@canonmsg/agent-sdk 12.5.1 → 13.0.2

package/dist/mls-wasm-host.js

@@ -0,0 +1,258 @@
+import {
+  WASM_HOST_CONFIGURE,
+  WASM_HOST_PROVISION,
+  keyFile
+} from "./chunks/chunk-DTAWEQCM.js";
+import {
+  MAX_INPUT,
+  NodeMlsDevCustodyError,
+  parseFrame,
+  rejected,
+  requireValue
+} from "./chunks/chunk-YJUPKU47.js";
+import {
+  __name,
+  canonicalEndpointJson,
+  isMlsDevReceiptClockSkew,
+  parseMlsDevDeviceContext
+} from "./chunks/chunk-5WPAB5MB.js";
+
+// src/mls-wasm-host.ts
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+
+// ../endpoint/src/mls-browser-custody.ts
+var AAD_DOMAIN = "canon.mls.browser-state.v1";
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_PAYLOAD_BYTES = 4 * 1024 * 1024;
+var refused = /* @__PURE__ */ __name(() => {
+  throw new Error("CANON_MLS_CUSTODY_REFUSED");
+}, "refused");
+function toBase64(bytes) {
+  let text = "";
+  for (let at = 0; at < bytes.length; at += 32768) text += String.fromCharCode(...bytes.subarray(at, at + 32768));
+  return btoa(text);
+}
+__name(toBase64, "toBase64");
+function fromBase64(text) {
+  const binary = atob(text), bytes = new Uint8Array(binary.length);
+  for (let at = 0; at < binary.length; at += 1) bytes[at] = binary.charCodeAt(at);
+  return bytes;
+}
+__name(fromBase64, "fromBase64");
+function parsedContext(json) {
+  const { revision, ...context } = JSON.parse(json);
+  if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 0) refused();
+  return { contextId: canonicalEndpointJson(context), context, revision };
+}
+__name(parsedContext, "parsedContext");
+function createMlsBrowserCustody(options) {
+  const { engine, wrappingKey } = options;
+  const clock = options.clock ?? Date.now;
+  const issuerKeys = encoder.encode(JSON.stringify(options.issuerKeys)), receiptKeys = encoder.encode(JSON.stringify(options.receiptKeys));
+  const aad = /* @__PURE__ */ __name((purpose, context, binding) => encoder.encode(canonicalEndpointJson({ domain: AAD_DOMAIN, purpose, context, binding })), "aad");
+  async function wrap(key, additionalData, clear) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, key, clear));
+    const framed = new Uint8Array(12 + sealed.length);
+    framed.set(iv);
+    framed.set(sealed, 12);
+    return `v1:${toBase64(framed)}`;
+  }
+  __name(wrap, "wrap");
+  async function unwrap(key, additionalData, wrapped) {
+    if (!wrapped.startsWith("v1:")) refused();
+    const framed = fromBase64(wrapped.slice(3));
+    if (framed.length < 28) refused();
+    return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv: framed.subarray(0, 12), additionalData }, key, framed.subarray(12)));
+  }
+  __name(unwrap, "unwrap");
+  function answer2(bytes) {
+    if (bytes.length < 4) refused();
+    const length = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0);
+    if (length === 0) return { skew: decoder.decode(bytes.subarray(4)) };
+    if (length > MAX_PAYLOAD_BYTES || length > bytes.length - 4) refused();
+    return { payload: decoder.decode(bytes.subarray(4, 4 + length)), clear: bytes.slice(4 + length) };
+  }
+  __name(answer2, "answer");
+  async function finish(bytes, seal) {
+    try {
+      const result = answer2(bytes);
+      if ("skew" in result) return result.skew;
+      try {
+        return `{"wrappedState":${JSON.stringify(await seal(result.clear, result.payload))},"payload":${result.payload}}`;
+      } finally {
+        result.clear.fill(0);
+      }
+    } finally {
+      bytes.fill(0);
+    }
+  }
+  __name(finish, "finish");
+  return Object.freeze({
+    async initializeDevSigning(contextJson) {
+      await wrappingKey(parsedContext(contextJson).contextId);
+    },
+    async prepareDevSigning(contextJson, commandJson, wrappedState) {
+      const { contextId, context, revision } = parsedContext(contextJson), key = await wrappingKey(contextId);
+      const clear = wrappedState === null ? void 0 : await unwrap(key, aad("identity", context, { revision }), wrappedState);
+      try {
+        const prepared2 = engine.prepare_signing(encoder.encode(contextJson), encoder.encode(commandJson), clear, clock());
+        return await finish(prepared2, (next) => wrap(key, aad("identity", context, { revision: revision + 1 }), next));
+      } finally {
+        clear?.fill(0);
+      }
+    },
+    async prepareDevKeyPackage(contextJson, commandJson, wrappedIdentityState) {
+      const { contextId, context, revision } = parsedContext(contextJson), key = await wrappingKey(contextId);
+      const identity2 = await unwrap(key, aad("identity", context, { revision }), wrappedIdentityState);
+      try {
+        const prepared2 = engine.prepare_key_package(encoder.encode(contextJson), encoder.encode(commandJson), identity2, issuerKeys, clock());
+        return await finish(prepared2, (next, payload) => {
+          const { keyPackageId, deviceId } = JSON.parse(payload);
+          return wrap(key, aad("key-package", context, { version: 1, keyPackageId, deviceId }), next);
+        });
+      } finally {
+        identity2.fill(0);
+      }
+    },
+    async prepareDevGroup(identityContextJson, groupContextJson, commandJson, wrappedIdentityState, wrappedGroupState, wrappedKeyPackageState) {
+      const { contextId, context, revision } = parsedContext(identityContextJson), key = await wrappingKey(contextId);
+      const group = JSON.parse(groupContextJson);
+      const clear = [];
+      const open = /* @__PURE__ */ __name(async (additionalData, wrapped) => {
