@cognipeer/agent-sdk 0.10.5 → 0.10.6

package/dist/index.d.cts

@@ -210,6 +210,37 @@ type MediaAttachment = {
     approxBytes?: number;
     fileName?: string;
 };
+type MediaKind$1 = "image" | "audio" | "video" | "file";
+/**
+ * What kind of attachment a content part is, or undefined for text and for
+ * anything that is not a media part.
+ *
+ * Covers the unified shape (`image`/`audio`/`file` with a `source`), the
+ * OpenAI shapes (`image_url`, `input_audio`, `file`, `input_image`, `input_file`)
+ * and Gemini's untyped `inlineData` / `fileData`.
+ */
+declare function mediaKindOf(part: unknown): MediaKind$1 | undefined;
+/** True when the content is an array holding at least one media part. */
+declare function hasMediaPart(content: unknown): boolean;
+/**
+ * A short, human-readable stand-in for a media part: `[image: photo.png]`,
+ * `[image: image/png]`, `[audio]`. Undefined for text and non-media parts.
+ *
+ * This is what anything that flattens content to TEXT must use for an
+ * attachment — token estimation, the summarizer's input, trace display. The
+ * alternative, `JSON.stringify(part)`, writes the whole base64 payload into the
+ * text: an image of ~400 tokens counts as 18,000 and a summarizer reads (and is
+ * truncated into) a wall of base64 instead of knowing a picture was there.
+ *
+ * The label is the part's own `name`, else its file id, else its media type.
+ */
+declare function describeContentPart(part: unknown): string | undefined;
+/**
+ * One content part as plain text: strings and text parts as they are, media as
+ * its placeholder, anything else through `fallback` (default: its own `text` /
+ * `content`, else its JSON).
+ */
+declare function contentPartToText(part: unknown, fallback?: (part: unknown) => string): string;
 declare function contentToString(content: string | ContentPart$1[] | any): string;
 declare function extractMessageText(message: any): string;
 /**
@@ -1801,12 +1832,28 @@ type AgentRuntimeConfig = {
     smart?: ResolvedSmartAgentConfig;
     humanInTheLoop?: HumanInTheLoopRuntimeConfig;
 };
+/** One part of a message as it was sent: text, or an attachment (image, audio, file …). */
+type TraceMessagePart = {
+    type?: string;
+    text?: string;
+    [key: string]: any;
+};
 type TraceMessageSection = {
     id?: string;
     kind: "message";
     label: string;
     role: string;
+    /**
+     * The message as text. An attachment appears in it as a short placeholder
+     * (`[image: photo.png]`), never as its encoded payload.
+     */
     content: string;
+    /**
+     * The message's structured parts, present only when it carries a non-text part
+     * (an image, audio, a file). Lets a host render the attachment — a thumbnail —
+     * where `content` can only name it. Text parts are included, in order.
+     */
+    parts?: TraceMessagePart[];
     metadata?: Record<string, any>;
 };
 type TraceToolCallSection = {
@@ -3255,725 +3302,847 @@ type CreateGuardrailOptions = {
 };
 declare function createGuardrail(options: CreateGuardrailOptions): ConversationGuardrail;
 
-type RegexRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    pattern: RegExp | string;
-    flags?: string;
-    matchDisposition?: GuardrailDisposition;
-    selector?: (context: GuardrailContext) => string;
-    allowIfMatch?: boolean;
-    failureMessage?: string;
+type MessageRole = "system" | "user" | "assistant" | "tool";
+type TextContent = {
+    type: "text";
+    text: string;
 };
-declare function regexRule(options: RegexRuleOptions): GuardrailRule;
-type JsonSchemaRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    schema: JSONSchema7 | z.ZodTypeAny;
-    selector?: (context: GuardrailContext) => string;
-    disposition?: GuardrailDisposition;
-    allowOnParseError?: boolean;
+type ImageContent = {
+    type: "image";
+    source: {
+        type: "base64";
+        mediaType: string;
+        data: string;
+    } | {
+        type: "url";
+        url: string;
+        mediaType?: string;
+    };
 };
-declare function jsonSchemaRule(options: JsonSchemaRuleOptions): GuardrailRule;
-type CodeDetectionRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    selector?: (context: GuardrailContext) => string;
-    disposition?: GuardrailDisposition;
-    allowList?: Array<RegExp | string>;
+/**
+ * A document attachment (PDF, DOCX, CSV, …). Providers map this to their
+ * native document blocks: Gemini `inlineData`/`fileData`, Anthropic
+ * `document`, OpenAI Chat Completions `file` / Responses `input_file`,
+ * Bedrock Converse `document`. Providers without document support degrade
+ * to a text placeholder referencing the file name/URL.
+ */
+type FileContent = {
+    type: "file";
+    source: {
+        type: "base64";
+        mediaType: string;
+        data: string;
+    } | {
+        type: "url";
+        url: string;
+        mediaType?: string;
+    };
+    /** Original file name, when known (required by some providers, e.g. Bedrock). */
+    fileName?: string;
 };
-declare function codePresenceRule(options?: CodeDetectionRuleOptions): GuardrailRule;
-declare const guardianSchema: z.ZodObject<{
-    allow: z.ZodBoolean;
-    disposition: z.ZodOptional<z.ZodEnum<["allow", "warn", "block"]>>;
-    reason: z.ZodOptional<z.ZodString>;
-    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-}, "strip", z.ZodTypeAny, {
-    allow: boolean;
-    reason?: string | undefined;
-    disposition?: "allow" | "block" | "warn" | undefined;
-    details?: Record<string, any> | undefined;
-}, {
-    allow: boolean;
-    reason?: string | undefined;
-    disposition?: "allow" | "block" | "warn" | undefined;
-    details?: Record<string, any> | undefined;
-}>;
-type AgentRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    agent: SmartAgentInstance<z.infer<typeof guardianSchema>>;
-    systemPrompt?: string;
-    payloadBuilder?: (context: GuardrailContext) => string;
-    dispositionFallback?: GuardrailDisposition;
+/**
+ * An audio attachment. Gemini accepts it as `inlineData`/`fileData`; OpenAI
+ * audio-capable models as `input_audio`. Providers without audio support
+ * degrade to a text placeholder.
+ */
+type AudioContent = {
+    type: "audio";
+    source: {
+        type: "base64";
+        mediaType: string;
+        data: string;
+    } | {
+        type: "url";
+        url: string;
+        mediaType?: string;
+    };
 };
-declare function agentVerdictRule(options: AgentRuleOptions): GuardrailRule;
-type CustomRuleCallback = (context: GuardrailContext) => boolean | {
-    allow: boolean;
-    reason?: string;
-    disposition?: GuardrailDisposition;
-    details?: Record<string, any>;
-} | Promise<boolean | {
-    allow: boolean;
-    reason?: string;
-    disposition?: GuardrailDisposition;
-    details?: Record<string, any>;
-}>;
-type CustomRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    callback: CustomRuleCallback;
-    defaultDisposition?: GuardrailDisposition;
+type ContentPart = TextContent | ImageContent | FileContent | AudioContent;
+type ToolCall = {
+    id: string;
+    name: string;
+    arguments: string;
 };
-declare function customCallbackRule(options: CustomRuleOptions): GuardrailRule;
-
-type GuardrailPresetBase = {
-    guardrailId?: string;
-    guardrailTitle?: string;
-    guardrailDescription?: string;
-    phases?: GuardrailPhase[];
-    haltOnViolation?: boolean;
-    onViolation?: ConversationGuardrail["onViolation"];
-    metadata?: Record<string, any>;
+/**
+ * A provider-native reasoning/thinking block. Captured from the model response
+ * and replayed verbatim on subsequent turns (required by Anthropic extended
+ * thinking when tools are involved — the `signature` must round-trip intact).
+ */
+type ReasoningBlock = {
+    type: "thinking" | "redacted_thinking";
+    /** Plain-text thinking content (absent for redacted blocks). */
+    text?: string;
+    /** Cryptographic signature Anthropic requires to be echoed back verbatim. */
+    signature?: string;
+    /** Opaque payload for redacted_thinking blocks. */
+    data?: string;
 };
-type RegexGuardrailOptions = GuardrailPresetBase & {
-    rule?: Omit<RegexRuleOptions, "pattern">;
+/** Captured reasoning payload attached to assistant turns / responses. */
+type ReasoningPayload = {
+    /** Verbatim provider blocks to replay on the next turn. */
+    blocks?: ReasoningBlock[];
+    /** Human-readable reasoning summary, when the provider exposes one. */
+    summary?: string;
 };
-declare function createRegexGuardrail(pattern: RegExp | string, options?: RegexGuardrailOptions): ConversationGuardrail;
-type JsonGuardrailOptions = GuardrailPresetBase & {
-    rule?: Omit<JsonSchemaRuleOptions, "schema">;
+type UnifiedMessage = {
+    role: MessageRole;
+    content: string | ContentPart[];
+    name?: string;
+    toolCalls?: ToolCall[];
+    toolCallId?: string;
+    /** Native reasoning blocks to replay verbatim (Anthropic/Bedrock thinking). */
+    reasoning?: ReasoningPayload;
 };
-declare function createJsonGuardrail(schema: JsonSchemaRuleOptions["schema"], options?: JsonGuardrailOptions): ConversationGuardrail;
-type CodeGuardrailOptions = GuardrailPresetBase & {
-    rule?: CodeDetectionRuleOptions;
+type ToolDefinition = {
+    name: string;
+    description: string;
+    parameters: Record<string, any>;
+    strict?: boolean;
 };
-declare function createCodeGuardrail(options?: CodeGuardrailOptions): ConversationGuardrail;
-
-/**
- * Wrap a plugin factory so config flows through with full inference:
- *
- *   const myGuard = definePlugin<{ level: number }>((cfg) => ({ name: "my-guard", ... }));
- *   myGuard({ level: 2 })
- *
- * The indirection buys nothing at runtime — it exists so the config type is
- * inferred at the call site and the returned object is checked against
- * `AgentPlugin` at the definition site, where the error message is useful.
- */
-declare function definePlugin<TConfig = void>(factory: (config: TConfig) => AgentPlugin): (config: TConfig) => AgentPlugin;
-/**
- * A single hook, packaged as a plugin. For the common case where naming and a
- * lifecycle would be ceremony:
- *
- *   defineHook("preToolUse", ({ toolName }) => toolName === "shell" ? { decision: "ask" } : undefined)
- */
-declare function defineHook<K extends HookName>(hook: K, handler: HookHandler<K>, opts?: {
-    name?: string;
-    priority?: number;
-    failureMode?: PluginFailureMode;
-    timeoutMs?: number;
-    inheritToSubagents?: boolean;
+type ChatCompletionRequest = {
+    model: string;
+    messages: UnifiedMessage[];
+    temperature?: number;
+    maxTokens?: number;
+    topP?: number;
+    stop?: string[];
+    tools?: ToolDefinition[];
+    toolChoice?: "auto" | "required" | "none" | {
+        name: string;
+    };
+    responseFormat?: {
+        type: "json_schema" | "json_object" | "text";
+        schema?: Record<string, any>;
+        name?: string;
+    };
+    stream?: boolean;
+    extra?: Record<string, any>;
     /**
-     * Declare that this hook never returns `decision: "ask"`. Without it a
-     * `preToolUse` hook is assumed to be able to pause, and the whole tool
-     * batch is scheduled serially — silently costing an agent its parallel
-     * tool execution.
