@theoremjs/agents 0.3.0 → 0.3.1

package/esm/mod.d.ts

@@ -12,16 +12,19 @@ export { describeError, ERROR_KINDS, errorKind, isAbortError, publicError, Theor
 export { errorCopiesSchema, errorKindSchema, guardrailEventSchema, } from './src/guardrails/event-schemas.js';
 export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './src/guardrails/events.js';
 export { hitFromSpan, projectGuardrailEvent, } from './src/guardrails/hits.js';
-export type { ClientLexiconKey, LexiconKey, LexiconOverrides, LexiconParams, } from './src/guardrails/lexicon.js';
-export { CLIENT_LEXICON_KEYS, LEXICON_KEYS, lexiconDefault, lexiconText, overrideLexicon, resetLexicon, } from './src/guardrails/lexicon.js';
-export type { AdvisoryLevel, CanaryGateResult, CanaryGateSession, CanaryStreamGate, CompiledEgressRules, DetectionOptions, EgressChecks, EgressEnforcer, EgressOnBlock, EgressPolicyOptions, EgressRule, GivenUrls, GuardedToolText, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, LiveHeldOutput, LiveOutboundBatchResult, LiveOutboundGateSession, NetworkGuardrailSpec, OutboundPayload, ProfileEgressSpec, ProfileGuardrailsSpec, ProgressiveYieldGate, ProgressiveYieldGateOptions, ProgressiveYieldResult, Provenance, QuotaGuardrailSpec, ResolvedGuardrailPolicy, ScanText, SensitiveGroup, SensitiveSelection, SensitiveSwitches, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, UrlCheck, Verdict, } from './src/guardrails/mod.js';
-export { ADVISORY_LEVELS, abortLiveOutboundTurn, bindCanary, checkTaintGate, collectEgressHits, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DEFAULT_HOLDBACK, DIRECTIVE_RULES, detectionForTrust, directiveHits, EGRESS_ON_BLOCK, EGRESS_RULES, egressPolicy, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, looksDirective, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, runEnforcer, SEVERITIES, scanTextForCanaryLeak, scanTextOf, standardEgressEnforce, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
+export type { ClientLabelKey, LabelKey, LabelOverrides, LabelParams, } from './src/guardrails/labels.js';
+export { CLIENT_LABEL_KEYS, LABEL_KEYS, labelDefault, labelText, overrideLabels, resetLabels, } from './src/guardrails/labels.js';
+export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, CanaryGateResult, CanaryGateSession, CanaryStreamGate, DestinationGate, DestinationVerdict, Directive, DirectiveSignal, GivenUrls, GuardedToolText, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, InspectedToolArguments, LiveHeldOutput, LiveOutboundBatchResult, LiveOutboundGateSession, NameAllow, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, ProgressiveYieldGate, ProgressiveYieldGateOptions, ProgressiveYieldResult, Provenance, QuotaGuardrailSpec, ResolvedGuardrailPolicy, ScanText, SensitiveGroup, SensitiveSelection, SensitiveSwitches, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnDestinations, TurnTaint, UrlAllow, Verdict, } from './src/guardrails/mod.js';
+export { ADVISORY_LEVELS, abortLiveOutboundTurn, addGivenDestinations, addHistoryDestinations, addRequestDestinations, addResultDestinations, BLOCKED_REPLY_ON_BLOCK, bindCanary, checkDestinationGate, checkTaintGate, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DESTINATION_GATES, DIRECTIVE_SIGNALS, directives, EGRESS_RULES, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, SEVERITIES, scanTextForCanaryLeak, scanTextOf, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, turnDestinations, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
 export type { DnsOverHttpsOptions, GuardedFetchOptions, ResolveHost, } from './src/guardrails/network.js';
 export { assertSafeUrl, dnsOverHttpsResolver, fetchGuarded, isLocalhostName, isPrivateOrLocalAddress, } from './src/guardrails/network.js';
 export type { QuotaSlotStatus } from './src/guardrails/quota.js';
 export { clientIp, quotaExhausted, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
-export { detectionForProfile, detectText, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
-export { clearProfiles, compactHistory, getProfile, getStructured, getTool, hasProfile, hasTool, invokeTool, listProfiles, listTools, projectProfile, registerProfile, registerProfiles, registerStructured, registerTool, registerTools, requireTool, resetTools, resolveTurn, runDecision, runSession, runTurn, } from './src/kernel/default-scope.js';
+export type { SanitizedTurnRequest } from './src/guardrails/sanitize.js';
+export { sanitizeProjectId, sanitizeTurnRequest, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
+export type { ProviderStateRebuilt } from './src/kernel/checkpoint.js';
+export { historyHash, providerCheckpointSchema, providerContinuationSchema, providerWarningSchema, } from './src/kernel/checkpoint.js';
+export { clearProfiles, compactHistory, getProfile, getProvider, getStructured, getTool, hasProfile, hasTool, invokeTool, invokeToolStep, listProfiles, listProtocols, listProviders, listTools, projectProfile, registerProfile, registerProfiles, registerProvider, registerStructured, registerTool, registerTools, requireTool, resetTools, resolveTurn, runDecision, runEmbedding, runSession, runTool, runToolStep, runTurn, } from './src/kernel/default-scope.js';
 export type { CompactionSplit, CompactionTokens } from './src/kernel/engine/compaction.js';
