@fungi.computer/shiitake 0.0.0-stage → 0.0.1

package/dist/fleet.js

@@ -0,0 +1,515 @@
+import { SessionTerminalSchema } from "./client-wire.js";
+import { usage, createFleetDirectoryStore, createFleetDelegationStore, } from "./internal/woodstock/index.js";
+import { pending } from "@fungi.computer/agar";
+import { BirdDogMailSchema } from "@fungi.computer/bird-dog/effect";
+import * as Schema from "effect/Schema";
+import { parseAccepted } from "./client.js";
+import { checkHostMeta } from "./internal/host-meta.js";
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { z } from "zod";
+import { authorMeta, FungiMessageMetaSchema, } from "@fungi.computer/agar/agents";
+const identity = z.string().min(1).max(256);
+/** Operations explicitly admitted by the host. */
+export const agentActionSchema = z.enum([
+    "create",
+    "manage",
+    "read",
+    "send",
+    "delegate",
+]);
+/** Attribution supplied by the admitting host, without Team semantics. */
+export const agentProvenanceSchema = z.strictObject({
+    actor: identity,
+    workflowRunId: identity.optional(),
+    /** Host fingerprint of the enclosing model program, frozen with replay input. */
+    toolCallInputDigest: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/)
+        .optional(),
+    session: z
+        .strictObject({ agentId: identity, sessionId: identity })
+        .optional(),
+});
+/** Fleet authority is supplied, never looked up in host policy. */
+export const agentGrantSchema = z.strictObject({
+    agents: z.union([z.literal("all"), z.array(identity)]),
+    actions: z.array(agentActionSchema).max(5),
+    expiresAt: z.number().int().nonnegative(),
+    provenance: agentProvenanceSchema,
+    meta: z.json().optional(),
+    /** Delegation abuse bound; inherited paths may only narrow it. */
+    maxDepth: z.number().int().min(1).max(8).optional(),
+});
+/** Refusal of supplied authority; no host policy lookup is performed. */
+export class AgentGrantError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+/** Check every operation against its explicit authority. */
+export function assertAgentGrant(grant, action, agentId) {
+    const admitted = agentGrantSchema.parse(grant);
+    if (admitted.expiresAt <= Date.now())
+        throw new AgentGrantError("expired");
+    if (!admitted.actions.includes(action))
+        throw new AgentGrantError("action");
+    if (admitted.agents !== "all" &&
+        (agentId === undefined
+            ? action === "create"
+            : !admitted.agents.includes(agentId)))
+        throw new AgentGrantError("agent");
+}
+/** Stable Agent identities, retained across host compositions. */
+export const agentIds = defineIdFamily({
+    family: "agent",
+    version: 1,
+    kinds: { agent: { prefix: "agent" } },
+});
+const agentRowSchema = z.strictObject({
+    agent_id: z.string(),
+    name: z.string(),
+    actor_user_id: z.string(),
+    created_at: z.number().int().nonnegative(),
+    updated_at: z.number().int().nonnegative(),
+});
+const receiptRowSchema = z.strictObject({
+    request_id: z.string(),
+    actor_user_id: z.string(),
+    name: z.string(),
+    agent_id: z.string(),
+    computer_mode: z.string().min(1).max(4096),
+});
+/** Stable replay input; configuration is an opaque host creation choice. */
+export const agentCreationSchema = z.strictObject({
+    name: z.string().min(1).max(256),
+    requestId: z.string().min(1).max(256),
+    configuration: z.string().min(1).max(4096),
+});
+/** Owner-only rename input: an Agent's new display name. */
+export const agentRenameSchema = z.strictObject({
+    name: z.string().min(1).max(256),
+});
+/** Directory input, replay or storage refusal. */
+export class DirectoryError extends Error {
+    status;
+    code;
+    constructor(status, code) {
+        super(code);
+        this.status = status;
+        this.code = code;
+    }
+}
+function asDirectoryAgent(row) {
+    const parsed = agentRowSchema.safeParse(row);
+    if (!parsed.success)
+        throw new DirectoryError(503, "partial_init");
+    const agent = agentIds.agent.parse(parsed.data.agent_id);
+    if (!agent.ok)
+        throw new DirectoryError(503, "partial_init");
+    return Object.freeze({
+        agentId: agent.value,
+        name: parsed.data.name,
+        createdAt: parsed.data.created_at,
+        updatedAt: parsed.data.updated_at,
+    });
+}
+/**
+ * Agent identities, replay receipts and erasure roster. Mutations belong inside
+ * the caller's storage transaction, so lifecycle facts and host projections
+ * commit together. Physical table names retain the existing Hub store layout.
