@deepstrike/sdk 0.2.50 → 0.2.51

package/dist/types/agent.js

@@ -1,22 +1,4 @@
 import { getKernel } from "../kernel.js";
-/** Map kernel spawn observation → host manifest. */
-export function spawnObservationToManifest(obs, spec, parentSessionId) {
-    const o = obs;
-    return {
-        kind: "agent_process_changed",
-        turn: o.turn,
-        agent_id: String(o.agent_id ?? spec.identity.agentId),
-        parent_session_id: String(o.parent_session_id ?? parentSessionId),
-        role: String(o.role ?? spec.role),
-        isolation: String(o.isolation ?? spec.isolation ?? "shared"),
-        context_inheritance: String(o.context_inheritance ?? "none"),
-        permitted_capability_ids: o.permitted_capability_ids ?? [],
-    };
-}
-export function findSpawnProcessObservation(observations) {
-    const hit = observations.find(o => o.kind === "agent_process_changed" && typeof o.agent_id === "string");
-    return hit;
-}
 export function agentIdentitySub(agentId, sessionId, parentSessionId) {
     return {
         agentId,
@@ -97,6 +79,9 @@ export function subAgentResultToKernel(result) {
     const attempt = result.result.attempt;
     return {
         agent_id: result.agentId,
+        ...(result.submittedNodes?.length
+            ? { submitted_nodes: result.submittedNodes.map(workflowNodeSpecToKernel) }
+            : {}),
         result: {
             termination: result.result.termination,
             final_message: finalMessage
@@ -151,6 +136,18 @@ export function milestoneCheckPass(phaseId) {
 export function milestoneCheckFail(phaseId, reason) {
     return { phaseId, passed: false, reason };
 }
+/**
+ * R-B27: the conservative resolution the runner feeds back when an `evaluate_milestone` effect
+ * arrives with no phase `verifier` and no host `onMilestoneEvaluate` hook. Nothing can attest the
+ * phase, but the kernel is already holding the effect in its pending table — returning without an
+ * answer leaves a dangling effect that a logical-checkpoint recovery cannot resolve. The current
+ * `MilestoneResult` wire has no error field, so "could not be verified" is expressed with the
+ * shape the wire does have: `passed: false` (the phase does not advance — fail-closed).
+ *
+ * The string is part of the cross-SDK contract: WASM (`wasm/src/runtime/types/agent.ts`),
+ * Python (`deepstrike/types/agent.py`) and Rust must feed back the byte-identical reason.
+ */
+export const MILESTONE_UNVERIFIED_REASON = "milestone unverified: no verifier configured and no host evaluation hook (fail-closed)";
 export function workflowNodeStatusFromTermination(termination) {
     if (termination === "completed")
         return "completed";
@@ -196,6 +193,15 @@ export function workflowBudgetNote(budget) {
     if (budget.tokens_remaining != null && budget.tokens_max != null) {
         parts.push(`tokens ${budget.tokens_used ?? 0}/${budget.tokens_max} used, ${budget.tokens_remaining} remaining`);
     }
+    if (budget.max_total_tokens != null) {
+        parts.push(`tokens capped at ${budget.max_total_tokens}`);
+    }
+    if (budget.max_turns != null) {
+        parts.push(`turns capped at ${budget.max_turns}`);
+    }
+    if (budget.max_concurrency != null) {
+        parts.push(`concurrency capped at ${budget.max_concurrency}`);
+    }
     if (parts.length === 0)
         return "";
     return (`[workflow budget] ${parts.join(" · ")}. ` +
@@ -230,7 +236,7 @@ function nodeKindToKernel(n) {
         return { type: "tournament", entrants: n.tournament.entrants.map(workflowTaskToKernel) };
     return undefined;
 }
-/** Map one host `WorkflowNodeSpec` to its snake_case kernel JSON. Shared by `load_workflow` (the
+/** Map one host `WorkflowNodeSpec` to its snake_case canonical JSON. Shared by the workflow root (the
  *  whole spec) and `submit_workflow_nodes` (R3-1 runtime append) so the two encodings never drift. */
 export function workflowNodeSpecToKernel(n) {
     const kind = nodeKindToKernel(n);
@@ -254,32 +260,10 @@ export function workflowNodeSpecToKernel(n) {
         dep_policy: n.depPolicy ?? "all_success",
     };
 }
-/** Map a host `WorkflowSpec` to the snake_case kernel JSON (`load_workflow.spec`). */
+/** Map a host `WorkflowSpec` to the canonical workflow-root JSON. */
 export function workflowSpecToKernel(spec) {
     return { nodes: spec.nodes.map(workflowNodeSpecToKernel) };
 }
-/** R3-1: map a batch of host nodes to the `submit_workflow_nodes` kernel event body. G1: pass
- *  `submitterAgentId` (the node that requested the append) so the kernel can enforce no-privilege-
- *  escalation — a quarantined submitter's nodes are coerced to quarantined. Omitted ⇒ no coercion. */
-export function submitWorkflowNodesToKernel(nodes, submitterAgentId) {
-    return {
-        kind: "submit_workflow_nodes",
-        nodes: nodes.map(workflowNodeSpecToKernel),
-        ...(submitterAgentId ? { submitter_agent_id: submitterAgentId } : {}),
-    };
-}
-/** M5/G1: map an agent-authored spec to the `submit_workflow` kernel event body (the agent-reachable
- *  `Syscall::LoadWorkflow`). The kernel bootstraps the DAG when none is active, else flattens onto it.
- *  `parentSessionId` seeds child session ids on bootstrap; `submitterAgentId` carries G1 trust coercion
- *  on the flatten case (a quarantined author's nodes are coerced quarantined). */
-export function submitWorkflowToKernel(spec, parentSessionId, submitterAgentId) {
-    return {
-        kind: "submit_workflow",
-        spec: workflowSpecToKernel(spec),
-        parent_session_id: parentSessionId,
-        ...(submitterAgentId ? { submitter_agent_id: submitterAgentId } : {}),
-    };
-}
 /** Shared JSON-Schema for a workflow-node batch (a DAG). Used by both `submit_workflow_nodes`
  *  (append) and `start_workflow` (M5 v1: author a sub-workflow), so the two tools never drift. */
 const workflowNodesArraySchema = {