+        const opened = await unwrap(key, additionalData, wrapped);
+        clear.push(opened);
+        return opened;
+      }, "open");
+      try {
+        const identity2 = await open(aad("identity", context, { revision }), wrappedIdentityState);
+        const groupState = wrappedGroupState === null ? void 0 : await open(aad("group", context, group), wrappedGroupState);
+        let keyPackageState;
+        if (wrappedKeyPackageState !== null) {
+          const { keyPackageId } = JSON.parse(commandJson);
+          keyPackageState = await open(aad("key-package", context, { version: 1, keyPackageId, deviceId: group.deviceId }), wrappedKeyPackageState);
+        }
+        const prepared2 = engine.prepare_group(
+          encoder.encode(identityContextJson),
+          encoder.encode(groupContextJson),
+          encoder.encode(commandJson),
+          identity2,
+          groupState,
+          keyPackageState,
+          issuerKeys,
+          receiptKeys,
+          clock()
+        );
+        return await finish(prepared2, (next) => wrap(key, aad("group", context, { ...group, revision: group.revision + 1 }), next));
+      } finally {
+        clear.forEach((bytes) => bytes.fill(0));
+      }
+    }
+  });
+}
+__name(createMlsBrowserCustody, "createMlsBrowserCustody");
+
+// src/mls-wasm-host.ts
+var NULL = Buffer.from('{"version":1,"ok":true,"value":null}');
+var REJECTED = Buffer.from('{"version":1,"ok":false,"error":"MLS_NODE_CUSTODY_REJECTED"}');
+var sha256 = /* @__PURE__ */ __name((bytes) => createHash("sha256").update(bytes).digest("hex"), "sha256");
+var prepared = /* @__PURE__ */ __name((value) => Buffer.from(isMlsDevReceiptClockSkew(JSON.parse(value)) ? value : `{"version":1,"ok":true,"value":${value}}`), "prepared");
+var configuration;
+var custody;
+var wrapping;
+async function load() {
+  requireValue(existsSync(configuration.keyPath));
+  const bytes = keyFile(configuration.keyPath);
+  try {
+    return await crypto.subtle.importKey("raw", bytes, "AES-GCM", false, ["encrypt", "decrypt"]);
+  } finally {
+    bytes.fill(0);
+  }
+}
+__name(load, "load");
+async function configure(value) {
+  const wasm = readFileSync(value.wasmPath), glue = readFileSync(value.gluePath);
+  requireValue(sha256(wasm) === value.wasmSha256 && sha256(glue) === value.glueSha256);
+  const engine = await import(`data:text/javascript;base64,${glue.toString("base64")}`);
+  engine.initSync({ module: wasm });
+  configuration = value;
+  custody = createMlsBrowserCustody({
+    engine,
+    issuerKeys: value.issuerKeys,
+    receiptKeys: value.receiptKeys,
+    wrappingKey: /* @__PURE__ */ __name(() => wrapping ??= load().catch((error) => {
+      wrapping = void 0;
+      throw error;
+    }), "wrappingKey")
+  });
+}
+__name(configure, "configure");
+var identity = /* @__PURE__ */ __name((value) => {
+  const { revision: _revision, ...device } = parseMlsDevDeviceContext(value);
+  return JSON.stringify(device);
+}, "identity");
+function own(value) {
+  requireValue(typeof value === "string" && configuration);
+  requireValue(identity(JSON.parse(value)) === identity({ ...configuration.context, revision: 0 }));
+  return value;
+}
+__name(own, "own");
+async function answer(operation, values) {
+  if (operation === WASM_HOST_CONFIGURE) {
+    requireValue(!custody && values.length === 1);
+    await configure(JSON.parse(values[0]));
+    return NULL;
+  }
+  const context = own(values[0]);
+  if (operation === WASM_HOST_PROVISION) {
+    requireValue(values.length === 1 && !existsSync(configuration.keyPath));
+    keyFile(configuration.keyPath).fill(0);
+    return NULL;
+  }
+  if (operation === 1 && values.length === 1) {
+    await custody.initializeDevSigning(context);
+    return NULL;
+  }
+  if (operation === 2 && values.length === 3) return prepared(await custody.prepareDevSigning(context, values[1], values[2]));
+  if (operation === 3 && values.length === 3) return prepared(await custody.prepareDevKeyPackage(context, values[1], values[2]));
+  if (operation === 4 && values.length === 6) {
+    return prepared(await custody.prepareDevGroup(context, values[1], values[2], values[3], values[4], values[5]));
+  }
+  return rejected();
+}
+__name(answer, "answer");
+async function* frames(input) {
+  let buffered = Buffer.alloc(0);
+  for await (const chunk of input) {
+    buffered = Buffer.concat([buffered, chunk]);
+    while (buffered.length >= 4) {
+      const length = buffered.readUInt32BE(0);
+      requireValue(length <= MAX_INPUT);
+      if (buffered.length < 4 + length) break;
+      yield buffered.subarray(4, 4 + length);
+      buffered = buffered.subarray(4 + length);
+    }
+  }
+}
+__name(frames, "frames");
+function send(message) {
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(message.length);
+  return new Promise((sent) => {
+    process.stdout.write(Buffer.concat([length, message]), () => sent());
+  });
+}
+__name(send, "send");
+for (const signal of ["SIGINT", "SIGTERM", "SIGBREAK", "SIGHUP"]) process.on(signal, () => void 0);
+for await (const message of frames(process.stdin)) {
+  try {
+    const { operation, values } = parseFrame(message);
+    await send(await answer(operation, values));
+  } catch (error) {
+    if (!custody || !(error instanceof NodeMlsDevCustodyError) && error.message !== "CANON_MLS_CUSTODY_REFUSED") process.exit(70);
+    await send(REJECTED);
+  }
+}
+process.exit(0);

