@cognipeer/agent-sdk 0.10.5 → 0.12.0

package/dist/index.d.ts

@@ -72,6 +72,7 @@ interface BaseChatMessage {
             name: string;
             arguments: string;
         };
+        thoughtSignature?: string;
     }>;
     tool_call_id?: string;
     usage?: any;
@@ -210,6 +211,37 @@ type MediaAttachment = {
     approxBytes?: number;
     fileName?: string;
 };
+type MediaKind$1 = "image" | "audio" | "video" | "file";
+/**
+ * What kind of attachment a content part is, or undefined for text and for
+ * anything that is not a media part.
+ *
+ * Covers the unified shape (`image`/`audio`/`file` with a `source`), the
+ * OpenAI shapes (`image_url`, `input_audio`, `file`, `input_image`, `input_file`)
+ * and Gemini's untyped `inlineData` / `fileData`.
+ */
+declare function mediaKindOf(part: unknown): MediaKind$1 | undefined;
+/** True when the content is an array holding at least one media part. */
+declare function hasMediaPart(content: unknown): boolean;
+/**
+ * A short, human-readable stand-in for a media part: `[image: photo.png]`,
+ * `[image: image/png]`, `[audio]`. Undefined for text and non-media parts.
+ *
+ * This is what anything that flattens content to TEXT must use for an
+ * attachment — token estimation, the summarizer's input, trace display. The
+ * alternative, `JSON.stringify(part)`, writes the whole base64 payload into the
+ * text: an image of ~400 tokens counts as 18,000 and a summarizer reads (and is
+ * truncated into) a wall of base64 instead of knowing a picture was there.
+ *
+ * The label is the part's own `name`, else its file id, else its media type.
+ */
+declare function describeContentPart(part: unknown): string | undefined;
+/**
+ * One content part as plain text: strings and text parts as they are, media as
+ * its placeholder, anything else through `fallback` (default: its own `text` /
+ * `content`, else its JSON).
+ */
+declare function contentPartToText(part: unknown, fallback?: (part: unknown) => string): string;
 declare function contentToString(content: string | ContentPart$1[] | any): string;
 declare function extractMessageText(message: any): string;
 /**
@@ -1801,12 +1833,28 @@ type AgentRuntimeConfig = {
     smart?: ResolvedSmartAgentConfig;
     humanInTheLoop?: HumanInTheLoopRuntimeConfig;
 };
+/** One part of a message as it was sent: text, or an attachment (image, audio, file …). */
+type TraceMessagePart = {
+    type?: string;
+    text?: string;
+    [key: string]: any;
+};
 type TraceMessageSection = {
     id?: string;
     kind: "message";
     label: string;
     role: string;
+    /**
+     * The message as text. An attachment appears in it as a short placeholder
+     * (`[image: photo.png]`), never as its encoded payload.
+     */
     content: string;
+    /**
+     * The message's structured parts, present only when it carries a non-text part
+     * (an image, audio, a file). Lets a host render the attachment — a thumbnail —
+     * where `content` can only name it. Text parts are included, in order.
+     */
+    parts?: TraceMessagePart[];
     metadata?: Record<string, any>;
 };
 type TraceToolCallSection = {
@@ -2355,6 +2403,11 @@ type StreamEvent = {
     text: string;
     isFinal?: boolean;
 };
+/** Incremental model reasoning text (providers that expose it while streaming). */
+type ReasoningEvent = {
+    type: "reasoning";
+    text: string;
+};
 type CancelledEvent = {
     type: "cancelled";
     stage?: string;
@@ -2533,7 +2586,7 @@ type DelegationEventStamp = {
     /** Name of the `asTool` child agent this forwarded event came from. */
     delegatedTo?: string;
 };
-type SmartAgentEvent = (ToolCallEvent | ToolApprovalEvent | UserQuestionEvent | PlanEvent | SummarizationEvent | FinalAnswerEvent | MetadataEvent | HandoffEvent | GuardrailEvent | ProgressEvent | StreamEvent | CancelledEvent | SubagentEvent | ReflectionEvent | PluginEvent) & DelegationEventStamp;
+type SmartAgentEvent = (ToolCallEvent | ToolApprovalEvent | UserQuestionEvent | PlanEvent | SummarizationEvent | FinalAnswerEvent | MetadataEvent | HandoffEvent | GuardrailEvent | ProgressEvent | StreamEvent | ReasoningEvent | CancelledEvent | SubagentEvent | ReflectionEvent | PluginEvent) & DelegationEventStamp;
 type ReflectionEvent = {
     type: "reflection";
     id: string;
@@ -3255,596 +3308,305 @@ type CreateGuardrailOptions = {
 };
 declare function createGuardrail(options: CreateGuardrailOptions): ConversationGuardrail;
 
-type RegexRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    pattern: RegExp | string;
-    flags?: string;
-    matchDisposition?: GuardrailDisposition;
-    selector?: (context: GuardrailContext) => string;
-    allowIfMatch?: boolean;
-    failureMessage?: string;
+type MessageRole = "system" | "user" | "assistant" | "tool";
+type TextContent = {
+    type: "text";
+    text: string;
 };
-declare function regexRule(options: RegexRuleOptions): GuardrailRule;
-type JsonSchemaRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    schema: JSONSchema7 | z.ZodTypeAny;
-    selector?: (context: GuardrailContext) => string;
-    disposition?: GuardrailDisposition;
-    allowOnParseError?: boolean;
+type ImageContent = {
+    type: "image";
+    source: {
+        type: "base64";
+        mediaType: string;
+        data: string;
+    } | {
+        type: "url";
+        url: string;
+        mediaType?: string;
+    };
 };
-declare function jsonSchemaRule(options: JsonSchemaRuleOptions): GuardrailRule;
-type CodeDetectionRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    selector?: (context: GuardrailContext) => string;
-    disposition?: GuardrailDisposition;
-    allowList?: Array<RegExp | string>;
+/**
+ * A document attachment (PDF, DOCX, CSV, …). Providers map this to their
+ * native document blocks: Gemini `inlineData`/`fileData`, Anthropic
+ * `document`, OpenAI Chat Completions `file` / Responses `input_file`,
+ * Bedrock Converse `document`. Providers without document support degrade
+ * to a text placeholder referencing the file name/URL.
+ */
+type FileContent = {
+    type: "file";
+    source: {
+        type: "base64";
+        mediaType: string;
+        data: string;
+    } | {
+        type: "url";
+        url: string;
+        mediaType?: string;
+    };
+    /** Original file name, when known (required by some providers, e.g. Bedrock). */
+    fileName?: string;
 };
-declare function codePresenceRule(options?: CodeDetectionRuleOptions): GuardrailRule;
-declare const guardianSchema: z.ZodObject<{
-    allow: z.ZodBoolean;
-    disposition: z.ZodOptional<z.ZodEnum<["allow", "warn", "block"]>>;
-    reason: z.ZodOptional<z.ZodString>;
-    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-}, "strip", z.ZodTypeAny, {
-    allow: boolean;
-    reason?: string | undefined;
-    disposition?: "allow" | "block" | "warn" | undefined;
-    details?: Record<string, any> | undefined;
-}, {
-    allow: boolean;
-    reason?: string | undefined;
-    disposition?: "allow" | "block" | "warn" | undefined;
-    details?: Record<string, any> | undefined;
-}>;
-type AgentRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    agent: SmartAgentInstance<z.infer<typeof guardianSchema>>;
-    systemPrompt?: string;
-    payloadBuilder?: (context: GuardrailContext) => string;
-    dispositionFallback?: GuardrailDisposition;
+/**
+ * An audio attachment. Gemini accepts it as `inlineData`/`fileData`; OpenAI
+ * audio-capable models as `input_audio`. Providers without audio support
+ * degrade to a text placeholder.
+ */
+type AudioContent = {
+    type: "audio";
+    source: {
+        type: "base64";
+        mediaType: string;
+        data: string;
+    } | {
+        type: "url";
+        url: string;
+        mediaType?: string;
+    };
 };
-declare function agentVerdictRule(options: AgentRuleOptions): GuardrailRule;
-type CustomRuleCallback = (context: GuardrailContext) => boolean | {
-    allow: boolean;
-    reason?: string;
-    disposition?: GuardrailDisposition;
-    details?: Record<string, any>;
-} | Promise<boolean | {
-    allow: boolean;
-    reason?: string;
-    disposition?: GuardrailDisposition;
-    details?: Record<string, any>;
-}>;
-type CustomRuleOptions = {
-    id?: string;
-    title?: string;
-    description?: string;
-    callback: CustomRuleCallback;
-    defaultDisposition?: GuardrailDisposition;
+type ContentPart = TextContent | ImageContent | FileContent | AudioContent;
+type ToolCall = {
+    id: string;
+    name: string;
+    arguments: string;
+    /** Gemini `thoughtSignature` attached to a functionCall part; must be echoed back on the next turn. */
+    thoughtSignature?: string;
+    /** Position of the call within the assistant turn. Set on streamed deltas so a consumer can frame them (OpenAI `tool_calls[].index`). */
+    index?: number;
 };
-declare function customCallbackRule(options: CustomRuleOptions): GuardrailRule;
-
-type GuardrailPresetBase = {
-    guardrailId?: string;
-    guardrailTitle?: string;
-    guardrailDescription?: string;
-    phases?: GuardrailPhase[];
-    haltOnViolation?: boolean;
-    onViolation?: ConversationGuardrail["onViolation"];
-    metadata?: Record<string, any>;
+/**
+ * A provider-native reasoning/thinking block. Captured from the model response
+ * and replayed verbatim on subsequent turns (required by Anthropic extended
+ * thinking when tools are involved — the `signature` must round-trip intact).
+ */
+type ReasoningBlock = {
+    type: "thinking" | "redacted_thinking";
+    /** Plain-text thinking content (absent for redacted blocks). */
+    text?: string;
+    /** Cryptographic signature Anthropic requires to be echoed back verbatim. */
+    signature?: string;
+    /** Opaque payload for redacted_thinking blocks. */
+    data?: string;
 };
-type RegexGuardrailOptions = GuardrailPresetBase & {
-    rule?: Omit<RegexRuleOptions, "pattern">;
+/** Captured reasoning payload attached to assistant turns / responses. */
+type ReasoningPayload = {
+    /** Verbatim provider blocks to replay on the next turn. */
+    blocks?: ReasoningBlock[];
+    /** Human-readable reasoning summary, when the provider exposes one. */
+    summary?: string;
 };
-declare function createRegexGuardrail(pattern: RegExp | string, options?: RegexGuardrailOptions): ConversationGuardrail;
-type JsonGuardrailOptions = GuardrailPresetBase & {
-    rule?: Omit<JsonSchemaRuleOptions, "schema">;
+type UnifiedMessage = {
+    role: MessageRole;
+    content: string | ContentPart[];
+    name?: string;
+    toolCalls?: ToolCall[];
+    toolCallId?: string;
+    /** Native reasoning blocks to replay verbatim (Anthropic/Bedrock thinking). */
+    reasoning?: ReasoningPayload;
 };
-declare function createJsonGuardrail(schema: JsonSchemaRuleOptions["schema"], options?: JsonGuardrailOptions): ConversationGuardrail;
-type CodeGuardrailOptions = GuardrailPresetBase & {
-    rule?: CodeDetectionRuleOptions;
+type ToolDefinition = {
+    name: string;
+    description: string;
+    parameters: Record<string, any>;
+    strict?: boolean;
+};
+type ChatCompletionRequest = {
+    model: string;
+    messages: UnifiedMessage[];
+    temperature?: number;
+    maxTokens?: number;
+    topP?: number;
+    stop?: string[];
+    /** OpenAI-family only; other providers ignore it. */
+    presencePenalty?: number;
+    /** OpenAI-family only; other providers ignore it. */
+    frequencyPenalty?: number;
+    tools?: ToolDefinition[];
+    toolChoice?: "auto" | "required" | "none" | {
+        name: string;
+    };
+    responseFormat?: {
+        type: "json_schema" | "json_object" | "text";
+        schema?: Record<string, any>;
+        name?: string;
+    };
+    stream?: boolean;
+    /**
+     * Streaming only. `false` opts out of `stream_options.include_usage` on
+     * OpenAI-shaped endpoints (some servers reject the option). Default true.
+     */
+    streamUsage?: boolean;
+    /** OpenAI-family: deterministic sampling seed. Passed through. */
+    seed?: number;
+    /** OpenAI-family: number of choices. Pass-through only; only choice 0 is parsed. */
+    n?: number;
+    /** OpenAI-family: allow/forbid parallel tool calls. Passed through when set. */
+    parallelToolCalls?: boolean;
+    /** OpenAI-family: return token log probabilities. Passed through. */
+    logprobs?: boolean;
+    /** OpenAI-family: how many top log probabilities per token. Passed through. */
+    topLogprobs?: number;
+    extra?: Record<string, any>;
+    /**
+     * Unified native-reasoning request config. Each provider maps this to its
+     * own shape:
+     *  - OpenAI o-series:   body.reasoning_effort = effort
+     *  - OpenAI Responses:  body.reasoning = { effort }
+     *  - Anthropic:         body.thinking  = { type: "enabled", budget_tokens }
+     *  - Google / Vertex:   body.generationConfig.thinkingConfig = { thinkingBudget, includeThoughts }
+     *
+     * Providers silently ignore unsupported fields.
+     */
+    reasoning?: ReasoningRequestConfig;
+    /**
+     * Cancels the HTTP request (and an in-flight stream) when it aborts. The agent
+     * loop sets it from the run's cancellation token / abort signal; a caller using
+     * a provider directly can pass its own. It is never serialised into the body.
