@tangle-network/agent-interface 0.37.0 → 0.38.0

package/dist/agent-workspace-lease.js

@@ -0,0 +1,203 @@
+import { z } from "zod";
+import { canonicalCandidateDigest, isCanonicalJsonValue, isWellFormedUnicode, looksLikeCredential, omitTopLevelDigest, sha256DigestSchema, } from "./agent-candidate-schema-common.js";
+export const AGENT_WORKSPACE_LEASE_PHASES = [
+    "copy-ready",
+    "workspace-sealed",
+    "execution-bound",
+    "destroying",
+    "cleanup-failed",
+    "destroyed",
+];
+const controlCharacterPattern = /[\u0000-\u001f\u007f]/;
+const publicIdentifierSchema = z
+    .string()
+    .min(1)
+    .max(500)
+    .refine((value) => value.trim().length > 0 &&
+    isWellFormedUnicode(value) &&
+    !controlCharacterPattern.test(value) &&
+    !looksLikeCredential(value), "public workspace identity cannot carry credential-like material");
+const publicLocatorSchema = z
+    .string()
+    .min(1)
+    .max(16_384)
+    .refine((value) => value.trim().length > 0 &&
+    isWellFormedUnicode(value) &&
+    !controlCharacterPattern.test(value) &&
+    !looksLikeCredential(value), "workspace locator must be public, well-formed text");
+const publicCleanupErrorSchema = z
+    .string()
+    .min(1)
+    .max(2_000)
+    .refine((value) => value.trim().length > 0 &&
+    isWellFormedUnicode(value) &&
+    !controlCharacterPattern.test(value) &&
+    !looksLikeCredential(value), "workspace cleanup error must be sanitized public text");
+const timestampSchema = z
+    .number()
+    .int()
+    .nonnegative()
+    .max(Number.MAX_SAFE_INTEGER);
+export const agentWorkspaceLeasePhaseSchema = z.enum(AGENT_WORKSPACE_LEASE_PHASES);
+export const agentWorkspaceSourceSnapshotPolicySchema = z.strictObject({
+    kind: z.literal("provider-declared"),
+    name: publicIdentifierSchema,
+    version: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    digest: sha256DigestSchema,
+});
+export const agentWorkspaceAllocationIdentitySchema = z.strictObject({
+    provider: publicIdentifierSchema,
+    root: publicLocatorSchema,
+    identityDigest: sha256DigestSchema,
+});
+const agentWorkspaceLeaseRecordFields = {
+    kind: z.literal("agent-workspace-lease"),
+    schemaVersion: z.literal(1),
+    phase: agentWorkspaceLeasePhaseSchema,
+    leaseId: publicIdentifierSchema,
+    ownerId: publicIdentifierSchema,
+    workspace: agentWorkspaceAllocationIdentitySchema,
+    isolation: z.enum(["per-run", "shared"]),
+    sourceSnapshotDigest: sha256DigestSchema,
+    sourceSnapshotPolicy: agentWorkspaceSourceSnapshotPolicySchema,
+    preparedWorkspaceDigest: sha256DigestSchema.optional(),
+    profileActivationDigest: sha256DigestSchema.optional(),
+    executionPreparationDigest: sha256DigestSchema.optional(),
+    createdAtMs: timestampSchema,
+    updatedAtMs: timestampSchema,
+    expiresAtMs: timestampSchema,
+    cleanupAttempts: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+    cleanupError: publicCleanupErrorSchema.optional(),
+};
+const rawAgentWorkspaceLeaseRecordMaterialSchema = z
+    .strictObject(agentWorkspaceLeaseRecordFields)
+    .superRefine((record, context) => {
+    validateAgentWorkspaceLeaseState(record, context);
+    if (!isCanonicalJsonValue(record)) {
+        context.addIssue({
+            code: "custom",
+            message: "workspace lease material must contain only RFC 8785 JSON values",
+        });
+    }
+})
+    .transform((record) => record);
+export const agentWorkspaceLeaseRecordMaterialSchema = rawAgentWorkspaceLeaseRecordMaterialSchema;
+export const agentWorkspaceLeaseRecordSchema = z
+    .strictObject({
+    ...agentWorkspaceLeaseRecordFields,
+    digest: sha256DigestSchema,
+})
+    .superRefine((record, context) => {
+    validateAgentWorkspaceLeaseState(record, context);
+    if (!isCanonicalJsonValue(record)) {
+        context.addIssue({
+            code: "custom",
+            message: "workspace lease record must contain only RFC 8785 JSON values",
+        });
+    }
+    else if (canonicalCandidateDigest(omitTopLevelDigest(record)) !== record.digest) {
