@corbat-tech/coco 2.39.0 → 2.41.0

package/dist/{agent-runtime-DJY9FzL_.d.ts → context-BLPsKYxc.d.ts}

@@ -1,4 +1,4 @@
-import { T as ToolRegistry, a as ToolDefinition$1 } from './registry-CEpl9Jq0.js';
+import { z } from 'zod';
 
 /**
  * Unified thinking/reasoning mode support for all LLM providers.
@@ -87,7 +87,7 @@ interface Message {
 /**
  * Tool definition for LLM
  */
-interface ToolDefinition {
+interface ToolDefinition$1 {
     name: string;
     description: string;
     input_schema: {
@@ -138,7 +138,7 @@ interface ChatResponse {
  * Chat with tools options
  */
 interface ChatWithToolsOptions extends ChatOptions {
-    tools: ToolDefinition[];
+    tools: ToolDefinition$1[];
     toolChoice?: "auto" | "any" | {
         type: "tool";
         name: string;
@@ -302,19 +302,117 @@ type ProviderType = "anthropic" | "openai" | "codex" | "copilot" | "gemini" | "v
  */
 declare function createProvider(type: ProviderType, config?: ProviderConfig): Promise<LLMProvider>;
 
-/** Catalog-backed provider/model registry used by runtime consumers. */
-declare class ProviderRegistry {
-    listProviders(): ProviderCatalogEntry[];
-    getProvider(provider: ProviderType): ProviderCatalogEntry;
-    listModels(provider: ProviderType): ModelCatalogEntry[];
-    getModel(provider: ProviderType, model: string): ModelCatalogEntry | undefined;
-    getDefaultModel(provider: ProviderType): string;
-    getRecommendedModel(provider: ProviderType): ModelCatalogEntry;
-    getCapability(provider: ProviderType, model?: string): ProviderRuntimeCapability;
-    createProvider(provider: ProviderType, config?: ProviderConfig): Promise<LLMProvider>;
-    probe(provider: ProviderType, model: string | undefined, checkAvailability?: () => Promise<boolean>): Promise<ProviderProbeResult>;
-}
-declare function createProviderRegistry(): ProviderRegistry;
+/**
+ * Tool Registry for Corbat-Coco
+ * Central management of all available tools
+ */
+
+/**
+ * Tool definition
+ */
+interface ToolDefinition<TInput = unknown, TOutput = unknown> {
+    name: string;
+    description: string;
+    category: ToolCategory;
+    parameters: z.ZodType<TInput, any, any>;
+    execute: (params: TInput) => Promise<TOutput>;
+}
+/**
+ * Tool categories
+ */
+type ToolCategory = "file" | "bash" | "git" | "test" | "quality" | "build" | "deploy" | "config" | "web" | "search" | "memory" | "document";
+/**
+ * Tool execution result
+ */
+interface ToolResult<T = unknown> {
+    success: boolean;
+    data?: T;
+    error?: string;
+    duration: number;
+}
+/**
+ * Progress callback for long-running operations
+ */
+type ProgressCallback = (progress: ProgressInfo) => void;
+/**
+ * Progress information
+ */
+interface ProgressInfo {
+    /** Current step or phase name */
+    phase: string;
+    /** Progress percentage (0-100), null if indeterminate */
+    percent: number | null;
+    /** Human-readable message */
+    message?: string;
+    /** Estimated time remaining in ms, null if unknown */
+    estimatedTimeRemaining?: number | null;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Options for tool execution
+ */
+interface ExecuteOptions {
+    /** Progress callback for long operations */
+    onProgress?: ProgressCallback;
+    /** Abort signal for cancellation */
+    signal?: AbortSignal;
+}
+/**
+ * Tool registry
+ */
+declare class ToolRegistry {
+    private tools;
+    private logger;
+    /**
+     * Register a tool
+     */
+    register<TInput, TOutput>(tool: ToolDefinition<TInput, TOutput>): void;
+    /**
+     * Unregister a tool
+     */
+    unregister(name: string): boolean;
+    /**
+     * Get a tool by name
+     */
+    get<TInput = unknown, TOutput = unknown>(name: string): ToolDefinition<TInput, TOutput> | undefined;
+    /**
+     * Check if a tool exists
+     */
+    has(name: string): boolean;
+    /**
+     * Get all tools
+     */
+    getAll(): ToolDefinition[];
+    /**
+     * Get tools by category
+     */
+    getByCategory(category: ToolCategory): ToolDefinition[];
+    /**
+     * Execute a tool
+     */
+    execute<TInput, TOutput>(name: string, params: TInput, options?: ExecuteOptions): Promise<ToolResult<TOutput>>;
+    /**
+     * Get tool definitions for LLM (simplified format)
+     */
+    getToolDefinitionsForLLM(): Array<{
+        name: string;
+        description: string;
+        input_schema: Record<string, unknown>;
+    }>;
+}
+/**
+ * Get the global tool registry
+ */
+declare function getToolRegistry(): ToolRegistry;
+/**
+ * Create a new tool registry
+ */
+declare function createToolRegistry(): ToolRegistry;
+/**
+ * Helper to create a tool definition with type safety
+ */
+declare function defineTool<TInput, TOutput>(definition: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
 
 /**
  * Agent mode registry.