package/dist/workflow/public.d.ts

@@ -3,7 +3,7 @@ export type { SubAgentRunContext } from "../runtime/sub-agent-orchestrator.js";
 export { builtinReducers, resolveReducer } from "../runtime/reducers.js";
 export type { Reducer, ReducerRegistry, ReducerInput } from "../runtime/reducers.js";
 export { FileWorkflowStore } from "../runtime/workflow-store.js";
-export { submitWorkflowNodesTool, startWorkflowTool, generateAndFilter, verifyRules, genEval, milestoneCheckPass, milestoneCheckFail, } from "../types/agent.js";
+export { submitWorkflowNodesTool, startWorkflowTool, generateAndFilter, verifyRules, genEval, milestoneCheckPass, milestoneCheckFail, MILESTONE_UNVERIFIED_REASON, } from "../types/agent.js";
 export type { AgentCapabilityFilter, AgentIdentity, AgentIsolation, AgentRunSpec, AgentProcessChangedObservation, ContextInheritance, KernelAgentRole, LoopResult, MilestoneCheckResult, MilestoneContract, MilestonePhase, MilestonePolicy, SubAgentResult, TerminationReason, WorkflowSpawnInfo, WorkflowTaskSpec, WorkflowDependencyPolicy, WorkflowNodeStatus, WorkflowNodeOutcome, WorkflowOutcome, } from "../types/agent.js";
 export type { AcceptanceCriterion, VerificationContract, ContractCheckResult } from "../collaboration/contract.js";
 export { ContractBuilder, formatContractForSystemPrompt, contractToCriteriaStrings } from "../collaboration/contract.js";

package/dist/workflow/public.js

@@ -5,7 +5,7 @@
 export { SubAgentOrchestrator, defaultSubAgentOrchestrator, spawnStandalone } from "../runtime/sub-agent-orchestrator.js";
 export { builtinReducers, resolveReducer } from "../runtime/reducers.js";
 export { FileWorkflowStore } from "../runtime/workflow-store.js";
-export { submitWorkflowNodesTool, startWorkflowTool, generateAndFilter, verifyRules, genEval, milestoneCheckPass, milestoneCheckFail, } from "../types/agent.js";
+export { submitWorkflowNodesTool, startWorkflowTool, generateAndFilter, verifyRules, genEval, milestoneCheckPass, milestoneCheckFail, MILESTONE_UNVERIFIED_REASON, } from "../types/agent.js";
 export { ContractBuilder, formatContractForSystemPrompt, contractToCriteriaStrings } from "../collaboration/contract.js";
 export { HandoffBus } from "../collaboration/handoff.js";
 export { CreatorVerifierMode, OrchestrationMode } from "../collaboration/modes/creator-verifier.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.50",
+  "version": "0.2.51",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.50",
+    "@deepstrike/core": "0.2.51",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },

