@tangle-network/agent-runtime 0.104.0 → 0.106.0

package/dist/protected-model-port-DzkUY3HQ.d.ts

@@ -1,271 +0,0 @@
-import { TraceStore } from '@tangle-network/agent-eval';
-import { AgentCandidateArtifactRef, AgentCandidateAttemptPolicy, Sha256Digest, AgentCandidateResolvedModel, AgentCandidateFixedSpend, AgentProfile, AgentCandidateProfile, AgentProfileDiff, AgentCandidateProfilePlanEvidence, AgentCandidateProfileActivation } from '@tangle-network/agent-interface';
-import { A as AgentCandidateExecutorPort, a as AgentCandidateBenchmarkGraderPort, b as AgentCandidateOutputArtifactPort, P as PreparedAgentCandidateExecution, c as AgentCandidateRunFinalization, V as VerifiedAgentCandidate, d as AgentCandidateTaskExecution, e as AgentCandidateExecutionPorts, f as AgentCandidateModelPort, g as AgentCandidateProtectedModelReservation, h as AgentCandidateProtectedModelActivation, i as AgentCandidateProtectedModelSettlement } from './types-Cbp72qyu.js';
-
-interface AgentCandidatePreparationEvidence {
-    readonly executionPlan: AgentCandidateArtifactRef;
-    readonly materializationReceipt: AgentCandidateArtifactRef;
-}
-
-/** Durable one-shot lifecycle for candidate execution attempts. */
-
-/** Non-secret identities a trusted recovery worker needs to close an abandoned attempt. */
-interface AgentCandidateExecutionCleanupHandles {
-    readonly preparationId: string;
-    readonly modelGrantDigest: Sha256Digest;
-    readonly resolvedModel: AgentCandidateResolvedModel;
-    readonly traceRunId: string;
-    readonly cleanupTimeoutMs: number;
-    readonly memory?: {
-        readonly accessDigest: Sha256Digest;
-        readonly effectiveNamespace: string;
-    };
-}
-/** Immutable signed identity stored for one execution attempt. */
-interface AgentCandidateExecutionClaim {
-    readonly executionId: string;
-    readonly attempt: number;
-    readonly maxAttempts: number;
-    readonly retryPolicy: AgentCandidateAttemptPolicy['retryPolicy'];
-    readonly bundleDigest: Sha256Digest;
-    readonly executionPlanDigest: Sha256Digest;
-    /** Durable canonical bytes needed to reconstruct the signed preparation. */
-    readonly preparationEvidence: AgentCandidatePreparationEvidence;
-    /** Frozen plan identity with only attempt number and per-attempt grant identity normalized. */
-    readonly retryLineageDigest: Sha256Digest;
-    /** The winning lease stops authorizing a new terminal write at this instant. */
-    readonly leaseExpiresAtMs: number;
-    /** Frozen budget for task verification, executable grading, and receipt construction. */
-    readonly resultTimeoutMs: number;
-    /** Non-secret handles retained so an expired attempt can be closed and reconciled. */
-    readonly cleanup: AgentCandidateExecutionCleanupHandles;
-}
-/** Secret capability required to finish the acquired attempt. */
-interface AgentCandidateExecutionLease {
-    readonly executionId: string;
-    readonly attempt: number;
-    readonly token: string;
-    readonly expiresAtMs: number;
-}
-/** Only the first class is retryable, and only when the closed model ledger has zero calls. */
-type AgentCandidateExecutionFailureClass = 'pre-model-infrastructure' | 'execution' | 'post-model-infrastructure' | 'unknown';
-/** Evaluator-owned terminal facts staged durably before the terminal CAS. */
-type AgentCandidateExecutionTerminalResult = {
-    readonly status: 'succeeded';
-    readonly usage: AgentCandidateFixedSpend;
-    readonly modelSettlement: AgentCandidateArtifactRef;
-    readonly taskOutcome: AgentCandidateArtifactRef;
-    readonly benchmarkResult: AgentCandidateArtifactRef;
-    readonly runReceipt: AgentCandidateArtifactRef;
-} | {
-    readonly status: 'failed';
-    readonly failureClass: AgentCandidateExecutionFailureClass;
-    readonly usage: AgentCandidateFixedSpend;
-    readonly modelSettlement: AgentCandidateArtifactRef;
-    readonly failureEvidence?: AgentCandidateArtifactRef;
-};
-/** Durable terminal record for one acquired execution attempt. */
-type AgentCandidateExecutionTerminalRecord = AgentCandidateExecutionTerminalResult & {
-    readonly executionId: string;
-    readonly attempt: number;
-    readonly bundleDigest: Sha256Digest;
