@tangle-network/agent-interface 0.10.1 → 0.11.1

package/LICENSE

@@ -1,11 +1,21 @@
-Copyright (c) 2025 Tangle Network
+MIT License
 
-All rights reserved.
+Copyright (c) 2026 Tangle Network
 
-This software and associated documentation files (the "Software") are proprietary
-and confidential. No part of this Software may be reproduced, distributed, or
-transmitted in any form or by any means, including photocopying, recording, or
-other electronic or mechanical methods, without the prior written permission of
-Tangle Network.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-For licensing inquiries, contact: hello@tangle.tools
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,31 @@
+# @tangle-network/agent-interface
+
+Shared TypeScript types and zod schemas that define the contract between Tangle
+agents, the sidecar, and provider adapters: capabilities, agent profiles,
+message parts, and harness descriptors. This is the canonical home for those
+shapes; higher-level packages import from here rather than redefining them.
+
+The only runtime dependency is `zod` (used for the schema exports).
+
+## Install
+
+```bash
+pnpm add @tangle-network/agent-interface
+```
+
+## Usage
+
+```ts
+import type { BackendCapabilities, ProviderCapabilities } from "@tangle-network/agent-interface";
+
+const caps: ProviderCapabilities = {
+  supportsVision: true,
+  supportsLogprobs: false,
+  supportsToolCalls: true,
+  supportsComputerUse: false,
+};
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -214,6 +214,13 @@ export type ToolInvocation = {
     toolName: string;
     input: unknown;
     result?: unknown;
+    /**
+     * True when the tool call failed (errored, timed out, or was rejected).
+     * Failed tools are recorded — not dropped — so the run outcome can reflect
+     * them. Consumers deriving success must treat any `isError: true` invocation
+     * as a failure signal.
+     */
+    isError?: boolean;
 };
 export type TokenUsage = {
     inputTokens: number;
@@ -582,3 +589,5 @@ export * from "./agent-profile.js";
 export * from "./harness.js";
 export * from "./harness-capabilities.js";
 export * from "./profile-schema.js";
+export * from "./profile-security.js";
+export * from "./sandbox-size.js";

package/dist/index.js

@@ -126,3 +126,5 @@ export * from "./agent-profile.js";
 export * from "./harness.js";
 export * from "./harness-capabilities.js";
 export * from "./profile-schema.js";
+export * from "./profile-security.js";
+export * from "./sandbox-size.js";

