@tangle-network/agent-app 0.45.53 → 0.45.55

package/dist/attachment-validation-BfJDBU1g.d.ts

@@ -1,261 +0,0 @@
-import { F as FileMention } from './wire-DOZ-O6hD.js';
-
-/**
- * `createSandboxFileIndexRoute` — server side of `@`-file-mentions
- * (companion to sandbox-ui#184's composer mention primitive). Serves a flat,
- * ignore-filtered listing of the workspace sandbox so `useFileMentions`
- * (`/web-react`) can filter it client-side without a round trip per
- * keystroke.
- *
- * Same seam style as `createUploadRoute`: `authorize({ request })` resolves a
- * structural `{ tree(path, opts) }` handle (the shape of the sandbox SDK's
- * `box.fs.tree`) — no SDK import here. `authorize` also carries the
- * cold-box signal: a sandbox that isn't running yet answers `{ status:
- * 'warming' }` directly, never provisions-and-waits inside this route.
- *
- * A box can also be running with its workspace root not yet materialised, which
- * `authorize` cannot see; the route recognises that one signal off `fs.tree`
- * and answers `warming` too, so every consumer gets the retry-and-wait state
- * instead of a 500. Every other `tree()` failure propagates.
- */
-
-/** One entry from a structural `tree()` scan. Mirrors the sandbox SDK's
- *  `FileTreeFile` (`path`, `size`, `mtime`) — `mtime` is unused here so it's
- *  omitted from the structural match. */
-interface SandboxTreeFile {
-    path: string;
-    size: number;
-}
-/** Structural match of the sandbox SDK's `box.fs.tree` result shape
- *  (`FileTreeResult`). `stats.truncated` is the only stat this route reads;
- *  the rest ride through unread on the real SDK type. */
-interface SandboxTreeResult {
-    root: string;
-    files: SandboxTreeFile[];
-    stats: {
-        truncated: boolean;
-    };
-}
-/** Structural match of the sandbox SDK's `box.fs` tree surface. */
-interface SandboxFileTreeSource {
-    tree(path: string, options?: {
-        maxDepth?: number;
-    }): Promise<SandboxTreeResult>;
-}
-/** Describe a ready file index response with workspace-relative entries and truncation status */
-interface FileIndexReadyResponse {
-    status: 'ready';
-    /** Workspace-relative entries. Same shape as `FileMention` (`./wire`) so a
-     *  client can hand a response entry straight to `fileMentionsToParts` /
-     *  `buildMentionPromptBlock` without remapping. */
-    files: FileMention[];
-    /** True when either the underlying scan truncated (SDK-side cap) or this
-     *  route's own `maxEntries` cap trimmed the filtered list. The client
-     *  should show "showing first N files" rather than imply completeness. */
-    truncated: boolean;
-    generatedAt: string;
-}
-/** Cold-box answer: no provisioning happened, no files were scanned. The
- *  client shows a warming state and retries — this route never blocks on a
- *  box coming up. Two situations produce it: `authorize` reporting a box that
- *  is not running, and a running box whose workspace root does not exist yet
- *  (see `isMissingRootError`). */
-interface FileIndexWarmingResponse {
-    status: 'warming';
-}
-/** Resolve a response indicating the file index is either ready or warming up */
-type FileIndexResponse = FileIndexReadyResponse | FileIndexWarmingResponse;
-/** Short-TTL cache seam so repeat popover opens in the same session don't
- *  re-scan the workspace. Host-provided (e.g. a KV binding); `key` is