package/dist/runtime/kernel-rebuild.d.ts

@@ -1,13 +0,0 @@
-import type { KernelRuntimeHandle } from "./kernel-step.js";
-import { type KernelOperationCursor, type KernelOperationGenesis, type KernelTransaction } from "./kernel-transaction-log.js";
-export interface KernelRebuildResult {
-    runtime: KernelRuntimeHandle;
-    cursor: KernelOperationCursor;
-}
-/**
- * Deterministically fold an authoritative operation stream into a fresh runtime.
- *
- * The caller owns runtime construction, but its initial policy and replay-affecting defaults must
- * exactly match genesis. A failure leaves the supplied runtime unusable; callers must discard it.
- */
-export declare function rebuildKernelRuntime(runtime: KernelRuntimeHandle, genesis: KernelOperationGenesis, transactions: readonly KernelTransaction[]): KernelRebuildResult;

package/dist/runtime/kernel-rebuild.js

@@ -1,75 +0,0 @@
-import { KernelLogIntegrityError, kernelRecordDigest, verifyKernelTransactionStream, } from "./kernel-transaction-log.js";
-/**
- * Deterministically fold an authoritative operation stream into a fresh runtime.
- *
- * The caller owns runtime construction, but its initial policy and replay-affecting defaults must
- * exactly match genesis. A failure leaves the supplied runtime unusable; callers must discard it.
- */
-export function rebuildKernelRuntime(runtime, genesis, transactions) {
-    const cursor = verifyKernelTransactionStream(genesis, transactions);
-    assertFreshRuntimeMatchesGenesis(runtime, genesis);
-    for (const transaction of transactions) {
-        const prepared = JSON.parse(runtime.prepareStep(JSON.stringify(transaction.input)));
-        const token = prepared.prepare_token;
-        try {
-            if (prepared.status !== "prepared" || !token) {
-                throw new KernelLogIntegrityError(`kernel rebuild step ${transaction.step_seq} was not accepted as a new transition`);
-            }
-            if (prepared.base_generation !== transaction.base_generation) {
-                throw new KernelLogIntegrityError(`kernel rebuild generation ${prepared.base_generation} does not match transaction ${transaction.base_generation}`);
-            }
-            if (prepared.step.step_seq !== transaction.step_seq) {
-                throw new KernelLogIntegrityError(`kernel rebuild step_seq ${prepared.step.step_seq} does not match transaction ${transaction.step_seq}`);
-            }
-            if (kernelRecordDigest(prepared.input) !== transaction.input_digest) {
-                throw new KernelLogIntegrityError(`kernel rebuild normalized input diverged at step ${transaction.step_seq}`);
-            }
-            if (kernelRecordDigest(prepared.step) !== transaction.step_digest) {
-                throw new KernelLogIntegrityError(`kernel rebuild planned step diverged at step ${transaction.step_seq}`);
-            }
-            const committed = JSON.parse(runtime.commitPrepared(token));
-            if (kernelRecordDigest(committed) !== transaction.step_digest) {
-                throw new KernelLogIntegrityError(`kernel rebuild committed step diverged at step ${transaction.step_seq}`);
-            }
-        }
-        catch (error) {
-            if (token && prepared.status === "prepared") {
-                try {
-                    runtime.abortPrepared(token);
-                }
-                catch {
-                    // The caller must discard a failed rebuild runtime; preserve the primary integrity error.
-                }
-            }
-            throw error;
-        }
-    }
-    return { runtime, cursor };
-}
-function assertFreshRuntimeMatchesGenesis(runtime, genesis) {
-    const snapshot = JSON.parse(runtime.snapshot());
-    if (snapshot.abi_version !== genesis.abi_version) {
-        throw new KernelLogIntegrityError("kernel runtime ABI version does not match operation genesis");
-    }
-    if (genesis.default_policy_version !== 1) {
-        throw new KernelLogIntegrityError("kernel operation uses an unsupported default policy version");
-    }
-    if (snapshot.operation_id || snapshot.next_step_seq !== 1 || snapshot.accepted_inputs.length !== 0) {
-        throw new KernelLogIntegrityError("kernel rebuild requires a fresh runtime");
-    }
-    if (kernelRecordDigest(snapshot.initial_policy) !== kernelRecordDigest(genesis.initial_scheduler_policy)) {
-        throw new KernelLogIntegrityError("kernel runtime initial policy does not match operation genesis");
-    }
-    const defaults = resolvedRuntimeDefaults(snapshot);
-    if (kernelRecordDigest(defaults) !== kernelRecordDigest(genesis.resolved_runtime_defaults)) {
-        throw new KernelLogIntegrityError("kernel runtime defaults do not match operation genesis");
-    }
-}
-function resolvedRuntimeDefaults(snapshot) {
-    return {
-        snapshot_version: snapshot.snapshot_version,
-        snapshot_input_limit: snapshot.snapshot_input_limit,
-        max_input_bytes: snapshot.max_input_bytes,
-        snapshot_journal_bytes_limit: snapshot.snapshot_journal_bytes_limit,
-    };
-}

