@wardby/cli 0.6.0 → 0.8.0

package/dist/providers/executor/in-process.d.ts

@@ -13,5 +13,13 @@ export declare class InProcessExecutor implements Executor {
     private readonly heartbeatIntervalMs;
     constructor(providers: NativeRunProviders, db?: RunnerDb, heartbeatIntervalMs?: number);
     start(runId: string): Promise<void>;
-    stop(_runId: string, _reason?: string): Promise<void>;
+    /**
+     * Records the run cancelled (only while it is still pending or running: the first terminal write
+     * wins) and settles it like any finished run (its review check, status comments, notifications).
+     * The engine itself is stopped cooperatively: executeRun's inline step runner reads the run's row
+     * before every step (stopAwareStep), so the process executing it, this one or another, stops it
+     * at the next step boundary, and a run that has not started yet never does. A step already in
+     * flight (one model turn or tool call) finishes first; its spend is still recorded.
+     */
+    stop(runId: string, reason?: string): Promise<void>;
 }

package/dist/providers/executor/in-process.js

@@ -5,7 +5,7 @@
  * heartbeat and recovers the run to `lost` rather than leaving it stuck
  * `running` forever.
  */
-import { executeRun } from "../../core/runner.js";
+import { executeRun, failNativeRun, nativeRunIntegrations, RunCancelledError, } from "../../core/runner.js";
 import { prisma as defaultDb } from "../../core/db.js";
 import { HEARTBEAT_INTERVAL_MS } from "../../core/timing.js";
 export class InProcessExecutor {
@@ -31,8 +31,18 @@ export class InProcessExecutor {
             clearInterval(timer);
         }
     }
-    async stop(_runId, _reason) {
-        // Native engine cancellation remains cooperative until Engine accepts an
-        // AbortSignal. The task state still records the caller's request.
+    /**
+     * Records the run cancelled (only while it is still pending or running: the first terminal write
+     * wins) and settles it like any finished run (its review check, status comments, notifications).
+     * The engine itself is stopped cooperatively: executeRun's inline step runner reads the run's row
+     * before every step (stopAwareStep), so the process executing it, this one or another, stops it
+     * at the next step boundary, and a run that has not started yet never does. A step already in
+     * flight (one model turn or tool call) finishes first; its spend is still recorded.
+     */
+    async stop(runId, reason) {
+        const run = await this.db.run.findUnique({ where: { id: runId }, select: { status: true } });
+        if (!run || (run.status !== "pending" && run.status !== "running"))
+            return;
+        await failNativeRun({ runId, db: this.db, providers: this.providers, ...nativeRunIntegrations(this.providers, this.db) }, new RunCancelledError(reason ?? "The run was cancelled."));
     }
 }

package/dist/providers/executor/linked-issue-reader.d.ts

@@ -0,0 +1,16 @@
+import type { IssueTrackerRegistry } from "../issue-tracker/types.js";
+import type { ReviewHostRegistry } from "../review-host/types.js";
+import type { LinkedIssueRef } from "./container.js";
+/**
+ * The executor's readLinkedIssue: a GitHub issue through the review host's
+ * issue read (the App's installation token for the run's repository), a Jira
+ * issue through the configured tracker. Null when the number is a pull
+ * request, the issue is missing, or no host or tracker is configured.
+ */
+export declare function linkedIssueReader(deps: {
+    hosts: ReviewHostRegistry;
+    issueTrackers: IssueTrackerRegistry;
+}): (ref: LinkedIssueRef) => Promise<{
+    title: string;
+    body: string;
+} | null>;

package/dist/providers/executor/linked-issue-reader.js

@@ -0,0 +1,30 @@
+/** A tracker read for a continuation's task must not hold up its launch. */
+const TRACKER_READ_TIMEOUT_MS = 10_000;
+/**
+ * The executor's readLinkedIssue: a GitHub issue through the review host's
+ * issue read (the App's installation token for the run's repository), a Jira
+ * issue through the configured tracker. Null when the number is a pull
+ * request, the issue is missing, or no host or tracker is configured.
+ */
+export function linkedIssueReader(deps) {
+    return async (ref) => {
+        if (ref.provider === "github") {
+            const host = deps.hosts.github;
+            if (!host?.readIssue)
+                return null;
+            // Title and body only: the task carries the ticket, not its discussion.
+            const result = await host.readIssue(ref.repository, ref.number, { comments: false });
+            return result.kind === "issue" ? { title: result.title, body: result.body } : null;
+        }
+        const tracker = deps.issueTrackers.jira;
+        if (!tracker)
+            return null;
+        const view = await tracker.getIssue(ref.key, {
+            maxComments: 0,
+            agentMarker: "",
+            timeoutMs: TRACKER_READ_TIMEOUT_MS,
+            retryOn429: false,
+        });
+        return { title: view.summary, body: view.description };
+    };
+}

