@tangle-network/agent-runtime 0.208.1 → 0.210.0

package/dist/{stream-agent-turn-B3NfR48z.d.ts → stream-agent-turn-BXZMQQ0K.d.ts}

@@ -7,6 +7,138 @@ import { ChildProcess } from "node:child_process";
 import { WorkspacePlanReceipt } from "@tangle-network/agent-profile-materialize";
 import { BackendType, CreateSandboxOptions, PromptOptions, Sandbox, SandboxEvent, SandboxInstance } from "@tangle-network/sandbox";
 import { AgentEnvironment, AgentEnvironment as AgentEnvironment$1, AgentEnvironmentCapabilities, AgentEnvironmentCapabilities as AgentEnvironmentCapabilities$1, AgentEnvironmentEvent, AgentEnvironmentEvent as AgentEnvironmentEvent$1, AgentEnvironmentProvider, AgentEnvironmentProvider as AgentEnvironmentProvider$1, AgentEnvironmentQuery, AgentEnvironmentStatus, AgentEnvironmentSummary, AgentProfileRef, AgentProfileRef as AgentProfileRef$1, AgentSession, AgentSessionRef, AgentSessionStatus as AgentSessionStatus$1, AgentTurnInput, AgentTurnInput as AgentTurnInput$1, AgentTurnResult as AgentTurnResult$1, AgentTurnResult as AgentTurnResult$2, CheckpointRef, CheckpointRequest, CreateAgentEnvironmentInput, CreateAgentEnvironmentInput as CreateAgentEnvironmentInput$1, ExecRequest, ExecResult, ForkRequest, PlacementInfo, ResourceRequest, WorkspaceRequest } from "@tangle-network/agent-interface/environment-provider";
+//#region src/runtime/supervise/budget.d.ts
+/** Opaque, single-use reservation handle returned by `reserve` and consumed by
+ *  `reconcile`. Carries the reserved ceilings so reconciliation needs no lookup. */
+interface ReservationTicket {
+  readonly id: number;
+  readonly reserved: {
+    readonly resources?: Budget['resources'];
+    readonly tokens: number;
+    readonly usd: number;
+    readonly iterations: number;
+    /**
+     * Whether the child's `Budget` actually declared `maxUsd`. `reserved.usd` is `0` for BOTH a
+     * child that named no dollar ceiling and one that named `$0`, and the two settle differently:
+     * an undeclared ceiling cannot be exceeded, so the child's real dollars are committed as
+     * OBSERVED spend, while a declared ceiling of `$0` is a limit whose breach is fail-loud.
+     * Optional so an externally constructed ticket stays valid; an absent flag is read as
+     * `true` — the strict, fail-closed reading.
+     */
+    readonly usdBudgeted?: boolean;
+  };
+}
+/** Post-reservation pool readout — the shape `Scope.budget` exposes. `tokensLeft`,
+ *  `usdLeft`, and `reservedTokens` reflect committed-but-unsettled reservations;
+ *  `deadlineMs` is the ABSOLUTE wall-clock deadline (0 when the root set none).
+ *  `iterationsLeft` is the remaining iteration capacity.
+ *  `usdCapped` distinguishes a real `usdLeft <= 0` exhaustion from an uncapped pool (which always
+ *  reads `usdLeft: 0`) — the in-loop guard needs it to bound a usd-capped driver. */
+type BudgetReadout = Readonly<{
+  resources?: Readonly<Record<string, {
+    unit: string;
+    limit: number;
+    remaining: number;
+    reserved: number;
+    committed: number;
+    known: boolean;
+  }>>;
+  tokensLeft: number;
+  /**
+   * False once the pool has recorded work whose token count was UNREPORTED (a `Spend` with
+   * `tokensKnown: false`). `tokensLeft` is then a ceiling on what remains, not a measurement: real
+   * consumption is at least the debited amount and possibly more. Reading `tokensLeft` without this
+   * flag would present an under-count as an exact balance.
+   */
+  tokensKnown: boolean;
+  /**
+   * False once the pool has charged a REPORTED spend whose prompt-cache split it could not read.
+   * The prompt tokens that carried no class were charged in full, and a cached prefix reaches the
+   * pool again on every turn that reads it, so the debited amount is an upper bound on
+   * newly-presented work rather than a measurement. It is a separate fact from `tokensKnown`: the
+   * counts arrived, but their composition did not. A restored uncertain reservation leaves this
+   * flag alone — it charges a declared ceiling, which has no composition to misread, and
+   * `tokensKnown` already reports that the balance is not a measurement.
+   */
+  cacheBreakdownKnown: boolean;
+  usdLeft: number;
+  usdCapped: boolean;
+  /** False once any recorded work reported an unknown dollar cost; the dollar totals are then a
+   *  lower bound on real spend, not a measurement. */
+  usdKnown: boolean;
+  iterationsLeft: number;
+  deadlineMs: number;
+  reservedTokens: number;
+}>;
+/** Why a reservation was refused. `budget-exhausted` means the pool ran out of a channel it
+ * budgets; `usd-unbudgeted` means the root declared no dollar ceiling, so a dollar request is
+ * unsatisfiable at any amount and the fix is to budget the root, not to ask for less. */
+type ReservationRejection = 'budget-exhausted' | 'usd-unbudgeted';
+/** State recovered from a prior process before new work is admitted. `committed` is measured spend
+ * already present in the durable journal. Each `uncertainReservation` is a child that was recorded
+ * as started but never recorded as settled: its full declared ceiling is charged conservatively,
+ * while the public readout remains explicitly unknown. */
+interface BudgetPoolRestore {
+  readonly committed?: Spend;
+  readonly uncertainReservations?: ReadonlyArray<Budget>;
+}
+interface BudgetPool {
+  /**
+   * Atomically reserve a child's full ceiling from the free balance. Fails closed
+   * ({ ok: false }) when the pool can't cover standard or named channels — the
+   * caller inspects `ok` before `ticket`.
+   */
+  reserve(b: Budget): {
+    ok: true;
+    ticket: ReservationTicket;
+  } | {
+    ok: false;
+    reason: ReservationRejection;
+  };
+  /**
+   * Release a reservation: commit the actual `spent`, refund the unspent remainder
+   * to the free pool. Throws on an unknown or already-reconciled ticket (fail loud —
+   * a double refund would silently break conservation).
+   */
+  reconcile(ticket: ReservationTicket, spent: Spend): void;
+  /** Fold a normalized `UsageEvent` stream (or array) into a `Spend`. Tokens via
+   *  `addTokenUsage`, usd on its own channel, iterations from `'iteration'` events.
+   *  `ms` is left zero — wall-clock duration is the caller's to record, not the pool's. */
+  spendFrom(events: AsyncIterable<UsageEvent> | UsageEvent[]): Promise<Spend>;
+  /** The current readout, reflecting all outstanding reservations. */
+  readout(): BudgetReadout;
+  /**
+   * Record OBSERVED spend that did NOT go through reserve/reconcile — the driver's OWN inference
+   * (its chat turns), which is real compute but not a spawned child. A direct `free → committed`
+   * debit, so `total ≡ free + reserved + committed` is preserved: equal-k counts the driver's
+   * tokens and the in-loop budget guard (`readout().tokensLeft`) sees them. `free` may go negative
+   * when a run overspends. Unknown enforced resource usage is recorded before throwing.
+   * Partial increments defer completeness checks until the invocation reports its terminal spend.
+   * The DURABLE record is the journal's `metered` event (written by `Scope.meter`); this debit
+   * only makes the live `readout()` reflect driver inference for the in-loop guard.
+   */
+  observe(spend: Spend, options?: {
+    partial?: boolean;
+  }): void;
+  /** Fail loud if any reservation is still open — the conserved-pool leak detector. Called at the
+   *  supervisor's join barrier: once every child has settled, no ticket may remain (a leaked
+   *  reservation would silently break `total ≡ free + reserved + committed`). */
+  assertNoOpenTickets(): void;
+}
+/** Fold a normalized `UsageEvent` array into a `Spend`. Tokens and usd are separate
+ *  channels; iterations come from `'iteration'` events. Pure; `ms` stays zero (the
+ *  pool does not read wall-clock). */
+declare function spendFromUsageEvents(events: UsageEvent[]): Spend;
+/**
+ * Create a conserved reservation pool from a root `Budget`. `runStartedAtMs` is the WALL-CLOCK
+ * instant the run's root was recorded, and it is the only input the deadline is derived from:
+ * `runStartedAtMs + root.deadlineMs`, or `0` when the root declares no deadline. The pool holds no
+ * clock, so a caller cannot hand it a run-relative one and get a duration back where an instant is
+ * expected. A resumed pool passes the ORIGINAL root instant, so restart never slides the limit.
+ * The readout is an absolute instant, not a shrinking remainder.