+ */
+export function createAgentDirectory(sql) {
+    const store = createFleetDirectoryStore(sql);
+    function readStored(agentId) {
+        const row = store.read(agentId);
+        return row === undefined ? null : asDirectoryAgent(row);
+    }
+    function findCreation(actorUserId, command) {
+        const receipt = store.readReceipt(command.requestId);
+        if (receipt !== undefined) {
+            const parsedReceipt = receiptRowSchema.safeParse(receipt);
+            if (!parsedReceipt.success)
+                throw new DirectoryError(503, "partial_init");
+            if (parsedReceipt.data.actor_user_id !== actorUserId ||
+                parsedReceipt.data.name !== command.name ||
+                parsedReceipt.data.computer_mode !== command.configuration)
+                throw new DirectoryError(409, "request_conflict");
+            const agentId = agentIds.agent.parse(parsedReceipt.data.agent_id);
+            if (!agentId.ok)
+                throw new DirectoryError(503, "partial_init");
+            const existing = readStored(agentId.value);
+            if (existing === null)
+                throw new DirectoryError(503, "partial_init");
+            return existing;
+        }
+        return null;
+    }
+    function readCreation(grant, raw) {
+        assertAgentGrant(grant, "read");
+        const existing = findCreation(grant.provenance.actor, agentCreationSchema.parse(raw));
+        if (existing !== null)
+            assertAgentGrant(grant, "read", existing.agentId);
+        return existing;
+    }
+    function create(grant, raw) {
+        assertAgentGrant(grant, "create");
+        const command = agentCreationSchema.parse(raw);
+        const actorUserId = grant.provenance.actor;
+        const existing = findCreation(actorUserId, command);
+        if (existing !== null)
+            return { agent: existing, fact: null };
+        const duplicate = store.findByName(command.name);
+        if (duplicate !== undefined)
+            throw new DirectoryError(409, "name_taken");
+        const agentId = agentIds.agent.generate();
+        const now = Date.now();
+        store.reserve(agentId, command.name, actorUserId, now, command.requestId, command.configuration);
+        const created = readStored(agentId);
+        if (created === null)
+            throw new DirectoryError(503, "partial_init");
+        return {
+            agent: created,
+            fact: {
+                kind: "created",
+                agentId,
+                provenance: grant.provenance,
+            },
+        };
+    }
+    function list(grant) {
+        assertAgentGrant(grant, "read");
+        return store
+            .list()
+            .map(asDirectoryAgent)
+            .filter(({ agentId }) => grant.agents === "all" || grant.agents.includes(agentId));
+    }
+    function read(grant, agentId) {
+        assertAgentGrant(grant, "read", agentId);
+        return readStored(agentId);
+    }
+    /** The user who created an Agent; that user's own credentials follow it. */
+    function readCreator(grant, agentId) {
+        assertAgentGrant(grant, "read", agentId);
+        const raw = store.readCreator(agentId);
+        if (raw === undefined)
+            return null;
+        const creator = z.string().min(1).max(256).safeParse(raw.actor_user_id);
+        if (!creator.success)
+            throw new DirectoryError(503, "partial_init");
+        return creator.data;
+    }
+    function remove(grant, agentId) {
+        assertAgentGrant(grant, "manage", agentId);
+        if (readStored(agentId) === null)
+            return null;
+        store.remove(agentId);
+        return { kind: "deleted", agentId, provenance: grant.provenance };
+    }
+    /** Owner-only rename; refuses a name already held by another Agent. */
+    function rename(grant, agentId, raw) {
+        assertAgentGrant(grant, "manage", agentId);
+        const command = agentRenameSchema.parse(raw);
+        const existing = readStored(agentId);
+        if (existing === null)
+            throw new DirectoryError(404, "not_found");
+        if (command.name !== existing.name) {
+            const duplicate = store.findByName(command.name);
+            if (duplicate !== undefined)
+                throw new DirectoryError(409, "name_taken");
