@axiom-lattice/core 6.2.0 → 6.3.1

package/dist/index.d.mts

@@ -8,15 +8,15 @@ import { BaseLanguageModelInput, LanguageModelLike } from '@langchain/core/langu
 import { CallbackManagerForLLMRun } from '@langchain/core/callbacks/manager';
 import { ChatResult } from '@langchain/core/outputs';
 import * as _axiom_lattice_protocols from '@axiom-lattice/protocols';
-import { LLMConfig, SemanticMetricsServerConfig, MetricMeta, MetricQueryResult, DataSource, SemanticMetricsQueryRequest, SemanticMetricsQueryResponse, TableQueryRequest, TableQueryResponse, ExecuteSqlQueryRequest, ExecuteSqlQueryResponse, MetricsServerType, MetricsServerConfig, ToolConfig, ToolExecutor, AgentConfig, MiddlewareType, GraphBuildOptions, DeepAgentConfig, MessageChunk, MessageChunkType, QueueLatticeProtocol, QueueConfig, QueueClient, QueueResult, ScheduleLatticeProtocol, ScheduleConfig, ScheduleClient, ScheduleStorage, TaskHandler, ScheduleOnceOptions, ScheduleCronOptions, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TrustedRunContext, QueuedExecutionMode, ThreadStore, AssistantStore, SkillStore, CollectionStore, WorkspaceStore, ProjectStore, DatabaseConfigStore, MetricsServerConfigStore, McpServerConfigStore, ModelProviderStore, UserStore, TenantStore, UserTenantLinkStore, WorkflowTrackingStore, EvalStore, ChannelInstallationStore, BindingRegistry, MenuRegistry, A2AApiKeyStore, OpenAuditStore, TaskStore, SharedResourceStore, ConnectionStore, TaskWorkItemStore, AgentWebAppStore, CapabilityBundleStore, ProjectRoomStore, ProjectMembershipStore, ProjectBotMembershipStore, ProjectRoomMessageStore, ProjectRoomReadStateStore, UserPushSubscriptionStore, VectorStoreProvider, Thread, CreateThreadRequest, Assistant, CreateAssistantRequest, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, Skill, CreateSkillRequest, SkillStoreContext, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, ModelProviderEntry, CreateModelProviderRequest, UpdateModelProviderRequest, ModelProviderStatus, ModelProviderModelEntry, ProviderModelInput, User, CreateUserRequest, UpdateUserRequest, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditAppendInput, OpenAuditQuery, OpenAuditRecord, TaskMutationSnapshot, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, CreateWorkItemRequest, TaskWorkItem, CreateWorkItemIfAbsentRequest, TaskWorkItemListFilter, ProjectLifecycleEventQuery, Collection, CreateCollectionRequest, UpdateCollectionRequest, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, ProjectRoom, ProjectMembership, ProjectBotMembership, ProjectRoomMessage, ProjectHumanRole, ProjectMembershipMutationResult, ProjectRoomReadState, UserPushSubscription, STTModelLatticeProtocol, STTConfig, STTClient, TranscriptionResult, LoggerLatticeProtocol, LoggerConfig, LoggerClient, LoggerContext, SkillConfig, SkillClient, PluginSkillDefinition, McpTool, McpUiResourcePayload, McpServerConfig, McpUiRef, ResourceResolver, ResourceAddress, ShareVisibility, OpenGrant, CreateShareRequest, ChannelAdapter, InterruptPolicy, ProjectTaskLifecycleAction, TaskBeliefState, PluginMeta, Plugin, PluginMetaOutput, SandboxPluginManifest, SandboxPluginToolDef, SandboxPluginDiagnostic, CapabilityPreview, CreateCapabilityBundleInput, UpdateCapabilityBundleInput, InternalStateField, InternalInput, InternalNode, InternalAgentNode, InternalMapNode, InternalDSL, ConnectionEntry } from '@axiom-lattice/protocols';
+import { LLMConfig, SemanticMetricsServerConfig, MetricMeta, MetricQueryResult, DataSource, SemanticMetricsQueryRequest, SemanticMetricsQueryResponse, TableQueryRequest, TableQueryResponse, ExecuteSqlQueryRequest, ExecuteSqlQueryResponse, MetricsServerType, MetricsServerConfig, ToolConfig, ToolExecutor, AgentConfig, MiddlewareType, GraphBuildOptions, DeepAgentConfig, MessageChunk, MessageChunkType, QueueLatticeProtocol, QueueConfig, QueueClient, QueueResult, ScheduleLatticeProtocol, ScheduleConfig, ScheduleClient, ScheduleStorage, TaskHandler, ScheduleOnceOptions, ScheduleCronOptions, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TrustedRunContext, QueuedExecutionMode, ThreadStore, AssistantStore, SkillStore, CollectionStore, WorkspaceStore, ProjectStore, DatabaseConfigStore, MetricsServerConfigStore, McpServerConfigStore, ModelProviderStore, UserStore, TenantStore, UserTenantLinkStore, WorkflowTrackingStore, EvalStore, ChannelInstallationStore, BindingRegistry, MenuRegistry, A2AApiKeyStore, OpenAuditStore, TaskStore, SharedResourceStore, ConnectionStore, TaskWorkItemStore, AgentWebAppStore, CapabilityBundleStore, ProjectRoomStore, ProjectMembershipStore, ProjectBotMembershipStore, ProjectRoomMessageStore, ProjectRoomReadStateStore, UserPushSubscriptionStore, LeaseStore, OutboxStore, VectorStoreProvider, Thread, CreateThreadRequest, Assistant, CreateAssistantRequest, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, Skill, CreateSkillRequest, SkillStoreContext, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, ModelProviderEntry, CreateModelProviderRequest, UpdateModelProviderRequest, ModelProviderStatus, ModelProviderModelEntry, ProviderModelInput, User, CreateUserRequest, UpdateUserRequest, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditAppendInput, OpenAuditQuery, OpenAuditRecord, TaskMutationSnapshot, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, CreateWorkItemRequest, TaskWorkItem, CreateWorkItemIfAbsentRequest, TaskWorkItemListFilter, ProjectLifecycleEventQuery, Collection, CreateCollectionRequest, UpdateCollectionRequest, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, ProjectRoom, ProjectMembership, ProjectBotMembership, ProjectRoomMessage, ProjectHumanRole, ProjectMembershipMutationResult, ProjectRoomReadState, UserPushSubscription, LeaseRecord, OutboxEvent, STTModelLatticeProtocol, STTConfig, STTClient, TranscriptionResult, LoggerLatticeProtocol, LoggerConfig, LoggerClient, LoggerContext, SkillConfig, SkillClient, PluginSkillDefinition, McpTool, McpUiResourcePayload, McpServerConfig, McpUiRef, ResourceResolver, ResourceAddress, ShareVisibility, OpenGrant, CreateShareRequest, ChannelAdapter, InterruptPolicy, ProjectTaskLifecycleAction, TaskBeliefState, PluginMeta, Plugin, PluginMetaOutput, SandboxPluginManifest, SandboxPluginToolDef, SandboxPluginDiagnostic, CapabilityPreview, CreateCapabilityBundleInput, UpdateCapabilityBundleInput, InternalStateField, InternalInput, InternalNode, InternalAgentNode, InternalMapNode, InternalDSL, ConnectionEntry } from '@axiom-lattice/protocols';
 export { _axiom_lattice_protocols as Protocols };
 export { AgentConfig, AgentType, GraphBuildOptions, MemoryType, ProjectRoomTrustedRunContext, QueuedExecutionMode, TrustedRunContext, parseQueuedExecutionMode, parseTrustedRunContext } from '@axiom-lattice/protocols';
 import * as langchain from 'langchain';
-import { ReactAgent, AgentMiddleware } from 'langchain';
+import { StructuredTool, ReactAgent, AgentMiddleware } from 'langchain';
 import z, { z as z$1, ZodTypeAny } from 'zod';
 import { BaseStore, BaseCheckpointSaver } from '@langchain/langgraph-checkpoint';
 import * as _langchain_core_tools from '@langchain/core/tools';
-import { StructuredTool, DynamicStructuredTool } from '@langchain/core/tools';
+import { StructuredTool as StructuredTool$1, DynamicStructuredTool } from '@langchain/core/tools';
 import * as _langchain_langgraph from '@langchain/langgraph';
 import { CompiledStateGraph, CommandParams, AnnotationRoot } from '@langchain/langgraph';
 import { ReplaySubject } from 'rxjs';
@@ -1721,11 +1721,21 @@ interface SandboxManagerProtocol {
     getVolumeBackendForPath(config: RunSandboxConfig, filePath: string): Promise<BackendProtocol | null>;
 }
 
+/**
+ * Shell Execution Tool (shell_exec)
+ *
+ * Execute a shell command in the sandbox environment.
+ */
+
+declare const createShellExecTool: ({ vmIsolation, }: {
+    vmIsolation: SandboxIsolationLevel;
+}) => StructuredTool;
+
 type ToolDefinition = ToolConfig;
 interface ToolLattice {
     key: string;
     config: ToolConfig;
-    client: StructuredTool;
+    client: StructuredTool$1;
 }
 /**
  * ToolLatticeManager - 单例工具Lattice管理器
@@ -1788,7 +1798,7 @@ declare class ToolLatticeManager extends BaseLatticeManager<ToolLattice> {
      * 获取工具客户端
      * @param key Lattice键名
      */
-    getToolClient(key: string): StructuredTool;
+    getToolClient(key: string): StructuredTool$1;
     /**
      * 获取所有工具定义
      */
@@ -1798,7 +1808,7 @@ declare class ToolLatticeManager extends BaseLatticeManager<ToolLattice> {
      * @param key Lattice键名
      * @param tool 已有的StructuredTool实例
      */
-    registerExistingTool(key: string, tool: StructuredTool): void;
+    registerExistingTool(key: string, tool: StructuredTool$1): void;
     /**
      * Register an existing StructuredTool into a specific tenant's tool bucket.
      *
@@ -1806,7 +1816,7 @@ declare class ToolLatticeManager extends BaseLatticeManager<ToolLattice> {
      * @param key - tool lattice key (no tenant prefix)
      * @param tool - the StructuredTool client
      */
-    registerExistingToolWithTenant(tenantId: string, key: string, tool: StructuredTool): void;
+    registerExistingToolWithTenant(tenantId: string, key: string, tool: StructuredTool$1): void;
     /**
      * Get a tool lattice from a specific tenant bucket.
      *
@@ -1823,7 +1833,7 @@ declare class ToolLatticeManager extends BaseLatticeManager<ToolLattice> {
      * @param key - tool lattice key
      * @returns the StructuredTool client
      */
-    getToolClientWithTenant(tenantId: string, key: string): StructuredTool;
+    getToolClientWithTenant(tenantId: string, key: string): StructuredTool$1;
     /**
      * 验证工具输入参数
      * @param key Lattice键名
@@ -1833,12 +1843,12 @@ declare class ToolLatticeManager extends BaseLatticeManager<ToolLattice> {
 }
 declare const toolLatticeManager: ToolLatticeManager;
 declare const registerToolLattice: (key: string, config: ToolConfig, executor: ToolExecutor) => void;
-declare const registerExistingTool: (key: string, tool: StructuredTool) => void;
-declare const registerExistingToolWithTenant: (tenantId: string, key: string, tool: StructuredTool) => void;
+declare const registerExistingTool: (key: string, tool: StructuredTool$1) => void;
+declare const registerExistingToolWithTenant: (tenantId: string, key: string, tool: StructuredTool$1) => void;
 declare const getToolLattice: (key: string) => ToolLattice | undefined;
-declare const getToolClientWithTenant: (tenantId: string, key: string) => StructuredTool<_langchain_core_tools.ToolSchemaBase, any, any, any>;
+declare const getToolClientWithTenant: (tenantId: string, key: string) => StructuredTool$1<_langchain_core_tools.ToolSchemaBase, any, any, any>;
 declare const getToolDefinition: (key: string) => ToolConfig;
-declare const getToolClient: (key: string) => StructuredTool<_langchain_core_tools.ToolSchemaBase, any, any, any>;
+declare const getToolClient: (key: string) => StructuredTool$1<_langchain_core_tools.ToolSchemaBase, any, any, any>;
 declare const getAllToolDefinitions: () => ToolConfig[];
 declare const validateToolInput: (key: string, input: any) => boolean;
 
@@ -2712,6 +2722,22 @@ declare class MemoryScheduleStorage implements ScheduleStorage {
      * Update task
      */
     update(taskId: string, updates: Partial<ScheduledTaskDefinition>): Promise<void>;
+    /**
+     * Atomically claims one due fire by transitioning the task `pending -> running`.
