@stratusagent/agents 0.11.4 → 0.11.5

package/dist/index.d.ts

@@ -1,655 +1,12 @@
-import { type ListensMode, AgentRegistry, type AgentDefinition, type AgentMemoryStore, type AgentRunner, type AvatarTheme, type JsonObject, type Session, type Skill, type Tool, type TrustLevel } from '@stratusagent/core';
-/**
- * The one house style every Stratus agent avatar is drawn in. Surfaces
- * (CLI, web, macOS) render this style; agents differ by their name-derived
- * hue and palette, so the team looks cohesive while each member is
- * recognizable.
- */
-export declare const AVATAR_STYLE = "stratus";
-/**
- * Generate a human-ish first name. Deterministic when a seed is supplied;
- * random otherwise.
- */
-export declare const generateAgentName: (seed?: string) => string;
-/**
- * Derive an avatar theme from a name: a stable hue and a small palette in
- * the shared Stratus house style. Consumers (CLI, web, macOS) draw the
- * actual image from this so the agent looks the same on every surface.
- */
-export declare const generateAvatarTheme: (name: string) => AvatarTheme;
-/**
- * The shape an id is *minted* in: lowercase alphanumerics and internal
- * hyphens, starting with an alphanumeric. Everything `slugify` produces
- * matches it, so every id this module derives does.
- *
- * Not what validation enforces. A hand-written `id:` predates any shape
- * rule and `Ava_1` was as valid as `ava` — see `isValidAgentId`.
- */
-export declare const AGENT_ID_PATTERN: RegExp;
-/**
- * How long an id we *build* is allowed to get. A construction bound, not a
- * validation rule — `isValidAgentId` deliberately does not check it.
- *
- * Every id derived from a long name predates this bound, and enforcing it
- * retroactively drops working agents off the roster, while trimming them
- * silently re-keys their sessions, memory, and credentials to an id nobody
- * has ever used. So the bound applies where an id is minted fresh and
- * nothing is keyed to it yet, and nowhere else. File systems still have
- * limits, and an id long enough to hit them fails at the join with a name
- * that says so.
- */
-export declare const MAX_AGENT_ID_LENGTH = 64;
-/**
- * Whether `id` is safe to key an agent's resources and paths by.
- *
- * Ids are not labels. They key sessions, memory, credentials, Slack channel
- * tokens, and every per-agent path on disk — and an explicit frontmatter
- * `id` is untrusted input: a soul file travels with a repository, and in
- * the hosted profile it comes from a tenant. `id: ../../escape` reaches
- * every one of those joins intact, so it is stopped once here rather than
- * defended at each of them.
- *
- * **Unsafe is the rule, not un-sluglike.** Nothing before this checked an
- * explicit id at all, so `Ava_1`, `team.alpha`, and `AVA` are all out there
- * keying real sessions and real credentials. Holding them to the shape ids
- * are minted in would not make anything safer — none of them can leave
- * their directory — and `loadRosterSouls` degrades a soul that will not
- * parse to a warning, so the only thing it would accomplish is dropping
- * those agents off the roster on upgrade, quietly, while their data stays
- * behind under the old id. Reserving the slug shape for ids nobody has
- * chosen yet costs nothing; imposing it on ids people are already using
- * costs them their agent.
- *
- * Rejected, never sanitized: rewriting `../../escape` into `escape` hands
- * back an agent nobody asked for, keyed to resources nobody named.
- */
-export declare const isValidAgentId: (id: string) => boolean;
-/**
- * Whether a `delegates` entry is one the soul can hold: any agent id, or
- * the wildcard — the same rule as {@link isValidAgentId}, so every agent a
- * roster can hold can be named as a target. Exported so the control API
- * refuses a bad entry as the client's error rather than discovering it in
- * the soul round-trip.
- */
-export declare const isValidDelegateEntry: (entry: string) => boolean;
-/**
- * How much of a new session id is the *client's* to spend, on top of the
- * agent id it addresses.