@@ -336,204 +434,6 @@ declare function getAgentMode(mode: AgentModeId): AgentModeDefinition;
 declare function listAgentModes(): AgentModeDefinition[];
 declare function isAgentMode(value: string): value is AgentModeId;
 
-type ReasoningEffort = "auto" | "low" | "medium" | "high" | "max";
-type RuntimeMode = AgentModeId;
-interface AgentRuntimeOptions {
-    providerType: ProviderType;
-    model?: string;
-    providerConfig?: ProviderConfig;
-    provider?: LLMProvider;
-    toolRegistry?: ToolRegistry;
-    /** Legacy CLI session store passthrough. Runtime APIs use runtimeSessionStore. */
-    sessionStore?: unknown;
-    runtimeSessionStore?: RuntimeSessionStore;
-    workflowEngine?: WorkflowEngine;
-    permissionPolicy?: PermissionPolicy;
-    eventLog?: EventLog;
-    eventLogPath?: string;
-    turnRunner?: RuntimeTurnRunner;
-    /**
-     * Publish provider/tools into Coco's legacy process-global subagent bridge.
-     * CLI/headless use this for compatibility; embedders should leave it false.
-     */
-    publishToGlobalBridge?: boolean;
-}
-interface AgentRuntimeSnapshot {
-    provider: {
-        type: ProviderType;
-        model: string;
-        capability: ProviderRuntimeCapability;
-    };
-    tools: {
-        count: number;
-        names: string[];
-    };
-    modes: AgentModeDefinition[];
-}
-type RuntimeEventType = "runtime.initialized" | "provider.attached" | "provider.created" | "provider.updated" | "turn.started" | "turn.completed" | "turn.cancelled" | "turn.failed" | "tool.started" | "tool.completed" | "tool.allowed" | "tool.blocked" | "tool.skipped" | "agent.started" | "agent.graph.started" | "agent.graph.completed" | "agent.graph.failed" | "agent.tool.called" | "agent.handoff.created" | "agent.artifact.created" | "agent.completed" | "agent.failed" | "guardrail.input" | "guardrail.output" | "guardrail.tool" | "workflow.planned" | "workflow.started" | "workflow.completed" | "workflow.failed" | "workflow.gate.passed" | "workflow.gate.failed" | "shared_state.updated" | "session.created" | "session.updated" | "checkpoint.created" | "error";
-interface RuntimeEvent {
-    id: string;
-    type: RuntimeEventType;
-    timestamp: string;
-    data: Record<string, unknown>;
-}
-interface EventLog {
-    record(type: RuntimeEventType, data?: Record<string, unknown>): RuntimeEvent;
-    list(): RuntimeEvent[];
-    count(): number;
-    clear(): void;
-}
-interface PermissionDecision {
-    allowed: boolean;
-    reason?: string;
-    requiresConfirmation?: boolean;
-    risk: "read-only" | "write" | "network" | "destructive" | "secrets-sensitive";
-}
-interface PermissionPolicy {
-    canExecuteTool(mode: RuntimeMode, tool: ToolDefinition$1): PermissionDecision;
-    canExecuteToolInput?(mode: RuntimeMode, tool: ToolDefinition$1, input: Record<string, unknown>): PermissionDecision;
-}
-interface ProviderRuntimeSelection {
-    provider: ProviderType;
-    model: string;
-    thinking?: ThinkingMode;
-}
-interface RuntimeSession {
-    id: string;
-    createdAt: string;
-    updatedAt: string;
-    mode: RuntimeMode;
-    messages: Message[];
-    instructions?: string;
-    metadata: Record<string, unknown>;
-}
-interface RuntimeSessionCreateOptions {
-    id?: string;
-    mode?: RuntimeMode;
-    instructions?: string;
-    metadata?: Record<string, unknown>;
-    messages?: Message[];
-}
-interface RuntimeSessionStore {
-    create(options?: RuntimeSessionCreateOptions): RuntimeSession;
-    get(id: string): RuntimeSession | undefined;
-    update(session: RuntimeSession): RuntimeSession;
-    list(): RuntimeSession[];
-    delete(id: string): boolean;
-}
-interface RuntimeTurnInput {
-    content: string;
-    sessionId?: string;
-    mode?: RuntimeMode;
-    options?: ChatOptions;
-    metadata?: Record<string, unknown>;
-    /**
-     * Tool names that the embedding product has explicitly confirmed for this
-     * turn. Destructive tools are still blocked unless listed here.