+ */
+declare function createBudgetPool(root: Budget, runStartedAtMs: number, restore?: BudgetPoolRestore): BudgetPool;
+//#endregion
 //#region src/runtime/retained-run-types.d.ts
 /** Cursor plus runtime sequence needed to continue one ordered replay. @stable */
 interface RetainedRunReplayPoint {
@@ -388,6 +520,7 @@ interface WorkerProgress {
   readonly usd: number;
   /** False when observed dollar spend is only a known subtotal, not a complete total. */
   readonly usdKnown?: boolean;
+  readonly resources?: Spend['resources'];
   /** Steers delivered but not yet read by the worker. */
   readonly pendingMessages: number;
   /** Newest-last window of tool/turn activity; empty when the executor exposes none. */
@@ -422,6 +555,7 @@ interface ScopeProgressInput {
   readonly tokensKnown?: boolean;
   readonly usd: number;
   readonly usdKnown?: boolean;
+  readonly resources?: Spend['resources'];
 }
 /** Fold the scope-derived facts and the executor's optional enrichment into one read. Pure: the
  *  caller supplies `now`, so a test can observe a stall without waiting for one. */
@@ -1085,6 +1219,10 @@ interface Agent<Task, Out> {
    * path; returning `true` means the message was accepted for the current manager session.
    */
   deliver?(msg: unknown): void | boolean;
+  /** Optional live tool evidence exposed by executors that can observe it. */
+  traceSource?(): TraceSource | undefined;
+  /** Optional live execution progress exposed by executors that can observe it. */
+  progress?(): ExecutorProgress | undefined;
 }
 /**
  * The leaf runtime — ONE open interface, not a closed union. `execute` returns a
@@ -1454,6 +1592,12 @@ type UsageEvent = {
   /** Observed output, not accounting. Meters ignore it; the turn projection publishes it. */
   kind: 'progress';
   progress: ExecutorProgressEvent;
+} | {
+  kind: 'resource';
+  name: string;
+  unit: string;
+  amount: number;
+  known: boolean;
 } | {
   kind: 'iteration';
 };
@@ -1651,12 +1795,25 @@ interface ExecutorRegistry {
     error: string;
   };
 }
+/** Caller-defined resource ceiling in non-negative safe-integer units, consistent throughout a tree. */
+interface ResourceLimit {
+  readonly unit: string;
+  readonly limit: number;
+}
+/** Non-negative safe-integer subtotal. False means unknown, even when amount is zero.
+ * Select sufficiently fine units, such as GPU-milliseconds. */
+interface ResourceSpend {
+  readonly unit: string;
+  readonly amount: number;
+  readonly known: boolean;
+}
 /** A budget envelope on a spawn or the root. All ceilings; the pool reserves against them. */
 interface Budget {
   readonly maxIterations: number;
   readonly maxTokens: number;
   readonly maxUsd?: number;
   readonly deadlineMs?: number;
+  readonly resources?: Readonly<Record<string, ResourceLimit>>;
 }
 /**
  * Conserved spend, reconciled from the normalized `UsageEvent` stream. Tokens and usd are separate
@@ -1667,6 +1824,7 @@ interface Budget {
  * holds the reason.
  */
 interface Spend {
+  resources?: Readonly<Record<string, ResourceSpend>>;
   iterations: number;
   tokens: LoopTokenUsage;
   /** Token accounting is known unless explicitly false. A false value marks work that HAPPENED with
@@ -1975,22 +2133,7 @@ interface Scope<Out> {
   /** The live tree — reads the in-memory nursery, not the journal. */
   readonly view: TreeView;
   /** Conserved-pool readouts (post-reservation). */
-  readonly budget: Readonly<{
-    tokensLeft: number;
-    /** `false` once a turn settled without reporting its tokens: `tokensLeft` is then a ceiling,
-     *  not a measurement. */
-    tokensKnown: boolean;
-    /** `false` once a charged spend arrived without a readable prompt-cache split. That spend was
-     *  charged at its rolled-up prompt total, which counts a cached prefix again on every turn that
-     *  reads it, so `tokensLeft` is an upper bound on newly-presented work. */
-    cacheBreakdownKnown: boolean;
-    usdLeft: number;
-    usdCapped: boolean;
-    usdKnown: boolean;
-    iterationsLeft: number;
-    deadlineMs: number;
-    reservedTokens: number;
-  }>;
+  readonly budget: BudgetReadout;
   /** One tree-wide view of simultaneous spawned work. Every nested scope reads the same counter;
    *  the root agent itself is not a spawned worker. `freeSlots` is `null` when no limit is set.
    *  `unconfirmed` NAMES the settled children whose executor teardown was never acknowledged —
@@ -2499,7 +2642,7 @@ interface NoWinnerError {
   stack?: string;
 }
 /** The accounting channels a usage gap leaves incomplete. */
-type SpendChannel = 'tokens' | 'usd';
+type SpendChannel = 'tokens' | 'usd' | `resource:${string}`;
 /**
  * One journaled node whose usage accounting is incomplete — the named gap behind a `false`
  * `tokensKnown`/`usdKnown` on a terminal `spentTotal`. `never-settled`: the spawn is durable but
@@ -2930,6 +3073,8 @@ type ToolLoopChat = (messages: ReadonlyArray<ToolLoopMessageRecord>, tools: Read
     output: number;
     reasoning?: number;
   };
+  /** Caller-measured resource totals for this turn; omission makes enforced dimensions unknown. */
+  resources?: Spend['resources'];
   /** Dollar value reported for the turn. It is not billed spend unless provenance says so. */
   costUsd?: number;
   costProvenance?: 'provider-receipt' | 'billing-receipt' | 'catalog-estimate';
@@ -2987,7 +3132,7 @@ type ToolLoopCompactionOptions = Omit<ToolLoopCompaction, 'distill'> & {
 interface RouterTransportConfig {
   routerBaseUrl: string;
   routerKey: string;
-  /** Injectable OpenAI-compatible transport for offline execution. */
+  /** Injectable OpenAI-compatible transport. Optional usage.resources carries measured turn totals. */
   complete?: (body: Record<string, unknown>, request?: {
     readonly headers: Readonly<Record<string, string>>;
     readonly signal?: AbortSignal;
@@ -3446,177 +3591,6 @@ interface InPlaceHarnessResult {
   harness: WorktreeHarnessResult['harness'];
 }
 //#endregion
-//#region src/runtime/harness-usage.d.ts
-/**
- * One harness's own token-usage report for one turn, in the runtime's field names.
- *
- * `input` is the provider's TOTAL prompt count and `output` is its TOTAL completion count.
- * The other three counters CLASSIFY a part of one of those totals; none of them adds to it.
- * `cachedInput` and `cacheWriteInput` classify `input`, which is the convention
- * `promptCacheTokenClasses` (`util.ts`) folds: `freshInput = input - cacheRead - cacheWrite`.
- * `reasoningOutput` classifies `output`.
- *
- * A counter the harness does not report stays absent, because a zero would claim the harness
- * measured none.
- */
-interface HarnessUsage {
-  /** The harness family whose adapter produced this report. */
-  readonly harness: HarnessType;
-  /** Total prompt tokens the provider charged for the turn, the cached ones included. */
-  readonly input: number;
-  /** Total completion tokens the provider charged for the turn, the reasoning ones included. */
-  readonly output: number;
-  /** The part of `input` the provider served from its prompt cache. */
-  readonly cachedInput?: number;
-  /** The part of `input` the provider wrote into its prompt cache. */
-  readonly cacheWriteInput?: number;
-  /** The part of `output` the model spent on reasoning. Never added to `output`. */
-  readonly reasoningOutput?: number;
-}
-/**
- * Decode a sandbox event with one harness's adapter, or `undefined` when the event carries no
- * harness-native usage.
- *
- * A NAMED harness reads with that harness's adapter only, and a named harness with no adapter
- * reports nothing. It never falls through to another harness's adapter: a different harness's
- * `turn.completed` decoded as codex would either drop the counters codex does not name or fail on
- * a field codex requires, and both answers would be about the wrong harness. The composite over
- * every registered adapter runs only when the caller cannot name the harness.
- *
- * Throws `ValidationError` when an adapter recognizes the event as its harness's usage carrier and
- * cannot read the numbers.
- */
-declare function decodeHarnessUsage(event: SandboxEvent, harness?: HarnessType): HarnessUsage | undefined;
-//#endregion
-//#region src/runtime/codex-rollout-store.d.ts
-/** Who wrote one rollout, exactly as its own `session_meta` states it. Nothing here is inferred. */
-interface CodexRolloutIdentity {
-  /** The rollout's own thread id (`session_meta.payload.id`). */
-  readonly sessionId: string;
-  /** The thread this one was spawned or forked from, when it was. */
-  readonly parentThreadId?: string;
-  /** The thread whose rows are prepended into this file, when this file is a fork. */
-  readonly forkedFromId?: string;
-  /** True when `thread_source` reads `subagent`: a harness-native child, invisible to the journal. */
-  readonly nativeChild: boolean;
-  /** The child's own path in the harness's agent tree (`/root/c1_b_grid`), when it has one. */
-  readonly agentPath?: string;
-  /** The harness's own nickname for the child ("Turing"), when it has one. */
-  readonly agentNickname?: string;
-  /** Spawn depth the harness recorded. `1` is a direct child of the seat. */
-  readonly depth?: number;
-  /** The working directory the session ran in, used to attribute a store to a workspace. */
-  readonly cwd?: string;
-  /** The codex build that wrote it. */
-  readonly cliVersion?: string;
-  /** When the session itself started, from its own `session_meta` timestamp. */
-  readonly startedAtMs?: number;
-}
-/** How this reader isolated the session's own rows from the parent rows prepended to its file. */
-type CodexForkBoundary =
-/** Not a fork: every row in the file belongs to this session. */
-{
-  readonly kind: 'whole-file';
-} |
-/** A fork whose own first turn was isolated, and by which rule. */
-{
-  readonly kind: 'resolved';
-  readonly rule: 'history-start-ordinal' | 'turn-is-session' | 'turn-uuid-v7' | 'turn-start-time';
-  /** The `turn_id` of the session's own first turn. */
-  readonly turnId?: string;
-  /** Rows credited to the parent and excluded from `own`. */
-  readonly inheritedTurns: number;
-} |
-/** A fork this reader could not isolate. `own` is absent; nothing may be charged. */
-{
-  readonly kind: 'unresolved';
-  readonly reason: string;
-};
-/** One turn of one session, with the counters it added to the session's cumulative total. */
-interface CodexRolloutTurn {
-  readonly turnId?: string;
-  readonly startedAtMs?: number;
-  readonly usage: HarnessUsage;
-}
-/** One rollout file, read. */
-interface CodexRolloutSession {
-  readonly identity: CodexRolloutIdentity;
-  readonly boundary: CodexForkBoundary;
-  /**
-   * The session's OWN spend — the cumulative delta from its fork boundary to its last report.