- *
- * Every id in circulation is a colon-joined address that embeds the agent
- * id — `web:<agentId>:<uuid>` from the dashboard, a channel key of
- * `<channel>:<agentId>:<team>:<conversation>:<thread>`, with a bare UUID
- * from the CLI the one exception. So a flat cap is the wrong shape: agent
- * ids are deliberately unbounded (see {@link isValidAgentId}), and a flat
- * 200 refused every dashboard conversation for an agent whose id ran past
- * 159 characters — an agent that stays on the roster and simply stops being
- * chattable, which is the quiet-breakage failure the unbounded rule exists
- * to avoid.
- *
- * Budgeting the composition instead keeps the bound meaningful without
- * capping the agent id through the back door. It cannot be gamed to widen
- * itself: the allowance comes from an agent id already checked against the
- * roster, not from the caller's own string.
- */
-export declare const MAX_SESSION_ID_LENGTH = 200;
-/**
- * Whether `id` may open a *new* conversation.
- *
- * Session ids are client-minted and a `POST` to an unknown one creates it,
- * so this is the only thing standing between an HTTP caller and a durable
- * row. `undefined`, `null`, and a bare space have all reached the session
- * table through that door — the dashboard shipped the first of them.
- *
- * **Checked where an id is minted, never where one is used.** An id already
- * in the store addresses a real conversation, whatever shape it is, and
- * re-validating on read would lock someone out of their own history to
- * enforce a rule that postdates it. Same reasoning as
- * {@link MAX_AGENT_ID_LENGTH}, which is why the length bound lives here and
- * not in {@link isValidAgentId}.
- *
- * `agentId` is the agent the id addresses, when the caller knows it — every
- * client convention embeds it, so its length is part of the budget rather
- * than something the bound gets to cap. The allowance applies only to an id
- * that actually contains it, since those are the characters being paid for;
- * a bare UUID and an unrelated string are both held to
- * {@link MAX_SESSION_ID_LENGTH} alone, as they are when `agentId` is
- * omitted.
- *
- * Shape is deliberately not enforced. Every id above is a legitimate
- * address, and no pattern admitting all of them excludes `undefined` — so
- * the safety rule, a bound, and {@link STRINGIFIED_NOTHING} are what catch
- * the real mistakes. Rejected, never sanitized: trimming an id hands the
- * caller back a conversation at an address it never asked for.
- */
-export declare const isValidSessionId: (id: string, agentId?: string) => boolean;
-/**
- * A freshly minted id, bounded — `base` trimmed so that appending `suffix`
- * still fits, with any hyphen left dangling by the trim removed.
- *
- * Only for ids nothing is keyed to yet: a generated agent's
- * name-plus-suffix, and `agent new` retrying a filename collision. Both mint
- * an id in the same breath as the agent, so trimming takes nothing away.
- * Shared rather than re-derived so the two do not each own half of the bound
- * and drift. An id derived from a name someone chose does *not* come through
- * here — that name may already have an agent behind it.
- */
-export declare const agentIdWithSuffix: (base: string, suffix?: string) => string;
-export interface DefineAgentInput {
-    name?: string;
-    id?: string;
-    instructions?: string;
-    tools?: string[];
-    skills?: string[];
-    credentials?: string[];
-    delegates?: string[];
-    /** See `AgentDefinition.listens`. */
-    listens?: ListensMode;
-    avatar?: AvatarTheme;
-    /** Seed for deterministic identity generation (used in tests). */
-    seed?: string;
-}
-/**
- * One-call agent creation. Everything is optional: with no input you get a
- * fresh identity with a human-ish name and a matching avatar theme.
- * Explicitly named agents keep a clean, predictable slug id.
- */
-export declare const defineAgent: (input?: DefineAgentInput) => AgentDefinition;
-/**
- * Whether `agent` may delegate to the agent with id `targetId`. Exact ids
- * or `*`; no namespace globs, because agent ids have no namespaces. Omitted
- * is nobody — see `AgentDefinition.delegates`.
- */
-export declare const isDelegateAllowed: (agent: Pick<AgentDefinition, "delegates">, targetId: string) => boolean;
-/**
- * A parsed soul file: the agent it defines plus optional runtime hints.
- * Souls are markdown with frontmatter — the frontmatter carries structured
- * identity (name, tools, credentials, provider, model) and the body is the
- * persona itself, written in prose.