 export { compactionMeter, compactionNeeded, resolveCompactionTokens, resolveHistoryTokens, shouldCompact, splitForCompaction, } from './src/kernel/engine/compaction.js';
 export { validateDecisionRequest } from './src/kernel/engine/decision.js';
@@ -29,37 +32,48 @@ export { prepareLiveInboundText } from './src/kernel/engine/live-inbound.js';
 export type { LiveIngressChannel } from './src/kernel/engine/live-ingress.js';
 export { assertLiveIngress, assertLiveIngressConfigured, hasAnyLiveIngress, liveIngressChannelDefault, liveIngressEnabled, liveIngressEnabledFromSpec, } from './src/kernel/engine/live-ingress.js';
 export type { RunSessionOptions, SignInGatePolicy } from './src/kernel/engine/session/mod.js';
-export type { MediaPayload, MediaTokenFamily, TokenCount, TokenEstimator, } from './src/kernel/engine/token-estimate.js';
-export { loadTokenEstimator, mediaTokenFamily, TOKEN_TEXT_ENCODING, } from './src/kernel/engine/token-estimate.js';
+export type { TokenCount, TokenEstimator, } from './src/kernel/engine/token-estimate.js';
+export { loadTokenEstimator, TOKEN_TEXT_ENCODING, } from './src/kernel/engine/token-estimate.js';
 export { sumTokens } from './src/kernel/engine/usage.js';
 export type { ProfileGraphEditor, ProfileGraphFacet, ProfileGraphFacetId, ProfileGraphRole, } from './src/kernel/profile-graph.js';
 export { PROFILE_GRAPH, profileGraphFacet, spineFacetsForProfileType, } from './src/kernel/profile-graph.js';
+export type { RuntimeAbilities } from './src/kernel/protocols/binding.js';
+export { checkBinding, commonModelSettingsSchema, decisionModelBindingSchema, keySlotSchema, keySlotsOf, modelBindingSchema, } from './src/kernel/protocols/binding.js';
+export { providerLimitsSchema, resolveProviderLimits } from './src/kernel/protocols/limits.js';
+export type { CallSetup, ProtocolCall } from './src/kernel/protocols/runtime.js';
+export { callProtocol, plainWebSocket } from './src/kernel/protocols/runtime.js';
 export type { AttachmentFacts, AttachmentRules } from './src/kernel/registry/attachments.js';
-export { assertTurnAttachments, attachmentIssueCopy, attachmentIssues, attachmentIssueText, attachmentsRefused, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, } from './src/kernel/registry/attachments.js';
+export { assertTurnAttachments, attachmentIssueCopy, attachmentIssues, attachmentIssueText, attachmentsRefused, base64Bytes, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, } from './src/kernel/registry/attachments.js';
 export type { MediaInputChannel } from './src/kernel/registry/catalog.js';
 export { clampThinkingLevel, clampThinkingLevelForApiId, mediaChannelForMime, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelBinding, } from './src/kernel/registry/catalog.js';
+export type { EmbeddingRules } from './src/kernel/registry/embedding-rules.js';
+export { embeddingMediaIssues, embeddingRules } from './src/kernel/registry/embedding-rules.js';
 export type { KernelRegistry } from './src/kernel/registry/kernel-registry.js';
 export { createKernelRegistry } from './src/kernel/registry/kernel-registry.js';
-export type { ImageProfileDefinition, LiveProfileDefinition, ProfileDefinition, ProfileDefinitionBase, ProfileRegistry, SpeechProfileDefinition, TextProfileDefinition, } from './src/kernel/registry/profiles.js';
+export type { EmbeddingProfileDefinition, ImageProfileDefinition, LiveProfileDefinition, ProfileDefinition, ProfileDefinitionBase, ProfileRegistry, SpeechProfileDefinition, TextProfileDefinition, } from './src/kernel/registry/profiles.js';
 export { createProfileRegistry, defineProfile } from './src/kernel/registry/profiles.js';
 export { pickModel } from './src/kernel/registry/resolve.js';
 export type { SchemaRegistry } from './src/kernel/registry/schemas.js';
 export { createSchemaRegistry } from './src/kernel/registry/schemas.js';
-export type { AuthUnauthenticatedPolicy, ContinueStopKind, CustomToolType, HttpMethod, PlaygroundAuthType, ToolAccess, ToolAuthType, ToolPermission, ToolType, TurnStopKind, } from './src/kernel/schema.js';
-export { ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_OUTCOMES, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, coerceProtocol, coerceProvider, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, IMAGE_ATTACHMENT_ACCEPT_MIMES, isKeySlotName, isToolGateKind, isTurnInjectStage, isTurnStage, isValidPair, isValidProfileProtocol, KEY_SLOT_NAME, LIVE_ACTIVITY_HANDLINGS, LIVE_END_SENSITIVITIES, LIVE_START_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, PLAYGROUND_AUTH_TYPES, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
+export type { AuthUnauthenticatedPolicy, ContinueStopKind, CustomToolType, HttpMethod, StepLimitMode, StudioAuthType, ToolAccess, ToolAuthType, ToolPermission, ToolType, TurnStopKind, } from './src/kernel/schema.js';
+export { API_EXPORTS, ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_OUTCOMES, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, IMAGE_ATTACHMENT_ACCEPT_MIMES, isKeySlotName, isToolGateKind, isTurnInjectStage, isTurnStage, KEY_SLOT_NAME, LIVE_ACTIVITY_HANDLINGS, LIVE_END_SENSITIVITIES, LIVE_START_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, PROFILE_FIELDS, PROFILE_HANDLE_MAX_CHARS, PROFILE_ID_MAX_CHARS, PROFILE_TYPES, REQUEST_FIELDS, SPEECH_AUDIO_FORMATS, STREAM_MODES, STUDIO_AUTH_TYPES, SUMMARY_MODES, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
