@skill-harness/adapters 0.16.0 → 0.18.0

package/dist/codex-subscription.d.ts

@@ -1,114 +0,0 @@
-import { type CodexDiagnosticModelPin } from './codex-diagnostic-model.js';
-import { inspectCodexRoleSeparation, type LocalCodexInvocation } from './codex-host-observer.js';
-import type { CodexSdkBinding, CodexWire } from './codex-sdk-transport.js';
-import { type CodexProducerApi, type CodexProducerBinding } from './codex-producer-ipc.js';
-/** Original capabilities from one pinned producer graph. Queued permits count as active.
- * The caller supplies the existing owner; this entry never mints a replacement budget. */
-export interface CodexQualificationSource {
-    producer: CodexProducerApi & {
-        producerIpcDemand(binding: CodexProducerBinding): any;
-    };
-    owner: {
-        reserveBatch(demands: any[]): Promise<readonly {
-            settle(outcome: 'cancelled'): Promise<void>;
-        }[]>;
-    };
-    bindings: CodexProducerBinding[];
-    signal: AbortSignal;
-}
-export declare const CODEX_RUNTIME_FILES: readonly string[];
-export declare const SUBSCRIPTION_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
-export interface CodexCharter {
-    version: 'codex-synthetic-charter-v1';
-    provider: 'openai-codex';
-    destination: string;
-    rolePolicy: Parameters<typeof inspectCodexRoleSeparation>[0];
-    identityEvidence: {
-        kind: 'fixture' | 'unresolved' | 'host-resolved';
-        reference: string | null;
-    };
-    hostEvidence: {
-        kind: 'fixture' | 'unqualified' | 'qualified-host';
-        reference: string | null;
-    };
-    accountId: string | null;
-    serverOutputTokenCap: null;
-    runtime: {
-        sdkRoot: string;
-        oauthFile: string;
-        fingerprints: Record<string, string>;
-    };
-    limits: {
-        calls: number;
-        requestBytes: number;
-        responseBytes: number;
-        totalRequestBytes: number;
-        totalResponseBytes: number;
-        callMs: number;
-        wallMs: number;
-    };
-    invocations: LocalCodexInvocation[];
-    diagnosticModel?: CodexDiagnosticModelPin;
-}
-/** A trusted-host approval input, not a signature or a user-consent detector.
- * Neither a subject frame nor the charter itself can supply this separate input. */
-export interface CodexApproval {
-    scope: 'fixture' | 'subscription-live';
-    charterSha256: string;
-    approvalId: string;
-    expiresAt: number;
-    journalPath: string;
-}
-export interface CodexOAuth {
-    type: 'oauth';
-    provider: 'openai-codex';
-    access: string;
-    expires: number;
-    accountId: string;
-}
-export interface CodexCredentialPort {
-    kind: 'fixture-oauth' | 'oauth-snapshot';
-    read(signal: AbortSignal): Promise<unknown>;
-}
-export interface CodexHttpPort {
-    kind: 'fixture-http' | 'subscription-http';
-    preflight?(): void;
-    exchange(wire: CodexWire, credential: CodexOAuth, signal: AbortSignal, record: (v: Record<string, unknown>) => void, limits: CodexCharter['limits']): Promise<Response>;
-}
-export interface CodexExecutionPorts {
-    bindings: Record<string, CodexSdkBinding>;
-    credentials: CodexCredentialPort;
-    transport: CodexHttpPort;
-}
-export declare const codexCharterHash: (charter: CodexCharter) => string;
-export declare function validateCodexCharter(raw: CodexCharter, approval: CodexApproval | undefined): CodexCharter;
-export declare function validateCodexOAuth(value: unknown, accountId: string, mode: 'fixture' | 'subscription-live'): CodexOAuth;
-/** Lazy read-only SDK storage adapter. list FIRST: an API-key entry never reaches read(),
- * so command/env key helpers are unavailable. Never refresh/modify/login or persist secrets. */
-export declare function createReadOnlyCodexOAuthPort(factory: () => {
-    list(o?: {
-        signal: AbortSignal;
-    }): Promise<Array<{
-        providerId: string;
-        type: string;
-    }>>;
-    read(id: string, o?: {
-        signal: AbortSignal;
-    }): Promise<any>;
-}): CodexCredentialPort;
-/** Bounded, no-follow read of the explicitly approved file, invoked lazily AFTER approval.
