@standardagents/builder 0.41.7 → 0.41.8

package/dist/resolver-BMZAzKD3.d.ts

@@ -0,0 +1,4522 @@
+import { i as AuthContext, b as ThreadEnv, v as Agent, x as ThreadMetadata, z as ToolResult, M as Message, n as ClientToolRequest, o as ClientToolResponse, V as ProxyStreamReceiver, W as ProxyStreamFrame, p as ClientStreamRequest, X as ProxyStreamTarget, q as ClientStreamResponse, Y as ProxyStreamOpenResult, H as FileRecord, Z as SkillStorageScope, F as FlowState, N as FileStats, K as GrepResult, J as AttachmentRef, U as MessageContent, G as Env, w as ThreadInstance } from './index-ChHAVogf.js';
+import { DurableObject, WorkerEntrypoint } from 'cloudflare:workers';
+import { CodeExecutionOptions, CodeExecutionResult, SubagentRegistryEntry, InjectMessageInput, QueueMessageInput, CredentialGrant, SkillMetadata, SkillFileInput, ModelDefinition as ModelDefinition$1, ToolArgs, PromptTextPart, PromptEnvPart, VariableDefinition, SubpromptConfig as SubpromptConfig$1, PromptToolConfig as PromptToolConfig$1, ReasoningConfig, HumanSide as HumanSide$1, SubagentRelationship as SubagentRelationship$1, ParentHookRequirement, LLMProviderInterface, ContentPart, TextPart, ImagePart, FilePart, ThreadState, NamespaceContext, DefinitionLoader } from '@standardagents/spec';
+import { N as NamespacedRegistry } from './types-Dhd0M369.js';
+
+/**
+ * Global namespace for AgentBuilder types.
+ *
+ * This namespace provides type-safe references for models, prompts, agents, and tools.
+ * Types are automatically populated when you run `pnpm dev` or `pnpm build`,
+ * which scans your `agentbuilder/` directories and generates types.
+ *
+ * The generated types are placed in `.agents/types.d.ts` and augment the
+ * StandardAgentSpec namespace from @standardagents/spec.
+ *
+ * Note: This namespace is provided for backward compatibility. New code should
+ * use StandardAgentSpec types directly, which are defined in @standardagents/spec.
+ *
+ * @deprecated Use StandardAgentSpec namespace from @standardagents/spec instead
+ */
+declare global {
+    namespace AgentBuilder {
+        /**
+         * Interface for model type registration.
+         * @deprecated Use StandardAgentSpec.ModelRegistry instead
+         */
+        interface ModelRegistry extends StandardAgentSpec.ModelRegistry {
+        }
+        /**
+         * Interface for prompt type registration.
+         * @deprecated Use StandardAgentSpec.PromptRegistry instead
+         */
+        interface PromptRegistry extends StandardAgentSpec.PromptRegistry {
+        }
+        /**
+         * Interface for agent type registration.
+         * @deprecated Use StandardAgentSpec.AgentRegistry instead
+         */
+        interface AgentRegistry extends StandardAgentSpec.AgentRegistry {
+        }
+        /**
+         * Interface for tool type registration.
+         * @deprecated Use StandardAgentSpec.ToolRegistry instead
+         */
+        interface ToolRegistry extends StandardAgentSpec.ToolRegistry {
+        }
+        /**
+         * Interface for callable type registration (prompts, agents, tools).
+         * @deprecated Use StandardAgentSpec.CallableRegistry instead
+         */
+        interface CallableRegistry extends StandardAgentSpec.CallableRegistry {
+        }
+        /**
+         * Union type of all model names defined in agentbuilder/models/.
+         * @deprecated Use StandardAgentSpec.Models instead
+         */
+        type Models = StandardAgentSpec.Models;
+        /**
+         * Union type of all prompt names defined in agentbuilder/prompts/.
+         * @deprecated Use StandardAgentSpec.Prompts instead
+         */
+        type Prompts = StandardAgentSpec.Prompts;
+        /**
+         * Union type of all agent names defined in agentbuilder/agents/.
+         * @deprecated Use StandardAgentSpec.Agents instead
+         */
+        type Agents = StandardAgentSpec.Agents;
+        /**
+         * Union type of all tool names defined in agentbuilder/tools/.
+         * @deprecated Use StandardAgentSpec.Tools instead
+         */
+        type Tools = StandardAgentSpec.Tools;
+        /**
+         * Union type of all callable items (prompts, agents, tools) that can be used as tools.
+         * @deprecated Use StandardAgentSpec.Callables instead
+         */
+        type Callables = StandardAgentSpec.Callables;
+        /**
+         * Interface for hook ID registration.
+         * @deprecated Use StandardAgentSpec.HookIdRegistry instead
+         */
+        interface HookIdRegistry extends StandardAgentSpec.HookIdRegistry {
+        }
+        /**
+         * Union type of all hook IDs defined in agents/hooks/.
+         * @deprecated Use StandardAgentSpec.HookIds instead
+         */
+        type Hooks = StandardAgentSpec.HookIds;
+        /**
+         * Interface for handler name registration.
+         * @deprecated Use StandardAgentSpec.HandlerRegistry instead
+         */
+        interface HandlerRegistry extends StandardAgentSpec.HandlerRegistry {
+        }
+        /**
+         * Union type of all handler names defined in agents/handlers/.
+         * @deprecated Use StandardAgentSpec.Handlers instead
+         */
+        type Handlers = StandardAgentSpec.Handlers;
+    }
+}
+
+/**
+ * Permissions utility for role-based access control
+ *
+ * Current behavior:
+ * - Admin role can do everything (early return true)
+ * - Other roles only get baseline access (own threads)
+ *
+ * The `can()` function checks arbitrary permission strings.
+ * Currently, non-admin users have no explicit permissions,
+ * meaning they rely on ownership checks for access.
+ */
+
+/**
+ * Check if a user can access a specific thread
+ *
+ * @param auth - The authenticated user context
+ * @param thread - The thread to check access for (must have user_id)
+ * @returns true if the user can access the thread
+ */
+declare function canAccessThread(auth: AuthContext, thread: {
+    user_id: string | null;
+}): boolean;
+
+/** Central API exposure policy shared by the generated Worker router and tests. */
+declare function isHostedInstance(env: unknown): boolean;
+/**
+ * Local-only conveniences are enabled by the request destination, not merely
+ * by the absence of a deployment flag. This makes an incorrectly configured
+ * internet-facing Worker fail closed while preserving localhost and OrbStack.
+ */
+declare function isTrustedLocalDevelopmentRequest(request: Request, env: Record<string, unknown> | undefined, trustedDevHosts?: readonly string[]): boolean;
+declare function isPublicApiRoute(routePath: string, request: Request, env: Record<string, unknown> | undefined): boolean;
+/**
+ * Reject browser requests initiated by another origin. Requests without
+ * browser provenance headers remain available to local CLI/test clients; they
+ * still need the normal route credential once bootstrap has completed.
+ *
+ * `Sec-Fetch-Site: same-origin` is a forbidden header, so a real browser that
+ * sends it is attesting same-origin even when a local reverse proxy rewrote
+ * `request.url`. Page JavaScript cannot forge that header.
+ */
+declare function isSameOriginBrowserRequest(request: Request): boolean;
+/** Instance-global authoring and package-management surfaces are admin-only. */
+declare function isAdminOnlyApiRoute(routePath: string, method?: string): boolean;
+
+declare function runtimeCorsHeaders(request: Request, env: Record<string, unknown> | undefined): Record<string, string>;
+declare function applyRuntimeCors(response: Response, request: Request, env: Record<string, unknown> | undefined): Response;
+declare function runtimePreflightResponse(request: Request, env: Record<string, unknown> | undefined): Response;
+
+type AlarmQueueStatus = "pending" | "processing" | "completed" | "failed" | "agent_canceled" | "user_canceled";
+type EffectCancelSource = "agent" | "user";
+interface EffectRunRecord {
+    id: string;
+    name: string;
+    args: Record<string, unknown>;
+    scheduledAt: number;
+    createdAt: number;
+    status: AlarmQueueStatus;
+    attempts: number;
+    error: string | null;
+    completedAt: number | null;
+    manualRun: boolean;
+    manualRunAt: number | null;
+    replayedFrom: string | null;
+}
+interface EffectRunListOptions {
+    limit?: number;
+    offset?: number;
+}
+interface EffectRunListResult {
+    effects: EffectRunRecord[];
+    total: number;
+    upcomingCount: number;
+    limit: number;
+    offset: number;
+}
+interface EffectRunActionResult {
+    action: "ran" | "replayed";
+    id: string;
+    replayedId?: string;
+}
+
+interface RuntimeSafetyStatus {
+    state: 'active' | 'quarantined';
+    reason: string | null;
+    source: string | null;
+    trippedAt: number | null;
+    resumedAt: number | null;
+    forensicHold: boolean;
+    lastActionId: string | null;
+    observed: Record<string, number>;
+}
+interface RuntimeQuarantineInput {
+    actionId: string;
+    reason: string;
+    source?: string;
+    forensicHold?: boolean;
+    observed?: Record<string, number>;
+}
+
+interface CodeExecutionBridgeRegistration {
+    call(functionId: string, encodedArgs: unknown[]): Promise<unknown>;
+}
+
+declare const INTERNAL_TOOL_DELIVERY: unique symbol;
+type ThreadEndpointCodeOptions = Pick<CodeExecutionOptions, "language" | "filename" | "execute" | "modules" | "memoryLimitBytes">;
+/**
+ * Result of one watchdog assessment (see performWatchdogAssessment). Returned
+ * to whichever delivery invoked it — the internal alarm check, the
+ * ThreadWatchdog companion probe, or the diagnostics revive endpoint — so the
+ * caller can schedule/record without re-deriving thread state.
+ */
+interface WatchdogProbeResult {
+    /** What the thread looked like, after any recovery action taken. */
+    verdict: "healthy" | "observing" | "recovered" | "parked" | "idle";
+    /** The recovery action performed (all actions are already done on return). */
+    action: "none" | "finalized_resumed" | "finalized_parked" | "finalized_deferred" | "aborted_takeover_resumed";
+    executing: boolean;
+    incompleteLogs: number;
+    queuedMessages: number;
+    /** Milliseconds since the last execution heartbeat; null when unknown/∞. */
+    silenceMs: number | null;
+    ceilingMs: number;
+    strikes: number;
+    /**
+     * True when a live-but-wedged executor was taken over: the zombie turn may
+     * still own this DO's alarm invocation, so the caller should force a
+     * restart (ThreadWatchdog calls forceRestart()) to free the alarm chain.
+     */
+    requestRestart: boolean;
+}
+declare class DurableThread<Env extends ThreadEnv = ThreadEnv> extends DurableObject<Env> {
+    private migratedToVersion;
+    private logSockets;
+    private messageSockets;
+    private bridgeSockets;
+    private bridgeLastSeen;
+    private bridgeClientInfo;
+    private executionOwnerCache;
+    private pendingClientCalls;
+    private clientStreams;
+    private proxyStreamReceivers;
+    private eventProxyStreams;
+    private alarmQueue;
+    private runtimeSafety;
+    private alarmQueueRearmed;
+    private currentAbortController;
+    private isExecuting;
+    /**
+     * In-memory waiters parked until the running flow finishes (AB-09): the
+     * executeFlow busy-guard awaits this signal instead of re-checking
+     * isExecuting every 500ms. Every isExecuting=false transition (execution
+     * finallys and the watchdog takeover) notifies. In-memory only — a DO
+     * restart drops waiters together with the busy caller.
+     */
+    private executionIdleWaiters;
+    private notifyExecutionIdleWaiters;
+    private lastProgressAt;
+    private watchdogWedgeStrikes;
+    private readonly watchdogIntervalMs;
+    private readonly watchdogResumeWindowMs;
+    private readonly watchdogMaxResumesPerWindow;
+    private codeExecutionBridges;
+    constructor(ctx: DurableObjectState, env: Env);
+    /**
+     * Returns the tools registry for this thread.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * @throws Error if not implemented in a subclass
+     * @returns Record of tool name to tool loader function
+     *
+     * @example
+     * ```typescript
+     * import { DurableThread } from 'virtual:@standardagents/builder'
+     *
+     * export class Thread extends DurableThread {}
+     * ```
+     */
+    tools(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the hooks registry for this thread.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * @throws Error if not implemented in a subclass
+     * @returns Record of hook name to hook loader function
+     *
+     * @example
+     * ```typescript
+     * import { DurableThread } from 'virtual:@standardagents/builder'
+     *
+     * export class Thread extends DurableThread {}
+     * ```
+     */
+    hooks(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the models registry for lazy-loading model definitions.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * @throws Error if not implemented in a subclass
+     * @returns Record of model name to model loader function
+     */
+    models(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the prompts registry for lazy-loading prompt definitions.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * @throws Error if not implemented in a subclass
+     * @returns Record of prompt name to prompt loader function
+     */
+    prompts(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the agents registry for lazy-loading agent definitions.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * @throws Error if not implemented in a subclass
+     * @returns Record of agent name to agent loader function
+     */
+    agents(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the effects registry for lazy-loading effect definitions.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * Effects are scheduled operations that run outside the tool execution context,
+     * ideal for delayed notifications, webhooks, and cleanup tasks.
+     *
+     * @throws Error if not implemented in a subclass
+     * @returns Record of effect name to effect loader function
+     */
+    effects(): Record<string, () => Promise<any>>;
+    /**
+     * Returns available handler loaders from the agents/handlers/ directory.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * Handlers are deterministic code that backs one side of an agent and takes
+     * that side's turns in place of a model.
+     *
+     * @returns Record of handler name to handler loader function
+     */
+    handlers(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the namespaced registry for packed agent support.
+     * This method is implemented when you import DurableThread from 'virtual:@standardagents/builder'.
+     *
+     * @throws Error if not implemented in a subclass
+     * @returns The namespaced registry with global and packages namespaces
+     */
+    registry(): any;
+    /**
+     * Load a model definition by name.
+     * Supports both global models and packed models (e.g., "packageId/modelName").
+     * For scoped packages, use "@scope/pkg/modelName".
+     * For packed context, tries package first then falls back to global.
+     */
+    loadModel(name: string): Promise<any>;
+    /**
+     * List available model names.
+     */
+    getModelNames(): string[];
+    /**
+     * Load a prompt definition by name.
+     * Supports both global prompts (e.g., "my-prompt") and packed prompts (e.g., "packageId/promptName").
+     */
+    loadPrompt(name: string): Promise<any>;
+    /**
+     * A prompt whose tools array still carries a 0.1.0 SubagentToolConfig is a
+     * LOAD error — there is no compatibility window, and the boot failure is
+     * the migration UX. Relationship declarations live on the owning agent
+     * side's subagents array.
+     */
+    static rejectLegacyPromptSubagentTools(promptDef: any, promptName: string): any;
+    /**
+     * List available prompt names.
+     */
+    getPromptNames(): string[];
+    /**
+     * Load an agent definition by name.
+     * Supports both global agents (e.g., "my-agent") and packed agents (e.g., "packageId/agentName").
+     * For scoped packages, use "@scope/pkg/agentName".
+     */
+    loadAgent(name: string): Promise<any>;
+    /**
+     * Convert a raw agent definition (defineAgent) into the runtime `Agent` config
+     * FlowEngine expects: maps `sideA/sideB.prompt` → `side_a/b_agent_prompt`,
+     * resolves session-tool bindings, and qualifies prompt names for packed
+     * agents. The execution entrypoints build this inline; this method is the
+     * shared path for code that resolves an agent OUTSIDE a live execution (e.g.
+     * `ThreadState.invokeTool()` from a thread endpoint), so the two can't drift
+     * (a raw def has no `side_a_agent_prompt`).
+     */
+    static buildAgentConfig(agentDef: any, agentName: string): Agent;
+    /**
+     * Load an agent by name AND convert it to the runtime `Agent` config (see
+     * `buildAgentConfig`). Used by `ThreadState.invokeTool()` when firing a tool
+     * outside an active execution, so the assembled state has a real
+     * `side_a_agent_prompt` instead of the raw definition's `sideA.prompt`.
+     */
+    loadAgentConfig(name: string): Promise<Agent>;
+    /**
+     * List available agent names.
+     */
+    getAgentNames(): string[];
+    /**
+     * Load a handler definition by name.
+     * Supports packed handlers via qualified names ("packageId/handlerName").
+     */
+    loadHandler(name: string): Promise<any>;
+    /**
+     * List available handler names.
+     */
+    getHandlerNames(): string[];
+    /**
+     * Load an effect definition by name.
+     */
+    loadEffect(name: string): Promise<any>;
+    /**
+     * List available effect names.
+     */
+    getEffectNames(): string[];
+    /**
+     * Load a tool definition by name.
+     * Supports both global tools (e.g., "my_tool") and packed tools (e.g., "packageId/toolName").
+     */
+    loadTool(name: string): Promise<any>;
+    /**
+     * Get thread metadata from DurableAgentBuilder.
+     * Used for creating ThreadState outside of flow execution.
+     */
+    getThreadMetadata(threadId: string): Promise<ThreadMetadata>;
+    /**
+     * Execute sandboxed code for a thread endpoint from inside the thread DO.
+     *
+     * Thread endpoint handlers often start in the top-level Worker with only a
+     * Durable Object stub. Code execution must originate here so the dynamic
+     * worker can use this DO's env, ctx exports, and bridge registration map.
+     */
+    executeThreadEndpointCode(threadId: string, source: string, options: ThreadEndpointCodeOptions): Promise<CodeExecutionResult>;
+    /**
+     * Execute ThreadState.runCode for endpoint handlers that only have a
+     * Durable Object stub. The actual Dynamic Worker must be started inside this
+     * DurableThread so it has access to env, ctx exports, and bridge callbacks.
+     */
+    executeThreadStateRunCode(threadId: string, source: string, options?: CodeExecutionOptions, wantsReport?: boolean): Promise<CodeExecutionResult>;
+    /**
+     * Run `ThreadState.invokeTool()` INSIDE this Durable Object.
+     *
+     * Thread endpoints hold only a DO stub (no `ctx`/`env`/storage), so they can't
+     * build a standalone execution state in the top-level Worker. ThreadStateImpl
+     * forwards idle `invokeTool` calls here — where `this` is the real DO — so the
+     * assembled state has real storage and `ctx.waitUntil`, letting a non-blocking
+     * subagent (e.g. `compaction_agent`) be spawned from an endpoint. Mirrors
+     * `executeThreadStateRunCode`.
+     */
+    executeThreadStateInvokeTool(threadId: string, toolName: string, args: Record<string, unknown>): Promise<ToolResult>;
+    /**
+     * Read a JSON value from this thread's durable key-value store.
+     */
+    getValue<T = unknown>(key: string): Promise<T | null>;
+    /**
+     * Write a JSON value to this thread's durable key-value store.
+     *
+     * Per the Standard Agents spec, null and undefined delete the key.
+     */
+    setValue(key: string, value: unknown): Promise<void>;
+    listValues(options?: {
+        search?: string | null;
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        values: Array<{
+            key: string;
+            value: unknown;
+            serialized: string;
+            size: number;
+            updatedAt: number;
+            parseError?: string;
+        }>;
+        total: number;
+        limit: number;
+        offset: number;
+        search: string | null;
+    }>;
+    private assertValidThreadValueKey;
+    private escapeThreadValueLike;
+    private serializeThreadValue;
+    private assertJsonSerializableThreadValue;
+    /**
+     * Trigger an agent to run on this thread.
+     *
+     * Queues an agent execution via the alarm queue. The execution
+     * runs asynchronously in the background.
+     *
+     * @param threadId - Thread ID for the execution
+     * @param agentName - Name of the agent to run
+     */
+    runAgent(threadId: string, agentName: string): Promise<void>;
+    /**
+     * Get the persisted resumable-subagent registry for this thread.
+     */
+    getChildrenRegistry(_threadId: string): Promise<SubagentRegistryEntry[]>;
+    /** In-memory throttle/reentrancy guards for the stale-child reconciler. */
+    private lastChildAuditAt;
+    private childAuditInFlight;
+    /**
+     * Lazily heal registry entries stranded at a "working" status. The normal
+     * settlement chain lives only in the parent's `waitUntil`; a parent
+     * eviction/deploy/kill during a child's run leaves the entry at `running`
+     * forever and clients render an eternal spinner. On registry reads, audit
+     * old unsettled entries against the child thread's ACTUAL state and settle
+     * them — conservatively (see subagent-reconcile.ts): resumable children
+     * are never deterministically terminated.