- *  whatever `authorize` returns as `cacheKey` — this route treats it opaquely. */
-interface FileIndexCache {
-    get(key: string): Promise<FileIndexReadyResponse | null> | FileIndexReadyResponse | null;
-    put(key: string, value: FileIndexReadyResponse, options?: {
-        ttlSeconds?: number;
-    }): Promise<void> | void;
-}
-/** Define authorization details and parameters for indexing a file workspace with optional caching and ignore rules */
-type FileIndexAuthorization = {
-    status: 'ready';
-    /** Structural sandbox `fs` handle, usually `ensureWorkspaceSandbox(...)` → `box.fs`. */
-    fs: SandboxFileTreeSource;
-    /** Workspace root to index (e.g. `/home/agent`). */
-    root: string;
-    /** Extra ignore segments for this request, merged with the route's
-     *  defaults + `CreateSandboxFileIndexRouteOptions.ignore`. */
-    ignore?: string[];
-    /** Opaque cache key for the optional cache seam. Omit to skip caching
-     *  for this request (e.g. a workspace the host chooses not to cache). */
-    cacheKey?: string;
-} | {
-    status: 'warming';
-} | {
-    status: 'denied';
-    response: Response;
-};
-/** Define options to authorize and configure sandbox file index route behavior */
-interface CreateSandboxFileIndexRouteOptions {
-    /** Authenticate the caller, resolve the sandbox `fs` handle, and signal a
-     *  cold box — never provisions or waits. */
-    authorize(args: {
-        request: Request;
-    }): Promise<FileIndexAuthorization>;
-    /** Extra ignore segments beyond the route's defaults (node_modules, .git,
-     *  dotfiles/dot-dirs, common build dirs). Matched as exact path-segment
-     *  names, same rule as the defaults. */
-    ignore?: string[];
-    /** Passed to `fs.tree` as `options.maxDepth`. Default 12. */
-    maxDepth?: number;
-    /** Hard cap on entries returned after filtering. Default 5000. */
-    maxEntries?: number;
-    /** Optional host-provided cache seam. */
-    cache?: FileIndexCache;
-    /** Cache TTL in seconds when `cache` is set. Default 20. */
-    cacheTtlSeconds?: number;
-}
-/** Resolve a sandbox file index route with authorization, caching, and configurable depth and entries limits */
-declare function createSandboxFileIndexRoute(options: CreateSandboxFileIndexRouteOptions): (request: Request) => Promise<Response>;
-
-/**
- * Content-based binary/text classification, shared by the attachment upload
- * route (server) and the composer's client-side pre-validation (browser) —
- * both sides must agree on what counts as binary before a byte ever leaves
- * the client. Extension-based allowlists lie (a renamed `.docx`, a PNG saved
- * as `.txt`), so classification reads the actual bytes: a magic-byte table
- * for common binary formats first, then a UTF-8 decode attempt for
- * everything else. Two families need more than a fixed-offset signature and
- * get a reader of their own — ISO-BMFF brands (`sniffFtyp`) and OOXML Office
- * packages, whose PKZIP container is shared with every other `.zip`
- * (`sniffOoxml`).
- *
- * Lifted near-verbatim from gtm-agent's `src/lib/binary-sniff.ts` (the
- * source PRs hardened this against real corruption/gate bugs: gtm#584,
- * gtm#592). Import-free by design — `/web-react` re-exports `/chat-routes`
- * modules into browser bundles (`tests/browser-safe-subpaths.test.ts` walks
- * the graph), so nothing here may reach a Node builtin or an engine package.