+     * Unified native-reasoning request config. Each provider maps this to its
+     * own shape:
+     *  - OpenAI o-series:   body.reasoning_effort = effort
+     *  - OpenAI Responses:  body.reasoning = { effort }
+     *  - Anthropic:         body.thinking  = { type: "enabled", budget_tokens }
+     *  - Google / Vertex:   body.generationConfig.thinkingConfig = { thinkingBudget, includeThoughts }
+     *
+     * Providers silently ignore unsupported fields.
      */
-    mayRequireApproval?: boolean;
-}): AgentPlugin;
-
+    reasoning?: ReasoningRequestConfig;
+    /**
+     * Cancels the HTTP request (and an in-flight stream) when it aborts. The agent
+     * loop sets it from the run's cancellation token / abort signal; a caller using
+     * a provider directly can pass its own. It is never serialised into the body.
+     */
+    signal?: AbortSignal;
+};
 /**
- * What this build actually implements.
- *
- * A policy configured as `mode: "enforce"` whose hook is never called is worse
- * than no policy: the console shows a control that does not exist. A host
- * cannot infer that from the type surface, because a declared hook and a wired
- * one look identical to TypeScript — so the runtime states it.
+ * `none` is OFF, and it is a value rather than the absence of one.
  *
- * This table is maintained BY HAND alongside the wiring. That is deliberate:
- * deriving it from the registry would only prove that a handler was registered,
- * not that any call site raises it, which is precisely the failure it exists to
- * make visible.
- */
-
-/**
- * Bumped when the hook contract changes shape in a way a host must notice —
- * a hook gains or loses a call site, a payload field changes meaning, a slot
- * starts or stops being consumed. Independent of the package version.
+ * On a thinking-by-default model — every Qwen3 under vLLM, gpt-5.1 and newer on
+ * OpenAI — sending no reasoning field leaves the model thinking. So "do not
+ * think" is an instruction that has to travel: `reasoning_effort:"none"` on
+ * OpenAI, `thinkingBudget:0` on Gemini, and no thinking block at all on
+ * Anthropic (where thinking is opt-in and the absence IS off). Omitting
+ * `effort` still means "say nothing about reasoning", which is the different
+ * and equally necessary state.
  */
-declare const HOOK_CONTRACT_VERSION = 1;
-type CapabilityStatus = {
-    /** True when a call site in the runtime actually raises this. */
-    implemented: boolean;
-    /** Why not, or what the caveat is. */
-    notes?: string;
-};
-type SdkCapabilities = {
-    hookContractVersion: number;
-    hooks: Record<HookName, CapabilityStatus>;
-    slots: Record<SlotName, CapabilityStatus>;
-    features: Record<string, CapabilityStatus>;
+type ReasoningEffort = "none" | "minimal" | "low" | "medium" | "high";
+type ReasoningRequestConfig = {
+    /** Qualitative effort hint (mapped per-provider). */
+    effort?: ReasoningEffort;
+    /** Explicit per-call token budget for reasoning/thinking. */
+    budgetTokens?: number;
+    /** Whether the provider should expose its reasoning/thought summary to the caller. Default false. */
+    includeThoughts?: boolean;
+    /** Provider-specific passthrough merged on top of the mapped shape. */
+    providerExtras?: Record<string, any>;
 };
-/**
- * Hook ids used by the Cognipeer Console's guardrail plane, mapped onto this
- * SDK's hooks.
- *
- * The Console plane originally had one input stage, which collapsed two
- * moments that behave differently: `userPromptSubmit` fires ONCE for a new
- * user turn and can see attachments, while `preModelCall` fires before EVERY
- * provider call — which is where the legacy `GuardrailPhase.Request` actually
- * ran. A policy meant to vet what a person typed wants the first; one meant to
- * vet every prompt reaching the model, including turns built from tool output,
- * wants the second. Mapping both to one id silently changes how often the
- * policy runs, and on a moderation-model guardrail that is a cost as well as a
- * semantics bug.
- *
- * The Console added `prompt.pre` for the first and kept `input.pre` meaning
- * the second, so every id below is single-valued.
- */
-declare const CONSOLE_HOOK_MAP: Readonly<Record<string, HookName | null>>;
-/** What this build implements. Safe to call at any time; allocates a fresh copy. */
-declare function pluginCapabilities(): SdkCapabilities;
-/** Convenience for a host that only wants to know whether it can enforce. */
-declare function isHookImplemented(hook: HookName): boolean;
-
-/**
- * Guardrail transport + the plugin that drives it.
- *
- * Layered the way tracing sinks are layered — a transport seam, a generic HTTP
- * implementation, an in-process escape hatch, and thin first-party presets on
- * top (see `cognipeerGuardrail`, `portkeyGuardrail`). What is deliberately NOT
- * copied from tracing is its retry policy: a trace post can afford four
- * attempts at an 8s timeout because nothing waits on it, while a guardrail sits
- * on the critical path of every turn and the same policy would stall an agent
- * for half a minute.
- */
-
-/**
- * `tool` is the ARGUMENTS a model wants to run; `tool_result` is what came
- * back. They are different surfaces with different risks — one is an action
- * about to happen, the other is untrusted content entering the context — and a
- * policy usually wants different rules for each.
- */
-type GuardrailPhaseName = "input" | "output" | "tool" | "tool_result";
-type GuardrailRequest = {
-    phase: GuardrailPhaseName;
-    content: string;
-    /** Tool name for `tool` / `tool_result`, otherwise unset. */
-    subject?: string;
-    /** The SDK hook this check was raised from, so a preset can map it exactly. */
-    hook?: string;
-    /** Structured tool arguments, for a service that wants them un-stringified. */
-    toolArgs?: unknown;
-    /** The tool's return value, for `tool_result`. */
-    toolResult?: unknown;
-    /**
-     * Non-text parts of the turn — images, audio, video, files. A text-only
-     * policy sees the caption and nothing else, so a service that moderates
-     * media needs these; one that does not simply ignores the field.
-     *
-     * Inline payloads are DESCRIBED (kind, media type, size) rather than
-     * inlined: shipping a base64 image on every check would multiply the cost of
-     * the guardrail by the size of the upload. A service that needs the bytes
-     * should take a URL, or the caller should override `buildRequest`.
-     */
-    attachments?: MediaAttachment[];
-    metadata?: Record<string, unknown>;
+type TokenUsage = {
+    inputTokens: number;
+    outputTokens: number;
+    totalTokens: number;
+    cachedInputTokens: number;
+    cachedWriteTokens: number;
+    cachedOutputTokens: number;
+    reasoningTokens: number;
 };
-type GuardrailViolation = {
-    id?: string;
-    type?: string;
-    severity?: string;
-    detail?: string;
+declare function emptyUsage(): TokenUsage;
+type FinishReason = "stop" | "tool_calls" | "length" | "content_filter" | "error";
+type ChatCompletionResponse = {
+    id: string;
+    model: string;
+    content: string | null;
+    toolCalls: ToolCall[];
+    usage: TokenUsage;
+    finishReason: FinishReason;
+    /** Native reasoning blocks + summary captured from the response, if any. */
+    reasoning?: ReasoningPayload;
+    raw: any;
 };
-type GuardrailVerdict = {
-    action: "allow" | "block" | "mask";
-    message?: string;
-    /** Required when `action === "mask"`. */
-    maskedContent?: string;
-    violations?: GuardrailViolation[];
-    /** The untouched service response, for tracing and debugging. */
-    raw?: unknown;
+type ChatCompletionChunk = {
+    id: string;
+    model: string;
+    delta: {
+        content?: string;
+        toolCalls?: Partial<ToolCall>[];
+        /** Incremental reasoning text / signature deltas (Anthropic thinking). */
+        reasoning?: ReasoningPayload;
+    };
+    usage?: TokenUsage;
+    finishReason?: FinishReason;
 };
-type GuardrailCallContext = {
-    runId: string;
-    agentName?: string;
-    /** Correlates a guardrail decision with the trace session in the console UI. */
-    traceId?: string;
-    signal?: AbortSignal;
+type ProviderRetryConfig = {
+    /** Maximum retries on 429/5xx (default 3). */
+    maxRetries?: number;
+    /** Initial delay between retries in ms (default 500, doubled each attempt). */
+    baseDelayMs?: number;
+    /** Hard cap on a single retry delay in ms (default 8000). */
+    maxDelayMs?: number;
+    /** Custom predicate to opt in/out of a specific retry. */
+    shouldRetry?: (error: any, attempt: number) => boolean;
 };
-type GuardrailTransport = {
-    name: string;
-    /** Verdicts must come back in the same order as `requests`. */
-    evaluate(requests: GuardrailRequest[], ctx: GuardrailCallContext): MaybePromise<GuardrailVerdict[]>;
+type OpenAIProviderConfig = {
+    provider: "openai";
+    apiKey: string;
+    baseURL?: string;
+    organization?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    retry?: ProviderRetryConfig;
     /**
-     * Optional setup-time handshake. When a service can say which phases carry
-     * active rules, every other phase skips the network entirely — usually the
-     * single biggest latency win available here.
+     * WHICH API a reasoning-carrying request is addressed to.
+     *
+     *  auto    (default, and today's behaviour) route to the Responses API when
+     *          the request carries `reasoning` AND the model name looks like an
+     *          o-series/gpt-5 reasoning model.
+     *  never   always Chat Completions. `reasoning` is still mapped, as
+     *          `reasoning_effort` plus any `providerExtras`.
+     *  always  always Responses, whatever the model is called.
+     *
+     * `auto` is a name-based guess, and it decides far more than where reasoning
+     * goes: Responses is a different request shape (`input` not `messages`,
+     * `text.format` not `response_format`, flat tool objects) and a different
+     * response parse. A caller with its own measurements of the Chat Completions
+     * body — a gateway, a proxy, an on-prem server that serves one and not the
+     * other, or anything that has tuned `extra` — must be able to say so, rather
+     * than discover that asking for less thinking silently changed the transport.
+     *
+     * Applies to any OpenAI-shaped endpoint, which is also why the guess is weak
+     * where it matters most: a self-hosted model is named by whoever served it.
      */
-    describe?: () => MaybePromise<{
-        activePhases?: GuardrailPhaseName[];
-    } | null | undefined>;
-    close?: () => MaybePromise<void>;
-};
-type HttpGuardrailOptions = {
-    url: string;
-    /** Static headers, or a thunk so a rotating token is read per call. */
-    headers?: Record<string, string> | (() => Record<string, string>);
-    /** Hard ceiling per attempt. Default 3000ms — this is on the critical path. */
-    timeoutMs?: number;
-    /** Retries after the first attempt. Default 1. */
-    retries?: number;
-    /** Send all pending checks in one request. Default true. */
-    batch?: boolean;
-    /** Override the wire request. Default: `{ items, runId, traceId }`. */
-    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
-    /** Override response mapping. Default: `normalizeVerdicts`, which is forgiving. */
-    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
+    responsesApi?: "auto" | "never" | "always";
     /**
-     * Status codes that carry a VERDICT rather than an error. Some services
-     * signal the outcome in the status line (e.g. 446 for a block); treating
-     * those as transport failures would route a real decision through the
-     * failureMode path with the wrong reason attached.
+     * Models that go to the Responses API, named explicitly. Opt-in; unset by
+     * default, and nothing here is inferred from a model name.
+     *
+     * A string matches the request's model (or `defaultModel`) exactly; a RegExp
+     * is tested against it. A match routes the request to Responses whether or
+     * not it carries `reasoning` — the case this exists for is a model that
+     * reasons by default and rejects function tools on Chat Completions, where
+     * sending no reasoning field does not help. `responsesApi: "never"` still
+     * wins; under `"always"` the routing is unchanged.