+            store.rename(agentId, command.name, Date.now());
+        }
+        const updated = readStored(agentId);
+        if (updated === null)
+            throw new DirectoryError(503, "partial_init");
+        return updated;
+    }
+    return {
+        /** Resolve a matching creation receipt before host admission of a new reservation. */
+        readCreation,
+        /** Reserve an Agent once and return its committed lifecycle fact. */
+        create,
+        /** Read one admitted Agent identity. */
+        read,
+        /** List only identities covered by the supplied grant. */
+        list,
+        /** Remove an identity while retaining its erasure address. */
+        remove,
+        /** Rename an existing Agent; refuses a name already held by another one. */
+        rename,
+        /** Read the host actor recorded at creation. */
+        readCreator,
+        /** Enumerate retained addresses for host erasure. */
+        listErasureIds: store.listErasureIds,
+        /** Whether the retained erasure roster covers this store. */
+        erasureRosterComplete: store.erasureRosterComplete,
+    };
+}
+/** Replay identity and work, with the parent supplied exclusively by the grant. */
+export const agentDelegationTaskSchema = z.strictObject({
+    requestId: identity,
+    agentId: identity,
+    sessionId: identity.optional(),
+    text: z
+        .string()
+        .min(1)
+        .max(256 * 1024),
+});
+/** Exact host facts encoded over internal transports, without transcript content. */
+export const commandSettlementSchema = Schema.Struct({
+    terminal: SessionTerminalSchema,
+    content: Schema.String,
+    usage: Schema.Array(Schema.Struct({ provider: Schema.String, model: Schema.String, usage })),
+    toolCalls: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+});
+/**
+ * Provenance for one delegated send from the invoking Agent's Session. The
+ * model program's digest is frozen with the replay input, so a retried tool
+ * call that changed its code conflicts instead of replaying.
+ */
+export async function delegationProvenance(session, toolCallCode) {
+    const provenance = {
+        actor: session.agentId,
+        session: { agentId: session.agentId, sessionId: session.sessionId },
+    };
+    if (toolCallCode === undefined)
+        return provenance;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(toolCallCode));
+    return {
+        ...provenance,
+        toolCallInputDigest: Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join(""),
+    };
+}
+/**
+ * The host metadata one delegated send carries: the sending Agent as author
+ * and only the path inherited from the invoking line. A reply's verified facts
+ * stay on that reply's own line and never travel onward.
+ */
+export function delegationSendMeta(sender, invocationMeta) {
+    const author = authorMeta(sender);
+    const inherited = invocationMeta === undefined
+        ? undefined
+        : FungiMessageMetaSchema.parse(invocationMeta).delegation;
+    return inherited === undefined
+        ? author
+        : {
+            ...author,
+            delegation: {
+                ancestors: [...inherited.ancestors],
+                maxDepth: inherited.maxDepth,
+            },
+        };
+}
+/**
+ * The host metadata for one authenticated reply line: the replying Agent is
+ * its author, and the verified reply rides beside the caller's own path.
+ */
+export function delegationReplyMeta(delegation, replierName) {
+    return {
+        ...authorMeta({ id: delegation.reply.agentId, name: replierName }),
+        delegation: {
+            ancestors: [...delegation.ancestors],
+            maxDepth: delegation.maxDepth,
+            reply: delegation.reply,
+        },
+    };
+}
+const delegationMetadata = z.object({
+    delegation: FungiMessageMetaSchema.shape.delegation,
+});
+const delegationRowSchema = z.strictObject({
+    input: z.string(),
+    mail: z.string(),
+    receipt: z.string().nullable(),
+});
+const decodeMail = Schema.decodeUnknownSync(Schema.fromJsonString(BirdDogMailSchema));
+/**
+ * Hosted BirdDog submission and Pending observation. The durable row freezes
+ * correspondence before transport; an ambiguous delivery reuses that exact mail.
+ * Shiitake owns work deduplication, execution and settlement; Post owns replies.
