@ricsam/r5d-worker 0.0.136 → 0.0.138

package/dist/types/runtime/protocol.d.ts

@@ -0,0 +1,544 @@
+import { z } from "zod";
+export declare const EXECUTOR_CAPABILITY = "host-executor-v1";
+export declare const MAX_FRAME_BYTES: number;
+export declare const Lane: z.ZodEnum<{
+    general: "general";
+    utility: "utility";
+    control: "control";
+}>;
+export declare const ShellPayload: z.ZodObject<{
+    argv: z.ZodArray<z.ZodString>;
+    cwd: z.ZodString;
+    env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    lane: z.ZodDefault<z.ZodEnum<{
+        general: "general";
+        utility: "utility";
+        control: "control";
+    }>>;
+    interactive: z.ZodDefault<z.ZodBoolean>;
+    pty: z.ZodOptional<z.ZodObject<{
+        cols: z.ZodNumber;
+        rows: z.ZodNumber;
+    }, z.core.$strict>>;
+    credentials: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        generation: z.ZodNumber;
+    }, z.core.$strict>>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type ShellPayload = z.input<typeof ShellPayload>;
+export declare const RunIdentity: z.ZodObject<{
+    operationId: z.ZodString;
+    userId: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    fence: z.ZodObject<{
+        installationId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+        ownerId: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type RunIdentity = z.infer<typeof RunIdentity>;
+export declare const Principal: z.ZodObject<{
+    id: z.ZodString;
+    tokenHash: z.ZodString;
+    role: z.ZodEnum<{
+        controller: "controller";
+        adapter: "adapter";
+    }>;
+    ownerId: z.ZodString;
+    userIds: z.ZodArray<z.ZodString>;
+    cwdRoots: z.ZodArray<z.ZodString>;
+    lanes: z.ZodArray<z.ZodEnum<{
+        general: "general";
+        utility: "utility";
+        control: "control";
+    }>>;
+    credentialIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** Only an authenticated controller may install this immutable generation grant. */
+export declare const AdapterGrant: z.ZodObject<{
+    installationId: z.ZodString;
+    workerId: z.ZodString;
+    principal: z.ZodObject<{
+        id: z.ZodString;
+        tokenHash: z.ZodString;
+        ownerId: z.ZodString;
+        userIds: z.ZodArray<z.ZodString>;
+        cwdRoots: z.ZodArray<z.ZodString>;
+        lanes: z.ZodArray<z.ZodEnum<{
+            general: "general";
+            utility: "utility";
+            control: "control";
+        }>>;
+        credentialIds: z.ZodArray<z.ZodString>;
+        role: z.ZodLiteral<"adapter">;
+    }, z.core.$strict>;
+    hello: z.ZodObject<{
+        installationId: z.ZodString;
+        instanceId: z.ZodString;
+        releaseId: z.ZodString;
+        role: z.ZodEnum<{
+            web: "web";
+            scheduler: "scheduler";
+            runner: "runner";
+            gateway: "gateway";
+            "worker-adapter": "worker-adapter";
+            "browser-adapter": "browser-adapter";
+            executor: "executor";
+            keeper: "keeper";
+            storage: "storage";
+        }>;
+        protocol: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    artifactDigest: z.ZodString;
+}, z.core.$strict>;
+export type AdapterGrant = z.infer<typeof AdapterGrant>;
+export type AdapterRegistration = {
+    principalId: string;
+    ownerId: string;
+    releaseId: string;
+    artifactDigest: string;
+    grantDigest: string;
+    state: "registered" | "retired";
+};
+export declare const ExecutorCommand: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"adapter.register">;
+    grant: z.ZodObject<{
+        installationId: z.ZodString;
+        workerId: z.ZodString;
+        principal: z.ZodObject<{
+            id: z.ZodString;
+            tokenHash: z.ZodString;
+            ownerId: z.ZodString;
+            userIds: z.ZodArray<z.ZodString>;
+            cwdRoots: z.ZodArray<z.ZodString>;
+            lanes: z.ZodArray<z.ZodEnum<{
+                general: "general";
+                utility: "utility";
+                control: "control";
+            }>>;
+            credentialIds: z.ZodArray<z.ZodString>;
+            role: z.ZodLiteral<"adapter">;
+        }, z.core.$strict>;
+        hello: z.ZodObject<{
+            installationId: z.ZodString;
+            instanceId: z.ZodString;
+            releaseId: z.ZodString;
+            role: z.ZodEnum<{