 export type { KernelScope } from './src/kernel/scope.js';
 export { createKernelScope, defaultKernelScope } from './src/kernel/scope.js';
 export type { AwaitingUserInput, StageAffordance, StageApplyInput, StageApplyOutput, StageApplyWarning, StageApplyWarningCode, StageContext, StageEventExtra, StageHandler, StageMutate, StageResult, } from './src/kernel/stages.js';
-export { applyStageResult, isAwaitingUserInput, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
+export { applyStageResult, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
 export type { MediaTurnBehaviourSpec, ProfileTurnBehaviourSpec, ProfileTurnResumptionSpec, TurnContinueFrom, TurnStop, } from './src/kernel/stop.js';
 export { AUTO_CONTINUE_DELAY_MS, DEFAULT_ALLOW_CONTINUE, DEFAULT_AUTO_CONTINUE, GenerationStopError, isContinueStopKind, isGenerationStopError, isResumeableStop, isUserCancelledStop, profileAllowsInject, profileAllowsSteering, profileTurnResumption, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
+export { authorizeToolReplay } from './src/kernel/tools/execute.js';
 export { GATE_DECISIONS, type GateDecision } from './src/kernel/tools/gate-answer.js';
-export type { McpProtocolVersion, McpRpcResponse, ToolRegistry } from './src/kernel/tools/mod.js';
-export { askUserTool, buildHttpToolTarget, createToolRegistry, executeHttpTool, executeMcpTool, formatToolResult, isUnsupportedMcpProtocolError, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, resolveToolAuth, } from './src/kernel/tools/mod.js';
-export { awaitingUserInputSchema, TURN_EVENT_SCHEMAS, toolGateSchema, turnDoneOf, turnEventSchema, turnHistoryMessageSchema, turnToolSnapshotSchema, } from './src/kernel/turn-events.js';
+export type { CredentialQuery, McpProtocolVersion, McpRpcResponse, ToolRegistry, } from './src/kernel/tools/mod.js';
+export { askUserTool, buildHttpToolTarget, createToolRegistry, credentialPlacement, executeHttpTool, executeMcpTool, formatToolResult, isUnsupportedMcpProtocolError, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, resolveToolAuth, UncheckedOutput, uncheckedOutput, withCredentialQuery, } from './src/kernel/tools/mod.js';
+export type { BeginToolOperationResult, PageToolDispatch, PageToolExecution, SavedToolInvocation, TerminalToolEvent, ToolExecutionCoordinator, ToolOperationClaim, ToolOperationIdentity, ToolOperationOutcome, ToolOperationUncertainty, } from './src/kernel/tools/operation.js';
+export { savedToolInvocationSchema, toolInvocationHash, toolOperationOutcomeSchema, } from './src/kernel/tools/operation.js';
+export type { SettledToolCall, ToolCallResult, ToolStepCallResult, } from './src/kernel/tools/run.js';
+export type { ModelToolResult, PageAnswer, ToolContext } from './src/kernel/tools/types.js';
+export { awaitingUserInputSchema, type GateReference, gateReferenceSchema, isAwaitingUserInput, keptReply, reasoningPartSchema, TURN_EVENT_SCHEMAS, toolGateSchema, turnDoneOf, turnEventSchema, turnHistoryMessageSchema, turnToolSnapshotSchema, } from './src/kernel/turn-events.js';
 export type * from './src/kernel/types.js';
-export type { OtlpAnyValue, OtlpKeyValue, OtlpSpan, OtlpTraceRequest, ProfileObservabilitySpec, ResolvedObservabilityPolicy, ResolvedTraceInclude, ResolvedTraceScrub, SpanHandle, SpanLinkInput, SpanOptions, TraceAttributeGroup, TraceAttributeMeta, TraceAttributes, TraceAttributeValue, TraceBytes, TraceClock, TraceContent, TraceEventMeta, TraceIncludeSpec, TraceJson, TraceOptionMeta, TraceRecord, TraceScrubSpec, TraceSink, TraceSpan, TraceSpanEvent, TraceSpanKind, TraceSpanLink, TraceSpanMeta, TraceSpanStatus, TraceSpanType, TraceTree, TraceValueFormat, TraceWriteContext, } from './src/observability/mod.js';
+export type { OtlpAnyValue, OtlpKeyValue, OtlpSpan, OtlpTraceRequest, ProfileObservabilitySpec, ResolvedObservabilityPolicy, ResolvedScrubSwitch, ResolvedTraceInclude, ResolvedTraceScrub, ScrubSwitch, SpanHandle, SpanLinkInput, SpanOptions, TraceAttributeGroup, TraceAttributeMeta, TraceAttributes, TraceAttributeValue, TraceBytes, TraceClock, TraceContent, TraceEventMeta, TraceIncludeSpec, TraceJson, TraceOptionMeta, TraceRecord, TraceScrubSpec, TraceSink, TraceSpan, TraceSpanEvent, TraceSpanKind, TraceSpanLink, TraceSpanMeta, TraceSpanStatus, TraceSpanType, TraceTree, TraceValueFormat, TraceWriteContext, } from './src/observability/mod.js';
 export { buildRecord, clearTraceDestinations, contentOf, getTraceDestination, inlineContent, isTraceSink, listTraceDestinationIds, memorySink, noopSink, readTraceparent, registerTraceDestination, requireTraceDestination, resolveObservabilityPolicy, resolveTraceWriter, startTrace, TRACE_ATTRIBUTE_GROUPS, TRACE_FIELDS, TRACE_SPAN_TYPES, TRACE_STATUS, toOtlpJson, traceAttributeMeta, traceBytes, traceContent, traceEventAttributeMeta, traceEventMeta, traceJson, traceRecordSchema, traceSpanMeta, writeTrace, } from './src/observability/mod.js';
 export * from './src/presets/mod.js';
-export type { CreateProviderOptions, GeminiOptions, KeyVault, LocalProviderConfig, OpenAiGatewayConfig, } from './src/providers/mod.js';
-export { createProvider } from './src/providers/mod.js';
+export * from './src/providers/mod.js';