+     *
+     * Requests for a matched model also get, on the Responses body only:
+     *  - Chat Completions spellings arriving through `extra`, which /responses
+     *    rejects with a 400, re-spelled with their values unchanged:
+     *    `reasoning_effort` → `reasoning.effort` (a request `reasoning` effort
+     *    still wins), `max_tokens` / `max_completion_tokens` →
+     *    `max_output_tokens`, `response_format` → `text.format`, and
+     *    `stream_options.include_usage` dropped.
+     *  - real SSE streaming, when `responsesStreaming` is also true.
+     *
+     * Honoured by `OpenAIProvider` itself only; `AzureProvider` and
+     * `OpenAICompatibleProvider` ignore it.
      */
-    verdictStatuses?: number[];
-    /** Optional GET endpoint for the setup-time handshake. */
-    describeUrl?: string;
-    name?: string;
-};
-/**
- * Accepts the shapes a guardrail service is likely to return and normalizes
- * them. Being forgiving here is the point: the exact contract can change on the
- * service side without a client release, and a stricter parser would turn a
- * cosmetic field rename into an outage.
- */
-declare function normalizeVerdicts(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
-declare function httpGuardrail(options: HttpGuardrailOptions): GuardrailTransport;
-/** In-process evaluation — regex policies, a local model, Presidio, tests. */
-declare function customGuardrail(evaluate: (request: GuardrailRequest, ctx: GuardrailCallContext) => MaybePromise<GuardrailVerdict | void>, name?: string): GuardrailTransport;
-type GuardrailPluginOptions = {
-    name: string;
-    transport: GuardrailTransport;
-    /** Which surfaces to check. Default: input + output. */
-    apply?: GuardrailPhaseName[];
+    responsesApiModels?: Array<string | RegExp>;
     /**
-     * `shadow` evaluates and reports but never blocks or masks. This is how a
-     * policy gets rolled out safely: measure what it would have caught first.
+     * Stream Responses API output as it arrives (text and tool-call argument
+     * deltas) for models in `responsesApiModels`. Default false, which keeps the
+     * existing behaviour: one non-streaming Responses call, emitted as a single
+     * chunk. Has no effect on any other request.
      */
-    mode?: "enforce" | "shadow";
-    /** Block when the service is unreachable. Default true. */
-    failClosed?: boolean;
-    timeoutMs?: number;
-    priority?: number;
-    inheritToSubagents?: boolean;
-    /** Memoize verdicts per run. Default true. */
-    cache?: boolean | {
-        maxEntries?: number;
-    };
-    /** Extra metadata attached to every request. */
-    metadata?: Record<string, unknown>;
+    responsesStreaming?: boolean;
 };
-declare function createGuardrailPlugin(options: GuardrailPluginOptions): AgentPlugin;
-
-/**
- * Cognipeer Console guardrail — the first-party preset.
- *
- * Talks to the Console's HOOK plane, not its single-shot evaluator:
- *
- *   POST {baseUrl}/api/client/v1/guardrails/hooks/evaluate
- *   Authorization: Bearer <api key>
- *   { hook, guardrail_keys, text?, tool_name?, tool_args?, tool_result?, … }
- *
- * Three properties of that contract shape everything below, and getting any of
- * them wrong turns a working policy into a silent one:
- *
- *   `decision`  is the EFFECTIVE verdict, already neutralised in monitor mode.
- *               Priority runs block > redact > warn > flag > allow.
- *   `enforced`  false means the decision was NOT applied — a dry run. Blocking
- *               on `decision === "block"` without checking this turns every
- *               monitoring policy into an enforcing one on the day it is
- *               switched on for observation.
- *   `passed`    means "no blocking finding", NOT "the request was allowed".
- *               The two diverge in monitor mode, which is exactly when someone
- *               reads the wrong one.
- *
- * `subject` (or `redacted_text` for the text case) is filled only when the
- * service actually rewrote something; when it is present it REPLACES what was
- * sent rather than being merged with it.
- *
- * The endpoint answers 200 for a finding as readily as for a clean check, and
- * only emits 246/446 when a guardrail opts into verdict status codes — so both
- * are declared as verdict-carrying rather than treated as transport failures.
- * An unknown key answers 404 ON PURPOSE: a vacuous allow read as "content is
- * safe" is the failure the whole plane exists to avoid.
- */
-
-type CognipeerGuardrailConfig = {
-    /** Guardrail keys from the Console. Defaults to `COGNIPEER_GUARDRAIL_KEYS` (comma-separated). */
-    guardrailKeys?: string[];
-    /** Convenience for the single-key case. */
-    guardrailKey?: string;
-    /** Defaults to `COGNIPEER_API_KEY`. */
-    apiKey?: string;
-    /** Defaults to `COGNIPEER_BASE_URL`, then the production console. Point at localhost for local runs. */
-    baseUrl?: string;
-    /** Override the hook-evaluate path. */
-    path?: string;
-    /** Surfaces to guard. Default: input + output. Add `"tool"` / `"tool_result"` for the tool surface. */
-    apply?: GuardrailPhaseName[];
-    /** Restrict to specific check families, e.g. `["pii"]`. */
-    only?: string[];
-    /** Override the SDK-hook → Console-hook-id mapping, merged over the default. */
-    hookIds?: Record<string, string>;
-    /** Ask the service to evaluate without enforcing. Independent of `mode`. */
-    shadow?: boolean;
-    /** `shadow` here reports locally without acting, whatever the service says. */
-    mode?: "enforce" | "shadow";
-    /** Default true — an unreachable or misconfigured policy blocks rather than silently stops guarding. */
-    failClosed?: boolean;
-    /** Per-check ceiling. Default 3000ms; also sent as `budget_ms`. */
-    timeoutMs?: number;
-    retries?: number;
-    priority?: number;
-    cache?: boolean | {
-        maxEntries?: number;
+type AnthropicProviderConfig = {
+    provider: "anthropic";
+    apiKey: string;
+    baseURL?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    anthropicVersion?: string;
+    retry?: ProviderRetryConfig;
+    /**
+     * Prompt caching configuration. When enabled, places cache_control:
+     * ephemeral breakpoints on the system prompt and the final tool definition,
+     * which is the recommended Anthropic recipe for static system + tools.
+     */
+    prompt_caching?: {
+        enabled: boolean;
     };
-    metadata?: Record<string, unknown>;
-    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
-    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
-    name?: string;
 };
-/** The Console's hook response, mapped onto the transport's three-valued verdict. */
-declare function mapConsoleHookVerdict(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
-declare function cognipeerGuardrail(config?: CognipeerGuardrailConfig): AgentPlugin;
-
-type MessageRole = "system" | "user" | "assistant" | "tool";
-type TextContent = {
-    type: "text";
-    text: string;
+type AzureProviderConfig = {
+    provider: "azure";
+    apiKey: string;
+    endpoint: string;
+    apiVersion?: string;
+    deploymentName?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
 };
-type ImageContent = {
-    type: "image";
-    source: {
-        type: "base64";
-        mediaType: string;
-        data: string;
-    } | {
-        type: "url";
-        url: string;
-        mediaType?: string;
-    };
+type OpenAICompatibleProviderConfig = {
+    provider: "openai-compatible";
+    apiKey: string;
+    baseURL: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
 };
-/**
- * A document attachment (PDF, DOCX, CSV, …). Providers map this to their
- * native document blocks: Gemini `inlineData`/`fileData`, Anthropic
- * `document`, OpenAI Chat Completions `file` / Responses `input_file`,
- * Bedrock Converse `document`. Providers without document support degrade
- * to a text placeholder referencing the file name/URL.
- */
-type FileContent = {
-    type: "file";
-    source: {
-        type: "base64";
-        mediaType: string;
-        data: string;
-    } | {
-        type: "url";
-        url: string;
-        mediaType?: string;
+type BedrockProviderConfig = {
+    provider: "bedrock";
+    region: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    retry?: ProviderRetryConfig;
+    /**
+     * Insert Bedrock Converse `cachePoint` blocks at the end of the system
+     * prompt and tools list. Only supported by models that implement Converse
+     * prompt caching (most Anthropic Claude variants on Bedrock).
+     */
+    prompt_caching?: {
+        enabled: boolean;
     };
-    /** Original file name, when known (required by some providers, e.g. Bedrock). */
-    fileName?: string;
 };
-/**
- * An audio attachment. Gemini accepts it as `inlineData`/`fileData`; OpenAI
- * audio-capable models as `input_audio`. Providers without audio support
- * degrade to a text placeholder.
- */
-type AudioContent = {
-    type: "audio";
-    source: {
-        type: "base64";
-        mediaType: string;
-        data: string;
-    } | {
-        type: "url";
-        url: string;
-        mediaType?: string;
-    };
+type VertexProviderConfig = {
+    provider: "vertex";
+    projectId: string;
+    location?: string;
+    accessToken?: string;
+    serviceAccountJson?: string | Record<string, any>;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
 };
-type ContentPart = TextContent | ImageContent | FileContent | AudioContent;
-type ToolCall = {
-    id: string;
-    name: string;
-    arguments: string;
+type JevProviderConfig = {
+    provider: "jev";
+    apiKey: string;
+    /** Defaults to https://api.typesafe.ai. */
+    baseURL?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    retry?: ProviderRetryConfig;
 };
-/**
- * A provider-native reasoning/thinking block. Captured from the model response
- * and replayed verbatim on subsequent turns (required by Anthropic extended
- * thinking when tools are involved — the `signature` must round-trip intact).
- */
-type ReasoningBlock = {
-    type: "thinking" | "redacted_thinking";
-    /** Plain-text thinking content (absent for redacted blocks). */
-    text?: string;
-    /** Cryptographic signature Anthropic requires to be echoed back verbatim. */
-    signature?: string;
-    /** Opaque payload for redacted_thinking blocks. */
-    data?: string;
+type ProviderConfig = OpenAIProviderConfig | AnthropicProviderConfig | AzureProviderConfig | OpenAICompatibleProviderConfig | BedrockProviderConfig | VertexProviderConfig | JevProviderConfig;
+type ProviderType = ProviderConfig["provider"];
+declare class ProviderError extends Error {
+    readonly provider: string;
+    readonly statusCode?: number | undefined;
+    readonly responseBody?: any | undefined;
+    constructor(message: string, provider: string, statusCode?: number | undefined, responseBody?: any | undefined);
+}
+
+type ProviderRetryPolicy = {
+    /** Maximum number of retries on 429/5xx responses. Default: 3. */
+    maxRetries?: number;
+    /** Initial backoff in ms (doubled on each retry). Default: 500. */
+    baseDelayMs?: number;
+    /** Hard cap on individual delay between retries. Default: 8000. */
+    maxDelayMs?: number;
+    /**
+     * Custom predicate to decide whether to retry. By default we retry 429
+     * and 5xx responses; pass a function to broaden/narrow that set.