+     */
+    private reconcileStaleChildren;
+    /**
+     * Child-side registry settlement: called from the CHILD's own DO whenever
+     * a run ends, so the spinner clears even when the parent-held completion
+     * chain died with the parent. Only downgrades a live "working" status to
+     * idle — never clobbers terminated.
+     */
+    settleChildRegistryIdle(_threadId: string, reference: string): Promise<void>;
+    private setChildrenRegistry;
+    upsertChildRegistry(_threadId: string, entry: SubagentRegistryEntry): Promise<void>;
+    updateChildRegistryStatus(_threadId: string, reference: string, status: string): Promise<void>;
+    /**
+     * Nudge live event listeners after a child's registry status changes. The
+     * status (`running`/`idle`/`terminated`) lives here in the parent registry,
+     * not on the child's thread row, so without this a transition like running →
+     * idle would never reach `/api/events`. We re-broadcast a `thread_updated`
+     * for the child thread so consumers re-read its status. Best effort.
+     */
+    private broadcastChildStatusChanged;
+    removeChildRegistry(_threadId: string, reference: string): Promise<void>;
+    /**
+     * Persist the invocation arguments supplied when this subagent thread was
+     * created. These are hydrated into prompt-interpolation context on every
+     * activation of either side, so they survive for the life of the thread.
+     */
+    setSubagentArguments(_threadId: string, args: Record<string, unknown>): Promise<void>;
+    /**
+     * Read the persisted invocation arguments for this subagent thread.
+     * Returns an empty object when none were stored.
+     */
+    getSubagentArguments(_threadId: string): Promise<Record<string, unknown>>;
+    private asOptionalString;
+    private asOptionalBoolean;
+    private getThreadNameFromTags;
+    private toSubagentProjection;
+    private resolveSubagentMessageProjections;
+    /**
+     * Build hook resolution context and a genuine at-rest ThreadState.
+     * Resolution failures abort insertion so lifecycle hooks cannot be bypassed.
+     */
+    private buildAtRestHookState;
+    /**
+     * Inject a top-level message without starting a new execution.
+     *
+     * This path is used by effects and thread endpoints, which run without a
+     * FlowState but still need to write visible messages to the thread.
+     */
+    injectMessage(threadId: string, message: InjectMessageInput): Promise<Message>;
+    /**
+     * Queue a message for deferred delivery.
+     */
+    queueMessage(threadId: string, message: QueueMessageInput): Promise<void>;
+    private hasPendingTurnAlarm;
+    private ensureQueuedMessageExecution;
+    private ensureRootMessageId;
+    /**
+     * Soft-terminate this thread.
+     */
+    terminateThread(threadId: string): Promise<{
+        success: boolean;
+        terminated: number;
+    }>;
+    /**
+     * Schedule an effect for future execution.
+     *
+     * @param threadId - Thread ID for the effect execution context
+     * @param effectName - Name of the effect to schedule
+     * @param effectArgs - Arguments to pass to the effect handler
+     * @param delayMs - Delay in milliseconds before execution (default: 0)
+     * @returns UUID of the scheduled effect
+     */
+    scheduleEffect(threadId: string, effectName: string, effectArgs: Record<string, unknown>, delayMs?: number, options?: {
+        sourceLogId?: string | null;
+    }): Promise<string>;
+    /**
+     * Check whether an effect loader exists in either global or packed registries.
+     */
+    private effectExists;
+    /**
+     * Get scheduled effects for this thread.
+     *
+     * @param name - Optional effect name to filter by
+     * @returns Array of scheduled effect records
+     */
+    getScheduledEffects(name?: string): Promise<Array<{
+        id: string;
+        name: string;
+        args: Record<string, unknown>;
+        scheduledAt: number;
+        createdAt: number;
+    }>>;
+    /**
+     * List pending and historical effect runs for the AgentBuilder UI.
+     */
+    listEffectRuns(options?: EffectRunListOptions): Promise<EffectRunListResult>;
+    /**
+     * Run a pending effect now, or replay a historical effect immediately.
+     */
+    runEffectNow(effectRunId: string): Promise<EffectRunActionResult>;
+    /**
+     * Cancel a scheduled effect and keep it in history.
+     *
+     * @param id - The effect ID returned by scheduleEffect
+     * @returns true if the effect was found and canceled, false otherwise
+     */
+    removeScheduledEffect(id: string, canceledBy?: EffectCancelSource): Promise<boolean>;
+    /**
+     * Ensures the database schema is up to date.
+     * This method is called on the first request to the Durable Object.
+     * It checks the schema version and runs any pending migrations.
+     *
+     * Performance:
+     * - Already migrated to latest: ~0.1ms (single SELECT + integer comparison)
+     * - Needs migration: Runs once per Durable Object lifetime per schema version
+     * - Detects new migrations after code deployment
+     */
+    private ensureMigrated;
+    /**
+     * Gets the current schema version from the database.
+     * Returns 0 if the metadata table doesn't exist (brand new database).
+     */
+    private getCurrentVersion;
+    /**
+     * Runs all pending migrations sequentially.
+     * Each migration is run in order, starting from the current version + 1.
+     */
+    private runMigrations;
+    /**
+     * Legacy fetch handler for WebSocket upgrades only
+     */
+    fetch(request: Request): Promise<Response>;
+    registerCodeExecutionBridge(runId: string, bridge: CodeExecutionBridgeRegistration): void;
+    unregisterCodeExecutionBridge(runId: string): void;
+    callCodeExecutionBridge(runId: string, functionId: string, encodedArgs: unknown[]): Promise<unknown>;
+    /**
+     * Execute thread with initial messages (RPC method)
+     * Enqueues the execution to be processed by the alarm handler
+     */
+    execute(threadId: string, agentId: string, initial_messages?: any[], data?: any): Promise<Response>;
+    /**
+     * Execute a flow synchronously and return the final top-level message content.
+     * Used by blocking subagent tool calls.
+     */
+    executeBlocking(threadId: string, agentId: string, initial_messages?: any[], data?: any): Promise<{
+        status: "success" | "error";
+        result?: string;
+        error?: string;
+        attachments?: unknown[];
+        terminal?: boolean;
+    }>;
+    /** Best-effort: mark this child's entry idle in its parent's registry. */
+    private settleOwnRegistryEntry;
+    private executeBlockingImpl;
+    /**
+     * Send a new message to the thread (RPC method)
+     * Enqueues the message processing to be handled by the alarm handler
+     */
+    sendMessage(threadId: string, content: string, role?: string, attachments?: string): Promise<Response>;
+    /**
+     * Check if execution should be stopped (called by FlowEngine)
+     * Reads from SQLite for persistence across hibernation
+     */
+    shouldStop(): Promise<boolean>;
+    /**
+     * Returns the termination timestamp (microseconds) or null when active.
+     */
+    getTerminated(_threadId: string): Promise<number | null>;
+    private assertNotTerminated;
+    private getLatestTopLevelMessage;
+    private getTerminalSessionToolNames;
+    private parseAttachmentRefsJson;
+    private deleteAttachmentRefsFromJson;
+    private cancelQueuedMessage;
+    private parseMessageMetadata;
+    private extractSubagentIdFromMetadata;
+    private getLatestTerminalSessionMessageAfter;
+    private inferMimeTypeFromPath;
+    private extensionForMimeType;
+    private sanitizeFilename;
+    private splitFilename;
+    private resolveAttachmentMimeType;
+    private buildAttachmentTargetPath;
+    private copyAttachmentRefsToThread;
+    private readAttachmentDataFromSource;
+    private arrayBufferToBase64;
+    private formatSubagentAttachmentPathSummary;
+    private persistParentHandoffStatusMessage;
+    private buildMissingTerminalSessionFailure;
+    private deliverCompletionToParentIfNeeded;
+    private getParentRegistryEntryForChild;
+    /**
+     * Stop the currently executing thread (RPC method)
+     * Simple "off" switch - stops turns, only cleared by user messages
+     */
+    /**
+     * Flip every still-`pending` message to `failed` and broadcast the change to
+     * all connected heads. This is THE settle path for any terminal condition
+     * that leaves a turn half-open — user stop, lost execution, terminal
+     * execution failure, and expired parked forwarded calls — so no head is
+     * left rendering a stuck "Working" state. Returns the failure timestamp.
+     */
+    failPendingMessagesAndBroadcast(): Promise<number>;
+    /**
+     * A terminal failure ended a turn without a normal assistant reply: settle
+     * every pending message and persist a durable `failed` assistant message so
+     * all connected heads land on a real, visible end state — never a stuck
+     * "Working" spinner. Used by the FlowEngine's terminal catch and the parked
+     * forwarded-call TTL.
+     */
+    settleTerminalFailure(errorMessage: string, threadId?: string): Promise<void>;
+    stop(): Promise<Response>;
+    /**
+     * Continue execution from where it stopped (RPC method)
+     * Useful for debugging - continues the FlowEngine with additional steps
+     * without adding a new message.
+     *
+     * @param threadId The thread ID
+     * @param side Which side to start from ('a' or 'b'), defaults to 'a'
+     */
+    continueExecution(threadId: string, side?: 'a' | 'b'): Promise<Response>;
+    /**
+     * Get message history (RPC method)
+     *
+     * By default, returns the newest messages (when truncating), but in chronological
+     * order (oldest first in the array). This is ideal for chat UIs where messages
+     * should be appended and scrolled to the bottom.
+     *
+     * The offset parameter allows "scrolling up" to view older messages.
+     *
+     * Example:
+     * - getMessages(10, 0) -> newest 10 messages, oldest first in array
+     * - getMessages(10, 10) -> next 10 older messages, oldest first in array
+     *
+     * @param limit Number of messages to return (default: 100)
+     * @param offset Number of newest messages to skip (default: 0)
+     * @param order Internal query order - "DESC" (default) fetches newest first then reverses
+     * @param includeSilent Include silent messages (UI-only messages)
+     * @param maxDepth Maximum depth to include (default: 0 for top-level only)
+     */
+    getMessages(limit?: number, offset?: number, order?: "ASC" | "DESC" | "asc" | "desc", includeSilent?: boolean, maxDepth?: number): Promise<{
+        messages: {
+            id: string;
+            role: string;
+            content: string | null;
+            name: string | null;
+            tool_calls: string | null;
+            tool_call_id: string | null;
+            tool_status: "success" | "error" | null;
+            log_id: string | null;
+            created_at: number;
+            silent: boolean;
+            parent_id: string | null;
+            depth: number;
+            status: "pending" | "completed" | "failed" | null;
+            reasoning_content: string | null;
+            reasoning_details: string | null;
+            attachments: any;
+            metadata: Record<string, unknown> | undefined;
+            subagent_id: string | null;
+        }[];
+        total: number;
+        hasMore: boolean;
+    }>;
+    /**
+     * Get specific messages, optionally expanding any requested tool-call message
+     * to the full contiguous workblock it belongs to.
+     */
+    getMessagesByIds(ids: string[], includeSilent?: boolean, maxDepth?: number, includeWorkblocks?: boolean): Promise<{
+        messages: {
+            id: string;
+            role: string;
+            content: string | null;
+            name: string | null;
+            tool_calls: string | null;
+            tool_call_id: string | null;
+            tool_status: "success" | "error" | null;
+            log_id: string | null;
+            created_at: number;
+            silent: boolean;
+            parent_id: string | null;
+            depth: number;
+            status: "pending" | "completed" | "failed" | null;
+            reasoning_content: string | null;
+            reasoning_details: string | null;
+            attachments: any;
+            metadata: Record<string, unknown> | undefined;
+            subagent_id: string | null;
+        }[];
+        total: number;
+        hasMore: boolean;
+    }>;
+    /**
+     * Delete a message (RPC method)
+     * Also cleans up any attachment files stored on the thread filesystem
+     */
+    deleteMessage(messageId: string): Promise<{
+        success: boolean;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+    }>;
+    /**
+     * Update a message's content (RPC method)
+     */
+    updateMessageContent(messageId: string, content: string): Promise<{
+        success: boolean;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+    }>;
+    /**
+     * Seed messages directly into the database (RPC method - for testing)
+     * This bypasses the normal message processing flow
+     */
+    seedMessages(args: {
+        messages: Array<{
+            id: string;
+            role: string;
+            content: string;
+            created_at: number;
+            log_id?: string | null;
+        }>;
+    }): Promise<{
+        success: boolean;
+        count: number;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        count?: undefined;
+    }>;
+    /**
+     * Seed a log directly into the database (RPC method - for testing)
+     * This bypasses the normal log creation flow
+     */
+    seedLog(args: {
+        id: string;
+        message_id: string;
+        provider: string;
+        model: string;
+        created_at: number;
+        is_complete?: boolean;
+        prompt_name?: string;
+    }): Promise<{
+        success: boolean;
+        id: string;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        id?: undefined;
+    }>;
+    /**
+     * Get logs (RPC method)
+     */
+    getLogs(limit?: number, offset?: number, order?: "ASC" | "DESC"): Promise<{
+        logs: {
+            id: string;
+            kind: string | null;
+            message_id: string;
+            provider: string;
+            actual_provider: string | null;
+            standard_agents_router_used: boolean;
+            model: string;
+            model_name: string | null;
+            prompt_name: string | null;
+            tools_called: string | null;
+            queued_tools: string | null;
+            provider_tools: string | null;
+            parent_log_id: string | null;
+            retry_of_log_id: string | null;
+            error: string | null;
+            error_type: string | null;
+            error_origin: string | null;
+            cost_total: number | null;
+            input_tokens: number | null;
+            cached_tokens: number | null;
+            output_tokens: number | null;
+            total_tokens: number | null;
+            is_complete: boolean;
+            created_at: number;
+        }[];
+        total: number;
+        hasMore: boolean;
+    }>;
+    /**
+     * This thread's OWN request-log cost summary (no descendants), aggregated
+     * in SQL so subtree cost reporting doesn't page full log rows out of every
+     * thread in the tree. Used by GET /api/threads/:id/cost, which merges these
+     * across the thread and all of its subagent descendants.
+     */
+    getCostSummary(): Promise<{
+        totalCost: number;
+        inputCost: number;
+        cachedCost: number;
+        outputCost: number;
+        routerFeeCost: number;
+        requestCount: number;
+        messageCount: number;
+        byModel: Record<string, {
+            totalCost: number;
+            inputCost: number;
+            cachedCost: number;
+            outputCost: number;
+            routerFeeCost: number;
+            count: number;
+        }>;
+    }>;
+    /**
+     * Get specific logs, optionally including all descendant logs.
+     */
+    getLogsByIds(ids: string[], includeDescendants?: boolean, order?: "ASC" | "DESC"): Promise<{
+        logs: {
+            id: string;
+            kind: string | null;
+            message_id: string;
+            provider: string;
+            actual_provider: string | null;
+            standard_agents_router_used: boolean;
+            model: string;
+            model_name: string | null;
+            prompt_name: string | null;
+            tools_called: string | null;
+            queued_tools: string | null;
+            provider_tools: string | null;
+            parent_log_id: string | null;
+            retry_of_log_id: string | null;
+            error: string | null;
+            error_type: string | null;
+            error_origin: string | null;
+            cost_total: number | null;
+            is_complete: boolean;
+            created_at: number;
+        }[];
+        total: number;
+        hasMore: boolean;
+    }>;
+    /**
+     * Get logs for specific messages, optionally expanding requested messages to
+     * the full contiguous workblock they belong to and including descendant logs.
+     */
+    getLogsByMessageIds(messageIds: string[], includeWorkblocks?: boolean, includeDescendants?: boolean, order?: "ASC" | "DESC"): Promise<{
+        logs: {
+            id: string;
+            kind: string | null;
+            message_id: string;
+            provider: string;
+            actual_provider: string | null;
+            standard_agents_router_used: boolean;
+            model: string;
+            model_name: string | null;
+            prompt_name: string | null;
+            tools_called: string | null;
+            queued_tools: string | null;
+            provider_tools: string | null;
+            parent_log_id: string | null;
+            retry_of_log_id: string | null;
+            error: string | null;
+            error_type: string | null;
+            error_origin: string | null;
+            cost_total: number | null;
+            is_complete: boolean;
+            created_at: number;
+        }[];
+        total: number;
+        hasMore: boolean;
+    }>;
+    /**
+     * Scalar (non-heavy) log-detail fields plus joined source-message scalars
+     * and scheduled-effect provenance. The multi-MB TEXT columns are read one
+     * at a time via readLogDetailHeavyField so no caller ever holds them all
+     * in memory at once.
+     */
+    private readLogDetailScalars;
+    /**
+     * Single-column reads for the multi-MB log-detail TEXT columns. Static SQL
+     * per field (never interpolated), keyed by the shared heavy-field list the
+     * streamed serializer iterates.
+     */
+    private static readonly LOG_DETAIL_HEAVY_FIELD_SQL;
+    private readLogDetailHeavyField;
+    /**
+     * Get detailed information for a single log (RPC method).
+     *
+     * Kept for RPC compatibility; HTTP routes use the streamed
+     * `/internal/logs/:logId/details` fetch transport instead, because an
+     * assembled detail object can approach the 32MiB RPC serialization cap.
+     * `message_history` is no longer returned — it was byte-for-byte
+     * `request_body.messages`; clients derive it from request_body.
+     */
+    getLogDetails(logId: string): Promise<{
+        request_body: string | null;
+        response_body: string | null;
+        tools_schema: string | null;
+        system_prompt: string | null;
+        tool_results: string | null;
+        reasoning_content: string | null;
+        source_message_content: string | null;
+        id: string;
+        kind: string | null;
+        message_id: string;
+        provider: string;
+        actual_provider: string | null;
+        standard_agents_router_used: boolean;
+        model: string;
+        model_name: string | null;
+        endpoint: string | null;
+        request_headers: string | null;
+        response_headers: string | null;
+        status_code: number | null;
+        input_tokens: number | null;
+        cached_tokens: number | null;
+        output_tokens: number | null;
+        reasoning_tokens: number | null;
+        total_tokens: number | null;
+        latency_ms: number | null;
+        time_to_first_token_ms: number | null;
+        generation_ms: number | null;
+        finish_reason: string | null;
+        error: string | null;
+        error_type: string | null;
+        error_origin: string | null;
+        cost_input: number | null;
+        cost_cached: number | null;
+        cost_output: number | null;
+        cost_router_fee: number | null;
+        router_fee_percent: number | null;
+        cost_total: number | null;
+        message_history_length: number | null;
+        tools_available: number | null;
+        prompt_name: string | null;
+        tools_called: string | null;
+        queued_tools: string | null;
+        provider_tools: string | null;
+        parent_log_id: string | null;
+        errors: string | null;
+        retry_of_log_id: string | null;
+        is_complete: boolean;
+        created_at: number;
+        source_message_role: string | null;
+        source_message_created_at: number | null;
+        source_message_metadata: string | null;
+        scheduled_effects: string;
+    } | null>;
+    /**
+     * Streamed transport for log details: same JSON shape as getLogDetails but
+     * served as a fetch Response (no 32MiB RPC cap) whose body is written
+     * field-by-field with backpressure, so the full multi-MB detail object is
+     * never buffered in this DO.
+     */
+    private streamLogDetails;
+    /**
+     * Get thread metadata (RPC method)
+     */
+    getThreadMeta(threadId: string): Promise<Response | {
+        thread: {
+            id: any;
+            agent_id: any;
+            user_id: any;
+            tags: any;
+            parent: any;
+            terminated: any;
+            created_at: any;
+        };
+        agent: {
+            id: any;
+            title: any;
+            description: any;
+            icon: any;
+            side_a_backing: string;
+            side_b_backing: string;
+            side_a_label: any;
+            side_b_label: any;
+            side_a_agent_prompt: string | null;
+            side_b_agent_prompt: string | null;
+            side_a_handler: any;
+            side_b_handler: any;
+        } | null;
+        stats: {
+            message_count: number;
+            log_count: number;
+        };
+    }>;
+    /**
+     * Update thread metadata (RPC method)
+     * Calls the DurableAgentBuilder to update the thread registry
+     */
+    updateThreadMeta(threadId: string, params: {
+        agent_name?: string;
+        user_id?: string | null;
+        tags?: string[] | null;
+        env?: Record<string, string> | null;
+        tenvs?: Record<string, unknown> | null;
+    }): Promise<{
+        success: boolean;
+        thread: {
+            id: any;
+            agent_id: any;
+            user_id: any;
+            tags: any;
+            created_at: any;
+        };
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        thread?: undefined;
+    }>;
+    /**
+     * Delete thread data completely (RPC method)
+     * This will permanently delete the Durable Object instance
+     */
+    deleteThread(): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Handle WebSocket upgrade for real-time log streaming
+     * Uses Hibernation API to reduce costs during inactivity
+     */
+    private handleLogsWebSocketUpgrade;
+    /**
+     * Handle WebSocket upgrade for real-time message streaming
+     * Uses Hibernation API to reduce costs during inactivity
+     */
+    private handleMessagesWebSocketUpgrade;
+    /**
+     * Handle WebSocket upgrade for the client-tool bridge.