+                web: "web";
+                scheduler: "scheduler";
+                runner: "runner";
+                gateway: "gateway";
+                "worker-adapter": "worker-adapter";
+                "browser-adapter": "browser-adapter";
+                executor: "executor";
+                keeper: "keeper";
+                storage: "storage";
+            }>;
+            protocol: z.ZodObject<{
+                min: z.ZodNumber;
+                max: z.ZodNumber;
+            }, z.core.$strict>;
+            capabilities: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        artifactDigest: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"adapter.retire">;
+    principalId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"status">;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"authority">;
+    fence: z.ZodObject<{
+        installationId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+        ownerId: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    validUntil: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"start">;
+    operation: z.ZodObject<{
+        protocol: z.ZodLiteral<1>;
+        installationId: z.ZodString;
+        operationId: z.ZodString;
+        userId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+        kind: z.ZodString;
+        fence: z.ZodObject<{
+            installationId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+            ownerId: z.ZodString;
+            epoch: z.ZodNumber;
+        }, z.core.$strict>;
+        payload: z.ZodUnknown;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"poll">;
+    run: z.ZodObject<{
+        operationId: z.ZodString;
+        userId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+        fence: z.ZodObject<{
+            installationId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+            ownerId: z.ZodString;
+            epoch: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    stdoutOffset: z.ZodDefault<z.ZodNumber>;
+    stderrOffset: z.ZodDefault<z.ZodNumber>;
+    maxBytes: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"write">;
+    run: z.ZodObject<{
+        operationId: z.ZodString;
+        userId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+        fence: z.ZodObject<{
+            installationId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+            ownerId: z.ZodString;
+            epoch: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    actionId: z.ZodString;
+    data: z.ZodString;
+    eof: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"resize">;
+    run: z.ZodObject<{
+        operationId: z.ZodString;
+        userId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+        fence: z.ZodObject<{
+            installationId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+            ownerId: z.ZodString;
+            epoch: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    actionId: z.ZodString;
+    cols: z.ZodNumber;
+    rows: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"cancel">;
+    run: z.ZodObject<{
+        operationId: z.ZodString;
+        userId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+        fence: z.ZodObject<{
+            installationId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+            ownerId: z.ZodString;
+            epoch: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    actionId: z.ZodString;
+}, z.core.$strict>], "method">;
+export type ExecutorCommand = z.input<typeof ExecutorCommand>;
+export declare const ExecutorRequest: z.ZodObject<{
+    protocol: z.ZodLiteral<1>;
+    requestId: z.ZodString;
+    auth: z.ZodObject<{
+        principalId: z.ZodString;
+        token: z.ZodString;
+    }, z.core.$strict>;
+    hello: z.ZodObject<{
+        installationId: z.ZodString;
+        instanceId: z.ZodString;
+        releaseId: z.ZodString;
+        role: z.ZodEnum<{
+            web: "web";
+            scheduler: "scheduler";
+            runner: "runner";
+            gateway: "gateway";
+            "worker-adapter": "worker-adapter";
+            "browser-adapter": "browser-adapter";
+            executor: "executor";
+            keeper: "keeper";
+            storage: "storage";
+        }>;
+        protocol: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    command: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        method: z.ZodLiteral<"adapter.register">;