+     */
+    signal?: AbortSignal;
 };
-declare function createCodeGuardrail(options?: CodeGuardrailOptions): ConversationGuardrail;
-
-/**
- * Wrap a plugin factory so config flows through with full inference:
- *
- *   const myGuard = definePlugin<{ level: number }>((cfg) => ({ name: "my-guard", ... }));
- *   myGuard({ level: 2 })
- *
- * The indirection buys nothing at runtime — it exists so the config type is
- * inferred at the call site and the returned object is checked against
- * `AgentPlugin` at the definition site, where the error message is useful.
- */
-declare function definePlugin<TConfig = void>(factory: (config: TConfig) => AgentPlugin): (config: TConfig) => AgentPlugin;
 /**
- * A single hook, packaged as a plugin. For the common case where naming and a
- * lifecycle would be ceremony:
+ * `none` is OFF, and it is a value rather than the absence of one.
  *
- *   defineHook("preToolUse", ({ toolName }) => toolName === "shell" ? { decision: "ask" } : undefined)
+ * On a thinking-by-default model — every Qwen3 under vLLM, gpt-5.1 and newer on
+ * OpenAI — sending no reasoning field leaves the model thinking. So "do not
+ * think" is an instruction that has to travel: `reasoning_effort:"none"` on
+ * OpenAI, `thinkingBudget:0` on Gemini, and no thinking block at all on
+ * Anthropic (where thinking is opt-in and the absence IS off). Omitting
+ * `effort` still means "say nothing about reasoning", which is the different
+ * and equally necessary state.
  */
-declare function defineHook<K extends HookName>(hook: K, handler: HookHandler<K>, opts?: {
-    name?: string;
-    priority?: number;
-    failureMode?: PluginFailureMode;
-    timeoutMs?: number;
-    inheritToSubagents?: boolean;
+type ReasoningEffort = "none" | "minimal" | "low" | "medium" | "high";
+type ReasoningRequestConfig = {
+    /** Qualitative effort hint (mapped per-provider). */
+    effort?: ReasoningEffort;
+    /** Explicit per-call token budget for reasoning/thinking. */
+    budgetTokens?: number;
     /**
-     * Declare that this hook never returns `decision: "ask"`. Without it a
-     * `preToolUse` hook is assumed to be able to pause, and the whole tool
-     * batch is scheduled serially — silently costing an agent its parallel
-     * tool execution.
+     * Gemini 3 style discrete thinking level (e.g. "low" | "high"). Sent as
+     * `thinkingConfig.thinkingLevel` and replaces the derived `thinkingBudget`
+     * (the API rejects both together). Ignored by other providers.
      */
-    mayRequireApproval?: boolean;
-}): AgentPlugin;
-
-/**
- * What this build actually implements.
- *
- * A policy configured as `mode: "enforce"` whose hook is never called is worse
- * than no policy: the console shows a control that does not exist. A host
- * cannot infer that from the type surface, because a declared hook and a wired
- * one look identical to TypeScript — so the runtime states it.
- *
- * This table is maintained BY HAND alongside the wiring. That is deliberate:
- * deriving it from the registry would only prove that a handler was registered,
- * not that any call site raises it, which is precisely the failure it exists to
- * make visible.
- */
-
-/**
- * Bumped when the hook contract changes shape in a way a host must notice —
- * a hook gains or loses a call site, a payload field changes meaning, a slot
- * starts or stops being consumed. Independent of the package version.
- */
-declare const HOOK_CONTRACT_VERSION = 1;
-type CapabilityStatus = {
-    /** True when a call site in the runtime actually raises this. */
-    implemented: boolean;
-    /** Why not, or what the caveat is. */
-    notes?: string;
+    thinkingLevel?: string;
+    /** Whether the provider should expose its reasoning/thought summary to the caller. Gemini: default false. Claude adaptive thinking (5.x): default summarized (`thinking.display = "summarized"`) unless this is `false`; never added when the caller passes an explicit `extra.thinking`. */
+    includeThoughts?: boolean;
+    /** Provider-specific passthrough merged on top of the mapped shape. */
+    providerExtras?: Record<string, any>;
 };
-type SdkCapabilities = {
-    hookContractVersion: number;
-    hooks: Record<HookName, CapabilityStatus>;
-    slots: Record<SlotName, CapabilityStatus>;
-    features: Record<string, CapabilityStatus>;
+type TokenUsage = {
+    inputTokens: number;
+    outputTokens: number;
+    totalTokens: number;
+    cachedInputTokens: number;
+    cachedWriteTokens: number;
+    cachedOutputTokens: number;
+    reasoningTokens: number;
 };
-/**
- * Hook ids used by the Cognipeer Console's guardrail plane, mapped onto this
- * SDK's hooks.
- *
- * The Console plane originally had one input stage, which collapsed two
- * moments that behave differently: `userPromptSubmit` fires ONCE for a new
- * user turn and can see attachments, while `preModelCall` fires before EVERY
- * provider call — which is where the legacy `GuardrailPhase.Request` actually
- * ran. A policy meant to vet what a person typed wants the first; one meant to
- * vet every prompt reaching the model, including turns built from tool output,
- * wants the second. Mapping both to one id silently changes how often the
- * policy runs, and on a moderation-model guardrail that is a cost as well as a
- * semantics bug.
- *
- * The Console added `prompt.pre` for the first and kept `input.pre` meaning
- * the second, so every id below is single-valued.
- */
-declare const CONSOLE_HOOK_MAP: Readonly<Record<string, HookName | null>>;
-/** What this build implements. Safe to call at any time; allocates a fresh copy. */
-declare function pluginCapabilities(): SdkCapabilities;
-/** Convenience for a host that only wants to know whether it can enforce. */
-declare function isHookImplemented(hook: HookName): boolean;
-
-/**
- * Guardrail transport + the plugin that drives it.
- *
- * Layered the way tracing sinks are layered — a transport seam, a generic HTTP
- * implementation, an in-process escape hatch, and thin first-party presets on
- * top (see `cognipeerGuardrail`, `portkeyGuardrail`). What is deliberately NOT
- * copied from tracing is its retry policy: a trace post can afford four
- * attempts at an 8s timeout because nothing waits on it, while a guardrail sits
- * on the critical path of every turn and the same policy would stall an agent
- * for half a minute.
- */
-
-/**
- * `tool` is the ARGUMENTS a model wants to run; `tool_result` is what came
- * back. They are different surfaces with different risks — one is an action
- * about to happen, the other is untrusted content entering the context — and a
- * policy usually wants different rules for each.
- */
-type GuardrailPhaseName = "input" | "output" | "tool" | "tool_result";
-type GuardrailRequest = {
-    phase: GuardrailPhaseName;
-    content: string;
-    /** Tool name for `tool` / `tool_result`, otherwise unset. */
-    subject?: string;
-    /** The SDK hook this check was raised from, so a preset can map it exactly. */
-    hook?: string;
-    /** Structured tool arguments, for a service that wants them un-stringified. */
-    toolArgs?: unknown;
-    /** The tool's return value, for `tool_result`. */
-    toolResult?: unknown;
+declare function emptyUsage(): TokenUsage;
+type FinishReason = "stop" | "tool_calls" | "length" | "content_filter" | "error";
+type ProviderResponseFields = {
+    system_fingerprint?: string;
+    service_tier?: string;
+    annotations?: any[];
+    refusal?: string | null;
+    logprobs?: any;
+    [key: string]: any;
+};
+type ChatCompletionResponse = {
+    id: string;
+    model: string;
+    content: string | null;
+    toolCalls: ToolCall[];
+    usage: TokenUsage;
+    finishReason: FinishReason;
+    /** The provider's own finish/stop reason string, unnormalised (e.g. "end_turn", "function_call"). */
+    rawFinishReason?: string;
     /**
-     * Non-text parts of the turn — images, audio, video, files. A text-only
-     * policy sees the caption and nothing else, so a service that moderates
-     * media needs these; one that does not simply ignores the field.
-     *
-     * Inline payloads are DESCRIBED (kind, media type, size) rather than
-     * inlined: shipping a base64 image on every check would multiply the cost of
-     * the guardrail by the size of the upload. A service that needs the bytes
-     * should take a URL, or the caller should override `buildRequest`.
+     * Provider response fields the unified shape has no slot for, kept when present:
+     * `system_fingerprint`, `service_tier`, `annotations`, `refusal`, `logprobs`.
      */
-    attachments?: MediaAttachment[];
-    metadata?: Record<string, unknown>;
+    providerFields?: ProviderResponseFields;
+    /** Native reasoning blocks + summary captured from the response, if any. */
+    reasoning?: ReasoningPayload;
+    raw: any;
 };
-type GuardrailViolation = {
-    id?: string;
-    type?: string;
-    severity?: string;
-    detail?: string;
+type ChatCompletionChunk = {
+    id: string;
+    model: string;
+    delta: {
+        content?: string;
+        toolCalls?: Partial<ToolCall>[];
+        /** Incremental reasoning text / signature deltas (Anthropic thinking). */
+        reasoning?: ReasoningPayload;
+    };
+    usage?: TokenUsage;
+    finishReason?: FinishReason;
+    /** The provider's own finish reason string, unnormalised. Present on the chunk that carries it. */
+    rawFinishReason?: string;
+    /** See ChatCompletionResponse.providerFields; per-chunk (fingerprint, tier, delta refusal/annotations, logprobs). */
+    providerFields?: ProviderResponseFields;
+};
+/** Why the text is being embedded; mapped to each provider's own task/input type. */
+type EmbeddingInputType = "search_document" | "search_query" | "classification" | "clustering" | "semantic_similarity" | "question_answering" | "fact_verification" | "code_retrieval_query" | (string & {});
+type EmbeddingRequest = {
+    /** Model id (OpenAI/compatible), deployment name (Azure), model id (Bedrock), model name (Vertex). */
+    model: string;
+    /** Texts to embed. One vector per entry, in the same order. */
+    input: string[];
+    /** Requested output dimensions, for models that support shortening (OpenAI v3, Titan v2, Cohere v4, Gemini). */
+    dimensions?: number;
+    /** OpenAI-shaped endpoints: wire encoding. Vectors are always returned as number[] either way. */
+    encodingFormat?: "float" | "base64";
+    /** Task hint (Cohere on Bedrock, Gemini on Vertex). Ignored by providers without one. */
+    inputType?: EmbeddingInputType;
+    /** Max texts per HTTP request. Defaults per provider (OpenAI 2048, Vertex 100, Gemini-embedding 1, Titan 1). */
+    batchSize?: number;
+    /** Provider-specific fields merged into each request body (escape hatch). */
+    extra?: Record<string, any>;
+    signal?: AbortSignal;
 };
-type GuardrailVerdict = {
-    action: "allow" | "block" | "mask";
-    message?: string;
-    /** Required when `action === "mask"`. */
-    maskedContent?: string;
-    violations?: GuardrailViolation[];
-    /** The untouched service response, for tracing and debugging. */
-    raw?: unknown;
+type EmbeddingUsage = {
+    inputTokens: number;
+    totalTokens: number;
 };
-type GuardrailCallContext = {
-    runId: string;
-    agentName?: string;
-    /** Correlates a guardrail decision with the trace session in the console UI. */
-    traceId?: string;
-    signal?: AbortSignal;
+type EmbeddingResponse = {
+    model: string;
+    /** One vector per input, in input order. */
+    vectors: number[][];
+    usage: EmbeddingUsage;
+    /** Raw provider responses, one per HTTP request made. */
+    raw: any[];
 };
-type GuardrailTransport = {
-    name: string;
-    /** Verdicts must come back in the same order as `requests`. */
-    evaluate(requests: GuardrailRequest[], ctx: GuardrailCallContext): MaybePromise<GuardrailVerdict[]>;
-    /**
-     * Optional setup-time handshake. When a service can say which phases carry
-     * active rules, every other phase skips the network entirely — usually the
-     * single biggest latency win available here.
-     */
-    describe?: () => MaybePromise<{
-        activePhases?: GuardrailPhaseName[];
-    } | null | undefined>;
-    close?: () => MaybePromise<void>;
+type ProviderRetryConfig = {
+    /** Maximum retries on 429/5xx (default 3). */
+    maxRetries?: number;
+    /** Initial delay between retries in ms (default 500, doubled each attempt). */
+    baseDelayMs?: number;
+    /** Hard cap on a single retry delay in ms (default 8000). */
+    maxDelayMs?: number;
+    /** Custom predicate to opt in/out of a specific retry. */
+    shouldRetry?: (error: any, attempt: number) => boolean;
 };
-type HttpGuardrailOptions = {
-    url: string;
-    /** Static headers, or a thunk so a rotating token is read per call. */
-    headers?: Record<string, string> | (() => Record<string, string>);
-    /** Hard ceiling per attempt. Default 3000ms — this is on the critical path. */
-    timeoutMs?: number;
-    /** Retries after the first attempt. Default 1. */
-    retries?: number;
-    /** Send all pending checks in one request. Default true. */
-    batch?: boolean;
-    /** Override the wire request. Default: `{ items, runId, traceId }`. */
-    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
-    /** Override response mapping. Default: `normalizeVerdicts`, which is forgiving. */
-    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
+/** Transport options shared by every provider config. */
+type ProviderTransportConfig = {
     /**
-     * Status codes that carry a VERDICT rather than an error. Some services
-     * signal the outcome in the status line (e.g. 446 for a block); treating
-     * those as transport failures would route a real decision through the
-     * failureMode path with the wrong reason attached.
