@aexhq/sdk 0.46.4-canary → 0.50.0

package/dist/_contracts/submission.d.ts

@@ -1,547 +0,0 @@
-import type { McpServerRef } from "./session-config.js";
-import { type RuntimeSize } from "./runtime-sizes.js";
-import type { RuntimeKind } from "./runtime-kind.js";
-import type { ModelName } from "./models.js";
-import type { RuntimeSecurityProfileName } from "./runtime-security-profile.js";
-import type { SubmissionAssets } from "./workspace-resources.js";
-import { OUTPUT_MODES, RESPONSE_FORMAT_KINDS } from "./schemas/submission-body.js";
-import { type JsonValue } from "./value-guards.js";
-export type { JsonPrimitive, JsonValue } from "./value-guards.js";
-/**
- * Networking + runtime-package snapshot carried inside a flat submission
- * so the hosted API can deep-clone and mutate it per session (e.g. injecting the
- * proxy hostname into `allowed_hosts`) without sharing state across
- * concurrent sessions.
- *
- * `envVars` is the customer-controlled key/value bag delivered into the
- * managed container process and mirrored in the mounted `RUNTIME.env` /
- * `RUNTIME.json` files. The same keys become `__KEY__` substitution targets
- * in agent-facing markdown inside skill / instruction / file bundles. Aex-set
- * runtime keys use the reserved `AEX_*` prefix; customer keys MUST NOT
- * collide with that prefix.
- */
-export interface PlatformEnvironment {
-    readonly networking?: PlatformNetworking;
-    readonly packages?: readonly PlatformPackage[];
-    readonly envVars?: Readonly<Record<string, string>>;
-}
-/**
- * Wire/input form of {@link PlatformEnvironment}, i.e. what a customer hands
- * to the SDK / sends to the submission endpoint BEFORE parsing. Identical to
- * the parsed shape except `packages` use the customer-supplied
- * {@link PlatformPackageInput} (prefixed name, no `ecosystem`). The shared
- * parser resolves it into a {@link PlatformEnvironment}.
- */
-export type PlatformEnvironmentInput = Omit<PlatformEnvironment, "packages"> & {
-    readonly packages?: readonly PlatformPackageInput[];
-};
-export { AEX_RESERVED_ENV_PREFIX, ENV_VARS_MAX_ENTRIES, ENV_VARS_MAX_VALUE_BYTES, ENV_VARS_MAX_TOTAL_BYTES, PLATFORM_PACKAGE_ECOSYSTEMS } from "./submission-limits.js";
-export type { PlatformPackageEcosystem } from "./submission-limits.js";
-import type { PlatformPackageEcosystem } from "./submission-limits.js";
-export interface PlatformNetworking {
-    readonly mode: "limited" | "open";
-    /** Lowercase host names. The hosted API always appends the proxy host. */
-    readonly allowedHosts?: readonly string[];
-}
-export interface PlatformPackage {
-    readonly name: string;
-    readonly version?: string;
-    readonly ecosystem: PlatformPackageEcosystem;
-}
-/**
- * Submission package as the CUSTOMER supplies it on the wire: the target
- * ecosystem is encoded as an optional `name` prefix (`"pip:pandas"`,
- * `"npm:express"`, `"apt:ffmpeg"`; an unprefixed name defaults to `apt`).
- * Customers never set `ecosystem` directly — `parsePackages` resolves it and
- * the submission schema rejects `ecosystem` as an unknown field. The parsed
- * result is a {@link PlatformPackage} (bare `name` + explicit `ecosystem`).
- */
-export interface PlatformPackageInput {
-    readonly name: string;
-    readonly version?: string;
-}
-/**
- * Render a parsed {@link PlatformPackage} as the version-embedded install
- * string used by runtime materialization. The join differs per manager:
- *   - pip  → `name==version`
- *   - npm  → `name@version`
- *   - apt  → `name=version`
- * With no `version`, just the bare `name`. Pure; used by the managed runner
- * package installer.
