@xenosystem/agent-cli 0.5.107 → 0.5.108

package/dist/sdk-build-identity.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "packageName": "@xenosystem/agent-sdk",
   "version": "0.10.59",
-  "cliBundleSha256": "cb1f79b4a55dfb484cf65520842681d731dda125830e061a1aa8b34be9dceed0",
+  "cliBundleSha256": "84ce2b2a979b9368376ceb669da9f10af61ec61abfaa050f79b52ff97ef26ee1",
   "inputs": [
     {
       "path": "dist/agents/index.js",
@@ -157,15 +157,15 @@
   "emitted": [
     {
       "path": "cli.js",
-      "sha256": "8036feb360c5f4d4b8414ff12034dd5c0e58254f8cb643ba19902ec3472e9e36"
+      "sha256": "25464ebf7863e0a64dc17565642107675ab59062d13f77a44a2be98a6980a7e3"
     },
     {
       "path": "index.js",
-      "sha256": "cb1f79b4a55dfb484cf65520842681d731dda125830e061a1aa8b34be9dceed0"
+      "sha256": "84ce2b2a979b9368376ceb669da9f10af61ec61abfaa050f79b52ff97ef26ee1"
     },
     {
       "path": "metafile-esm.json",
-      "sha256": "8f1cf7d50da12396ec1b5a3862f18677d3231355f1c6f5040f2a1371a82f8f17"
+      "sha256": "5cc3e2e2dddae274e55eff2b9f7798d7eea4ed455cbf335bce48c4325988f740"
     }
   ]
 }

package/native/xeno-pty/prebuilds/win32-x64/manifest.json

@@ -1,18 +1,18 @@
-{
-  "schemaVersion": 2,
-  "component": "xeno-pty",
-  "binary": "xeno_pty.node",
-  "apiVersion": 1,
-  "platform": "win32",
-  "architecture": "x64",
-  "abi": "napi-v8",
-  "napi": 8,
-  "minimumNode": "20.0.0",
-  "nodeHeaders": "24.13.1",
-  "compiler": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36260 for x64",
-  "sourceSha256": "3da3e5b6c553f76d9adb3078507c9d615e5dcae9fe5f8b86094e219c7ad768fa",
-  "sha256": "557d7c100735e72506e3eb302d33cec302b2e6fcc6d3bcbf66730844eac8f3df",
-  "signature": {
-    "status": "unsigned-development"
-  }
-}
+{
+  "schemaVersion": 2,
+  "component": "xeno-pty",
+  "binary": "xeno_pty.node",
+  "apiVersion": 1,
+  "platform": "win32",
+  "architecture": "x64",
+  "abi": "napi-v8",
+  "napi": 8,
+  "minimumNode": "20.0.0",
+  "nodeHeaders": "24.13.1",
+  "compiler": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36260 for x64",
+  "sourceSha256": "3da3e5b6c553f76d9adb3078507c9d615e5dcae9fe5f8b86094e219c7ad768fa",
+  "sha256": "557d7c100735e72506e3eb302d33cec302b2e6fcc6d3bcbf66730844eac8f3df",
+  "signature": {
+    "status": "unsigned-development"
+  }
+}

package/node_modules/@xeno-corporation/account/LICENSE

@@ -0,0 +1,39 @@
+@xeno-corporation/account — PROPRIETARY SOFTWARE LICENSE
+
+Copyright (c) 2026 XENO Corporation. All rights reserved.
+
+This package is the confidential and proprietary property of XENO Corporation.
+No license, right, or interest is granted by possession of this package or by
+its availability on any package registry.
+
+You may NOT, without the prior written permission of XENO Corporation: use,
+execute, copy, publish, distribute, modify, create derivative works from,
+reverse engineer, sublicense, sell, rent, lease, or otherwise transfer this
+package, in whole or in part.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL XENO CORPORATION BE LIABLE FOR ANY CLAIM, DAMAGES, OR
+OTHER LIABILITY ARISING FROM OR IN CONNECTION WITH THE SOFTWARE.
+
+---
+
+WHY THIS PACKAGE CARRIES ITS OWN LICENCE
+
+This is the canonical XENO ecosystem account + credits-ledger client. Every XENO
+product federates to the platform through it — and most of those products are
+proprietary.
+
+It lives inside the `xeno-post` repository for historical reasons
+(`XENO AUTH - SPEC.md` line 7 designates `xeno-post/packages/account-kit` as its
+canonical home). It therefore used to inherit that repository's licence. When
+`xeno-post` was AGPL-3.0, this SDK was implicitly AGPL-3.0 too — meaning every
+proprietary XENO app that embedded it was linking copyleft code.
+
+This file exists so that never happens again by accident. **A package's licence
+must be stated on the package, not inherited from whatever repository it happens
+to sit in.** If `xeno-post` is ever relicensed — in either direction — this file
+governs this package and must be changed deliberately, on its own merits.
+
+Publishing note: this package is published to a PRIVATE registry (GitHub
+Packages, `@xeno-corporation` scope). It must never be published to the public
+npm registry.