-   * ABSENT when the boundary is unresolved: an unattributable number must not be charged.
-   */
-  readonly own?: HarnessUsage;
-  /** The session's own turns, newest last. Empty when the file reported no usage. */
-  readonly turns: readonly CodexRolloutTurn[];
-  /**
-   * The file's final cumulative `total_token_usage`, kept ONLY as the diagnostic that shows how
-   * far a naive file total is from the truth. Never charge this.
-   */
-  readonly fileCumulativeInput: number;
-  readonly fileCumulativeOutput: number;
-}
-/** What one incremental read of a store observed. */
-interface CodexStoreDelta {
-  /** Spend by sessions that are NOT native children — the seat's own turns. */
-  readonly seat: HarnessUsage;
-  /** Spend by `thread_source: subagent` sessions — the harness-native children. */
-  readonly native: HarnessUsage;
-  /** Sessions whose fork boundary could not be isolated, so their spend is absent, not zero. */
-  readonly unresolved: ReadonlyArray<{
-    readonly sessionId: string;
-    readonly reason: string;
-  }>;
-  /**
-   * Every session this read touched, for evidence. Each one states its WHOLE own spend and turn
-   * list, which is not the same number as `seat` / `native`: those two carry only what this read
-   * newly observed.
-   */
-  readonly sessions: readonly CodexRolloutSession[];
-}
-/** A store reader that credits each turn once: it tails only the bytes appended since the last read. */
-interface CodexRolloutStoreReader {
-  /**
-   * Read everything appended since the previous call and attribute it.
-   *
-   * The FIRST call establishes the baseline. Call it before the first turn so pre-existing rows are
-   * consumed and credited to nothing; every later call returns exactly that turn's spend.
-   */
-  read(): Promise<CodexStoreDelta>;
-}
-/** Where a harness keeps its own session store, and which workspace may be credited from it. */
-interface CodexRolloutStoreRef {
-  /**
-   * Absolute path to the harness home the CLI writes into — `CODEX_HOME`, or `$HOME/.codex`.
-   * This MUST be the run's own isolated store. Pointing it at an ambient host store credits one
-   * run with another run's files, which is the exact defect this reader exists to end.
-   */
-  readonly root: string;
-  /**
-   * Credit only sessions whose recorded `cwd` is this path or below it. Absent credits every
-   * session under `root`, which is correct only for a store no other run writes to.
-   */
-  readonly workspaceRoot?: string;
-}
-/**
- * Read one rollout's rows into a session record.
- *
- * `rows` is the file's JSON values in file order. Pass the whole file to read a completed session;
- * the store reader passes appended slices and carries the identity forward itself.
- */
-declare function readCodexRolloutSession(rows: Iterable<unknown>): CodexRolloutSession | undefined;
-/**
- * Open an incremental reader over a codex store.
- *
- * Nothing is read until `read()` is called, and every read is bounded by the bytes appended since
- * the previous one, so a 695MB rollout is scanned once rather than once per turn.
- */
-declare function createCodexRolloutStoreReader(ref: CodexRolloutStoreRef): CodexRolloutStoreReader;
-/** Sum two usage reports on every counter both of them state. */
-declare function addHarnessUsage(left: HarnessUsage, right: HarnessUsage): HarnessUsage;
-/** True when a report states any spend at all. */
-declare function harnessUsageIsEmpty(usage: HarnessUsage): boolean;
-//#endregion
 //#region src/runtime/provider-placement.d.ts
 /** Caller-declared execution placement. Matching never changes the authored profile.
  * @experimental */
@@ -3774,56 +3748,6 @@ interface ProviderExecutorOptions {
  * @experimental */
 declare function providerAsExecutor(provider: AgentEnvironmentProvider, options?: ProviderExecutorOptions): ExecutorFactory<unknown>;
 //#endregion
-//#region src/runtime/key-provider.d.ts
-/** Resolve named secrets. The ONE seam every secret store adapts to. */
-interface KeyProvider {
-  /** The value for `name`, or `undefined` when this provider does not hold it. */
-  get(name: string): Promise<string | undefined>;
-}
-/** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
- *  whitespace-only values count as absent — fail loud, not with a blank key. */
-declare function envKeyProvider(env?: Record<string, string | undefined>): KeyProvider;
-/** The `AgentProfileMcpServer.metadata` key the declarative secret-env map
- *  rides under: `{ ENV_VAR_NAME: 'PROVIDER_KEY_NAME' }`. Names only — values
- *  are resolved at materialize time and never stored. */
-declare const mcpSecretEnvMetadataKey = "secretEnv";
-/** Read (and validate) a server entry's declared secret-env map, if any.
- *  Malformed metadata throws — a half-declared secret must never half-boot. */
-declare function secretEnvOfMcpServer(server: AgentProfileMcpServer): Record<string, string> | undefined;
-/**
- * Resolve a declared secret-env map into the real env entries for a server
- * spawn. Fail-closed: no provider or a missing key throws, naming the KEY
- * NAME only (the value never appears in any message). `label` names the
- * server for the error (e.g. `profile.mcp['exa']`).
- */
-declare function resolveSecretEnv(secretEnv: Record<string, string>, keys: KeyProvider | undefined, label: string): Promise<Record<string, string>>;
-/** The spawn-ready strings for one stdio MCP server: profile config values
- *  resolved, secrets separated so the client can redact them. */
-interface ResolvedMcpServerLaunch {
-  args?: string[];
-  /** Public env, safe to appear in diagnostics. */
-  env?: Record<string, string>;
-  /** Resolved secret env. Reaches only the child process; redacted everywhere else. */
-  protectedEnv?: Record<string, string>;
-}
-/**
- * Resolve a profile MCP server's `args`/`env` config values (interface ≥0.40
- * `AgentProfileConfigValue`) plus the legacy `metadata.secretEnv` channel into
- * the plain strings a spawn needs.
- *
- * Rules, all fail-closed:
- * - `args` must be public values. A secret-ref in argv is refused: argv is
- *   readable by every host process (/proc/PID/cmdline) and outside the
- *   protected-value redaction channel, so a secret there cannot be contained.
- * - `env` secret-refs resolve through the KeyProvider (missing provider or key
- *   throws, naming the KEY NAME only) and land in `protectedEnv`.
- * - An env var declared secret on BOTH channels (env secret-ref and
- *   metadata.secretEnv) is ambiguous configuration and throws.
- * - A public `env` entry shadowed by a legacy metadata secret keeps the
- *   pre-0.40 spawn precedence: the secret value wins in the child env.
- */
-declare function resolveMcpServerLaunch(server: AgentProfileMcpServer, keys: KeyProvider | undefined, label: string): Promise<ResolvedMcpServerLaunch>;
-//#endregion
 //#region src/runtime/sandbox-events.d.ts
 /** The provider/model the platform reports it actually bound to a turn, when it reports one.
  *  `source` is the platform's own account of where that choice came from — `environment` means
@@ -4067,13 +3991,341 @@ interface SandboxLeafOut {
   outcome?: AgentRunOutcome;
 }
 //#endregion
-//#region src/runtime/supervise/inbox.d.ts
-/** A message from the run's AUTHORITY — the parent driver. These two kinds carry instruction. */
-interface AuthorityInboxMessage {
-  readonly kind: 'steer' | 'answer';
-  readonly text: string;
-  /** Forceful messages abort the in-flight turn; queued ones wait for the boundary flush. */
-  readonly interrupt: boolean;
+//#region src/runtime/harness-usage.d.ts
+/**
+ * One harness's own token-usage report for one turn, in the runtime's field names.
+ *
+ * `input` is the provider's TOTAL prompt count and `output` is its TOTAL completion count.
+ * The other three counters CLASSIFY a part of one of those totals; none of them adds to it.
+ * `cachedInput` and `cacheWriteInput` classify `input`, which is the convention
+ * `promptCacheTokenClasses` (`util.ts`) folds: `freshInput = input - cacheRead - cacheWrite`.
+ * `reasoningOutput` classifies `output`.
+ *
+ * A counter the harness does not report stays absent, because a zero would claim the harness
+ * measured none.