+     */
+    shouldRetry?: (error: any, attempt: number) => boolean;
 };
-/** Captured reasoning payload attached to assistant turns / responses. */
-type ReasoningPayload = {
-    /** Verbatim provider blocks to replay on the next turn. */
-    blocks?: ReasoningBlock[];
-    /** Human-readable reasoning summary, when the provider exposes one. */
-    summary?: string;
-};
-type UnifiedMessage = {
-    role: MessageRole;
-    content: string | ContentPart[];
-    name?: string;
-    toolCalls?: ToolCall[];
-    toolCallId?: string;
-    /** Native reasoning blocks to replay verbatim (Anthropic/Bedrock thinking). */
-    reasoning?: ReasoningPayload;
-};
-type ToolDefinition = {
-    name: string;
-    description: string;
-    parameters: Record<string, any>;
-    strict?: boolean;
-};
-type ChatCompletionRequest = {
-    model: string;
-    messages: UnifiedMessage[];
-    temperature?: number;
-    maxTokens?: number;
-    topP?: number;
-    stop?: string[];
-    tools?: ToolDefinition[];
-    toolChoice?: "auto" | "required" | "none" | {
-        name: string;
-    };
-    responseFormat?: {
-        type: "json_schema" | "json_object" | "text";
-        schema?: Record<string, any>;
-        name?: string;
-    };
-    stream?: boolean;
-    extra?: Record<string, any>;
+declare abstract class BaseProvider {
+    abstract readonly providerName: ProviderType;
+    protected retryPolicy: ProviderRetryPolicy;
+    /** Non-streaming completion */
+    abstract complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
+    /** Streaming completion – yields incremental chunks */
+    abstract completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
     /**
-     * Unified native-reasoning request config. Each provider maps this to its
-     * own shape:
-     *  - OpenAI o-series:   body.reasoning_effort = effort
-     *  - OpenAI Responses:  body.reasoning = { effort }
-     *  - Anthropic:         body.thinking  = { type: "enabled", budget_tokens }
-     *  - Google / Vertex:   body.generationConfig.thinkingConfig = { thinkingBudget, includeThoughts }
+     * Helper concrete providers can wrap their fetch with. Retries 429/5xx
+     * with exponential backoff and respects Retry-After if the response
+     * carries one.
      *
-     * Providers silently ignore unsupported fields.
+     * `signal` is the call's cancellation: a run that is cancelled while the
+     * provider is backing off must not sit out the delay, nor start another attempt.
      */
-    reasoning?: ReasoningRequestConfig;
+    protected doFetchWithRetry(execute: () => Promise<Response>, signal?: AbortSignal): Promise<Response>;
+}
+
+/** A System One question. `noul` asks for the probability of a "yes". */
+type JevQuestion = {
+    type: "noul" | "choice" | "score";
+    instructions?: string;
+    criteria?: unknown;
+};
+type JevSystemOneRequest = {
+    /** The text the questions are asked about. */
+    state: string;
+    questions: Record<string, JevQuestion>;
+    /** Overrides the provider's `defaultModel` for this call. */
+    model?: string;
+};
+type JevSystemOneResult = {
+    readonly model?: string;
+    readonly answers?: Record<string, {
+        readonly type: string;
+        readonly noul?: number;
+        readonly [k: string]: unknown;
+    } | undefined>;
+    readonly usage?: {
+        readonly input_tokens: number;
+        readonly output_tokens: number;
+    };
+};
+declare class JevProvider extends BaseProvider {
+    readonly providerName: ProviderType;
+    private readonly apiKey;
+    private readonly baseURL;
+    private readonly defaultModel?;
+    private readonly defaultHeaders;
+    constructor(config: JevProviderConfig);
+    /** Ask System One questions about `state`. */
+    systemOne(request: JevSystemOneRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<JevSystemOneResult>;
+    complete(_request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
+    completeStream(_request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
+}
+
+type RegexRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    pattern: RegExp | string;
+    flags?: string;
+    matchDisposition?: GuardrailDisposition;
+    selector?: (context: GuardrailContext) => string;
+    allowIfMatch?: boolean;
+    failureMessage?: string;
+};
+declare function regexRule(options: RegexRuleOptions): GuardrailRule;
+type JsonSchemaRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    schema: JSONSchema7 | z.ZodTypeAny;
+    selector?: (context: GuardrailContext) => string;
+    disposition?: GuardrailDisposition;
+    allowOnParseError?: boolean;
+};
+declare function jsonSchemaRule(options: JsonSchemaRuleOptions): GuardrailRule;
+type CodeDetectionRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    selector?: (context: GuardrailContext) => string;
+    disposition?: GuardrailDisposition;
+    allowList?: Array<RegExp | string>;
+};
+declare function codePresenceRule(options?: CodeDetectionRuleOptions): GuardrailRule;
+declare const guardianSchema: z.ZodObject<{
+    allow: z.ZodBoolean;
+    disposition: z.ZodOptional<z.ZodEnum<["allow", "warn", "block"]>>;
+    reason: z.ZodOptional<z.ZodString>;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, "strip", z.ZodTypeAny, {
+    allow: boolean;
+    reason?: string | undefined;
+    disposition?: "allow" | "block" | "warn" | undefined;
+    details?: Record<string, any> | undefined;
+}, {
+    allow: boolean;
+    reason?: string | undefined;
+    disposition?: "allow" | "block" | "warn" | undefined;
+    details?: Record<string, any> | undefined;
+}>;
+/** Which judge backend `agentVerdictRule` uses to produce its verdict. */
+type GuardrailJudgeEngine = "llm" | "jev";
+/** Jev answer for a `noul` (yes/no probability) question. */
+type JevNoulAnswer = {
+    readonly type: "noul";
+    /** Probability of a "yes", from zero to one. */
+    readonly noul: number;
 };
 /**
- * `none` is OFF, and it is a value rather than the absence of one.
- *
- * On a thinking-by-default model — every Qwen3 under vLLM, gpt-5.1 and newer on
- * OpenAI — sending no reasoning field leaves the model thinking. So "do not
- * think" is an instruction that has to travel: `reasoning_effort:"none"` on
- * OpenAI, `thinkingBudget:0` on Gemini, and no thinking block at all on
- * Anthropic (where thinking is opt-in and the absence IS off). Omitting
- * `effort` still means "say nothing about reasoning", which is the different
- * and equally necessary state.
+ * Anything with the provider's `systemOne` method: a `JevProvider`, or a stub in tests.
  */
-type ReasoningEffort = "none" | "minimal" | "low" | "medium" | "high";
-type ReasoningRequestConfig = {
-    /** Qualitative effort hint (mapped per-provider). */
-    effort?: ReasoningEffort;
-    /** Explicit per-call token budget for reasoning/thinking. */
-    budgetTokens?: number;
-    /** Whether the provider should expose its reasoning/thought summary to the caller. Default false. */
-    includeThoughts?: boolean;
-    /** Provider-specific passthrough merged on top of the mapped shape. */
-    providerExtras?: Record<string, any>;
+type JevClientLike = Pick<JevProvider, "systemOne">;
+type JevEngineOptions = {
+    /** Pre-built `JevProvider` (or compatible stub). When set, `apiKey`/`baseURL`/`model` are ignored. */
+    client?: JevClientLike;
+    /** API key for the `JevProvider` built on first use; falls back to `TYPESAFE_API_KEY`. */
+    apiKey?: string;
+    /** API root; falls back to `TYPESAFE_BASE_URL`, then the provider default. */
+    baseURL?: string;
+    /** Model override, per call. */
+    model?: string;
+    /** Risk probability at or above which the message fails the rule. Defaults to 0.5. */
+    threshold?: number;
+    /** Customizes the `noul` question instructions, mirroring `payloadBuilder`. */
+    question?: (context: GuardrailContext) => string;
+    /** Optional descriptions of the yes/no outcomes passed to the `noul` question. */
+    criteria?: {
+        true?: string;
+        false?: string;
+    };
 };
-type TokenUsage = {
-    inputTokens: number;
-    outputTokens: number;
-    totalTokens: number;
-    cachedInputTokens: number;
-    cachedWriteTokens: number;
-    cachedOutputTokens: number;
-    reasoningTokens: number;
+type AgentRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    /** Guardian agent. Required for the default `"llm"` engine; unused by `"jev"`. */
+    agent?: SmartAgentInstance<z.infer<typeof guardianSchema>>;
+    systemPrompt?: string;
+    payloadBuilder?: (context: GuardrailContext) => string;
+    dispositionFallback?: GuardrailDisposition;
+    /** Judge backend. Defaults to `"llm"` for full backward compatibility. */
+    engine?: GuardrailJudgeEngine;
+    /** Configuration for the `"jev"` engine. Ignored by the `"llm"` engine. */
+    jev?: JevEngineOptions;
 };
-declare function emptyUsage(): TokenUsage;
-type FinishReason = "stop" | "tool_calls" | "length" | "content_filter" | "error";
-type ChatCompletionResponse = {
-    id: string;
-    model: string;
-    content: string | null;
-    toolCalls: ToolCall[];
-    usage: TokenUsage;
-    finishReason: FinishReason;
-    /** Native reasoning blocks + summary captured from the response, if any. */
-    reasoning?: ReasoningPayload;
-    raw: any;
+declare function agentVerdictRule(options: AgentRuleOptions): GuardrailRule;
+type CustomRuleCallback = (context: GuardrailContext) => boolean | {
+    allow: boolean;
+    reason?: string;
+    disposition?: GuardrailDisposition;
+    details?: Record<string, any>;
+} | Promise<boolean | {
+    allow: boolean;
+    reason?: string;
+    disposition?: GuardrailDisposition;
+    details?: Record<string, any>;
+}>;
+type CustomRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    callback: CustomRuleCallback;
+    defaultDisposition?: GuardrailDisposition;
 };
-type ChatCompletionChunk = {
-    id: string;
-    model: string;
-    delta: {
-        content?: string;
-        toolCalls?: Partial<ToolCall>[];
-        /** Incremental reasoning text / signature deltas (Anthropic thinking). */
-        reasoning?: ReasoningPayload;
-    };
-    usage?: TokenUsage;
-    finishReason?: FinishReason;
+declare function customCallbackRule(options: CustomRuleOptions): GuardrailRule;
+
+type GuardrailPresetBase = {
+    guardrailId?: string;
+    guardrailTitle?: string;
+    guardrailDescription?: string;
+    phases?: GuardrailPhase[];
+    haltOnViolation?: boolean;
+    onViolation?: ConversationGuardrail["onViolation"];
+    metadata?: Record<string, any>;
 };
-type ProviderRetryConfig = {
-    /** Maximum retries on 429/5xx (default 3). */
-    maxRetries?: number;
-    /** Initial delay between retries in ms (default 500, doubled each attempt). */
-    baseDelayMs?: number;
-    /** Hard cap on a single retry delay in ms (default 8000). */
-    maxDelayMs?: number;
-    /** Custom predicate to opt in/out of a specific retry. */
-    shouldRetry?: (error: any, attempt: number) => boolean;
+type RegexGuardrailOptions = GuardrailPresetBase & {
+    rule?: Omit<RegexRuleOptions, "pattern">;
 };
-type OpenAIProviderConfig = {
-    provider: "openai";
-    apiKey: string;
-    baseURL?: string;
-    organization?: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
-    retry?: ProviderRetryConfig;
+declare function createRegexGuardrail(pattern: RegExp | string, options?: RegexGuardrailOptions): ConversationGuardrail;
+type JsonGuardrailOptions = GuardrailPresetBase & {
+    rule?: Omit<JsonSchemaRuleOptions, "schema">;
+};
+declare function createJsonGuardrail(schema: JsonSchemaRuleOptions["schema"], options?: JsonGuardrailOptions): ConversationGuardrail;
+type CodeGuardrailOptions = GuardrailPresetBase & {
+    rule?: CodeDetectionRuleOptions;
+};
+declare function createCodeGuardrail(options?: CodeGuardrailOptions): ConversationGuardrail;
+
+/**
+ * Wrap a plugin factory so config flows through with full inference:
+ *
+ *   const myGuard = definePlugin<{ level: number }>((cfg) => ({ name: "my-guard", ... }));
+ *   myGuard({ level: 2 })
+ *
+ * The indirection buys nothing at runtime — it exists so the config type is
+ * inferred at the call site and the returned object is checked against
+ * `AgentPlugin` at the definition site, where the error message is useful.