package/dist/runtime/kernel-transaction-log.d.ts

@@ -1,61 +0,0 @@
-export declare const KERNEL_LOG_RECORD_VERSION: 1;
-export interface KernelOperationGenesisBody {
-    record_version: typeof KERNEL_LOG_RECORD_VERSION;
-    abi_version: number;
-    operation_id: string;
-    initial_scheduler_policy: Record<string, unknown>;
-    resolved_runtime_defaults: Record<string, unknown>;
-    default_policy_version: number;
-}
-export interface KernelOperationGenesis extends KernelOperationGenesisBody {
-    genesis_digest: string;
-}
-export interface KernelTransactionBody {
-    record_version: typeof KERNEL_LOG_RECORD_VERSION;
-    operation_id: string;
-    step_seq: number;
-    base_generation: number;
-    input: Record<string, unknown>;
-    input_digest: string;
-    previous_transaction_digest: string;
-    step_digest: string;
-}
-export interface KernelTransaction extends KernelTransactionBody {
-    transaction_digest: string;
-}
-export interface KernelGenesisReceipt {
-    log_seq: number;
-    genesis_digest: string;
-}
-export interface DurableAppendReceipt {
-    log_seq: number;
-    transaction_digest: string;
-}
-export interface KernelOperationCursor {
-    operation_id: string;
-    next_event_sequence: number;
-    next_step_seq: number;
-    transaction_head_digest: string;
-}
-export declare class KernelLogConflictError extends Error {
-    constructor(message: string);
-}
-export declare class KernelLogIntegrityError extends Error {
-    constructor(message: string);
-}
-export declare function canonicalKernelJson(value: unknown): string;
-export declare function kernelRecordDigest(value: unknown): string;
-export declare function createKernelOperationGenesis(input: Omit<KernelOperationGenesisBody, "record_version">): Promise<KernelOperationGenesis>;
-export declare function createKernelTransaction(input: {
-    operation_id: string;
-    step_seq: number;
-    base_generation: number;
-    input: Record<string, unknown>;
-    step: Record<string, unknown>;
-    previous_transaction_digest: string;
-}): Promise<KernelTransaction>;
-export declare function verifyKernelOperationGenesis(genesis: KernelOperationGenesis): void;
-export declare function verifyKernelTransaction(transaction: KernelTransaction): void;
-export declare function verifyKernelTransactionSuccessor(previous: KernelTransaction | undefined, transaction: KernelTransaction): void;
-/** Validate one complete authoritative operation stream and derive its next wire cursor. */
-export declare function verifyKernelTransactionStream(genesis: KernelOperationGenesis, transactions: readonly KernelTransaction[]): KernelOperationCursor;