- * Whole JSON is parsed in trusted host memory; only OAuth is returned, never helper resolution. */
-export declare function createCodexOAuthFilePort(path: string): CodexCredentialPort;
-/** Fixed synthetic evaluation only. Model votes select a conditional third judge, never
- * a worker, grant, production action or adoption. Same journal owns all reservations/results. */
-export declare function executeCodexQualification(path: string, raw: CodexCharter, rawApproval: CodexApproval | undefined, ports: CodexExecutionPorts): Promise<Record<string, unknown>>;
-/** Explicit opt-in; never silently substitutes producer backing for host frames. */
-export declare function executeProducerCodexQualification(path: string, raw: CodexCharter, rawApproval: CodexApproval | undefined, ports: CodexExecutionPorts, source: CodexQualificationSource): Promise<Record<string, unknown>>;
-export interface CodexSingleRequestApproval extends Omit<CodexApproval, 'scope'> {
-    scope: 'fixture-single-request' | 'subscription-single-request';
-    approvedCalls: 1;
-}
-export declare function assertCodexSingleRequestPlan(c: CodexCharter): void;
-export declare function validateCodexSingleRequestCharter(raw: CodexCharter, a: CodexSingleRequestApproval | undefined): CodexCharter;
-/** Separate one-call authority; five charged original permits are never five callable roles. */
-export declare function executeProducerCodexSingleRequest(path: string, raw: CodexCharter, a: CodexSingleRequestApproval | undefined, ports: CodexExecutionPorts, source: CodexQualificationSource): Promise<Record<string, unknown>>;

package/dist/codex-subscription.js

@@ -1,268 +0,0 @@
-import { loadCodexDiagnosticModel } from './codex-diagnostic-model.js';
-import { existsSync, realpathSync } from 'node:fs';
-import { dirname, isAbsolute, resolve } from 'node:path';
-import { collapseVotePanel } from '@skill-harness/core';
-import { Readable } from 'node:stream';
-import { learningCopy, learningHash, learningJournal, learningFile } from './learning-journal.js';
-import { createLocalCodexHost, openLocalCodexHost, inspectCodexRoleSeparation } from './codex-host-observer.js';
-import { startCodexProducerIpc, validateCodexProducerBinding } from './codex-producer-ipc.js';
-export const CODEX_RUNTIME_FILES = Object.freeze(['node_modules/@earendil-works/pi-ai/dist/api/openai-codex-responses.js', 'node_modules/@earendil-works/pi-ai/dist/api/openai-responses-shared.js', 'node_modules/@earendil-works/pi-ai/dist/providers/data/openai-codex.json', 'dist/core/auth-storage.js']);
-export const SUBSCRIPTION_ENDPOINT = 'https://chatgpt.com/backend-api/codex/responses';
-const closed = (x, keys) => { if (!x || Object.keys(x).sort().join() !== keys.sort().join())
-    throw Error('invalid execution charter'); };
-export const codexCharterHash = (charter) => learningHash(charter);
-export function validateCodexCharter(raw, approval) { return validateCharter(raw, approval); }
-function validateCharter(raw, approval, single = false) {
-    const c = learningCopy(raw);
-    closed(c, ['version', 'provider', 'destination', 'rolePolicy', 'identityEvidence', 'hostEvidence', 'accountId', 'serverOutputTokenCap', 'runtime', 'limits', 'invocations', ...(single && c.diagnosticModel ? ['diagnosticModel'] : [])]);
-    if (c.version !== 'codex-synthetic-charter-v1' || c.provider !== 'openai-codex' || c.destination !== SUBSCRIPTION_ENDPOINT || c.serverOutputTokenCap !== null)
-        throw Error('unsupported execution charter route/server guarantee');
-    closed(c.runtime, ['sdkRoot', 'oauthFile', 'fingerprints']);
-    if (!isAbsolute(c.runtime.sdkRoot) || !isAbsolute(c.runtime.oauthFile) || !c.runtime.fingerprints || !Object.values(c.runtime.fingerprints).every(h => /^[a-f0-9]{64}$/.test(h)))
-        throw Error('unbound host runtime');
-    const l = c.limits;
-    closed(l, ['calls', 'requestBytes', 'responseBytes', 'totalRequestBytes', 'totalResponseBytes', 'callMs', 'wallMs']);