- */
-interface SniffResult {
-    binary: boolean;
-    mime: string | null;
-}
-/** Sniffed mime for a Word OOXML package (`.docx`). */
-declare const OOXML_WORD_MIME = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
-/** Sniffed mime for an Excel OOXML package (`.xlsx`). */
-declare const OOXML_SPREADSHEET_MIME = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
-/** Sniffed mime for a PowerPoint OOXML package (`.pptx`). */
-declare const OOXML_PRESENTATION_MIME = "application/vnd.openxmlformats-officedocument.presentationml.presentation";
-/** Sniffed mime for a macro-enabled Word package (`.docm`). Reported
- *  separately from {@link OOXML_WORD_MIME} so a package carrying a VBA project
- *  can never be admitted under the plain-document mime: a route that wants
- *  macro-enabled files opts in explicitly through its allowed-mime seam. */
-declare const OOXML_WORD_MACRO_ENABLED_MIME = "application/vnd.ms-word.document.macroEnabled.12";
-/** Sniffed mime for a macro-enabled Excel package (`.xlsm`). */
-declare const OOXML_SPREADSHEET_MACRO_ENABLED_MIME = "application/vnd.ms-excel.sheet.macroEnabled.12";
-/** Sniffed mime for a macro-enabled PowerPoint package (`.pptm`). */
-declare const OOXML_PRESENTATION_MACRO_ENABLED_MIME = "application/vnd.ms-powerpoint.presentation.macroEnabled.12";
-/** Decide whether uploaded bytes are binary or text, and identify the mime
- *  type when it can be determined from content. Magic bytes are checked
- *  first; anything unmatched falls back to a fatal UTF-8 decode. A NUL byte
- *  or a decode failure means binary. Valid UTF-8 that is an SVG document is
- *  binary (byte-identity matters for image tooling). Content that matches
- *  nothing and does not decode as text is binary with an unknown mime —
- *  extension-based guessing happens at the call site, not here. */
-declare function sniffBinary(bytes: Uint8Array): SniffResult;
-
-/**
- * Shared attachment validation core — constants, type-gate, and filename
- * sanitization used by BOTH the (server) attachment upload route and the
- * (browser) composer's client-side pre-validation, so a rejection never
- * differs depending on which side classified the bytes first.
- *
- * ≈ gtm-agent's `src/lib/attachment-limits.ts`, minus what agent-app already
- * has (`ATTACHMENT_MAX_COUNT`/`MAX_ATTACHMENT_TOTAL_BYTES`/
- * `attachmentTotalSizeErrorMessage` lived in `./resolve-attachments` and are
- * re-homed here so the whole validation vocabulary — count cap, size caps,
- * and type gate — has one address). Import-free besides `./wire`
- * (`formatBytes`) and `./binary-sniff` (`SniffResult`): `/web-react`
- * re-exports `/chat-routes` modules into browser bundles
- * (`tests/browser-safe-subpaths.test.ts` walks the graph), so nothing here
- * may reach a Node builtin or an engine package.
- */
-
-/** Ceiling on a binary attachment's raw (pre-encoding) byte size. */
-declare const MAX_BINARY_ATTACHMENT_BYTES: number;
-/** Ceiling on a text attachment's raw byte size. Text hydrates through
- *  inline prompt parts, a separate path that remains proxy-capped (see
- *  `INLINE_PARTS_MAX_BYTES` in `./wire`). */
-declare const MAX_TEXT_ATTACHMENT_BYTES: number;
-/** Most files a single request may carry: the composer staging cap, the
- *  upload route's per-request cap, and the chat body's `attachments` cap. */
-declare const ATTACHMENT_MAX_COUNT = 10;
-/** Aggregate raw-byte ceiling across one message's attachments. */
-declare const MAX_ATTACHMENT_TOTAL_BYTES: number;
-/**
- * Accept list for the composer file picker + type validation, same grammar as
- * the native `<input accept>` attribute. Images plus the text/doc types a
- * product's store actually reads.
- *
- * Every extension here is one the default {@link ALLOWED_ATTACHMENT_SNIFFED_MIMES}
- * actually admits — a picker that offers a format the gate then rejects is a
- * defect, so `tests/chat-routes/attachment-validation.test.ts` walks this
- * string and proves each entry uploads.
- */
-declare const ATTACHMENT_ACCEPT = "image/*,.pdf,.docx,.xlsx,.pptx,.txt,.md,.csv,.json,.yaml,.yml,.html";
-/** The Office (OOXML) package mimes the default allow-list admits — the
- *  formats professionals actually send: Word contracts, Excel workpapers,
- *  PowerPoint decks. Admitting the format is a gate decision only; whether a
- *  product can EXTRACT text from one is that product's concern. */
-declare const OOXML_SNIFFED_MIMES: ReadonlySet<string>;
-/** Macro-enabled Office package mimes (`.docm`/`.xlsm`/`.pptm`), reported by
- *  `sniffBinary` but deliberately NOT in the default allow-list: a package
- *  carrying a VBA project is a different risk decision than a plain document,
- *  and it is the product's to make. Opt in by widening the allow-list at the
- *  route's `allowedSniffedMimes` seam:
- *  `new Set([...ALLOWED_ATTACHMENT_SNIFFED_MIMES, ...MACRO_ENABLED_OOXML_SNIFFED_MIMES])`. */
-declare const MACRO_ENABLED_OOXML_SNIFFED_MIMES: ReadonlySet<string>;
-/** Sniffed-mime counterpart of `ATTACHMENT_ACCEPT`: the binary formats
- *  `sniffBinary` can identify from content among the accepted types.
