@guuey/host 0.1.0

package/dist/frameworks/claude-options.js

@@ -0,0 +1,208 @@
+import { GUUEY_DEFAULT_SYSTEM_PROMPT, defaultModelFor } from "@guuey/config";
+/**
+ * Default Claude model — only used when the snapshot omits `model`. Derived
+ * from the `@guuey/config` registry (single source of truth per the
+ * model-release playbook §8 item A) rather than a bare literal, so a
+ * registry default change propagates here automatically.
+ */
+const DEFAULT_MODEL = defaultModelFor("claude-agent-sdk");
+/** Default cap on agent-loop turns per user message (matches the SDK/runner default). */
+const DEFAULT_MAX_TURNS = 25;
+/**
+ * Env-var names the Router injects so agent code reaches the home/app layers
+ * portably. Host-owned copies of `@guuey/fs`'s `ENV_HOME_DIR`/`ENV_APP_DIR`
+ * (trivial string literals — not imported, to keep this package OSS-legal).
+ */
+export const ENV_HOME_DIR = "GUUEY_HOME_DIR";
+export const ENV_APP_DIR = "GUUEY_APP_DIR";
+/**
+ * File tools enabled when GuueyFS layers are bound. `Bash` is added separately
+ * (see {@link BASH_TOOL}) so the two are independently testable.
+ */
+const FS_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep"];
+/**
+ * Real shell exec, enabled alongside the file tools when GuueyFS layers are
+ * bound. Unlike the source runner — which enabled `Bash` only when the SDK's OWN
+ * `sandbox:{}` block was on — this host runs entirely INSIDE the Router's
+ * bubblewrap jail, so the OS isolation is always present whenever fs is bound.
+ * The SDK `sandbox:{}` block is therefore NOT set here (it would spawn a nested
+ * bubblewrap inside the Router's bwrap); the Router's bwrap IS the isolation.
+ */
+const BASH_TOOL = "Bash";
+/**
+ * Build the Claude Agent SDK `Options` for one invoke. Pure: all disk/env access
+ * is injected via {@link BuildOptionsContext}. Throws on an unresolved `{file}`
+ * system prompt or a missing API key (the same loud failures the source had).
+ */
+export function buildOptions(snapshot, ctx) {
+    const apiKey = ctx.apiKey;
+    const baseUrl = ctx.baseUrl;
+    const authToken = ctx.authToken;
+    // Require either the loopback proxy credentials (hosted/broker path) or a
+    // direct API key (local-dev fallback). Neither → fail loudly.
+    if (!((baseUrl !== undefined && authToken !== undefined) || apiKey)) {
+        throw new Error("@guuey/host: either (baseUrl + authToken) for the managed-LLM proxy, " +
+            "or ANTHROPIC_API_KEY for local dev, is required.");
+    }
+    // Snapshots reach the worker fully resolved — the CLI's loader inlines any
+    // `{file}` system prompt before upload. A `{file}` reaching the worker means
+    // someone hit the API directly with an un-resolved snapshot; reject loudly.
+    if (snapshot.systemPrompt !== undefined && typeof snapshot.systemPrompt !== "string") {
+        throw new Error(`@guuey/host: snapshot.systemPrompt must be a resolved string (got ${JSON.stringify(snapshot.systemPrompt)}). The CLI inlines {file} references before upload; workers never read the filesystem.`);
+    }
+    const mcpServers = resolveMcpServers(ctx);
+    const allowedTools = buildAllowedTools(snapshot, Object.keys(mcpServers), Boolean(ctx.fs));
+    const systemPrompt = withContextPreamble(snapshot.systemPrompt ?? GUUEY_DEFAULT_SYSTEM_PROMPT, ctx.history, ctx.priorMemory, ctx.priorState);
+    const model = snapshot.model ?? DEFAULT_MODEL;
+    const maxTurns = snapshot.runtime?.maxTurns ?? DEFAULT_MAX_TURNS;
+    const fs = ctx.fs;
+    // Build the subprocess env. Two mutually-exclusive paths:
+    //
+    //  - Proxy path (baseUrl + authToken present): route the Claude CLI
+    //    subprocess through the managed-LLM broker. baseUrl + authToken are
+    //    spread LAST so a builder's snapshot.env cannot override them.
+    //    ANTHROPIC_API_KEY is intentionally absent — the proxy owns auth.