- */
-export declare function packageInstallString(pkg: PlatformPackage): string;
-/**
- * A serving-provider label. Under the managed Vercel AI Gateway there is NO
- * public provider selector and no closed provider set — routing is the
- * gateway's job. This thin alias survives only because telemetry / cost /
- * custody records still carry the *serving provider string* reported by the
- * gateway's generation info (e.g. `"anthropic"`, `"deepseek"`); it is an open
- * string, never a customer input.
- */
-export type ProviderName = string;
-export interface PlatformMcpServerSecret {
-    readonly name: string;
-    readonly url: string;
-    readonly headers?: Record<string, string>;
-}
-/**
- * Per-session inline secrets bundle. Under managed gateway keys the customer
- * supplies NO provider API keys — the platform's single managed gateway key
- * routes all model traffic. This bundle carries only non-LLM secret material:
- * `mcpServers` credentials (an MCP credential is the same secret whichever
- * model is driving the MCP client) and per-session `envSecrets`.
- */
-export interface PlatformInlineSecrets {
-    readonly mcpServers?: readonly PlatformMcpServerSecret[];
-    /**
-     * Per-session env-var secret VALUES, keyed by env name. Each entry pairs with a
-     * `submission.secretEnv[<envName>] = { ephemeral: true }` declaration. Lives
-     * in the secrets channel so it is vaulted and excluded from the idempotency
-     * hash; the runtime injects it as the named env var and it is deleted at the
-     * session's terminal. Workspace `{ ref }` bindings resolve server-side and never
-     * appear here.
-     */
-    readonly envSecrets?: Readonly<Record<string, string>>;
-}
-export declare const SECRETS_KEY = "secrets";
-/**
- * The `secretEnv` grammars, declared in the leaf bounds module so
- * `schemas/submission-body.ts` can enforce them without importing this file
- * back, and re-exported here so the published surface is unchanged.
- */
-export { SECRET_ENV_NAME_PATTERN, SECRET_HANDLE_PATTERN } from "./submission-limits.js";
-/**
- * One `submission.secretEnv` entry — VALUE-FREE, so it rides the (hashed)
- * submission safely. `{ ref }` resolves a workspace secret server-side;
- * `{ ephemeral: true }` pairs with a `secrets.envSecrets[<envName>]` value
- * (per-session, vaulted, deleted at the session's terminal).
- */
-export type PlatformSecretEnvEntry = {
-    readonly ref: string;
-} | {
-    readonly ephemeral: true;
-};
-export declare const deniedSecretFields: Set<string>;
-/**
- * Cross-check `submission.secretEnv` declarations against `secrets.envSecrets`
- * values:
- *
- *  - `{ ephemeral: true }` MUST have a matching `secrets.envSecrets` value.
- *  - `{ ref }` MUST NOT supply a value (the value lives in the workspace store).
- *  - every `secrets.envSecrets` value MUST have a matching `{ ephemeral: true }`
- *    declaration (no orphan values that would never be injected).
- */
-export declare function crossValidateSecretEnvAndValues(secretEnv: Readonly<Record<string, PlatformSecretEnvEntry>> | undefined, envSecrets: Readonly<Record<string, string>> | undefined): void;
-export declare function parseInlineSecrets(input: unknown): PlatformInlineSecrets;
-export declare function assertNoSecretBearingFields(input: unknown, path: readonly string[]): void;
-export declare function requireRecord(input: unknown, field: string): Record<string, unknown>;
-export declare function requireString(input: unknown, field: string): string;
-export declare function optionalString(input: unknown, field: string): string | undefined;
-export declare function optionalEnum<const T extends readonly string[]>(input: unknown, field: string, allowed: T): T[number] | undefined;
-export declare function optionalPositiveInt(input: unknown, field: string): number | undefined;
-/**
- * A finite positive NUMBER (fractional allowed — e.g. a USD amount like `2.5`), or
- * undefined when absent. Rejects non-numbers, NaN/Infinity, and `<= 0`.