- *  Values must match `sniffBinary`'s output strings verbatim, or every
- *  upload of that format fails the type gate — locked by the round-trip test
- *  that sniffs real bytes of every mime listed here. */
-declare const ALLOWED_ATTACHMENT_SNIFFED_MIMES: ReadonlySet<string>;
-/** Represent the result of checking an attachment's type with success or specific failure details */
-type AttachmentTypeCheckResult = {
-    succeeded: true;
-} | {
-    succeeded: false;
-    code: 'attachment_type_mismatch' | 'attachment_type_not_allowed';
-    message: string;
-};
-/**
- * Cross-check a filename's extension against its sniffed content.
- *
- * Text content (`sniff.binary === false`) always passes here — it has no
- * magic bytes to compare, so it rides the existing UTF-8 gate instead. For
- * binary content: an extension with an unambiguous magic-byte family (e.g.
- * `.pdf`) must match the sniffed mime, or the upload is a mismatch (a
- * renamed file). Otherwise the sniffed mime must be one of `allowed`
- * (default {@link ALLOWED_ATTACHMENT_SNIFFED_MIMES}), or the upload is
- * rejected outright. The `allowed` param feeds a route's override seam (a
- * product accepting a narrower or wider set than the default).
- */
-declare function checkAttachmentType(fileName: string, sniff: SniffResult, allowed?: ReadonlySet<string>): AttachmentTypeCheckResult;
-/**
- * Rewrite a filename into the store-path charset (`A-Za-z0-9._-` per
- * segment) — attachment paths double as store keys, sandbox file paths, and
- * in-message path references, none of which tolerate spaces or punctuation.
- * Runs of unsupported characters collapse to one `-`; leading dots/dashes are
- * stripped so the name can't read as a hidden segment. The original name is
- * preserved separately (the returned `ChatAttachmentInput.name`), so
- * sanitization loses nothing.
- */
-declare function sanitizeAttachmentFileName(name: string): string;
-/** Human-readable error naming both the actual size and the limit that was
- *  exceeded. Shared so the server route and the composer pre-check report
- *  the same message shape. */
-declare function attachmentSizeErrorMessage(name: string, actualBytes: number, limitBytes: number): string;
-/** Human-readable error for a chat message whose combined attachments exceed
- *  the aggregate raw-byte ceiling. */
-declare function attachmentTotalSizeErrorMessage(totalBytes: number, limitBytes: number): string;
-
-export { ALLOWED_ATTACHMENT_SNIFFED_MIMES as A, type CreateSandboxFileIndexRouteOptions as C, type FileIndexAuthorization as F, MACRO_ENABLED_OOXML_SNIFFED_MIMES as M, OOXML_PRESENTATION_MACRO_ENABLED_MIME as O, type SandboxFileTreeSource as S, ATTACHMENT_ACCEPT as a, ATTACHMENT_MAX_COUNT as b, type AttachmentTypeCheckResult as c, type FileIndexCache as d, type FileIndexReadyResponse as e, type FileIndexResponse as f, type FileIndexWarmingResponse as g, MAX_ATTACHMENT_TOTAL_BYTES as h, MAX_BINARY_ATTACHMENT_BYTES as i, MAX_TEXT_ATTACHMENT_BYTES as j, OOXML_PRESENTATION_MIME as k, OOXML_SNIFFED_MIMES as l, OOXML_SPREADSHEET_MACRO_ENABLED_MIME as m, OOXML_SPREADSHEET_MIME as n, OOXML_WORD_MACRO_ENABLED_MIME as o, OOXML_WORD_MIME as p, type SandboxTreeFile as q, type SandboxTreeResult as r, type SniffResult as s, attachmentSizeErrorMessage as t, attachmentTotalSizeErrorMessage as u, checkAttachmentType as v, createSandboxFileIndexRoute as w, sanitizeAttachmentFileName as x, sniffBinary as y };

package/dist/budget-BOucfcb_.d.ts

@@ -1,142 +0,0 @@
-import { AgentProfile } from '@tangle-network/agent-interface';
-
-/**
- * Profile fingerprinting — prove WHICH profile a turn actually executed.