+    //    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC suppresses telemetry pings
+    //    that would bypass the proxy.
+    //
+    //  - Local-dev fallback (only apiKey present): pass the real key directly.
+    //    The guard above guarantees apiKey is non-null on this branch.
+    // Explicit Record<string, string> annotation prevents TypeScript from widening
+    // the ternary to a union `{ K: string } | {}`, which would make spread targets
+    // produce optional-undefined keys that conflict with Record<string, string>.
+    const fsEnv = fs
+        ? { [ENV_HOME_DIR]: fs.home, [ENV_APP_DIR]: fs.app }
+        : {};
+    let env;
+    if (baseUrl !== undefined && authToken !== undefined) {
+        env = {
+            ...(snapshot.env ?? {}),
+            ...fsEnv,
+            ANTHROPIC_BASE_URL: baseUrl,
+            ANTHROPIC_AUTH_TOKEN: authToken,
+            CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+        };
+    }
+    else {
+        // apiKey is guaranteed non-null by the guard; the if-check narrows the type.
+        if (!apiKey)
+            throw new Error("unreachable: apiKey guard should have prevented this path");
+        env = {
+            ANTHROPIC_API_KEY: apiKey,
+            ...(snapshot.env ?? {}),
+            ...fsEnv,
+        };
+    }
+    // Whether the operator pinned a Claude permission mode in agent.json. When
+    // set we forward it verbatim and let the SDK's mode govern the posture; when
+    // unset we install the auto-allow `canUseTool` below so the default no-code
+    // agent's Bash runs prompt-free (a never-answered prompt would hang the pod).
+    const explicitMode = snapshot.claude?.permissions?.mode;
+    const options = {
+        model,
+        mcpServers,
+        allowedTools,
+        // With GuueyFS layers bound, expose the file tools PLUS real `Bash`; without
+        // them this is byte-identical to the source (purely MCP-driven). `Bash` is
+        // safe here because the host already runs inside the Router's bubblewrap
+        // jail — that bwrap, NOT the SDK's own `sandbox:{}` block, is the isolation.
+        tools: fs ? [...FS_TOOLS, BASH_TOOL] : [],
+        // Settings isolation. Empty array = "no filesystem settings loaded" — guards
+        // against a future SDK change auto-pulling `~/.claude/settings.json` and
+        // leaking the operator's logged-in Claude Code MCPs into the tool catalog.
+        settingSources: [],
+        strictMcpConfig: true,
+        maxTurns,
+        env,
+        systemPrompt,
+        // GuueyFS binding (opt-in): session dir as cwd, home+app as extra roots.
+        ...(fs ? { cwd: fs.session, additionalDirectories: [fs.home, fs.app] } : {}),
+        // Permission posture. Two mutually-exclusive paths:
+        //
+        //  - Operator pinned `claude.permissions.mode` → forward it verbatim; the
+        //    operator owns the posture (e.g. `acceptEdits`).
+        //  - No explicit mode + fs bound → install an auto-allow `canUseTool`. In
+        //    the SDK permission flow (hooks → deny → allow → ask → mode/canUseTool),
+        //    `default` mode with no callback routes Bash subcommands through an
+        //    interactive permission prompt — which, in this headless ephemeral pod,
+        //    no one answers, so the agent would HANG. The auto-allow callback short-
+        //    circuits that: every tool the model picks (already constrained to
+        //    `tools`/`allowedTools` + `settingSources:[]` + `strictMcpConfig`) is
+        //    allowed without a prompt. This is safe precisely because the Router's
+        //    bubblewrap jail is the real isolation boundary — NOT the SDK's own
+        //    `sandbox:{}` block (which is intentionally absent to avoid a nested
+        //    bwrap inside the Router's bwrap). We do NOT use `bypassPermissions`