-    readonly executionPlanDigest: Sha256Digest;
-    readonly preparationEvidence: AgentCandidateExecutionClaim['preparationEvidence'];
-    /** RFC 8785 SHA-256 of this record with `terminalDigest` omitted. */
-    readonly terminalDigest: Sha256Digest;
-};
-/** Monotonic durable phase: the second value means candidate code could have started. */
-type AgentCandidateExecutionPhase = 'claimed' | 'candidate-may-run';
-/** Trusted, independently observed closure facts for one expired winning lease. */
-interface AgentCandidateExecutionRecoveryEvidence {
-    readonly failureClass: AgentCandidateExecutionFailureClass;
-    readonly usage: AgentCandidateFixedSpend;
-    readonly modelSettlement: AgentCandidateArtifactRef;
-    readonly failureEvidence?: AgentCandidateArtifactRef;
-    readonly process: {
-        readonly stopped: true;
-        readonly executionPlanDigest: Sha256Digest;
-    };
-    readonly model: {
-        readonly closed: true;
-        readonly preparationId: string;
-        readonly grantDigest: Sha256Digest;
-    };
-    readonly memory?: {
-        readonly closed: true;
-        readonly preparationId: string;
-        readonly accessDigest: Sha256Digest;
-        readonly effectiveNamespace: string;
-    };
-}
-interface AgentCandidateExecutionAttemptRef {
-    readonly executionId: string;
-    readonly attempt: number;
-}
-/** Persisted state available to a fresh trusted recovery worker after a crash. */
-interface AgentCandidateExecutionAttemptRecord {
-    readonly claim: AgentCandidateExecutionClaim;
-    readonly phase: AgentCandidateExecutionPhase;
-    /** Durable outbox content written before the terminal compare-and-set. */
-    readonly staged?: AgentCandidateExecutionTerminalRecord;
-    readonly terminal?: AgentCandidateExecutionTerminalRecord;
-}
-/** Result of atomically claiming one execution attempt. */
-type AgentCandidateExecutionClaimResult = {
-    readonly acquired: true;
-    readonly claim: AgentCandidateExecutionClaim;
-    readonly lease: AgentCandidateExecutionLease;
-} | {
-    readonly acquired: false;
-    readonly reason: 'already-claimed';
-    /** The durable winner already occupying this execution-attempt slot. */
-    readonly claim: AgentCandidateExecutionClaim;
-    /** True only when every signed claim field matches the durable winner. */
-    readonly exactReplay: boolean;
-} | {
-    readonly acquired: false;
-    readonly reason: 'retry-not-eligible';
-    readonly claim: AgentCandidateExecutionClaim;
-    readonly detail: AgentCandidateRetryRejection;
-};
-/** Result of atomically recording an attempt's terminal facts. */
-type AgentCandidateExecutionFinishResult = {
-    readonly finished: true;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-} | {
-    readonly finished: false;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-    /** True when a repeated finish supplied the same terminal digest. */
-    readonly exactReplay: boolean;
-};
-/** Result of durably staging the one immutable terminal outbox entry. */
-type AgentCandidateExecutionStageResult = {
-    readonly staged: true;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-} | {
-    readonly staged: false;
-    readonly terminal: AgentCandidateExecutionTerminalRecord;
-    readonly exactReplay: boolean;
-};
-/** Result of crossing the irreversible candidate-may-run boundary. */
-type AgentCandidateExecutionPhaseResult = {
-    readonly marked: true;
-    readonly phase: 'candidate-may-run';
-} | {
-    readonly marked: false;
-    readonly phase: 'candidate-may-run';
-};
-type AgentCandidateRetryRejection = 'prior-attempt-missing' | 'prior-attempt-running' | 'prior-attempt-succeeded' | 'prior-attempt-spent-model-calls' | 'prior-attempt-not-pre-model-infrastructure' | 'retry-lineage-mismatch';
-/**
- * Atomic one-shot store for candidate execution attempts.
- *
- * Implementations must linearize both methods across every process sharing the
- * store. Terminal publication is deliberately two-step: `stageTerminal`
- * fsyncs the complete immutable outbox record, then `finish` publishes exactly
- * those staged bytes by digest. A crash between the two leaves recoverable
- * evidence rather than an ambiguous completed run.