- */
-export declare function optionalPositiveNumber(input: unknown, field: string): number | undefined;
-/**
- * Wire-level submission posted to /api/sessions in the flat surface. The
- * `prompt` is always an array internally so the hosted API, the audit log,
- * and the BFF idempotency hash all see one shape. `mcpServers` carries
- * only the non-secret half; bearer headers travel in
- * `secrets.mcpServers` keyed by `name`.
- *
- * Reusable resources are immutable, version-pinned refs grouped under `assets`.
- * Builtin capabilities and MCP servers remain separate submission fields.
- */
-export interface PlatformSubmission {
-    readonly model: ModelName;
-    readonly system?: string;
-    readonly prompt: readonly string[];
-    /** Immutable, version-pinned workspace resources materialized for this run. */
-    readonly assets: SubmissionAssets;
-    readonly mcpServers: readonly McpServerRef[];
-    /**
-     * Env-var secret bindings — VALUE-FREE declarations keyed by env name. Each
-     * value is `{ ref }` (resolve a workspace secret server-side) or
-     * `{ ephemeral: true }` (value supplied in `secrets.envSecrets`, vaulted and
-     * deleted at terminal). The runtime injects the resolved value as the named
-     * env var. Lifecycle parity with skills/files: per-session by default, persisted
-     * only when promoted to the workspace store.
-     */
-    readonly secretEnv?: Readonly<Record<string, PlatformSecretEnvEntry>>;
-    readonly environment?: PlatformEnvironment;
-    readonly securityProfile?: RuntimeSecurityProfileName;
-    readonly metadata?: Record<string, JsonValue>;
-    /**
-     * File capture policy. Omit `fileCapture.allowedDirs` to expose regular
-     * workspace files from the latest complete checkpoint; provide it to narrow
-     * capture to the listed roots. `fileCapture.deniedDirs` subtracts denied
-     * roots/patterns from the allowed set.
-     */
-    readonly fileCapture?: PlatformFileCaptureConfig;
-    /** Builtin capabilities are separate from uploaded custom-tool assets. */
-    readonly builtinTools: BuiltinToolsSelection;
-    /**
-     * Assistant-output granularity. `buffered` (the default) emits one event per
-     * assistant message; `stream` emits the agent's per-token text deltas as they
-     * arrive, THEN a final coalesced block. Every model streams through the
-     * managed gateway, so `stream` is honored for ALL models.
-     */
-    readonly outputMode?: OutputMode;
-    /**
-     * Structured-output policy. `{ kind: 'text' }` (default) is free-form; a
-     * `{ kind: 'json_schema', … }` requests provider-native constrained decode.
-     * The session's typed outcome is then `decoded | refused` — no untyped path yields
-     * a hallucinated object. Fail-closed for a provider lacking the capability.
-     */
-    readonly responseFormat?: ResponseFormat;
-    /**
-     * Declarative HITL write-gate: the platform parks the session
-     * `awaiting_approval` BEFORE dispatching any listed tool, holding for an
-     * `approve()`/`deny()`. Structural — independent of model prose. Empty/absent
-     * ⇒ no gate.
-     */
-    readonly approvalGate?: ApprovalGate;
-    /**
-     * Platform-injection controls. The platform prepends a small system
-     * prompt (see `platformSystemPrompt`) ahead of `system` to explain
-     * managed-session expectations such as durable file capture. Set
-     * `systemPrompt: "off"` to suppress that injection and have the runtime
-     * see only the customer's own `system`. Omitting the field (or
-     * `systemPrompt: "default"`) keeps the injection on.
-     *
-     * This does not change file capture scope. Omitted
-     * `fileCapture.allowedDirs` means expose regular workspace files from the
-     * latest complete checkpoint; explicit `fileCapture.allowedDirs` narrows it.
-     */
-    readonly platform?: PlatformInjectionConfig;
-}
-export interface PlatformFileCaptureConfig {
-    /**
-     * Allowed capture roots. Omit or pass an empty list to expose regular
-     * workspace files from the latest complete checkpoint. Entries are absolute
-     * UNIX paths.