+     *
+     * @param taskId Task to claim.
+     * @returns True when this caller won the claim (task was `pending`); false if
+     *   another replica already claimed it or it is not pending.
+     */
+    claimScheduledRun(taskId: string): Promise<boolean>;
+    /**
+     * Requeues `running` tasks whose `updatedAt` is older than `olderThanMs` back
+     * to `pending` (recovery after a crash that left a claim unsettled).
+     *
+     * @param olderThanMs Age threshold in milliseconds.
+     * @returns The number of tasks requeued.
+     */
+    requeueStaleRunning(olderThanMs: number): Promise<number>;
     /**
      * Delete task
      */
@@ -2903,6 +2929,20 @@ interface ThreadInfo {
     projectId?: string | null;
 }
 type QueueScope = Pick<ThreadInfo, "tenantId" | "assistantId" | "workspaceId" | "projectId">;
+/**
+ * Options for an atomic pending→processing claim.
+ *
+ * @remarks `owner` identifies the claimant replica (see `getReplicaId`); a
+ * claim is only reclaimable once its lease expires.
+ */
+interface ClaimMessagesOptions {
+    /** Replica/owner id stamped on claimed rows. */
+    owner: string;
+    /** Lease time-to-live in milliseconds. */
+    ttlMs: number;
+    /** Maximum rows to claim; omitted means all currently-pending rows. */
+    limit?: number;
+}
 /**
  * Interface for message queue storage
  * Implemented by pg-stores or other storage backends
@@ -2912,6 +2952,24 @@ interface IMessageQueueStore {
     addMessageIfCapacity(params: AddMessageParams, maxSize: number): Promise<boolean>;
     addMessageAtHead(params: AddMessageParams): Promise<PendingMessage>;
     getPendingMessages(threadId: string, scope?: QueueScope): Promise<PendingMessage[]>;
+    /**
+     * Atomically claims pending messages for `owner`, moving them to `processing`
+     * with a lease. Concurrent callers receive disjoint sets.
+     *
+     * @param threadId Thread whose queue is claimed.
+     * @param scope Optional exact scope filter.
+     * @param options Owner id, lease TTL, and optional row limit.
+     * @returns The messages this caller actually claimed (possibly empty).
+     */
+    claimPendingMessages(threadId: string, scope: QueueScope | undefined, options: ClaimMessagesOptions): Promise<PendingMessage[]>;
+    /**
+     * Returns `processing` messages whose lease expired to `pending`.
+     *
+     * @param threadId Thread to reclaim.
+     * @param scope Optional exact scope filter.
+     * @returns The number of rows reset to `pending`.
+     */
+    reclaimExpiredProcessing(threadId: string, scope?: QueueScope): Promise<number>;
     getProcessingMessages(threadId: string, scope?: QueueScope): Promise<PendingMessage[]>;
     getQueueSize(threadId: string, scope?: QueueScope): Promise<number>;
     getThreadsWithPendingMessages(): Promise<ThreadInfo[]>;
@@ -3006,6 +3064,8 @@ type StoreTypeMap = {
     projectRoomMessage: ProjectRoomMessageStore;
     projectRoomReadState: ProjectRoomReadStateStore;
     userPushSubscription: UserPushSubscriptionStore;
+    lease: LeaseStore;
+    outbox: OutboxStore;
 };
 /**
  * Store type keys
@@ -4019,9 +4079,11 @@ declare class InMemoryOpenAuditStore implements OpenAuditStore {
  */
 
 declare class InMemoryThreadMessageQueueStore implements IMessageQueueStore {
+    private readonly now;
     private messages;
     private messageIdCounter;
     private capacityTail;
+    constructor(now?: () => number);
     private generateId;
     private getMessagesForThread;
     private inScope;
@@ -4030,6 +4092,8 @@ declare class InMemoryThreadMessageQueueStore implements IMessageQueueStore {
     addMessageAtHead(params: AddMessageParams): Promise<PendingMessage>;
     getPendingMessages(threadId: string, scope?: QueueScope): Promise<PendingMessage[]>;
     getProcessingMessages(threadId: string, scope?: QueueScope): Promise<PendingMessage[]>;
+    claimPendingMessages(threadId: string, scope: QueueScope | undefined, options: ClaimMessagesOptions): Promise<PendingMessage[]>;
+    reclaimExpiredProcessing(threadId: string, scope?: QueueScope): Promise<number>;
     getQueueSize(threadId: string, scope?: QueueScope): Promise<number>;
     getThreadsWithPendingMessages(): Promise<ThreadInfo[]>;
     removeMessage(messageId: string, scope?: QueueScope): Promise<boolean>;
@@ -4639,6 +4703,79 @@ declare class InMemoryUserPushSubscriptionStore implements UserPushSubscriptionS
     delete(tenantId: string, userId: string, endpoint: string): Promise<boolean>;
 }
 
+/**
+ * In-process {@link LeaseStore} used for single-process runs and tests.
+ *
+ * @remarks Real cross-replica exclusion requires the PostgreSQL implementation;
+ * this store only serializes within one Node process.
+ */
+declare class InMemoryLeaseStore implements LeaseStore {
+    private readonly leases;
+    private readonly now;
+    /**
+     * @param now Injectable clock in epoch milliseconds (tests use a fake clock).
+     */
+    constructor(now?: () => number);
+    /** Atomically acquires a free/expired key (or the caller's own key). */
+    tryAcquire(key: string, holder: string, ttlMs: number): Promise<boolean>;
+    /** Extends a lease only while `holder` still owns it. */
+    renew(key: string, holder: string, ttlMs: number): Promise<boolean>;
+    /** Deletes a lease only when `holder` owns it. */
+    release(key: string, holder: string): Promise<boolean>;
+    /** Returns the live lease, pruning an expired one. */
+    get(key: string): Promise<LeaseRecord | null>;
+}
+
+/**
+ * In-process {@link OutboxStore} used for single-process runs and tests.
+ *
+ * @remarks Real cross-replica fan-out requires the PostgreSQL implementation;
+ * this store only preserves a monotonic log within one Node process. Ids are
+ * assigned from an in-memory counter and serialized as decimal strings to match
+ * the transport-neutral contract.
+ */
+declare class InMemoryOutboxStore implements OutboxStore {
+    private readonly events;
+    private counter;
+    private readonly now;
+    /**
+     * Creates an in-memory outbox store.
+     *
+     * @param now Optional clock override (defaults to the system clock); it stamps
+     * `createdAt` and is used to evaluate age-based retention.
+     */
+    constructor(now?: () => Date);
+    /**
+     * Appends one event, assigning the next monotonic id.
+     * @param input Topic, JSON-safe payload, and authoring replica id.
+     * @returns A defensive copy of the stored event.
+     */
+    append(input: {
+        topic: string;
+        payload: unknown;
+        originReplicaId: string;
+    }): Promise<OutboxEvent>;
+    /**
+     * Lists events strictly newer than `cursor`, ascending, bounded by `limit`.
+     * @param cursor Last-seen id, or `null` to read from the start.
+     * @param limit Maximum number of events to return.
+     * @returns Defensive copies of the matching events.
+     */
+    listAfter(cursor: string | null, limit: number): Promise<OutboxEvent[]>;
+    /**
+     * Returns the newest event id.
+     * @returns The last id, or `null` when the log is empty.
+     */
+    latestId(): Promise<string | null>;
+    /**
+     * Deletes events older than `olderThanMs`, evaluated against this store's clock.
+     *
+     * @param olderThanMs Age threshold in milliseconds.
+     * @returns The number of events removed.
+     */
+    pruneOlderThan(olderThanMs: number): Promise<number>;
+}
+
 /**
  * Embeddings Lattice Interface
  * Defines the structure of an embeddings lattice entry
@@ -6580,6 +6717,13 @@ declare class DaytonaInstance implements SandboxInstance {
     readonly shell: SandboxShellService;
 }
 
+/**
+ * Environment variables that must never reach sandbox-executed code.
+ *
+ * A denylist MVP for the local provider (which host-executes). A future
+ * follow-up should flip this to a default-deny allowlist of benign vars.
+ */
+declare const PLATFORM_SECRET_ENV_VARS: readonly string[];
 /**
  * Sandbox instance backed by the host filesystem.
  *
@@ -6786,6 +6930,81 @@ interface SharePayload {
  */
 declare function createSharePayload(tenantId: string, workspaceId: string, projectId: string, userId: string, request: CreateShareRequest): SharePayload;
 
+/**
+ * Sandbox open-credential seam.
+ *
+ * A process-global provider (registered by the gateway composition root) resolves
+ * a short-lived Open bearer for a running sandbox so sandbox code can call the
+ * Open MCP endpoint. Core never mints tokens — it only transports a provider's
+ * result into single-process env.
+ */
+/** Identity of the sandbox whose code will consume the credential. */
+interface SandboxOpenCredentialContext {
+    tenantId: string;
+    workspaceId?: string;
+    projectId?: string;
+    /** Resolved sandbox name; determines the token's `self` binding. */
+    sandboxName: string;
+    /** Caller Assistant id (agent runs); absent for plugin-handler callers. */
+    assistantId?: string;
+    /** Caller thread id (agent runs). */
+    threadId?: string;
+    /** Current orchestration depth; nested mints pass depth+1. */
+    depth?: number;
+}
+/** A resolved Open bearer plus the gateway base URL to call. */
+interface SandboxOpenCredential {
+    gatewayUrl: string;
+    token: string;
+}
+/** Resolves a credential for a sandbox, or `undefined` to inject nothing. */
+type SandboxOpenCredentialProvider = (context: SandboxOpenCredentialContext) => Promise<SandboxOpenCredential | undefined>;
+/** Env var name carrying the platform gateway URL into sandbox code. */
+declare const SANDBOX_OPEN_GATEWAY_URL_ENV = "API_GATEWAY_URL";
+/** Env var name carrying the short-lived Open bearer into sandbox code. */
+declare const SANDBOX_OPEN_TOKEN_ENV = "OPEN_API_TOKEN";
+/** Options for {@link registerSandboxOpenCredentialProvider}. */
+interface SandboxOpenCredentialProviderOptions {
+    /** Invoked (best-effort) when the provider throws; use for structured warnings. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * Register (or replace) the process-global sandbox open-credential provider.
+ *
+ * @param next - Provider implementation supplied by the composition root
+ * @param options - Optional error hook for structured warnings
+ * @returns An unregister function that clears the registration when it is still current
+ *
+ * @remarks
+ * Singleton, last-write-wins. A stale unregister (from a superseded registration)
+ * is a no-op, so hot-path re-registration cannot be disarmed by an old handle.
+ *
+ * @example
+ * ```ts
+ * const unregister = registerSandboxOpenCredentialProvider(
+ *   async (ctx) => ({ gatewayUrl: process.env.PUBLIC_GATEWAY_URL!, token: mint(ctx) }),
+ *   { onError: (err) => logger.warn({ err }, "sandbox credential failed") },
+ * );
+ * ```
+ */
+declare function registerSandboxOpenCredentialProvider(next: SandboxOpenCredentialProvider, options?: SandboxOpenCredentialProviderOptions): () => void;
+/**
+ * Resolve the credential for a sandbox.
+ *
+ * @param context - Sandbox identity and resolved sandbox name
+ * @returns The credential, or `undefined` when no provider is registered or it throws
+ */
+declare function getSandboxOpenCredential(context: SandboxOpenCredentialContext): Promise<SandboxOpenCredential | undefined>;
+/**
+ * Build the shell `export … && export …` prefix for a credential.
