@anureo/sdk 0.2.0 → 0.3.0

package/src/ports.d.ts

@@ -0,0 +1,224 @@
+import type { AhpEventPayload, AhpMethod, AhpRequestMap, AhpResultMap, Capabilities, HarnessError, InitializeParams, InitializeResult, InteractionRequested, InteractionResponse, JsonSchema, SessionBinding, SessionOpenParams } from '@anureo/protocol';
+import type { QueueLimits } from "./queue.js";
+/**
+ * Deliver an interaction answer or cancellation to the native peer. Adapters supply this callback to
+ * the sink's requestInteraction. InteractionRegistry.deliverResponse invokes it with an answer;
+ * cancelPending invokes it with null and a reason on expiry/cancellation/teardown.
+ * Session.requestInteraction also calls it directly when rejecting closed, unsupported or handler
+ * capacity admission. Resolve once native delivery or cancellation is confirmed by the adapter.
+ * Reject delivery failures and mark uncertain outcomes so the SDK can report them without retrying
+ * a response that might already have been accepted.
+ */
+export type NativeInteractionResponder = (response: InteractionResponse | null, reason?: string) => Promise<void>;
+/** Session.request and BackendSession.execute use these methods; Client handles initialize/session-open separately through HarnessAdapter. */
+export type SessionMethod = Exclude<AhpMethod, 'initialize' | 'session/open'>;
+/** Supply the execution and item identities for a native event. IDs in scope and payload must agree. */
+export interface EventScope {
+    /** Execution identity needed for item/usage events whose payload carries no turn ID. */
+    turnId?: string;
+    /** Optional item identity; must agree with an item payload's own ID. */
+    itemId?: string;
+}
+/**
+ * Publish events and settle interactions through the sink received by HarnessAdapter.openSession.
+ * OutputSession.open supplies adapter callbacks that route events through structured-output policy
+ * before delivering them to Session. Await publication calls to preserve source order. Report
+ * observation failures through fail and release native resources through the adapter's disposal.
+ */
+export interface SessionEventSink {
+    /**
+     * Project final JSON synchronously for privacy. Session supplies this hook to
+     * OutputSession.publishOutput, which revalidates the returned text against the schema.
+     * Projection or validation failure turns the native success into a failed terminal result.
+     */
+    projectOutput?(text: string): string;
+    /**
+     * Publish an association between a submission and its native execution. Successful publication
+     * can resolve Session.submit before the native receipt. Invalid or conflicting bindings fail
+     * publication. PiBackendSession.beginTurn awaits this before processing later turn events.
+     */
+    bindSubmission(submissionId: string, turnId: string): Promise<void>;
+    /**
+     * Admit a detached event for ordered processing. Await this call before sending a dependent event.
+     * Structured-output policy can hold events until a binding arrives. Admission can throw or reject.
+     * Queued processing failures reject and end observation.
+     */
+    emit(event: AhpEventPayload, scope?: EventScope): Promise<void>;
+    /** Attempt event admission without waiting. False reports immediate failure. True allows later processing failure to end observation. */
+    tryEmit(event: AhpEventPayload, scope?: EventScope): boolean;
+    /**
+     * Register a native request and the callback that delivers its answer or cancellation. Session
+     * publishes interaction/requested before scheduling a configured host handler. Manual answers
+     * arrive through Session.request. Resolve with the answer after delivery and settlement
+     * publication. Admission failures, cancellation and expiry reject. If native delivery and
+     * publication of its unknown outcome both fail, the pending answer can remain unresolved.
+     * Keep native callback resources available through settlement or adapter teardown.
+     */
+    requestInteraction(request: InteractionRequested, responder: NativeInteractionResponder): Promise<InteractionResponse>;
+    /**
+     * Report settlement already completed by the native peer. Session publishes the result without
+     * invoking the responder and rejects the pending requestInteraction, including for a responded
+     * outcome, because there is no answer value. Unknown or resolved IDs are ignored. A publication
+     * failure rejects this call.
+     */
+    resolveInteraction(result: AhpResultMap['interaction/respond']): Promise<void>;
+    /**
+     * Report observation loss. The first call on an open Session ends observation, cancels pending
+     * interactions and attempts backend cleanup. Session suppresses backend disposal rejection.
+     * Native execution stop remains unconfirmed.