+     *
+     * A connected CLI holds this socket open. Forwarded tools send `tool_request`
+     * frames down it and the client replies with `tool_response` frames, letting
+     * the remotely-running agent execute filesystem/shell operations on the
+     * user's own machine.
+     */
+    private handleBridgeWebSocketUpgrade;
+    /** Parse a raw KV value into an {@link ExecutionOwner}, or null. */
+    private parseExecutionOwner;
+    /** Load (and cache) the thread's persisted execution-owner record. */
+    private getExecutionOwner;
+    /** Owner id from the in-memory mirror only (for sync paths); null when
+     *  unloaded or unowned — both degrade to the historical any-socket rule. */
+    private currentExecutionOwnerId;
+    /** Persist + cache the execution-owner record (null releases ownership). */
+    private setExecutionOwner;
+    /** Whether the given client id has an open bridge socket (excluding `except`).
+     * Idle bridge heartbeats are handled by Cloudflare without waking this object,
+     * so timestamp liveness is intentionally enforced only for an in-flight call. */
+    private hasLiveBridgeSocketForClient;
+    /** Tell every other bridge socket that execution ownership moved. */
+    private broadcastOwnerChanged;
+    /** Whether any forwarded call is mid-flight (blocking await or parked). */
+    hasInFlightClientCalls(): Promise<boolean>;
+    /**
+     * Ownership moved away from a dead client: settle everything that was
+     * dispatched to it. In-memory blocking calls fail immediately; parked
+     * durable calls get an error result and the turn resumes — re-sending them
+     * to the NEW owner would silently re-run the operation on a different
+     * machine's filesystem, which is worse than an honest retryable error.
+     */
+    private failStalePendingWork;
+    /**
+     * Forward a tool operation to a connected bridge client and await its result.
+     *
+     * Returns a structured response rather than throwing so forwarded tools can
+     * always produce a normal tool error (no client connected, timeout, or user
+     * denial) for the model to reason about.
+     */
+    callClientTool(request: ClientToolRequest, durability?: {
+        toolCallId: string;
+        side: "a" | "b";
+    }): Promise<ClientToolResponse>;
+    /** Settle a pending forwarded call exactly once, clearing its timers. */
+    private settleClientCall;
+    /** Close and forget a bridge socket we've deemed dead, failing remaining calls. */
+    private markBridgeDead;
+    /**
+     * Return the bridge socket a forwarded call should be dispatched to, pruning
+     * closed ones. Idle clients use Cloudflare's hibernation auto-response, so
+     * their frames deliberately do not update `bridgeLastSeen`. Once a call is
+     * dispatched, the client switches to application-visible pings and the
+     * in-flight liveness timer above detects a half-open connection.
+     *
+     * With an execution owner recorded, only the owner's socket (or, as a
+     * back-compat fallback, an unidentified legacy socket) is eligible; with no
+     * owner, the first live socket wins as it always has.
+     */
+    private getOpenBridgeSocket;
+    /** Resolve an in-flight forwarded tool call from a client `tool_response`. */
+    private resolveClientCall;
+    /**
+     * When the last bridge client that could serve forwarded calls disconnects,
+     * fail any in-flight ones so the agent loop doesn't hang waiting on a client
+     * that is gone. Uses the in-memory owner mirror (sync path); when the mirror
+     * isn't loaded this degrades to the historical any-socket check, and the
+     * per-call liveness interval still catches a dead dispatch target.
+     */
+    private failPendingClientCallsIfNoBridge;
+    /** Whether a bridge client that can execute forwarded calls is connected
+     *  right now (used to decide durable park). */
+    hasBridge(): Promise<boolean>;
+    private ensurePendingClientTable;
+    /**
+     * Durably dispatch a forwarded tool call WITHOUT blocking the agent loop.
+     * Persists the request, sends it to the connected client (best effort), and
+     * returns immediately. The client later delivers the result via
+     * {@link deliverClientToolResult}, which resumes execution.
+     */
+    dispatchClientTool(request: ClientToolRequest, toolCallId: string, side: "a" | "b"): Promise<{
+        dispatched: boolean;
+    }>;
+    /**
+     * Send one durable `tool_request` frame to the bridge if a client is
+     * connected — and stamp the pending row with the identity+generation it was
+     * dispatched to, fencing the eventual HTTP delivery to that client. A
+     * legacy (unidentified) executor leaves the row unstamped, keeping the
+     * historical accept-anything delivery for old CLIs.
+     */
+    private sendClientToolRequest;
+    /**
+     * The delivered result of a parked forwarded call, if the client has
+     * already resolved it — lets the approval-park path grace-wait briefly and
+     * return the REAL result inline instead of a "⏳ Awaiting your approval…"
+     * placeholder. Instant auto-accepts (the common case: the client's saved
+     * permission level covers the call) otherwise race the placeholder into
+     * stored history, leaving the model blind to its own tool outcomes.
+     */
+    /**
+     * In-memory waiters parked on a forwarded call's result delivery (AB-09).
+     * `deliverClientToolResult` resolves them so the approval grace-wait reads
+     * delivered state exactly once instead of re-polling it every 150ms.
+     * In-memory only: a DO restart drops waiters along with the caller that
+     * registered them, and the durable park path still resumes the turn.
+     */
+    private deliveredResultWaiters;
+    private notifyDeliveredResultWaiters;
+    /**
+     * Await a parked forwarded call's delivered result: one immediate read,
+     * then a single parked wait resolved by result delivery, bounded by one
+     * hard deadline, then one final read. Replaces the caller-side 150ms
+     * re-poll of {@link getDeliveredClientToolResult}.
+     */
+    awaitDeliveredClientToolResult(toolCallId: string, maxWaitMs: number): Promise<{
+        content: string;
+        toolStatus: string | null;
+    } | null>;
+    getDeliveredClientToolResult(toolCallId: string): Promise<{
+        content: string;
+        toolStatus: string | null;
+    } | null>;
+    /** Still-pending durable forwarded calls (for re-sending after a reconnect). */
+    getPendingClientCalls(): Promise<Array<{
+        toolCallId: string;
+        tool: string;
+        args: Record<string, unknown>;
+        requestPermission: string | null;
+        risk: number | null;
+    }>>;
+    /** Re-send all pending durable requests to a freshly connected bridge socket. */
+    private resendPendingClientCalls;
+    /**
+     * Deliver a client's result for a durable forwarded call: rewrite the parked
+     * "awaiting" placeholder tool-result message to the real result and mark the
+     * call resolved. Returns the side to continue, or null if there is no pending
+     * call (unknown id or already resolved — the delivery is idempotent).
+     */
+    deliverClientToolResult(toolCallId: string, ok: boolean, result?: string, error?: string, deliveredByClientId?: string, deliveredGeneration?: number, deliveryToken?: string, internalAuthorization?: typeof INTERNAL_TOOL_DELIVERY): Promise<{
+        side: "a" | "b";
+    } | null>;
+    /** Default time to wait for the client to accept a stream open. */
+    private static readonly CLIENT_STREAM_OPEN_TIMEOUT_MS;
+    /**
+     * In-memory waiters parked on the owner's bridge socket returning (AB-09).
+     * Resolved by bridge attach and by execution-owner changes; each waiter
+     * re-evaluates against the CURRENT owner on wake. In-memory only: a DO
+     * restart drops waiters with the stream-open call that registered them.
+     */
+    private ownerBridgeWaiters;
+    private notifyOwnerBridgeWaiters;
+    /**
+     * The thread HAS an elected execution owner, but its bridge socket is gone
+     * (daemon restart, network blip, DO handoff). Summon the owning machine
+     * through the per-user hub and wait for a bridge to re-attach instead of
+     * failing the stream open instantly — that instant failure is what ended
+     * Sama One turns with "workspace unavailable" whenever a slow tool/approval
+     * outlived the socket. Threads with NO recorded owner (subagent children)
+     * still fail fast so ancestor walk-up routing stays immediate.
+     *
+     * The wait parks on bridge-attach/owner-change signals under ONE hard
+     * deadline — no re-poll cadence. Each wake re-reads the owner because the
+     * returning daemon may reclaim with a new generation, and the socket must
+     * match the CURRENT owner.
+     */
+    private awaitOwnerBridgeSocket;
+    private parseProxyStreamAttachments;
+    /** Keep live proxy routes on the hibernating bridge socket for restart cleanup. */
+    private updateBridgeProxyAttachment;
+    private deliverProxyStreamFrame;
+    /** Abort live proxy routes restored without their in-memory stream state. */
+    private recoverInterruptedProxyStreams;
+    /** Register the child side before any ancestor opens an owner stream. */
+    createProxyStreamReceiver(onCancel: (error?: string) => void): ProxyStreamReceiver;
+    proxyStreamReceiverExists(receiverId: string): Promise<boolean>;
+    proxyStreamReceive(receiverId: string, frame: ProxyStreamFrame): Promise<boolean>;
+    /** Open a bidirectional byte stream to the connected owner client. */
+    openClientStream(request: ClientStreamRequest, proxyTarget?: ProxyStreamTarget | null): Promise<ClientStreamResponse>;
+    proxyStreamOpen(request: ClientStreamRequest, target: ProxyStreamTarget): Promise<ProxyStreamOpenResult>;
+    proxyStreamWrite(id: string, dataB64: string): Promise<void>;
+    proxyStreamEnd(id: string): Promise<void>;
+    proxyStreamAbort(id: string): Promise<void>;
+    private forgetEventProxyStream;
+    /** Settle and remove a client stream exactly once. */
+    private settleClientStream;
+    /** Abort a stream from the Worker side, telling the client to tear down. */
+    private abortClientStream;
+    /** Handle an incoming stream_* frame from a bridge client. */
+    private handleClientStreamFrame;
+    /** Fail every stream bound to a socket that closed or died. */
+    private failClientStreamsForSocket;
+    /** How long a parked forwarded call waits for a client before failing visibly. */
+    private static readonly CLIENT_PARK_TTL_MS;
+    /**
+     * A forwarded call parked with NO client attached: ask the user's hub to
+     * summon the owning machine's daemon to this thread, and arm the bounded
+     * park TTL that turns an unreachable host into a visible durable failure
+     * instead of a silent hang.
+     */
+    notifyClientWaiting(toolCallId: string, threadId: string, userId: string | null): Promise<void>;
+    /** Ask the user's hub to summon the owning machine's daemon to a thread.
+     *  Best-effort: wake failure must never fail the caller's own path. */
+    private requestHubWake;
+    /**
+     * Park TTL expired: if the call is still pending, settle it as a durable,
+     * VISIBLE failure — rewrite the waiting placeholder, mark the pending row
+     * failed, fail any still-pending assistant messages, and persist a durable
+     * failed assistant message so every connected head settles instead of
+     * showing "Working" forever.
+     */
+    private failParkedClientCall;
+    /**
+     * Broadcast a log record to all connected WebSocket clients
+     */
+    private broadcastLog;
+    /**
+     * Broadcast a message record to all connected message WebSocket clients
+     * Filters silent messages based on each socket's includeSilent preference
+     */
+    private broadcastMessage;
+    /**
+     * The FlowEngine's message emit path: broadcast the record, and stamp
+     * message recency when it is the thread's visible terminal assistant reply.
+     *
+     * This is the frame a client's reducer consumes to retire its provisional
+     * draft, so it is the one place where "the user has something new to read"
+     * is known. The stamp deliberately does NOT carry a preview: previews are
+     * row labels and stay keyed to the user's own message, while recency has to
+     * follow the agent's reply.
+     */
+    private emitFlowMessage;
+    private broadcastMessageWithSubagentProjection;
+    /**
+     * Broadcast a content chunk for real-time streaming
+     * Does NOT update database - only broadcasts to connected clients
+     */
+    private broadcastMessageChunk;
+    /**
+     * Broadcast an internal-reasoning chunk for real-time streaming.
+     *
+     * OPT-IN per the spec (`ThreadReasoningChunkEvent`): only sockets that
+     * subscribed with `?reasoning=1` receive it. Like content chunks it does NOT
+     * touch the database — reasoning is ephemeral display output.
+     */
+    private broadcastReasoningChunk;
+    /**
+     * Broadcast a telemetry event to all connected message WebSocket clients
+     * Used for execution status updates (step_started, tool_started, etc.)
+     */
+    private broadcastTelemetry;
+    /**
+     * Broadcast a custom event to all connected message WebSocket clients
+     * Used by tools via emitThreadEvent() to send user-defined events
+     */
+    emitThreadEvent(_threadId: string, type: string, data: unknown): void;
+    private broadcastEvent;
+    /**
+     * WebSocket Hibernation API handler for incoming messages
+     * Called when a message is received on a hibernated WebSocket
+     */
+    webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void>;
+    /**
+     * WebSocket Hibernation API handler for connection close
+     * Called when a WebSocket connection is closed
+     * Note: Do NOT call ws.close() here - the connection is already closed
+     */
+    webSocketClose(ws: WebSocket, _code: number, _reason: string, _wasClean: boolean): Promise<void>;
+    /**
+     * WebSocket Hibernation API handler for errors
+     * Called when a WebSocket encounters an error
+     */
+    webSocketError(ws: WebSocket, error: unknown): Promise<void>;
+    /**
+     * Alarm handler - called by Cloudflare when a scheduled alarm fires
+     * Processes the next item in the alarm queue
+     *
+     * Important: This method must NEVER throw an exception, as that would break
+     * the alarm chain. All errors are caught and logged.
+     */
+    alarm(): Promise<void>;
+    /** Persist a reversible emergency stop without scanning or deleting thread data. */
+    emergencyQuarantine(input: RuntimeQuarantineInput): Promise<RuntimeSafetyStatus>;
+    /** Return the low-cost quarantine status used by Brolly and diagnostics. */
+    getRuntimeSafetyStatus(): Promise<RuntimeSafetyStatus>;
+    /** Resume only through an explicit idempotent action; forensic holds need release. */
+    emergencyResume(input: {
+        actionId: string;
+        reason: string;
+        releaseForensicHold?: boolean;
+    }): Promise<RuntimeSafetyStatus>;
+    /** Heartbeat: called by LLMRequest on each attempt and streamed chunk. */
+    noteExecutionProgress(): void;
+    /**
+     * The per-thread companion watchdog DO (ThreadWatchdog), derived from the
+     * thread id. It exists because this thread's OWN alarm cannot fire while a
+     * queue-dispatched turn runs inside alarm() — the companion delivers the
+     * same check via RPC, which interleaves at await points even mid-turn.
+     * Returns null on deployments whose generated config predates the binding.
+     */
+    private watchdogCompanion;
+    /**
+     * Stamp thread activity on the registry so thread lists can sort by recency
+     * of real work and show which threads are executing right now. Registry
+     * bookkeeping is presentation state: a failure here must never take down the
+     * turn that triggered it.
+     */
+    private recordRegistryActivity;
+    /**
+     * The newest non-empty user message on this thread, for thread-list previews.
+     * Returns null when the thread has none. The Durable Object does not know its
+     * own thread id, so the caller is the one that stamps the registry.
+     */
+    getLatestUserMessagePreview(): Promise<string | null>;
+    /** Arm the standing watchdog for an execution start. One pending row max. */
+    private armExecutionWatchdog;
+    /** Disarm on clean execution end. Completed check rows are noise, not history. */
+    private disarmExecutionWatchdog;
+    /**
+     * The standing check, alarm-queue delivery. Evaluates the thread's state AT
+     * FIRE TIME — it knows nothing about whichever request was in flight when it
+     * was armed. NOTE this delivery path cannot fire while a queue-dispatched
+     * turn runs (the turn owns this DO's single alarm invocation); the
+     * ThreadWatchdog companion delivers the same assessment via watchdogProbe()
+     * in exactly that window.
+     */
+    private watchdogCheck;
+    /**
+     * RPC delivery of the standing check — called by the ThreadWatchdog
+     * companion (and the diagnostics revive endpoint). Runs in a fresh request
+     * context, so it interleaves with a running turn at await points and its
+     * own awaits/timers are alive even when a wedged turn's context is frozen.
+     * Does NOT touch the internal watchdogCheck alarm rows — those belong to
+     * the alarm delivery path.
+     */
+    watchdogProbe(threadId: string): Promise<WatchdogProbeResult>;
+    /**
+     * Reset this Durable Object instance on request. Used by the watchdog
+     * companion after a wedged-executor takeover: the zombie turn may still own
+     * this DO's single alarm invocation, which would block the just-enqueued
+     * recovery alarm forever. Aborting guarantees a fresh instance whose alarm
+     * chain re-arms from persisted queue state on first wake.
+     */
+    forceRestart(reason: string): Promise<void>;
+    /**
+     * Execution-health snapshot for the diagnostics endpoint and `agents diag`.
+     * Exposes the state the 2026-07-08 post-mortem could not see from outside:
+     * the alarm queue (was a turn item pending/processing/failed? was the
+     * watchdog row gone?), the volatile execution flags, and open request logs.
+     * Read-only; safe to call at any time.
+     */
+    getDiagnostics(): Promise<{
+        executing: boolean;
+        lastProgressAt: number | null;
+        silenceMs: number | null;
+        watchdogStrikes: number;
+        watchdogCeilingMs: number;
+        stopped: boolean;
+        runtimeSafety: RuntimeSafetyStatus;
+        incompleteLogs: Array<{
+            id: string;
+            model: string | null;
+            provider: string | null;
+            created_at: number;
+        }>;
+        alarmQueue: Array<{
+            id: string;
+            method: string;
+            status: string;
+            scheduled_at: number;
+            created_at: number;
+            attempts: number;
+            error: string | null;
+        }>;
+        messageQueueCount: number;
+        contextUsage: Record<string, unknown> | null;
+    }>;
+    /**
+     * The shared watchdog decision core. Both deliveries (alarm + companion
+     * probe) evaluate and ACT through this method; the caller only decides what
+     * to do with its own scheduling based on the verdict.
+     */
+    private performWatchdogAssessment;
+    /** Mark logs the dead executor abandoned, and tell connected clients. */
+    private finalizeLostExecutionLogs;
+    /**
+     * A subagent whose execution the watchdog gave up on leaves its parent
+     * waiting forever for a completion message. Deliver the failure the same way
+     * a sessionFail would, so the parent's turn wakes and can route around it.
+     * Explicit-communication children (e.g. the compaction agent) stay quiet by
+     * contract — only the registry status updates for those.
+     */
+    private notifyParentOfLostExecution;
+    /** At most N auto-resumes per rolling window, tracked durably. */
+    private consumeWatchdogResumeBudget;
+    private normalizePlainRecord;
+    private buildExecutionArguments;
+    /**
+     * Internal method: Execute a flow (called by alarm queue)
+     * This is the actual execution logic, separate from the public execute() RPC method
+     */
+    private executeFlow;
+    /**
+     * Internal method: Execute an effect (called by alarm queue)
+     * Effects run outside the tool execution context.
+     */
+    private executeEffect;
+    /**
+     * Internal method: Process a message (called by alarm queue)
+     * This is the actual message processing logic, separate from the public sendMessage() RPC method
+     */
+    private processMessage;
+    /**
+     * Internal method: Continue execution without adding a message (called by alarm queue)
+     * This allows resuming FlowEngine execution from where it stopped.