package/dist/profile-schema.d.ts

@@ -1,17 +1,19 @@
 import { z } from "zod";
+import type { AgentProfile } from "./agent-profile.js";
+import { type SandboxSizePreset } from "./sandbox-size.js";
 export declare const agentProfilePermissionValueSchema: z.ZodEnum<{
     allow: "allow";
-    ask: "ask";
     deny: "deny";
+    ask: "ask";
 }>;
 export declare const agentProfilePermissionSchema: z.ZodUnion<readonly [z.ZodEnum<{
     allow: "allow";
-    ask: "ask";
     deny: "deny";
+    ask: "ask";
 }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
     allow: "allow";
-    ask: "ask";
     deny: "deny";
+    ask: "ask";
 }>>]>;
 export declare const agentProfileResourceRefSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"inline">;
@@ -117,10 +119,10 @@ export declare const agentProfileModelHintsSchema: z.ZodObject<{
     small: z.ZodOptional<z.ZodString>;
     provider: z.ZodOptional<z.ZodString>;
     reasoningEffort: z.ZodOptional<z.ZodEnum<{
+        medium: "medium";
         none: "none";
         minimal: "minimal";
         low: "low";
-        medium: "medium";
         high: "high";
         xhigh: "xhigh";
         ultracode: "ultracode";
@@ -138,12 +140,12 @@ export declare const agentSubagentProfileSchema: z.ZodObject<{
     tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
     permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
         allow: "allow";
-        ask: "ask";
         deny: "deny";
+        ask: "ask";
     }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
         allow: "allow";
-        ask: "ask";
         deny: "deny";
+        ask: "ask";
     }>>]>>>;
     maxSteps: z.ZodOptional<z.ZodNumber>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -162,12 +164,12 @@ export declare const agentProfileModeSchema: z.ZodObject<{
     tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
     permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
         allow: "allow";
-        ask: "ask";
         deny: "deny";
+        ask: "ask";
     }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
         allow: "allow";
-        ask: "ask";
         deny: "deny";
+        ask: "ask";
     }>>]>>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
@@ -216,10 +218,10 @@ export declare const agentProfileSchema: z.ZodObject<{
         small: z.ZodOptional<z.ZodString>;
         provider: z.ZodOptional<z.ZodString>;
         reasoningEffort: z.ZodOptional<z.ZodEnum<{
+            medium: "medium";
             none: "none";
             minimal: "minimal";
             low: "low";
-            medium: "medium";
             high: "high";
             xhigh: "xhigh";
             ultracode: "ultracode";
@@ -228,12 +230,12 @@ export declare const agentProfileSchema: z.ZodObject<{
     }, z.core.$strip>>;
     permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
         allow: "allow";
-        ask: "ask";
         deny: "deny";
+        ask: "ask";
     }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
         allow: "allow";
-        ask: "ask";
         deny: "deny";
+        ask: "ask";
     }>>]>>>;
     tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
     mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -263,12 +265,12 @@ export declare const agentProfileSchema: z.ZodObject<{
         tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
         permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
             allow: "allow";
-            ask: "ask";
             deny: "deny";
+            ask: "ask";
         }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
             allow: "allow";
-            ask: "ask";
             deny: "deny";
+            ask: "ask";
         }>>]>>>;
         maxSteps: z.ZodOptional<z.ZodNumber>;
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -360,12 +362,12 @@ export declare const agentProfileSchema: z.ZodObject<{
         tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
         permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
             allow: "allow";
-            ask: "ask";
             deny: "deny";
+            ask: "ask";
         }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
             allow: "allow";
-            ask: "ask";
             deny: "deny";
+            ask: "ask";
         }>>]>>>;
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>>>;
@@ -378,3 +380,24 @@ export declare const agentProfileSchema: z.ZodObject<{
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodUndefined]>>>;
 }, z.core.$strip>;
+/**
+ * A registered capability: a stable id paired with its canonical
+ * {@link AgentProfile}. `definition` is the full profile (prompt/model/tools/
+ * mcp/permissions), so a capability carries the whole agent shape, not just a
+ * system prompt. The platform capability registry validates and stores these.
+ */
+export interface Capability {
+    /** Stable, deterministic id — the key a workflow's `agent.run.profile` names. */
+    id: string;
+    /** The canonical agent profile (prompt/model/tools/mcp/permissions). */
+    definition: AgentProfile;
+    /**
+     * Recommended compute tier for a sandbox running this capability. A dispatcher
+     * uses it as the size DEFAULT when the caller does not pick one — so a
+     * capability that only ever does thin work defaults to a small box instead of
+     * a maxed one. The caller may always override it per dispatch. Omitted → the
+     * dispatcher's own default tier.
+     */
+    recommendedSize?: SandboxSizePreset;
+}
+export declare const capabilitySchema: z.ZodType<Capability>;

package/dist/profile-schema.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { SANDBOX_SIZE_PRESET_NAMES, } from "./sandbox-size.js";
 export const agentProfilePermissionValueSchema = z.enum([
     "allow",
     "deny",
@@ -126,3 +127,8 @@ export const agentProfileSchema = z.object({
 });
 const _agentProfileSchemaMatchesInterface = true;
 void _agentProfileSchemaMatchesInterface;
+export const capabilitySchema = z.object({
+    id: z.string().min(1),
+    definition: agentProfileSchema,
+    recommendedSize: z.enum(SANDBOX_SIZE_PRESET_NAMES).optional(),
+});