package/dist/providers/executor/routing.d.ts

@@ -37,6 +37,8 @@ export declare class RoutingExecutor implements Executor {
      * backend name.
      */
     recover(handle: PersistedExecutionHandle): Promise<ExecutionRecoveryResult>;
+    /** Only coding runs wait in the coding queue, so only the coding executor is asked. */
+    cleanupQueueTimeout(runId: string): Promise<void>;
     /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
     private distinct;
     /** Lifecycle fans out to every distinct executor; each hook is optional on the seam. */

package/dist/providers/executor/routing.js

@@ -63,6 +63,10 @@ export class RoutingExecutor {
         }
         return executor.recover(handle);
     }
+    /** Only coding runs wait in the coding queue, so only the coding executor is asked. */
+    async cleanupQueueTimeout(runId) {
+        await this.coding.cleanupQueueTimeout?.(runId);
+    }
     /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
     distinct() {
         return [this.native, this.coding, this.sandbox].filter((executor, index, all) => executor !== undefined && all.indexOf(executor) === index);

package/dist/providers/executor/types.d.ts

@@ -35,6 +35,14 @@ export interface Executor {
      * terminal Run persistence completed. Recovery must never relaunch a job.
      */
     recover?: (handle: PersistedExecutionHandle) => Promise<ExecutionRecoveryResult>;
+    /**
+     * Called by drainCodingQueue for each queued coding run it failed with coding_queue_timeout, after
+     * that write: releases what an earlier attempt of the run left (a launch the backend refused for
+     * capacity), such as a continuation's in-progress host signal and its input artifact. Best effort;
+     * a throw is logged by the caller. Optional: an executor that never leaves a queued run anything
+     * to release omits it.
+     */
+    cleanupQueueTimeout?: (runId: string) => Promise<void>;
     /**
      * Optional one-time startup. A durable backend connects and re-drives the
      * workflows it owned before the last restart. Composition roots call it
@@ -97,5 +105,10 @@ export interface Executor {
      * in). MCP refuses to set an agent to sandbox mode where it cannot (docs/native-sandbox.md).
      */
     supportsNativeSandbox?(): boolean;
+    /**
+     * true: this executor cannot resolve coding inputs; dispatch records the coding run unresolved
+     * and the process that starts it resolves them (resolveDeferredCodingRun).
+     */
+    defersCodingResolution?: boolean;
 }
 import type { CodingProvider } from "../../coding/provider.js";

package/dist/providers/host-tools/invoke.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Runs one approved snapshot of a bound tool with a restricted privileged host: fetch
+ * reaches the provider's API hosts inside this call's repository, using the operation's
+ * methods, with no redirects followed and only plain content headers, and the only secret alias is `host`. Datastores and readable secrets are
+ * absent, and console output is dropped. Never throws: every failure is a fixed code,
+ * so no tool text reaches a model, a run record or a published comment.
+ */
+import type { SandboxLimits } from "../../sandbox/eval-core.js";
+import { safeFetch } from "../../sandbox/safe-fetch.js";
+import type { SecretEntry } from "../../core/secrets.js";
+import { type HostOperation, type HostToolDeclineCode } from "./operations.js";
+export declare const HOST_SECRET_ALIAS = "host";
+export type HostToolErrorCode = "host_tool_failed" | "host_tool_timeout" | "host_tool_invalid_result" | "host_tool_invalid_params" | "host_tool_request_denied" | "host_tool_no_credential" | `host_${HostToolDeclineCode}`;
+export type HostToolResult = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    code: HostToolErrorCode;
+};
+export interface HostToolInvocation {
+    provider: string;
+    operation: HostOperation;
+    snapshot: {
+        code: string;
+        paramsZod: string;
+    };
+    params: Record<string, unknown>;
+    apiHosts: readonly string[];
+    pathPrefix: string;
+    credential: () => Promise<SecretEntry | undefined>;
+    fetchImpl?: typeof safeFetch;
+    limits?: Partial<SandboxLimits>;
+    /** The approved snapshot's time limit (effectiveToolTimeoutMs); absent = the default. */
+    timeoutMs?: number;
+}
+export declare function invokeHostTool(input: HostToolInvocation): Promise<HostToolResult>;