- */
-interface AgentCandidateExecutionClaimStore {
-    tryClaim(claim: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>;
-    getAttempt(attempt: AgentCandidateExecutionAttemptRef): Promise<AgentCandidateExecutionAttemptRecord | undefined>;
-    /** Persist the point after which candidate code may have run. */
-    markCandidateMayRun(lease: AgentCandidateExecutionLease): Promise<AgentCandidateExecutionPhaseResult>;
-    /** Fsync the complete terminal record into the durable outbox. */
-    stageTerminal(lease: AgentCandidateExecutionLease, result: AgentCandidateExecutionTerminalResult): Promise<AgentCandidateExecutionStageResult>;
-    /** Publish exactly the staged terminal identified by `terminalDigest`. */
-    finish(lease: AgentCandidateExecutionLease, terminalDigest: Sha256Digest): Promise<AgentCandidateExecutionFinishResult>;
-    /**
-     * Write a failed terminal only after the lease expired and a trusted worker
-     * independently proved process death plus model and memory closure.
-     */
-    recoverExpired(attempt: AgentCandidateExecutionAttemptRef, evidence: AgentCandidateExecutionRecoveryEvidence): Promise<AgentCandidateExecutionFinishResult>;
-}
-interface InMemoryAgentCandidateExecutionClaimStoreOptions {
-    /** Testable evaluator clock; defaults to `Date.now`. */
-    now?: () => number;
-}
-/** Single-process lifecycle implementation. */
-declare class InMemoryAgentCandidateExecutionClaimStore implements AgentCandidateExecutionClaimStore {
-    private readonly claims;
-    private readonly now;
-    constructor(options?: InMemoryAgentCandidateExecutionClaimStoreOptions);
-    tryClaim(requested: AgentCandidateExecutionClaim): Promise<AgentCandidateExecutionClaimResult>;
-    getAttempt(requestedAttempt: AgentCandidateExecutionAttemptRef): Promise<AgentCandidateExecutionAttemptRecord | undefined>;
-    markCandidateMayRun(requestedLease: AgentCandidateExecutionLease): Promise<AgentCandidateExecutionPhaseResult>;
-    stageTerminal(requestedLease: AgentCandidateExecutionLease, result: AgentCandidateExecutionTerminalResult): Promise<AgentCandidateExecutionStageResult>;
-    finish(requestedLease: AgentCandidateExecutionLease, requestedTerminalDigest: Sha256Digest): Promise<AgentCandidateExecutionFinishResult>;
-    recoverExpired(requestedAttempt: AgentCandidateExecutionAttemptRef, evidence: AgentCandidateExecutionRecoveryEvidence): Promise<AgentCandidateExecutionFinishResult>;
-    private requireClaim;
-}
-
-interface ExecutePreparedAgentCandidateOptions {
-    executor: AgentCandidateExecutorPort;
-    grader: AgentCandidateBenchmarkGraderPort;
-    outputArtifacts: AgentCandidateOutputArtifactPort;
-    traceStore: TraceStore;
-    /** Long-lived evaluator-owned store shared by every process that can run this benchmark. */
-    claimStore: AgentCandidateExecutionClaimStore;
-    /** Maximum time to prove process death and revoke protected access after a run ends. */
-    cleanupTimeoutMs?: number;
-    /** Maximum time for task verification, executable grading, and receipt construction. */
-    resultTimeoutMs?: number;
-}
-/** Executes and finalizes one durably claimed candidate without exposing an unproven result. */
-declare function executePreparedAgentCandidate(prepared: PreparedAgentCandidateExecution, options: ExecutePreparedAgentCandidateOptions): Promise<AgentCandidateRunFinalization>;
-
-interface PrepareAgentCandidateExecutionOptions {
-    cleanupTimeoutMs?: number;
-    /** Maximum time for task verification, executable grading, and receipt construction. */
-    resultTimeoutMs?: number;
-}
-/** Materializes a verified candidate into one immutable evaluator-owned execution plan. */
-declare function prepareAgentCandidateExecution(candidate: VerifiedAgentCandidate, task: AgentCandidateTaskExecution, ports: AgentCandidateExecutionPorts, options?: PrepareAgentCandidateExecutionOptions): Promise<PreparedAgentCandidateExecution>;
-
-/** Parse and check every native file hash plus both canonical document digests. */
-declare function parseAgentCandidateProfileActivation(input: unknown, expectedProfilePlanDigest?: AgentCandidateProfilePlanEvidence['digest']): AgentCandidateProfileActivation;
-/** Prove the measured generic profile and sealed candidate profile describe the same behavior. */
-declare function assertCandidateProfileBinding(measuredInput: AgentProfile, bundled: AgentCandidateProfile): void;
-/** Parse a complete profile without silently discarding unsupported fields. */
-declare function parseExactAgentProfile(input: unknown, label: string): AgentProfile;
-/** Parse a profile diff without silently discarding unsupported fields. */
