@namzu/sdk 45.1.0 → 48.0.0

package/src/provider/tool-call-framing.ts

@@ -0,0 +1,226 @@
+import type { StreamChunk } from '../types/provider/stream.js'
+
+type ToolCallDelta = NonNullable<StreamChunk['delta']['toolCalls']>[number]
+
+/**
+ * A stream that broke tool-call framing: a second call id on an `index`
+ * another call holds.
+ *
+ * The index is what groups a call's fragments, so after this no buffer can be
+ * trusted to hold one call's arguments. The second call's arguments used to be
+ * appended to the first's; the buffer that reached `JSON.parse` was then not
+ * what the model sent, and the model was told its call had been cut off.
+ *
+ * Nothing else about a call's framing is a violation. Arguments that arrive
+ * before the call's id belong to the call at their index and are kept, and a
+ * call whose id never arrives is still one call.
+ */
+export interface ToolCallFramingViolation {
+	readonly kind: 'index_reused'
+	readonly index: number
+	readonly openId: string
+	readonly newId: string
+}
+
+/**
+ * Whether this tool-call delta puts a new call on an index another call
+ * holds, or `undefined` when it does not.
+ *
+ * The same id repeated on every fragment is fine: some wires send it each
+ * time. Only a different one is a second call.
+ */
+export function toolCallFramingViolation(
+	open: { readonly id: string } | undefined,
+	delta: ToolCallDelta,
+	/** The index the fragment was placed on, when it came without one. */
+	index: number = delta.index,
+): ToolCallFramingViolation | undefined {
+	if (open?.id && delta.id && delta.id !== open.id) {
+		return { kind: 'index_reused', index, openId: open.id, newId: delta.id }
+	}
+	return undefined
+}
+
+function hasIndex(index: number | undefined): index is number {
+	return typeof index === 'number' && Number.isInteger(index) && index >= 0
+}
+
+/**
+ * Whether a fragment carries neither an index nor an id — the one shape
+ * `ToolCallIndexer.indexOf` cannot place by itself, and the only shape
+ * {@link ToolCallIndexer.placeUnindexedFragment} is for. A fragment with
+ * either goes through `indexOf` instead, unaffected by anything below.
+ */
+export function isUnindexedFragment(delta: {
+	readonly index?: number
+	readonly id?: string
+}): boolean {
+	return !hasIndex(delta.index) && !delta.id
+}
+
+/**
+ * The index each tool-call fragment of one stream belongs to.
+ *
+ * A driver sets `index`, and the index is what groups a call's fragments.
+ * Some servers leave it out of their `tool_calls` fragments, and a driver
+ * that passes the wire value through then sends none. Every such fragment used
+ * to land on one `undefined` index: two parallel calls were refused as a
+ * reused index, and the turn paused on a stream that had nothing wrong with
+ * it but the missing field.
+ *
+ * A fragment that carries an id, with or without an index, is placed by
+ * {@link indexOf}: an id seen before continues its call; a new id names the
+ * call the latest fragment went to when that call has no id yet, and starts a
+ * call on the next free index otherwise. A fragment that carries an index
+ * keeps it, so a well-formed stream is read exactly as before and a real
+ * reuse of an index is still refused.
+ *
+ * A fragment with NEITHER an id nor an index — see
+ * {@link isUnindexedFragment} — goes through {@link placeUnindexedFragment}
+ * instead, which is never a guess: nothing in such a fragment says which call
+ * it continues, so the caller is asked, for every call opened so far,
+ * whether it could still be receiving more of its arguments right now, and
+ * the fragment is placed only when the answer says exactly one call.
+ */
+export class ToolCallIndexer {
+	private readonly byId = new Map<string, number>()
+	private readonly idOf = new Map<number, string>()
+	private readonly named = new Set<number>()
+	private readonly opened = new Set<number>()
+	private latest: number | undefined
+	private next = 0
+
+	/** The index this id- or index-bearing fragment belongs to. */
+	indexOf(delta: { readonly index?: number; readonly id?: string }): number {
+		const index = hasIndex(delta.index) ? delta.index : this.placed(delta.id)
+		if (delta.id && !this.byId.has(delta.id)) this.byId.set(delta.id, index)
+		if (delta.id) {
+			this.named.add(index)
+			this.idOf.set(index, delta.id)
+		}
+		this.opened.add(index)
+		if (index >= this.next) this.next = index + 1
+		this.latest = index
+		return index
+	}
+
+	private placed(id: string | undefined): number {
+		if (!id) return this.latest ?? this.next
+		const known = this.byId.get(id)
+		if (known !== undefined) return known
+		return this.latest !== undefined && !this.named.has(this.latest) ? this.latest : this.next
+	}
+
+	/**
+	 * Where a fragment with neither an id nor an index belongs — see
+	 * {@link isUnindexedFragment}.
+	 *
+	 * Evaluated fresh for every such fragment, never decided once and
+	 * remembered from when a call opened: a call's buffer can go from
+	 * accepting more text to not (once it completes) and stay that way, so
+	 * only the state right now, at each fragment, says which calls could
