@byok-sdk/protocol 0.18.0 → 0.20.0

package/dist/input-preparation.d.ts

@@ -0,0 +1,977 @@
+import { z } from 'zod';
+/**
+ * Remote authenticated runtime input preparation — the wire half of
+ * `docs/researches/runtime-input-preparation-contract.md` §19 (channel shape)
+ * and the C07 G4 design decision §17 B.
+ *
+ * This module owns ONLY the leaf shapes. The server -> device payload lives in
+ * `messages.ts` beside every other message payload (so the one inline byte
+ * bound `MAX_INLINE_BYTES` stays a single module-local authority), and the two
+ * authenticated HTTP bodies live in `http-api.ts`.
+ *
+ * Three structural rules this surface exists to hold:
+ *
+ * 1. The request carries NO tools, NO tool executors and NO runtime identity.
+ *    Those are LOCAL observations: only the device can honestly say which MCP
+ *    toolsets it has, what schemas their servers publish, and which native
+ *    package closure is installed. A Host that could state them would be
+ *    stating an identity it cannot verify.
+ * 2. The receipt summary discloses identities, digests, sizes, counter
+ *    evidence and readiness — never D, never P(D), never the snapshot. A
+ *    digest proves content identity; it is not a disclosure channel and not a
+ *    bearer token (§10.3.4).
+ * 3. Every shape here is `.strict()`. This is control data: an unrecognized
+ *    field must be REJECTED, not silently stripped, per docs/protocol.md's
+ *    freeze-rule asymmetry. Adding a field post-freeze is therefore a
+ *    breaking change, exactly like `PermissionPolicySchema`.
+ */
+/**
+ * The ONE version of the input-preparation contract, shared by this relay wire
+ * (the `agent.input.preparation` payload and the completion receipt summary)
+ * and by the device-local request, receipt and artifact
+ * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).
+ *
+ * The relay wire carries no version field of its own, so a version change is
+ * made visible where admission actually happens: in the capability token
+ * below. See `INPUT_PREPARATION_VERSION` in the client for what each version
+ * changed.
+ */
+export declare const INPUT_PREPARATION_WIRE_VERSION: 5;
+/**
+ * Capability required before a task-free remote input preparation — or a
+ * prepared Execution — is admitted: `agent-input-preparation-v<N>`, where
+ * `<N>` is {@link INPUT_PREPARATION_WIRE_VERSION}.
+ *
+ * The version is IN the token because the relay wire has none. A device
+ * declares exactly the one token of the contract it speaks, and a cloud admits
+ * exactly the one token of the contract it speaks, so a device and a cloud on
+ * different contract versions never exchange a preparation at all: the cloud
+ * refuses at enqueue (`agent_capability_missing`, before any receipt or
+ * mailbox row) instead of relaying a payload the other side would refuse with
+ * a strict-schema 422 and a device would then redeliver forever. There is no
+ * dual token and no accepted older one. The retired unversioned token
+ * `agent-input-preparation` (versions up to 4) is admitted nowhere.
+ *
+ * The token gates NEW admissions only. A row enqueued before a version cut is
+ * still in flight afterwards, and its completion is accepted only by a cloud
+ * on the same version as the device answering it; across the cut it is a 422
+ * and a stalled device cursor. Draining in-flight rows and upgrading cloud and
+ * devices as a pair is the operator precondition for the cut (`docs/spec.md`,
+ * bounded admission); nothing here parses an older receipt.
+ */
+export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparation-v5";
+/** The preparation surface uses the package-wide lowercase `sha256:<hex>` transport form. */
+export declare const InputPreparationContentHashSchema: z.ZodString;
+/**
+ * The operator-assigned limits-policy revision a device must already hold. The
+ * SDK compares it for exact equality and never negotiates it: a device whose
+ * configured revision differs rejects rather than preparing under a policy the
+ * caller believed was in force.
+ */
+export declare const InputPreparationPolicyRevisionSchema: z.ZodString;
+/**
+ * Host-owned Profile identity. It rides beside `agentRef` rather than inside
+ * it because `AgentRefSchema` is the frozen generic Agent identity shared by
+ * every other message, and widening that would be a breaking change to all of
+ * them. The device never trusts this value directly — its configured local
+ * authority resolver validates it against trusted local Profile records before
+ * anything is compiled.
+ */
+export declare const InputPreparationProfileIdSchema: z.ZodString;
+/**
+ * The permission mode a preparation is compiled FOR.
+ *
+ * It is the same closed set every task policy uses (`permission.ts`'s
+ * `PERMISSION_MODES`), spelled here as its own schema because a preparation
+ * carries a mode without carrying a policy: there is no task, no grant and no
+ * approval seam on this wire. The mode selects which tools the device's own
+ * observation projects into the counted manifest, and nothing else.
+ *
+ * Declared by the requester rather than inferred by the device: a device that
+ * guessed would be counting a manifest the requester never asked for, and a
+ * device that defaulted would silently count the widest one.