+ *
+ * @param credential - Resolved gateway URL and bearer
+ * @returns A single-quote-escaped `export` chain safe to prepend to a command
+ */
+declare function buildSandboxOpenEnv(credential: SandboxOpenCredential): string;
+/** @internal */
+declare function clearSandboxOpenCredentialProviderForTests(): void;
+
 /**
  * Channel connection lifecycle.
  *
@@ -7598,7 +7817,7 @@ interface TeammateSpec {
     /** Model override (defaults to team-level model) */
     model?: LanguageModelLike | string;
     /** Tools this teammate has access to (in addition to team tools) */
-    tools?: StructuredTool[];
+    tools?: StructuredTool$1[];
     /** Custom system prompt for this teammate */
     systemPrompt?: string;
     /** Additional middleware for this teammate */
@@ -7617,7 +7836,7 @@ interface TeamConfig {
     /** Custom system prompt for the team lead */
     systemPrompt?: string;
     /** Tools available to the team lead */
-    tools?: StructuredTool[];
+    tools?: StructuredTool$1[];
     /** Checkpointer for persisting agent state between runs */
     checkpointer?: BaseCheckpointSaver | boolean;
     /** Pluggable task list store (default: InMemoryTaskListStore) */
@@ -7817,7 +8036,7 @@ interface TeammateToolsOptions {
  * - Task lifecycle: claim_task, complete_task, fail_task
  * - Communication: send_message, read_messages
  */
-declare function createTeammateTools(options: TeammateToolsOptions): StructuredTool[];
+declare function createTeammateTools(options: TeammateToolsOptions): StructuredTool$1[];
 
 /**
  * Agent Graph Builder 接口
@@ -8682,6 +8901,9 @@ type TaskLifecycleListener = (event: TaskLifecycleNotification) => void | Promis
 declare class TaskLifecycleNotifier {
     private readonly listeners;
     private readonly tails;
+    private outbox;
+    /** Installs (or clears) the durable outbox used to fan notifications to other replicas. */
+    setOutbox(outbox: OutboxStore | undefined): void;
     /**
      * Registers an async lifecycle listener.
      *
@@ -8697,6 +8919,8 @@ declare class TaskLifecycleNotifier {
      * @throws Error when the event is malformed or one or more listeners reject.
      */
     publish(event: TaskLifecycleNotification): Promise<void>;
+    /** Delivers one outbox payload to local listeners without re-appending (poller path). */
+    deliverFromOutbox(event: unknown): Promise<void>;
     private deliver;
 }
 /** Process-global notifier used by every lifecycle service unless explicitly injected. */
@@ -8736,6 +8960,9 @@ declare class ProjectTaskAdmissionNotifier {
     private readonly listeners;
     private readonly tails;
     private readonly listenerTimeoutMs;
+    private outbox;
+    /** Installs (or clears) the durable outbox used to fan notifications to other replicas. */
+    setOutbox(outbox: OutboxStore | undefined): void;
     /**
      * Creates a bounded Project task admission notifier.
      *
@@ -8756,12 +8983,68 @@ declare class ProjectTaskAdmissionNotifier {
      * @returns A promise settled after every snapshotted listener settles.
      */
     publish(event: ProjectTaskAdmissionNotification): Promise<void>;
+    /** Delivers one outbox payload to local listeners without re-appending (poller path). */
+    deliverFromOutbox(event: unknown): Promise<void>;
     private deliver;
     private deliverTo;
 }
 /** Process-global Project task admission notifier used by the managed dispatch path. */
 declare const projectTaskAdmissionNotifier: ProjectTaskAdmissionNotifier;
 
+/** Dependencies for {@link OutboxPoller}. */
+interface OutboxPollerDeps {
+    /** Durable outbox log. */
+    store: OutboxStore;
+    /** This replica's id; rows it authored are skipped (already delivered locally). */
+    owner: string;
+    /** Handlers per topic that deliver a foreign payload to local listeners. */
+    handlers: Record<string, (payload: unknown) => Promise<void>>;
+    /** Poll interval in ms (default 1000). */
+    intervalMs?: number;
+    /** Max rows per query (default 100). */
+    batchSize?: number;
+    /** Per-handler delivery timeout in ms (default 5000); a hung listener cannot stall the poller. */
+    handlerTimeoutMs?: number;
+    /** Optional structured logger for recoverable delivery/poll failures. */
+    log?: {
+        warn(message: string, context: Record<string, unknown>): void;
+    };
+}
+/**
+ * Polls a durable outbox and delivers FOREIGN events to local handlers.
+ *
+ * @remarks
+ * - The cursor starts at the current `latestId()` (no history replay); events
+ *   missed during downtime are covered by existing startup repair.
+ * - Rows authored by this replica (`originReplicaId === owner`) are skipped
+ *   because `publish` already delivered them locally.
+ * - A handler failure is logged and skipped (the cursor still advances), so one
+ *   bad event cannot stall the log.
+ */
+declare class OutboxPoller {
+    private readonly deps;
+    private cursor;
+    private timer;
+    private polling;
+    /**
+     * Creates a poller bound to one durable outbox.
+     *
+     * @param deps Store, owner replica id, topic handlers, and optional tuning.
+     */
+    constructor(deps: OutboxPollerDeps);
+    /** Captures the starting cursor and begins polling. */
+    start(): Promise<void>;
+    /** Stops polling. */
+    stop(): void;
+    /** Runs one drain pass (exported for tests). */
+    pollOnce(): Promise<void>;
+    /**
+     * Runs one handler bounded by `handlerTimeoutMs` so a hung listener cannot
+     * stall cross-replica delivery for this replica.
+     */
+    private deliverWithTimeout;
+}
+
 /** Exact Tenant and Project scope for collaboration mutations. */
 interface ProjectMutationScope {
     tenantId: string;
@@ -8774,6 +9057,14 @@ interface ProjectMutationScope {
  * When an operation needs both a Project task machine mutex and this mutex, it
  * must acquire the machine mutex first. Project-only membership, roster, human,
  * and ordinary Task mutations acquire only this mutex.
+ *
+ * A coordination lease store may be installed process-wide
+ * ({@link configureCoordinationLeaseStore}). When present, each critical section
+ * additionally holds a bounded distributed lease (`project-mutation:<tenant>:<project>`)
+ * so mutations on the same Tenant and Project serialize across replicas, not just
+ * within this process. The local FIFO lock is always retained; the lease only adds
+ * cross-replica exclusion. When no store is configured (single process, tests),
+ * behavior is unchanged.
  */
 declare class ProjectMutationMutex {
     private readonly queues;
@@ -8804,6 +9095,23 @@ interface ResumeTaskResult {
     status: ThreadStatus;
     /** Whether processing rows are settled and pending queue work may continue. */
     settled: boolean;
+    /**
+     * True only when the thread-run lease was held by another replica, so this
+     * call did nothing and left the thread entirely to its owner.
+     *
+     * This disambiguates the two situations that report `settled: false`:
+     * - **Lease contention** — a peer owns the run; recovery must be deferred and
+     *   the caller must not settle, arm watchdogs, or classify the thread.
+     * - **Genuine interruption / busy** — this replica observed the thread and
+     *   reports an authoritative status (`INTERRUPTED`/`BUSY`) that the caller
+     *   must still act on.
+     *
+     * Callers that defer recovery on contention MUST branch on this flag, not on
+     * `settled`, and callers that continue processing on `INTERRUPTED` must ignore
+     * it. It is never set on the `INTERRUPTED`, `BUSY`, `IDLE`, or `ERROR`
+     * returns from {@link Agent.resumeTask}.
+     */
+    leaseContended?: boolean;
 }
 /**
  * Snapshot of a thread's current state including queue and status.
@@ -9064,6 +9372,14 @@ declare class Agent {
     private queueProcessorGeneration;
     private queueWakeRequested;
     private recoveryBlockedKey?;
+    /**
+     * Thread-run ownership lease held while this replica is actively processing
+     * the thread. Acquired non-blockingly in {@link startQueueProcessor}; released
+     * exactly once when the processor definitively stops.
+     */
+    private threadRunLease;
+    private threadRunLeaseRetryAttempt;
+    private threadRunLeaseRetryTimer;
     asyncTasks: AsyncTaskRecord[];
     /**
      * Constructs an Agent instance.
@@ -9155,6 +9471,20 @@ declare class Agent {
     private queueScope;
     private agentStreamExecutor;
     private consumeAgentStream;
+    /**
+     * Waits until the thread's durable checkpoint reports the given interrupt id.
+     *
+     * Reads {@link getCurrentState} (the checkpoint, i.e. the single source of
+     * truth), never an in-memory status, so a `true` result guarantees a resume
+     * against this thread will find the interrupt. Bounded so a broken
+     * checkpointer cannot strand the stream; on timeout the interrupt is emitted
+     * anyway and a warning is logged.
+     *
+     * @param interruptId - Interrupt id from the streamed `__interrupt__` update.
+     * @param signal - Run abort signal; polling stops when aborted.
+     * @param timeoutMs - Maximum time to wait for durable confirmation.
+     */
+    private awaitDurableInterrupt;
     /**
      * Resume LangGraph execution from the last checkpoint.
      *
@@ -9165,6 +9495,19 @@ declare class Agent {
     private resumeGraphFromCheckpoint;
     private waitingForQueueEnd;
     private getQueueStore;
+    /**
+     * Resolves the shared lease store used to serialize thread runs across
+     * Gateway replicas. Returns `undefined` when no lease store is registered so
+     * single-process deployments keep running unconditionally.
+     */
+    private getLeaseStore;
+    /**
+     * Releases this replica's thread-run ownership lease, if held.
+     *
+     * @remarks Safe to call from any definitive-stop path; a second call is a
+     * no-op. The handle's unique holder makes a stale release harmless.
+     */
+    private releaseThreadRunLease;
     private getDefaultQueueConfig;
     /**
      * Override the thread's queue processing mode.
@@ -9227,6 +9570,21 @@ declare class Agent {
     private finishQueueProcessor;
     private scheduleQueueProcessorRetry;
     private cancelQueueProcessorRetry;
+    /**
+     * Bounded re-attempt after losing the thread-run lease to a peer. Covers the
+     * narrow window where the peer releases the lease without having observed a
+     * just-enqueued message. Bounded so a genuinely long-held thread does not make
+     * this replica poll forever — the owning replica's loop drains new messages.
+     */
+    private scheduleThreadRunLeaseRetry;
+    /**
+     * Clears any pending thread-run lease retry and resets its backoff budget.
+     *
+     * @remarks Called on lease acquisition and on every definitive processor
+     * stop so the next enqueue starts from the base delay. Never called on
+     * continue/re-arm paths, which must preserve the bounded budget.
+     */
+    private cancelThreadRunLeaseRetry;
     private runQueueProcessor;
     /**
      * Remove pending message
@@ -9287,6 +9645,8 @@ declare class Agent {
      * queue work must not start; `IDLE` and `ERROR` mean those rows were settled.
      */
     resumeTask(): Promise<ResumeTaskResult>;
+    /** Recovery body of {@link resumeTask}, executed while thread ownership is settled. */
+    private resumeTaskLocked;
     /**
      * Fully abort all activity on this thread.
      *
@@ -10505,6 +10865,12 @@ interface ReconcileStaleTaskRunsInput {
     lifecycle: Pick<TaskLifecycleService, "failTask">;
     /** Registry override (tests); defaults to {@link taskRunRegistry}. */
     registry?: TaskRunRegistry;
+    /**
+     * Optional cross-replica liveness probe. When provided and it resolves true,
+     * the task is treated as live and NOT converged (a peer replica owns it). A
+     * rejection is also treated as live, so a probe error never converges a task.
+     */
+    isTaskLive?: (task: TaskItem) => Promise<boolean>;
 }
 /** Result of {@link reconcileStaleTaskRuns}. */
 interface ReconcileStaleTaskRunsResult {
@@ -10520,12 +10886,15 @@ interface ReconcileStaleTaskRunsResult {
 /**
  * Converges `in_progress` tasks that no live run holds to `failed(no_executor)`.