-    if (!Object.values(l).every(n => Number.isSafeInteger(n) && n > 0) || l.calls !== 5 || l.requestBytes > 4096 || l.responseBytes > 16384 || l.callMs > 30000 || l.wallMs > 150000 || l.totalRequestBytes > 20480 || l.totalResponseBytes > 81920 || l.totalRequestBytes < l.requestBytes || l.totalResponseBytes < l.responseBytes)
-        throw Error('invalid aggregate reservation');
-    const separation = inspectCodexRoleSeparation(c.rolePolicy);
-    if (separation.state === 'BLOCKED')
-        throw Error(separation.reason);
-    if (!Array.isArray(c.invocations) || c.invocations.length !== 5 || c.invocations.map(i => i.role).join() !== 'proposer,subject,judge,judge,judge' || new Set(c.invocations.map(i => i.id)).size !== 5 || c.invocations.slice(2).some(i => i.subjectId !== c.invocations[1].id))
-        throw Error('fixed five-role context policy required');
-    if (!approval)
-        throw Error('missing execution approval');
-    closed(approval, ['scope', 'charterSha256', 'approvalId', 'expiresAt', 'journalPath']);
-    if (!['fixture', 'subscription-live'].includes(approval.scope) || approval.charterSha256 !== codexCharterHash(c) || typeof approval.approvalId !== 'string' || !approval.approvalId || !Number.isSafeInteger(approval.expiresAt) || approval.expiresAt <= Date.now())
-        throw Error('execution approval mismatch/expired');
-    for (const e of [c.identityEvidence, c.hostEvidence])
-        closed(e, ['kind', 'reference']);
-    if (typeof c.accountId !== 'string' || !c.accountId || c.accountId.length > 256 || /[\r\n]/.test(c.accountId))
-        throw Error('unresolved approved account binding');
-    if (approval.scope === 'subscription-live' && Object.keys(c.runtime.fingerprints).sort().join() !== [...CODEX_RUNTIME_FILES].sort().join())
-        throw Error('unpinned production SDK runtime');
-    if (approval.scope === 'subscription-live' && (c.identityEvidence.kind !== 'host-resolved' || !c.identityEvidence.reference || c.hostEvidence.kind !== 'qualified-host' || !c.hostEvidence.reference || c.accountId.startsWith('fixture-')))
-        throw Error('production canonical/host qualification unresolved');
-    if (approval.scope === 'fixture' && (c.identityEvidence.kind !== 'fixture' || c.hostEvidence.kind !== 'fixture'))
-        throw Error('fixture provenance required');
-    return c;
-}
-export function validateCodexOAuth(value, accountId, mode) {
-    try {
-        const v = value;
-        if (v.type !== 'oauth' || v.provider !== 'openai-codex' || typeof v.access !== 'string' || v.access.length > 16384 || !Number.isFinite(v.expires) || v.expires <= Date.now() || v.accountId !== accountId)
-            throw Error();
-        const parts = v.access.split('.');
-        if (parts.length !== 3 || parts.some(p => !p || !/^[A-Za-z0-9_-]+$/.test(p)) || mode === 'subscription-live' && (parts[0] === 'fixture' || parts[2] === 'invalid'))
-            throw Error();
-        const claim = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-        if (claim['https://api.openai.com/auth']?.chatgpt_account_id !== accountId)
-            throw Error();
-        return { type: 'oauth', provider: 'openai-codex', access: v.access, expires: v.expires, accountId };
-    }
-    catch {
-        throw Error('oauth-credential-unavailable');
-    }
-}
-/** Lazy read-only SDK storage adapter. list FIRST: an API-key entry never reaches read(),
- * so command/env key helpers are unavailable. Never refresh/modify/login or persist secrets. */
-export function createReadOnlyCodexOAuthPort(factory) {
-    let snapshot;
-    return { kind: 'oauth-snapshot', async read(signal) { try {
-            signal.throwIfAborted();
-            if (snapshot)
-                return snapshot;
-            const store = factory();
-            const entries = await store.list({ signal });
-            if (entries.filter(e => e.providerId === 'openai-codex' && e.type === 'oauth').length !== 1 || entries.some(e => e.providerId === 'openai-codex' && e.type !== 'oauth'))
-                throw Error();
-            const value = await store.read('openai-codex', { signal });
-            if (value?.type !== 'oauth' || typeof value.access !== 'string')