+ */
+export declare const InputPreparationPermissionModeSchema: z.ZodEnum<{
+    auto: "auto";
+    confirm: "confirm";
+    plan: "plan";
+    readonly: "readonly";
+}>;
+export type InputPreparationPermissionMode = z.infer<typeof InputPreparationPermissionModeSchema>;
+/**
+ * The canonical Host source snapshot this input was assembled from. Both
+ * values are Host authority carried verbatim so the receipt binds the exact
+ * revision/digest a later consumer must re-present. The SDK interprets
+ * neither.
+ */
+export declare const InputPreparationSourceSchema: z.ZodObject<{
+    revision: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strict>;
+export type InputPreparationSource = z.infer<typeof InputPreparationSourceSchema>;
+export declare const InputPreparationModelCostSchema: z.ZodObject<{
+    input: z.ZodNumber;
+    output: z.ZodNumber;
+    cacheRead: z.ZodNumber;
+    cacheWrite: z.ZodNumber;
+}, z.core.$strict>;
+/**
+ * The exact model identity the request compiles for.
+ *
+ * `api` is a single literal, not an open enum: `openai-completions` is the one
+ * API the frozen B-P1 native validator admits, and widening it is a
+ * registration, not a parser relaxation.
+ *
+ * `thinkingLevelMap` and `compat` are the two body-affecting declarations a
+ * locally configured provider profile projects into the model entry the runtime
+ * is launched with. They are OPTIONAL because a model configuration may declare
+ * neither, and absent stays absent on every carrier: nothing here defaults,
+ * coerces or infers one, since a preparation whose model gained a field on the
+ * way through would no longer equal the session model it was counted for.
+ */
+export declare const InputPreparationModelSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    api: z.ZodLiteral<"openai-completions">;
+    provider: z.ZodString;
+    baseUrl: z.ZodString;
+    reasoning: z.ZodBoolean;
+    input: z.ZodArray<z.ZodEnum<{
+        image: "image";
+        text: "text";
+    }>>;
+    cost: z.ZodObject<{
+        input: z.ZodNumber;
+        output: z.ZodNumber;
+        cacheRead: z.ZodNumber;
+        cacheWrite: z.ZodNumber;
+    }, z.core.$strict>;
+    contextWindow: z.ZodNumber;
+    maxTokens: z.ZodNumber;
+    thinkingLevelMap: z.ZodOptional<z.ZodObject<{
+        off: z.ZodNullable<z.ZodString>;
+        minimal: z.ZodNullable<z.ZodString>;
+        low: z.ZodNullable<z.ZodString>;
+        medium: z.ZodNullable<z.ZodString>;
+        high: z.ZodNullable<z.ZodString>;
+        xhigh: z.ZodNullable<z.ZodString>;
+        max: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    compat: z.ZodOptional<z.ZodObject<{
+        supportsStore: z.ZodOptional<z.ZodBoolean>;
+        supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
+        supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
+        supportsUsageInStreaming: z.ZodOptional<z.ZodBoolean>;
+        maxTokensField: z.ZodOptional<z.ZodEnum<{
+            max_completion_tokens: "max_completion_tokens";
+            max_tokens: "max_tokens";
+        }>>;
+        thinkingFormat: z.ZodOptional<z.ZodEnum<{
+            "ant-ling": "ant-ling";
+            baseten: "baseten";
+            "chat-template": "chat-template";
+            deepseek: "deepseek";
+            openai: "openai";
+            openrouter: "openrouter";
+            qwen: "qwen";
+            "qwen-chat-template": "qwen-chat-template";
+            "string-thinking": "string-thinking";
+            together: "together";
+            zai: "zai";
+        }>>;
+        zaiToolStream: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type InputPreparationModel = z.infer<typeof InputPreparationModelSchema>;
+/**
+ * Body-affecting options only. Transport options are deliberately not on this wire.
+ *
+ * `toolChoice` admits `auto` and `none` and nothing else: the native prepared
+ * boundary compiles through the simple stream path, which cannot express
+ * `required`, so a Host stating it would be stating an option no compiler on
+ * the other side can produce. It is refused HERE, by the schema, rather than
+ * surviving to a native refusal nobody can read.
+ *
+ * `reasoningEffort` names a requested thinking level. The native compiler maps
+ * it through the launched model's own level map and clamps it exactly as the
+ * live session does, so the effort token that reaches the body is the model's,
+ * never this value verbatim.