package/node_modules/@xeno-corporation/account/README.md

@@ -0,0 +1,211 @@
+# @xeno-corporation/account
+
+The canonical XENO ecosystem **account + credits-ledger client**. Every XENO app
+(a "branch") federates to the platform ("origin") through this one SDK — uniform
+integration, not bespoke per-app hacks. See `XENO ACCOUNT - ARCHITECTURE.md`.
+
+Framework-agnostic (no NestJS/React/etc.), `fetch`-based, Zod-validated. Node + edge.
+
+## What it does
+- **Identity (OIDC relying-party):** Authorization Code + PKCE (S256) for web/native
+  (RFC 8252), Device Authorization Grant (RFC 8628) for CLI. No implicit, no ROPC.
+- **Ledger (idempotent metering):** double-entry spend via usage events + two-phase
+  holds (reserve → settle/void). Every mutation carries an `Idempotency-Key`; a retry
+  can never double-charge. Money is integer **micro-credits** (1 credit = 1e6 µcr).
+- **Authorization (ReBAC):** central authz checks (OpenFGA-backed) so cross-app
+  permission inheritance works without per-app role sync.
+
+## Quick start (a branch)
+```ts
+import { XenoAccountClient, keychainStore } from '@xeno-corporation/account';
+import { createNodeDpopSigner } from '@xeno-corporation/account/node';
+
+// Load this stable P-256 private JWK from the host keychain/secret manager.
+// Never generate a new key for each process start and never log the JWK.
+const dpopSigner = createNodeDpopSigner(process.env.XENO_OIDC_DPOP_PRIVATE_JWK!);
+
+const xeno = new XenoAccountClient({
+  issuer: process.env.XENO_PLATFORM_URL!,        // https://xenostudio.ai
+  apiBase: process.env.XENO_PLATFORM_API_URL!,   // https://api.xenostudio.ai
+  surface: 'xeno_post',                          // this app's attribution tag
+  oidc: {
+    clientId: 'xeno-post',
+    redirectUri: 'https://post.xenostudio.ai/auth/callback',
+    dpopSigner,
+  },
+  store: keychainStore(hostKeychain),
+});
+
+// 1. Begin "Continue with XENO" — persist { state, pkce.verifier } (encrypted).
+const { url, state, nonce, pkce } = await xeno.beginSignIn();
+
+// 2. On callback — exchange the code (verify state first).
+const tokens = await xeno.completeSignIn({
+  code,
+  codeVerifier: pkce.verifier,
+  expectedNonce: nonce,
+});
+
+// 3. Sender-constrain every resource call to its exact method and URL.
+const usageUrl = `${process.env.XENO_PLATFORM_API_URL!}/api/v2/ledger/usage`;
+const usageAuth = await xeno.authorization('POST', usageUrl, { scopes: ['ledger'] });
+if (!usageAuth) throw new Error('XENO sign-in required');
+
+// 4. Meter a spend (idempotent on a deterministic transactionId).
+await xeno.ledger.recordUsage(usageAuth, {
+  surface: 'xeno_post',
+  transactionId: `post:${postId}:ai-caption`,    // deterministic → exactly-once
+  operation: 'ai.caption',
+  model: 'claude-opus-4-8',
+  costMicro: 5_000,
+});
+
+// 5. Obtain a new proof for every distinct method/URL. Never reuse one.
+const holdUrl = `${process.env.XENO_PLATFORM_API_URL!}/api/v2/ledger/holds`;
+const holdAuth = await xeno.authorization('POST', holdUrl, { scopes: ['ledger'] });
+if (!holdAuth) throw new Error('XENO sign-in required');
+const hold = await xeno.ledger.hold(holdAuth, {
+  surface: 'xeno_post', holdId: `job:${jobId}`, amountMicro: 50_000, operation: 'ai.image',
+});
+// … do the work …
+const settleUrl = `${holdUrl}/${encodeURIComponent(hold.holdId)}/settle`;
+const settleAuth = await xeno.authorization('POST', settleUrl, { scopes: ['ledger'] });
+if (!settleAuth) throw new Error('XENO sign-in required');
+await xeno.ledger.settle(settleAuth, hold.holdId, /* actual */ 42_000);
+```
+
+## Standalone-first
+A branch only constructs this in **cloud mode** (when a platform URL is configured).
+With it absent the app runs entirely on its own auth — self-host stays free.
+
+## Resource Request Verification
+
+`createResourceRequestAuthorizer` is the shared resource-server verifier for