+ */
+interface HarnessUsage {
+  /** The harness family whose adapter produced this report. */
+  readonly harness: HarnessType;
+  /** Total prompt tokens the provider charged for the turn, the cached ones included. */
+  readonly input: number;
+  /** Total completion tokens the provider charged for the turn, the reasoning ones included. */
+  readonly output: number;
+  /** The part of `input` the provider served from its prompt cache. */
+  readonly cachedInput?: number;
+  /** The part of `input` the provider wrote into its prompt cache. */
+  readonly cacheWriteInput?: number;
+  /** The part of `output` the model spent on reasoning. Never added to `output`. */
+  readonly reasoningOutput?: number;
+}
+/**
+ * Decode a sandbox event with one harness's adapter, or `undefined` when the event carries no
+ * harness-native usage.
+ *
+ * A NAMED harness reads with that harness's adapter only, and a named harness with no adapter
+ * reports nothing. It never falls through to another harness's adapter: a different harness's
+ * `turn.completed` decoded as codex would either drop the counters codex does not name or fail on
+ * a field codex requires, and both answers would be about the wrong harness. The composite over
+ * every registered adapter runs only when the caller cannot name the harness.
+ *
+ * Throws `ValidationError` when an adapter recognizes the event as its harness's usage carrier and
+ * cannot read the numbers.
+ */
+declare function decodeHarnessUsage(event: SandboxEvent, harness?: HarnessType): HarnessUsage | undefined;
+//#endregion
+//#region src/runtime/codex-rollout-store.d.ts
+/** Who wrote one rollout, exactly as its own `session_meta` states it. Nothing here is inferred. */
+interface CodexRolloutIdentity {
+  /** The rollout's own thread id (`session_meta.payload.id`). */
+  readonly sessionId: string;
+  /** The thread this one was spawned or forked from, when it was. */
+  readonly parentThreadId?: string;
+  /** The thread whose rows are prepended into this file, when this file is a fork. */
+  readonly forkedFromId?: string;
+  /** True when `thread_source` reads `subagent`: a harness-native child, invisible to the journal. */
+  readonly nativeChild: boolean;
+  /** The child's own path in the harness's agent tree (`/root/c1_b_grid`), when it has one. */
+  readonly agentPath?: string;
+  /** The harness's own nickname for the child ("Turing"), when it has one. */
+  readonly agentNickname?: string;
+  /** Spawn depth the harness recorded. `1` is a direct child of the seat. */
+  readonly depth?: number;
+  /** The working directory the session ran in, used to attribute a store to a workspace. */
+  readonly cwd?: string;
+  /** The codex build that wrote it. */
+  readonly cliVersion?: string;
+  /** When the session itself started, from its own `session_meta` timestamp. */
+  readonly startedAtMs?: number;
+}
+/** How this reader isolated the session's own rows from the parent rows prepended to its file. */
+type CodexForkBoundary =
+/** Not a fork: every row in the file belongs to this session. */
+{
+  readonly kind: 'whole-file';
+} |
+/** A fork whose own first turn was isolated, and by which rule. */
+{
+  readonly kind: 'resolved';
+  readonly rule: 'history-start-ordinal' | 'turn-is-session' | 'turn-uuid-v7' | 'turn-start-time';
+  /** The `turn_id` of the session's own first turn. */
+  readonly turnId?: string;
+  /** Rows credited to the parent and excluded from `own`. */
+  readonly inheritedTurns: number;
+} |
+/** A fork this reader could not isolate. `own` is absent; nothing may be charged. */
+{
+  readonly kind: 'unresolved';
+  readonly reason: string;
+};
+/** One turn of one session, with the counters it added to the session's cumulative total. */
+interface CodexRolloutTurn {
+  readonly turnId?: string;
+  readonly startedAtMs?: number;
+  readonly usage: HarnessUsage;
+}
+/** One rollout file, read. */
+interface CodexRolloutSession {
+  readonly identity: CodexRolloutIdentity;
+  readonly boundary: CodexForkBoundary;
+  /**
+   * The session's OWN spend — the cumulative delta from its fork boundary to its last report.
+   * ABSENT when the boundary is unresolved: an unattributable number must not be charged.
+   */
+  readonly own?: HarnessUsage;
+  /** The session's own turns, newest last. Empty when the file reported no usage. */
+  readonly turns: readonly CodexRolloutTurn[];
+  /**
+   * The file's final cumulative `total_token_usage`, kept ONLY as the diagnostic that shows how
+   * far a naive file total is from the truth. Never charge this.
+   */
+  readonly fileCumulativeInput: number;
+  readonly fileCumulativeOutput: number;
+}
+/** What one incremental read of a store observed. */
+interface CodexStoreDelta {
+  /** Spend by sessions that are NOT native children — the seat's own turns. */
+  readonly seat: HarnessUsage;
+  /** Spend by `thread_source: subagent` sessions — the harness-native children. */
+  readonly native: HarnessUsage;
+  /** Sessions whose fork boundary could not be isolated, so their spend is absent, not zero. */
+  readonly unresolved: ReadonlyArray<{
+    readonly sessionId: string;
+    readonly reason: string;
+  }>;
+  /**
+   * Every session this read touched, for evidence. Each one states its WHOLE own spend and turn
+   * list, which is not the same number as `seat` / `native`: those two carry only what this read
+   * newly observed.
+   */
+  readonly sessions: readonly CodexRolloutSession[];
+}
+/** A store reader that credits each turn once: it tails only the bytes appended since the last read. */
+interface CodexRolloutStoreReader {
+  /**
+   * Read everything appended since the previous call and attribute it.
+   *
+   * The FIRST call establishes the baseline. Call it before the first turn so pre-existing rows are
+   * consumed and credited to nothing; every later call returns exactly that turn's spend.
+   */
+  read(): Promise<CodexStoreDelta>;
+}
+/** Where a harness keeps its own session store, and which workspace may be credited from it. */
+interface CodexRolloutStoreRef {
+  /**
+   * Absolute path to the harness home the CLI writes into — `CODEX_HOME`, or `$HOME/.codex`.
+   * This MUST be the run's own isolated store. Pointing it at an ambient host store credits one
+   * run with another run's files, which is the exact defect this reader exists to end.
+   */
+  readonly root: string;
+  /**
+   * Credit only sessions whose recorded `cwd` is this path or below it. Absent credits every
+   * session under `root`, which is correct only for a store no other run writes to.
+   */
+  readonly workspaceRoot?: string;
+}
+/**
+ * Read one rollout's rows into a session record.
+ *
+ * `rows` is the file's JSON values in file order. Pass the whole file to read a completed session;
+ * the store reader passes appended slices and carries the identity forward itself.
+ */
+declare function readCodexRolloutSession(rows: Iterable<unknown>): CodexRolloutSession | undefined;
+/**
+ * Open an incremental reader over a codex store.
+ *
+ * Nothing is read until `read()` is called, and every read is bounded by the bytes appended since
+ * the previous one, so a 695MB rollout is scanned once rather than once per turn.
+ */
+declare function createCodexRolloutStoreReader(ref: CodexRolloutStoreRef): CodexRolloutStoreReader;
+/** Sum two usage reports on every counter both of them state. */
+declare function addHarnessUsage(left: HarnessUsage, right: HarnessUsage): HarnessUsage;
+/** True when a report states any spend at all. */
+declare function harnessUsageIsEmpty(usage: HarnessUsage): boolean;
+//#endregion
+//#region src/runtime/key-provider.d.ts
+/** Resolve named secrets. The ONE seam every secret store adapts to. */
+interface KeyProvider {
+  /** The value for `name`, or `undefined` when this provider does not hold it. */
+  get(name: string): Promise<string | undefined>;
+}
+/** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
+ *  whitespace-only values count as absent — fail loud, not with a blank key. */
+declare function envKeyProvider(env?: Record<string, string | undefined>): KeyProvider;
+/** The `AgentProfileMcpServer.metadata` key the declarative secret-env map
+ *  rides under: `{ ENV_VAR_NAME: 'PROVIDER_KEY_NAME' }`. Names only — values
+ *  are resolved at materialize time and never stored. */
+declare const mcpSecretEnvMetadataKey = "secretEnv";
+/** Read (and validate) a server entry's declared secret-env map, if any.
+ *  Malformed metadata throws — a half-declared secret must never half-boot. */
+declare function secretEnvOfMcpServer(server: AgentProfileMcpServer): Record<string, string> | undefined;
+/**
+ * Resolve a declared secret-env map into the real env entries for a server
+ * spawn. Fail-closed: no provider or a missing key throws, naming the KEY
+ * NAME only (the value never appears in any message). `label` names the
+ * server for the error (e.g. `profile.mcp['exa']`).
+ */
+declare function resolveSecretEnv(secretEnv: Record<string, string>, keys: KeyProvider | undefined, label: string): Promise<Record<string, string>>;
+/** The spawn-ready strings for one stdio MCP server: profile config values
+ *  resolved, secrets separated so the client can redact them. */
+interface ResolvedMcpServerLaunch {
+  args?: string[];
+  /** Public env, safe to appear in diagnostics. */
+  env?: Record<string, string>;
+  /** Resolved secret env. Reaches only the child process; redacted everywhere else. */
+  protectedEnv?: Record<string, string>;
+}
+/**
+ * Resolve a profile MCP server's `args`/`env` config values (interface ≥0.40
+ * `AgentProfileConfigValue`) plus the legacy `metadata.secretEnv` channel into
+ * the plain strings a spawn needs.
