@namzu/sdk 5.0.0 → 5.2.0

package/src/provider/__tests__/strict-schema.test.ts

@@ -0,0 +1,133 @@
+import { describe, expect, it } from 'vitest'
+
+import { getBuiltinTools } from '../../tools/builtins/index.js'
+import { assertStrictSchema, findStrictSchemaViolations } from '../strict-schema.js'
+
+/**
+ * Strict tool input validates against a SUBSET of JSON Schema, and a keyword
+ * outside that subset is not degraded — the vendor rejects the entire request,
+ * so one unexpressible field in one tool takes down every tool in the call and
+ * the turn dies before producing a token.
+ *
+ * That shipped. The edit tool declared its integer-or-`"end"` field with
+ * `oneOf`, which is outside the subset while the equivalent `anyOf` is inside
+ * it, and the driver marked the tool strict without asking whether the schema
+ * it was vouching for could be said in that dialect.
+ *
+ * Measured against the live API:
+ *
+ * | body                   | result   |
+ * |------------------------|----------|
+ * | strict: true  + oneOf  | 400      |
+ * | strict: false + oneOf  | accepted |
+ * | strict: true  + anyOf  | accepted |
+ *
+ * The middle row is why nothing caught it. Neither half is wrong alone — the
+ * schema is valid JSON Schema, and turning strict on is correct policy — so no
+ * test of either one fails. Only the pairing does, and the pairing had no
+ * owner. The sweep below is that owner.
+ */
+
+describe('every tool that asks for strict validation can be expressed strictly', () => {
+	// The regression test that matters. Checking only the tool that broke
+	// would leave the next one to be found in production, which is how this
+	// one was found.
+	it.each(
+		getBuiltinTools()
+			.filter((t) => t.enforceModelInput)
+			.map((t) => [t.name, t] as const),
+	)('%s', (name, tool) => {
+		const violations = findStrictSchemaViolations(tool.modelInputSchema)
+		expect(violations, violations.map((v) => `${name}.${v.path}: ${v.remedy}`).join('\n')).toEqual(
+			[],
+		)
+	})
+
+	it('found at least one tool to check', () => {
+		// Guards the sweep itself: a filter that matches nothing passes
+		// vacuously, and a rename of `enforceModelInput` would silently turn
+		// this whole file into a no-op.
+		expect(getBuiltinTools().filter((t) => t.enforceModelInput).length).toBeGreaterThan(0)
+	})
+})
+
+describe('the violation report names the exact path', () => {
+	it('points at the keyword inside a nested property', () => {
+		const schema = {
+			type: 'object',
+			properties: {
+				insertLine: { oneOf: [{ type: 'integer' }, { const: 'end' }] },
+			},
+		}
+
+		expect(findStrictSchemaViolations(schema)).toEqual([
+			{
+				path: 'properties.insertLine.oneOf',
+				keyword: 'oneOf',
+				remedy: 'use `anyOf` — for disjoint branches the two are equivalent',
+			},
+		])
+	})
+
+	it('accepts the anyOf spelling of the same union', () => {
+		const schema = {
+			type: 'object',
+			properties: {
+				insertLine: { anyOf: [{ type: 'integer' }, { const: 'end' }] },
+			},
+		}
+
+		expect(findStrictSchemaViolations(schema)).toEqual([])
+	})
+
+	it('reports numeric and string bounds, which are also outside the subset', () => {
+		const schema = {
+			type: 'object',
+			properties: {
+				n: { type: 'integer', minimum: 0 },
+				s: { type: 'string', maxLength: 10 },
+			},
+		}
+
+		expect(
+			findStrictSchemaViolations(schema)
+				.map((v) => v.keyword)
+				.sort(),
+		).toEqual(['maxLength', 'minimum'])
+	})
+
+	it('admits additionalProperties only as false', () => {
+		expect(findStrictSchemaViolations({ additionalProperties: false })).toEqual([])
+		expect(findStrictSchemaViolations({ additionalProperties: { type: 'string' } })).toHaveLength(1)
+	})
+
+	it('walks into arrays of subschemas', () => {
+		const schema = { anyOf: [{ type: 'string' }, { not: { type: 'null' } }] }
+
+		expect(findStrictSchemaViolations(schema)[0]?.path).toBe('anyOf[1].not')
+	})
+
+	it('leaves ordinary annotations alone', () => {
+		const schema = {
+			type: 'object',
+			description: 'a tool',
+			properties: { a: { type: 'string', description: 'x', enum: ['y'] } },
+			required: ['a'],
+			additionalProperties: false,
+		}
+
+		expect(findStrictSchemaViolations(schema)).toEqual([])
+	})
+})
+
+describe('assertStrictSchema refuses rather than letting the request go', () => {
+	it('throws naming the tool, the path and the fix', () => {
+		expect(() => assertStrictSchema('edit', { properties: { insertLine: { oneOf: [] } } })).toThrow(
+			/edit\.properties\.insertLine\.oneOf/,
+		)
+	})
+
+	it('says nothing about a schema that is expressible', () => {
+		expect(() => assertStrictSchema('edit', { type: 'object' })).not.toThrow()
+	})
+})