+ */
+export function createFleetDelegation(options) {
+    const store = createFleetDelegationStore(options.storage);
+    function read(requestId) {
+        const row = store.read(requestId);
+        return row === undefined ? undefined : delegationRowSchema.parse(row);
+    }
+    async function start(grant, raw) {
+        const task = agentDelegationTaskSchema.parse(raw);
+        assertAgentGrant(grant, "delegate", task.agentId);
+        const parent = grant.provenance.session;
+        if (parent === undefined)
+            throw new AgentGrantError("agent");
+        assertAgentGrant(grant, "delegate", parent.agentId);
+        const meta = grant.meta === undefined
+            ? undefined
+            : checkHostMeta(undefined, grant.meta);
+        const objectMeta = z.record(z.string(), z.json()).safeParse(meta);
+        const inherited = objectMeta.success
+            ? delegationMetadata.parse(objectMeta.data).delegation
+            : undefined;
+        const ancestors = inherited?.ancestors ?? [];
+        const maxDepth = Math.min(grant.maxDepth ?? 8, inherited?.maxDepth ?? 8);
+        if (ancestors.includes(task.agentId) || parent.agentId === task.agentId)
+            throw new AgentGrantError("delegation_loop");
+        if (ancestors.length >= maxDepth)
+            throw new AgentGrantError("delegation_depth");
+        const delegation = { ancestors: [...ancestors, parent.agentId], maxDepth };
+        const outgoingMeta = {
+            ...(objectMeta.success
+                ? objectMeta.data
+                : meta === undefined
+                    ? {}
+                    : { hostMeta: meta }),
+            delegation,
+        };
+        checkHostMeta(undefined, outgoingMeta);
+        const input = JSON.stringify({
+            task,
+            provenance: grant.provenance,
+            meta,
+            maxDepth,
+        });
+        let row = read(task.requestId);
+        if (row === undefined) {
+            let sessionId = task.sessionId;
+            if (sessionId === undefined) {
+                const opened = await options.open(task.agentId);
+                try {
+                    sessionId = await opened.agent.createSession(task.requestId);
+                }
+                finally {
+                    await opened.release();
+                }
+            }
+            const from = { kind: "agent", ...parent };
+            let mail = {
+                key: task.requestId,
+                from,
+                to: { kind: "agent", agentId: task.agentId, sessionId },
+                replyTo: [from],
+                content: task.text,
+                createdAt: Date.now(),
+            };
+            mail = { ...mail, meta: outgoingMeta };
+            store.reserve(task.requestId, input, JSON.stringify(mail));
+            row = read(task.requestId);
+        }
+        if (row === undefined)
+            throw new DirectoryError(503, "partial_init");
+        if (row.input !== input)
+            throw new DirectoryError(409, "request_conflict");
+        if (row.receipt !== null)
+            return parseAccepted(row.receipt);
+        assertAgentGrant(grant, "delegate", task.agentId);
+        const receipt = parseAccepted(JSON.stringify(await options.deliver(decodeMail(row.mail))));
+        store.recordReceipt(task.requestId, JSON.stringify(receipt));
+        return receipt;
+    }
+    async function delegate(grant, task) {
+        const accepted = await start(grant, task);
+        const row = read(task.requestId);
+        if (row === undefined)
+            throw new DirectoryError(503, "partial_init");
+        const mail = decodeMail(row.mail);
+        const settlement = await options.readSettlement(mail.to.agentId, mail.to.sessionId, accepted.commandId);
+        return settlement === undefined
+            ? pending(1000)
+            : {
+                kind: "settled",
+                agentId: mail.to.agentId,
+                sessionId: mail.to.sessionId,
+                ...settlement,
+            };
+    }
+    /**
+     * Authenticate one arriving reply against the frozen mail this owner sent.
+     * It must be BirdDog's single reply key for that mail, mirror its sender and
+     * recipient exactly, carry BirdDog's settlement facts and, once the send's
+     * receipt is recorded, name that receipt's `commandId`. The result restores
+     * the caller's own delegation path and the verified reply; it never reads
+     * the reply's text or any settlement metadata.
+     */
+    function authenticateReply(mail) {
+        // This owner sends to one correspondent, so BirdDog's reply index is zero.