+ *
+ * Rules, all fail-closed:
+ * - `args` must be public values. A secret-ref in argv is refused: argv is
+ *   readable by every host process (/proc/PID/cmdline) and outside the
+ *   protected-value redaction channel, so a secret there cannot be contained.
+ * - `env` secret-refs resolve through the KeyProvider (missing provider or key
+ *   throws, naming the KEY NAME only) and land in `protectedEnv`.
+ * - An env var declared secret on BOTH channels (env secret-ref and
+ *   metadata.secretEnv) is ambiguous configuration and throws.
+ * - A public `env` entry shadowed by a legacy metadata secret keeps the
+ *   pre-0.40 spawn precedence: the secret value wins in the child env.
+ */
+declare function resolveMcpServerLaunch(server: AgentProfileMcpServer, keys: KeyProvider | undefined, label: string): Promise<ResolvedMcpServerLaunch>;
+//#endregion
+//#region src/runtime/supervise/bridge-config.d.ts
+/**
+ * cli-bridge seam. A local OpenAI-compatible bridge that fronts harness CLIs
+ * (claude-code / opencode / kimi / pi) behind one HTTP surface. The spawned
+ * `AgentProfile` is the sole harness/provider/model and behavioral authority and
+ * is forwarded verbatim per request; this seam carries transport data only.
+ *
+ * The executor opens a resumable cli-bridge session. `sessionId` identifies the
+ * harness conversation across turns; each turn also receives its own durable run id.
+ * A dropped HTTP reader reattaches to that exact run and explicit cancel is the only
+ * operation allowed to stop it. Omit `sessionId` and the executor mints one per spawn.
+ *
+ * ── HOW TO CONTROL WHAT THE HARNESS LOADS (there is no argv field, by design) ──
+ *
+ * A worker often needs the harness started in a KNOWN state — no ambient extensions, skills,
+ * context files, or prompt templates — because ambient state is how a paired experiment silently
+ * loses its pairing: an installed extension that persists memory across runs carries arm A's state
+ * into arm B, and nothing reports it.
+ *
+ * That is what the spawned `AgentProfile` is FOR. `agent_profile`
+ * rides every request verbatim, and cli-bridge maps it onto each harness's own native controls:
+ *
+ *   - Materializing any profile at all already starts the harness isolated from ambient
+ *     workspace state — for pi that is `--no-context-files --no-skills --no-prompt-templates`,
+ *     applied to every request that carries an `agent_profile`.
+ *   - `AgentProfile.extensions.<harness>` is the named, per-harness control channel. An explicit
+ *     `extensions: { pi: { load: [] } }` disables ambient extension discovery outright
+ *     (pi's `--no-extensions`); listing package names loads exactly those and nothing else.
+ *   - `permissions` / `tools` / `mcp` map onto the harness's native tool and server controls.
+ *
+ * A caller therefore does NOT need to hand-roll an `Executor` to isolate a harness run, and the
+ * profile expressing it stays portable: the same declaration means the same thing on a different
+ * harness, whereas an argv string means nothing anywhere else.
+ *
+ * WHY NOT A GENERAL ARGV PASSTHROUGH. `bridgeUrl` addresses a process-spawning server. Forwarding
+ * an arbitrary argv array to it would let any caller holding a bearer token choose the flags of a
+ * process on the bridge host — which for real harness CLIs includes flags that load code from a
+ * path, read a file into the prompt, redirect the working directory, or turn off the isolation the
+ * bridge applies. cli-bridge deliberately confines workers (a filesystem jail and deny-by-default
+ * network egress), and every one of those confinements is expressed as spawn configuration, so an
+ * argv channel is a channel for unwinding them. It would also break this executor's own contract:
+ * the durable-run replay protocol, session pinning, and streaming mode are all argv the bridge
+ * owns, and a caller-supplied duplicate silently wins or corrupts the parse. The structured profile
+ * channel is validated, per-harness, portable, and refuses controls it does not understand — keep
+ * new harness capability there.
+ */
+interface BridgeSeam {
+  bridgeUrl: string;
+  bridgeBearer: string;
+  /**
+   * Optional request-scoped model credential.
+   *
+   * The key name is portable configuration. The provider is a live service and is intentionally
+   * not serialised. Runtime resolves both values immediately before every bridge POST and sends
+   * them only to a loopback bridge through private request headers.
+   */
+  modelCredential?: BridgeModelCredential;
+  /** Optional working directory forwarded to cli-bridge and persisted with the session. */
+  cwd?: string;
+  /**
+   * The harness's OWN on-disk session store, read as a spend receipt.
+   *
+   * cli-bridge forwards no token usage for a codex worker, so a turn whose provider counters exist
+   * only in codex's rollout meters `{0, 0}` with `tokensKnown: false`. Measured on one live seat
+   * (discovery#80): 9 of 9 `metered` events read zero while 27,320,482 codex tokens sat in the same
+   * run directory, 1,453,948 of them belonging to harness-native children the journal never saw.
+   *
+   * Naming the store here turns those rows into evidence. The executor tails it once per turn and
+   * credits the DELTA, so each turn is charged once, and it reports the counters with
+   * `provenance: 'harness-store'` so a reader can tell a disk receipt from a stream receipt.
+   *
+   * The path must be the run's OWN isolated store. An ambient host store credits this run with
+   * another run's files, and `workspaceRoot` is the structural guard against it.
+   */
+  harnessStore?: BridgeHarnessStore;
+  /** Caller-owned deadline for each bridge turn. Runtime enforces it locally and sends the
+   *  same value in `execution.timeoutMs` so the bridge-owned process follows the same policy. */
+  timeoutMs?: number;
+  /** Stable, caller-owned cli-bridge session id for harness-side resume. Defaults
+   *  to a freshly minted per-spawn id so each worker is its own resumable session. */
+  sessionId?: string;
+  /** Transport reconnects allowed after the first POST. Default 3; set 0 to disable. */
+  maxReconnects?: number;
+  /** Newest-last activity window `progress()` reports. Default 12. */
+  activityWindow?: number;
+}
+/**
+ * A harness's own session store on the bridge host, named so the runtime may read it.
+ *
+ * Only `codex` has a reader today. Any other harness is REFUSED rather than read with codex's
+ * decoder: a different harness's file decoded as a codex rollout would either drop counters it does
+ * not name or credit a number that is about the wrong wire shape.
+ */
+interface BridgeHarnessStore extends CodexRolloutStoreRef {
+  /** The harness family that wrote the store. */
+  readonly harness: HarnessType;
+}
+/** A live, request-scoped model credential reference for a local cli-bridge. */
+interface BridgeModelCredential {
+  /** Provider key name for the scoped model token. */
+  key: string;
+  /** Provider key name for the exact scoped HTTPS model gateway URL. */
+  baseUrlKey: string;
+  /** Live credential service. Runtime retains this reference through reusable captures. */
+  provider: KeyProvider;
+}
+//#endregion
+//#region src/runtime/supervise/inbox.d.ts
+/** A message from the run's AUTHORITY — the parent driver. These two kinds carry instruction. */
+interface AuthorityInboxMessage {
+  readonly kind: 'steer' | 'answer';
+  readonly text: string;
+  /** Forceful messages abort the in-flight turn; queued ones wait for the boundary flush. */
+  readonly interrupt: boolean;
   /** Present for an `answer` — the question id it resolves. */
   readonly questionId?: string;
 }
@@ -4321,111 +4573,6 @@ interface CliWorktreeBridgeSeam {
   /** Transport reconnects allowed after the first POST. Default 3; set 0 to disable. */
   maxReconnects?: number;
 }
-/**
- * cli-bridge seam. A local OpenAI-compatible bridge that fronts harness CLIs
- * (claude-code / opencode / kimi / pi) behind one HTTP surface. The spawned
- * `AgentProfile` is the sole harness/provider/model and behavioral authority and
- * is forwarded verbatim per request; this seam carries transport data only.
- *
- * The executor opens a resumable cli-bridge session. `sessionId` identifies the
- * harness conversation across turns; each turn also receives its own durable run id.
- * A dropped HTTP reader reattaches to that exact run and explicit cancel is the only
- * operation allowed to stop it. Omit `sessionId` and the executor mints one per spawn.
- *
- * ── HOW TO CONTROL WHAT THE HARNESS LOADS (there is no argv field, by design) ──
- *
- * A worker often needs the harness started in a KNOWN state — no ambient extensions, skills,
- * context files, or prompt templates — because ambient state is how a paired experiment silently
- * loses its pairing: an installed extension that persists memory across runs carries arm A's state
- * into arm B, and nothing reports it.
- *
- * That is what the spawned `AgentProfile` is FOR. `agent_profile`
- * rides every request verbatim, and cli-bridge maps it onto each harness's own native controls:
- *
- *   - Materializing any profile at all already starts the harness isolated from ambient
- *     workspace state — for pi that is `--no-context-files --no-skills --no-prompt-templates`,
- *     applied to every request that carries an `agent_profile`.
- *   - `AgentProfile.extensions.<harness>` is the named, per-harness control channel. An explicit
- *     `extensions: { pi: { load: [] } }` disables ambient extension discovery outright
- *     (pi's `--no-extensions`); listing package names loads exactly those and nothing else.
- *   - `permissions` / `tools` / `mcp` map onto the harness's native tool and server controls.