package/src/provider/__tests__/typed-error-classification.test.ts

@@ -0,0 +1,143 @@
+import { describe, expect, it } from 'vitest'
+
+import { classifyProviderError } from '../../types/provider/errors.js'
+import type { LLMProvider, StreamChunk } from '../../types/provider/index.js'
+import { ProviderRequestError } from '../errors.js'
+import { withProviderRetry } from '../retry.js'
+
+/**
+ * A driver that classified its own failure was coming out WORSE than one that
+ * did not, in two independent places, and both shipped.
+ *
+ * `classifyProviderError` never read `kind`. A `ProviderRequestError` fell
+ * through to the status heuristics, where a carefully-diagnosed
+ * `context_overflow` carrying a 400 became `invalid_request` — so the run
+ * loop's overflow branch, which tests for `context_length_exceeded`, could
+ * never fire for a first-party driver, and compaction relief was unreachable
+ * for exactly the drivers that had diagnosed the problem correctly.
+ *
+ * And `withProviderRetry` rethrew any such error before the retry loop. Its
+ * comment justified preserving the classification, which is right; the code
+ * also skipped retrying, which is a different decision that nobody made.
+ */
+
+function providerThatFails(err: unknown): { provider: LLMProvider; calls: () => number } {
+	let calls = 0
+	const provider = {
+		id: 'test',
+		name: 'Test',
+		async *chatStream(): AsyncIterable<StreamChunk> {
+			calls++
+			throw err
+			// biome-ignore lint/correctness/useYield: it fails before producing anything
+		},
+	} as unknown as LLMProvider
+	return { provider, calls: () => calls }
+}
+
+const typed = (kind: string, status: number) =>
+	new ProviderRequestError({ kind, providerId: 'test', status, message: `a ${kind}` } as never)
+
+describe('a driver that classified its own failure is believed', () => {
+	const cases: readonly [string, number, string, boolean][] = [
+		['throttle', 429, 'rate_limit', true],
+		['server', 500, 'server_error', true],
+		['network', 0, 'network', true],
+		['auth', 401, 'auth', false],
+		['bad_request', 400, 'invalid_request', false],
+		// The one that mattered most: a 400 whose kind says the prompt was too
+		// long is not a bad request, and the difference decides whether the
+		// kernel reaches for compaction.
+		['context_overflow', 400, 'context_length_exceeded', false],
+	]
+
+	for (const [kind, status, code, retryable] of cases) {
+		it(`maps kind "${kind}" to ${code}`, () => {
+			const classified = classifyProviderError(typed(kind, status), 'test')
+			expect(classified.code).toBe(code)
+			expect(classified.retryable).toBe(retryable)
+		})
+	}
+
+	it('keeps the driver-supplied status and provider id', () => {
+		const classified = classifyProviderError(typed('throttle', 429), 'other')
+		expect(classified.status).toBe(429)
+		expect(classified.providerId).toBe('test')
+	})
+})
+
+describe('a classified failure still goes through the retry loop', () => {
+	it('retries a typed throttle', async () => {
+		// This is the regression: a first-party driver reporting a 429 as
+		// `kind: 'throttle'` used to get exactly one attempt, while the same
+		// failure from a driver that classified nothing got the full backoff.
+		const { provider, calls } = providerThatFails(typed('throttle', 429))
+		const wrapped = withProviderRetry(provider, {
+			config: { maxRetries: 2 },
+			sleepFn: async () => {},
+			random: () => 0,
+		})
+
+		await expect(async () => {
+			for await (const _ of wrapped.chatStream({} as never)) {
+				// drain
+			}
+		}).rejects.toThrow()
+
+		expect(calls()).toBe(3)
+	})
+
+	it('does not retry a typed auth failure', async () => {
+		const { provider, calls } = providerThatFails(typed('auth', 401))
+		const wrapped = withProviderRetry(provider, {
+			config: { maxRetries: 2 },
+			sleepFn: async () => {},
+		})
+
+		await expect(async () => {
+			for await (const _ of wrapped.chatStream({} as never)) {
+				// drain
+			}
+		}).rejects.toThrow()
+
+		expect(calls()).toBe(1)
+	})
+
+	it('does not retry a typed context overflow', async () => {
+		// Correctly non-retryable — an identical prompt overflows identically.
+		// The remedy is compaction, which the run loop reaches for once the
+		// code is `context_length_exceeded`.
+		const { provider, calls } = providerThatFails(typed('context_overflow', 400))
+		const wrapped = withProviderRetry(provider, {
+			config: { maxRetries: 2 },
+			sleepFn: async () => {},
+		})
+
+		await expect(async () => {
+			for await (const _ of wrapped.chatStream({} as never)) {
+				// drain
+			}
+			// The ORIGINAL escapes, so the boundary still sees the driver's
+			// own kind rather than a wrapper's code.
+		}).rejects.toMatchObject({ kind: 'context_overflow', status: 400 })
+
+		expect(calls()).toBe(1)
+	})
+
+	it('leaves an abort alone', async () => {
+		const abort = Object.assign(new Error('aborted'), { name: 'AbortError' })
+		const { provider, calls } = providerThatFails(abort)
+		const wrapped = withProviderRetry(provider, {
+			config: { maxRetries: 2 },
+			sleepFn: async () => {},
+		})
+
+		await expect(async () => {
+			for await (const _ of wrapped.chatStream({} as never)) {
+				// drain
+			}
+		}).rejects.toThrow(/aborted/)
+
+		expect(calls()).toBe(1)
+	})
+})