+ */
+export declare const InputPreparationOptionsSchema: z.ZodObject<{
+    cacheRetention: z.ZodEnum<{
+        long: "long";
+        none: "none";
+        short: "short";
+    }>;
+    maxTokens: z.ZodNumber;
+    temperature: z.ZodOptional<z.ZodNumber>;
+    toolChoice: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        none: "none";
+    }>>;
+    reasoningEffort: z.ZodOptional<z.ZodEnum<{
+        high: "high";
+        low: "low";
+        max: "max";
+        medium: "medium";
+        minimal: "minimal";
+        xhigh: "xhigh";
+    }>>;
+}, z.core.$strict>;
+export type InputPreparationOptions = z.infer<typeof InputPreparationOptionsSchema>;
+export declare const InputPreparationSelectionSchema: z.ZodObject<{
+    model: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        api: z.ZodLiteral<"openai-completions">;
+        provider: z.ZodString;
+        baseUrl: z.ZodString;
+        reasoning: z.ZodBoolean;
+        input: z.ZodArray<z.ZodEnum<{
+            image: "image";
+            text: "text";
+        }>>;
+        cost: z.ZodObject<{
+            input: z.ZodNumber;
+            output: z.ZodNumber;
+            cacheRead: z.ZodNumber;
+            cacheWrite: z.ZodNumber;
+        }, z.core.$strict>;
+        contextWindow: z.ZodNumber;
+        maxTokens: z.ZodNumber;
+        thinkingLevelMap: z.ZodOptional<z.ZodObject<{
+            off: z.ZodNullable<z.ZodString>;
+            minimal: z.ZodNullable<z.ZodString>;
+            low: z.ZodNullable<z.ZodString>;
+            medium: z.ZodNullable<z.ZodString>;
+            high: z.ZodNullable<z.ZodString>;
+            xhigh: z.ZodNullable<z.ZodString>;
+            max: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        compat: z.ZodOptional<z.ZodObject<{
+            supportsStore: z.ZodOptional<z.ZodBoolean>;
+            supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
+            supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
+            supportsUsageInStreaming: z.ZodOptional<z.ZodBoolean>;
+            maxTokensField: z.ZodOptional<z.ZodEnum<{
+                max_completion_tokens: "max_completion_tokens";
+                max_tokens: "max_tokens";
+            }>>;
+            thinkingFormat: z.ZodOptional<z.ZodEnum<{
+                "ant-ling": "ant-ling";
+                baseten: "baseten";
+                "chat-template": "chat-template";
+                deepseek: "deepseek";
+                openai: "openai";
+                openrouter: "openrouter";
+                qwen: "qwen";
+                "qwen-chat-template": "qwen-chat-template";
+                "string-thinking": "string-thinking";
+                together: "together";
+                zai: "zai";
+            }>>;
+            zaiToolStream: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    options: z.ZodObject<{
+        cacheRetention: z.ZodEnum<{
+            long: "long";
+            none: "none";
+            short: "short";
+        }>;
+        maxTokens: z.ZodNumber;
+        temperature: z.ZodOptional<z.ZodNumber>;
+        toolChoice: z.ZodOptional<z.ZodEnum<{
+            auto: "auto";
+            none: "none";
+        }>>;
+        reasoningEffort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            max: "max";
+            medium: "medium";
+            minimal: "minimal";
+            xhigh: "xhigh";
+        }>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type InputPreparationSelection = z.infer<typeof InputPreparationSelectionSchema>;
+export declare const InputPreparationContextFileSchema: z.ZodObject<{
+    path: z.ZodString;
+    content: z.ZodString;
+}, z.core.$strict>;
+/**
+ * The three documentation locations the native prompt renderer names.
+ *
+ * The wire field names are this SDK's own and do not track upstream Pi's
+ * (`readme`/`docs`/`examples`): the contract a Host integrates against is this
+ * one, and renaming a frozen wire field because a runtime renamed a parameter
+ * would be a breaking change to every Host for no gain. The device adapter maps
+ * these onto whatever the pinned runtime calls them.
+ */
+export declare const InputPreparationDocsPathsSchema: z.ZodObject<{
+    readmePath: z.ZodString;
+    docsPath: z.ZodString;
+    examplesPath: z.ZodString;
+}, z.core.$strict>;
+/**
+ * One skill the system prompt renders, stated as the closed set of fields the
+ * renderer actually reads.
+ *
+ * Not a preformatted string: the native renderer owns the skill block's
+ * markup, and a Host-rendered one would be a second renderer that could drift
+ * from what a live session emits. Loader bookkeeping the prompt never reads
+ * (`baseDir`, source info) is deliberately absent — the Host cannot know it and
+ * the device must never invent it.
+ */
+export declare const InputPreparationSkillSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    filePath: z.ZodString;
+    disableModelInvocation: z.ZodBoolean;
+}, z.core.$strict>;
+export type InputPreparationSkill = z.infer<typeof InputPreparationSkillSchema>;
+/**
+ * Explicit, already-authorized inputs for the native system prompt renderer.
+ *
+ * `toolSnippets` is PROMPT TEXT the Host authored — it is not the
+ * model-visible tool schemas, which the device observes locally and the Host
+ * never states (see this module's rule 1). `toolGuidelines` is the same kind of
+ * value one level down: the guideline bullets a tool contributes, keyed by tool
+ * name and bounded exactly like `toolSnippets` and `promptGuidelines`.
+ *
+ * `selectedTools` is deliberately absent for the same reason one level up: the
+ * native contract requires that list to equal the model-visible manifest
+ * exactly, so a Host stating it would be stating the manifest. The device
+ * fills it from its own assembled tool surface.