package/dist/providers/host-tools/invoke.js

@@ -0,0 +1,117 @@
+import { createPrivilegedHost } from "../../sandbox/host-functions.js";
+import { runToolCode, toolLimits } from "../../sandbox/run-in-sandbox.js";
+import { fetchTimeoutFor } from "../../sandbox/tool-timeout.js";
+import { WALL_TIME_LIMIT_MS } from "../../sandbox/limits.js";
+import { safeFetch } from "../../sandbox/safe-fetch.js";
+import { validateParams } from "../../sandbox/zod-params.js";
+import { HOST_OPERATIONS, HOST_TOOL_DECLINE_CODES, } from "./operations.js";
+import { assertHostToolHeaders, assertHostToolRequest, HostToolRequestDenied, MAX_HOST_TOOL_FETCHES, } from "./request-guard.js";
+export const HOST_SECRET_ALIAS = "host";
+const absent = async () => {
+    throw new Error("host_tool_capability_absent");
+};
+export async function invokeHostTool(input) {
+    const definition = HOST_OPERATIONS[input.operation];
+    const failures = { denied: false, noCredential: false };
+    const validated = await validateParams(input.snapshot.paramsZod, input.params);
+    if (!validated.ok)
+        return { ok: false, code: "host_tool_invalid_params" };
+    const privileged = (signal) => {
+        const inner = createPrivilegedHost({
+            agentId: `host-provider:${input.provider}`,
+            // Never reached: every bridge that would use them is `absent` below.
+            datastore: {},
+            sharedDatastore: {},
+            logTag: `host-tool:${input.operation}`,
+            allowedFetchHosts: [...input.apiHosts],
+            // Redirects are never followed here: a later hop would skip the guard, so the tool re-fetches through it.
+            fetchImpl: (u, i, o) => (input.fetchImpl ?? safeFetch)(u, i, { ...o, followRedirects: false }),
+            signal,
+            fetchTimeoutMs: fetchTimeoutFor(input.timeoutMs ?? input.limits?.wallTimeLimitMs ?? WALL_TIME_LIMIT_MS),
+            secrets: {
+                get: async () => undefined,
+                resolve: async (name) => {
+                    if (name !== HOST_SECRET_ALIAS)
+                        return undefined;
+                    let entry;
+                    try {
+                        entry = await input.credential();
+                    }
+                    catch {
+                        entry = undefined;
+                    }
+                    // A thrown or partial credential must not carry its text into tool code. Registering
+                    // checks the hosts, but a broker config can be narrowed afterwards.
+                    if (!entry || !entry.broker || input.apiHosts.some((h) => !entry.broker.hosts.includes(h))) {
+                        failures.noCredential = true;
+                        throw new Error("host_tool_no_credential");
+                    }
+                    return entry;
+                },
+            },
+        });
+        let fetches = 0;
+        return {
+            __bridge_console: async () => null,
+            __bridge_fetch: async (argsJson) => {
+                try {
+                    const [url, init, secretNames] = JSON.parse(argsJson);
+                    if (++fetches > MAX_HOST_TOOL_FETCHES)
+                        throw new HostToolRequestDenied();
+                    if (secretNames !== undefined &&
+                        !(Array.isArray(secretNames) && secretNames.every((n) => n === HOST_SECRET_ALIAS))) {
+                        throw new HostToolRequestDenied();
+                    }
+                    assertHostToolHeaders(init?.headers);
+                    assertHostToolRequest(url, init?.method ?? "GET", {
+                        apiHosts: input.apiHosts,
+                        pathPrefix: input.pathPrefix,
+                        methods: definition.methods,
+                    });
+                }
+                catch (err) {
+                    failures.denied = true;
+                    throw err;
+                }
+                return inner.__bridge_fetch(argsJson);
+            },
+            __bridge_datastoreGet: absent,
+            __bridge_datastoreSet: absent,
+            __bridge_datastoreDelete: absent,
+            __bridge_datastoreList: absent,
+            __bridge_sharedDatastoreGet: absent,
+            __bridge_sharedDatastoreSet: absent,
+            __bridge_sharedDatastoreDelete: absent,
+            __bridge_sharedDatastoreList: absent,
+            __bridge_secretsGet: absent,
+        };
+    };
+    const result = await runToolCode({
+        code: input.snapshot.code,
+        params: validated.value,
+        limits: toolLimits(input.timeoutMs, input.limits),
+        privileged,
+    });
+    // Checked first: a tool that catches a refusal must not turn it into a success.
+    if (failures.denied)
+        return { ok: false, code: "host_tool_request_denied" };
+    if (failures.noCredential)
+        return { ok: false, code: "host_tool_no_credential" };
+    if (!result.ok) {
+        return {
+            ok: false,
+            code: result.errorKind === "timeout" || result.errorKind === "cpu" ? "host_tool_timeout" : "host_tool_failed",
+        };
+    }
+    const decline = declineOf(result.value);
+    if (decline)
+        return { ok: false, code: `host_${decline}` };
+    const parsed = definition.result.safeParse(result.value);
+    return parsed.success ? { ok: true, value: parsed.data } : { ok: false, code: "host_tool_invalid_result" };
+}
+function declineOf(value) {
+    if (typeof value !== "object" || value === null || !("error" in value))
+        return null;
+    const { error } = value;
+    return HOST_TOOL_DECLINE_CODES.includes(error) ? error : null;
+}