package/src/provider/model-version.ts

@@ -0,0 +1,98 @@
+/**
+ * Parse a versioned model id, given the vocabulary that names one.
+ *
+ * Several vendors spell an id the same way — a product segment, a family, a
+ * major version, sometimes a minor, and sometimes an 8-digit release date:
+ *
+ * ```
+ * <product>-<family>-<major>[-<minor>][-<YYYYMMDD>]
+ * ```
+ *
+ * The SHAPE is general and lives here; the vocabulary is not, and is supplied
+ * by the driver that knows it. That split is deliberate: a driver package
+ * exists to speak one service's dialect, and the kernel has no business
+ * knowing whose ids these are.
+ *
+ * It exists at all because three drivers had each written the same matcher and
+ * all three had the same defect: the minor-version group was `\d+`, which
+ * happily swallowed the date. An id naming no minor therefore parsed as
+ * `major.<the date>` and compared as enormously NEWER than one that does, so
+ * every capability gate keyed on `minor >= n` inverted for exactly those ids —
+ * a model was told it supported features it does not.
+ *
+ * A real minor version is one to three digits; a date is exactly eight.
+ * Bounding the group is what stops it reaching across the separator, and the
+ * expression then backtracks into leaving the minor absent so the date suffix
+ * can match where it belongs.
+ */
+
+export interface ModelVersion {
+	readonly family: string
+	readonly major: number
+	/** `0` when the id names no minor — a bare major is `<major>.0`. */
+	readonly minor: number
+}
+
+/**
+ * What a driver must say to have its ids parsed.
+ *
+ * Every field is a wire value the driver already carries. Passing them in
+ * rather than hard-coding them is what keeps this module free of any one
+ * service's names.
+ */
+export interface ModelIdGrammar {
+	/** The product segment an id begins with. */
+	readonly product: string
+	/** The family segment that follows it. */
+	readonly families: readonly string[]
+	/** An optional routing segment a gateway may prepend, including its slash. */
+	readonly routingPrefix?: string
+}
+
+const quoteMeta = (value: string): string => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+function expressionFor(grammar: ModelIdGrammar): RegExp {
+	const routing = grammar.routingPrefix ? `(?:${quoteMeta(grammar.routingPrefix)})?` : ''
+	// `.map(quoteMeta)` and not `.map(escape)`: the latter resolves to the
+	// global, deprecated `escape()`, which percent-encodes instead of escaping
+	// regex metacharacters — and would pass every test here, because no family
+	// name contains a character either function changes.
+	const families = grammar.families.map((f) => quoteMeta(f)).join('|')
+	// `\d{1,3}` on the minor, not `\d+`. That single bound is the whole fix.
+	return new RegExp(
+		`^${routing}${quoteMeta(grammar.product)}-(${families})-(\\d+)(?:[-_.](\\d{1,3}))?(?:-\\d{8})?$`,
+	)
+}
+
+/** `undefined` for anything the grammar does not describe — never a guess. */
+export function parseVersionedModelId(
+	id: string,
+	grammar: ModelIdGrammar,
+): ModelVersion | undefined {
+	const match = id.toLowerCase().match(expressionFor(grammar))
+	if (!match) return undefined
+	return {
+		family: match[1] as string,
+		major: Number(match[2]),
+		minor: match[3] === undefined ? 0 : Number(match[3]),
+	}
+}
+
+/**
+ * Whether an id names a version at or above `major.minor`.
+ *
+ * The comparison every caller was writing by hand. An id this cannot parse
+ * returns `false`: a capability gate must not open for a name it does not
+ * understand, which is the fail-safe reading and the one those callers' own
+ * comments already claimed.
+ */
+export function modelVersionAtLeast(
+	id: string,
+	grammar: ModelIdGrammar,
+	major: number,
+	minor: number,
+): boolean {
+	const version = parseVersionedModelId(id, grammar)
+	if (!version) return false
+	return version.major > major || (version.major === major && version.minor >= minor)
+}