+ */
+declare function definePlugin<TConfig = void>(factory: (config: TConfig) => AgentPlugin): (config: TConfig) => AgentPlugin;
+/**
+ * A single hook, packaged as a plugin. For the common case where naming and a
+ * lifecycle would be ceremony:
+ *
+ *   defineHook("preToolUse", ({ toolName }) => toolName === "shell" ? { decision: "ask" } : undefined)
+ */
+declare function defineHook<K extends HookName>(hook: K, handler: HookHandler<K>, opts?: {
+    name?: string;
+    priority?: number;
+    failureMode?: PluginFailureMode;
+    timeoutMs?: number;
+    inheritToSubagents?: boolean;
     /**
-     * WHICH API a reasoning-carrying request is addressed to.
-     *
-     *  auto    (default, and today's behaviour) route to the Responses API when
-     *          the request carries `reasoning` AND the model name looks like an
-     *          o-series/gpt-5 reasoning model.
-     *  never   always Chat Completions. `reasoning` is still mapped, as
-     *          `reasoning_effort` plus any `providerExtras`.
-     *  always  always Responses, whatever the model is called.
-     *
-     * `auto` is a name-based guess, and it decides far more than where reasoning
-     * goes: Responses is a different request shape (`input` not `messages`,
-     * `text.format` not `response_format`, flat tool objects) and a different
-     * response parse. A caller with its own measurements of the Chat Completions
-     * body — a gateway, a proxy, an on-prem server that serves one and not the
-     * other, or anything that has tuned `extra` — must be able to say so, rather
-     * than discover that asking for less thinking silently changed the transport.
-     *
-     * Applies to any OpenAI-shaped endpoint, which is also why the guess is weak
-     * where it matters most: a self-hosted model is named by whoever served it.
+     * Declare that this hook never returns `decision: "ask"`. Without it a
+     * `preToolUse` hook is assumed to be able to pause, and the whole tool
+     * batch is scheduled serially — silently costing an agent its parallel
+     * tool execution.
      */
-    responsesApi?: "auto" | "never" | "always";
+    mayRequireApproval?: boolean;
+}): AgentPlugin;
+
+/**
+ * What this build actually implements.
+ *
+ * A policy configured as `mode: "enforce"` whose hook is never called is worse
+ * than no policy: the console shows a control that does not exist. A host
+ * cannot infer that from the type surface, because a declared hook and a wired
+ * one look identical to TypeScript — so the runtime states it.
+ *
+ * This table is maintained BY HAND alongside the wiring. That is deliberate:
+ * deriving it from the registry would only prove that a handler was registered,
+ * not that any call site raises it, which is precisely the failure it exists to
+ * make visible.
+ */
+
+/**
+ * Bumped when the hook contract changes shape in a way a host must notice —
+ * a hook gains or loses a call site, a payload field changes meaning, a slot
+ * starts or stops being consumed. Independent of the package version.
+ */
+declare const HOOK_CONTRACT_VERSION = 1;
+type CapabilityStatus = {
+    /** True when a call site in the runtime actually raises this. */
+    implemented: boolean;
+    /** Why not, or what the caveat is. */
+    notes?: string;
+};
+type SdkCapabilities = {
+    hookContractVersion: number;
+    hooks: Record<HookName, CapabilityStatus>;
+    slots: Record<SlotName, CapabilityStatus>;
+    features: Record<string, CapabilityStatus>;
+};
+/**
+ * Hook ids used by the Cognipeer Console's guardrail plane, mapped onto this
+ * SDK's hooks.
+ *
+ * The Console plane originally had one input stage, which collapsed two
+ * moments that behave differently: `userPromptSubmit` fires ONCE for a new
+ * user turn and can see attachments, while `preModelCall` fires before EVERY
+ * provider call — which is where the legacy `GuardrailPhase.Request` actually
+ * ran. A policy meant to vet what a person typed wants the first; one meant to
+ * vet every prompt reaching the model, including turns built from tool output,
+ * wants the second. Mapping both to one id silently changes how often the
+ * policy runs, and on a moderation-model guardrail that is a cost as well as a
+ * semantics bug.
+ *
+ * The Console added `prompt.pre` for the first and kept `input.pre` meaning
+ * the second, so every id below is single-valued.
+ */
+declare const CONSOLE_HOOK_MAP: Readonly<Record<string, HookName | null>>;
+/** What this build implements. Safe to call at any time; allocates a fresh copy. */
+declare function pluginCapabilities(): SdkCapabilities;
+/** Convenience for a host that only wants to know whether it can enforce. */
+declare function isHookImplemented(hook: HookName): boolean;
+
+/**
+ * Guardrail transport + the plugin that drives it.
+ *
+ * Layered the way tracing sinks are layered — a transport seam, a generic HTTP
+ * implementation, an in-process escape hatch, and thin first-party presets on
+ * top (see `cognipeerGuardrail`, `portkeyGuardrail`). What is deliberately NOT
+ * copied from tracing is its retry policy: a trace post can afford four
+ * attempts at an 8s timeout because nothing waits on it, while a guardrail sits
+ * on the critical path of every turn and the same policy would stall an agent
+ * for half a minute.
+ */
+
+/**
+ * `tool` is the ARGUMENTS a model wants to run; `tool_result` is what came
+ * back. They are different surfaces with different risks — one is an action
+ * about to happen, the other is untrusted content entering the context — and a
+ * policy usually wants different rules for each.
+ */
+type GuardrailPhaseName = "input" | "output" | "tool" | "tool_result";
+type GuardrailRequest = {
+    phase: GuardrailPhaseName;
+    content: string;
+    /** Tool name for `tool` / `tool_result`, otherwise unset. */
+    subject?: string;
+    /** The SDK hook this check was raised from, so a preset can map it exactly. */
+    hook?: string;
+    /** Structured tool arguments, for a service that wants them un-stringified. */
+    toolArgs?: unknown;
+    /** The tool's return value, for `tool_result`. */
+    toolResult?: unknown;
     /**
-     * Models that go to the Responses API, named explicitly. Opt-in; unset by
-     * default, and nothing here is inferred from a model name.
-     *
-     * A string matches the request's model (or `defaultModel`) exactly; a RegExp
-     * is tested against it. A match routes the request to Responses whether or
-     * not it carries `reasoning` — the case this exists for is a model that
-     * reasons by default and rejects function tools on Chat Completions, where
-     * sending no reasoning field does not help. `responsesApi: "never"` still
-     * wins; under `"always"` the routing is unchanged.
-     *
-     * Requests for a matched model also get, on the Responses body only:
-     *  - Chat Completions spellings arriving through `extra`, which /responses
-     *    rejects with a 400, re-spelled with their values unchanged:
-     *    `reasoning_effort` → `reasoning.effort` (a request `reasoning` effort
-     *    still wins), `max_tokens` / `max_completion_tokens` →
-     *    `max_output_tokens`, `response_format` → `text.format`, and
-     *    `stream_options.include_usage` dropped.
-     *  - real SSE streaming, when `responsesStreaming` is also true.
+     * Non-text parts of the turn — images, audio, video, files. A text-only
+     * policy sees the caption and nothing else, so a service that moderates
+     * media needs these; one that does not simply ignores the field.
      *
-     * Honoured by `OpenAIProvider` itself only; `AzureProvider` and
-     * `OpenAICompatibleProvider` ignore it.
+     * Inline payloads are DESCRIBED (kind, media type, size) rather than
+     * inlined: shipping a base64 image on every check would multiply the cost of
+     * the guardrail by the size of the upload. A service that needs the bytes
+     * should take a URL, or the caller should override `buildRequest`.
      */
-    responsesApiModels?: Array<string | RegExp>;
+    attachments?: MediaAttachment[];
+    metadata?: Record<string, unknown>;
+};
+type GuardrailViolation = {
+    id?: string;
+    type?: string;
+    severity?: string;
+    detail?: string;
+};
+type GuardrailVerdict = {
+    action: "allow" | "block" | "mask";
+    message?: string;
+    /** Required when `action === "mask"`. */
+    maskedContent?: string;
+    violations?: GuardrailViolation[];
+    /** The untouched service response, for tracing and debugging. */
+    raw?: unknown;
+};
+type GuardrailCallContext = {
+    runId: string;
+    agentName?: string;
+    /** Correlates a guardrail decision with the trace session in the console UI. */
+    traceId?: string;
+    signal?: AbortSignal;
+};
+type GuardrailTransport = {
+    name: string;
+    /** Verdicts must come back in the same order as `requests`. */
+    evaluate(requests: GuardrailRequest[], ctx: GuardrailCallContext): MaybePromise<GuardrailVerdict[]>;
     /**
-     * Stream Responses API output as it arrives (text and tool-call argument
-     * deltas) for models in `responsesApiModels`. Default false, which keeps the
-     * existing behaviour: one non-streaming Responses call, emitted as a single
-     * chunk. Has no effect on any other request.
+     * Optional setup-time handshake. When a service can say which phases carry
+     * active rules, every other phase skips the network entirely — usually the
+     * single biggest latency win available here.
      */
-    responsesStreaming?: boolean;
+    describe?: () => MaybePromise<{
+        activePhases?: GuardrailPhaseName[];
+    } | null | undefined>;
+    close?: () => MaybePromise<void>;
 };
-type AnthropicProviderConfig = {
-    provider: "anthropic";
-    apiKey: string;
-    baseURL?: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
-    anthropicVersion?: string;
-    retry?: ProviderRetryConfig;
+type HttpGuardrailOptions = {
+    url: string;
+    /** Static headers, or a thunk so a rotating token is read per call. */
+    headers?: Record<string, string> | (() => Record<string, string>);
+    /** Hard ceiling per attempt. Default 3000ms — this is on the critical path. */
+    timeoutMs?: number;
+    /** Retries after the first attempt. Default 1. */
+    retries?: number;
+    /** Send all pending checks in one request. Default true. */
+    batch?: boolean;
+    /** Override the wire request. Default: `{ items, runId, traceId }`. */
+    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
+    /** Override response mapping. Default: `normalizeVerdicts`, which is forgiving. */
+    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
     /**
-     * Prompt caching configuration. When enabled, places cache_control:
-     * ephemeral breakpoints on the system prompt and the final tool definition,
-     * which is the recommended Anthropic recipe for static system + tools.
+     * Status codes that carry a VERDICT rather than an error. Some services
+     * signal the outcome in the status line (e.g. 446 for a block); treating
+     * those as transport failures would route a real decision through the
+     * failureMode path with the wrong reason attached.
      */
-    prompt_caching?: {
-        enabled: boolean;
-    };
-};
-type AzureProviderConfig = {
-    provider: "azure";
-    apiKey: string;
-    endpoint: string;
-    apiVersion?: string;
-    deploymentName?: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
-};
-type OpenAICompatibleProviderConfig = {
-    provider: "openai-compatible";
-    apiKey: string;
-    baseURL: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
+    verdictStatuses?: number[];
+    /** Optional GET endpoint for the setup-time handshake. */
+    describeUrl?: string;
+    name?: string;
 };
-type BedrockProviderConfig = {
-    provider: "bedrock";
-    region: string;
-    accessKeyId?: string;
-    secretAccessKey?: string;
-    sessionToken?: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
-    retry?: ProviderRetryConfig;
+/**
+ * Accepts the shapes a guardrail service is likely to return and normalizes
+ * them. Being forgiving here is the point: the exact contract can change on the
+ * service side without a client release, and a stricter parser would turn a
+ * cosmetic field rename into an outage.