package/dist/runtime/kernel-transaction-log.js

@@ -1,149 +0,0 @@
-import { createHash } from "node:crypto";
-export const KERNEL_LOG_RECORD_VERSION = 1;
-export class KernelLogConflictError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "KernelLogConflictError";
-    }
-}
-export class KernelLogIntegrityError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "KernelLogIntegrityError";
-    }
-}
-export function canonicalKernelJson(value) {
-    if (value === null)
-        return "null";
-    if (typeof value === "string" || typeof value === "boolean")
-        return JSON.stringify(value);
-    if (typeof value === "number") {
-        if (!Number.isFinite(value))
-            throw new KernelLogIntegrityError("canonical records require finite numbers");
-        if (Number.isSafeInteger(value))
-            return JSON.stringify(Object.is(value, -0) ? 0 : value);
-        if (Number.isInteger(value)) {
-            throw new KernelLogIntegrityError("canonical record integer exceeds the cross-SDK safe range");
-        }
-        const bytes = new Uint8Array(8);
-        new DataView(bytes.buffer).setFloat64(0, value, false);
-        return `f64:${Array.from(bytes, byte => byte.toString(16).padStart(2, "0")).join("")}`;
-    }
-    if (Array.isArray(value))
-        return `[${value.map(canonicalKernelJson).join(",")}]`;
-    if (typeof value === "object") {
-        const object = value;
-        const keys = Object.keys(object).sort();
-        return `{${keys.map(key => `${JSON.stringify(key)}:${canonicalKernelJson(object[key])}`).join(",")}}`;
-    }
-    throw new KernelLogIntegrityError(`unsupported canonical record value: ${typeof value}`);
-}
-export function kernelRecordDigest(value) {
-    return createHash("sha256").update(canonicalKernelJson(value), "utf8").digest("hex");
-}
-export async function createKernelOperationGenesis(input) {
-    const body = {
-        record_version: KERNEL_LOG_RECORD_VERSION,
-        ...input,
-    };
-    validateGenesisBody(body);
-    return { ...body, genesis_digest: kernelRecordDigest(body) };
-}
-export async function createKernelTransaction(input) {
-    const body = {
-        record_version: KERNEL_LOG_RECORD_VERSION,
-        operation_id: input.operation_id,
-        step_seq: input.step_seq,
-        base_generation: input.base_generation,
-        input: input.input,
-        input_digest: kernelRecordDigest(input.input),
-        previous_transaction_digest: input.previous_transaction_digest,
-        step_digest: kernelRecordDigest(input.step),
-    };
-    validateTransactionBody(body);
-    return { ...body, transaction_digest: kernelRecordDigest(body) };
-}
-export function verifyKernelOperationGenesis(genesis) {
-    const { genesis_digest, ...body } = genesis;
-    validateGenesisBody(body);
-    if (kernelRecordDigest(body) !== genesis_digest) {
-        throw new KernelLogIntegrityError("kernel genesis digest does not match its canonical body");
-    }
-}
-export function verifyKernelTransaction(transaction) {
-    const { transaction_digest, ...body } = transaction;
-    validateTransactionBody(body);
-    if (kernelRecordDigest(body.input) !== body.input_digest) {
-        throw new KernelLogIntegrityError("kernel transaction input digest does not match its input");
-    }
-    if (kernelRecordDigest(body) !== transaction_digest) {
-        throw new KernelLogIntegrityError("kernel transaction digest does not match its canonical body");
-    }
-}
-export function verifyKernelTransactionSuccessor(previous, transaction) {
-    const expectedStepSeq = previous ? previous.step_seq + 1 : 1;
-    const expectedGeneration = previous ? previous.base_generation + 1 : 0;
-    if (transaction.step_seq !== expectedStepSeq) {
-        throw new KernelLogIntegrityError(`kernel transaction step_seq ${transaction.step_seq} does not follow ${expectedStepSeq - 1}`);
-    }
-    if (transaction.base_generation !== expectedGeneration) {
-        throw new KernelLogIntegrityError(`kernel transaction base_generation ${transaction.base_generation} does not match ${expectedGeneration}`);
-    }
-    if (transaction.input.operation_id !== transaction.operation_id) {
-        throw new KernelLogIntegrityError("kernel transaction input operation_id does not match its envelope");
-    }
-}
-/** Validate one complete authoritative operation stream and derive its next wire cursor. */
-export function verifyKernelTransactionStream(genesis, transactions) {
-    verifyKernelOperationGenesis(genesis);
-    let previous;
-    let head = genesis.genesis_digest;
-    for (const transaction of transactions) {
-        verifyKernelTransaction(transaction);
-        if (transaction.operation_id !== genesis.operation_id) {
-            throw new KernelLogIntegrityError("kernel transaction operation_id does not match genesis");
-        }
-        if (transaction.previous_transaction_digest !== head) {
-            throw new KernelLogIntegrityError("kernel transaction digest chain is not continuous");
-        }
-        verifyKernelTransactionSuccessor(previous, transaction);
-        previous = transaction;
-        head = transaction.transaction_digest;
-    }
-    const nextSequence = (previous?.step_seq ?? 0) + 1;
-    return {
-        operation_id: genesis.operation_id,
-        next_event_sequence: nextSequence,
-        next_step_seq: nextSequence,
-        transaction_head_digest: head,
-    };
-}
-function validateGenesisBody(genesis) {
-    if (genesis.record_version !== KERNEL_LOG_RECORD_VERSION) {
-        throw new KernelLogIntegrityError("unsupported kernel genesis record version");
-    }
-    if (!Number.isSafeInteger(genesis.abi_version) || genesis.abi_version <= 0) {
-        throw new KernelLogIntegrityError("kernel genesis abi_version must be a positive safe integer");
-    }
-    if (!genesis.operation_id)
-        throw new KernelLogIntegrityError("kernel genesis operation_id is required");
-    if (!Number.isSafeInteger(genesis.default_policy_version) || genesis.default_policy_version <= 0) {
-        throw new KernelLogIntegrityError("kernel genesis default_policy_version must be a positive safe integer");
-    }
-}
-function validateTransactionBody(transaction) {
-    if (transaction.record_version !== KERNEL_LOG_RECORD_VERSION) {
-        throw new KernelLogIntegrityError("unsupported kernel transaction record version");
-    }
-    if (!transaction.operation_id)
-        throw new KernelLogIntegrityError("kernel transaction operation_id is required");
-    if (!Number.isSafeInteger(transaction.step_seq) || transaction.step_seq <= 0) {
-        throw new KernelLogIntegrityError("kernel transaction step_seq must be a positive safe integer");
-    }
-    if (!Number.isSafeInteger(transaction.base_generation) || transaction.base_generation < 0) {
-        throw new KernelLogIntegrityError("kernel transaction base_generation must be a non-negative safe integer");
-    }
-    if (!transaction.previous_transaction_digest) {
-        throw new KernelLogIntegrityError("kernel transaction previous_transaction_digest is required");
-    }
-}