+     * Custom `fetch` used at EVERY HTTP call site of the provider (chat, stream,
+     * Responses, token exchange). Lets a host inject an SSRF-safe or proxied
+     * fetch. Defaults to the global `fetch`.
      */
-    verdictStatuses?: number[];
-    /** Optional GET endpoint for the setup-time handshake. */
-    describeUrl?: string;
-    name?: string;
-};
-/**
- * Accepts the shapes a guardrail service is likely to return and normalizes
- * them. Being forgiving here is the point: the exact contract can change on the
- * service side without a client release, and a stricter parser would turn a
- * cosmetic field rename into an outage.
- */
-declare function normalizeVerdicts(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
-declare function httpGuardrail(options: HttpGuardrailOptions): GuardrailTransport;
-/** In-process evaluation — regex policies, a local model, Presidio, tests. */
-declare function customGuardrail(evaluate: (request: GuardrailRequest, ctx: GuardrailCallContext) => MaybePromise<GuardrailVerdict | void>, name?: string): GuardrailTransport;
-type GuardrailPluginOptions = {
-    name: string;
-    transport: GuardrailTransport;
-    /** Which surfaces to check. Default: input + output. */
-    apply?: GuardrailPhaseName[];
+    fetch?: typeof fetch;
     /**
-     * `shadow` evaluates and reports but never blocks or masks. This is how a
-     * policy gets rolled out safely: measure what it would have caught first.
+     * Per-request timeout in ms, measured until the response headers arrive
+     * (an established stream is not cut by it). Default: none.
      */
-    mode?: "enforce" | "shadow";
-    /** Block when the service is unreachable. Default true. */
-    failClosed?: boolean;
     timeoutMs?: number;
-    priority?: number;
-    inheritToSubagents?: boolean;
-    /** Memoize verdicts per run. Default true. */
-    cache?: boolean | {
-        maxEntries?: number;
-    };
-    /** Extra metadata attached to every request. */
-    metadata?: Record<string, unknown>;
 };
-declare function createGuardrailPlugin(options: GuardrailPluginOptions): AgentPlugin;
-
-/**
- * Cognipeer Console guardrail — the first-party preset.
- *
- * Talks to the Console's HOOK plane, not its single-shot evaluator:
- *
- *   POST {baseUrl}/api/client/v1/guardrails/hooks/evaluate
- *   Authorization: Bearer <api key>
- *   { hook, guardrail_keys, text?, tool_name?, tool_args?, tool_result?, … }
- *
- * Three properties of that contract shape everything below, and getting any of
- * them wrong turns a working policy into a silent one:
- *
- *   `decision`  is the EFFECTIVE verdict, already neutralised in monitor mode.
- *               Priority runs block > redact > warn > flag > allow.
- *   `enforced`  false means the decision was NOT applied — a dry run. Blocking
- *               on `decision === "block"` without checking this turns every
- *               monitoring policy into an enforcing one on the day it is
- *               switched on for observation.
- *   `passed`    means "no blocking finding", NOT "the request was allowed".
- *               The two diverge in monitor mode, which is exactly when someone
- *               reads the wrong one.
- *
- * `subject` (or `redacted_text` for the text case) is filled only when the
- * service actually rewrote something; when it is present it REPLACES what was
- * sent rather than being merged with it.
- *
- * The endpoint answers 200 for a finding as readily as for a clean check, and
- * only emits 246/446 when a guardrail opts into verdict status codes — so both
- * are declared as verdict-carrying rather than treated as transport failures.
- * An unknown key answers 404 ON PURPOSE: a vacuous allow read as "content is
- * safe" is the failure the whole plane exists to avoid.
- */
-
-type CognipeerGuardrailConfig = {
-    /** Guardrail keys from the Console. Defaults to `COGNIPEER_GUARDRAIL_KEYS` (comma-separated). */
-    guardrailKeys?: string[];
-    /** Convenience for the single-key case. */
-    guardrailKey?: string;
-    /** Defaults to `COGNIPEER_API_KEY`. */
-    apiKey?: string;
-    /** Defaults to `COGNIPEER_BASE_URL`, then the production console. Point at localhost for local runs. */
-    baseUrl?: string;
-    /** Override the hook-evaluate path. */
-    path?: string;
-    /** Surfaces to guard. Default: input + output. Add `"tool"` / `"tool_result"` for the tool surface. */
-    apply?: GuardrailPhaseName[];
-    /** Restrict to specific check families, e.g. `["pii"]`. */
-    only?: string[];
-    /** Override the SDK-hook → Console-hook-id mapping, merged over the default. */
-    hookIds?: Record<string, string>;
-    /** Ask the service to evaluate without enforcing. Independent of `mode`. */
-    shadow?: boolean;
-    /** `shadow` here reports locally without acting, whatever the service says. */
-    mode?: "enforce" | "shadow";
-    /** Default true — an unreachable or misconfigured policy blocks rather than silently stops guarding. */
-    failClosed?: boolean;
-    /** Per-check ceiling. Default 3000ms; also sent as `budget_ms`. */
-    timeoutMs?: number;
-    retries?: number;
-    priority?: number;
-    cache?: boolean | {
-        maxEntries?: number;
-    };
-    metadata?: Record<string, unknown>;
-    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
-    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
-    name?: string;
-};
-/** The Console's hook response, mapped onto the transport's three-valued verdict. */
-declare function mapConsoleHookVerdict(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
-declare function cognipeerGuardrail(config?: CognipeerGuardrailConfig): AgentPlugin;
-
-type MessageRole = "system" | "user" | "assistant" | "tool";
-type TextContent = {
-    type: "text";
-    text: string;
-};
-type ImageContent = {
-    type: "image";
-    source: {
-        type: "base64";
-        mediaType: string;
-        data: string;
-    } | {
-        type: "url";
-        url: string;
-        mediaType?: string;
-    };
-};
-/**
- * A document attachment (PDF, DOCX, CSV, …). Providers map this to their
- * native document blocks: Gemini `inlineData`/`fileData`, Anthropic
- * `document`, OpenAI Chat Completions `file` / Responses `input_file`,
- * Bedrock Converse `document`. Providers without document support degrade
- * to a text placeholder referencing the file name/URL.
- */
-type FileContent = {
-    type: "file";
-    source: {
-        type: "base64";
-        mediaType: string;
-        data: string;
-    } | {
-        type: "url";
-        url: string;
-        mediaType?: string;
-    };
-    /** Original file name, when known (required by some providers, e.g. Bedrock). */
-    fileName?: string;
-};
-/**
- * An audio attachment. Gemini accepts it as `inlineData`/`fileData`; OpenAI
- * audio-capable models as `input_audio`. Providers without audio support
- * degrade to a text placeholder.
- */
-type AudioContent = {
-    type: "audio";
-    source: {
-        type: "base64";
-        mediaType: string;
-        data: string;
-    } | {
-        type: "url";
-        url: string;
-        mediaType?: string;
-    };
-};
-type ContentPart = TextContent | ImageContent | FileContent | AudioContent;
-type ToolCall = {
-    id: string;
-    name: string;
-    arguments: string;
-};
-/**
- * A provider-native reasoning/thinking block. Captured from the model response
- * and replayed verbatim on subsequent turns (required by Anthropic extended
- * thinking when tools are involved — the `signature` must round-trip intact).
- */
-type ReasoningBlock = {
-    type: "thinking" | "redacted_thinking";
-    /** Plain-text thinking content (absent for redacted blocks). */
-    text?: string;
-    /** Cryptographic signature Anthropic requires to be echoed back verbatim. */
-    signature?: string;
-    /** Opaque payload for redacted_thinking blocks. */
-    data?: string;
-};
-/** Captured reasoning payload attached to assistant turns / responses. */
-type ReasoningPayload = {
-    /** Verbatim provider blocks to replay on the next turn. */
-    blocks?: ReasoningBlock[];
-    /** Human-readable reasoning summary, when the provider exposes one. */
-    summary?: string;
-};
-type UnifiedMessage = {
-    role: MessageRole;
-    content: string | ContentPart[];
-    name?: string;
-    toolCalls?: ToolCall[];
-    toolCallId?: string;
-    /** Native reasoning blocks to replay verbatim (Anthropic/Bedrock thinking). */
-    reasoning?: ReasoningPayload;
-};
-type ToolDefinition = {
-    name: string;
-    description: string;
-    parameters: Record<string, any>;
-    strict?: boolean;
-};
-type ChatCompletionRequest = {
-    model: string;
-    messages: UnifiedMessage[];
-    temperature?: number;
-    maxTokens?: number;
-    topP?: number;
-    stop?: string[];
-    tools?: ToolDefinition[];
-    toolChoice?: "auto" | "required" | "none" | {
-        name: string;
-    };
-    responseFormat?: {
-        type: "json_schema" | "json_object" | "text";
-        schema?: Record<string, any>;
-        name?: string;
-    };
-    stream?: boolean;
-    extra?: Record<string, any>;
+type OpenAIProviderConfig = ProviderTransportConfig & {
     /**
-     * Unified native-reasoning request config. Each provider maps this to its
-     * own shape:
-     *  - OpenAI o-series:   body.reasoning_effort = effort
-     *  - OpenAI Responses:  body.reasoning = { effort }
-     *  - Anthropic:         body.thinking  = { type: "enabled", budget_tokens }
-     *  - Google / Vertex:   body.generationConfig.thinkingConfig = { thinkingBudget, includeThoughts }
-     *
-     * Providers silently ignore unsupported fields.
+     * Which token-limit field to send: `max_tokens` or `max_completion_tokens`.
+     * `auto` (default) uses `max_completion_tokens` for o-series / gpt-5 models
+     * and `max_tokens` otherwise.
      */
-    reasoning?: ReasoningRequestConfig;
-};
-/**
- * `none` is OFF, and it is a value rather than the absence of one.
- *
- * On a thinking-by-default model — every Qwen3 under vLLM, gpt-5.1 and newer on
- * OpenAI — sending no reasoning field leaves the model thinking. So "do not
- * think" is an instruction that has to travel: `reasoning_effort:"none"` on
- * OpenAI, `thinkingBudget:0` on Gemini, and no thinking block at all on
- * Anthropic (where thinking is opt-in and the absence IS off). Omitting
- * `effort` still means "say nothing about reasoning", which is the different
- * and equally necessary state.
- */
-type ReasoningEffort = "none" | "minimal" | "low" | "medium" | "high";
-type ReasoningRequestConfig = {
-    /** Qualitative effort hint (mapped per-provider). */
-    effort?: ReasoningEffort;
-    /** Explicit per-call token budget for reasoning/thinking. */
-    budgetTokens?: number;
-    /** Whether the provider should expose its reasoning/thought summary to the caller. Default false. */
-    includeThoughts?: boolean;
-    /** Provider-specific passthrough merged on top of the mapped shape. */
-    providerExtras?: Record<string, any>;
-};
-type TokenUsage = {
-    inputTokens: number;
-    outputTokens: number;
-    totalTokens: number;
-    cachedInputTokens: number;
-    cachedWriteTokens: number;
-    cachedOutputTokens: number;
-    reasoningTokens: number;
-};
-declare function emptyUsage(): TokenUsage;
-type FinishReason = "stop" | "tool_calls" | "length" | "content_filter" | "error";
-type ChatCompletionResponse = {
-    id: string;
-    model: string;
-    content: string | null;
-    toolCalls: ToolCall[];
-    usage: TokenUsage;
-    finishReason: FinishReason;
-    /** Native reasoning blocks + summary captured from the response, if any. */
-    reasoning?: ReasoningPayload;
-    raw: any;
-};
-type ChatCompletionChunk = {
-    id: string;
-    model: string;
-    delta: {
-        content?: string;
-        toolCalls?: Partial<ToolCall>[];
-        /** Incremental reasoning text / signature deltas (Anthropic thinking). */
-        reasoning?: ReasoningPayload;
-    };
-    usage?: TokenUsage;
-    finishReason?: FinishReason;
-};
-type ProviderRetryConfig = {
-    /** Maximum retries on 429/5xx (default 3). */
-    maxRetries?: number;
-    /** Initial delay between retries in ms (default 500, doubled each attempt). */
-    baseDelayMs?: number;
-    /** Hard cap on a single retry delay in ms (default 8000). */
-    maxDelayMs?: number;
-    /** Custom predicate to opt in/out of a specific retry. */
-    shouldRetry?: (error: any, attempt: number) => boolean;
-};
-type OpenAIProviderConfig = {
+    maxTokensParam?: "auto" | "max_tokens" | "max_completion_tokens";
     provider: "openai";
     apiKey: string;
     baseURL?: string;
@@ -3853,9 +3615,13 @@ type OpenAIProviderConfig = {
     defaultHeaders?: Record<string, string>;
     retry?: ProviderRetryConfig;
     /**
+     * @deprecated Use `api: "chat" | "responses" | "auto"`. Kept as an alias:
+     * `never` = chat, `always` = responses, `auto` = the name-based heuristic.
+     * When `api` is also set, `api` wins.
+     *
      * WHICH API a reasoning-carrying request is addressed to.
      *
-     *  auto    (default, and today's behaviour) route to the Responses API when
+     *  auto    (the default for OpenAI and Azure) route to the Responses API when
      *          the request carries `reasoning` AND the model name looks like an
      *          o-series/gpt-5 reasoning model.
      *  never   always Chat Completions. `reasoning` is still mapped, as
@@ -3874,9 +3640,25 @@ type OpenAIProviderConfig = {
      * where it matters most: a self-hosted model is named by whoever served it.