package/dist/runner/mls-bundled.d.ts

@@ -16,10 +16,23 @@ export declare const MLS_ENVIRONMENT_PINS: Readonly<Record<MlsEnvironmentId, {
 }>>;
 /**
  * The custody helper this package ships for this host (`dist/mls/<platform>/canon-mls-custody`), checked against its
- * pin, or undefined where it ships none: an Intel Mac, musl, Windows, or a build of this package without helpers. A
- * file that is there but differs from its pin is refused.
+ * pin, or undefined where it ships none that runs: an Intel Mac, Windows, musl, an old glibc, or a build of this package
+ * without helpers. A file that is there but differs from its pin is refused.
  */
 export declare function bundledMlsCustodyHelper(): {
     path: string;
     sha256: string;
 } | undefined;
+export interface BundledMlsWasmCore {
+    /** The process that runs the core (dist/mls-wasm-host.js). */
+    hostPath: string;
+    wasmPath: string;
+    wasmSha256: string;
+    gluePath: string;
+    glueSha256: string;
+}
+/**
+ * The WASM core this package ships for hosts with no helper (`dist/mls/wasm/`), checked against its pins, or undefined in a
+ * build of this package without it. A file that is there but differs from its pin is refused.
+ */
+export declare function bundledMlsWasmCore(): BundledMlsWasmCore | undefined;