- *
- * The backtest invariant this exists to enforce: an eval's score is only worth
- * publishing if the benchmarked profile IS the shipped profile. The failure
- * mode is structural, not hypothetical — a product's eval composed the
- * production profile in one module, executed a hand-rolled stub in another,
- * and stamped the composed profile's identity onto the stub's scorecard.
- * Nothing compared the two, so nothing could notice.
- *
- * A `ProfileFingerprint` is a channelled identity of the profile handed to the
- * sandbox SDK: the system-prompt digest plus the names of every capability
- * surface (MCP servers, subagents, file mounts, hub connections) and the
- * model/harness the turn dispatched at. It is deliberately NOT a byte-exhaustive
- * serialization — channels are what drift in practice, and a channelled diff
- * names the surface that moved instead of reporting "bytes differ".
- *
- * The write half of the seam is `StreamSandboxPromptOptions.onProfileResolved`
- * (`/sandbox`): the one place the final profile exists is inside
- * `streamSandboxPrompt` after the system-prompt override, the MCP merge, and
- * reasoning-effort attachment, so that is where the fingerprint is taken. A
- * caller re-deriving a profile to fingerprint it would reintroduce the exact
- * gap this closes.
- */
-
-/** The dispatch context a profile cannot see but a turn's identity includes. */
-interface ProfileFingerprintContext {
-    model?: string;
-    harness?: string;
-}
-/** Channelled identity of one executed (or composed) profile. */
-interface ProfileFingerprint {
-    /** sha256 over every channel below — one value to log/compare. */
-    hash: string;
-    /** sha256 of `prompt.systemPrompt` ('' when absent). */
-    promptSha: string;
-    /** UTF-8 byte length of `prompt.systemPrompt`. */
-    promptBytes: number;
-    /** Sorted MCP server keys. */
-    mcpKeys: string[];
-    /** Sorted subagent names. */
-    subagentNames: string[];
-    /** Sorted `resources.files[].path` mounts. */
-    fileMountPaths: string[];
-    /** Sorted hub connection ids (alias-qualified when present). */
-    connectionIds: string[];
-    model?: string;
-    harness?: string;
-}
-/** Fingerprint a profile as the SDK would receive it. */
-declare function fingerprintAgentProfile(profile: AgentProfile, context?: ProfileFingerprintContext): Promise<ProfileFingerprint>;
-/** One drifted channel between two fingerprints, rendered as comparable strings. */
-interface ProfileDriftEntry {
-    channel: 'promptSha' | 'promptBytes' | 'mcpKeys' | 'subagentNames' | 'fileMountPaths' | 'connectionIds' | 'model' | 'harness';
-    a: string;
-    b: string;
-}
-interface ProfileDrift {
-    equal: boolean;
-    drift: ProfileDriftEntry[];
-}
-/** Channel-by-channel comparison of two fingerprints. */
-declare function diffProfileFingerprints(a: ProfileFingerprint, b: ProfileFingerprint): ProfileDrift;
-/** Human-readable drift report; exactly 'profiles identical' when equal. */
-declare function formatProfileDrift(drift: ProfileDrift): string;
-
-/**
- * The composed-system-prompt byte budget, split out of `./index` so it imports
- * NOTHING.