+        //    here: it requires `allowDangerouslySkipPermissions` and globally
+        //    disables hooks/deny-rule evaluation, whereas the callback keeps the
+        //    deny/hook stages intact while only collapsing the final ask stage.
+        ...(explicitMode
+            ? { permissionMode: explicitMode }
+            : fs
+                ? { canUseTool: autoAllowTool }
+                : {}),
+        ...(ctx.abortController ? { abortController: ctx.abortController } : {}),
+    };
+    return options;
+}
+/**
+ * Auto-allow permission callback. Installed when fs is bound and the operator
+ * did NOT pin `claude.permissions.mode`, so the default no-code agent's `Bash`
+ * (and the file tools) run prompt-free. Returns `{ behavior: 'allow' }` for
+ * every request, passing the input through unchanged.
+ *
+ * Safe because the model's tool surface is already locked down BEFORE the
+ * callback ever fires — `tools`/`allowedTools` cap which tools exist,
+ * `settingSources:[]` blocks filesystem-loaded settings, `strictMcpConfig`
+ * pins the MCP catalog — and the real OS isolation is the Router's bubblewrap
+ * jail this whole process runs inside. The callback only collapses the SDK's
+ * final interactive "ask" stage (which would otherwise hang a headless pod);
+ * the earlier hook/deny-rule stages of the permission flow still run.
+ */
+export const autoAllowTool = (_toolName, input) => Promise.resolve({ behavior: "allow", updatedInput: input });
+/**
+ * Map the Router-resolved cred files to the framework-neutral SdkMcpServer map.
+ * The Router (credential-broker) owns ALL resolution — default, federation, mint,
+ * env-substitution; this worker just reads `<session>/.guuey/credentials/*.json`
+ * (via ctx.listCredentials) and shapes each entry. Keyed by the server name.
+ */
+export function resolveMcpServers(ctx) {
+    const out = {};
+    for (const { name, cred } of ctx.listCredentials()) {
+        out[name] = {
+            type: cred.transport,
+            url: cred.url,
+            // Declared MCP servers ARE this agent's tool surface. Without
+            // alwaysLoad the CLI defers MCP tools behind its ToolSearch built-in —
+            // absent here (tools: []) — leaving the model tool-less. Empirically
+            // load-bearing; mirrors the scaffold template's worker (see
+            // create-agentic-app templates-src claude worker.ts).
+            alwaysLoad: true,
+            ...(Object.keys(cred.headers).length > 0 ? { headers: cred.headers } : {}),
+        };
+    }
+    return out;
+}
+/**
+ * Build the SDK's `allowedTools` array. MCP tools are auto-namespaced by the SDK
+ * as `mcp__<server>__<tool>`; we can't enumerate the namespaces ahead of time,
+ * so the allowlist is necessarily wildcard-ish.
+ *
+ * - explicit `tools.allowlist` → pass those literal names through.
+ * - else → allow every tool from every declared server via `mcp__<server>`.
+ *
+ * When GuueyFS layers are bound, the file tools AND `Bash` join the allowlist
+ * (an allow rule in the SDK permission flow), so the model may use them
+ * alongside the MCP allowlist. The auto-allow `canUseTool` (or the operator's
+ * pinned mode) governs whether those still prompt — see `buildOptions`.
+ */
+function buildAllowedTools(snapshot, declaredServerNames, fsBound) {
+    const explicit = snapshot.tools?.allowlist;
+    const base = explicit && explicit.length > 0
+        ? explicit.slice()
+        : declaredServerNames.map((s) => `mcp__${s}`);
+    return fsBound ? [...base, ...FS_TOOLS, BASH_TOOL] : base;
+}
+// withContextPreamble now lives in ../preamble.js (framework-neutral — the
+// ADK runner renders the same preamble); re-exported for existing importers.
+export { withContextPreamble } from "../preamble.js";
+import { withContextPreamble } from "../preamble.js";