package/dist/runner/mls-managed.d.ts

@@ -1,4 +1,5 @@
 import { type MlsDevDeviceContext, type MlsEnvironmentId } from '../internal/backend-contracts/index.js';
+import { type BundledMlsWasmCore } from './mls-bundled.js';
 import type { RunnerMlsOptions } from './mls.js';
 export interface ManagedMlsDeviceOptions {
     /** The runner's home (CANON_HOME, or a relay installation's home). */
@@ -9,6 +10,8 @@ export interface ManagedMlsDeviceOptions {
         path: string;
         sha256: string;
     };
+    /** The WASM core rather than a helper, as on a host with none. */
+    wasm?: BundledMlsWasmCore;
     /** Other public pins than this package's for the environment. */
     pins?: {
         issuerKeys: ReadonlyArray<{
@@ -24,13 +27,13 @@ export interface ManagedMlsDeviceOptions {
 }
 export type ManagedMlsDevice = RunnerMlsOptions & {
     provision(context: MlsDevDeviceContext): Promise<void>;
-    /** Whether this context's vault exists: its device was provisioned here. */
+    /** Whether this context's device was provisioned here. Throws, saying why, if it was made in the way this host cannot open. */
     provisioned(context: MlsDevDeviceContext): boolean;
     close(): Promise<void>;
 };
 /**
- * A runner's device where it is given none (`createRunner` and the CLI alike): managed custody with this package's helper
- * for the host, or undefined where it ships none or the environment has no MLS.
+ * A runner's device where it is given none (`createRunner` and the CLI alike): managed custody as `custodyFor` chooses, or
+ * undefined where this package ships neither helper nor core, or the environment has no MLS.
  */
 export declare function defaultMlsDevice(home: string, environmentId: string): ManagedMlsDevice | undefined;
 export declare function managedMlsDevice(options: ManagedMlsDeviceOptions): ManagedMlsDevice;

package/dist/runner/mls.d.ts

@@ -27,12 +27,12 @@ export declare function mlsAudiencePrincipals(value: MlsDevCurrentAudience): str
  */
 export declare function mlsAudienceEpoch(value: MlsDevCurrentAudience): string;
 /** What an encrypted room's text message is to the runner; Canon never learns it (`MlsIds.text`). */
-export type MlsTextKind = 'final' | 'failed' | 'restart' | 'said' | 'item';
+export type MlsTextKind = 'final' | 'failed' | 'restart' | 'said' | 'item' | 'part';
 /**
  * §6 ids. Canon sees the message id of everything the runner sends to an encrypted room, and a card's request id (its
  * public binding), so these are keyed with a secret only this installation holds (`privateKey`): HMAC-SHA256 over
  * domain-separated inputs, cut to 128 bits. Canon can test no guess of the text, question or turn an id names, and every
- * text message (a final, a failure or restart notice, a `communicate` send, an item) has the same shape, `msg-<32 hex>`, so none
+ * text message (a final, a part of one, a failure or restart notice, a `communicate` send, an item) has the same shape, `msg-<32 hex>`, so none
  * says what kind it is. The same inputs give the same id after a restart, so journal replay, a repeated `communicate`,
  * a re-asked card and a restart notice keep theirs.
  */
@@ -46,14 +46,11 @@ export interface MlsIds {
 export declare const MLS_ID_KEY_BYTES = 32;
 export declare function createMlsIds(key: Uint8Array): MlsIds;
 /**
- * Encrypted rooms are for agents whose outbound communication is not closed, in an environment with an MLS profile. Canon
- * decides who joins a room under the invitation policies, as for plaintext rooms, and whether that environment runs MLS.
+ * Encrypted rooms are for an environment with an MLS profile. Canon decides who joins a room under the invitation policies,
+ * as for plaintext rooms, and a closed agent's text needs authority for each reply (`replyGrant` in runner.ts).
  */
 export declare function requireMlsSupport(input: {
     environmentId: string;
-    agent: {
-        outboundPolicy: string;
-    };
 }): void;
 /**
  * Whether `text` @mentions any of `names` (an agent's display name, id or aliases). Encrypted text carries no `mentions[]`,