+	 * still be its target. `canAccept(index)` is asked for every call opened
+	 * so far and answers exactly that: true while its buffer is empty or is
+	 * not yet a complete JSON value (it could still be receiving more), false
+	 * once the buffer already parses as one complete value (nothing more is
+	 * missing from it).
+	 *
+	 * - No call has opened yet: this fragment starts the first one. An id
+	 *   for it, if the stream sends one, arrives on a later fragment and
+	 *   attaches to it — the ordinary "arguments before the id" case,
+	 *   unchanged.
+	 * - Exactly one open call can still accept: it is unambiguously that
+	 *   one.
+	 * - Zero, or more than one, open call can: there is no way to tell which
+	 *   one this fragment was for, or none could take it at all. Every call
+	 *   that could have is returned in `candidates` (empty when none could),
+	 *   and the fragment belongs to none of them — appending it to a guess
+	 *   is exactly the splice this method exists to refuse.
+	 */
+	placeUnindexedFragment(
+		canAccept: (index: number) => boolean,
+	):
+		| number
+		| { readonly candidates: ReadonlyArray<{ readonly index: number; readonly id?: string }> } {
+		if (this.opened.size === 0) {
+			const index = this.next
+			this.opened.add(index)
+			this.next = index + 1
+			this.latest = index
+			return index
+		}
+		const candidates = [...this.opened].filter(canAccept)
+		if (candidates.length === 1) {
+			const [index] = candidates as [number]
+			this.latest = index
+			return index
+		}
+		return {
+			candidates: candidates
+				.sort((a, b) => a - b)
+				.map((index) => ({ index, id: this.idOf.get(index) })),
+		}
+	}
+
+	/**
+	 * The index a block close belongs to: its own, or, when it has none, the
+	 * call its id names, or the call the latest fragment went to.
+	 */
+	closedIndex(end: { readonly index?: number; readonly id?: string }): number | undefined {
+		if (hasIndex(end.index)) return end.index
+		return (end.id ? this.byId.get(end.id) : undefined) ?? this.latest
+	}
+}
+
+/** One sentence naming the violation, for an error's detail. */
+export function describeToolCallFramingViolation(violation: ToolCallFramingViolation): string {
+	return `the stream reused tool-call index ${violation.index} for call "${violation.newId}" while call "${violation.openId}" held it`
+}
+
+/**
+ * A stream sent a fragment with neither an id nor an index while more than
+ * one open call could still have been its target, or while none could.
+ *
+ * {@link ToolCallIndexer.placeUnindexedFragment} places such a fragment only
+ * when exactly one open call can still accept more text right now (its
+ * buffer empty, or not yet a complete JSON value). Once two calls are both
+ * in that state — the ordinary shape of a chat-completions "open" fragment,
+ * name and id with empty arguments, sent for one call right after another,
+ * before either has streamed any argument text — a later fragment naming
+ * neither could belong to either, and there is no field in it that says
+ * which. Guessing (placing it on whichever call was merely most recently
+ * active) can splice one call's JSON into the other's, and the splice can
+ * still happen to parse, so the wrong call runs with no error at all.
+ *
+ * `candidates` names every call that could have accepted the fragment: more
+ * than one when ambiguous, empty when the fragment matched no open call
+ * (nothing to route it to, and nothing to blame for it either).
+ */
+export interface ToolCallInterleaving {
+	readonly kind: 'interleaved_without_index'
+	readonly candidates: ReadonlyArray<{ readonly index: number; readonly id?: string }>
+}
+
+/** One sentence naming the interleaving, for an error's detail or log line. */
+export function describeToolCallInterleaving(interleaving: ToolCallInterleaving): string {
+	if (interleaving.candidates.length === 0) {
+		return 'the stream sent a tool-call fragment with neither an index nor an id, and no open call could still have accepted it'
+	}
+	const names = interleaving.candidates
+		.map((c) => (c.id ? `"${c.id}"` : `index ${c.index} (not yet named)`))
+		.join(' and ')
+	return `the stream sent a tool-call fragment with neither an index nor an id while ${names} could each still have accepted it, with nothing to tell them apart`
+}
+
+/**
+ * The `ToolInputError.parseError` given to every call an interleaving names.
+ * Reported `reason: 'malformed'`, never `'truncated'`: nothing here says the
+ * response was cut off, and "the model moved on to more text, reasoning or
+ * another call" — the only other case {@link ToolInputError} models — is
+ * exactly what opening a second call means. A call this leaves open may
+ * genuinely have gone on to carry valid JSON, if by chance no ambiguous
+ * fragment ever decided its fate; it is still reported unreadable rather
+ * than risk having guessed right by luck on some other stream.
+ */
+export const INTERLEAVED_TOOL_INPUT_PARSE_ERROR =
+	"its fragments arrived interleaved with another call's, with neither carrying an index to tell them apart"