package/src/provider/retry.ts

@@ -111,12 +111,19 @@ export function withProviderRetry(
 				return
 			} catch (err) {
 				if (isAbortError(err) || params.signal?.aborted) throw err
-				// A driver that already classified its own failure has said
-				// everything this layer would: re-wrapping it would replace a
-				// first-hand statement with a guess, and the run boundary reads
-				// that classification to choose between a pause and a failure.
-				if (isProviderRequestError(err)) throw err
-
+				// A driver that already classified its own failure keeps that
+				// classification — `classifyProviderError` reads its `kind`
+				// first and does not re-guess.
+				//
+				// This used to rethrow such an error outright. The stated reason
+				// was sound and the code did more than it said: preserving a
+				// first-hand classification is one thing, and skipping the retry
+				// loop is another. A first-party driver that correctly reported
+				// a 429 as `kind: 'throttle'` got ZERO attempts, while the same
+				// failure from a driver that classified nothing got the full
+				// backoff — so diagnosing your own error was punished. Whether
+				// to retry is now decided the same way for both, by the
+				// classification's own `retryable`.
 				const classified = classifyProviderError(err, provider.id)
 				const exhausted = attempt >= config.maxRetries
 
@@ -133,7 +140,16 @@ export function withProviderRetry(
 								? 'retries exhausted'
 								: 'not retryable',
 					})
-					throw classified
+					// The ORIGINAL escapes when the driver classified it. Two
+					// different consumers want two different things and both are
+					// right: this loop needs a retryable verdict, which the
+					// classification supplies, and the run boundary reports
+					// `lastProviderError` as the driver's own `{kind, status,
+					// retryAfterMs}`, which only survives if the error itself
+					// does. Wrapping here would have kept the retry fix and lost
+					// the vendor's `kind` at the boundary — the existing
+					// stream-recovery test caught exactly that.
+					throw isProviderRequestError(err) ? err : classified
 				}
 