+ */
+export declare const InputPreparationPromptSnapshotSchema: z.ZodObject<{
+    customPrompt: z.ZodOptional<z.ZodString>;
+    appendSystemPrompt: z.ZodOptional<z.ZodString>;
+    cwd: z.ZodString;
+    toolSnippets: z.ZodRecord<z.ZodString, z.ZodString>;
+    toolGuidelines: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    promptGuidelines: z.ZodArray<z.ZodString>;
+    contextFiles: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        content: z.ZodString;
+    }, z.core.$strict>>;
+    skills: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodString;
+        filePath: z.ZodString;
+        disableModelInvocation: z.ZodBoolean;
+    }, z.core.$strict>>;
+    docsPaths: z.ZodObject<{
+        readmePath: z.ZodString;
+        docsPath: z.ZodString;
+        examplesPath: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * One model-visible user message. Text-only: multimodal content and any extra
+ * field are not inferred, they reject.
+ */
+export declare const InputPreparationUserMessageSchema: z.ZodObject<{
+    role: z.ZodLiteral<"user">;
+    content: z.ZodString;
+    timestamp: z.ZodNumber;
+}, z.core.$strict>;
+/**
+ * One host-canonical assistant text message.
+ *
+ * A different fact from a provider-generated assistant turn: the host asserts
+ * this text was already said, and nothing generated it here. It carries no
+ * `api`, `provider`, `model`, `usage` or `stopReason`, and `.strict()` is what
+ * keeps one from being fabricated on the way in — an assistant message with
+ * provenance fields, or without the `origin` discriminant, is a claim this
+ * surface cannot check, so it rejects rather than being narrowed to one it can.
+ */
+export declare const InputPreparationHostCanonicalAssistantMessageSchema: z.ZodObject<{
+    role: z.ZodLiteral<"assistant">;
+    origin: z.ZodLiteral<"host_canonical">;
+    content: z.ZodString;
+    timestamp: z.ZodNumber;
+}, z.core.$strict>;
+/**
+ * The whole support set a caller may state: text-only user history,
+ * host-canonical assistant text history, and the current user message.
+ *
+ * A discriminated union on `role`, so an unsupported kind is refused by name
+ * rather than by a shape error on whichever member happened to be tried first.
+ * Provider-generated assistant turns, tool-result history and multimodal
+ * content are not members and are not inferred; adding one is a registration
+ * here AND in the device's hand-written parse, never a relaxation of either.
+ */
+export declare const InputPreparationMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    role: z.ZodLiteral<"user">;
+    content: z.ZodString;
+    timestamp: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    role: z.ZodLiteral<"assistant">;
+    origin: z.ZodLiteral<"host_canonical">;
+    content: z.ZodString;
+    timestamp: z.ZodNumber;
+}, z.core.$strict>], "role">;
+export type InputPreparationMessage = z.infer<typeof InputPreparationMessageSchema>;
+/**
+ * What `context.inline` (or the referenced blob) decodes to.
+ *
+ * Deliberately NOT the whole compiled snapshot: `tools` is absent because the
+ * device adds it from its own MCP observation. A Host that could send `tools`
+ * could claim a toolset the device does not have.
+ */
+export declare const InputPreparationContextDocumentSchema: z.ZodObject<{
+    prompt: z.ZodObject<{
+        customPrompt: z.ZodOptional<z.ZodString>;
+        appendSystemPrompt: z.ZodOptional<z.ZodString>;
+        cwd: z.ZodString;
+        toolSnippets: z.ZodRecord<z.ZodString, z.ZodString>;
+        toolGuidelines: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+        promptGuidelines: z.ZodArray<z.ZodString>;
+        contextFiles: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            content: z.ZodString;
+        }, z.core.$strict>>;
+        skills: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodString;
+            filePath: z.ZodString;
+            disableModelInvocation: z.ZodBoolean;
+        }, z.core.$strict>>;
+        docsPaths: z.ZodObject<{
+            readmePath: z.ZodString;
+            docsPath: z.ZodString;
+            examplesPath: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    messages: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        role: z.ZodLiteral<"user">;
+        content: z.ZodString;
+        timestamp: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        role: z.ZodLiteral<"assistant">;
+        origin: z.ZodLiteral<"host_canonical">;
+        content: z.ZodString;
+        timestamp: z.ZodNumber;
+    }, z.core.$strict>], "role">>;
+}, z.core.$strict>;
+export type InputPreparationContextDocument = z.infer<typeof InputPreparationContextDocumentSchema>;
+/**
+ * Durable lifecycle state of one local preparation record.
+ *
+ * `prepared` is the one successful terminal state: the artifact is compiled,
+ * persisted, and — when the device has an optional counter configured — its
+ * counter answered. A device with no counter reaches `prepared` without ever
+ * entering `counting`.
+ */
+export declare const InputPreparationStateSchema: z.ZodEnum<{
+    cancelled: "cancelled";
+    counter_interrupted: "counter_interrupted";
+    counting: "counting";
+    failed: "failed";
+    prepared: "prepared";
+    reserved: "reserved";
+}>;
+export type InputPreparationState = z.infer<typeof InputPreparationStateSchema>;
+/**
+ * Why a receipt is not ready. An empty list is the only thing that makes
+ * `ready` true.