+     */
+    fail(cause: unknown): Promise<void>;
+}
+/**
+ * Inspect the candidate decision returned by StructuredOutputToolDefinition.execute to native tool
+ * adapters. OutputSession.submitCandidate checks and retains accepted candidates. Acceptance is
+ * provisional: final privacy/schema validation occurs at terminal publication. Rejection carries
+ * safe retry/terminal policy; infrastructure failure can reject the callback promise instead.
+ */
+export type StructuredOutputToolResult = {
+    accepted: true;
+} | {
+    accepted: false;
+    error: HarnessError;
+};
+/**
+ * Present this tool to the native agent and invoke execute for candidate calls. OutputSession.prepareOutput
+ * passes the definition to a native StructuredOutputToolPort before input dispatch. The adapter
+ * consumes acceptance or safe failure. Each callback captures its submission, so a late call cannot
+ * satisfy a replacement input. Native tool registration/cleanup remains the adapter's responsibility.
+ */
+export interface StructuredOutputToolDefinition {
+    /** Native tool name supplied by the output wrapper; keep it stable when presenting the tool. */
+    name: string;
+    /** Model-facing instructions supplied by the output wrapper. */
+    description: string;
+    /** Candidate schema whose constraints the native tool presentation must preserve. */
+    schema: JsonSchema;
+    /** Native tool calls await candidate validation/retention; resolve a decision, or reject an infrastructure failure. Acceptance does not settle Turn.result. */
+    execute(value: unknown): Promise<StructuredOutputToolResult>;
+}
+/**
+ * Implement session-scoped native tool registration on a BackendSession. OutputSession.prepareOutput
+ * awaits installation before dispatch. OutputSession.completeTurn, reject and release disable the
+ * tool on completion, definite rejection or teardown. Finish changes before resolving.
+ */
+export interface StructuredOutputToolPort {
+    /**
+     * OutputSession replaces the tool or disables it with undefined. Resolve when native registration
+     * changes complete; setup rejection prevents input dispatch, while teardown rejection reports cleanup failure.
+     */
+    configure(tool?: StructuredOutputToolDefinition): Promise<void>;
+}
+/**
+ * Return an owned native session from HarnessAdapter.openSession. OutputSession.open adopts it; Client then
+ * attaches the wrapper to Session. Session.executeRequest awaits wrapper execute and
+ * Session.disposeBackend awaits wrapper disposal, which releases the native backend. Receipt promises
+ * and sink events can settle independently; adapters must preserve that distinction.
+ */
+export interface BackendSession {
+    /** Optional native tool registration used by OutputSession.prepareOutput when native outputSchema support is absent. */
+    readonly structuredOutputTool?: StructuredOutputToolPort;
+    /** Optional attachment snapshot; Session.attach restores its active execution observations after checking its binding. */
+    readonly state?: import('@anureo/protocol').SessionState;
+    /** Session.attach requires the requested session/adapter/configuration IDs, then adopts this binding's nativeRef. */
+    readonly binding: SessionBinding;
+    /** Session-specific capabilities adopted at attachment, after output projection; may differ from initialization capabilities. */
+    readonly capabilities: Capabilities;
+    /**
+     * OutputSession.execute invokes the native backend after policy setup and request validation.
+     * Resolve a native receipt/result or reject a safe failure with unknown-outcome metadata when
+     * acceptance is uncertain; neither wrapper nor Session automatically retries native dispatch.
+     */
+    execute<M extends SessionMethod>(method: M, params: AhpRequestMap[M]): Promise<AhpResultMap[M]>;
+    /** OutputSession.dispose awaits native handle release; implementations must be idempotent and reject cleanup failure without claiming execution stopped. */
+    dispose(): Promise<void>;
+}
+/**
+ * Implement native negotiation, session acquisition and client-wide cleanup for ClientOptions.adapter.
+ * Client invokes these operations through its structured-output wrapper. Release partially acquired
+ * native resources if setup fails. Be prepared to dispose after failed negotiation or while
+ * negotiation or a native open is still in flight, since a host can stop waiting first.
+ */
+export interface HarnessAdapter {
+    /**
+     * Select a bridge transport reachable by the native session, or return undefined to disable MCP
+     * fallback. OutputSession.open calls this synchronously when initialization lacks native
+     * outputSchema support. Opt in when native open can consume session-scoped MCP configuration.