 				const serverDirected = classified.retryAfterMs

package/src/provider/strict-schema.ts

@@ -0,0 +1,125 @@
+/**
+ * Which JSON Schema a driver may mark as strictly validated.
+ *
+ * Strict tool input is not "JSON Schema, enforced" — it is a SUBSET of JSON
+ * Schema, and a keyword outside that subset does not degrade. The vendor
+ * rejects the entire request, so one unexpressible field in one tool takes down
+ * every tool in the call and the turn dies before a single token is produced.
+ *
+ * This exists because that happened. A tool declared its integer-or-`"end"`
+ * field as `oneOf`, which is outside the subset while its synonym `anyOf` is
+ * inside it, and the driver marked the tool strict without ever asking whether
+ * the schema it was vouching for could be said in that dialect. Measured
+ * against the live API: strict + `oneOf` is a 400, strict + `anyOf` is
+ * accepted, and non-strict + `oneOf` is accepted.
+ *
+ * That last row is why nothing caught it. Neither half is wrong on its own —
+ * the schema is valid JSON Schema and the strict decision is correct policy —
+ * so no test of either one fails. Only the pairing does, and the pairing had no
+ * owner until this function.
+ *
+ * The check is cheap and runs where the pairing is made, which is the only
+ * place both facts are in hand.
+ */
+
+/**
+ * Keywords the strict subset does not accept.
+ *
+ * A deny-list rather than an allow-list, deliberately. An allow-list would have
+ * to enumerate every annotation a schema may carry — `description`, `title`,
+ * `examples`, vendor extensions — and would refuse a schema for saying
+ * something harmless. These are the constructs documented as outside the
+ * subset; each one names what to write instead.
+ */
+const NO_CONDITIONALS = 'strict mode has no conditional schemas; flatten the object'
+const NO_NUMERIC_BOUNDS = 'numeric bounds are not in the subset; enforce at execution'
+const NO_LENGTH_BOUNDS = 'length bounds are not in the subset; enforce at execution'
+
+// A Map rather than an object literal, because one of the keys is `then`: an
+// ordinary object carrying a `then` property is a thenable, and awaiting it
+// anywhere would silently call the string. The lint rule that says so is
+// right, and a Map has no such hazard.
+const UNSUPPORTED: ReadonlyMap<string, string> = new Map([
+	['oneOf', 'use `anyOf` — for disjoint branches the two are equivalent'],
+	['not', 'express the constraint positively, or validate it at execution'],
+	['if', NO_CONDITIONALS],
+	['then', NO_CONDITIONALS],
+	['else', NO_CONDITIONALS],
+	['minimum', NO_NUMERIC_BOUNDS],
+	['maximum', NO_NUMERIC_BOUNDS],
+	['exclusiveMinimum', NO_NUMERIC_BOUNDS],
+	['exclusiveMaximum', NO_NUMERIC_BOUNDS],
+	['multipleOf', NO_NUMERIC_BOUNDS],
+	['minLength', NO_LENGTH_BOUNDS],
+	['maxLength', NO_LENGTH_BOUNDS],
+	['minItems', NO_LENGTH_BOUNDS],
+	['maxItems', NO_LENGTH_BOUNDS],
+	['uniqueItems', 'array constraints are not in the subset; enforce at execution'],
+	['patternProperties', 'name the properties explicitly'],
+	['propertyNames', 'name the properties explicitly'],
+	['dependentSchemas', 'flatten the object and validate at execution'],
+	['dependentRequired', 'flatten the object and validate at execution'],
+])
+
+export interface StrictSchemaViolation {
+	/** Dotted path to the offending keyword, e.g. `properties.insertLine.oneOf`. */
+	readonly path: string
+	readonly keyword: string
+	/** What to write instead. */
+	readonly remedy: string
+}
+
+/**
+ * Every place a schema leaves the strict subset, with its exact path.
+ *
+ * The path is the point. The vendor's own error names the tool and the
+ * keyword but not where inside the schema it sits, which on a schema of any
+ * size is the difference between a glance and an afternoon.
+ */
+export function findStrictSchemaViolations(schema: unknown, path = ''): StrictSchemaViolation[] {
+	if (Array.isArray(schema)) {
+		return schema.flatMap((item, index) => findStrictSchemaViolations(item, `${path}[${index}]`))
+	}
+	if (typeof schema !== 'object' || schema === null) return []
+
+	const found: StrictSchemaViolation[] = []
+	for (const [keyword, value] of Object.entries(schema as Record<string, unknown>)) {
+		const here = path ? `${path}.${keyword}` : keyword
+		const remedy = UNSUPPORTED.get(keyword)
+		if (remedy !== undefined) {
+			found.push({ path: here, keyword, remedy })
+			continue
+		}
+		// `additionalProperties` is admitted only as `false`; any schema there
+		// is an open object, which the subset does not allow.
+		if (keyword === 'additionalProperties' && value !== false) {
+			found.push({
+				path: here,
+				keyword,
+				remedy: 'strict objects must set `additionalProperties: false`',
+			})
+			continue
+		}
+		found.push(...findStrictSchemaViolations(value, here))
+	}
+	return found
+}
+
+/**
+ * Refuse a schema the driver is about to vouch for and cannot.
+ *
+ * Refusing here rather than dropping `strict` quietly: a caller who set
+ * `enforceModelInput` asked for the guarantee, and silently not providing it
+ * is the failure this repo names `refuse, do not degrade`. The alternative
+ * costs a turn and teaches nothing — the vendor's 400 arrives with the tool
+ * name and the keyword, but not the path, and not the fix.
+ */
+export function assertStrictSchema(toolName: string, schema: unknown): void {
+	const violations = findStrictSchemaViolations(schema)
+	if (violations.length === 0) return
+
+	const detail = violations.map((v) => `  ${toolName}.${v.path} — ${v.remedy}`).join('\n')
+	throw new Error(
+		`Tool "${toolName}" is marked for strict input validation, but its model-facing schema uses ${violations.length} construct(s) the strict subset does not accept. The request would be rejected whole, taking every other tool in it down as well.\n${detail}`,
+	)
+}