+     */
+    private doContinueExecution;
+    private getLatestQueuedMessageSide;
+    /**
+     * TEST METHOD: Queue a test operation
+     * Used for testing alarm queue ordering and timing
+     */
+    queueTestOperation(id: string, label: string, expectedOrder: number, delayMs: number): Promise<Response>;
+    /**
+     * TEST METHOD: Get queue state
+     */
+    getQueueState(): Promise<Response>;
+    /**
+     * TEST METHOD: Get test execution logs
+     */
+    getTestLogs(): Promise<Response>;
+    /**
+     * TEST METHOD: Clear test logs
+     */
+    clearTestLogs(): Promise<Response>;
+    /**
+     * TEST METHOD: Insert a malformed message with orphaned tool calls
+     * This allows testing the tool call filtering logic
+     */
+    insertOrphanedToolCall(params: {
+        content?: string;
+        toolCallId: string;
+        toolName: string;
+        toolArgs: string;
+    }): Promise<Response>;
+    /**
+     * TEST METHOD: Execute a test operation
+     * Internal method called by alarm queue
+     */
+    private testOperation;
+    /**
+     * Get file storage helper instance
+     */
+    private getFileStorage;
+    /**
+     * Write a file to storage (RPC method)
+     */
+    writeFile(path: string, data: string, // base64 encoded
+    mimeType: string, options?: {
+        metadata?: Record<string, unknown>;
+        thumbnail?: string;
+    }): Promise<{
+        success: boolean;
+        file: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        file?: undefined;
+    }>;
+    /**
+     * Write a text file to storage (RPC method)
+     */
+    writeTextFile(path: string, content: string, mimeType?: string, options?: {
+        metadata?: Record<string, unknown>;
+    }): Promise<{
+        success: boolean;
+        file: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        file?: undefined;
+    }>;
+    /**
+     * Process an image using sip (WASM-based image processing)
+     * This runs inside the DO where WASM is properly initialized.
+     *
+     * @param data - base64 encoded image data
+     * @param mimeType - MIME type of the input image
+     * @returns Processed image data, dimensions, and mimeType
+     */
+    processImage(data: string, mimeType: string): Promise<{
+        success: boolean;
+        data?: string;
+        mimeType?: string;
+        width?: number;
+        height?: number;
+        error?: string;
+    }>;
+    /**
+     * Link to an external file (RPC method)
+     */
+    linkFile(path: string, location: string, options?: {
+        mimeType?: string;
+        size?: number;
+        metadata?: Record<string, unknown>;
+    }): Promise<{
+        success: boolean;
+        file: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        file?: undefined;
+    }>;
+    /**
+     * Read a file from storage (RPC method)
+     * Returns base64-encoded data
+     */
+    readFile(path: string): Promise<{
+        success: boolean;
+        data: string;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        data?: undefined;
+    }>;
+    /**
+     * Read a text file from storage (RPC method)
+     */
+    readTextFile(path: string): Promise<{
+        success: boolean;
+        content: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        content?: undefined;
+    }>;
+    /**
+     * Get file metadata (RPC method)
+     */
+    statFile(path: string): Promise<{
+        success: boolean;
+        file: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        file?: undefined;
+    }>;
+    /**
+     * Check if file exists (RPC method)
+     */
+    fileExists(path: string): Promise<{
+        success: boolean;
+        exists: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        exists?: undefined;
+    }>;
+    /**
+     * Delete a file (RPC method)
+     */
+    unlinkFile(path: string): Promise<{
+        success: boolean;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+    }>;
+    /**
+     * Create a directory (RPC method)
+     */
+    mkdirFile(path: string): Promise<{
+        success: boolean;
+        directory: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        directory?: undefined;
+    }>;
+    /**
+     * List directory contents (RPC method)
+     */
+    readdirFile(path: string): Promise<{
+        success: boolean;
+        files: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        files?: undefined;
+    }>;
+    /**
+     * Remove empty directory (RPC method)
+     */
+    rmdirFile(path: string): Promise<{
+        success: boolean;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+    }>;
+    /**
+     * Move or rename a file or directory (RPC method).
+     * Relocates inline files, chunked files, and whole directory subtrees.
+     */
+    moveFile(sourcePath: string, destinationPath: string): Promise<{
+        success: boolean;
+        file: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        file?: undefined;
+    }>;
+    /**
+     * Rename a file or directory in place (RPC method).
+     */
+    renameFile(path: string, newName: string): Promise<{
+        success: boolean;
+        file: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        file?: undefined;
+    }>;
+    /**
+     * Get file storage statistics (RPC method)
+     */
+    getFileStats(): Promise<{
+        success: boolean;
+        stats: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        stats?: undefined;
+    }>;
+    /**
+     * Get thumbnail for an image (RPC method)
+     * Returns base64-encoded data
+     */
+    getFileThumbnail(path: string): Promise<{
+        success: boolean;
+        data: string;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        data?: undefined;
+    }>;
+    /**
+     * Search file contents using FTS5 (RPC method)
+     */
+    grepFiles(pattern: string, options?: {
+        path?: string;
+        limit?: number;
+    }): Promise<{
+        success: boolean;
+        results: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        results?: undefined;
+    }>;
+    /**
+     * Find files by path pattern (RPC method)
+     */
+    findFiles(pattern: string, options?: {
+        type?: "file" | "directory" | "all";
+        limit?: number;
+    }): Promise<{
+        success: boolean;
+        files: any;
+        error?: undefined;
+    } | {
+        success: boolean;
+        error: any;
+        files?: undefined;
+    }>;
+    /**
+     * Start a chunked file upload.
+     * Creates file record with is_chunked=1 and chunk_count=null.
+     * Caller should then use writeFileChunk() to write chunks.
+     */
+    startChunkedUpload(path: string, totalSize: number, mimeType: string, options?: {
+        metadata?: Record<string, unknown>;
+        width?: number;
+        height?: number;
+    }): Promise<{
+        success: boolean;
+        chunkSize?: number;
+        expectedChunks?: number;
+        error?: string;
+    }>;
+    /**
+     * Write a single chunk of a chunked file upload.
+     * @param path - File path
+     * @param chunkIndex - 0-based chunk index
+     * @param data - Base64 encoded chunk data
+     */
+    writeFileChunk(path: string, chunkIndex: number, data: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    /**
+     * Complete a chunked file upload.
+     * Validates all chunks are present and sets chunk_count.
+     */
+    completeChunkedUpload(path: string, expectedChunks: number, options?: {
+        thumbnail?: string;
+    }): Promise<{
+        success: boolean;
+        file?: FileRecord;
+        error?: string;
+    }>;
+    /**
+     * Read a single chunk of a file.
+     * Use for streaming large files to client.
+     */
+    readFileChunk(path: string, chunkIndex: number): Promise<{
+        success: boolean;
+        data?: string;
+        error?: string;
+    }>;
+    /**
+     * Get file info including chunking metadata.
+     */
+    getFileInfo(path: string): Promise<{
+        success: boolean;
+        file?: FileRecord;
+        error?: string;
+    }>;
+}
+
+interface DurableUserHubEnv {
+    /** Secret JSON registry of runtime-managed grants shared by all users. */
+    AGENT_BUILDER_CREDENTIAL_GRANTS?: string;
+    [key: string]: unknown;
+}
+interface HubClientInfo {
+    clientId: string | null;
+    clientName: string | null;
+    clientKind: string | null;
+}
+declare class DurableUserHub extends DurableObject<DurableUserHubEnv> {
+    /** Persistent client (daemon) sockets, restored across hibernation. */
+    private clientSockets;
+    private clientInfo;
+    private migrated;
+    constructor(ctx: DurableObjectState, env: DurableUserHubEnv);
+    private ensureMigrated;
+    /**
+     * Returns the user endpoints registry for lazy-loading `users/` files.
+     * Keys are endpoint file paths relative to `users/` with the extension
+     * stripped except the method suffix (e.g. `standardcode/lease_acquire.post`).
+     * Implemented when DurableUserHub is imported from
+     * 'virtual:@standardagents/builder'.
+     */
+    userEndpoints(): Record<string, () => Promise<unknown>>;
+    /**
+     * Returns the hooks registry (same registry the thread runtime uses). The
+     * hub filters it to user-scope hook types at dispatch time. Implemented
+     * when DurableUserHub is imported from 'virtual:@standardagents/builder'.
+     */
+    userHooks(): Record<string, () => Promise<unknown>>;
+    /**
+     * Accept the user's persistent client (daemon) WebSocket. The daemon holds
+     * this ONE socket for its whole lifetime; per-thread bridge sockets are
+     * opened separately and only while a thread is active.
+     */
+    fetch(request: Request): Promise<Response>;
+    /** Idle sockets answer heartbeats at the edge without waking the object.
+     *  Registered at accept time rather than in the constructor so a hub that
+     *  never accepts a socket stays fully evictable (this also keeps
+     *  vitest-pool-workers' isolated storage able to pop the DO's frame). */
+    private ensureHeartbeatAutoResponse;
+    /** Sockets attached to the user event stream, restored after hibernation. */
+    private streamSockets;
+    private acceptUserStream;
+    /**
+     * Deliver an event frame to every socket attached to this user's stream.
+     * At-most-once, live-only (spec: Users §4) — no history, no acks.
+     */
+    broadcastUserEvent(userId: string, event: string, data?: unknown): void;
+    /** Per-user execution chain (spec: Users §2.1) — see users/serialize.ts. */
+    private executionChain;
+    private scopeHost;
+    private runUserEndpoint;
+    /**
+     * Fire every definition of a user hook type. Observational and best-effort:
+     * failures are swallowed and dispatch never blocks the triggering
+     * operation. Nested dispatch is suppressed so a `user_value_changed` hook
+     * writing values cannot recurse.
+     */
+    private inUserHookDispatch;
+    private dispatchUserHooks;
+    webSocketClose(ws: WebSocket): Promise<void>;
+    /**
+     * Store or replace a grant. `secret` is write-only from this point on.
+     * Policy (`CredentialGrant` minus the secret) is kept as JSON config.
+     */
+    setGrant(userId: string, grant: CredentialGrant, secret: string): Promise<void>;
+    deleteGrant(userId: string, name: string): Promise<void>;
+    /** Metadata-only listing — never returns secret material. */
+    listGrants(userId: string): Promise<Array<Omit<CredentialGrant, "name"> & {
+        name: string;
+    }>>;
+    /** Perform a privileged fetch with the grant's credential injected. */
+    private grantFetch;
+    private handleGrantFetch;
+    webSocketMessage(ws: WebSocket, _message: string | ArrayBuffer): Promise<void>;
+    webSocketError(ws: WebSocket): Promise<void>;
+    /** Whether a persistent client (daemon) is connected right now. */
+    hasClient(): Promise<boolean>;
+    /**
+     * Signal the connected daemon to attach a bridge to `threadId`. Called by a
+     * cold thread DO that parked a forwarded call with no client attached. The
+     * daemon reacts by opening a per-thread bridge socket, which triggers the
+     * thread's drain-on-attach. Returns whether a daemon was reachable.
+     */
+    requestWake(threadId: string): Promise<{
+        delivered: boolean;
+    }>;
+    getUserValue(userId: string, key: string): Promise<unknown | null>;
+    setUserValue(userId: string, key: string, value: unknown): Promise<void>;
+    listUserValues(userId: string, options?: {
+        prefix?: string | null;
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        entries: Array<{
+            key: string;
+            value: unknown;
+            updated_at: number;
+        }>;
+        total: number;
+        limit: number;
+        offset: number;
+    }>;
+}
+
+type EnvValueType = 'text' | 'secret';
+/**
+ * Environment type for DurableAgentBuilder.
+ * Users extend this with their own bindings.
+ */
+interface AgentBuilderEnv {
+    AGENT_BUILDER: DurableObjectNamespace<DurableAgentBuilder>;
+    AGENT_BUILDER_THREAD: DurableObjectNamespace;
+    AGENT_BUILDER_USER_HUB?: DurableObjectNamespace<DurableUserHub>;
+    ENCRYPTION_KEY?: string;
+}
+/**
+ * Thread metadata stored in the registry.
+ */
+interface ThreadRegistryEntry {
+    id: string;
+    agent_name: string;
+    /**
+     * Agent the thread was CREATED on. Never changed by handoffs
+     * (updateThreadAgent only re-points agent_name), so lists can keep a
+     * handed-off conversation visible on its original agent's page.
+     */
+    origin_agent_name?: string | null;
+    user_id: string | null;
+    tags: string[] | null;
+    env: Record<string, string> | null;
+    env_types: Record<string, EnvValueType> | null;
+    /** @deprecated Use env */
+    tenvs: Record<string, unknown> | null;
+    properties: Record<string, unknown> | null;
+    parent: string | null;
+    terminated: number | null;
+    created_at: number;
+    /** Unix seconds of the last message or execution on this thread (or a descendant). */
+    last_activity_at?: number | null;
+    /** True while the thread is executing a flow (stale markers read as false). */
+    executing?: boolean;
+    /** Short excerpt of the most recent user message, for thread-list rows. */
+    last_message_preview?: string | null;
+    /**
+     * Unix seconds of the newest VISIBLE MESSAGE on this thread — the one field
+     * clients key unread indicators on. It moves when a non-empty user (or
+     * operator assistant-role) message arrives, and when a visible terminal
+     * assistant record lands (`isVisibleTerminalAssistantMessage`): terminal
+     * answers, attachment-only replies, and failed rows with visible text — but
+     * never mid-turn tool-calling steps, silent rows, sub-prompt records, or
+     * background execution activity (which move only `last_activity_at`).
+     * Monotonic per thread and never propagated to ancestors.
+     */
+    last_message_at?: number | null;
+}
+/**
+ * Safe registry projection carried by system events. Thread env and arbitrary
+ * properties are intentionally excluded: the stream is an invalidation/list
+ * surface, not a second transport for thread configuration or secrets.
+ */
+type ThreadEventPayload = Pick<ThreadRegistryEntry, 'id' | 'agent_name' | 'origin_agent_name' | 'user_id' | 'tags' | 'parent' | 'terminated' | 'created_at' | 'last_activity_at' | 'executing' | 'last_message_preview' | 'last_message_at'>;
+interface PendingSubagentAttachmentRef {
+    path: string;
+    name?: string;
+    mimeType?: string;
+    size?: number;
+    width?: number;
+    height?: number;
+}
+interface PendingSubagentEnvRequestPayload {
+    blocking: boolean;
+    /** Relationship name (`as` ?? agent) the spawn was requested under. */
+    relationship?: string;
+    /** Which parent side OWNS the relationship ('a' when unrecorded). */
+    owner?: 'a' | 'b';
+    parent_communication: 'implicit' | 'explicit';
+    initial_message_content: string;
+    initial_message_attachments: PendingSubagentAttachmentRef[];
+    initial_arguments?: Record<string, unknown>;
+    initial_agent_name?: string | null;
+    agent_title?: string | null;
+    agent_description?: string | null;
+    spawn_group_id?: string | null;
+    /** Invocation arguments persisted for the life of the child thread. */
+    arguments?: Record<string, unknown>;
+}
+interface PendingSubagentEnvRequest {
+    request_id: string;
+    parent_thread_id: string;
+    agent_name: string;
+    registry_agent_name: string;
+    required: string[];
+    missing: string[];
+    payload: PendingSubagentEnvRequestPayload;
+    created_at: number;
+}
+/**
+ * Parameters for updating a thread.
+ */
+interface UpdateThreadParams {
+    agent_name?: string;
+    user_id?: string | null;
+    tags?: string[] | null;
+    env?: Record<string, string> | null;
+    env_types?: Record<string, EnvValueType> | null;
+    /** @deprecated Use env */
+    tenvs?: Record<string, unknown> | null;
+    properties?: Record<string, unknown> | null;
+    parent?: string | null;
+    terminated?: number | null;
+}
+/**
+ * User record.
+ */
+type InstanceRole = 'admin' | 'user' | 'api';
+interface User {
+    id: string;
+    username: string;
+    password_hash: string;
+    role: InstanceRole;
+    /** Explicit permission grants (e.g. 'logs'); null = legacy default. */
+    permissions?: string[] | null;
+    platform_user_id?: string | null;
+    email?: string | null;
+    display_name?: string | null;
+    avatar_url?: string | null;
+    source?: 'local' | 'standard_agents';
+    replica_active?: number;
+    created_at: number;
+    updated_at: number;
+}
+interface PlatformReplicaUser {
+    platform_user_id: string;
+    username?: string | null;
+    email?: string | null;
+    display_name?: string | null;
+    avatar_url?: string | null;
+    role: InstanceRole;
+    permissions?: string[] | null;
+    session_revoked_at?: number | null;
+}
+interface PlatformReplicaApiKey {
+    id: string;
+    name?: string | null;
+    key_hash: string;
+    key_prefix: string;
+    last_five?: string | null;
+    user_platform_id?: string | null;
+    scope?: string | null;
+    created_at?: number | null;
+}
+interface PlatformReplicaSnapshot {
+    users: PlatformReplicaUser[];
+    api_keys?: PlatformReplicaApiKey[];
+}
+interface ScopedEnvEntry {
+    name: string;
+    value: string;
+    type: EnvValueType;
+    created_at: number;
+    updated_at: number;
+}
+/**
+ * Provider credentials.
+ */
+interface Provider$1 {
+    name: string;
+    sdk: string;
+    api_key: string;
+}
+/**
+ * Lightweight agent metadata included with real-time thread events.
+ */
+interface ThreadEventAgent {
+    name: string;
+    title: string;
+    side_a_backing: 'human' | 'prompt' | 'handler';
+    side_b_backing: 'human' | 'prompt' | 'handler';
+    description?: string;
+    icon?: string;
+}
+/**
+ * DurableAgentBuilder - The root Durable Object for AgentBuilder.
+ *
+ * This is a singleton DO that stores:
+ * - Thread registry (maps thread IDs to agent names)
+ * - User authentication data
+ * - Provider credentials (API keys for LLM providers)
+ * - Edit lock state for coordinated edits
+ *
+ * ## Usage
+ *
+ * Users must extend this class to provide virtual module access:
+ *
+ * ```typescript
+ * import { DurableAgentBuilder } from '@standardagents/builder/runtime';
+ * import { models } from 'virtual:@standardagents-models';
+ * import { prompts } from 'virtual:@standardagents-prompts';
+ * import { agents } from 'virtual:@standardagents-agents';
+ *
+ * export class AgentBuilder extends DurableAgentBuilder {
+ *   models() { return models; }
+ *   prompts() { return prompts; }
+ *   agents() { return agents; }
+ * }
+ * ```
+ */
+/**
+ * Event types that can be emitted via WebSocket
+ */
+type AgentBuilderEvent = {
+    type: 'thread_created';
+    thread: ThreadEventPayload & {
+        agent?: ThreadEventAgent;
+    };
+} | {
+    type: 'thread_updated';
+    thread: ThreadEventPayload & {
+        agent?: ThreadEventAgent;
+    };
+} | {
+    type: 'thread_deleted';
+    threadId: string;
+}
+/**
+ * Lightweight activity signal. Kept separate from `thread_updated` because it
+ * fires on every execution start/stop: re-broadcasting the whole registry
+ * entry would decrypt thread env on each transition for data that never
+ * changed.
+ */
+ | {
+    type: 'thread_activity';
+    threadId: string;
+    /** Present only when this event actually wrote the field: a message-only
+     *  recency stamp omits last_activity_at, and `executing` rides only on a
+     *  real transition — clients must leave their current value alone for
+     *  absent fields. */
+    last_activity_at?: number;
+    executing?: boolean;
+    last_message_preview?: string | null;
+    last_message_at?: number | null;
+};
+/** Sort orders supported by `listThreads`. */
+type ThreadListSort = 'activity' | 'created' | 'oldest';
+declare class DurableAgentBuilder<Env extends AgentBuilderEnv = AgentBuilderEnv> extends DurableObject<Env> {
+    private migratedToVersion;
+    private eventSockets;
+    constructor(ctx: DurableObjectState, env: Env);
+    private normalizeEnvRecord;
+    private normalizePlainObject;
+    private hasInitialArguments;
+    private buildSubagentThreadProperties;
+    private buildSubagentInitialArgumentsMessage;
+    private normalizeEnvTypeRecord;
+    private extractEnvTypeRecord;
+    private withEnvTypeRecord;
+    private serializeEnvTypes;
+    private resolveRegistryKey;
+    private extractScopedVariables;
+    private filterScopedInheritedEnv;
+    private filterScopedInheritedEnvTypes;
+    private collectScopedVariablesForAgent;
+    private getScopedVariableNamesForAgent;
+    private getRequiredScopedVariableNamesForAgent;
+    private normalizeScopedVariableList;
+    private normalizePendingAttachments;
+    private sanitizeFilename;
+    private inferMimeTypeFromPath;
+    private extensionForMimeType;
+    private buildAttachmentTargetPath;
+    private formatSubagentAttachmentPathSummary;
+    private formatSubagentTerminalMessage;
+    private copyPendingAttachmentsBetweenThreads;
+    private buildThreadNameTag;
+    private encryptEnvRecord;
+    private decryptEnvRecord;
+    private listActiveDescendantThreadIds;
+    private propagateThreadEnvToDescendants;
+    /**
+     * Returns the tools registry for lazy-loading tool definitions.