- *
- * A caller therefore does NOT need to hand-roll an `Executor` to isolate a harness run, and the
- * profile expressing it stays portable: the same declaration means the same thing on a different
- * harness, whereas an argv string means nothing anywhere else.
- *
- * WHY NOT A GENERAL ARGV PASSTHROUGH. `bridgeUrl` addresses a process-spawning server. Forwarding
- * an arbitrary argv array to it would let any caller holding a bearer token choose the flags of a
- * process on the bridge host — which for real harness CLIs includes flags that load code from a
- * path, read a file into the prompt, redirect the working directory, or turn off the isolation the
- * bridge applies. cli-bridge deliberately confines workers (a filesystem jail and deny-by-default
- * network egress), and every one of those confinements is expressed as spawn configuration, so an
- * argv channel is a channel for unwinding them. It would also break this executor's own contract:
- * the durable-run replay protocol, session pinning, and streaming mode are all argv the bridge
- * owns, and a caller-supplied duplicate silently wins or corrupts the parse. The structured profile
- * channel is validated, per-harness, portable, and refuses controls it does not understand — keep
- * new harness capability there.
- */
-interface BridgeSeam {
-  bridgeUrl: string;
-  bridgeBearer: string;
-  /**
-   * Optional request-scoped model credential.
-   *
-   * The key name is portable configuration. The provider is a live service and is intentionally
-   * not serialised. Runtime resolves both values immediately before every bridge POST and sends
-   * them only to a loopback bridge through private request headers.
-   */
-  modelCredential?: BridgeModelCredential;
-  /** Optional working directory forwarded to cli-bridge and persisted with the session. */
-  cwd?: string;
-  /**
-   * The harness's OWN on-disk session store, read as a spend receipt.
-   *
-   * cli-bridge forwards no token usage for a codex worker, so a turn whose provider counters exist
-   * only in codex's rollout meters `{0, 0}` with `tokensKnown: false`. Measured on one live seat
-   * (discovery#80): 9 of 9 `metered` events read zero while 27,320,482 codex tokens sat in the same
-   * run directory, 1,453,948 of them belonging to harness-native children the journal never saw.
-   *
-   * Naming the store here turns those rows into evidence. The executor tails it once per turn and
-   * credits the DELTA, so each turn is charged once, and it reports the counters with
-   * `provenance: 'harness-store'` so a reader can tell a disk receipt from a stream receipt.
-   *
-   * The path must be the run's OWN isolated store. An ambient host store credits this run with
-   * another run's files, and `workspaceRoot` is the structural guard against it.
-   */
-  harnessStore?: BridgeHarnessStore;
-  /** Caller-owned deadline for each bridge turn. Runtime enforces it locally and sends the
-   *  same value in `execution.timeoutMs` so the bridge-owned process follows the same policy. */
-  timeoutMs?: number;
-  /** Stable, caller-owned cli-bridge session id for harness-side resume. Defaults
-   *  to a freshly minted per-spawn id so each worker is its own resumable session. */
-  sessionId?: string;
-  /** Transport reconnects allowed after the first POST. Default 3; set 0 to disable. */
-  maxReconnects?: number;
-  /** Newest-last activity window `progress()` reports. Default 12. */
-  activityWindow?: number;
-}
-/**
- * A harness's own session store on the bridge host, named so the runtime may read it.
- *
- * Only `codex` has a reader today. Any other harness is REFUSED rather than read with codex's
- * decoder: a different harness's file decoded as a codex rollout would either drop counters it does
- * not name or credit a number that is about the wrong wire shape.
- */
-interface BridgeHarnessStore extends CodexRolloutStoreRef {
-  /** The harness family that wrote the store. */
-  readonly harness: HarnessType;
-}
-/** A live, request-scoped model credential reference for a local cli-bridge. */
-interface BridgeModelCredential {
-  /** Provider key name for the scoped model token. */
-  key: string;
-  /** Provider key name for the exact scoped HTTPS model gateway URL. */
-  baseUrlKey: string;
-  /** Live credential service. Runtime retains this reference through reusable captures. */
-  provider: KeyProvider;
-}
 /**
  * Generic environment provider executor config. External packages implement
  * `AgentEnvironmentProvider`; this built-in wrapper lets `createExecutor` consume them as backend
@@ -4665,5 +4812,5 @@ declare function streamAgentTurn(backend: AgentTurnBackend, input: AgentTurnInpu
  */
 declare function collectAgentTurn(stream: AsyncIterable<RuntimeStreamEvent>): Promise<CollectedAgentTurn>;
 //#endregion
-export { resolveSecretEnv as $, RetainedRunEffect as $a, createRuntimeStreamEventCollector as $i, Redactor as $n, Supervisor as $r, WorktreeCommandResult as $t, Inbox as A, ReconnectRetainedInteractiveRunOptions as Aa, OtelExportConfig as Ai, ToolLoopToolCall as An, ProfileMaterializationReceipt as Ar, providerAsExecutor as At, createSandboxToolPartState as B, ReconnectRetainedRunOptions as Ba, generateSpanId as Bi, PeerMailRefusal as Bn, Runtime as Br, CodexRolloutSession as Bt, createExecutorRegistry as C, ActivityNote as Ca, EvalRunEvent as Ci, RouterTransportConfig as Cn, MaterializedExecutionIdentity as Cr, ProviderExecutorOptions as Ct, SteerableSandboxSession as D, WorkerProgress as Da, INTELLIGENCE_WIRE_VERSION as Di, ToolLoopCompaction as Dn, NodeId as Dr, SandboxClientProviderOptions as Dt, SteerableSandboxArgs as E, ScopeProgressInput as Ea, EvalRunsExportResult as Ei, ToolLoopChat as En, NodeExecutionIdentity as Er, ResourceRequest as Et, SandboxOutputMarker as F, RetainedInteractiveStartMaterial as Fa, buildLoopSpanNodes as Fi, PeerMailEvent as Fn, ResumedWork as Fr, SandboxControlClient as Ft, sandboxEventServedBackend as G, RetainedInteractiveEnvironmentAdmission as Ga, RuntimeEventCollector as Gi, createPeerMailbox as Gn, SpawnOpts as Gr, addHarnessUsage as Gt, extractLlmCallEvent as H, RecoverRetainedRunOptions as Ha, padSpanId as Hi, PeerMailbox as Hn, Settled as Hr, CodexRolloutStoreRef as Ht, SandboxServedBackend as I, StartRetainedInteractiveRunOptions as Ia, buildRuntimeEventOtelSpans as Ii, PeerMailKind as In, RootHandle as Ir, createTangleSandboxExactProcessProvider as It, KeyProvider as J, RetainedRunAdmission as Ja, RuntimeStreamEventSummary as Ji, peerMailVerbNames as Jn, Spend as Jr, readCodexRolloutSession as Jt, sandboxProgressEvents as K, RetainedInteractiveIntentAdmission as Ka, RuntimeStreamEventCollector as Ki, isPeerMailEnvelope as Kn, SpawnPrior as Kr, createCodexRolloutStoreReader as Kt, SandboxToolPartState as L, NativeContextContinuationExecution as La, createOpenInferenceFileExporter as Li, PeerMailLimits as Ln, RootMaterialization as Lr, ProviderPlacement as Lt, PeerInboxMessage as M, RetainedInteractiveAdmissionHook as Ma, OtelSpan as Mi, DEFAULT_PEER_MAIL_LIMITS as Mn, ProviderModelExecutionEvidence as Mr, resolveAgentEnvironmentProvider as Mt, createInbox as N, RetainedInteractiveEnvironmentInput as Na, RuntimeEventOtelOptions as Ni, PEER_MAIL_WIRE_KEY as Nn, ResultBlobStore as Nr, sandboxClientAsProvider as Nt, createSteerableSandboxSession as O, createActivityLog as Oa, LoopSpanNode as Oi, ToolLoopCompactionOptions as On, NodeSnapshot as Or, WorkspaceRequest as Ot, SandboxLeafOut as P, RetainedInteractiveRunHandle as Pa, buildLoopOtelSpans as Pi, PeerMailEnvelope as Pn, ResumedKeyState as