@aexhq/sdk 0.46.5-canary → 0.51.0

package/dist/_contracts/schemas/submission-assets.d.ts

@@ -1,117 +0,0 @@
-/**
- * Schemas for `submission.assets` — the four lists of immutable, version-pinned
- * workspace resources a run materializes.
- *
- * Each list is an array of a per-kind element schema, so the wire shape of a
- * submitted resource is stated once here rather than reconstructed field by
- * field in `submission.ts`.
- *
- * **What deliberately stays in the parser** (D4/L1): the *name grammars*
- * (`assertWorkspaceFileResourceName`, the skill and tool name rules), the mount
- * path assert, the `assetId`/`contentHash` agreement, the `entry` bundle-path
- * normalisation and per-list duplicate detection. The grammars are asserts the
- * SDK builders call directly on values they already hold, and the skill/tool
- * ones are declared in `session-config.ts`, which imports `submission.ts` — a
- * cycle if this module reached for them. Everything a schema *can* state — the
- * kind discriminator, the pinned identity quartet, string/number envelopes,
- * description bounds, the tool input schema — is stated here.
- *
- * Messages carry the element's INDEX (`submission.assets.files[3].mountPath`),
- * which is read off the position Zod reports rather than baked in, so one
- * element schema serves the whole list at any mount depth — see `indexedPath` /
- * `indexedFieldPath` in `wire.ts`.
- */
-import * as z from "zod/mini";
-/** `submission.assets.files[i]` — a mounted workspace file. */
-export declare const WorkspaceFileRefSchema: z.ZodMiniObject<{
-    name: z.ZodMiniString<string>;
-    mountPath: z.ZodMiniString<string>;
-    kind: z.ZodMiniLiteral<"file">;
-    resourceId: z.ZodMiniString<string>;
-    version: z.ZodMiniNumber<number>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-}, z.core.$strict>;
-/** `submission.assets.skills[i]` — a loadable skill bundle. */
-export declare const WorkspaceSkillRefSchema: z.ZodMiniObject<{
-    name: z.ZodMiniString<string>;
-    description: z.ZodMiniString<string>;
-    kind: z.ZodMiniLiteral<"skill">;
-    resourceId: z.ZodMiniString<string>;
-    version: z.ZodMiniNumber<number>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-}, z.core.$strict>;
-/** `submission.assets.tools[i]` — a custom tool bundle plus its input schema. */
-export declare const WorkspaceToolRefSchema: z.ZodMiniObject<{
-    name: z.ZodMiniString<string>;
-    description: z.ZodMiniString<string>;
-    input_schema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-    entry: z.ZodMiniString<string>;
-    kind: z.ZodMiniLiteral<"tool">;
-    resourceId: z.ZodMiniString<string>;
-    version: z.ZodMiniNumber<number>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-}, z.core.$strict>;
-/** `submission.assets.instructions[i]` — an injected instruction document. */
-export declare const WorkspaceInstructionRefSchema: z.ZodMiniObject<{
-    name: z.ZodMiniString<string>;
-    kind: z.ZodMiniLiteral<"instruction">;
-    resourceId: z.ZodMiniString<string>;
-    version: z.ZodMiniNumber<number>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-}, z.core.$strict>;
-/**
- * The four asset lists.
- *
- * Its unknown-key sentence is deliberately the shorter "is not allowed" wording
- * rather than the "is not an allowed field" the siblings use; both are pinned
- * byte-for-byte by `test/allowed-keys-parser-golden.test.ts`, so neither can be
- * normalised toward the other without a contract change.