+     * Must be overridden in a subclass.
+     */
+    tools(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the hooks registry for lazy-loading hook definitions.
+     * Must be overridden in a subclass.
+     */
+    hooks(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the models registry for lazy-loading model definitions.
+     * Must be overridden in a subclass.
+     */
+    models(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the prompts registry for lazy-loading prompt definitions.
+     * Must be overridden in a subclass.
+     */
+    prompts(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the agents registry for lazy-loading agent definitions.
+     * Must be overridden in a subclass.
+     */
+    agents(): Record<string, () => Promise<any>>;
+    /**
+     * Returns the namespaced registry for packed agent support.
+     * Must be overridden in a subclass.
+     */
+    registry(): any;
+    private ensureMigrated;
+    private getCurrentVersion;
+    private runMigrations;
+    /**
+     * Create a new thread and add it to the registry.
+     */
+    createThread(params: {
+        agent_name: string;
+        user_id?: string;
+        tags?: string[];
+        env?: Record<string, string>;
+        env_types?: Record<string, EnvValueType>;
+        /** @deprecated Use env */
+        tenvs?: Record<string, unknown>;
+        properties?: Record<string, unknown>;
+        parent?: string;
+    }): Promise<ThreadRegistryEntry>;
+    /**
+     * Spawn `immediate` subagent relationships at THREAD CREATION, before any
+     * side takes a turn — required even when the owning side is a handler, or
+     * when the first inbound message arrives instantly. Spawns run through the
+     * normal `subagent_create` machinery (registry, scoped env, hidden,
+     * maxInstances) via the standalone invokeTool path. A relationship whose
+     * child demands invocation arguments this path cannot synthesize fails
+     * softly here; the FlowEngine immediate runner bootstraps it with an
+     * internal model call before the owning side's first turn.
+     */
+    private spawnImmediateSubagents;
+    private runAfterThreadCreatedHook;
+    /**
+     * Get a thread by ID.
+     */
+    getThread(id: string): Promise<ThreadRegistryEntry | null>;
+    /**
+     * All descendant threads of a root thread (children, grandchildren, …),
+     * excluding the root itself. Used for subtree cost reporting: a thread's
+     * displayed cost is its own plus every subagent thread it spawned,
+     * recursively. Ordered parents-before-children (breadth by creation time).
+     */
+    getDescendantThreads(rootId: string): Promise<Array<{
+        id: string;
+        agent_name: string;
+        parent: string | null;
+        tags: string[] | null;
+        terminated: number | null;
+        created_at: number;
+    }>>;
+    /**
+     * List threads with optional filtering.
+     * Note: tenvs are not decrypted in list operations for performance.
+     * Use getThread() to retrieve a thread with decrypted tenvs.
+     */
+    listThreads(params?: {
+        agent_name?: string;
+        user_id?: string;
+        search?: string;
+        startDate?: number;
+        endDate?: number;
+        limit?: number;
+        offset?: number;
+        include_children?: boolean;
+        /** Default `activity`: most recently worked-on threads first. */
+        sort?: ThreadListSort;
+        /** `true` → only threads currently executing; `false` → only idle ones. */
+        executing?: boolean;
+        /** `false` hides terminated threads; `true` shows only terminated ones. */
+        terminated?: boolean;
+    }): Promise<{
+        threads: ThreadRegistryEntry[];
+        total: number;
+    }>;
+    /**
+     * Distinct owners of threads visible to the caller, with counts, so a thread
+     * list can offer an "owner" filter without exposing the admin-only user
+     * directory (which is unavailable on hosted instances).
+     */
+    listThreadOwners(params?: {
+        user_id?: string;
+    }): Promise<Array<{
+        user_id: string | null;
+        username: string | null;
+        display_name: string | null;
+        email: string | null;
+        thread_count: number;
+    }>>;
+    /**
+     * Record that a thread did work: stamp `last_activity_at` and flip the
+     * executing marker. Activity bubbles up the parent chain so a root thread
+     * sorts by the freshest work anywhere in its subagent tree — otherwise a
+     * long-running subagent would let its parent sink down an activity-sorted
+     * list.
+     */
+    recordThreadActivity(threadId: string, options?: {
+        executing?: boolean;
+        messagePreview?: string | null;
+        messageAt?: number;
+    }): Promise<void>;
+    /**
+     * Fill in previews for threads that predate preview tracking. Callers read
+     * each thread's newest user message and stamp the results here in one batch.
+     *
+     * A thread with no user message is stamped with an empty string rather than
+     * left NULL: NULL means "not looked at yet", so without the sentinel an
+     * empty thread would be re-read on every list request forever.
+     */
+    backfillThreadPreviews(entries: Array<{
+        id: string;
+        preview: string | null;
+    }>): Promise<void>;
+    /**
+     * Delete a thread from the registry.
+     */
+    deleteThread(id: string): Promise<boolean>;
+    /**
+     * Delete all singleton AgentBuilder storage for platform-owned teardown.
+     * Used when the hosting platform expires a preview branch deployment after
+     * all thread Durable Objects have already been wiped.
+     */
+    deleteAllStorage(): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Get a thread tree (root + all descendants) in child-first order.
+     *
+     * Child-first ordering allows callers to perform destructive operations
+     * (like deletes) without leaving child rows referencing a deleted parent.
+     */
+    getThreadTreeIds(rootThreadId: string): Promise<string[]>;
+    /**
+     * Update a thread's agent_name (used during agent handoff).
+     * origin_agent_name is deliberately untouched — it pins the thread to the
+     * agent page it started on. Broadcasts thread_updated so connected clients
+     * re-render the row immediately instead of on the next activity tick
+     * (which is when handed-off threads used to silently vanish mid-watch).
+     */
+    updateThreadAgent(id: string, agent_name: string): Promise<boolean>;
+    /**
+     * Update a thread's metadata.
+     */
+    updateThread(id: string, params: UpdateThreadParams): Promise<ThreadRegistryEntry | null>;
+    private getEncryptionKey;
+    private encryptEnvValue;
+    private decryptEnvValue;
+    private listScopedEnv;
+    private listScopedEnvEntries;
+    private getScopedEnvTypeRecord;
+    private replaceScopedEnv;
+    private patchScopedEnv;
+    getInstanceEnv(): Promise<Record<string, string>>;
+    getInstanceEnvTypes(): Promise<Record<string, EnvValueType>>;
+    getInstanceEnvEntries(): Promise<ScopedEnvEntry[]>;
+    setInstanceEnv(env: Record<string, string>, envTypes?: Record<string, EnvValueType> | null): Promise<void>;
+    patchInstanceEnv(params: {
+        env_patch?: Record<string, unknown> | null;
+        env_type_patch?: Record<string, unknown> | null;
+        env_delete?: string[] | null;
+    }): Promise<void>;
+    getUserEnv(userId: string): Promise<Record<string, string>>;
+    getUserEnvTypes(userId: string): Promise<Record<string, EnvValueType>>;
+    getUserEnvEntries(userId: string): Promise<ScopedEnvEntry[]>;
+    setUserEnv(userId: string, env: Record<string, string>, envTypes?: Record<string, EnvValueType> | null): Promise<void>;
+    patchUserEnv(userId: string, params: {
+        env_patch?: Record<string, unknown> | null;
+        env_type_patch?: Record<string, unknown> | null;
+        env_delete?: string[] | null;
+    }): Promise<void>;
+    private assertValidUserValueKey;
+    private assertValidUserValueUserId;
+    /**
+     * The per-user hub is the sharded home for account-wide KV. When the binding
+     * exists, the singleton delegates so the global object is no longer a
+     * per-user bottleneck; without it (pre-hub deploys, unit tests) it keeps the
+     * local `user_values` table.
+     */
+    private userHub;
+    /** Read one JSON value from a user's account-wide key-value store. */
+    getUserValue(userId: string, key: string): Promise<unknown | null>;
+    /** Write one JSON value to a user's account-wide store; null/undefined deletes. */
+    setUserValue(userId: string, key: string, value: unknown): Promise<void>;
+    /** List a user's account-wide values, optionally filtered by key prefix. */
+    listUserValues(userId: string, options?: {
+        prefix?: string | null;
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        entries: Array<{
+            key: string;
+            value: unknown;
+            updated_at: number;
+        }>;
+        total: number;
+        limit: number;
+        offset: number;
+    }>;
+    getMissingRequiredScopedSubagentEnv(params: {
+        parent_thread_id: string;
+        agent_name: string;
+        provided_env?: Record<string, string> | null;
+    }): Promise<string[]>;
+    createPendingSubagentEnvRequest(params: {
+        parent_thread_id: string;
+        agent_name: string;
+        registry_agent_name: string;
+        required_variables: string[];
+        missing_variables: string[];
+        payload: PendingSubagentEnvRequestPayload;
+    }): Promise<PendingSubagentEnvRequest>;
+    getPendingSubagentEnvRequest(parentThreadId: string, requestId: string): Promise<PendingSubagentEnvRequest | null>;
+    private clearPendingSubagentEnvRequest;
+    completePendingSubagentEnvRequest(params: {
+        parent_thread_id: string;
+        request_id: string;
+        env: Record<string, string>;
+    }): Promise<{
+        request_id: string;
+        child_thread_id: string;
+        status: 'success';
+    }>;
+    resolveThreadEnv(params: {
+        threadId: string;
+        property: string;
+        promptName?: string;
+    }): Promise<string | null>;
+    resolveThreadEnvType(params: {
+        threadId: string;
+        property: string;
+        promptName?: string;
+    }): Promise<EnvValueType>;
+    private toThreadEventPayload;
+    /**
+     * Load a model definition by name.
+     */
+    loadModel(name: string): Promise<any>;
+    /**
+     * List available model names.
+     */
+    getModelNames(): string[];
+    /**
+     * Load a prompt definition by name.
+     */
+    loadPrompt(name: string): Promise<any>;
+    /**
+     * List available prompt names.
+     */
+    getPromptNames(): string[];
+    /**
+     * Load an agent definition by name.
+     * Supports both global agents (e.g., "my-agent") and packed agents (e.g., "packageId/agentName").
+     * For scoped packages, use "@scope/pkg/agentName".
+     */
+    loadAgent(name: string): Promise<any>;
+    /**
+     * List available agent names.
+     */
+    getAgentNames(): string[];
+    /**
+     * Get a provider's credentials.
+     */
+    getProvider(name: string): Promise<Provider$1 | null>;
+    /**
+     * Set a provider's credentials.
+     */
+    setProvider(provider: Provider$1): Promise<void>;
+    /**
+     * List all providers.
+     */
+    listProviders(): Promise<Provider$1[]>;
+    /**
+     * Delete a provider.
+     */
+    deleteProvider(name: string): Promise<boolean>;
+    private normalizeReplicaUsername;
+    private availableReplicaUsername;
+    private userFromRow;
+    /**
+     * Get a user by username.
+     */
+    getUserByUsername(username: string): Promise<User | null>;
+    /**
+     * Get a user by ID.
+     */
+    getUserById(id: string): Promise<User | null>;
+    /**
+     * Create a new user.
+     */
+    createUser(params: {
+        username: string;
+        password_hash: string;
+        role?: InstanceRole;
+        permissions?: string[] | null;
+        platform_user_id?: string | null;
+        email?: string | null;
+        display_name?: string | null;
+        avatar_url?: string | null;
+        source?: 'local' | 'standard_agents';
+    }): Promise<User>;
+    /**
+     * Check if any users exist (for first-time setup).
+     */
+    hasUsers(): Promise<boolean>;
+    /**
+     * List all users (excludes password hash).
+     */
+    listUsers(): Promise<Array<{
+        id: string;
+        username: string;
+        role: InstanceRole;
+        platform_user_id: string | null;
+        email: string | null;
+        display_name: string | null;
+        avatar_url: string | null;
+        source: 'local' | 'standard_agents';
+        replica_active: number;
+        created_at: number;
+        updated_at: number;
+    }>>;
+    /**
+     * Update a user.
+     */
+    updateUser(id: string, params: {
+        username?: string;
+        password_hash?: string;
+        role?: InstanceRole;
+        permissions?: string[] | null;
+        platform_user_id?: string | null;
+        email?: string | null;
+        display_name?: string | null;
+        avatar_url?: string | null;
+        source?: 'local' | 'standard_agents';
+        replica_active?: number;
+    }): Promise<User | null>;
+    /**
+     * Delete a user.
+     */
+    deleteUser(id: string): Promise<boolean>;
+    /**
+     * Upsert a platform-replicated identity and return the local user row.
+     */
+    upsertPlatformReplicaUser(replica: PlatformReplicaUser): Promise<User>;
+    /**
+     * Apply a full platform read-replica snapshot for this instance.
+     */
+    applyPlatformReplicaSnapshot(snapshot: PlatformReplicaSnapshot): Promise<{
+        users: number;
+        api_keys: number;
+    }>;
+    getUserByPlatformUserId(platformUserId: string): Promise<User | null>;
+    private getFirstReplicaAdminUser;
+    private upsertPlatformReplicaApiKey;
+    /**
+     * Create a new session.
+     */
+    createSession(params: {
+        user_id: string;
+        token_hash: string;
+        expires_at: number;
+    }): Promise<string>;
+    /**
+     * Validate a session token.
+     */
+    validateSession(tokenHash: string): Promise<{
+        user_id: string;
+        expires_at: number;
+    } | null>;
+    /**
+     * Delete expired sessions.
+     */
+    cleanupSessions(): Promise<number>;
+    /**
+     * Delete a session.
+     */
+    deleteSession(tokenHash: string): Promise<void>;
+    /** Register a short-lived super-admin token so it can be revoked alone. */
+    createSuperAdminSession(params: {
+        token_hash: string;
+        expires_at: number;
+    }): Promise<void>;
+    /** A valid signature is insufficient: the session must still be registered. */
+    validateSuperAdminSession(tokenHash: string): Promise<boolean>;
+    /** Revoke only the presented super-admin session; no key rotation required. */
+    deleteSuperAdminSession(tokenHash: string): Promise<void>;
+    /** Register a path-bound bearer ticket for one WebSocket handshake. */
+    createWebSocketTicket(params: {
+        ticket_hash: string;
+        pathname: string;
+        auth_json: string;
+        expires_at: number;
+    }): Promise<void>;
+    /**
+     * Atomically consume a WebSocket ticket. Deleting before validating its path
+     * means even a mistaken or malicious first presentation burns the bearer.
+     */
+    consumeWebSocketTicket(params: {
+        ticket_hash: string;
+        pathname: string;
+    }): Promise<string | null>;
+    /** Atomically accept an unexpired platform handoff identifier once. */
+    consumePlatformHandoffJti(params: {
+        jti: string;
+        expires_at: number;
+    }): Promise<boolean>;
+    /**
+     * Atomically consume one attempt from a fixed-window authentication bucket.
+     * The singleton Durable Object serializes calls, preventing parallel bypass.
+     */
+    consumeAuthRateLimit(params: {
+        key: string;
+        limit: number;
+        window_seconds: number;
+    }): Promise<{
+        allowed: boolean;
+        retry_after: number;
+        remaining: number;
+    }>;
+    /**
+     * Create an API key.
+     */
+    createApiKey(params: {
+        name: string;
+        key_hash: string;
+        key_prefix: string;
+        last_five: string;
+        user_id: string;
+    }): Promise<string>;
+    /**
+     * Validate an API key.
+     */
+    validateApiKey(keyHash: string): Promise<{
+        user_id: string;
+        id: string;
+    } | null>;
+    /**
+     * List API keys for a user.
+     */
+    listApiKeys(userId: string): Promise<Array<{
+        id: string;
+        name: string;
+        key_prefix: string;
+        last_five: string;
+        source: 'local' | 'standard_agents';
+        created_at: number;
+        last_used_at: number | null;
+    }>>;
+    /**
+     * Delete an API key.
+     */
+    deleteApiKey(id: string, userId: string): Promise<boolean>;
+    /**
+     * Link an OAuth account to a user.
+     */
+    linkOAuthAccount(params: {
+        user_id: string;
+        provider: 'github' | 'google';
+        provider_user_id: string;
+        provider_username?: string;
+    }): Promise<void>;
+    /**
+     * Find user by OAuth account.
+     */
+    findUserByOAuth(provider: 'github' | 'google', providerUserId: string): Promise<User | null>;
+    /**
+     * Acquire edit lock for coordinated edits.
+     */
+    acquireEditLock(params: {
+        locked_by: string;
+        lock_reason: string;
+    }): Promise<boolean>;
+    /**
+     * Release edit lock.
+     */
+    releaseEditLock(lockedBy: string): Promise<boolean>;
+    /**
+     * Get current lock state.
+     */
+    getEditLockState(): Promise<{
+        locked: boolean;
+        locked_by: string | null;
+        locked_at: number | null;
+        lock_reason: string | null;
+        pending_changes: string | null;
+    }>;
+    /**
+     * Store pending changes for commit.
+     */
+    setPendingChanges(changes: string): Promise<void>;
+    /**
+     * Get the Durable Object stub for a thread.
+     */
+    getThreadStub(threadId: string): DurableObjectStub;
+    /**
+     * Handle fetch requests - used for WebSocket upgrades
+     */
+    fetch(request: Request): Promise<Response>;
+    /**
+     * Handle WebSocket upgrade for events channel
+     * Uses Hibernation API to reduce costs during inactivity
+     */
+    private handleEventsWebSocketUpgrade;
+    /**
+     * Re-broadcast a `thread_updated` for a single thread to all event listeners.
+     *
+     * Subagent running/idle status lives in the *parent's* child registry, not on
+     * the thread row, so a status change (e.g. running → idle) normally produces
+     * no thread-registry event. The child-registry writer calls this so live
+     * listeners (the CLI subagent indicator) re-read `/api/threads/:id/subagents`
+     * and reflect the new status without polling.
+     */
+    broadcastThreadUpdated(threadId: string): Promise<void>;
+    /**
+     * Broadcast an event only to its owner or an explicitly all-scoped admin.
+     */
+    private broadcastEvent;
+    /** Resolve a thread owner without decrypting its env or loading the row. */
+    private getThreadOwnerId;
+    /**
+     * WebSocket Hibernation API handler for incoming messages
+     * Called when a message is received on a hibernated WebSocket
+     */
+    webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void>;
+    /**
+     * WebSocket Hibernation API handler for connection close
+     * Called when a WebSocket connection is closed
+     */
+    webSocketClose(ws: WebSocket, code: number, reason: string, wasClean: boolean): Promise<void>;
+    /**
+     * WebSocket Hibernation API handler for errors
+     * Called when a WebSocket encounters an error
+     */
+    webSocketError(ws: WebSocket, error: unknown): Promise<void>;
+    /** Installed skills, metadata only (no file contents). */
+    listSkills(scope: SkillStorageScope, options?: {
+        includeDisabled?: boolean;
+    }): Promise<SkillMetadata[]>;
+    /** One skill's metadata (null when not installed). */
+    getSkill(scope: SkillStorageScope, name: string): Promise<SkillMetadata | null>;
+    /** One bundled file's text (null when the skill or file is missing). */
+    getSkillFile(scope: SkillStorageScope, name: string, path: string): Promise<string | null>;
+    /**
+     * Install (or replace) a skill from its file set. Validates the payload and
+     * the root SKILL.md frontmatter; the skill's identity always comes from
+     * that frontmatter. Throws SkillValidationError with an actionable message
+     * on any standard violation.
+     */
+    upsertSkill(scope: SkillStorageScope, files: SkillFileInput[]): Promise<SkillMetadata>;
+    /** Enable/disable an installed skill. Returns false when not installed. */
+    setSkillEnabled(scope: SkillStorageScope, name: string, enabled: boolean): Promise<boolean>;
+    private sweepDeviceLogins;
+    startDeviceLogin(codeHash: string): Promise<void>;
+    /** Poll a device login. An approved row returns its token exactly once. */
+    pollDeviceLogin(codeHash: string): Promise<{
+        status: string;
+        token?: string;
+    } | null>;
+    /** Deny a pending device login without creating a user or API key. */
+    denyDeviceLogin(codeHash: string): Promise<boolean>;
+    /** Approve a pending device login: mint a personal API key for the user and
+     *  park its plaintext for the single claim. A retry by the same user remains
+     *  successful after the row is approved or claimed, without minting another
+     *  key. Returns false for unknown, expired, denied, or differently-owned
+     *  logins. */
+    approveDeviceLogin(params: {
+        code_hash: string;
+        user_id: string;
+        token: string;
+        token_hash: string;
+        key_prefix: string;
+        last_five: string;
+        key_name: string;
+    }): Promise<boolean>;
+    /** Uninstall a skill and its files. Returns false when not installed. */
+    deleteSkill(scope: SkillStorageScope, name: string): Promise<boolean>;
+}
+
+interface CodeExecutionBridgeProps {
+    threadId?: string;
+    runId?: string;
+}
+declare class CodeExecutionBridge extends WorkerEntrypoint<ThreadEnv, CodeExecutionBridgeProps> {
+    call(threadId: string, runId: string, functionId: string, encodedArgs: unknown[]): Promise<unknown>;
+}
+
+/**
+ * ThreadWatchdog — a per-thread companion Durable Object whose only job is to
+ * deliver liveness checks INTO a DurableThread on a schedule the thread cannot
+ * starve.