+        context.addIssue({
+            code: "custom",
+            path: ["digest"],
+            message: "workspace lease record digest is invalid",
+        });
+    }
+})
+    .transform((record) => record);
+/** Canonical public identity; private token/state fields cannot enter its schema. */
+export function canonicalAgentWorkspaceLeaseRecordDigest(material) {
+    return canonicalCandidateDigest(agentWorkspaceLeaseRecordMaterialSchema.parse(material));
+}
+/** Build and self-hash one phase-valid public workspace lease record. */
+export function buildAgentWorkspaceLeaseRecord(material) {
+    const parsed = agentWorkspaceLeaseRecordMaterialSchema.parse(material);
+    return agentWorkspaceLeaseRecordSchema.parse({
+        ...parsed,
+        digest: canonicalCandidateDigest(parsed),
+    });
+}
+function validateAgentWorkspaceLeaseState(record, context) {
+    if (record.updatedAtMs < record.createdAtMs) {
+        context.addIssue({
+            code: "custom",
+            path: ["updatedAtMs"],
+            message: "workspace lease update cannot precede creation",
+        });
+    }
+    if (record.expiresAtMs <= record.createdAtMs) {
+        context.addIssue({
+            code: "custom",
+            path: ["expiresAtMs"],
+            message: "workspace lease expiry must follow creation",
+        });
+    }
+    const hasPrepared = record.preparedWorkspaceDigest !== undefined;
+    const hasActivation = record.profileActivationDigest !== undefined;
+    const hasExecution = record.executionPreparationDigest !== undefined;
+    if (hasPrepared !== hasActivation) {
+        context.addIssue({
+            code: "custom",
+            message: "prepared workspace and profile activation evidence must appear together",
+        });
+    }
+    if (hasExecution && (!hasPrepared || !hasActivation)) {
+        context.addIssue({
+            code: "custom",
+            path: ["executionPreparationDigest"],
+            message: "execution binding requires sealed workspace evidence",
+        });
+    }
+    const active = record.phase === "copy-ready" ||
+        record.phase === "workspace-sealed" ||
+        record.phase === "execution-bound";
+    if (active && record.cleanupAttempts !== 0) {
+        context.addIssue({
+            code: "custom",
+            path: ["cleanupAttempts"],
+            message: "active workspace phases cannot have cleanup attempts",
+        });
+    }
+    if (!active && record.cleanupAttempts < 1) {
+        context.addIssue({
+            code: "custom",
+            path: ["cleanupAttempts"],
+            message: "cleanup workspace phases require at least one cleanup attempt",
+        });
+    }
+    if (record.phase === "copy-ready" && (hasPrepared || hasExecution)) {
+        context.addIssue({
+            code: "custom",
+            message: "copy-ready workspace cannot carry preparation evidence",
+        });
+    }
+    if (record.phase === "workspace-sealed" &&
+        (!hasPrepared || !hasActivation || hasExecution)) {
+        context.addIssue({
+            code: "custom",
+            message: "workspace-sealed phase requires preparation evidence without execution binding",
+        });
+    }
+    if (record.phase === "execution-bound" &&
+        (!hasPrepared || !hasActivation || !hasExecution)) {
+        context.addIssue({
+            code: "custom",
+            message: "execution-bound phase requires complete preparation evidence",
+        });
+    }
+    if (record.phase === "cleanup-failed") {
+        if (record.cleanupError === undefined) {
+            context.addIssue({
+                code: "custom",
+                path: ["cleanupError"],
+                message: "cleanup-failed phase requires a sanitized error",
+            });
+        }
+    }
+    else if (record.cleanupError !== undefined) {
+        context.addIssue({
+            code: "custom",
+            path: ["cleanupError"],
+            message: "cleanup error is valid only in cleanup-failed phase",
+        });
+    }
+}