-     */
-    readonly allowedDirs?: readonly string[];
-    /**
-     * Denied capture roots/patterns. These are subtracted from the allowed roots;
-     * platform-mandatory denies always apply and cannot be re-included.
-     */
-    readonly deniedDirs?: readonly string[];
-    /**
-     * Maximum time the platform may spend capturing files after the agent exits.
-     * Positive integer milliseconds; values above the platform maximum are clamped.
-     */
-    readonly captureTimeoutMs?: number;
-    /** Maximum size of a single captured file in bytes. Positive integer. */
-    readonly maxFileBytes?: number;
-    /** Maximum total captured file bytes for the session. Positive integer. */
-    readonly maxTotalBytes?: number;
-    /** Maximum number of captured files for the session. Positive integer. */
-    readonly maxFiles?: number;
-}
-export interface PlatformInjectionConfig {
-    readonly systemPrompt?: "default" | "off";
-}
-export interface PlatformSessionSubmissionRequest {
-    readonly workspaceId: string;
-    readonly idempotencyKey: string;
-    readonly submission: PlatformSubmission;
-    readonly secrets: PlatformInlineSecrets;
-    /**
-     * Managed runtime size. One of the closed {@link RuntimeSize} preset tokens
-     * or absent (downstream applies the default).
-     */
-    readonly runtimeSize?: RuntimeSize;
-    /**
-     * Execution-runtime selector — which backend runs the session
-     * ({@link RuntimeKind}: `container` | `spot_container` | `lambda`). Distinct
-     * from {@link runtimeSize} (the box preset). Absent ⇒ downstream applies
-     * {@link import("./runtime-kind.js").DEFAULT_RUNTIME_KIND} (`spot_container`).
-     * `spot_container` implies interruptible capacity (reconciled with
-     * {@link machine}); `lambda` is availability-gated server-side.
-     */
-    readonly runtimeKind?: RuntimeKind;
-    /**
-     * Session deadline in milliseconds, normalised by the parser from the wire
-     * `timeout` duration string (bounded to [1m, 8h]). Absent ⇒
-     * {@link DEFAULT_SESSION_TIMEOUT_MS} (8h). Applies to the managed runner's
-     * terminal wait window and self-kill deadline.
-     */
-    readonly timeoutMs?: number;
-    /**
-     * Optional callback URL registered on this session. The platform delivers one
-     * run-scoped `run.finished` or `run.error` event after each run finalizes,
-     * signed Standard-Webhooks style. It is a sibling of {@link idempotencyKey} — an
-     * operational/delivery concern, NOT part of the hashed submission brief, so
-     * the same idempotency key with a different callback URL never 409s and the
-     * field never enters `request_hash`.
-     */
-    readonly webhook?: SessionWebhookSpec;
-    /**
-     * Optional per-session override of the lineage limits (max concurrent child sessions,
-     * max subagent depth, per-session spend cap). These are dials the client may
-     * *request*; the server resolves them against the per-workspace ceiling and
-     * the hard platform ceiling (clamping happens in the resolver, NOT this
-     * parser). Absent fields fall back to the platform defaults. Only shape +
-     * positivity are validated here.
-     */
-    readonly limits?: SessionLimits;
-    /**
-     * Optional capacity intent for the session's managed machine. `spot: true` opts
-     * the session into interruptible capacity; absent / `spot: false` requests
-     * standard capacity (the default). Intent only — the managed runtime selects
-     * capacity from it.
-     */
-    readonly machine?: SessionMachine;
-}
-/** Per-session registration for finalized run callbacks; the URL must be https. */
-export interface SessionWebhookSpec {
-    readonly url: string;
-}
-/**
- * Per-session override of the lineage limits. Both fields are optional; an absent
- * field means "use the platform default". The parser ({@link parseSessionLimits})
- * only validates positivity/shape — clamping to the workspace + platform
- * ceilings is the resolver's job (see `resolveSessionLimits` in `@aexhq/shared`).