+ *
+ * Why this exists (2026-07-08 incident, api.standardcode.ai): every normal
+ * turn is dispatched through the thread's own AlarmQueue and runs INSIDE its
+ * alarm() handler. Cloudflare serializes alarm invocations per object and the
+ * queue only re-arms the storage alarm after the current item finishes — so
+ * while a turn runs, the thread's own standing `watchdogCheck` alarm rows are
+ * inert. When a provider request wedged (zero bytes for 18+ minutes, in-flight
+ * stall-guard timers frozen with the turn's context), nothing could fire: the
+ * thread sat "working" forever, and the user's UI polling kept the instance
+ * resident, which is exactly what prevented fresh-instance wake recovery.
+ * A manual RPC delivery of the same check recovered the thread in one call —
+ * the LOGIC was sound, the DELIVERY was starved. This object is that delivery.
+ *
+ * Design rules:
+ * - The alarm handler stays tiny: one probe RPC + reschedule. It must never
+ *   run long work, so it can never starve itself the way thread turns do.
+ * - Reschedule-first: the next alarm is set before the probe runs, so a crash
+ *   mid-probe never kills the chain.
+ * - Parent-child lifecycle is explicit (Cloudflare has no cascade): the
+ *   companion is created lazily by the thread's execution start (`arm`),
+ *   stands itself down when the thread probes clean, and is destroyed by
+ *   `DurableThread.deleteThread()`/`terminateThread()`. Standing down keeps
+ *   the check-in history (the UI reads it) but drops the alarm — a DO with no
+ *   alarm and no traffic hibernates at zero cost.
+ * - Probe timeouts are counted, not fatal: a thread DO whose input gate is
+ *   permanently blocked cannot be revived at the application layer, so after
+ *   MAX_UNREACHABLE consecutive timeouts the companion logs loudly and stands
+ *   down instead of ticking forever.
+ */
+/** One recorded check-in, newest first in storage. */
+interface WatchdogCheckin {
+    at: number;
+    /** Thread verdict, or 'unreachable' when the probe itself failed/timed out. */
+    verdict: "healthy" | "observing" | "recovered" | "parked" | "idle" | "unreachable";
+    /** What the probe did, for the UI's determination column. */
+    action: string;
+    executing: boolean | null;
+    incompleteLogs: number | null;
+    silenceMs: number | null;
+    probeMs: number;
+    error?: string;
+}
+interface ThreadWatchdogState {
+    armed: boolean;
+    threadId: string | null;
+    armedAt: number | null;
+    history: WatchdogCheckin[];
+}
+interface ThreadWatchdogEnv {
+    AGENT_BUILDER_THREAD: {
+        idFromName(name: string): unknown;
+        get(id: unknown): unknown;
+    };
+    [key: string]: unknown;
+}
+declare class ThreadWatchdog extends DurableObject<ThreadWatchdogEnv> {
+    /**
+     * Arm (or re-arm) the standing check for a thread execution. Idempotent —
+     * called at every execution start. Resets the unreachable counter because a
+     * fresh arm proves the thread is answering RPCs right now.
+     */
+    arm(threadId: string): Promise<void>;
+    /**
+     * Hint that the thread believes its execution ended cleanly. The companion
+     * does NOT trust this (a bogus "clean end" was one of the incident's failure
+     * modes) — it just moves the next check close so a genuinely clean thread
+     * stands down in seconds instead of a full cadence.
+     */
+    disarmHint(): Promise<void>;
+    /** Diagnostics view for the thread inspector UI and the diag CLI. */
+    getState(): Promise<ThreadWatchdogState>;
+    /**
+     * Explicit cascade from the parent thread (delete/terminate). Cloudflare
+     * has no automatic parent-child cleanup — this IS the cleanup.
+     */
+    destroy(): Promise<void>;
+    alarm(): Promise<void>;
+    private getThreadStub;
+    private probeThread;
+    private recordCheckin;
+}
+
+/**
+ * Model definition module for AgentBuilder.
+ *
+ * This module re-exports model types from @standardagents/spec and provides
+ * a builder-specific version of ModelDefinition that supports the generated
+ * AgentBuilder.Models type for fallback references.
+ *
+ * @module
+ */
+
+/**
+ * Model definition configuration with AgentBuilder-specific fallback typing.
+ *
+ * Extends the base ModelDefinition from @standardagents/spec to support
+ * the generated AgentBuilder.Models type for type-safe fallback references.
+ *
+ * @template N - The model name as a string literal type for type inference
+ */
+interface ModelDefinition<N extends string = string> extends Omit<ModelDefinition$1<N>, 'fallbacks'> {
+    /**
+     * Fallback models to try if this model fails.
+     * Referenced by model name (must be defined in agents/models/).
+     * Tried in order after primary model exhausts retries.
+     *
+     * @example ['gpt-4', 'gpt-3.5-turbo']
+     */
+    fallbacks?: AgentBuilder.Models[];
+}
+
+/**
+ * Prompt definition module for AgentBuilder.
+ *
+ * This module re-exports prompt types from @standardagents/spec and provides
+ * builder-specific versions that use the generated AgentBuilder namespace types.
+ *
+ * @module
+ */
+
+/**
+ * A prompt inclusion part with type-safe autocomplete.
+ * Uses AgentBuilder.Prompts for type-safe prompt name references.
+ */
+interface PromptIncludePart {
+    type: 'include';
+    /** The name of the prompt to include (type-safe with autocomplete) */
+    prompt: AgentBuilder.Prompts;
+}
+/**
+ * A single part of a structured prompt.
+ */
+type PromptPart = PromptTextPart | PromptIncludePart | PromptEnvPart;
+/**
+ * Prompt content can be a string or structured array with type-safe includes.
+ */
+type PromptContent = string | PromptPart[];
+/**
+ * Sub-prompt configuration with type-safe name references.
+ */
+interface SubpromptConfig<T extends string = AgentBuilder.Callables> extends Omit<SubpromptConfig$1<T>, 'name'> {
+    /** Name of the sub-prompt (type-safe with autocomplete) */
+    name: T;
+}
+/**
+ * Prompt tool configuration with static tenvs/options.
+ */
+interface PromptToolConfig<T extends string = AgentBuilder.Callables> extends Omit<PromptToolConfig$1, 'name'> {
+    /** Name of the callable tool/agent (type-safe with autocomplete). */
+    name: T;
+    /** Environment values scoped to this tool invocation. */
+    env?: Record<string, string>;
+    /** @deprecated Use env */
+    tenvs?: Record<string, unknown>;
+}
+/**
+ * @deprecated Removed in 0.2.0 — subagent relationships are no longer
+ * declared in a prompt's `tools` array. Declare them on the owning side's
+ * `subagents` array instead (see `SubagentRelationship`). The owning side's
+ * prompt automatically receives the lifecycle tools (`subagents`,
+ * `subagent_create`, `subagent_message`).
+ */
+type SubagentToolConfig<T extends string = string> = never;
+/**
+ * @deprecated Use SubpromptConfig instead
+ */
+type ToolConfig<T extends string = AgentBuilder.Callables> = SubpromptConfig<T>;
+
+/**
+ * Prompt definition configuration with AgentBuilder-specific typing.
+ *
+ * Provides type-safe references to models, tools, and agents via the
+ * generated AgentBuilder namespace.
+ *
+ * @template N - The prompt name as a string literal type
+ * @template S - The Zod schema type for requiredSchema (inferred automatically)
+ */
+interface PromptDefinition<N extends string = string, S extends ToolArgs = ToolArgs> {
+    /** Unique name for this prompt. */
+    name: N;
+    /** Description shown when this prompt is exposed as a tool. */
+    toolDescription: string;
+    /** The system prompt content with type-safe includes. */
+    prompt: PromptContent;
+    /** Model to use (type-safe with autocomplete). */
+    model: AgentBuilder.Models;
+    /**
+     * @deprecated All prompts are now automatically exposed as tools.
+     */
+    exposeAsTool?: boolean;
+    /** Include full chat history in the LLM context. @default false */
+    includeChat?: boolean;
+    /** Include results from past tool calls. @default false */
+    includePastTools?: boolean;
+    /** Allow parallel execution of multiple tool calls. @default false */
+    parallelToolCalls?: boolean;
+    /** Tool calling strategy. @default 'auto' */
+    toolChoice?: 'auto' | 'none' | 'required';
+    /** Zod schema for validating inputs when called as a tool. */
+    requiredSchema?: S;
+    /** Variable declarations for this prompt. */
+    variables?: VariableDefinition[];
+    /**
+     * Tools available to this prompt (type-safe with autocomplete). To enable
+     * handoffs, include exposed agent names. Subagent relationships are NOT
+     * declared here — they live on the owning side's `subagents` array, and
+     * the runtime injects the lifecycle tools automatically. Handlers may
+     * never appear in this array.
+     */
+    tools?: (AgentBuilder.Callables | SubpromptConfig | PromptToolConfig)[];
+    /** Prompt-level environment values. */
+    env?: Record<string, string>;
+    /** @deprecated Use env */
+    tenvs?: Record<string, unknown>;
+    /** Reasoning configuration for extended thinking models. */
+    reasoning?: ReasoningConfig;
+    /** Number of recent messages to keep actual images for. @default 10 */
+    recentImageThreshold?: number;
+    /** Hook IDs to run when this prompt is active. Falls back to agent-level hooks if not set. */
+    hooks?: AgentBuilder.Hooks[];
+}
+
+/**
+ * Agent definition module for AgentBuilder.
+ *
+ * This module re-exports agent types from @standardagents/spec and provides
+ * builder-specific versions that use the generated AgentBuilder namespace types.
+ *
+ * An agent has exactly two sides; each side is backed by exactly one of
+ * `human`, `prompt`, or `handler`. There is no agent "type".
+ *
+ * @module
+ */
+
+/**
+ * Session lifecycle tool configuration with type-safe autocomplete.
+ * Object form only — the bare-string binding was removed in 0.2.0.
+ */
+interface SessionToolConfig {
+    /**
+     * Tool name for this lifecycle binding.
+     */
+    readonly name: AgentBuilder.Callables;
+    /**
+     * Optional tool-argument property used as message text.
+     */
+    readonly messageProperty?: string;
+    /**
+     * Optional tool-argument property containing attachment path(s).
+     */
+    readonly attachmentsProperty?: string;
+}
+/**
+ * Session lifecycle binding.
+ * Object form only — use `{ name: 'tool_name' }` in place of `'tool_name'`.
+ */
+type SessionToolBinding = SessionToolConfig;
+/**
+ * A side-owned subagent relationship with type-safe agent references.
+ * See the spec `SubagentRelationship` for full semantics.
+ */
+interface SubagentRelationship extends Omit<SubagentRelationship$1, 'agent' | 'initUserMessageProperty' | 'initAttachmentsProperty' | 'initAgentNameProperty'> {
+    /**
+     * Which agent definition to instantiate (type-safe with autocomplete).
+     * Must reference an agent with `exposeAsTool: true`.
+     */
+    readonly agent: AgentBuilder.Agents;
+    /**
+     * Property from `subagent_create` arguments used as the initial user
+     * message when spawning an instance.
+     */
+    readonly initUserMessageProperty?: string;
+    /**
+     * Property from `subagent_create` arguments containing attachment path(s)
+     * to include with the initial message.
+     */
+    readonly initAttachmentsProperty?: string;
+    /**
+     * Property from `subagent_create` arguments used as a human-readable name
+     * for each spawned instance.
+     */
+    readonly initAgentNameProperty?: string;
+}
+/**
+ * A side backed by a human: a person takes this side's turns. The runtime
+ * parks execution awaiting inbound input on this side's perspective.
+ */
+type HumanSide = HumanSide$1;
+/**
+ * A side backed by a prompt: a model takes this side's turns
+ * (type-safe with autocomplete).
+ */
+interface PromptSide {
+    /**
+     * The prompt to use for this side.
+     * Must reference a prompt defined in agents/prompts/.
+     */
+    readonly prompt: AgentBuilder.Prompts;
+    /** Custom label for this side of the conversation. */
+    readonly label?: string;
+    /**
+     * Subagent relationships OWNED by this side. The side's prompt
+     * automatically receives the lifecycle tools (`subagents`,
+     * `subagent_create`, `subagent_message`) for the side's non-hidden
+     * relationships; inbound child traffic lands on this side's perspective.
+     */
+    readonly subagents?: readonly SubagentRelationship[];
+    /**
+     * Stop this side's turn when it returns a text response (no tool calls).
+     * @default true
+     */
+    readonly stopOnResponse?: boolean;
+    /**
+     * Stop this side's turn when a specific tool is called (type-safe with
+     * autocomplete). Requires stopToolResponseProperty to extract the result.
+     */
+    readonly stopTool?: AgentBuilder.Callables;
+    /**
+     * Property to extract from the stop tool's result.
+     * Required when stopTool is set.
+     */
+    readonly stopToolResponseProperty?: string;
+    /**
+     * Maximum steps for this side before forcing a stop.
+     * A step is one complete LLM request/response cycle.
+     */
+    readonly maxSteps?: number;
+    /**
+     * Tool that ends the entire session when called. Ending a session never
+     * terminates the thread.
+     */
+    readonly sessionStop?: SessionToolBinding;
+    /**
+     * Tool that fails the entire session when called. Failing a session never
+     * terminates the thread.
+     */
+    readonly sessionFail?: SessionToolBinding;
+    /**
+     * Tool that publishes status updates to the parent thread when this agent
+     * runs as a subagent.
+     */
+    readonly sessionStatus?: SessionToolBinding;
+    /**
+     * Enable manual stop condition handling via hooks.
+     * Builder-specific feature for custom stop logic.
+     * @default false
+     */
+    readonly manualStopCondition?: boolean;
+    readonly human?: never;
+    readonly handler?: never;
+}
+/**
+ * A side backed by a handler: deterministic code takes this side's turns
+ * (type-safe with autocomplete). A handler turn has no steps to cap and no
+ * session bindings — handlers end sessions via `state.stopSession()`.
+ */
+interface HandlerSide {
+    /**
+     * The handler that takes this side's turns.
+     * Must reference a handler defined in agents/handlers/.
+     */
+    readonly handler: AgentBuilder.Handlers;
+    /** Custom label for this side of the conversation. */
+    readonly label?: string;
+    /**
+     * Subagent relationships OWNED by this side. Handlers need no tool grant;
+     * they reach children through `ThreadState`.
+     */
+    readonly subagents?: readonly SubagentRelationship[];
+    readonly human?: never;
+    readonly prompt?: never;
+    readonly stopOnResponse?: never;
+    readonly stopTool?: never;
+    readonly stopToolResponseProperty?: never;
+    readonly maxSteps?: never;
+    readonly sessionStop?: never;
+    readonly sessionFail?: never;
+    readonly sessionStatus?: never;
+    readonly manualStopCondition?: never;
+}
+/**
+ * Configuration for one side of an agent conversation — exactly one backing:
+ * `human`, `prompt`, or `handler`. Both sides human is reserved and rejected.
+ */
+type SideConfig = HumanSide | PromptSide | HandlerSide;
+/**
+ * Agent definition configuration with AgentBuilder-specific typing.
+ *
+ * Provides type-safe references to prompts, handlers, and agents via the
+ * generated AgentBuilder namespace.
+ *
+ * @template N - The agent name as a string literal type
+ *
+ * @example
+ * ```typescript
+ * import { defineAgent } from '@standardagents/builder';
+ *
+ * export default defineAgent({
+ *   name: 'support_agent',
+ *   sideA: {
+ *     label: 'Support',
+ *     prompt: 'customer_support',
+ *     stopOnResponse: true,
+ *   },
+ *   sideB: { human: true },
+ * });
+ * ```
+ */
+interface AgentDefinition<N extends string = string> {
+    /** Unique name for this agent. */
+    readonly name: N;
+    /**
+     * Human-readable title for the agent.
+     * @deprecated Use name instead. Title will be removed in a future version.
+     */
+    readonly title?: string;
+    /**
+     * @deprecated Removed in 0.2.0 — there is no agent "type". Delete this
+     * field and declare both sides explicitly: `type: 'ai_human'` becomes
+     * `sideB: { human: true }`; `type: 'dual_ai'` is two prompt-backed sides.
+     */
+    readonly type?: never;
+    /**
+     * Maximum total exchanges across both sides before the runtime ends the
+     * session. Optional on every side combination; exchange counting is
+     * uniform across backings. Reaching the cap ends the session, never the
+     * thread.
+     */
+    readonly maxSessionTurns?: number;
+    /** Configuration for side A (type-safe with autocomplete). */
+    readonly sideA: SideConfig;
+    /** Configuration for side B (type-safe with autocomplete). */
+    readonly sideB: SideConfig;
+    /**
+     * Expose this agent as a tool for other prompts.
+     * Enables handoffs and subagent composition.
+     * @default false
+     */
+    readonly exposeAsTool?: boolean;
+    /**
+     * Whether this agent is a PRIMARY, user-facing entry point.
+     * Set false on internal handoff targets (e.g. domain-gearbox variants) so
+     * UIs keep them out of top-level agent lists while they stay fully
+     * addressable for handoffs and thread resumption.
+     * @default true
+     */
+    readonly primary?: boolean;
+    /** Description shown when agent is used as a tool. */
+    readonly toolDescription?: string;
+    /**
+     * Thread-scoped hooks this child requires on every direct parent side that
+     * declares a relationship targeting it. Legal on any exposed agent.
+     */
+    readonly parentHooks?: readonly ParentHookRequirement[];
+    /**
+     * Environment values provided by this agent.
+     */
+    readonly env?: Readonly<Record<string, string>>;
+    /**
+     * @deprecated Use env
+     */
+    readonly tenvs?: Readonly<Record<string, unknown>>;
+    /** Brief description of what this agent does. */
+    readonly description?: string;
+    /** Icon URL or absolute path for the agent. */
+    readonly icon?: string;
+    /**
+     * npm package name for this agent when packed.
+     * Preserved through unpack → edit → pack cycles.
+     */
+    readonly packageName?: string;
+    /**
+     * Package version (semver format).
+     * Preserved through unpack → edit → pack cycles.
+     */
+    readonly version?: string;
+    /**
+     * Package author/copyright holder.
+     * Preserved through unpack → edit → pack cycles.
+     */
+    readonly author?: string;
+    /**
+     * License identifier (SPDX format).
+     * Preserved through unpack → edit → pack cycles.
+     */
+    readonly license?: string;
+}
+
+/**
+ * Options for injecting a message
+ */
+interface InjectMessageOptions {
+    /** The message content */
+    content: string;
+    /** The message role */
+    role: "system" | "user" | "assistant" | "tool";
+    /** Optional message ID. If not provided, a UUID will be generated */
+    id?: string;
+    /** Optional message to insert before. If not provided, message is appended to the end */
+    beforeMessageId?: string;
+    /** Optional tool call ID (for role="tool" only) */
+    toolCallId?: string;
+    /** Optional name field */
+    name?: string;
+    /** Whether this message is silent (not shown in UI). Default: false */
+    silent?: boolean;
+    /** Optional structured metadata */
+    metadata?: Record<string, unknown>;
+    /** Force message to be top-level (depth 0) even when called from sub-prompts. Default: false */
+    forceTopLevel?: boolean;
+    /** Force a specific side to play the next turn after injecting the message */
+    forceTurn?: "side_a" | "side_b";
+}
+/**
+ * Queue a new tool call to be executed in the current flow
+ *
+ * This adds a tool call to the execution queue without immediately executing it.
+ * The tool will be executed as part of the normal flow processing.
+ *
+ * If the current tool has a `uses` list defined, the toolName must be in that list.
+ * This enforces namespace isolation for packed agents.