-     */
-    confirmedTools?: string[];
-}
-interface RuntimeTurnResult {
-    sessionId: string;
-    content: string;
-    usage: {
-        inputTokens: number;
-        outputTokens: number;
-        estimated?: boolean;
-    };
-    model: string;
-    mode: RuntimeMode;
-}
-type RuntimeTurnStreamEvent = {
-    type: "text";
-    sessionId: string;
-    text: string;
-} | {
-    type: "done";
-    sessionId: string;
-    result: RuntimeTurnResult;
-} | {
-    type: "error";
-    sessionId: string;
-    error: string;
-};
-interface RuntimeTurnContext {
-    runtime: unknown;
-    session: RuntimeSession;
-    provider: LLMProvider;
-    toolRegistry: ToolRegistry;
-    permissionPolicy: PermissionPolicy;
-    eventLog: EventLog;
-}
-interface RuntimeTurnRunner {
-    run(input: RuntimeTurnInput, context: RuntimeTurnContext): Promise<RuntimeTurnResult>;
-}
-interface RuntimeToolExecutionInput {
-    sessionId?: string;
-    mode?: RuntimeMode;
-    toolName: string;
-    input: Record<string, unknown>;
-    confirmed?: boolean;
-    metadata?: Record<string, unknown>;
-}
-interface RuntimeToolExecutionResult {
-    toolName: string;
-    success: boolean;
-    output?: unknown;
-    error?: string;
-    duration: number;
-    decision: PermissionDecision;
-}
-
-type WorkflowRisk = "read-only" | "write" | "network" | "destructive" | "secrets-sensitive";
-interface WorkflowStepDefinition {
-    id: string;
-    description: string;
-    requiredTools: string[];
-    risk: WorkflowRisk;
-}
-interface WorkflowRetryPolicy {
-    maxAttempts: number;
-    backoffMs?: number;
-}
-interface WorkflowDefinition {
-    id: string;
-    name: string;
-    description: string;
-    inputSchema: string;
-    /** Legacy linear workflow steps. Prefer nodes for new multi-agent workflows. */
-    steps: WorkflowStepDefinition[];
-    nodes?: AgentGraphNode[];
-    edges?: AgentGraphDefinition["edges"];
-    gates?: AgentGateDefinition[];
-    retryPolicy?: WorkflowRetryPolicy;
-    parallelism?: number;
-    checks: string[];
-    outputKind: "markdown" | "json" | "patch" | "pull-request" | "release";
-    replayable: boolean;
-}
-interface WorkflowPlan {
-    id: string;
-    workflowId: string;
-    input: Record<string, unknown>;
-    status: "planned";
-    createdAt: string;
-}
-declare function workflowToAgentGraph(workflow: WorkflowDefinition): AgentGraphDefinition;
-/** Descriptive catalog of reusable workflow definitions; it does not execute workflows. */
-declare class WorkflowCatalog {
-    private workflows;
-    constructor(workflows?: WorkflowDefinition[]);
-    register(workflow: WorkflowDefinition): void;
-    get(id: string): WorkflowDefinition | undefined;
-    list(): WorkflowDefinition[];
-    createPlan(workflowId: string, input: Record<string, unknown>, eventLog?: EventLog): WorkflowPlan;
-}
-declare const DEFAULT_WORKFLOWS: WorkflowDefinition[];
-declare const WorkflowRegistry: typeof WorkflowCatalog;
-declare function createWorkflowCatalog(workflows?: WorkflowDefinition[]): WorkflowCatalog;
-declare function createWorkflowRegistry(workflows?: WorkflowDefinition[]): WorkflowCatalog;
-
 type AgentRole = "researcher" | "planner" | "architect" | "editor" | "coder" | "tester" | "reviewer" | "optimizer" | "security" | "qa" | "integrator" | "pm" | "docs" | "database";
 interface AgentBudget {
     maxTurns?: number;
@@ -666,6 +566,7 @@ interface AgentGraphNode {
         maxAttempts: number;
         backoffMs?: number;
     };
+    timeoutMs?: number;
     condition?: string;
 }
 interface AgentGraphEdge {
@@ -717,6 +618,7 @@ interface SharedWorkspaceRecord {
     createdAt: string;
 }
 interface SharedWorkspaceWriteInput {
+    id?: string;
     kind: SharedWorkspaceRecordKind;
     key: string;
     value: unknown;
@@ -832,6 +734,7 @@ interface AgentGraphEngineOptions {
     nodeExecutor?: AgentGraphNodeExecutor;
     gateEvaluator?: AgentGateEvaluator;
     trace?: AgentTraceContext;
+    allowSimulated?: boolean;
 }
 interface AgentGraphRunInput {
     workflowRunId: string;
@@ -888,6 +791,67 @@ declare function normalizeAgentRunResult(input: {
 }): AgentRunResult;
 declare function validateAgentCapabilities(capability: AgentCapability, requiredTools?: string[]): AgentGraphValidationIssue[];
 declare function validateAgentGraph(graph: AgentGraphDefinition): AgentGraphValidationResult;
+declare function dryRunAgentGraphNodeExecutor(execution: AgentGraphNodeExecution): Promise<AgentRunResult>;
+
+interface AgentRunnerExecutionInput {
+    task: AgentTask;
+    capability: AgentCapability;
+    trace?: AgentTraceContext;
+    toolRiskManifest?: ToolRiskManifest;
+}
+interface AgentRunnerExecutionContext {
+    task: AgentTask;
+    capability: AgentCapability;
+    trace: AgentTraceContext;
+    assertToolAllowed(toolName: string): void;
+}
+type AgentRunnerExecutor = (context: AgentRunnerExecutionContext) => Promise<AgentRunnerRawResult>;
+interface AgentRunnerRawResult {
+    output: string;
+    success?: boolean;
+    turns?: number;
+    toolsUsed?: string[];
+    inputTokens?: number;