package/dist/runtime/large-result-spool.d.ts

@@ -1,93 +0,0 @@
-/**
- * Large result spool (Layer 1 of 5-layer compression pyramid).
- *
- * When a single tool result exceeds 50KB, write the full content to disk
- * and keep only a 2KB preview in the message. Zero API overhead.
- *
- * Design principles:
- * - Kernel defines policy (thresholds)
- * - SDK performs I/O (disk write/read)
- * - Model can retrieve full content via Read tool when needed
- */
-export interface ToolResult {
-    callId: string;
-    tool: string;
-    output: string;
-    isError?: boolean;
-}
-export interface SpooledToolResult {
-    originalOutput: string;
-    preview: string;
-    spoolRef: string;
-    wasSpooled: boolean;
-}
-/**
- * Large result spool configuration (mirrors kernel ContextConfig).
- */
-export interface SpoolConfig {
-    /** Single result size threshold (bytes) */
-    spoolThresholdBytes: number;
-    /** Preview token count (~2KB) */
-    previewTokens: number;
-    /** Total message limit (bytes) */
-    totalMessageLimitBytes: number;
-    /** Custom spool directory path */
-    spoolDir?: string;
-    /** Maximum age of spooled files (default 7 days) */
-    maxAgeMs?: number;
-}
-export declare const DEFAULT_SPOOL_CONFIG: SpoolConfig;
-/**
- * Large result spool manager.
- */
-export declare class LargeResultSpool {
-    private config;
-    private spoolDir;
-    private activeWrites;
-    constructor(config?: Partial<SpoolConfig>);
-    /**
-     * Check if a tool result needs spooling.
-     */
-    private needsSpool;
-    /**
-     * Hash content for spool reference.
-     */
-    private hashContent;
-    /**
-     * Get spool file path for a hash.
-     */
-    private getSpoolPath;
-    private callKey;
-    private atomicWrite;
-    /**
-     * Write large result to disk.
-     */
-    private writeToDisk;
-    /**
-     * Generate preview for a tool result.
-     */
-    private generatePreview;
-    /**
-     * Process a tool result: spool if large, return spooled result.
-     */
-    processToolResult(result: ToolResult): Promise<SpooledToolResult>;
-    /**
-     * Persist a kernel-spooled tool output to disk. Returns the on-disk path ref.
-     */
-    persistOutput(sessionId: string, callId: string, content: string): Promise<string>;
-    /**
-     * Read a spooled result back from disk.
-     */
-    readSpooledResult(spoolRef: string): Promise<string>;
-    /**
-     * O7: locate a spooled output by the tool call's id (the `read_result` meta-tool only knows
-     * `call_id`, not the content-hashed file name `persistOutput` chose). Scans the spool directory
-     * for the hashed call-key prefix; returns `undefined` if nothing was ever spooled
-     * for that call (e.g. it never actually exceeded the threshold, or the spool dir was cleaned up).
-     */
-    findByCallId(sessionId: string, callId: string): Promise<string | undefined>;
-    /**
-     * Clean up old spool files (optional maintenance).
-     */
-    cleanup(maxAgeMs?: number): Promise<number>;
-}