package/esm/mod.js

@@ -11,32 +11,39 @@ export { describeError, ERROR_KINDS, errorKind, isAbortError, publicError, Theor
 export { errorCopiesSchema, errorKindSchema, guardrailEventSchema, } from './src/guardrails/event-schemas.js';
 export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './src/guardrails/events.js';
 export { hitFromSpan, projectGuardrailEvent, } from './src/guardrails/hits.js';
-export { CLIENT_LEXICON_KEYS, LEXICON_KEYS, lexiconDefault, lexiconText, overrideLexicon, resetLexicon, } from './src/guardrails/lexicon.js';
-export { ADVISORY_LEVELS, abortLiveOutboundTurn, bindCanary, checkTaintGate, collectEgressHits, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DEFAULT_HOLDBACK, DIRECTIVE_RULES, detectionForTrust, directiveHits, EGRESS_ON_BLOCK, EGRESS_RULES, egressPolicy, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, looksDirective, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, runEnforcer, SEVERITIES, scanTextForCanaryLeak, scanTextOf, standardEgressEnforce, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
+export { CLIENT_LABEL_KEYS, LABEL_KEYS, labelDefault, labelText, overrideLabels, resetLabels, } from './src/guardrails/labels.js';
+export { ADVISORY_LEVELS, abortLiveOutboundTurn, addGivenDestinations, addHistoryDestinations, addRequestDestinations, addResultDestinations, BLOCKED_REPLY_ON_BLOCK, bindCanary, checkDestinationGate, checkTaintGate, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DESTINATION_GATES, DIRECTIVE_SIGNALS, directives, EGRESS_RULES, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, SEVERITIES, scanTextForCanaryLeak, scanTextOf, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, turnDestinations, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
 export { assertSafeUrl, dnsOverHttpsResolver, fetchGuarded, isLocalhostName, isPrivateOrLocalAddress, } from './src/guardrails/network.js';
 export { clientIp, quotaExhausted, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
-export { detectionForProfile, detectText, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
-export { clearProfiles, compactHistory, getProfile, getStructured, getTool, hasProfile, hasTool, invokeTool, listProfiles, listTools, projectProfile, registerProfile, registerProfiles, registerStructured, registerTool, registerTools, requireTool, resetTools, resolveTurn, runDecision, runSession, runTurn, } from './src/kernel/default-scope.js';
+export { sanitizeProjectId, sanitizeTurnRequest, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
+export { historyHash, providerCheckpointSchema, providerContinuationSchema, providerWarningSchema, } from './src/kernel/checkpoint.js';
+export { clearProfiles, compactHistory, getProfile, getProvider, getStructured, getTool, hasProfile, hasTool, invokeTool, invokeToolStep, listProfiles, listProtocols, listProviders, listTools, projectProfile, registerProfile, registerProfiles, registerProvider, registerStructured, registerTool, registerTools, requireTool, resetTools, resolveTurn, runDecision, runEmbedding, runSession, runTool, runToolStep, runTurn, } from './src/kernel/default-scope.js';
 export { compactionMeter, compactionNeeded, resolveCompactionTokens, resolveHistoryTokens, shouldCompact, splitForCompaction, } from './src/kernel/engine/compaction.js';
 export { validateDecisionRequest } from './src/kernel/engine/decision.js';
 export { prepareLiveInboundText } from './src/kernel/engine/live-inbound.js';
 export { assertLiveIngress, assertLiveIngressConfigured, hasAnyLiveIngress, liveIngressChannelDefault, liveIngressEnabled, liveIngressEnabledFromSpec, } from './src/kernel/engine/live-ingress.js';
-export { loadTokenEstimator, mediaTokenFamily, TOKEN_TEXT_ENCODING, } from './src/kernel/engine/token-estimate.js';
+export { loadTokenEstimator, TOKEN_TEXT_ENCODING, } from './src/kernel/engine/token-estimate.js';
 export { sumTokens } from './src/kernel/engine/usage.js';
 export { PROFILE_GRAPH, profileGraphFacet, spineFacetsForProfileType, } from './src/kernel/profile-graph.js';
-export { assertTurnAttachments, attachmentIssueCopy, attachmentIssues, attachmentIssueText, attachmentsRefused, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, } from './src/kernel/registry/attachments.js';
+export { checkBinding, commonModelSettingsSchema, decisionModelBindingSchema, keySlotSchema, keySlotsOf, modelBindingSchema, } from './src/kernel/protocols/binding.js';
+export { providerLimitsSchema, resolveProviderLimits } from './src/kernel/protocols/limits.js';
+export { callProtocol, plainWebSocket } from './src/kernel/protocols/runtime.js';
+export { assertTurnAttachments, attachmentIssueCopy, attachmentIssues, attachmentIssueText, attachmentsRefused, base64Bytes, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, } from './src/kernel/registry/attachments.js';
 export { clampThinkingLevel, clampThinkingLevelForApiId, mediaChannelForMime, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelBinding, } from './src/kernel/registry/catalog.js';
+export { embeddingMediaIssues, embeddingRules } from './src/kernel/registry/embedding-rules.js';
 export { createKernelRegistry } from './src/kernel/registry/kernel-registry.js';
 export { createProfileRegistry, defineProfile } from './src/kernel/registry/profiles.js';
 export { pickModel } from './src/kernel/registry/resolve.js';
 export { createSchemaRegistry } from './src/kernel/registry/schemas.js';
-export { ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_OUTCOMES, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, coerceProtocol, coerceProvider, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, IMAGE_ATTACHMENT_ACCEPT_MIMES, isKeySlotName, isToolGateKind, isTurnInjectStage, isTurnStage, isValidPair, isValidProfileProtocol, KEY_SLOT_NAME, LIVE_ACTIVITY_HANDLINGS, LIVE_END_SENSITIVITIES, LIVE_START_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, PLAYGROUND_AUTH_TYPES, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
+export { API_EXPORTS, ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_OUTCOMES, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, IMAGE_ATTACHMENT_ACCEPT_MIMES, isKeySlotName, isToolGateKind, isTurnInjectStage, isTurnStage, KEY_SLOT_NAME, LIVE_ACTIVITY_HANDLINGS, LIVE_END_SENSITIVITIES, LIVE_START_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, PROFILE_FIELDS, PROFILE_HANDLE_MAX_CHARS, PROFILE_ID_MAX_CHARS, PROFILE_TYPES, REQUEST_FIELDS, SPEECH_AUDIO_FORMATS, STREAM_MODES, STUDIO_AUTH_TYPES, SUMMARY_MODES, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
 export { createKernelScope, defaultKernelScope } from './src/kernel/scope.js';
-export { applyStageResult, isAwaitingUserInput, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
+export { applyStageResult, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
 export { AUTO_CONTINUE_DELAY_MS, DEFAULT_ALLOW_CONTINUE, DEFAULT_AUTO_CONTINUE, GenerationStopError, isContinueStopKind, isGenerationStopError, isResumeableStop, isUserCancelledStop, profileAllowsInject, profileAllowsSteering, profileTurnResumption, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
+export { authorizeToolReplay } from './src/kernel/tools/execute.js';
 export { GATE_DECISIONS } from './src/kernel/tools/gate-answer.js';
-export { askUserTool, buildHttpToolTarget, createToolRegistry, executeHttpTool, executeMcpTool, formatToolResult, isUnsupportedMcpProtocolError, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, resolveToolAuth, } from './src/kernel/tools/mod.js';
-export { awaitingUserInputSchema, TURN_EVENT_SCHEMAS, toolGateSchema, turnDoneOf, turnEventSchema, turnHistoryMessageSchema, turnToolSnapshotSchema, } from './src/kernel/turn-events.js';
+export { askUserTool, buildHttpToolTarget, createToolRegistry, credentialPlacement, executeHttpTool, executeMcpTool, formatToolResult, isUnsupportedMcpProtocolError, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, resolveToolAuth, UncheckedOutput, uncheckedOutput, withCredentialQuery, } from './src/kernel/tools/mod.js';
+export { savedToolInvocationSchema, toolInvocationHash, toolOperationOutcomeSchema, } from './src/kernel/tools/operation.js';
+export { awaitingUserInputSchema, gateReferenceSchema, isAwaitingUserInput, keptReply, reasoningPartSchema, TURN_EVENT_SCHEMAS, toolGateSchema, turnDoneOf, turnEventSchema, turnHistoryMessageSchema, turnToolSnapshotSchema, } from './src/kernel/turn-events.js';
 export { buildRecord, clearTraceDestinations, contentOf, getTraceDestination, inlineContent, isTraceSink, listTraceDestinationIds, memorySink, noopSink, readTraceparent, registerTraceDestination, requireTraceDestination, resolveObservabilityPolicy, resolveTraceWriter, startTrace, TRACE_ATTRIBUTE_GROUPS, TRACE_FIELDS, TRACE_SPAN_TYPES, TRACE_STATUS, toOtlpJson, traceAttributeMeta, traceBytes, traceContent, traceEventAttributeMeta, traceEventMeta, traceJson, traceRecordSchema, traceSpanMeta, writeTrace, } from './src/observability/mod.js';
 export * from './src/presets/mod.js';
-export { createProvider } from './src/providers/mod.js';
+export * from './src/providers/mod.js';