package/dist/profile-security.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Security validation for inline {@link AgentProfile} values.
+ *
+ * When a caller sends a full profile inline (rather than naming a curated,
+ * trusted capability), the profile is author-controlled and may declare surfaces
+ * that execute code OUTSIDE the agent's own reasoning — a stdio/local MCP server
+ * (an arbitrary command spawned at startup) or a hook (a shell command run
+ * automatically around the turn). A sandbox isolates the workload, but these
+ * surfaces run unattended on the owner's behalf, so a cloud dispatcher must gate
+ * them before materializing the profile.
+ *
+ * This validates the CANONICAL agent-interface shape (`mcp` keyed by
+ * `AgentProfileMcpServer`, `hooks` keyed by `AgentProfileHookCommand[]`) — the
+ * provider-neutral contract every backend translates from. The opencode-native
+ * `validateProfileSecurity` (in `sdk-provider-opencode`) operates on opencode's
+ * own profile shape and is a different layer; this is the one to use at the
+ * application boundary where profiles are still provider-neutral.
+ */
+import type { AgentProfile, AgentProfileValidationResult } from "./agent-profile.js";
+/** Policy for {@link validateAgentProfileSecurity}. */
+export interface AgentProfileSecurityPolicy {
+    /**
+     * Allow stdio/local MCP servers (a spawned local process). Off in cloud: an
+     * inline profile must not start arbitrary commands at MCP init.
+     */
+    allowLocalMcp: boolean;
+    /**
+     * Allow lifecycle hooks (shell commands run automatically around the turn).
+     * Off in cloud: hooks are author-controlled shell outside the agent's loop.
+     */
+    allowHooks: boolean;
+    /**
+     * Glob allowlist for REMOTE MCP hosts (http/sse `url` hostnames). A set list
+     * rejects any host that matches no pattern; an empty list (`[]`) blocks ALL
+     * remote MCP.
+     *
+     * SECURITY: `undefined` leaves remote MCP hosts UNRESTRICTED — it does NOT
+     * protect against SSRF (an inline profile could point an MCP server at, e.g.,
+     * `http://169.254.169.254/` cloud metadata or an internal address). When this
+     * is `undefined`, the caller MUST enforce SSRF/egress controls at the network
+     * layer, or set a restrictive allowlist (or `[]`) to fail closed.
+     */
+    allowedMcpHosts?: string[];
+    /**
+     * Allow `connections` (hub-managed integration grants). `undefined` leaves them
+     * allowed — a connection is a legitimate inline-profile feature where the host
+     * wires it. A host that does NOT support inline connection grants (e.g. a
+     * surface that grants hub access through a separate, audited path) sets this
+     * `false` so an inline profile cannot smuggle hub access through the profile.
+     */
+    allowConnections?: boolean;
+}
+/**
+ * Default cloud policy: block the two unattended-code surfaces (local MCP,
+ * hooks); leave remote MCP and everything else to the profile. Deliberately
+ * narrow — it gates code execution paths, not the agent's normal tools/edits,
+ * which the sandbox already isolates.
+ *
+ * NOTE: this default leaves `allowedMcpHosts` undefined, so REMOTE MCP hosts are
+ * unrestricted — it is NOT an SSRF guard (see `allowedMcpHosts`). A surface that
+ * must fail closed against arbitrary MCP egress should set `allowedMcpHosts`
+ * (e.g. `[]` to block all remote MCP), as the workflow inline-profile policy does.
+ */
+export declare const DEFAULT_CLOUD_AGENT_PROFILE_SECURITY_POLICY: AgentProfileSecurityPolicy;
+/**
+ * Validate an inline profile against a security policy. Returns `ok: false` with
+ * `error`-level issues when the profile declares a blocked surface; warnings do
+ * not fail. Pure and synchronous — safe to run at author (compile) time and
+ * again at dispatch as defense in depth.
+ */
+export declare function validateAgentProfileSecurity(profile: AgentProfile, policy?: AgentProfileSecurityPolicy): AgentProfileValidationResult;