package/dist/providers/host-tools/operations.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The contract between Wardby and a host provider's bound tools. A bound tool makes
+ * one host operation; paging, markers, safeguards and wording stay in Wardby. Wardby
+ * calls each tool with `{ workspace, repo, repository, ...operation fields }`.
+ *
+ * A tool answers with its operation's result, or `{ error: <decline code> }` when the
+ * host refused. Results are untrusted and validated here, and a tool's own text never
+ * reaches a model, a run record or a comment.
+ */
+import { z } from "zod";
+export declare const HOST_TOOL_CONTRACT_VERSION = 1;
+/** What a tool may say about a host refusal: fixed words, so no tool text passes through. */
+export declare const HOST_TOOL_DECLINE_CODES: readonly ["unauthorized", "forbidden", "not_found", "conflict", "rate_limited", "unavailable"];
+export type HostToolDeclineCode = (typeof HOST_TOOL_DECLINE_CODES)[number];
+type OperationDef = {
+    /** The HTTP methods this operation's requests may use. */
+    methods: readonly string[];
+    /** Changes nothing on the host: test_host_provider may call it. */
+    readOnly: boolean;
+    /** Which credential its `host` alias resolves to. */
+    credential: "repository" | "permission" | "none";
+    result: z.ZodType;
+};
+export declare const HOST_OPERATIONS: {
+    readonly getPullRequest: OperationDef;
+    readonly listPullRequestFiles: OperationDef;
+    readonly getDiff: OperationDef;
+    readonly findPullRequest: OperationDef;
+    readonly readFile: OperationDef;
+    readonly listFiles: OperationDef;
+    readonly listComments: OperationDef;
+    readonly listCommitStatuses: OperationDef;
+    readonly getRepositoryPermission: {
+        readonly methods: readonly ["GET"];
+        readonly readOnly: true;
+        readonly credential: "permission";
+        readonly result: z.ZodObject<{
+            permission: z.ZodEnum<{
+                read: "read";
+                write: "write";
+                none: "none";
+                triage: "triage";
+                maintain: "maintain";
+                admin: "admin";
+            }>;
+        }, z.core.$strict>;
+    };
+    readonly openPullRequest: OperationDef;
+    readonly updatePullRequest: OperationDef;
+    readonly createComment: OperationDef;
+    readonly editComment: OperationDef;
+    readonly resolveThread: OperationDef;
+    readonly submitVerdict: OperationDef;
+    readonly setCommitStatus: OperationDef;
+    readonly normalizeEvent: {
+        readonly methods: readonly [];
+        readonly readOnly: false;
+        readonly credential: "none";
+        readonly result: z.ZodUnknown;
+    };
+};
+export type HostOperation = keyof typeof HOST_OPERATIONS;
+export declare const REQUIRED_OPERATIONS: readonly HostOperation[];
+export declare function isHostOperation(name: string): name is HostOperation;
+export {};