-                throw Error();
-            const claim = JSON.parse(Buffer.from(value.access.split('.')[1], 'base64url').toString('utf8'));
-            snapshot = { type: 'oauth', provider: 'openai-codex', access: value.access, expires: value.expires, accountId: claim['https://api.openai.com/auth']?.chatgpt_account_id };
-            signal.throwIfAborted();
-            return snapshot;
-        }
-        catch {
-            throw Error('oauth-credential-unavailable');
-        } } };
-}
-/** Bounded, no-follow read of the explicitly approved file, invoked lazily AFTER approval.
- * Whole JSON is parsed in trusted host memory; only OAuth is returned, never helper resolution. */
-export function createCodexOAuthFilePort(path) {
-    return createReadOnlyCodexOAuthPort(() => { const data = JSON.parse(learningFile(path, 65536).toString('utf8')); if (!data || typeof data !== 'object' || Array.isArray(data))
-        throw Error('invalid credential snapshot'); return { list: async () => Object.entries(data).map(([providerId, v]) => ({ providerId, type: v?.type })), read: async (id) => data[id] }; });
-}
-/** Fixed synthetic evaluation only. Model votes select a conditional third judge, never
- * a worker, grant, production action or adoption. Same journal owns all reservations/results. */
-export function executeCodexQualification(path, raw, rawApproval, ports) {
-    return executeQualification(path, raw, rawApproval, ports);
-}
-/** Explicit opt-in; never silently substitutes producer backing for host frames. */
-export async function executeProducerCodexQualification(path, raw, rawApproval, ports, source) {
-    if (!source)
-        throw Error('explicit original producer source required');
-    return executeQualification(path, raw, rawApproval, ports, source);
-}
-export function assertCodexSingleRequestPlan(c) {
-    const model = c.diagnosticModel ? loadCodexDiagnosticModel(c.diagnosticModel).id : 'gpt-5.4';
-    const i = c.invocations[0];
-    if (!i || i.role !== 'proposer' || i.model !== model || i.effort !== 'low' || i.instructions !== 'Return only the integer answer.' || i.input !== 'Return only the integer: 2 + 2.' || i.expectedSha256 !== '4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a' || i.subjectId !== null)
-        throw Error('fixed single request plan required');
-}
-function checkedSingleRequest(raw, a) {
-    if (!a)
-        throw Error('missing single request approval');
-    closed(a, ['scope', 'approvedCalls', 'charterSha256', 'approvalId', 'expiresAt', 'journalPath']);
-    if (!['fixture-single-request', 'subscription-single-request'].includes(a.scope) || a.approvedCalls !== 1)
-        throw Error('single request approval mismatch');
-    const { approvedCalls: _, scope, ...rest } = learningCopy(a);
-    const approval = { ...rest, scope: scope === 'fixture-single-request' ? 'fixture' : 'subscription-live' };
-    const c = validateCharter(raw, approval, true);
-    assertCodexSingleRequestPlan(c);
-    return { c, approval };
-}
-export function validateCodexSingleRequestCharter(raw, a) { return checkedSingleRequest(raw, a).c; }
-/** Separate one-call authority; five charged original permits are never five callable roles. */
-export async function executeProducerCodexSingleRequest(path, raw, a, ports, source) {
-    if (!source)
-        throw Error('explicit original producer source required');
-    const { c, approval } = checkedSingleRequest(raw, a);
-    return executeQualification(path, c, approval, ports, source, true);
-}
-async function executeQualification(path, raw, rawApproval, ports, source, single = false) {
-    const approval = rawApproval ? learningCopy(rawApproval) : undefined;
-    const c = validateCharter(raw, approval, single), mode = approval.scope, hash = codexCharterHash(c);
-    if (c.diagnosticModel) {
-        assertCodexSingleRequestPlan(c);
-        if (learningHash(ports.bindings[c.invocations[0].model]?.model) !== learningHash(loadCodexDiagnosticModel(c.diagnosticModel)))