+     * A throw rejects session setup.
+     */
+    outputBridgeTransport?(params: SessionOpenParams): 'http' | 'stdio' | undefined;
+    /** Client.initialize awaits negotiation through its wrapper, validates the result and stores capabilities; reject incompatible contracts/native setup failure. */
+    initialize(params: InitializeParams): Promise<InitializeResult>;
+    /**
+     * OutputSession.open supplies detached params and forwarding sink callbacks. Resolve an owned
+     * backend; callbacks may run before it resolves. Reject setup failure after releasing partially
+     * acquired native resources; the wrapper/Session release backends that arrive after caller teardown.
+     */
+    openSession(params: SessionOpenParams, sink: SessionEventSink): Promise<BackendSession>;
+    /** The output wrapper invokes this after session cleanup attempts; release client-wide native resources or reject release failure. */
+    dispose(): Promise<void>;
+}
+/**
+ * Hosts supply these hooks/budgets through ClientOptions.runtime. Client consumes ID/wait policy;
+ * Session consumes publication, interaction and privacy policy. Hooks can perform host-owned effects,
+ * but do not transfer native execution ownership. Callback failures propagate through their invoking
+ * operation; hosts must arrange any cleanup needed by their callbacks.
+ */
+export interface RuntimeOptions {
+    /**
+     * Generate nonempty, collision-free IDs synchronously; defaults to randomUUID. Client session helpers
+     * and Session request/stream allocation invoke this; allocation failures propagate to their callers.
+     */
+    createId?: () => string;
+    /**
+     * Supply public ISO timestamps for Session.publish. Defaults to new Date().toISOString().
+     * An invalid timestamp or throw fails publication. Interaction expiry uses wall-clock time.
+     */
+    now?: () => string;
+    /**
+     * Default wait for initialization, session requests, submission association and native interaction
+     * responders, in milliseconds. Defaults to 30_000. Per-call waits can override the operation
+     * wait. Turn.result has a separate 30-second default.
+     */
+    requestTimeoutMs?: number;
+    /**
+     * Default session attachment wait in milliseconds; defaults to 120_000. Per-call waits override it;
+     * abort/expiry does not abandon late backend cleanup.
+     */
+    openTimeoutMs?: number;
+    /**
+     * Bound actionable interaction lifetime in milliseconds. Defaults to 600_000.
+     * An earlier native expiry takes precedence.
+     */
+    interactionTimeoutMs?: number;
+    /**
+     * Separate caps for pending/settling interactions and live automatic handlers; each defaults to 32.
+     * Aborted host work retains its slot until settled.
+     */
+    maxPendingInteractions?: number;
+    /**
+     * Retained idempotency-outcome count per session; defaults to 1024.
+     * Session.admitRequestCapacity never evicts unsettled requests.
+     */
+    requestCacheSize?: number;
+    /**
+     * Set maxEvents, maxBytes and maxFrameBytes for session and structured-output event buffering.
+     * Their defaults are 2048 events, 16 MiB buffered and 8 MiB per frame. Observer queues use
+     * EventSubscriptionOptions.
+     */
+    queue?: QueueLimits;
+    /**
+     * Persist irreversible privacy metadata synchronously before accepting a new marked secret.
+     * Session registers this hook with SecretRedactor. SecretRedactor.rememberScalar invokes it before
+     * retaining a new marked value during InteractionRegistry.respond's pre-delivery check.
+     * A throw prevents native response delivery and leaves earlier persisted values in place.
+     */
+    onMarkedSecret?: (binding: Readonly<SessionBinding>, value: string) => void;
+    /**
+     * Apply host privacy metadata, including secrets retained across processes, to a native history page.
+     * Session.executeRequest invokes/awaits this after local history redaction, then validates/freezes
+     * the returned history/read page for its caller. Host I/O is allowed; throws/rejection fail the
+     * history request without SDK retries.
+     */
+    redactHistory?: (binding: Readonly<SessionBinding>, page: AhpResultMap["history/read"]) => AhpResultMap["history/read"] | Promise<AhpResultMap["history/read"]>;
+}

package/src/privacy/file-change-limits.d.ts

@@ -0,0 +1,20 @@
+import type { Item } from '@anureo/protocol';
+/**
+ * boundMaterial caps available materials across every file in one tool-call item. Existing
+ * unavailable metadata does not consume this count; excess available materials are omitted.