- */
-export interface SessionLimits {
-    readonly maxConcurrentChildSessions?: number;
-    readonly maxSubagentDepth?: number;
-    /**
-     * Per-session spend cap in USD (defense-in-depth). The platform kills the session once
-     * it would out-spend the cap. A positive number; omitted ⇒ unbounded per-session
-     * (only the session's wall-clock `timeout` + the per-workspace spend cap apply).
-     * Only shape/positivity are validated here.
-     *
-     * The frozen boot session config the managed runtime folds the loop against
-     * names this same USD value `budgetUsd`; {@link sessionBudgetLimits} is the
-     * single source of truth for that wire→boot name mapping.
-     */
-    readonly maxSpendUsd?: number;
-    /**
-     * Maximum number of agent ITERATIONS (turns) the session may take before the
-     * platform parks it terminal. A positive integer; omitted ⇒ the platform
-     * default (`SESSION_DEFAULT_MAX_TURNS`). Previously a bare server literal absent
-     * from both the public contract and the limits SSoT — now a settable dial.
-     * Only shape/positivity are validated here; clamping to the ceiling is the
-     * resolver's job.
-     */
-    readonly maxTurns?: number;
-    /**
-     * Maximum number of agent STEPS (LLM+tool cycles) a single turn may take before
-     * the platform terminalizes it — the per-turn runaway-loop backstop (doc 13 G2),
-     * one level below {@link maxTurns}. A positive integer; omitted ⇒ the platform
-     * default (`SESSION_DEFAULT_MAX_STEPS_PER_TURN`). Only shape/positivity are
-     * validated here; clamping to the ceiling is the resolver's job.
-     */
-    readonly maxStepsPerTurn?: number;
-}
-/**
- * Per-session machine/capacity intent. v1 exposes only `spot`: opt the session into
- * interruptible capacity (`spot: true`) vs standard capacity (absent /
- * `spot: false`, the default). Only the boolean intent is public — capacity
- * selection is a runtime concern.
- */
-export interface SessionMachine {
-    readonly spot?: boolean;
-}
-/**
- * Internal pre-parser input used by authenticated platform adapters. The public
- * SDK and CLI post {@link SessionCreateRequest}; adapters derive `workspaceId`
- * and inject header idempotency before calling the platform parser.
- *
- * This type remains available from `@aexhq/contracts/internal` for platform
- * consumers and is intentionally absent from the public contracts barrel.
- */
-export type PlatformSessionSubmissionInput = Omit<PlatformSessionSubmissionRequest, "workspaceId" | "timeoutMs"> & {
-    readonly workspaceId?: string;
-    /**
-     * Session deadline as a human duration string (`"1h"`, `"90m"`, `"30s"`).
-     * Parsed + bounded to [1m, 8h] server-side into
-     * {@link PlatformSessionSubmissionRequest.timeoutMs}. Absent ⇒ 8h default.
-     */
-    readonly timeout?: string;
-};
-export declare function parseSessionSubmissionRequest(input: unknown): PlatformSessionSubmissionRequest;
-/**
- * Parse + SSRF-shape-validate the optional per-session `webhook`. The URL must be
- * https with no userinfo (a `user:pass@host` URL is rejected — credentials must
- * not ride in a callback URL). Unknown subfields are rejected so the strict
- * top-level allow-list extends to the nested object. Returns `undefined` when
- * absent. Delivery-time re-resolution + IP-deny checks live server-side; this
- * is the submit-time shape gate.
- */
-export declare function parseSessionWebhook(input: unknown): SessionWebhookSpec | undefined;
-/**
- * Parse the optional per-session `limits` override. Mirrors {@link parseSessionWebhook}:
- * absent ⇒ `undefined`; a non-object or any unknown subfield is rejected so the
- * strict top-level allow-list extends to the nested object. Each present field
- * is validated as a positive safe integer via {@link optionalPositiveInt}.
- *
- * This is a SHAPE/positivity gate only — it does NOT clamp to the workspace or
- * platform ceilings (that precedence lives in the resolver, `resolveSessionLimits`).