  *
- * @param input Candidate tasks, actor, lifecycle, and optional registry.
+ * @param input Candidate tasks, actor, lifecycle, optional registry, and optional
+ * cross-replica liveness probe.
  * @returns The ids that were converged.
  * @remarks
  * The caller owns scope enumeration (a store cannot list across tenants). A task
- * is converged only when it is `in_progress` and absent from the registry, so a
- * task a live run genuinely holds is never touched. An orphaned run is a
+ * is converged only when it is `in_progress`, absent from the process-local
+ * registry, and (when `isTaskLive` is supplied) not reported live by the host's
+ * cross-replica probe. The probe lets a host consult a durable lease so a peer
+ * replica's live run is never mistaken for an orphan. An orphaned run is a
  * mechanical failure, not a human-in-the-loop interruption, so it converges to
  * `failed`, never `interrupted`.
  *
@@ -10533,6 +10902,7 @@ interface ReconcileStaleTaskRunsResult {
  * ```ts
  * const { converged } = await reconcileStaleTaskRuns({
  *   tasks: scopeTasks, actor: "system:reconcile", lifecycle,
+ *   isTaskLive: async (task) => (await leaseStore.get(`task-run:${task.id}`)) !== null,
  * });
  * ```
  */
@@ -10557,22 +10927,33 @@ interface ReconcileTenantTaskRunsInput {
      * generic reconciler never competes with a domain reconciler.
      */
     include?: (task: TaskItem) => boolean;
+    /**
+     * Optional cross-replica liveness probe forwarded to
+     * {@link reconcileStaleTaskRuns}. When provided and it resolves true, the
+     * task is treated as live and NOT converged (a peer replica owns it). A
+     * rejection is also treated as live, so a probe error never converges a task.
+     */
+    isTaskLive?: (task: TaskItem) => Promise<boolean>;
 }
 /**
  * Reconciles a tenant's orphaned `in_progress` tasks, converged to `failed`.
  *
- * @param input Tenant, actor, store, lifecycle, optional registry and predicate.
+ * @param input Tenant, actor, store, lifecycle, optional registry, predicate, and
+ * cross-replica liveness probe.
  * @returns The ids that were converged.
  * @remarks
  * Enumerates `{ tenantId, status: "in_progress" }` and delegates to
  * {@link reconcileStaleTaskRuns}. The caller owns the `include` predicate; a
- * host must exclude task families that have their own reconciliation.
+ * host must exclude task families that have their own reconciliation. The
+ * optional `isTaskLive` probe is forwarded unchanged so the host can consult a
+ * cross-replica lease.
  *
  * @example
  * ```ts
  * await reconcileTenantTaskRuns({
  *   tenantId, actor: "system:reconcile", taskStore, lifecycle,
  *   include: (task) => !isProjectLifecycleTask(task),
+ *   isTaskLive: async (task) => (await leaseStore.get(`task-run:${task.id}`)) !== null,
  * });
  * ```
  */
@@ -10595,21 +10976,31 @@ interface ReconcileAllTenantTaskRunsInput {
     registry?: TaskRunRegistry;
     /** Host predicate selecting which candidates this reconciler owns. */
     include?: (task: TaskItem) => boolean;
+    /**
+     * Optional cross-replica liveness probe forwarded per tenant to
+     * {@link reconcileTenantTaskRuns}. When provided and it resolves true, the
+     * task is treated as live and NOT converged (a peer replica owns it). A
+     * rejection is also treated as live, so a probe error never converges a task.
+     */
+    isTaskLive?: (task: TaskItem) => Promise<boolean>;
 }
 /**
  * Reconciles orphaned `in_progress` tasks across all tenants, converged to `failed`.
  *
- * @param input Actor, tenant store, task store, lifecycle, optional registry and predicate.
+ * @param input Actor, tenant store, task store, lifecycle, optional registry,
+ * predicate, and cross-replica liveness probe.
  * @returns The ids that were converged across every tenant.
  * @remarks Enumerates tenants via `listTenants()` and delegates per tenant to
- * {@link reconcileTenantTaskRuns}. Intended for a host startup/interval job;
- * callers own when it runs.
+ * {@link reconcileTenantTaskRuns}. The optional `isTaskLive` probe is forwarded
+ * to every tenant so the host can consult a cross-replica lease. Intended for a
+ * host startup/interval job; callers own when it runs.
  *
  * @example
  * ```ts
  * await reconcileAllTenantTaskRuns({
  *   actor: "system:reconcile", tenantStore, taskStore, lifecycle,
  *   include: (task) => !isProjectLifecycleTask(task),
+ *   isTaskLive: async (task) => (await leaseStore.get(`task-run:${task.id}`)) !== null,
  * });
  * ```
  */
@@ -10717,6 +11108,286 @@ declare class ExecutionAuthorityRegistry {
 /** Process-global execution authority registry used by the immediate executor. */
 declare const executionAuthorityRegistry: ExecutionAuthorityRegistry;
 
+/**
+ * Returns the stable identity of this Gateway process.
+ *
+ * Resolution order: `AXIOM_REPLICA_ID` (trimmed, when non-empty), else
+ * `<hostname>:<pid>`. Cached for the process lifetime so leases, run ownership,
+ * and logs attribute consistently.
+ *
+ * @returns The replica id used by distributed leases and run ownership.
+ *
+ * @example
+ * ```ts
+ * import { getReplicaId } from "@axiom-lattice/core";
+ * const owner = getReplicaId();
+ * ```
+ *
+ * @remarks Multi-replica deployments SHOULD set `AXIOM_REPLICA_ID` to a stable
+ * unique value (e.g. the pod name) so a restarted replica is distinguishable
+ * from a concurrently running one; otherwise a restart can appear to still own
+ * a lease it held before its pid/hostname changed.
+ */
+declare function getReplicaId(): string;
+/**
+ * Test seam: clears the cached id so a changed env takes effect.
+ *
+ * @remarks Not part of the public runtime contract; call only from tests.
+ */
+declare function resetReplicaIdForTests(): void;
+
+/**
+ * Installs the process-wide coordination lease store.
+ *
+ * @param store A shared (PostgreSQL) lease store, or `undefined` to clear it.
+ * @remarks Called once at the composition root (gateway startup) after stores
+ * are configured. When unset, coordination mutexes keep their process-local
+ * behavior only (single-process / tests).
+ */
+declare function configureCoordinationLeaseStore(store: LeaseStore | undefined): void;
+/** Returns the configured coordination lease store, if any. */
+declare function getCoordinationLeaseStore(): LeaseStore | undefined;
+
+/** Raised when a lease could not be acquired within the bounded wait. */
+declare class LeaseAcquisitionTimeoutError extends Error {
+    readonly key: string;
+    readonly holder: string;
+    readonly timeoutMs: number;
+    /** Stable machine-readable code. */
+    readonly code: "LEASE_ACQUISITION_TIMEOUT";
+    /**
+     * @param key Lease key that could not be acquired.
+     * @param holder Unique holder that attempted acquisition.
+     * @param timeoutMs How long the caller waited before giving up.
+     */
+    constructor(key: string, holder: string, timeoutMs: number);
+}
+/** Tuning for {@link withLease}. */
+interface WithLeaseOptions {
+    /** Lease time-to-live; must exceed the longest expected critical section. */
+    ttlMs?: number;
+    /** Bounded wait for acquisition before throwing. */
+    acquireTimeoutMs?: number;
+    /** Delay between acquisition attempts. */
+    retryDelayMs?: number;
+    /** Heartbeat interval; defaults to `ttlMs / 3` (min 1s). */
+    heartbeatMs?: number;
+}
+/**
+ * Runs `fn` under a distributed lease, heartbeating for the duration.
+ *
+ * @param store Lease store (PostgreSQL in multi-replica deployments).
+ * @param key Lease key, e.g. `project-mutation:<tenant>:<project>`.
+ * @param ownerLabel Stable owner label (e.g. `getReplicaId()`); a unique suffix
+ * is appended per invocation so concurrent sections on the same replica still
+ * serialize.
+ * @param fn Critical section to run while holding the lease.
+ * @param options TTL, acquisition timeout, retry, and heartbeat tuning.
+ * @returns Whatever `fn` returns.
+ *
+ * @remarks
+ * - Acquires with a per-invocation unique holder (`<ownerLabel>#<uuid>`), so two
+ *   concurrent calls on the same key serialize regardless of backend — both
+ *   within one replica and across replicas.
+ * - Retries with a fixed delay until `acquireTimeoutMs`, then throws
+ *   {@link LeaseAcquisitionTimeoutError}.
+ * - A heartbeat renews the lease while `fn` runs; a lost lease is not force-killed
+ *   (the work should be CAS/idempotent), and the heartbeat stops on completion.
+ * - The lease is released in `finally`, including when `fn` throws.
+ *
+ * @example
+ * ```ts
+ * await withLease(leaseStore, `task-run:${taskId}`, getReplicaId(), () => run());
+ * ```
+ */
+declare function withLease<T>(store: LeaseStore, key: string, ownerLabel: string, fn: () => Promise<T>, options?: WithLeaseOptions): Promise<T>;
+
+/** Builds the canonical thread-run lease key. */
+declare function threadRunLeaseKey(tenantId: string, assistantId: string, threadId: string): string;
+/** A held thread-run lease; call `release()` when the processor stops. */
+interface ThreadRunLeaseHandle {
+    /** True once the lease was lost to another holder (a heartbeat renew failed). */
+    readonly lost: boolean;
+    /** Releases the lease (no-op if already lost/taken over). */
+    release(): Promise<void>;
+}
+/** Input for {@link tryAcquireThreadRun}. */
+interface TryAcquireThreadRunInput {
+    /** Shared lease store (PostgreSQL in multi-replica deployments). */
+    store: LeaseStore;
+    tenantId: string;
+    assistantId: string;
+    threadId: string;
+    /** Owner label, e.g. `getReplicaId()`. */
+    owner: string;
+    /** Lease TTL in milliseconds; must exceed one processing cycle's gaps. */
+    ttlMs: number;
+    /** Heartbeat interval; defaults to `ttlMs / 3` (min 1s). */
+    heartbeatMs?: number;
+    /** Invoked once (best-effort) when the lease is lost to another holder. */
+    onLost?: () => void;
+}
+/**
+ * Non-blocking acquire of a thread's run ownership lease.
+ *
+ * @param input Store, thread identity, owner, and TTL.
+ * @returns A handle to release the lease, or `null` when another replica holds it.
+ *
+ * @remarks
+ * - The holder is unique per call (`<owner>#<uuid>`), so lease release can never
+ *   remove another holder's lease (a stale release is a no-op).
+ * - A heartbeat renews while held; the caller MUST call `release()` when the
+ *   processor stops so another replica can take over without waiting for expiry.
+ *   Once released, an in-flight renew that resolves `false` cannot flip `lost`
+ *   or fire `onLost` (a clean release is not a loss).
+ * - When a heartbeat renew returns `false`, ownership has moved to another
+ *   holder: `handle.lost` flips true and `onLost` fires exactly once so the
+ *   caller can self-abort. This is a bounded mitigation only — a holder that is
+ *   CPU-blocked and resumes before the next detection can still write; it does
+ *   not fence such a zombie.
+ *
+ * @example
+ * ```ts
+ * const lease = await tryAcquireThreadRun({ store, tenantId, assistantId, threadId, owner: getReplicaId(), ttlMs: 60_000 });
+ * if (!lease) return; // another replica owns this thread
+ * try { await process(); } finally { await lease.release(); }
+ * ```
+ */
+declare function tryAcquireThreadRun(input: TryAcquireThreadRunInput): Promise<ThreadRunLeaseHandle | null>;
+/** Input for {@link getThreadRunOwner}. */
+interface GetThreadRunOwnerInput {
+    tenantId: string;
+    assistantId: string;
+    threadId: string;
+    /** Test seam; defaults to the registered `default`/`lease` store. */
+    store?: LeaseStore;
+}
+/**
+ * Reads the replica that currently owns a thread's run, or `null` when the
+ * thread is free (idle, completed, or the lease expired).
