@hraness/xcb 0.9.1

package/dist/private-file.d.ts

@@ -0,0 +1,215 @@
+import { type BigIntStats, type Stats } from "node:fs";
+import { type FileHandle } from "node:fs/promises";
+/** Canonical path ceiling shared by the private-state modules. */
+export declare const PRIVATE_PATH_MAX_LENGTH = 4096;
+/** Path byte rejection for custody paths: C0 controls, DEL, `"` and `\`. */
+export declare const PRIVATE_PATH_REJECT: RegExp;
+/** Control-byte-only rejection (C0 + DEL) for paths that permit `"` and `\`. */
+export declare const PRIVATE_CONTROL_REJECT: RegExp;
+/** C0-only rejection for sites that historically allowed DEL as well. */
+export declare const PRIVATE_C0_REJECT: RegExp;
+/** Canonical path grammar: absolute, lexically resolved, length-capped and
+ * control-clean. `resolved: false` keeps only the absolute check for sites
+ * that canonicalize through `realpath` instead of the lexical form; `reject:
+ * null` drops the character check; `maxLength: Infinity` drops the cap;
+ * `measureBytes` counts UTF-8 bytes instead of UTF-16 units (codex-host). */
+export declare function canonicalizePrivatePath(value: unknown, rule: Readonly<{
+    code: string;
+    resolved?: boolean;
+    reject?: RegExp | null;
+    maxLength?: number;
+    measureBytes?: boolean;
+}>): string;
+/** The absolute-path half of a split-code site: grammar failures and physical
+ * custody failures report different codes, so they stay two calls. */
+export declare function assertAbsolutePrivatePath(value: unknown, code: string): asserts value is string;
+/** Ownership expectation for a private file or directory. `"self"` requires
+ * the current uid and fails the site code when `getuid` is unavailable;
+ * `"selfOrThrow"` calls `getuid!()` so an absent uid check throws exactly as
+ * the replaced site did; the `OrRoot` variants additionally admit uid 0 (a
+ * root-owned system artifact is at least as tamper-evident as a user file);
+ * a number, bigint, or list is an exact uid set resolved by the caller. */
+export type PrivateOwner = "self" | "selfOrThrow" | "selfOrRoot" | "selfOrRootOrThrow" | number | bigint | readonly (number | bigint)[];
+/** One mode-predicate rule: `(mode & mask)` must equal `equals` and/or differ
+ * from `notEquals`. Examples: exact-0600 is `{ mask: 0o7777, equals: 0o600 }`;
+ * "some execute bit" is `{ mask: 0o111, notEquals: 0 }`. */
+export type PrivateModeRule = Readonly<{
+    mask: number | bigint;
+    equals?: number | bigint;
+    notEquals?: number | bigint;
+}>;
+/** The shape a private file or directory must have. `links: "single"` is the
+ * nlink===1 no-hardlink rule; `noSymlink` rejects an lstat symlink result (an
+ * O_NOFOLLOW open can never produce one, so it applies to lstat snapshots);
+ * `size.min` is an inclusive floor (`min: 1` is the nonempty check). */
+export type PrivateStatShape = Readonly<{
+    kind?: "file" | "directory";
+    owner?: PrivateOwner;
+    links?: "single";
+    mode?: readonly PrivateModeRule[];
+    size?: Readonly<{
+        min?: number | bigint;
+        max?: number | bigint;
+        equals?: number | bigint;
+    }>;
+    noSymlink?: boolean;
+}>;
+/** Boolean form of the private-stat predicate, for sites whose contract is a
+ * yes/no answer (mode repair, best-effort probes) rather than a thrown code. */
+export declare function matchesPrivateStat(metadata: Stats | BigIntStats, shape: PrivateStatShape): boolean;
+/** Throwing form of the shape predicate; `code` is the site's own error. */
+export declare function assertPrivateStat(metadata: Stats | BigIntStats, shape: PrivateStatShape, code: string): void;
+/** Comparable stat fields. `mtime`/`ctime` map to `mtimeNs`/`ctimeNs` on
+ * BigIntStats and `mtimeMs`/`ctimeMs` on Stats, preserving each site's
+ * original precision. The default set is the nine-field identity every
+ * custody module compared; sites with a narrower drift set pass a subset. */
+export type PrivateIdentityField = "dev" | "ino" | "uid" | "gid" | "mode" | "nlink" | "size" | "mtime" | "ctime";