+        const suffix = ":reply:0";
+        if (mail.replyTo.length !== 0 ||
+            mail.reply === undefined ||
+            !mail.key.endsWith(suffix))
+            return undefined;
+        const row = read(mail.key.slice(0, -suffix.length));
+        if (row === undefined)
+            return undefined;
+        const sent = decodeMail(row.mail);
+        if (mail.from.agentId !== sent.to.agentId ||
+            mail.from.sessionId !== sent.to.sessionId ||
+            mail.to.agentId !== sent.from.agentId ||
+            mail.to.sessionId !== sent.from.sessionId)
+            return undefined;
+        if (row.receipt !== null &&
+            parseAccepted(row.receipt).commandId !== mail.reply.commandId)
+            return undefined;
+        const path = delegationMetadata.parse(sent.meta).delegation;
+        if (path === undefined)
+            return undefined;
+        const reply = {
+            agentId: mail.from.agentId,
+            sessionId: mail.from.sessionId,
+            ...mail.reply,
+        };
+        return {
+            ancestors: path.ancestors.slice(0, -1),
+            maxDepth: path.maxDepth,
+            reply,
+        };
+    }
+    return {
+        /** Authenticate a reply against its frozen mail and restore the caller's path. */
+        authenticateReply,
+        /** Submit once and return the existing Shiitake admission receipt. */
+        start,
+        /** Submit or poll the exact turn, yielding Agar Pending until settled. */
+        delegate,
+    };
+}
+/**
+ * Addressed Session operations over the existing Shiitake client. Each operation
+ * checks a fresh supplied grant and releases its transport without stopping work.
+ */
+export function createFleetSessions(open) {
+    async function withAgent(grant, action, agentId, run) {
+        assertAgentGrant(grant, action, agentId);
+        const meta = grant.meta === undefined
+            ? undefined
+            : checkHostMeta(undefined, grant.meta);
+        const access = await open(agentId, meta);
+        try {
+            assertAgentGrant(grant, action, agentId);
+            return await run(access.agent);
+        }
+        finally {
+            await access.release();
+        }
+    }
+    return {
+        /** Enumerate existing Sessions through the owner's bounded cursor. */
+        list: (grant, agentId, after) => withAgent(grant, "read", agentId, (agent) => agent.listSessions(after)),
+        /** Open the exact saved conversation without creating work. */
+        read: (grant, agentId, sessionId) => withAgent(grant, "read", agentId, (agent) => agent.session(sessionId).read()),
+        /** Create a Session once under the caller's replay identity. */
+        create: (grant, agentId, requestId) => withAgent(grant, "manage", agentId, (agent) => agent.createSession(requestId)),
+        /** Remove a Session through its runtime owner. */
+        remove: (grant, agentId, sessionId) => withAgent(grant, "manage", agentId, (agent) => agent.deleteSession(sessionId)),
+        /** Send once; an omitted Session is created under the same replay identity. */
+        send: (grant, agentId, sessionId, message) => withAgent(grant, "send", agentId, async (agent) => {
+            const target = sessionId ?? (await agent.createSession(message.requestId));
+            const accepted = await agent
+                .session(target)
+                .send(message.text, message.delivery === undefined
+                ? { requestId: message.requestId }
+                : { requestId: message.requestId, delivery: message.delivery });
+            return { ...accepted, sessionId: target };
+        }),
+    };
+}

package/dist/hosted.d.ts

@@ -0,0 +1,133 @@
+import { z } from "zod";
+import { type ExtensionCapabilityV0, type ExtensionManifestV0, type RosteredExtensionV0 } from "./extensions.js";
+/** App method names a hosted extension's backend serves. */
+export declare const agentExtensionMethodNames: Readonly<{
+    readonly prompt: "agentExtensionPrompt";
+    readonly tools: "agentExtensionTools";
+    readonly call: "agentExtensionCall";
+}>;
+/** Capabilities a hosted extension may request in this protocol version. */
+export declare const hostedExtensionCapabilities: readonly ExtensionCapabilityV0[];
+/** The run a hosted call is made for; the host derives it, never the model. */
+export declare const hostedRunSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    workId: z.ZodString;
+    origin: z.ZodNullable<z.ZodObject<{
+        extensionId: z.ZodString;
+        correlation: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** A parsed {@link hostedRunSchema} value. */
+export type HostedRun = z.output<typeof hostedRunSchema>;
+/** `agentExtensionPrompt` input: the run whose model request needs sections. */