-            throw Error('frozen diagnostic SDK definition mismatch');
-    }
-    if (!isAbsolute(path) || resolve(path) !== path || realpathSync(dirname(path)) !== dirname(path) || approval.journalPath !== path)
-        throw Error('execution approval owner-path mismatch');
-    if (ports.credentials.kind !== (mode === 'fixture' ? 'fixture-oauth' : 'oauth-snapshot') || ports.transport.kind !== (mode === 'fixture' ? 'fixture-http' : 'subscription-http'))
-        throw Error('fixture/production port mismatch');
-    for (const i of c.invocations) {
-        const b = ports.bindings[i.model];
-        if (!b || typeof b.stream !== 'function' || b.model.id !== i.model || b.model.provider !== 'openai-codex' || b.model.api !== 'openai-codex-responses' || b.model.baseUrl !== 'https://chatgpt.com/backend-api' || b.model.headers && Object.keys(b.model.headers).length)
-            throw Error('unresolved SDK binding');
-    }
-    const sourceBindings = source?.bindings.map(validateCodexProducerBinding);
-    if (source) {
-        if (!(source.signal instanceof AbortSignal) || typeof source.owner?.reserveBatch !== 'function' || typeof source.producer?.producerIpcDemand !== 'function' || typeof source.producer?.startProducerIpc !== 'function' || typeof source.producer?.createProducerIpcHost !== 'function')
-            throw Error('original producer capabilities required');
-        source.signal.throwIfAborted();
-        if (!sourceBindings || sourceBindings.length !== 5 || new Set(sourceBindings.map(b => b.executionId)).size !== 5 || sourceBindings.some((b, k) => b.charterSha256 !== hash || b.invocationId !== c.invocations[k].id || ['budgetDigest', 'orderId', 'experimentId'].some(key => b[key] !== sourceBindings[0][key])))
-            throw Error('producer source charter/batch mismatch');
-    }
-    const sourceDeclaration = source ? { kind: 'producer-ipc-v1', bindings: sourceBindings, ...(single ? { diagnostic: 'single-request-v1' } : {}) } : { kind: 'host-frames-v1' };
-    ports.transport.preflight?.();
-    const reservation = { charterSha256: hash, mode, requestBytes: c.limits.requestBytes, responseBytes: c.limits.responseBytes, totalRequestBytes: c.limits.totalRequestBytes, totalResponseBytes: c.limits.totalResponseBytes, callMs: c.limits.callMs };
-    const host = existsSync(path) ? openLocalCodexHost(path) : createLocalCodexHost(path, { version: 'codex-host-local-v1', maxCalls: single ? 1 : c.limits.calls, wallMs: Math.min(c.limits.wallMs, approval.expiresAt - Date.now()), invocations: single ? c.invocations.slice(0, 1) : c.invocations }, c.rolePolicy, reservation);
-    const store = learningJournal(path), rows = store.read();
-    if (learningHash(rows[0].value.subscription) !== learningHash(reservation) || learningHash(rows[0].value.rolePolicy) !== learningHash(c.rolePolicy))
-        throw Error('frozen execution charter changed');
-    const append = (v) => store.append(store.read().at(-1).id, v);
-    const priorCharter = rows.find(e => e.value.type === 'subscription-charter');
-    if (priorCharter && learningHash(priorCharter.value.source ?? { kind: 'host-frames-v1' }) !== learningHash(sourceDeclaration))
-        throw Error('frozen execution source changed');
-    const old = rows.find(e => e.value.type === 'subscription-finished');
-    if (old)
-        return old.value;
-    if (priorCharter || host.inspect().calls || host.inspect().aborted)
-        throw Error('stranded execution; no retry');
-    append({ type: 'subscription-charter', charter: c, charterSha256: hash, approvalId: approval.approvalId, executionMode: mode, source: sourceDeclaration, aggregateReservation: c.limits, liveQualified: false });
-    let inFlight = false, httpAttempts = 0;
-    const transport = { kind: ports.transport.kind, exchange: async (wire, signal, record) => {
-            if (inFlight || single && httpAttempts >= 1 || wire.destination !== SUBSCRIPTION_ENDPOINT || wire.method !== 'POST' || wire.body.length > c.limits.requestBytes || approval.expiresAt <= Date.now())
-                throw Error('subscription preflight refused');