+export declare const PRIVATE_IDENTITY_FIELDS: readonly PrivateIdentityField[];
+/** Exact field equality between two stat snapshots of the same type. Mixed
+ * Stats/BigIntStats pairs compare only the type-shared fields; a mismatched
+ * timestamp precision reports unequal (fails closed as drift). */
+export declare function sameFileIdentity(a: Stats | BigIntStats, b: Stats | BigIntStats, fields?: readonly PrivateIdentityField[]): boolean;
+/** The held-fd before/after revalidation: every `observed` snapshot must keep
+ * `before`'s identity fields. `requirePlainFile` additionally demands each
+ * observed value stay a plain non-symlink file (the codex-host rule). All
+ * snapshots come from callers that hold the descriptor open — this predicate
+ * never opens, closes, or reopens anything. */
+export declare function assertFileStable(before: Stats | BigIntStats, observed: readonly (Stats | BigIntStats)[], rule: Readonly<{
+    code: string;
+    fields?: readonly PrivateIdentityField[];
+    requirePlainFile?: boolean;
+}>): void;
+/** Assert an existing directory is canonical, physical, owner-only and
+ * private. `canonical: "self"` (default) requires `realpath(path) === path`;
+ * `"resolved"` accepts a noncanonical input whose physical form equals
+ * `resolve(path)` (codex-process). `mode: "exact"` is `(mode & 0o7777) ===
+ * 0o700` including suid/sgid/sticky rejection; `"perms"` masks only 0o777;
+ * `"ownerOnly"` accepts any mode with no group/other bits. `statOrder` keeps
+ * the site's lstat-vs-realpath call order so a missing path reports from the
+ * same syscall it used to. `metadataFirst` preserves the one short-circuiting
+ * site that rejected unsafe metadata before calling realpath. `stats: "number"`
+ * preserves the ordinary-Stats precision of its caller; bigint is the default.
+ * Returns the metadata and realpath. */
+type PrivateDirectoryRule = Readonly<{
+    code: string;
+    owner?: PrivateOwner;
+    mode?: "exact" | "perms" | "ownerOnly";
+    canonical?: "self" | "resolved";
+    statOrder?: "lstatFirst" | "realpathFirst";
+    metadataFirst?: boolean;
+    stats?: "number";
+}>;
+export declare function assertPrivateDirectory(path: string, rule: PrivateDirectoryRule & {
+    stats: "number";
+}): Promise<Readonly<{
+    metadata: Stats;
+    physical: string;
+}>>;
+export declare function assertPrivateDirectory(path: string, rule: PrivateDirectoryRule): Promise<Readonly<{
+    metadata: BigIntStats;
+    physical: string;
+}>>;
+/** Open a directory read-only+no-follow and fsync it — the durability proof
+ * for a create/unlink/rename inside it. */
+export declare function fsyncDirectory(path: string): Promise<void>;
+/** Create `path` mode 0700 if missing, fsync the parent on creation, then
+ * apply `assertPrivateDirectory` — a preexisting directory is re-verified,
+ * never trusted. */
+export declare function ensurePrivateDirectory(path: string, rule: Omit<PrivateDirectoryRule, "stats">): Promise<BigIntStats>;
+type PrivateReadOptions = Readonly<{
+    directory?: boolean;
+    nonblock?: boolean;
+    missingOk?: boolean;
+    openErrorCode?: string;
+}>;
+/** Open `path` `O_RDONLY | O_NOFOLLOW` — the stable-read descriptor every
+ * held-fd check starts from. `nonblock` defaults on (every custody site);
+ * `directory` adds O_DIRECTORY; `missingOk` maps ENOENT to null; an
+ * `openErrorCode` collapses any open failure (including ELOOP) to the site's
+ * invalid-shape code. The caller owns and must close the handle. */
+export declare function openPrivateRead(path: string, options: PrivateReadOptions & {
+    missingOk: true;
+}): Promise<FileHandle | null>;
+export declare function openPrivateRead(path: string, options?: PrivateReadOptions): Promise<FileHandle>;
+type PrivateWriteOptions = Readonly<{
+    mode?: number;
+    exclusive?: boolean;
+    nofollow?: boolean;
+    append?: boolean;
+    truncate?: boolean;
+    create?: boolean;
+}>;
+/** Open `path` `O_WRONLY | O_CREAT` for a private write. `exclusive` (default)