package/dist/frameworks/claude-runner.d.ts

@@ -0,0 +1,3 @@
+import type { FrameworkRunner } from "../index.js";
+export declare function createRunner(): FrameworkRunner;
+//# sourceMappingURL=claude-runner.d.ts.map

package/dist/frameworks/claude-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-runner.d.ts","sourceRoot":"","sources":["../../src/frameworks/claude-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAA0B,MAAM,aAAa,CAAC;AAK3E,wBAAgB,YAAY,IAAI,eAAe,CAa9C"}

package/dist/frameworks/claude-runner.js

@@ -0,0 +1,33 @@
+/**
+ * Claude runner module — the `FrameworkRunner` adapter around the existing
+ * claude turn loop (`claude.ts#runInvoke`). Imports the SDK at module top
+ * level so the host's lazy `import()` of this file is what pulls the
+ * optional peer.
+ *
+ * Credential posture (unchanged from the pre-restructure host):
+ *  - hosted/broker: `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` injected by
+ *    the Router's `buildWorkerEnv`; the real `ANTHROPIC_API_KEY` is
+ *    intentionally absent so it cannot leak to agent code.
+ *  - local-dev: only `ANTHROPIC_API_KEY` is set; `buildOptions` falls back to
+ *    the direct-key path.
+ *  A missing key is NOT fatal at boot — the run path emits a clear `error`
+ *  per invoke if neither form is present.
+ */
+import { query } from "@anthropic-ai/claude-agent-sdk";
+import { runInvoke } from "./claude.js";
+import { listCredentials } from "../creds.js";
+import { buildHostContext } from "../boot-context.js";
+export function createRunner() {
+    const bootCtx = buildHostContext(process.env);
+    return {
+        async runTurn(snapshot, turn, emit) {
+            const runtime = {
+                listCredentials: listCredentials(turn.fs),
+                ...(bootCtx.anthropicApiKey !== undefined ? { apiKey: bootCtx.anthropicApiKey } : {}),
+                ...(bootCtx.anthropicBaseUrl !== undefined ? { baseUrl: bootCtx.anthropicBaseUrl } : {}),
+                ...(bootCtx.anthropicAuthToken !== undefined ? { authToken: bootCtx.anthropicAuthToken } : {}),
+            };
+            await runInvoke(snapshot, turn, runtime, emit, query);
+        },
+    };
+}