- */
-export interface ParsedSoul {
-    agent: AgentDefinition;
-    /** Provider the soul prefers (e.g. "anthropic"). Runtimes may override. */
-    provider?: string;
-    /** Model the soul prefers (e.g. "claude-opus-5"). Runtimes may override. */
-    model?: string;
-}
-export interface ParseSoulOptions {
-    /** Seed for deterministic identity generation when the soul has no name. */
-    seed?: string;
-}
-/**
- * Parse a soul file (markdown with optional frontmatter) into an agent
- * definition. The body becomes the agent's instructions; a missing name is
- * generated, so the smallest possible soul is just prose.
- */
-export declare const parseSoul: (source: string, options?: ParseSoulOptions) => ParsedSoul;
-export declare const formatSoul: (soul: ParsedSoul) => string;
-/**
- * The shape a skill id is written in — the Agent Skills spec's rule for
- * `name`, which is also the directory name: lowercase letters and digits
- * in hyphen-separated runs (`web-research`), at most 64 characters, no
- * leading, trailing, or doubled hyphen. One pattern for the manifest's
- * declared ids, the operator directory's folder names, and install-time
- * validation — two copies would drift into two answers to what a valid
- * id is.
- */
-export declare const SKILL_ID_PATTERN: RegExp;
-/** The spec's ceiling on `name`, and so on a skill id. */
-export declare const SKILL_ID_MAX_LENGTH = 64;
-export declare const isValidSkillId: (id: string) => boolean;
-/**
- * Whether an id that is already on this machine — a directory under
- * `~/.stratus/skills/`, a plugin manifest's declared id — is served.
- * Wider than `isValidSkillId` on purpose: the spec's rule arrived after
- * some of these were written, and tightening the *loader* would silently
- * drop an enabled procedure from an agent on upgrade. Installing and
- * validating use the strict rule; loading uses this one, and warns.
- */
-export declare const isLoadableSkillId: (id: string) => boolean;
-/** What a skill id refusal says, everywhere one is refused. */
-export declare const SKILL_ID_RULE = "Skill ids are lowercase letters, digits, and single hyphens (web-research), at most 64 characters.";
-/** The spec's ceiling on `description`. */
-export declare const SKILL_DESCRIPTION_MAX_LENGTH = 1024;
-/** The spec's ceiling on `compatibility`. */
-export declare const SKILL_COMPATIBILITY_MAX_LENGTH = 500;
-/**
- * A parsed `SKILL.md`: the one-line identity that reaches the system
- * prompt, and the body that only ever travels through `skill.read`.
- */
-export interface ParsedSkillDocument {
-    /**
-     * The skill's name — under the spec, its id, and equal to its directory
-     * name. Optional here because loading stays tolerant of what is already
-     * installed; the registered skill falls back to its id.
-     */
-    name?: string;
-    /**
-     * When to reach for this skill — what routing runs on, so it earns its
-     * place by saying when, not what the body contains.
-     */
-    description: string;
-    /** The spec's `license`: a name, or a bundled file. Informational. */
-    license?: string;
-    /**
-     * The spec's `compatibility`: what the skill needs from its environment,
-     * in prose — for the operator installing it, since nothing here can act
-     * on it.
-     */
-    compatibility?: string;
-    /** The spec's `metadata:` map, verbatim — every value a string. */
-    metadata?: Record<string, string>;
-    /** `metadata.version`, or the legacy top-level key. Informational. */
-    version?: string;
-    /**
-     * Toolset globs the procedure expects (`browser.*`), from
-     * `metadata.requires` (space-separated) or the legacy top-level list.
-     * Advisory — see `Skill.requires`.
-     */
-    requires?: string[];
-    /**
-     * Top-level keys outside the spec, in file order — the legacy Stratus
-     * keys and other hosts' fields alike. What validation warns about.
-     */
-    unknownKeys: string[];
-    body: string;
-}
-/**
- * Parse a `SKILL.md` — the same frontmatter dialect souls use (`key: value`
- * scalars, block lists), plus the spec's `metadata:` map. The body is the
- * procedure itself, markdown, untouched.