- *
- * `./index` pulls `@tangle-network/agent-eval` (the evolvable-section seam), so
- * `/sandbox` — which has no agent-eval import and must not gain one — could not
- * enforce the budget from there. The gate is the same function either way; only
- * its module home moved. `./index` re-exports every symbol below, so the
- * published `/profile` surface is byte-identical.
- *
- * Why the gate belongs at more than one call site: `composeAgentProfile` is
- * OPT-IN. A product may hand-build its `AgentProfile`, and one does —
- * creative-agent's create-time profile is deliberately minimal and its full
- * system prompt rides the PER-TURN backend (`buildPromptBackend`), which never
- * touches the composer. `/sandbox` therefore runs this gate at the three points
- * where the profile that actually executes exists.
- */
-/** Byte budget on the FINAL composed `prompt.systemPrompt`. Past this the
- *  model degrades sharply (a 122,659-byte prompt shipped once and the model
- *  returned empty answers), so the default gate throws well before that. */
-declare const DEFAULT_MAX_SYSTEM_PROMPT_BYTES = 40000;
-/** Budget config for the composed system prompt. */
-interface ComposeProfileBudget {
-    /** Byte cap on the composed `prompt.systemPrompt`.
-     *  Default {@link DEFAULT_MAX_SYSTEM_PROMPT_BYTES}. */
-    maxSystemPromptBytes?: number;
-    /** Downgrade the over-budget throw to a `console.warn` — the escape hatch
-     *  for a product with a known-big prompt that must still ship (it yells on
-     *  every compose instead of blocking). */
-    warnOnly?: boolean;
-    /** Required to raise {@link maxSystemPromptBytes} above
-     *  {@link DEFAULT_MAX_SYSTEM_PROMPT_BYTES} or to set {@link warnOnly}: a
-     *  written reason naming what stays inline and why it cannot be mounted.
-     *  Weakening the cap is a product decision that outlives the person making
-     *  it, and the usual cause is reference material concatenated into the prompt
-     *  that belongs in `resources.files`; demanding the sentence here keeps that
-     *  from happening by accident. */
-    overBudgetReason?: string;
-}
-/** Largest markdown-heading-delimited sections of a prompt, by UTF-8 bytes.
- *  Cheap heuristic: split on `#`-heading lines; the preamble before the first
- *  heading reports as "(preamble)". */
-declare function largestPromptSections(prompt: string, top?: number): Array<{
-    title: string;
-    bytes: number;
-}>;
-/** Enforce {@link ComposeProfileBudget} on a composed system prompt: over
- *  budget throws (or warns with `warnOnly`) with the actual size and the
- *  top-3 largest sections. Exported so a product assembling its prompt
- *  outside `composeAgentProfile` (e.g. via the `/prompt` assembler) can
- *  run the same gate at its own final-composition point. */
-declare function assertSystemPromptWithinBudget(systemPrompt: string, budget?: ComposeProfileBudget, 
-/** Prefixed to the message so a throw from a turn/provision choke point says
- *  WHERE it fired — "composed systemPrompt" alone reads like a compose-time
- *  error even when it fired on `driveSandboxTurn`. */
-origin?: string): void;
-/** Run {@link assertSystemPromptWithinBudget} over a profile-shaped object's
- *  `prompt.systemPrompt`. Structural on purpose: `/sandbox` calls this on the
- *  SDK's `AgentProfile` and on the product-supplied seam result without either
- *  module importing the other's types. A profile with no string systemPrompt
- *  is a no-op — there is nothing to measure.