      */
     responsesApi?: "auto" | "never" | "always";
+    /** @internal Set by OpenAICompatibleProvider: `auto` then means Chat Completions. */
+    _autoMeansChat?: boolean;
+    /**
+     * Which upstream API requests are sent to. `"auto"` (default) keeps the
+     * 0.11 behaviour of each class: OpenAI and Azure use Responses when the
+     * request carries `reasoning` and the model name looks like an o-series /
+     * gpt-5 model, otherwise Chat Completions; OpenAI-compatible always uses
+     * Chat Completions (the model name is the server operator's). `"chat"` always
+     * sends Chat Completions. `"responses"`
+     * sends every request to the Responses API (`POST /responses`) and streams it
+     * over real SSE (text, tool-call arguments and reasoning-summary deltas;
+     * set `responsesStreaming: false` to get one non-streaming call instead).
+     * Works on `OpenAIProvider`, `AzureProvider` and `OpenAICompatibleProvider`.
+     * When set, it wins over the deprecated `responsesApi`.
+     */
+    api?: "chat" | "responses" | "auto";
     /**
      * Models that go to the Responses API, named explicitly. Opt-in; unset by
-     * default, and nothing here is inferred from a model name.
+     * default.
      *
      * A string matches the request's model (or `defaultModel`) exactly; a RegExp
      * is tested against it. A match routes the request to Responses whether or
@@ -3894,86 +3676,654 @@ type OpenAIProviderConfig = {
      *    `stream_options.include_usage` dropped.
      *  - real SSE streaming, when `responsesStreaming` is also true.
      *
-     * Honoured by `OpenAIProvider` itself only; `AzureProvider` and
-     * `OpenAICompatibleProvider` ignore it.
+     * Honoured by `OpenAIProvider`, `AzureProvider` and
+     * `OpenAICompatibleProvider` alike.
      */
     responsesApiModels?: Array<string | RegExp>;
     /**
-     * Stream Responses API output as it arrives (text and tool-call argument
-     * deltas) for models in `responsesApiModels`. Default false, which keeps the
-     * existing behaviour: one non-streaming Responses call, emitted as a single
-     * chunk. Has no effect on any other request.
+     * Stream Responses API output as it arrives (text, tool-call argument and
+     * reasoning-summary deltas) for `api: "responses"` and for models in
+     * `responsesApiModels`. Default true with `api: "responses"`, false
+     * otherwise (one non-streaming Responses call emitted as a single chunk).
+     * Has no effect on Chat Completions requests.
+     */
+    responsesStreaming?: boolean;
+};
+type AnthropicProviderConfig = ProviderTransportConfig & {
+    provider: "anthropic";
+    apiKey: string;
+    baseURL?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    anthropicVersion?: string;
+    retry?: ProviderRetryConfig;
+    /**
+     * Prompt caching configuration. When enabled, places cache_control:
+     * ephemeral breakpoints on the system prompt and the final tool definition,
+     * which is the recommended Anthropic recipe for static system + tools.
+     */
+    prompt_caching?: {
+        enabled: boolean;
+    };
+    /**
+     * Thinking request shape. `auto` (default) picks per model id: Claude 5.x
+     * and newer use `thinking:{type:"adaptive"}` + `output_config.effort`, older
+     * models use `thinking:{type:"enabled", budget_tokens}`. Force one with
+     * `adaptive` / `budget`. On the specific 400 for the wrong shape the
+     * provider retries once with the other form.
+     */
+    thinkingMode?: "auto" | "adaptive" | "budget";
+};
+type AzureProviderConfig = ProviderTransportConfig & {
+    provider: "azure";
+    retry?: ProviderRetryConfig;
+    /** See OpenAIProviderConfig.maxTokensParam. */
+    maxTokensParam?: "auto" | "max_tokens" | "max_completion_tokens";
+    apiKey: string;
+    endpoint: string;
+    apiVersion?: string;
+    deploymentName?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    /** See OpenAIProviderConfig.api. Default "auto". */
+    api?: "chat" | "responses" | "auto";
+    /** @deprecated Use `api`. */
+    responsesApi?: "auto" | "never" | "always";
+    responsesApiModels?: Array<string | RegExp>;
+    responsesStreaming?: boolean;
+};
+type OpenAICompatibleProviderConfig = ProviderTransportConfig & {
+    provider: "openai-compatible";
+    organization?: string;
+    retry?: ProviderRetryConfig;
+    /** @deprecated Use `api`. Default: see `api`. */
+    responsesApi?: "auto" | "never" | "always";
+    /** See OpenAIProviderConfig.api. Default "auto". */
+    api?: "chat" | "responses" | "auto";
+    responsesApiModels?: Array<string | RegExp>;
+    responsesStreaming?: boolean;
+    /** See OpenAIProviderConfig.maxTokensParam. Compatible servers default to `auto`. */
+    maxTokensParam?: "auto" | "max_tokens" | "max_completion_tokens";
+    apiKey: string;
+    baseURL: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+};
+type BedrockProviderConfig = ProviderTransportConfig & {
+    provider: "bedrock";
+    region: string;
+    /** Thinking request shape for Claude models: `auto` (by model id), `adaptive` or `budget`. */
+    thinkingMode?: "auto" | "adaptive" | "budget";
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    retry?: ProviderRetryConfig;
+    /**
+     * Insert Bedrock Converse `cachePoint` blocks at the end of the system
+     * prompt and tools list. Only supported by models that implement Converse
+     * prompt caching (most Anthropic Claude variants on Bedrock).
+     */
+    prompt_caching?: {
+        enabled: boolean;
+    };
+};
+type VertexProviderConfig = ProviderTransportConfig & {
+    provider: "vertex";
+    projectId: string;
+    location?: string;
+    accessToken?: string;
+    serviceAccountJson?: string | Record<string, any>;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    /** Retry policy for 429/5xx (default 3 retries, exponential backoff). */
+    retry?: ProviderRetryConfig;
+};
+type JevProviderConfig = ProviderTransportConfig & {
+    provider: "jev";
+    apiKey: string;
+    /** Defaults to https://api.typesafe.ai. */
+    baseURL?: string;
+    defaultModel?: string;
+    defaultHeaders?: Record<string, string>;
+    retry?: ProviderRetryConfig;
+};
+type ProviderConfig = OpenAIProviderConfig | AnthropicProviderConfig | AzureProviderConfig | OpenAICompatibleProviderConfig | BedrockProviderConfig | VertexProviderConfig | JevProviderConfig;
+type ProviderType = ProviderConfig["provider"];
+declare class ProviderError extends Error {
+    readonly provider: string;
+    readonly statusCode?: number | undefined;
+    readonly responseBody?: any | undefined;
+    constructor(message: string, provider: string, statusCode?: number | undefined, responseBody?: any | undefined);
+}
+
+type ProviderRetryPolicy = {
+    /** Maximum number of retries on 429/5xx responses. Default: 3. */
+    maxRetries?: number;
+    /** Initial backoff in ms (doubled on each retry). Default: 500. */
+    baseDelayMs?: number;
+    /** Hard cap on individual delay between retries. Default: 8000. */
+    maxDelayMs?: number;
+    /**
+     * Custom predicate to decide whether to retry. By default we retry 429
+     * and 5xx responses; pass a function to broaden/narrow that set.
+     */
+    shouldRetry?: (error: any, attempt: number) => boolean;
+};
+declare abstract class BaseProvider {
+    abstract readonly providerName: ProviderType;
+    protected retryPolicy: ProviderRetryPolicy;
+    /** Injected `fetch` (config.fetch); falls back to the global one at call time. */
+    protected fetchImpl?: typeof fetch;
+    /** Per-request timeout in ms (config.timeoutMs). Undefined = no timeout. */
+    protected timeoutMs?: number;
+    /** Applies the transport options shared by every provider config. */
+    protected configureTransport(config: {
+        fetch?: typeof fetch;
+        timeoutMs?: number;
+    }): void;
+    /**
+     * The single HTTP entry point for every provider call site. Uses the
+     * configured `fetch` and applies `timeoutMs`: the timer covers the time until
+     * the response HEADERS arrive and is cleared after that, so a long-running
+     * stream is never cut by it (use the request `signal` to cancel a stream).
+     * A timeout surfaces as a `ProviderError` with status 408. The caller's
+     * `signal` still aborts the request as before.
+     */
+    protected httpFetch(url: string, init?: RequestInit): Promise<Response>;
+    /**
+     * Embeds `request.input`. Implemented by the providers that have an
+     * embeddings endpoint (OpenAI, Azure, openai-compatible, Bedrock, Vertex);
+     * the others reject with a 400 ProviderError.
+     */
+    embed(_request: EmbeddingRequest): Promise<EmbeddingResponse>;
+    /** Non-streaming completion */
+    abstract complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
+    /** Streaming completion – yields incremental chunks */
+    abstract completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
+    /**
+     * Helper concrete providers can wrap their fetch with. Retries 429/5xx
+     * with exponential backoff and respects Retry-After if the response
+     * carries one.
+     *
+     * `signal` is the call's cancellation: a run that is cancelled while the
+     * provider is backing off must not sit out the delay, nor start another attempt.
+     */
+    protected doFetchWithRetry(execute: () => Promise<Response>, signal?: AbortSignal): Promise<Response>;
+}
+
+/** A System One question. `noul` asks for the probability of a "yes". */
+type JevQuestion = {
+    type: "noul" | "choice" | "score";
+    instructions?: string;
+    criteria?: unknown;
+};
+type JevSystemOneRequest = {
+    /** The text the questions are asked about. */
+    state: string;
+    questions: Record<string, JevQuestion>;
+    /** Overrides the provider's `defaultModel` for this call. */
+    model?: string;
+};
+type JevSystemOneResult = {
+    readonly model?: string;
+    readonly answers?: Record<string, {
+        readonly type: string;
+        readonly noul?: number;
+        readonly [k: string]: unknown;
+    } | undefined>;
+    readonly usage?: {
+        readonly input_tokens: number;
+        readonly output_tokens: number;
+    };
+};
+declare class JevProvider extends BaseProvider {
+    readonly providerName: ProviderType;
+    private readonly apiKey;
+    private readonly baseURL;
+    private readonly defaultModel?;
+    private readonly defaultHeaders;
+    constructor(config: JevProviderConfig);
+    /** Ask System One questions about `state`. */
+    systemOne(request: JevSystemOneRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<JevSystemOneResult>;
+    complete(_request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
+    completeStream(_request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
+}
+
+type RegexRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    pattern: RegExp | string;
+    flags?: string;
+    matchDisposition?: GuardrailDisposition;
+    selector?: (context: GuardrailContext) => string;
+    allowIfMatch?: boolean;
+    failureMessage?: string;
+};
+declare function regexRule(options: RegexRuleOptions): GuardrailRule;
+type JsonSchemaRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    schema: JSONSchema7 | z.ZodTypeAny;
+    selector?: (context: GuardrailContext) => string;
+    disposition?: GuardrailDisposition;
+    allowOnParseError?: boolean;
+};
+declare function jsonSchemaRule(options: JsonSchemaRuleOptions): GuardrailRule;
+type CodeDetectionRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    selector?: (context: GuardrailContext) => string;
+    disposition?: GuardrailDisposition;
+    allowList?: Array<RegExp | string>;
+};
+declare function codePresenceRule(options?: CodeDetectionRuleOptions): GuardrailRule;
+declare const guardianSchema: z.ZodObject<{
+    allow: z.ZodBoolean;
+    disposition: z.ZodOptional<z.ZodEnum<["allow", "warn", "block"]>>;
+    reason: z.ZodOptional<z.ZodString>;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, "strip", z.ZodTypeAny, {
+    allow: boolean;
+    reason?: string | undefined;
+    disposition?: "allow" | "block" | "warn" | undefined;
+    details?: Record<string, any> | undefined;
+}, {
+    allow: boolean;
+    reason?: string | undefined;
+    disposition?: "allow" | "block" | "warn" | undefined;
+    details?: Record<string, any> | undefined;
+}>;
+/** Which judge backend `agentVerdictRule` uses to produce its verdict. */
+type GuardrailJudgeEngine = "llm" | "jev";
+/** Jev answer for a `noul` (yes/no probability) question. */
+type JevNoulAnswer = {
+    readonly type: "noul";
+    /** Probability of a "yes", from zero to one. */
+    readonly noul: number;
+};
+/**
+ * Anything with the provider's `systemOne` method: a `JevProvider`, or a stub in tests.