+ *
+ * `ready` means the preparation CAN BE CONSUMED — the artifact is intact and
+ * unexpired, the native compiler's projection is content-complete, every
+ * residual key is ruled by an applicable Host accounting policy, D is text
+ * only, every executor identity is attested, and — only when the device has an
+ * optional counter configured — that count is provider-authoritative and
+ * covered. No count is required: the size evidence is
+ * `artifact.requestBytes`, the exact byte length of the frozen D. It is
+ * deliberately NOT Host budget admission: the device performs no budget
+ * arithmetic, so a ready receipt says the evidence holds, never that the
+ * spend fits a window.
+ */
+export declare const InputPreparationReadinessReasonSchema: z.ZodEnum<{
+    accounting_policy_inapplicable: "accounting_policy_inapplicable";
+    accounting_policy_missing: "accounting_policy_missing";
+    artifact_expired: "artifact_expired";
+    cancelled: "cancelled";
+    counter_authority_not_production: "counter_authority_not_production";
+    counter_coverage_incomplete: "counter_coverage_incomplete";
+    counter_interrupted: "counter_interrupted";
+    executor_identity_unproven: "executor_identity_unproven";
+    failed: "failed";
+    not_prepared: "not_prepared";
+    projection_unknown: "projection_unknown";
+    request_content_not_text: "request_content_not_text";
+    residual_not_ruled: "residual_not_ruled";
+    runtime_contract_superseded: "runtime_contract_superseded";
+}>;
+export type InputPreparationReadinessReason = z.infer<typeof InputPreparationReadinessReasonSchema>;
+/**
+ * Runtime/compiler identity derived from the VERIFIED installed package
+ * closure on the device. A Host never states it and cannot override it.
+ */
+export declare const InputPreparationRuntimeIdentitySchema: z.ZodObject<{
+    packageName: z.ZodString;
+    packageVersion: z.ZodString;
+    upstreamBase: z.ZodString;
+    upstreamCommit: z.ZodString;
+    forkBuild: z.ZodNumber;
+    envelopeFormat: z.ZodString;
+    requestFormat: z.ZodString;
+    compilerVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type InputPreparationRuntimeIdentity = z.infer<typeof InputPreparationRuntimeIdentitySchema>;
+export declare const InputPreparationCounterTargetSchema: z.ZodObject<{
+    endpoint: z.ZodString;
+    modelId: z.ZodString;
+}, z.core.$strict>;
+/**
+ * The Host's ruling about which residual keys of D its accounting already
+ * accounts for.
+ *
+ * Host authority, carried verbatim. The device performs exactly one check
+ * against it — APPLICABILITY — and never any budget arithmetic: every residual
+ * key the artifact carries must be named here, and the ruling must have been
+ * made for this preparation's own runtime identity and endpoint/model. There
+ * is no default: a request that names none produces a receipt carrying
+ * `accounting_policy_missing`, because "nobody ruled" and "everything is
+ * ruled" are different facts.
+ */
+export declare const InputPreparationAccountingPolicyRefSchema: z.ZodObject<{
+    revision: z.ZodString;
+    ruledRuntime: z.ZodString;
+    ruledTarget: z.ZodObject<{
+        endpoint: z.ZodString;
+        modelId: z.ZodString;
+    }, z.core.$strict>;
+    ruledResidualKeys: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type InputPreparationAccountingPolicyRef = z.infer<typeof InputPreparationAccountingPolicyRefSchema>;
+/**
+ * What the provider side of a count asserted, and which exact projection it
+ * was asserted about.
+ *
+ * Required, fixture included: a number without the identity of the bytes it
+ * was taken over is not evidence. The device compares `projectionDigest`
+ * against the artifact's own projection digest and `endpoint`/`modelId`
+ * against the counted target, and refuses the count outright on a mismatch.
+ *
+ * `asserted` is the provider's own answer, stored and never second-guessed —
+ * re-deriving a usage number locally is the shadow accounting this surface
+ * exists to avoid. It carries no output or whole-request field: the Host holds
+ * its own request, and `binding.requestDigest` is the check that ties the two.
+ */
+export declare const InputPreparationCounterProviderEvidenceSchema: z.ZodObject<{
+    projectionDigest: z.ZodString;
+    endpoint: z.ZodString;
+    modelId: z.ZodString;
+    asserted: z.ZodObject<{
+        httpStatus: z.ZodNumber;
+        usageFields: z.ZodRecord<z.ZodString, z.ZodNumber>;
+        responseDigest: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * Counter evidence exactly as the device's OPTIONAL adapter reported it.
+ * Absent when the device has no counter configured, which is a legal, ready-
+ * capable state: the size evidence is `artifact.requestBytes`.
+ *
+ * `authority: 'test_fixture'` is a first-class value, not a debug flag: a
+ * fixture result can never produce a ready receipt, which is what keeps an
+ * offline suite from ever looking like production accounting evidence.