+        grant: z.ZodObject<{
+            installationId: z.ZodString;
+            workerId: z.ZodString;
+            principal: z.ZodObject<{
+                id: z.ZodString;
+                tokenHash: z.ZodString;
+                ownerId: z.ZodString;
+                userIds: z.ZodArray<z.ZodString>;
+                cwdRoots: z.ZodArray<z.ZodString>;
+                lanes: z.ZodArray<z.ZodEnum<{
+                    general: "general";
+                    utility: "utility";
+                    control: "control";
+                }>>;
+                credentialIds: z.ZodArray<z.ZodString>;
+                role: z.ZodLiteral<"adapter">;
+            }, z.core.$strict>;
+            hello: z.ZodObject<{
+                installationId: z.ZodString;
+                instanceId: z.ZodString;
+                releaseId: z.ZodString;
+                role: z.ZodEnum<{
+                    web: "web";
+                    scheduler: "scheduler";
+                    runner: "runner";
+                    gateway: "gateway";
+                    "worker-adapter": "worker-adapter";
+                    "browser-adapter": "browser-adapter";
+                    executor: "executor";
+                    keeper: "keeper";
+                    storage: "storage";
+                }>;
+                protocol: z.ZodObject<{
+                    min: z.ZodNumber;
+                    max: z.ZodNumber;
+                }, z.core.$strict>;
+                capabilities: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>;
+            artifactDigest: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"adapter.retire">;
+        principalId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"status">;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"authority">;
+        fence: z.ZodObject<{
+            installationId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+            ownerId: z.ZodString;
+            epoch: z.ZodNumber;
+        }, z.core.$strict>;
+        validUntil: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"start">;
+        operation: z.ZodObject<{
+            protocol: z.ZodLiteral<1>;
+            installationId: z.ZodString;
+            operationId: z.ZodString;
+            userId: z.ZodString;
+            sessionId: z.ZodOptional<z.ZodString>;
+            kind: z.ZodString;
+            fence: z.ZodObject<{
+                installationId: z.ZodString;
+                resourceType: z.ZodString;
+                resourceId: z.ZodString;
+                ownerId: z.ZodString;
+                epoch: z.ZodNumber;
+            }, z.core.$strict>;
+            payload: z.ZodUnknown;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"poll">;
+        run: z.ZodObject<{
+            operationId: z.ZodString;
+            userId: z.ZodString;
+            sessionId: z.ZodOptional<z.ZodString>;
+            fence: z.ZodObject<{
+                installationId: z.ZodString;
+                resourceType: z.ZodString;
+                resourceId: z.ZodString;
+                ownerId: z.ZodString;
+                epoch: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        stdoutOffset: z.ZodDefault<z.ZodNumber>;
+        stderrOffset: z.ZodDefault<z.ZodNumber>;
+        maxBytes: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"write">;
+        run: z.ZodObject<{
+            operationId: z.ZodString;
+            userId: z.ZodString;
+            sessionId: z.ZodOptional<z.ZodString>;
+            fence: z.ZodObject<{
+                installationId: z.ZodString;
+                resourceType: z.ZodString;
+                resourceId: z.ZodString;
+                ownerId: z.ZodString;
+                epoch: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        actionId: z.ZodString;
+        data: z.ZodString;
+        eof: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"resize">;
+        run: z.ZodObject<{
+            operationId: z.ZodString;
+            userId: z.ZodString;
+            sessionId: z.ZodOptional<z.ZodString>;
+            fence: z.ZodObject<{
+                installationId: z.ZodString;
+                resourceType: z.ZodString;
+                resourceId: z.ZodString;
+                ownerId: z.ZodString;