package/src/public-runtime.ts

@@ -278,9 +278,13 @@ export type { JsonSchemaDialect } from './registry/tool/dialect.js'
 // by construction. Exported so a driver or a CI gate can assert it.
 export {
 	findPortableSchemaViolations,
+	findUndescribedProperties,
 	toPortableToolSchema,
 } from './registry/tool/portable.js'
-export type { PortableSchemaViolation } from './registry/tool/portable.js'
+export type {
+	PortableSchemaViolation,
+	UndescribedPropertyViolation,
+} from './registry/tool/portable.js'
 // The renderer itself, so a driver or a contract test can ask what a tool will
 // actually put on the wire without reaching into the registry.
 export { renderToolSchema, toolWireSchema } from './registry/tool/schema.js'
@@ -424,6 +428,7 @@ export {
 	loadSkill,
 	resolveSkillChain,
 	SKILL_FRONTMATTER_KEYS,
+	SkillCollisionError,
 	SkillRegistry,
 } from './skills/index.js'
 // The one frontmatter reader. `loadSkill` is built on it, and a host reading
@@ -450,6 +455,7 @@ export {
 	loadDirectory,
 } from './directory/index.js'
 export {
+	AdvisorCollisionError,
 	AdvisorRegistry,
 	AdvisoryContext,
 	AdvisoryExecutor,
@@ -464,6 +470,7 @@ export {
 	defineAgent,
 	InvocationLock,
 	PipelineAgent,
+	QueryAgent,
 	ReactiveAgent,
 	RouterAgent,
 	// The short path: provider + model + prompt. Assembles the identity and
@@ -552,18 +559,42 @@ export {
 	BaseRegistry,
 	ManagedRegistry,
 	PluginRegistry,
-	ToolCatalog,
+	RegistryCollisionError,
 	ToolNameCollisionError,
-	ToolRegistry,
-	createToolCatalogFromRegistry,
-	loadingFromAvailability,
-	toolDefinitionToCatalogEntry,
 } from './registry/index.js'
+export type { ManagedRegistryConfig, RegistryCollisionPolicy } from './registry/index.js'
+
+// Toolsets (plan.md v3 §1-2): the unit every tool comes from, and the
+// runtime-owned resolver of them. `toolset()` builds a plain static one;
+// `combineToolsets` merges several under one umbrella source, atomically
+// (throwing `ToolsetConflictError` on a name collision instead of silently
+// picking a winner); the rest are composable wrappers over any `Toolset`.
+// `ToolManager` is an advanced API: `query()` builds one per turn from
+// `toolsets`, and a host embedding the execution pipeline directly (rather
+// than through `query()`/the agent classes) builds its own.
+export { combineToolsets, ToolsetConflictError } from './toolsets/combine.js'
+export { defineCapability, dynamicCapability } from './capabilities/index.js'
+export { ToolManager } from './toolsets/manager.js'
+export type { ToolManagerConfig, ToolsetChangeReport } from './toolsets/manager.js'
+export { matchesSourceIdGlob } from './toolsets/source-glob.js'
+export { toolset } from './toolsets/toolset.js'
+export { toToolSourceRef } from './toolsets/types.js'
+export {
+	deferred,
+	filtered,
+	mapTools,
+	prefixed,
+	renamed,
+	readyWhen,
+	requireApproval,
+	withMetadata,
+} from './toolsets/wrappers.js'
 