- * Only the present fields are returned; an all-absent override (e.g. `{}`)
- * collapses to `undefined` so it carries no signal onto the request.
- */
-export declare function parseSessionLimits(input: unknown): SessionLimits | undefined;
-/**
- * Boot-session budget fragment. The public submit surface names a session's spend
- * cap `limits.maxSpendUsd`; the frozen boot session config the managed runtime
- * folds the loop against names the SAME USD value `budgetUsd` — the field the
- * session planner reads to enforce/terminate a session that would out-spend its cap.
- * This is the single source of truth for that wire→boot name mapping so the two
- * layers can never drift.
- *
- * Returns a fragment safe to spread into `sessionConfig.limits`: `{ budgetUsd }`
- * when a cap is set, `{}` when none is (an absent cap stays absent — the session is
- * unbounded per-session, subject only to the session timeout + the per-workspace cap).
- * Pure: same input ⇒ same output.
- */
-export declare function sessionBudgetLimits(limits: SessionLimits | undefined): {
-    budgetUsd?: number;
-};
-/**
- * Parse the optional per-session `machine` capacity intent. Mirrors
- * {@link parseSessionWebhook}: absent ⇒ `undefined`; a non-object or any unknown
- * subfield is rejected so the strict top-level allow-list extends to the nested
- * object. `spot` must be a boolean when present. A no-signal object (e.g.
- * `machine: {}`) collapses to `undefined` so it never lands an empty object on
- * the request. An explicit `spot` (true or false) is preserved verbatim. Only
- * shape is validated here — capacity selection is a runtime concern.
- */
-export declare function parseSessionMachine(input: unknown): SessionMachine | undefined;
-export declare function parseSubmission(input: unknown): PlatformSubmission;
-/**
- * Assistant-output granularity values and the structured-output kinds, declared
- * with the schemas that enforce them and re-exported here so the published
- * surface is unchanged — see the sibling note on the `secretEnv` grammars.
- */
-export { OUTPUT_MODES, RESPONSE_FORMAT_KINDS } from "./schemas/submission-body.js";
-export type OutputMode = (typeof OUTPUT_MODES)[number];
-export declare const DEFAULT_OUTPUT_MODE: OutputMode;
-export type ResponseFormatKind = (typeof RESPONSE_FORMAT_KINDS)[number];
-/**
- * Structured-output policy. `{ kind: 'text' }` is free-form; `{ kind:
- * 'json_schema', schema, strict?, name? }` requests provider-native constrained
- * decode against `schema` (a JSON Schema object).
- */
-export type ResponseFormat = {
-    readonly kind: "text";
-} | {
-    readonly kind: "json_schema";
-    readonly schema: JsonValue;
-    readonly strict?: boolean;
-    readonly name?: string;
-};
-/**
- * Parse the optional `submission.responseFormat`. Absent ⇒ undefined; a bad
- * `kind` or unknown subfield is rejected (fail-fast). `json_schema` requires a
- * JSON-object `schema`.
- */
-export declare function parseResponseFormat(input: unknown): ResponseFormat | undefined;
-/** Declarative HITL write-gate: park `awaiting_approval` before any listed tool. */
-export interface ApprovalGate {
-    readonly tools: readonly string[];
-}
-/**
- * Parse the optional `submission.approvalGate`. Absent / empty tool list ⇒
- * undefined (no gate). Tool names are deduped; the strict allow-list mirrors the
- * sibling parsers.
- */
-export declare function parseApprovalGate(input: unknown): ApprovalGate | undefined;
-/**
- * The CLOSED set of builtin tool NAMES the managed runtime can inject — one per
- * machine tool the hands implement. This list is the single source of truth for
- * validating builtin tool references; the platform's `HANDS_TOOLS` (the execute
- * vocabulary) is pinned EQUAL to it at module load (`platform-runtime-agent`
- * `assertNamesMatch`), so a rename on either side fails loudly rather than
- * silently shipping a name the executors do not speak.