+                epoch: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        actionId: z.ZodString;
+        cols: z.ZodNumber;
+        rows: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        method: z.ZodLiteral<"cancel">;
+        run: z.ZodObject<{
+            operationId: z.ZodString;
+            userId: z.ZodString;
+            sessionId: z.ZodOptional<z.ZodString>;
+            fence: z.ZodObject<{
+                installationId: z.ZodString;
+                resourceType: z.ZodString;
+                resourceId: z.ZodString;
+                ownerId: z.ZodString;
+                epoch: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        actionId: z.ZodString;
+    }, z.core.$strict>], "method">;
+}, z.core.$strict>;
+export declare const ExecutorCredential: z.ZodObject<{
+    id: z.ZodString;
+    installationId: z.ZodString;
+    userId: z.ZodString;
+    generation: z.ZodNumber;
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+    files: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>;
+export declare const ExecutorConfig: z.ZodObject<{
+    installationId: z.ZodString;
+    workerId: z.ZodString;
+    instanceId: z.ZodString;
+    releaseId: z.ZodString;
+    stateDir: z.ZodString;
+    productCredentialDirectory: z.ZodOptional<z.ZodString>;
+    capacity: z.ZodObject<{
+        general: z.ZodNumber;
+        utility: z.ZodNumber;
+        control: z.ZodNumber;
+    }, z.core.$strict>;
+    maxLeaseMs: z.ZodDefault<z.ZodNumber>;
+    maxRunMs: z.ZodDefault<z.ZodNumber>;
+    maxLogBytes: z.ZodDefault<z.ZodNumber>;
+    principals: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        tokenHash: z.ZodString;
+        role: z.ZodEnum<{
+            controller: "controller";
+            adapter: "adapter";
+        }>;
+        ownerId: z.ZodString;
+        userIds: z.ZodArray<z.ZodString>;
+        cwdRoots: z.ZodArray<z.ZodString>;
+        lanes: z.ZodArray<z.ZodEnum<{
+            general: "general";
+            utility: "utility";
+            control: "control";
+        }>>;
+        credentialIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    credentials: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        installationId: z.ZodString;
+        userId: z.ZodString;
+        generation: z.ZodNumber;
+        env: z.ZodRecord<z.ZodString, z.ZodString>;
+        files: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type ExecutorConfig = z.input<typeof ExecutorConfig>;
+export type ResolvedConfig = z.output<typeof ExecutorConfig>;
+export type Principal = ResolvedConfig["principals"][number];
+export declare const AdapterConfig: z.ZodObject<{
+    socketPath: z.ZodString;
+    principalId: z.ZodString;
+    token: z.ZodString;
+    hello: z.ZodObject<{
+        installationId: z.ZodString;
+        instanceId: z.ZodString;
+        releaseId: z.ZodString;
+        role: z.ZodEnum<{
+            web: "web";
+            scheduler: "scheduler";
+            runner: "runner";
+            gateway: "gateway";
+            "worker-adapter": "worker-adapter";
+            "browser-adapter": "browser-adapter";
+            executor: "executor";
+            keeper: "keeper";
+            storage: "storage";
+        }>;
+        protocol: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type AdapterConfig = z.input<typeof AdapterConfig>;
+export type RunReceipt = {
+    operationId: string;
+    userId: string;
+    sessionId: string | null;
+    payloadHash: string;
+    state: "accepted" | "running" | "completed" | "cancelled" | "unknown";
+    pid: number | null;
+    pty: boolean;
+    lane: z.infer<typeof Lane>;
+    stdoutBytes: number;
+    stderrBytes: number;
+    stdinClosed: boolean;
+    exitCode: number | null;
+    signal: string | null;
+    reason: string | null;
+};
+export type ActionReceipt = {
+    actionId: string;
+    state: "accepted" | "completed" | "unknown";
+};
+export type PollResult = {
+    receipt: RunReceipt;
+    stdout: {
+        base64: string;
+        nextOffset: number;
+    };
+    stderr: {
+        base64: string;
+        nextOffset: number;
+    };
+};
+export declare class ExecutorError extends Error {
+    readonly code: string;
+    /** Authenticated start rejection only: stale_fence may retry same ID; capacity_busy must not auto-retry. */
+    readonly rejectedBeforeAdmission: boolean;
+    constructor(code: string, message?: string, 