+ */
+declare function normalizeVerdicts(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
+declare function httpGuardrail(options: HttpGuardrailOptions): GuardrailTransport;
+/** In-process evaluation — regex policies, a local model, Presidio, tests. */
+declare function customGuardrail(evaluate: (request: GuardrailRequest, ctx: GuardrailCallContext) => MaybePromise<GuardrailVerdict | void>, name?: string): GuardrailTransport;
+type GuardrailPluginOptions = {
+    name: string;
+    transport: GuardrailTransport;
+    /** Which surfaces to check. Default: input + output. */
+    apply?: GuardrailPhaseName[];
     /**
-     * Insert Bedrock Converse `cachePoint` blocks at the end of the system
-     * prompt and tools list. Only supported by models that implement Converse
-     * prompt caching (most Anthropic Claude variants on Bedrock).
+     * `shadow` evaluates and reports but never blocks or masks. This is how a
+     * policy gets rolled out safely: measure what it would have caught first.
      */
-    prompt_caching?: {
-        enabled: boolean;
+    mode?: "enforce" | "shadow";
+    /** Block when the service is unreachable. Default true. */
+    failClosed?: boolean;
+    timeoutMs?: number;
+    priority?: number;
+    inheritToSubagents?: boolean;
+    /** Memoize verdicts per run. Default true. */
+    cache?: boolean | {
+        maxEntries?: number;
     };
+    /** Extra metadata attached to every request. */
+    metadata?: Record<string, unknown>;
 };
-type VertexProviderConfig = {
-    provider: "vertex";
-    projectId: string;
-    location?: string;
-    accessToken?: string;
-    serviceAccountJson?: string | Record<string, any>;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
+declare function createGuardrailPlugin(options: GuardrailPluginOptions): AgentPlugin;
+
+/**
+ * Cognipeer Console guardrail — the first-party preset.
+ *
+ * Talks to the Console's HOOK plane, not its single-shot evaluator:
+ *
+ *   POST {baseUrl}/api/client/v1/guardrails/hooks/evaluate
+ *   Authorization: Bearer <api key>
+ *   { hook, guardrail_keys, text?, tool_name?, tool_args?, tool_result?, … }
+ *
+ * Three properties of that contract shape everything below, and getting any of
+ * them wrong turns a working policy into a silent one:
+ *
+ *   `decision`  is the EFFECTIVE verdict, already neutralised in monitor mode.
+ *               Priority runs block > redact > warn > flag > allow.
+ *   `enforced`  false means the decision was NOT applied — a dry run. Blocking
+ *               on `decision === "block"` without checking this turns every
+ *               monitoring policy into an enforcing one on the day it is
+ *               switched on for observation.
+ *   `passed`    means "no blocking finding", NOT "the request was allowed".
+ *               The two diverge in monitor mode, which is exactly when someone
+ *               reads the wrong one.
+ *
+ * `subject` (or `redacted_text` for the text case) is filled only when the
+ * service actually rewrote something; when it is present it REPLACES what was
+ * sent rather than being merged with it.
+ *
+ * The endpoint answers 200 for a finding as readily as for a clean check, and
+ * only emits 246/446 when a guardrail opts into verdict status codes — so both
+ * are declared as verdict-carrying rather than treated as transport failures.
+ * An unknown key answers 404 ON PURPOSE: a vacuous allow read as "content is
+ * safe" is the failure the whole plane exists to avoid.
+ */
+
+type CognipeerGuardrailConfig = {
+    /** Guardrail keys from the Console. Defaults to `COGNIPEER_GUARDRAIL_KEYS` (comma-separated). */
+    guardrailKeys?: string[];
+    /** Convenience for the single-key case. */
+    guardrailKey?: string;
+    /** Defaults to `COGNIPEER_API_KEY`. */
+    apiKey?: string;
+    /** Defaults to `COGNIPEER_BASE_URL`, then the production console. Point at localhost for local runs. */
+    baseUrl?: string;
+    /** Override the hook-evaluate path. */
+    path?: string;
+    /** Surfaces to guard. Default: input + output. Add `"tool"` / `"tool_result"` for the tool surface. */
+    apply?: GuardrailPhaseName[];
+    /** Restrict to specific check families, e.g. `["pii"]`. */
+    only?: string[];
+    /** Override the SDK-hook → Console-hook-id mapping, merged over the default. */
+    hookIds?: Record<string, string>;
+    /** Ask the service to evaluate without enforcing. Independent of `mode`. */
+    shadow?: boolean;
+    /** `shadow` here reports locally without acting, whatever the service says. */
+    mode?: "enforce" | "shadow";
+    /** Default true — an unreachable or misconfigured policy blocks rather than silently stops guarding. */
+    failClosed?: boolean;
+    /** Per-check ceiling. Default 3000ms; also sent as `budget_ms`. */
+    timeoutMs?: number;
+    retries?: number;
+    priority?: number;
+    cache?: boolean | {
+        maxEntries?: number;
+    };
+    metadata?: Record<string, unknown>;
+    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
+    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
+    name?: string;
 };
-type ProviderConfig = OpenAIProviderConfig | AnthropicProviderConfig | AzureProviderConfig | OpenAICompatibleProviderConfig | BedrockProviderConfig | VertexProviderConfig;
-type ProviderType = ProviderConfig["provider"];
-declare class ProviderError extends Error {
-    readonly provider: string;
-    readonly statusCode?: number | undefined;
-    readonly responseBody?: any | undefined;
-    constructor(message: string, provider: string, statusCode?: number | undefined, responseBody?: any | undefined);
-}
+/** The Console's hook response, mapped onto the transport's three-valued verdict. */
+declare function mapConsoleHookVerdict(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
+declare function cognipeerGuardrail(config?: CognipeerGuardrailConfig): AgentPlugin;
 
 /**
  * Portkey — two integration shapes, because Portkey supports two.
@@ -5505,34 +5674,6 @@ declare function buildResponseFormatSection(responseFormat: Record<string, any>
  */
 declare function startStreamingSession(session: TraceSessionRuntime | undefined, agentRuntime?: AgentRuntimeConfig): Promise<void>;
 
-type ProviderRetryPolicy = {
-    /** Maximum number of retries on 429/5xx responses. Default: 3. */
-    maxRetries?: number;
-    /** Initial backoff in ms (doubled on each retry). Default: 500. */
-    baseDelayMs?: number;
-    /** Hard cap on individual delay between retries. Default: 8000. */
-    maxDelayMs?: number;
-    /**
-     * Custom predicate to decide whether to retry. By default we retry 429
-     * and 5xx responses; pass a function to broaden/narrow that set.
-     */
-    shouldRetry?: (error: any, attempt: number) => boolean;
-};
-declare abstract class BaseProvider {
-    abstract readonly providerName: ProviderType;
-    protected retryPolicy: ProviderRetryPolicy;
-    /** Non-streaming completion */
-    abstract complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
-    /** Streaming completion – yields incremental chunks */
-    abstract completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
-    /**
-     * Helper concrete providers can wrap their fetch with. Retries 429/5xx
-     * with exponential backoff and respects Retry-After if the response
-     * carries one.
-     */
-    protected doFetchWithRetry(execute: () => Promise<Response>): Promise<Response>;
-}
-
 declare class OpenAIProvider extends BaseProvider {
     readonly providerName: ProviderType;
     protected readonly apiKey: string;
@@ -5573,11 +5714,11 @@ declare class OpenAIProvider extends BaseProvider {
     protected buildResponsesBody(request: ChatCompletionRequest): Record<string, any>;
     /** Maps a unified message to a Responses API `input` item. */
     protected toResponsesInput(m: UnifiedMessage): Record<string, any>;
-    protected responsesFetch(body: Record<string, any>): Promise<Response>;
+    protected responsesFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
     protected parseResponsesResponse(json: any, modelId: string): ChatCompletionResponse;
     protected toOpenAIMessage(m: UnifiedMessage): Record<string, any>;
     protected toOpenAITool(t: ToolDefinition): Record<string, any>;
-    protected doFetch(body: Record<string, any>): Promise<Response>;
+    protected doFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
     protected parseResponse(json: any): ChatCompletionResponse;
     protected extractUsage(usage: any): TokenUsage;
 }
@@ -5620,11 +5761,11 @@ declare class AzureProvider extends OpenAIProvider {
     private readonly deploymentName?;
     private readonly azureApiKey;
     constructor(config: AzureProviderConfig);
-    protected doFetch(body: Record<string, any>): Promise<Response>;
+    protected doFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
     /** Azure exposes the Responses API at /openai/responses with api-key auth.