+ * adds O_EXCL — atomic create-once; `nofollow` (default) adds O_NOFOLLOW;
+ * `append` adds O_APPEND (append-only journals); `truncate` adds O_TRUNC for
+ * the staged-temp rewrite pattern; `create: false` drops O_CREAT so reopening
+ * an already-durable journal still asserts the inode exists. The caller owns
+ * and must close the handle. */
+export declare function openPrivateWrite(path: string, options?: PrivateWriteOptions): Promise<FileHandle>;
+/** Synchronous `openPrivateWrite` for the journal descriptors held across a
+ * launch: custody must be provable inside synchronous state machines. */
+export declare function openPrivateWriteSync(path: string, options?: PrivateWriteOptions): number;
+/** Atomic create-once durable write: O_EXCL no-follow create at `mode`
+ * (default 0600), the contents, an optional file fsync, close, and an
+ * optional parent-directory fsync. `nofollow`/`truncate`/`append` forward to
+ * the same flag grammar as `openPrivateWrite` (Node's `"wx"` flag is
+ * `nofollow: false, truncate: true`). Callers whose ownership flag must flip
+ * between open and write use `openPrivateWrite` directly. */
+export declare function writeFileOnce(path: string, contents: string | Uint8Array, options?: PrivateWriteOptions & Readonly<{
+    syncFile?: boolean;
+    syncParent?: boolean;
+}>): Promise<void>;
+/** Bounded position-zero read through a held descriptor. `growth` sizes the
+ * allocation one byte larger; `loop` retries short reads to EOF/capacity;
+ * `into` preserves a caller-owned buffer and its zeroization semantics. No
+ * exact-size verdict is made here because several sites collect post-read
+ * stats before that verdict. */
+export declare function readFdBounded(fd: FileHandle, size: number | bigint, options?: Readonly<{
+    growth?: boolean;
+    loop?: boolean;
+    into?: Buffer;
+}>): Promise<Readonly<{
+    buffer: Buffer;
+    bytesRead: number;
+}>>;
+/** `readFdBounded` plus an immediate exact-size and optional byte-equality
+ * verdict. Returns exactly `size` verified bytes. */
+export declare function readFdExact(fd: FileHandle, size: number | bigint, options: Readonly<{
+    code: string;
+    contents?: Uint8Array;
+    growth?: boolean;
+    loop?: boolean;
+    into?: Buffer;
+}>): Promise<Buffer>;
+/** Stream at most `size`+1 bytes from position 0 through `onChunk`. Reads are
+ * bounded by `size`+1 so growth is always detectable; the return value is the
+ * consumed count and the caller compares it at its own verdict position —
+ * sites disagree on where that verdict lands relative to their post-read
+ * stats, so it is deliberately not asserted here. `earlyGrowth` fails `code`
+ * inside the loop (sites whose replaced loop asserted `read <= size`
+ * mid-loop); out-of-range reads always fail `code`. The descriptor stays
+ * open and owned by the caller. */
+export declare function streamFdContent(fd: FileHandle, size: number | bigint, options: Readonly<{
+    code: string;
+    onChunk: (chunk: Buffer) => void | Promise<void>;
+    chunkBytes?: number;
+    earlyGrowth?: boolean;
+}>): Promise<number>;
+/** The exact-content private file: optionally durable-create when absent
+ * (EEXIST tolerated — a prior run may have left it), then open no-follow,
+ * require a 0600 single-link self-owned file of exactly `contents`' length,
+ * read and byte-compare it through the held descriptor, and revalidate the
+ * identity against a post-read fstat and fresh lstat. `statsEarly` collects
+ * those two snapshots before the content check (the browser/account order);
+ * `stableCode`/`stablePlainFile` model the codex-host stability predicate
+ * where identity drift reports a different code than content drift. */
+export declare function readExactPrivateFile(path: string, contents: string, options: Readonly<{
+    invalidCode: string;
+    changedCode: string;
+    create?: boolean;
+    loop?: boolean;
+    statsEarly?: boolean;
+    stableCode?: string;
+    stablePlainFile?: boolean;
+}>): Promise<void>;
+export {};