- */
-export declare const SubmissionAssetsSchema: z.ZodMiniObject<{
-    files: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-        name: z.ZodMiniString<string>;
-        mountPath: z.ZodMiniString<string>;
-        kind: z.ZodMiniLiteral<"file">;
-        resourceId: z.ZodMiniString<string>;
-        version: z.ZodMiniNumber<number>;
-        assetId: z.ZodMiniString<string>;
-        contentHash: z.ZodMiniString<string>;
-    }, z.core.$strict>>>;
-    skills: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-        name: z.ZodMiniString<string>;
-        description: z.ZodMiniString<string>;
-        kind: z.ZodMiniLiteral<"skill">;
-        resourceId: z.ZodMiniString<string>;
-        version: z.ZodMiniNumber<number>;
-        assetId: z.ZodMiniString<string>;
-        contentHash: z.ZodMiniString<string>;
-    }, z.core.$strict>>>;
-    tools: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-        name: z.ZodMiniString<string>;
-        description: z.ZodMiniString<string>;
-        input_schema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-        entry: z.ZodMiniString<string>;
-        kind: z.ZodMiniLiteral<"tool">;
-        resourceId: z.ZodMiniString<string>;
-        version: z.ZodMiniNumber<number>;
-        assetId: z.ZodMiniString<string>;
-        contentHash: z.ZodMiniString<string>;
-    }, z.core.$strict>>>;
-    instructions: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-        name: z.ZodMiniString<string>;
-        kind: z.ZodMiniLiteral<"instruction">;
-        resourceId: z.ZodMiniString<string>;
-        version: z.ZodMiniNumber<number>;
-        assetId: z.ZodMiniString<string>;
-        contentHash: z.ZodMiniString<string>;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-export type SubmissionAssetsWire = z.infer<typeof SubmissionAssetsSchema>;
-export type WorkspaceFileRefWire = z.infer<typeof WorkspaceFileRefSchema>;
-export type WorkspaceSkillRefWire = z.infer<typeof WorkspaceSkillRefSchema>;
-export type WorkspaceToolRefWire = z.infer<typeof WorkspaceToolRefSchema>;
-export type WorkspaceInstructionRefWire = z.infer<typeof WorkspaceInstructionRefSchema>;

package/dist/_contracts/schemas/submission-assets.js

@@ -1,147 +0,0 @@
-/**
- * Schemas for `submission.assets` — the four lists of immutable, version-pinned
- * workspace resources a run materializes.
- *
- * Each list is an array of a per-kind element schema, so the wire shape of a
- * submitted resource is stated once here rather than reconstructed field by
- * field in `submission.ts`.
- *
- * **What deliberately stays in the parser** (D4/L1): the *name grammars*
- * (`assertWorkspaceFileResourceName`, the skill and tool name rules), the mount
- * path assert, the `assetId`/`contentHash` agreement, the `entry` bundle-path
- * normalisation and per-list duplicate detection. The grammars are asserts the
- * SDK builders call directly on values they already hold, and the skill/tool
- * ones are declared in `session-config.ts`, which imports `submission.ts` — a
- * cycle if this module reached for them. Everything a schema *can* state — the
- * kind discriminator, the pinned identity quartet, string/number envelopes,
- * description bounds, the tool input schema — is stated here.
- *
- * Messages carry the element's INDEX (`submission.assets.files[3].mountPath`),
- * which is read off the position Zod reports rather than baked in, so one
- * element schema serves the whole list at any mount depth — see `indexedPath` /
- * `indexedFieldPath` in `wire.ts`.
- */
-import * as z from "zod/mini";
-import { isJsonValue } from "../value-guards.js";
-import { indexedFieldPath, indexedPath, wireObject } from "./wire.js";
-const ASSETS = "submission.assets";
-/** Maximum length of a resource description shown to the model. */
-const RESOURCE_DESCRIPTION_MAX_CHARS = 2048;
-/**
- * A rejected key on a resource element names the key and stops — the permitted
- * list is deliberately absent, because the per-kind list differs across the four
- * lists and the caller already knows which list it wrote to.
- */
-const resourceRefText = {
-    unknownKey: (path, key) => `${path}.${key} is not allowed`
-};
-/** A required, non-empty string field of the element at an indexed position. */
-function refString(list) {
-    const message = (issue) => `${indexedFieldPath(list, issue.path)} must be a non-empty string`;
-    return z.string({ error: message }).check(z.minLength(1, { error: message, abort: true }));
-}
-/** The pinned `version` counter: a positive safe integer. */
-function refVersion(list) {
-    const message = (issue) => `${indexedFieldPath(list, issue.path)} must be a positive integer`;
-    return z
-        .number({ error: message })
-        .check(z.refine((value) => Number.isSafeInteger(value) && value >= 1, {
-        error: message,
-        abort: true
-    }));
-}
-/**
- * The kind discriminator. Declared first so a mislabelled element is rejected
- * before its identity fields are read, matching the parser's order.