package/dist/frameworks/claude.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The testable core of the worker loop. `runInvoke` runs one invoke through the
+ * Claude Agent SDK and emits each native `SDKMessage` to fd-3 as a `native`
+ * WorkerEvent (the Router dispatches them to the matching normalizer). On the
+ * SDK result message it emits `done`; on a throw or a framework-gate violation
+ * it emits `error`. Emits `hello` FIRST (§8 item B) — the SDK-version handshake.
+ *
+ * `query` is injected so the loop is unit-testable without a live model. The
+ * worker entrypoint (`index.ts`) passes the real `@anthropic-ai/claude-agent-sdk`
+ * `query`.
+ */
+import type { Options, SDKMessage } from "@anthropic-ai/claude-agent-sdk";
+import type { Emitter, Fs, HistoryMessage, Identity, JsonValue } from "@guuey/worker";
+import { buildOptions, type CredentialFile, type PriorMemoryRecord } from "./claude-options.js";
+/**
+ * The invoke this host consumes. A superset of `@guuey/worker`'s `Invoke`:
+ * `priorMemory`/`priorState` are the §1.4 push-by-value context the worker reads
+ * for the preamble (the Worker Protocol `Invoke` is EXTENDED with these in
+ * Task 3; until then the worker loop parses them off the raw control line).
+ */
+export interface HostInvoke {
+    input: string;
+    identity: Identity;
+    fs: Fs;
+    history: HistoryMessage[];
+    priorMemory?: PriorMemoryRecord[];
+    priorState?: JsonValue;
+}
+/** Per-process config the worker resolves once at boot. */
+export interface HostRuntime {
+    /**
+     * Anthropic API key — local-dev fallback when `baseUrl`+`authToken` are
+     * absent. One of (`baseUrl`+`authToken`) or `apiKey` must be provided;
+     * `buildOptions` throws at invoke time if neither is present.
+     */
+    apiKey?: string;
+    /**
+     * Loopback proxy base URL (hosted/broker mode). Task 8 injects this as
+     * `ANTHROPIC_BASE_URL` via `buildWorkerEnv`. When set together with
+     * `authToken`, the Claude CLI subprocess routes through the managed-LLM
+     * broker; the real API key is intentionally absent to prevent leaks.
+     */
+    baseUrl?: string;
+    /**
+     * Opaque session token for the loopback proxy (hosted/broker mode). Task 8
+     * injects this as `ANTHROPIC_AUTH_TOKEN`. Required when `baseUrl` is set.
+     */
+    authToken?: string;
+    /**
+     * Returns every credential the Router broker wrote to
+     * `<sessionDir>/.guuey/credentials/` this invoke. Injected so the run path
+     * stays pure (no disk access inside `runInvoke`).
+     */
+    listCredentials: () => Array<{
+        name: string;
+        cred: CredentialFile;
+    }>;
+}
+/** The `query` surface the loop needs — the real SDK `query` satisfies it. */
+export type QueryFn = (params: {
+    prompt: string;
+    options: Options;
+}) => AsyncIterable<SDKMessage>;
+/**
+ * Run one invoke. Emits `native` per SDKMessage, `done` on the result, `error`
+ * on a framework-gate violation or a thrown error. Never throws — every failure
+ * path becomes an `error` event so the Router always sees a terminal event.
+ */
+export declare function runInvoke(snapshot: {
+    framework?: string;
+} & Parameters<typeof buildOptions>[0], invoke: HostInvoke, runtime: HostRuntime, emit: Emitter, query: QueryFn): Promise<void>;
+//# sourceMappingURL=claude.d.ts.map

package/dist/frameworks/claude.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../src/frameworks/claude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAc,MAAM,eAAe,CAAC;AAClG,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAQ7B;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,SAAS,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,EAAE,MAAM,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;AA0BhC;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,EACrE,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/dist/frameworks/claude.js