+ *
+ * @remarks
+ * - The holder is `<owner>#<uuid>`; the returned value is the replica part.
+ * - Best-effort: a missing store or read failure returns `null` (callers must
+ *   treat `null` as "cannot prove another owner", never as an error).
+ */
+declare function getThreadRunOwner(input: GetThreadRunOwnerInput): Promise<string | null>;
+
+/** Builds the canonical task-run lease key. */
+declare function taskRunLeaseKey(taskId: string): string;
+/** A held task-run lease; call `release()` when the processor stops. */
+interface TaskRunLeaseHandle {
+    /** True once the lease was lost to another holder (a heartbeat renew failed). */
+    readonly lost: boolean;
+    /** Releases the lease (no-op if already lost/taken over). */
+    release(): Promise<void>;
+}
+/** Input for {@link tryAcquireTaskRun}. */
+interface TryAcquireTaskRunInput {
+    /** Shared lease store (PostgreSQL in multi-replica deployments). */
+    store: LeaseStore;
+    taskId: string;
+    /** Owner label, e.g. `getReplicaId()`. */
+    owner: string;
+    /** Lease TTL in milliseconds; must exceed one processing cycle's gaps. */
+    ttlMs: number;
+    /** Heartbeat interval; defaults to `ttlMs / 3` (min 1s). */
+    heartbeatMs?: number;
+    /** Invoked once (best-effort) when the lease is lost to another holder. */
+    onLost?: () => void;
+}
+/**
+ * Non-blocking acquire of a task's run ownership lease.
+ *
+ * @param input Store, task identity, owner, and TTL.
+ * @returns A handle to release the lease, or `null` when another replica holds it.
+ *
+ * @remarks
+ * - The holder is unique per call (`<owner>#<uuid>`), so lease release can never
+ *   remove another holder's lease (a stale release is a no-op).
+ * - A heartbeat renews while held; the caller MUST call `release()` when the
+ *   processor stops so another replica can take over without waiting for expiry.
+ *   Once released, an in-flight renew that resolves `false` cannot flip `lost`
+ *   or fire `onLost` (a clean release is not a loss).
+ * - When a heartbeat renew returns `false`, ownership has moved to another
+ *   holder: `handle.lost` flips true and `onLost` fires exactly once so the
+ *   caller can self-abort. This is a bounded mitigation only — a holder that is
+ *   CPU-blocked and resumes before the next detection can still write; it does
+ *   not fence such a zombie.
+ *
+ * @example
+ * ```ts
+ * const lease = await tryAcquireTaskRun({ store, taskId, owner: getReplicaId(), ttlMs: 60_000 });
+ * if (!lease) return; // another replica owns this task
+ * try { await process(); } finally { await lease.release(); }
+ * ```
+ */
+declare function tryAcquireTaskRun(input: TryAcquireTaskRunInput): Promise<TaskRunLeaseHandle | null>;
+
+/** Options for {@link runAsLeader}. */
+interface RunAsLeaderOptions {
+    /** Owner label; defaults to {@link getReplicaId}. */
+    owner?: string;
+    /** Lease TTL in milliseconds (default 60_000). */
+    ttlMs?: number;
+    /**
+     * When true, the lease is NOT released after `fn` — it is held until it
+     * expires, so a replica that boots later in the same window also skips.
+     * When false (default) the lease is released immediately after `fn`.
+     */
+    hold?: boolean;
+}
+/** Outcome of {@link runAsLeader}. */
+interface RunAsLeaderResult<T> {
+    /** Whether this caller won leadership and ran `fn`. */
+    ran: boolean;
+    /** The value returned by `fn`, when it ran. */
+    result?: T;
+}
+/**
+ * Runs `fn` on exactly one caller (non-blocking leader election).
+ *
+ * @param store Shared lease store (PostgreSQL in multi-replica deployments).
+ * @param name Logical job name; leased as `leader:<name>`.
+ * @param fn The one-shot critical work.
+ * @param options Owner, TTL, and whether to hold the lease until expiry.
+ * @returns `{ ran: true, result }` for the winner, `{ ran: false }` for the rest.
+ *
+ * @remarks
+ * - Non-blocking: losers return immediately (they must not wait for the leader).
+ * - The lease is heartbeated while `fn` runs, so an unbounded leader job cannot
+ *   let the lease lapse and admit a late second leader.
+ * - The lease is released in `finally` unless `hold` is set.
+ * - With the default in-memory lease store a single process always wins, so
+ *   single-process behavior is unchanged.
+ *
+ * @example
+ * ```ts
+ * const { ran } = await runAsLeader(leaseStore, "startup-recovery", () => recoverAll());
+ * ```
+ */
+declare function runAsLeader<T>(store: LeaseStore, name: string, fn: () => Promise<T>, options?: RunAsLeaderOptions): Promise<RunAsLeaderResult<T>>;
+
+/** Outbox topic carrying cross-replica plugin-catalog invalidation. */
+declare const PLUGIN_CATALOG_CHANGED_TOPIC = "plugin-catalog-changed";
+/**
+ * Installs the process-wide outbox used to broadcast plugin-catalog invalidation.
+ *
+ * @param next Shared outbox + this replica id, or `undefined` to clear.
+ * @remarks Called once at the composition root (gateway startup).
+ */
+declare function configurePluginCatalogSync(next: {
+    outbox: OutboxStore;
+    owner: string;
+} | undefined): void;
+/**
+ * Best-effort broadcast that a tenant's plugin catalog changed.
+ *
+ * @param tenantId Tenant whose catalog was reloaded.
+ * @remarks Never throws: a miss is corrected by the 30s catalog TTL.
+ */
+declare function publishPluginCatalogChanged(tenantId: string): Promise<void>;
+
 declare const AGENT_TASK_EVENT = "agent:execute";
 
 /**
@@ -11067,6 +11738,8 @@ interface SandboxRunConfig {
     workspaceId?: string;
     /** Project that scopes the run. */
     projectId?: string;
+    /** Current orchestration depth; nested mints pass depth+1. */
+    depth?: number;
 }
 /**
  * Resolves a `SandboxInstance` for the given run identity.
@@ -11527,6 +12200,90 @@ declare function resolveTenantPluginSkill(tenantId: string, owner: string, skill
  */
 declare function resolveEnabledPluginSkill(owner: string | undefined, skillName: string, enabledDefinition: PluginSkillDefinition | undefined, tenantId: string | undefined): Promise<ResolvedPluginSkill | undefined>;
 
+/**
+ * Versioned provisioning of the Open MCP client bundle into a sandbox volume.
+ *
+ * Writes the built zero-dependency client + CLI as **raw bundle files** under
+ * `/root/.agents/sdk/open-mcp-client` (plus a version manifest at
+ * `/root/.agents/sdk/.open-client-manifest.json`). Sandbox code can load the
+ * entry point by absolute path, e.g.
+ * `require("/root/.agents/sdk/open-mcp-client/index.js")`.
+ *
+ * @remarks
+ * This helper only writes files. `NODE_PATH`/`PATH` resolution is **not**
+ * configured here: a consumer (a prebuilt image, or the caller after
+ * provisioning) must expose the directory on `NODE_PATH` (for bare module
+ * resolution) or `PATH` (for the `cli.js` shim, which keeps its
+ * `#!/usr/bin/env node` shebang). The bundle is not laid out as a scoped
+ * `node_modules/@axiom-lattice/...` tree, so do NOT advertise
+ * `require("@axiom-lattice/open-mcp-client")` or a bare `NODE_PATH` pointing at
+ * `/root/.agents/sdk/node_modules` unless that layout is created too.
+ */
+/** Minimal sandbox file surface required for provisioning. */
+interface ProvisionFileSink {
+    /**
+     * Create a directory (recursively) inside the sandbox volume.
+     *
+     * @param path - Absolute sandbox path to create.
+     * @returns A promise resolved after the directory exists.
+     */
+    createDirectory(path: string): Promise<void>;
+    /**
+     * Write a UTF-8 text file inside the sandbox volume.
+     *
+     * @param path - Absolute sandbox path to write.
+     * @param content - File contents.
+     * @returns A promise resolved after the file is written.
+     */
+    writeFile(path: string, content: string): Promise<void>;
+}
+/** Bundle contents to provision. */
+interface SandboxOpenClientBundle {
+    /** Built CommonJS entry point, loaded by absolute path in the sandbox. */
+    indexJs: string;
+    /** Executable CLI source, invoked as `node cli.js`. */
+    cliJs: string;
+    /** Package version recorded in the sandbox manifest. */
+    version: string;
+}
+/**
+ * Write the Open MCP client bundle into the sandbox at `/root/.agents/sdk`.
+ *
+ * Idempotent: rewrites the same paths.
+ *
+ * @param sandbox - Sandbox whose volume receives the bundle.
+ * @param bundle - Client JS/CLI source and version.
+ * @returns A promise resolved after the files and manifest are written.
+ *
+ * @example
+ * ```ts
+ * await provisionSandboxOpenClient(sandbox, {
+ *   indexJs: 'module.exports = { createClient };',
+ *   cliJs: '#!/usr/bin/env node\n// ...',
+ *   version: "0.1.0",
+ * });
+ * // sandbox code loads it by absolute path:
+ * //   const client = require("/root/.agents/sdk/open-mcp-client/index.js");
+ * ```
+ *
+ * @remarks
+ * The version manifest is written last, so its presence means the JS files were
+ * written first. This only writes raw bundle files; consumers load `index.js` by
+ * absolute path and must add the directory to `PATH` themselves to run `cli.js`.
+ * No scoped `node_modules` tree is created.
+ */
+declare function provisionSandboxOpenClient(sandbox: {
+    file: ProvisionFileSink;
+}, bundle: SandboxOpenClientBundle): Promise<void>;
+/**
+ * Build a bundle from an installed package's built files.
+ *
+ * @param distDir - Directory containing `index.js` and `cli.js`.
+ * @param version - Package version to record in the manifest.
+ * @returns The bundle.