- */
-function refKind(list, kind) {
-    return z.literal(kind, {
-        error: (issue) => `${indexedFieldPath(list, issue.path)} must be '${kind}'`
-    });
-}
-/**
- * A model-facing description: non-empty after trimming and within
- * {@link RESOURCE_DESCRIPTION_MAX_CHARS}. The envelope and the bound report
- * separately, as the `requireResourceDescription` ladder they replace did.
- */
-function refDescription(list) {
-    const envelope = (issue) => `${indexedFieldPath(list, issue.path)} must be a non-empty string`;
-    const bound = (issue) => `${indexedFieldPath(list, issue.path)} must be non-empty and <= ${RESOURCE_DESCRIPTION_MAX_CHARS} chars`;
-    return z.string({ error: envelope }).check(z.minLength(1, { error: envelope, abort: true }), z.refine((value) => value.trim().length > 0 && value.length <= RESOURCE_DESCRIPTION_MAX_CHARS, { error: bound, abort: true }));
-}
-/** A custom tool's JSON Schema: an object literal whose `type` is `"object"`. */
-function refInputSchema(list) {
-    const notObject = (issue) => `${indexedFieldPath(list, issue.path)} must be an object`;
-    const notToolSchema = (issue) => `${indexedFieldPath(list, issue.path)} must be a JSON Schema object with type 'object'`;
-    return z.record(z.string(), z.unknown(), { error: notObject }).check(z.refine((value) => isJsonValue(value) && value.type === "object", { error: notToolSchema, abort: true }));
-}
-/** The immutable identity every submitted resource carries, in assertion order. */
-function pinnedRefKeys(list, kind) {
-    return {
-        kind: refKind(list, kind),
-        resourceId: refString(list),
-        version: refVersion(list),
-        assetId: refString(list),
-        contentHash: refString(list)
-    };
-}
-/**
- * One resource element, strict over its per-kind key set.
- *
- * Declaration order is the order the sequential assertions this replaces ran in,
- * and `errorFromZod` reports the shallowest issue first, so a rejected key still
- * outranks a field complaint on the same element.
- */
-function refObject(list, shape) {
-    return wireObject(indexedPath(list), shape, resourceRefText);
-}
-const FILES = `${ASSETS}.files`;
-const SKILLS = `${ASSETS}.skills`;
-const TOOLS = `${ASSETS}.tools`;
-const INSTRUCTIONS = `${ASSETS}.instructions`;
-/** `submission.assets.files[i]` — a mounted workspace file. */
-export const WorkspaceFileRefSchema = refObject(FILES, {
-    ...pinnedRefKeys(FILES, "file"),
-    name: refString(FILES),
-    mountPath: refString(FILES)
-});
-/** `submission.assets.skills[i]` — a loadable skill bundle. */
-export const WorkspaceSkillRefSchema = refObject(SKILLS, {
-    ...pinnedRefKeys(SKILLS, "skill"),
-    name: refString(SKILLS),
-    description: refDescription(SKILLS)
-});
-/** `submission.assets.tools[i]` — a custom tool bundle plus its input schema. */
-export const WorkspaceToolRefSchema = refObject(TOOLS, {
-    ...pinnedRefKeys(TOOLS, "tool"),
-    name: refString(TOOLS),
-    description: refDescription(TOOLS),
-    input_schema: refInputSchema(TOOLS),
-    entry: refString(TOOLS)
-});
-/** `submission.assets.instructions[i]` — an injected instruction document. */
-export const WorkspaceInstructionRefSchema = refObject(INSTRUCTIONS, {
-    ...pinnedRefKeys(INSTRUCTIONS, "instruction"),
-    name: refString(INSTRUCTIONS)
-});
-/**
- * The four asset lists.
- *
- * Its unknown-key sentence is deliberately the shorter "is not allowed" wording
- * rather than the "is not an allowed field" the siblings use; both are pinned
- * byte-for-byte by `test/allowed-keys-parser-golden.test.ts`, so neither can be
- * normalised toward the other without a contract change.