@@ -0,0 +1,80 @@
+import { buildOptions, } from "./claude-options.js";
+import { resolveSdkVersion } from "../sdk-version.js";
+/** The framework THIS run path runs. OpenAI has its own path (`run-openai.ts`). */
+const CLAUDE_FRAMEWORK = "claude-agent-sdk";
+/** The npm package whose installed version is this framework's `hello.sdkVersion`. */
+const CLAUDE_SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
+function isResultMessage(msg) {
+    return msg.type === "result";
+}
+/** Map the SDK result message → the Worker Protocol `done` stopReason + result. */
+function resultToDone(msg) {
+    const result = typeof msg.result === "string" ? msg.result : "";
+    const stopReason = msg.subtype === "success"
+        ? "end_turn"
+        : msg.subtype === "error_max_turns"
+            ? "max_turns"
+            : "error";
+    return { stopReason, result };
+}
+/**
+ * Run one invoke. Emits `native` per SDKMessage, `done` on the result, `error`
+ * on a framework-gate violation or a thrown error. Never throws — every failure
+ * path becomes an `error` event so the Router always sees a terminal event.
+ */
+export async function runInvoke(snapshot, invoke, runtime, emit, query) {
+    // The SDK-version handshake (§8 item B, additive-optional) — ALWAYS the
+    // first event of this invoke's fd-3 stream, before the framework gate or any
+    // native/turn event. `sdkVersion` is resolved at runtime, never hardcoded;
+    // `null` (SDK not resolvable) is tolerated by the Router.
+    emit.hello(CLAUDE_FRAMEWORK, CLAUDE_SDK_PACKAGE, resolveSdkVersion(CLAUDE_SDK_PACKAGE));
+    // Framework gate: this run path is the Claude SDK. OpenAI agents route to
+    // `runInvokeOpenai` (selected in `index.ts` by `snapshot.framework`) and never
+    // reach here. A non-claude framework arriving here (e.g. `google-adk`,
+    // `vanilla`) has no run path yet → a clear `error`, never a silent mis-run.
+    if (snapshot.framework && snapshot.framework !== CLAUDE_FRAMEWORK) {
+        emit.error(`@guuey/host: the claude run path got framework '${snapshot.framework}'; no run path for it yet.`);
+        return;
+    }
+    let options;
+    try {
+        const ctx = {
+            input: invoke.input,
+            identity: invoke.identity,
+            fs: invoke.fs,
+            history: invoke.history,
+            listCredentials: runtime.listCredentials,
+            ...(runtime.apiKey !== undefined ? { apiKey: runtime.apiKey } : {}),
+            ...(runtime.baseUrl !== undefined ? { baseUrl: runtime.baseUrl } : {}),
+            ...(runtime.authToken !== undefined ? { authToken: runtime.authToken } : {}),
+            ...(invoke.priorMemory !== undefined ? { priorMemory: invoke.priorMemory } : {}),
+            ...(invoke.priorState !== undefined ? { priorState: invoke.priorState } : {}),
+        };
+        options = buildOptions(snapshot, ctx);
+    }
+    catch (err) {
+        emit.error(err instanceof Error ? err.message : String(err));
+        return;
+    }
+    try {
+        let done;
+        for await (const msg of query({ prompt: invoke.input, options })) {
+            emit.native(CLAUDE_FRAMEWORK, toJson(msg));
+            if (isResultMessage(msg))
+                done = resultToDone(msg);
+        }
+        emit.done(done?.result ?? "", done?.stopReason ?? "end_turn");
+    }
+    catch (err) {
+        emit.error(err instanceof Error ? err.message : String(err));
+    }
+}
+/**
+ * Coerce one SDKMessage to the `JsonValue` the `native` event carries. SDK
+ * messages are plain JSON-serializable objects; the round-trip drops any
+ * non-JSON surface (functions/symbols never appear on them) and yields the
+ * exact shape the Router's normalizer parses off the wire.
+ */
+function toJson(msg) {
+    return JSON.parse(JSON.stringify(msg));
+}