+ */
+declare function buildBundleFromDist(distDir: string, version: string): SandboxOpenClientBundle;
+
 /** Stable failure codes emitted when capability bundles cannot be composed. */
 type CapabilityBundleMergeErrorCode = "CAPABILITY_BUNDLE_DUPLICATE_ID" | "CAPABILITY_BUNDLE_EMPTY_ALLOWED_TOOLS" | "CAPABILITY_BUNDLE_INVALID_CONFIG" | "CAPABILITY_BUNDLE_NULL_VALUE" | "CAPABILITY_BUNDLE_UNSAFE_KEY";
 /** Describes invalid capability bundle input rejected by the pure merger. */
@@ -12672,4 +13429,4 @@ declare function parseDirectRoomType(projectId: string): "human" | "bot" | null;
  */
 declare function isDirectRoom(projectId: string): boolean;
 
-export { AGENT_TASK_EVENT, type AddMessageParams, type AddMessageResult, Agent, type AgentClient, type AgentExecutor, AgentInstanceManager, type AgentLattice, AgentLatticeManager, type AgentLifecycleEventName, AgentManager, type AgentStreamExecutor, type AgentTaskCompletionInput, type AgentThreadInterface, type ApproveInterruptedTaskInput, type AssignTaskOwnerInput, BUILTIN_PLUGINS, BUILTIN_SKILLS, type BackendFactory, type BackendProtocol, type BeginRunFailure, type BeginRunInput, type BeginRunResult, type BeginRunSuccess, type BufferStats, CAPABILITY_TOOL_NAME_CONFLICT, type CacheEntry, type CalibrationProbe, CapabilityBundleMergeError, type CapabilityBundleMergeErrorCode, CapabilityBundleMerger, CapabilityBundleValidationError, type CapabilityBundleValidationErrorCode, type CapabilityGuardDenialCode, type CapabilityResourceSelector, type CapabilityToolMetadata, CapabilityToolNameConflictError, CapabilityToolRegistry, type CaseRunResult, type Chunk, ChunkBuffer, ChunkBufferLatticeManager, CollectionLatticeManager, type ColumnInfo, type CompileSandboxPluginArgs, CompositeBackend, type ConflictItem, type ConnectAllChannelsOptions, ConnectionRegistry, ConsoleLoggerClient, type CreateSandboxProviderConfig, type CronFields, CustomMetricsClient, type CustomMiddlewareFactory, CustomMiddlewareRegistry, DEFAULT_CALIBRATION_PROBES, DEFAULT_CONNECT_TIMEOUT_MS, DEFAULT_DELAY_MS, DEFAULT_MAX_ATTEMPTS, type DatabaseConfig, type DatabaseType, DaytonaInstance, DaytonaProvider, type DaytonaProviderConfig, DefaultScheduleClient, DelegatedScopeNotQueueableError, type DeleteResult, DependencyResolver, type DispatchPreparation, DuplicateProjectRoomMessageIdempotencyKeyError, E2BInstance, E2BProvider, type E2BProviderConfig, EMPTY_CONTENT_WARNING, type EditResult, type EmbeddingsInfo, type EmbeddingsLatticeInterface, EmbeddingsLatticeManager, type EnsureMicrosandboxInput, type EvalRunService, type ExecutionAuthority, ExecutionAuthorityRegistry, type ExportBundle, type ExportContext, type ExportJob, type ExportableEntity, type ExportableEntityDefinition, ExportableEntityRegistry, type ExportableFile, type ExportableTypeInfo, type FileData, type FileInfo, FileSystemSkillStore, type FileSystemSkillStoreOptions, FilesystemBackend, type FsEntry, type GrepMatch, HEALTH_CHECK_INTERVAL_MS, HEALTH_CHECK_TIMEOUT_MS, type IMessageQueueStore, type IMetricsServerClient, type ISqlDatabase, IdRemapper, type ImmediateDispatchPlan, type ImportApplyResolution, type ImportApplyResult, type ImportEntityResult, type ImportEntityStatus, type ImportPreviewResult, InMemoryA2AApiKeyStore, InMemoryAgentWebAppStore, InMemoryAssistantStore, InMemoryBindingStore, InMemoryCapabilityBundleStore, InMemoryChannelInstallationStore, InMemoryChunkBuffer, InMemoryCollectionStore, InMemoryDatabaseConfigStore, InMemoryMailboxStore, InMemoryMenuStore, InMemoryModelProviderStore, InMemoryOpenAuditStore, InMemoryProjectBotMembershipStore, InMemoryProjectMembershipStore, InMemoryProjectRoomCoordinator, InMemoryProjectRoomMessageStore, InMemoryProjectRoomReadStateStore, InMemoryProjectRoomStore, InMemoryTaskListStore, InMemoryTaskStore, InMemoryTaskWorkItemStore, InMemoryTenantStore, InMemoryThreadMessageQueueStore, InMemoryThreadStore, InMemoryUserPushSubscriptionStore, InMemoryUserStore, InMemoryUserTenantLinkStore, type InsertionItem, type JudgeVerdict, LINE_NUMBER_WIDTH, type LangGraphStateChecker, type LatticeAgentStepConfig, LatticeEval, type LatticeEvalBatchReport, type LatticeEvalCase, type LatticeEvalCaseType, type LatticeEvalCaseWithTemplate, type LatticeEvalConfig, type LatticeEvalLogEvent, type LatticeEvalLogLevel, LatticeEvalProject, type LatticeEvalProjectType, type LatticeEvalResult, type LatticeEvalRubric, LatticeEvalSuite, type LatticeEvalSuiteType, type LatticeEvalTemplate, type LifecycleResult, type LifecycleWarning, LocalSandboxInstance, LocalSandboxProvider, type LocalSandboxProviderConfig, type LoggerLattice, LoggerLatticeManager, type LoopBreakerConfig, MAX_BACKOFF_MS, MAX_LINE_LENGTH, MAX_PACK_ENTRIES, MAX_PACK_FILE_BYTES, MAX_PACK_TOTAL_BYTES, type MailboxMessage, type MailboxStore, ManagedTaskStartError, type ManagedTaskStartOptions, type ManifestValidationResult, type McpClientFactory, type McpClientLike, type McpClientSession, type McpConnectionOptions, McpLatticeManager, type McpRegisterOptions, type McpServerId, type McpServerRuntime, type McpServerState, MemoryBackend, MemoryLatticeManager, MemoryQueueClient, MemoryScheduleStorage, type MergedPluginSkills, type MessageCompletedEvent, type MessageContent, type MessageContentPart, type MessageContentValue, type MessageFailedEvent, type MessageInterruptedEvent, type MessageLike, type MessageStartedEvent, MessageType, MetricsServerManager, MicrosandboxRemoteInstance, MicrosandboxRemoteProvider, type MicrosandboxRemoteProviderClient, type MicrosandboxRemoteProviderConfig, MicrosandboxServiceClient, type MicrosandboxServiceClientConfig, type MicrosandboxShellExecInput, type ModelConfig, type ModelLatticeInterface, ModelLatticeManager, MysqlDatabase, type OutputType, PACK_DIRECTORY_TIMEOUT_SECONDS, type PackSourceInfo, type PendingMessage, PersonalAssistantConfig, PinoLoggerClient, type PluginConnectionScope, PluginRegistry, type PostProcessTaskMutationResponseInput, PostgresDatabase, type PreviewError, ProjectBotMembershipIdConflictError, ProjectMutationMutex, type ProjectMutationScope, ProjectRoomMessageIdConflictError, type ProjectTaskAdmissionListener, type ProjectTaskAdmissionNotification, ProjectTaskAdmissionNotifier, type ProjectTaskAdmissionNotifierOptions, type ProjectTaskAssignmentScope, ProjectTaskOwnerPolicy, type ProjectTaskOwnerPolicyCode, ProjectTaskOwnerPolicyError, type ProjectTaskReassignmentAuthorization, type ProjectTaskReassignmentAuthorizationInput, type ProjectTaskReassignmentAuthorizer, type ProjectTaskReassignmentThreadValidationInput, type ProjectTaskReassignmentThreadValidator, type ProjectTaskRosterScope, PrometheusClient, type QueryResult, type QueueLattice, QueueLatticeManager, type QueueMessage, QueueMode, type QueuePendingEvent, type QueueScope, ROOM_COORDINATOR_KEY, type ReassignProjectTaskInput, type ReconcileAllTenantTaskRunsInput, type ReconcileStaleTaskRunsInput, type ReconcileStaleTaskRunsResult, type ReconcileTaskDescriptionInput, type ReconcileTenantTaskRunsInput, type RejectInterruptedTaskInput, RemoteSandboxInstance, RemoteSandboxProvider, type RemoteSandboxProviderConfig, type RepeatedToolCallBreakerOptions, RepeatedToolCallError, type ReplyReadyEvent, type Resolution, type ResolutionAction, type ResolveAgentFn, type ResolvedConfig, type ResolvedPluginConnection, type ResolvedPluginSkill, type ResumeTaskResult, type RoomAgentMessageCallbackFailure, type RoomAgentMessageCommitted, type RoomAgentMessageInput, RoomAgentMessageService, type RoomAgentReplyInput, type RunSandboxConfig, type RuntimeModelConfig, type RuntimeSkillSelection, SAFE_PATH_COMPONENT, type STTModelInfo, STTModelLattice, type STTModelLatticeInterface, STTModelLatticeManager, type SandboxFileInfo, type SandboxFileService, SandboxFilesystem, type SandboxGrepMatch, type SandboxInstance, type SandboxIsolationLevel, SandboxLatticeManager, type SandboxManagerProtocol, SandboxPluginExecutor, type SandboxPluginExecutorDeps, type SandboxPluginInvokeArgs, type SandboxPluginResult, type SandboxProvider, type SandboxProviderFactory, type SandboxProviderType, type SandboxResolver, type SandboxRunConfig, type SandboxShellService, SandboxSkillStore, type SandboxSkillStoreOptions, type SandboxVolumeDefinition, type ScheduleLattice, ScheduleLatticeManager, type SchedulerMiddlewareOptions, SemanticMetricsClient, type SettleRunInput, type SettleRunOutcome, type SharePayload, SimpleMemoryVectorStore, type SkillLattice, SkillLatticeManager, type SkillMeta, type SkillResource, SqlDatabaseManager, type StartLifecycleResult, type StartTaskExecutionInput, type StateAndStore, StateBackend, StoreBackend, type StoreLattice, StoreLatticeManager, type StoreType, type StoreTypeMap, type SubmitTaskReviewInput, TASK_RESPONSE_FINAL_WARNING_LIMIT, TASK_RESPONSE_PRIOR_WARNING_LIMIT, TASK_RESPONSE_SCALAR_MAX_BYTES, TOOL_RESULT_TOKEN_LIMIT, TRUNCATION_GUIDANCE, type TableInfo, type TableSchema, type TaskAgentInvocation, type TaskEvent, type TaskExecutionFailure, type TaskExecutionManaged, type TaskExecutionResult, type TaskExecutionServiceDeps, type TaskExecutionSuccess, type TaskLifecycleListener, type TaskLifecycleNotification, TaskLifecycleNotifier, TaskLifecycleService, type TaskLifecycleServiceDeps, type TaskListStore, type TaskResponseParseResult, type TaskRunBridge, type TaskRunBridgeDeps, TaskRunBridgeStoresRequiredError, TaskRunRegistry, type TaskSpec, TaskStatus, type TaskUpdatable, TeamAgentGraphBuilder, type TeamConfig, type TeamMiddlewareOptions, type TeamTask, type TeammateSpec, type TeammateToolsOptions, TenantPluginCatalog, type TenantPluginCatalogDeps, type TenantPlugins, type ThreadBuffer, type ThreadBufferConfig, type ThreadBusyEvent, type ThreadEndCode, ThreadEndError, type ThreadIdleEvent, type ThreadInfo, type ThreadQueueConfig, type ThreadState, ThreadStatus, type ThreadStatusChangedEvent, TokenCache, type ToolDefinition, type ToolLattice, ToolLatticeManager, type TransferOwnerInput, type TransferOwnerResult, type TrustedAgentMessageDispatcher, type TrustedMessageOptions, type UnknownToolHandlerConfig, UnsafeUpstreamUrlError, type UnsafeUrlReason, type ValidateManifestArgs, type VectorStoreLatticeInterface, VectorStoreLatticeManager, type VectorStoreProviderLattice, VectorStoreProviderManager, VolumeFilesystem, type VolumeFsClient, type WorkflowValidationError, type