Any mutation or relabel is `OS_SANDBOX_EXECUTABLE_CHANGED`; a missing or
+ * non-file path is `OS_SANDBOX_EXECUTABLE_INVALID`. */
+export declare function verifyOsSandboxExecutable(executablePath: string, sha256: string, sizeLimit: bigint): Promise<void>;
+/** Pure seatbelt planning: the wrapper argv and artifact identity for an
+ * already-reviewed SBPL profile. Exported so tests can pin the exact spawn
+ * contract on any platform; `createSeatbeltOsSandbox` adds the darwin
+ * platform gate and generator ownership. */
+export declare function planSeatbeltPolicy(input: OsSandboxSpec, policy: string): OsSandboxPlan;
+/** Pure bwrap planning: canonical policy JSON plus wrapper argv for an
+ * already-validated spec. Exported so tests can pin the exact contract on any
+ * platform; `createBwrapOsSandbox` adds the linux platform gate, the
+ * `network: "denied"` bound, and wrapper-artifact re-verification. */
+export declare function planBwrapPolicy(input: OsSandboxSpec, wrapperExecutable: string): OsSandboxPlan;
+/** macOS seatbelt backend. The SBPL policy text is host-owned admission input
+ * — the port owns wrapping, canonical identity and the durable-artifact
+ * contract. `/usr/bin/sandbox-exec` is a fixed literal: PATH cannot inject. */
+export declare function createSeatbeltOsSandbox(options: Readonly<{
+    /** Reviewed policy generator. Receives the validated spec; returns exact
+     * SBPL text. The generator, not this port, owns rule semantics. */
+    generateProfile(spec: OsSandboxSpec): string;
+}>): OsSandboxBackend;
+/** Linux bubblewrap backend, offline policy only. The wrapper binary is a
+ * second admitted artifact, re-verified at plan time. */
+export declare function createBwrapOsSandbox(options: Readonly<{
+    /** Absolute canonical path of the admitted `bwrap` binary. */
+    executable: string;
+    /** SHA-256 of the admitted `bwrap` bytes. */
+    sha256: string;
+}>): OsSandboxBackend;
+/** Composes an admitted plan onto the unchanged bounded-provider custody:
+ * argv/env are rewritten, stdout/stderr bounds, detached group custody and
+ * join semantics are untouched. The returned factory stays synchronous so it
+ * can run inside provider SDKs that spawn from a sync callback. */
+export declare function createSandboxedProviderProcessFactory(plan: OsSandboxPlan): BoundedProviderProcessFactory;