package/esm/src/cli/commands/bench.js

@@ -1,8 +1,11 @@
-// TTFE: time to first event (profile resolve + provider setup). TTFT: time to first text delta.
+import { z } from 'zod';
+import { defineProtocol } from '../../kernel/protocols/protocol.js';
+import { defineProvider } from '../../kernel/protocols/provider.js';
+// why: TTFE: time to first event (profile resolve + provider setup). TTFT: time to first text delta.
 // Overhead: total wall-clock delta vs. raw provider consumption.
 import { canaryNote, eventHasCanary, mintCanary } from '../../guardrails/canary.js';
 import { sanitizeTurnRequest } from '../../guardrails/sanitize.js';
-import { clearProfiles, getProfile, registerProfile, resolveTurn, runTurn, } from '../../kernel/default-scope.js';
+import { clearProfiles, getProfile, getProvider, registerProfile, registerProvider, resolveTurn, runTurn, } from '../../kernel/default-scope.js';
 import { startCallUsage } from '../../kernel/engine/runner/usage.js';
 import { startCallTrace } from '../../kernel/engine/turn-trace.js';
 import { pickSystemRole } from '../../kernel/registry/system-role.js';
@@ -25,8 +28,8 @@ function registerBenchProfile() {
         },
         models: {
             'bench-model': {
-                protocol: 'openAi',
-                provider: 'openrouter',
+                protocol: 'bench',
+                provider: 'bench',
                 apiId: 'bench-model',
                 efforts: { normal: 'none' },
                 summaries: false,
@@ -38,11 +41,6 @@ function registerBenchProfile() {
         defaultModel: 'bench-model',
         tools: { allow: [] },
         inputs: { text: true },
-        guardrails: {
-            canary: true,
-            sanitizeInput: true,
-            redactSensitive: true,
-        },
     });
 }
 function generateChunks(count) {
@@ -66,6 +64,29 @@ function createMockProvider(chunks) {
         },
     };
 }
+/** A protocol and provider that answer every turn with `chunks`, so the bench times the kernel alone. */
+function registerBenchProvider(chunks) {
+    if (getProvider('bench'))
+        return;
+    const protocol = defineProtocol({
+        id: 'bench',
+        name: 'Bench',
+        description: 'Streams the bench chunks without a network.',
+        endpoints: { text: '/bench' },
+        options: z.strictObject({}),
+        create: () => ({
+            async *complete() {
+                yield* chunks;
+            },
+        }),
+    });
+    registerProvider(defineProvider({
+        id: 'bench',
+        name: 'Bench',
+        description: 'Answers the bench in process.',
+        serves: () => [{ protocol, baseUrl: 'https://bench.invalid' }],
+    }));
+}
 function buildBenchRequest() {
     return {
         profile: BENCH_PROFILE_ID,
@@ -117,7 +138,7 @@ async function measureRawProvider(provider) {
         textEvents,
     };
 }
-async function measureKernelPipeline(provider) {
+async function measureKernelPipeline(_provider) {
     const req = buildBenchRequest();
     const start = performance.now();
     let firstEvent = 0;
@@ -125,7 +146,7 @@ async function measureKernelPipeline(provider) {
     let textEvents = 0;
     let gotFirst = false;
     let gotFirstText = false;
-    for await (const event of runTurn(req, provider)) {
+    for await (const event of runTurn(req)) {
         if (!gotFirst) {
             firstEvent = performance.now() - start;
             gotFirst = true;
@@ -168,7 +189,7 @@ function aggregate(results) {
         },
         tokensPerSec: {
             median: percentile(tps, 50),
-            p95: percentile(tps, 5), // lower is worse for throughput
+            p95: percentile(tps, 5), // why: lower is worse for throughput
             mean: mean(tps),
         },
         totalMs: {
@@ -321,7 +342,7 @@ async function microAsyncGenOverhead(chunks, iterations) {
     const start = performance.now();
     for (let i = 0; i < iterations; i++) {
         for await (const _e of layer4(chunks)) {
-            // consume
+            // why: only the time to read the stream matters, so each event is dropped.
         }
     }
     const elapsed = performance.now() - start;
@@ -363,7 +384,7 @@ async function microTraceRecord(chunks, iterations) {
             req,
             usage: startCallUsage('', { history: [], input: req.input }),
             binding: undefined,
-            transport: 'interactions',
+            transport: 'turn',
             step: 0,
             attempt: 0,
         });
@@ -433,6 +454,7 @@ export async function benchCommand(options = {}) {
     console.log(`   ${chunkCount} chunks × ${iterations} iterations (${warmup} warmup)\n`);
     const chunks = generateChunks(chunkCount);
     const provider = createMockProvider(chunks);
+    registerBenchProvider(chunks);
     registerBenchProfile();
     for (let i = 0; i < warmup; i++) {
         await measureRawProvider(provider);