Pr, CreateTangleSandboxExactProcessProviderOptions as Pt, resolveMcpServerLaunch as Q, RetainedRunDispatchedAdmission as Qa, createRuntimeEventCollector as Qi, McpTransport as Qn, SupervisedResult as Qr, WorktreeCheckRunner as Qt, SandboxUsageLedger as R, NativeContextContinuationHandle as Ra, createOtelExporter as Ri, PeerMailOutcome as Rn, RootProviderModelEvidence as Rr, CodexForkBoundary as Rt, createExecutor as S, ActivityLog as Sa, traceContextToEnv as Si, runLocalHarness as Sn, Handle as Sr, ProviderAsSandboxClientOptions as St, SandboxSteeringOptions as T, ExecutorProgress as Ta, EvalRunsExportConfig as Ti, ToolLoopCallContext as Tn, NoWinnerError as Tr, ProviderPromptOptions as Tt, mapSandboxEvent as U, RecoverRetainedRunResult as Ua, padTraceId as Ui, PeerMailboxOptions as Un, SpawnEvent as Ur, CodexRolloutTurn as Ut, createSandboxUsageLedger as V, RecoverRetainedRunIntentOptions as Va, loopEventToOtelSpan as Vi, PeerMailSendInput as Vn, Scope as Vr, CodexRolloutStoreReader as Vt, mapSandboxToolEvent as W, RetainedInteractiveAdmission as Wa, toOtelAttributes as Wi, claimsAuthority as Wn, SpawnJournal as Wr, CodexStoreDelta as Wt, envKeyProvider as X, RetainedRunCancelOptions as Xa, SanitizedKnowledgeReadinessReport as Xi, JsonRpcResponse as Xn, SpendGap as Xr, decodeHarnessUsage as Xt, ResolvedMcpServerLaunch as Y, RetainedRunAdmissionHook as Ya, RuntimeTelemetryOptions as Yi, JsonRpcMessage as Yn, SpendChannel as Yr, HarnessUsage as Yt, mcpSecretEnvMetadataKey as Z, RetainedRunCancellation as Za, SanitizedKnowledgeRequirement as Zi, McpToolDescriptor as Zn, SteerableRootHandle as Zr, InPlaceHarnessResult as Zt, RouterSeam as _, ToolStepInput as _a, workerTraceSeamKey as _i, LocalHarnessResult as _n, ExecutorProgressEvent as _r, CreateAgentEnvironmentInput$1 as _t, StreamAgentTurnOptions as a, WaitProbe as aa, UsageEvent as ai, GitRunner as an, RetainedRunSnapshot as ao, Budget as ar, AgentEnvironmentProviderRef as at, cliInPlaceExecutor as b, decodeToolPart as ba, mergeTraceEnv as bi, localHarnessExecutable as bn, ExecutorTeardownWarning as br, ForkRequest as bt, BridgeHarnessStore as c, WaitSpec as ca, WorkerInteractiveSession as ci, captureWorktreeDiff as cn, StartRetainedRunInEnvironmentOptions as co, Executor as cr, AgentEnvironmentStatus as ct, CliInPlaceSeam as d, pollFor as da, WorkerTraceUnavailableReason as di, CodexExecutionEvidence as dn, ExecutorCancellationRequest as dr, AgentSession as dt, sanitizeAgentRuntimeEvent as ea, SupervisorOpts as ei, WorktreeHarnessResult as en, RetainedRunEnvironmentAdmission as eo, defaultRedactor as er, secretEnvOfMcpServer as et, CliSeam as f, timerAt as fa, WorkerTraceResolver as fi, CodexExecutionPolicy as fn, ExecutorContext as fr, AgentSessionRef as ft, ProviderSeam as g, SessionTraceBox as ga, workerTraceHeaders as gi, LocalHarness as gn, ExecutorNodeContext as gr, CheckpointRequest as gt, ExecutorConfig as h, SessionMessageLike as ha, workerTraceEnv as hi, LOCAL_HARNESSES as hn, ExecutorMaterialization as hr, CheckpointRef as ht, CollectedAgentTurn as i, WaitOutcome as ia, UnknownMaterializationReason as ii, DiffResult as in, RetainedRunReplayPoint as io, AgentSpec as ir, AgentEnvironmentProvider$1 as it, InboxMessage as j, RecoverRetainedInteractiveRunOptions as ja, OtelExporter as ji, AUTHORITY_MARKERS as jn, ProviderModelAttemptEvidence as jr, providerAsSandboxClient as jt, AuthorityInboxMessage as k, readWorkerProgress as ka, OtelAttribute as ki, ToolLoopMessageRecord as kn, NodeStatus as kr, createAgentEnvironmentProviderRegistry as kt, BridgeModelCredential as l, createWaitProbes as la, WorkerInteractiveUnavailableReason as li, createWorktree as ln, StartRetainedRunOptions as lo, ExecutorAccounting as lr, AgentEnvironmentSummary as lt, CliWorktreeSeam as m, waitUntil as ma, readWorkerTraceContext as mi, DEFAULT_LOCAL_HARNESS as mn, ExecutorFactory as mr, AgentTurnResult$2 as mt, AgentTurnInput$1 as n, sanitizeRuntimeStreamEvent as na, TreeView as ni, CreateWorktreeOptions as nn, RetainedRunHandle as no, Agent as nr, AgentEnvironmentCapabilities$1 as nt, collectAgentTurn as o, WaitProbeRegistry as oa, WaitOpts as oi, RemoveWorktreeOptions as on, RetainedRunStartMaterial as oo, DefaultVerdict as or, AgentEnvironmentProviderRegistry as ot, CliWorktreeBridgeSeam as p, validateWaitSpec as pa, WorkerTraceSeamCarrier as pi, CodexTokenUsage as pn, ExecutorExecutionBinding as pr, AgentSessionStatus$1 as pt, sumSandboxUsage as q, RetainedInteractiveStartedAdmission as qa, RuntimeStreamEventSink as qi, peerMailTools as qn, SpawnRejection as qr, harnessUsageIsEmpty as qt, AgentTurnUsage as r, PendingWait as ra, UnconfirmedTeardown as ri, DiffOptions as rn, RetainedRunIntentAdmission as ro, AgentExecutionRef as rr, AgentEnvironmentEvent$1 as rt, streamAgentTurn as s, WaitRejection as sa, WidenGate as si, WorktreeHandle as sn, RetainedRunTurnInput as so, ExecutionBindingReceipt as sr, AgentEnvironmentQuery as st, AgentTurnBackend as t, sanitizeKnowledgeReadinessReport as ta, TokenUsageProvenance as ti, WorktreeProfileMaterializationReceipt as tn, RetainedRunEventOptions as to, resolveRedactor as tr, AgentEnvironment$1 as tt, BridgeSeam as u, isWaitOutcome as ua, WorkerTraceEvidence as ui, removeWorktree as un, ExecutorCancellation as ur, AgentProfileRef$1 as ut, RouterToolsSeam as v, TraceSource as va, TraceContext as vi, RunLocalHarnessOptions as vn, ExecutorRegistry as vr, ExecRequest as vt, DEFAULT_SANDBOX_STEERING_MAX_TURNS as w, DEFAULT_STALL_AFTER_MS as wa, EvalRunGeneration as wi, ToolSpec as wn, MaterializedModelIdentity as wr, ProviderLeafOut as wt, cliWorktreeExecutor as x, sandboxSessionTraceSource as xa, readTraceContextFromEnv as xi, parseCodexTokenUsage as xn, ExecutorToolCall as xr, PlacementInfo as xt, SandboxSeam as y, createPushTraceSource as ya, createPropagatingTraceEmitter as yi, harnessSupportsReasoningEffort as yn, ExecutorResult as yr, ExecResult as yt, assertSandboxServedModel as z, NativeContextContinuationInput as za, exportEvalRuns as zi, PeerMailReadout as zn, RootSignal as zr, CodexRolloutIdentity as zt };
-//# sourceMappingURL=stream-agent-turn-B3NfR48z.d.ts.map
+export { decodeHarnessUsage as $, RetainedRunCancellation as $a, SanitizedKnowledgeRequirement as $i, Redactor as $n, SteerableRootHandle as $r, WorktreeCommandResult as $t, createInbox as A, createActivityLog as Aa, LoopSpanNode as Ai, ToolLoopToolCall as An, ProfileMaterializationReceipt as Ar, CreateAgentEnvironmentInput$1 as At, secretEnvOfMcpServer as B, NativeContextContinuationHandle as Ba, createOtelExporter as Bi, PeerMailRefusal as Bn, RootProviderModelEvidence as Br, SandboxClientProviderOptions as Bt, SteerableSandboxArgs as C, sandboxSessionTraceSource as Ca, readTraceContextFromEnv as Ci, RouterTransportConfig as Cn, MaterializedExecutionIdentity as Cr, AgentProfileRef$1 as Ct, Inbox as D, ExecutorProgress as Da, EvalRunsExportConfig as Di, ToolLoopCompaction as Dn, NodeId as Dr, AgentTurnResult$2 as Dt, AuthorityInboxMessage as E, DEFAULT_STALL_AFTER_MS as Ea, EvalRunGeneration as Ei, ToolLoopChat as En, NodeExecutionIdentity as Er, AgentSessionStatus$1 as Et, ResolvedMcpServerLaunch as F, RetainedInteractiveEnvironmentInput as Fa, RuntimeEventOtelOptions as Fi, PeerMailEvent as Fn, ResultBlobStore as Fr, ProviderAsSandboxClientOptions as Ft, CodexRolloutStoreRef as G, RecoverRetainedRunResult as Ga, padTraceId as Gi, createPeerMailbox as Gn, SpawnEvent as Gr, resolveAgentEnvironmentProvider as Gt, CodexRolloutIdentity as H, ReconnectRetainedRunOptions as Ha, generateSpanId as Hi, PeerMailbox as Hn, Runtime as Hr, createAgentEnvironmentProviderRegistry as Ht, envKeyProvider