package/dist/profile-security.js

@@ -0,0 +1,179 @@
+/**
+ * Security validation for inline {@link AgentProfile} values.
+ *
+ * When a caller sends a full profile inline (rather than naming a curated,
+ * trusted capability), the profile is author-controlled and may declare surfaces
+ * that execute code OUTSIDE the agent's own reasoning — a stdio/local MCP server
+ * (an arbitrary command spawned at startup) or a hook (a shell command run
+ * automatically around the turn). A sandbox isolates the workload, but these
+ * surfaces run unattended on the owner's behalf, so a cloud dispatcher must gate
+ * them before materializing the profile.
+ *
+ * This validates the CANONICAL agent-interface shape (`mcp` keyed by
+ * `AgentProfileMcpServer`, `hooks` keyed by `AgentProfileHookCommand[]`) — the
+ * provider-neutral contract every backend translates from. The opencode-native
+ * `validateProfileSecurity` (in `sdk-provider-opencode`) operates on opencode's
+ * own profile shape and is a different layer; this is the one to use at the
+ * application boundary where profiles are still provider-neutral.
+ */
+/**
+ * Default cloud policy: block the two unattended-code surfaces (local MCP,
+ * hooks); leave remote MCP and everything else to the profile. Deliberately
+ * narrow — it gates code execution paths, not the agent's normal tools/edits,
+ * which the sandbox already isolates.
+ *
+ * NOTE: this default leaves `allowedMcpHosts` undefined, so REMOTE MCP hosts are
+ * unrestricted — it is NOT an SSRF guard (see `allowedMcpHosts`). A surface that
+ * must fail closed against arbitrary MCP egress should set `allowedMcpHosts`
+ * (e.g. `[]` to block all remote MCP), as the workflow inline-profile policy does.
+ */
+export const DEFAULT_CLOUD_AGENT_PROFILE_SECURITY_POLICY = {
+    allowLocalMcp: false,
+    allowHooks: false,
+};
+/**
+ * Match one DNS label against one pattern label, where `*` matches any run of
+ * characters WITHIN the label (never a `.`). Split-on-`*` with linear
+ * prefix/suffix/in-order scanning — deliberately NOT a constructed `RegExp`, so
+ * on this security boundary it stays provably linear with no catastrophic-
+ * backtracking surface whatever pattern an allowlist carries.
+ */
+function matchLabel(label, pattern) {
+    const segments = pattern.split("*");
+    if (segments.length === 1)
+        return label === segments[0]; // no wildcard
+    const first = segments[0];
+    const last = segments[segments.length - 1];
+    if (!label.startsWith(first) || !label.endsWith(last))
+        return false;
+    // Prefix and suffix may not overlap (e.g. `aa*aa` must not match `aaa`).
+    if (first.length + last.length > label.length)
+        return false;
+    let cursor = first.length;
+    const suffixStart = label.length - last.length;
+    for (let i = 1; i < segments.length - 1; i += 1) {
+        const seg = segments[i];
+        if (seg.length === 0)
+            continue;
+        const found = label.indexOf(seg, cursor);
+        if (found === -1 || found + seg.length > suffixStart)
+            return false;
+        cursor = found + seg.length;
+    }
+    return true;
+}
+/**
+ * Case-insensitive host glob (`*` only) for allowlists, matched at DNS LABEL
+ * granularity: the host and pattern are split on `.` and matched label-by-label,
+ * and a `*` matches within a single label only — it never crosses a `.`. So
+ * `*.example.com` matches `api.example.com` but NOT `evil-example.com` (no dot
+ * boundary), `a.b.example.com` (extra label), or the bare apex `example.com`
+ * (missing label). This prevents a wildcard from reaching an unintended sibling
+ * or deeper domain on the security boundary.
+ *
+ * An IPv6 host (the hostname contains `:`) is matched EXACTLY — never split or
+ * globbed — since `.`-label semantics don't apply to it (and an IPv4-mapped form
+ * like `::ffff:1.2.3.4` contains dots that would otherwise glob unpredictably).
+ */
+function matchHostGlob(host, pattern) {
+    const h = host.toLowerCase();
+    const p = pattern.toLowerCase();
+    if (h.includes(":") || p.includes(":"))
+        return h === p;
+    const hostLabels = h.split(".");
+    const patternLabels = p.split(".");
+    if (hostLabels.length !== patternLabels.length)
+        return false;
+    return patternLabels.every((label, i) => matchLabel(hostLabels[i], label));
+}
+/**
+ * A local/stdio MCP server spawns a process; a remote one connects over the
+ * network. ANY `command` makes it local — a spawnable process command is the
+ * thing being gated, and it stays dangerous whatever `transport` is declared
+ * alongside it (pairing `command` with `transport: "sse"`/`"http"` must not slip
+ * it past as "remote"). `transport: "stdio"` is local even with no command.
+ */
+function isLocalMcpServer(server) {
+    return server.command !== undefined || server.transport === "stdio";
+}
+/**
+ * Validate an inline profile against a security policy. Returns `ok: false` with
+ * `error`-level issues when the profile declares a blocked surface; warnings do
+ * not fail. Pure and synchronous — safe to run at author (compile) time and
+ * again at dispatch as defense in depth.
+ */
+export function validateAgentProfileSecurity(profile, policy = DEFAULT_CLOUD_AGENT_PROFILE_SECURITY_POLICY) {
+    const issues = [];
+    for (const [name, server] of Object.entries(profile.mcp ?? {})) {
+        if (isLocalMcpServer(server)) {
+            if (!policy.allowLocalMcp) {
+                issues.push({
+                    level: "error",
+                    code: "BLOCKED_LOCAL_MCP",
+                    message: `local/stdio MCP server '${name}' is not allowed (it spawns an arbitrary process)`,
+                    path: `mcp.${name}`,
+                });
+            }
+            continue;
+        }
+        if (policy.allowedMcpHosts) {
+            // An allowlist is active, so a non-local server MUST present a matchable
+            // host — a missing/empty `url` cannot be allowlist-checked, so it fails
+            // closed rather than slipping through unvalidated.
+            if (!server.url) {
+                issues.push({
+                    level: "error",
+                    code: "INVALID_MCP_URL",
+                    message: `remote MCP server '${name}' has no url to check against the allowlist`,
+                    path: `mcp.${name}`,
+                });
+                continue;
+            }
+            let host;
+            try {
+                host = new URL(server.url).hostname;
+            }
+            catch {
+                issues.push({
+                    level: "error",
+                    code: "INVALID_MCP_URL",
+                    message: `MCP server '${name}' has an invalid url: ${server.url}`,
+                    path: `mcp.${name}`,
+                });
+                continue;
+            }
+            if (!policy.allowedMcpHosts.some((p) => matchHostGlob(host, p))) {
+                issues.push({
+                    level: "error",
+                    code: "BLOCKED_REMOTE_MCP_HOST",
+                    message: `remote MCP host '${host}' is not in the allowlist`,
+                    path: `mcp.${name}`,
+                });
+            }
+        }
+    }
+    if (!policy.allowHooks &&
+        profile.hooks &&
+        Object.keys(profile.hooks).length > 0) {
+        issues.push({
+            level: "error",
+            code: "BLOCKED_HOOKS",
+            message: "hooks are not allowed (they run author-controlled shell commands automatically)",
+            path: "hooks",
+        });
+    }
+    if (policy.allowConnections === false &&
+        profile.connections &&
+        profile.connections.length > 0) {
+        issues.push({
+            level: "error",
+            code: "BLOCKED_CONNECTIONS",
+            message: "hub connections are not allowed in an inline profile here — grant hub access through this surface's supported connection path instead",
+            path: "connections",
+        });
+    }
+    return {
+        ok: !issues.some((i) => i.level === "error"),
+        issues,
+    };
+}