+ */
+type JevClientLike = Pick<JevProvider, "systemOne">;
+type JevEngineOptions = {
+    /** Pre-built `JevProvider` (or compatible stub). When set, `apiKey`/`baseURL`/`model` are ignored. */
+    client?: JevClientLike;
+    /** API key for the `JevProvider` built on first use; falls back to `TYPESAFE_API_KEY`. */
+    apiKey?: string;
+    /** API root; falls back to `TYPESAFE_BASE_URL`, then the provider default. */
+    baseURL?: string;
+    /** Model override, per call. */
+    model?: string;
+    /** Risk probability at or above which the message fails the rule. Defaults to 0.5. */
+    threshold?: number;
+    /** Customizes the `noul` question instructions, mirroring `payloadBuilder`. */
+    question?: (context: GuardrailContext) => string;
+    /** Optional descriptions of the yes/no outcomes passed to the `noul` question. */
+    criteria?: {
+        true?: string;
+        false?: string;
+    };
+};
+type AgentRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    /** Guardian agent. Required for the default `"llm"` engine; unused by `"jev"`. */
+    agent?: SmartAgentInstance<z.infer<typeof guardianSchema>>;
+    systemPrompt?: string;
+    payloadBuilder?: (context: GuardrailContext) => string;
+    dispositionFallback?: GuardrailDisposition;
+    /** Judge backend. Defaults to `"llm"` for full backward compatibility. */
+    engine?: GuardrailJudgeEngine;
+    /** Configuration for the `"jev"` engine. Ignored by the `"llm"` engine. */
+    jev?: JevEngineOptions;
+};
+declare function agentVerdictRule(options: AgentRuleOptions): GuardrailRule;
+type CustomRuleCallback = (context: GuardrailContext) => boolean | {
+    allow: boolean;
+    reason?: string;
+    disposition?: GuardrailDisposition;
+    details?: Record<string, any>;
+} | Promise<boolean | {
+    allow: boolean;
+    reason?: string;
+    disposition?: GuardrailDisposition;
+    details?: Record<string, any>;
+}>;
+type CustomRuleOptions = {
+    id?: string;
+    title?: string;
+    description?: string;
+    callback: CustomRuleCallback;
+    defaultDisposition?: GuardrailDisposition;
+};
+declare function customCallbackRule(options: CustomRuleOptions): GuardrailRule;
+
+type GuardrailPresetBase = {
+    guardrailId?: string;
+    guardrailTitle?: string;
+    guardrailDescription?: string;
+    phases?: GuardrailPhase[];
+    haltOnViolation?: boolean;
+    onViolation?: ConversationGuardrail["onViolation"];
+    metadata?: Record<string, any>;
+};
+type RegexGuardrailOptions = GuardrailPresetBase & {
+    rule?: Omit<RegexRuleOptions, "pattern">;
+};
+declare function createRegexGuardrail(pattern: RegExp | string, options?: RegexGuardrailOptions): ConversationGuardrail;
+type JsonGuardrailOptions = GuardrailPresetBase & {
+    rule?: Omit<JsonSchemaRuleOptions, "schema">;
+};
+declare function createJsonGuardrail(schema: JsonSchemaRuleOptions["schema"], options?: JsonGuardrailOptions): ConversationGuardrail;
+type CodeGuardrailOptions = GuardrailPresetBase & {
+    rule?: CodeDetectionRuleOptions;
+};
+declare function createCodeGuardrail(options?: CodeGuardrailOptions): ConversationGuardrail;
+
+/**
+ * Wrap a plugin factory so config flows through with full inference:
+ *
+ *   const myGuard = definePlugin<{ level: number }>((cfg) => ({ name: "my-guard", ... }));
+ *   myGuard({ level: 2 })
+ *
+ * The indirection buys nothing at runtime — it exists so the config type is
+ * inferred at the call site and the returned object is checked against
+ * `AgentPlugin` at the definition site, where the error message is useful.
+ */
+declare function definePlugin<TConfig = void>(factory: (config: TConfig) => AgentPlugin): (config: TConfig) => AgentPlugin;
+/**
+ * A single hook, packaged as a plugin. For the common case where naming and a
+ * lifecycle would be ceremony:
+ *
+ *   defineHook("preToolUse", ({ toolName }) => toolName === "shell" ? { decision: "ask" } : undefined)
+ */
+declare function defineHook<K extends HookName>(hook: K, handler: HookHandler<K>, opts?: {
+    name?: string;
+    priority?: number;
+    failureMode?: PluginFailureMode;
+    timeoutMs?: number;
+    inheritToSubagents?: boolean;
+    /**
+     * Declare that this hook never returns `decision: "ask"`. Without it a
+     * `preToolUse` hook is assumed to be able to pause, and the whole tool
+     * batch is scheduled serially — silently costing an agent its parallel
+     * tool execution.
+     */
+    mayRequireApproval?: boolean;
+}): AgentPlugin;
+
+/**
+ * What this build actually implements.
+ *
+ * A policy configured as `mode: "enforce"` whose hook is never called is worse
+ * than no policy: the console shows a control that does not exist. A host
+ * cannot infer that from the type surface, because a declared hook and a wired
+ * one look identical to TypeScript — so the runtime states it.
+ *
+ * This table is maintained BY HAND alongside the wiring. That is deliberate:
+ * deriving it from the registry would only prove that a handler was registered,
+ * not that any call site raises it, which is precisely the failure it exists to
+ * make visible.
+ */
+
+/**
+ * Bumped when the hook contract changes shape in a way a host must notice —
+ * a hook gains or loses a call site, a payload field changes meaning, a slot
+ * starts or stops being consumed. Independent of the package version.
+ */
+declare const HOOK_CONTRACT_VERSION = 1;
+type CapabilityStatus = {
+    /** True when a call site in the runtime actually raises this. */
+    implemented: boolean;
+    /** Why not, or what the caveat is. */
+    notes?: string;
+};
+type SdkCapabilities = {
+    hookContractVersion: number;
+    hooks: Record<HookName, CapabilityStatus>;
+    slots: Record<SlotName, CapabilityStatus>;
+    features: Record<string, CapabilityStatus>;
+};
+/**
+ * Hook ids used by the Cognipeer Console's guardrail plane, mapped onto this
+ * SDK's hooks.
+ *
+ * The Console plane originally had one input stage, which collapsed two
+ * moments that behave differently: `userPromptSubmit` fires ONCE for a new
+ * user turn and can see attachments, while `preModelCall` fires before EVERY
+ * provider call — which is where the legacy `GuardrailPhase.Request` actually
+ * ran. A policy meant to vet what a person typed wants the first; one meant to
+ * vet every prompt reaching the model, including turns built from tool output,
+ * wants the second. Mapping both to one id silently changes how often the
+ * policy runs, and on a moderation-model guardrail that is a cost as well as a
+ * semantics bug.
+ *
+ * The Console added `prompt.pre` for the first and kept `input.pre` meaning
+ * the second, so every id below is single-valued.
+ */
+declare const CONSOLE_HOOK_MAP: Readonly<Record<string, HookName | null>>;
+/** What this build implements. Safe to call at any time; allocates a fresh copy. */
+declare function pluginCapabilities(): SdkCapabilities;
+/** Convenience for a host that only wants to know whether it can enforce. */
+declare function isHookImplemented(hook: HookName): boolean;
+
+/**
+ * Guardrail transport + the plugin that drives it.
+ *
+ * Layered the way tracing sinks are layered — a transport seam, a generic HTTP
+ * implementation, an in-process escape hatch, and thin first-party presets on
+ * top (see `cognipeerGuardrail`, `portkeyGuardrail`). What is deliberately NOT
+ * copied from tracing is its retry policy: a trace post can afford four
+ * attempts at an 8s timeout because nothing waits on it, while a guardrail sits
+ * on the critical path of every turn and the same policy would stall an agent
+ * for half a minute.
+ */
+
+/**
+ * `tool` is the ARGUMENTS a model wants to run; `tool_result` is what came
+ * back. They are different surfaces with different risks — one is an action
+ * about to happen, the other is untrusted content entering the context — and a
+ * policy usually wants different rules for each.
+ */
+type GuardrailPhaseName = "input" | "output" | "tool" | "tool_result";
+type GuardrailRequest = {
+    phase: GuardrailPhaseName;
+    content: string;
+    /** Tool name for `tool` / `tool_result`, otherwise unset. */
+    subject?: string;
+    /** The SDK hook this check was raised from, so a preset can map it exactly. */
+    hook?: string;
+    /** Structured tool arguments, for a service that wants them un-stringified. */
+    toolArgs?: unknown;
+    /** The tool's return value, for `tool_result`. */
+    toolResult?: unknown;
+    /**
+     * Non-text parts of the turn — images, audio, video, files. A text-only
+     * policy sees the caption and nothing else, so a service that moderates
+     * media needs these; one that does not simply ignores the field.
+     *
+     * Inline payloads are DESCRIBED (kind, media type, size) rather than
+     * inlined: shipping a base64 image on every check would multiply the cost of
+     * the guardrail by the size of the upload. A service that needs the bytes
+     * should take a URL, or the caller should override `buildRequest`.
+     */
+    attachments?: MediaAttachment[];
+    metadata?: Record<string, unknown>;
+};
+type GuardrailViolation = {
+    id?: string;
+    type?: string;
+    severity?: string;
+    detail?: string;
+};
+type GuardrailVerdict = {
+    action: "allow" | "block" | "mask";
+    message?: string;
+    /** Required when `action === "mask"`. */
+    maskedContent?: string;
+    violations?: GuardrailViolation[];
+    /** The untouched service response, for tracing and debugging. */
+    raw?: unknown;
+};
+type GuardrailCallContext = {
+    runId: string;
+    agentName?: string;
+    /** Correlates a guardrail decision with the trace session in the console UI. */
+    traceId?: string;
+    signal?: AbortSignal;
+};
+type GuardrailTransport = {
+    name: string;
+    /** Verdicts must come back in the same order as `requests`. */
+    evaluate(requests: GuardrailRequest[], ctx: GuardrailCallContext): MaybePromise<GuardrailVerdict[]>;
+    /**
+     * Optional setup-time handshake. When a service can say which phases carry
+     * active rules, every other phase skips the network entirely — usually the
+     * single biggest latency win available here.
      */
-    responsesStreaming?: boolean;
+    describe?: () => MaybePromise<{
+        activePhases?: GuardrailPhaseName[];
+    } | null | undefined>;
+    close?: () => MaybePromise<void>;
 };
-type AnthropicProviderConfig = {
-    provider: "anthropic";
-    apiKey: string;
-    baseURL?: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
-    anthropicVersion?: string;
-    retry?: ProviderRetryConfig;
+type HttpGuardrailOptions = {
+    url: string;
+    /** Static headers, or a thunk so a rotating token is read per call. */
+    headers?: Record<string, string> | (() => Record<string, string>);
+    /** Hard ceiling per attempt. Default 3000ms — this is on the critical path. */
+    timeoutMs?: number;
+    /** Retries after the first attempt. Default 1. */
+    retries?: number;
+    /** Send all pending checks in one request. Default true. */
+    batch?: boolean;
+    /** Override the wire request. Default: `{ items, runId, traceId }`. */
+    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
+    /** Override response mapping. Default: `normalizeVerdicts`, which is forgiving. */
+    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
     /**
-     * Prompt caching configuration. When enabled, places cache_control:
-     * ephemeral breakpoints on the system prompt and the final tool definition,
-     * which is the recommended Anthropic recipe for static system + tools.
+     * Status codes that carry a VERDICT rather than an error. Some services
+     * signal the outcome in the status line (e.g. 446 for a block); treating
+     * those as transport failures would route a real decision through the
+     * failureMode path with the wrong reason attached.
      */
-    prompt_caching?: {
-        enabled: boolean;
-    };
-};
-type AzureProviderConfig = {
-    provider: "azure";
-    apiKey: string;
-    endpoint: string;
-    apiVersion?: string;
-    deploymentName?: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
-};
-type OpenAICompatibleProviderConfig = {
-    provider: "openai-compatible";
-    apiKey: string;
-    baseURL: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
+    verdictStatuses?: number[];
+    /** Optional GET endpoint for the setup-time handshake. */
+    describeUrl?: string;
+    name?: string;
 };
-type BedrockProviderConfig = {
-    provider: "bedrock";
-    region: string;
-    accessKeyId?: string;
-    secretAccessKey?: string;
-    sessionToken?: string;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
-    retry?: ProviderRetryConfig;
+/**
+ * Accepts the shapes a guardrail service is likely to return and normalizes
+ * them. Being forgiving here is the point: the exact contract can change on the
+ * service side without a client release, and a stricter parser would turn a
+ * cosmetic field rename into an outage.
+ */
+declare function normalizeVerdicts(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
+declare function httpGuardrail(options: HttpGuardrailOptions): GuardrailTransport;
+/** In-process evaluation — regex policies, a local model, Presidio, tests. */
+declare function customGuardrail(evaluate: (request: GuardrailRequest, ctx: GuardrailCallContext) => MaybePromise<GuardrailVerdict | void>, name?: string): GuardrailTransport;
+type GuardrailPluginOptions = {
+    name: string;
+    transport: GuardrailTransport;
+    /** Which surfaces to check. Default: input + output. */
+    apply?: GuardrailPhaseName[];
     /**
-     * Insert Bedrock Converse `cachePoint` blocks at the end of the system
-     * prompt and tools list. Only supported by models that implement Converse
-     * prompt caching (most Anthropic Claude variants on Bedrock).
+     * `shadow` evaluates and reports but never blocks or masks. This is how a
+     * policy gets rolled out safely: measure what it would have caught first.
      */
-    prompt_caching?: {
-        enabled: boolean;
+    mode?: "enforce" | "shadow";
+    /** Block when the service is unreachable. Default true. */
+    failClosed?: boolean;
+    timeoutMs?: number;
+    priority?: number;
+    inheritToSubagents?: boolean;
+    /** Memoize verdicts per run. Default true. */
+    cache?: boolean | {
+        maxEntries?: number;
     };
+    /** Extra metadata attached to every request. */
+    metadata?: Record<string, unknown>;
 };
-type VertexProviderConfig = {
-    provider: "vertex";
-    projectId: string;
-    location?: string;
-    accessToken?: string;
-    serviceAccountJson?: string | Record<string, any>;
-    defaultModel?: string;
-    defaultHeaders?: Record<string, string>;
+declare function createGuardrailPlugin(options: GuardrailPluginOptions): AgentPlugin;
+
+/**
+ * Cognipeer Console guardrail — the first-party preset.