      * Reasoning summaries require a preview api-version; callers can override via
      * the `apiVersion` config. */
-    protected responsesFetch(body: Record<string, any>): Promise<Response>;
+    protected responsesFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
 }
 
 declare class OpenAICompatibleProvider extends OpenAIProvider {
@@ -5736,4 +5877,4 @@ declare function fromNativeProvider(provider: BaseProvider, options?: NativeMode
  */
 declare function createProvider(config: ProviderConfig): BaseProvider;
 
-export { type AIMessage, ASK_USER_TOOL_NAME, type AgentInstance, type AgentInvokeResult, type AgentLimits, type AgentOptions, type AgentPlugin, type AgentRuleOptions, type AgentRuntimeConfig, type AgentSnapshot, type AgentSnapshotMetadata, type AgentState, AnthropicProvider, type AnthropicProviderConfig, type ApprovalTransport, type AudioContent, type AuditEntry, type AuditLogConfig, type AzureContentSafetyConfig, AzureProvider, type AzureProviderConfig, type BaseChatMessage, type BaseChatMessagePart, type BaseChatModel, type BaseMessage, BaseProvider, type BedrockGuardrailConfig, BedrockProvider, type BedrockProviderConfig, type BudgetGuardConfig, type BuildChildConfig, type BuiltInRuntimeProfile, CCRStore, CONSOLE_HOOK_MAP, CONTEXT_PILOT_JSON_MARKER_KEY, CONTROL_PLANE_TOOL_NAMES, type CancellationTokenLike, type CancelledEvent, type CapabilityStatus, type ChatCompletionChunk, type ChatCompletionRequest, type ChatCompletionResponse, type CheckpointPluginConfig, type CheckpointStore, type ChildContextPolicy, type CodeDetectionRuleOptions, type CodeGuardrailOptions, type CognipeerGuardrailConfig, type CompressToolOutputParams, type ContextBuilder, type ContextPilotCCRConfig, type ContextPilotCacheAlignmentConfig, type ContextPilotCompressionConfig, type ContextPilotCompressionStats, type ContextPilotCompressorKind, type ContextPilotConfig, type ContextPilotDedupConfig, type ContextPilotDiffCompressionConfig, type ContextPilotJsonCompressionConfig, type ContextPilotLogCompressionConfig, type ContextPilotResult, type ContextPilotRuntime, type ContextPilotSearchCompressionConfig, type ContextPilotTextCompressionConfig, type ContextPolicy, type ContextToolsStateRef, type ConversationGuardrail, type ConversationPluginConfig, type ConversationStore, type CostEstimator, type CustomRuleCallback, type CustomRuleOptions, DEFAULT_MAX_TOOL_INPUT_FIELD_CHARS, DEFAULT_PROFILE_CONFIGS, DEFAULT_SKILL_POLICY, DEFAULT_SUBAGENT_POLICY, DEFAULT_SUBAGENT_TOOL_NAMES, DEFAULT_TOOL_INPUT_DIGEST_HEAD_CHARS, DELEGATION_TOOL_NAMES, DedupTracker, type DelegationEventStamp, type DelegationMode, type EvalCase, type EvalCaseResult, type EvalFamily, type EvalHarnessMetrics, type EvalHarnessParams, type EvalHarnessResult, type EvalProfileDescriptor, type EvalProfileTarget, type FileContent, type FinalAnswerEvent, type FinishReason, type GateResult, type GuardrailCallContext, type GuardrailContext, type GuardrailDisposition, type GuardrailEvent, type GuardrailIncident, type GuardrailOutcome, GuardrailPhase, type GuardrailPhaseName, type GuardrailPluginOptions, type GuardrailRequest, type GuardrailRule, type GuardrailRuleResult, type GuardrailTransport, type GuardrailVerdict, type GuardrailViolation, HOOK_CONTRACT_VERSION, HOOK_NAMES, type HandoffDescriptor, type HandoffEvent, type HookContext, type HookDecision, type HookHandler, type HookMap, type HookName, type HookRegistrations, HookTimeoutError, type HttpGuardrailOptions, type HumanInTheLoopAskUserConfig, type HumanInTheLoopOptions, type HumanInTheLoopRuntimeConfig, type ImageContent, InMemoryMemoryStore, type InjectionScan, type InvokeConfig, type JsonGuardrailOptions, type JsonSchemaRuleOptions, type LangfuseBuildContext, type LangfuseEvent, type LangfuseEventKind, type LangfuseTracingConfig, type LanguageGuardConfig, type LoadSkillsOptions, type MaybePromise, type McpConfig, type McpConnection, type MediaAttachment, type MediaKind, type MediaPolicyConfig, type MemoryFact, type MemoryProviderKind, type MemoryReadPolicy, type MemoryScope, type MemoryStore, type MemoryWritePolicy, type Message, type MetadataEvent, type ModelCapabilities, NativeJsonSchemaStrategy, type NativeModelOptions, type NativeReasoningConfig, OpenAICompatibleProvider, type OpenAICompatibleProviderConfig, type OpenAIModerationConfig, OpenAIProvider, type OpenAIProviderConfig, type OtelTracingConfig, type OutputGuardConfig, PREOPEN_TOOL_CALL_PREFIX, type PendingToolApproval, type PendingUserQuestion, type PiiDetector, type PiiEntity, type PiiRedactionConfig, type PlanEvent, type PlanStepRecord, type PlanningMode, type PluginContributions, type PluginEvent, type PluginFailureMode, type PluginHost, type PluginHostOptions, type PluginLogger, type PluginProvides, type PluginRunHost, type PluginSetupContext, type PortkeyGatewayConfig, type PortkeyGuardrailConfig, type PreopenSkillsResult, type ProfileConfig, type ProgressEvent, type ProgressUpdate, type PromptHooks, type PromptInjectionFamily, type PromptInjectionGuardConfig, type PromptSource, type ProviderConfig, ProviderError, type ToolCall as ProviderToolCall, type ToolDefinition as ProviderToolDefinition, type ProviderType, type RateLimitConfig, type ReasoningConfig, type ReasoningLevel, type RedactionResult, type ReflectionCadence, type ReflectionConfig, type ReflectionEvent, type ReflectionHookContext, type ReflectionRecord, type RegexGuardrailConfig, type RegexGuardrailOptions, type RegexRuleOptions, type ReplanPolicy, type ResolvedContextPilotConfig, type ResolvedSmartAgentConfig, type ResolvedTraceConfig, type ResolvedTraceSink, type ResponseCacheConfig, type RestoreSnapshotOptions, type RuntimeProfile, SMALL_TIER_SKILL_POLICY, type SdkCapabilities, type SerializableSmartState, type SessionMetrics, type SessionMetricsConfig, type Skill, type SkillDisclosure, type SkillExecutionContext, type SkillFrontmatter, type SkillFs, type SkillModelTier, type SkillPolicy, type SkillRegistryRef, type SkillSource, type SkillToolDeps, type SkillToolHeader, type SlotName, type SmartAgentBudgetConfig, type SmartAgentContextConfig, type SmartAgentCustomProfileConfig, type SmartAgentDelegationConfig, type SmartAgentEvent, type SmartAgentInstance, type SmartAgentLimits, type SmartAgentMemoryConfig, type SmartAgentOptions, type SmartAgentPlanningConfig, type SmartAgentSummarizationConfig, type SmartAgentToolResponseConfig, type SmartAgentTracingConfig, type SmartModel, type SmartState, type SmartToolFn, type SnapshotOptions, type SnapshotRuntimeHint, type StreamChunk, type StreamEvent, type StrictRestorers, type StrictTransform, type StructuredOutputError, type StructuredOutputFieldError, StructuredOutputManager, type StructuredOutputManagerConfig, type StructuredOutputResult, type StructuredOutputStrategy, type StructuredSummary, type SubagentDef, type SubagentEvent, type SubagentMode, type SubagentPendingRecord, type SubagentPolicy, type SubagentRegistryRef, type SubagentResult, type SubagentToolDeps, type SubagentToolNames, type SummarizationEvent, type SummarizationMode, type SummarizerInput, type SummarizerResult, type SummarizerStrategy, type SummaryFactItem, type SummaryIntegrityCheck, TOOL_INPUT_DIGEST_KEY, type TextContent, type TokenCounter, type TokenUsage, type ToolApprovalEvent, type ToolApprovalResolution, type ToolApprovalStatus, ToolBasedStrategy, type ToolCachePolicy, type ToolCallEvent, type ToolInputDigestOptions, type ToolInputDigestResult, type ToolInputRetentionPolicy, type ToolInterface, type ToolPolicyConfig, type ToolResponseClassification, type ToolResponseRetentionPolicy, type ToolRetentionDeclarations, type ToolRetentionSpec, type ToolRetryPolicy, type ToolRule, type TraceDataSection, type TraceErrorRecord, type TraceEventRecord, type TraceMessageSection, type TraceMetadataSection, type TraceSessionConfigSnapshot, type TraceSessionFile, type TraceSessionStatus, type TraceSessionSummary, type TraceSinkCognipeerConfig, type TraceSinkConfig, type TraceSinkCustomConfig, type TraceSinkFileConfig, type TraceSinkHttpConfig, type TraceSinkOtlpConfig, type TraceSinkSnapshot, type TraceSummarySection, type TraceToolCallSection, type TraceToolDefinition, type TraceToolDefinitionsSection, type TraceToolDetails, type TraceToolResponseSection, type TraceToolResultSection, type TracingConfig, type TracingMode, type UnifiedMessage, type UserQuestionAnswer, type UserQuestionAnswerSet, type UserQuestionEvent, type UserQuestionItem, type UserQuestionOption, type UserQuestionResolution, type UserQuestionStatus, VertexProvider, type VertexProviderConfig, type VolatileContentFinding, type VolatileContentPattern, type WebhookApprovalConfig, agentVerdictRule, appendBoundTools, auditLog, azureContentSafety, bedrockGuardrail, budgetGuard, buildHandoffTools, buildResponseFormatSection, buildSkillHeaderBlock, buildSubagentCatalogBlock, buildSystemPrompt, buildToolDefinitionsSection, canOpenSkill, canSpawn, captureSnapshot, checkpointing, codePresenceRule, coerceToolArgs, cognipeerGuardrail, cognipeerSink, collectAttachments, collectToolRetentionDeclarations, composeToolSets, compressDiffOutput, compressJsonOutput, compressLogOutput, compressSearchOutput, compressTextOutput, compressToolOutput, contentToString, conversationHistory, countApproxTokens, countMessagesTokens, createAgent, createAgentNode, createAskUserQuestionTool, createBindSkillToolsTool, createCodeGuardrail, createContextPilotRuntime, createContextSummarizeNode, createContextTools, createDelegateTool, createGetToolResponseTool, createGuardrail, createGuardrailPlugin, createJsonGuardrail, createManageTodoListAliasTool, createManageTodoTool, createOpenSkillTool, createParallelTool, createPluginHost, createProvider, createRegexGuardrail, createResolverNode, createSearchSkillsTool, createSkillRegistryRef, createSkillTools, createSmartAgent, createSpawnTool, createSubagentRegistryRef, createSubagentTools, createTool, createToolLimitFinalizeNode, createToolsNode, customCallbackRule, customGuardrail, customSink, dedupeToolsByName, defaultTokenCounter, defineHook, definePlugin, detectLanguage, detectTextFormat, detectVolatileContent, digestToolInputArguments, digestToolInputValue, emptyUsage, evaluateGuardrails, extractLatestUserQuery, extractMessageText, fileCheckpointStore, fileSink, findSubagent, formatZodError, fromLangchainModel, fromLangchainTools, fromNativeProvider, generateSpanId, generateTraceId, getModelCapabilities, getNestedValue, getResolvedSmartConfig, getTokenCounter, hasToolResponseRecoveryReference, httpGuardrail, httpSink, inMemoryCheckpointStore, inMemoryConversationStore, isHookImplemented, isOpenAIHostedEndpoint, isSmartModel, isValidIban, isValidLuhn, isValidTckn, jsonSchemaRule, defaultBuildPayload as langfuseDefaultPayload, langfuseTracing, languageGuard, loadSkillsFromDisk, mapConsoleHookVerdict, mapTextParts, mcp, mediaPolicy, normalizeSmartAgentOptions, normalizeVerdicts, openAIModeration, otelTracing, otlpSink, outputGuard, parseApprovalDecision, parseSkillFrontmatter, pathSandbox, piiRedaction, pluginCapabilities, portkeyGateway, portkeyGuardrail, preopenSkills, preopenToolCallId, prepareStrictToolMenu, promptInjectionGuard, rateLimit, readMemoryFacts, redactText, regexGuardrail, regexRule, replaceTextContent, resolveAvailableSkills, resolveAvailableSubagents, resolveInputRetention, resolveMemoryStore, resolveReasoning, resolveStrategy, resolveSubagentTools, resolveSummarizationRetention, resolveToolApprovalState, resolveUserQuestionState, responseCache, restoreSnapshot, restoreToolCalls, runSmartAgentEvalHarness, scoreItemsByRelevance, searchSkills, seedChildMessages, selectTopIndicesInOrder, sessionMetrics, setTokenCounter, startStreamingSession, summarizeObject, textFromContent, toStrictCompatible, toStrictToolSchema, tokenize, toolPolicy, traceSessionToOtlp, validateReasoningConfig, validateToolArgs, webhookApproval, withTools, withinDepth, writeSummaryFactsToMemory };