- */
-export const SubmissionAssetsSchema = wireObject(ASSETS, {
-    files: z.optional(z.array(WorkspaceFileRefSchema, { error: `${FILES} must be an array` })),
-    skills: z.optional(z.array(WorkspaceSkillRefSchema, { error: `${SKILLS} must be an array` })),
-    tools: z.optional(z.array(WorkspaceToolRefSchema, { error: `${TOOLS} must be an array` })),
-    instructions: z.optional(z.array(WorkspaceInstructionRefSchema, { error: `${INSTRUCTIONS} must be an array` }))
-}, {
-    unknownKey: (path, key, permitted) => `${path}.${key} is not allowed; permitted: ${permitted.join(", ")}`
-}).register(z.globalRegistry, {
-    id: "SubmissionAssets",
-    description: "Immutable, version-pinned workspace resources materialized for the run. Resource name " +
-        "grammars, the mount-path rules, the assetId/contentHash agreement and per-list duplicate " +
-        "detection are enforced in packages/contracts/src/submission.ts and are not expressible here."
-});

package/dist/_contracts/schemas/submission-body.d.ts

@@ -1,251 +0,0 @@
-/**
- * Schemas for the submission BRIEF — `request.submission` — and for the inline
- * policy objects that hang directly off it: platform injection, file capture,
- * response format and the HITL approval gate.
- *
- * Declaration order is the permitted-key order reported on an unknown field, and
- * `test/allowed-keys-parser-golden.test.ts` pins every sentence below
- * byte-for-byte — including the three different wordings, which are historical
- * and deliberately not normalised toward each other.
- *
- * **What stays in `submission.ts`** (D4/L1): every transform and every
- * cross-field rule. Splitting `"pip:pandas"`, decoding a duration, collapsing an
- * empty object to `undefined`, canonicalising a capture path, deduplicating a
- * tool list, reconciling `secretEnv` against `secrets.envSecrets` — none of
- * those are shapes, and a `.transform()` here would make the response half of
- * the generated spec ungenerable. Rule sets whose ORDER decides which message
- * fires (`prompt`, `secretEnv`, the capture-path ladders) are single
- * `z.check()`s for the reason `submission-environment.ts` documents: composed
- * schemas report in Zod's order, not the ladder's.
- */
-import * as z from "zod/mini";
-/** Assistant-output granularity values. Buffered is the platform default. */
-export declare const OUTPUT_MODES: readonly ["buffered", "stream"];
-/** Response-format kinds: free-form `text` (default) or provider-native `json_schema`. */
-export declare const RESPONSE_FORMAT_KINDS: readonly ["text", "json_schema"];
-/**
- * Maximum number of file capture entries accepted per list.
- *
- * 32 is enough room for the typical "one or two capture roots" pattern plus a
- * generous margin for legitimate multi-root use cases (per-tool file directory +
- * scratch state + logs, repeated across a few subdirectories), without inviting
- * abuse of the synthetic-turn path the platform capture path drives at session
- * terminal.
- */
-export declare const MAX_FILE_CAPTURE_DIRS = 32;
-/**
- * Maximum byte length of a single file capture entry (after UTF-8 encoding).
- * 512 bytes comfortably covers `/very/long/nested/path` style entries without
- * letting a misuse smuggle large blobs through the field.
- */
-export declare const MAX_FILE_CAPTURE_DIR_BYTES = 512;
-/**
- * The prompt as a single string or an ordered list of parts.
- *
- * The union admits ANY array rather than an array of strings, and the per-entry
- * rules ride the ladder below, because a union reports its own failure — the
- * caller would learn "must be a string or an array of strings" for
- * `["ok", 7]` instead of which entry is wrong. The ladder is the parser's own
- * order: length, then each entry, then the all-whitespace check that only makes
- * sense once every entry is a string.
- */
-export declare const PromptSchema: z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniArray<z.ZodMiniUnknown>]>;
-/**
- * The non-secret half of the MCP server declarations.