package/dist/providers/host-tools/operations.js

@@ -0,0 +1,149 @@
+/**
+ * The contract between Wardby and a host provider's bound tools. A bound tool makes
+ * one host operation; paging, markers, safeguards and wording stay in Wardby. Wardby
+ * calls each tool with `{ workspace, repo, repository, ...operation fields }`.
+ *
+ * A tool answers with its operation's result, or `{ error: <decline code> }` when the
+ * host refused. Results are untrusted and validated here, and a tool's own text never
+ * reaches a model, a run record or a comment.
+ */
+import { z } from "zod";
+export const HOST_TOOL_CONTRACT_VERSION = 1;
+/** What a tool may say about a host refusal: fixed words, so no tool text passes through. */
+export const HOST_TOOL_DECLINE_CODES = [
+    "unauthorized",
+    "forbidden",
+    "not_found",
+    "conflict",
+    "rate_limited",
+    "unavailable",
+];
+// What a paged operation returns; its tool takes the last one back as the optional `page` input.
+const page = z.string().nullable();
+const pullRequest = z
+    .object({
+    number: z.number().int().positive(),
+    title: z.string(),
+    body: z.string(),
+    author: z.string().nullable(),
+    // A merged pull request is "closed" with `merged` set: consumers compare state to "open".
+    state: z.enum(["open", "closed"]),
+    merged: z.boolean(),
+    draft: z.boolean(),
+    baseRef: z.string(),
+    headRef: z.string(),
+    headSha: z.string().min(1),
+    isFork: z.boolean(),
+    htmlUrl: z.string().url(),
+})
+    .strict();
+const written = z.object({ id: z.string().min(1) }).strict();
+const read = (result) => ({
+    methods: ["GET"],
+    readOnly: true,
+    credential: "repository",
+    result,
+});
+const write = (methods, result) => ({
+    methods,
+    readOnly: false,
+    credential: "repository",
+    result,
+});
+export const HOST_OPERATIONS = {
+    getPullRequest: read(pullRequest),
+    listPullRequestFiles: read(z
+        .object({
+        files: z.array(z
+            .object({
+            filename: z.string(),
+            status: z.string(),
+            additions: z.number().int().nonnegative(),
+            deletions: z.number().int().nonnegative(),
+            previousFilename: z.string().optional(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    getDiff: read(z.object({ diff: z.string() }).strict()),
+    findPullRequest: read(z.object({ pullRequest: pullRequest.nullable() }).strict()),
+    readFile: read(z.discriminatedUnion("kind", [
+        z.object({ kind: z.literal("file"), content: z.string() }).strict(),
+        z.object({ kind: z.literal("directory") }).strict(),
+        z.object({ kind: z.literal("not_found") }).strict(),
+    ])),
+    listFiles: read(z
+        .object({
+        entries: z.array(z
+            .object({
+            path: z.string(),
+            type: z.enum(["file", "directory"]),
+            size: z.number().int().nonnegative().optional(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    listComments: read(z
+        .object({
+        comments: z.array(z
+            .object({
+            id: z.string().min(1),
+            author: z.string().nullable(),
+            authorId: z.string().nullable(),
+            body: z.string(),
+            createdAt: z.string(),
+            path: z.string().nullable(),
+            line: z.number().int().positive().nullable(),
+            parentId: z.string().nullable(),
+            resolved: z.boolean(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    listCommitStatuses: read(z
+        .object({
+        statuses: z.array(z
+            .object({
+            key: z.string(),
+            state: z.enum(["pending", "success", "failure", "stopped"]),
+            url: z.string().nullable(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    getRepositoryPermission: {
+        methods: ["GET"],
+        readOnly: true,
+        credential: "permission",
+        result: z.object({ permission: z.enum(["none", "read", "triage", "write", "maintain", "admin"]) }).strict(),
+    },
+    openPullRequest: write(["POST"], pullRequest),
+    updatePullRequest: write(["PUT"], pullRequest),
+    createComment: write(["POST"], written),
+    editComment: write(["PUT"], written),
+    resolveThread: write(["POST"], z.object({}).strict()),
+    submitVerdict: write(["POST"], z.object({}).strict()),
+    setCommitStatus: write(["POST"], z.object({}).strict()),
+    // PR 5 gives this its HostEvent schema. Nothing calls it before then.
+    normalizeEvent: { methods: [], readOnly: false, credential: "none", result: z.unknown() },
+};
+export const REQUIRED_OPERATIONS = [
+    "getPullRequest",
+    "listPullRequestFiles",
+    "getDiff",
+    "readFile",
+    "listFiles",
+    "listComments",
+    "createComment",
+    "submitVerdict",
+    "findPullRequest",
+    "openPullRequest",
+    "updatePullRequest",
+];
+export function isHostOperation(name) {
+    return Object.hasOwn(HOST_OPERATIONS, name);
+}