+ */
+export declare const InputPreparationCounterEvidenceSchema: z.ZodObject<{
+    method: z.ZodString;
+    methodVersion: z.ZodString;
+    authority: z.ZodEnum<{
+        provider: "provider";
+        test_fixture: "test_fixture";
+    }>;
+    value: z.ZodNumber;
+    coverage: z.ZodObject<{
+        covered: z.ZodBoolean;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    providerEvidence: z.ZodObject<{
+        projectionDigest: z.ZodString;
+        endpoint: z.ZodString;
+        modelId: z.ZodString;
+        asserted: z.ZodObject<{
+            httpStatus: z.ZodNumber;
+            usageFields: z.ZodRecord<z.ZodString, z.ZodNumber>;
+            responseDigest: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    target: z.ZodObject<{
+        endpoint: z.ZodString;
+        modelId: z.ZodString;
+    }, z.core.$strict>;
+    calledAt: z.ZodISODateTime;
+    completedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+/**
+ * What the device established about the implementation behind ONE
+ * model-visible tool: `attested`, or `unavailable:<reason>` naming which of
+ * the SDK's closed unavailable reasons applies.
+ *
+ * A kind, never the identity itself: an install path, a closure digest or a
+ * stat tuple is device-local filesystem detail, and a receipt discloses
+ * identity facts, not the machine's layout.
+ */
+export declare const InputPreparationToolImplementationKindSchema: z.ZodString;
+/**
+ * What the native compiler proved about ONE top-level key of D that lies
+ * outside P(D).
+ *
+ * These classes describe STRUCTURE and nothing else. No class states, implies
+ * or denies that a key influences a provider's token count — that is an
+ * external accounting fact the compiler cannot prove — which is exactly why
+ * the device re-derives nothing from them and routes the question to the
+ * Host's own {@link InputPreparationAccountingPolicyRefSchema}.
+ */
+export declare const InputPreparationResidualValueClassSchema: z.ZodEnum<{
+    boolean: "boolean";
+    bounded_integer: "bounded_integer";
+    bounded_number: "bounded_number";
+    closed_enum: "closed_enum";
+    constant: "constant";
+    finite_number: "finite_number";
+    nonempty_string: "nonempty_string";
+    object_shape: "object_shape";
+}>;
+export type InputPreparationResidualValueClass = z.infer<typeof InputPreparationResidualValueClassSchema>;
+export declare const InputPreparationResidualKeySchema: z.ZodObject<{
+    key: z.ZodString;
+    valueClass: z.ZodEnum<{
+        boolean: "boolean";
+        bounded_integer: "bounded_integer";
+        bounded_number: "bounded_number";
+        closed_enum: "closed_enum";
+        constant: "constant";
+        finite_number: "finite_number";
+        nonempty_string: "nonempty_string";
+        object_shape: "object_shape";
+    }>;
+}, z.core.$strict>;
+/**
+ * What the native compiler proves about P(D), copied verbatim off the envelope.
+ *
+ * `content_complete` — every context-derived byte of D is byte-identically
+ * inside P(D), and every remaining top-level key was classified. `unknown` —
+ * the compiler failed closed, claims nothing, and leaves `residual` empty.
+ *
+ * `digest` is sha-256 over the exact counted-projection bytes. The device
+ * recomputes it and refuses the artifact on a mismatch; it never recomputes
+ * the KIND, because the classification table belongs to the compiler and a
+ * local copy of it would be a shadow parser for the same semantic fact.
+ */
+export declare const InputPreparationProjectionSchema: z.ZodObject<{
+    version: z.ZodLiteral<3>;
+    kind: z.ZodEnum<{
+        content_complete: "content_complete";
+        unknown: "unknown";
+    }>;
+    digest: z.ZodString;
+}, z.core.$strict>;
+/**
+ * Identities, sizes and the native compiler's structural projection contract.
+ * Never D, never P(D), never the snapshot.
+ *
+ * The three tool-surface fields are what make drift between preparation and
+ * launch checkable rather than assumed:
+ *
+ * - `observationDigest` binds everything the device OBSERVED — the projected
+ *   tools, their executor fingerprints, the launch attestation and the
+ *   implementation identities — so a launch whose live observation differs is
+ *   a different manifest, whatever the schemas say.
+ * - `toolBindingDigest` binds only the facts that can be re-derived WITHOUT
+ *   spawning a server: the launch attestation, the toolset definition
+ *   revisions and the implementation identities. It is what a replay of an
+ *   already-recorded requestId compares against, because re-probing to detect
+ *   drift would be the second executor fact the idempotency key exists to
+ *   prevent.
+ * - `toolImplementationKinds` states, per model-visible tool name, whether the
+ *   implementation behind it was attested. It is the evidence behind
+ *   `executor_identity_unproven`, so a reader does not have to take that
+ *   readiness reason on trust.