+    /** Authenticated start rejection only: stale_fence may retry same ID; capacity_busy must not auto-retry. */
+    rejectedBeforeAdmission?: boolean);
+}
+export declare function isStartNonAdmissionCode(code: unknown): code is "stale_fence" | "capacity_busy";
+export declare function isDefiniteStartRejection(error: unknown): error is ExecutorError;

package/dist/types/runtime/pty.d.ts

@@ -0,0 +1,30 @@
+export declare function preflightNativePty(): void;
+/** Node native FD keeper is a daemon child; replacing adapters cannot signal it. */
+export declare class PtySession {
+    pid: number;
+    private sequence;
+    private readonly pending;
+    private readonly child;
+    private onDataCallback?;
+    private onExitCallback?;
+    private readonly buffered;
+    private exit?;
+    readonly ready: Promise<void>;
+    constructor(input: {
+        argv: string[];
+        cwd: string;
+        env: Record<string, string>;
+        cols: number;
+        rows: number;
+    });
+    private deliverExit;
+    onData(callback: (data: Buffer) => void): void;
+    onExit(callback: (event: {
+        exitCode: number;
+        signal: number;
+    }) => void): void;
+    private request;
+    write(data: string): Promise<void>;
+    resize(cols: number, rows: number): Promise<void>;
+    kill(signal?: string): void;
+}

package/dist/types/runtime/releases/artifacts.d.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+export declare const AdapterManifest: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    installationId: z.ZodString;
+    workerId: z.ZodString;
+    hello: z.ZodObject<{
+        installationId: z.ZodString;
+        instanceId: z.ZodString;
+        releaseId: z.ZodString;
+        role: z.ZodEnum<{
+            web: "web";
+            scheduler: "scheduler";
+            runner: "runner";
+            gateway: "gateway";
+            "worker-adapter": "worker-adapter";
+            "browser-adapter": "browser-adapter";
+            executor: "executor";
+            keeper: "keeper";
+            storage: "storage";
+        }>;
+        protocol: z.ZodObject<{
+            min: z.ZodNumber;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    entrypoint: z.ZodString;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+        size: z.ZodNumber;
+        executable: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AdapterManifest = z.infer<typeof AdapterManifest>;
+export declare const bytesHash: (bytes: Uint8Array) => string;
+export declare function within(root: string, path: string): boolean;
+/** Check every ancestor, not just a leaf. World-writable sticky /tmp is allowed, symlink ancestors are not. */
+export declare function canonicalDirectory(path: string): string;
+export declare function outsideWorkspaces(path: string, workspaceRoots: string[]): void;
+/** No network, package manager, archive extraction, shell commands or in-place overwrite. */
+export declare class ImmutableAdapterArtifacts {
+    readonly root: string;
+    private readonly installationId;
+    private readonly workerId;
+    private readonly workspaceRoots;
+    constructor(root: string, installationId: string, workerId: string, workspaceRoots: string[]);
+    private approved;
+    stage(source: string, input: AdapterManifest, approvalDigest: string): string;
+    verify(input: AdapterManifest, approvalDigest: string): string;
+}

package/dist/types/runtime/releases/grants.d.ts

@@ -0,0 +1,16 @@
+import type { Database } from "bun:sqlite";
+import { type RuntimeHello } from "@ricsam/r5d-api/runtime-protocol";
+import { AdapterGrant, type AdapterRegistration, type Principal, type ResolvedConfig } from "../protocol";
+export declare const digest: (value: unknown) => string;
+/** Keeper-owned registry. Durable tombstones prevent token/owner/release rebinding after retirement. */
+export declare class AdapterGrantRegistry {
+    private readonly db;
+    private readonly config;
+    constructor(db: Database, config: ResolvedConfig);
+    private rows;
+    find(id: string): AdapterGrant | undefined;
+    hasOwner(owner: string): boolean;
+    list(): AdapterRegistration[];
+    register(controller: Principal, input: AdapterGrant, keeperHello: RuntimeHello): AdapterRegistration;
+    retire(controller: Principal, id: string, authoritativeOwner?: string): AdapterRegistration;
+}