package/dist/process-port.d.ts

@@ -0,0 +1,44 @@
+/** Trusted host process boundary. This is an in-memory adapter contract, not a
+ * wire protocol, launch API, runtime qualification or authority to signal PIDs.
+ * The host owns artifact admission, launch policy and durable account custody. */
+export type ProviderProcessBinding = Readonly<{
+    version: 1;
+    nonce: string;
+    scope: "posix-process-group" | "windows-job";
+}>;
+export type ProviderProcessWriteResult = Readonly<{
+    outcome: "accepted-full" | "refused-before-write" | "partial-known" | "indeterminate";
+    acceptedBytes: number;
+}>;
+export type ProviderProcessSettlement = Readonly<{
+    kind: "joined" | "not-started";
+    binding: ProviderProcessBinding;
+}>;
+export interface ProviderProcessPort {
+    /** Resolves only after runtime readiness and the host's durable Ready commit. */
+    readonly ready: Promise<unknown>;
+    /** Root observation only. Neither root exit nor a rejected launch proves join. */
+    readonly rootExited: Promise<unknown>;
+    /** The trusted owner resolves this only after exact scope, native stream EOF,
+     * supervisor and control work join, or exact proof that launch never started.
+     * Operation or JavaScript delivery failure does not invalidate that proof. */
+    readonly joined: Promise<ProviderProcessSettlement>;
+    /** Operation result, separate from custody. Success includes consumer drain;
+     * rejection may precede physical join and must never be reinterpreted as it. */
+    readonly transportCompleted: Promise<void>;
+    readonly stdout: AsyncIterable<Uint8Array>;
+    readonly stderr: AsyncIterable<Uint8Array>;
+    /** Makes its admission decision synchronously when called, with no queue
+     * behind an outstanding provider write. It never retries uncertain bytes. */
+    write(bytes: Uint8Array): Promise<ProviderProcessWriteResult>;
+    closeInput(): Promise<void>;
+    /** Both calls revoke new writes synchronously and retain observation. Stop
+     * uses the exact owned handle, including a launch that is not ready yet. */
+    requestStop(): void;
+    forceStop(): void;
+}
+export declare function snapshotProviderProcessBinding(value: unknown): ProviderProcessBinding;
+export declare function sameProviderProcessBinding(a: ProviderProcessBinding, b: ProviderProcessBinding): boolean;
+/** Validate byte acceptance without treating a successful write as a successful
+ * RPC. Extra host receipt fields stay outside this product adapter. */
+export declare function providerProcessWriteResult(value: unknown, byteLength: number): ProviderProcessWriteResult;

package/dist/process-write.d.ts

@@ -0,0 +1,13 @@
+import { type ProviderProcessWriteResult } from "./process-port.ts";
+/** Product-owned serialization. A deadline revokes queued writes immediately;
+ * the original admitted write remains owned until its receipt settles. */
+export declare function createProcessWriteQueue(options: Readonly<{
+    write(bytes: Uint8Array): Promise<ProviderProcessWriteResult>;
+    assertActive(): void;
+    failed(): void;
+    timeoutMs: number;
+}>): Readonly<{
+    write(bytes: Uint8Array): Promise<void>;
+    stop(): void;
+    settled(): Promise<void>;
+}>;