+ */
+export declare const InputPreparationArtifactSummarySchema: z.ZodObject<{
+    requestDigest: z.ZodString;
+    envelopeDigest: z.ZodString;
+    toolManifestDigest: z.ZodString;
+    requestBytes: z.ZodNumber;
+    projectionBytes: z.ZodNumber;
+    projection: z.ZodObject<{
+        version: z.ZodLiteral<3>;
+        kind: z.ZodEnum<{
+            content_complete: "content_complete";
+            unknown: "unknown";
+        }>;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    residual: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        valueClass: z.ZodEnum<{
+            boolean: "boolean";
+            bounded_integer: "bounded_integer";
+            bounded_number: "bounded_number";
+            closed_enum: "closed_enum";
+            constant: "constant";
+            finite_number: "finite_number";
+            nonempty_string: "nonempty_string";
+            object_shape: "object_shape";
+        }>;
+    }, z.core.$strict>>;
+    observationDigest: z.ZodString;
+    toolBindingDigest: z.ZodString;
+    toolImplementationKinds: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>;
+/** The immutable binding a receipt carries and a later consumer must re-present. */
+export declare const InputPreparationBindingSchema: z.ZodObject<{
+    scopeId: z.ZodString;
+    deviceId: z.ZodString;
+    agentRef: z.ZodString;
+    profileId: z.ZodString;
+    profileRevision: z.ZodString;
+    source: z.ZodObject<{
+        revision: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    target: z.ZodObject<{
+        endpoint: z.ZodString;
+        modelId: z.ZodString;
+    }, z.core.$strict>;
+    policyRevision: z.ZodString;
+    permissionMode: z.ZodEnum<{
+        auto: "auto";
+        confirm: "confirm";
+        plan: "plan";
+        readonly: "readonly";
+    }>;
+    runtime: z.ZodObject<{
+        packageName: z.ZodString;
+        packageVersion: z.ZodString;
+        upstreamBase: z.ZodString;
+        upstreamCommit: z.ZodString;
+        forkBuild: z.ZodNumber;
+        envelopeFormat: z.ZodString;
+        requestFormat: z.ZodString;
+        compilerVersion: z.ZodNumber;
+    }, z.core.$strict>;
+    requestDigest: z.ZodString;
+    accountingPolicyRef: z.ZodOptional<z.ZodObject<{
+        revision: z.ZodString;
+        ruledRuntime: z.ZodString;
+        ruledTarget: z.ZodObject<{
+            endpoint: z.ZodString;
+            modelId: z.ZodString;
+        }, z.core.$strict>;
+        ruledResidualKeys: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * The exact receipt projection a device reports back.
+ *
+ * `reference` names the record inside the device-local authenticated scope
+ * that created it. It is not a capability: local lookup re-resolves authority
+ * on every call and derives the record key from the trusted grant.
+ */
+export declare const InputPreparationReceiptSummarySchema: z.ZodObject<{
+    reference: z.ZodString;
+    state: z.ZodEnum<{
+        cancelled: "cancelled";
+        counter_interrupted: "counter_interrupted";
+        counting: "counting";
+        failed: "failed";
+        prepared: "prepared";
+        reserved: "reserved";
+    }>;
+    binding: z.ZodObject<{
+        scopeId: z.ZodString;
+        deviceId: z.ZodString;
+        agentRef: z.ZodString;
+        profileId: z.ZodString;
+        profileRevision: z.ZodString;
+        source: z.ZodObject<{
+            revision: z.ZodString;
+            digest: z.ZodString;
+        }, z.core.$strict>;
+        target: z.ZodObject<{
+            endpoint: z.ZodString;
+            modelId: z.ZodString;
+        }, z.core.$strict>;
+        policyRevision: z.ZodString;
+        permissionMode: z.ZodEnum<{
+            auto: "auto";
+            confirm: "confirm";
+            plan: "plan";
+            readonly: "readonly";
+        }>;
+        runtime: z.ZodObject<{
+            packageName: z.ZodString;
+            packageVersion: z.ZodString;
+            upstreamBase: z.ZodString;
+            upstreamCommit: z.ZodString;
+            forkBuild: z.ZodNumber;
+            envelopeFormat: z.ZodString;
+            requestFormat: z.ZodString;
+            compilerVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        requestDigest: z.ZodString;
+        accountingPolicyRef: z.ZodOptional<z.ZodObject<{
+            revision: z.ZodString;
+            ruledRuntime: z.ZodString;
+            ruledTarget: z.ZodObject<{
+                endpoint: z.ZodString;
+                modelId: z.ZodString;
+            }, z.core.$strict>;
+            ruledResidualKeys: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    artifact: z.ZodOptional<z.ZodObject<{
+        requestDigest: z.ZodString;
+        envelopeDigest: z.ZodString;
+        toolManifestDigest: z.ZodString;
+        requestBytes: z.ZodNumber;
+        projectionBytes: z.ZodNumber;
+        projection: z.ZodObject<{
+            version: z.ZodLiteral<3>;
+            kind: z.ZodEnum<{
+                content_complete: "content_complete";
+                unknown: "unknown";
+            }>;
+            digest: z.ZodString;
+        }, z.core.$strict>;
+        residual: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            valueClass: z.ZodEnum<{
+                boolean: "boolean";
+                bounded_integer: "bounded_integer";
+                bounded_number: "bounded_number";
+                closed_enum: "closed_enum";
+                constant: "constant";
+                finite_number: "finite_number";
+                nonempty_string: "nonempty_string";
+                object_shape: "object_shape";
+            }>;