+ *
+ * @param flow - The current FlowState
+ * @param toolName - The name of the tool to call
+ * @param args - The arguments to pass to the tool
+ * @throws Error if toolName is not in the current tool's uses list (when defined)
+ *
+ * @example
+ * ```typescript
+ * import { queueTool } from '@standardagents/builder';
+ *
+ * queueTool(flow, "search_user", { email: "user@example.com" });
+ * ```
+ */
+declare function queueTool(flow: FlowState, toolName: string, args?: Record<string, unknown>): void;
+/**
+ * Inject a message into the thread without triggering execution
+ *
+ * This allows you to add messages to the conversation history programmatically.
+ * The message is persisted to storage but does not cause the agent to execute.
+ *
+ * By default, messages are appended to the end of the conversation.
+ * You can optionally insert a message before another message by providing beforeMessageId.
+ *
+ * @param flow - The current FlowState
+ * @param options - Message options
+ *
+ * @example
+ * ```typescript
+ * import { injectMessage } from '@standardagents/builder';
+ *
+ * // Append a system message
+ * await injectMessage(flow, {
+ *   role: "system",
+ *   content: "Context has been updated"
+ * });
+ *
+ * // Insert a user message before a specific message
+ * await injectMessage(flow, {
+ *   role: "user",
+ *   content: "Additional context",
+ *   beforeMessageId: "msg-123"
+ * });
+ *
+ * // Inject a message and force a specific side to play next
+ * await injectMessage(flow, {
+ *   role: "system",
+ *   content: "New instructions for the AI",
+ *   forceTurn: "side_a" // Force side_a to respond to this message
+ * });
+ * ```
+ */
+declare function injectMessage(flow: FlowState, options: InjectMessageOptions): Promise<Message>;
+/**
+ * Get messages from the thread history
+ *
+ * Retrieves message history from the thread's SQLite storage.
+ * Messages are ordered by creation time (oldest first by default).
+ *
+ * @param flow - The current FlowState
+ * @param limit - Maximum number of messages to retrieve (default: 100)
+ * @param offset - Number of messages to skip (default: 0)
+ * @param order - Sort order: "asc" (oldest first) or "desc" (newest first) (default: "asc")
+ * @returns Array of messages
+ *
+ * @example
+ * ```typescript
+ * import { getMessages } from '@standardagents/builder';
+ *
+ * // Get last 10 messages
+ * const messages = await getMessages(flow, 10);
+ *
+ * // Get 10 messages, skipping the first 20
+ * const messages = await getMessages(flow, 10, 20);
+ *
+ * // Get newest 10 messages
+ * const messages = await getMessages(flow, 10, 0, "desc");
+ * ```
+ */
+declare function getMessages(flow: FlowState, limit?: number, offset?: number, order?: "asc" | "desc"): Promise<Message[]>;
+/**
+ * Reload message history from storage
+ *
+ * Re-loads the complete message history from the thread's SQLite storage.
+ * This is useful when you need to refresh the message history after making
+ * changes (e.g., injecting messages).
+ *
+ * @param flow - The current FlowState
+ * @returns Array of messages (reloaded from storage)
+ *
+ * @example
+ * ```typescript
+ * import { injectMessage, reloadHistory } from '@standardagents/builder';
+ *
+ * // Reload history after injecting a silent message
+ * await injectMessage(flow, { role: "system", content: "...", silent: true });
+ * flow.messageHistory = await reloadHistory(flow);
+ * ```
+ */
+declare function reloadHistory(state: FlowState): Promise<Message[]>;
+/**
+ * Emit a custom event to WebSocket clients via the stream
+ *
+ * Sends a custom event to all connected WebSocket clients on the stream channel.
+ * This allows backend code to push arbitrary data to the frontend
+ * outside of the standard message events.
+ *
+ * @param flow - The current FlowState
+ * @param type - The event type name (e.g., "progress", "notification")
+ * @param data - The event payload (any serializable data)
+ *
+ * @example
+ * ```typescript
+ * import { emitThreadEvent } from '@standardagents/builder';
+ *
+ * // Emit a progress update
+ * emitThreadEvent(flow, "progress", { step: 3, total: 10, message: "Processing data..." });
+ *
+ * // Emit a custom notification
+ * emitThreadEvent(flow, "notification", { level: "info", message: "User authenticated" });
+ *
+ * // Emit metadata
+ * emitThreadEvent(flow, "metadata", { userId: "123", sessionId: "abc" });
+ * ```
+ */
+declare function emitThreadEvent(flow: FlowState, type: string, data: unknown): void;
+/**
+ * Force a specific side to play the next turn
+ *
+ * This queues the specified side to play next without interrupting the current turn.
+ * The forced turn only takes effect at the END of the current turn execution.
+ *
+ * If the tool queue is currently being processed (sequence.isHandling is true),
+ * the forced turn is deferred until all queued tools complete. This allows patterns like:
+ *
+ * ```typescript
+ * import { queueTool, forceTurn } from '@standardagents/builder';
+ *
+ * queueTool(flow, 'myTool', {});
+ * forceTurn(flow, 'side_a');
+ * // myTool executes first, THEN the turn switches to side_a
+ * ```
+ *
+ * @param flow - The current FlowState
+ * @param side - Which side should play next ('side_a' or 'side_b')
+ *
+ * @example
+ * ```typescript
+ * import { forceTurn } from '@standardagents/builder';
+ *
+ * // Force current side to continue (override stop condition)
+ * // If side_a is playing and would stop, this forces it to play at least 1 more turn
+ * forceTurn(flow, 'side_a');
+ *
+ * // Force switch to other side
+ * // If side_a is playing, this forces side_b to play next turn
+ * forceTurn(flow, 'side_b');
+ *
+ * // Forcing a HUMAN-backed side parks execution: the thread stops and waits
+ * // for that side's next inbound message instead of taking a runtime turn.
+ * forceTurn(flow, 'side_b'); // side B human-backed → parks awaiting input
+ * ```
+ */
+declare function forceTurn(flow: FlowState, side: 'side_a' | 'side_b'): void;
+/**
+ * Thread context from defineThreadEndpoint
+ */
+interface ThreadContext {
+    instance: {
+        updateThreadMeta: (threadId: string, params: {
+            agent_name?: string;
+            user_id?: string | null;
+            tags?: string[] | null;
+        }) => Promise<{
+            success: boolean;
+            error?: string;
+            thread?: {
+                id: string;
+                agent_id: string;
+                user_id: string | null;
+                tags: string[];
+                created_at: number;
+            };
+        }>;
+    };
+    metadata: {
+        id: string;
+        agent_name: string;
+        user_id: string | null;
+        tags: string[] | null;
+        created_at: number;
+    };
+}
+/**
+ * Update a thread's metadata in the DurableAgentBuilder registry
+ *
+ * This allows updating the agent_name, user_id, and tags for an existing thread.
+ * Uses the thread instance from defineThreadEndpoint context.
+ *
+ * @param thread - The thread context from defineThreadEndpoint ({ instance, metadata })
+ * @param params - The fields to update (agent_name, user_id, tags)
+ * @returns The updated thread info, or null if update failed
+ *
+ * @example
+ * ```typescript
+ * import { defineThreadEndpoint, updateThread } from '@standardagents/builder';
+ *
+ * export default defineThreadEndpoint(async (req, thread) => {
+ *   // Update thread's user_id
+ *   await updateThread(thread, { user_id: 'user-123' });
+ *
+ *   // Update thread's tags
+ *   await updateThread(thread, { tags: ['support', 'urgent'] });
+ *
+ *   // Update multiple fields
+ *   const result = await updateThread(thread, {
+ *     agent_name: 'new-agent',
+ *     user_id: 'user-456',
+ *     tags: ['sales']
+ *   });
+ *
+ *   return Response.json(result);
+ * });
+ * ```
+ */
+declare function updateThread(thread: ThreadContext, params: {
+    agent_name?: string;
+    user_id?: string | null;
+    tags?: string[] | null;
+}): Promise<{
+    id: string;
+    agent_id: string;
+    user_id: string | null;
+    tags: string[];
+    created_at: number;
+} | null>;
+/**
+ * Write a file to thread storage
+ *
+ * @param flow - The current FlowState
+ * @param path - File path (e.g., "/images/photo.jpg")
+ * @param data - File data as ArrayBuffer or string
+ * @param mimeType - MIME type of the file
+ * @param options - Optional metadata and thumbnail
+ * @returns The created file record
+ *
+ * @example
+ * ```typescript
+ * import { writeFile } from '@standardagents/builder';
+ *
+ * // Write binary file
+ * const imageData = new Uint8Array([...]);
+ * await writeFile(flow, "/images/photo.jpg", imageData.buffer, "image/jpeg");
+ *
+ * // Write text file
+ * await writeFile(flow, "/docs/readme.md", "# Hello", "text/markdown");
+ * ```
+ */
+declare function writeFile(flow: FlowState, path: string, data: ArrayBuffer | string, mimeType: string, options?: {
+    metadata?: Record<string, unknown>;
+    thumbnail?: ArrayBuffer;
+}): Promise<FileRecord>;
+/**
+ * Write an image file with optional thumbnail
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ * @param data - Image data as ArrayBuffer
+ * @param mimeType - Image MIME type
+ * @param options - Image metadata (width, height) and optional thumbnail
+ * @returns The created file record
+ *
+ * @example
+ * ```typescript
+ * import { writeImage } from '@standardagents/builder';
+ *
+ * await writeImage(flow, "/images/photo.jpg", imageBuffer, "image/jpeg", {
+ *   metadata: { width: 1024, height: 768 },
+ *   thumbnail: thumbnailBuffer
+ * });
+ * ```
+ */
+declare function writeImage(flow: FlowState, path: string, data: ArrayBuffer, mimeType: string, options?: {
+    metadata?: {
+        width: number;
+        height: number;
+        [key: string]: unknown;
+    };
+    thumbnail?: ArrayBuffer;
+}): Promise<FileRecord>;
+/**
+ * Link to an external file (URL, S3, R2)
+ *
+ * Creates a file entry pointing to an external location without storing the data locally.
+ *
+ * @param flow - The current FlowState
+ * @param path - File path in thread storage
+ * @param location - External location (https://, s3://, r2://)
+ * @param options - Optional MIME type, size, and metadata
+ * @returns The created file record
+ *
+ * @example
+ * ```typescript
+ * import { linkFile } from '@standardagents/builder';
+ *
+ * // Link to a URL
+ * await linkFile(flow, "/images/hero.jpg", "https://cdn.example.com/hero.jpg");
+ *
+ * // Link to S3
+ * await linkFile(flow, "/data/large.csv", "s3://mybucket/data/large.csv", {
+ *   mimeType: "text/csv",
+ *   size: 10 * 1024 * 1024 * 1024 // 10GB
+ * });
+ * ```
+ */
+declare function linkFile(flow: FlowState, path: string, location: string, options?: {
+    mimeType?: string;
+    size?: number;
+    metadata?: Record<string, unknown>;
+}): Promise<FileRecord>;
+/**
+ * Read a file from thread storage
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ * @returns File data as ArrayBuffer, or null if not found/external
+ *
+ * @example
+ * ```typescript
+ * import { readFile } from '@standardagents/builder';
+ *
+ * const data = await readFile(flow, "/images/photo.jpg");
+ * if (data) {
+ *   // Process binary data
+ * }
+ * ```
+ */
+declare function readFile(flow: FlowState, path: string): Promise<ArrayBuffer | null>;
+/**
+ * Get file metadata
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ * @returns File record or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { stat } from '@standardagents/builder';
+ *
+ * const file = await stat(flow, "/images/photo.jpg");
+ * if (file) {
+ *   console.log(`Size: ${file.size}, Type: ${file.mimeType}`);
+ * }
+ * ```
+ */
+declare function stat(flow: FlowState, path: string): Promise<FileRecord | null>;
+/**
+ * Check if file or directory exists
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ * @returns true if exists, false otherwise
+ *
+ * @example
+ * ```typescript
+ * import { exists } from '@standardagents/builder';
+ *
+ * if (await exists(flow, "/config.json")) {
+ *   // File exists
+ * }
+ * ```
+ */
+declare function exists(flow: FlowState, path: string): Promise<boolean>;
+/**
+ * Delete a file
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ *
+ * @example
+ * ```typescript
+ * import { unlink } from '@standardagents/builder';
+ *
+ * await unlink(flow, "/temp/draft.txt");
+ * ```
+ */
+declare function unlink(flow: FlowState, path: string): Promise<void>;
+/**
+ * Create a directory
+ *
+ * @param flow - The current FlowState
+ * @param path - Directory path
+ * @returns The created directory record
+ *
+ * @example
+ * ```typescript
+ * import { mkdir } from '@standardagents/builder';
+ *
+ * await mkdir(flow, "/uploads/2024");
+ * ```
+ */
+declare function mkdir(flow: FlowState, path: string): Promise<FileRecord>;
+/**
+ * List directory contents
+ *
+ * @param flow - The current FlowState
+ * @param path - Directory path
+ * @returns Array of file records in the directory
+ *
+ * @example
+ * ```typescript
+ * import { readdir } from '@standardagents/builder';
+ *
+ * const files = await readdir(flow, "/images");
+ * for (const file of files) {
+ *   console.log(file.name, file.size);
+ * }
+ * ```
+ */
+declare function readdir(flow: FlowState, path: string): Promise<FileRecord[]>;
+/**
+ * Remove an empty directory
+ *
+ * @param flow - The current FlowState
+ * @param path - Directory path
+ *
+ * @example
+ * ```typescript
+ * import { rmdir } from '@standardagents/builder';
+ *
+ * await rmdir(flow, "/temp");
+ * ```
+ */
+declare function rmdir(flow: FlowState, path: string): Promise<void>;
+/**
+ * Move or rename a file or directory to a new path.
+ *
+ * Works for files (inline or chunked) and directories (the whole subtree is
+ * relocated). The destination must not already exist.
+ *
+ * @param flow - The current FlowState
+ * @param sourcePath - Existing file or directory path
+ * @param destinationPath - New path
+ * @returns The moved file record at its new path
+ *
+ * @example
+ * ```typescript
+ * import { move } from '@standardagents/builder';
+ *
+ * await move(flow, "/drafts/post.md", "/published/post.md");
+ * await move(flow, "/tmp/work", "/archive/2024/work");
+ * ```
+ */
+declare function move(flow: FlowState, sourcePath: string, destinationPath: string): Promise<FileRecord>;
+/**
+ * Rename a file or directory in place, keeping it in the same directory.
+ *
+ * @param flow - The current FlowState
+ * @param path - Existing file or directory path
+ * @param newName - New name (must not contain path separators)
+ * @returns The renamed file record at its new path
+ *
+ * @example
+ * ```typescript
+ * import { rename } from '@standardagents/builder';
+ *
+ * await rename(flow, "/notes/draft.txt", "final.txt");
+ * ```
+ */
+declare function rename(flow: FlowState, path: string, newName: string): Promise<FileRecord>;
+/**
+ * Get file storage statistics
+ *
+ * @param flow - The current FlowState
+ * @returns Storage statistics (total size and file count)
+ *
+ * @example
+ * ```typescript
+ * import { getFileStats } from '@standardagents/builder';
+ *
+ * const stats = await getFileStats(flow);
+ * console.log(`Total: ${stats.totalSize} bytes, Files: ${stats.fileCount}`);
+ * ```
+ */
+declare function getFileStats(flow: FlowState): Promise<FileStats>;
+/**
+ * Get thumbnail for an image file
+ *
+ * @param flow - The current FlowState
+ * @param path - Image file path
+ * @returns Thumbnail data as ArrayBuffer, or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { getThumbnail } from '@standardagents/builder';
+ *
+ * const thumb = await getThumbnail(flow, "/images/photo.jpg");
+ * ```
+ */
+declare function getThumbnail(flow: FlowState, path: string): Promise<ArrayBuffer | null>;
+/**
+ * Read a text file as string
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ * @returns File content as string, or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { cat } from '@standardagents/builder';
+ *
+ * const content = await cat(flow, "/docs/readme.md");
+ * ```
+ */
+declare function cat(flow: FlowState, path: string): Promise<string | null>;
+/**
+ * Read first N lines of a text file
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ * @param lines - Number of lines to read (default: 10)
+ * @returns First N lines as string, or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { head } from '@standardagents/builder';
+ *
+ * const firstLines = await head(flow, "/logs/app.log", 20);
+ * ```
+ */
+declare function head(flow: FlowState, path: string, lines?: number): Promise<string | null>;
+/**
+ * Read last N lines of a text file
+ *
+ * @param flow - The current FlowState
+ * @param path - File path
+ * @param lines - Number of lines to read (default: 10)
+ * @returns Last N lines as string, or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { tail } from '@standardagents/builder';
+ *
+ * const lastLines = await tail(flow, "/logs/app.log", 50);
+ * ```
+ */
+declare function tail(flow: FlowState, path: string, lines?: number): Promise<string | null>;
+/**
+ * Search text file contents using FTS5 full-text search
+ *
+ * @param flow - The current FlowState
+ * @param pattern - Search pattern (FTS5 syntax)
+ * @param options - Search options
+ * @returns Array of matching results with snippets
+ *
+ * @example
+ * ```typescript
+ * import { grep } from '@standardagents/builder';
+ *
+ * // Search all files
+ * const results = await grep(flow, "error");
+ *
+ * // Search in specific directory
+ * const results = await grep(flow, "TODO", { path: "/src" });
+ * ```
+ */
+declare function grep(flow: FlowState, pattern: string, options?: {
+    path?: string;
+    limit?: number;
+}): Promise<GrepResult[]>;
+/**
+ * Find files by path pattern
+ *
+ * @param flow - The current FlowState
+ * @param pattern - Glob-like pattern (e.g., "*.md", "/docs/subdir/*.txt")
+ * @param options - Find options
+ * @returns Array of matching file records
+ *
+ * @example
+ * ```typescript
+ * import { find } from '@standardagents/builder';
+ *
+ * // Find all markdown files
+ * const mdFiles = await find(flow, "*.md");
+ *
+ * // Find all files in docs
+ * const docFiles = await find(flow, "/docs/*", { type: "file" });
+ * ```
+ */
+declare function find(flow: FlowState, pattern: string, options?: {
+    type?: "file" | "directory" | "all";
+    limit?: number;
+}): Promise<FileRecord[]>;
+
+/**
+ * Options for broadcasting custom data
+ */
+interface BroadcastOptions {
+    /** The type of the broadcast message */
+    type: string;
+    /** The value/payload of the broadcast message */
+    value: unknown;
+}
+/**
+ * FlowState SDK - Utility methods for working with FlowState
+ *
+ * These methods extend the FlowState object with helpful utilities for:
+ * - Queuing tool calls
+ * - Injecting messages
+ * - Retrieving message history
+ * - Broadcasting custom data via WebSocket
+ */
+declare class FlowStateSdk {
+    /**
+     * Queue a new tool call to be executed in the current flow
+     *
+     * This adds a tool call to the execution queue without immediately executing it.
+     * The tool will be executed as part of the normal flow processing.
+     *
+     * @param flow - The current FlowState
+     * @param toolName - The name of the tool to call (autocompletes from available tools)
+     * @param args - The arguments to pass to the tool
+     *
+     * @example
+     * ```typescript
+     * FlowStateSdk.queueTool(flow, "search_user", { email: "user@example.com" });
+     * ```
+     */
+    static queueTool(flow: FlowState, toolName: StandardAgentSpec.Callables, args?: Record<string, unknown>): void;
+    /**
+     * Inject a message into the thread without triggering execution
+     *
+     * This allows you to add messages to the conversation history programmatically.
+     * The message is persisted to storage but does not cause the agent to execute.
+     *
+     * By default, messages are appended to the end of the conversation.
+     * You can optionally insert a message before another message by providing beforeMessageId.
+     *
+     * @param flow - The current FlowState
+     * @param options - Message options
+     *
+     * @example
+     * ```typescript
+     * // Append a system message
+     * await FlowStateSdk.injectMessage(flow, {
+     *   role: "system",
+     *   content: "Context has been updated"
+     * });
+     *
+     * // Insert a user message before a specific message
+     * await FlowStateSdk.injectMessage(flow, {
+     *   role: "user",
+     *   content: "Additional context",
+     *   beforeMessageId: "msg-123"
+     * });
+     *
+     * // Inject a message and force a specific side to play next
+     * await FlowStateSdk.injectMessage(flow, {
+     *   role: "system",
+     *   content: "New instructions for the AI",
+     *   forceTurn: "side_a" // Force side_a to respond to this message
+     * });
+     * ```
+     */
+    static injectMessage(flow: FlowState, options: InjectMessageOptions): Promise<Message>;
+    /**
+     * Get messages from the thread history
+     *
+     * Retrieves message history from the thread's SQLite storage.