- *
- *  The `hint` exists because this gate can fire on a product that ALREADY made
- *  a deliberate budget decision somewhere else. gtm-agent composes with
- *  `{ maxSystemPromptBytes: 50_000 }`; without the hint, the shell's 40 KB
- *  default reads as the gate contradicting a choice the product already made
- *  rather than as "declare the same number here too". */
-declare function assertProfilePromptWithinBudget(profile: {
-    prompt?: {
-        systemPrompt?: unknown;
-    };
-} | undefined, budget?: ComposeProfileBudget, origin?: string, hint?: string): void;
-
-export { type ComposeProfileBudget as C, DEFAULT_MAX_SYSTEM_PROMPT_BYTES as D, type ProfileDrift as P, type ProfileDriftEntry as a, type ProfileFingerprint as b, type ProfileFingerprintContext as c, assertProfilePromptWithinBudget as d, assertSystemPromptWithinBudget as e, diffProfileFingerprints as f, fingerprintAgentProfile as g, formatProfileDrift as h, largestPromptSections as l };

package/dist/values-C7RidJuI.d.ts

@@ -1,156 +0,0 @@
-/**
- * Splitting an assistant message into prose and agent-authored UI.
- *
- * An agent emits a page by fencing it as ```` ```openui ```` in its reply (the
- * inline path) or by calling `render_ui` (the persisted-artifact path). Every
- * product that renders the inline path had forked the same scanner into its own
- * chat-message body; this is that scanner, once, with no React and no renderer
- * import — the node union stays owned by `@tangle-network/ui`'s `./openui`.
- */
-/**
- * The narrowest thing a host can assert about a parsed node: it names a type.
- * A renderer's node union satisfies this, so
- * `parseOpenUISegments<OpenUIComponentNode>(text)` hands typed nodes straight
- * to the renderer with no cast at the call site.
- */
-interface OpenUINode {
-    type: string;
-    id?: string;
-}
-/** One piece of an assistant message: prose, or a page to render. */
-type OpenUISegment<TNode extends OpenUINode = OpenUINode> = {
-    type: 'markdown';
-    text: string;
-} | {
-    type: 'openui';
-    nodes: TNode[];
-};
-/**
- * Split message content into markdown and OpenUI segments, in source order.
- *
- * A fence whose body is not JSON, or whose JSON carries no node at all, is
- * returned as a fenced `json` markdown segment rather than an empty page: the
- * content is still streaming, or the agent wrote something malformed, and both
- * cases are better shown than swallowed into a blank card.
- *
- * The type argument is the caller's assertion about the node union it will
- * render; this function checks only that each node names a `type`, and the
- * renderer rejects types it does not know.
- */
-declare function parseOpenUISegments<TNode extends OpenUINode = OpenUINode>(content: string): Array<OpenUISegment<TNode>>;
-/** Whether a message carries any agent-authored page at all. */
-declare function hasOpenUISegment(content: string): boolean;
-/** A page read back out of the vault, and its title when one was stored. */
-interface OpenUIArtifact<TNode extends OpenUINode = OpenUINode> {
-    title?: string;
-    nodes: TNode[];
-}
-/** Why a stored page could not be read. */
-interface OpenUIArtifactError {
-    code: 'artifact_not_json' | 'artifact_no_nodes';
-    message: string;
-}
-/** Reading a stored page either produces nodes or says why it did not. */
-type OpenUIArtifactResult<TNode extends OpenUINode = OpenUINode> = {
-    succeeded: true;
-    value: OpenUIArtifact<TNode>;
-} | {
-    succeeded: false;
-    error: OpenUIArtifactError;
-};
-/**
- * Read a `render_ui` artifact back out of the vault.
- *
- * Two shapes are in the wild and a product cannot tell them apart from the
- * path: the bare node tree that `preset-cloudflare`'s handler writes
- * (`JSON.stringify(args.schema)`), and the `{ title, schema }` envelope some
- * products write themselves. Reading only one of them renders an empty panel
- * for the other, with nothing on screen to say why — so this reads both and
- * fails loud when it is neither.
- */
-declare function parseOpenUIArtifact<TNode extends OpenUINode = OpenUINode>(content: string): OpenUIArtifactResult<TNode>;
-
-/**
- * The value half of an interactive OpenUI page: what a field holds, and whether
- * a submitted set of field values matches the form the agent authored.