package/dist/provider-process.d.ts

@@ -0,0 +1,26 @@
+import type { SpawnedProcess } from "@anthropic-ai/claude-agent-sdk";
+export type BoundedProviderProcessInput = Readonly<{
+    executable: string;
+    args: readonly string[];
+    cwd: string;
+    env: Readonly<Record<string, string>>;
+    onViolation: () => void;
+}>;
+export type BoundedProviderProcess = Readonly<{
+    process: SpawnedProcess;
+    stopAndJoin(): Promise<void>;
+    isStopped(): boolean;
+}>;
+/** Trusted application factory. Return an owned handle synchronously, including
+ * failed readiness; never reject after a possible launch without retaining it.
+ * Exact shared-artifact admission, durable launch/Ready fences and native join
+ * belong to the application. This signature creates no runtime qualification. */
+export type BoundedProviderProcessFactory = (input: BoundedProviderProcessInput & Readonly<{
+    binding: Readonly<{
+        runId: string;
+        accountId: string;
+        workspaceId: string;
+    }>;
+}>) => BoundedProviderProcess;
+/** Host-owned subprocess custody. Model-controlled tools cannot call this module. */
+export declare function spawnBoundedProvider(input: BoundedProviderProcessInput): BoundedProviderProcess;

package/dist/public-web.d.ts

@@ -0,0 +1,21 @@
+import { type PublicWeb } from "./broker.ts";
+/** Conservative public-unicast policy. Mapped IPv4, transition and special-use ranges fail closed. */
+export declare function isPublicAddress(address: string): boolean;
+type Address = Readonly<{
+    address: string;
+    family: number;
+}>;
+type WebResponse = Readonly<{
+    status: number;
+    location?: string;
+    text?: string;
+}>;
+/** Trusted host IO seam, useful for deterministic DNS/redirect qualification. Never a model tool. */
+export interface PublicWebIO {
+    resolve(hostname: string): Promise<readonly Address[]>;
+    get(url: URL, address: Address, maxBytes: number, signal: AbortSignal): Promise<WebResponse>;
+}
+export declare const nodePublicWebIO: PublicWebIO;
+/** Bounded public HTTPS GETs. Every redirect repeats DNS admission and pins one approved address. */
+export declare function createPublicWeb(io?: PublicWebIO): PublicWeb;
+export {};

package/dist/router.d.ts

@@ -0,0 +1,43 @@
+import type { AccountLeaseStore } from "./accounts.ts";
+import type { CapabilityBroker } from "./capabilities.ts";
+import { type AgentTaskAdapter, type AgentTaskRequest, type AgentTaskResult, type AgentTaskRoute } from "./task-runtime.ts";
+import { type AgentProvider } from "./validation.ts";
+/**
+ * The caller-facing request: `route` resolves by `provider` + `authentication`
+ * against the registered adapters when it is not given exactly, and `runId` /
+ * `workspaceId` default to the broker's own binding. Every other field keeps
+ * the task-runtime contract — the router validates nothing the runtime would
+ * not recheck.
+ */
+export type RouterTaskRequest = Omit<AgentTaskRequest, "route" | "runId" | "workspaceId" | "signal"> & Readonly<{
+    /** Exact route object; required when one provider registers several. */
+    route?: AgentTaskRoute;
+    /** Resolve the registered route for this provider. */
+    provider?: AgentProvider;
+    /** With `provider`, selects the route's authentication kind. */
+    authentication?: AgentTaskRoute["authentication"];
+    runId?: string;
+    workspaceId?: string;
+    signal?: AbortSignal;
+}>;
+export type SubscriptionRouter = Readonly<{
+    /**
+     * The adapter-registered routes this router can dispatch to. Registration is
+     * not eligibility: account custody, credentials and qualification evidence
+     * are proven when a task runs, never by listing.
+     */
+    routes(): readonly AgentTaskRoute[];
+    run(request: RouterTaskRequest, broker: CapabilityBroker): Promise<AgentTaskResult>;
+}>;
+export type SubscriptionRouterOptions = Readonly<{
+    /** Host-owned custody store, e.g. `new SqliteAccountLeases(db)`. */
+    leases: AccountLeaseStore;
+    adapters: readonly AgentTaskAdapter[];
+    now?: () => number;
+}>;
+/**
+ * One construction call for the embeddable subscription router: an account
+ * lease store plus qualified task adapters. There is no bundled live adapter
+ * and no credential discovery — the host still supplies both.
+ */
+export declare function createSubscriptionRouter(options: SubscriptionRouterOptions): SubscriptionRouter;