package/dist/runner/runner.d.ts

@@ -33,11 +33,9 @@ export interface RunnerOptions {
      */
     mls?: RunnerMlsOptions | false;
     /**
-     * Relay mode, the class-C relay (spec §11.4): only encrypted rooms are served, which is what lets a `remote` driver
-     * (the connector) into them. Plaintext input is cancelled with no turn (the connector's own installation serves it),
-     * control hints are read only for encrypted rooms, and `relayRead` and `relaySend` serve the relay channel. It publishes
-     * the runtime descriptor and heartbeat, so the apps show a relayed turn working and offer Stop. It needs the agent's MLS
-     * device.
+     * Relay mode, the class-C relay (spec §11.4): what lets a `remote` driver (the connector) into encrypted rooms, and
+     * `relayRead`, `relaySend` and `relayStart` serve the relay channel. It publishes the runtime descriptor and heartbeat,
+     * so the apps show a relayed turn working and offer Stop. It needs the agent's MLS device.
      */
     relay?: boolean;
     /** The engine's installation: the relay's reserved one, from its configuration. A store opened under another refuses to start. */
@@ -45,18 +43,17 @@ export interface RunnerOptions {
     /**
      * Team rooms: agents the owner trusts. A message from one of them counts as the owner's for tool permissions (the
      * drivers' guards read `TurnInputMessage.trustedAgent`) only in a room that holds no one but this agent, its owner and
-     * listed agents, all of which Canon confirms at the start of the turn are active agents of this agent's own owner; in
-     * a plaintext room only for a final its runner marked as answering the owner or confirmed teammates alone, and in an
-     * encrypted room never with a relay device in the group. A `remote` runtime has no tools on this host: a relay ignores it.
+     * listed agents, all of which Canon confirms at the start of the turn are active agents of this agent's own owner, and
+     * never with a relay device in the group. A `remote` runtime has no tools on this host: a relay ignores it.
      */
     trustedAgents?: string[];
     /**
-     * Encrypted rooms (§6): how many messages from other agents that @mention this agent a room may wake it with before a
-     * person's message is admitted there again (default 6; 0 never wakes on an agent). Past the cap they are settled with
-     * no turn, logged once. Plaintext rooms are Canon's to dispatch (RUN-29).
+     * How many messages from other agents that @mention this agent a room may wake it with before a person writes there
+     * again (default 6; 0 never wakes on an agent). Past the cap they are settled with no turn, logged once. The room's own
+     * rules can stop them sooner (`RoomRules`).
      */
     agentTurnCap?: number;
-    /** Encrypted rooms: names besides the agent's display name and id that @mention it, such as a role (`@engineer`). */
+    /** Names besides the agent's display name and id that @mention it, such as a role (`@engineer`). */
     mentionAliases?: string[];
     /** How long an aborted turn may take to settle before its session is reset (default 10 s). */
     abortGraceMs?: number;