+ *
+ * Talks to the Console's HOOK plane, not its single-shot evaluator:
+ *
+ *   POST {baseUrl}/api/client/v1/guardrails/hooks/evaluate
+ *   Authorization: Bearer <api key>
+ *   { hook, guardrail_keys, text?, tool_name?, tool_args?, tool_result?, … }
+ *
+ * Three properties of that contract shape everything below, and getting any of
+ * them wrong turns a working policy into a silent one:
+ *
+ *   `decision`  is the EFFECTIVE verdict, already neutralised in monitor mode.
+ *               Priority runs block > redact > warn > flag > allow.
+ *   `enforced`  false means the decision was NOT applied — a dry run. Blocking
+ *               on `decision === "block"` without checking this turns every
+ *               monitoring policy into an enforcing one on the day it is
+ *               switched on for observation.
+ *   `passed`    means "no blocking finding", NOT "the request was allowed".
+ *               The two diverge in monitor mode, which is exactly when someone
+ *               reads the wrong one.
+ *
+ * `subject` (or `redacted_text` for the text case) is filled only when the
+ * service actually rewrote something; when it is present it REPLACES what was
+ * sent rather than being merged with it.
+ *
+ * The endpoint answers 200 for a finding as readily as for a clean check, and
+ * only emits 246/446 when a guardrail opts into verdict status codes — so both
+ * are declared as verdict-carrying rather than treated as transport failures.
+ * An unknown key answers 404 ON PURPOSE: a vacuous allow read as "content is
+ * safe" is the failure the whole plane exists to avoid.
+ */
+
+type CognipeerGuardrailConfig = {
+    /** Guardrail keys from the Console. Defaults to `COGNIPEER_GUARDRAIL_KEYS` (comma-separated). */
+    guardrailKeys?: string[];
+    /** Convenience for the single-key case. */
+    guardrailKey?: string;
+    /** Defaults to `COGNIPEER_API_KEY`. */
+    apiKey?: string;
+    /** Defaults to `COGNIPEER_BASE_URL`, then the production console. Point at localhost for local runs. */
+    baseUrl?: string;
+    /** Override the hook-evaluate path. */
+    path?: string;
+    /** Surfaces to guard. Default: input + output. Add `"tool"` / `"tool_result"` for the tool surface. */
+    apply?: GuardrailPhaseName[];
+    /** Restrict to specific check families, e.g. `["pii"]`. */
+    only?: string[];
+    /** Override the SDK-hook → Console-hook-id mapping, merged over the default. */
+    hookIds?: Record<string, string>;
+    /** Ask the service to evaluate without enforcing. Independent of `mode`. */
+    shadow?: boolean;
+    /** `shadow` here reports locally without acting, whatever the service says. */
+    mode?: "enforce" | "shadow";
+    /** Default true — an unreachable or misconfigured policy blocks rather than silently stops guarding. */
+    failClosed?: boolean;
+    /** Per-check ceiling. Default 3000ms; also sent as `budget_ms`. */
+    timeoutMs?: number;
+    retries?: number;
+    priority?: number;
+    cache?: boolean | {
+        maxEntries?: number;
+    };
+    metadata?: Record<string, unknown>;
+    buildRequest?: (requests: GuardrailRequest[], ctx: GuardrailCallContext) => unknown;
+    mapVerdict?: (response: unknown, requests: GuardrailRequest[]) => GuardrailVerdict[];
+    name?: string;
 };
-type ProviderConfig = OpenAIProviderConfig | AnthropicProviderConfig | AzureProviderConfig | OpenAICompatibleProviderConfig | BedrockProviderConfig | VertexProviderConfig;
-type ProviderType = ProviderConfig["provider"];
-declare class ProviderError extends Error {
-    readonly provider: string;
-    readonly statusCode?: number | undefined;
-    readonly responseBody?: any | undefined;
-    constructor(message: string, provider: string, statusCode?: number | undefined, responseBody?: any | undefined);
-}
+/** The Console's hook response, mapped onto the transport's three-valued verdict. */
+declare function mapConsoleHookVerdict(response: unknown, requests: GuardrailRequest[]): GuardrailVerdict[];
+declare function cognipeerGuardrail(config?: CognipeerGuardrailConfig): AgentPlugin;
 
 /**
  * Portkey — two integration shapes, because Portkey supports two.
@@ -5505,33 +5855,8 @@ declare function buildResponseFormatSection(responseFormat: Record<string, any>
  */
 declare function startStreamingSession(session: TraceSessionRuntime | undefined, agentRuntime?: AgentRuntimeConfig): Promise<void>;
 
-type ProviderRetryPolicy = {
-    /** Maximum number of retries on 429/5xx responses. Default: 3. */
-    maxRetries?: number;
-    /** Initial backoff in ms (doubled on each retry). Default: 500. */
-    baseDelayMs?: number;
-    /** Hard cap on individual delay between retries. Default: 8000. */
-    maxDelayMs?: number;
-    /**
-     * Custom predicate to decide whether to retry. By default we retry 429
-     * and 5xx responses; pass a function to broaden/narrow that set.
-     */
-    shouldRetry?: (error: any, attempt: number) => boolean;
-};
-declare abstract class BaseProvider {
-    abstract readonly providerName: ProviderType;
-    protected retryPolicy: ProviderRetryPolicy;
-    /** Non-streaming completion */
-    abstract complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
-    /** Streaming completion – yields incremental chunks */
-    abstract completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
-    /**
-     * Helper concrete providers can wrap their fetch with. Retries 429/5xx
-     * with exponential backoff and respects Retry-After if the response
-     * carries one.
-     */
-    protected doFetchWithRetry(execute: () => Promise<Response>): Promise<Response>;
-}
+/** True for Claude model ids of major version 5+ (or the `fable` line). */
+declare function supportsAdaptiveThinking(model: unknown): boolean;
 
 declare class OpenAIProvider extends BaseProvider {
     readonly providerName: ProviderType;
@@ -5542,6 +5867,11 @@ declare class OpenAIProvider extends BaseProvider {
     protected readonly responsesApi: "auto" | "never" | "always";
     private readonly responsesApiModels;
     private readonly responsesStreaming;
+    private readonly apiExplicitChat;
+    private readonly apiExplicitResponses;
+    /** `api: "responses"` was passed (the legacy `responsesApi: "always"` keeps its old single-call behaviour). */
+    private readonly apiResponsesNative;
+    protected readonly maxTokensParam: "auto" | "max_tokens" | "max_completion_tokens";
     constructor(config: OpenAIProviderConfig);
     /** True when the caller listed this request's model in `responsesApiModels`. */
     private isResponsesApiModel;
@@ -5560,6 +5890,9 @@ declare class OpenAIProvider extends BaseProvider {
     protected useResponsesApi(request: ChatCompletionRequest): boolean;
     complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
     completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
+    /** POST /embeddings, batched (default 2048 inputs per request, the OpenAI cap). */
+    embed(request: EmbeddingRequest): Promise<EmbeddingResponse>;
+    protected embeddingsFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
     protected buildRequestBody(request: ChatCompletionRequest, stream: boolean): Record<string, any>;
     protected completeResponses(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
     /** Real Responses SSE streaming, for models opted in through
@@ -5573,11 +5906,11 @@ declare class OpenAIProvider extends BaseProvider {
     protected buildResponsesBody(request: ChatCompletionRequest): Record<string, any>;
     /** Maps a unified message to a Responses API `input` item. */
     protected toResponsesInput(m: UnifiedMessage): Record<string, any>;
-    protected responsesFetch(body: Record<string, any>): Promise<Response>;
+    protected responsesFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
     protected parseResponsesResponse(json: any, modelId: string): ChatCompletionResponse;
     protected toOpenAIMessage(m: UnifiedMessage): Record<string, any>;
     protected toOpenAITool(t: ToolDefinition): Record<string, any>;
-    protected doFetch(body: Record<string, any>): Promise<Response>;
+    protected doFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
     protected parseResponse(json: any): ChatCompletionResponse;
     protected extractUsage(usage: any): TokenUsage;
 }
@@ -5590,6 +5923,7 @@ declare class AnthropicProvider extends BaseProvider {
     private readonly defaultHeaders;
     private readonly anthropicVersion;
     private readonly promptCachingEnabled;
+    private readonly thinkingMode;
     constructor(config: AnthropicProviderConfig);
     complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
     completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
@@ -5609,6 +5943,9 @@ declare class AnthropicProvider extends BaseProvider {
     private toAnthropicToolResult;
     private toAnthropicMessage;
     private toAnthropicTool;
+    /** Builds and sends the request; retries once with the other thinking form
+     * when the upstream rejects the one we picked. */
+    private send;
     private doFetch;
     private parseResponse;
 }
@@ -5620,11 +5957,14 @@ declare class AzureProvider extends OpenAIProvider {
     private readonly deploymentName?;
     private readonly azureApiKey;
     constructor(config: AzureProviderConfig);
-    protected doFetch(body: Record<string, any>): Promise<Response>;
+    protected doFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
+    /** Azure embeddings: the deployment named by the request's model (falling back
+     * to the configured deployment) in the path, api-key auth. */
+    protected embeddingsFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
     /** Azure exposes the Responses API at /openai/responses with api-key auth.
      * Reasoning summaries require a preview api-version; callers can override via
      * the `apiVersion` config. */
-    protected responsesFetch(body: Record<string, any>): Promise<Response>;
+    protected responsesFetch(body: Record<string, any>, signal?: AbortSignal): Promise<Response>;
 }
 
 declare class OpenAICompatibleProvider extends OpenAIProvider {
@@ -5639,9 +5979,28 @@ declare class BedrockProvider extends BaseProvider {
     private readonly defaultModel;
     private readonly defaultHeaders;
     private readonly promptCachingEnabled;
+    private readonly thinkingMode;
     constructor(config: BedrockProviderConfig);
     complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
+    /**
+     * Real streaming over ConverseStream. The response is an AWS event-stream
+     * (binary frames); each frame carries one JSON event: messageStart,
+     * contentBlockStart/Delta/Stop (text, toolUse, reasoningContent),
+     * messageStop and, last, metadata (usage). Text, tool-call argument and
+     * reasoning deltas are yielded as they arrive; one closing chunk carries the
+     * finish reason, usage and the signed reasoning blocks.
+     */
     completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
+    /**
+     * InvokeModel embeddings. Supported families (by model id, inference-profile
+     * prefixes such as `us.` allowed):
+     *  - Amazon Titan Text Embeddings (v1, v2): one text per call, `dimensions`
+     *    (v2: 256/512/1024) and `normalize` via `extra`.
+     *  - Cohere Embed (v3, v4): a batch of texts per call (default 96), `inputType`
+     *    maps to `input_type`, `dimensions` to `output_dimension` (v4).
+     */
+    embed(request: EmbeddingRequest): Promise<EmbeddingResponse>;
+    private invokeModel;
     private buildConverseBody;
     private splitSystemMessages;
     /**
@@ -5659,6 +6018,9 @@ declare class BedrockProvider extends BaseProvider {
     private toBedrockToolResult;
     private toBedrockMessage;
     private toBedrockTool;
+    /** Sends the Converse call; retries once with toolChoice auto when the
+     * model rejects forced tool use. */
+    private converseFetch;
     private doFetch;
     private parseResponse;
 }
@@ -5675,6 +6037,13 @@ declare class VertexProvider extends BaseProvider {
     constructor(config: VertexProviderConfig);
     complete(request: ChatCompletionRequest): Promise<ChatCompletionResponse>;
     completeStream(request: ChatCompletionRequest): AsyncGenerator<ChatCompletionChunk, void, unknown>;
+    /**
+     * Vertex `:predict` embeddings (text-embedding-00x, text-multilingual-embedding,
+     * gemini-embedding-001). `inputType` maps to the task type; `dimensions` to
+     * `outputDimensionality`. gemini-embedding takes one instance per request, the
+     * text-embedding models up to `batchSize` (default 100).
+     */
+    embed(request: EmbeddingRequest): Promise<EmbeddingResponse>;
     private buildUrl;
     private buildGeminiBody;
     private buildContents;
@@ -5699,7 +6068,50 @@ type NativeModelOptions = {
     extra?: Record<string, any>;
     /** Unified native reasoning config applied by default (per-call overrides supported). */
     reasoning?: ReasoningRequestConfig;
+    /** Default nucleus sampling. */
+    topP?: number;
+    /** Default stop sequences. */
+    stop?: string[];
+    /** Default presence penalty (OpenAI-family only). */
+    presencePenalty?: number;
+    /** Default frequency penalty (OpenAI-family only). */
+    frequencyPenalty?: number;
+    /**
+     * Last-mile hook: receives the fully built request (tools, response format,
+     * reasoning already applied) right before it goes to the provider. Mutate it
+     * in place or return a replacement. Use it for model-specific rules the
+     * unified request cannot express (e.g. force `reasoning` off when tools are bound).
+     */
+    transformRequest?: (request: ChatCompletionRequest) => ChatCompletionRequest | void | Promise<ChatCompletionRequest | void>;
+};
+/**
+ * The ONE usage shape carried on every assistant message produced by a native
+ * provider (`message.usage`, and mirrored on `response_metadata.token_usage`):
+ *
+ * ```
+ * {
+ *   prompt_tokens, completion_tokens, total_tokens,
+ *   prompt_tokens_details:     { cached_tokens, cache_write_tokens },
+ *   completion_tokens_details: { reasoning_tokens },
+ * }
+ * ```
+ * `completion_tokens` INCLUDES `reasoning_tokens`; `prompt_tokens` INCLUDES
+ * `cached_tokens`. `response_metadata.token_usage` additionally keeps the flat
+ * legacy `cached_tokens` / `cache_write_tokens` keys.