- *
- * The NODE vocabulary (which fields exist, how they render) has one owner —
- * `@tangle-network/ui`'s `./openui` entry. This module does not restate it. It
- * declares the narrowest STRUCTURAL port a host needs to check a submission:
- * the field's id, its kind, and the constraints that make a value legal. A
- * renderer's richer node type satisfies this port by assignment, so the two
- * packages stay in step without either importing the other.
- */
-/** A value one OpenUI field can hold. `string[]` is a multi-select. */
-type OpenUIValue = string | number | boolean | string[];
-/** Submitted field values, keyed by field id. */
-type OpenUIFormValues = Record<string, OpenUIValue>;
-/**
- * Field ids the host will accept: identifier-safe, and never a key that would
- * reach `Object.prototype`. A submission arrives from a browser and is used to
- * index an object, so this is a boundary check, not a style rule.
- */
-declare function isSafeOpenUIFieldId(id: string): boolean;
-/** The input kinds a form field can be. */
-type OpenUIFieldKind = 'text' | 'number' | 'currency' | 'select' | 'checkbox' | 'slider';
-/** Whether a string names an input kind this contract knows. */
-declare function isOpenUIFieldKind(kind: string): kind is OpenUIFieldKind;
-/**
- * One field, reduced to what a value check needs. A renderer node carrying
- * labels, placeholders, and layout is assignable to this — the extra
- * presentation properties are simply not read here.
- */
-interface OpenUIFieldSpec {
-    id: string;
-    kind: OpenUIFieldKind;
-    required?: boolean;
-    /** `number` / `currency` / `slider` bounds, inclusive. */
-    min?: number;
-    max?: number;
-    /** Increment `number` / `currency` / `slider` values must land on, measured from `min ?? 0`. */
-    step?: number;
-    /** Longest accepted `text` value. */
-    maxLength?: number;
-    /** Accepted `select` values. */
-    options?: ReadonlyArray<{
-        value: string;
-    }>;
-    /** A `select` that accepts more than one option; its value is a `string[]`. */
-    multiple?: boolean;
-}
-/** A form the host can check a submission against. */
-interface OpenUIFormSpec {
-    id: string;
-    fields: readonly OpenUIFieldSpec[];
-}
-/** Why one field's value was rejected. */
-type OpenUIFieldIssueCode = 'required' | 'type' | 'range' | 'step' | 'option' | 'length' | 'unknown_field' | 'duplicate_field' | 'unsafe_field_id';
-/** One rejected field, named so a card can mark exactly that input. */
-interface OpenUIFieldIssue {
-    fieldId: string;
-    code: OpenUIFieldIssueCode;
-    message: string;
-}
-/** The outcome of checking a submission against a form. */
-type OpenUIFormValidation = {
-    ok: true;
-    values: OpenUIFormValues;
-} | {
-    ok: false;
-    issues: OpenUIFieldIssue[];
-};
-/**
- * Check submitted values against the form the agent authored.
- *
- * Fails loud on both sides of the shape: a value the form never declared is an
- * error (`unknown_field`), not a silently ignored extra, because a host that
- * drops it would act on a form different from the one the user filled in. A
- * `required` field with no value is an error even when the caller simply never
- * sent the key.
- *
- * On success the returned `values` contain only declared fields, in the form's
- * own field order — the object a handler should act on.
- */
-declare function validateOpenUIFormValues(spec: OpenUIFormSpec, values: OpenUIFormValues): OpenUIFormValidation;
-
-export { type OpenUIFormValues as O, type OpenUIFieldIssue as a, type OpenUINode as b, type OpenUIValue as c, type OpenUIFormSpec as d, type OpenUIFieldKind as e, type OpenUIArtifact as f, type OpenUIArtifactError as g, type OpenUIArtifactResult as h, type OpenUIFieldIssueCode as i, type OpenUIFieldSpec as j, type OpenUIFormValidation as k, type OpenUISegment as l, hasOpenUISegment as m, isOpenUIFieldKind as n, isSafeOpenUIFieldId as o, parseOpenUIArtifact as p, parseOpenUISegments as q, validateOpenUIFormValues as v };