+export declare const hostedPromptInputSchema: z.ZodObject<{
+    run: z.ZodObject<{
+        sessionId: z.ZodString;
+        workId: z.ZodString;
+        origin: z.ZodNullable<z.ZodObject<{
+            extensionId: z.ZodString;
+            correlation: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** A parsed {@link hostedPromptInputSchema} value. */
+export type HostedPromptInput = z.output<typeof hostedPromptInputSchema>;
+/** `agentExtensionPrompt` output: at most 16 named sections of at most 8 KiB each. */
+export declare const hostedPromptOutputSchema: z.ZodObject<{
+    sections: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        text: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** A parsed {@link hostedPromptOutputSchema} value. */
+export type HostedPromptOutput = z.output<typeof hostedPromptOutputSchema>;
+/** A run's tool module as at most 64 dotted operations with bounded JSON Schemas. */
+export declare const hostedModuleDescriptorSchema: z.ZodObject<{
+    description: z.ZodOptional<z.ZodString>;
+    operations: z.ZodRecord<z.ZodString, z.ZodObject<{
+        replay: z.ZodEnum<{
+            unsafe: "unsafe";
+            safe: "safe";
+        }>;
+        description: z.ZodOptional<z.ZodString>;
+        input: z.ZodJSONSchema;
+        output: z.ZodNullable<z.ZodJSONSchema>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** A parsed {@link hostedModuleDescriptorSchema} value. */
+export type HostedModuleDescriptor = z.output<typeof hostedModuleDescriptorSchema>;
+/** `agentExtensionTools` input: the run the tools are captured for. */
+export declare const hostedToolsInputSchema: z.ZodObject<{
+    run: z.ZodObject<{
+        sessionId: z.ZodString;
+        workId: z.ZodString;
+        origin: z.ZodNullable<z.ZodObject<{
+            extensionId: z.ZodString;
+            correlation: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** A parsed {@link hostedToolsInputSchema} value. */
+export type HostedToolsInput = z.output<typeof hostedToolsInputSchema>;
+/** `agentExtensionTools` output: the run's module, or null when it has none. */
+export declare const hostedToolsOutputSchema: z.ZodObject<{
+    module: z.ZodNullable<z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        operations: z.ZodRecord<z.ZodString, z.ZodObject<{
+            replay: z.ZodEnum<{
+                unsafe: "unsafe";
+                safe: "safe";
+            }>;
+            description: z.ZodOptional<z.ZodString>;
+            input: z.ZodJSONSchema;
+            output: z.ZodNullable<z.ZodJSONSchema>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** A parsed {@link hostedToolsOutputSchema} value. */
+export type HostedToolsOutput = z.output<typeof hostedToolsOutputSchema>;
+/** `agentExtensionCall` input: one operation, its input, and the host's call identity. */
+export declare const hostedCallInputSchema: z.ZodObject<{
+    run: z.ZodObject<{
+        sessionId: z.ZodString;
+        workId: z.ZodString;
+        origin: z.ZodNullable<z.ZodObject<{
+            extensionId: z.ZodString;
+            correlation: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    operation: z.ZodString;
+    input: z.ZodJSONSchema;
+    invocation: z.ZodObject<{
+        executionId: z.ZodString;
+        toolCallId: z.ZodOptional<z.ZodString>;
+        deadlineAt: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** A parsed {@link hostedCallInputSchema} value. */
+export type HostedCallInput = z.output<typeof hostedCallInputSchema>;
+/** `agentExtensionCall` output: the operation's JSON result. */
+export declare const hostedCallOutputSchema: z.ZodObject<{
+    value: z.ZodJSONSchema;
+}, z.core.$strict>;
+/** A parsed {@link hostedCallOutputSchema} value. */
+export type HostedCallOutput = z.output<typeof hostedCallOutputSchema>;
+/**
+ * The guest side of one hosted extension. Inputs are already parsed by the
+ * App method door with the schemas above; outputs are bounded here.
+ */
+export type HostedAgentExtension = Readonly<{
+    manifest: ExtensionManifestV0;
+    /** Build the run's prompt sections. */
+    prompt: (input: HostedPromptInput) => Promise<HostedPromptOutput>;
+    /** Describe the run's tool module. */
+    tools: (input: HostedToolsInput) => Promise<HostedToolsOutput>;
+    /** Run one operation of the run's tool module. */
+    call: (input: HostedCallInput) => Promise<HostedCallOutput>;
+}>;
+/**
+ * Serve one extension's prompt sections and tools to a remote Agent. Throws
+ * when the extension requests a capability hosting does not provide yet, so a
+ * build fails instead of silently dropping it.
+ */
+export declare function hostAgentExtension(rostered: RosteredExtensionV0): HostedAgentExtension;