+DPoP-bound account access tokens. Configure the canonical issuer, eligible
+client IDs, existing `Transport`, an atomic durable `DpopReplayStore`, and a
+trusted current-session/epoch callback. Pass the exact method, operator-known
+HTTPS URL, Authorization and DPoP headers. Never derive the trusted origin from
+caller Host/Forwarded headers or accept identity as a product capability grant.
+
+The returned receipt revalidates original identity before effect/evidence release
+without replaying its single-use proof. Token/proof/key/method/URL/hash/time/nonce,
+client/scope and ambiguous JSON failures refuse. Revocation/replay dependency
+outages remain unavailable. The callback and replay store need production
+provisioning; this candidate is not a new login issuer, live auth qualification
+or permission to publish. The live origin currently lacks a verified MFA-strength
+claim in the inspected contract, so fresh timing alone must not authorize MFA gates.
+
+`createOidcIntrospectionSessionAuthority` provides the current origin-session
+callback. It posts the exact verified token to the canonical introspection
+endpoint without forwarding a resource-specific proof, validates matching
+subject/session/client/scope/expiry/resource and bounds both headers and body
+by one deadline. It has no positive revocation cache or local session issuer.
+
+## HTTP Response And Retry Contract
+
+`Transport` keeps one per-attempt deadline across host authorization, headers and
+streamed response body. Default timeout is 8 seconds; default decoded-response
+limit is 1 MiB. Invalid limits, malformed UTF-8 and oversized responses refuse;
+successful JSON is never truncated. Redirects and ambient cookies are disabled.
+Unread/late bodies are cancelled without awaiting an unbounded cancel callback.
+Public errors omit request paths, queries, credentials and provider error text.
+
+Automatic retry requires an idempotent GET or a mutation idempotency key. A static
+DPoP proof is never replayed. Pass a `RequestAuthorizationProvider(method, url)`
+to the transport or account/ledger/authz client when retries need fresh host-owned
+authorization. Each attempt obtains a new proof for that exact method/URL.
+Original method/URL/body/headers/idempotency identity is snapshotted before any
+await. Invalid authorization replies refuse rather than falling back to old tokens.
+OAuth grant endpoints explicitly opt into bounded allowlisted error codes;
+unreadable/ambiguous bodies never become `invalid_grant` or successful polling.
+
+These changes are unpublished candidate behavior, not a live sign-in/keystore
+or release qualification. See `docs/ACCOUNT_HTTP_QUALIFICATION.md` in the owning
+repository for benchmark, verification scope and remaining release gates.
+
+## Errors
+Every failure is an `AccountError` with a `code` you branch on:
+`DISABLED · UNREACHABLE · INVALID_TOKEN · INSUFFICIENT_CREDITS · CONFLICT ·
+INVALID_RESPONSE · BAD_REQUEST · NOT_FOUND · RATE_LIMITED · PLATFORM_ERROR`.
+
+## Owning Session Lifecycle
+
+`TokenStore.withExclusive(key, work)` is required for canonical session writes.
+The host must exclude all other writers of that product/client entry, including
+other processes sharing its keystore. `memoryStore` supplies in-realm exclusion;
+`keychainStore` forwards the owning host primitive. Missing exclusion refuses
+before refresh dispatch. A promise queue in one CLI process is not OS exclusion.
+
+Refresh reserves a unique transition marker in the same protected store before
+the single-use request. Success persists the successor before publishing cached
+access. Unknown reply, invalid response or failed commit retains an explicit
+nonretryable pending state; cold clients cannot blindly replay the old rotating
+token. Explicit interactive sign-in replaces that state. Only confirmed typed
+`invalid_grant` removes the original credential, and only while it still owns