package/dist/frameworks/google-adk.d.ts

@@ -0,0 +1,105 @@
+import type { GuueyContext } from "@guuey/config";
+import type { Emitter, JsonValue } from "@guuey/worker";
+import type { FrameworkRunner, HostSnapshot, HostTurn } from "../index.js";
+import { type CredentialFile } from "../creds.js";
+/**
+ * Given a require-resolved entry file inside a package, walk up to the
+ * package root and return the absolute path of the root export's `import`
+ * condition (string conditions only — `@google/adk` 1.3.0's shape), or
+ * `undefined` when there is no exports map / no import condition.
+ */
+export declare function importConditionEntry(resolvedEntry: string): string | undefined;
+/**
+ * The narrow structural slice of `@google/adk`'s module surface this runner
+ * consumes. Structural (not `import type` from the peer's d.ts) so the module
+ * type-checks even where the optional peer is absent — the same posture as
+ * silverprotocol's facet-side `AdkEvent` contract.
+ */
+interface AdkModule {
+    LlmAgent: new (params: {
+        name: string;
+        model: string;
+        instruction: string;
+        tools: unknown[];
+    }) => AdkAgent;
+    InMemoryRunner: new (params: {
+        agent: AdkAgent;
+    }) => AdkRunner;
+    MCPToolset: new (connectionParams: {
+        type: "StreamableHTTPConnectionParams";
+        url: string;
+        transportOptions?: {
+            requestInit?: {
+                headers?: Record<string, string>;
+            };
+        };
+    }) => unknown;
+}
+/** Opaque agent handle — constructed here (no-code) or by the dev (graceful). */
+export type AdkAgent = object;
+interface AdkRunner {
+    readonly appName: string;
+    readonly sessionService: {
+        createSession(request: {
+            appName: string;
+            userId: string;
+        }): Promise<{
+            id: string;
+        }>;
+    };
+    runAsync(params: {
+        userId: string;
+        sessionId: string;
+        newMessage: {
+            role: "user";
+            parts: Array<{
+                text: string;
+            }>;
+        };
+        runConfig: {
+            streamingMode: "sse";
+        };
+    }): AsyncGenerator<JsonValue, void, undefined>;
+}
+/**
+ * Load `@google/adk`, honoring the single-copy rule: when `entryPath` (the
+ * graceful agent module) is given, resolve the SDK from THAT tree so the
+ * runner drives the same copy the dev's agent was built with; otherwise
+ * import from the host's own tree. A resolution failure surfaces as the
+ * actionable missing-peer error.
+ */
+export declare function loadAdk(entryPath?: string): Promise<AdkModule>;
+/**
+ * Map the broker's credential files to ADK MCP toolsets. Throws on an `sse`
+ * credential — the JS toolset has no SSE transport (unlike the Python-era
+ * host); the error names the server and the supported path.
+ */
+export declare function buildToolsets(adk: Pick<AdkModule, "MCPToolset">, creds: Array<{
+    name: string;
+    cred: CredentialFile;
+}>): unknown[];
+/**
+ * Extract a native event's last non-thought text part ("" when none).
+ * Structural narrowing from `JsonValue` — the event stays untyped JSON on its
+ * way to the normalizer; only this thin slice is inspected.
+ */
+export declare function finalTextOf(event: JsonValue): string;
+/**
+ * One turn against a caller-supplied agent + module (the seam graceful mode
+ * (T3) and the unit tests share). Emits hello → native* → done|error.
+ */
+export declare function runAdkTurn(adk: Pick<AdkModule, "InMemoryRunner">, agent: AdkAgent, turn: HostTurn, emit: Emitter, sdkVersion: string | null): Promise<void>;
+/**
+ * Assemble the per-turn {@link GuueyContext} — the ONE discoverable object a
+ * graceful factory receives (spec §2.2). `instruction` carries the standard
+ * context preamble already prepended; the raw fields ride alongside for
+ * factories that render context themselves.
+ */
+export declare function buildGuueyContext(snapshot: HostSnapshot, turn: HostTurn, instruction: string, mcpToolsets: unknown[]): GuueyContext;
+/** Injectable boot deps — the unit-test seam for the no-code path. */
+export interface AdkRunnerDeps {
+    load?: typeof loadAdk;
+}
+export declare function createRunner(deps?: AdkRunnerDeps): FrameworkRunner;
+export {};
+//# sourceMappingURL=google-adk.d.ts.map

package/dist/frameworks/google-adk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-adk.d.ts","sourceRoot":"","sources":["../../src/frameworks/google-adk.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAS3E,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAMnE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsB9E;AAID;;;;;GAKG;AACH,UAAU,SAAS;IACjB,QAAQ,EAAE,KAAK,MAAM,EAAE;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,OAAO,EAAE,CAAC;KAClB,KAAK,QAAQ,CAAC;IACf,cAAc,EAAE,KAAK,MAAM,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,KAAK,SAAS,CAAC;IAC/D,UAAU,EAAE,KAAK,gBAAgB,EAAE;QACjC,IAAI,EAAE,gCAAgC,CAAC;QACvC,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE;gBAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;aAAE,CAAA;SAAE,CAAC;KAC3E,KAAK,OAAO,CAAC;CACf;AAED,iFAAiF;AACjF,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,UAAU,SAAS;IACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE;QACvB,aAAa,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACtF,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;QAC7D,SAAS,EAAE;YAAE,aAAa,EAAE,KAAK,CAAA;SAAE,CAAC;KACrC,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;CAChD;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA0BpE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAClC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,GACnD,OAAO,EAAE,CAcX;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAapD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACtC,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,OAAO,EAAE,GACrB,YAAY,CAWd;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,OAAO,OAAO,CAAC;CACvB;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,aAAkB,GAAG,eAAe,CAwEtE"}