-declare function parseExactAgentProfileDiff(input: unknown, label: string): AgentProfileDiff;
-/** Apply one exact diff and reject any value that cannot be preserved canonically. */
-declare function applyExactAgentProfileDiff(baseInput: unknown, diffInput: unknown, label: string): AgentProfile;
-
-type AgentCandidateModelGrantReserveInput = Parameters<AgentCandidateModelPort['reserveGrant']>[0];
-type AgentCandidateModelGrantActivateInput = Parameters<AgentCandidateModelPort['activateGrant']>[0];
-type AgentCandidateModelGrantSettleInput = Parameters<AgentCandidateModelPort['settleGrant']>[0];
-/** Secret-free response from the service's reservation endpoint. */
-type AgentCandidateModelGrantReservation = AgentCandidateProtectedModelReservation;
-/**
- * Narrow transport contract for a service that owns scoped model credentials
- * and the authoritative per-call usage ledger.
- *
- * An HTTP client can bind these methods to control-plane endpoints. Keeping
- * transport out of the runtime prevents parent credentials, endpoint paths,
- * and retry policy from becoming part of the portable candidate contract.
- */
-interface AgentCandidateModelGrantClient {
-    reserve(input: AgentCandidateModelGrantReserveInput): Promise<AgentCandidateModelGrantReservation>;
-    activate(input: AgentCandidateModelGrantActivateInput): Promise<AgentCandidateProtectedModelActivation>;
-    settle(input: AgentCandidateModelGrantSettleInput): Promise<AgentCandidateProtectedModelSettlement>;
-}
-interface CreateProtectedAgentCandidateModelPortOptions {
-    client: AgentCandidateModelGrantClient;
-    /** Catalog/snapshot resolution stays separate from credential issuance. */
-    resolveModel: AgentCandidateModelPort['resolve'];
-    /** The only public DNS name candidate processes may reach for inference. */
-    gatewayDomain: string;
-    /** Exact environment names the activation endpoint must return, no more or fewer. */
-    activationEnvNames: readonly string[];
-}
-/**
- * Bind a protected model-grant service to the immutable candidate runtime.
- *
- * The service remains the authority for expiry, admission, revocation, and
- * metering. This adapter independently checks every response before allowing
- * it to cross into candidate execution or durable receipt finalization.
- */
-declare function createProtectedAgentCandidateModelPort(options: CreateProtectedAgentCandidateModelPortOptions): AgentCandidateModelPort;
-
-export { type AgentCandidateExecutionClaimStore as A, parseExactAgentProfile as B, type CreateProtectedAgentCandidateModelPortOptions as C, parseExactAgentProfileDiff as D, type ExecutePreparedAgentCandidateOptions as E, prepareAgentCandidateExecution as F, InMemoryAgentCandidateExecutionClaimStore as I, type PrepareAgentCandidateExecutionOptions as P, type AgentCandidateExecutionAttemptRecord as a, type AgentCandidateExecutionAttemptRef as b, type AgentCandidateExecutionClaim as c, type AgentCandidateExecutionClaimResult as d, type AgentCandidateExecutionCleanupHandles as e, type AgentCandidateExecutionFailureClass as f, type AgentCandidateExecutionFinishResult as g, type AgentCandidateExecutionLease as h, type AgentCandidateExecutionPhase as i, type AgentCandidateExecutionPhaseResult as j, type AgentCandidateExecutionRecoveryEvidence as k, type AgentCandidateExecutionStageResult as l, type AgentCandidateExecutionTerminalRecord as m, type AgentCandidateExecutionTerminalResult as n, type AgentCandidateModelGrantActivateInput as o, parseAgentCandidateProfileActivation as p, type AgentCandidateModelGrantClient as q, type AgentCandidateModelGrantReservation as r, type AgentCandidateModelGrantReserveInput as s, type AgentCandidateModelGrantSettleInput as t, type AgentCandidatePreparationEvidence as u, type AgentCandidateRetryRejection as v, applyExactAgentProfileDiff as w, assertCandidateProfileBinding as x, createProtectedAgentCandidateModelPort as y, executePreparedAgentCandidate as z };

package/dist/sanitize-DEbPNtyI.d.ts

@@ -1,328 +0,0 @@
-import { ControlEvalResult, KnowledgeReadinessReport, KnowledgeRequirement } from '@tangle-network/agent-eval';
-import { e as AgentRuntimeEvent, R as RuntimeStreamEvent, f as AgentTaskStatus } from './types-BwoZWq-i.js';
-
-/**
- * The one router chat client: direct OpenAI-compatible completions through the
- * Tangle router — the cheapest dial, no sandbox. Three layers: `routerChatWithUsage`
- * (chat-only), `routerChatWithTools` (one completion with function tools), and
- * `routerToolLoop` (the off-box agentic loop over tool-calling). Shared by the
- * built-in executors and the bench/lab harnesses.