- *
- * Order mirrors `HANDS_TOOLS`. A builtin tool reference (a bare string in
- * `submission.tools`) must be a member of this set.
- */
-export declare const BUILTIN_TOOL_NAMES: readonly ["bash", "read_file", "write_file", "edit_file", "grep", "glob", "head", "tail", "todo_write", "subagent", "subagent_result", "web_fetch", "web_search", "bash_output", "bash_kill", "code_execution", "wait", "git", "ls", "stat", "wc"];
-export type BuiltinToolName = (typeof BUILTIN_TOOL_NAMES)[number];
-/**
- * Typo-safe accessors for the closed builtin tool set: each key maps to the
- * real tool NAME string. Reference a builtin in `submission.tools` via
- * `BuiltinTools.web_search` rather than the bare string so a rename is a
- * compile error, not a runtime 400.
- *
- * Keys are the real tool names; a unit test asserts `Object.values(BuiltinTools)`
- * deep-equals `BUILTIN_TOOL_NAMES` so the two can never drift.
- */
-export declare const BuiltinTools: {
-    readonly bash: "bash";
-    readonly read_file: "read_file";
-    readonly write_file: "write_file";
-    readonly edit_file: "edit_file";
-    readonly grep: "grep";
-    readonly glob: "glob";
-    readonly head: "head";
-    readonly tail: "tail";
-    readonly todo_write: "todo_write";
-    readonly subagent: "subagent";
-    readonly subagent_result: "subagent_result";
-    readonly web_fetch: "web_fetch";
-    readonly web_search: "web_search";
-    readonly bash_output: "bash_output";
-    readonly bash_kill: "bash_kill";
-    readonly code_execution: "code_execution";
-    readonly wait: "wait";
-    readonly git: "git";
-    readonly ls: "ls";
-    readonly stat: "stat";
-    readonly wc: "wc";
-};
-/**
- * The complete builtin set selected by `builtinTools: "default"`.
- */
-export declare const DEFAULT_BUILTIN_TOOLS: readonly BuiltinToolName[];
-/**
- * Fixed name of the single skills meta-tool. Deliberately NOT a member of
- * {@link BUILTIN_TOOL_NAMES} (that closed set is the customer-cherry-pickable
- * toggle surface, pinned equal to `HANDS_TOOLS`) — the skills tool is IMPLIED by
- * a session having ≥1 skill, not chosen, and is injected platform-side. Kept in
- * lockstep with {@link SKILL_RESERVED_NAMES} so it can never be shadowed by a
- * custom tool or skill of the same name.
- */
-export declare const SKILLS_TOOL_NAME = "skills";
-/**
- * The single default `skills` meta-tool (list/load) the platform injects when a
- * session references ≥1 workspace skill. Shared by the platform tool composer and
- * kept adjacent to the reserved-name guard so the model-visible contract and the
- * name reservation stay in one place. It replaces the former N per-skill no-arg
- * load-tools with one arg-taking dispatcher.
- */
-export declare const SKILLS_TOOL_DEFINITION: {
-    readonly name: "skills";
-    readonly description: string;
-    readonly input_schema: {
-        readonly type: "object";
-        readonly properties: {
-            readonly action: {
-                readonly type: "string";
-                readonly enum: readonly ["list", "load"];
-                readonly description: "'list' all skills, or 'load' one by name.";
-            };
-            readonly name: {
-                readonly type: "string";
-                readonly description: "Skill name to load (required when action='load').";
-            };
-        };
-        readonly required: readonly ["action"];
-        readonly additionalProperties: false;
-    };
-};
-/**
- * Resolve the set of builtin tool NAMES a submission injects, deduplicated and
- * in {@link BUILTIN_TOOL_NAMES} order.
- *
- * `"default"` selects the standard set, `"none"` selects none, and an array
- * selects a validated subset in canonical order.
- */
-export type BuiltinToolsSelection = "default" | "none" | readonly BuiltinToolName[];
-export declare function resolveBuiltinToolNames(selection?: BuiltinToolsSelection): readonly BuiltinToolName[];