+ */
+export declare const FILE_CHANGE_MATERIAL_LIMIT = 50;
+/**
+ * Per-item UTF-8 text budget used by boundFileChangeItem.
+ * Canonical material reserves bytes before mirrors; JSON keys and item metadata are outside the cap.
+ */
+export declare const FILE_CHANGE_TEXT_LIMIT: number;
+/**
+ * Bound a tool call's file-change evidence without mutating the input. Items without fileChanges
+ * and non-tool items pass through by identity. Canonical material consumes the shared byte budget
+ * before input, output, raw and extensions, in that order. Overflow sets x-anureo/fileChangesTruncated.
+ * Only loss of canonical material downgrades a change's completeness and existing stat accuracy.
+ * SecretRedactor.toolCall calls this after redaction, so live events and history get the same
+ * retention rules. Callers own protocol validation and publication.
+ */
+export declare function boundFileChangeItem(item: Item): Item;

package/src/privacy/file-change-limits.js

@@ -0,0 +1,124 @@
+/**
+ * boundMaterial caps available materials across every file in one tool-call item. Existing
+ * unavailable metadata does not consume this count; excess available materials are omitted.
+ */
+export const FILE_CHANGE_MATERIAL_LIMIT = 50;
+/**
+ * Per-item UTF-8 text budget used by boundFileChangeItem.
+ * Canonical material reserves bytes before mirrors; JSON keys and item metadata are outside the cap.
+ */
+export const FILE_CHANGE_TEXT_LIMIT = 256 * 1024;
+/**
+ * Bound a tool call's file-change evidence without mutating the input. Items without fileChanges
+ * and non-tool items pass through by identity. Canonical material consumes the shared byte budget
+ * before input, output, raw and extensions, in that order. Overflow sets x-anureo/fileChangesTruncated.
+ * Only loss of canonical material downgrades a change's completeness and existing stat accuracy.
+ * SecretRedactor.toolCall calls this after redaction, so live events and history get the same
+ * retention rules. Callers own protocol validation and publication.
+ */
+export function boundFileChangeItem(item) {
+    if (item.type !== 'toolCall' || item.fileChanges === undefined)
+        return item;
+    const budget = {
+        bytes: FILE_CHANGE_TEXT_LIMIT,
+        materials: 0,
+        truncated: false,
+        encoder: new TextEncoder(),
+    };
+    const fileChanges = item.fileChanges.map(change => boundChange(change, budget));
+    const result = { ...item, fileChanges };
+    if (item.input !== undefined)
+        result.input = boundMirror(item.input, budget);
+    if (item.output !== undefined)
+        result.output = boundMirror(item.output, budget);
+    if (item.raw !== undefined)
+        result.raw = boundMirror(item.raw, budget);
+    if (item.extensions)
+        result.extensions = boundMirror(item.extensions, budget);
+    if (budget.truncated)
+        result.extensions = { ...result.extensions, 'x-anureo/fileChangesTruncated': true };
+    return result;
+}
+/**
+ * boundMaterial and boundMirror use this shared accounting rather than independent budgets. Return
+ * text within the remaining UTF-8 allowance and debit it. Overflow sets the sticky truncation flag
+ * and keeps only complete newline-terminated lines, dropping any split UTF-8 character with its line.
+ * Debit only the retained prefix, leaving unused bytes available to later material or mirrors.
+ */
+function takeText(budget, value) {
+    const encoded = budget.encoder.encode(value);
+    if (encoded.byteLength <= budget.bytes) {
+        budget.bytes -= encoded.byteLength;
+        return { value, complete: true };
+    }
+    const decoded = new TextDecoder().decode(encoded.subarray(0, budget.bytes));
+    const prefix = decoded.slice(0, decoded.lastIndexOf('\n') + 1);
+    budget.bytes -= budget.encoder.encode(prefix).byteLength;
+    budget.truncated = true;
+    return { value: prefix, complete: false };
+}
+/**
+ * boundChange calls this in source order with the item-wide budget. Return retained material and a
+ * partial flag, omitting material beyond the count cap. An empty retained patch becomes unavailable.
+ * Replacement sides must both fit to remain usable. Their consumed bytes stay reserved even when
+ * the replacement becomes unavailable metadata.