package/dist/harness-capabilities.d.ts

@@ -1,4 +1,4 @@
-import type { ReasoningEffort } from "./agent-profile.js";
+import { type ReasoningEffort } from "./agent-profile.js";
 import type { HarnessType } from "./harness.js";
 /**
  * The unified harness capability layer — the single source of truth for:

package/dist/harness-capabilities.js

@@ -1,3 +1,4 @@
+import { REASONING_EFFORTS, } from "./agent-profile.js";
 /**
  * The unified harness capability layer — the single source of truth for:
  *   1. harness ↔ model compatibility (which models a harness can run), and
@@ -15,15 +16,7 @@
  * caller supplies.
  */
 /** low → high. `none` = thinking off; `ultracode` = max (claude-code mode). */
-export const reasoningLadder = [
-    "none",
-    "minimal",
-    "low",
-    "medium",
-    "high",
-    "xhigh",
-    "ultracode",
-];
+export const reasoningLadder = REASONING_EFFORTS;
 // ── Harness ↔ model compatibility ────────────────────────────────────────────
 /**
  * Provider prefixes a harness is vendor-locked to (canonical-id prefix, e.g. `anthropic`, `openai`).

package/dist/index.d.ts

@@ -623,6 +623,10 @@ export * from "./agent-profile-improvement.js";
 export * from "./agent-profile-improvement-schema.js";
 export * from "./agent-execution-limits.js";
 export * from "./agent-profile.js";
+export * from "./agent-profile-activation.js";
+export * from "./agent-profile-materialization.js";
+export * from "./agent-execution-preparation.js";
+export * from "./agent-workspace-lease.js";
 export * from "./certified-context.js";
 export * from "./profile-diff.js";
 export * from "./harness.js";

package/dist/index.js

@@ -135,6 +135,10 @@ export * from "./agent-profile-improvement.js";
 export * from "./agent-profile-improvement-schema.js";
 export * from "./agent-execution-limits.js";
 export * from "./agent-profile.js";
+export * from "./agent-profile-activation.js";
+export * from "./agent-profile-materialization.js";
+export * from "./agent-execution-preparation.js";
+export * from "./agent-workspace-lease.js";
 export * from "./certified-context.js";
 export * from "./profile-diff.js";
 export * from "./harness.js";