- *
- * Reports REAL token usage so the backend-integrity guard sees a real backend.
- * Returns `undefined` usage when the provider omitted it — never a fabricated 0
- * (a phantom 0 reads as a free call downstream, which the gate would act on).
- */
-
-interface RouterConfig {
-    routerBaseUrl: string;
-    routerKey: string;
-    model: string;
-    /**
-     * Optional completion transport. When set, `routerChatWithUsage` / `routerChatWithTools` call it
-     * with the OpenAI-shape request body and use the parsed `/chat/completions` JSON it returns,
-     * INSTEAD of `fetch(routerBaseUrl + '/chat/completions')`. When absent the fetch path runs
-     * unchanged — the live router stays the default. The injection seam an offline benchmark uses to
-     * drive the worker with no network: a deterministic in-process responder satisfies it, no server.
-     */
-    complete?: (body: Record<string, unknown>) => Promise<unknown>;
-}
-interface RouterChatResult {
-    /** The final answer, with any inline `<think>...</think>` block stripped into `reasoning`. */
-    content: string;
-    /**
-     * Thinking-model reasoning, when the provider surfaced it — either as a separate
-     * `reasoning`/`reasoning_content` message field (OpenRouter style) or inlined into
-     * `content` as a `<think>` block (Groq style). Undefined for non-thinking models.
-     * Downstream parsers that match single-token answers must read `content`, which is
-     * clean either way; before this split, Groq-style inlining made the same model look
-     * broken on one provider and fine on another.
-     */
-    reasoning?: string;
-    /** REAL usage, or undefined when the provider reported none. */
-    usage?: {
-        input: number;
-        output: number;
-    };
-    /** Derived from usage via `estimateCost` when the model is priced; else undefined. */
-    costUsd?: number;
-}
-/** One OpenAI-compatible chat completion through the Tangle router, returning text + REAL token usage (`undefined` when the provider omits it — never a fabricated 0). */
-declare function routerChatWithUsage(cfg: RouterConfig, messages: Array<{
-    role: string;
-    content: string;
-}>, opts?: {
-    temperature?: number;
-    signal?: AbortSignal;
-    maxTokens?: number;
-    /**
-     * Reasoning control for thinking models, forwarded as `reasoning_effort`.
-     * 'none' is the load-bearing value: binary/single-token decisions (routing,
-     * gating) on a thinking model otherwise burn the whole token budget inside
-     * the think block — on slow backends (CPU-local) that turns into a client
-     * timeout, not just waste. Providers that ignore the field are handled by
-     * the reasoning/content split in `parseChatResult`.
-     */
-    reasoningEffort?: 'none' | 'low' | 'medium' | 'high';
-}): Promise<RouterChatResult>;
-/** A tool-call the model emitted (provider-neutral; mirrors the runtime's ToolCallRequest). */
-interface RouterToolCall {
-    id: string;
-    name: string;
-    /** Raw JSON arguments string as emitted by the model. */
-    arguments: string;
-}
-interface RouterChatToolsResult {
-    content: string | null;
-    toolCalls: RouterToolCall[];
-    usage?: {
-        input: number;
-        output: number;
-    };
-    costUsd?: number;
-}
-/**
- * A router completion WITH tool-calling — the operator driver's LLM seam. Passes OpenAI-shape
- * `messages` (system/user/assistant-with-tool_calls/tool roles) + function `tools`, and returns the
- * assistant text plus the tool calls the model wants run. Same fail-loud + real-usage discipline as
- * `routerChatWithUsage`. `tool_choice: 'auto'` lets the model decide; the driver loops on the result.