+the exact transition. Outages never silently delete the credential or prompt.
+
+Logout immediately withdraws local cached authority and advances a generation;
+late refresh/code/device/proof responses cannot restore it. A durable signed-out
+marker precedes deletion, so failed deletion refuses cold reuse. Global logout
+failure preserves the original local session for explicit step-up recovery;
+successful cleanup may delete only its original committed store transition,
+never a newer sign-in. Request release checks both generation and store state.
+
+Cached scope/expiry/session derive from signed access claims, with response
+expiry allowed only to shorten authority. User display derives from verified ID
+claims matching the access subject/session. Auth observers cannot break a
+committed state, signer/store failures are categorical, and broker tokens never
+transfer refresh credentials. Fresh standalone sign-in without a successor
+retires any prior standalone refresh token. Raw `refresh(token)` remains the
+server-owned low-level API; its caller owns serialization/durable reconciliation.
+
+These are candidate protocol/client guarantees, not an OS-keystore implementation,
+hardware-key claim, production origin/Hub/CLI migration or release clearance.
+See `docs/ACCOUNT_SESSION_LIFECYCLE.md` in the owning repository.
+
+## Windows Privileged Host
+
+`createWindowsAccountHost` is exported only from `@xeno-corporation/account/node`.
+It supplies a `TokenStore` backed by current-user Windows Credential Manager,
+native SID/product-namespaced mutex exclusion and a non-exportable P-256 signer
+from Microsoft Platform Crypto Provider. The provider's hardware implementation
+flag, actual key provider/algorithm/usage/export policy and returned signatures
+are verified. Missing TPM, key, secure vault or private mutex custody fails;
+there is no software-key, plaintext file or bearer fallback.
+
+```ts
+import { XenoAccountClient } from '@xeno-corporation/account';
+import { createWindowsAccountHost } from '@xeno-corporation/account/node';
+
+const host = await createWindowsAccountHost({ clientId: 'xeno-agent-cli' });
+const account = new XenoAccountClient({
+  issuer: 'https://xenostudio.ai',
+  apiBase: 'https://api.xenostudio.ai',
+  surface: 'xeno_agent_cli',
+  apiKey: '',
+  store: host.store,
+  oidc: { clientId: 'xeno-agent-cli', dpopSigner: host.dpopSigner },
+});
+// Own explicit system-browser/device sign-in and typed display state in the host.
+// On shutdown, finish active account work, then await host.close().
+```
+
+Default opens an existing key. Explicit initial `createKey: true` provisions one
+only when no key or vault refresh/pending authority exists in that namespace.
+It never silently replaces a missing key under an existing credential. A key
+rotation or account migration requires its own reviewed lifecycle.
+
+Refresh and transition values are limited to Credential Manager's 2560-byte
+generic-credential bound. Only the configured client refresh/pending names are
+accessible. Secrets use inherited private stdin/stdout, not command arguments,
+environment or logs. A hidden helper owns the thread-affine mutex and monitors
+the exact Node parent's kernel process handle; parent loss interrupts native
+waits. Abandoned mutex acquisition refuses, never pretending clean completion.
+Late callback access after transaction release refuses. Queues, RPC bytes,
+native lock waits and whole transaction/helper calls are bounded; timeout kills
+the exact helper and leaves account state unknown. Close refuses active work.
+
+Hardware/non-exportability is not remote attestation or containment against
+malicious same-user code. This candidate does not integrate real CLI login,
+verify Hub executable trust, provision Use policy/product grants, establish MFA,
+or qualify macOS/Linux keystores. See `docs/ACCOUNT_WINDOWS_HOST.md` in the owner.