package/dist/runner/types.d.ts

@@ -5,7 +5,7 @@ import type { MediaAttachment } from '../internal/core/index.js';
  * the claude and codex drivers pass the conformance suite.
  */
 export interface RuntimeDriver {
-    readonly name: 'code' | 'claude' | 'codex' | 'connector';
+    readonly name: 'code' | 'claude' | 'codex' | 'acp' | 'connector';
     /** Input to the generated runtime descriptor; never a static table. */
     readonly capabilities: DriverCapabilities;
     runTurn(turn: DriverTurn): Promise<DriverResult>;
@@ -71,6 +71,11 @@ export interface DriverCapabilities {
      * picked up.
      */
     remote?: boolean;
+    /**
+     * The runtime takes only its owner's messages, so the recent history a `none` session carries holds only those and the
+     * agent's own. Otherwise a message refused at the door would reach the runtime in the owner's next turn, with the owner's tools.
+     */
+    ownerHistoryOnly?: boolean;
     /** Across rooms; runner default 8. */
     maxConcurrentTurns?: number;
 }
@@ -196,6 +201,37 @@ export interface TurnInput {
     readonly errand?: ErrandFacts;
     /** Open errands that brought the agent into this conversation (§12.6), also at the head of `prompt`. */
     readonly errands?: ReadonlyArray<ErrandFacts>;
+    /** An encrypted room's turn: the room as Canon's records give it, also at the head of `prompt`. A relay's turn has none. */
+    readonly roomFacts?: RoomFacts;
+}
+/** What a turn knows about its encrypted room. Names, name and topic are what people typed: data, never instructions. */
+export interface RoomFacts {
+    readonly name?: string;
+    readonly topic?: string;
+    readonly owner: {
+        readonly id: string;
+        readonly name?: string;
+    };
+    readonly members: ReadonlyArray<{
+        readonly id: string;
+        readonly name?: string;
+        readonly type: 'human' | 'ai_agent';
+        readonly isOwner: boolean;
+        readonly isYou: boolean;
+    }>;
+    /** Absent only when this Canon does not send them yet. */
+    readonly rules?: RoomRules;
+}
+/**
+ * How the agent takes part in this room, resolved from its owner's defaults and the room's settings. Any admin of the room
+ * can set them, so they are never the owner's orders. The runner enforces all but `style`, which it tells the agent.
+ */
+export interface RoomRules {
+    readonly style: 'natural' | 'collaborative' | 'mention-first' | 'approval-gated' | 'handoff-only' | 'observer';
+    readonly requireMentionForGroupReplies: boolean;
+    readonly allowAgentToAgent: boolean;
+    readonly allowLongRunningCollaboration: boolean;
+    readonly maxConsecutiveAgentTurns: number | null;
 }
 /** An errand as a turn sees it: why the owner sent the agent, what to do, the recipient and the origin conversation. */
 export interface ErrandFacts {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/agent-sdk",
-  "version": "12.5.1",
+  "version": "13.0.2",
   "description": "Canon Agent SDK — build AI agents that participate in Canon conversations",
   "type": "module",
   "main": "dist/index.js",

package/dist/internal/core/approval-manager.d.ts

@@ -1,43 +0,0 @@
-import type { CanonClient } from './client.js';
-import type { CanonUnifiedDiff } from './types.js';
-import type { ApprovalConfig, ApprovalNativeRequestMetadata, ApprovalResult, ApprovalRequestCategory, ApprovalRequestDetail, ApprovalRisk } from './approval-types.js';
-import { RuntimeRequestManager, type RuntimeRequestOptions } from './runtime-request-manager.js';
-interface ApprovalRequestOpts {
-    riskLevel?: 'normal' | 'destructive';
-    risk?: ApprovalRisk;
-    category?: ApprovalRequestCategory;
-    runtimeId?: string;
-    turnId?: string;
-    native?: ApprovalNativeRequestMetadata;
-    toolSummary?: string;
-    details?: ApprovalRequestDetail[];
-    /** File-change preview rendered inline on the approval card (size-disciplined automatically). */
-    diff?: CanonUnifiedDiff;
-    ignoreSessionRules?: boolean;
-    allowSessionRule?: boolean;
-    /** Human conversation member who triggered this turn and should answer. */
-    responseUserId?: string;
-}
-/**
- * Platform-agnostic approval protocol for Canon.
- *
- * Now a thin `RuntimeRequestManager` subclass: the pending map, deadline timers,
- * the hybrid poll-plus-push loop, and cancellation live in the generalized
- * engine; approval-specific behaviour (session-rule fast path, redacted request
- * metadata, owner-authored outcome messages, and session-rule storage) is
- * expressed as a single `KindDescriptor`. Behaviour is preserved verbatim.
- */
-export declare class ApprovalManager extends RuntimeRequestManager {
-    private config;
-    constructor(client: CanonClient, agentId: string, ownerId: string, config?: Partial<ApprovalConfig>);
-    /**
-     * Request approval for a tool call.
-     *
-     * 1. Checks session rules — may resolve immediately.
-     * 2. Sends a message with approval card metadata.
-     * 3. Waits for the owner's reply (or timeout).
-     */
-    requestApproval(conversationId: string, toolName: string, toolInput: Record<string, unknown>, opts?: ApprovalRequestOpts, runtimeOptions?: RuntimeRequestOptions): Promise<ApprovalResult>;
-    private buildApprovalDescriptor;
-}
-export {};