+        }, z.core.$strict>>;
+        observationDigest: z.ZodString;
+        toolBindingDigest: z.ZodString;
+        toolImplementationKinds: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>;
+    counter: z.ZodOptional<z.ZodObject<{
+        method: z.ZodString;
+        methodVersion: z.ZodString;
+        authority: z.ZodEnum<{
+            provider: "provider";
+            test_fixture: "test_fixture";
+        }>;
+        value: z.ZodNumber;
+        coverage: z.ZodObject<{
+            covered: z.ZodBoolean;
+            reason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        providerEvidence: z.ZodObject<{
+            projectionDigest: z.ZodString;
+            endpoint: z.ZodString;
+            modelId: z.ZodString;
+            asserted: z.ZodObject<{
+                httpStatus: z.ZodNumber;
+                usageFields: z.ZodRecord<z.ZodString, z.ZodNumber>;
+                responseDigest: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        target: z.ZodObject<{
+            endpoint: z.ZodString;
+            modelId: z.ZodString;
+        }, z.core.$strict>;
+        calledAt: z.ZodISODateTime;
+        completedAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    ready: z.ZodBoolean;
+    readinessReasons: z.ZodArray<z.ZodEnum<{
+        accounting_policy_inapplicable: "accounting_policy_inapplicable";
+        accounting_policy_missing: "accounting_policy_missing";
+        artifact_expired: "artifact_expired";
+        cancelled: "cancelled";
+        counter_authority_not_production: "counter_authority_not_production";
+        counter_coverage_incomplete: "counter_coverage_incomplete";
+        counter_interrupted: "counter_interrupted";
+        executor_identity_unproven: "executor_identity_unproven";
+        failed: "failed";
+        not_prepared: "not_prepared";
+        projection_unknown: "projection_unknown";
+        request_content_not_text: "request_content_not_text";
+        residual_not_ruled: "residual_not_ruled";
+        runtime_contract_superseded: "runtime_contract_superseded";
+    }>>;
+    detail: z.ZodOptional<z.ZodString>;
+    artifactExpiresAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type InputPreparationReceiptSummary = z.infer<typeof InputPreparationReceiptSummarySchema>;
+/**
+ * The device-local reference one receipt answered with
+ * ({@link InputPreparationReceiptSummarySchema}'s `reference`).
+ *
+ * The same opaque identifier, spelled as its own schema so the offer wire and
+ * the receipt wire cannot drift into two definitions of one value. It is NOT a
+ * capability: the device re-resolves authority on every lookup and derives the
+ * record key from its own trusted grant, so presenting another scope's
+ * reference finds nothing.
+ */
+export declare const InputPreparationReferenceSchema: z.ZodString;
+/**
+ * The preparation a `task.offer_prepared` names, re-presented by the Host from
+ * the receipt it was given.
+ *
+ * Nothing here is authority. Every value is COMPARED against the device's own
+ * durable record before an Execution is admitted, and a difference declines the
+ * offer non-retryably — a Host that could state a binding would be stating what
+ * this device counted.
+ *
+ * `artifactDigest` is optional for one structural reason, not as a compatibility
+ * seam: a receipt discloses `artifact` only once there is one
+ * ({@link InputPreparationArtifactSummarySchema} is optional on the receipt), so
+ * a Host holding a not-yet-prepared receipt has no envelope digest to re-present.
+ * When it is present it is compared like everything else.
+ */
+export declare const InputPreparationOfferBindingSchema: z.ZodObject<{
+    reference: z.ZodString;
+    requestDigest: z.ZodString;
+    artifactDigest: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InputPreparationOfferBinding = z.infer<typeof InputPreparationOfferBindingSchema>;
+/**
+ * Why a device refused to prepare at all. These are the device-owned typed
+ * rejections; none of them ever accompanies an artifact.
+ *
+ * `input_preparation_unconfigured` is the answer from a device that advertised
+ * nothing: the whole surface is off there. It is reported rather than thrown so
+ * one mis-targeted request cannot freeze the device's mailbox cursor behind it.
+ */
+export declare const InputPreparationRejectionReasonSchema: z.ZodEnum<{
+    authority_unavailable: "authority_unavailable";
+    bad_request: "bad_request";
+    cancelled: "cancelled";
+    context_hash_mismatch: "context_hash_mismatch";
+    context_unresolvable: "context_unresolvable";
+    counter_interrupted: "counter_interrupted";
+    counter_unavailable: "counter_unavailable";
+    deadline_elapsed: "deadline_elapsed";
+    durable_write_failed: "durable_write_failed";
+    input_preparation_record_log_unsupported: "input_preparation_record_log_unsupported";
+    input_preparation_unconfigured: "input_preparation_unconfigured";
+    launch_boundary_unavailable: "launch_boundary_unavailable";
+    limit_exceeded: "limit_exceeded";
+    not_found: "not_found";
+    observation_drift: "observation_drift";
+    permission_mode_denied: "permission_mode_denied";
+    policy_revision_mismatch: "policy_revision_mismatch";
+    request_conflict: "request_conflict";
+    rpc_frame_too_large: "rpc_frame_too_large";
+    runtime_identity_unavailable: "runtime_identity_unavailable";
+    scope_denied: "scope_denied";
+    toolsets_unobservable: "toolsets_unobservable";
+    unsupported_input: "unsupported_input";
+}>;
+export type InputPreparationRejectionReason = z.infer<typeof InputPreparationRejectionReasonSchema>;