 export {
 	attachShellHooks,
 	createShellHook,
 	DEFAULT_SHELL_HOOK_TIMEOUT_MS,
+	definePlugin,
 	discoverAllPluginDirs,
 	discoverPlugins,
 	loadPluginManifest,
@@ -576,6 +607,7 @@ export {
 	shellHookMatches,
 	shellHookVerdict,
 } from './plugin/index.js'
+export type { DefinedPlugin, DefinePluginOptions } from './plugin/define.js'
 
 export {
 	AgentManager,
@@ -742,6 +774,7 @@ export {
 	CommandCancellationUnsupportedError,
 	ConnectorManager,
 	ConnectorRegistry,
+	EnvironmentCollisionError,
 	EnvironmentConnectorManager,
 	ExecutionContextFactory,
 	HttpConnector,
@@ -778,6 +811,8 @@ export {
 	renderPromptMessages,
 	mcpJsonSchemaToZod,
 	mcpToolResultToToolResult,
+	mcpToolset,
+	mcpToolsetName,
 	mcpToolToToolDefinition,
 	RemoteExecutionContext,
 	RemoteExecutionBusyError,
@@ -788,6 +823,7 @@ export {
 	ServerStdioTransport,
 	StdioTransport,
 	StreamableHttpTransport,
+	TenantCollisionError,
 	TenantConnectorManager,
 	toolDefinitionToMCPTool,
 	toolResultToMCPToolResult,
@@ -810,6 +846,8 @@ export type {
 	MCPToolDrift,
 	MCPToolPolicy,
 	MCPToolPolicyDecision,
+	MCPToolsetOptions,
+	MCPToolsets,
 } from './connector/index.js'
 
 // ─── bridges (a2a + sse) ─────────────────────────────────────────────────
@@ -923,7 +961,31 @@ export {
 // The one reader of a bash command line the gate itself uses. A host that
 // writes a `predicate` rule about what a line runs decides on this reading,
 // so its rule and the SDK's own never disagree about where a quote ends.
-export { lexShellCommandLine } from './authorization/shell-lexer.js'
+// `nestedShellCommand` says which `-c` payloads that reading already
+// includes, so a host treats every other text a program runs as unread.
+export {
+	NESTED_SHELLS,
+	lexShellCommandLine,
+	nestedShellCommand,
+} from './authorization/shell-lexer.js'
+
+// Where a command line actually execs a program — unwrapping `sudo`, `env`,
+// `nice`, `timeout` and the rest of a re-exec chain with their own real
+// option grammars, rather than assuming the program sits right after the
+// wrapper's name. The live `bash` tool's escalation, the CLI's
+// scheduled-run floor and its script check all read this the same way, so
+// `env $(echo git) push` and `timeout 5 $(echo systemctl) stop …` cannot be
+// verified by one and missed by another.
+export {
+	DYNAMIC_RESOLUTION_VARIABLES,
+	hasPoisoningPrefix,
+	poisonedProgramPosition,
+	poisonsLaterCommands,
+	programPositions,
+	resolveScriptPrograms,
+	unknownProgramInLine,
+} from './authorization/program.js'
+export type { CommandProgramPositions, ProgramPosition } from './authorization/program.js'
 