+ */
+type MessageUsage = {
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+    prompt_tokens_details: {
+        cached_tokens: number;
+        cache_write_tokens: number;
+    };
+    completion_tokens_details: {
+        reasoning_tokens: number;
+    };
 };
+declare function toMessageUsage(u: TokenUsage): MessageUsage;
 /**
  * Creates a BaseChatModel from a native provider.
  *
@@ -5736,4 +6148,4 @@ declare function fromNativeProvider(provider: BaseProvider, options?: NativeMode
  */
 declare function createProvider(config: ProviderConfig): BaseProvider;
 
-export { type AIMessage, ASK_USER_TOOL_NAME, type AgentInstance, type AgentInvokeResult, type AgentLimits, type AgentOptions, type AgentPlugin, type AgentRuleOptions, type AgentRuntimeConfig, type AgentSnapshot, type AgentSnapshotMetadata, type AgentState, AnthropicProvider, type AnthropicProviderConfig, type ApprovalTransport, type AudioContent, type AuditEntry, type AuditLogConfig, type AzureContentSafetyConfig, AzureProvider, type AzureProviderConfig, type BaseChatMessage, type BaseChatMessagePart, type BaseChatModel, type BaseMessage, BaseProvider, type BedrockGuardrailConfig, BedrockProvider, type BedrockProviderConfig, type BudgetGuardConfig, type BuildChildConfig, type BuiltInRuntimeProfile, CCRStore, CONSOLE_HOOK_MAP, CONTEXT_PILOT_JSON_MARKER_KEY, CONTROL_PLANE_TOOL_NAMES, type CancellationTokenLike, type CancelledEvent, type CapabilityStatus, type ChatCompletionChunk, type ChatCompletionRequest, type ChatCompletionResponse, type CheckpointPluginConfig, type CheckpointStore, type ChildContextPolicy, type CodeDetectionRuleOptions, type CodeGuardrailOptions, type CognipeerGuardrailConfig, type CompressToolOutputParams, type ContextBuilder, type ContextPilotCCRConfig, type ContextPilotCacheAlignmentConfig, type ContextPilotCompressionConfig, type ContextPilotCompressionStats, type ContextPilotCompressorKind, type ContextPilotConfig, type ContextPilotDedupConfig, type ContextPilotDiffCompressionConfig, type ContextPilotJsonCompressionConfig, type ContextPilotLogCompressionConfig, type ContextPilotResult, type ContextPilotRuntime, type ContextPilotSearchCompressionConfig, type ContextPilotTextCompressionConfig, type ContextPolicy, type ContextToolsStateRef, type ConversationGuardrail, type ConversationPluginConfig, type ConversationStore, type CostEstimator, type CustomRuleCallback, type CustomRuleOptions, DEFAULT_MAX_TOOL_INPUT_FIELD_CHARS, DEFAULT_PROFILE_CONFIGS, DEFAULT_SKILL_POLICY, DEFAULT_SUBAGENT_POLICY, DEFAULT_SUBAGENT_TOOL_NAMES, DEFAULT_TOOL_INPUT_DIGEST_HEAD_CHARS, DELEGATION_TOOL_NAMES, DedupTracker, type DelegationEventStamp, type DelegationMode, type EvalCase, type EvalCaseResult, type EvalFamily, type EvalHarnessMetrics, type EvalHarnessParams, type EvalHarnessResult, type EvalProfileDescriptor, type EvalProfileTarget, type FileContent, type FinalAnswerEvent, type FinishReason, type GateResult, type GuardrailCallContext, type GuardrailContext, type GuardrailDisposition, type GuardrailEvent, type GuardrailIncident, type GuardrailOutcome, GuardrailPhase, type GuardrailPhaseName, type GuardrailPluginOptions, type GuardrailRequest, type GuardrailRule, type GuardrailRuleResult, type GuardrailTransport, type GuardrailVerdict, type GuardrailViolation, HOOK_CONTRACT_VERSION, HOOK_NAMES, type HandoffDescriptor, type HandoffEvent, type HookContext, type HookDecision, type HookHandler, type HookMap, type HookName, type HookRegistrations, HookTimeoutError, type HttpGuardrailOptions, type HumanInTheLoopAskUserConfig, type HumanInTheLoopOptions, type HumanInTheLoopRuntimeConfig, type ImageContent, InMemoryMemoryStore, type InjectionScan, type InvokeConfig, type JsonGuardrailOptions, type JsonSchemaRuleOptions, type LangfuseBuildContext, type LangfuseEvent, type LangfuseEventKind, type LangfuseTracingConfig, type LanguageGuardConfig, type LoadSkillsOptions, type MaybePromise, type McpConfig, type McpConnection, type MediaAttachment, type MediaKind, type MediaPolicyConfig, type MemoryFact, type MemoryProviderKind, type MemoryReadPolicy, type MemoryScope, type MemoryStore, type MemoryWritePolicy, type Message, type MetadataEvent, type ModelCapabilities, NativeJsonSchemaStrategy, type NativeModelOptions, type NativeReasoningConfig, OpenAICompatibleProvider, type OpenAICompatibleProviderConfig, type OpenAIModerationConfig, OpenAIProvider, type OpenAIProviderConfig, type OtelTracingConfig, type OutputGuardConfig, PREOPEN_TOOL_CALL_PREFIX, type PendingToolApproval, type PendingUserQuestion, type PiiDetector, type PiiEntity, type PiiRedactionConfig, type PlanEvent, type PlanStepRecord, type PlanningMode, type PluginContributions, type PluginEvent, type PluginFailureMode, type PluginHost, type PluginHostOptions, type PluginLogger, type PluginProvides, type PluginRunHost, type PluginSetupContext, type PortkeyGatewayConfig, type PortkeyGuardrailConfig, type PreopenSkillsResult, type ProfileConfig, type ProgressEvent, type ProgressUpdate, type PromptHooks, type PromptInjectionFamily, type PromptInjectionGuardConfig, type PromptSource, type ProviderConfig, ProviderError, type ToolCall as ProviderToolCall, type ToolDefinition as ProviderToolDefinition, type ProviderType, type RateLimitConfig, type ReasoningConfig, type ReasoningLevel, type RedactionResult, type ReflectionCadence, type ReflectionConfig, type ReflectionEvent, type ReflectionHookContext, type ReflectionRecord, type RegexGuardrailConfig, type RegexGuardrailOptions, type RegexRuleOptions, type ReplanPolicy, type ResolvedContextPilotConfig, type ResolvedSmartAgentConfig, type ResolvedTraceConfig, type ResolvedTraceSink, type ResponseCacheConfig, type RestoreSnapshotOptions, type RuntimeProfile, SMALL_TIER_SKILL_POLICY, type SdkCapabilities, type SerializableSmartState, type SessionMetrics, type SessionMetricsConfig, type Skill, type SkillDisclosure, type SkillExecutionContext, type SkillFrontmatter, type SkillFs, type SkillModelTier, type SkillPolicy, type SkillRegistryRef, type SkillSource, type SkillToolDeps, type SkillToolHeader, type SlotName, type SmartAgentBudgetConfig, type SmartAgentContextConfig, type SmartAgentCustomProfileConfig, type SmartAgentDelegationConfig, type SmartAgentEvent, type SmartAgentInstance, type SmartAgentLimits, type SmartAgentMemoryConfig, type SmartAgentOptions, type SmartAgentPlanningConfig, type SmartAgentSummarizationConfig, type SmartAgentToolResponseConfig, type SmartAgentTracingConfig, type SmartModel, type SmartState, type SmartToolFn, type SnapshotOptions, type SnapshotRuntimeHint, type StreamChunk, type StreamEvent, type StrictRestorers, type StrictTransform, type StructuredOutputError, type StructuredOutputFieldError, StructuredOutputManager, type StructuredOutputManagerConfig, type StructuredOutputResult, type StructuredOutputStrategy, type StructuredSummary, type SubagentDef, type SubagentEvent, type SubagentMode, type SubagentPendingRecord, type SubagentPolicy, type SubagentRegistryRef, type SubagentResult, type SubagentToolDeps, type SubagentToolNames, type SummarizationEvent, type SummarizationMode, type SummarizerInput, type SummarizerResult, type SummarizerStrategy, type SummaryFactItem, type SummaryIntegrityCheck, TOOL_INPUT_DIGEST_KEY, type TextContent, type TokenCounter, type TokenUsage, type ToolApprovalEvent, type ToolApprovalResolution, type ToolApprovalStatus, ToolBasedStrategy, type ToolCachePolicy, type ToolCallEvent, type ToolInputDigestOptions, type ToolInputDigestResult, type ToolInputRetentionPolicy, type ToolInterface, type ToolPolicyConfig, type ToolResponseClassification, type ToolResponseRetentionPolicy, type ToolRetentionDeclarations, type ToolRetentionSpec, type ToolRetryPolicy, type ToolRule, type TraceDataSection, type TraceErrorRecord, type TraceEventRecord, type TraceMessageSection, type TraceMetadataSection, type TraceSessionConfigSnapshot, type TraceSessionFile, type TraceSessionStatus, type TraceSessionSummary, type TraceSinkCognipeerConfig, type TraceSinkConfig, type TraceSinkCustomConfig, type TraceSinkFileConfig, type TraceSinkHttpConfig, type TraceSinkOtlpConfig, type TraceSinkSnapshot, type TraceSummarySection, type TraceToolCallSection, type TraceToolDefinition, type TraceToolDefinitionsSection, type TraceToolDetails, type TraceToolResponseSection, type TraceToolResultSection, type TracingConfig, type TracingMode, type UnifiedMessage, type UserQuestionAnswer, type UserQuestionAnswerSet, type UserQuestionEvent, type UserQuestionItem, type UserQuestionOption, type UserQuestionResolution, type UserQuestionStatus, VertexProvider, type VertexProviderConfig, type VolatileContentFinding, type VolatileContentPattern, type WebhookApprovalConfig, agentVerdictRule, appendBoundTools, auditLog, azureContentSafety, bedrockGuardrail, budgetGuard, buildHandoffTools, buildResponseFormatSection, buildSkillHeaderBlock, buildSubagentCatalogBlock, buildSystemPrompt, buildToolDefinitionsSection, canOpenSkill, canSpawn, captureSnapshot, checkpointing, codePresenceRule, coerceToolArgs, cognipeerGuardrail, cognipeerSink, collectAttachments, collectToolRetentionDeclarations, composeToolSets, compressDiffOutput, compressJsonOutput, compressLogOutput, compressSearchOutput, compressTextOutput, compressToolOutput, contentToString, conversationHistory, countApproxTokens, countMessagesTokens, createAgent, createAgentNode, createAskUserQuestionTool, createBindSkillToolsTool, createCodeGuardrail, createContextPilotRuntime, createContextSummarizeNode, createContextTools, createDelegateTool, createGetToolResponseTool, createGuardrail, createGuardrailPlugin, createJsonGuardrail, createManageTodoListAliasTool, createManageTodoTool, createOpenSkillTool, createParallelTool, createPluginHost, createProvider, createRegexGuardrail, createResolverNode, createSearchSkillsTool, createSkillRegistryRef, createSkillTools, createSmartAgent, createSpawnTool, createSubagentRegistryRef, createSubagentTools, createTool, createToolLimitFinalizeNode, createToolsNode, customCallbackRule, customGuardrail, customSink, dedupeToolsByName, defaultTokenCounter, defineHook, definePlugin, detectLanguage, detectTextFormat, detectVolatileContent, digestToolInputArguments, digestToolInputValue, emptyUsage, evaluateGuardrails, extractLatestUserQuery, extractMessageText, fileCheckpointStore, fileSink, findSubagent, formatZodError, fromLangchainModel, fromLangchainTools, fromNativeProvider, generateSpanId, generateTraceId, getModelCapabilities, getNestedValue, getResolvedSmartConfig, getTokenCounter, hasToolResponseRecoveryReference, httpGuardrail, httpSink, inMemoryCheckpointStore, inMemoryConversationStore, isHookImplemented, isOpenAIHostedEndpoint, isSmartModel, isValidIban, isValidLuhn, isValidTckn, jsonSchemaRule, defaultBuildPayload as langfuseDefaultPayload, langfuseTracing, languageGuard, loadSkillsFromDisk, mapConsoleHookVerdict, mapTextParts, mcp, mediaPolicy, normalizeSmartAgentOptions, normalizeVerdicts, openAIModeration, otelTracing, otlpSink, outputGuard, parseApprovalDecision, parseSkillFrontmatter, pathSandbox, piiRedaction, pluginCapabilities, portkeyGateway, portkeyGuardrail, preopenSkills, preopenToolCallId, prepareStrictToolMenu, promptInjectionGuard, rateLimit, readMemoryFacts, redactText, regexGuardrail, regexRule, replaceTextContent, resolveAvailableSkills, resolveAvailableSubagents, resolveInputRetention, resolveMemoryStore, resolveReasoning, resolveStrategy, resolveSubagentTools, resolveSummarizationRetention, resolveToolApprovalState, resolveUserQuestionState, responseCache, restoreSnapshot, restoreToolCalls, runSmartAgentEvalHarness, scoreItemsByRelevance, searchSkills, seedChildMessages, selectTopIndicesInOrder, sessionMetrics, setTokenCounter, startStreamingSession, summarizeObject, textFromContent, toStrictCompatible, toStrictToolSchema, tokenize, toolPolicy, traceSessionToOtlp, validateReasoningConfig, validateToolArgs, webhookApproval, withTools, withinDepth, writeSummaryFactsToMemory };