package/node_modules/@xeno-corporation/account/dist/chunk-FELZILY4.mjs

@@ -0,0 +1,60 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/errors.ts
+var AccountError = class extends Error {
+  static {
+    __name(this, "AccountError");
+  }
+  code;
+  httpStatus;
+  retryable;
+  retryAfterMs;
+  oauthError;
+  constructor(args) {
+    super(args.message);
+    this.name = "AccountError";
+    this.code = args.code;
+    this.httpStatus = args.httpStatus ?? null;
+    this.retryable = args.retryable ?? defaultRetryable(args.code);
+    this.retryAfterMs = args.retryAfterMs ?? null;
+    this.oauthError = args.oauthError ?? null;
+  }
+};
+function defaultRetryable(code) {
+  return code === "UNREACHABLE" || code === "RATE_LIMITED" || code === "PLATFORM_ERROR";
+}
+__name(defaultRetryable, "defaultRetryable");
+function codeForStatus(status) {
+  if (status === 401 || status === 403) return "INVALID_TOKEN";
+  if (status === 402) return "INSUFFICIENT_CREDITS";
+  if (status === 409) return "CONFLICT";
+  if (status === 400 || status === 422) return "BAD_REQUEST";
+  if (status === 404) return "NOT_FOUND";
+  if (status === 429) return "RATE_LIMITED";
+  if (status >= 500) return "UNREACHABLE";
+  return "PLATFORM_ERROR";
+}
+__name(codeForStatus, "codeForStatus");
+
+// src/dpop.ts
+function normalizeDpopHtu(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:") throw new Error("DPoP htu must use HTTPS");
+  url.hash = "";
+  url.search = "";
+  url.username = "";
+  url.password = "";
+  url.hostname = url.hostname.toLowerCase();
+  if (url.port === "443") url.port = "";
+  return url.toString();
+}
+__name(normalizeDpopHtu, "normalizeDpopHtu");
+
+export {
+  __name,
+  AccountError,
+  codeForStatus,
+  normalizeDpopHtu
+};
+//# sourceMappingURL=chunk-FELZILY4.mjs.map

package/node_modules/@xeno-corporation/account/dist/chunk-FELZILY4.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/dpop.ts"],"mappings":";;;;AAgBO,IAAMA,eAAN,cAA2BC,MAAAA;EAhBlC,OAgBkCA;;;EACvBC;EACAC;EACAC;EACAC;EACAC;EAET,YAAYC,MAOT;AACD,UAAMA,KAAKC,OAAO;AAClB,SAAKC,OAAO;AACZ,SAAKP,OAAOK,KAAKL;AACjB,SAAKC,aAAaI,KAAKJ,cAAc;AACrC,SAAKC,YAAYG,KAAKH,aAAaM,iBAAiBH,KAAKL,IAAI;AAC7D,SAAKG,eAAeE,KAAKF,gBAAgB;AACzC,SAAKC,aAAaC,KAAKD,cAAc;EACvC;AACF;AAEA,SAASI,iBAAiBR,MAAsB;AAC9C,SAAOA,SAAS,iBAAiBA,SAAS,kBAAkBA,SAAS;AACvE;AAFSQ;AAKF,SAASC,cAAcC,QAAc;AAC1C,MAAIA,WAAW,OAAOA,WAAW,IAAK,QAAO;AAC7C,MAAIA,WAAW,IAAK,QAAO;AAC3B,MAAIA,WAAW,IAAK,QAAO;AAC3B,MAAIA,WAAW,OAAOA,WAAW,IAAK,QAAO;AAC7C,MAAIA,WAAW,IAAK,QAAO;AAC3B,MAAIA,WAAW,IAAK,QAAO;AAC3B,MAAIA,UAAU,IAAK,QAAO;AAC1B,SAAO;AACT;AATgBD;;;AC7BT,SAASE,iBAAiBC,OAAa;AAC5C,QAAMC,MAAM,IAAIC,IAAIF,KAAAA;AACpB,MAAIC,IAAIE,aAAa,SAAU,OAAM,IAAIC,MAAM,yBAAA;AAC/CH,MAAII,OAAO;AACXJ,MAAIK,SAAS;AACbL,MAAIM,WAAW;AACfN,MAAIO,WAAW;AACfP,MAAIQ,WAAWR,IAAIQ,SAASC,YAAW;AACvC,MAAIT,IAAIU,SAAS,MAAOV,KAAIU,OAAO;AACnC,SAAOV,IAAIW,SAAQ;AACrB;AAVgBb;","names":["AccountError","Error","code","httpStatus","retryable","retryAfterMs","oauthError","args","message","name","defaultRetryable","codeForStatus","status","normalizeDpopHtu","value","url","URL","protocol","Error","hash","search","username","password","hostname","toLowerCase","port","toString"]}