- *
- * `description` is required: it is the only thing the model sees before
- * deciding to load the body, and a skill without one is unreachable by the
- * mechanism that makes skills cheap. Everything the spec constrains beyond
- * presence — the name rule, the length ceilings — is
- * `validateSkillDocument`'s, so that loading what is already installed
- * stays lenient while installing is strict.
- */
-export declare const parseSkillDocument: (source: string) => ParsedSkillDocument;
-export interface ValidateSkillDocumentOptions {
-    /**
-     * The directory the skill sits in (its basename), which the spec
-     * requires `name` to equal. Omit where the directory is circumstance
-     * rather than identity — a repository whose root is the skill, checked
-     * out wherever git put it.
-     */
-    directoryName?: string;
-    /**
-     * What to suggest when `name` is missing — the directory name, or for a
-     * root skill the repository's. Only ever read for the error text.
-     */
-    suggestedName?: string;
-}
-/** What `validateSkillDocument` found: errors refuse an install, warnings ride along. */
-export interface SkillValidation {
-    errors: string[];
-    warnings: string[];
-}
-/**
- * Check a parsed `SKILL.md` against the Agent Skills spec — the checks
- * `skills-ref validate` runs, so a skill that passes here passes there:
- * `name` present, shaped like an id, equal to the directory name;
- * `description` and `compatibility` under their ceilings. Errors are what
- * refuses an install. Top-level keys the spec does not define are
- * warnings, not errors: the reference validator refuses them, but the
- * ecosystem's skills carry other hosts' fields routinely, and refusing a
- * skill over a field that changes nothing here fails the whole point of
- * conforming. The legacy Stratus keys get their own warning, naming the
- * `metadata:` form that ports.
- *
- * Loading never calls this — an installed skill keeps loading whatever
- * the spec says today. Installing always does.
- */
-export declare const validateSkillDocument: (document: ParsedSkillDocument, options?: ValidateSkillDocumentOptions) => SkillValidation;
-export interface LazySkillInput {
-    /** The id the skill registers under — qualified for a plugin's skill. */
-    id: string;
-    /** The parsed document, from the load-time read that validated the file. */
-    document: ParsedSkillDocument;
-    /** Re-read the file's source. Called on demand; the registry caches. */
-    read: () => Promise<string>;
-}
-/**
- * A `Skill` whose body stays on disk until somebody asks. The identity
- * comes from the load-time parse (which is also what validated the file);
- * `load()` re-reads rather than closing over the body, so an
- * enabled-but-unused skill costs its description line and nothing else —
- * in the prompt and in memory.
- */
-export declare const createLazySkill: ({ id, document, read }: LazySkillInput) => Skill;
-export declare const MEMORY_TOOL_NAME = "memory.remember";
-/**
- * A tool that lets an agent write to its own long-term memory. Entries are
- * keyed by the session's agent id, so what one agent learns stays exclusively
- * that agent's knowledge — and follows it to every channel and thread.
- */
-export declare const createRememberTool: (store: AgentMemoryStore) => Tool;
-export declare const RECALL_TOOL_NAME = "memory.recall";
-/**
- * Searches the agent's own long-term memory. `safe` by the same rule as
- * `memory.remember`: reading what this agent already knows. The query is
- * literal text — the store does whatever escaping its backend needs, so no
- * query a model writes is ever a syntax error; matching nothing is a normal
- * result, because an agent that has learned nothing yet is the ordinary
- * starting state, not a broken tool.
- */
-export declare const createRecallTool: (store: AgentMemoryStore) => Tool;
-export declare const FORGET_TOOL_NAME = "memory.forget";
-/**
- * Retires one of the agent's own memories, by id. Tombstoned rather than
- * deleted — which is what makes `safe` defensible for it: the entry stops
- * being live but does not stop existing, so an operator can still see what
- * an agent chose to drop.
- */
-export declare const createForgetTool: (store: AgentMemoryStore) => Tool;
-export declare const DELEGATE_TOOL_NAME = "agent.delegate";
-/**
- * Metadata a delegated sub-session carries: which agent delegated, and the
- * session at the root of the chain. Written by `agent.delegate` and read by
- * the gateway's restart sweep, which is why the keys are named here rather
- * than spelled twice — a sub-session's parent is a turn in some other
- * process's memory, and after a restart nothing can consume its reply.