as I, RetainedInteractiveRunHandle as Ia, buildLoopOtelSpans as Ii, PeerMailKind as In, ResumedKeyState as Ir, ProviderExecutorOptions as It, addHarnessUsage as J, RetainedInteractiveIntentAdmission as Ja, RuntimeStreamEventCollector as Ji, peerMailVerbNames as Jn, SpawnPrior as Jr, SandboxControlClient as Jt, CodexRolloutTurn as K, RetainedInteractiveAdmission as Ka, toOtelAttributes as Ki, isPeerMailEnvelope as Kn, SpawnJournal as Kr, sandboxClientAsProvider as Kt, mcpSecretEnvMetadataKey as L, RetainedInteractiveStartMaterial as La, buildLoopSpanNodes as Li, PeerMailLimits as Ln, ResumedWork as Lr, ProviderLeafOut as Lt, BridgeModelCredential as M, ReconnectRetainedInteractiveRunOptions as Ma, OtelExportConfig as Mi, DEFAULT_PEER_MAIL_LIMITS as Mn, ProviderModelExecutionEvidence as Mr, ExecResult as Mt, BridgeSeam as N, RecoverRetainedInteractiveRunOptions as Na, OtelExporter as Ni, PEER_MAIL_WIRE_KEY as Nn, ResourceLimit as Nr, ForkRequest as Nt, InboxMessage as O, ScopeProgressInput as Oa, EvalRunsExportResult as Oi, ToolLoopCompactionOptions as On, NodeSnapshot as Or, CheckpointRef as Ot, KeyProvider as P, RetainedInteractiveAdmissionHook as Pa, OtelSpan as Pi, PeerMailEnvelope as Pn, ResourceSpend as Pr, PlacementInfo as Pt, HarnessUsage as Q, RetainedRunCancelOptions as Qa, SanitizedKnowledgeReadinessReport as Qi, McpTransport as Qn, SpendGap as Qr, WorktreeCheckRunner as Qt, resolveMcpServerLaunch as R, StartRetainedInteractiveRunOptions as Ra, buildRuntimeEventOtelSpans as Ri, PeerMailOutcome as Rn, RootHandle as Rr, ProviderPromptOptions as Rt, SandboxSteeringOptions as S, decodeToolPart as Sa, mergeTraceEnv as Si, runLocalHarness as Sn, Handle as Sr, AgentEnvironmentSummary as St, createSteerableSandboxSession as T, ActivityNote as Ta, EvalRunEvent as Ti, ToolLoopCallContext as Tn, NoWinnerError as Tr, AgentSessionRef as Tt, CodexRolloutSession as U, RecoverRetainedRunIntentOptions as Ua, loopEventToOtelSpan as Ui, PeerMailboxOptions as Un, Scope as Ur, providerAsExecutor as Ut, CodexForkBoundary as V, NativeContextContinuationInput as Va, exportEvalRuns as Vi, PeerMailSendInput as Vn, RootSignal as Vr, WorkspaceRequest as Vt, CodexRolloutStoreReader as W, RecoverRetainedRunOptions as Wa, padSpanId as Wi, claimsAuthority as Wn, Settled as Wr, providerAsSandboxClient as Wt, harnessUsageIsEmpty as X, RetainedRunAdmission as Xa, RuntimeStreamEventSummary as Xi, JsonRpcResponse as Xn, Spend as Xr, ProviderPlacement as Xt, createCodexRolloutStoreReader as Y, RetainedInteractiveStartedAdmission as Ya, RuntimeStreamEventSink as Yi, JsonRpcMessage as Yn, SpawnRejection as Yr, createTangleSandboxExactProcessProvider as Yt, readCodexRolloutSession as Z, RetainedRunAdmissionHook as Za, RuntimeTelemetryOptions as Zi, McpToolDescriptor as Zn, SpendChannel as Zr, InPlaceHarnessResult as Zt, cliInPlaceExecutor as _, SessionMessageLike as _a, workerTraceEnv as _i, LocalHarnessResult as _n, createBudgetPool as _o, ExecutorProgressEvent as _r, AgentEnvironmentProvider$1 as _t, StreamAgentTurnOptions as a, PendingWait as aa, UnconfirmedTeardown as ai, GitRunner as an, RetainedRunIntentAdmission as ao, Budget as ar, assertSandboxServedModel as at, createExecutorRegistry as b, TraceSource as ba, TraceContext as bi, localHarnessExecutable as bn, ExecutorTeardownWarning as br, AgentEnvironmentQuery as bt, CliInPlaceSeam as c, WaitProbeRegistry as ca, WaitOpts as ci, captureWorktreeDiff as cn, RetainedRunStartMaterial as co, Executor as cr, extractLlmCallEvent as ct, CliWorktreeSeam as d, createWaitProbes as da, WorkerInteractiveUnavailableReason as di, CodexExecutionEvidence as dn, StartRetainedRunOptions as do, ExecutorCancellationRequest as dr, sandboxEventServedBackend as dt, createRuntimeEventCollector as ea, SupervisedResult as ei, WorktreeHarnessResult as en, RetainedRunDispatchedAdmission as eo, defaultRedactor as er, SandboxLeafOut as et, ExecutorConfig as f, isWaitOutcome as fa, WorkerTraceEvidence as fi, CodexExecutionPolicy as fn, BudgetPool as fo, ExecutorContext as fr, sandboxProgressEvents as ft, SandboxSeam as g, waitUntil as ga, readWorkerTraceContext as gi, LocalHarness as gn, ReservationTicket as go, ExecutorNodeContext as gr, AgentEnvironmentEvent$1 as gt, RouterToolsSeam as h, validateWaitSpec as ha, WorkerTraceSeamCarrier as hi, LOCAL_HARNESSES as hn, ReservationRejection as ho, ExecutorMaterialization as hr, AgentEnvironmentCapabilities$1 as ht, CollectedAgentTurn as i, sanitizeRuntimeStreamEvent as ia, TreeView as ii, DiffResult as in, RetainedRunHandle as io, AgentSpec as ir, SandboxUsageLedger as it, BridgeHarnessStore as j, readWorkerProgress as ja, OtelAttribute as ji, AUTHORITY_MARKERS as jn, ProviderModelAttemptEvidence as jr, ExecRequest as jt, PeerInboxMessage as k, WorkerProgress as ka, INTELLIGENCE_WIRE_VERSION as ki, ToolLoopMessageRecord as kn, NodeStatus as kr, CheckpointRequest as kt, CliSeam as l, WaitRejection as la, WidenGate as li, createWorktree as ln, RetainedRunTurnInput as lo, ExecutorAccounting as lr, mapSandboxEvent as lt, RouterSeam as m, timerAt as ma, WorkerTraceResolver as mi, DEFAULT_LOCAL_HARNESS as mn, BudgetReadout as mo, ExecutorFactory as mr, AgentEnvironment$1 as mt, AgentTurnInput$1 as n, sanitizeAgentRuntimeEvent as na, SupervisorOpts as ni, CreateWorktreeOptions as nn, RetainedRunEnvironmentAdmission as no, Agent as nr, SandboxServedBackend as nt, collectAgentTurn as o, WaitOutcome as oa, UnknownMaterializationReason as oi, RemoveWorktreeOptions as on, RetainedRunReplayPoint as oo, DefaultVerdict as or, createSandboxToolPartState as ot, ProviderSeam as p, pollFor as pa, WorkerTraceUnavailableReason as pi, CodexTokenUsage as pn, BudgetPoolRestore as po, ExecutorExecutionBinding as pr, sumSandboxUsage as pt, CodexStoreDelta as q, RetainedInteractiveEnvironmentAdmission as qa, RuntimeEventCollector as qi, peerMailTools as qn, SpawnOpts as qr, CreateTangleSandboxExactProcessProviderOptions as qt, AgentTurnUsage as r, sanitizeKnowledgeReadinessReport as ra, TokenUsageProvenance as ri, DiffOptions as rn, RetainedRunEventOptions as ro, AgentExecutionRef as rr, SandboxToolPartState as rt, streamAgentTurn as s, WaitProbe as sa, UsageEvent as si, WorktreeHandle as sn, RetainedRunSnapshot as so, ExecutionBindingReceipt as sr, createSandboxUsageLedger as st, AgentTurnBackend as t, createRuntimeStreamEventCollector as ta, Supervisor as ti, WorktreeProfileMaterializationReceipt as tn, RetainedRunEffect as to, resolveRedactor as tr, SandboxOutputMarker as tt, CliWorktreeBridgeSeam as u, WaitSpec as ua, WorkerInteractiveSession as ui, removeWorktree as un, StartRetainedRunInEnvironmentOptions as uo, ExecutorCancellation as ur, mapSandboxToolEvent as ut, cliWorktreeExecutor as v, SessionTraceBox as va, workerTraceHeaders as vi, RunLocalHarnessOptions as vn, spendFromUsageEvents as vo, ExecutorRegistry as vr, AgentEnvironmentProviderRef as vt, SteerableSandboxSession as w, ActivityLog as wa, traceContextToEnv as wi, ToolSpec as wn, MaterializedModelIdentity as wr, AgentSession as wt, DEFAULT_SANDBOX_STEERING_MAX_TURNS as x, createPushTraceSource as xa, createPropagatingTraceEmitter as xi, parseCodexTokenUsage as xn, ExecutorToolCall as xr, AgentEnvironmentStatus as xt, createExecutor as y, ToolStepInput as ya, workerTraceSeamKey as yi, harnessSupportsReasoningEffort as yn, ExecutorResult as yr, AgentEnvironmentProviderRegistry as yt, resolveSecretEnv as z, NativeContextContinuationExecution as za, createOpenInferenceFileExporter as zi, PeerMailReadout as zn, RootMaterialization as zr, ResourceRequest as zt };
+//# sourceMappingURL=stream-agent-turn-BXZMQQ0K.d.ts.map