+    outputTokens?: number;
+    error?: string;
+    metadata?: Record<string, unknown>;
+}
+interface AgentRunnerOptions {
+    eventLog?: EventLog;
+    executor?: AgentRunnerExecutor;
+}
+declare class AgentRunner {
+    private readonly options;
+    constructor(options?: AgentRunnerOptions);
+    run(input: AgentRunnerExecutionInput): Promise<AgentRunResult>;
+}
+declare function createAgentRunner(options?: AgentRunnerOptions): AgentRunner;
+
+declare class AgentDefinitionRegistry {
+    private readonly definitionsByRole;
+    private readonly definitionsById;
+    constructor(definitions?: AgentDefinition[]);
+    register(definition: AgentDefinition): void;
+    get(id: string): AgentDefinition | undefined;
+    getByRole(role: AgentRole): AgentDefinition | undefined;
+    list(): AgentDefinition[];
+}
+interface RuntimeAgentNodeExecutorOptions {
+    registry: AgentDefinitionRegistry;
+    runner?: AgentRunner;
+    runnerOptions?: AgentRunnerOptions;
+    runtimePolicy?: RuntimePolicy;
+    toolRiskManifest?: ToolRiskManifest;
+}
+declare class RuntimeAgentNodeExecutor {
+    private readonly options;
+    private readonly runner;
+    constructor(options: RuntimeAgentNodeExecutorOptions);
+    execute: AgentGraphNodeExecutor;
+    private findBlockedTool;
+}
+declare function createAgentDefinitionRegistry(definitions?: AgentDefinition[]): AgentDefinitionRegistry;
+declare function createRuntimeAgentNodeExecutor(options: RuntimeAgentNodeExecutorOptions): AgentGraphNodeExecutor;
 
 type WorkflowRunStatus = "completed" | "failed";
 interface WorkflowRunInput {
@@ -917,12 +881,20 @@ interface WorkflowEngineOptions {
     eventLog?: EventLog;
     sharedState?: SharedWorkspaceStore;
     nodeExecutor?: AgentGraphNodeExecutor;
+    agentDefinitionRegistry?: AgentDefinitionRegistry;
+    agentNodeExecutorOptions?: Omit<RuntimeAgentNodeExecutorOptions, "registry" | "runtimePolicy">;
+    runtimePolicy?: RuntimePolicy;
+    runtimeContext?: RuntimeRequestContext;
+    runtimeHostMode?: RuntimeHostMode;
 }
 declare class WorkflowEngine {
     private readonly catalog;
     private readonly eventLog;
     private handlers;
     private readonly sharedState;
+    private readonly runtimePolicy?;
+    private readonly runtimeContext?;
+    private readonly runtimeHostMode;
     private nodeExecutor?;
     constructor(catalog?: WorkflowCatalog, eventLog?: EventLog, options?: Omit<WorkflowEngineOptions, "catalog" | "eventLog">);
     registerHandler(workflowId: string, handler: WorkflowHandler): void;
@@ -932,38 +904,318 @@ declare class WorkflowEngine {
 }
 declare function createWorkflowEngine(catalog?: WorkflowCatalog, eventLog?: EventLog, options?: Omit<WorkflowEngineOptions, "catalog" | "eventLog">): WorkflowEngine;
 
-/**
- * Reusable runtime facade for wiring providers, tools, permissions, sessions,
- * and observability. It does not own the CLI loop; CLI/headless are adapters on
- * top of this boundary.
- */
-declare class AgentRuntime {
-    private readonly options;
-    readonly providerRegistry: ProviderRegistry;
-    readonly toolRegistry: ToolRegistry;
-    readonly sessionStore: unknown;
-    readonly runtimeSessionStore: RuntimeSessionStore;
-    readonly workflowEngine: WorkflowEngine;
-    readonly permissionPolicy: PermissionPolicy;
-    readonly eventLog: EventLog;
-    readonly turnRunner: RuntimeTurnRunner;
-    private providerType;
-    private model;
-    private provider?;
-    constructor(options: AgentRuntimeOptions);
-    initialize(): Promise<void>;
-    getModel(): string;
-    updateProvider(providerType: ProviderType, model: string | undefined, provider: LLMProvider): void;
-    private publishToGlobalBridge;
-    snapshot(): AgentRuntimeSnapshot;
-    createSession(options?: RuntimeSessionCreateOptions): RuntimeSession;
-    getSession(sessionId: string): RuntimeSession | undefined;
-    listSessions(): RuntimeSession[];
-    runTurn(input: RuntimeTurnInput): Promise<RuntimeTurnResult>;
-    streamTurn(input: RuntimeTurnInput): AsyncIterable<RuntimeTurnStreamEvent>;
-    executeTool(input: RuntimeToolExecutionInput): Promise<RuntimeToolExecutionResult>;
-    assertToolAllowed(mode: RuntimeMode, toolName: string, input?: Record<string, unknown>): boolean;
-}
-declare function createAgentRuntime(options: AgentRuntimeOptions): Promise<AgentRuntime>;
+type ReasoningEffort = "auto" | "low" | "medium" | "high" | "max";
+type RuntimeMode = AgentModeId;
+interface AgentRuntimeOptions {
+    providerType: ProviderType;
+    model?: string;
+    providerConfig?: ProviderConfig;
+    provider?: LLMProvider;
+    toolRegistry?: ToolRegistry;
+    /** Legacy CLI session store passthrough. Runtime APIs use runtimeSessionStore. */
+    sessionStore?: unknown;
+    runtimeSessionStore?: RuntimeSessionStore;
+    workflowEngine?: WorkflowEngine;
+    permissionPolicy?: PermissionPolicy;
+    eventLog?: EventLog;
+    eventLogPath?: string;
+    turnRunner?: RuntimeTurnRunner;
+    /**
+     * Publish provider/tools into Coco's legacy process-global subagent bridge.