package/dist/providers/host-tools/registry.d.ts

@@ -0,0 +1,79 @@
+import { z } from "zod";
+import type { PrismaClient } from "#prisma";
+import type { SecretCipher } from "../secrets/types.js";
+export type HostProviderErrorCode = "host_provider_not_found" | "host_provider_missing_operation" | "host_provider_tool_not_found" | "host_provider_secret_not_found" | "host_provider_secret_not_brokered" | "host_provider_secret_hosts" | "host_provider_secret_placement" | "host_provider_webhook_secret_shared" | "host_provider_webhook_secret_short" | "host_provider_permission_secret_shared" | "host_provider_username_is_secret" | "host_provider_in_use" | "host_provider_operation_not_bound" | "host_provider_tool_deleted";
+export declare class HostProviderError extends Error {
+    readonly code: HostProviderErrorCode;
+    readonly detail: string;
+    constructor(code: HostProviderErrorCode, detail: string);
+}
+export declare const RegisterHostProviderSchema: z.ZodObject<{
+    provider: z.ZodString;
+    gitHost: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    apiHosts: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    gitUsername: z.ZodString;
+    pullRequestUrlTemplate: z.ZodString;
+    repositoryApiPath: z.ZodString;
+    permissionApiPath: z.ZodOptional<z.ZodString>;
+    webhook: z.ZodObject<{
+        header: z.ZodString;
+        algorithm: z.ZodLiteral<"sha256">;
+        deliveryHeader: z.ZodString;
+        eventHeader: z.ZodString;
+        secret: z.ZodString;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        repositories: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        secret: z.ZodString;
+    }, z.core.$strict>>;
+    permissionCredential: z.ZodOptional<z.ZodString>;
+    trustedAccounts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tools: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>;
+export type RegisterHostProviderInput = z.infer<typeof RegisterHostProviderSchema>;
+export declare function findCredential<T extends {
+    repositoryPattern: string;
+}>(credentials: readonly T[], repositoryPath: string): T | null;
+export interface OperationView {
+    operation: string;
+    toolName: string | null;
+    status: "approved" | "changed" | "tool_deleted";
+    approvedAt: Date;
+    approvedById: string;
+    approvedSha256: string;
+    currentSha256: string | null;
+    /** The approved snapshot's time limit (null: the default), and the tool's now; a change waits for approval. */
+    approvedTimeoutMs: number | null;
+    currentTimeoutMs: number | null;
+    approvedCode?: string;
+    approvedParamsZod?: string;
+    currentCode?: string;
+    currentParamsZod?: string;
+}
+export interface HostProviderView {
+    provider: string;
+    contractVersion: number;
+    gitHost: string;
+    apiHosts: string[];
+    gitUsername: string;
+    pullRequestUrlTemplate: string;
+    repositoryApiPath: string;
+    permissionApiPath: string | null;
+    mode: "permission" | "allowlist";
+    webhook: unknown;
+    webhookSecret: string;
+    permissionSecret: string | null;
+    credentials: {
+        repositories: string;
+        secret: string;
+        kind: string;
+    }[];
+    trustedAccounts: string[];
+    operations: OperationView[];
+}
+export declare function registerHostProvider(db: PrismaClient, cipher: SecretCipher, principalId: string, input: RegisterHostProviderInput): Promise<HostProviderView>;
+export declare function approveHostProviderTools(db: PrismaClient, principalId: string, provider: string, operations: readonly string[]): Promise<HostProviderView>;
+export declare function getHostProviderView(db: PrismaClient, provider: string, options?: {
+    includeCode?: boolean;
+}): Promise<HostProviderView | null>;
+export declare function deleteHostProvider(db: PrismaClient, provider: string): Promise<void>;