- *
- * Deliberately an array of unvalidated entries: the per-entry rules
- * (`mcpServerRefSchema`) need the SSRF host deny-list and the transport parser,
- * which `schemas/mcp-server.ts` takes as an injected `McpWirePolicy` because
- * they must stay inside `session-config.ts` for the cross-repo parity check —
- * and `session-config.ts` imports `submission.ts`, so this module cannot reach
- * them without a cycle. `parseMcpServers` applies them one entry at a time.
- */
-export declare const McpServerRefsSchema: z.ZodMiniArray<z.ZodMiniUnknown>;
-/**
- * Value-free env-var secret bindings, keyed by env name.
- *
- * One ordered `z.check()` rather than a record of a union, for the reason
- * `EnvSecretsSchema` documents: each rung has its own message and the key rule
- * must beat the value rule, which a composed schema cannot promise.
- */
-export declare const SecretEnvSchema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-/** Caller-owned metadata: any JSON-serializable value per key. */
-export declare const MetadataSchema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-/**
- * The builtin-capability selection.
- *
- * The array branch admits any entry: the closed name set lives on
- * `submission.ts` (`BUILTIN_TOOL_NAMES`, pinned equal to the platform's
- * `HANDS_TOOLS`), which imports this module, and `resolveBuiltinToolNames` both
- * validates membership and re-orders the result — a transform either way.
- */
-export declare const BuiltinToolsSchema: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"default">, z.ZodMiniLiteral<"none">, z.ZodMiniArray<z.ZodMiniUnknown>]>;
-/** Assistant-output granularity. */
-export declare const OutputModeSchema: z.ZodMiniEnum<{
-    buffered: "buffered";
-    stream: "stream";
-}>;
-/** `submission.fileCapture` — the post-run capture policy. */
-export declare const FileCaptureSchema: z.ZodMiniObject<{
-    allowedDirs: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniUnknown>>;
-    deniedDirs: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniUnknown>>;
-    captureTimeoutMs: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxFileBytes: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxTotalBytes: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxFiles: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-}, z.core.$strict>;
-/**
- * `submission.responseFormat` when `kind` is `"text"` — a free-form response
- * admits no other field, and says so in its own words rather than listing a
- * permitted set of one.
- */
-export declare const ResponseFormatTextSchema: z.ZodMiniObject<{
-    kind: z.ZodMiniLiteral<"text">;
-}, z.core.$strict>;
-/** `submission.responseFormat` when `kind` is `"json_schema"`. */
-export declare const ResponseFormatJsonSchemaSchema: z.ZodMiniObject<{
-    kind: z.ZodMiniLiteral<"json_schema">;
-    schema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-    strict: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-    name: z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strict>;
-/**
- * The structured-output policy, selected by `kind`.
- *
- * A DISCRIMINATED union rather than a plain one: `kind` picks the variant before
- * either member runs, so a bad `kind` outranks an unknown key and each variant
- * words its own rejection — which is exactly the two-stage sequencing the
- * hand-written parser had. A plain `z.union` would report its own failure for
- * both cases and lose the distinction.
- *
- * The union's own message therefore covers only what routing itself can fail on:
- * a non-object, or an object whose `kind` names no variant.
- */
-export declare const ResponseFormatSchema: z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
-    kind: z.ZodMiniLiteral<"text">;
-}, z.core.$strict>, z.ZodMiniObject<{
-    kind: z.ZodMiniLiteral<"json_schema">;
-    schema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-    strict: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-    name: z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strict>], "kind">;
-/** `submission.approvalGate` — the declarative HITL write-gate. */
-export declare const ApprovalGateSchema: z.ZodMiniObject<{
-    tools: z.ZodMiniArray<z.ZodMiniString<string>>;
-}, z.core.$strict>;
-/** `submission.platform` — platform-injection controls. */
-export declare const PlatformInjectionSchema: z.ZodMiniObject<{
-    systemPrompt: z.ZodMiniOptional<z.ZodMiniEnum<{
-        default: "default";
-        off: "off";
-    }>>;
-}, z.core.$strict>;
-/**
- * Wire shape of the submission brief.
- *
- * The two diagnostics report under DIFFERENT paths and always have: an unknown
- * key is `submission.<key> …` (the brief's fields are the caller's
- * `submission.*` fields), while a non-object brief is `submission.submission …`
- * (the brief's own position inside the request envelope). Both are pinned.