+     * CLI/headless use this for compatibility; embedders should leave it false.
+     */
+    publishToGlobalBridge?: boolean;
+    legacyAgentBridge?: {
+        setAgentProvider(provider: LLMProvider): void;
+        setAgentToolRegistry(registry: ToolRegistry): void;
+    };
+    runtimeContext?: RuntimeRequestContext;
+    runtimePolicy?: RuntimePolicy;
+    runtimeHostMode?: RuntimeHostMode;
+    agentDefinitionRegistry?: AgentDefinitionRegistry;
+}
+interface AgentRuntimeSnapshot {
+    provider: {
+        type: ProviderType;
+        model: string;
+        capability: ProviderRuntimeCapability;
+    };
+    tools: {
+        count: number;
+        names: string[];
+    };
+    modes: AgentModeDefinition[];
+    context?: RuntimeRequestContext;
+    policy?: RuntimePolicy;
+    hostMode: RuntimeHostMode;
+}
+type RuntimeEventType = "runtime.initialized" | "provider.attached" | "provider.created" | "provider.updated" | "retention.cleanup" | "turn.started" | "turn.completed" | "turn.cancelled" | "turn.failed" | "tool.started" | "tool.completed" | "tool.allowed" | "tool.blocked" | "tool.skipped" | "agent.started" | "agent.graph.started" | "agent.graph.completed" | "agent.graph.failed" | "agent.tool.called" | "agent.handoff.created" | "agent.artifact.created" | "agent.completed" | "agent.failed" | "guardrail.input" | "guardrail.output" | "guardrail.tool" | "workflow.planned" | "workflow.started" | "workflow.completed" | "workflow.failed" | "workflow.gate.passed" | "workflow.gate.failed" | "shared_state.updated" | "session.created" | "session.updated" | "checkpoint.created" | "error";
+interface RuntimeEvent {
+    id: string;
+    type: RuntimeEventType;
+    timestamp: string;
+    data: Record<string, unknown>;
+}
+interface EventLog {
+    record(type: RuntimeEventType, data?: Record<string, unknown>): RuntimeEvent;
+    list(): RuntimeEvent[];
+    count(): number;
+    clear(): void;
+}
+interface AsyncEventLog {
+    record(type: RuntimeEventType, data?: Record<string, unknown>): Promise<RuntimeEvent>;
+    list(): Promise<RuntimeEvent[]>;
+    count(): Promise<number>;
+    clear(): Promise<void>;
+}
+interface PermissionDecision {
+    allowed: boolean;
+    reason?: string;
+    requiresConfirmation?: boolean;
+    risk: "read-only" | "write" | "network" | "destructive" | "secrets-sensitive";
+}
+interface PermissionPolicy {
+    canExecuteTool(mode: RuntimeMode, tool: ToolDefinition): PermissionDecision;
+    canExecuteToolInput?(mode: RuntimeMode, tool: ToolDefinition, input: Record<string, unknown>): PermissionDecision;
+}
+interface ProviderRuntimeSelection {
+    provider: ProviderType;
+    model: string;
+    thinking?: ThinkingMode;
+}
+interface RuntimeSession {
+    id: string;
+    createdAt: string;
+    updatedAt: string;
+    mode: RuntimeMode;
+    messages: Message[];
+    instructions?: string;
+    metadata: Record<string, unknown>;
+}
+interface RuntimeSessionCreateOptions {
+    id?: string;
+    mode?: RuntimeMode;
+    instructions?: string;
+    metadata?: Record<string, unknown>;
+    messages?: Message[];
+}
+interface RuntimeSessionStore {
+    create(options?: RuntimeSessionCreateOptions): RuntimeSession;
+    get(id: string): RuntimeSession | undefined;
+    update(session: RuntimeSession): RuntimeSession;
+    list(): RuntimeSession[];
+    delete(id: string): boolean;
+}
+interface AsyncRuntimeSessionStore {
+    create(options?: RuntimeSessionCreateOptions): Promise<RuntimeSession>;
+    get(id: string): Promise<RuntimeSession | undefined>;
+    update(session: RuntimeSession): Promise<RuntimeSession>;
+    list(): Promise<RuntimeSession[]>;
+    delete(id: string): Promise<boolean>;
+}
+interface RuntimeTurnInput {
+    content: string;
+    sessionId?: string;
+    mode?: RuntimeMode;
+    options?: ChatOptions;
+    metadata?: Record<string, unknown>;
+    /**
+     * Tool names that the embedding product has explicitly confirmed for this
+     * turn. Destructive tools are still blocked unless listed here.