-            inFlight = true;
-            httpAttempts++;
-            try {
-                signal.throwIfAborted();
-                const credential = validateCodexOAuth(await ports.credentials.read(signal), c.accountId, mode);
-                signal.throwIfAborted();
-                if (approval.expiresAt <= Date.now())
-                    throw Error('execution approval expired before transport');
-                const response = await ports.transport.exchange(wire, credential, signal, record, learningCopy(c.limits));
-                if (response.redirected || response.status >= 300 && response.status < 400)
-                    throw Error('redirect refused');
-                return response;
-            }
-            finally {
-                inFlight = false;
-            }
-        } };
-    let permits = [], result;
-    const handed = new Set();
-    try {
-        if (source) {
-            permits = await source.owner.reserveBatch(sourceBindings.map(b => source.producer.producerIpcDemand(b)));
-            if (permits.length !== 5)
-                throw Error('whole original reservation required');
-        }
-        const exchange = async (i) => {
-            if (!source)
-                return host.exchangeSubscriptionSdk(Readable.from([JSON.stringify({ id: i.id, sequence: 1 }) + '\n']), ports.bindings[i.model], transport, hash);
-            source.signal.throwIfAborted();
-            const first = store.read()[0].value, k = c.invocations.indexOf(i), remaining = Math.min(c.limits.callMs, approval.expiresAt - Date.now(), Number(first.createdAt) + c.limits.wallMs - Date.now());
-            if (remaining < 50)
-                throw Error('source deadline expired before launch');
-            handed.add(k); // Conservatively never settle a possibly handed-off permit from this caller.
-            const run = await startCodexProducerIpc({ path, binding: sourceBindings[k], sdk: ports.bindings[i.model], transport, producer: source.producer, owner: source.owner, permit: permits[k], signal: source.signal, timeoutMs: remaining });
-            const done = await Promise.race([run.completion, run.result.then(observed => {
-                    // A bounded observer can refuse progress, NEVER grant completion or release the hold.
-                    if (!['pending', 'completed'].includes(observed.outcome))
-                        throw Error('original source observation failed');
-                    return run.completion;
-                })]);
-            if (done.outcome !== 'completed' || done.settlement !== 'acknowledged')
-                throw Error('original source not completed');
-            const observed = store.read().find(e => e.value.type === 'observation' && e.value.id === i.id);
-            if (!observed)
-                throw Error('source observation missing');
-            return observed.value;
-        };
-        const evaluate = async () => {
-            if (single) {
-                const r = await exchange(c.invocations[0]);
-                return { type: 'subscription-finished', diagnostic: 'single-request-v1', charterSha256: hash, executionMode: mode, sourceKind: sourceDeclaration.kind, outcome: r.objective === 'PASS' ? 'single-request-completed' : 'objective-failed', objective: r.objective, outputSha256: r.outputSha256, calls: host.inspect().calls, httpAttempts, panel: null, liveQualified: false, routingDefault: null };
-            }
-            for (const i of c.invocations.slice(0, 2)) {
-                const r = await exchange(i);
-                if (r.objective !== 'PASS') {
-                    return { type: 'subscription-finished', charterSha256: hash, executionMode: mode, sourceKind: sourceDeclaration.kind, outcome: 'objective-failed', calls: host.inspect().calls, liveQualified: false, routingDefault: null };
-                }
-            }
-            await exchange(c.invocations[2]);
-            await exchange(c.invocations[3]);
-            // Decide only whether the already-reserved clean-split tie-break is needed.