 // NZ-BOOT-03: the module-attributed invariant registry. `compaction.ts` and
 // `claim-disk.ts` register themselves against the shared `invariants`
@@ -1302,6 +1364,8 @@ export {
 	REVIEW_EXEMPT_WRITES,
 	REVIEW_MODES,
 	SANDBOX_ESCAPE_UNATTENDED_REFUSAL,
+	SCREEN_CONSENT_DECLINED_FEEDBACK,
+	SCREEN_CONSENT_UNATTENDED_REFUSAL,
 	STRICT_MODE_REFUSAL,
 	batchNeedsReview,
 	createReviewHandler,
@@ -1317,6 +1381,7 @@ export { DECLINED_TOOL_CALL_FEEDBACK } from './runtime/query/declined.js'
 export {
 	CODING_AGENT_DELEGATION_DOCTRINE,
 	CODING_AGENT_DOCTRINE_CONTRIBUTION_ID,
+	CODING_AGENT_HYPERMODE_DOCTRINE,
 	CODING_AGENT_ORCHESTRATE_DOCTRINE,
 	CODING_AGENT_WORKING_DOCTRINE,
 	PLAN_MODE_DOCTRINE,
@@ -1416,7 +1481,6 @@ export type {
 	GoalCommandScope,
 	KernelCommandOptions,
 } from './registry/command/kernel-commands.js'
-export type { ToolCatalogFromRegistryOptions } from './registry/toolset/catalog.js'
 export type { MockBidiScript, MockBidiSession } from './runtime/bidi/mock.js'
 export type { BidiTurn, BidiTurnParams } from './runtime/bidi/session.js'
 export type { SecretRedactionOptions } from './runtime/query/guardrail-presets.js'
@@ -1433,7 +1497,13 @@ export type {
 export type { BroadcastHandoffDeps } from './session/handoff/broadcast.js'
 export type { SingleHandoffDeps } from './session/handoff/single.js'
 export type { InterventionChainLoader } from './session/intervention/prev-artifact.js'
-export type { ActionInput } from './tools/builtins/computer-use.js'
+export type {
+	ActionInput,
+	ComputerUseTool,
+	ComputerUseToolOptions,
+	ImageSize,
+	ScreenshotLimits,
+} from './tools/builtins/computer-use.js'
 export type { Project } from './types/project/entity.js'
 export type { CreatedLogger } from './utils/log/create-logger.js'
 export type {
@@ -1544,3 +1614,76 @@ export * from './store/session-index/index.js'
 export * from './store/checkpoint/index.js'
 export * from './store/budget/index.js'
 export * from './contracts/session/index.js'
+
+// ─── system events (@experimental) ──────────────────────────────────────
+//
+// One envelope for every asynchronous event a running turn reads as
+// provider-required user-role context. See `runtime/system-events.ts`.
+
+export {
+	SYSTEM_EVENT_HEADER,
+	SYSTEM_EVENT_KINDS,
+	SYSTEM_EVENT_STATUSES,
+	formatSystemEvent,
+} from './runtime/system-events.js'
+
+// ─── peer messaging (@experimental) ─────────────────────────────────────
+//
+// Cross-session messaging's SDK half: the live-session registry, the
+// `namzu-peer/1` transport (server + client), and the runtime-context
+// rendering of a delivered message or notice. CLI wiring (registry
+// lifecycle, inbox policy, `/peers`) is a separate workstream. See
+// `peers/index.ts`.
+
+export {
+	DEFAULT_PEER_READ_DEADLINE_MS,
+	DeliverRequestSchema,
+	DeliverResponseSchema,
+	DeliverStatusSchema,
+	LONGEST_PEER_SOCKET_FILE_NAME_LENGTH,
+	MAX_OUTSTANDING_PEERS,
+	MAX_OUTSTANDING_PER_PEER,
+	MAX_PEER_CONNECTIONS,
+	MAX_PEER_MESSAGE_TEXT_BYTES,
+	MAX_PEER_REQUEST_BYTES,
+	NoticeRequestSchema,
+	NoticeResponseSchema,
+	OUTSTANDING_EXPIRY_MS,
+	PEER_PROTOCOL_VERSION,
+	PEER_RECORD_VERSION,
+	PeerAddressError,
+	PeerClient,
+	PeerClientError,
+	PeerDirectoryError,
+	PeerEndpointError,
+	PeerFromSchema,
+	PeerNoticeAboutSchema,
+	PeerNoticePayloadSchema,
+	PeerRecordSchema,
+	PeerRefSchema,
+	PeerRegistryError,
+	PeerRequestSchema,
+	PeerSessionKindSchema,
+	PeerSessionStateSchema,
+	PingRequestSchema,
+	PingResponseSchema,
+	SubscribeIdleRequestSchema,
+	SubscribeIdleResponseSchema,
+	createPeerEndpoint,
+	derivePeerRef,
+	formatPeerMessage,
+	formatPeerNotice,
+	hardenPeerRuntimeDir,
+	isPeerRecordLive,
+	listLivePeers,
+	parsePeerAddress,
+	peerSocketFileName,
+	pingPeer,
+	pipePeerAddress,
+	readPeerRecord,
+	readPeerRecords,
+	removePeerRecord,
+	resolvePeerRuntimeDir,
+	udsPeerAddress,
+	writePeerRecord,
+} from './peers/index.js'