+     */
+    confirmedTools?: string[];
+}
+interface RuntimeTurnResult {
+    sessionId: string;
+    content: string;
+    usage: {
+        inputTokens: number;
+        outputTokens: number;
+        estimated?: boolean;
+    };
+    model: string;
+    mode: RuntimeMode;
+}
+type RuntimeTurnStreamEvent = {
+    type: "text";
+    sessionId: string;
+    text: string;
+} | {
+    type: "done";
+    sessionId: string;
+    result: RuntimeTurnResult;
+} | {
+    type: "error";
+    sessionId: string;
+    error: string;
+};
+interface RuntimeTurnContext {
+    runtime: unknown;
+    session: RuntimeSession;
+    provider: LLMProvider;
+    toolRegistry: ToolRegistry;
+    permissionPolicy: PermissionPolicy;
+    eventLog: EventLog;
+}
+interface RuntimeTurnRunner {
+    run(input: RuntimeTurnInput, context: RuntimeTurnContext): Promise<RuntimeTurnResult>;
+}
+interface RuntimeToolExecutionInput {
+    sessionId?: string;
+    mode?: RuntimeMode;
+    toolName: string;
+    input: Record<string, unknown>;
+    confirmed?: boolean;
+    metadata?: Record<string, unknown>;
+}
+interface RuntimeToolExecutionResult {
+    toolName: string;
+    success: boolean;
+    output?: unknown;
+    error?: string;
+    duration: number;
+    decision: PermissionDecision;
+}
+
+type WorkflowRisk = "read-only" | "write" | "network" | "destructive" | "secrets-sensitive";
+interface WorkflowStepDefinition {
+    id: string;
+    description: string;
+    requiredTools: string[];
+    risk: WorkflowRisk;
+}
+interface WorkflowRetryPolicy {
+    maxAttempts: number;
+    backoffMs?: number;
+}
+interface WorkflowDefinition {
+    id: string;
+    name: string;
+    description: string;
+    inputSchema: string;
+    /** Legacy linear workflow steps. Prefer nodes for new multi-agent workflows. */
+    steps: WorkflowStepDefinition[];
+    nodes?: AgentGraphNode[];
+    edges?: AgentGraphDefinition["edges"];
+    gates?: AgentGateDefinition[];
+    retryPolicy?: WorkflowRetryPolicy;
+    parallelism?: number;
+    checks: string[];
+    outputKind: "markdown" | "json" | "patch" | "pull-request" | "release";
+    replayable: boolean;
+}
+interface WorkflowPlan {
+    id: string;
+    workflowId: string;
+    input: Record<string, unknown>;
+    status: "planned";
+    createdAt: string;
+}
+declare function workflowToAgentGraph(workflow: WorkflowDefinition): AgentGraphDefinition;
+/** Descriptive catalog of reusable workflow definitions; it does not execute workflows. */
+declare class WorkflowCatalog {
+    private workflows;
+    constructor(workflows?: WorkflowDefinition[]);
+    register(workflow: WorkflowDefinition): void;
+    get(id: string): WorkflowDefinition | undefined;
+    list(): WorkflowDefinition[];
+    createPlan(workflowId: string, input: Record<string, unknown>, eventLog?: EventLog): WorkflowPlan;
+}
+declare const DEFAULT_WORKFLOWS: WorkflowDefinition[];
+declare const WorkflowRegistry: typeof WorkflowCatalog;
+declare function createWorkflowCatalog(workflows?: WorkflowDefinition[]): WorkflowCatalog;
+declare function createWorkflowRegistry(workflows?: WorkflowDefinition[]): WorkflowCatalog;
+
+type RuntimeSurface = "cli" | "api" | "web" | "whatsapp" | "slack" | "teams" | "internal" | "mcp" | "worker";
+interface TenantContext {
+    id: string;
+    name?: string;
+    environment?: "development" | "staging" | "production";
+    metadata?: Record<string, unknown>;
+}
+interface UserContext {
+    id?: string;
+    displayName?: string;
+    roles?: string[];
+    groups?: string[];
+    metadata?: Record<string, unknown>;
+}
+interface DataBoundary {
+    region?: string;
+    classification?: "public" | "internal" | "confidential" | "restricted";
+    allowCrossTenantMemory?: boolean;
+    redactSensitiveData?: boolean;
+}
+interface CostBudget {
+    maxInputTokens?: number;
+    maxOutputTokens?: number;
+    maxEstimatedCostUsd?: number;
+    maxTurns?: number;
+}
+interface RetentionPolicy {
+    conversationDays?: number;
+    eventDays?: number;
+    artifactDays?: number;
+}
+interface RuntimePolicy {
+    allowedTools?: string[];
+    maxToolRisk?: WorkflowRisk;
+    requireHumanApprovalFor?: WorkflowRisk[];
+    dataBoundary?: DataBoundary;
+    costBudget?: CostBudget;
+    retention?: RetentionPolicy;
+    rateLimit?: {
+        maxRequestsPerMinute?: number;
+        maxConcurrentRuns?: number;
+    };
+}
+type RuntimeHostMode = "local" | "embedded" | "hosted";
+interface RuntimeRequestContext {
+    tenant?: TenantContext;
+    user?: UserContext;
+    surface: RuntimeSurface;
+    channel?: string;
+    correlationId?: string;
+    policy?: RuntimePolicy;
+    metadata?: Record<string, unknown>;
+}