package/dist/sandbox-size.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Portable sandbox size vocabulary.
+ *
+ * A size preset is a provider-neutral NAME for a compute tier (cpu / memory /
+ * disk). This module owns only the vocabulary — the names and their smallest→
+ * largest ordering — so the lowest shared layer can reference a size without
+ * depending on the sandbox SDK (`Capability.recommendedSize` lives here, and
+ * agent-interface must not depend on `@tangle-network/sandbox`).
+ *
+ * The concrete cpu/memory/disk numbers for each preset are the sandbox SDK's
+ * single source of truth (`@tangle-network/sandbox` → `SANDBOX_SIZE_PRESETS`),
+ * which imports these names. Mirrors how this package owns the `ReasoningEffort`
+ * vocabulary while backends own its native mapping.
+ */
+/** Compute tiers, ordered smallest → largest. */
+export declare const SANDBOX_SIZE_PRESET_NAMES: readonly ["nano", "small", "medium", "large"];
+/**
+ * A named compute tier for a sandbox. `nano` suits thin glue work (a single API
+ * call, a notify); `large` suits heavy builds over big repositories. Sizing is a
+ * per-task decision — a thin workflow step should not provision a maxed box.
+ */
+export type SandboxSizePreset = (typeof SANDBOX_SIZE_PRESET_NAMES)[number];

package/dist/sandbox-size.js

@@ -0,0 +1,21 @@
+/**
+ * Portable sandbox size vocabulary.
+ *
+ * A size preset is a provider-neutral NAME for a compute tier (cpu / memory /
+ * disk). This module owns only the vocabulary — the names and their smallest→
+ * largest ordering — so the lowest shared layer can reference a size without
+ * depending on the sandbox SDK (`Capability.recommendedSize` lives here, and
+ * agent-interface must not depend on `@tangle-network/sandbox`).
+ *
+ * The concrete cpu/memory/disk numbers for each preset are the sandbox SDK's
+ * single source of truth (`@tangle-network/sandbox` → `SANDBOX_SIZE_PRESETS`),
+ * which imports these names. Mirrors how this package owns the `ReasoningEffort`
+ * vocabulary while backends own its native mapping.
+ */
+/** Compute tiers, ordered smallest → largest. */
+export const SANDBOX_SIZE_PRESET_NAMES = [
+    "nano",
+    "small",
+    "medium",
+    "large",
+];

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@tangle-network/agent-interface",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "type": "module",
+  "license": "MIT",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -11,8 +12,19 @@
       "default": "./dist/index.js"
     }
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tangle-network/agent-sdk.git",
+    "directory": "packages/agent-interface"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
   "files": [
-    "dist"
+    "dist",
+    "README.md",
+    "LICENSE"
   ],
   "dependencies": {
     "zod": "4.4.3"
@@ -23,6 +35,7 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
+    "check-types": "tsc --noEmit",
     "clean": "rm -rf dist"
   }
 }