package/esm/src/cli/commands/detect-compile.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `agents detect-compile`: reads a module's exported `guardrails.detect` setting and writes the
+ * table each detector's own patterns compile to.
+ *
+ * @module
+ */
+interface DetectCompileOptions {
+    /** Path or URL of the module exporting the detect setting. */
+    module: string;
+    /** The export holding it. Default `detect`. */
+    exportName?: string;
+    /** Where the compiled module is written. */
+    out: string;
+}
+/** Compiles each detector's patterns and writes the module; returns the detectors it compiled. */
+declare function detectCompileCommand({ module, exportName, out, }: DetectCompileOptions): Promise<string[]>;
+export { detectCompileCommand };

package/esm/src/cli/commands/detect-compile.js

@@ -0,0 +1,22 @@
+/**
+ * `agents detect-compile`: reads a module's exported `guardrails.detect` setting and writes the
+ * table each detector's own patterns compile to.
+ *
+ * @module
+ */
+import { writeFile } from 'node:fs/promises';
+import { cwd } from 'node:process';
+/** Compiles each detector's patterns and writes the module; returns the detectors it compiled. */
+async function detectCompileCommand({ module, exportName = 'detect', out, }) {
+    const loaded = await import(new URL(module, `file://${cwd()}/`).href);
+    const detect = loaded[exportName];
+    if (typeof detect !== 'object' || detect === null) {
+        throw new Error(`${module} has no detect setting exported as ${exportName}`);
+    }
+    // why: Loaded here so no other command loads the regex engine.
+    const { compiledDetectModule, compileDetectTables } = await import('../../guardrails/egress-compiler.js');
+    const tables = compileDetectTables(detect);
+    await writeFile(out, compiledDetectModule(tables));
+    return Object.keys(tables);
+}
+export { detectCompileCommand };

package/esm/src/cli/commands/eval.d.ts

@@ -1,6 +1,6 @@
 import type { EvalMediaResolver } from '../../evals/types.js';
 import type { RunDecisionOptions } from '../../kernel/engine/decision.js';
-import type { ModelProvider } from '../../kernel/types.js';
+import type { ProviderHostOptions } from '../../kernel/protocols/runtime.js';
 export interface EvalOptions {
     /** Path of the suite module (`export default` an `EvalSuite`). */
     suite: string;
@@ -22,9 +22,9 @@ export interface EvalOptions {
 /** What the host hands the eval command: providers and keys it never creates or reads itself. */
 export interface EvalHost {
     /** The provider for the profile under test. */
-    provider?: ModelProvider;
+    provider?: ProviderHostOptions;
     /** The provider for text judge profiles. */
-    judgeProvider?: ModelProvider;
+    judgeProvider?: ProviderHostOptions;
     /** The key for decision judge profiles (Jev). */
     judgeDecision?: Omit<RunDecisionOptions, 'sink'>;
     /** Where a judge finds media a trace names only by hash. */