+type RuntimePolicyViolationCode = "tenant_required" | "tool_not_allowed" | "risk_exceeded" | "approval_required" | "input_tokens_exceeded" | "output_tokens_exceeded" | "estimated_cost_exceeded" | "max_turns_exceeded" | "rate_limit_exceeded" | "concurrency_limit_exceeded";
+interface RuntimePolicyViolationInput {
+    code: RuntimePolicyViolationCode;
+    subject: string;
+    tenantId?: string;
+    policyPath: string;
+    severity?: "warning" | "blocked";
+    message: string;
+}
+declare class RuntimePolicyViolation extends Error {
+    readonly code: RuntimePolicyViolationCode;
+    readonly subject: string;
+    readonly tenantId?: string;
+    readonly policyPath: string;
+    readonly severity: "warning" | "blocked";
+    constructor(input: RuntimePolicyViolationInput);
+}
+interface RuntimeTenantBoundary {
+    hostMode: RuntimeHostMode;
+    surface: RuntimeSurface;
+    tenantId?: string;
+    required: boolean;
+}
+declare function createRuntimeRequestContext(input?: Partial<RuntimeRequestContext>): RuntimeRequestContext;
+declare function mergeRuntimePolicy(base: RuntimePolicy | undefined, override: RuntimePolicy | undefined): RuntimePolicy | undefined;
+declare function runtimeContextToMetadata(context: RuntimeRequestContext | undefined): Record<string, unknown>;
+declare function createRuntimeTenantBoundary(context: RuntimeRequestContext | undefined, hostMode?: RuntimeHostMode): RuntimeTenantBoundary;
+declare function assertRuntimeTenantBoundary(context: RuntimeRequestContext | undefined, hostMode?: RuntimeHostMode, subject?: string): RuntimeTenantBoundary;
+declare function assertRuntimeTurnWithinPolicy(policy: RuntimePolicy | undefined, input: {
+    subject: string;
+    currentTurns: number;
+    tenantId?: string;
+}): void;
+declare function createRetentionCutoffs(policy: RuntimePolicy | undefined, now?: Date): {
+    conversationBefore?: string;
+    eventBefore?: string;
+    artifactBefore?: string;
+};
 
-export { type AgentTask as $, AGENT_MODES as A, type AgentMessageRole as B, type ChatOptions as C, type AgentModeDefinition as D, type AgentModeId as E, type AgentRole as F, type AgentRunResult as G, type AgentRunStatus as H, AgentRuntime as I, type AgentRuntimeOptions as J, type AgentRuntimeSnapshot as K, type LLMProvider as L, type Message as M, type AgentToolPolicyDecision as N, type AgentTraceContext as O, type ProviderConfig as P, DEFAULT_WORKFLOWS as Q, type EventLog as R, type StreamChunk as S, FileSharedWorkspaceStore as T, InMemorySharedWorkspaceStore as U, type LegacyAgentRoleMapping as V, type PermissionDecision as W, type PermissionPolicy as X, ProviderRegistry as Y, type ProviderRuntimeSelection as Z, type ReasoningEffort as _, type ChatResponse as a, type RuntimeEvent as a0, type RuntimeEventType as a1, type RuntimeMode as a2, type RuntimeSession as a3, type RuntimeSessionCreateOptions as a4, type RuntimeSessionStore as a5, type RuntimeToolExecutionInput as a6, type RuntimeToolExecutionResult as a7, type RuntimeTurnContext as a8, type RuntimeTurnInput as a9, createAgentArtifact as aA, createAgentGraphEngine as aB, createAgentRuntime as aC, createAgentTraceContext as aD, createProvider as aE, createProviderRegistry as aF, createSummaryArtifact as aG, createWorkflowCatalog as aH, createWorkflowEngine as aI, createWorkflowRegistry as aJ, evaluateAgentToolPolicy as aK, getAgentMode as aL, isAgentMode as aM, listAgentModes as aN, listLegacyAgentRoleMappings as aO, mapLegacyAgentRole as aP, normalizeAgentRunResult as aQ, validateAgentCapabilities as aR, validateAgentGraph as aS, workflowToAgentGraph as aT, type ProviderType as aU, type RuntimeTurnResult as aa, type RuntimeTurnRunner as ab, type RuntimeTurnStreamEvent as ac, type SharedWorkspaceProvenance as ad, type SharedWorkspaceRecord as ae, type SharedWorkspaceRecordKind as af, SharedWorkspaceState as ag, type SharedWorkspaceStateSnapshot as ah, type SharedWorkspaceStore as ai, type SharedWorkspaceWriteInput as aj, type ToolRiskLevel as ak, type ToolRiskManifest as al, type ToolRiskManifestEntry as am, WorkflowCatalog as an, type WorkflowDefinition as ao, WorkflowEngine as ap, type WorkflowHandler as aq, type WorkflowPlan as ar, WorkflowRegistry as as, type WorkflowRetryPolicy as at, type WorkflowRisk as au, type WorkflowRunContext as av, type WorkflowRunInput as aw, type WorkflowRunResult as ax, type WorkflowRunStatus as ay, type WorkflowStepDefinition as az, type ChatWithToolsOptions as b, type ChatWithToolsResponse as c, type AgentArtifact as d, type AgentArtifactKind as e, type AgentBudget as f, type AgentCapability as g, type AgentCard as h, type AgentDefinition as i, type AgentGateDefinition as j, type AgentGateKind as k, type AgentGraphDefinition as l, type AgentGraphEdge as m, AgentGraphEngine as n, type AgentGraphEngineOptions as o, type AgentGraphNode as p, type AgentGraphNodeExecution as q, type AgentGraphNodeExecutor as r, type AgentGraphRunInput as s, type AgentGraphRunResult as t, type AgentGraphRunStatus as u, type AgentGraphValidationIssue as v, type AgentGraphValidationResult as w, type AgentGuardrailPolicy as x, type AgentHandoff as y, type AgentMessage as z };