+export { type AIMessage, ASK_USER_TOOL_NAME, type AgentInstance, type AgentInvokeResult, type AgentLimits, type AgentOptions, type AgentPlugin, type AgentRuleOptions, type AgentRuntimeConfig, type AgentSnapshot, type AgentSnapshotMetadata, type AgentState, AnthropicProvider, type AnthropicProviderConfig, type ApprovalTransport, type AudioContent, type AuditEntry, type AuditLogConfig, type AzureContentSafetyConfig, AzureProvider, type AzureProviderConfig, type BaseChatMessage, type BaseChatMessagePart, type BaseChatModel, type BaseMessage, BaseProvider, type BedrockGuardrailConfig, BedrockProvider, type BedrockProviderConfig, type BudgetGuardConfig, type BuildChildConfig, type BuiltInRuntimeProfile, CCRStore, CONSOLE_HOOK_MAP, CONTEXT_PILOT_JSON_MARKER_KEY, CONTROL_PLANE_TOOL_NAMES, type CancellationTokenLike, type CancelledEvent, type CapabilityStatus, type ChatCompletionChunk, type ChatCompletionRequest, type ChatCompletionResponse, type CheckpointPluginConfig, type CheckpointStore, type ChildContextPolicy, type CodeDetectionRuleOptions, type CodeGuardrailOptions, type CognipeerGuardrailConfig, type CompressToolOutputParams, type ContextBuilder, type ContextPilotCCRConfig, type ContextPilotCacheAlignmentConfig, type ContextPilotCompressionConfig, type ContextPilotCompressionStats, type ContextPilotCompressorKind, type ContextPilotConfig, type ContextPilotDedupConfig, type ContextPilotDiffCompressionConfig, type ContextPilotJsonCompressionConfig, type ContextPilotLogCompressionConfig, type ContextPilotResult, type ContextPilotRuntime, type ContextPilotSearchCompressionConfig, type ContextPilotTextCompressionConfig, type ContextPolicy, type ContextToolsStateRef, type ConversationGuardrail, type ConversationPluginConfig, type ConversationStore, type CostEstimator, type CustomRuleCallback, type CustomRuleOptions, DEFAULT_MAX_TOOL_INPUT_FIELD_CHARS, DEFAULT_PROFILE_CONFIGS, DEFAULT_SKILL_POLICY, DEFAULT_SUBAGENT_POLICY, DEFAULT_SUBAGENT_TOOL_NAMES, DEFAULT_TOOL_INPUT_DIGEST_HEAD_CHARS, DELEGATION_TOOL_NAMES, DedupTracker, type DelegationEventStamp, type DelegationMode, type EvalCase, type EvalCaseResult, type EvalFamily, type EvalHarnessMetrics, type EvalHarnessParams, type EvalHarnessResult, type EvalProfileDescriptor, type EvalProfileTarget, type FileContent, type FinalAnswerEvent, type FinishReason, type GateResult, type GuardrailCallContext, type GuardrailContext, type GuardrailDisposition, type GuardrailEvent, type GuardrailIncident, type GuardrailJudgeEngine, type GuardrailOutcome, GuardrailPhase, type GuardrailPhaseName, type GuardrailPluginOptions, type GuardrailRequest, type GuardrailRule, type GuardrailRuleResult, type GuardrailTransport, type GuardrailVerdict, type GuardrailViolation, HOOK_CONTRACT_VERSION, HOOK_NAMES, type HandoffDescriptor, type HandoffEvent, type HookContext, type HookDecision, type HookHandler, type HookMap, type HookName, type HookRegistrations, HookTimeoutError, type HttpGuardrailOptions, type HumanInTheLoopAskUserConfig, type HumanInTheLoopOptions, type HumanInTheLoopRuntimeConfig, type ImageContent, InMemoryMemoryStore, type InjectionScan, type InvokeConfig, type JevClientLike, type JevEngineOptions, type JevNoulAnswer, JevProvider, type JevProviderConfig, type JevQuestion, type JevSystemOneRequest, type JevSystemOneResult, type JsonGuardrailOptions, type JsonSchemaRuleOptions, type LangfuseBuildContext, type LangfuseEvent, type LangfuseEventKind, type LangfuseTracingConfig, type LanguageGuardConfig, type LoadSkillsOptions, type MaybePromise, type McpConfig, type McpConnection, type MediaAttachment, type MediaKind$1 as MediaKind, type MediaPolicyConfig, type MemoryFact, type MemoryProviderKind, type MemoryReadPolicy, type MemoryScope, type MemoryStore, type MemoryWritePolicy, type Message, type MetadataEvent, type ModelCapabilities, NativeJsonSchemaStrategy, type NativeModelOptions, type NativeReasoningConfig, OpenAICompatibleProvider, type OpenAICompatibleProviderConfig, type OpenAIModerationConfig, OpenAIProvider, type OpenAIProviderConfig, type OtelTracingConfig, type OutputGuardConfig, PREOPEN_TOOL_CALL_PREFIX, type PendingToolApproval, type PendingUserQuestion, type PiiDetector, type PiiEntity, type PiiRedactionConfig, type PlanEvent, type PlanStepRecord, type PlanningMode, type PluginContributions, type PluginEvent, type PluginFailureMode, type PluginHost, type PluginHostOptions, type PluginLogger, type PluginProvides, type PluginRunHost, type PluginSetupContext, type PortkeyGatewayConfig, type PortkeyGuardrailConfig, type PreopenSkillsResult, type ProfileConfig, type ProgressEvent, type ProgressUpdate, type PromptHooks, type PromptInjectionFamily, type PromptInjectionGuardConfig, type PromptSource, type ProviderConfig, ProviderError, type ToolCall as ProviderToolCall, type ToolDefinition as ProviderToolDefinition, type ProviderType, type RateLimitConfig, type ReasoningConfig, type ReasoningLevel, type RedactionResult, type ReflectionCadence, type ReflectionConfig, type ReflectionEvent, type ReflectionHookContext, type ReflectionRecord, type RegexGuardrailConfig, type RegexGuardrailOptions, type RegexRuleOptions, type ReplanPolicy, type ResolvedContextPilotConfig, type ResolvedSmartAgentConfig, type ResolvedTraceConfig, type ResolvedTraceSink, type ResponseCacheConfig, type RestoreSnapshotOptions, type RuntimeProfile, SMALL_TIER_SKILL_POLICY, type SdkCapabilities, type SerializableSmartState, type SessionMetrics, type SessionMetricsConfig, type Skill, type SkillDisclosure, type SkillExecutionContext, type SkillFrontmatter, type SkillFs, type SkillModelTier, type SkillPolicy, type SkillRegistryRef, type SkillSource, type SkillToolDeps, type SkillToolHeader, type SlotName, type SmartAgentBudgetConfig, type SmartAgentContextConfig, type SmartAgentCustomProfileConfig, type SmartAgentDelegationConfig, type SmartAgentEvent, type SmartAgentInstance, type SmartAgentLimits, type SmartAgentMemoryConfig, type SmartAgentOptions, type SmartAgentPlanningConfig, type SmartAgentSummarizationConfig, type SmartAgentToolResponseConfig, type SmartAgentTracingConfig, type SmartModel, type SmartState, type SmartToolFn, type SnapshotOptions, type SnapshotRuntimeHint, type StreamChunk, type StreamEvent, type StrictRestorers, type StrictTransform, type StructuredOutputError, type StructuredOutputFieldError, StructuredOutputManager, type StructuredOutputManagerConfig, type StructuredOutputResult, type StructuredOutputStrategy, type StructuredSummary, type SubagentDef, type SubagentEvent, type SubagentMode, type SubagentPendingRecord, type SubagentPolicy, type SubagentRegistryRef, type SubagentResult, type SubagentToolDeps, type SubagentToolNames, type SummarizationEvent, type SummarizationMode, type SummarizerInput, type SummarizerResult, type SummarizerStrategy, type SummaryFactItem, type SummaryIntegrityCheck, TOOL_INPUT_DIGEST_KEY, type TextContent, type TokenCounter, type TokenUsage, type ToolApprovalEvent, type ToolApprovalResolution, type ToolApprovalStatus, ToolBasedStrategy, type ToolCachePolicy, type ToolCallEvent, type ToolInputDigestOptions, type ToolInputDigestResult, type ToolInputRetentionPolicy, type ToolInterface, type ToolPolicyConfig, type ToolResponseClassification, type ToolResponseRetentionPolicy, type ToolRetentionDeclarations, type ToolRetentionSpec, type ToolRetryPolicy, type ToolRule, type TraceDataSection, type TraceErrorRecord, type TraceEventRecord, type TraceMessagePart, type TraceMessageSection, type TraceMetadataSection, type TraceSessionConfigSnapshot, type TraceSessionFile, type TraceSessionStatus, type TraceSessionSummary, type TraceSinkCognipeerConfig, type TraceSinkConfig, type TraceSinkCustomConfig, type TraceSinkFileConfig, type TraceSinkHttpConfig, type TraceSinkOtlpConfig, type TraceSinkSnapshot, type TraceSummarySection, type TraceToolCallSection, type TraceToolDefinition, type TraceToolDefinitionsSection, type TraceToolDetails, type TraceToolResponseSection, type TraceToolResultSection, type TracingConfig, type TracingMode, type UnifiedMessage, type UserQuestionAnswer, type UserQuestionAnswerSet, type UserQuestionEvent, type UserQuestionItem, type UserQuestionOption, type UserQuestionResolution, type UserQuestionStatus, VertexProvider, type VertexProviderConfig, type VolatileContentFinding, type VolatileContentPattern, type WebhookApprovalConfig, agentVerdictRule, appendBoundTools, auditLog, azureContentSafety, bedrockGuardrail, budgetGuard, buildHandoffTools, buildResponseFormatSection, buildSkillHeaderBlock, buildSubagentCatalogBlock, buildSystemPrompt, buildToolDefinitionsSection, canOpenSkill, canSpawn, captureSnapshot, checkpointing, codePresenceRule, coerceToolArgs, cognipeerGuardrail, cognipeerSink, collectAttachments, collectToolRetentionDeclarations, composeToolSets, compressDiffOutput, compressJsonOutput, compressLogOutput, compressSearchOutput, compressTextOutput, compressToolOutput, contentPartToText, contentToString, conversationHistory, countApproxTokens, countMessagesTokens, createAgent, createAgentNode, createAskUserQuestionTool, createBindSkillToolsTool, createCodeGuardrail, createContextPilotRuntime, createContextSummarizeNode, createContextTools, createDelegateTool, createGetToolResponseTool, createGuardrail, createGuardrailPlugin, createJsonGuardrail, createManageTodoListAliasTool, createManageTodoTool, createOpenSkillTool, createParallelTool, createPluginHost, createProvider, createRegexGuardrail, createResolverNode, createSearchSkillsTool, createSkillRegistryRef, createSkillTools, createSmartAgent, createSpawnTool, createSubagentRegistryRef, createSubagentTools, createTool, createToolLimitFinalizeNode, createToolsNode, customCallbackRule, customGuardrail, customSink, dedupeToolsByName, defaultTokenCounter, defineHook, definePlugin, describeContentPart, detectLanguage, detectTextFormat, detectVolatileContent, digestToolInputArguments, digestToolInputValue, emptyUsage, evaluateGuardrails, extractLatestUserQuery, extractMessageText, fileCheckpointStore, fileSink, findSubagent, formatZodError, fromLangchainModel, fromLangchainTools, fromNativeProvider, generateSpanId, generateTraceId, getModelCapabilities, getNestedValue, getResolvedSmartConfig, getTokenCounter, hasMediaPart, hasToolResponseRecoveryReference, httpGuardrail, httpSink, inMemoryCheckpointStore, inMemoryConversationStore, isHookImplemented, isOpenAIHostedEndpoint, isSmartModel, isValidIban, isValidLuhn, isValidTckn, jsonSchemaRule, defaultBuildPayload as langfuseDefaultPayload, langfuseTracing, languageGuard, loadSkillsFromDisk, mapConsoleHookVerdict, mapTextParts, mcp, mediaKindOf, mediaPolicy, normalizeSmartAgentOptions, normalizeVerdicts, openAIModeration, otelTracing, otlpSink, outputGuard, parseApprovalDecision, parseSkillFrontmatter, pathSandbox, piiRedaction, pluginCapabilities, portkeyGateway, portkeyGuardrail, preopenSkills, preopenToolCallId, prepareStrictToolMenu, promptInjectionGuard, rateLimit, readMemoryFacts, redactText, regexGuardrail, regexRule, replaceTextContent, resolveAvailableSkills, resolveAvailableSubagents, resolveInputRetention, resolveMemoryStore, resolveReasoning, resolveStrategy, resolveSubagentTools, resolveSummarizationRetention, resolveToolApprovalState, resolveUserQuestionState, responseCache, restoreSnapshot, restoreToolCalls, runSmartAgentEvalHarness, scoreItemsByRelevance, searchSkills, seedChildMessages, selectTopIndicesInOrder, sessionMetrics, setTokenCounter, startStreamingSession, summarizeObject, textFromContent, toStrictCompatible, toStrictToolSchema, tokenize, toolPolicy, traceSessionToOtlp, validateReasoningConfig, validateToolArgs, webhookApproval, withTools, withinDepth, writeSummaryFactsToMemory };