package/esm/src/cli/commands/fuzz-canary.js

@@ -1,25 +1,32 @@
-// A bypass is judged from the attack's own encoded canary, not from the detector under test.
+// why: A bypass is judged from the attack's own encoded canary, not from the detector under test.
 import { bindCanary, isStreamedCanaryEvent, mintCanary, scanTextForCanaryLeak, } from '../../guardrails/canary.js';
 import { buildCanaryEgressAttacks, FIXED_CANARY, FUZZ_SYSTEM, } from '../../guardrails/corpus/canary-egress-attacks.js';
+import { scopeOf } from '../../guardrails/detect-at.js';
+import { readReply } from '../../guardrails/detect-reply.js';
 import { givenUrlSets } from '../../guardrails/egress-urls.js';
 import { createLiveOutboundGateSession, finalizeLiveOutboundTurn, processLiveOutboundBatch, } from '../../guardrails/live-outbound-gate.js';
+import { resolveGuardrailPolicy } from '../../guardrails/policy.js';
 import { scanTextOf } from '../../guardrails/serialize.js';
-import { clearProfiles, getProfile, registerProfile, resolveTurn, } from '../../kernel/default-scope.js';
-import { yieldProviderEvents, } from '../../kernel/engine/runner/stream.js';
+import { clearProfiles, getProfile, getProvider, registerProfile, registerProvider, resolveTurn, } from '../../kernel/default-scope.js';
+import { isWithheldOnBlock, yieldProviderEvents, } from '../../kernel/engine/runner/stream.js';
 import { providerCompleteRequest } from '../../kernel/registry/provider-request.js';
 import { defaultKernelScope } from '../../kernel/scope.js';
+import { shownToolArguments } from '../../kernel/tools/execute.js';
+import { openRouterProvider } from '../../providers/openrouter/provider.js';
 const FUZZ_PROFILE_ID = '__fuzz_canary__';
 function registerFuzzCanaryProfile() {
+    if (!getProvider('openrouter'))
+        registerProvider(openRouterProvider);
     registerProfile({
         type: 'text',
         id: FUZZ_PROFILE_ID,
         identity: { handle: 'fuzz-canary', system: 'Canary fuzz profile.' },
         models: {
             'fuzz-model': {
-                protocol: 'openAi',
+                protocol: 'openRouter',
                 provider: 'openrouter',
                 apiId: 'fuzz-model',
-                key: 'fuzz',
+                keySlot: 'fuzz',
                 efforts: { normal: 'none' },
                 summaries: false,
                 maxOutputTokens: 4096,
@@ -30,7 +37,6 @@ function registerFuzzCanaryProfile() {
         defaultModel: 'fuzz-model',
         tools: { allow: [] },
         inputs: { text: true },
-        guardrails: { canary: true },
     });
 }
 function resolveFuzzGeneration(canary) {
@@ -40,10 +46,42 @@ function resolveFuzzGeneration(canary) {
     });
     return { ...generation, canary };
 }
-async function collectEvents(gen) {
+/** The model's tool call as a host is shown it: its arguments as the tool gets them. */
+function callShown(event, canary) {
+    if (event.type !== 'tool' || event.tool.phase !== undefined)
+        return event;
+    const shown = shownToolArguments({
+        tools: defaultKernelScope.tools,
+        profile: getProfile(FUZZ_PROFILE_ID),
+        name: event.tool.name,
+        input: event.tool.arguments,
+        scope: { canary, privateSystem: [bindCanary(FUZZ_SYSTEM, canary)] },
+    });
+    return { ...event, tool: { ...event.tool, arguments: shown } };
+}
+/** The structured output as the read of the whole reply leaves it; none when that read stops it. */
+function structuredShown(event, canary) {
+    if (event.type !== 'structured')
+        return [event];
+    const policy = resolveGuardrailPolicy(getProfile(FUZZ_PROFILE_ID).guardrails);
+    const read = readReply({ text: '', structured: event.structured }, policy.detect, {
+        boundary: 'reply',
+        scope: scopeOf(policy, { canary, privateSystem: [bindCanary(FUZZ_SYSTEM, canary)] }),
+    });
+    return read.blocked ? [] : [{ ...event, structured: read.payload.structured }];
+}
+/**
+ * A call's events as the step runner passes them on. Once the stream's gate
+ * withholds the reply, its text and media are kept for the verdict on the
+ * whole reply and never reach the client. A tool call and a structured output
+ * are read at their own boundaries.
+ */
+async function reachingClient(control, canary, gen) {
     const out = [];
     for await (const event of gen) {
-        out.push(event);
+        if (control.withholdVisible && isWithheldOnBlock(event))
+            continue;
+        out.push(...structuredShown(callShown(event, canary), canary));
     }
     return out;
 }
@@ -86,24 +124,25 @@ async function* replay(turn) {
 }
 async function runStreamChannel(attack, generation, canary) {
     const events = [];
-    // Every provider call of one turn shares its canary: each attack turn is a step.
+    // why: Every provider call of one turn shares its canary: each attack turn is a step.
     const control = { withholdVisible: false };
     for (const turn of attack.turns) {
-        const streamed = await collectEvents(yieldProviderEvents({
+        const streamed = await reachingClient(control, canary, yieldProviderEvents({
             profile: getProfile(FUZZ_PROFILE_ID),
             generation,
             request: providerCompleteRequest(defaultKernelScope.tools, generation, bindCanary(FUZZ_SYSTEM, canary)),
             privateSystem: [bindCanary(FUZZ_SYSTEM, canary)],
             provider: { complete: () => replay(turn) },
-            // The fuzz reads what reaches the client, not the trace.
+            tools: defaultKernelScope.tools,
+            // why: The fuzz reads what reaches the client, not the trace.
             call: { tap: () => { }, observe: () => { } },
             control,
             givenUrls: givenUrlSets(),
         }));
-        // The runner reads the call's `done`; the client never receives it.
-        const turnEvents = streamed.flatMap((event) => (event.type === 'done' ? [] : [event]));
+        // why: The runner reads the call's `done`; the client never receives it.
+        const turnEvents = streamed.flatMap((event) => event.type === 'done' || event.type === 'reasoning' ? [] : [event]);
         events.push(...turnEvents);
-        if (turnEvents.some((event) => event.type === 'error')) {
+        if (control.withholdVisible || turnEvents.some((event) => event.type === 'error')) {
             return channelResult(attack, 'runTurn.stream', true, events);
         }
     }
@@ -111,13 +150,13 @@ async function runStreamChannel(attack, generation, canary) {
 }
 /** One Live session; each turn is a cycle the provider finishes before the next. */
 async function runLiveBatchChannel(attack, canary) {
-    const session = createLiveOutboundGateSession(getProfile(FUZZ_PROFILE_ID), canary, [
+    const session = await createLiveOutboundGateSession(getProfile(FUZZ_PROFILE_ID), canary, [
         bindCanary(FUZZ_SYSTEM, canary),
     ]);
     const events = [];
     for (const turn of attack.turns) {
         for (const result of [
-            await processLiveOutboundBatch(session, turn),
+            await processLiveOutboundBatch(session, turn.map((event) => callShown(event, canary))),
             await finalizeLiveOutboundTurn(session),
         ]) {
             if (result.action === 'withhold') {