package/src/public-tools.ts

@@ -32,8 +32,9 @@ export {
 	untrustedEnvelopeBody,
 	wrapUntrusted,
 } from './tools/untrusted-envelope.js'
-export { filterReadOnlyTools, filterToolsNamed } from './tools/roster.js'
-export type { UntrustedEnvelope } from './tools/untrusted-envelope.js'
+export { matchesToolSelector } from './tools/roster.js'
+export type { ToolSelector } from './tools/roster.js'
+export type { UntrustedEnvelope, WrapUntrustedOptions } from './tools/untrusted-envelope.js'
 
 // ─── Built-in tools ──────────────────────────────────────────────────────
 
@@ -44,10 +45,29 @@ export { buildResidentHistoryTools } from './tools/resident-history.js'
 // input, which is how an `allow` for `git status*` came to approve
 // `git status && rm -rf ~`.
 export { builtinCommandArguments, commandArgumentOf } from './tools/command-arguments.js'
+// Which shell a host-side command runs in, and how to spawn it, so a host
+// that runs a command line outside the `bash` tool itself (a scheduled
+// job's own script, say) resolves the SAME shell the rules already read the
+// line in — never a second, drifting copy of this resolution.
+export {
+	type CommandShell,
+	type CommandShellProbe,
+	findCommandShell,
+	findCommandShellForDialect,
+	hostCommandShell,
+	hostShellSpawn,
+	installedCommandShellForDialect,
+	withoutBashStartup,
+} from './tools/command-shell.js'
 export { ReadFileTool } from './tools/builtins/read-file.js'
 export { WriteFileTool } from './tools/builtins/write-file.js'
 export { EditTool } from './tools/builtins/edit.js'
-export { BashTool, SANDBOX_ESCAPE_NOT_APPROVED } from './tools/builtins/bash.js'
+export {
+	BashTool,
+	type ExecHostShellProgress,
+	SANDBOX_ESCAPE_NOT_APPROVED,
+	execHostShell,
+} from './tools/builtins/bash.js'
 export { LSP_TOOL_NAME, LspTool, getCodeNavigationTools } from './tools/builtins/lsp.js'
 export { GlobTool } from './tools/builtins/glob.js'
 export { GrepTool } from './tools/builtins/grep.js'
@@ -66,7 +86,21 @@ export { WaitForJobTool } from './tools/builtins/wait-for-job.js'
 // NOT in the default builtin set: a turn with no skills has nothing for it
 // to do, and offering a tool that can only refuse is worse than not
 // offering it. Hosts register it alongside a skills registry.
-export { SKILL_TOOL_NAME, SkillTool, parseAllowedTools } from './tools/builtins/skill.js'
+// `createSkillTool` takes what the host knows about where its model's tools
+// run: `resolveModelDirectory` names the directory the model can open for
+// each skill, which a sandboxed host's own path is not.
+export {
+	SKILL_TOOL_NAME,
+	SkillTool,
+	createSkillTool,
+	parseAllowedTools,
+} from './tools/builtins/skill.js'
+export type {
+	SkillDirectoryContext,
+	SkillDirectoryRequest,
+	SkillDirectoryResolver,
+	SkillToolOptions,
+} from './tools/builtins/skill.js'
 // Both declare `category: 'network'`, which is what the authorization
 // presets branch on. NOT in the default builtin set: a turn with no web
 // provider has nothing for them to do, and only the `unattended` preset --
@@ -105,7 +139,11 @@ export {
 } from './tools/builtins/structuredOutput.js'
 export {
 	COMPUTER_USE_TOOL_NAME,
+	HIGH_RES_SCREENSHOT_LIMITS,
+	STANDARD_SCREENSHOT_LIMITS,
+	computerUseUnavailableReason,
 	createComputerUseTool,
+	screenshotTargetSize,
 } from './tools/builtins/computer-use.js'
 // The browser contract: the two tools over a host a separate package
 // provides, and the canonicalisers a host and a site-rule compiler must share
@@ -174,7 +212,7 @@ export {
 	allConnectorTools,
 	connectorInstanceToTools,
 	connectorMethodToTool,
-	ConnectorToolRouter,
+	connectorTools,
 	createConnectorExecuteTool,
 	createConnectorListTool,
 	createConnectorRouterTool,