- */
-export declare const DELEGATED_BY_METADATA_KEY = "delegatedBy";
-export declare const ROOT_SESSION_ID_METADATA_KEY = "rootSessionId";
-export declare const DELEGATION_DEPTH_METADATA_KEY = "delegationDepth";
-/**
- * The segment `agent.delegate` mints into every sub-session's id —
- * `<parent>:delegate:<agent>:<depth>:<suffix>`. The second half of what
- * identifies a sub-session, beside the metadata above: the gateway refuses
- * the metadata keys at its public door, but rows written before it did
- * cannot be told apart by their metadata alone, and a caller who wrote
- * `delegatedBy` onto a session of its own would not also have minted an
- * id in this shape.
- */
-export declare const DELEGATED_SESSION_ID_MARKER = ":delegate:";
-/**
- * Whether this session is a delegated sub-session — one whose reply is
- * consumed by a parent turn's `agent.delegate` call and by nothing else.
- * Both halves are required: the metadata `agent.delegate` writes, and the
- * id shape it mints.
- */
-export declare const isDelegatedSession: (session: Pick<Session, "id" | "metadata">) => boolean;
-/**
- * The id of the session whose `agent.delegate` call started this one, read
- * off the id shape above — the text before the last marker, since a nested
- * sub-session embeds its parent's id whole. Undefined for an id that was
- * not minted that way.
- */
-export declare const delegatingSessionIdOf: (sessionId: string) => string | undefined;
-/**
- * The id of the `agent.delegate` call in `parent` that is still awaiting
- * `child`, or undefined when none is.
- *
- * The one thing about a delegation nothing outside the runner can forge:
- * a caller can name a session in the sub-session id shape and write the
- * metadata keys, but only the runner writes assistant tool calls, and only
- * a delegation in flight leaves one with no result behind it. Matched to
- * the child and not merely counted, because a parent can be inside one
- * delegation while an earlier sub-session of its — continued from outside
- * under a version that kept the markers — is parked on something of its
- * own. The call names its target and its prompt, and `agent.delegate`
- * made the prompt the child's first user message. Read against the
- * transcript order so a re-used call id cannot make a later call look
- * answered.
- */
-export declare const outstandingDelegationFor: (parent: Pick<Session, "messages">, child: Pick<Session, "agent" | "messages">) => string | undefined;
-/**
- * `metadata` with the delegation markers removed — what a sub-session
- * carries once it has been addressed from outside. The delegation ended
- * with the turn that awaited it; a conversation somebody continues on the
- * same id afterwards is an ordinary one, and must not be closed as an
- * orphan by a later restart.
- */
-export declare const withoutDelegation: (metadata: JsonObject) => JsonObject;
-/**
- * Runs a delegated sub-session. A plain runner works when every agent
- * shares one provider; a host with per-agent provider routing (the
- * gateway) supplies its own dispatcher so the target runs on the
- * target's resolved provider and credentials — never the delegator's.
- */
-export type DelegateDispatch = (input: {
-    sessionId: string;
-    agent: AgentDefinition;
-    userMessage: string;
-    metadata: JsonObject;
-    /** The parent turn's abort signal — a cancelled parent cancels the delegated run too. */
-    signal?: AbortSignal;
-}) => Promise<Session>;
-export type DelegateToolOptions = {
-    registry: AgentRegistry;
-    /** Maximum delegation depth to stop orchestrator loops. Default 3. */
-    maxDepth?: number;
-} & ({
-    runner: AgentRunner;
-    dispatch?: never;
-} | {
-    dispatch: DelegateDispatch;
-    runner?: never;
-});
-/**
- * The orchestrator primitive: a tool that runs another agent in its own
- * sub-session (with that agent's memory, tool allowlist, and credentials)
- * and returns its final reply as the tool result.
- */
-export declare const createDelegateTool: ({ registry, runner, dispatch, maxDepth, }: DelegateToolOptions) => Tool;
-export interface AgentRouteRule {
-    /** Regex or predicate matched against the routing key (e.g. channel or message). */
-    match: RegExp | ((input: string) => boolean);
-    agent: AgentDefinition;
-}
-export interface AgentRouter {
-    route(input: string): AgentDefinition;
-}
-/**
- * Route inbound work (a channel name, a message, a thread key) to an agent.