- */
-declare function routerChatWithTools(cfg: RouterConfig, messages: ReadonlyArray<Record<string, unknown>>, tools: ReadonlyArray<{
-    type: 'function';
-    function: {
-        name: string;
-        description?: string;
-        parameters: unknown;
-    };
-}>, opts?: {
-    temperature?: number;
-    signal?: AbortSignal;
-    toolChoice?: 'auto' | 'required' | 'none';
-    maxTokens?: number;
-}): Promise<RouterChatToolsResult>;
-interface ToolSpec {
-    type: 'function';
-    function: {
-        name: string;
-        description?: string;
-        parameters: unknown;
-    };
-}
-interface RouterToolLoopResult {
-    /** The model's final assistant text (the turn where it stopped calling tools, or the budget turn). */
-    final: string;
-    /** Inference turns spent (≤ maxTurns) — the equal-budget unit vs random@k. */
-    turns: number;
-    toolCalls: number;
-    /** The behavior trace: each tool call + its result, in order. What a trace-analyst
-     *  steerer reads (behavior, never the verdict) to diagnose + redirect the next shot. */
-    toolTrace: Array<{
-        name: string;
-        args: string;
-        result: string;
-    }>;
-    usage: {
-        input: number;
-        output: number;
-    };
-    /** The full conversation after the loop (seed + every assistant/tool turn). Lets a caller
-     *  CARRY the messages into the next shot (depth continuation) and read the trajectory. */
-    messages: Array<Record<string, unknown>>;
-}
-/**
- * The tool-using router backend: a real agentic loop OVER the Tangle router (which
- * supports tool-calling), off-box — no sandbox. Each turn is one router completion
- * with `tools`; if the model emits tool_calls, `execute` runs them on the host and
- * their results are folded back as `tool` messages; the loop repeats until the
- * model answers without a tool call or the turn budget is hit. One turn = one
- * inference call, so `maxTurns` is the equal-compute unit against random@k.
- *
- * This is the depth substrate for agentic gates (the worker ACTS, observes the real
- * result, and continues) that the chat-only `routerChatWithUsage` cannot express.
- */
-declare function routerToolLoop(cfg: RouterConfig, system: string, user: string, tools: ReadonlyArray<ToolSpec>, execute: (name: string, args: Record<string, unknown>) => Promise<string>, opts?: {
-    maxTurns?: number;
-    temperature?: number;
-    signal?: AbortSignal;
-    maxTokens?: number;
-    /** Seed the loop with an existing conversation (depth continuation) instead of
-     *  `[system, user]`. When set, `system`/`user` are ignored. The array is copied. */
-    initialMessages?: ReadonlyArray<Record<string, unknown>>;
-}): Promise<RouterToolLoopResult>;
-/**
- * The router as a supervisor BRAIN: the canonical `ToolLoopChat` seam backed by the router's
- * tool-calling. The driver's spawn/observe/steer/await/stop turns become real router tool-calls.
- * The turnkey production brain — tests script a mock `ToolLoopChat`; production passes
- * `routerBrain(cfg)`. No message translation: the loop already speaks the router's OpenAI shape.
- */
-declare function routerBrain(cfg: RouterConfig, opts?: {
-    temperature?: number;
-}): ToolLoopChat;
-
-/**
- * THE canonical agentic tool-loop. One inference turn → run any requested tools → fold the
- * results back as `tool` messages → repeat, until the model answers without a tool call or the
- * turn budget is hit. One turn = one inference call (the equal-compute unit vs random@k).
- *
- * The inference is an INJECTABLE seam (`ToolLoopChat`): a router model, a sandboxed CLI
- * harness, or a scripted mock all satisfy it — so the loop is backend-agnostic. The metered /
- * steerable concerns the call sites add (a driver's conserved-pool + deadline bound; an inline
- * executor's inbox flush + abort) attach via optional `hooks`; the skeleton stays one copy.