package/esm/src/cli/commands/profile.js

@@ -14,7 +14,7 @@ function formatProfileInputs(p) {
     }
     if (spec.text !== false)
         inputs.push('text');
-    if (p.type !== 'image' && p.inputs?.voice)
+    if (p.type !== 'image' && p.type !== 'embedding' && p.inputs?.voice)
         inputs.push('voice');
     if (spec.attachments) {
         inputs.push(`attachments [${spec.attachments.accept?.join(', ')}]`);
@@ -37,19 +37,19 @@ function printProfileCard(p) {
         console.log(`   - Model:      ${Object.keys(p.models).join(', ')}`);
         console.log(`   - Inputs:     JSON state`);
         console.log(`   - Contract:   ${p.decision.contract}`);
-        console.log(`   - Key Slot: ${p.key ?? '(unset)'}`);
         console.log('-'.repeat(70));
         return;
     }
     const models = Object.keys(p.models).join(', ') || 'default';
-    const structured = p.type === 'live' || p.type === 'speech' ? undefined : p.outputs?.structured;
+    const structured = p.type === 'live' || p.type === 'speech' || p.type === 'embedding'
+        ? undefined
+        : p.outputs?.structured;
     const structuredLabel = typeof structured === 'string' ? structured : structured ? 'custom' : 'none';
     console.log(` • Profile: ${p.id.padEnd(16)} (handle: ${p.identity.handle}) [${p.type}]`);
     console.log(`   - Models:     ${models}`);
     console.log(`   - Inputs:     ${formatProfileInputs(p)}`);
     console.log(`   - Tools:      ${tools}`);
     console.log(`   - Structured: ${structuredLabel}`);
-    console.log(`   - Key Slot: ${p.key ?? '(unset)'}`);
     console.log('-'.repeat(70));
 }
 export function listProfilesCommand() {

package/esm/src/cli/commands/run.d.ts

@@ -1,11 +1,11 @@
-import type { ModelProvider } from '../../kernel/types.js';
+import type { ProviderHostOptions } from '../../kernel/protocols/runtime.js';
 export interface RunOptions {
     profile: string;
     prompt?: string;
     mode?: string;
     search?: boolean;
     map?: boolean;
-    provider?: ModelProvider;
+    provider?: ProviderHostOptions;
     verbose?: boolean;
     trace?: boolean;
     traceDir?: string;

package/esm/src/cli/commands/run.js

@@ -5,7 +5,7 @@ export async function runCommand(options) {
     requireModelProfile(getProfile(options.profile), 'agents run');
     const provider = options.provider;
     if (!provider) {
-        console.error('\n\x1b[31mExecution Failed\x1b[0m: Theorem CLI does not create providers or read keys. Run turns from a host app with an explicit ModelProvider.\n');
+        console.error('\n\x1b[31mExecution Failed\x1b[0m: Theorem CLI does not create providers or read keys. Run turns from a host app with an explicit ProviderHostOptions.\n');
         return;
     }
     const prompt = options.prompt || 'Hello! Please introduce your capabilities.';

package/esm/src/cli/commands/test.d.ts

@@ -1,4 +1,5 @@
-import type { ModelProvider, TurnRequest, TurnTokens } from '../../kernel/types.js';
+import type { ProviderHostOptions } from '../../kernel/protocols/runtime.js';
+import type { TurnRequest, TurnTokens } from '../../kernel/types.js';
 import { type MatrixOptions } from '../matrix/synthesizer.js';
 export interface TestRunResult {
     passed: boolean;
@@ -13,11 +14,11 @@ interface CliTestOptions {
     trace?: boolean;
     traceDir?: string;
 }
-export declare function executeSingleTest(req: TurnRequest, testName: string, provider?: ModelProvider, cliOptions?: CliTestOptions): Promise<TestRunResult>;
+export declare function executeSingleTest(req: TurnRequest, testName: string, provider?: ProviderHostOptions, cliOptions?: CliTestOptions): Promise<TestRunResult>;
 export declare function testProfileCommand(profileId?: string, options?: MatrixOptions & {
     all?: boolean;
     matrix?: boolean;
-    provider?: ModelProvider;
+    provider?: ProviderHostOptions;
     verbose?: boolean;
     trace?: boolean;
     traceDir?: string;

package/esm/src/cli/commands/test.js

@@ -46,7 +46,7 @@ export async function executeSingleTest(req, testName, provider, cliOptions = {}
     };
     try {
         if (!provider) {
-            throw new Error('Theorem CLI does not create providers or read keys. Pass an explicit ModelProvider from the host app.');
+            throw new Error('Theorem CLI does not create providers or read keys. Pass an explicit ProviderHostOptions from the host app.');
         }
         const traceCapture = cliOptions.trace ? createCliTraceCapture(cliOptions.traceDir) : undefined;
         for await (const event of runTurn(req, provider, traceCapture?.sink)) {
@@ -74,7 +74,7 @@ export async function executeSingleTest(req, testName, provider, cliOptions = {}
 }
 function resolveTargetProfiles(profileId, all) {
     if (all) {
-        // Host and decision profiles run no model turn, so they have no turn matrix.
+        // why: Host and decision profiles run no model turn, so they have no turn matrix.
         return listProfiles().filter(isModelProfile);
     }
     if (profileId) {