+export { type AIMessage, ASK_USER_TOOL_NAME, type AgentInstance, type AgentInvokeResult, type AgentLimits, type AgentOptions, type AgentPlugin, type AgentRuleOptions, type AgentRuntimeConfig, type AgentSnapshot, type AgentSnapshotMetadata, type AgentState, AnthropicProvider, type AnthropicProviderConfig, type ApprovalTransport, type AudioContent, type AuditEntry, type AuditLogConfig, type AzureContentSafetyConfig, AzureProvider, type AzureProviderConfig, type BaseChatMessage, type BaseChatMessagePart, type BaseChatModel, type BaseMessage, BaseProvider, type BedrockGuardrailConfig, BedrockProvider, type BedrockProviderConfig, type BudgetGuardConfig, type BuildChildConfig, type BuiltInRuntimeProfile, CCRStore, CONSOLE_HOOK_MAP, CONTEXT_PILOT_JSON_MARKER_KEY, CONTROL_PLANE_TOOL_NAMES, type CancellationTokenLike, type CancelledEvent, type CapabilityStatus, type ChatCompletionChunk, type ChatCompletionRequest, type ChatCompletionResponse, type CheckpointPluginConfig, type CheckpointStore, type ChildContextPolicy, type CodeDetectionRuleOptions, type CodeGuardrailOptions, type CognipeerGuardrailConfig, type CompressToolOutputParams, type ContextBuilder, type ContextPilotCCRConfig, type ContextPilotCacheAlignmentConfig, type ContextPilotCompressionConfig, type ContextPilotCompressionStats, type ContextPilotCompressorKind, type ContextPilotConfig, type ContextPilotDedupConfig, type ContextPilotDiffCompressionConfig, type ContextPilotJsonCompressionConfig, type ContextPilotLogCompressionConfig, type ContextPilotResult, type ContextPilotRuntime, type ContextPilotSearchCompressionConfig, type ContextPilotTextCompressionConfig, type ContextPolicy, type ContextToolsStateRef, type ConversationGuardrail, type ConversationPluginConfig, type ConversationStore, type CostEstimator, type CustomRuleCallback, type CustomRuleOptions, DEFAULT_MAX_TOOL_INPUT_FIELD_CHARS, DEFAULT_PROFILE_CONFIGS, DEFAULT_SKILL_POLICY, DEFAULT_SUBAGENT_POLICY, DEFAULT_SUBAGENT_TOOL_NAMES, DEFAULT_TOOL_INPUT_DIGEST_HEAD_CHARS, DELEGATION_TOOL_NAMES, DedupTracker, type DelegationEventStamp, type DelegationMode, type EmbeddingInputType, type EmbeddingRequest, type EmbeddingResponse, type EmbeddingUsage, type EvalCase, type EvalCaseResult, type EvalFamily, type EvalHarnessMetrics, type EvalHarnessParams, type EvalHarnessResult, type EvalProfileDescriptor, type EvalProfileTarget, type FileContent, type FinalAnswerEvent, type FinishReason, type GateResult, type GuardrailCallContext, type GuardrailContext, type GuardrailDisposition, type GuardrailEvent, type GuardrailIncident, type GuardrailJudgeEngine, type GuardrailOutcome, GuardrailPhase, type GuardrailPhaseName, type GuardrailPluginOptions, type GuardrailRequest, type GuardrailRule, type GuardrailRuleResult, type GuardrailTransport, type GuardrailVerdict, type GuardrailViolation, HOOK_CONTRACT_VERSION, HOOK_NAMES, type HandoffDescriptor, type HandoffEvent, type HookContext, type HookDecision, type HookHandler, type HookMap, type HookName, type HookRegistrations, HookTimeoutError, type HttpGuardrailOptions, type HumanInTheLoopAskUserConfig, type HumanInTheLoopOptions, type HumanInTheLoopRuntimeConfig, type ImageContent, InMemoryMemoryStore, type InjectionScan, type InvokeConfig, type JevClientLike, type JevEngineOptions, type JevNoulAnswer, JevProvider, type JevProviderConfig, type JevQuestion, type JevSystemOneRequest, type JevSystemOneResult, type JsonGuardrailOptions, type JsonSchemaRuleOptions, type LangfuseBuildContext, type LangfuseEvent, type LangfuseEventKind, type LangfuseTracingConfig, type LanguageGuardConfig, type LoadSkillsOptions, type MaybePromise, type McpConfig, type McpConnection, type MediaAttachment, type MediaKind$1 as MediaKind, type MediaPolicyConfig, type MemoryFact, type MemoryProviderKind, type MemoryReadPolicy, type MemoryScope, type MemoryStore, type MemoryWritePolicy, type Message, type MessageUsage, type MetadataEvent, type ModelCapabilities, NativeJsonSchemaStrategy, type NativeModelOptions, type NativeReasoningConfig, OpenAICompatibleProvider, type OpenAICompatibleProviderConfig, type OpenAIModerationConfig, OpenAIProvider, type OpenAIProviderConfig, type OtelTracingConfig, type OutputGuardConfig, PREOPEN_TOOL_CALL_PREFIX, type PendingToolApproval, type PendingUserQuestion, type PiiDetector, type PiiEntity, type PiiRedactionConfig, type PlanEvent, type PlanStepRecord, type PlanningMode, type PluginContributions, type PluginEvent, type PluginFailureMode, type PluginHost, type PluginHostOptions, type PluginLogger, type PluginProvides, type PluginRunHost, type PluginSetupContext, type PortkeyGatewayConfig, type PortkeyGuardrailConfig, type PreopenSkillsResult, type ProfileConfig, type ProgressEvent, type ProgressUpdate, type PromptHooks, type PromptInjectionFamily, type PromptInjectionGuardConfig, type PromptSource, type ProviderConfig, ProviderError, type ProviderResponseFields, type ToolCall as ProviderToolCall, type ToolDefinition as ProviderToolDefinition, type ProviderTransportConfig, type ProviderType, type RateLimitConfig, type ReasoningConfig, type ReasoningLevel, type RedactionResult, type ReflectionCadence, type ReflectionConfig, type ReflectionEvent, type ReflectionHookContext, type ReflectionRecord, type RegexGuardrailConfig, type RegexGuardrailOptions, type RegexRuleOptions, type ReplanPolicy, type ResolvedContextPilotConfig, type ResolvedSmartAgentConfig, type ResolvedTraceConfig, type ResolvedTraceSink, type ResponseCacheConfig, type RestoreSnapshotOptions, type RuntimeProfile, SMALL_TIER_SKILL_POLICY, type SdkCapabilities, type SerializableSmartState, type SessionMetrics, type SessionMetricsConfig, type Skill, type SkillDisclosure, type SkillExecutionContext, type SkillFrontmatter, type SkillFs, type SkillModelTier, type SkillPolicy, type SkillRegistryRef, type SkillSource, type SkillToolDeps, type SkillToolHeader, type SlotName, type SmartAgentBudgetConfig, type SmartAgentContextConfig, type SmartAgentCustomProfileConfig, type SmartAgentDelegationConfig, type SmartAgentEvent, type SmartAgentInstance, type SmartAgentLimits, type SmartAgentMemoryConfig, type SmartAgentOptions, type SmartAgentPlanningConfig, type SmartAgentSummarizationConfig, type SmartAgentToolResponseConfig, type SmartAgentTracingConfig, type SmartModel, type SmartState, type SmartToolFn, type SnapshotOptions, type SnapshotRuntimeHint, type StreamChunk, type StreamEvent, type StrictRestorers, type StrictTransform, type StructuredOutputError, type StructuredOutputFieldError, StructuredOutputManager, type StructuredOutputManagerConfig, type StructuredOutputResult, type StructuredOutputStrategy, type StructuredSummary, type SubagentDef, type SubagentEvent, type SubagentMode, type SubagentPendingRecord, type SubagentPolicy, type SubagentRegistryRef, type SubagentResult, type SubagentToolDeps, type SubagentToolNames, type SummarizationEvent, type SummarizationMode, type SummarizerInput, type SummarizerResult, type SummarizerStrategy, type SummaryFactItem, type SummaryIntegrityCheck, TOOL_INPUT_DIGEST_KEY, type TextContent, type TokenCounter, type TokenUsage, type ToolApprovalEvent, type ToolApprovalResolution, type ToolApprovalStatus, ToolBasedStrategy, type ToolCachePolicy, type ToolCallEvent, type ToolInputDigestOptions, type ToolInputDigestResult, type ToolInputRetentionPolicy, type ToolInterface, type ToolPolicyConfig, type ToolResponseClassification, type ToolResponseRetentionPolicy, type ToolRetentionDeclarations, type ToolRetentionSpec, type ToolRetryPolicy, type ToolRule, type TraceDataSection, type TraceErrorRecord, type TraceEventRecord, type TraceMessagePart, type TraceMessageSection, type TraceMetadataSection, type TraceSessionConfigSnapshot, type TraceSessionFile, type TraceSessionStatus, type TraceSessionSummary, type TraceSinkCognipeerConfig, type TraceSinkConfig, type TraceSinkCustomConfig, type TraceSinkFileConfig, type TraceSinkHttpConfig, type TraceSinkOtlpConfig, type TraceSinkSnapshot, type TraceSummarySection, type TraceToolCallSection, type TraceToolDefinition, type TraceToolDefinitionsSection, type TraceToolDetails, type TraceToolResponseSection, type TraceToolResultSection, type TracingConfig, type TracingMode, type UnifiedMessage, type UserQuestionAnswer, type UserQuestionAnswerSet, type UserQuestionEvent, type UserQuestionItem, type UserQuestionOption, type UserQuestionResolution, type UserQuestionStatus, VertexProvider, type VertexProviderConfig, type VolatileContentFinding, type VolatileContentPattern, type WebhookApprovalConfig, agentVerdictRule, appendBoundTools, auditLog, azureContentSafety, bedrockGuardrail, budgetGuard, buildHandoffTools, buildResponseFormatSection, buildSkillHeaderBlock, buildSubagentCatalogBlock, buildSystemPrompt, buildToolDefinitionsSection, canOpenSkill, canSpawn, captureSnapshot, checkpointing, codePresenceRule, coerceToolArgs, cognipeerGuardrail, cognipeerSink, collectAttachments, collectToolRetentionDeclarations, composeToolSets, compressDiffOutput, compressJsonOutput, compressLogOutput, compressSearchOutput, compressTextOutput, compressToolOutput, contentPartToText, contentToString, conversationHistory, countApproxTokens, countMessagesTokens, createAgent, createAgentNode, createAskUserQuestionTool, createBindSkillToolsTool, createCodeGuardrail, createContextPilotRuntime, createContextSummarizeNode, createContextTools, createDelegateTool, createGetToolResponseTool, createGuardrail, createGuardrailPlugin, createJsonGuardrail, createManageTodoListAliasTool, createManageTodoTool, createOpenSkillTool, createParallelTool, createPluginHost, createProvider, createRegexGuardrail, createResolverNode, createSearchSkillsTool, createSkillRegistryRef, createSkillTools, createSmartAgent, createSpawnTool, createSubagentRegistryRef, createSubagentTools, createTool, createToolLimitFinalizeNode, createToolsNode, customCallbackRule, customGuardrail, customSink, dedupeToolsByName, defaultTokenCounter, defineHook, definePlugin, describeContentPart, detectLanguage, detectTextFormat, detectVolatileContent, digestToolInputArguments, digestToolInputValue, emptyUsage, evaluateGuardrails, extractLatestUserQuery, extractMessageText, fileCheckpointStore, fileSink, findSubagent, formatZodError, fromLangchainModel, fromLangchainTools, fromNativeProvider, generateSpanId, generateTraceId, getModelCapabilities, getNestedValue, getResolvedSmartConfig, getTokenCounter, hasMediaPart, hasToolResponseRecoveryReference, httpGuardrail, httpSink, inMemoryCheckpointStore, inMemoryConversationStore, isHookImplemented, isOpenAIHostedEndpoint, isSmartModel, isValidIban, isValidLuhn, isValidTckn, jsonSchemaRule, defaultBuildPayload as langfuseDefaultPayload, langfuseTracing, languageGuard, loadSkillsFromDisk, mapConsoleHookVerdict, mapTextParts, mcp, mediaKindOf, mediaPolicy, normalizeSmartAgentOptions, normalizeVerdicts, openAIModeration, otelTracing, otlpSink, outputGuard, parseApprovalDecision, parseSkillFrontmatter, pathSandbox, piiRedaction, pluginCapabilities, portkeyGateway, portkeyGuardrail, preopenSkills, preopenToolCallId, prepareStrictToolMenu, promptInjectionGuard, rateLimit, readMemoryFacts, redactText, regexGuardrail, regexRule, replaceTextContent, resolveAvailableSkills, resolveAvailableSubagents, resolveInputRetention, resolveMemoryStore, resolveReasoning, resolveStrategy, resolveSubagentTools, resolveSummarizationRetention, resolveToolApprovalState, resolveUserQuestionState, responseCache, restoreSnapshot, restoreToolCalls, runSmartAgentEvalHarness, scoreItemsByRelevance, searchSkills, seedChildMessages, selectTopIndicesInOrder, sessionMetrics, setTokenCounter, startStreamingSession, summarizeObject, supportsAdaptiveThinking, textFromContent, toMessageUsage, toStrictCompatible, toStrictToolSchema, tokenize, toolPolicy, traceSessionToOtlp, validateReasoningConfig, validateToolArgs, webhookApproval, withTools, withinDepth, writeSummaryFactsToMemory };