package/dist/profile-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import type { AgentProfile, AgentProfileMcpServer } from "./agent-profile.js";
+import { type AgentProfile, type AgentProfileMcpServer } from "./agent-profile.js";
 import type { AgentProfileDiff } from "./profile-diff.js";
 import { type SandboxSizePreset } from "./sandbox-size.js";
 export declare const agentProfilePermissionValueSchema: z.ZodEnum<{
@@ -11,11 +11,7 @@ export declare const agentProfilePermissionSchema: z.ZodUnion<readonly [z.ZodEnu
     allow: "allow";
     ask: "ask";
     deny: "deny";
-}>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-    allow: "allow";
-    ask: "ask";
-    deny: "deny";
-}>>]>;
+}>, z.ZodType<Record<string, "allow" | "ask" | "deny">, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny">, unknown>>]>;
 export declare const agentProfileResourceRefSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"inline">;
     name: z.ZodString;
@@ -137,51 +133,102 @@ export declare const agentProfileModelHintsSchema: z.ZodObject<{
         xhigh: "xhigh";
         ultracode: "ultracode";
     }>>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfilePromptSchema: z.ZodObject<{
     systemPrompt: z.ZodOptional<z.ZodString>;
     instructions: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
+export declare const agentProfilePublicConfigValueSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"public">;
+    value: z.ZodString;
+}, z.core.$strict>;
+export declare const agentProfileSecretRefSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"secret-ref">;
+    key: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        raw: "raw";
+        bearer: "bearer";
+    }>>;
+}, z.core.$strict>;
+export declare const agentProfileConfigValueSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"public">;
+    value: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"secret-ref">;
+    key: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        raw: "raw";
+        bearer: "bearer";
+    }>>;
+}, z.core.$strict>], "kind">;
+export declare const agentProfileEnvironmentSchema: z.ZodType<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown, z.core.$ZodTypeInternals<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown>>;
+export declare const agentProfileHeaderSchema: z.ZodType<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown, z.core.$ZodTypeInternals<Record<string, {
+    kind: "public";
+    value: string;
+} | {
+    kind: "secret-ref";
+    key: string;
+    format?: "raw" | "bearer" | undefined;
+}>, unknown>>;
 export declare const agentSubagentProfileSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     prompt: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
-    tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-    permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>>]>>>;
+    tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
+    permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
     maxSteps: z.ZodOptional<z.ZodNumber>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileHookCommandSchema: z.ZodObject<{
     command: z.ZodString;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
     blocking: z.ZodOptional<z.ZodBoolean>;
     matcher: z.ZodOptional<z.ZodString>;
-    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    env: z.ZodOptional<z.ZodType<Record<string, {
+        kind: "public";
+        value: string;
+    } | {
+        kind: "secret-ref";
+        key: string;
+        format?: "raw" | "bearer" | undefined;
+    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        kind: "public";
+        value: string;
+    } | {
+        kind: "secret-ref";
+        key: string;
+        format?: "raw" | "bearer" | undefined;
+    }>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileModeSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
     prompt: z.ZodOptional<z.ZodString>;
-    tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-    permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>>]>>>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
+    permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileConfidentialSchema: z.ZodObject<{
     tee: z.ZodOptional<z.ZodString>;
@@ -264,7 +311,7 @@ export declare const agentProfileSchema: z.ZodObject<{
             xhigh: "xhigh";
             ultracode: "ultracode";
         }>>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
     }, z.core.$strict>>;
     harness: z.ZodOptional<z.ZodEnum<{
         "claude-code": "claude-code";
@@ -281,39 +328,31 @@ export declare const agentProfileSchema: z.ZodObject<{
         acp: "acp";
         "cli-base": "cli-base";
     }>>;
-    permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-        allow: "allow";
-        ask: "ask";
-        deny: "deny";
-    }>>]>>>;
-    tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-    mcp: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<AgentProfileMcpServer, unknown, z.core.$ZodTypeInternals<AgentProfileMcpServer, unknown>>>>;
+    permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
+    tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
+    mcp: z.ZodOptional<z.ZodType<Record<string, AgentProfileMcpServer>, unknown, z.core.$ZodTypeInternals<Record<string, AgentProfileMcpServer>, unknown>>>;
     connections: z.ZodOptional<z.ZodArray<z.ZodObject<{
         connectionId: z.ZodString;
         capabilities: z.ZodArray<z.ZodString>;
         alias: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
-    subagents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        description: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodString>;
-        model: z.ZodOptional<z.ZodString>;
-        tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-        permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>>]>>>;
-        maxSteps: z.ZodOptional<z.ZodNumber>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strict>>>;
+    subagents: z.ZodOptional<z.ZodType<Record<string, {
+        description?: string | undefined;
+        prompt?: string | undefined;
+        model?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        maxSteps?: number | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        description?: string | undefined;
+        prompt?: string | undefined;
+        model?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        maxSteps?: number | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown>>>;
     resources: z.ZodOptional<z.ZodObject<{
         files: z.ZodOptional<z.ZodArray<z.ZodObject<{
             path: z.ZodString;
@@ -387,37 +426,56 @@ export declare const agentProfileSchema: z.ZodObject<{
         }, z.core.$strict>]>]>>;
         failOnError: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
-    hooks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
-        command: z.ZodString;
-        timeoutMs: z.ZodOptional<z.ZodNumber>;
-        blocking: z.ZodOptional<z.ZodBoolean>;
-        matcher: z.ZodOptional<z.ZodString>;
-        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, z.core.$strict>>>>;
-    modes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        description: z.ZodOptional<z.ZodString>;
-        model: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodString>;
-        tools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodBoolean>>;
-        permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>, z.ZodRecord<z.ZodString, z.ZodEnum<{
-            allow: "allow";
-            ask: "ask";
-            deny: "deny";
-        }>>]>>>;
-        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strict>>>;
+    hooks: z.ZodOptional<z.ZodType<Record<string, {
+        command: string;
+        timeoutMs?: number | undefined;
+        blocking?: boolean | undefined;
+        matcher?: string | undefined;
+        env?: Record<string, {
+            kind: "public";
+            value: string;
+        } | {
+            kind: "secret-ref";
+            key: string;
+            format?: "raw" | "bearer" | undefined;
+        }> | undefined;
+    }[]>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        command: string;
+        timeoutMs?: number | undefined;
+        blocking?: boolean | undefined;
+        matcher?: string | undefined;
+        env?: Record<string, {
+            kind: "public";
+            value: string;
+        } | {
+            kind: "secret-ref";
+            key: string;
+            format?: "raw" | "bearer" | undefined;
+        }> | undefined;
+    }[]>, unknown>>>;
+    modes: z.ZodOptional<z.ZodType<Record<string, {
+        description?: string | undefined;
+        model?: string | undefined;
+        prompt?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
+        description?: string | undefined;
+        model?: string | undefined;
+        prompt?: string | undefined;
+        tools?: Record<string, boolean> | undefined;
+        permissions?: Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">> | undefined;
+        metadata?: Record<string, unknown> | undefined;
+    }>, unknown>>>;
     confidential: z.ZodOptional<z.ZodObject<{
         tee: z.ZodOptional<z.ZodString>;
         attestationNonce: z.ZodOptional<z.ZodString>;
         sealed: z.ZodOptional<z.ZodBoolean>;
         attestationRefresh: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodUndefined]>>>;
+    metadata: z.ZodOptional<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
+    extensions: z.ZodOptional<z.ZodType<Record<string, Record<string, unknown> | undefined>, unknown, z.core.$ZodTypeInternals<Record<string, Record<string, unknown> | undefined>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileDiffSchema: z.ZodType<AgentProfileDiff>;
 /**