WriteResult, abortWorkflowRun, agentInstanceManager, agentLatticeManager, appendReconciliationWarning, appendUiFence, assertSafeUpstreamUrl, buildGrepResultsDict, buildInput, buildNamedVolumeName, buildRemotePackDirectoryCommand, buildSandboxMetadataEnv, buildSkillFile, buildStateAnnotation, buildTableName, buildTaskMutationFallback, buildTaskNormalizationFallback, checkEmptyContent, clearEncryptionKeyCache, clearEvalRunService, collectionLatticeManager, compileInternal, compileSandboxPlugin, compileWorkflow, computeSandboxName, configureStores, connectAllChannels, convertToConnection, createAgentNode, createAgentTeam, createCapabilityGuardMiddleware, createExecuteSqlQueryTool, createFileData, createInfoSqlTool, createListMetricsDataSourcesTool, createListMetricsServersTool, createListTablesSqlTool, createMapNode, createModelSelectorMiddleware, createNodeHandler, createProjectRoomMiddleware, createProjectTaskOwnerPolicy, createProjectTaskReassignmentAuthorizer, createQueryCheckerSqlTool, createQueryMetricDefinitionTool, createQueryMetricsListTool, createQuerySemanticMetricDataTool, createQuerySqlTool, createQueryTableDefinitionTool, createQueryTablesListTool, createRepeatedToolCallBreakerMiddleware, createResourceAddress, createSandboxProvider, createSandboxResolver, createSchedulerMiddleware, createSharePayload, createTaskExecutionService, createTaskLifecycleService, createTaskMiddleware, createTaskRunBridge, createTeamMiddleware, createTeammateTools, createTrustedAgentMessageDispatcher, createUnknownToolHandlerMiddleware, createWidgetMiddleware, decrypt, describeCronExpression, documentLearningPlugin, documentParserPlugin, embeddingsLatticeManager, encrypt, ensureBuiltinAgentsForTenant, ensurePluginSkillInSandbox, evaluateLatticeCaseWithLogs, eventBus, eventBus as eventBusDefault, executionAuthorityRegistry, extractAppsRef, extractFetcherError, extractLegacyRefs, extractOutput, fileDataToString, formatContentWithLineNumbers, formatGrepMatches, formatGrepResults, formatReadResponse, generateDirectBotProjectId, generateDirectHumanProjectId, generateToken, getAgentClient, getAgentClientAsync, getAgentConfig, getAllAgentConfigs, getAllBuiltInSkillMetas, getAllToolDefinitions, getBindingRegistry, getBuiltInSkillContent, getBuiltInSkillMeta, getBuiltInSkillNames, getCheckpointSaver, getChunkBuffer, getCollectionEntryCount, getEmbeddingsClient, getEmbeddingsLattice, getEncryptionKey, getEvalRunService, getLoggerLattice, getMenuRegistry, getModelLattice, getNextCronTime, getOrCreateCollectionVectorStore, getPluginSkillManifestVersion, getQueueLattice, getRuntimeCapabilityConfig, getRuntimeSkillSelection, getSTTClient, getSTTClientWithTenant, getSTTModelLattice, getSandBoxManager, getSandboxPluginCatalog, getScheduleLattice, getStoreLattice, getToolClient, getToolClientWithTenant, getToolDefinition, getToolLattice, getVectorStoreClient, getVectorStoreLattice, getVectorStoreProvider, getWorkflowSignal, globSearchFiles, grepMatchesFromFiles, grepSearchFiles, hasChunkBuffer, hasDelegatedWorkerToken, hasRuntimeCapabilityPolicy, invokeWithRetry, isBuiltInSkill, isDirectRoom, isMcpConnectionError, isPluginSkillAuthorizedInSandbox, isPluginSkillManagedInSandbox, isUsingDefaultKey, isValidCronExpression, isValidSandboxName, isValidSkillName, jsonSchemaToZod, listCollectionEntries, listSandboxProviderTypes, loggerLatticeManager, mcpManager, mergeCapabilityBundles, mergePluginSkills, mergePluginSources, metricsServerManager, modelLatticeManager, nextBackoffDelay, normalizeSandboxName, ownTaskResponseField, parallelLimit, parseCronExpression, parseDirectRoomType, parseJudgeVerdict, parsePackSize, parseSkillFrontmatter, parseTaskResponse, parseYaml, performStringReplacement, postProcessTaskMutationResponse, prepareTaskDispatch, projectMutationMutex, projectRoomPlugin, projectTaskAdmissionNotifier, queueLatticeManager, readLoopBreakerConfig, reconcileAllTenantTaskRuns, reconcileStaleTaskRuns, reconcileTenantTaskRuns, registerAgentLattice, registerAgentLatticeWithTenant, registerAgentLattices, registerCheckpointSaver, registerChunkBuffer, registerEmbeddingsLattice, registerExistingTool, registerExistingToolWithTenant, registerLoggerLattice, registerModelLattice, registerModelLatticeForTenant, registerQueueLattice, registerSTTModelLattice, registerSandboxProviderType, registerScheduleLattice, registerStoreLattice, registerTeammateAgent, registerToolLattice, registerVectorStoreLattice, registerVectorStoreProvider, registerWorkflowRun, removeCollectionVectorStore, renderTemplate, resolveEnabledPluginSkill, resolveJudgeModelKey, resolvePath, resolvePluginConnections, resolveSandboxPluginConnections, resolveTenantPluginSkill, roomCoordinatorConfig, runRemotePackDirectory, safeTaskResponseId, sandboxLatticeManager, sanitizeToolCallId, scheduleLatticeManager, serializePluginMeta, serializeTaskMutationSuccess, serializeTaskNormalizationFallback, serializeTaskReadResponse, setBindingRegistry, setEvalRunService, setMenuRegistry, setSandboxPluginCatalog, skillLatticeManager, sqlDatabaseManager, storeLatticeManager, sttModelLatticeManager, taskLifecycleNotifier, taskRunRegistry, toJsonSchema, toSafeStateExpr, toolLatticeManager, truncateIfTooLong, unregisterTeammateAgent, unregisterWorkflowRun, updateFileData, validateAgentInput, validateCapabilityBundleInput, validateDSL, validateEncryptionKey, validatePackSourcePath, validatePath, validateRelativePath, validateSandboxPluginManifest, validateSkillName, validateToolInput, vectorStoreLatticeManager, vectorStoreProviderManager, withTimeout, wrapMcpToolWithUi };
+export { AGENT_TASK_EVENT, type AddMessageParams, type AddMessageResult, Agent, type AgentClient, type AgentExecutor, AgentInstanceManager, type AgentLattice, AgentLatticeManager, type AgentLifecycleEventName, AgentManager, type AgentStreamExecutor, type AgentTaskCompletionInput, type AgentThreadInterface, type ApproveInterruptedTaskInput, type AssignTaskOwnerInput, BUILTIN_PLUGINS, BUILTIN_SKILLS, type BackendFactory, type BackendProtocol, type BeginRunFailure, type BeginRunInput, type BeginRunResult, type BeginRunSuccess, type BufferStats, CAPABILITY_TOOL_NAME_CONFLICT, type CacheEntry, type CalibrationProbe, CapabilityBundleMergeError, type CapabilityBundleMergeErrorCode, CapabilityBundleMerger, CapabilityBundleValidationError, type CapabilityBundleValidationErrorCode, type CapabilityGuardDenialCode, type CapabilityResourceSelector, type CapabilityToolMetadata, CapabilityToolNameConflictError, CapabilityToolRegistry, type CaseRunResult, type Chunk, ChunkBuffer, ChunkBufferLatticeManager, type ClaimMessagesOptions, CollectionLatticeManager, type ColumnInfo, type CompileSandboxPluginArgs, CompositeBackend, type ConflictItem, type ConnectAllChannelsOptions, ConnectionRegistry, ConsoleLoggerClient, type CreateSandboxProviderConfig, type CronFields, CustomMetricsClient, type CustomMiddlewareFactory, CustomMiddlewareRegistry, DEFAULT_CALIBRATION_PROBES, DEFAULT_CONNECT_TIMEOUT_MS, DEFAULT_DELAY_MS, DEFAULT_MAX_ATTEMPTS, type DatabaseConfig, type DatabaseType, DaytonaInstance, DaytonaProvider, type DaytonaProviderConfig, DefaultScheduleClient, DelegatedScopeNotQueueableError, type DeleteResult, DependencyResolver, type DispatchPreparation, DuplicateProjectRoomMessageIdempotencyKeyError, E2BInstance, E2BProvider, type E2BProviderConfig, EMPTY_CONTENT_WARNING, type EditResult, type EmbeddingsInfo, type EmbeddingsLatticeInterface, EmbeddingsLatticeManager, type EnsureMicrosandboxInput, type EvalRunService, type ExecutionAuthority, ExecutionAuthorityRegistry, type ExportBundle, type ExportContext, type ExportJob, type ExportableEntity, type ExportableEntityDefinition, ExportableEntityRegistry, type ExportableFile, type ExportableTypeInfo, type FileData, type FileInfo, FileSystemSkillStore, type FileSystemSkillStoreOptions, FilesystemBackend, type FsEntry, type GetThreadRunOwnerInput, type GrepMatch, HEALTH_CHECK_INTERVAL_MS, HEALTH_CHECK_TIMEOUT_MS, type IMessageQueueStore, type IMetricsServerClient, type ISqlDatabase, IdRemapper, type ImmediateDispatchPlan, type ImportApplyResolution, type ImportApplyResult, type ImportEntityResult, type ImportEntityStatus, type ImportPreviewResult, InMemoryA2AApiKeyStore, InMemoryAgentWebAppStore, InMemoryAssistantStore, InMemoryBindingStore, InMemoryCapabilityBundleStore, InMemoryChannelInstallationStore, InMemoryChunkBuffer, InMemoryCollectionStore, InMemoryDatabaseConfigStore, InMemoryLeaseStore, InMemoryMailboxStore, InMemoryMenuStore, InMemoryModelProviderStore, InMemoryOpenAuditStore, InMemoryOutboxStore, InMemoryProjectBotMembershipStore, InMemoryProjectMembershipStore, InMemoryProjectRoomCoordinator, InMemoryProjectRoomMessageStore, InMemoryProjectRoomReadStateStore, InMemoryProjectRoomStore, InMemoryTaskListStore, InMemoryTaskStore, InMemoryTaskWorkItemStore, InMemoryTenantStore, InMemoryThreadMessageQueueStore, InMemoryThreadStore, InMemoryUserPushSubscriptionStore, InMemoryUserStore, InMemoryUserTenantLinkStore, type InsertionItem, type JudgeVerdict, LINE_NUMBER_WIDTH, type LangGraphStateChecker, type LatticeAgentStepConfig, LatticeEval, type LatticeEvalBatchReport, type LatticeEvalCase, type LatticeEvalCaseType, type LatticeEvalCaseWithTemplate, type LatticeEvalConfig, type LatticeEvalLogEvent, type LatticeEvalLogLevel, LatticeEvalProject, type LatticeEvalProjectType, type LatticeEvalResult, type LatticeEvalRubric, LatticeEvalSuite, type LatticeEvalSuiteType, type LatticeEvalTemplate, LeaseAcquisitionTimeoutError, type LifecycleResult, type LifecycleWarning, LocalSandboxInstance, LocalSandboxProvider, type LocalSandboxProviderConfig, type LoggerLattice, LoggerLatticeManager, type LoopBreakerConfig, MAX_BACKOFF_MS, MAX_LINE_LENGTH, MAX_PACK_ENTRIES, MAX_PACK_FILE_BYTES, MAX_PACK_TOTAL_BYTES, type MailboxMessage, type MailboxStore, ManagedTaskStartError, type ManagedTaskStartOptions, type ManifestValidationResult, type McpClientFactory, type McpClientLike, type McpClientSession, type McpConnectionOptions, McpLatticeManager, type McpRegisterOptions, type McpServerId, type McpServerRuntime, type McpServerState, MemoryBackend, MemoryLatticeManager, MemoryQueueClient, MemoryScheduleStorage, type MergedPluginSkills, type MessageCompletedEvent, type MessageContent, type MessageContentPart, type MessageContentValue, type MessageFailedEvent, type MessageInterruptedEvent, type MessageLike, type MessageStartedEvent, MessageType, MetricsServerManager, MicrosandboxRemoteInstance, MicrosandboxRemoteProvider, type MicrosandboxRemoteProviderClient, type MicrosandboxRemoteProviderConfig, MicrosandboxServiceClient, type MicrosandboxServiceClientConfig, type MicrosandboxShellExecInput, type ModelConfig, type ModelLatticeInterface, ModelLatticeManager, MysqlDatabase, OutboxPoller, type OutboxPollerDeps, type OutputType, PACK_DIRECTORY_TIMEOUT_SECONDS, PLATFORM_SECRET_ENV_VARS, PLUGIN_CATALOG_CHANGED_TOPIC, type PackSourceInfo, type PendingMessage, PersonalAssistantConfig, PinoLoggerClient, type PluginConnectionScope, PluginRegistry, type PostProcessTaskMutationResponseInput, PostgresDatabase, type PreviewError, ProjectBotMembershipIdConflictError, ProjectMutationMutex, type