+     * Messages are ordered by creation time (oldest first by default).
+     *
+     * @param flow - The current FlowState
+     * @param limit - Maximum number of messages to retrieve (default: 100)
+     * @param offset - Number of messages to skip (default: 0)
+     * @param order - Sort order: "asc" (oldest first) or "desc" (newest first) (default: "asc")
+     * @returns Array of messages
+     *
+     * @example
+     * ```typescript
+     * // Get last 10 messages
+     * const messages = await FlowStateSdk.getMessages(flow, 10);
+     *
+     * // Get 10 messages, skipping the first 20
+     * const messages = await FlowStateSdk.getMessages(flow, 10, 20);
+     *
+     * // Get newest 10 messages
+     * const messages = await FlowStateSdk.getMessages(flow, 10, 0, "desc");
+     * ```
+     */
+    static getMessages(flow: FlowState, limit?: number, offset?: number, order?: "asc" | "desc"): Promise<Message[]>;
+    /**
+     * Reload message history from storage
+     *
+     * Re-loads the complete message history from the thread's SQLite storage.
+     * This is useful when you need to refresh the message history after making
+     * changes (e.g., injecting messages).
+     *
+     * @param flow - The current FlowState
+     * @returns Array of messages (reloaded from storage)
+     *
+     * @example
+     * ```typescript
+     * // Reload history after injecting a silent message
+     * await FlowStateSdk.injectMessage(flow, { role: "system", content: "...", silent: true });
+     * flow.messageHistory = await FlowStateSdk.reloadHistory(flow);
+     * ```
+     */
+    static reloadHistory(state: FlowState): Promise<Message[]>;
+    /**
+     * Broadcast custom data to WebSocket clients
+     *
+     * Sends a custom message to all connected WebSocket clients.
+     * This allows backend code to push arbitrary data to the frontend
+     * outside of the standard telemetry events.
+     *
+     * The message is sent with the structure: { type: string, value: unknown }
+     *
+     * @param flow - The current FlowState
+     * @param options - Broadcast options
+     *
+     * @example
+     * ```typescript
+     * // Broadcast a progress update
+     * FlowStateSdk.broadcast(flow, {
+     *   type: "progress",
+     *   value: { step: 3, total: 10, message: "Processing data..." }
+     * });
+     *
+     * // Broadcast a custom notification
+     * FlowStateSdk.broadcast(flow, {
+     *   type: "notification",
+     *   value: { level: "info", message: "User authenticated successfully" }
+     * });
+     *
+     * // Broadcast metadata
+     * FlowStateSdk.broadcast(flow, {
+     *   type: "metadata",
+     *   value: { userId: "123", sessionId: "abc", timestamp: Date.now() }
+     * });
+     * ```
+     */
+    static broadcast(flow: FlowState, options: BroadcastOptions): void;
+    /**
+     * Force a specific side to play the next turn
+     *
+     * This queues the specified side to play next without interrupting the current turn.
+     * The forced turn only takes effect at the END of the current turn execution.
+     *
+     * If the tool queue is currently being processed (sequence.isHandling is true),
+     * the forced turn is deferred until all queued tools complete. This allows patterns like:
+     *
+     * ```typescript
+     * FlowStateSdk.queueTool(flow, 'myTool', {});
+     * FlowStateSdk.forceTurn(flow, 'side_a');
+     * // myTool executes first, THEN the turn switches to side_a
+     * ```
+     *
+     * @param flow - The current FlowState
+     * @param side - Which side should play next ('side_a' or 'side_b')
+     *
+     * @example
+     * ```typescript
+     * // Force current side to continue (override stop condition)
+     * // If side_a is playing and would stop, this forces it to play at least 1 more turn
+     * FlowStateSdk.forceTurn(flow, 'side_a');
+     *
+     * // Force switch to other side
+     * // If side_a is playing, this forces side_b to play next turn
+     * FlowStateSdk.forceTurn(flow, 'side_b');
+     *
+     * // Forcing a HUMAN-backed side parks execution: the thread stops and
+     * // waits for that side's next inbound message instead of taking a turn.
+     * FlowStateSdk.forceTurn(flow, 'side_b'); // side B human-backed → parks
+     * ```
+     */
+    static forceTurn(flow: FlowState, side: 'side_a' | 'side_b'): void;
+}
+/**
+ * Convenience methods added to FlowState (optional - can be used via static methods above)
+ *
+ * These are helper methods that can be added to FlowState instances for convenience.
+ * They delegate to the static methods above.
+ */
+interface FlowStateWithSdk extends FlowState {
+    queueTool: (toolName: StandardAgentSpec.Callables, args?: Record<string, unknown>) => void;
+    injectMessage: (options: InjectMessageOptions) => Promise<Message>;
+    getMessages: (limit?: number, offset?: number, order?: "asc" | "desc") => Promise<Message[]>;
+    reloadHistory: () => Promise<Message[]>;
+    broadcast: (options: BroadcastOptions) => void;
+    forceTurn: (side: 'side_a' | 'side_b') => void;
+}
+/**
+ * Enhance a FlowState object with SDK methods
+ *
+ * This adds convenience methods to a FlowState instance that delegate to
+ * the static FlowStateSdk methods.
+ *
+ * @param flow - The FlowState to enhance
+ * @returns The enhanced FlowState with SDK methods
+ *
+ * @example
+ * ```typescript
+ * const enhancedFlow = enhanceFlowState(flow);
+ *
+ * // Now you can use methods directly on the flow object
+ * enhancedFlow.queueTool("search_user", { email: "user@example.com" });
+ * await enhancedFlow.injectMessage({ role: "system", content: "Context updated" });
+ * const messages = await enhancedFlow.getMessages(10);
+ * flow.messageHistory = await enhancedFlow.reloadHistory();
+ * enhancedFlow.broadcast({ type: "progress", value: { step: 1 } });
+ * enhancedFlow.forceTurn('side_b'); // Force side_b to play next turn
+ * ```
+ */
+declare function enhanceFlowState(flow: FlowState): FlowStateWithSdk;
+
+/**
+ * Context Management for Image Attachments
+ *
+ * Handles auto-summarization of old images to reduce context window usage
+ * while preserving the semantic meaning of image content.
+ */
+
+/**
+ * Configuration for image context management
+ */
+interface ImageContextConfig {
+    /** Number of recent messages to keep images for (default: 10) */
+    recentMessageThreshold: number;
+    /** System prompt for generating image descriptions */
+    descriptionPrompt: string;
+}
+/**
+ * Check if a message has image attachments that could be summarized
+ */
+declare function hasImageAttachments(message: Message): boolean;
+/**
+ * Get image attachments from a message that don't have descriptions yet
+ */
+declare function getUnsummarizedImageAttachments(message: Message): AttachmentRef[];
+/**
+ * Determine which messages should have their images replaced with descriptions.
+ * Returns indices of messages that are old enough to be summarized.
+ */
+declare function getMessagesToSummarize(messages: Message[], config?: ImageContextConfig): number[];
+/**
+ * Build text representation for an image attachment (used when image is too old)
+ */
+declare function buildImageDescription(attachment: AttachmentRef): string;
+/**
+ * Transform message content to replace old images with text descriptions.
+ * This modifies the content array for LLM context building.
+ */
+declare function replaceImagesWithDescriptions(content: MessageContent, attachments: AttachmentRef[]): MessageContent;
+/**
+ * Process message history to optimize context window usage.
+ * Old images are replaced with their text descriptions.
+ *
+ * @param messages - Full message history
+ * @param config - Context management configuration
+ * @returns Processed messages with old images replaced by descriptions
+ */
+declare function optimizeImageContext(messages: Message[], config?: ImageContextConfig): Message[];
+/**
+ * Generate a description for an image using a vision model.
+ * This should be called when storing new messages with images.
+ *
+ * Note: This function is a placeholder for the actual LLM call.
+ * The actual implementation would need to make an API call to a vision model.
+ *
+ * @param imageBase64 - Base64-encoded image data
+ * @param mimeType - MIME type of the image
+ * @param state - Flow state for LLM access
+ * @returns Generated description
+ */
+declare function generateImageDescription(_imageBase64: string, _mimeType: string, _state: FlowState): Promise<string | null>;
+
+/** @public Alias for LLMProviderInterface */
+type Provider = LLMProviderInterface;
+/** @public Alias for ContentPart */
+type ProviderContentPart = ContentPart;
+/** @public Alias for TextPart */
+type ProviderTextPart = TextPart;
+/** @public Alias for ImagePart */
+type ProviderImagePart = ImagePart;
+/** @public Alias for FilePart */
+type ProviderFilePart = FilePart;
+
+/**
+ * Function that can intercept provider creation.
+ * Returns a provider to override the default, or null to fall through.
+ */
+type ProviderOverrideFn = (modelName: string, modelDef: ModelDefinition$1<string>, env: Env) => LLMProviderInterface | null;
+interface ProviderLookupResult {
+    provider: LLMProviderInterface;
+    modelName: string;
+    modelDef: ModelDefinition$1<string>;
+    /** True when requests route through the Standard Agents platform (hosted routing or a registered override). */
+    viaPlatform: boolean;
+    /**
+     * Platform origin serving the passthrough proxy when built-in hosted routing
+     * is active. Lets request logging look up the router-fee percent observed on
+     * this origin's proxied responses.
+     */
+    platformProxyOrigin?: string;
+}
+/**
+ * Provider registry implementation
+ *
+ * Models must use ProviderFactory functions imported from provider packages
+ * (e.g., @standardagents/openai, @standardagents/openrouter).
+ *
+ * Loads model configs from TypeScript virtual modules and
+ * provider API keys from environment variables.
+ */
+declare class ProviderRegistryImpl {
+    private providerCache;
+    /** Why the last thread-scoped resolution did (not) contribute user env,
+     *  keyed by the env object handed back — surfaced in missing-variable
+     *  errors so a silent user-env failure is diagnosable from the log. */
+    private scopeDiagnostics;
+    private providerOverrideFn;
+    private providerOverrideRevision;
+    setProviderOverride(fn: ProviderOverrideFn | null): void;
+    /**
+     * The env a provider resolves against for a given execution, scoped to the
+     * THREAD rather than just the instance: thread env overrides win, then the
+     * thread OWNER's user env, then instance/Worker env. This is what makes
+     * per-user BYOK providers work — a credential a user installs in their own
+     * account env (e.g. an OAuth token a companion service rotates) is honored
+     * for that user's threads no matter which authorized actor plays the turn.
+     *
+     * Best-effort by design: a missing user id (super-admin/local threads) or
+     * an older AgentBuilder DO without user-env storage simply contributes
+     * nothing, leaving instance-env behavior untouched.
+     */
+    buildThreadScopedEnv(state: {
+        env: Env;
+        thread: {
+            metadata?: {
+                user_id?: string | null;
+                parent?: string | null;
+                env?: Record<string, unknown> | null;
+                tenvs?: Record<string, unknown> | null;
+            };
+        };
+    }): Promise<Env>;
+    /**
+     * Get provider for a model.
+     *
+     * Models must use ProviderFactory functions (imported from provider packages).
+     *
+     * @param modelName - The model name (from TypeScript config)
+     * @param env - Environment bindings
+     * @param thread - Thread instance for loading model from virtual modules
+     * @returns Provider and model definition
+     */
+    getProvider(modelName: string, env: Env, thread?: ThreadInstance, getState?: () => Promise<ThreadState>): Promise<ProviderLookupResult>;
+    private buildResult;
+    private cacheAndReturn;
+    private getProviderFingerprint;
+    /**
+     * Get API key for a provider from environment variables.
+     */
+    private getApiKeyForProvider;
+    /**
+     * Clear the provider cache
+     * Useful for testing or when configurations change
+     */
+    clearCache(): void;
+}
+/**
+ * Singleton instance
+ */
+declare const ProviderRegistry: ProviderRegistryImpl;
+
+/**
+ * Namespace-scoped resolution for the packing system.
+ *
+ * This module provides functions to resolve items (tools, prompts, models, agents)
+ * within the correct namespace context, enforcing isolation between packed and
+ * unpacked code.
+ *
+ * @module
+ */
+
+/**
+ * Error thrown when an item cannot be resolved in the current namespace.
+ */
+declare class NamespaceResolutionError extends Error {
+    readonly itemType: 'tool' | 'prompt' | 'model' | 'agent' | 'hook';
+    readonly itemName: string;
+    readonly namespace: NamespaceContext;
+    constructor(itemType: 'tool' | 'prompt' | 'model' | 'agent' | 'hook', itemName: string, namespace: NamespaceContext, message: string);
+}
+/**
+ * Parse a potentially qualified name into package ID and short name.
+ *
+ * For scoped npm packages (starting with @), the format is @scope/pkg-name/item-name
+ * where @scope/pkg-name is the package and item-name is the short name.
+ *
+ * For non-scoped packages, the format is pkg-name/item-name.
+ *
+ * @param name - The name to parse (e.g., 'tool', 'pkg/tool', or '@scope/pkg/tool')
+ * @returns Tuple of [packageId, shortName] where packageId is null for unqualified names
+ */
+declare function parseQualifiedName(name: string): [string | null, string];
+/**
+ * Create a qualified name from package ID and short name.
+ */
+declare function qualifyName(packageId: string, shortName: string): string;
+/**
+ * Get the short name (strip any package qualification).
+ */
+declare function getShortName(name: string): string;
+/**
+ * Resolve a tool by name within a namespace context.
+ *
+ * Resolution rules:
+ * - Qualified names (pkg:tool) → resolve cross-package entry point
+ * - Unqualified names in packed context → resolve from own package
+ * - Unqualified names in global context → resolve from global namespace
+ *
+ * @param registry - The namespaced registry
+ * @param name - Tool name (can be qualified with packageId:toolName)
+ * @param namespace - Current namespace context
+ * @returns Loader function for the tool definition
+ * @throws NamespaceResolutionError if tool cannot be found or accessed
+ */
+declare function resolveTool(registry: NamespacedRegistry, name: string, namespace: NamespaceContext): DefinitionLoader<unknown>;
+/**
+ * Resolve a prompt by name within a namespace context.
+ *
+ * @param registry - The namespaced registry
+ * @param name - Prompt name (can be qualified)
+ * @param namespace - Current namespace context
+ * @returns Loader function for the prompt definition
+ */
+declare function resolvePrompt(registry: NamespacedRegistry, name: string, namespace: NamespaceContext): DefinitionLoader<unknown>;
+/**
+ * Resolve a model by name within a namespace context.
+ *
+ * Models are special: packed agents include their model definitions,
+ * but the host must provide API keys.
+ *
+ * @param registry - The namespaced registry
+ * @param name - Model name
+ * @param namespace - Current namespace context
+ * @returns Loader function for the model definition
+ */
+declare function resolveModel(registry: NamespacedRegistry, name: string, namespace: NamespaceContext): DefinitionLoader<unknown>;
+/**
+ * Resolve an agent by name within a namespace context.
+ *
+ * Resolution rules:
+ * - Qualified names (pkg:agent) → resolve cross-package entry point
+ * - Unqualified in packed → resolve from own package
+ * - Unqualified in global → resolve from global + entry points
+ *
+ * @param registry - The namespaced registry
+ * @param name - Agent name (can be qualified)
+ * @param namespace - Current namespace context
+ * @returns Loader function for the agent definition
+ */
+declare function resolveAgent(registry: NamespacedRegistry, name: string, namespace: NamespaceContext): DefinitionLoader<unknown>;
+/**
+ * Resolve a hook by name within a namespace context.
+ *
+ * Hooks follow similar rules to tools but are keyed by hook type.
+ *
+ * @param registry - The namespaced registry
+ * @param name - Hook name (file name, e.g., 'filter_messages')
+ * @param namespace - Current namespace context
+ * @returns Loader function for the hook implementation
+ */
+declare function resolveHook(registry: NamespacedRegistry, name: string, namespace: NamespaceContext): DefinitionLoader<unknown> | null;
+/**
+ * Get all tool names visible in a namespace context.
+ *
+ * @param registry - The namespaced registry
+ * @param namespace - Current namespace context
+ * @returns Array of visible tool names (short names)
+ */
+declare function getVisibleToolNames(registry: NamespacedRegistry, namespace: NamespaceContext): string[];
+/**
+ * Get all agent names visible in a namespace context.
+ *
+ * @param registry - The namespaced registry
+ * @param namespace - Current namespace context
+ * @returns Array of visible agent names (may include qualified names for cross-package)
+ */
+declare function getVisibleAgentNames(registry: NamespacedRegistry, namespace: NamespaceContext): string[];
+/**
+ * Get all prompt names visible in a namespace context.
+ */
+declare function getVisiblePromptNames(registry: NamespacedRegistry, namespace: NamespaceContext): string[];
+/**
+ * Get all model names visible in a namespace context.
+ */
+declare function getVisibleModelNames(registry: NamespacedRegistry, namespace: NamespaceContext): string[];
+/**
+ * Create a namespace context for an agent definition.
+ *
+ * @param agentDef - Agent definition (may have __package field)
+ * @returns Appropriate namespace context
+ */
+declare function createNamespaceContext(agentDef: {
+    __package?: {
+        packageId: string;
+    };
+} | undefined): NamespaceContext;
+/**
+ * Check if a name is qualified (contains package prefix).
+ *
+ * For scoped packages (@scope/name), there must be at least two slashes
+ * to be considered qualified (e.g., @scope/pkg/item).
+ * For non-scoped packages, a single slash qualifies it (e.g., pkg/item).
+ */
+declare function isQualifiedName(name: string): boolean;
+
+export { stat as $, type AgentDefinition as A, type SessionToolBinding as B, CodeExecutionBridge as C, DurableThread as D, type HumanSide as E, type PromptSide as F, type HandlerSide as G, type HubClientInfo as H, type SideConfig as I, type SubagentRelationship as J, queueTool as K, injectMessage as L, type ModelDefinition as M, getMessages as N, reloadHistory as O, type Provider$1 as P, emitThreadEvent as Q, forceTurn as R, type SubpromptConfig as S, ThreadWatchdog as T, type UpdateThreadParams as U, updateThread as V, type WatchdogProbeResult as W, writeFile as X, writeImage as Y, linkFile as Z, readFile as _, isTrustedLocalDevelopmentRequest as a, exists as a0, unlink as a1, mkdir as a2, readdir as a3, rmdir as a4, move as a5, rename as a6, getFileStats as a7, getThumbnail as a8, cat as a9, resolveTool as aA, resolvePrompt as aB, resolveModel as aC, resolveAgent as aD, resolveHook as aE, getVisibleToolNames as aF, getVisibleAgentNames as aG, getVisiblePromptNames as aH, getVisibleModelNames as aI, createNamespaceContext as aJ, isQualifiedName as aK, NamespaceResolutionError as aL, head as aa, tail as ab, grep as ac, find as ad, type InjectMessageOptions as ae, FlowStateSdk as af, enhanceFlowState as ag, type BroadcastOptions as ah, type FlowStateWithSdk as ai, hasImageAttachments as aj, getUnsummarizedImageAttachments as ak, getMessagesToSummarize as al, buildImageDescription as am, replaceImagesWithDescriptions as an, optimizeImageContext as ao, generateImageDescription as ap, type ImageContextConfig as aq, ProviderRegistry as ar, type Provider as as, type ProviderContentPart as at, type ProviderTextPart as au, type ProviderImagePart as av, type ProviderFilePart as aw, parseQualifiedName as ax, qualifyName as ay, getShortName as az, isPublicApiRoute as b, canAccessThread as c, isAdminOnlyApiRoute as d, isSameOriginBrowserRequest as e, applyRuntimeCors as f, runtimePreflightResponse as g, DurableAgentBuilder as h, isHostedInstance as i, type ThreadWatchdogState as j, type WatchdogCheckin as k, DurableUserHub as l, type AgentBuilderEnv as m, type AgentBuilderEvent as n, type ThreadEventPayload as o, type ThreadRegistryEntry as p, type User as q, runtimeCorsHeaders as r, type PromptDefinition as s, type PromptToolConfig as t, type SubagentToolConfig as u, type ToolConfig as v, type PromptContent as w, type PromptPart as x, type PromptIncludePart as y, type SessionToolConfig as z };