package/dist/runtime.d.ts

@@ -0,0 +1,90 @@
+import type { AccountLeaseStore } from "./accounts.ts";
+import type { ToolBroker } from "./broker.ts";
+import type { CapabilityBroker } from "./capabilities.ts";
+import { type AgentTaskAdapter, type AgentTaskRequest, type AgentTaskResult } from "./task-runtime.ts";
+import { type AgentProvider } from "./validation.ts";
+export declare const CONTACT_TOOL_PROFILE: "xcb.scoped-tools.v1";
+export type RuntimeQualification = Readonly<{
+    status: "unqualified";
+    reason: string;
+}> | Readonly<{
+    status: "qualified";
+    profile: typeof CONTACT_TOOL_PROFILE;
+    runtimeVersion: string;
+    runtimeDigest: string;
+    evidenceDigest: string;
+    expiresAt: number;
+    controls: Readonly<{
+        noCommandTools: true;
+        exactToolInventory: true;
+        contactReadIsolation: true;
+        contactWriteIsolation: true;
+        isolatedConfiguration: true;
+        authOutsideWorkspace: true;
+        hostBrokerOnly: true;
+    }>;
+}>;
+export type AgentRunRequest = Readonly<{
+    runId: string;
+    provider: AgentProvider;
+    accountId: string;
+    workspaceId: string;
+    prompt: string;
+    model: string;
+    purpose: "classify" | "respond";
+    signal: AbortSignal;
+}>;
+export type AgentRunResult = Readonly<{
+    output: unknown;
+    /** Must prove provider process exit or fenced controller release, even after errors. */
+    processStopped: true;
+}>;
+/** An adapter may use this only after independently joining every process it started. */
+export declare class AgentStoppedError extends Error {
+    readonly processStopped = true;
+}
+export interface AgentAdapter {
+    readonly provider: AgentProvider;
+    readonly qualification: RuntimeQualification;
+    run(request: AgentRunRequest, broker: ToolBroker): Promise<AgentRunResult>;
+}
+export declare const UNQUALIFIED_PROVIDER_REASONS: Readonly<{
+    codex: "Codex 0.153.4 has a restricted experimental driver; native confinement, adversarial custody and account transport qualification remain incomplete.";
+    claude: "Claude tool selection is documented; isolated configuration and contact-only read confinement require exact-runtime adversarial qualification.";
+    devin: "Devin ACP exposes session and usage facts; exact-runtime custody, tool-inventory and read/write confinement qualification remain incomplete.";
+}>;
+/** Installed adapters explicitly advertise blocked status until their host evidence exists. */
+export declare function unqualifiedAdapter(selected: AgentProvider): AgentAdapter;
+export type AccountBinding = Readonly<{
+    provider: AgentProvider;
+    accountId: string;
+    authBindingId: string;
+}>;
+/** The trusted adapter resolves this opaque handle; the broker/model never receives credentials. */
+export interface AccountResolver {
+    resolve(provider: AgentProvider, accountId: string): Promise<AccountBinding>;
+}
+export declare class Xcb {
+    private readonly options;
+    private readonly taskAdapters;
+    constructor(options: {
+        adapters: readonly AgentAdapter[];
+        taskAdapters?: readonly AgentTaskAdapter[];
+        leases: AccountLeaseStore;
+        now: () => number;
+    });
+    /** Additive execution path for an application's exact capability profile. */
+    runTask(request: AgentTaskRequest, broker: CapabilityBroker): Promise<AgentTaskResult>;
+    run(request: AgentRunRequest, broker: ToolBroker): Promise<AgentRunResult>;
+    private runAdmitted;
+}
+export declare function assertQualified(value: RuntimeQualification, now: number): void;
+export type ProviderLaunchPlan = Readonly<{
+    provider: AgentProvider;
+    status: "unqualified";
+    authBindingId: string;
+    workspaceId: string;
+    /** Configuration intent, not an executable security claim. Host adapter must qualify it. */
+    configuration: Readonly<Record<string, unknown>>;
+}>;
+export declare function createProviderLaunchPlan(binding: AccountBinding, workspaceId: string): ProviderLaunchPlan;