- */
-
-type Msg = Record<string, unknown>;
-/** One inference turn over the running conversation + the tool specs → the model's text, any
- *  tool calls, and token usage. The seam every brain satisfies. */
-type ToolLoopChat = (messages: ReadonlyArray<Msg>, tools: ReadonlyArray<ToolSpec>) => Promise<{
-    content?: string | null;
-    toolCalls: RouterToolCall[];
-    usage?: {
-        input: number;
-        output: number;
-    };
-    /** The turn's inference cost (usd) when the provider priced it — for callers that meter usd
-     *  into a conserved pool (the supervisor brain). `runBrainLoop` itself ignores it. */
-    costUsd?: number;
-}>;
-/** Self-compaction — bound the loop's OWN context window the way a fresh-respawn (dumb-Ralph) loop
- *  does, but in place. A stateless chat API re-sends the WHOLE running conversation every turn, so an
- *  agent that accumulates dozens of turns of tool results re-bills its entire transcript on every
- *  inference — the context-overflow-one-level-up that the conserved budget pool cannot fix. With
- *  compaction set, once the conversation exceeds `thresholdTokens` the accumulated middle (every prior
- *  assistant turn + tool result) is distilled into ONE compact progress note and the conversation is
- *  reset to `[...head, digest]`: the preserved head (system + the original task) survives, the stale
- *  turn-by-turn history does not. The model keeps deciding; it stops re-billing the whole transcript.
- *  Fires at a CLEAN turn boundary (after a turn's tool results are folded in, before the next
- *  inference) so it never orphans an assistant `tool_calls` from its `tool` replies. */
-interface ToolLoopCompaction {
-    /** Compact once the estimated token count of the conversation exceeds this. */
-    readonly thresholdTokens: number;
-    /** Distill the conversation into a compact progress note that REPLACES the middle. Receives the
-     *  full conversation (so it can summarize everything done so far); returns the digest string. */
-    readonly distill: (messages: ReadonlyArray<Msg>) => Promise<string> | string;
-    /** Leading messages preserved verbatim (system + the original task). Default 2. */
-    readonly preserveHead?: number;
-    /** Token estimator over the conversation. Default ≈ chars/4 (incl. tool-call arguments). */
-    readonly estimateTokens?: (messages: ReadonlyArray<Msg>) => number;
-    /** Notified each time a compaction fires — for observability/metering. */
-    readonly onCompact?: (info: {
-        turn: number;
-        beforeTokens: number;
-        afterTokens: number;
-    }) => void;
-}
-/** Public supervisor-facing compaction config: same knobs as the primitive, but `distill` is optional
- *  because the supervisor has a default digest that combines a brain note with live worker state. */
-type ToolLoopCompactionOptions = Omit<ToolLoopCompaction, 'distill'> & {
-    readonly distill?: ToolLoopCompaction['distill'];
-};
-
-/**
- *
- * Sanitization for runtime telemetry. The rule: nothing user-controlled leaks
- * unless the caller opts in with a `RuntimeTelemetryOptions` flag. This is the
- * envelope that ends up in `agent_run.metadata.runtimeEvents` on every
- * consumer, so the default must be safe.
- *
- * @stable
- */
-
-/** @stable */
-interface RuntimeTelemetryOptions {
-    /**
-     * Include raw task inputs. Off by default because task inputs often contain
-     * customer facts, credentials, source text, or internal IDs.
-     */
-    includeInputs?: boolean;
-    /** Include requirement descriptions. Secret requirements are always redacted. */
-    includeRequirementDescriptions?: boolean;
-    /** Include evidence IDs. Off by default; counts are safer for shared reports. */
-    includeEvidenceIds?: boolean;
-    /** Include user answers from question preflight. Off by default. */
-    includeUserAnswers?: boolean;
-    /** Include action payloads and action results for control steps. Off by default. */
-    includeControlPayloads?: boolean;
-    /** Include task metadata. Off by default because metadata may carry IDs or policy internals. */
-    includeMetadata?: boolean;
-    /** Include eval detail/evidence strings. Off by default because validators may echo private input. */
-    includeEvalDetails?: boolean;
-}
-/** @stable */
-interface SanitizedKnowledgeRequirement {
-    id: string;
-    description?: string;
-    requiredFor: string[];
-    category: KnowledgeRequirement['category'];
-    acquisitionMode: KnowledgeRequirement['acquisitionMode'];
-    importance: KnowledgeRequirement['importance'];