- * The Slack transport will feed channel/mention strings through this so the
- * same person consistently answers in the same places.
- */
-export declare const createAgentRouter: (rules: AgentRouteRule[], fallback: AgentDefinition) => AgentRouter;
-/** Register a set of agents and get the registry back. */
-export declare const createAgentTeam: (agents: AgentDefinition[]) => AgentRegistry;
-/**
- * Where a schedule reports, or a `message.send` speaks: a channel kind plus
- * a channel-native id — the same convention approver lists use, because
- * mapping through a Stratus identity adds a lookup that can only be wrong.
- */
-export interface ScheduleDestination {
-    /** Channel kind, e.g. 'slack' — which adapter must do the talking. */
-    channel: string;
-    /** Channel-native conversation id (Slack: `C…`/`G…`/`D…`). */
-    to: string;
-}
-/**
- * The one string form of a destination, `<channel>:<native id>`, used
- * everywhere a destination is *compared*: `Tool.destinationFor`, the
- * permission policy's pre-authorization check, and the schedule row it is
- * checked against. One canonicalization, or two writers of `slack:C01` and
- * `SLACK:C01` would disagree about the same channel.
- */
-export declare const canonicalDestination: (destination: ScheduleDestination) => string;
-/**
- * When a schedule runs. Three shapes rather than one string, because the
- * three are advanced differently: an interval adds itself to the previous
- * slot, a cron expression is searched forward, and a one-shot has no next
- * at all.
- */
-export type ScheduleCadence = {
-    kind: 'every';
-    intervalMs: number;
-} | {
-    kind: 'cron';
-    expression: string;
-} | {
-    kind: 'at';
-    at: string;
-};
-/** One durable schedule, exactly as the human approved it. */
-export interface ScheduleRecord {
-    id: string;
-    agentId: string;
-    cadence: ScheduleCadence;
-    /** The user message each firing dispatches — the payload of the feature. */
-    prompt: string;
-    /**
-     * Where firings are pre-authorized to report. Absent for a silent
-     * schedule, whose firings face the gate like any inbound turn.
-     */
-    destination?: ScheduleDestination;
-    createdAt: string;
-    /** The session whose turn created it, for the audit trail. */
-    createdBy?: string;
-    /**
-     * The trust label of the session that set the schedule. The prompt is
-     * that session's text, so each firing's "sender" is the agent's past
-     * self at that label — a tainted session must not launder attacker text
-     * into a fresh, trusted firing. Absent on a schedule set before
-     * provenance was tracked, and a firing reads that as `unknown`.
-     */
-    trust?: TrustLevel;
-    /**
-     * The next slot, ISO-8601. Consumed — advanced — BEFORE the dispatch, so
-     * a daemon that dies mid-firing can never run the same window twice.
-     * Absent for a spent one-shot: it will not fire again and its row stays
-     * only until the firing it pre-authorized has finished.
-     */
-    nextFireAt?: string;
-    lastFiredAt?: string;
-    /**
-     * The session id of the most recent firing. What the restart sweep uses
-     * to tell a spent one-shot whose turn is parked on a human (keep the row
-     * — it is the approval's scope) from one whose turn is over (delete it).
-     */
-    lastSessionId?: string;
-}
-/** `every` strings: a positive integer and one unit — `90s`, `10m`, `2h`, `1d`. */
-export declare const parseInterval: (text: string) => number | undefined;
-interface CronFields {
-    minutes: Set<number>;
-    hours: Set<number>;
-    daysOfMonth: Set<number>;
-    months: Set<number>;
-    daysOfWeek: Set<number>;
-    /**
-     * Whether the day fields were written as anything but `*`. Standard cron
-     * semantics: when BOTH are restricted, a day matches if EITHER does —
-     * `0 0 1 * 1` is "the 1st, and every Monday", not "the 1st when it is a
-     * Monday".