package/src/public-runtime.ts

@@ -70,6 +70,16 @@ export { resolveTaskModel } from './router/task-router.js'
 // Every driver accepts `thinking`; one that does not implement it must
 // refuse rather than drop it. Shared so a new driver inherits the rule.
 export { assertThinkingUnsupported } from './provider/thinking-support.js'
+// One matcher for versioned model ids. Shared because three drivers had each
+// written their own and all three read an 8-digit date suffix as the MINOR
+// version, which inverted every capability decision keyed on it. The shape
+// lives here; the vocabulary comes from the driver that knows it.
+export { modelVersionAtLeast, parseVersionedModelId } from './provider/model-version.js'
+// Strict tool input is a SUBSET of JSON Schema, and a keyword outside it makes
+// the vendor reject the whole request rather than degrade one field.
+export { assertStrictSchema, findStrictSchemaViolations } from './provider/strict-schema.js'
+export type { StrictSchemaViolation } from './provider/strict-schema.js'
+export type { ModelIdGrammar, ModelVersion } from './provider/model-version.js'
 export { drainQuery, query } from './runtime/query/index.js'
 // Mid-run guidance. A host holds the channel and the loop drains it at the
 // tool-result boundary; see the module for why that is the only legal slot.
@@ -125,6 +135,24 @@ export {
 	resolveSkillChain,
 	SkillRegistry,
 } from './skills/index.js'
+
+// ─── the agent directory ─────────────────────────────────────────────────
+//
+// Reading a conventional `agent/` directory — its instructions, tools, skills
+// and delegates — into the same options `runAgent` and `SupervisorAgent`
+// already take. A loader, not a second engine: everything it produces is an
+// ordinary option, so a caller who outgrows the convention passes overrides
+// or stops calling it and keeps everything else.
+//
+// It shipped briefly as its own package. The name was the tell — nothing fit,
+// because a directory reader that needs the kernel to be useful is a function
+// of the kernel, not a product beside it.
+export {
+	ALL_SLOTS,
+	deriveRunOptions,
+	deriveSupervisorOptions,
+	loadDirectory,
+} from './directory/index.js'
 export {
 	AdvisorRegistry,
 	AdvisoryContext,
@@ -145,6 +173,9 @@ export {
 	// The short path: provider + model + prompt. Assembles the identity and
 	// budgets `drainQuery` requires and hands the generated identity back.
 	runAgent,
+	DEFAULT_MAX_ITERATIONS,
+	DEFAULT_TIMEOUT_MS,
+	DEFAULT_TOKEN_BUDGET,
 	SupervisorAgent,
 } from './agents/index.js'
 

package/src/public-tools.ts

@@ -12,6 +12,10 @@
 // ─── Tool definition primitive ───────────────────────────────────────────
 
 export { defineTool } from './tools/defineTool.js'
+// Containment, for a host or sibling package that resolves caller-supplied
+// paths against a root. Both were internal while three call sites outside
+// this file needed them.
+export { isWithin, resolveWithin, resolveWithinReal } from './tools/paths.js'
 // A host that surfaces its own untrusted content to a model needs the same
 // framing the kernel applies to connector prompts and delegated results.
 export { neutralizeEnvelopeDelimiter, wrapUntrusted } from './tools/untrusted-envelope.js'

package/src/public-types.ts

@@ -18,6 +18,14 @@ export type * from './types/message/index.js'
 export type * from './types/common/index.js'
 export type * from './types/bidi/index.js'
 export type * from './types/tool/index.js'
+// The directory convention: what a loaded `agent/` directory is, and what the
+// loader reports about the files it could not use.
+export type * from './directory/types.js'
+export type {
+	DelegatePlan,
+	DeriveSupervisorInput,
+	SupervisorPlan,
+} from './directory/derive-supervisor.js'
 export type * from './types/toolset/index.js'
 export type * from './types/permission/index.js'
 export type * from './types/run/index.js'