- *
- * `null` is admitted wherever the parser treated it as "unset" — that
- * back-compat is the parser's, and the schema states it rather than letting a
- * null reach a normaliser that would have to re-check it.
- */
-export declare const SubmissionSchema: z.ZodMiniObject<{
-    model: z.ZodMiniString<string>;
-    system: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    prompt: z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniArray<z.ZodMiniUnknown>]>;
-    assets: z.ZodMiniObject<{
-        files: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-            name: z.ZodMiniString<string>;
-            mountPath: z.ZodMiniString<string>;
-            kind: z.ZodMiniLiteral<"file">;
-            resourceId: z.ZodMiniString<string>;
-            version: z.ZodMiniNumber<number>;
-            assetId: z.ZodMiniString<string>;
-            contentHash: z.ZodMiniString<string>;
-        }, z.core.$strict>>>;
-        skills: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-            name: z.ZodMiniString<string>;
-            description: z.ZodMiniString<string>;
-            kind: z.ZodMiniLiteral<"skill">;
-            resourceId: z.ZodMiniString<string>;
-            version: z.ZodMiniNumber<number>;
-            assetId: z.ZodMiniString<string>;
-            contentHash: z.ZodMiniString<string>;
-        }, z.core.$strict>>>;
-        tools: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-            name: z.ZodMiniString<string>;
-            description: z.ZodMiniString<string>;
-            input_schema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-            entry: z.ZodMiniString<string>;
-            kind: z.ZodMiniLiteral<"tool">;
-            resourceId: z.ZodMiniString<string>;
-            version: z.ZodMiniNumber<number>;
-            assetId: z.ZodMiniString<string>;
-            contentHash: z.ZodMiniString<string>;
-        }, z.core.$strict>>>;
-        instructions: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-            name: z.ZodMiniString<string>;
-            kind: z.ZodMiniLiteral<"instruction">;
-            resourceId: z.ZodMiniString<string>;
-            version: z.ZodMiniNumber<number>;
-            assetId: z.ZodMiniString<string>;
-            contentHash: z.ZodMiniString<string>;
-        }, z.core.$strict>>>;
-    }, z.core.$strict>;
-    mcpServers: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniUnknown>>;
-    secretEnv: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>>>;
-    environment: z.ZodMiniOptional<z.ZodMiniObject<{
-        networking: z.ZodMiniOptional<z.ZodMiniObject<{
-            mode: z.ZodMiniOptional<z.ZodMiniEnum<{
-                limited: "limited";
-                open: "open";
-            }>>;
-            allowedHosts: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
-        }, z.core.$strict>>;
-        packages: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
-            name: z.ZodMiniString<string>;
-            version: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        }, z.core.$strict>>>;
-        envVars: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>>;
-    }, z.core.$strict>>;
-    securityProfile: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniEnum<{
-        strict: "strict";
-        standard: "standard";
-        developer: "developer";
-    }>>>;
-    metadata: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>>;
-    fileCapture: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniObject<{
-        allowedDirs: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniUnknown>>;
-        deniedDirs: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniUnknown>>;
-        captureTimeoutMs: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-        maxFileBytes: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-        maxTotalBytes: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-        maxFiles: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    }, z.core.$strict>>>;
-    builtinTools: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"default">, z.ZodMiniLiteral<"none">, z.ZodMiniArray<z.ZodMiniUnknown>]>>>;
-    outputMode: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniEnum<{
-        buffered: "buffered";
-        stream: "stream";
-    }>>>;
-    responseFormat: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
-        kind: z.ZodMiniLiteral<"text">;
-    }, z.core.$strict>, z.ZodMiniObject<{
-        kind: z.ZodMiniLiteral<"json_schema">;
-        schema: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
-        strict: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-        name: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    }, z.core.$strict>], "kind">>>;
-    approvalGate: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniObject<{
-        tools: z.ZodMiniArray<z.ZodMiniString<string>>;
-    }, z.core.$strict>>>;
-    platform: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniObject<{
-        systemPrompt: z.ZodMiniOptional<z.ZodMiniEnum<{
-            default: "default";
-            off: "off";
-        }>>;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-export type SubmissionWire = z.infer<typeof SubmissionSchema>;