ProjectMutationScope, ProjectRoomMessageIdConflictError, type ProjectTaskAdmissionListener, type ProjectTaskAdmissionNotification, ProjectTaskAdmissionNotifier, type ProjectTaskAdmissionNotifierOptions, type ProjectTaskAssignmentScope, ProjectTaskOwnerPolicy, type ProjectTaskOwnerPolicyCode, ProjectTaskOwnerPolicyError, type ProjectTaskReassignmentAuthorization, type ProjectTaskReassignmentAuthorizationInput, type ProjectTaskReassignmentAuthorizer, type ProjectTaskReassignmentThreadValidationInput, type ProjectTaskReassignmentThreadValidator, type ProjectTaskRosterScope, PrometheusClient, type ProvisionFileSink, type QueryResult, type QueueLattice, QueueLatticeManager, type QueueMessage, QueueMode, type QueuePendingEvent, type QueueScope, ROOM_COORDINATOR_KEY, type ReassignProjectTaskInput, type ReconcileAllTenantTaskRunsInput, type ReconcileStaleTaskRunsInput, type ReconcileStaleTaskRunsResult, type ReconcileTaskDescriptionInput, type ReconcileTenantTaskRunsInput, type RejectInterruptedTaskInput, RemoteSandboxInstance, RemoteSandboxProvider, type RemoteSandboxProviderConfig, type RepeatedToolCallBreakerOptions, RepeatedToolCallError, type ReplyReadyEvent, type Resolution, type ResolutionAction, type ResolveAgentFn, type ResolvedConfig, type ResolvedPluginConnection, type ResolvedPluginSkill, type ResumeTaskResult, type RoomAgentMessageCallbackFailure, type RoomAgentMessageCommitted, type RoomAgentMessageInput, RoomAgentMessageService, type RoomAgentReplyInput, type RunAsLeaderOptions, type RunAsLeaderResult, type RunSandboxConfig, type RuntimeModelConfig, type RuntimeSkillSelection, SAFE_PATH_COMPONENT, SANDBOX_OPEN_GATEWAY_URL_ENV, SANDBOX_OPEN_TOKEN_ENV, type STTModelInfo, STTModelLattice, type STTModelLatticeInterface, STTModelLatticeManager, type SandboxFileInfo, type SandboxFileService, SandboxFilesystem, type SandboxGrepMatch, type SandboxInstance, type SandboxIsolationLevel, SandboxLatticeManager, type SandboxManagerProtocol, type SandboxOpenClientBundle, type SandboxOpenCredential, type SandboxOpenCredentialContext, type SandboxOpenCredentialProvider, type SandboxOpenCredentialProviderOptions, SandboxPluginExecutor, type SandboxPluginExecutorDeps, type SandboxPluginInvokeArgs, type SandboxPluginResult, type SandboxProvider, type SandboxProviderFactory, type SandboxProviderType, type SandboxResolver, type SandboxRunConfig, type SandboxShellService, SandboxSkillStore, type SandboxSkillStoreOptions, type SandboxVolumeDefinition, type ScheduleLattice, ScheduleLatticeManager, type SchedulerMiddlewareOptions, SemanticMetricsClient, type SettleRunInput, type SettleRunOutcome, type SharePayload, SimpleMemoryVectorStore, type SkillLattice, SkillLatticeManager, type SkillMeta, type SkillResource, SqlDatabaseManager, type StartLifecycleResult, type StartTaskExecutionInput, type StateAndStore, StateBackend, StoreBackend, type StoreLattice, StoreLatticeManager, type StoreType, type StoreTypeMap, type SubmitTaskReviewInput, TASK_RESPONSE_FINAL_WARNING_LIMIT, TASK_RESPONSE_PRIOR_WARNING_LIMIT, TASK_RESPONSE_SCALAR_MAX_BYTES, TOOL_RESULT_TOKEN_LIMIT, TRUNCATION_GUIDANCE, type TableInfo, type TableSchema, type TaskAgentInvocation, type TaskEvent, type TaskExecutionFailure, type TaskExecutionManaged, type TaskExecutionResult, type TaskExecutionServiceDeps, type TaskExecutionSuccess, type TaskLifecycleListener, type TaskLifecycleNotification, TaskLifecycleNotifier, TaskLifecycleService, type TaskLifecycleServiceDeps, type TaskListStore, type TaskResponseParseResult, type TaskRunBridge, type TaskRunBridgeDeps, TaskRunBridgeStoresRequiredError, type TaskRunLeaseHandle, TaskRunRegistry, type TaskSpec, TaskStatus, type TaskUpdatable, TeamAgentGraphBuilder, type TeamConfig, type TeamMiddlewareOptions, type TeamTask, type TeammateSpec, type TeammateToolsOptions, TenantPluginCatalog, type TenantPluginCatalogDeps, type TenantPlugins, type ThreadBuffer, type ThreadBufferConfig, type ThreadBusyEvent, type ThreadEndCode, ThreadEndError, type ThreadIdleEvent, type ThreadInfo, type ThreadQueueConfig, type ThreadRunLeaseHandle, type ThreadState, ThreadStatus, type ThreadStatusChangedEvent, TokenCache, type ToolDefinition, type ToolLattice, ToolLatticeManager, type TransferOwnerInput, type TransferOwnerResult, type TrustedAgentMessageDispatcher, type TrustedMessageOptions, type TryAcquireTaskRunInput, type TryAcquireThreadRunInput, type UnknownToolHandlerConfig, UnsafeUpstreamUrlError, type UnsafeUrlReason, type ValidateManifestArgs, type VectorStoreLatticeInterface, VectorStoreLatticeManager, type VectorStoreProviderLattice, VectorStoreProviderManager, VolumeFilesystem, type VolumeFsClient, type WithLeaseOptions, type WorkflowValidationError, type WriteResult, abortWorkflowRun, agentInstanceManager, agentLatticeManager, appendReconciliationWarning, appendUiFence, assertSafeUpstreamUrl, buildBundleFromDist, buildGrepResultsDict, buildInput, buildNamedVolumeName, buildRemotePackDirectoryCommand, buildSandboxMetadataEnv, buildSandboxOpenEnv, buildSkillFile, buildStateAnnotation, buildTableName, buildTaskMutationFallback, buildTaskNormalizationFallback, checkEmptyContent, clearEncryptionKeyCache, clearEvalRunService, clearSandboxOpenCredentialProviderForTests, collectionLatticeManager, compileInternal, compileSandboxPlugin, compileWorkflow, computeSandboxName, configureCoordinationLeaseStore, configurePluginCatalogSync, configureStores, connectAllChannels, convertToConnection, createAgentNode, createAgentTeam, createCapabilityGuardMiddleware, createExecuteSqlQueryTool, createFileData, createInfoSqlTool, createListMetricsDataSourcesTool, createListMetricsServersTool, createListTablesSqlTool, createMapNode, createModelSelectorMiddleware, createNodeHandler, createProjectRoomMiddleware, createProjectTaskOwnerPolicy, createProjectTaskReassignmentAuthorizer, createQueryCheckerSqlTool, createQueryMetricDefinitionTool, createQueryMetricsListTool, createQuerySemanticMetricDataTool, createQuerySqlTool, createQueryTableDefinitionTool, createQueryTablesListTool, createRepeatedToolCallBreakerMiddleware, createResourceAddress, createSandboxProvider, createSandboxResolver, createSchedulerMiddleware, createSharePayload, createShellExecTool, createTaskExecutionService, createTaskLifecycleService, createTaskMiddleware, createTaskRunBridge, createTeamMiddleware, createTeammateTools, createTrustedAgentMessageDispatcher, createUnknownToolHandlerMiddleware, createWidgetMiddleware, decrypt, describeCronExpression, documentLearningPlugin, documentParserPlugin, embeddingsLatticeManager, encrypt, ensureBuiltinAgentsForTenant, ensurePluginSkillInSandbox, evaluateLatticeCaseWithLogs, eventBus, eventBus as eventBusDefault, executionAuthorityRegistry, extractAppsRef, extractFetcherError, extractLegacyRefs, extractOutput, fileDataToString, formatContentWithLineNumbers, formatGrepMatches, formatGrepResults, formatReadResponse, generateDirectBotProjectId, generateDirectHumanProjectId, generateToken, getAgentClient, getAgentClientAsync, getAgentConfig, getAllAgentConfigs, getAllBuiltInSkillMetas, getAllToolDefinitions, getBindingRegistry, getBuiltInSkillContent, getBuiltInSkillMeta, getBuiltInSkillNames, getCheckpointSaver, getChunkBuffer, getCollectionEntryCount, getCoordinationLeaseStore, getEmbeddingsClient, getEmbeddingsLattice, getEncryptionKey, getEvalRunService, getLoggerLattice, getMenuRegistry, getModelLattice, getNextCronTime, getOrCreateCollectionVectorStore, getPluginSkillManifestVersion, getQueueLattice, getReplicaId, getRuntimeCapabilityConfig, getRuntimeSkillSelection, getSTTClient, getSTTClientWithTenant, getSTTModelLattice, getSandBoxManager, getSandboxOpenCredential, getSandboxPluginCatalog, getScheduleLattice, getStoreLattice, getThreadRunOwner, getToolClient, getToolClientWithTenant, getToolDefinition, getToolLattice, getVectorStoreClient, getVectorStoreLattice, getVectorStoreProvider, getWorkflowSignal, globSearchFiles, grepMatchesFromFiles, grepSearchFiles, hasChunkBuffer, hasDelegatedWorkerToken, hasRuntimeCapabilityPolicy, invokeWithRetry, isBuiltInSkill, isDirectRoom, isMcpConnectionError, isPluginSkillAuthorizedInSandbox, isPluginSkillManagedInSandbox, isUsingDefaultKey, isValidCronExpression, isValidSandboxName, isValidSkillName, jsonSchemaToZod, listCollectionEntries, listSandboxProviderTypes, loggerLatticeManager, mcpManager, mergeCapabilityBundles, mergePluginSkills, mergePluginSources, metricsServerManager, modelLatticeManager, nextBackoffDelay, normalizeSandboxName, ownTaskResponseField, parallelLimit, parseCronExpression, parseDirectRoomType, parseJudgeVerdict, parsePackSize, parseSkillFrontmatter, parseTaskResponse, parseYaml, performStringReplacement, postProcessTaskMutationResponse, prepareTaskDispatch, projectMutationMutex, projectRoomPlugin, projectTaskAdmissionNotifier, provisionSandboxOpenClient, publishPluginCatalogChanged, queueLatticeManager, readLoopBreakerConfig, reconcileAllTenantTaskRuns, reconcileStaleTaskRuns, reconcileTenantTaskRuns, registerAgentLattice, registerAgentLatticeWithTenant, registerAgentLattices, registerCheckpointSaver, registerChunkBuffer, registerEmbeddingsLattice, registerExistingTool, registerExistingToolWithTenant, registerLoggerLattice, registerModelLattice, registerModelLatticeForTenant, registerQueueLattice, registerSTTModelLattice, registerSandboxOpenCredentialProvider, registerSandboxProviderType, registerScheduleLattice, registerStoreLattice, registerTeammateAgent, registerToolLattice, registerVectorStoreLattice, registerVectorStoreProvider, registerWorkflowRun, removeCollectionVectorStore, renderTemplate, resetReplicaIdForTests, resolveEnabledPluginSkill, resolveJudgeModelKey, resolvePath, resolvePluginConnections, resolveSandboxPluginConnections, resolveTenantPluginSkill, roomCoordinatorConfig, runAsLeader, runRemotePackDirectory, safeTaskResponseId, sandboxLatticeManager, sanitizeToolCallId, scheduleLatticeManager, serializePluginMeta, serializeTaskMutationSuccess, serializeTaskNormalizationFallback, serializeTaskReadResponse, setBindingRegistry, setEvalRunService, setMenuRegistry, setSandboxPluginCatalog, skillLatticeManager, sqlDatabaseManager, storeLatticeManager, sttModelLatticeManager, taskLifecycleNotifier, taskRunLeaseKey, taskRunRegistry, threadRunLeaseKey, toJsonSchema, toSafeStateExpr, toolLatticeManager, truncateIfTooLong, tryAcquireTaskRun, tryAcquireThreadRun, unregisterTeammateAgent, unregisterWorkflowRun, updateFileData, validateAgentInput, validateCapabilityBundleInput, validateDSL, validateEncryptionKey, validatePackSourcePath, validatePath, validateRelativePath, validateSandboxPluginManifest, validateSkillName, validateToolInput, vectorStoreLatticeManager, vectorStoreProviderManager, withLease, withTimeout, wrapMcpToolWithUi };