-     */
-    domRestricted: boolean;
-    dowRestricted: boolean;
-}
-/**
- * Five fields — minute, hour, day-of-month, month, day-of-week — with `*`,
- * lists, ranges, and steps. Numbers only; day-of-week 0-7 with both 0 and 7
- * as Sunday. Evaluated in the daemon's local time, which is what "every
- * morning at 7" means to the person whose machine it is.
- */
-export declare const parseCronExpression: (expression: string) => CronFields;
-/**
- * The slot after `after`, or undefined when there is none — a one-shot
- * already past, or a cron expression that matches no real date. One
- * implementation, because the scheduler advancing a fired slot and the
- * creation path computing the first one must never disagree.
- */
-export declare const nextFireAfter: (cadence: ScheduleCadence, after: Date) => Date | undefined;
-/** One line for a human: `every 30m`, `cron 0 7 * * *`, `once at 2026-…`. */
-export declare const describeCadence: (cadence: ScheduleCadence) => string;
-/**
- * Metadata a firing's session carries. The schedule id is what the
- * permission carve-out resolves the approved destination from, and
- * `scheduled: true` is what lets a renderer say a turn arrived from a
- * schedule rather than a person.
- */
-export declare const SCHEDULE_ID_METADATA_KEY = "scheduleId";
-export declare const SCHEDULED_TURN_METADATA_KEY = "scheduled";
-export declare const SCHEDULE_EVERY_TOOL_NAME = "schedule.every";
-export declare const SCHEDULE_AT_TOOL_NAME = "schedule.at";
-export declare const SCHEDULE_LIST_TOOL_NAME = "schedule.list";
-export declare const SCHEDULE_CANCEL_TOOL_NAME = "schedule.cancel";
-export declare const MESSAGE_SEND_TOOL_NAME = "message.send";
-/**
- * The tools only a running gateway registers. Each needs the dispatcher,
- * the store, or the channels, and nothing else in the tree has them — so a
- * soul naming one is correct while a host without them cannot call it,
- * which is a different thing from a name that does not exist. `stratus
- * run` reads this to say which it is rather than reporting a daemon soul's
- * `schedule.*` as a typo.
- *
- * It lives here, with the names, rather than in `@stratusagent/gateway`
- * where the registrations are: the CLI imports the gateway only through
- * `await import`, because `bin.ts` has to load the CLI to print the Node
- * version message and the gateway pulls in `node:sqlite` at module scope.
- * A static import for a list of strings would have made the floor guard
- * fail with the exact builtin-module error it exists to replace. The
- * gateway's own test pins this set against what it actually registers,
- * which holds the two together better than proximity would.
- */
-export declare const GATEWAY_ONLY_TOOL_NAMES: readonly string[];
-export interface ScheduleCreateInput {
-    agentId: string;
-    cadence: ScheduleCadence;
-    prompt: string;
-    destination?: ScheduleDestination;
-    /** The session whose turn asked, for the audit trail. */
-    createdBy?: string;
-    /** That session's trust label at the time — see `ScheduleRecord.trust`. */
-    trust?: TrustLevel;
-}
-/**
- * The gateway-supplied handle the schedule tools close over — the same
- * pattern as `agent.delegate`'s dispatcher, because the scheduler needs the
- * store, the roster, and the channels, and none of those are this package's
- * to hold. `create` owns every refusal that needs daemon knowledge: the
- * interval floor, and a destination the agent's channel cannot address —
- * checked NOW, while a person is present to hear why, not at 6am.
- */
-export interface SchedulerHandle {
-    create(input: ScheduleCreateInput): Promise<ScheduleRecord>;
-    list(agentId: string): Promise<ScheduleRecord[]>;
-    /** True when a schedule of this agent's was cancelled; false when nothing matched. */
-    cancel(agentId: string, scheduleId: string): Promise<boolean>;
-}
-/**
- * One schedule as a surface shows it — the CLI table, the control API's
- * listing, and the tool results all render this one projection, so the
- * operator's view and the agent's cannot drift.
- */
-export declare const describeSchedule: (record: ScheduleRecord) => JsonObject;
-/**
- * The four `schedule.*` tools over one handle.