+ */
+function boundMaterial(material, budget) {
+    if (material.format === 'unavailable')
+        return { material, partial: false };
+    if (++budget.materials > FILE_CHANGE_MATERIAL_LIMIT) {
+        budget.truncated = true;
+        return { partial: true };
+    }
+    if (material.format === 'unified') {
+        const patch = takeText(budget, material.patch);
+        return {
+            material: patch.value ? { ...material, patch: patch.value } : { format: 'unavailable', reason: 'tooLarge' },
+            partial: !patch.complete,
+        };
+    }
+    const oldText = material.oldText === null ? null : takeText(budget, material.oldText);
+    const newText = takeText(budget, material.newText);
+    if ((oldText !== null && !oldText.complete) || !newText.complete) {
+        return { material: { format: 'unavailable', reason: 'tooLarge' }, partial: true };
+    }
+    return { material: { ...material, oldText: oldText === null ? null : oldText.value, newText: newText.value }, partial: false };
+}
+/**
+ * boundFileChangeItem maps canonical changes through this before traversing mirrors. Retain material
+ * in order and downgrade completeness/stat accuracy when a cap discards content; keep a metadata placeholder
+ * when all supplied material was omitted. Only the shared budget is mutated, never the source change.
+ */
+function boundChange(change, budget) {
+    let partial = false;
+    const materials = [];
+    for (const material of change.materials) {
+        const retained = boundMaterial(material, budget);
+        partial ||= retained.partial;
+        if (retained.material)
+            materials.push(retained.material);
+    }
+    if (!materials.length && change.materials.length)
+        materials.push({ format: 'unavailable', reason: 'tooLarge' });
+    const result = { ...change, materials };
+    if (partial) {
+        result.completeness = 'partial';
+        if (change.stats)
+            result.stats = { ...change.stats, accuracy: 'partial' };
+    }
+    return result;
+}
+/**
+ * boundFileChangeItem invokes this for input, output, raw and extensions after canonical material.
+ * Return recursively bounded JSON without changing keys or scalar types. String values consume the
+ * remaining budget in traversal order; only the shared budget is mutated.
+ */
+function boundMirror(value, budget) {
+    if (typeof value === 'string')
+        return takeText(budget, value).value;
+    if (Array.isArray(value))
+        return value.map(entry => boundMirror(entry, budget));
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, boundMirror(child, budget)]));
+    return value;
+}

package/src/privacy/secrets.d.ts

@@ -0,0 +1,205 @@
+import type { Capabilities, AhpEventPayload, AhpMethod, AhpResultMap, GoalState, HistoryPage, InteractionRequested, InteractionResponse, Item, JsonValue, SessionState } from "@anureo/protocol";
+/**
+ * Register explicitly marked answers before projecting content for public observation.
+ * This root-exported implementation helper is owned by Session, which installs registration in
+ * InteractionRegistry's pre-response callback and projects events and request results. Direct
+ * consumers own the same registration/publication order. Secrets and pending prefixes stay in
+ * memory; the optional synchronous hook owns persistence. No native resources are acquired.
+ */
+export declare class SecretRedactor {
+    private readonly onRemember?;
+    /**
+     * Create an empty in-memory registry with an optional synchronous persistence hook. Session
+     * forwards runtime.onMarkedSecret here; rememberScalar invokes it before accepting each new value.
+     * Construction only retains the hook. The host owns persistence and any effects its hook performs.
+     */
+    constructor(onRemember?: ((secret: string) => void) | undefined);
+    /**
+     * Register answers marked secret/writeOnly by the request before exposing or delivering them.
+     * Marked containers contribute their scalar descendants. Numbers and booleans register by string
+     * value, while empty strings, null and duplicates are ignored. At most 128 distinct values and
+     * 64 KiB of UTF-8 text are retained. Exceeding either cap throws a HarnessSdkError with code
+     * BACKPRESSURE_EXCEEDED. Hook exceptions also propagate, leaving earlier registrations intact.
+     * Schema traversal stops beyond depth 32, with the request schema at depth zero.
+     * Session installs this as InteractionRegistry's pre-response check. InteractionRegistry.respond
+     * invokes it after validation and rejects on failure before looking up a replay or starting native
+     * delivery. Direct consumers own validation and delivery.
+     */
+    rememberResponse(request: InteractionRequested, response: InteractionResponse): void;
+    /**
+     * Replace complete secret matches with [redacted], preferring the longest match at each position.