package/dist/sqlite-port.d.ts

@@ -0,0 +1,29 @@
+export type SqliteBinding = string | number | bigint | boolean | null | Uint8Array;
+export interface SqliteStatement<Row, _Params extends SqliteBinding[] = SqliteBinding[]> {
+    get(...params: unknown[]): Row | null;
+    all(...params: unknown[]): Row[];
+    run(...params: unknown[]): {
+        changes: number;
+    };
+}
+export interface SqliteDatabase {
+    exec(sql: string): void;
+    query<Row = unknown, Params extends SqliteBinding[] = SqliteBinding[]>(sql: string): SqliteStatement<Row, Params>;
+    close(): void;
+}
+type NativeStatement = {
+    get(...params: never[]): unknown;
+    all(...params: never[]): unknown[];
+    run(...params: never[]): {
+        changes: number | bigint;
+    };
+    finalize?(): void;
+};
+type NativeDatabase = {
+    exec(sql: string): unknown;
+    prepare(sql: string): NativeStatement;
+    close(): void;
+};
+export declare function wrapSqliteDatabase(database: NativeDatabase, journal?: "WAL" | "DELETE"): SqliteDatabase;
+export declare function openAccountDatabase(path: string, journal?: "WAL" | "DELETE"): Promise<SqliteDatabase>;
+export {};