+export { type AgentGraphValidationIssue as $, type AgentRuntimeOptions as A, type AgentCapability as B, type ChatOptions as C, type DataBoundary as D, type EventLog as E, type AgentCard as F, type AgentDefinition as G, AgentDefinitionRegistry as H, type AgentGateDefinition as I, type AgentGateKind as J, type AgentGraphDefinition as K, type LLMProvider as L, type ModelCatalogEntry as M, type AgentGraphEdge as N, AgentGraphEngine as O, type ProviderType as P, type AgentGraphEngineOptions as Q, type RuntimeRequestContext as R, type StreamChunk as S, ToolRegistry as T, type AgentGraphNode as U, type AgentGraphNodeExecution as V, WorkflowEngine as W, type AgentGraphNodeExecutor as X, type AgentGraphRunInput as Y, type AgentGraphRunResult as Z, type AgentGraphRunStatus as _, type RuntimeTurnStreamEvent as a, type WorkflowStepDefinition as a$, type AgentGraphValidationResult as a0, type AgentGuardrailPolicy as a1, type AgentHandoff as a2, type AgentMessage as a3, type AgentMessageRole as a4, type AgentModeDefinition as a5, type AgentModeId as a6, type AgentRole as a7, type AgentRunResult as a8, type AgentRunStatus as a9, type RuntimePolicyViolationCode as aA, type RuntimeSurface as aB, type RuntimeTenantBoundary as aC, type RuntimeTurnContext as aD, type SharedWorkspaceProvenance as aE, type SharedWorkspaceRecord as aF, type SharedWorkspaceRecordKind as aG, SharedWorkspaceState as aH, type SharedWorkspaceStateSnapshot as aI, type SharedWorkspaceStore as aJ, type SharedWorkspaceWriteInput as aK, type TenantContext as aL, type ToolRiskLevel as aM, type ToolRiskManifest as aN, type ToolRiskManifestEntry as aO, type UserContext as aP, WorkflowCatalog as aQ, type WorkflowDefinition as aR, type WorkflowHandler as aS, type WorkflowPlan as aT, WorkflowRegistry as aU, type WorkflowRetryPolicy as aV, type WorkflowRisk as aW, type WorkflowRunContext as aX, type WorkflowRunInput as aY, type WorkflowRunResult as aZ, type WorkflowRunStatus as a_, AgentRunner as aa, type AgentRunnerExecutionContext as ab, type AgentRunnerExecutionInput as ac, type AgentRunnerExecutor as ad, type AgentRunnerOptions as ae, type AgentRunnerRawResult as af, type AgentToolPolicyDecision as ag, type AgentTraceContext as ah, type AsyncEventLog as ai, type AsyncRuntimeSessionStore as aj, type CostBudget as ak, DEFAULT_WORKFLOWS as al, FileSharedWorkspaceStore as am, InMemorySharedWorkspaceStore as an, type LegacyAgentRoleMapping as ao, type PermissionDecision as ap, type ProviderRuntimeSelection as aq, type ReasoningEffort as ar, type RetentionPolicy as as, RuntimeAgentNodeExecutor as at, type RuntimeAgentNodeExecutorOptions as au, type AgentTask as av, type RuntimeEvent as aw, type RuntimeEventType as ax, type RuntimeHostMode as ay, RuntimePolicyViolation as az, type ProviderConfig as b, assertRuntimeTenantBoundary as b0, assertRuntimeTurnWithinPolicy as b1, createAgentArtifact as b2, createAgentDefinitionRegistry as b3, createAgentGraphEngine as b4, createAgentRunner as b5, createAgentTraceContext as b6, createProvider as b7, createRuntimeAgentNodeExecutor as b8, createRuntimeRequestContext as b9, createRuntimeTenantBoundary as ba, createSummaryArtifact as bb, createToolRegistry as bc, createWorkflowCatalog as bd, createWorkflowEngine as be, createWorkflowRegistry as bf, dryRunAgentGraphNodeExecutor as bg, evaluateAgentToolPolicy as bh, getAgentMode as bi, isAgentMode as bj, listAgentModes as bk, listLegacyAgentRoleMappings as bl, mapLegacyAgentRole as bm, mergeRuntimePolicy as bn, normalizeAgentRunResult as bo, runtimeContextToMetadata as bp, validateAgentCapabilities as bq, validateAgentGraph as br, workflowToAgentGraph as bs, type ToolDefinition as bt, type ToolCategory as bu, type ToolResult as bv, defineTool as bw, getToolRegistry as bx, type RuntimeTurnRunner as c, type RuntimePolicy as d, type RuntimeSession as e, type RuntimeTurnInput as f, type RuntimeTurnResult as g, type ProviderCatalogEntry as h, type ProviderRuntimeCapability as i, type ProviderProbeResult as j, type RuntimeSessionStore as k, type PermissionPolicy as l, type AgentRuntimeSnapshot as m, type RuntimeSessionCreateOptions as n, createRetentionCutoffs as o, type RuntimeToolExecutionInput as p, type RuntimeToolExecutionResult as q, type RuntimeMode as r, type Message as s, type ChatResponse as t, type ChatWithToolsOptions as u, type ChatWithToolsResponse as v, AGENT_MODES as w, type AgentArtifact as x, type AgentArtifactKind as y, type AgentBudget as z };