-    freshness: KnowledgeRequirement['freshness'];
-    sensitivity: KnowledgeRequirement['sensitivity'];
-    confidenceNeeded: number;
-    currentConfidence: number;
-    evidenceCount: number;
-    evidenceIds?: string[];
-    fallbackPolicy: KnowledgeRequirement['fallbackPolicy'];
-}
-/** @stable */
-interface SanitizedKnowledgeReadinessReport {
-    taskId: string;
-    readinessScore: number;
-    recommendedAction: KnowledgeReadinessReport['recommendedAction'];
-    severity: KnowledgeReadinessReport['severity'];
-    reason: string;
-    blockingMissingRequirements: SanitizedKnowledgeRequirement[];
-    nonBlockingGaps: SanitizedKnowledgeRequirement[];
-    evidenceCount: number;
-    evidenceIds?: string[];
-    missingRequirementIds: string[];
-}
-/** Strip PII and large blobs from a `KnowledgeReadinessReport` for safe telemetry emission. @stable */
-declare function sanitizeKnowledgeReadinessReport(report: KnowledgeReadinessReport, options?: RuntimeTelemetryOptions): SanitizedKnowledgeReadinessReport;
-/** Reduce an `AgentRuntimeEvent` to a PII-safe, serializable plain object for telemetry. @stable */
-declare function sanitizeAgentRuntimeEvent<TState, TAction, TActionResult, TEval extends ControlEvalResult>(event: AgentRuntimeEvent<TState, TAction, TActionResult, TEval>, options?: RuntimeTelemetryOptions): Record<string, unknown>;
-/** Reduce a `RuntimeStreamEvent` to a PII-safe, serializable plain object for telemetry. @stable */
-declare function sanitizeRuntimeStreamEvent(event: RuntimeStreamEvent, options?: RuntimeTelemetryOptions): Record<string, unknown>;
-/** @stable */
-interface RuntimeEventCollector<TState = unknown, TAction = unknown, TActionResult = unknown, TEval extends ControlEvalResult = ControlEvalResult> {
-    onEvent: (event: AgentRuntimeEvent<TState, TAction, TActionResult, TEval>) => void;
-    events: Array<Record<string, unknown>>;
-}
-/** @stable */
-type RuntimeStreamEventSink = (event: RuntimeStreamEvent) => void;
-/** @stable */
-interface RuntimeStreamEventSummary {
-    /** Total count of sanitized events collected. */
-    eventCount: number;
-    /** Count of events per `type`. Useful for log-line summaries. */
-    eventCountsByType: Record<string, number>;
-    /** First session id observed in a `session_created` / `session_resumed` event, if any. */
-    firstSessionId?: string;
-    /** Last `final` event's status, if a final event was observed. */
-    finalStatus?: AgentTaskStatus;
-    /** Last `final` event's reason, if a final event was observed. */
-    finalReason?: string;
-    /** Concatenated `text_delta.text` across the stream, even when payloads are redacted. */
-    finalText: string;
-}
-/** @stable */
-interface RuntimeStreamEventCollector {
-    onEvent: RuntimeStreamEventSink;
-    events: Array<Record<string, unknown>>;
-    /** Snapshot of a small streaming-flavored summary derived from collected events. */
-    summary(): RuntimeStreamEventSummary;
-}
-/** Build an in-memory collector that sanitizes and accumulates `AgentRuntimeEvent`s for inspection. @stable */
-declare function createRuntimeEventCollector<TState = unknown, TAction = unknown, TActionResult = unknown, TEval extends ControlEvalResult = ControlEvalResult>(options?: RuntimeTelemetryOptions): RuntimeEventCollector<TState, TAction, TActionResult, TEval>;
-/**
- *
- * Streaming-event counterpart of `createRuntimeEventCollector`. Pass each
- * event yielded by `runAgentTaskStream` through `onEvent` and read the
- * sanitized copies off `events`; the same `RuntimeTelemetryOptions` redaction
- * flags apply. Kept distinct from `createRuntimeEventCollector` because the
- * stream and non-stream event shapes overlap on `type` literals — dispatching
- * on `type` alone would misroute events.
- *
- * @stable
- */
-declare function createRuntimeStreamEventCollector(options?: RuntimeTelemetryOptions): RuntimeStreamEventCollector;
-
-export { type RouterConfig as R, type SanitizedKnowledgeReadinessReport as S, type ToolLoopChat as T, type ToolLoopCompactionOptions as a, type ToolSpec as b, type RuntimeTelemetryOptions as c, type RuntimeEventCollector as d, type RuntimeStreamEventCollector as e, createRuntimeEventCollector as f, createRuntimeStreamEventCollector as g, sanitizeKnowledgeReadinessReport as h, sanitizeRuntimeStreamEvent as i, type RouterChatResult as j, type RouterChatToolsResult as k, type RouterToolCall as l, type RouterToolLoopResult as m, type ToolLoopCompaction as n, routerChatWithTools as o, routerChatWithUsage as p, routerToolLoop as q, routerBrain as r, sanitizeAgentRuntimeEvent as s };