-            const observations = store.read().filter(e => e.value.type === 'observation');
-            const verdicts = observations.slice(-2).map(e => JSON.parse(Buffer.from(String(e.value.outputBase64), 'base64').toString('utf8')));
-            const split = collapseVotePanel(verdicts.map((v, k) => ({ ...v, ordinal: k + 1 }))).split;
-            const ids = c.invocations.slice(2, 4).map(i => i.id);
-            if (split) {
-                await exchange(c.invocations[4]);
-                ids.push(c.invocations[4].id);
-            }
-            const panel = host.panel(c.invocations[1].id, ids, c.rolePolicy);
-            return { type: 'subscription-finished', charterSha256: hash, executionMode: mode, sourceKind: sourceDeclaration.kind, outcome: 'advisory-panel', calls: host.inspect().calls, panel, liveQualified: false, routingDefault: null };
-        };
-        result = await evaluate();
-    }
-    catch {
-        append({ type: 'abort', reason: 'subscription execution failed; no retry', charterSha256: hash });
-        throw Error('subscription-execution-failed');
-    }
-    finally {
-        // Only the original unclaimed queued permits are cancelled. Attempts/bytes are not refunded.
-        const outcomes = await Promise.allSettled(permits.filter((_, k) => !handed.has(k)).map(p => p.settle('cancelled')));
-        if (outcomes.some(o => o.status === 'rejected')) {
-            append({ type: 'abort', reason: 'queued original settlement unknown; no retry' });
-            throw Error('queued original settlement unknown');
-        }
-    }
-    append(result);
-    return result;
-}
-//# sourceMappingURL=codex-subscription.js.map

package/dist/evidence-archive.d.ts

@@ -1,65 +0,0 @@
-export type ArchiveRetention = "exact" | "redacted" | "reference-only";
-export interface ArchiveSourceReference {
-    schema: "archive-source-v1";
-    sourceId: string;
-    parser: {
-        id: string;
-        version: string;
-    };
-    sha256: string;
-    bytes: number;
-    retention: ArchiveRetention;
-}
-export interface ArchiveSourceInput {
-    sourceId: string;
-    parser: {
-        id: string;
-        version: string;
-    };
-    bytes: Uint8Array;
-    /** Explicit caller policy; this API neither authorizes collection nor redacts data. */
-    retention: ArchiveRetention;
-}
-export type ArchiveRead = {
-    status: "available";
-    reference: ArchiveSourceReference;
-    bytes: Buffer;
-} | {
-    status: "missing";
-    reason: "manifest" | "content" | "not-retained";
-} | {
-    status: "error";
-    reason: string;
-};
-/** External explicit ingestion only: no session writes, worker callbacks, network or automatic discovery. */
-export declare function retainArchiveSource(root: string, input: ArchiveSourceInput): {
-    manifestId: string;
-    reference: ArchiveSourceReference;
-};
-export type ArchiveReferenceRead = {
-    status: 'available';
-    reference: ArchiveSourceReference;
-} | Exclude<ArchiveRead, {
-    status: 'available';
-}>;
-/** Metadata only for explicit archive inventory. Does not claim content availability. */
-export declare function readArchiveSourceReference(root: string, manifestId: string): ArchiveReferenceRead;
-export declare function readArchiveSource(root: string, manifestId: string, maxBytes?: number): ArchiveRead;
-export interface ArchivedJsonl {
-    status: "complete" | "partial" | "error";
-    records: Array<{
-        line: number;
-        start: number;
-        end: number;
-        value: unknown;
-    }>;
-    errors: Array<{
-        line: number;
-        start: number;
-        reason: "invalid-json";
-    }>;
-    completeBytes: number;
-    pendingBytes: number;
-}
-/** Syntax/byte coverage only. No semantic validation, branch inference, deduplication or acceptance. */
-export declare function parseArchivedJsonl(bytes: Uint8Array): ArchivedJsonl;