+     * Unmatched trailing prefixes are emitted without retaining stream state. Session.projectOutput
+     * and Session.projectSubmissionStatus use this before exposure. OutputSession.publishOutput
+     * revalidates JSON returned through projectOutput and converts schema failures into failed turns.
+     */
+    text(value: string): string;
+    /**
+     * Project an ordered text chunk, withholding a possible trailing secret prefix until the next chunk.
+     * Complete matches win even when a longer secret is incomplete. event scopes streams by turn/item
+     * and discards pending prefixes on item/completed, whose snapshot carries authoritative full text.
+     * Direct consumers must use distinct ordered keys; this method has no flush/reset operation, so
+     * they must discard the redactor when they no longer need its retained prefixes and secrets.
+     */
+    delta(stream: string, value: string): string;
+    /**
+     * Return recursively projected JSON without mutating the input. Marked numbers and booleans become
+     * the string [redacted]. If projected keys collide, the last entry in traversal order wins.
+     * Session.projectSubmissionStatus selects receipt and error content. Direct callers should also
+     * pass only content fields to preserve protocol identity.
+     */
+    json(value: JsonValue): JsonValue;
+    /**
+     * Project configuration annotations and values without modifying validation constraints or
+     * property names. Return the original value when no configuration is advertised. state uses this
+     * for session snapshots; the caller owns storing or publishing the result.
+     */
+    capabilities(value: Capabilities): Capabilities;
+    /**
+     * Return a new outer value with projected goal JSON and unchanged native goal metadata.
+     * state and result call this before exposing goal content; no session state is written here.
+     */
+    goal(value: GoalState): GoalState;
+    /**
+     * Project content-bearing state fields while preserving bindings, protocol enums and revisions; no
+     * session bookkeeping is changed. Session.snapshot calls this on reads; event and result use it
+     * for state/config observations. Session freezes reads and validates/stores request results;
+     * direct consumers retain responsibility for validation and publication.
+     */
+    state(value: SessionState): SessionState;
+    /**
+     * Project a validated configuration or goal result according to its method. Other results pass
+     * through by identity. Session.projectRequestResult routes history to history() and calls this
+     * for other projectable results. Session.executeRequest stores projected configuration or goal
+     * state and validates and freezes the returned result. Direct callers own validation and storage.
+     */
+    result<M extends AhpMethod>(method: M, value: AhpResultMap[M]): AhpResultMap[M];
+    /**
+     * Project validated item content without changing protocol identity or registering new secrets.
+     * Tool-call file changes additionally use the shared material/mirror budget. event uses this for
+     * snapshots and validated patches; history applies it to each native entry. Direct consumers
+     * must validate item shape first, as Session and deltaValue do for their respective input paths.
+     */
+    item(item: Item): Item;
+    /**
+     * Project public request content while preserving identifiers, answer keys and protocol alternatives.
+     * event calls this after Session.requestInteraction applies protocol publicInteraction; direct
+     * consumers must likewise apply protocol privacy rules first. If a privatePayload is supplied
+     * directly, this method projects its JSON content and retains the field. InteractionRegistry
+     * retains the native request for response validation and marked-field lookup.
+     */
+    interaction(request: InteractionRequested): InteractionRequested;
+    /**
+     * Project validated events in publication order, clearing an item's buffered prefix on completion.
+     * Supply turnId to isolate reused item IDs across turns. Omission uses an item-only stream key.
+     * Session.publish invokes this after lifecycle admission and before retaining/publishing results.
+     * An invalid Item-shaped patch throws ProtocolValidationError and rejects Session.emit, which
+     * starts observation teardown. Direct consumers own event validation, ordering and publication.
+     * Completed snapshots supply authoritative item content.
+     */
+    event(event: AhpEventPayload, turnId?: string): AhpEventPayload;
+    /**
+     * Project a prevalidated history page using live items' privacy/retention rules, preserving
+     * pagination and execution identities. The input must already be validated; no history is fetched
+     * here. Session.projectRequestResult calls this before executeRequest awaits the optional host
+     * redactHistory hook, validates and freezes the result; host-hook rejection fails that request.
+     */
+    history(page: HistoryPage): HistoryPage;
+    private readonly values;
+    private readonly streams;
+    private secretBytes;
+    /**
+     * rememberResponse and fromSchema call this before a response can be sent. Recursively retain marked
+     * scalar values within session budgets; invoke the host hook before accepting each new value.