- *
- * Risk is split per tool, not per toolset: creating a schedule spends
- * future money unattended and (with a destination) mints a standing
- * permission to speak, so `schedule.every` and `schedule.at` are `gated` —
- * the approval of THAT call is the human decision the whole step leans on.
- * `schedule.list` is a read, and `schedule.cancel` only ever narrows
- * authority — it is the reversal the risk note in the spec names — so both
- * are `safe`: a headless agent that set a bad schedule must be able to
- * undo it without waiting for the human whose absence is the problem.
- */
-export declare const createScheduleTools: (scheduler: SchedulerHandle) => Tool[];
-/**
- * Delivers one outbound message through the agent's channel. The gateway
- * implements it over the channel contract's `resolveOutbound`; rejecting is
- * the way to say a destination cannot be served.
- */
-export type OutboundMessenger = (input: {
-    agentId: string;
-    destination: ScheduleDestination;
-    text: string;
-}) => Promise<void>;
-/**
- * Post to a channel or DM outside the current conversation — what makes a
- * scheduled turn observable.
- *
- * `gated`, and deliberately not `safe` the way `agent.delegate` is: the
- * delegate stays inside the fleet, under every per-agent allowlist and the
- * same approval policy, while this speaks to people who did not ask. The
- * unattended path is the schedule carve-out — `destinationFor` names where
- * this call would speak, and the policy allows it exactly when the firing's
- * schedule was approved with that destination.
- */
-export declare const createMessageSendTool: (send: OutboundMessenger) => Tool;
-export {};
+export { AVATAR_STYLE, generateAgentName, generateAvatarTheme, AGENT_ID_PATTERN, MAX_AGENT_ID_LENGTH, isValidAgentId, isValidDelegateEntry, MAX_SESSION_ID_LENGTH, isValidSessionId, agentIdWithSuffix, } from './identity.ts';
+export { type DefineAgentInput, defineAgent } from './define.ts';
+export { isDelegateAllowed, type ParsedSoul, type ParseSoulOptions, parseSoul, formatSoul, } from './soul.ts';
+export { SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, isLoadableSkillId, SKILL_ID_RULE, SKILL_DESCRIPTION_MAX_LENGTH, SKILL_COMPATIBILITY_MAX_LENGTH, type ParsedSkillDocument, parseSkillDocument, type ValidateSkillDocumentOptions, type SkillValidation, validateSkillDocument, type LazySkillInput, createLazySkill, } from './skills.ts';
+export { type ScheduleDestination, canonicalDestination, type ScheduleCadence, type ScheduleRecord, parseInterval, parseCronExpression, nextFireAfter, describeCadence, SCHEDULE_ID_METADATA_KEY, SCHEDULED_TURN_METADATA_KEY, type ScheduleCreateInput, type SchedulerHandle, describeSchedule, } from './schedules.ts';
+export { type AgentRouteRule, type AgentRouter, createAgentRouter, createAgentTeam, } from './router.ts';
+export { MEMORY_TOOL_NAME, createRememberTool, RECALL_TOOL_NAME, createRecallTool, FORGET_TOOL_NAME, createForgetTool, PIN_TOOL_NAME, createPinTool, type MemoryToolOptions, } from './tools/memory.ts';
+export { DELEGATE_TOOL_NAME, DELEGATED_BY_METADATA_KEY, ROOT_SESSION_ID_METADATA_KEY, DELEGATION_DEPTH_METADATA_KEY, DELEGATED_SESSION_ID_MARKER, isDelegatedSession, delegatingSessionIdOf, outstandingDelegationFor, withoutDelegation, type DelegateDispatch, type DelegateToolOptions, createDelegateTool, } from './tools/delegate.ts';
+export { SCHEDULE_EVERY_TOOL_NAME, SCHEDULE_AT_TOOL_NAME, SCHEDULE_LIST_TOOL_NAME, SCHEDULE_CANCEL_TOOL_NAME, createScheduleTools, } from './tools/schedule.ts';
+export { MESSAGE_SEND_TOOL_NAME, type OutboundMessenger, createMessageSendTool, } from './tools/message.ts';
+export { GATEWAY_ONLY_TOOL_NAMES } from './tools/gateway-only.ts';
 //# sourceMappingURL=index.d.ts.map