package/dist/task-runtime.d.ts

@@ -0,0 +1,150 @@
+import type { AccountLease, AccountLeaseStore } from "./accounts.ts";
+import { type CapabilityBroker, type CapabilityProfileIdentity } from "./capabilities.ts";
+import { type AgentProvider } from "./validation.ts";
+export type AgentTaskRoute = Readonly<{
+    id: string;
+    provider: AgentProvider;
+    authentication: "subscription" | "api";
+}>;
+export type AgentTaskModel = Readonly<{
+    id: string;
+    reasoningEffort: string | null;
+    serviceTier: string | null;
+}>;
+/** Freshness proof supplied only by a trusted managed-account handoff. It is
+ * provenance, not permission: the runtime still requires its normal lease and
+ * qualification checks. */
+export type AgentTaskAuthority = Readonly<{
+    kind: "codex-managed";
+    accountGeneration: number;
+    modelCatalogDigest: string;
+}>;
+export type AgentTaskLimits = Readonly<{
+    maxRunMs: number;
+    maxCleanupMs: number;
+    maxOutputBytes: number;
+}>;
+export type TaskRuntimeQualification = Readonly<{
+    status: "unqualified";
+    reason: string;
+}> | Readonly<{
+    status: "qualified";
+    route: AgentTaskRoute;
+    profile: CapabilityProfileIdentity;
+    runtimeVersion: string;
+    runtimeDigest: string;
+    evidenceDigest: string;
+    expiresAt: number;
+    controls: Readonly<{
+        noCommandTools: true;
+        exactToolInventory: true;
+        workspaceReadIsolation: true;
+        workspaceWriteIsolation: true;
+        isolatedConfiguration: true;
+        authOutsideWorkspace: true;
+        hostBrokerOnly: true;
+    }>;
+}>;
+export type AgentTaskRequest = Readonly<{
+    route: AgentTaskRoute;
+    accountId: string;
+    workspaceId: string;
+    runId: string;
+    profile: CapabilityProfileIdentity;
+    model: AgentTaskModel;
+    purpose: string;
+    prompt: string;
+    limits: AgentTaskLimits;
+    signal: AbortSignal;
+    authority?: AgentTaskAuthority;
+}>;
+export type AgentTaskRuntimeProof = Readonly<{
+    runtimeVersion: string;
+    runtimeDigest: string;
+    evidenceDigest: string;
+    qualificationExpiresAt: number;
+}>;
+/** Runtime-owned snapshot of the one acquired lease. Its values may be retained
+ * as evidence; a reconstructed object never grants execution authority. */
+export type AgentTaskAccountLease = AccountLease;
+export type AgentTaskBinding = Readonly<{
+    route: AgentTaskRoute;
+    accountId: string;
+    workspaceId: string;
+    runId: string;
+    profile: CapabilityProfileIdentity;
+    model: AgentTaskModel;
+    runtime: AgentTaskRuntimeProof;
+    accountLease: AgentTaskAccountLease;
+    authority?: AgentTaskAuthority;
+}>;
+export type AgentTaskExecutionRequest = AgentTaskRequest & Readonly<{
+    runtime: AgentTaskRuntimeProof;
+    accountLease: AgentTaskAccountLease;
+    admittedAtUnixMs: number;
+    executionDeadlineUnixMs: number;
+    cleanupDeadlineUnixMs: number;
+}>;
+export type AgentTaskUsage = Readonly<{
+    inputTokens: number | null;
+    outputTokens: number | null;
+    totalTokens: number | null;
+    costUsd: number | null;
+}>;
+export type AgentTaskOutcome = Readonly<{
+    status: "completed" | "failed" | "cancelled" | "deadline-exceeded";
+    code: string | null;
+}>;
+export type AgentTaskCompletion = AgentTaskBinding & Readonly<{
+    output: string | null;
+    usage: AgentTaskUsage;
+    outcome: AgentTaskOutcome;
+}>;
+export type AgentTaskStopReason = "completed" | "failed" | "cancelled" | "deadline-exceeded";
+/** Trusted adapter evidence, never inferred from a signal, timeout or lease expiry. */
+export type AgentTaskStopEvidence = AgentTaskBinding & Readonly<{
+    processStopped: true;
+    controllersStopped: true;
+    joined: true;
+    stoppedAtUnixMs: number;
+    proofDigest: string;
+}>;
+export type AgentTaskResult = AgentTaskCompletion & Readonly<{
+    stop: AgentTaskStopEvidence;
+    timing: Readonly<{
+        admittedAtUnixMs: number;
+        executionDeadlineUnixMs: number;
+        cleanupDeadlineUnixMs: number;
+        outerDeadlineUnixMs: number;
+        joinedAtUnixMs: number;
+        cleanupDeadlineExceeded: boolean;
+    }>;
+    brokerJoined: true;
+    custody: "released";
+}>;
+export interface AgentTaskAdapter {
+    readonly route: AgentTaskRoute;
+    readonly runtime: Readonly<{
+        version: string;
+        digest: string;
+    }>;
+    readonly qualification: TaskRuntimeQualification;
+    run(request: AgentTaskExecutionRequest, broker: CapabilityBroker): Promise<AgentTaskCompletion>;
+    /** Must work while run is pending; settle only after every owned controller/process joins.
+     * This request copy carries the actual cleanup deadline, capped by the original outer deadline. */
+    stop(request: AgentTaskExecutionRequest, reason: AgentTaskStopReason): Promise<AgentTaskStopEvidence>;
+}
+export type AgentTaskOptions = Readonly<{
+    adapters: readonly AgentTaskAdapter[];
+    leases: AccountLeaseStore;
+    now(): number;
+}>;
+/** Check runtime provenance without minting authority. Adapters must retain the
+ * original lease reference and signal when copying a request. Cancellation can
+ * narrow stop's cleanup deadline; it cannot authorize another run or lease. */
+export declare function assertAgentTaskAccountLease(request: AgentTaskExecutionRequest, phase?: "run" | "stop"): AgentTaskAccountLease;
+/** Admission only: no bundled live adapter, credential discovery or route fallback.
+ * Native adapters must enforce supplied deadlines outside this JS event loop. This
+ * owner never races past unresolved run/stop/handler promises or claims force-stop.
+ */
+export declare function runAgentTask(options: AgentTaskOptions, input: AgentTaskRequest, broker: CapabilityBroker): Promise<AgentTaskResult>;

package/dist/validation.d.ts

@@ -0,0 +1,6 @@
+export declare function object(value: unknown, keys: readonly string[]): Record<string, unknown>;
+export declare function boundedText(value: unknown, maxBytes: number, empty?: boolean): string;
+export declare function identifier(value: unknown): string;
+export declare function safeInteger(value: unknown, min: number, max: number): number;
+export type AgentProvider = "codex" | "claude" | "devin";
+export declare function provider(value: unknown): AgentProvider;