+     * Capacity or hook failures throw to InteractionRegistry.respond before native delivery; values
+     * already accepted during the traversal remain registered, with no rollback of host effects.
+     */
+    private remember;
+    /**
+     * Accept a new nonempty scalar only after capacity checks and the synchronous persistence hook
+     * succeed. remember preserves traversal order, so a later failure never rolls back earlier values;
+     * a failed hook leaves this value unregistered and retryable.
+     */
+    private rememberScalar;
+    /**
+     * Resolve a reference beginning with #/ against the original request schema. Decode JSON Pointer
+     * escapes and follow object keys. A missing key or non-object intermediate yields undefined.
+     * fromSchema checks the returned node's shape before visiting it.
+     */
+    private resolveLocalReference;
+    /**
+     * rememberResponse calls this for elicitation/dynamicTool schemas; recursive branches pass marked
+     * values to remember. Collect marked values through bounded local schema traversal, including
+     * referenced and sibling rules; does not validate response values or fetch references. Visit
+     * references before siblings because registration order determines host-hook and budget failures.
+     * Stop beyond depth 32; registration failures propagate without undoing earlier registrations.
+     */
+    private fromSchema;
+    /**
+     * fromSchema calls this between reference and array/composition visits. Register declared
+     * properties before additional ones, sharing the next-depth context and propagating registration
+     * failures. Even a declared non-schema property excludes that key from additionalProperties.
+     */
+    private rememberObjectProperties;
+    /**
+     * fromSchema visits array elements in order under the same items schema and next-depth context.
+     * Tuple arrays and absent items rules contribute no registrations. Registration failures propagate.
+     */
+    private rememberArrayItems;
+    /**
+     * fromSchema visits composition branches after reference, object and array rules. Visit every
+     * schema branch in keyword and array order without selecting a validation match. Registration
+     * failures stop the remaining visits.
+     */
+    private rememberComposedSchemas;
+    /**
+     * text consumes the complete scan; delta stores a stream scan's pending prefix for the next chunk.
+     * Return longest complete matches as redactions. Stream mode withholds an unmatched trailing
+     * prefix so it cannot leak before the next chunk arrives; complete mode emits that prefix.
+     * This scan reads registered secrets but changes no stream or registration state.
+     */
+    private scan;
+    /**
+     * capabilities calls this for config-option schemas before exposing state. Project schema
+     * annotations/defaults recursively while preserving constraints and property names; privacy must not
+     * silently change validation rules. Object schemas are copied and boolean schemas pass through.
+     */
+    private schema;
+    /**
+     * item maps user-message content through this projection. Project content-bearing input block fields
+     * while preserving modality and protocol structure; return a detached outer block without loading
+     * files or fetching URLs. item returns the block in the public user message.
+     */
+    private input;
+    /**
+     * toolCall merges these fields into projected tool-call items before bounding file-change material.
+     * Project tool image paths/prompts only; image identity and other native metadata remain
+     * authoritative. Return only the image field (or no fields) without reading or modifying an image.
+     */
+    private toolImage;
+    /**
+     * toolCall maps fileChanges through this before boundFileChangeItem enforces retention.
+     * Project change paths and material text while preserving source metadata; the caller subsequently
+     * applies the shared retention budget. Return copied text material without applying patches or
+     * changing unavailable-material metadata.
+     */
+    private fileChange;
+    /**
+     * item delegates tool content projection here after extensions have been projected. Redact every
+     * content field before enforcing the shared file-change budget so accounting measures projected
+     * text. Return the bounded snapshot without changing native identity or source material.
+     */
+    private toolCall;
+    /**
+     * itemDelta calls this for JSON-valued payloads before Session retains or publishes the event.
+     * A patch object with type or fileChanges must pass Item validation before item projection.
+     * Item-shaped validation failures throw ProtocolValidationError. Other values receive ordinary
+     * JSON projection.
+     */
+    private deltaValue;
+    /**
+     * event projects delta text before validating/projecting an optional JSON value. A malformed patch
+     * throws after any prefix update, as publication fails through Session.emit; no buffered state is
+     * rolled back. Non-Item JSON still receives ordinary content projection.
+     */
+    private itemDelta;
+}